[BUG] Claude Desktop (Windows x64) — recurring "freeze-then-vanish" crash with zero forensic trace across all standard channels
Preflight Checklist
- [x] I have searched existing issues and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code
What's Wrong?
Over roughly two weeks of dedicated investigation, Claude Desktop has repeatedly frozen and then silently disappeared — process gone, app relaunches on its own, conversation state intact — leaving no trace whatsoever in the minidump folder, Crashpad, Windows Application log, System log, or Reliability Monitor. Six confirmed occurrences were correlated against the app's own main.log, revealing two distinct precursor patterns that may represent two separate mechanisms converging on the same symptom:
- Long stall-accumulation: several occurrences were preceded by large cumulative
event-loop-stallbacklogs (up to ~44.7 minutes), correlating with slowgit status/git fetchoperations against a large, binary-heavy repository. - Concurrency: other occurrences had minimal or no stall backlog, but shared multiple Claude sessions actively warming/working simultaneously.
Regardless of which trigger applies, nothing explains why these crashes produce zero forensic trace across every standard Windows diagnostic channel — a genuine kernel crash (separately confirmed elsewhere in this same investigation, see Additional Information) reliably produces minidumps and event-log entries; these do not.
What Should Happen?
Claude Desktop should not become unresponsive and silently vanish without producing any diagnosable trace. At minimum, a crash of this kind should generate a standard Windows crash report (minidump, Application-log entry, or Reliability Monitor record) so it can be self-diagnosed or reported usefully, rather than requiring the multi-day manual log correlation performed here.
Error Messages/Logs
No Windows-level crash artifact exists for any of the eight occurrences (checked: minidump folder, Crashpad, Application log, System log, Reliability Monitor — all empty for these timestamps). Evidence is entirely from `main.log`/`main1.log` correlation, e.g. (representative excerpt, occurrence #4):
[event-loop-stall] main process blocked ... cumulative 2681078ms ...
[GitStatusService] Failed to check git status: git status timed out
<crash/relaunch follows ~6s later>
No stack trace, exception, or bugcheck code is available for any of these eight events — that absence is itself the core of this report.
Steps to Reproduce
Not reliably reproducible on demand. Confirmed occurrences and their precursor stall backlog:
| # | Timestamp | Cumulative stall backlog before crash | Notes |
|---|---|---|---|
| 1 | 2026-08-10 12:03:58 | — | First occurrence |
| 2 | 2026-08-10 17:21:42 | — | |
| 3 | 2026-08-10 17:22:07 | — | 25s after #2 |
| 4 | 2026-08-11 14:57:52 | ~2,681,078ms (~44.7 min), 1,353 stalls | Largest backlog on record; preceded by git status timed out |
| 5 | 2026-08-11 14:58:14 | ~2 stalls only | 22s after #4's restart |
| 6 | 2026-08-11 15:00:28 | — | 2m14s after #5; preceded by git fetch origin master timing out |
| 7 | 2026-08-11 20:47:29 | ~432,970ms (~7.2 min) | Preceded by a slow fetchGitDiff (18,938ms) |
| 8 | 2026-08-11 21:04:41 | ~64,521ms (~1.1 min) — lowest on record | Occurred while a second, different session was actively warming concurrently |
Claude Model
Not sure / Multiple models
Is this a regression?
Yes, this worked in a previous version
Last Working Version
The version around 3 months ago
Claude Code Version
Claude 1.37937.0 (61bfd4) 2026-08-25T05:51:27.000Z
Platform
Anthropic API
Operating System
Windows
Terminal/Shell
Other
Additional Information
Claude Desktop app (Windows), not invoked from a terminal.
Environment: Windows 11 Pro, Version 25H2 (OS Build 26200.9168), x64. Intel i7-12700K, AMD RX 6800 XT, 64GB DDR4. Claude Desktop versions observed across the investigation: 1.26832.0 through at least 1.34493.1.0.
Leading untested theory (~55% confidence): silent termination by Windows Process Lifecycle Manager (PLM) — normally used to suspend/resume/terminate UWP-style apps under resource pressure — could plausibly kill a hung MSIX-packaged process without generating a normal crash report. Not directly tested; plmdebug.exe (the tool that could query PLM state live during a hang) is not present on the investigating machine and would require installing the full Windows SDK "Debugging Tools for Windows" component.
Related but distinct issues investigated in the same effort, for context (not this bug):
- A genuine kernel BSOD (bugcheck
0x50) confirmed via WinDbg, caused bygit.exe/Malwarebytesfarflt11.sysfilter-driver interaction — a documented, known Malwarebytes issue with full forensic evidence. Mitigated via a driver-level exclusion. - AMD GPU driver crashes (
amdkmdag.sys, bugcheck0x141) — 10 historical reports, all predating an 8/3 driver update, none since. - A separate AMD driver fault (
amdfendr.sys, bugcheck0xa2000002). - A leaked AppContainer Job object causing "another program is using this file" on relaunch — filed as a separate report; may explain some historical "already open" incidents in this investigation, but not the freeze-then-vanish signature itself (that one involves the process disappearing mid-session, not failing to relaunch afterward).
Workarounds considered, not yet systematically tested:
- Run one Claude Code session at a time (targets the concurrency mechanism).
- Reduce repository size/trim large tracked binaries to cut
git status/git fetch/gitDifflatency (targets the stall-accumulation mechanism). - Enable Windows PLM analytic/debug event channels to directly test the PLM theory — attempted, inconclusive; the initially-suspected
Microsoft-Windows-AppModel-Runtimechannel's available event types (AppContainer creation/integrity checks) don't match PLM's suspend/resume/terminate responsibilities, so this remains unresolved.
Suggested fixes:
- Investigate whether the MSIX-packaged Desktop app can be silently terminated by PLM under a hung/unresponsive state, and whether that path can be made to produce a normal crash report.
- Consider a graceful-degradation warning when
event-loop-stallaccumulation crosses a threshold, before the process becomes unresponsive. - Consider whether concurrent sessions contribute to main-process instability independent of stall backlog.
- A crash with zero trace across every standard diagnostic channel is a defect independent of root cause — it leaves users unable to self-diagnose or report usefully.
Showing cached comments. Read the full discussion on GitHub ↗
3 Comments
I've been independently tracking the same symptom (Claude Desktop on Windows freezing then vanishing, zero trace in minidump/Crashpad/Application log/System log/Reliability Monitor) with a custom watchdog that holds a handle on the process, so I can add a few data points this report doesn't have.
Exit code, captured directly (not from any Windows log — those stayed empty for us too):
0xCFFFFFFF=STATUS_APPLICATION_HANG, consistently, across 9 occurrences over 2 weeks (2026-08-16 to 2026-08-30). This string doesn't appear anywhere in the app bundle, so it's Windows' own hang-kill code, not something the app emits. This may explain part of the "zero trace" mystery: for MSIX-packaged Claude Desktop, the classicHKLM...\Windows Error Reporting\Hangsregistry path expectsEventType=AppHang, but this app's hang reports (when they exist at all) useEventType=MoAppHang(the MSIX/packaged-app hang path), which that registry key doesn't route dumps for. Separately, I noticed the app appears to have moved off MSIX packaging entirely at some point between 2026-08-19 and 2026-08-29 (now running from a non-MSIX install path) — whether that changes anything about hang reporting, I haven't verified.A live hang capture (one of the 9), with a minidump:
A companion tool of mine polls
IsHungAppWindowand captures a minidump + per-thread CPU deltas the moment a hang is detected. For the most recent occurrence (2026-08-30 06:47:58 local), the UI thread consumed 484ms of a 672ms sampling window right before capture — i.e., it was spinning/doing sustained synchronous work, not blocked/waiting. The dump itself only resolves one stack frame per thread (no symbols available for this build), so I can't identify what code was running.Correlation with
main.log'sgit status timed out:Across the 3 occurrences where I still had the relevant
main.logwindow, all 3 show[GitStatusService] Failed to check git status: git status timed outas the last (or near-last) log line before the process went dark. That matches the precursor pattern described in this report. However, for the one occurrence where I have clear ordering, the[event-loop-stall] main process blocked for 7726msline appears before the git-status-timeout line by about 1 second — so I'd read this as "consistent with, but not proof of, git status being the trigger." It's equally plausible both are downstream symptoms of something else blocking the main process (my repo lives on a local, non-network drive, so I can rule out network-mount latency specifically).On the concurrency theory:
I compared claude-code CLI session count at capture time against outcome (recovered vs. terminated) across 6 captured hangs: session counts ranged 8–18 for hangs that recovered, and the one that terminated had 11 sessions — squarely in the middle of that range. So in my data, raw session count alone doesn't predict recovery vs. termination. I haven't checked whether concurrent git operations specifically (as opposed to session count generally) correlate — that seems like the more precise version of the hypothesis and I don't have the instrumentation to test it directly.
Versions observed: Desktop app 1.40609.0, CCD/harness 2.1.247, Windows 10 (build 19045).
Happy to share the watchdog's raw exit ledger or the minidump/thread-snapshot bundle from the 2026-08-30 occurrence if useful — it's not published anywhere, just sitting locally.
Thanks for sharing what you've experienced and learned! A few notes for
you: when I whitelisted git, it didn't help. Claude had noticed a
connection in logs and while monitoring to farflt11.sys, so I removed the
git whitelist and whitelisted that, instead. As far as I can tell, it
doesn't help much, if at all, but i stopped monitoring. The biggest single
contributor seems to be having more than one session going, even if they're
not being used concurrently, but it can happen using one session. I have
had crashes when running one session, waiting until its turn is over, then
using the other, going back and forth consecutively, and it still crashes.
I've had the desktop app crash, too, when I try to use a session right
away, or when I switch to a new session and activate it right away. These
issues did not used to happen until some time in July, I believe. There
were many updates and, at some point, the app became unstable. I haven't
yet tried to uninstall and reinstall the app, but I did try the Windows
repair option. The first time I did it, it didn't make a difference. I was
prompted the other day to try again, and it couldn't repair it that time. I
may just try reinstalling. Have you tried that?
Frankly, between the problems with the app and with Claude itself, I'm
getting pretty fed up. I sure wish they'd hire a programmer or three that
can do a better job of it, or help us fix this issue.
Message ID: @.***>
Thanks for this — the exit-code data alone is a solid addition (9 occurrences landing on the same STATUS_APPLICATION_HANG is more consistent evidence than anything in the original report), and the ordering you found between the event-loop-stall and git-status-timeout lines is worth flagging back to my own report: I'd been treating "git status timed out" as a plausible trigger, but if event-loop-stall precedes it even in one clearly-ordered case, that points more toward both being downstream symptoms of something else blocking the main thread — which matches your UI-thread-spinning finding (484ms of 672ms) better than a "blocked waiting on git" story would.
On the session-concurrency point: agreed that raw session count doesn't look like it separates recovered vs. terminated in your data. If you do get instrumentation on concurrent git operations specifically (versus session count generally), I'd be very interested — that's the sharper version of the hypothesis and I don't currently have a way to test it either.
One difference worth naming: my install is still MSIX as of today (2026-09-04) — Get-AppxPackage returns a normal result — so whatever moved your install off MSIX between 8/19–8/29 either hasn't hit my machine/channel, or is unrelated to the hang itself. Not sure which yet.
Would genuinely value the watchdog's raw exit ledger and the 8/30 minidump/thread-snapshot bundle if you're willing to share — nothing on my end currently holds a handle on the process or samples on hang detection, so I have no way to reproduce your exit-code or thread-spin measurements independently. Happy to cross-check against my own main.log occurrences in the meantime.