[BUG] CoworkVMService crashes during use (HcsShutdownComputeSystem 0x80070032), cannot self-recover due to ACL restriction

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Root cause finding: sc.exe sdshow CoworkVMService shows the service's ACL grants Authenticated Users only start/stop/query rights — not SERVICE_CHANGE_CONFIG. This means Windows' native service recovery (auto-restart-on-crash) cannot be configured by anyone but the service's own account, and the service does not appear to configure this for itself (per the "Access is denied" warning in its own log at startup). Net effect: when it crashes, there is no self-healing — it stays down until a user manually runs Start-Service. Requested fix: 1. Investigate why HcsShutdownComputeSystem returns 0x80070032 during VM stop. 2. Have the service configure its own crash-recovery actions (via its elevated service account) so it restarts automatically after an unexpected termination, since external tools are ACL-blocked from doing this. Recurrence: Happened 3 separate times over ~2 weeks on the same machine.

What Should Happen?

Expected CoworkVMService to either (1) not crash during normal active use, or (2) automatically restart itself after an unexpected termination. Instead it requires manually running Start-Service CoworkVMService each time to recover, since the service's ACL blocks external tools (including local Administrator accounts) from configuring Windows service recovery/failure actions — and the service does not appear to configure this for itself, per an "Access is denied" warning logged at its own startup.

Error Messages/Logs

Event ID 7034: "The Claude service terminated unexpectedly. It has done this 3 time(s)."
Key error: HcsShutdownComputeSystem failed with HRESULT 0x80070032, forcing hard VM termination.
Service also cannot self-configure crash recovery: "failed to open service for recovery config: Access is denied."
ACL confirms Authenticated Users (incl. local Admin) lack SERVICE_CHANGE_CONFIG rights — ACL enforced by design.
Full logs available on request.

Steps to Reproduce

1. Open Claude Desktop, use Cowork mode on an active project
2. Work normally for a period (varies — sometimes minutes, sometimes longer)
3. CoworkVMService unexpectedly terminates (Event ID 7034 in Windows System log)
4. Cowork becomes unusable until Start-Service CoworkVMService is run manually

Claude Model

Sonnet (default)

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

Claude Desktop version: 1.24012.9.0

Platform

Other

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

_No response_