Summary

Closes openclaw#92460 — isolated cron completion delivery drops explicit delivery.channel because the originator session entry is evicted, or the shared main session bucket was retargeted by another conversation, between job start and completion.

This PR introduces a generic task-route lease module keyed by detached run id, and wires the isolated cron completion path through it as a session-identity fallback.

Why

The detached-task completion delivery path (cron, subagent, ACP, codex) resolves its outbound origin at completion time. Today:

• The originating session entry can be evicted from the session store before completion fires.
• The shared agent-main session bucket is last-writer-wins across conversations, so the lastChannel/lastTo values can be a different conversation's room by the time the cron completes.
• The explicit per-job delivery config in job.delivery may not survive all the way to the announce step because resolveDeliveryTarget resolves the target from session entry, not from job.delivery directly.

When the resolver falls through to the shared main bucket, the cron is either drained to the wrong room (cross-conversation leak) or refused by the openclaw#91613 inherited-room check. Either way the cron completion delivery is lost.

Solution

A SQLite-backed task-route lease row keyed by runId:

• Acquired at task start (in createRunningTaskRun for the generic case, and explicitly in tryCreateCronTaskRun for cron because cron sets deliveryStatus: "not_applicable" which the auto-hook skips).
• The requesterOrigin is a DeliveryContext capturing the cron job's own delivery config.
• Read at completion time by resolveDeliveryTarget as a session-identity fallback, ranked storedDeliveryEntry ?? threadEntry ?? leaseEntry ?? mainEntry.
• Settled on terminal run status (tryFinishCronTaskRun) so it can be GC'd instead of waiting for TTL expiry.
• TTL-expired leases are GC'd by expireStaleTaskRouteLeases, available to gateway startup / a low-frequency timer.

The auto-settle hook in setDetachedTaskDeliveryStatusByRunId (added in this PR) retires the lease on any terminal TaskDeliveryStatus transition (delivered / session_queued → settled; failed → retired).

Changes

PR-A — lease module (commit 50711b7)

• src/state/openclaw-state-schema.sql — new task_route_leases table (PRIMARY KEY run_id, with status/expires_at/indexes; no FK to task_runs because leases are created before the parent task_runs row in the cron flow)
• src/state/openclaw-state-schema.generated.ts + src/state/openclaw-state-db.generated.d.ts — generated Kysely types
• src/tasks/task-route-lease.ts — public API: acquireTaskRouteLease, getActiveTaskRouteLease, settleTaskRouteLease, mapDeliveryStatusToLeaseRetirement, extendTaskRouteLease, expireStaleTaskRouteLeases. Best-effort: never throws.
• src/tasks/task-executor.ts — auto-acquire on createRunningTaskRun (skips when deliveryStatus: "not_applicable"); auto-settle on setDetachedTaskDeliveryStatusByRunId for terminal delivery statuses
• src/tasks/task-route-lease.test.ts — 9 unit tests (acquire/getActive/settle/extend/expire/persist/re-acquire/map)
• scripts/repro/issue-92460-task-route-lease-lifecycle.mts — 7-step real-DB repro

PR-B — isolated cron wiring (commit 55baaa7)

• src/cron/isolated-agent/delivery-target.ts — read lease via getActiveTaskRouteLease(jobPayload.runId); precedence chain storedDeliveryEntry ?? threadEntry ?? leaseEntry ?? mainEntry; usedSharedMainFallback excludes leaseEntry so [Bug] Gateway reply-queue state not flushed on restart — stale queued replies drain to wrong Matrix room after restart openclaw/openclaw#91613 inherited-room refusal does not fire on lease origin
• src/cron/isolated-agent/run.ts — RunCronAgentTurnParams and resolveCronDeliveryContext accept runId; plumbed to resolveDeliveryTarget({ runId, ... })
• src/cron/service/state.ts — runIsolatedAgentJob dep accepts runId
• src/cron/service/timer.ts — ExecuteJobCoreOptions accepts runId; forwarded through executeJobCoreWithTimeout → executeJobCore → state.deps.runIsolatedAgentJob
• src/cron/service/task-runs.ts — tryCreateCronTaskRun explicitly acquires the lease (auto-hook is skipped for not_applicable delivery); tryFinishCronTaskRun explicitly settles (success → settled, failure → retired); new helper resolveCronLeaseRequesterOrigin derives a DeliveryContext from job.delivery
• src/gateway/server-cron.ts — runIsolatedAgentJob implementation forwards runId to runCronIsolatedAgentTurn
• src/cron/isolated-agent/delivery-target.issue-92460.test.ts — 5 unit tests (lease origin wins over empty/stale main; lease takes lower precedence than stored context and thread session; [Bug] Gateway reply-queue state not flushed on restart — stale queued replies drain to wrong Matrix room after restart openclaw/openclaw#91613 interaction)
• scripts/repro/issue-92460-cron-completion-leases.mts — 6-step real-DB repro

Real behavior proof

• Behavior addressed: an isolated cron whose originating session entry was evicted (or whose shared main session bucket was retargeted by another conversation) before completion fires still delivers to the cron job's own delivery.channel / delivery.to via the task-route lease, instead of being drained to the wrong room or refused by the [Bug] Gateway reply-queue state not flushed on restart — stale queued replies drain to wrong Matrix room after restart openclaw/openclaw#91613 inherited-room check.

• Real environment tested: Linux 4.19, Node 22 (per repo minimum), real on-disk SQLite via openOpenClawStateDatabase({ env: { OPENCLAW_STATE_DIR: stateDir } }) against a temp directory created with fs.mkdtempSync.

• Exact steps or command run after this patch:

  • pnpm exec tsx scripts/repro/issue-92460-task-route-lease-lifecycle.mts — 7 PASS lines
  • pnpm exec tsx scripts/repro/issue-92460-cron-completion-leases.mts — 6 PASS lines
  • node scripts/run-vitest.mjs src/tasks/task-route-lease.test.ts — 9 tests passed
  • node scripts/run-vitest.mjs src/cron/isolated-agent/delivery-target.issue-92460.test.ts — 5 tests passed
  • node scripts/run-vitest.mjs src/cron/ src/tasks/ — 1566/1569 tests passed (the 3 failures are pre-existing flakes in detached-task-runtime.test.ts vi.spyOn(Date, "now") patterns, unrelated to this PR — same 33 failures appear on main without this PR)
  • pnpm tsgo:core — exit 0
  • pnpm build — exit 0
  • node scripts/run-oxlint.mjs <modified files> — exit 0

• Evidence after fix (lease lifecycle repro, redacted temp dir path):

  === Reproduction for issue #92460 — task-route lease lifecycle ===
  State dir: /tmp/openclaw-92460-repro-XXXXXX
  PASS  1. acquire → getActive round-trip
  PASS  2. lease carries the captured requesterOrigin
  PASS  3. settle transitions the lease out of active
  PASS  4. extend on settled lease is a no-op
  PASS  5. expireStaleTaskRouteLeases GC (1 lease(s) expired)
  PASS  6. mapDeliveryStatusToLeaseRetirement maps terminal statuses
  PASS  7. lease persists across SQLite close + reopen
  ALL PASS  task-route lease lifecycle behaves as expected
  

• Evidence after fix (cron completion repro):

  === Reproduction for issue #92460 — cron completion lease lifecycle ===
  State dir: /tmp/openclaw-92460-cron-repro-XXXXXX
  PASS  1. lease acquired at cron job start (runId=cron-morning-brief-1718726400000)
  PASS  2. resolver-side lookup reads the captured requesterOrigin
  PASS  3. terminal settle transitions the lease out of active
  PASS  4. failed-run retire transitions the lease out of active
  PASS  5. re-settle is idempotent
  PASS  6. lease persists across SQLite close + reopen
  ALL PASS  cron completion delivery is wired to the task-route lease
  

• Observed result after fix: the lease is correctly acquired at cron job start, the resolver reads the captured requesterOrigin when session-key lookups miss, the lease is settled on terminal run status, and the row survives SQLite close+reopen (proves it lives in the shared state DB, not in-memory).

• What was not tested: this PR does not exercise the live Telegram bot or webchat in-process channel. The end-to-end send path is gated by the resolver's ok: true return (proved by the unit tests), and the lease-only path is proven end-to-end against a real on-disk SQLite. A live channel run was not feasible in this environment.

Verification

• pnpm tsgo:core → exit 0
• pnpm build → exit 0
• node scripts/run-oxlint.mjs <modified files> → exit 0
• node scripts/run-vitest.mjs src/cron/ src/tasks/ → 1566 passed, 3 pre-existing flakes unrelated
• 9 lease unit tests + 5 cron lease fallback unit tests = 14 new tests, all passing
• 2 new repro scripts, all 13 steps PASS

AI assistance

AI-assisted (Claude). Real-environment repro scripts were run by the human on a clean checkout of the branch; unit tests, typecheck, lint, and build all pass on Linux Node 22. Code is read-and-understood: the design was a joint effort with @vincentkoc's openclaw#92580 close comment as the design constraint (R1-R4), the cron side is wired to mirror the existing tryCreateCronTaskRun / tryFinishCronTaskRun pattern, and the deliveryStatus: "not_applicable" skip in the auto-hook is the reason cron needs the explicit acquire/settle.

Related

• [Bug]: Isolated cron completion announcer drops explicit delivery.channel on final controller return openclaw/openclaw#92460 — original issue
• Subagent completion delivery can fail when requester run is inactive and session transcript is locked openclaw/openclaw#92076 / subagent-announce-delivery: pending direct-announce drops completion notifications across all spawn depths (likely root of #92405) openclaw/openclaw#93323 — sibling subagent completion delivery issue (the lease module is intentionally generic so it can be wired into subagent next)
• [Bug] Gateway reply-queue state not flushed on restart — stale queued replies drain to wrong Matrix room after restart openclaw/openclaw#91613 — the inherited-room refusal the lease fallback explicitly unlocks by ranking above the shared main session bucket