I wrote only yesterday about how troubling I find the opaqueness of Apple’s App Sandbox.
Well, don’t I feel ignorant today.
% man asctl NAME asctl -- App Sandbox Control Tool SYNOPSIS asctl [-p] [-l] command [arguments] DESCRIPTION asctl is a facility for manipulating the filesystem container for an applications using App Sandbox. A container is a per-application filesytem hierarchy rooted in ~/Library/Containers.
This tool appears to offer extensive insight into the sandbox’s understanding of containers. I wish I had discovered it earlier!