[Bug]: v1.38.7 - "Cannot open session" persists across restarts: transcript display projection fails with a duplicate transcript record (31 local_only sentinel records accumulated)

Version line

v2 — Go rewrite (1.x), main-v2 (active development)

Exact version

1.38.7 (build 036c7c50c5c1), Windows 10 IoT Enterprise LTSC 10.0.19044

What happened?

A conversation can no longer be opened at all in the desktop app. It reports

Failed to load conversation history. Previous content was kept when available — retry to try again.
Failed to load conversation history. Previous content was kept when available — retry to try again.
Cannot open session

and — unlike the transient variant reported in #10162 — this does not recover by switching conversations, and does not recover by restarting the app. The session is a long-lived one (topic AI Arr** Doctor, 50 turns, 8.4 MB transcript).

The data is intact. The canonical transcript parses completely:

jsonl: 1423 lines, 8.4 MB, 0 unparseable
roles: system 1 | user 77 | assistant 580 | tool 765

So this is a projection/load failure, not data loss — but the practical effect for the user is that a 50-turn conversation is unreachable.

Root-cause evidence

desktop-shell/logs/service.log (local time):

12:59:33 WARN controller: turn transcript saved before metadata update failed err="session write authority stale"
12:59:33 WARN desktop: session autosave failed; retrying tab=... attempt=1 err="session write authority stale"
12:59:33 WARN desktop: session autosave failed; retrying tab=... attempt=2 err="session write authority stale"
12:59:33 WARN desktop: session snapshot failed tab=... action=autosave err="session write authority stale"
13:03:36 WARN controller: keeping in-flight marker after failed turn snapshot err="session write authority stale"
13:03:37 WARN desktop: session autosave failed; retrying tab=... attempt=1 err="session write authority stale"
13:03:37 WARN desktop: session snapshot failed tab=... action=autosave err="session write authority stale"

13:48:12 WARN controller: persist transcript display checkpoint err="duplicate transcript record \"tool:call_00_WfQsnq6GeTBTAHUBRCT6778\""
13:48:12 WARN desktop: acknowledge turn display projection err="duplicate transcript record \"tool:call_00_WfQsnq6GeTBTAHUBRCT6778\""

(read the id as call_00_WfQsnq6GeTBTAHkUBRCT6778 — transcribed from the log line, see the raw text below)

Reproduction after a restart (so this is a persisted state, not a transient):

• fresh process: pid 16536, version v1.38.7, startedAt 2026-09-17T11:46:27Z
• same duplicate transcript record failure at 13:48:12 local — i.e. inside the new process
• the CLI cannot help either: reasonix-cli.exe session recovery 20260911-150839.605567100-deepseek-deepseek-v4-flash --json returns {"error":{"code":"recovery_state_unavailable","message":"recovery state is unavailable"}}

What the transcript actually contains (this rules out the obvious guess)

The named identity is not duplicated in the canonical file:

• assistant:call_00_WfQsnq6GeTBTAHkUBRCT6778 → line 1366 (the tool call)
• tool:call_00_WfQsnq6GeTBTAHkUBRCT6778 → line 1367 (its result) — one occurrence
• .turns.jsonl contains neither key (0 occurrences)

So the duplicate is produced at projection time, not by two same-key records on disk.

What the session does contain is a large population of interrupted-turn placeholders sharing one sentinel identity:

• 31 records with tool_call_id = "__reasonix_local_only__" (62 references in the transcript, 62 in events.jsonl)
• 8 of them carry interrupted_turn: true, with sizes up to 68 KB
• transcript-projection.json is 5.9 MB and dated 13:03, i.e. stale relative to the 13:48 transcript

That pattern suggests the display projection is fed local_only / interrupted_turn records whose identity normalizes onto the interrupted tool call, and it then rejects the whole projection as a duplicate rather than deduplicating.

Steps to reproduce

1. Use a long-lived conversation with several interrupted turns (the interrupted_turn / local_only records accumulate).
2. Trigger the write-authority-stale condition (autosave/snapshot failures above).
3. Open the conversation: history load fails, Cannot open session, and it stays that way across chat switching and app restarts.

Expected behavior

The conversation opens. If the stored records are ambiguous, the projection should deduplicate by identity (or ignore local_only sentinel records) rather than failing the entire projection and making the session unreachable. A user-visible repair path ("rebuild projection from transcript") would also unblock this class.

Relevant logs or output

# desktop-shell/logs/service.log (2026-09-17, local time)
12:59:33 WARN controller: turn transcript saved before metadata update failed err="session write authority stale"
12:59:33 WARN desktop: session autosave failed; retrying tab=tab_c5a08bb5046caa149e67549c03da4a34 attempt=1 err="session write authority stale"
12:59:33 WARN desktop: session autosave failed; retrying tab=tab_c5a08bb5046caa149e67549c03da4a34 attempt=2 err="session write authority stale"
12:59:33 WARN desktop: session snapshot failed tab=tab_c5a08bb5046caa149e67549c03da4a34 action=autosave err="session write authority stale"
13:03:36 WARN controller: keeping in-flight marker after failed turn snapshot err="session write authority stale"
13:03:37 WARN desktop: session autosave failed; retrying tab=tab_2da9f05ecbbdd7631b96aaa64e871156 attempt=1 err="session write authority stale"
13:03:37 WARN desktop: session snapshot failed tab=tab_2da9f05ecbbdd7631b96aaa64e871156 action=autosave err="session write authority stale"
13:48:12 WARN controller: persist transcript display checkpoint err="duplicate transcript record \"tool:call_00_WfQsnq6GeTBTAHkUBRCT6778\""
13:48:12 WARN desktop: acknowledge turn display projection err="duplicate transcript record \"tool:call_00_WfQsnq6GeTBTAHkUBRCT6778\""

(The id in the log is call_00_WfQsnq6GeTBTAHkUBRCT6778; I have transcribed it here from the log output.)

Related

• #10162 — the transient launch-time variant ("Unable to load this session … Retry loading"), which recovers by switching conversations. This report is the persistent form of the same visible failure, unrecoverable by restart.
• #10294 — assistant output produced but not rendered (session-level display failure).
• #10286 / #10326 — session identity and ledger authority changes; the session write authority stale errors here look like the same authority area.
• #10153 — the interrupted-tool recovery path that produces the interrupted_turn / local_only records.