Windows Desktop data loss: 457 local rollout JSONL transcripts deleted while thread records remain

Summary

On Windows, Codex/ChatGPT Desktop retained hundreds of local thread records but the corresponding local rollout transcript files disappeared. Every historical thread now fails to open with:

failed to resolve rollout path ... rollout-<timestamp>-<thread-id>.jsonl: file does not exist

This is a data-loss incident, not merely a sidebar/indexing issue.

Environment

• Windows 11
• Microsoft Store package: OpenAI.Codex 26.820.7780.0
• Local transcript locations: %USERPROFILE%\.codex\sessions and %USERPROFILE%\.codex\archived_sessions

Evidence collected

• The NTFS USN journal records a batch deletion at 2026-08-27 10:28:25–10:28:26 local time:
  • 457 historical rollout-*.jsonl files deleted
  • both sessions and archived_sessions directories deleted
• The desktop recreated a new sessions directory at 10:41, after which newly created sessions worked normally.
• state_5.sqlite and the Desktop local thread catalog still contain the historical thread metadata; opening all affected items fails because their referenced rollout paths are absent.
• This was not a Microsoft Store Codex update: the Store update scan at 10:20 reported NumberOfApplicableUpdates = 0, and there is no AppX deployment/install event in the incident window.
• The Windows Recycle Bin contains only manually deleted Desktop items; it contains no .codex, sessions, archived_sessions, or rollout entry.
• Process-creation auditing/Sysmon was not enabled, so the USN journal cannot identify the deleting process.
• Recovery attempts (Recycle Bin, VSS, Windows File Recovery, TestDisk, and a read-only free-space PhotoRec scan) did not produce a valid recovered rollout JSONL.

Why this needs first-party help

The Desktop UI still exposes the task records, but there is no supported recovery path when the source rollout is missing. Local SQLite state only stores metadata/path references and cannot reconstruct the transcript.

Requested action

1. Please investigate whether the Windows Desktop app, bundled Codex runtime, or any supported cleanup/migration path can delete local .codex session directories.
2. Please advise whether affected transcript data may be recoverable from any OpenAI-side retained session/task state, or whether a supported diagnostic/export exists.
3. Please add a safety guard: never silently delete database-referenced sessions or archived_sessions transcripts; surface an explicit backup/recovery workflow instead.
4. Please provide a supported way to detect and repair orphaned thread records without implying that a sidebar reindex can restore deleted transcript content.

I can provide privacy-safe additional diagnostics if maintainers request them.

Start by tracing the Windows Desktop and bundled Codex runtime paths that manage %USERPROFILE%.codex\sessions, archived_sessions, and the SQLite thread metadata. Inspect cleanup, migration, and deletion behavior, then determine whether a supported recovery or orphan-repair path exists. Done requires identifying the deleting path or ruling it out, and defining a safe guard against deleting database-referenced transcripts.