Best possible solution:

Land this narrow UI-boundary hardening after adding valid changelog credit and keeping exact-head validation green, without moving stale persisted-row repair into startup core.

Do we have a high-confidence way to reproduce the issue?

Yes. A high-confidence source-level reproduction is to put a Cron row with a missing or non-object payload into state.cronJobs or a cron.list response on current main; app render, edit hydration, and job detail paths dereference job.payload.kind.

Is this the best way to solve the issue?

Yes for the functional bug. A shared UI payload guard plus list-boundary filtering is the narrowest maintainable fix for stale malformed Cron rows, with only changelog attribution remaining.

Full review comments:

• [P3] Add a human credit to the changelog entry — CHANGELOG.md:17
  OpenClaw changelog policy asks contributor-facing user-visible fix entries to include at least one human Thanks @... credit. This new Control UI/Cron fix entry lacks one, so add the appropriate reporter or contributor credit before merge.
  Confidence: 0.9

Overall correctness: patch is correct
Overall confidence: 0.86

Acceptance criteria:

• git diff --check
• pnpm exec oxfmt --check --threads=1 CHANGELOG.md

What I checked:

• Protected routing: The PR author association is MEMBER and the PR has the protected maintainer label, so conservative cleanup policy keeps it open rather than closing it. (21354f06acb0)
• Current-main app render crash path: Current main builds Cron model suggestions by directly reading job.payload.kind and job.payload.model, so a stale Cron row with payload: undefined can throw during shared app render. (ui/src/ui/app-render.ts:841, 33eebc29c31f)
• Current-main Cron list trusts rows: loadCronJobsPage assigns every array entry returned by cron.list into state.cronJobs without validating payload shape first. (ui/src/ui/controllers/cron.ts:303, 33eebc29c31f)
• Current-main edit hydration crash path: Cron edit/clone hydration directly dereferences job.payload.kind, text, message, and timeoutSeconds, so malformed stale UI state can crash when a Cron row is opened or cloned. (ui/src/ui/controllers/cron.ts:463, 33eebc29c31f)
• Current-main Cron detail crash path: Cron job detail rendering directly reads job.payload.kind and job.payload.message, matching the linked undefined.kind failure class when malformed rows reach the view. (ui/src/ui/views/cron.ts:1583, 33eebc29c31f)
• Gateway contract requires payloads: The protocol schema requires Cron jobs to carry a payload matching either systemEvent with text or agentTurn with message, so the PR correctly treats malformed persisted/runtime rows as tainted UI-boundary data. (src/gateway/protocol/schema/cron.ts:137, 33eebc29c31f)

Likely related people:

• BunsDev: Provided PR context and prior review discussion tie this maintainer to recent Control UI/Cron work; local author search over the affected UI paths also found prior dashboard/app-render history associated with the same author query. (role: recent Control UI contributor and PR owner; confidence: medium; commits: e697ec273a85, 5fce2f6b0fb1; files: ui/src/ui/app-render.ts, ui/src/ui/controllers/cron.ts, ui/src/ui/views/cron.ts)
• steipete: Current-main blame on the Cron controller, view, and shared UI types points to a recent broad maintainer commit over the affected paths. (role: recent maintainer/refactor owner; confidence: medium; commits: c06739d773da; files: ui/src/ui/controllers/cron.ts, ui/src/ui/views/cron.ts, ui/src/ui/types.ts)
• Val Alexander: Recent local history over affected UI files includes Control UI app-render work and older dashboard polish touching this surface. (role: recent Control UI maintainer; confidence: medium; commits: 5fce2f6b0fb1, e697ec273a85; files: ui/src/ui/app-render.ts, ui/src/ui/app-render.assistant-avatar.test.ts)

Remaining risk / open question:

• The only known pre-merge cleanup is the missing human changelog credit for a user-facing fix entry.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 33eebc29c31f.