v0.10.0: desktop sync fails with "desktop message identity conflicts with retained cache container" (also on empty DB)

[vitorsj]

Summary

After upgrading from v0.8.5 to v0.10.0, desktop sync fails on every run with:

error: desktop message identity conflicts with retained cache container

The same happens against a brand-new, empty database, so the problem seems to be in how v0.10.0 reads the Slack desktop cache, not in existing archive state. v0.8.5 reads the same cache without errors.

There is also a second issue: the failed first run still migrates the archive schema from 7 to 8. After that, v0.8.5 refuses to open the database (database schema version 8 is newer than this slacrawl build supports (7)), so rolling back means restoring from a backup.

Environment

• slacrawl v0.10.0, slacrawl_0.10.0_darwin_arm64.tar.gz (checksum and notarization verified)
• macOS 27.0, Apple Silicon (arm64)
• Slack desktop 4.51.180, direct-download build (cache at ~/Library/Application Support/Slack, not the App Store container)
• Desktop-only mode: bot/app/user tokens and MCP disabled, [slack.desktop].enabled = true

Steps to reproduce

1. With a working v0.8.5 desktop-only setup, replace the binary with v0.10.0.
2. Run slacrawl sync --source desktop. It fails with the error above.
3. Point --config at a config whose db_path, cache_dir and log_dir are all new, empty locations. Run slacrawl --config <test.toml> sync --source desktop. It fails with the same error and 0 messages are stored.

--format log prints no more detail than the one-line error. slacrawl doctor reports the desktop cache as available.

Expected

• Desktop sync succeeds, as it did on v0.8.5.
• A sync that fails before persisting anything should not leave the archive on a schema that older builds can't open. At minimum, the release notes could mention that the upgrade is one-way.

Workaround

Roll back to v0.8.5 and restore the archive from a copy taken before the upgrade (for example with sqlite3 slacrawl.db ".backup ...").

[clawsweeper]

Codex review: this still needs some work. Reviewed September 22, 2026, 4:11 PM ET / 20:11 UTC.

Summary
The desktop failure remains actionable on the latest release and current main; no open replacement PR was found. The separate schema-upgrade behavior is already explicitly documented, including migration before a later sync failure and unsupported in-place downgrade.

Reproducibility: no. high-confidence reproduction of an erroneous rejection yet: source explains the error and the independent migration, but the Slack cache shape that triggers this report is unavailable. No runtime reproduction was executed.

Regression provenance
Possible regression — suspected (failure trace). No predecessor PR is attributed.

Next step
The assigned owner should obtain a minimal sanitized failing cache shape and establish a regression test before selecting a repair; the current evidence cannot safely authorize an automated admission change.

Review details

Best possible solution:

Correct any demonstrated cache-decoding false positive while preserving genuine identity rejection, and make the existing backup and downgrade guidance visible during upgrade recovery.

Do we have a high-confidence way to reproduce the issue?

No high-confidence reproduction of an erroneous rejection yet: source explains the error and the independent migration, but the Slack cache shape that triggers this report is unavailable. No runtime reproduction was executed.

Is this the best way to solve the issue?

Unclear until the offending cache shape is reduced to a sanitized fixture; removing the guard would contradict the accepted admission contract. Automatic schema rollback is not the existing upgrade contract.

AGENTS.md: not found in the target repository.

Remaining risk / open question:

• The failing cache structure is unknown, so relaxing the identity check could admit genuinely misattributed records and undermine the accepted conversation-admission boundary.

Codex review notes: model internal, reasoning medium; reviewed against 4eeb7828ca42.

Label changes

Label changes:

• add P1: A concrete latest-release report describes every desktop-only sync failing, including on a fresh archive.
• add impact:other: Desktop archive ingestion is blocked; the report does not establish lost existing data or failure of live channel delivery.
• add issue-rating: 🦐 gold shrimp: Current issue advisory state selects this label.
• add clawsweeper:needs-info: Current issue advisory state selects this label.

Label justifications:

• P1: A concrete latest-release report describes every desktop-only sync failing, including on a fresh archive.
• impact:other: Desktop archive ingestion is blocked; the report does not establish lost existing data or failure of live channel delivery.

Evidence reviewed

What I checked:

• Concrete affected release and fresh-database report: The report identifies the official v0.10.0 darwin_arm64 artifact, Slack 4.51.180, the desktop sync command, and the same failure with a fresh database. The issue is assigned to vincentkoc. This is a specific owned ingestion failure, although the triggering cache shape is not supplied.
• Current rejection is independent of existing archive contents: prepareRedux rejects retained alias/container conflicts at line 263. Ingest calls prepareDesktop before its workspace and message writes, explaining why an empty archive can fail identically. (internal/slackdesktop/admission.go:263, 4eeb7828ca42)
• Decoder evidence needs a representative failing shape: The decoder combines aliases and outer container identity across duplicate observations, and initializes container context from keys under messages and threads. A mismatch can therefore originate in cache interpretation before persistence; the report does not establish which observation is responsible or whether rejection is erroneous. (internal/slackdesktop/redux_decoder.js:105, 4eeb7828ca42)
• Intentional rejection contract and existing tests: The tests cover conflicting aliases, nested keys, duplicate payloads, shared subtrees and outer-DM containers under default, include and exclude policies, expecting rejection before archive writes. These tests were inspected, not executed. (internal/slackdesktop/admission_test.go:159, 4eeb7828ca42)
• Prior sponsor decision limits the repair: The human discussion on fix: honor DM exclusion before desktop cache writes #199 explicitly accepts retained-identity rejection under every DM policy. Its body describes synthetic qualification and expressly excludes live Slack qualification. Honor explicit DM exclusion before desktop archive writes #195 defines the same admission contract; neither establishes that this reporter's cache is malformed. (40622a718968)
• Migration is an existing documented contract: Configuration documentation states that first writable open upgrades pre-v8 archives independently of later sync success. The v0.9.0 changelog already instructs operators to keep a consistent pre-upgrade backup and states that in-place downgrade is unsupported. runSync opens the store before running ingestion, and migrateSchema commits its own transaction. (docs/configuration.md:85, 4eeb7828ca42)

Likely related people:

• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Peter Steinberger: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

Fixed on main by #255 (1f410a6f14c9e4fbfd4943af85169794f46242a3), thanks to @ViaxCo.

The root cause was recursive discovery treating a timestamped attachment/unfurl as a standalone message. An attachment’s original channel then conflicted with its parent’s cache container. Discovery now stops at attachments while preserving their raw payload on the parent; genuine message identity conflicts still reject before writes.

Synthetic proof: the baseline reproduces the exact reported identity error. The expanded regression passes for message/thread containers, foreign/same/missing attachment channel IDs, all three DM policies, and replay. Full make check on Linux passed, including race tests and snapshot packaging. A compiled CLI synced a fresh synthetic cache twice and SQL confirmed one parent row with its attachment. All exact-head hosted CI checks passed, including macOS with the minimum Go version: https://github.com/openclaw/slacrawl/actions/runs/35984818029.

The schema concern remains the existing v0.9.0+ upgrade contract: writable open migrates to schema 8 even if sync later fails. The desktop guide and patch notes now call out the consistent pre-upgrade backup required for rollback; no in-place downgrade is attempted.

[steipete]

Released in v0.10.1. The Homebrew formula is updated, and the downloaded macOS arm64 artifact’s checksum, Developer ID signature, explicit notarization requirement, and 0.10.1 version output have been verified.