[Critical Data Loss] Turn-diff git corruption after rollback deletes all workspace files

What version of the Codex App are you using (From “About Codex” dialog)?

Version: 26.623.4041.0 (Windows)

What subscription do you have?

free

What platform is your computer?

Windows x64

What issue are you seeing?

Repeated thread_rolled_back operations corrupt the internal turn-diff git repository, causing permanent loss of all workspace files.

After 3 consecutive rollbacks, the .git directory was left in a broken state:

• .git/config missing
• .git/index missing
• HEAD replaced by binary garbage
• All refs point to non-existent commit objects
• git fsck reports invalid sha1 pointer for every ref
• Only 2 dangling trees remain (initial pip-installed state), out of 3,635 objects
• All user files lost; not in Recycle Bin

What steps can reproduce the bug?

1. Work in a Codex workspace with multiple turns creating files and generating content
2. Use the rollback feature repeatedly in quick succession (3 times within ~5 minutes)
3. The internal git repository becomes corrupted, working directory goes empty

Session ID: 019ed009-ccd7-79b1-9fdf-078a83289ee7
CLI Version: 0.140.0-alpha.2 → desktop 26.623.4041.0
Context window: 258,400 tokens
Token usage at time of corruption: ~827,524 → ~1,304,744 total tokens

Session JSONL evidence (2026-06-24):

{"type":"thread_rolled_back","num_turns":1}

(×3 within 5 minutes)

What is the expected behavior?

Rollback should be an atomic, safe operation. The git repository should never be left in a corrupted or incomplete state. At minimum, the working tree should be preserved even if git state becomes inconsistent — no user files should ever be lost due to internal checkpointing failures.

Additional information

Environment:

• Windows 11, PowerShell
• Workspace: C:\Users\...\Documents\math
• Git ref paths are deeply nested: refs/codex/turn-diffs/checkpoints/<64-char-hash>/<64-char-hash>/<timestamp>/<uuid> — approaching Windows MAX_PATH (260)

Note: The workspace files (PDF lecture notes, generated review content) were permanently lost. Session JSONL logs were the only source for partial content recovery.