Summary

• Replace the async exec approval follow-up expectFinal path with explicit agent.wait handling for accepted gateway runs, avoiding direct fallback duplicates while the agent continuation is still running.
• Add stable approval-id dedupe across nonce idempotency keys, with early overlap reservation, cleanup on pre-run failures, active-run TTL protection, and regression coverage.
• Add a changelog entry for [Bug]: Multiple parallel sessions deliver duplicate messages for every async exec completion #82711

Verification

• pnpm -s format -- src/gateway/server-methods/agent.ts src/gateway/server-methods/agent.test.ts src/gateway/server-maintenance.ts src/gateway/server-maintenance.test.ts src/agents/bash-tools.exec-approval-followup.ts src/agents/bash-tools.exec-approval-followup.test.ts
• git diff --check origin/main...HEAD
• node scripts/run-vitest.mjs src/agents/bash-tools.exec-approval-followup.test.ts src/gateway/server-methods/agent.test.ts src/gateway/server-maintenance.test.ts -- --reporter=verbose
• Codex review: /Users/steipete/Projects/agent-scripts/skills/codex-review/scripts/codex-review --mode branch --base origin/main -> clean, no accepted/actionable findings reported.
• Crabbox approval scenario: provider=aws, leaseId=cbx_43f0ff1be053, slug=silver-lobster, run=run_c59813d12220, command exited 0 with 5 test files and 245 tests passed.

Real behavior proof

Behavior addressed: Duplicate async exec approval follow-up continuations when approval retries use different nonce idempotency keys.

Real environment tested: AWS Crabbox Linux lease synced from this PR branch after Node 22 runtime setup; provider=aws, leaseId=cbx_43f0ff1be053, slug=silver-lobster, run=run_c59813d12220.

Exact steps or command run after this patch: On the AWS Crabbox lease, ran the approval follow-up scenario command with env CI=1 NODE_OPTIONS=--max-old-space-size=4096 OPENCLAW_TEST_PROJECTS_PARALLEL=6 OPENCLAW_VITEST_MAX_WORKERS=1 OPENCLAW_VITEST_NO_OUTPUT_TIMEOUT_MS=900000 node scripts/run-vitest.mjs src/agents/bash-tools.exec-approval-followup.test.ts src/gateway/server-methods/agent.test.ts src/gateway/server-maintenance.test.ts -- --reporter=verbose.

Evidence after fix: Terminal output from AWS Crabbox run run_c59813d12220:

run context:
  run=run_c59813d12220 portal=https://crabbox.openclaw.ai/portal/runs/run_c59813d12220 logs=https://crabbox.openclaw.ai/v1/runs/run_c59813d12220/logs
  lease=cbx_43f0ff1be053 slug=silver-lobster provider=aws target=linux type=c7a.8xlarge
  workdir=/work/crabbox/cbx_43f0ff1be053/clawdbot7 workspace=raw actions=-
RUN v4.1.6 /work/crabbox/cbx_43f0ff1be053/clawdbot7
Test Files 5 passed (5)
Tests 245 passed (245)
command complete in 2m19.495s total=2m22.297s
{"provider":"aws","leaseId":"cbx_43f0ff1be053","slug":"silver-lobster","syncSkipped":true,"commandMs":139495,"totalMs":142297,"exitCode":0}

Observed result after fix: The approval follow-up path now waits on accepted gateway runs instead of falling through to direct delivery; overlapping retries with a fresh nonce reuse the stable approval-id reservation and do not start a second agent command; failed pre-run reservations are cleared so a retry can start normally.

What was not tested: Live Telegram/Discord user approval with real channel credentials.