Windows desktop: apply_patch intermittently fails with "windows sandbox: setup refresh failed" after directory refresh

What version of the Codex App are you using (From “About Codex” dialog)?

v26.325.31654

What subscription do you have?

Plus

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

On Codex desktop for Windows, apply_patch intermittently but reproducibly fails inside this workspace with:

windows sandbox: setup refresh failed with status exit code: 1

The failure happens even for trivial patches and appears to occur during sandbox refresh/setup, before the patch is actually applied.

Important observations:

• apply_patch works in some directories like docs/, scripts/, and sometimes the repo root.
• The same kind of patch fails in contracts/ and datasets/.
• Regular shell writes in those same directories work normally.
• Git, file permissions, symlink/junction checks, and repo validation are all normal.

What steps can reproduce the bug?

Workspace:

D:\Code\RadishMind

1. Run a minimal apply_patch in docs/:

*** Begin Patch
*** Add File: docs/tmp-ap-test.txt
+docs
*** End Patch

Observed result:
This succeeds.

1. Run a minimal apply_patch in contracts/:

*** Begin Patch
*** Add File: contracts/tmp-ap-test.txt
+contracts
*** End Patch

Observed result:
Fails with:

windows sandbox: setup refresh failed with status exit code: 1

1. Run the same kind of patch in datasets/:

*** Begin Patch
*** Add File: datasets/tmp-ap-test.txt
+datasets
*** End Patch

Observed result:
Fails with the same error.

1. Compare with normal shell writes in those directories:

Set-Content -Path contracts/tmp-shell-write-test.txt -Value 'ok'
Remove-Item -LiteralPath contracts/tmp-shell-write-test.txt

Set-Content -Path datasets/tmp-shell-write-test.txt -Value 'ok'
Remove-Item -LiteralPath datasets/tmp-shell-write-test.txt

Observed result:
These succeed.

Additional repro signal:

1. apply_patch can sometimes create a brand new directory/file once:

*** Begin Patch
*** Add File: zz_ap_native/new.txt
+native create
*** End Patch

Observed result:
Succeeds.

1. Then a second patch into that same new directory may fail:

*** Begin Patch
*** Add File: zz_ap_native/second.txt
+second
*** End Patch

Observed result:
Fails with the same sandbox refresh error.

What is the expected behavior?

apply_patch should work consistently for writable files and directories inside the workspace, the same way shell-based file writes do.

A minimal patch that adds or updates a file in contracts/ or datasets/ should succeed if those directories are writable and inside the current repo.

Additional information

• Environment: Codex desktop app on Windows
• Shell: PowerShell
• Repo is healthy: git status works, validation scripts pass, shell writes succeed
• This does not look like a repository permission issue
• It looks more like a Windows sandbox refresh / directory state tracking issue in the apply_patch tool layer

Useful contrast from this workspace:

• Works reliably:
• docs/
• scripts/
• Fails reproducibly:
• contracts/
• datasets/

I also checked:

• directory ACLs: normal
• symlink/junction state: normal
• .gitattributes / line ending config: normal
• file system writes via shell: normal

So the failure seems specific to apply_patch sandbox refresh behavior, not to the repo content itself.