Windows: repo-local .codex directory can end up with DENY ACLs and block codex startup

What version of Codex is running?

codex-cli 0.115.0

What model were you using?

gpt-5.4

What platform is your computer?

Windows / PowerShell

What issue are you seeing?

codex failed to start in one specific repo with Accesso negato. (os error 5), while it worked in other repos on the same machine.

What steps can reproduce the bug?

1. Run codex in the affected repo.
2. It fails with Accesso negato. (os error 5).
3. Inspect the repo-local .codex directory with icacls .codex.
4. The directory has explicit DENY ACL entries for write/delete/read-permissions.
5. Rename the directory: rename-item .codex .codex.broken
6. Run codex again.
7. Codex starts normally.

What is the expected behavior?

Codex should not leave the repo-local .codex directory in a state that blocks future startup.

Additional information

This happened in C:\repo\djangotutorial. The same machine could run codex successfully in another repo. After renaming .codex, startup worked again.

Example ACL output included explicit DENY entries on .codex for write/delete/read-permissions.