codex-windows-fast-patch

# Codex Windows Fast Patch Use this skill when the user says Codex Desktop was upgraded and the Fast Mode / Plugins / Goal patch disappeared, asks to repatch Codex on Windows, asks to verify whether Fast Mode is really being sent, asks to restore/register the local plugin marketplace, asks to enable Chrome browser use or Windows Computer Use in Codex Desktop, or asks to enable/repair phone remote control while keeping third-party/API-key model access. Also use it when a custom provider or `/v1/models` exposes a new model but Desktop still hides it, when GPT-5.6 Sol/Terra/Luna are missing from the model picker, when the compact blue-purple Power slider falls back to the legacy Model / Reasoning / Speed menu because Statsig `available_models` filtering removed the required model combinations, or when the "Ultra in model picker slider" setting is visible but disabled because a third-party provider cannot load ChatGPT account user settings. Also use it when the language/locale setting reverts after restart, browser or plugin entries are hidden by availability gates, the Computer Control settings page shows "Any App" / "任意应用" as disabled by organization or unavailable in the current region, a Computer Use task reports native pipe, bundled plugin cache, helper path, package import, or runtime initialization errors, a Computer Use conversation loses `cua.getApp` / `cua.listApps` while `cua.getState()` and the native pipe still work and the symptom returns after every Desktop restart, a Computer Use call fails with `Native app bindings are unavailable for windows.` or times out on an in-app-browser tab while `cua.computer.list_windows()` still works, phone remote-control QR pairing spins/fails, post-pairing phone-created turns hit the wrong model API endpoint, Desktop new-chat/thread start fails with `missing field inputSchema`, local conversations disappear after switching `model_provider` / API account, restored conversations are visible but cannot continue because the current working directory is missing, or the user explicitly asks to configure the bundled custom `model_instructions_file` prompt asset. ## Platform Compatibility This skill is Windows-only. It depends on the Windows Store/MSIX package layout, PowerShell, `Get-AppxPackage`, `makeappx.exe`, `signtool.exe`, Windows user environment variables, and Windows Computer Use helper paths. Do not run this skill on macOS. A macOS adaptation needs a separate workflow for the Codex `.app` bundle, ASAR extraction and repacking, macOS code signing or quarantine handling, shell scripts, and macOS-specific Computer Use availability. ## Skill Root Every command in this document refers to the skill directory as `$SkillRoot`. Resolve it once per session before running anything else. This skill does not care which harness loaded it, so the probe matches any agent home that follows the `~/<agent-home>/skills/<skill-name>` layout: ```powershell $SkillRoot = $env:CODEX_WIN_FAST_PATCH_SKILL_ROOT if (-not $SkillRoot) { $SkillRoot = (Get-ChildItem -Force -Path "$env:USERPROFILE\.*\skills\codex-windows-fast-patch\SKILL.md" -ErrorAction SilentlyContinue | Select-Object -First 1).Directory.FullName } if (-not $SkillRoot) { throw 'skill root not found; set CODEX_WIN_FAST_PATCH_SKILL_ROOT to the directory that holds this SKILL.md' } ``` If the agent already knows the directory it loaded this `SKILL.md` from, assign that path directly instead of probing. When more than one harness has the skill installed, set `CODEX_WIN_FAST_PATCH_SKILL_ROOT` to pick one explicitly; the probe otherwise takes the first match. ## Self-Update Preflight Before updating the skill or changing patch code, inspect its actual update source and compare the available main refs with the installed files and local edits. A direct clone of this project uses `origin/main`; a fork also needs comparison with this project's main. Do not require users to create a fork, add a duplicate remote or change their remote URLs merely to use the skill. Reuse an existing remote fix or effective PR; add only evidence-backed missing behavior. A zero `HEAD..origin/main` count does not establish freshness when `origin` is a fork or the installed copy has a separate overlay. Use `$SkillRoot` when it is a Git checkout. For a copied/plugin installation, inspect its recorded source/version and preserve the installed overlay; use a persistent source checkout when source comparison or code changes are needed. Absence of `.git` does not establish that a copy is current. Ordinary diagnosis with installed tools does not itself require a checkout or network access. Read [remote review and publication](references/remote-review-and-publication.md) before changing patch code or publishing a fix. Reuse existing commits/PRs when they already cover the task, without empty commits or duplicate PRs. Ordinary installation, update and local repair do not authorize repository publishing or create a duty to contribute. If a human explicitly asks the agent to contribute a fix or idea to this project, first read [the contribution rules](AGENTS.md#human-directed-pr-contributions), then validate and follow the authorized publication workflow; record the commit, base/head and PR URL. Otherwise keep any necessary repair local and report its validation and limits without pushing branches or opening PRs. Preserve local edits and resolve divergence without forced resets or pushes. If a pattern fails or a helper hash is unknown, recheck the update source and this project's main before implementing. Report unavailable remote review separately from local verification; do not claim freshness without evidence. Publication can remain pending only when a human requested it, not as a condition of ordinary repair completion. If the normal workflow does not explain a restriction, plugin gate, Computer Use failure, browser_use failure, or Fast Mode failure, read `references/restriction-debug-cases.md` before editing scripts or repatching. For Desktop 26.1021 native Windows CUA or a Power slider moved into `app-primary`, use the native-layout case in that reference. Preserve the shipped Windows readiness and installed-plugin guards when the patcher reports `already-open-native-windows`. For browser AX `Decompression failed`, use the AX asset case in that reference. For missing CUA child proxy variables, use its read-only process probe before selecting the opt-in `-OnlyNodeReplProxyEnv` or `-OnlyComputerUseSurfaceAndProxyEnv` repair; missing root-process proxy settings alone do not justify a package patch. For Desktop 26.1029 `missing=browser-client path hint`, use the Browser Client trust-contract case there: the legacy diagnostic disappeared, while paired schema-2 native-host registration survives. Update the diagnostic before refreshing local caches; do not modify the trusted browser client or broaden Desktop gates. Desktop `26.1027.3384.0` uses a double-quoted registered-core anchor in `early-bootstrap.js`; the proxy-only matcher supports this webpack layout. Keep the native CUA surface unchanged when enumeration already works, and distinguish a successful DryRun from post-install routing acceptance. When the requested repair includes default proxy routing for custom stdio MCP servers, inspect their actual launcher and server processes too. A passing Desktop/backend/CUA check does not establish custom MCP inheritance. Use the custom stdio MCP proxy case in that reference for a config-only `env_vars` repair; the CUA ASAR patch does not add proxy allowlists to unrelated MCP servers. If the task is phone remote control, QR pairing, mobile setup, isolated remote OAuth, remote-control WebSocket, or post-pairing API endpoint diagnosis, read `references/remote-control-debug-cases.md` before editing scripts or repatching. ## Config Backup Rule Before any action that can modify, regenerate, or overwrite `$env:USERPROFILE\.codex\config.toml`, create one timestamped backup of the current file for the task. This applies whether the agent uses bundled scripts, writes TOML manually, runs another helper, registers a marketplace, changes MCP servers, or repairs Computer Use. The bundled scripts already back up an existing `config.toml` once per script run before their first write. If not using those scripts, do the backup explicitly before touching the file: ```powershell $config = Join-Path $env:USERPROFILE '.codex\config.toml' if (Test-Path -LiteralPath $config -PathType Leaf) { $backupDir = Join-Path (Split-Path -Parent $config) 'backups\config' New-Item -ItemType Directory -Force -Path $backupDir | Out-Null $backup = Join-Path $backupDir ('config.toml.' + (Get-Date -Format 'yyyyMMdd-HHmmss-fff') + '.manual.bak') Copy-Item -LiteralPath $config -Destination $backup -Force Write-Host "config.toml backup before overwrite: $backup" } ``` Do not proceed with a config write if the backup of an existing config fails. The shared TOML writer uses a basic string when a value contains an apostrophe or control character; doubled apostrophes are not valid TOML escaping. Validate the candidate content before replacing the config when `tomllib` is available, and validate again after the complete repair. Windows PowerShell 5.1 can prefix native stdin with a UTF-8 BOM even with a no-BOM `$OutputEncoding`; decode validator input with `utf-8-sig` to avoid falsely rejecting valid content. This transport handling does not change the no-BOM file writer or the malformed-TOML rejection. A missing parser is a tooling limitation, not evidence of invalid configuration. ## Workflow Selection Only when the user explicitly requests changing Desktop's scheduled-follow-up instructions, use the [optional thread automation customization](references/restriction-debug-cases.md#explicit-recurring-follow-up-is-refused). It is hash-pinned and not Windows-10-specific. Ordinary full repairs preserve the shipped instructions; a scheduling request alone does not authorize client repackaging or installation. It does not repair the scheduler or create a task. For `failed to spawn code-mode host` or an older CLI selected after Desktop restart, read [executor runtime repair](references/executor-runtime-repair.md). Use the targeted local repair and verify actual post-restart tool execution before declaring recovery. For recurring update regressions, prefer the repository's `scripts/codex-after-update.ps1`: default mode checks the exact package's repair transaction, live models and strict plugin/runtime contracts; `-CheckApp` runs a complete package dry run in disposable scratch space. A passing plugin check without accepted current-package evidence is `app-check-needed`, not app health. `-RepairPlugins -RepairApp` is an explicit repair path, never a watcher. Resume pending acceptance rather than deploying again, and reject unknown layouts or installer state before launch. Do not schedule or automatically invoke it unless the user requests that behavior. The recoverable launcher resolves default CustomModels from live model/list; explicit CustomModels remain available when the CLI cannot load the catalog. Never fabricate reasoning or service tiers. Before choosing the full MSIX repack path, identify whether the current failure is a Desktop bundle gate or a local plugin/runtime repair. Do not treat a vague "Chrome/Computer Use is unavailable" report as enough evidence to run the full repatch. For a missing dots entry, read [dots diagnostics](references/dots-diagnostics.md) first and use `scripts\diagnose-dots.py` for read-only package inspection. The cloud agent requires separate ChatGPT account/workspace access; route presence and a custom model provider do not establish that access. This is diagnostic support, not a dots unlock or a default MSIX patch. - Use the Model Experience workflow for Fast Mode request/UI failures, new models hidden from the Desktop picker, the compact Power slider falling back to the legacy picker, or its Ultra setting being disabled under a custom provider. Run `scripts\patch_codex_fast_mode_windows_msix.ps1 -OnlyModelExperience -DryRun` first for isolated diagnosis; it checks the Fast request gate, Fast UI gate, model visibility filter, Electron Power slider `harborEnabled` gate, and Ultra setting persistence independently. The Ultra fallback preserves the normal ChatGPT account API path and uses local `show-ultra-in-model-picker-slider` config only when ChatGPT user settings cannot load. `-OnlyCustomModels` remains a compatibility alias. Merge missing model metadata into `models_cache.json` only when read-only inspection proves the cache entry is absent; back up the cache first. The same area also covers the model picker offering only the Fast speed tier when the official catalog adds a second `ultrafast` tier for `gpt-5.6-sol` and a custom `model_catalog_json` predates it; that is a config-layer catalog backfill, not an ASAR repair — see the missing Ultrafast tier case in `references/restriction-debug-cases.md`. Native Desktop 26.1023 can instead filter Ultra through gate `1186680773` in both the model query and host capability bootstrap. The Ultra patcher recognizes this paired layout, admits existing catalog capabilities for custom providers, and preserves the official gate for other providers. Require both patch markers and `test-native-ultra-reasoning.ps1` before installation; `not-applicable` alone does not establish that a native Ultra control is healthy. After a package update, the local plugin repair also backs up and refreshes already published descriptors in Desktop's actual reserved marketplace mirror, then upgrades installed plugin version records to the package versions while preserving disabled states. It does not install unrelated optional plugins. Desktop availability patches for optional plugins, including Deep Research, must also set `installWhenMissing:false`; discovery must not change existing installation or enabled/disabled choices. Run `node scripts/test-bundled-plugin-discovery.cjs <original-extracted-asar>` and `node scripts/test-bundled-marketplace-copy.cjs` when changing this boundary. Run `test-bundled-plugin-upgrade-repair.ps1` when changing this synchronization. If `install-computer-use-local.ps1 -StrictVerifyOnly` also reports that installed `app.asar` does not preserve external `NODE_REPL_TRUSTED_CODE_PATHS` across Desktop config regeneration, do not use the Model Experience-only installer: that mode cannot repair the shared Node REPL trust contract. Run a full package dry run in a sufficiently spacious local scratch directory and require a `Node REPL trusted-paths patch result: patched` or `already-patched` report plus the trusted-path marker in the staged `app.asar`, then use `scripts\start-model-experience-repair.ps1`. A repair runner must confirm that marker in the candidate package; it must not infer failure from `already-patched` alone. This launcher requests ordinary UAC consent, binds the external installer to the current user SID, desktop session, and exact source package version, and invokes the complete non-phone patch path. It builds a higher-revision signed recovery package containing the original program files, installs the patch in place, then requires the default model to expose `priority` plus a passing `-StrictVerifyOnly` before removing temporary artifacts. Record `ultrafast` per model from `model/list`; never fabricate it for a model/provider that does not advertise that tier. No phone remote-control patch is included. UAC or policy rejection stops before the app is closed; do not replace it with a scheduled task, policy change, or another elevation bypass. - Use the full repatch workflow for locale, plugin UI gates, browser_use Desktop gates, Goal gates, ASAR integrity, settings/UI availability gates, or when Model Experience repair is required together with those features. For packages that ship `image-guided-assets`, the marketplace gate may be tied to the default-off `imageGuidedAssets` feature flag; expose the entry through the guarded ASAR patch while setting `installWhenMissing:false`, then require `-StrictVerifyOnly -VerifyAllBundledPluginsAvailable`. This makes the optional plugin discoverable without installing it. - Before a full repatch after a Store update, compare the current-user and `Get-AppxPackage -AllUsers` results. The patcher selects the highest-version valid current-user or SYSTEM-Staged package, plus running-process candidates; it uses WindowsApps-directory candidates only if the all-user query is unavailable. This prevents an older user-installed package from hiding a newer SYSTEM-Staged build without selecting a package registered only to another user. Check the `selected Codex app` log before proceeding. Use `-AppPath` only when an explicit source override is required. - Use the Computer Use Only workflow first when evidence points to a local plugin/runtime problem: `codex plugin list` marketplace errors, missing `.agents\plugins\marketplace.json`, missing or partial `openai-bundled` plugin files, `bundled_plugins_marketplace_resolve_failed`, `EBUSY` on bundled plugin files, native pipe unavailable, `missing-helper-path`, stale Chrome native messaging host paths, bundled plugin cache drift, Chrome/browser cache link drift, stale `SKY_CUA_NATIVE_PIPE` config, `@oai/sky` import errors, or `setupComputerUseRuntime` import failure. This class does not require an MSIX uninstall/reinstall unless a later check also proves a Desktop gate is still closed. - If a Store update breaks an already-configured MCP because its `command` points into a removed `%LOCALAPPDATA%\OpenAI\Codex\runtimes\cua_node\<old-runtime-id>` directory, use the retired CUA Node MCP case in `references/restriction-debug-cases.md`. This is a targeted `config.toml` repair, not evidence for a broad MSIX repatch or permission to install additional MCP servers. - If app/window enumeration works but screenshots fail with `SetIsBorderRequired failed` / `0x80004002` or `FrameArrived timed out` on Windows 10, treat it as a native CUA screenshot-helper compatibility failure, not a cache path or Desktop gate. A subsequent `coordinate input geometry is unavailable` can follow the failed capture; repair and verify capture before retesting coordinate input. Read `references/win10-computer-use-screenshot-backend.md`, then use `scripts\patch-computer-use-helper-win10.ps1` only when its read-only status reports the exact supported original or patched hash. Unknown hashes require fresh analysis and must remain untouched. - If `sky.list_windows()` succeeds but a later independent `sky.get_window_state()` or `sky.activate_window()` call fails with `node_repl exec context not found`, read the cross-call approval case in `references/restriction-debug-cases.md`. On the exact documented `@oai/sky 0.6.2` helper transport, the persistent helper's approval callback can inherit the previous JavaScript call's `AsyncLocalStorage` store. `install-computer-use-local.ps1 -VerifyOnly` applies the hash-guarded request-context patch; `-StrictVerifyOnly` only verifies it. Reset the current JavaScript kernel after repair, then prove the fix with real captures in later independent calls. - Use the Custom Provider Tool Exposure triage when MCP tools or Computer Use are unavailable only under a custom `model_provider`: the agent reports zero MCP tool names, while the same machine and config expose every MCP tool with `-c model_provider=openai`. Capture the real provider request body through a local logging reverse proxy and check the `/models` response shape before touching Desktop: a gateway that answers the OpenAI list-models shape (`{"data":[...]}`) fails catalog decoding (`missing field \`models\``) and forces fallback model metadata with `supports_search_tool: false`, pinning the wire shape to `namespace` entries; both the `namespace` and `tool_search` shapes were ineffective despite HTTP 200 on the observed chain - an outcome that does not by itself distinguish gateway filtering from upstream or model-side ignoring. Treat the dropping hop (gateway filter versus model-side rejection of these shapes) as unverified unless a controlled raw-request probe or a gateway inbound/outbound comparison proves it, and never use the model's verbal tool report as evidence. The documented MSIX repatch and Computer Use local repair do not target this failure class — see the custom provider chain case in `references/restriction-debug-cases.md`. - Use the CUA surface lock case when `cua.getState()` works but `Object.keys(cua)` has no `computer`/`getApp`/`listApps`/`listWindows` while `install-computer-use-local.ps1 -StrictVerifyOnly` passes. Inspect the plugin layout first: a script-based `unified-computer-use/scripts/launch.mjs` can use `repair-cua-surface-lock.ps1`; a descriptor-only 26.908+ plugin has no such target and requires the Desktop `-OnlyComputerUseSurface` ASAR workflow after a successful DryRun. Editing the materialized `.mcp.json` is temporary because Desktop reconcile can rewrite it. See both surface cases in `references/restriction-debug-cases.md`. - Use the Windows app-binding case only when the installed `@oai/cua` runtime actually throws `Native app bindings are unavailable for windows.` after the surface is exposed. The recorded legacy runtime had that boundary; `@oai/cua` 0.2.5 instead provides Windows `cua.listWindows()` and `cua.getApp({ windowId })`. Check the installed runtime and its injected documentation before choosing the legacy repair, and verify native capture in a fresh conversation. - Use the config-rewriter case when a provider switcher rewrites `config.toml` and `codex mcp list` loses `cua_repl`: restore the missing `[plugins."unified-computer-use@openai-bundled"]` table from a backup, preserving current provider settings. Evaluate feature keys with the running CLI's `codex features list` before restoring them. On CLI 0.155.0-alpha.16.4, `computer_use` is stable and on by default, `js_repl` is removed, and native CUA works with no explicit `computer_use` entry and `js_repl = false`; those values alone are not a defect. See the historical config-rewriter case in `references/restriction-debug-cases.md`. - Use the Phone Remote Control workflow when the user needs mobile pairing/control, the Connections page hides the phone setup card, the QR dialog spins, remote-control setup jumps to ChatGPT auth, the Allow dialog fails, the phone says the Codex environment version expired, or phone-created turns reach Desktop but send model requests to the wrong API endpoint. - Use the Missing inputSchema decision workflow when Codex Desktop cannot create a new conversation or local task and the newest Desktop log reports `method=thread/start` with the phrase `missing field inputSchema`. Do not assume this is always MCP. First compare CLI/app-server smoke tests against Desktop logs and inspect whether Desktop is sending non-null app dynamic tools. If the failure follows a suspect MCP server, isolate MCP. If CLI thread start succeeds while Desktop UI fails and extracted ASAR has `webview\assets\app-server-dynamic-tools-*.js` returning a namespace-wrapped `dynamicTools` object, use the Dynamic Tools Schema workflow. Do not run Phone Remote Control or Computer Use repair for this symptom unless separate evidence points there. - Use the Provider History Sync workflow when old conversations disappear from the official Desktop sidebar after the user changes `model_provider`, API account, or provider config, but local `sessions`, `archived_sessions`, or `state_5.sqlite` data still exists. Also use it when the conversations reappear but opening/continuing one fails with `当前工作目录缺失`, `current working directory missing`, or `invalid codex request` caused by a missing historical `cwd`. This workflow is data-layer repair; it does not require third-party recovery tools, does not patch ASAR, and must not modify `config.toml`. - For project assignments lost after crash/restart, or an archive-load error beside loaded chats, read [project and archive state repair](references/project-archive-state.md). Inspect database/global-state/backup evidence before recovering memberships; use the opt-in `-OnlyProjectArchiveState` mode only for supported complete source hashes, then verify persistence after restarting Desktop. - Use the targeted bundled marketplace repair when the newest Desktop logs show fewer descriptors than the current package marketplace, or show `not_in_bundled_marketplace_plugin_names` removing a plugin the user had already installed. Descriptor presence means a plugin is available; it does not authorize installing or enabling optional plugins such as `sites`, `latex`, `deep-research`, or `visualize`. This should not trigger a broad repatch or Phone Remote Control workflow. Inspect the complete missing-descriptor predicates and platform support first. The recorded `26.825.6671.0` macOS-only unified CUA and account-authenticated `user-writing` gaps are expected; preserve those boundaries. Supported `26.1007` Code Review and unified CUA discovery predicates instead use the newer optional-entry case in `references/restriction-debug-cases.md`, with `installWhenMissing:false`. Unknown account predicates remain unsupported. - If the user asks for Phone Remote Control and ordinary Desktop features in the same repair, patch Phone Remote Control first, then verify Fast Mode/browser/Chrome/Computer Use. If the remote-control MSIX install disturbs Computer Use or Chrome native-host state, immediately run the Computer Use Only workflow and re-run `-StrictVerifyOnly`. - Do not infer that a new `resources\codex.exe` PE file means `app.asar` is gone or that Computer Use needs binary patching. Inspect the current package resources first. If `app.asar` still exists and the symptom is a plugin/runtime import or cache failure, run `scripts\install-computer-use-local.ps1` before considering MSIX or binary changes. - After a Computer Use-only repair, always run `scripts\install-computer-use-local.ps1 -StrictVerifyOnly`. Legacy layouts pass with `client import ok` plus `helper transport ok`; descriptor-only layouts pass with `runtime import ok` after importing the official `sky` export and calling `list_windows`. For a recognized cross-call request-context profile, strict verification must also report the exact patched helper-transport hash. These checks still do not replace a real screenshot in a later JavaScript call. - Do not put Phone Remote Control into the default full repatch path unless the user asked for it. It is an opt-in workflow because it can require isolated remote-control OAuth, ASAR changes, a native app-server replacement binary, SQLite enrollment cleanup, and post-pairing API endpoint diagnosis. - If evidence is mixed, use the lowest-disruption path first: run read-only triage, then `scripts\install-computer-use-local.ps1 -VerifyOnly` for local plugin evidence, restart Codex Desktop only if needed, and escalate to MSIX only when logs or extracted ASAR checks still show a closed gate. The normal `scripts\repatch-codex-windows.ps1` preflight recognizes one package-gated Computer Use case: `installed app.asar does not preserve external NODE_REPL_TRUSTED_CODE_PATHS across Desktop config regeneration`. This means the installed app must be repatched before external marketplace/cache roots can survive Desktop config regeneration. For this exact message only, the wrapper records the fallback and continues into its MSIX dry run or install; unrelated Computer Use failures still stop the workflow. After installation, the wrapper runs the normal Computer Use refresh and strict verification. During a dry run, post-dry-run local verification is skipped only for this recognized case because the currently installed package is intentionally still unpatched. When Chrome session/tab commands or the browser portion of `cua.getState()` report `Codex auth token is unavailable` under an explicitly non-OpenAI-auth custom provider, read the Chrome custom-provider request-header case in `references/restriction-debug-cases.md`. The supported local service overlay keeps agent request headers ON; it does not forge a login, change provider/auth files, disable other policies, or modify trusted browser-client bytes. The local installer reapplies the hash-guarded overlay after cache refresh. Both repair and strict verification include browser/chrome plugin copies and the current `cua_node` runtime's `@oai/browser-desktop/service`, each checked against its own installed-package source. Unknown official source hashes explicitly skip only this overlay without claiming the auth error is repaired; missing current runtime services and unknown, mixed-version, or partial files under a supported source fail before any overlay write. After applying it, reset only the current JavaScript kernel and verify real Chrome navigation and input; do not reinstall Desktop for this error. ## External Executor For Desktop-Restarting Repairs MSIX deployment must be an in-place update, never an uninstall followed by an install. All three patchers increment the package revision and use `scripts/lib/msix-safe-install.ps1`. It checks the manifest, publisher, architecture, signature, version, administrator requirement for packaged services, and installer ancestry before deployment. Permission or same-version failures must stop without closing or removing the working app. Do not restore a `Remove-AppxPackage` fallback to work around a failed update. `Start-Process` from Desktop can still belong to Desktop's job/process tree and terminate with it. Verify an external executor's ancestry and user session before releasing installation. Packages declaring `windows.service`, `packagedServices`, or `localSystemServices` require an elevated executor; a valid signature does not establish deployment permission. Obtain normal Windows UAC consent and verify the elevated token before any app shutdown. Keep a separately signed recovery package containing the original program files, with a revision higher than the intended update, until real launch and runtime acceptance pass. The launcher starts its elevated PowerShell hidden: a visible console can enter QuickEdit selection mode (window title starts with `Select` / `选择`) and suspend the repair until selection is cleared. The transcript remains the progress source. The normal patcher entrypoints do not create that recovery package automatically. `scripts\repatch-model-experience-recoverable.ps1` implements the guarded transaction for the full non-phone patch set; start it through `scripts\start-model-experience-repair.ps1` so the elevated executor is outside the Desktop process tree. For new runs it selects the ready fixed local drive with the most available free space, with `-DataRoot` or process-scoped `CODEX_WINDOWS_REPAIR_DATA_ROOT` available as an explicit override. Its ASAR extraction work uses `<selected-drive>\CodexData\cwp-tmp`, passed explicitly as `-AsarWorkRoot`; do not put it below the deeper repair output tree. This matters for nested package assets: the current bundle's longest ASAR entry is 236 characters at the guarded layout, while the previous layout exceeded `MAX_PATH`. The runner identity-checks that temporary directory and removes it only after launch, app-server model-tier, and Computer Use strict verification pass; failed runs retain it for diagnosis. It reads patch-result lines from the transcript as well as captured output because the patcher reports them with `Write-Host`, and keeps downloaded SDK BuildTools until the original-content recovery package has been signed. Interrupted recovery-package trees are checked and removed with an extended-path traversal, which tolerates entries that disappeared during enumeration but rejects reparse points; do not replace it with `Remove-Item -Recurse` on deep PowerShell 5.1 trees. Its code-signing EKU check reads `ObjectId` as either the string returned by Windows PowerShell 5.1 or its `.Value` wrapper. If package creation and Fast wire verification succeeded but the run stopped specifically because the recovery signing certificate lookup failed, retain the run directory, transcript, short temp directory, and SDK cache; after fixing the certificate check, the launcher can resume only that prepared build after validating its sentinel, source package identity, transcript failure reason, package signature and payload: ```powershell powershell -NoProfile -ExecutionPolicy Bypass -File "$SkillRoot\scripts\start-model-experience-repair.ps1" -ResumePreparedBuild -PreparedOutputRoot "D:\CodexData\codex-windows-fast-patch\model-experience-repair-runs\<run-id>" -PreparedTranscriptPath "D:\CodexData\codex-windows-fast-patch\model-experience-repair-logs\<run-id>.transcript.txt" ```