[macOS Desktop] Renderer memory growth, repeated reconnects and lost steered messages

Codex Desktop became unusable during long tasks with tools and agents. Renderer memory grew sharply, responses stalled for minutes, and accepted messages disappeared from desktop history after steering and interruption. I restarted the app to recover usability.

Environment: Desktop 26.908.40834 (build 8881, ChatGPT.app); CLI 0.154.0-alpha.6.2; Chromium 152.0.7977.83; macOS 26.5.2 (25F84), arm64. uname -mprs: Darwin 25.5.0 arm64 arm. Subscription pro 20x.

Renderer memory growth

The same renderer, PID 2340, launched at 16:17:26.290, produced these measurements:

Real memory grew 1.64 GB in 8 minutes 27 seconds. Physical footprint is a separate metric that independently corroborates the increase.

Repeated stalls, including after successful compaction

stream disconnected before completion: idle timeout waiting for websocket

Seven accepted submissions missing from desktop history

Five submissions during the first episode: I sent text and images while work was active. They appeared uploaded, but the assistant did not receive them, and interruption and restart left them missing from history.

Backend TurnInput records confirm receipt at 19:38:52, 19:40:11, 19:42:43, 19:44:14 and 19:48:48, including eight attachment references to four screenshots. None appears in rollout user events, user response items or indexed history. Four other submissions persist normally, providing a control for the lookup.

Successful turn/steer replies are followed within milliseconds by thread/queue/delete. Interruptions occur at 19:42:54 and 19:47:19, then backend shutdown at 19:49:21. The missing text and attachment paths were recovered from logs.

Two messages sent from mobile: These appeared in the desktop queue. Choosing to steer removed them without rendering them in desktop history. A mobile photo still shows:

• “But this pattern seems common” — backend receipt 21:06:15.243.
• “The history audit just had a reconnecting issue” — receipt 21:06:55.733.

The desktop photo shows Reconnecting 2/5. Interruption follows at 21:07:03.980. Both messages are absent from the same three local history representations by client ID and exact text. This episode logs queue listing and interruption but no matching steering or queue deletion RPCs. Mobile storage was not inspected; visible mobile copies remained.

Source findings and diagnostic tests

Draft PR diegomrsantos/codex#2 provides runnable scripts against the matching desktop build. Both scripts passed, covering 30 signature calls, a control for changed agent status and nine streaming and retention scenarios:

• Repeated scans: notifyConversationCallbacks → Zzt → Qzt rebuilds the subagent signature before metadata equality checks. Every call scans all items in histories of 100, 1,000 and 10,000, with or without subagent calls. All 24 ordinary text updates leave the result unchanged; changing agent status changes it.
• Streaming amplification: TKt normally drains 24 characters per frame, using document visibility rather than task selection. Connecting it to the scan produces the counts below. All modes preserve the text, drain buffers and release pending frame work. Reasoning summaries drain in one frame.
• Retention: Active or unfinished tasks are excluded from normal expiry after three hours. Tests retain them after four hours, then select them once completed. Capacity selection chooses the two oldest of twelve eligible tasks while excluding twenty active ones.

For 2,400 characters over 10,000 synthetic history items:

Separate durability lead: installed desktop sendNow deletes queued input after steering succeeds. Audited Rust code acknowledges input stored in an in-memory pending vector. Consumption and normal completion record it; explicit abort clears it, and graceful shutdown uses that abort path. Queue deletion does not check history persistence.

Related reports and fixes

What remains unresolved

There is no established common cause, identified owner of the 2.5 GB footprint, or fix verified for this incident. The passing tests do not reproduce the full memory growth, stream stalls or steering loss. They characterize mechanisms with synthetic history views and an explicit connection between the buffer and scan; they do not exercise production notifications, unsubscribe I/O or steering durability, or measure runtime and retained bytes. The audited Rust revision has not been matched to the installed backend. The late change summary may also have a separate explanation.

The next useful checks are retained allocations during actual growth, scan and animation costs during stalls, and a backend regression for accepted steering interrupted before consumption. Expected behavior: tasks remain usable or report a recoverable failure, and accepted text and attachments remain recoverable across Stop and restart.

Preserved locally: two native samples, six Activity Monitor screenshots, both mobile and desktop photos, scoped logs, recovered inputs, trace summaries and source evidence. A third native sample remains uninspected. Raw incident files were not uploaded; the published diagnostics contain no private conversation data.

Start with the renderer entry webview/assets/app-initial-9b95fa538c62.js and the scripts in draft PR diegomrsantos/codex#2, then inspect the cited Rust paths in codex-rs. Re-run the scan, streaming, and retention tests, and investigate retained allocations and stall behavior during actual growth. Done means a reproduced cause or regression test covering accepted steering inputs and attachments across interruption and restart.