Expected App Sandbox behavior when preserving quarantine metadata during copies

I'm developing a sandboxed macOS file manager and want to preserve the supported quarantine/provenance metadata of copied files without disabling App Sandbox or weakening security.

Environment

• macOS 26.6.2 (25G83), Apple silicon, local APFS
• Xcode 26.6 (17F113)
• Apple Development signing and Hardened Runtime
• Sandboxed variant: App Sandbox, user-selected read/write, and app-scope bookmark entitlements
• Comparison variant: the same optimized Foundation-only diagnostic without App Sandbox
• This is not yet a notarized distribution-build comparison

Observed behavior

I used a naturally quarantined JPEG whose quarantine record identifies another application as the agent. I copied it to fresh destinations twice with each API:

1. fclonefileat with CLONE_ACL | CLONE_NOFOLLOW_ANY | CLONE_RESOLVE_BENEATH
2. copyfile with COPYFILE_CLONE | COPYFILE_ACL, observing COPYFILE_STATE_WAS_CLONED
3. FileManager.copyItem(at:to:)

In the sandboxed variant, all six copies succeed and preserve file length and SHA-256, but the output quarantine record changes:

• flags change from 0283 to 0082
• the agent changes from the source agent to the copying app
• the nonempty event field becomes empty
• the timestamp changes
• the public quarantine dictionary no longer includes the source event identifier and adds LSQuarantineTypeSandboxed

In the otherwise-matched non-sandbox variant, all six copies preserve the observed raw quarantine record and public quarantine dictionary. Finder Copy/Paste also preserves both. copyfile reports COPYFILE_STATE_WAS_CLONED = true in both variants.

The source file remains unchanged. Other compared metadata (non-quarantine extended attributes, mode, flags, creation/modification times, owner/group, and ACL) matches in these tests.

Questions

1. Is this quarantine transformation expected for an App Sandbox process, or should it be reported as a bug?
2. What documented quarantine/provenance preservation behavior may a sandboxed file manager rely on?
3. Is there a supported public API or operation that preserves the relevant provenance without disabling App Sandbox or removing quarantine?
4. If exact raw com.apple.quarantine equality is intentionally not guaranteed, which public properties or behaviors should a regression test verify?
5. Is round-tripping URLResourceKey.quarantinePropertiesKey supported here, and which fields is it expected to preserve or omit?

I have not attempted to repair or rewrite quarantine metadata. A pathname-based repair would also require a separate file-identity and race-safety review; I'm asking about supported API semantics, not an internal implementation detail or security bypass.

A dependency-free Xcode reproducer is available. It contains synthetic comparison and redaction checks, with no user fixture, saved security-scoped grant, private log, or binary. The newer GUI/NSOpenPanel packaging has not yet been validated in a signed runtime, so the observations above are from the original direct-executable diagnostic.