[Desktop/macOS] Six completed turns omit mixed-format history while adjacent canonical items index normally

What version of the Codex App are you using (From “About Codex” dialog)?

26.903.61454 (build 8378), verified from the installed app metadata during the investigation.

What subscription do you have?

Not included in this public diagnostic summary.

What platform is your computer?

Darwin 25.5.0 arm64 arm

What issue are you seeing?

The primary issue is an interval of six completed turns whose source-backed message bodies and tool activity are omitted from the native display index, while adjacent canonical item records index normally. A separate offline reader experiment is included as additional evidence, not as an asserted explanation or repair of that native projection gap.

Disclosure scope: diagnostic summaries only. The underlying conversation, attachments, account data and raw logs are not included.

Environment observed during the investigation

• macOS desktop application, version 26.903.61454, build 8378.
• Persisted history mode: paginated.
• Conversation data stored on an external APFS SSD.
• Installed app archive SHA-256: ce970dc84795cb12ee33cc6f4c6b918affc2e15602b051fdb3af04913d5056f1.
• Bundled backend SHA-256: c147aa90d34139599711fb568102ceefc6319ca1ac5cb6f4056ca46a1834edd9.

Issue A — original messages exist but are absent from the native display index

Six completed turns contain 6 user messages and 22 assistant messages in response_item/message and related legacy event records. Their native display index contains 0 userMessage and 0 agentMessage items. Only eight subAgentActivity items appear across those turns, with item counts 0/1/5/0/1/1.

The original interval also contains 22 mcp_tool_call_end, 13 web_search_end and 15 patch_apply_end records, among other event categories. No corresponding display item types appear in those six turns. These record counts may include alternate representations or updates and must not be summed as a count of unique lost activities.

Control comparison across ten completed turns:

• Before affected interval: 15 unique native item_completed keys, 15 indexed items.
• Affected six turns: 0/1/5/0/1/1 unique native keys and the same indexed counts; all indexed items are subAgentActivity.
• Following three healthy turns: 70/70, 120/120 and 46/46 native unique keys versus indexed counts.
• No native item_completed key was missing from the DB in the compared interval.

The source event representation changes while recorded settings remain the same. Thirteen complete thread_settings_applied objects have the same canonical hash. Other turn_context differences are limited to date and turn identifiers.

Affected turns began between 2026-09-09 12:14:15 and 15:08:13 UTC; the final affected turn completed at 15:13:34 UTC. A new desktop process began at 15:26:43 UTC, and native message item_completed records resumed at 15:30:34 UTC. A restart/profile transition is correlated with the format recovery, not established as its causal trigger. The app files on disk in an earlier audit have the same hashes listed above; identity of all prior loaded process memory and unrecorded feature state is not proven.

Requested repair: a supported, durable compatibility projection or repair overlay that recognizes the mixed-format interval without editing original history, duplicating canonical items, dropping tools/images, changing original ordering or losing repaired items after an index rebuild. Please preserve the original task and turn identities.

Issue B — diagnostic history reader can silently return unqueried turns as empty

The installed pagination helper and output-mapping functions were extracted verbatim for a strictly offline test. Application initialization, native transport, API and live history were not executed by the harness. All test records were synthetic.

With five turns holding 500/3/4/2/1 items, the exact installed reader returned 500/0/0/0/0. It made five item-page requests for the first turn and zero for the remaining turns. A shared item-hydration budget was exhausted. Internal incomplete/summary markers existed, but the public output mapper omitted them.

A separate lab candidate that budgets bounded work per turn and preserves completeness plus continuation metadata returned 500/3/4/2/1. A single turn with 150 items under a 100-item limit correctly remained partial, with an explicit continuation. Fourteen synthetic cases and 71 assertions passed, including ordering, deduplication, empty source, caps and cursor guards. The candidate is not deployed and is not a general native UI patch.

Limits: budget exhaustion does not explain an empty first requested turn with a positive budget and a nonempty backend response. It also does not explain a request whose total stays below the budget. A cached-cursor exclusion experiment relied on an explicit synthetic boundary assumption; it does not establish the actual native cursor value or semantics. The individual real invocation's cause is not proven. Issue B does not repair Issue A.

Requested repair: preserve incomplete versus genuinely empty state through the diagnostic tool boundary; provide fair bounded pagination or explicit continuations without silently starving later turns; preserve snapshot, cancellation and schema compatibility. Do not clear cached cursors indiscriminately.

Additional historical symptom

The old process logged invalid cursor and Failed to load older thread history repeatedly. New-process logs in the inspected immediate post-restart window did not repeat them. These observations are not proof of permanent cursor recovery or a single root cause shared with Issues A and B.

Verification required before declaring resolution

1. All six original turns render their source-backed messages and relevant activities in the native application.
2. The two original image attachments render with the correct original input order.
3. Page backward and forward through the affected boundary without cursor loops or incomplete-as-empty reports.
4. Reopening and a supported index rebuild preserve the correction.
5. New messages continue to index normally; non-target items remain unchanged.
6. Installation/update signatures and SSD bindings remain valid.

No live database patch, rollout edit, history-mode override, application modification, restart, private RPC, reimport or deletion was performed as part of the isolated repair experiments. No transcript or attachment is included in this request. Diagnostic files and synthetic test results are retained locally; broader disclosure requires a separate content review.

What steps can reproduce the bug?

There is not yet a deterministic reproduction of the live six-turn format transition. This was observed in an existing long-running desktop task; the original data was preserved rather than deliberately modifying or replaying it. Read-only comparison of the affected interval with one preceding and three following completed turns established the source/index discrepancy described above.

The separate diagnostic-reader fixture is reproducible in isolation: provide five synthetic turns containing 500/3/4/2/1 items, paginate item responses, and request their full items through the extracted installed helper and mapper. The observed 500/0/0/0/0 result is a synthetic mechanism reproduction, not proof that the actual live call consumed that budget. No private data or source-code excerpts are posted here.

What is the expected behavior?

Source-backed historical messages, attachments and activities should remain accessible in their original turns. If compatibility projection is incomplete, it should be reported explicitly and have a supported non-destructive recovery path. Separately, an unqueried or partial turn must not be indistinguishable from a genuinely empty turn at the diagnostic-reader boundary.

Additional information

Potentially related reports, reviewed before filing:

• #38762 concerns an EOF subagent-history boundary after migration. This report instead concerns an interval inside an ongoing parent task with native records indexing normally before and after it.
• #40014 reports completed child answers visible in the UI but absent from read_thread. The reader finding here may be relevant, but the synthetic shared-budget mechanism is not asserted to explain that report or the six native missing-body turns.

Please advise on a supported durable repair for the mixed-format interval, or route this to the desktop history/projection owner. Any request for private transcripts or raw diagnostics requires a separate disclosure review; those materials have not been publicly uploaded.

Start with the native history/display-index path and the installed pagination helper and output-mapping functions described in the report. Reproduce the synthetic five-turn fixture first, then investigate the live mixed-format interval only with supported diagnostics. Done means the six turns and attachments render correctly, pagination does not treat incomplete data as empty, and reopening or rebuilding the index preserves the correction.