setup-windows breaks activation of ALL packaged (MSIX/AppX) apps after reboot — 0x800701F6 [FinishPackageActivation]; only a full Windows reinstall recovered previously

[0xReSan]

setup-windows breaks activation of ALL packaged (MSIX/AppX) apps after reboot — 0x800701F6 [FinishPackageActivation]; only a full Windows reinstall recovered previously

Environment

• OS: Windows 11 Pro, build 26200 (10.0.26200.9168), zh-CN locale
• finsafe version at failure onset: 0.9.44 — the first setup-windows on this host whose helper probe flipped to helper_installed: true (all earlier attempts since 8/31 failed, see [bug]: Windows setup-windows cannot establish helper IPC — finsafe-winhelper named pipe rejects Read/Write connections (PIPE NOT AVAILABLE); WFP never registered; allowlist unusable (persists across reboots, build 26200) #37). finsafe 0.9.46 setup-windows was later re-run on the already-broken host with no change.
• Machine: personal desktop, single local-admin user (xuls2), no domain/enterprise policy
• Backend in use: RestrictedToken / network:host for agent runs (AppContainer used only by probes)

Summary

After a successful finsafe setup-windows followed by a reboot, activation of every packaged (MSIX/AppX) application started failing for the user: Windows Terminal, Windows Web Experience (widgets), PowerToys (all three context-menu packages), Command Palette, Microsoft Store, OpenAI Codex desktop, etc. Failure is at the process-creation / "configuring runtime" stage. Regular (non-packaged) Win32 processes, user-profile loading, file ACLs, registry, disk, and the AppX services themselves are all healthy. Every remediation attempted so far has failed (list below). The user reports this exact failure previously forced a full Windows reinstall.

Steps to reproduce

1. Clean Windows 11 26200 host with a local-admin user.
2. Install finsafe (0.9.44 era), run finsafe setup-windows, accept the UAC prompt (helper service + finsafe-net group + WFP provisioning all complete).
3. Reboot.
4. Launch any packaged app — Start menu → Windows Terminal, or run C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_*_x64__8wekyb3d8bbwe\WindowsTerminal.exe directly.

Expected

The app launches normally.

Actual

Windows Terminal fails immediately at process creation with:

Access to the user profile configuration is denied.  (加载用户配置文件时访问被拒绝)

Microsoft-Windows-AppModel-Runtime/Admin fills with events 208/216:

0x800701F6: Cannot create the process for package <pkg> because an error was
encountered while configuring runtime. [FinishPackageActivation]

240 events since first onset 2026-09-06 17:13:02 local — minutes after the setup-windows reboot.

Affected packages (event-216 census, top offenders)

WindowsTerminal ×88, MicrosoftWindows.Client.WebExperience ×27, PowerToys FileLocksmithContextMenu / PowerRenameContextMenu / ImageResizerContextMenu, Microsoft.CommandPalette, Microsoft.WindowsStore, ThunderShell, OpenAI.Codex — i.e., every packaged app that was attempted.

Verified healthy (ruled out)

• User profile loading: User Profile Service logs only successes (1531/1532). Fresh full-profile processes spawned via Task Scheduler read/write the profile normally.
• File ACLs: C:\Users\xuls2, AppData roots, %LOCALAPPDATA%\Packages, the WindowsApps package directory, NTUSER.DAT — all standard ACEs, no deny entries.
• Registry: ProfileList entry correct (State=0, ProfileImagePath correct), HKCU readable, no finsafe keys besides the service (now deleted).
• Disk / services: 182 GB free; AppXSvc, StateRepository, ClipSVC, TokenBroker all running.
• Component store: sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth both exit 0 — no corruption reported, no effect on the failure.

Remediation attempts that did NOT help

1. Stop + delete the finsafe-winhelper service.
2. Remove the user from finsafe-net and delete the group.
3. Delete all 90 accumulated AppContainer profile folders (finsafe-probe-*, finsafe-local) under %LOCALAPPDATA%\Packages (finsafe creates one per probe/run/self-confine).
4. Re-register Windows Terminal (Add-AppxPackage -Register AppxManifest.xml -DisableDevelopmentMode) — succeeds, no effect.
5. sfc + DISM (above).
6. Restore the AppRepository package-metadata files (surgery undone, state reverted).

A StateRepository database reset was attempted (stop AppXSvc/StateRepository/ClipSVC → rename C:\ProgramData\Microsoft\Windows\AppRepository) but the folder and DB files are protected against rename even after takeown + recursive Administrators grant (TrustedInstaller protection), so a clean reset could not be performed without Safe Mode.

Working hypothesis (for the developer)

finsafe creates one per-user AppContainer profile (finsafe-probe-<pid>, finsafe-local) on every probe/run/self-confine — 90 accumulated on this host since 8/31. Packaged-app activation creates a Desktop AppX container that consults the same per-user AppContainer/AppX registration state (StateRepository per-user partition). If repeated CreateAppContainerProfile churn corrupts that state, every packaged app fails at container creation ("configuring runtime", 0x800701F6), which would explain why:

• the failure is user-wide and survives deleting the helper service, the finsafe-net group, and the package folders (corruption persists), and
• a fresh Windows install was the only recovery the user found.

Questions for the maintainers

1. What in setup-windows / helper provisioning runs for the first time on a previously-failing host (see [bug]: Windows setup-windows cannot establish helper IPC — finsafe-winhelper named pipe rejects Read/Write connections (PIPE NOT AVAILABLE); WFP never registered; allowlist unusable (persists across reboots, build 26200) #37) that could corrupt per-user AppX/AppContainer registration state machine- or user-wide?
2. Is there a supported way to reset the per-user AppX activation state (short of Safe Mode AppRepository reset or reinstall)?
3. Does this reproduce on other hosts with repeated finsafe probe/run activity (many finsafe-probe-* AppContainer profiles)?

[0xReSan]

Follow-up: failure isolated to the affected user's per-user AppX state (machine is healthy)

Additional findings after the initial report:

1. New local admin user finsafediag activates packaged apps normally — same Windows Terminal executable, same machine, no AppModel-Runtime errors, process starts. The corruption is confined to the original user's (xuls2) per-user state, not machine-wide (AppXSvc/StateRepository/ClipSVC are healthy, AppRepository DB intact).

2. Per-user AppContainer registry pollution found and removed — HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\finsafe-* and ...\Mappings\S-1-15-2-* (DisplayName = finsafe-*) contained 91 registrations each (finsafe-local + 90 finsafe-probe-*), one per probe/run since first install. All 182 keys deleted (backed up first). No recovery — packaged-app activation still fails for xuls2 with 0x800701F6 even from a fresh full-profile process (Task Scheduler), while it succeeds for the new user.

3. Remaining suspects inside the user's per-user state: the per-user deployment records under C:\ProgramData\Microsoft\Windows\AppRepository\Packages\<family>\S-1-5-21-...-<user>.pckgdep (protected by TrustedInstaller; a full StateRepository reset is blocked without Safe Mode).

Conclusion for maintainers: repeated CreateAppContainerProfile churn (one finsafe-probe-<pid> per probe/run/self-confine, 90+ on this host over 6 days) pollutes/corrupts the per-user AppContainer/AppX activation state. Deleting the package folders, the helper service, the finsafe-net group, and the per-user AppContainer registry entries does NOT restore it; only a different user profile (or a Windows reinstall, as the user experienced previously) recovers. Recommend investigating what per-user state CreateAppContainerProfile churn leaves behind and whether cleanup should remove it, plus whether an upper bound / reuse of probe profile names is needed.

[Geeksfino]

Automated fix: A pull request is open for this issue.

• PR: Geeksfino/finsafe# (link)
• Status: In review — merge and public release are handled by a separate ship step.
• What changed: finsafe probe now reuses one stable AppContainer profile (finsafe-probe) instead of creating a new finsafe-probe-<pid> profile on every run. That stops the profile churn that likely corrupted your per-user AppX activation state.
• If your PC is already broken: upgrading alone may not repair existing corruption. You may still need the manual AppX/StateRepository recovery steps you already tried, or a reinstall, on affected hosts. The fix prevents new damage from repeated probes.
• You will get another comment here when a public release is published.

[Geeksfino]

Correction: PR link in the previous automated comment should be Geeksfino/finsafe#307 — https://github.com/Geeksfino/finsafe/pull/307

[Geeksfino]

Automated dispatch: Cloud agent started for Geeksfino/finsafe.

• Agent: bc-c06f3a49-3c85-4ca4-992c-bcab764d56c0
• Run: run-b36c5c36-c914-4c80-a3f7-a4ae8ca6c8b3

A PR will be opened when the agent finishes. Fixes will reference this issue.