Windows Desktop: fresh generated sandbox attachment can fail immediately and become downloadable later

Version

Codex desktop package 26.825.4187.0
Internal app build 26.825.32147

Platform

Windows 11 x86-64

Summary

A newly generated attachment can fail when opened or downloaded immediately in vanilla Windows desktop, before the native Save As flow receives bytes. The same attachment descriptor/resource can later succeed without regeneration, and the web route can download the same attachment.

The current evidence supports a transient native sandbox-resource readiness/retry failure. The exact native readiness or fetch subfailure was not captured.

Steps to reproduce

1. Run Codex desktop normally.
2. Generate a fresh downloadable attachment.
3. Immediately activate its download/open affordance.
4. Observe that resolution fails before a usable native Save As result.
5. Wait and retry the same attachment, or download that same attachment through the web route.
6. Observe that the same resource may succeed later.

Because the issue is intermittent, repeat with synthetic files and record only privacy-safe state transitions.

Expected behavior

Once the UI exposes an attachment as downloadable, its sandbox resource should be ready. If registration is still converging, desktop should keep the same descriptor and perform a bounded retry with a clear pending state.

Actual behavior

A fresh attachment failed immediately in vanilla desktop. The same immutable logical attachment later succeeded. Failure occurred after the valid descriptor selected the sandbox-resource path but before successful byte transfer and native Save As completion.

Additional technical evidence

The controlled matrix rules out remote debugging, CDP, page attachment, runtime evaluation, maintenance cadence, and the full injector as causes. The exact native status/error was not retained, so I am not asserting a particular status code or internal service boundary.

Proposed fix direction

Prefer an explicit readiness signal. Otherwise, classify transient not-ready separately from permanent not-found/authorization failures and perform a small bounded retry while preserving descriptor identity. Do not regenerate the file or create duplicate downloads.

Privacy note

No generated user content, attachment identifiers, prompts, account data, usernames, local paths, tokens, cookies, signed URLs, or credentials are included.

Start by reproducing the documented fresh-attachment and retry matrix on Windows, recording only privacy-safe state transitions. Trace the desktop attachment open/download path through sandbox-resource readiness and native Save As; done means transient not-ready states receive a bounded retry without regenerating or duplicating the attachment, while permanent failures remain distinct.