Best possible solution:

Keep the lifecycle-boundary filter and regression coverage, then land after maintainer undraft/review and exact-head checks remain green.

Do we have a high-confidence way to reproduce the issue?

Yes. Source inspection on current main shows assembleHarnessContextEngine and finalizeHarnessContextEngineTurn pass unfiltered message arrays into context-engine hooks, so a hidden runtime-context custom message in those arrays reaches the hook.

Is this the best way to solve the issue?

Yes. Reusing the existing runtime-context custom-message stripper at the harness lifecycle boundary is the narrow maintainable fix, and the proposed helper preserves the pre-prompt/new-turn boundary by filtering each side separately.

What I checked:

• Protected PR state: Provided GitHub context shows this PR is draft, authorAssociation is MEMBER, and labels include maintainer, so cleanup-close automation should not close it. (4740481a1179)
• Current assemble path is unfiltered: Current main passes params.messages directly into contextEngine.assemble, so hidden runtime-context custom messages can reach the assemble hook. (src/agents/harness/context-engine-lifecycle.ts:74, c874c0863ada)
• Current post-turn paths are unfiltered: Current main passes messagesSnapshot to afterTurn and slices messagesSnapshot for ingest fallback without removing runtime-context custom messages. (src/agents/harness/context-engine-lifecycle.ts:118, c874c0863ada)
• Existing filter helper matches the PR boundary: stripRuntimeContextCustomMessages already removes messages whose role is custom and customType is openclaw.runtime-context. (src/agents/internal-runtime-context.ts:234, c874c0863ada)
• Runtime context policy supports filtering: Transcript hygiene docs say runtime/system context is not end-user-authored transcript content and stored visible turns use the transcript-facing body rather than runtime-enriched prompt content. Public docs: docs/reference/transcript-hygiene.md. (docs/reference/transcript-hygiene.md:32, c874c0863ada)
• PR patch applies the narrow lifecycle fix: The public PR patch adds the existing filter before assemble, builds a filtered conversation snapshot for afterTurn and ingest fallback, and adds tests for assemble, afterTurn, and ingestBatch behavior. (src/agents/harness/context-engine-lifecycle.ts:72, 4740481a1179)

Likely related people:

• @jalehman: GitHub commit history shows Josh Lehman introduced the app-server harness context-engine lifecycle in feat(codex): run context-engine lifecycle in app-server harness #70809 and is repeatedly credited/reviewed in context-engine contract history. (role: introduced and reviewed adjacent context-engine lifecycle work; confidence: high; commits: 51186d272543, 751d5b7849ca, 75e7fc97f804; files: src/agents/harness/context-engine-lifecycle.ts, src/context-engine/types.ts)
• @steipete: Recent main history shows Peter Steinberger touching the harness lifecycle file, runtime-context helper file, and transcript hygiene/runtime-context behavior around this area. (role: recent maintainer of runtime-context and context-engine paths; confidence: high; commits: f7ed29e11812, 9a9fefd21fe2, 11e6928b3edc; files: src/agents/harness/context-engine-lifecycle.ts, src/agents/internal-runtime-context.ts, docs/reference/transcript-hygiene.md)
• @vincentkoc: Beyond authoring this PR, current-main history shows Vincent Koc recently changed context-engine-related code and transcript-hygiene docs, making him relevant to follow-up review. (role: recent adjacent context-engine maintainer; confidence: medium; commits: 2988203a5e52, 5bba899a7062; files: src/context-engine/types.ts, docs/reference/transcript-hygiene.md)

Remaining risk / open question:

• This read-only review did not execute the PR tests; it relies on source inspection and the test commands reported in the PR body.
• The PR is draft and was recently force-pushed, so exact-head validation may need to be repeated before merge.

Codex review notes: model gpt-5.5, reasoning high; reviewed against c874c0863ada.