[Windows Desktop regression] Existing root-deny permission-profile chat cannot resume after 26.911.7940.0 update

Summary

An existing local Codex Desktop Work chat stopped resuming after the Windows app updated from 26.908.9136.0 to 26.911.7940.0. Its selected named permission profile explicitly sets :root = "deny" and :minimal = "read", with project-scoped read/write exceptions. The app now fails during session initialization, before the chat can work:

Failed to resume chat
error resuming thread: Fatal error: Failed to initialize session:
failed to load AGENTS.md instructions for environment `local`:
fs sandbox helper failed with status exit code: 1:
windows sandbox failed: elevated Windows sandbox requires effective `:root` read access

This is not a request to broaden the profile to :root = "read": that would remove an intentional isolation boundary.

Environment and evidence

• Windows 11 Pro, build 26200; native local execution.
• Installed OpenAI.Codex package: 26.911.7940.0. Windows AppX events recorded replacement of 26.908.9136.0 at approximately 2026-09-18 00:01 local time (Europe/Bucharest).
• The project-local profile predated the update. A local rollout from the previous app version records the named managed profile selected for 19 subsequent turn contexts, with many successful shell-tool results. This establishes that the chat ran with the profile selected; it does not independently certify enforcement of every deny rule.
• The :root = "deny" and :minimal = "read" lines were not changed during troubleshooting.
• A separate malformed, disabled MCP stanza initially caused an invalid transport parser error. Removing only that incomplete stanza allowed configuration parsing to proceed; the above sandbox error then appeared. These are separate failures.
• Other Codex chats can run; this is not a global inability to launch the app.
• The existing conversation data remains locally present. The failure is at resume/initialization, not evidence that the conversation was deleted.

Relevant profile shape (paths and name sanitized):

default_permissions = "restricted-audit"

[permissions.restricted-audit]
extends = ":read-only"

[permissions.restricted-audit.filesystem]
":root" = "deny"
":minimal" = "read"
'C:\Work\Audit' = "read"
'C:\Work\Audit\Reports' = "write"
'C:\Work\Audit\Scratch' = "write"
'C:\Work\OtherProject' = "deny"

[permissions.restricted-audit.network]
enabled = false

The official permissions documentation explicitly illustrates workspace-limited profiles using :root = "deny" with :minimal = "read". The Windows sandbox documentation describes the elevated backend but does not flag such a profile as unsupported.

Steps to reproduce

1. On Windows, create/select a project-local named profile with the restricted filesystem rules above for a local Work chat.
2. Use and resume the chat on Codex Desktop 26.908.9136.0.
3. Update the Desktop app to 26.911.7940.0 without changing the filesystem rules.
4. Reopen the existing chat.

Actual: The chat cannot resume; AGENTS.md loading aborts with the effective-:root-read error.

Expected: Preserve the documented workspace-limited policy and resume the chat, or provide a supported recovery path with equivalent isolation and a clear compatibility diagnostic. Do not silently weaken filesystem access.

Relationship to existing report

#46114 has the same visible error string, but reports an all-threads provisioning failure with a different permission pattern. This report isolates an explicit :root = "deny" profile that was selected and usable before the Desktop update. The common error could have a shared underlying cause; this report does not assume one.

No private paths, conversation transcript, raw logs, or project files are attached.

Start by reproducing the resume failure on Windows with the documented named profile, then trace session initialization through AGENTS.md loading and the Windows sandbox helper. Done means an existing chat resumes without weakening :root = "deny", or the app provides a clear supported recovery path with equivalent isolation.