Windows sandbox runner fails with CreateProcessAsUserW 1312 after successful setup refresh

Environment

• Codex Desktop for Windows: 26.707.3748.0
• Windows: Windows 11 x64
• Shell: PowerShell 7 via pwsh.exe
• Command runner: codex-command-runner-0.144.0-alpha.4.exe

Problem

Every normal sandbox shell command fails before PowerShell executes, including a minimal command such as:

Write-Output 'POWERSHELL_OK'

The reported error is:

windows sandbox: runner failed: CreateProcessAsUserW failed: 1312
A specified logon session does not exist

The same PowerShell works normally when run directly in an interactive Windows PowerShell window.

The issue persists after restarting both Codex and Windows.

Relevant sandbox log

The recent log shows setup and ACL preparation succeeding:

setup refresh: processed 3 write roots (read roots delegated); errors=[]
setup binary completed
read ACL run completed
helper copy: reused command-runner
helper launch resolution: using copied command-runner path ...\\.codex\\.sandbox-bin\\codex-command-runner-0.144.0-alpha.4.exe

For the failing command, the log then contains:

START: ...\\pwsh.exe -NoProfile -Command ...
setup refresh: processed 3 write roots (read roots delegated); errors=[]
setup binary completed
read ACL run completed
helper launch resolution: using copied command-runner path ...\\.codex\\.sandbox-bin\\codex-command-runner-0.144.0-alpha.4.exe

There is no subsequent runner launch, runner launch failed, child process exit, stdout, or stderr entry.

What has been ruled out

• The interactive Windows user is active in session 1.
• Codex and the interactive shell use the same Windows user.
• Direct PowerShell execution works.
• The sandbox setup binary reports no ACL errors.
• The issue remains after a full Windows reboot.
• The failure occurs for read-only and minimal commands, not just Git or project-specific commands.

Expected behavior

A minimal read-only PowerShell command should run in the normal Codex sandbox after successful setup refresh.

Request

Please investigate the command-runner launch/token path on Windows and improve the logging around the boundary after helper launch resolution, especially failures between launching codex-command-runner.exe and its internal CreateProcessAsUserW call.