Codex Windows desktop app still crashes on latest Store build due to WindowsApps ACL sandbox failure (SetNamedSecurityInfoW failed: 5) #17901

Get-AppxPackage OpenAI.Codex | Select Name, Version, InstallLocation

Result:

Name         Version       InstallLocation
----         -------       ---------------
OpenAI.Codex 26.409.7971.0 C:\Program Files\WindowsApps\OpenAI.Codex_26.409.7971.0_x64__2p2nqsd0c76g0

### What subscription do you have?

ChatGPT subscription with Codex access

### What platform is your computer?

Windows x64

### What issue are you seeing?

The Windows desktop app crashes / fails to initialize, while Codex CLI in WSL works normally.

This does not look like a WSL configuration issue on my machine. My WSL setup is valid and running:

wsl -l -v

Result:

  NAME      STATE           VERSION
* Ubuntu    Running         2

The key evidence is in the sandbox log. Codex tries to grant a read ACE to its packaged resources under C:\Program Files\WindowsApps\... and fails with Windows error 5:

granting read ACE to C:\Program Files\WindowsApps\OpenAI.Codex_26.309.3504.0_x64__2p2nqsd0c76g0\app\resources for sandbox users
grant read ACE failed on C:\Program Files\WindowsApps\OpenAI.Codex_26.309.3504.0_x64__2p2nqsd0c76g0\app\resources for sandbox_group: SetNamedSecurityInfoW failed: 5
read ACL run completed with errors
setup error: read ACL run had errors

This strongly suggests the desktop app is failing in the Windows Store / WindowsApps sandbox ACL path.

### What steps can reproduce the bug?

1. Install Codex from Microsoft Store.
2. Launch the Windows desktop app.
3. The app fails during startup / initialization.
4. Inspect:

C:\Users\<USER>\.codex\.sandbox\sandbox.log

5. Observe repeated ACL failures on the WindowsApps packaged resources path with:

SetNamedSecurityInfoW failed: 5

### What is the expected behavior?

The Windows desktop app should start normally and should not try to mutate ACLs on its packaged resources path in a way that causes startup failure.

### Additional information

Additional notes:

- Codex CLI in WSL works normally on the same machine.
- WSL is installed correctly and Ubuntu is the default running WSL2 distro.
- C:\Users\<USER>\.codex\codex-global-state.json does not exist on this machine, which may indicate the app dies before normal initialization completes.
- The sandbox log exists and consistently shows the ACL failure.
- The issue appears related to the same WindowsApps ACL family of bugs reported in:
    - #15179
    - #16502
    - #17612
    - #13965

Relevant local log excerpt:

[2026-03-12T06:37:59.007393200+00:00] read-acl-only mode: applying read ACLs
[2026-03-12T06:37:59.011019200+00:00] granting read ACE to C:\Program Files\WindowsApps\OpenAI.Codex_26.309.3504.0_x64__2p2nqsd0c76g0\app\resources for sandbox users
[2026-03-12T06:37:59.011313700+00:00] grant read ACE failed on C:\Program Files\WindowsApps\OpenAI.Codex_26.309.3504.0_x64__2p2nqsd0c76g0\app\resources for sandbox_group: SetNamedSecurityInfoW failed: 5
[2026-03-12T06:37:59.041330100+00:00] read ACL run completed with errors: ["grant read ACE failed on C:\\Program Files\\WindowsApps\\OpenAI.Codex_26.309.3504.0_x64__2p2nqsd0c76g0\\app\\resources for sandbox_group: SetNamedSecurityInfoW failed: 5"]
[2026-03-12T06:37:59.041409100+00:00] setup error: read ACL run had errors

If needed, I can provide a larger sanitized sandbox.log excerpt.