Session Agent down - cw doctor / cw agent status → cw agent start (reinstall tool if agent binary missing). CmdWarden Vault shows a yellow Session Agent not running banner and disables actions.
If the detail says pipe exists but denied access, an agent runs elevated or as another user. That happens when an admin terminal ran cw. Stop that agent from an admin shell (cw agent stop), then run cw agent start from a normal shell. A normal Vault window cannot reach an elevated agent, and an elevated Vault window cannot reach a normal one.
Always blocked / no Approval Gate - cw whoami, cw policy list → enroll; use interactive desktop for the Gate.
Tool skips CmdWarden - where.exe gh, cw scan → new shell; PATH not absolute real binary; re-cw harden ….
cw doctor and cw harden --list show Degraded - shim not first on PATH: <entry> (machine|user) precedes shims when a real tool sits before the shims dir. A machine entry needs cw doctor --fix-path: one UAC prompt prepends %LOCALAPPDATA%\CmdWarden\shims to the machine PATH as REG_EXPAND_SZ, checks the logon PATH expands it (else it writes the literal path), and prints shims first on PATH (machine). Open a new terminal after the fix. Doctor prints info: this terminal started before the last PATH change; open a new terminal when this shell has an old PATH copy.
Auth fails after harden (gh) - cw audit → re-cw harden gh; do not rely on ambient parent-shell GH_TOKEN for the gated path.
Vault app missing from Start Menu or Desktop - cw shortcut status → cw shortcut install --desktop. If it reports Vault UI binary not found, repack so secrets-manager\ sits next to cw, or set CW_SECRETS_MANAGER_PATH. If cw says Unknown command: shortcut, the installed tool is old; rebuild and reinstall (Install, Option B).
Approval Gate ignores Approve and shows "Use your keyboard, or move the mouse off this card and back." - the popup accepts Approve only from a physical keyboard or mouse. An on-screen keyboard, voice control, some remote desktop tools, and scripts send injected input, so the popup ignores them. A click also needs your own mouse moves to bring the pointer onto the card. When the card opens under the pointer, or a program moves the pointer, move the mouse off the card and back. Deny and Esc work with every input type.