Static UNBLOCK_WRITTEN 

static UNBLOCK_WRITTEN: AtomicBool

Set once this run actually wrote the runtime drop-in (not merely attempted it), so the exit path knows a sandbox restore is owed. The webui thread stores it; main reads it after the run loop ends. SeqCst orders the drop-in write before the main-thread restore decision regardless of which core each ran on.