@@ -38,6 +38,7 @@ use windows_sys::Win32::Foundation::ERROR_ACCOUNT_DISABLED;
 use windows_sys::Win32::Foundation::ERROR_LOGON_FAILURE;
 use windows_sys::Win32::Foundation::ERROR_NO_SUCH_LOGON_SESSION;
 use windows_sys::Win32::Foundation::ERROR_NOT_FOUND;
+use windows_sys::Win32::Foundation::ERROR_SERVICE_ALREADY_RUNNING;
 use windows_sys::Win32::Foundation::GetLastError;
 use windows_sys::Win32::Foundation::HANDLE;
 use windows_sys::Win32::System::Diagnostics::Debug::SetErrorMode;
@@ -58,8 +59,8 @@ const RUNNER_ERROR_MODE_FLAGS: u32 = 0x0001 | 0x0002;
 const WAIT_OBJECT_0: u32 = 0;
 
 #[derive(Debug)]
-struct RunnerLogonError {
-    code: u32,
+pub(crate) struct RunnerLogonError {
+    pub(crate) code: u32,
 }
 
 impl std::fmt::Display for RunnerLogonError {
@@ -146,8 +147,16 @@ pub(crate) fn retry_runner_spawn_once<T>(
     mut spawn: impl FnMut(SandboxCreds) -> Result<T>,
     refresh: impl FnOnce() -> Result<SandboxCreds>,
 ) -> Result<T> {
-    let result = match spawn(sandbox_creds) {
+    let result = match spawn(sandbox_creds.clone()) {
         Ok(result) => Ok(result),
+        // No runner (and therefore no user command) started. Keep credentials unchanged.
+        Err(err)
+            if err
+                .downcast_ref::<RunnerLogonError>()
+                .is_some_and(|err| err.code == ERROR_SERVICE_ALREADY_RUNNING) =>
+        {
+            spawn(sandbox_creds)
+        }
         Err(err) if is_refreshable_sandbox_creds_error(&err, command) => refresh().and_then(spawn),
         Err(err) => Err(err),
     };
@@ -462,13 +471,106 @@ mod tests {
     use super::RunnerLogonError;
     use super::RunnerStartupError;
     use super::is_refreshable_sandbox_creds_error;
+    use super::retry_runner_spawn_once;
+    use crate::identity::SandboxCreds;
     use crate::ipc_framed::ErrorPayload;
     use crate::ipc_framed::ErrorStage;
     use pretty_assertions::assert_eq;
     use windows_sys::Win32::Foundation::ERROR_ACCOUNT_DISABLED;
     use windows_sys::Win32::Foundation::ERROR_LOGON_FAILURE;
     use windows_sys::Win32::Foundation::ERROR_NO_SUCH_LOGON_SESSION;
     use windows_sys::Win32::Foundation::ERROR_NOT_FOUND;
+    use windows_sys::Win32::Foundation::ERROR_SERVICE_ALREADY_RUNNING;
+
+    #[test]
+    fn logon_service_already_running_retries_once_without_refresh() {
+        let mut attempts = 0;
+        let result = retry_runner_spawn_once(
+            SandboxCreds {
+                username: "sandbox-user".into(),
+                password: "test-only".into(),
+            },
+            &[],
+            |creds| {
+                attempts += 1;
+                assert_eq!(
+                    (creds.username.as_str(), creds.password.as_str()),
+                    ("sandbox-user", "test-only")
+                );
+                if attempts == 1 {
+                    Err(anyhow::Error::new(RunnerLogonError {
+                        code: ERROR_SERVICE_ALREADY_RUNNING,
+                    })
+                    .context("runner launch failed"))
+                } else {
+                    Ok(42)
+                }
+            },
+            || panic!("1056 must not refresh credentials"),
+        );
+        assert_eq!((result.unwrap(), attempts), (42, 2));
+    }
+
+    #[test]
+    fn logon_service_already_running_stops_after_two_failures() {
+        let mut attempts = 0;
+        let err = retry_runner_spawn_once::<()>(
+            SandboxCreds {
+                username: "sandbox-user".into(),
+                password: "test-only".into(),
+            },
+            &[],
+            |_| {
+                attempts += 1;
+                Err(RunnerLogonError {
+                    code: ERROR_SERVICE_ALREADY_RUNNING,
+                }
+                .into())
+            },
+            || panic!("1056 must not refresh credentials"),
+        )
+        .unwrap_err();
+        assert_eq!(
+            (
+                attempts,
+                err.downcast_ref::<RunnerLogonError>().unwrap().code
+            ),
+            (2, ERROR_SERVICE_ALREADY_RUNNING)
+        );
+    }
+
+    #[test]
+    fn child_service_already_running_does_not_replay_command() {
+        let mut attempts = 0;
+        let err = retry_runner_spawn_once::<()>(
+            SandboxCreds {
+                username: "sandbox-user".into(),
+                password: "test-only".into(),
+            },
+            &[],
+            |_| {
+                attempts += 1;
+                Err(RunnerStartupError::new(ErrorPayload {
+                    message: "child startup failed".into(),
+                    stage: ErrorStage::SpawnChild,
+                    windows_error_code: Some(ERROR_SERVICE_ALREADY_RUNNING),
+                })
+                .into())
+            },
+            || panic!("1056 must not refresh credentials"),
+        )
+        .unwrap_err();
+        assert_eq!(
+            (
+                attempts,
+                err.downcast_ref::<RunnerStartupError>()
+                    .unwrap()
+                    .payload
+                    .windows_error_code,
+            ),
+            (1, Some(ERROR_SERVICE_ALREADY_RUNNING))
+        );
+    }
 
     #[test]
     fn refreshable_sandbox_creds_error_recognizes_credential_and_child_start_failures() {
 
@@ -6,6 +6,7 @@ use crate::ipc_framed::ErrorPayload;
 use crate::ipc_framed::ErrorStage;
 use crate::ipc_framed::SpawnRequest;
 use crate::resolved_permissions::ResolvedWindowsSandboxPermissions;
+use crate::runner_client::RunnerLogonError;
 use crate::runner_client::RunnerStartupError;
 use codex_protocol::models::PermissionProfile;
 use codex_utils_absolute_path::AbsolutePathBuf;
@@ -16,7 +17,10 @@ use std::cell::RefCell;
 use std::collections::HashMap;
 use std::path::Path;
 use std::path::PathBuf;
+use std::process::Command;
+use tempfile::tempdir;
 use windows_sys::Win32::Foundation::ERROR_NO_SUCH_LOGON_SESSION;
+use windows_sys::Win32::Foundation::ERROR_SERVICE_ALREADY_RUNNING;
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 struct SpawnObservation {
@@ -43,8 +47,7 @@ struct RefreshObservation {
     proxy_settings_mode: WindowsSandboxProxySettingsMode,
 }
 
-#[test]
-fn retry_uses_original_unified_exec_request_and_stops_after_second_failure() {
+fn runner_transport_request() -> RunnerTransportRequest {
     let workspace_root = AbsolutePathBuf::from_absolute_path(PathBuf::from(r"C:\workspace"))
         .expect("absolute workspace root");
     let permission_profile = PermissionProfile::workspace_write();
@@ -61,16 +64,16 @@ fn retry_uses_original_unified_exec_request_and_stops_after_second_failure() {
             "http://localhost:1234".to_string(),
         ),
     ]);
-    let request = RunnerTransportRequest {
-        permissions: permissions.clone(),
+    RunnerTransportRequest {
+        permissions,
         codex_home: PathBuf::from(r"C:\Users\codex"),
         cwd: PathBuf::from(r"C:\workspace"),
         env_map: env_map.clone(),
         logs_base_dir: Some(PathBuf::from(r"C:\Users\codex\.sandbox")),
         spawn_request: SpawnRequest {
             command: vec!["pwsh.exe".to_string(), "-NoProfile".to_string()],
             cwd: PathBuf::from(r"C:\workspace"),
-            env: env_map.clone(),
+            env: env_map,
             permission_profile,
             workspace_roots: vec![workspace_root],
             codex_home: PathBuf::from(r"C:\Users\codex\.sandbox"),
@@ -89,13 +92,18 @@ fn retry_uses_original_unified_exec_request_and_stops_after_second_failure() {
         deny_write_paths_override: vec![PathBuf::from(r"C:\workspace\.codex")],
         proxy_enforced: true,
         proxy_settings_mode: WindowsSandboxProxySettingsMode::Preserve,
-    };
+    }
+}
+
+#[test]
+fn retry_uses_original_unified_exec_request_and_stops_after_second_failure() {
+    let request = runner_transport_request();
     let expected_spawn_request =
         serde_json::to_value(&request.spawn_request).expect("serialize spawn request");
     let expected_refresh = RefreshObservation {
-        permissions,
+        permissions: request.permissions.clone(),
         cwd: request.cwd.clone(),
-        env_map,
+        env_map: request.env_map.clone(),
         codex_home: request.codex_home.clone(),
         read_roots_override: request.read_roots_override.clone(),
         read_roots_include_platform_defaults: true,
@@ -191,3 +199,62 @@ fn retry_uses_original_unified_exec_request_and_stops_after_second_failure() {
     );
     assert_eq!(vec![expected_refresh], *refresh_observations.borrow());
 }
+
+#[test]
+fn unified_exec_logon_1056_retries_original_request_and_runs_command_once() {
+    let workspace = tempdir().expect("temporary workspace");
+    let mut request = runner_transport_request();
+    request.cwd = workspace.path().to_path_buf();
+    request.spawn_request.cwd = request.cwd.clone();
+    request.spawn_request.command = vec![
+        std::env::var("COMSPEC").expect("Windows command interpreter"),
+        "/d".into(),
+        "/c".into(),
+        "echo launched>>command-launches.txt".into(),
+    ];
+    let expected = SpawnObservation {
+        codex_home: request.codex_home.clone(),
+        cwd: request.cwd.clone(),
+        username: "sandbox".into(),
+        password: "unchanged-test-password".into(),
+        logs_base_dir: request.logs_base_dir.clone(),
+        spawn_request: serde_json::to_value(&request.spawn_request).expect("serialize request"),
+    };
+    let mut attempts = Vec::new();
+    let status = spawn_runner_transport_with_retry(
+        SandboxCreds {
+            username: expected.username.clone(),
+            password: expected.password.clone(),
+        },
+        &request,
+        |codex_home, cwd, creds, logs_base_dir, spawn_request| {
+            attempts.push(SpawnObservation {
+                codex_home: codex_home.to_path_buf(),
+                cwd: cwd.to_path_buf(),
+                username: creds.username.clone(),
+                password: creds.password.clone(),
+                logs_base_dir: logs_base_dir.map(Path::to_path_buf),
+                spawn_request: serde_json::to_value(&spawn_request).expect("serialize request"),
+            });
+            if attempts.len() == 1 {
+                return Err(RunnerLogonError {
+                    code: ERROR_SERVICE_ALREADY_RUNNING,
+                }
+                .into());
+            }
+            Ok(Command::new(&spawn_request.command[0])
+                .args(&spawn_request.command[1..])
+                .current_dir(&spawn_request.cwd)
+                .status()?)
+        },
+        |_, _, _, _, _, _, _, _, _, _, _| panic!("1056 must never refresh credentials"),
+    )
+    .expect("unified exec should recover from runner logon 1056");
+    assert!(status.success());
+    assert_eq!(attempts, vec![expected.clone(), expected]);
+    assert_eq!(
+        std::fs::read_to_string(workspace.path().join("command-launches.txt"))
+            .expect("read command launch marker"),
+        "launched\r\n"
+    );
+}