---
name: hfenduleam-daemon-path-claude-spawn
description: "2026-07-24 HFENDULEAM incident: post-0.41.1 manual daemon restart lost claude from PATH — every FRESH claude spawn failed node-wide (lia dead-harness/ENDPOINT_RUN_SESSION_TIMEOUT, psyches striking out). Root = env, not code. HKCU PATH fix STAGED; daemon bounce HELD by operator (agents mid-work)."
metadata: 
  node_type: memory
  type: project
  originSessionId: b5bfa053-0922-4c48-9e08-fe64cebcde7e
  modified: 2026-07-24T10:58:08.929Z
---

**Incident (2026-07-24):** after the v0.41.1 apply + manual daemon restart, every FRESH claude spawn on HFENDULEAM failed `program not found` / shim `claude is not on path`: lia `spt endpoint run` → instant writer-exit → `LIVENESS_RECONCILE_OFFLINE (dead harness)` → `ENDPOINT_RUN_SESSION_TIMEOUT` (25s, client-side message misleads — says "retry with spt rc", real cause daemon-side spawn fail); doyle psyche-host FAILED, flynn + liam psyche strikes 3/3. Surviving sessions unaffected (processes never respawned).

**Root:** claude.exe lives ONLY at `C:\Users\decid\.local\bin\claude.exe` (native install 2.1.218, healthy); that dir was on NO persistent PATH (HKCU or HKLM) and no shim exists in any registry-PATH dir. Old daemon inherited a working PATH from whatever originally launched it; today's manual restart inherited a shell env WITHOUT it. Session spawns route `{adapter_dir}/claude-spt launch` → shim resolves `claude` against daemon-inherited PATH.

**Ruled out (measured):** v0.41.1 code regression (zero spawn/resolution delta v0.41.0..v0.41.1 — only nethost/pump-update/test files); adapter-shim swap (claude-spt.exe mtime 7/21, worked all 7/22-23); claude.exe broken (runs). Previous daemon log (`daemon.stderr.log.1`, 684k lines): ZERO `program not found` — breakage starts exactly at the restart.

**Fix state:** ✅ `C:\Users\decid\.local\bin` APPENDED to HKCU Environment Path 2026-07-24 (type ExpandString preserved, 696→722 chars; backup at session scratchpad `hkcu-path-backup.txt`). ⏳ **Daemon bounce PENDING — operator ruled HOLD (agents mid-work).** Bounce = `spt daemon stop --force` (kills 9 live sessions; they respawn healthy) + `spt daemon start`. ⚠ **Bounce from a FRESH shell (opened after the PATH edit) or via the scheduled task** — a stale shell hands the daemon its old PATH again (daemon env = inherited at spawn, not registry-read).

**Verify after bounce:** `spt endpoint run --id lia` attaches; `spt endpoint list` SELF psyche-host healthy (daemon reseeds psyches).

**Seeds spotted en route (not filed yet):** (1) ~280 stale `deadline-*.json` in spt-core home root — hygiene sweep candidate; (2) ENDPOINT_RUN_SESSION_TIMEOUT message hides daemon-side spawn failure — error should surface the dead-harness spawn error to the client ([[spt-core-findings-backlog]] candidate); (3) psyche strike-out (3/3) has no operator-visible alarm beyond `endpoint list` SELF line.

**Also:** daemon bounce (once run) doubles as NOTHING for field legs — sessions die so dispatcher replay has nothing to re-serve; the leg-3 vehicle is `spt daemon refresh` (sessions preserved, same request_brain_restart seam, banked doyle ruling in [[v0394-field-bugs-hertz-rca]]).

## RESOLVED 2026-07-24 — combined bounce
- ✅ **FIXED.** HKCU PATH edit (`.local\bin` appended, type-preserving) + daemon bounce (emphasys mjs swap first, then `stop --force` + scheduled-task start). Daemon pid 48508, 0.41.1, gen-0 cold. **lia ONLINE** (daemon spawned claude harness clean = PATH fix proven), zero program-not-found, claude resolves.
- ⚠ **COLLATERAL: liam went OFFLINE** (was ONLINE pre-bounce; spt-progress-tool/flynn lane, not incident target). Watch — may just need a wake, or its harness did not re-establish.
- **Bounce doubled as the F-033 capture window** (see [[daemon-lifecycle-progress]]): fresh hertz session drains CLEAN under emphasys instrumented adapter → F-033 verdict = stuck-session-state-specific, not code-dead.

## REOPENED 2026-07-24: broader PATH corruption (HKLM/nvm), gh casualty
- ⚠ **NOT fully fixed — SECOND, SEPARATE corruption found (operator flagged gh missing in new terminals).** Root: **nvm-windows corrupted the SYSTEM (HKLM) PATH on 2026-07-22 21:56:21** (key last-write, verified — TWO DAYS before doyle any edit). Signature: HKLM Path = REG_SZ (should be REG_EXPAND_SZ), EXACTLY 1024 chars (setx truncation limit), duplicate Windows entries (system32/Wbem/openssh/VSCode ×2 = user+machine concat), ends with `C:\Users\decid\AppData\Local\nvm` = $NVM_HOME (user path bled into machine PATH). nvm-windows reads merged PATH → appends its dirs → setx-writes HKLM → truncates at 1024 → dropped tail incl. `C:\Program Files\GitHub CLI` (exists on disk, on NEITHER hive) = why new terminals cannot find gh.
- ✅ **doyle HKCU edit PROVEN INNOCENT:** current HKCU == backup + `;C:\Users\decid\.local\bin` EXACTLY (verified True), still REG_EXPAND_SZ, 696→722; HKLM untouched by doyle (last-write 07-22 vs doyle work 07-24). Two hives, two days, two issues.
- ⏳ **AWAITING OPERATOR GO (system change, no unilateral write):** opt1 = append `C:\Program Files\GitHub CLI` to HKCU (safe, non-elevated, fixes gh now, leaves HKLM broken); opt2 = full HKLM repair (elevation: REG_SZ→REG_EXPAND_SZ, dedup, drop NVM_HOME bleed, re-add GitHub CLI — but 1024-cut dropped unknown others; RECOVER exact pre-corruption PATH from a pre-21:56 process, e.g. rc-doyle pid 8392 started 07-22 20:10, still holds full old PATH in env). ⚠ **nvm-windows WILL re-truncate on next `nvm use`/install** unless its PATH-switching is changed — recurrence root.
- 📌 **flynn unblocked + post-fix cleanup owed:** liam bridged a node-global cred `alchemy-github-token` into Windows CredentialManager (credman = step 3 of alchemy's GitHub resolve chain, AHEAD of the broken bare-`gh` tail), so flynn's alchemy reads work now — NOT blocked pending bounce. ⭐ **DOYLE OWES flynn a PING when HKCU-PATH + daemon bounce lands** → shells revert to gh-tail resolve, bridged cred becomes removable, flynn pulls it (no stray stored token). Track through fix completion.
- 📌 **flynn digest-seal question QUEUED behind this incident** (separate topic): should the IDLE transition SEAL a trailing partial turn (assign seq to committed entries) instead of waiting for next user-input? A finished-idle turn deadlocks a replay-safe seq-cursor scanner (flynn Liaison repro: drive-tag sat seq-less in trailing partial turn, unseen until an unrelated nudge closed the turn). flynn HOLDING the consumer-side ephemeral-dedup workaround pending doyle ruling (told not to build — idle-seals ruling would waste it). Ground in digest seq/seal path + idle-transition seam ([hooks.Idle]=api state idle, authoritative). Non-blocking, manual-nudge interim.
- 🔧 **HKLM REPAIR IN PROGRESS via swan (elevated agent, operator-paired 2026-07-24).** Ground-truth pre-corruption PATH RECOVERED by reading env of pid 8392 (rc doyle, started 07-22 20:10, pre-21:56-truncation) via NtQueryInformationProcess+ReadProcessMemory PEB walk — 2013 chars, GitHub CLI present (saved scratchpad/recovered-old-path-pid8392.txt). Derived restored HKLM = 28 machine entries, ~1008 chars, REG_EXPAND_SZ, deduped, 5 dropped dirs re-added (GitHub CLI/flutter/Tailscale/CMake/Arduino, all on disk), NVM_HOME+nvm4w bleed removed. Ready elevated script scratchpad/swan-hklm-fix.ps1 (backup-first → Set-ItemProperty -Type ExpandString → verify → WM_SETTINGCHANGE broadcast) SENT to swan. ⚠ WRITE RULES sent: ExpandString NOT setx (re-truncates) NOT [Environment]::SetEnvironmentVariable (writes REG_SZ); do NOT touch HKCU (known-good). Awaiting swan verification output.
- 📌 **nvm-windows = the culprit tool** (coreybutler/nvm-windows): Go-based Node manager, switches via NVM_SYMLINK; its install/helper setx-rewrites PATH → 1024 truncation + REG_SZ + user-into-machine merge. WILL RE-CORRUPT on next nvm use/install. Operator remediation options: stop its PATH manipulation / replace with fnm or volta (no system-PATH setx).
- 📌 **HKCU user-PATH oddity found (separate, operator cleanup):** recovered PATH shows malformed user entry ":\Users\decid\AppData\Roaming\Python\Python312\Scripts" (missing leading C) — not in current HKCU, pre-existing; flag but not HKLM scope.
- ⭐ **swan pre-write catch (2026-07-24): restored value dropped `C:\Windows\System32\AMD`** — first entry in current HKLM, on disk, but ABSENT from pid-8392 snapshot (20:10) ⇒ AMD added to machine PATH between 20:10 and the 21:56 corruption (likely AMD GPU driver update prepending its dir). RULING: KEEP it (legit live entry my pre-corruption snapshot predated, not artifact). Final HKLM = AMD prepended + 28 = ~1032 chars. ⭐ **1024 is a setx-ONLY artifact, NOT a registry limit** — Set-ItemProperty -Type ExpandString has no cap; >1024 via proper registry write is CORRECT (total env ~1032 HKLM + ~722 HKCU, trivial). LESSON: a process-env snapshot is a point-in-time recovery source — diff it against surviving-live entries before overwrite (swan did; AMD was the only discrepancy). swan writing now, verify block owed.
- ✅ **nvm-windows version answered (operator Q):** installed = 1.2.2 (Jan 2025) = the LATEST release; setx/1024 truncation NOT fixed in any release through 1.2.2 (issues #224/#546/#467/#913 long-standing/open); box empirically corrupted ON 1.2.2 ⇒ no upgrade fixes it. Recurrence fix = stop nvm PATH writes / replace with fnm or volta (no system-PATH setx). Symlink C:\nvm4w\nodejs can stay on PATH.
- ✅ **HKLM REPAIR DONE (swan, elevated, independently verified 2026-07-24 03:12):** REG_EXPAND_SZ, len 1032, 29 entries, AMD-first preserved, GitHub CLI present, no nvm bleed, no internal dups. Backup: C:\Users\decid\hklm-path-backup-20260724-031213.txt (raw REG_SZ len 1024, pre-write). WM_SETTINGCHANGE broadcast. **New terminals now resolve gh** (post any env-refresh).
- 🔧 **nvm→volta migration DISPATCHED to swan (elevated script, operator-ordered).** JUDGMENT: **volta over fnm** — node spawns shells programmatically here (broker/daemon-inherited env); volta stable-shim-bin-on-PATH resolves node with NO per-shell hook (closest to nvm symlink, minus setx); fnm shell-hook fragile for broker shells. ⭐ Script does NOT run nvm Inno uninstaller (PATH-editing uninstaller = setx re-truncation risk on the just-fixed HKLM) — manual PATH-safe removal instead (HKCU strip via ExpandString asserting GitHub CLI stays; NVM_HOME/NVM_SYMLINK both hives; delete AppData\nvm + C:\nvm4w; winget Volta.Volta 2.0.2 + node LTS; prior nvm node=25.8.2 Current → LTS default, operator can node@25). NO setx. Awaiting swan PRE/POST verify.
- ⏳ **SEQUENCE REMAINING:** swan nvm→volta → **THEN doyle drives ONE operator-gated daemon bounce** (picks up GitHub CLI-restored + nvm-gone + volta-added in one env refresh for broker/alchemy shells) → **ping flynn** to remove bridged alchemy-github-token cred. nvm-windows 1.2.2 = latest, bug unfixed → volta replacement IS the recurrence fix.
- 🔧 **CLAUDE CODE HOOKS BROKEN BY nvm DELETION — IDENTIFIED + REPAIRED (operator screenshot 2026-07-24).** Symptom: every PreToolUse/PostToolUse Write/Edit/Read hook errored `C:/nvm4w/nodejs/node.exe: No such file or directory` (non-blocking). Root: 2 settings.json files hardcoded the DELETED nvm symlink node path to run gsd-*.js hooks. FIXED both: `~/.claude/settings.json` (6 hooks + statusline) AND `~/.ccs/shared/settings.json` (6 hooks + statusline, SHARED across ccs agent instances = would break other agents too). Repointed all 13 → `C:/Program Files/Volta/node.exe` (volta STABLE SHIM: exists now, returns v24.18.0, self-resolves active version WITHOUT needing VOLTA_HOME in env ⇒ works in THIS stale-env session immediately, survives node version changes). ⭐ Chose ABSOLUTE volta-shim path NOT bare `node` — confirmed bare `node` = command-not-found in the running session (stale env, volta not on PATH until restart); absolute path works NOW. Backups in scratchpad. Both files JSON-valid post-edit; all 7 gsd hook scripts exist + volta node parses them. SWEPT .claude/.ccs/instances/project/.mcp.json/.claude.json = NO other nvm4w hardcodes. ⚠ LESSON: deleting a version-manager symlink breaks everything that hardcoded it — sweep configs on any such removal.
- ✅ **COMPAT SYMLINK created (operator ran elevated 2026-07-24):** C:\nvm4w\nodejs → C:\Program Files\Volta (directory SymbolicLink). Old hardcoded C:\nvm4w\nodejs\node.exe (+npm.exe/npx.exe) resolve to volta shims (node v24.18.0). Belt-and-braces safety net for any missed nvm-path hardcode. ⚠ tradeoff noted to operator: keeps old hardcodes working = hides them rather than forcing a proper volta fix.

## INCIDENT STATUS 2026-07-24 (PATH corruption, near-complete)
**DONE:** root=nvm-windows 1.2.2 (latest, setx-1024 bug unfixed) truncated HKLM 07-22 → dropped GitHub CLI (my HKCU .local\bin edit proven innocent). HKLM repaired (swan, pid-8392 recovery, REG_EXPAND_SZ, GitHub CLI+all machine dirs, AMD-preserved, backed up). HKCU nvm-removed+volta-added. nvm UNINSTALLED, volta 2.0.2 + node 24 LTS installed. Claude Code hooks (2 settings.json / 13 cmds) repointed nvm→volta shim (work now). Compat symlink at old path. Config sweep clean.
**PENDING (operator-gated): daemon bounce** — running daemon 48508 still lacks GitHub CLI + volta node in its env, so broker/alchemy shells need it; bounce also cycles 35 nvm node.exe → THEN doyle deletes locked AppData\nvm + pings flynn to remove bridged alchemy-github-token cred. Nothing broken now (terminals+hooks fixed, flynn stopgapped, old node path symlinked).
**WATCH:** volta self-update may re-flip PATH REG_SZ (swan Issue-1); flynn digest-seal ruling queued.

## CLEANUP + BOUNCE DEFERRED 2026-07-24 (doyle respawn session)
- ⚠ **`<sptc_wake>` resume prompt was STALE** — told next session to launch staged `spt-bounce-cleanup.ps1` (force-stop daemon → scheduled-task start → delete AppData\nvm → ping flynn). Verified before running: bounce log ABSENT (script never ran), daemon **48508 already 0.41.1 + healthy** (7 live agents up, lia+liam both alive), node resolves via nvm4w v24.18.0. Halted the destructive script.
- ✅ **Operator ruled CLEANUP-ONLY, skip the bounce** (overrode the wake). Done this session: deleted stale `C:\Users\decid\AppData\Local\Temp\spt-bounce-cleanup.ps1`; deleted `C:\Users\decid\AppData\Local\nvm` (v25.8.2). ⭐ **AppData\nvm was NOT locked** — plain `rm -rf` succeeded exit 0; the plan's assumption that a bounce was needed to unlock it was WRONG. No daemon disruption required.
- ⏳ **DAEMON BOUNCE STILL DEFERRED (operator choice).** Consequence: daemon 48508 keeps its pre-HKLM-repair env → broker/alchemy shells spawned by it still lack GitHub CLI + volta on PATH. Terminals/hooks the operator opens fresh are fine (fixed via HKLM+hooks repair); only daemon-inherited spawns carry the stale env. Bounce (or `spt daemon refresh`) whenever convenient to pick up gh+volta.
- ⏳ **flynn cred-removal ping NOT sent — correctly.** It was gated on the bounce landing (shells revert to gh-tail resolve → bridged `alchemy-github-token` becomes removable). Bounce didn't land ⇒ bridged cred still in use ⇒ leave it. Ping owed WHEN the deferred bounce eventually runs.
- **NET:** incident functionally closed; only the optional env-refresh bounce + its downstream flynn ping remain, both deferred, nothing broken.