graphcoded.exe crashes silently (0xC000001D) when USERPROFILE is redirected on Windows

[coneilen]

Describe the bug
graphcoded.exe exits immediately with 0xC000001D (STATUS_ILLEGAL_INSTRUCTION, the usual Windows signature of a Swift runtime trap) and writes nothing to stdout or stderr when USERPROFILE points at a directory other than the real profile. When the shell's supervisor starts the daemon, this shows up only as "daemon unavailable".

Each variable was changed alone, always with GRAPHCODE_SUPPORT_DIR set to a sandbox, using the packaged daemon:

Overridden variable	Result
none (support dir only)	listening
HOME	listening
USERPROFILE	exit 0xC000001D, no output
LOCALAPPDATA	listening
TEMP and TMP	listening

To reproduce

1. $env:GRAPHCODE_SUPPORT_DIR = <sandbox>, and set $env:USERPROFILE to an existing empty directory.
2. Run bin\graphcoded.exe from the built package.
3. The process exits with 0xC000001D and no output.

Expected behavior
Either run normally or exit with a clear diagnostic on stderr and a non-trap exit code.

Environment

• GraphCode version: 0.1.77 label, built locally from commit 59ebed1
• OS: Windows 11 Enterprise 26200 x64
• Swift 6.3.3

Additional context

• Likely candidates are FileManager.default.homeDirectoryForCurrentUser / NSHomeDirectory() call sites (for example IPC/WindowsNamedPipeTransport.swift, SupportDirectory.swift), or a force-unwrap or precondition on profile identity. The root cause was not determined; attach a debugger, or capture a crash dump with WER LocalDumps.
• GraphcodeKit/ is shared with macOS, so validate on both platforms per AGENTS.md.
• Redirecting USERPROFILE is uncommon in practice, but people try it when sandboxing.

[coneilen]

Status audit — 2026-10-01

Classification: needing evidence. Recommendation: keep open pending current reproduction and crash evidence. Confidence: medium-high.

The original runtime report is credible, but the root cause is not source-established. The daemon still prepares support paths before guarded startup (main.swift); SupportDirectory and named-pipe defaults still consult home-directory APIs. These are candidates, not proof of the 0xC000001D trap. Scheduled-task packaging coverage is not a direct-process proxy. #563 correctly recorded the diagnosis as unresolved; #568 performed no launch.

Remaining acceptance criteria: reproduce with a package built from exact current source while changing only USERPROFILE and using an explicit support directory; capture a WER/debugger stack identifying the trapping call; replace the trap with normal behavior or a clear diagnostic/non-trap exit; add a direct-process regression; and validate any shared-Swift change on Windows and macOS. Redirected USERPROFILE should not become the preview isolation mechanism.

Preview priority: P1 diagnosis/guardrail; not yet shown on the supported installed path.

[coneilen]

Exact current-main (c19e277e) reproduction and diagnosis completed. The release daemon stays listening with the real profile, but exits silently with 0xC000001D when only USERPROFILE is redirected alongside owned GRAPHCODE_SUPPORT_DIR/TEMP/TMP. CDB plus embedded DWARF identifies the ud2 as the out-of-range [0] in SupportDirectory.legacyURL (SupportDirectory.swift:151) after Foundation returns no application-support URLs. Commit a9eac4da replaces that trap with a fallback and adds injected unit and production direct-process coverage; exact-head Windows swift-production passed 101 XCTest cases, 6 Swift Testing cases, the new regression, release builds, and the existing clean-runtime smoke. The branch is pushed as coneilen-microsoft-diagnose-redirected-userprofile-daemon-c. Keep this issue open: app-native PR creation is currently blocked by an Enterprise Managed User 403, and exact-head macOS shared CI still must pass before merge.

[coneilen]

PR #593 is now open at exact head 87e510145c529b8eb60f9266d49699ca315036dd. The LF-only follow-up is included; git diff --check, the direct-process redirected-USERPROFILE regression, swift-format, and Windows swift-production (101 XCTest + 6 Swift Testing cases, release builds, regression, and clean runtime smoke) pass. Keep the issue open until exact-head Windows and mandatory macOS shared CI pass and the PR merges.