Windows desktop app dies repeatedly under Smart App Control: vk_swiftshader.dll blocked because sideloaded MSIX ships no CodeIntegrity catalog

Component: Claude Desktop for Windows (Claude Code Desktop)
Versions affected: 1.32885.1.0, 1.34493.0.0, 1.34493.1.0 (sideloaded MSIX, package family Claude_pzs8sxrjxfjjc, SignatureKind=Developer)
OS: Windows 11 Pro 10.0.26200, Smart App Control: ON (enforcement)
GPU: NVIDIA RTX 5080, driver 610.62 and 610.88 (reproduces on both)

Summary

On machines with Smart App Control enforcement enabled, the desktop app terminates entirely (all windows, all sessions) whenever Chromium's GPU process attempts to fall back to the SwiftShader software renderer. The fallback DLL load is blocked by Code Integrity because the sideloaded MSIX package contains no AppxMetadata\CodeIntegrity.cat, so files in the package cannot be validated at the signing level Windows requires for MSIX package context — even though vk_swiftshader.dll itself carries a valid "Anthropic, PBC" Authenticode signature.

Evidence (all timestamps 2026-08-20/21, KST)

Six app deaths, each preceded within ~2 seconds by the same Code Integrity block:

| # | CI 3033 block | App death (main.log "GPU process gone: crashed") |
|---|---|---|
| 1 | 08-09 07:06:35 | (log rotated) |
| 2 | 08-12 06:47:30 | (log rotated) |
| 3 | 08-20 22:08:26 | 22:08:28, exitCode 101457950 |
| 4 | 08-20 23:52:45 | 23:52:46, exitCode 101457950 |
| 5 | 08-21 00:13:20 | 00:13:20 |
| 6 | 08-21 17:03:59 (v1.34493.0.0) / 19:47:10 (v1.34493.1.0) | app gone both times |

CodeIntegrity/Operational event 3033 (verbatim):

Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\WindowsApps\Claude_1.34493.0.0_x64__pzs8sxrjxfjjc\app\claude.exe) attempted to load \Device\HarddiskVolume3\Program Files\WindowsApps\Claude_1.34493.0.0_x64__pzs8sxrjxfjjc\app\vk_swiftshader.dll that did not meet the Microsoft signing level requirements.

Accompanied every time by 3× event 3010:

Code Integrity was unable to load the \Device\HarddiskVolume3\Program Files\WindowsApps\Claude_...\AppxMetadata\CodeIntegrity.cat catalog. Status 0xC000003A.

AppxMetadata\ does not exist in the deployed package directory (verified for 1.32885.1.0 and 1.34493.1.0). Get-AuthenticodeSignature on vk_swiftshader.dll returns Valid / CN="Anthropic, PBC" — inline signature is fine; the MSIX context requires the catalog.

Ruled out

• GPU driver: reproduces on 610.62 and 610.88 (clean full reboot between).
• App version: reproduces on 1.32885.1.0 → 1.34493.1.0.
• Package corruption: full Remove-AppxPackage + fresh install from the official ClaudeSetup.exe bootstrapper reproduced it (bootstrapper installs the same catalog-less MSIX).
• System load: crash #6 occurred with GPU at 1% utilization, 2 GB/16 GB VRAM, app tree RSS 1.6 GB, no driver events in the System log.
• Crash reporting: Crashpad directory stays empty; no WER reports — the GPU process is killed by CI policy, then the app exits.

Side effects also observed

• Windows repeatedly attempts package repair (RepairAppRegistrationOption, trust-label failure 0x80070057, package status flag 0x400), delaying app relaunch by 2–3 minutes after each death (resolved after clean reinstall, but the CI catalog absence persists).
• At every boot: EBUSY copying chrome-native-host.exe out of WindowsApps (old package state).

Suggested fixes

1. Ship the MSIX with a proper CodeIntegrity.cat (Store-level signing pipeline), or
2. Distribute a non-MSIX build for SAC machines (the pre-migration Squirrel install did not exhibit this), or
3. Make the GPU process degrade gracefully when the SwiftShader fallback fails to load instead of taking down the whole app.

Happy to provide full event logs on request.