Best possible solution:

Split or rework this into narrow owner-bounded PRs that preserve retry and cleanup semantics, avoid blanket Codex deadlines, keep transcript idempotency in owned storage, align generated config metadata if queue controls stay, and add redacted live behavior proof.

Do we have a high-confidence way to reproduce the issue?

Yes for the review findings by source inspection: current main and the PR diff differ on Discord replay/cleanup, Codex timeout semantics, transcript sidecar state, and generated config metadata; no live reproduction was established for the original load claim.

Is this the best way to solve the issue?

No; this is a broad mitigation rather than the best fix, and the safer path is smaller owner-bounded changes that preserve existing delivery, timeout, and storage contracts unless maintainers explicitly approve new policy.

Full review comments:

• [P1] Do not consume unprocessed Discord queue drops — extensions/discord/src/monitor/message-run-queue.ts:107-127
  This commits replay keys when the queue cap is exceeded and again for stale jobs before they reach processDiscordQueuedMessage. Current skipped-job cleanup releases replay claims for accepted but not-started work, so committing here can suppress retry for a Discord delivery that was never processed.
  Confidence: 0.92
• [P1] Preserve skipped queued-message cleanup — extensions/discord/src/monitor/message-run-queue.ts:138-140
  deactivate() now clears pending jobs and deactivates the run queue without running the current cleanup that releases replay claims and cleans reply typing feedback for accepted but not-started jobs. On shutdown or abort, those jobs can leave stale replay or typing state that affects later delivery behavior.
  Confidence: 0.9
• [P1] Keep Codex RPC timeouts caller-opt-in — extensions/codex/src/app-server/client.ts:541-543
  When timeoutMs is omitted, this helper now gives every app-server RPC a 60s deadline. Current main only times out calls that explicitly pass a timeout, and the checked sibling Codex app-server source does not define a universal 60s JSON-RPC deadline, so legitimate long-running operations can fail without caller opt-in.
  Confidence: 0.9
• [P2] Keep transcript idempotency in owned storage — src/config/sessions/transcript.ts:449-452
  This writes a runtime ${transcriptPath}.idempotency.json sidecar next to the transcript. OpenClaw-owned runtime state/cache needs clear storage ownership, cleanup, and rebuild semantics before adding another file format beside transcript files.
  Confidence: 0.86
• [P2] Regenerate bundled Discord config metadata — src/config/zod-schema.providers-core.ts:714-715
  The PR accepts maxPendingPerSession and maxQueuedAgeMs in the runtime schema, but bundled generated channel config metadata still only exposes inboundWorker.runTimeoutMs. Packaged config/help surfaces can drift from runtime unless the generated metadata is updated or the new config surface is removed.
  Confidence: 0.82

Overall correctness: patch is incorrect
Overall confidence: 0.91

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 9d68f877ac3e.

Label justifications:

• P1: The PR changes active Discord delivery, session transcript state, and Codex app-server behavior with blockers that can affect real workflows.
• merge-risk: 🚨 compatibility: The PR adds Discord config surfaces and changes omitted Codex app-server timeout behavior for existing callers.
• merge-risk: 🚨 message-delivery: The new Discord queue cap and stale-age paths can mark unprocessed deliveries as consumed rather than retryable.
• merge-risk: 🚨 session-state: The PR changes skipped queued-job cleanup and adds transcript idempotency sidecar state outside the current storage path.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🧂 unranked krab.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body supplies terminal output for CI, lint, typecheck, and unit tests only, and explicitly omits live Discord, live Codex app-server, and long-duration load proof. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

PR surface:

Source +577, Tests +772. Total +1349 across 22 files.

Acceptance criteria:

• [P1] Re-run targeted Discord queue tests after preserving retry/cleanup semantics.
• [P2] Run focused Codex app-server client tests after removing or making explicit any timeout change.
• [P1] Validate generated config metadata if Discord inboundWorker keys remain.
• [P1] Collect redacted live Discord/Gateway and Codex app-server proof for the changed runtime paths.

What I checked:

• Live PR state: this PR is open at bd224fb, marked CONFLICTING/DIRTY, and changes 22 files with 1442 additions and 93 deletions. (bd224fbbcc8e)
• Current Discord skipped-job cleanup: Current main releases replay claims and typing cleanup for queued Discord jobs skipped before processing, which preserves retry behavior for accepted but unstarted work. (extensions/discord/src/monitor/message-run-queue.ts:75, 9d68f877ac3e)
• PR consumes unprocessed Discord queue drops: The PR commits replay keys when max-pending is exceeded and when queued jobs become stale before processDiscordQueuedMessage runs. (extensions/discord/src/monitor/message-run-queue.ts:107, bd224fbbcc8e)
• PR drops skipped cleanup on deactivate: The PR clears pendingBySession and deactivates the run queue without running the current skipped-job cleanup path. (extensions/discord/src/monitor/message-run-queue.ts:138, bd224fbbcc8e)
• Channel queue timeout contract: Current channel lifecycle says channel queues serialize per key and do not impose run timeouts; callers rely on session/tool/runtime lifecycle for long-running work. (src/plugin-sdk/channel-lifecycle.core.ts:51, 9d68f877ac3e)
• Discord timeout compatibility contract: Current Discord timeout helpers are compatibility-only and say Discord no longer enforces channel-owned listener or inbound run timeouts. (extensions/discord/src/monitor/timeouts.ts:4, 9d68f877ac3e)

Likely related people:

• steipete: Authored recent shared Discord queue and channel run-timeout removal commits in the lifecycle boundary this PR changes. (role: recent Discord queue and channel lifecycle contributor; confidence: high; commits: 364c67bcb5b7, 07631fb931fc; files: extensions/discord/src/monitor/message-run-queue.ts, extensions/discord/src/monitor/timeouts.ts, src/plugin-sdk/channel-lifecycle.core.ts)
• zhuisDEV: Authored the recent queued reply typing feedback cleanup work directly adjacent to the skipped-job cleanup this PR removes. (role: recent Discord queue contributor; confidence: high; commits: 6f20f29688d7; files: extensions/discord/src/monitor/message-run-queue.ts)
• kevinslin: Authored recent remote app-server plugin support in the same Codex client path whose request timeout and write behavior this PR changes. (role: recent Codex app-server contributor; confidence: medium; commits: bc5081c58730; files: extensions/codex/src/app-server/client.ts)
• jalehman: Authored recent transcript writer seam refactoring adjacent to the idempotency storage path changed here. (role: recent transcript writer seam contributor; confidence: medium; commits: 00a75db4280b; files: src/config/sessions/transcript.ts)
• vincentkoc: Authored recent delivery mirror dedupe work adjacent to the transcript idempotency and channel-final behavior touched by the sidecar change. (role: adjacent delivery mirror contributor; confidence: medium; commits: f5eddc2b6d1f; files: src/config/sessions/transcript.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.