ClawSweeper review: did not complete due to Codex infrastructure failure. Reviewed July 9, 2026, 3:43 AM ET / 07:43 UTC.

Summary
Review failed before ClawSweeper could summarize the requested change.

PR surface: Source +354, Tests +691, Docs 0. Total +1045 across 46 files.

Reproducibility: unclear. The review failed before ClawSweeper could establish a reproduction path.

Review metrics: none identified.

Stored data model
Persistent data-model change detected: serialized state: src/agents/cli-runner.spawn.test.ts. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Not assessed.
Failure reason: timeout.

This is a ClawSweeper/Codex infrastructure failure, not a PR readiness or patch-quality verdict.
Keep any merge decision on the normal maintainer review path until ClawSweeper can complete a fresh review.

Risk before merge

• [P1] No close action taken because the review did not complete.

Maintainer options:

1. Decide the mitigation before merge
   Retry the Codex review after fixing the execution failure.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

• Review did not complete, so no work-lane recommendation was made.

Both code findings fixed and rebuilt into this branch (ce3339dd05a):

1. Self-hosted explicit run-timeout cap (d2a3cc9ba76 on fix(agents): keep finite LLM idle watchdog under unlimited run budgets #101986): the explicit non-cron run-budget branch now goes through the same provider-class ceiling as the agent-budget branch — one shared clampToClassIdleCeiling helper (local: budget-bound with no class ceiling; self-hosted: 300s; cloud: 120s), replacing the cloud-only implicit clamp entirely. Resolver table tests added for budgets above and below the tiers.
2. Detached-but-leased suspect close (c66a2e58956 on fix(codex): ungate app-server terminal liveness and fan out poisoned-client retirement #102097): failActiveLeases now closes the physical client even when the entry was already gracefully detached from the shared map (the one-shot-cleanup-then-terminal-kill ordering), with a WeakSet guard so a repeat suspect retire honestly reports closed: false. Regression test covers graceful-retire → suspect-retire.

On the maintainer-acceptance item: the upgrade-behavior decisions (10-minute takeover default, run_stalled attribution, B3 timeout semantics, B2 terminal-only fan-out) are each recorded explicitly by @obviyus on the per-track PRs (#101910, #101986, #102097). This PR stays draft while the stack soaks on a production bot for several days; undraft follows the soak verdict plus a final rebase + full gate.

@clawsweeper autoreview

🦞👀
ClawSweeper assist is taking a look at your question.

I queued a lightweight read-only assist pass. It will post a separate answer comment and will not edit the durable ClawSweeper review comment or trigger close, merge, repair, label, or branch changes.

Request: autoreview

ClawSweeper assist: Existing autoreview has already run on #102160 at head ce3339dd05a810e3e60146680404816c177221f2. Current result is: no findings, but maintainer review is still required before merge because this is a draft XL run-lifecycle compatibility/session-state/message-delivery change.

Evidence:

• Previous ClawSweeper review: “needs maintainer review before merge,” reviewed July 8, 2026 12:31 UTC, SHA ce3339dd05a810e3e60146680404816c177221f2.
• Earlier findings were fixed after force-push ce3339dd05a: self-hosted explicit timeout cap and detached-but-leased suspect close.
• Labels now include proof: sufficient, rating: 🐚 platinum hermit, and status: 👀 ready for maintainer look.
• PR is still draft, mergeable state is behind, with 46 files changed and 17 commits.

Suggested next action: For a fresh full correctness pass on the current PR, use @clawsweeper review.

Source: #102160 (comment)
Assist reasoning: low.

Soak finding (HamVerBot, 2026-07-08 17:21 UTC): a live Claude CLI turn was killed with CLI produced no output for 180s and was terminated while a quiet Bash tool was running (diagnostics: blocked_tool_call activeTool=Bash activeToolAge=163s recovery=none).

Analysis: not a regression from this branch — the live-session no-output watchdog resets only on real subprocess stdout/stderr (handleClaudeStdout), and the deleted cli_live:tool_running heartbeat never fed it; main kills this scenario identically. But it is the same inconsistency this stack fixes elsewhere: embedded runs honor BLOCKED_TOOL_CALL_ABORT_FLOOR_MS (15 min) for quiet tool calls, while the claude-cli live watchdog killed them at the 180s base window even though turn.activeTools proves a tool is outstanding.

Fix in f493f8b: unified the two watchdog arming sites into armNoOutputTimer; while observed tool calls are outstanding, the quiet window extends to max(noOutputTimeoutMs, BLOCKED_TOOL_CALL_ABORT_FLOOR_MS); the retryable cli_no_output_timeout code is preserved exactly for turns that never produced output; the kill message now reports actual quiet time. New test covers no-kill-at-base + kill-at-floor + timed_out tool provenance (replaces the test that pinned the old mid-tool kill).

Out of scope sibling: the generic (non-live) CLI runner delegates its no-output kill to the process supervisor (src/process/supervisor/supervisor.ts), which is agent-agnostic and has no tool visibility; extending it needs a supervisor API seam — follow-up if it ever bites in practice.

Validation: cli-runner.spawn.test.ts + cli-runner.reliability.test.ts green (148/148), tsgo core + core-test lanes green, oxlint/oxfmt clean.