The desktop archive probe called the script with only -Path, which the new
interface refuses, so it now passes -AllowRoot and -Out. The skill no longer
suggests running the repair confined: the confined token cannot write a DACL, so
that run would report the sandbox's own restriction as a missing right.
The subtree walk bounds its first enumeration too, and a directory whose stat
fails counts as unreadable instead of vanishing. The removal decision says
inherited copies follow their repaired source, and the pre-flight comment names
grant targets as well. Add the third behavior test the rewrite dropped: an
inherit-only FullControl ACE survives a grant.
Huanqi Cao
fd5e89feb7