I was not doing anything special with sforce.connection.sessionId in my code. All the button does is {!REQUIRESCRIPT('/soap/ajax/30.0/connection.js')} and move on to query and update the database. The same code was working fine in my sandbox still, so I figured the next best thing would be to actually look at sessionId to see what's wrong.
At first glance, sessionId looked like a perfectly fine mess of characters that are reasonable for a Session ID value.
00DG0000000krVL!ARQAQP3vNkwdt8OU3WVIjlAwQvWtGcFcIjWq.0jb7A5wYNljj6Oog50.wDma4uUiB.PeDMqx1mLwkMyGj78gyMGLRLGTxic1
Then, I compared sessionId to the sid cookie, and I noticed that the two values were very different.
00DG0000000krVL!ARQAQLWR697R.eqoAy4178kYPxh2kJGv6BOpv_wsHc6KBjY6UPY01.Rfncn6WAMS2klSm.gLvDOWicNKujfE4smTPBLJvyS5
Refreshing the page in my browser did nothing for the problem. The same two values consistently appeared, and the INVALID_SESSION_ID error consistently broke my code.
Finally, the fix was implemented in the form of additional JavaScript in a static resource. This resource, added using REQUIRESCRIPT() after connection.js, simply maps the cookies in the current document and then stores the sid value in sforce.connection.sessionId. The addition of this step resolved the INVALID_SESSION_ID error as far as I could tell.
Has anyone else ever encountered this issue, in Spring '14 or earlier? I feel like I've stumbled upon a bug, because as far as I know connection.js used in a custom button should not need this kind of "initialization".
