[Windows][26.721.11231.0] RADAR_PRE_LEAK_64 and AppHang before sleep; resume leaves app headless and system unresponsive

Summary

On Windows, Codex Desktop became severely unresponsive after resuming from a long sleep. The app's ChatGPT.exe processes remained present, but no application window appeared, and attempts to terminate the process tree from Task Manager did not complete normally.

Windows Error Reporting shows that the application was already unhealthy before the machine entered sleep: it recorded a suspected memory-leak event for ChatGPT.exe, followed later by an application hang. The system entered sleep approximately two minutes after the hang event. After an approximately eleven-hour sleep, resuming the machine exposed the headless/unresponsive state and severe system slowdown.

A normal reboot restored usability.

Environment

• Codex Windows package: OpenAI.Codex 26.721.11231.0
• Architecture: x64
• Windows build: 10.0.26200
• Physical memory: approximately 16 GB
• Executable recorded by Windows: ChatGPT.exe
• Executable version in the relevant WER records: 150.0.7871.128
• Subscription: not included because the failure occurs at the local desktop-process / OS-resume layer

Observed timeline

Exact local timestamps are intentionally omitted; the relative sequence is preserved.

1. Windows Error Reporting Event ID 1001 recorded:

• Event name: RADAR_PRE_LEAK_64
• Process: ChatGPT.exe

1. Approximately 8 hours 43 minutes later, Application Hang Event ID 1002 reported that ChatGPT.exe had stopped interacting with Windows.
2. Approximately two minutes later, Kernel-Power Event ID 42 recorded entry into sleep.
3. After approximately 11 hours 8 minutes, Kernel-Power Event ID 107 and Power-Troubleshooter Event ID 1 recorded resume from the low-power state.
4. After resume:

• overall system responsiveness was severely degraded;
• memory use appeared abnormally high;
• ChatGPT.exe processes were still visible;
• the Codex window never appeared;
• ending the process from Task Manager did not complete normally.

1. A normal OS restart recovered the machine.

Negative evidence / checks

The relevant Windows logs did not show:

• Resource-Exhaustion-Detector Event ID 2004;
• an unexpected shutdown or Kernel-Power Event ID 41;
• a blue-screen event;
• a display-driver reset Event ID 4101;
• disk-reset or disk-failure events around the incident.

There was an Intel wireless-adapter power-transition failure at resume. This may have contributed to resume latency, but it does not explain the earlier RADAR_PRE_LEAK_64 and Application Hang 1002 events for ChatGPT.exe.

Steps to reproduce

The failure has been observed once and is not yet deterministic:

1. Launch Codex Desktop on Windows and use it normally for several hours.
2. Leave the application running.
3. Allow the machine to enter sleep without fully quitting Codex.
4. Leave the machine asleep for an extended period (approximately eleven hours in this incident).
5. Resume Windows.
6. Observe whether the system becomes severely unresponsive while ChatGPT.exe remains in the process list without a visible Codex window.

Expected behavior

• Codex memory usage should remain bounded during extended use.
• The desktop app should survive sleep/resume with a usable window.
• If a renderer or background process cannot be restored, Codex should recover it or present a clear error.
• The application process tree should remain terminable through normal Windows process-management tools.

Actual behavior

The application was flagged for a suspected memory leak, later stopped interacting with Windows, entered sleep in that state, and resumed as a headless process group while the system was severely degraded.

Related issues

• #34305 reports Windows memory spikes, RADAR_PRE_LEAK_64, and MoAppHang.
• #35963 reports Windows memory-leak and hang events.
• #25575 reports background processes remaining present with no GUI window.

This report differs by documenting the sequence on package 26.721.11231.0: suspected leak -> application hang -> sleep -> long-duration resume -> headless process group and failed normal termination.

Privacy and diagnostic artifacts

No raw Event Viewer exports, WER files, minidumps, application databases, screenshots, or full process listings are attached. Those artifacts may contain usernames, local paths, conversation identifiers, project information, or process memory.

This report intentionally excludes:

• email/account information;
• Windows username and private filesystem paths;
• machine name, IP addresses, and device identifiers;
• conversation, task, thread, and project contents;
• private repository names;
• WER report GUIDs and temporary-file paths;
• unrelated installed applications and processes.

A minimal redacted event summary can be provided privately if maintainers request additional evidence.