@@ -118,7 +118,15 @@ export class DiffViewProvider {
 	// thing that tells two edits on one provider apart: relPath and editType say what is being edited,
 	// not which attempt is doing it, so a retry that reopens the same file as the same kind of edit
 	// looks exactly like the install a retained recovery record describes.
+	// This is the install stamp, not the allocator: a recovery performs an older attempt's edit and so wears
+	// that attempt number, which can put the number back below one a later open() already handed out.
+	// Allocation itself lives in sessionAllocator below, which nothing but open() ever writes.
 	private editSession = 0
+	// Allocation counter for those stamps: advanced by open() and never assigned by anything else, so a
+	// stamp is issued once. If the counter rewound along with a recovery's install, the next open() would
+	// hand out a number a retained record already holds, and that record - same file, same kind of edit -
+	// would then read as its own install and roll back an edit it has nothing to do with.
+	private sessionAllocator = 0
 	private taskRef: WeakRef<Task>
 
 	constructor(
@@ -132,7 +140,8 @@ export class DiffViewProvider {
 		// A new edit session starts here, even when the target and the edit type are the same as the last
 		// one: this install's baseline, directories and buffer are its own, and any recovery record captured
 		// from an earlier install is now answerable to a different attempt.
-		const openSession = ++this.editSession
+		const openSession = ++this.sessionAllocator
+		this.editSession = openSession
 		this.relPath = relPath
 		const fileExists = this.editType === "modify"
 		const absolutePath = path.resolve(this.cwd, relPath)
@@ -681,6 +690,8 @@ export class DiffViewProvider {
 		// The install is this recovery performing the edit the record describes, so it wears that record
 		// session: the comparison afterwards asks whether this install is still what the provider answers
 		// to, and only a stamp that a later open() moved tells it when the target and the type stayed put.
+		// Wearing the number is not the same as putting it back into circulation: sessionAllocator keeps its
+		// own value, so the next open() issues a stamp no retained record can already hold.
 		this.editSession = context.editSession
 		this.createdDirs = [...context.createdDirs]
 		this.originalContent = context.originalContent
 
@@ -2986,6 +2986,71 @@ describe("DiffViewProvider", () => {
 			expect(diffViewProvider["originalContent"]).toBe("the retry's own baseline")
 			expect(diffViewProvider["activeDiffEditor"]).toBe(retryEditor)
 		})
+		it("never re-issues a session number after a recovery rewinds the install", async () => {
+			const relPath = "mock-recovery-target.ts"
+			const absolutePath = `${mockCwd}/${relPath}`
+			// Stubbed the way the rest of this suite stubs it: these cases are about which install a record is
+			// allowed to roll back, not about the tab plumbing or the acquisition timer. Each attempt gets its
+			// own editor so an installed buffer can be told from another attempt's.
+			const acquired: Array<{ editor: ReturnType<typeof makeTextEditor> }> = []
+			diffViewProvider["openDiffEditor"] = vi.fn().mockImplementation(async () => {
+				const editor = makeTextEditor({
+					document: makeTextDocument({
+						uri: makeUri(absolutePath),
+						getText: vi.fn().mockReturnValue("streamed, never approved"),
+						isDirty: true,
+					}),
+				})
+				acquired.push({ editor })
+				return editor
+			})
+			diffViewProvider["closeAllDiffViews"] = vi.fn().mockResolvedValue(undefined)
+			diffViewProvider["restorePreviewTabs"] = vi.fn().mockResolvedValue(undefined)
+			diffViewProvider["keepOrCloseEditedFile"] = vi.fn().mockResolvedValue(undefined)
+			diffViewProvider["restorePreStreamBuffer"] = vi.fn().mockResolvedValue(undefined)
+			diffViewProvider["saveBufferClean"] = vi.fn().mockResolvedValue(undefined)
+			diffViewProvider.editType = "modify"
+
+			// Two attempts at the same file, each record captured while its own install was the live one.
+			await diffViewProvider.open(relPath)
+			const firstRecord = recoveryContextFor(relPath, "modify")
+			const firstSession = firstRecord.editSession
+			await diffViewProvider.reset()
+			await diffViewProvider.open(relPath)
+			const secondRecord = recoveryContextFor(relPath, "modify")
+			const secondSession = secondRecord.editSession
+			await diffViewProvider.reset()
+			expect(secondSession).toBe(firstSession + 1)
+
+			// The first attempt rollback runs: it installs the first attempt edit and rewinds the provider to that
+			// attempt stamp.
+			await expect(diffViewProvider.attemptRollbackRecovery(firstRecord)).resolves.toBe(true)
+			expect(diffViewProvider["editSession"]).toBe(firstSession)
+			await diffViewProvider.reset()
+
+			// A third attempt on the same file. Allocation has to stay ahead of every stamp a retained record
+			// already holds, otherwise the second record describes this install as well as it describes its own.
+			await diffViewProvider.open(relPath)
+			const thirdSession = diffViewProvider["editSession"]
+			const thirdEditor = acquired[acquired.length - 1].editor
+			expect(thirdSession).toBeGreaterThan(secondSession)
+			const thirdRestore = vi.fn().mockResolvedValue(undefined)
+			const thirdSave = vi.fn().mockResolvedValue(undefined)
+			diffViewProvider["restorePreStreamBuffer"] = thirdRestore
+			diffViewProvider["saveBufferClean"] = thirdSave
+
+			await expect(diffViewProvider.attemptRollbackRecovery(secondRecord)).resolves.toBe(false)
+
+			// The second record belongs to an attempt that already finished its rollback question. The retry in
+			// front of it keeps its own edit: nothing was restored, nothing was saved, and its stamp, target and
+			// buffer are still what the provider answers to.
+			expect(thirdRestore).not.toHaveBeenCalled()
+			expect(thirdSave).not.toHaveBeenCalled()
+			expect(diffViewProvider["isEditing"]).toBe(true)
+			expect(diffViewProvider["relPath"]).toBe(relPath)
+			expect(diffViewProvider["editSession"]).toBe(thirdSession)
+			expect(diffViewProvider["activeDiffEditor"]).toBe(thirdEditor)
+		})
 	})
 	// The acquisition inside openDiffEditor() races a ten-second timer against a showTextDocument it cannot
 	// cancel. Both cases below are about what that leaves behind: a diff nobody is waiting for, and a diff