TUI: 'Failed to save approvals reviewer: config/batchWrite failed' on every Full Access startup despite fully persisted config (0.147.0, Windows)

Summary

On codex-cli 0.147.0 on Windows 11 (npm install), every startup in Full Access shows this error immediately after Permissions updated to Full Access:

Failed to save approvals reviewer: config/batchWrite failed

The session still clearly starts in Full Access / YOLO mode, so the profile config is loading. This looks like a redundant startup persistence attempt that fails noisily even though the setting is already persisted.

Forensics

• ~\.codex\config.toml already contains approvals_reviewer = "user", approval_policy = "never", and sandbox_mode = "danger-full-access".
• ~\.codex\automation.config.toml contains the same persisted values.
• ACLs were checked and normalized: owner has FullControl, there are no Deny ACEs, and directory inheritance is clean.
• Global state JSON is valid.
• There are no leftover .tmp or .lock files.
• The error persists across startups.

Related issues:

• #26077: batchWrite hides the underlying write error.
• #36647: the Full Access path appears to write approvals_reviewer unconditionally.

Request

Please make the startup write conditional, skipping it when approvals_reviewer is already persisted, and/or surface the underlying write error instead of only reporting config/batchWrite failed.

No secrets are included here; paths are limited to ~\.codex.

Start at the Full Access startup path and inspect the config/batchWrite handling for approvals_reviewer. Compare the persisted config values with the unconditional write described in related issue #36647, and use #26077 to trace the hidden write failure. Done means the redundant write is skipped when already persisted and/or the underlying error is surfaced.