Fix GUI operation script scope

docs/STATUS.md

@@ -1,4 +1,4 @@
-# Delivery status — 2026-09-23
+# Delivery status — 2026-09-24
 
 The update architecture and implementation pass was completed on 2026-09-20. The product is named ms-private. Local OS inventory, offline bundle verification, the graphical and terminal wizards, app/debloat flows, Microsoft app-account purge, network enforcement and capture, reversible privacy-service shutdown, Recall, exact sensors, privacy-artifact cleanup, lock handling, security status and AME packaging are implemented or prepared as described below. No real package download, app removal, account purge, policy write, service mutation, firewall change, device disable, cleanup or Recall deletion was performed.
 
@@ -23,11 +23,11 @@ The supplied script was parsed without execution. Three isolated in-memory probe
 - Exact selected PnP sensor disable/restore; allowlisted Temp, crash-report, Recent/Jump List, thumbnail, PowerShell-history and expired-report cleanup; scheduling; and SessionLock clipboard/VeraCrypt handling.
 - Read-only BitLocker/device-encryption, Defender/cloud posture, firewall, Secure Boot, TPM, VBS/Credential Guard, LSA, UAC, SMB/SMB1, remote-access and protected-service status without recovery keys, account names, Defender exclusions or secrets.
 - AME wrapper source and builder that launch the same graphical wizard without disabling Defender or Windows Update.
-- Self-contained x64 `ms-private-0.0.3.exe` launcher with a `requireAdministrator` manifest, embedded hash-manifested runtime, exact-file verification, tamper repair and protected Program Files installation.
+- Self-contained x64 `ms-private-0.0.4.exe` launcher with a `requireAdministrator` manifest, embedded hash-manifested runtime, exact-file verification, tamper repair and protected Program Files installation.
 
 ## Verification performed
 
-- 115 tests pass in PowerShell 7 and Windows PowerShell 5.1: 25 policy/transaction, 29 app/menu, 19 offline-bundle and 42 feature/package/security/service/account/preset/operation-runner checks. The runner now writes a real report path during regression testing.
+- 117 tests pass in PowerShell 7 and Windows PowerShell 5.1: 25 policy/transaction, 29 app/menu, 19 offline-bundle and 44 feature/package/security/service/account/preset/operation-runner checks. The runner writes a real report path during regression testing, and the GUI child-script invoker is exercised across the same nested module boundary used by Apply.
 - Ten native launcher tests pass for archive and installed-manifest integrity, installation validation, modified/extra-file repair, path traversal, bad hashes and undeclared entries. Managed PE inspection verifies AMD64 GUI format, the UAC manifest, version, checksum and signature state.
 - Shared journal/report create, flush, atomic-replace and parse tests passed using temporary workspace files.
 - All PowerShell source files parsed successfully during verification.