v5.8: service-folder repair — fix the 5.6 file-wedging ACL bug + record the real user through elevation

Root cause found while REPRODUCING the suspected wrong-owner bug in a gate test (the repro
failed in a way the theory couldn't explain, and the empirical icacls run showed why): the
5.6 hardening's /T sweep applied (OI)(CI) grants to FILES, where such ACEs are inherit-only
— they grant the file itself NOTHING. Every file existing at harden time was left with
/inheritance:r + inherit-only ACEs = an effectively EMPTY ACL: unreadable/unwritable by the
user, admins, even SYSTEM. That is the Jonathan report (2026-08-06) end to end: profile save
"access denied" even elevated, logs unreadable in Notepad, his own icacls /T "fix" adding
useless inherit-only ACEs (137 processed, nothing healed), new files fine (echo test), and
the service failing to start (SYSTEM can't read a wedged profile).

The fix, in layers:
- BuildServiceDirAclArgs no longer sweeps /T: the lockdown applies to the FOLDER only.
  Existing children are rebuilt by a new /reset pass (BuildResetChildrenArgs) as purely-
  inherited from the hardened folder ACL — real file access again, stale/planted explicit
  ACEs removed, and it HEALS files wedged by 5.6. Regression-pinned in the gate (the folder
  args must never contain /T again).
- Second bug fixed in the same area: the elevated helper recorded ITS OWN token as the
  "installing user" — under over-the-shoulder elevation that's the separate admin account
  whose password was typed, not the person at the keyboard. Elevated verbs now carry
  --as-user <SID> from the non-elevated app (validated: real user SIDs only — service
  identities and builtin groups rejected) and install/repair re-record it, so a stale wrong
  owner can't persist through reinstalls or self-update re-hardens.
- Self-heal everywhere: new --repair-service-access verb (re-record owner + re-harden);
  "Repair service folder access" in the Service menu; a startup write-probe that offers the
  repair when the folder is broken (settled startup sequence, ForegroundDialog, skipped on
  --silent); the profile-save UnauthorizedAccessException catch offers it at the exact wall
  users hit; and the service self-update's existing re-harden now runs the FIXED sequence,
  so wedged fleet machines heal automatically when 5.8 rolls out — no user action needed.
- Logs readable again: Users get read-only on service\logs (inheritable, no /T needed —
  propagation covers existing files) and on service-events.log. The profile stays locked
  (it holds the obfuscated password). GrantUsersWriteToBin deleted — the folder ACL's
  inherited user-Modify covers bin, and the reset wiped its explicit grants anyway.
- DoStart/DoStop no longer swallow the reason: exception recorded to service events, and
  distinct exit codes (6 timeout, 7 SCM refused, 9 repair-didn't-stick) let the dialog say
  what happened instead of the bare "(code 1)" that cost this diagnosis a day.

Gate: new "Service folder repair" step reproduces BOTH bugs for real in a scratch folder —
wedges a file with the exact 5.6 spec (proves reads genuinely die), locks the folder to the
wrong owner, asserts the app's probe reports broken, runs the exact shipped repair sequence
(ApplyServiceDirAcl), and asserts folder writable + wedged file readable again. Plus a
SID pass-through step (validation, parse, arg-building, logs-grant shape). 72/72 + relay 7.

Docs: Service-menu repair item + troubleshooting entry in readme; About + RELEASE_NOTES
rewritten for 5.8; MANUAL regenerated. Version 5.8. NOT released — awaiting Ed's test.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

MANUAL.md

@@ -1363,6 +1363,7 @@ Everything lives in the **Service** menu on the menu bar:
   2. **Install service** — registers it with Windows so it starts automatically at every boot. Windows asks for administrator permission (one prompt). Do this once. Straight after installing, RemSound asks whether you'd like to **start it now** (otherwise it waits until the next reboot). (When you first install RemSound on a PC, the app installer also offers to set the service up — and start it — for you, so you may have done this already.)
   3. **Start service** / **Stop service** — run or halt it now without waiting for a reboot.
   4. **Uninstall service** — removes it entirely.
+  5. **Repair service folder access** — fixes the permissions on the service's settings folder so your account can save the service profile and read the service logs again. You should never need this in normal use, but if saving the service profile ever fails with an “access denied” message, or the service's log files won't open, run this once (Windows asks for administrator permission) and everything is put right. RemSound also checks the folder itself every time it starts and offers this same repair automatically if it finds a problem.
 
 
 
@@ -1456,6 +1457,10 @@ RemSound notices when the computer has just woken up, waits a moment for any USB
 
 If a sound card you're playing received audio through is unplugged and then plugged back in, RemSound now re-opens it on its own and the sound resumes — you don't have to re-tick it in the output list. This works when the card comes back as the same Windows device, which is the usual case when you plug it into the same socket. If you move it to a different USB socket and Windows treats it as a brand-new device, just tick it again in the output list.
 
+### Saving the service profile says “access denied”, or the service's log files won't open
+
+Your account has lost its permissions on the service's settings folder — this could happen after some older-version reinstalls, and it also blocks the service itself from starting properly. The fix is one menu item: **Service → Repair service folder access**. Windows asks for administrator permission once, the folder is put right, and saving and log-reading work again. RemSound also spots this state by itself when it starts and offers the same repair automatically, and the service applies the fix on its own when it installs a RemSound update — so on an up-to-date machine you should never actually meet this problem.
+
 ### UPnP says “no router found” even though my router supports it
 
 The most common reasons: