[BUG] [Enterprise] CoworkVMService deadlocks MSIX updates on Windows 11 — fleet-wide

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

CoworkVMService (AUTO_START in Claude Desktop's MSIX manifest) holds open file handles on
C:\Program Files\WindowsApps\Claude_*_pzs8sxrjxfjjc at boot, blocking all MSIX update
attempts. Affects enterprise fleet of ~1,000 Windows 11 devices deployed via Intune.

sc.exe delete CoworkVMService fails with Access Denied even fully elevated. Result is either
orphaned double-MSIX state or device fully stuck in Servicing/Staged — Claude won't launch.

What Should Happen?

MSIX updates should succeed, or CoworkVMService should release file handles before the
updater runs. Enterprise policy key secureVmFeaturesEnabled = 0 should prevent the service
from starting entirely (unconfirmed — seeking clarification from engineering).

Error Messages/Logs

0x80073D02 — package in use (CoworkVMService holding handles)
  0x80073CF6 — AddPackage conflict / wedged state
  0x80073CFA — RemovePackage failed
  0x80073D28 — full deadlock (AddPackage after Remove failure)

Steps to Reproduce

1. Deploy Claude Desktop via Intune (windowsUniversalAppX LOB)
2. Device boots — CoworkVMService starts automatically
3. Intune or built-in auto-updater attempts MSIX update
4. Update fails with 0x80073D02 / 0x80073CF6
5. Attempting sc.exe delete CoworkVMService returns Access Denied
6. Device left in orphaned or Servicing/Staged state

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

N/A

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

Related issues: #51132, #49655, #49917, #48437 — same root cause, no engineering response yet.

Questions for engineering:

1. Is there a fix or roadmap item for this deadlock?
2. Does secureVmFeaturesEnabled = 0 via HKLM:\SOFTWARE\Policies\Claude prevent

CoworkVMService from starting?

1. What is the official recovery procedure for devices stuck in Servicing/Staged?

Enterprise deployment, ~1,000 Windows 11 Lenovo devices.