The Windows file-deny ACL stamp now accepts a --holder-pid flag that associates the stamp with a specific process ID. When the holder process exits, the ACL can be cleaned up rather than persisting for the entire session group.
Details
gta()(ACL stamp) andpoo()(ACL restore) both pass--holder-pid <pid>to thesrt-win aclhelper.- Changing the Windows sandbox group still requires
reset()andre-initialize(). - If the file-deny set changes mid-session, a warning is logged noting that the change cannot be applied without a reset.
Evidence
New flag (search for "--holder-pid")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.