[BUG] Cowork VM: HCS 0x80070005 at create_vm_config — regression between app 1.24012.0 and 1.24012.9 on Win11 25H2 (26200) MSIX; all known ACL workarounds ineffective

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Cowork worked normally until 2026-07-20. First failure 2026-07-27 on the first
launch attempt after the app auto-updated to 1.24012.9 on 07-24. Fails at
create_vm_config on every attempt since. Every documented workaround for this
HRESULT has been applied and ruled out.

What Should Happen?

Claude Cowork should open the workspace

Error Messages/Logs

## Environment
- Windows 11 Enterprise 25H2, build 26200 (Entra-joined, MDM-managed)
- Claude Desktop 1.24012.9.0 (MSIX / Microsoft Store)
- Bundle version 6d1538ba6fecc4e5c5583993c4b30bb1875f0f5a (unchanged since 07-13)
- VBS fully enabled; SecurityServicesRunning {1,2,3,4};
  CodeIntegrityPolicyEnforcementStatus 2

## Regression window
- 2026-07-20 11:11:16 — last successful VM start (sessiondata.vhdx written 11:11:40)
- 2026-07-20 to 07-22 — Windows cumulative updates (KB5120102, KB5100998,
  KB5101650, KB5121768); reboot 07-21
- 2026-07-24 12:02 — app auto-updated 1.24012.0 → .1 → .9
- 2026-07-27 14:00:31 — first VM start attempt after update; failed
- No VM start attempts between 07-20 and 07-27, so app update and OS updates
  cannot be fully separated from log evidence alone

## Error
[VM:steps] create_vm_config started
[VM:start] VM boot failed: HCS operation failed: failed to create compute system:
HcsWaitForOperationResult failed with HRESULT 0x80070005:
{"Error":-2147024891,"Attribution":[{"OperationFailure":{"Detail":"Construct"}}]}

Stack originates in app.asar (Object.startVM), not CoworkVMService.

## bundlePath leaks the MSIX-virtualized path
Log reports:
  bundlePath=C:\Users\<user>\AppData\Roaming\Claude\vm_bundles\claudevm.bundle
That path does not exist outside the MSIX container (Test-Path → False). Real
location is ...\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\.
vmcompute runs as LocalSystem outside the container and receives no VFS redirection.

**However, making the path resolvable does not fix the error.** Created a junction
%APPDATA%\Claude\vm_bundles → real LocalCache path; verified
Test-Path <junction>\claudevm.bundle\rootfs.vhdx → True. Identical failure.
The path leak appears to be a real but separate defect from the Construct denial.

## Ruled out
- SYSTEM ACL (per #38188): full control, inherited, package root through LocalCache;
  explicit /grant SYSTEM:(OI)(CI)F /T applied — no change
- VM identity ACL (per #61559): granted NT VIRTUAL MACHINE\Virtual Machines
  (*S-1-5-83-0:(OI)(CI)F /T), verified present on rootfs.vhdx — no change
- Hyper-V Administrators: member via Entra ID; whoami /groups in a NON-elevated
  shell shows "Mandatory group, Enabled" (net localgroup renders blank for AzureAD
  SIDs — misleading, worth noting for other reporters)
- Containers feature (per #37068): Disabled
- WDAC: all enforced policies are IsSystemPolicy=True Microsoft built-ins; no custom
  policy; zero CodeIntegrity 3076/3077 block events
- Services: vmcompute, hvhost, WSLService, CoworkVMService all Running
- VirtualMachinePlatform Enabled; WSL2 installed, default version 2
- No events in Microsoft-Windows-Hyper-V-Compute/Admin at failure time
- No Defender ASR block events (1121/1122)
- Bundle files present and current; smol-bin.vhdx rewritten each attempt

## Additional
`.auto_reinstall_attempted` is recreated on every failed start, so "reinstall the
workspace" is permanently a no-op after the first failure. Deleting it manually
buys exactly one retry.

Steps to Reproduce

1. Open Claude Cowork New or previously opened
2. Error message pops up

Failed to start Claude’s workspace
HCS operation failed: failed to create compute system: HcsWaitForOperationResult failed with HRESULT 0x80070005: {"Error":-2147024891,"ErrorMessage":"","Attribution":[{"OperationFailure":{"Detail":"Construct"}}]}
Restarting Claude or your computer sometimes resolves this. If it persists, you can reinstall the workspace.

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

1.24012.0

Claude Code Version

n/a

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Windows Terminal

Additional Information

_No response_