[Regression][macOS] Background review silently restores previously deleted files into active checkout

What version of the Codex App are you using (From “About Codex” dialog)?

Desktop log release: 26.825.41651

Bundled/current CLI: codex-cli 0.150.1

What subscription do you have?

Paid ChatGPT plan (exact tier omitted)

What platform is your computer?

Darwin 25.6.0 arm64 arm

What issue are you seeing?

A long-running local Codex Desktop task silently restored 61 previously deleted Python source files into the active local Git checkout. The files became ordinary untracked working-tree files even though:

• the checkout had previously passed a clean-state integrity check;
• all 61 paths are absent from HEAD;
• git worktree list --porcelain shows only the normal local checkout;
• no model shell command, apply_patch operation, checkout, copy, generator, or submitted user action occurred during the restoration window.

The files appeared sequentially between 16:36:11 and 16:38:04 local time. Their filesystem change times advance in the same order as the paths.

At the corresponding UTC times, Codex Desktop's own logs show its background review subsystem operating on the same checkout:

2026-08-30T19:36:09.262Z
source=review_model requestKind=branch-diff-stats
git ... hash-object --stdin-paths
cwd=<redacted local repository>

... repeated while output grows by one object hash at a time ...

2026-08-30T19:38:03.787Z
source=review_model requestKind=branch-diff-stats
git ... hash-object --stdin-paths

2026-08-30T19:38:05.245Z
source=review_model requestKind=branch-diff-stats
git diff --no-index <temporary empty directory> <redacted local repository> <the exact 61 restored paths>

The first and last observed file change times were:

2026-08-30T16:36:11 src/<redacted-package>/authorization/__init__.py
2026-08-30T16:38:04 src/<redacted-package>/storage/serialization.py

Fifty-seven of the 61 restored files are byte-identical to old source files that had intentionally been removed from the active architecture. Four contain later old variants. None belongs to the current HEAD tree.

git hash-object itself should only read the files, so the direct filesystem writer is not exposed in the Desktop log. Nevertheless, the exact timestamp/path correlation, the absence of a model-issued filesystem operation, and the review_model activity strongly implicate Desktop's background review/checkpoint/history machinery rather than the agent or user.

This is not merely the review pane displaying unrelated Git changes. The files physically exist in the active checkout and are reported by command-line git status.

What steps can reproduce the bug?

The captured occurrence is deterministic in its evidence, but I have not intentionally repeated it because doing so risks restoring or overwriting more deleted work.

Suspected reproduction shape:

1. Open a local Git repository in Codex Desktop and use one long-running local task over multiple days.
2. During that task, remove a set of source files and later confirm and commit a clean working tree in which those paths do not exist.
3. Continue or resume the same task after subsequent app updates/restarts.
4. Keep the repository/task open while Desktop's background review metadata refresh runs.
5. Observe old deleted files being materialized sequentially as untracked files in the active local checkout.
6. Inspect ~/Library/Logs/com.openai.codex/YYYY/MM/DD for source=review_model, requestKind=branch-diff-stats, and repeated hash-object --stdin-paths operations at the files' change times.

No repository name, package name, username, local path, or source content is included here because the affected repository is private. A sanitized log excerpt or session identifier can be provided privately to OpenAI if needed.

What is the expected behavior?

Codex Desktop review, checkpoint, history hydration, task resume, and worktree bookkeeping must never create, restore, overwrite, or delete files in the active local checkout unless a user-visible agent operation explicitly requests that filesystem change.

Background review should inspect repository state without mutating it. Historical/deleted file contents retained for task history or checkpoints must remain outside the active checkout.

Additional information

Possibly related, but not duplicates:

• #30820 documents restored-workspace review_model snapshots and untracked-aware background Git processing.
• #40303 documents a recent macOS regression in which resuming a task restores a deleted pre-rename workspace root.

The current incident goes further: obsolete source files were physically restored inside an existing active checkout without any agent or user filesystem action.

Start by tracing the Desktop background review, checkpoint, history hydration, task-resume, and worktree bookkeeping paths associated with review_model branch-diff-stats and hash-object --stdin-paths. Use the supplied macOS log evidence and related issues #30820 and #40303; done means background review can inspect repository state without materializing, overwriting, or deleting files in the active checkout.