Computer History, verified against the artifact — plus the stores that outlive a deleted conversation.
1.0.10 shipped ChatGPT Computer History support built partly on reasoning about how the feature ought to behave. This release is what happened when that reasoning was tested against a live 9,000-event capture from an enabled host: four claims were wrong. Asking the same question of Grok Build and Claude Desktop turned up six more stores that were not being read at all.
Corrected analysis
| 1.0.10 claimed | What the artifact shows |
|---|---|
| Credential rows recover typed passwords | macOS Secure Input Mode blocks the recorder's event tap — keystrokes consume event ids and are never written. Zero text-bearing input events under secure input across 9,000 events. A credential row is a timing anchor, not a password. |
EventId is capture-global and monotonic |
It restarts at 1 on every recorder session. Subtracting ids across that boundary went negative and landed in the reassuring branch — clearing 183 of 186 gap rows with "ids run continuously (17169 → 1)". Restart-spanning gaps are now reported as unassessed. |
| Slack is a metadata-only (Tier 3) app | Slack is Electron and exposed 53,590 characters including message bodies and timestamps. Telegram, same category, exposed 144. Fidelity follows the UI toolkit, not the product category. |
ComputerUseAppApprovals.json is the recording scope |
It belongs to the separate Computer Use agent feature — one bundle listed against 38 actually recorded, with an mtime predating Computer History by three months. |
Capture fidelity now takes the more capable of the known-app table and what the application actually produced, so a stale entry can be corrected by evidence while a thin sample can never argue capability away.
Newly collected — evidence that survives deletion
ChatGPT Computer History
- Consolidated Codex memory — activity summaries are mined into
~/.codex/memories/, which is neither purged at 48 h nor cleared with Computer History. On a stale host it can be the only surviving copy. - Summary bodies split into the model-inferred user profile (survives the raw purge, names typed search terms) and carried-forward prior context (describes activity outside its own window — labelled so it can't be used to date evidence).
app.secureInputas a second credential signal, andmouse.modifiers(a command-click opens a link in a background tab — the bulk-open pattern).
Claude Desktop
- Deletion tombstones —
deleted_<session-uuid>is 13 bytes containing the epoch-ms deletion time, named for the session it replaced. Dated proof a conversation existed and was removed. pending-uploads/— files staged for upload, i.e. what was attached or pasted into a chat, retained independently of it. Inventory only; content is never read.- App-usage windows, scheduled agent tasks, and workspace sightings.
Grok Build
sessions/session_search.sqlite— FTS5 index over session transcripts that mirrors a session and outlives deleting its directory.logs/unified.jsonl— tool executions with outcome and duration, written independently of the session tree. Records that a tool ran, never the command.active_sessions.json— sessions open at acquisition, with pid and working directory.
~/.grok/memtrace/is deliberately not parsed: despite the name it is a memory profiler trace, not agent memory, and carries no conversation content.
Grid quality
- Click multiplicity is named by meaning —
Click/Double-Click/Triple-Click/Multi-Click— instead of ten numericClick (xN)values. The exact count stays inClickCount. - Open (in-progress) recording segments are excluded from count reconciliation rather than scored as a shortfall.
- The artifact family is ChatGPT Computer History everywhere; the menu, tab title and
Toolcolumn previously disagreed.
Compatibility
No schema change. Computer History keeps its 54 columns and the AI history grid its 26 — every new artifact rides existing columns under new RecordType values. Existing saved tabs and sessions need no migration.
Install
Universal build (Apple Silicon + Intel), macOS 12 (Monterey) or later, code-signed and notarized.
IRFlow-Timeline-1.0.11-universal.dmg— normal installIRFlow-Timeline-1.0.11-universal.zip— auto-update channel.blockmapfiles andlatest-mac.ymlsupport delta updates; existing 1.0.10 installs will update in place on the next check.
Verified in CI on macOS 14: full test suite (1366 tests) against a freshly rebuilt better-sqlite3, then signed and notarized.