[Windows Sandbox] Elevated setup fails with COM+ registry database system error on Insider Beta 26220

Summary

The native elevated Windows sandbox cannot initialize. Every sandboxed file operation triggers codex-windows-sandbox-setup.exe, which displays a COM+ registry database error and causes the operation to wait or fail.

Environment

• Codex Windows app: 26.616.6631.0 x64
• Bundled Codex CLI: 0.130.0-alpha.5
• Windows: Pro 25H2, build 26220.8690
• Windows Insider channel: Beta / Mainline
• Architecture: x64

Error

Dialog shown by codex-windows-sandbox-setup.exe:

COM+ 注册表数据库检测到一个系统错误

English translation:

COM+ registry database detected a system error

The calling operation can also fail with:

orchestrator_helper_launch_canceled:
ShellExecuteExW failed to launch setup helper: 1223

Steps to reproduce

1. Start the Codex Windows app.
2. Use Default permissions with the native elevated Windows sandbox.
3. Open a local workspace.
4. Trigger an apply_patch operation.
5. Observe the codex-windows-sandbox-setup.exe COM+ error dialog.
6. The operation waits indefinitely or fails.

Expected behavior

The elevated Windows sandbox setup completes and sandboxed file operations run normally.

Actual behavior

The COM+ error dialog appears whenever the setup helper is triggered. Sandboxed operations cannot complete reliably.

Diagnostics already completed

• UAC is enabled with normal administrator prompt and secure desktop settings.
• 64-bit sfc /scannow reports no integrity violations.
• COMAdmin.COMAdminCatalog can successfully enumerate the local COM+ catalog (6 applications).
• COM+ Event System and RPC are running normally.
• The computer was renamed from a non-ASCII name to an ASCII-only name and rebooted.
• Removed and cleanly recreated:
• CodexSandboxOnline
• CodexSandboxOffline
• CodexSandboxUsers
• %USERPROFILE%\.codex\.sandbox
• %USERPROFILE%\.codex\.sandbox-bin
• Rebooted and reproduced the issue after the clean sandbox rebuild.
• Updating the Codex app did not resolve the issue.

Notes

The standard COM+ catalog is readable and Windows Resource Protection reports a healthy system, so this appears specific to the elevated Codex sandbox setup path on this Windows Insider Beta build.