[Windows] Primary runtime updater re-downloads 501.8 MB hourly after non-retryable EPERM activation failure

What version of the Codex App are you using?

• Current Windows Store package: OpenAI.Codex 26.818.5229.0 (x64)
• The repeated failures were logged by package build 26.814.5167.0
• Codex CLI: 0.147.0
• Primary runtime bundle requested: 26.819.11345

What platform is your computer?

Windows 11 Pro x64, version 10.0.26200 (build 26200).

What issue are you seeing?

The Codex desktop primary-runtime updater downloaded the same 501,849,919-byte archive from persistent.oaistatic.com approximately once per hour after every activation failure.

The download URL was:

https://persistent.oaistatic.com/codex-primary-runtime/26.819.11345/codex-primary-runtime-win32-x64-26.819.11345.tar.gz

Local log analysis found:

• First attempt: 2026-08-19 08:37:52 local time
• Successful completion: 2026-08-23 11:48:03 local time
• 101 scheduled attempts in roughly 4 days
• 96 complete archive downloads followed by activation failure
• 4 network-stage failures
• 1 eventual success
• At least 48.678 GB of confirmed traffic from complete archive downloads alone

The repeated error was:

[primary-runtime-installer] primary_runtime_bundle_install_outcome
errorCategory=permission_denied
errorCode=EPERM
failureStage=activate_runtime
outcome=failed
retryable=false
trigger=scheduled_update
errorMessage="EPERM: operation not permitted, rename '%USERPROFILE%\.cache\codex-runtimes\codex-primary-runtime' -> '...previous-<uuid>'"

The current runtime directory contained executables being used by Codex. Windows therefore refused the directory rename. That part is expected Windows file-lock behavior. The bandwidth-consumption problem is that Codex deleted the staging directory (including the fully downloaded, verified archive) after the non-retryable activation failure, then the hourly scheduler downloaded the identical 501.8 MB archive again.

This happened silently, with no user notification or visible bandwidth warning.

What steps can reproduce the bug?

1. Run Codex Desktop on Windows with the current primary runtime actively in use.
2. Make a newer primary runtime bundle available to the hourly scheduled updater.
3. Allow the 501.8 MB bundle to download.
4. Let activation attempt to rename the active codex-primary-runtime directory.
5. Observe EPERM at failureStage=activate_runtime.
6. Leave Codex running.
7. Observe another full download on the next hourly scheduled check, despite retryable=false.

What is the expected behavior?

After a complete bundle download and a non-retryable activation failure, Codex should not discard the verified archive and download it again every hour.

Any of the following would prevent the traffic loop:

• retain the verified archive and activate it after Codex exits/restarts;
• defer activation when the current runtime has live processes;
• stop automatic retries after a non-retryable error;
• use exponential backoff and a retry/traffic cap;
• notify the user and offer “restart to finish update”;
• respect metered-network settings.

At minimum, one failed 500 MB update must not become an unbounded hourly re-download loop.

Additional information

No raw log files are attached because they can contain local paths and session details. The counts above were derived from the local Codex desktop logs and the archive size was verified from the HTTP response.

Start by tracing the primary-runtime-installer activation path and the scheduled update trigger on Windows, focusing on the EPERM rename failure described in the logs. Reproduce the active-runtime update scenario and verify that a non-retryable activation failure does not cause the verified 501.8 MB bundle to be downloaded again on the next hourly check.