Greptile Summary

This PR fixes a class of silent message loss on SIGUSR1 restart by draining two in-memory buffers — per-channel inbound debounce timers and followup queues — before the server tears down. The solution is well-architected: a global debouncer registry (Symbol.for("openclaw.inboundDebouncers")) allows all debouncers to be collectively flushed, a new waitForFollowupQueueDrain poller gives newly-flushed items time to process, and the SIGUSR1 restart sequence is extended with a carefully-ordered set of drain steps.

Key observations from the review:

• All issues raised in previous review rounds have been addressed: the flush count now reflects actual buffers delivered (not debouncers registered), getPendingCount correctly sums per-queue draining sentinels, the flushAllInternal while-loop has a deadline guard, individual flush errors are isolated with try/catch, flushBuffer correctly tracks delivered vs. error-swallowed, the force-exit timer is re-armed conditionally after the debounce flush, and unregister is exposed and wired up across Discord, Slack, Mattermost, WhatsApp, and BlueBubbles monitors.
• Two test files not in the PR diff — extensions/slack/src/monitor/message-handler.app-mention-race.test.ts and extensions/bluebubbles/src/monitor.test.ts — contain stale flushKey mocks returning Promise<void> and omit flushAll / unregister. These won't cause runtime failures (the missing methods are never called in those tests) but may surface as TypeScript type errors under strict checking.

Confidence Score: 4/5

• Safe to merge; the fix is well-tested and all previous review concerns have been addressed, with only a minor stale-mock issue in two unmodified test files.
• The core implementation is correct and the restart drain sequence is properly ordered and guarded. All previously-raised logic bugs are fixed. The only remaining concern is that two test files outside the PR diff have incomplete mocks for the new debouncer interface, which could cause TypeScript errors but will not affect production behavior or the 118 tests the author references.
• extensions/slack/src/monitor/message-handler.app-mention-race.test.ts and extensions/bluebubbles/src/monitor.test.ts — stale debouncer mock types that were not updated alongside the interface changes.

This is a comment left during a code review.
Path: extensions/slack/src/monitor/message-handler.app-mention-race.test.ts
Line: 29-30

Comment:
**Stale mock missing new debouncer fields**

This test's mock of `createChannelInboundDebouncer` was not updated alongside `inbound-debounce.ts`. The return object is missing `flushAll` and `unregister`, and `flushKey` still returns `Promise<void>` instead of the new `Promise<boolean>`.

While `deactivate` (which calls `unregister`) is never invoked in this test so it won't cause a runtime failure, the stale types may produce a TypeScript error if the mock is checked against the `createChannelInboundDebouncer` return type under strict mode. The same issue exists at `extensions/bluebubbles/src/monitor.test.ts:1104` where `flushKey` is mocked with `vi.fn(async (key: string) => { await flush(key); })` — also returning `Promise<void>` and omitting `flushAll` and `unregister`.

How can I resolve this? If you propose a fix, please make it concise.

_{Last reviewed commit: 5092f7d}

@clawsweeper re-review

Rebuilt on main cutoff 262baedcf7fa3d66dc35cce7d0253e0a31f0cc0e; current head is 5ae09ec76ee9b851cb24b07acad291724c185868. The diff is narrowed to 13 files, the public SDK drain bypass is removed, followup drain counts droppedCount, and the PR body now contains exact-head runtime proof plus focused test/type/lint results.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper re-review

Current exact head is 5c06769703c80bf306311dac261e0e3cefce402f. The follow-up commit fixes the two type-aware oxlint findings from exact-head CI; the exact CI tsconfig, affected 53 tests, core typecheck, and runtime proof now pass on this head.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper re-review

Current exact head is 1952ec24195d85e8f6ea032fe76b44806d952f69. The only new change isolates the followup drain test from shared FOLLOWUP_QUEUES state exposed by the full CI shard. The exact two-file shard (18 tests) and full six-file focused suite (166 tests) now pass.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The targeted re-review published an exact durable review comment and queued an executing target-wide serialized router scan.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29168046367
• Updated: 2026-07-11T21:09:25.156Z

@clawsweeper re-review

Exact head c9067e7397281341627e8fdef266b7b865ff6101 addresses both blocking P1 findings:

• pre-created debounce callbacks are rebound with a captured async context from the core-private restart continuation before their reserved tasks are released;
• the global sweep receives the remaining restart deadline and is additionally capped at 100 passes / 30 seconds.

Focused regressions cover the pre-created command enqueue, sustained ingress, the exact final-pass boundary, and a slow callback at its deadline. The PR body now uses the required headings and records exact-head validation.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@openclaw-mantis telegram live: reproduce an inbound message buffered immediately before SIGUSR1/config reload and capture redacted proof that it is processed exactly once after the drain.

@clawsweeper re-review

Exact head 8c0a7a4e4cf7c35b97309c41b109e3134d94fb46 strengthens the admission regression to match the reported reproduction literally: the debounce buffer is created inside an admitted inbound root, that original root is released, restart admission closes, and the pre-created callback then successfully enqueues real command work only through the core-private drain context. The process suite remains 40/40 green; the PR body and exact tree identity are updated.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The targeted re-review published an exact durable review comment and queued an executing target-wide serialized router scan.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29169410675
• Updated: 2026-07-11T21:56:09.205Z

@clawsweeper re-review

Exact head 9ec51a263dbfa5a325d3300070db1637f190d1c9 addresses the timer-boundary P1 across both ownership and accounting:

• each reserved debounce key task is created inside a tracked required continuation before it waits on the buffer's ready gate;
• parentless accepted buffers now receive the same required-continuation ownership through the normal admission fence;
• flushBuffer atomically tracks a buffer as in-flight before removing it, and the global sweep counts/awaits removed-but-unsettled tasks even when it claims zero new buffers;
• the exact regression fires the normal timer after restart admission closes, pauses inside onFlush, proves the restart sweep remains unsettled, then releases a real command enqueue and verifies successful exactly-once settlement.

Exact local validation: 4 focused files / 164 tests, type-aware lint and formatting, core production/test tsgo, and plugin SDK declaration tsgo all pass. The PR body and exact tree identity are updated.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper re-review

Exact head 38befdcf347331814f3453093ff3ef0c31cc33c0 closes the restart-signal-pending gap while preserving the private fence:

• ordinary/new roots remain rejected as soon as beginGatewayRestartSignalAdmission() runs;
• only already-reserved requiredContinuation roots may finish subordinate work during that pending-signal window;
• a real debounce regression creates the buffer under accepted admission, closes the pending-signal fence, fires its normal timer, and verifies its command enqueue completes; a unit regression simultaneously proves a new root is still refused.

The timer in-flight tracking/settlement regression remains in place. Exact validation is now 4 files / 166 tests, formatting/type-aware lint, core production/test tsgo, and plugin SDK declaration tsgo. PR body/tree identity are updated.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The targeted re-review published an exact durable review comment and queued an executing target-wide serialized router scan.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29170298845
• Updated: 2026-07-11T22:27:44.007Z

@clawsweeper re-review

Exact head bb8f1b842e85c6745e7f8a1bfb8303d73ca6f7f6 addresses the remaining restart-deadline P1:

• the initial active-task and embedded-run waits now receive one shared snapshot of resolveRemainingRestartDrainTimeoutMs(), after debounce and channel drains have consumed their time;
• bounded restarts therefore preserve one absolute deadline, while unbounded restarts still pass undefined;
• the focused deterministic regression starts with 100 ms, consumes 35 ms in debounce drain and 25 ms in channel drain, then proves both active-work waits and final close receive at most the 40 ms remainder.

Exact local validation: 4 focused files / 167 tests; formatting and type-aware lint; core production/test tsgo; and plugin SDK declaration tsgo all pass. The PR body and exact tree identity are updated.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The targeted re-review published an exact durable review comment and queued an executing target-wide serialized router scan.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29170828283
• Updated: 2026-07-11T22:46:05.649Z

@joeykrug thanks for the PR. ClawSweeper is still waiting on real behavior proof before this can move forward.

Useful proof can be a screenshot, short video, terminal output, copied live output, linked artifact, or redacted logs that show the changed behavior after the fix. Please redact private tokens, phone numbers, private endpoints, customer data, and anything else sensitive.

Once proof is added to the PR body or a comment, ClawSweeper or a maintainer can re-check it.