Codex review: needs maintainer review before merge. Reviewed July 8, 2026, 8:03 AM ET / 12:03 UTC.

Summary
The PR adds bounded reply-run terminal settling, activity evidence, visible stale-run takeover, deprecated SDK compatibility exports, and focused regression coverage while removing the dispatch-side stale-recovery loop.

PR surface: Source +113, Tests -97. Total +16 across 19 files.

Reproducibility: yes. at source/proof level: current main waits on active reply runs without stale-running takeover, and the PR discussion includes live black-hole endpoint proof that abort released the lane and a later turn admitted. I did not run tests in this read-only review.

Review metrics: 1 noteworthy metric.

• Reply-run recovery bounds: 2 introduced: 60s terminal settle, 10-minute visible stale takeover. These defaults determine when an upgraded gateway may force-release or reclaim an active reply lane.

Root-cause cluster
Relationship: superseded
Canonical: #102160
Summary: This PR is the Track A review record; the open integration PR includes its commits and is now the canonical atomic landing path for the lifecycle reliability stack.

Members:

• canonical: fix(agents): run-lifecycle reliability — bounded release, evidence-based liveness, watchdog semantics #102160 - The integration PR body says it lands Track A plus sibling tracks atomically and includes closing syntax for this PR.
• same_root_cause: Design: run lifecycle reliability — bounded liveness, abort⇒release, crash resume, completion drive #101863 - The design issue defines the broader run lifecycle reliability problem and explicitly includes Track A's abort-to-release and stale-running takeover invariant.
• adjacent_distinct: fix(agents): make run liveness evidence-based #101985 - The Track B PR refines evidence-based liveness on top of Track A rather than replacing the terminal-release primitive.
• adjacent_distinct: fix(agents): keep finite LLM idle watchdog under unlimited run budgets #101986 - The timeout-semantics PR addresses an adjacent liveness footgun from the same design stack.
• partial_overlap: [Bug]: Stuck-session recovery never releases: status=aborted with released=0 on every event — wedges survive five correct-target aborts (~14h) and four ghost-target aborts (~16h) until an external restart or user /reset [2026.5.28] #92270 - The issue reports abort-without-release symptoms that Track A targets, but it also contains stale-target binding and visibility asks outside this PR.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• Review and land fix(agents): run-lifecycle reliability — bounded release, evidence-based liveness, watchdog semantics #102160 instead of merging this track branch directly.

Risk before merge

• [P1] Merging this Track A PR standalone would intentionally change recovery defaults before the sibling liveness protections in fix(agents): run-lifecycle reliability — bounded release, evidence-based liveness, watchdog semantics #102160 land.
• [P1] The new 60s terminal settle and 10-minute no-activity takeover clear active reply-run ownership, so missed activity evidence could affect session state and queued message delivery.
• [P1] The PR is draft and has the protected maintainer label, so direct merge or cleanup closure requires maintainer rollout intent.

Maintainer options:

1. Use The Atomic Landing PR (recommended)
   Keep this branch as review provenance and land the tested lifecycle stack through fix(agents): run-lifecycle reliability — bounded release, evidence-based liveness, watchdog semantics #102160 so Track A does not reach main without sibling protections.
2. Accept Track A Standalone
   Maintainers may merge this branch directly only if they accept the standalone recovery-default risk.
3. Pause For Production Proof
   Hold this PR and the integration PR until the planned production-bot validation is posted or explicitly waived.

Next step before merge

• No automated repair is needed; maintainers should keep this draft track open as review provenance and use the integration PR for the actual landing decision.

Maintainer decision needed

• Question: Should this Track A branch stay open only as review provenance for fix(agents): run-lifecycle reliability — bounded release, evidence-based liveness, watchdog semantics #102160, or should maintainers merge it standalone despite the intermediate recovery-default risk?
• Rationale: The code shape appears coherent, but the branch changes compatibility-sensitive recovery defaults and the latest maintainer discussion says the sibling tracks protect this one.
• Likely owner: obviyus — They authored the track, recorded the takeover-policy acceptance, and posted the current atomic landing plan.
• Options:
  • Land Through Integration PR (recommended): Keep this draft PR open as review provenance and let fix(agents): run-lifecycle reliability — bounded release, evidence-based liveness, watchdog semantics #102160 include and close it after the full stack is accepted.
  • Merge Track A Alone: Merge this branch directly only if maintainers explicitly accept the temporary 60s settle and 10-minute takeover rollout risk.
  • Hold The Stack: Leave this PR and the integration PR paused until production-bot validation or broader rollout approval is available.

Security
Cleared: No concrete security or supply-chain regression was found; the meaningful risk is runtime compatibility, session ownership, and message delivery behavior.

Live E2E validation (wedge/reclaim)

Ran the real root-cause scenario on this branch: local gateway (dist build), scratch profile, and a black-hole OpenAI-compatible endpoint (accepts POST /v1/chat/completions, never responds, never closes) with provider timeoutSeconds: 36000 so undici/first-event watchdogs don't break the wedge. Default stuck-session recovery was neutralized (diagnostics.stuckSessionWarnMs) to isolate this PR's mechanisms — in default config that recovery aborts a silent run at ~390s, and this PR's settle bound is what then guarantees the abort actually releases (the released=0 link).

Test A — abort ⇒ bounded release: PASS

Note: release was immediate rather than via the 60s settle timer, because the abort signal propagates into the guarded model fetch and the owner unwinds cleanly (the armed settle timer is cancelled). The forced-release path is the backstop for owners that never unwind post-abort — e.g. the embedded abort settle timed out lag observed when stuck-recovery aborted a phase-1 run — and is covered by the registry/admission tests on this exact build (65/65 green).

Test B — silent-stale takeover: works for its target shape; live-runtime wedges never reach admission

• Registry/dispatch level: reclaim of a zero-activity owner by a visible turn, and of a terminal-but-unreleased owner past settle grace, both pass (dispatch-from-config.stale-recovery.test.ts, admission suite).
• Live negative result worth recording: with a live embedded run wedged on a model call, no inbound surface produced a visible admission waiter in 2h of attempts — gateway chat.send on a busy lane always becomes a queued chat turn (queuedFollowupLifecycle, server-methods/chat.ts), and channel DM inbound is steered into the wedged run's queue (queueEmbeddedAgentMessageWithOutcome accepts unconditionally while a run handle exists). So the no_activity takeover rescues stale owners without a live steerable runtime (owner died mid-delivery, detached backend), while live-runtime wedges are rescued by abort (Test A) or by stuck-session recovery + this PR's settle bound in default config.

Follow-up candidates surfaced (out of scope here, feeding #101863 Track B)

1. Steer/queue capture swallows rescue messages before admission on zero-activity runs — steer acceptance should age out (or divert to admission) when the run has no recent activity evidence.
2. agents.defaults.timeoutSeconds: 0 clamps to 1s in config position (resolveAgentTimeoutSeconds Math.max(seconds, 1)) instead of meaning "no timeout" — surprising config semantics, worth a doctor/schema look.

Cleanup verified: no gateway/black-hole/QA-bus processes left, scratch state only, ~/.openclaw untouched.

Addressed the P1 in 4d4df31 — structurally, not with a one-line patch.

The finding was real (queued-followup onReasoningProgress didn't stamp activity), but the defect class is divergence: two call sites hand-rolling the same six CLI callbacks, where any forgotten stamp silently makes healthy runs reclaimable. The fix moves stamping to the one seam both paths share: runCliAgentWithLifecycle now takes onActivity and stamps it before every delivered bridge event (assistant, reasoning text, reasoning progress, tool, commentary, fast-mode). Both callers pass one line (onActivity: () => replyOperation?.recordActivity()) and all eight per-callback stamps were deleted — a future callback can't miss a stamp because call sites no longer stamp. Bonus: reasoning text now also counts as activity (it previously didn't on either path), and it stamps even when no reasoning callback is registered, since the durable-reasoning deliver always runs.

Coverage: two new tests in agent-runner-cli-dispatch.test.ts, including the exact reported scenario — a pure reasoning-progress stretch with no tool/commentary events keeps stamping (onActivity called per delivered progress event).

Acceptance criteria run (worktree, node scripts/run-vitest.mjs + tsgo lanes): followup-runner.test.ts, agent-runner-execution.test.ts, reply-turn-admission.test.ts, reply-run-registry.test.ts, agent-runner-cli-dispatch.test.ts, dispatch-from-config.stale-recovery.test.ts all green; tsgo core + core-test lanes exit 0; oxlint/oxfmt clean on touched files.

On the maintainer decision (10-minute no-activity takeover default): intentionally left open — the PR stays in draft until the maintainer picks accept / narrow / hold-for-Track-B. One datum for that call from the live E2E: for wedges with a live steerable runtime, inbound messages are captured by the steer queue before admission ever evaluates takeover, so the 10-minute policy in practice reclaims dead-owner shapes, not quiet-but-alive runs — the false-positive window is narrower than source inspection suggests.

Maintainer decision (@obviyus): accept the 10-minute zero-activity visible-turn takeover as default policy, with the stamp-seam repair already landed (4d4df31).

Rationale: the takeover requires a human actively waiting plus zero real activity evidence for 10 minutes — and the live E2E on this branch showed that runs with a live steerable runtime capture inbound messages in the steer queue before admission evaluates takeover at all, so the policy in practice reclaims dead-owner shapes. Quiet-but-alive false positives are tracked under #101863; Track B's phase-aware liveness (per-phase floors, reasoning-model allowances) is the designated refinement, not a merge blocker here.

Remaining before undraft: none from this review. The PR stays in draft per maintainer preference until Track A validation on a production bot is scheduled.

Both re-review P1s addressed in ae9081d36e1:

1. Suppressed-run staleness (0.95 confidence — real bug, good catch): activity stamping is now a dedicated delivery-independent bridge that fires on every CLI agent event regardless of suppressAssistantBridge, replacing the per-callback withActivity wrappers entirely (which also removes the wrapper layer). Regression test added: a silentExpected run with suppressed bridges delivers no callbacks but keeps stamping activity.
2. SDK export removal: isStuckSessionRecoveryEnabled and requestStuckDiagnosticSessionRecovery are restored verbatim as @deprecated exports (unused by core; kept because plugin-sdk/text-runtime.ts re-exports the module; removal deferred to the next SDK major per the deprecation policy). The surface-budget change is reverted accordingly.

Focused suites, surface pin, tsgo core/core-test lanes all green; stacked branch #101985 rebased on the new head.

Landing plan update: this track lands atomically with its siblings via the integration PR #102160 (all commits preserved, rebase merge) — sequential landing would put untested intermediate states on main (e.g. the stale takeover without the quiet-tool floor). This PR stays open as the per-track review record and closes when #102160 lands.