Follow-up to the salvaged #66803 (@HexLab98):
- Two-strike boot marker: a single mid-boot abort (task-manager kill,
power loss) no longer disables the sandbox — only a second consecutive
abort, or a signature-confirmed GPU/renderer STATUS_BREAKPOINT death,
engages --no-sandbox.
- Version-scoped stickiness: the fallback marker records the app version
and re-probes the sandbox once after an update (new Electron or
installer ACL repair may have fixed the host) instead of degrading
forever. A failed re-probe returns straight to fallback.
- Launch-time icacls repair now runs only when the marker shows a prior
aborted boot (icacls /T recurses the whole install tree — healthy
launches skip it; the installer grants the ACE at install time), and
targets the install dir only. The userData grant is dropped: granting
S-1-15-2-2 RX on userData would expose Hermes sessions/config to every
AppContainer app on the machine.
- Renderer crash-loop recovery (same class as #56726, credit @Sahil-SS9
in PR #57414): a Windows renderer crash loop bearing the breakpoint
exit code gets the same one-shot --no-sandbox relaunch instead of a
dead window; unrelated crash loops keep the sandbox.
- Manual --no-sandbox launches are honored but never made sticky.
Tests: 15/15 windows-sandbox-fallback vitest; full desktop electron
suite 432 passed / 1 skipped.
