Codex review: needs maintainer review before merge. Reviewed May 28, 2026, 4:45 PM ET / 20:45 UTC.

Summary
The PR adds an in-memory active-run projection flag and lifecycle cleanup hook so completed chat runs stop appearing active in sessions.list while the chat.send retry guard remains alive until normal cleanup.

PR surface: Source +25, Tests +125. Total +150 across 6 files.

Reproducibility: yes. Source inspection shows current main can broadcast terminal session changes while chatAbortControllers still projects hasActiveRun, and the attached before recording shows the visible stuck In progress/Stop state.

Review metrics: 2 noteworthy metrics.

• Active-run projection surface: 1 field added, 2 projection paths changed. The patch changes which in-memory chat runs appear as active without removing the retry/idempotency guard.
• Current head checks: 2 failed check jobs observed with annotations outside touched files. The failures do not look introduced by the gateway diff, but maintainers still need green required checks or explicit acceptance before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster ✨ media proof bonus
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• none.

Risk before merge

• [P1] The PR intentionally changes gateway session-state timing: terminal lifecycle now hides a run from sessions.list before chat.send finally settles, so maintainers should accept that completed runs are no longer user-abortable during that short retry-guard window.
• [P1] The public head check query still shows failing lint/extension jobs with annotations outside touched gateway files; merge should wait for required checks to go green or for explicit maintainer acceptance of those failures.

Maintainer options:

1. Accept lifecycle-ordering fix after checks (recommended)
   If maintainers agree terminal lifecycle should end user abortability before chat.send final cleanup, land once required checks are green or explicitly accepted.
2. Ask for broader retry-window proof
   Request one focused same-key retry or live gateway/browser proof if maintainers want more confidence around the terminal-to-finally window.
3. Pause for Stop semantics decision
   Pause if Stop must remain available until chat.send finally resolves rather than until terminal lifecycle completion.

Next step before merge

• [P2] Maintainer review should accept or reject the session-state lifecycle timing and required-check state; there is no narrow automated repair indicated from this review.

Security
Cleared: The diff changes in-memory gateway run-state projection and regression tests only; no concrete security or supply-chain regression was found.

@clawsweeper review

I pushed a follow-up commit addressing the retry/idempotency guard concern by keeping the chatAbortControllers entry alive while hiding terminal runs from the sessions-list active projection. Please review the latest head.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/26600379115
• Updated: 2026-05-28T20:37:28.249Z

@clawsweeper ask explain this risk a bit more please: The PR intentionally changes gateway session-state timing: terminal lifecycle now hides a run from sessions.list before chat.send finally settles, so maintainers should accept that completed runs are no longer user-abortable during that short retry-guard window.

is it mitigable?

🦞👀
ClawSweeper assist is taking a look at your question.

I queued a lightweight read-only assist pass. It will post a separate answer comment and will not edit the durable ClawSweeper review comment or trigger close, merge, repair, label, or branch changes.

Request: explain this risk a bit more please: The PR intentionally changes gateway session-state timing: terminal lifecycle now hides a run from sessions.list before chat.send finally settles, so maintainers should accept that completed runs are no longer user-abortable during that short retry-guard window. is it mitigable?

ClawSweeper assist: The risk is that sessions.list becomes a UI projection, not a literal “there is still an abort controller entry” view. After terminal lifecycle, the run is hidden as active/abortable even though the chatAbortControllers entry may remain briefly as a chat.send retry/idempotency guard. So a user should not be offered Stop/Abort for a run the gateway already considers terminal.

It looks partly mitigated already: the follow-up commit preserves the controller entry and only sets projectSessionActive = false, so retry/idempotency behavior remains while session active-state stops advertising the completed run as abortable. Further mitigation would be a correctness review of whether any real abort path still needs that short terminal-afterglow to appear abortable.

Evidence:

• PR head 8f8dbab281a9e802cccaf847f30e018439569519 added projectSessionActive?: boolean to src/gateway/chat-abort.ts.
• src/gateway/server-methods/sessions.ts now excludes entries with projectSessionActive === false from active session projection.
• src/gateway/server-runtime-subscriptions.ts keeps the map entry but sets entry.projectSessionActive = false only when the stored sessionKey matches.
• Added test: sessions.list ignores terminal abortable runs kept for retry guards.
• Author comment says the follow-up keeps chatAbortControllers alive while hiding terminal runs from sessions.list.

Suggested next action: Ask @clawsweeper review if you want a full correctness pass on whether any abort/retry/reconnect path depends on terminal runs remaining visible as active.

Source: #87767 (comment)
Assist model: gpt-5.5, reasoning low.

@clawsweeper visualize

🦞👀
ClawSweeper visual brief is being prepared.

I queued a read-only visual pass. It will create or update one marker-backed visual brief comment and will not trigger close, merge, repair, label, or branch changes.

Lens: auto

Source: #87767 (comment)
Visual model: gpt-5.5, reasoning low.

Visual brief

Lens: state

Advisory only. Maintainers remain the final judges.

Problem path before this PR

chat run completes
      |
      v
terminal lifecycle delivered
      |
      v
sessions.changed broadcast
      |
      v
sessions.list sees chatAbortControllers entry still present
      |
      v
hasActiveRun: true
      |
      v
🐛 Control UI keeps session abortable/running after response finished

Proposed path in this PR

chat run completes
      |
      v
terminal lifecycle delivered
      |
      v
mark matching run as not projected active
      |
      +------------------------------+
      |                              |
      v                              v
sessions.changed broadcast       chatAbortControllers entry remains
      |                          as retry/idempotency guard
      v                              |
sessions.list excludes it            v
      |                          normal cleanup later
      v
✅ hasActiveRun: false
      |
      v
✅ Control UI exits abortable/running state

State split introduced by the follow-up commit

+------------------------------+------------------------------+
| User/session projection      | Internal retry guard         |
+------------------------------+------------------------------+
| ✅ projectSessionActive=false | ✅ map entry remains present |
| ✅ not shown as abortable     | ✅ retry/idempotency retained|
| ✅ sessions.list reports idle | ✅ finally cleanup unchanged |
+------------------------------+------------------------------+

Guardrails shown in supplied diff

✅ only terminal lifecycle path calls clearTrackedActiveRun
✅ cleanup checks matching sessionKey before changing entry
✅ tries both provider run id and client run id
✅ sessions.list only filters entries with projectSessionActive === false
⚠️ UI projection no longer means "abort controller entry exists"

Maintainer judgment point

Before:
  active controller entry == user-visible abortable session

After:
  active controller entry may briefly exist for retry/idempotency
  while user-visible session is no longer abortable

🧑‍⚖️ Decide whether that short terminal-afterglow should be hidden from users.

Proof snapshot:

✅ before/after browser recordings supplied
✅ targeted gateway regression test added
✅ sessions.list projection test added
✅ targeted UI/session tests rerun
✅ lint, diff check, local autoreview reported passing
⚠️ broad full-suite, package, and cross-OS proof not supplied
⚠️ prior review noted required checks were still unstable/pending in available context

Maintainer ruling

Benefit: Completed chat runs should stop leaving the Control UI stuck in a running/abortable state.

Risk: Gateway session projection now intentionally diverges from raw in-memory abort-controller presence during a short retry/idempotency guard window.

Proof needed: Maintainer confidence that no real abort, retry, reconnect, or message-delivery path depends on terminal runs remaining user-visible as abortable during that window; confirm current required checks.

Recommended next action: Review the gateway lifecycle ordering and the projectSessionActive projection split, then decide whether the supplied targeted proof is enough or broader CI/cross-path proof is needed.

Question presented: Is it acceptable for terminal runs to remain internally guarded while no longer being advertised through sessions.list as active/abortable?

@clawsweeper automerge

🦞🔧
ClawSweeper automerge is enabled.

• Head: 8f8dbab281a9
• Label: clawsweeper:automerge
• Action: repair worker queued. Run: https://github.com/openclaw/clawsweeper/actions/runs/26606382977
• Flow: review this head, repair/rebase only if needed, then re-review the exact repaired head before merge.

Draft PRs stay fix-only until GitHub marks them ready for review. Pause with /clawsweeper stop.

Automerge progress:

• 2026-05-28 22:36:53 UTC review queued 8f8dbab281a9 (queued)

• 2026-05-28 22:37:39 UTC repair queued 8f8dbab281a9 (autonomous) Run: https://github.com/openclaw/clawsweeper/actions/runs/26606382977

• 2026-05-28 22:40:15 UTC repair started (running) in 0s Run: https://github.com/openclaw/clawsweeper/actions/runs/26606382977 automerge-openclaw-openclaw-87767

• 2026-05-28 22:40:31 UTC validation plan (passed) in 17s Run: https://github.com/openclaw/clawsweeper/actions/runs/26606382977 pnpm check:changed; pnpm lint; pnpm check:test-types

• 2026-05-28 22:40:42 UTC Codex write preflight (passed) in 28s Run: https://github.com/openclaw/clawsweeper/actions/runs/26606382977 danger-full-access

• 2026-05-28 22:55:24 UTC Codex edit 1 5efc9c2fb0f9 (complete) in 15m 10s Run: https://github.com/openclaw/clawsweeper/actions/runs/26606382977 exit 0

• 2026-05-28 23:12:38 UTC validation and review 1 e4d4995cf885 (base moved) in 32m 24s Run: https://github.com/openclaw/clawsweeper/actions/runs/26606382977 rebased

• 2026-05-28 23:13:25 UTC repair finished e4d4995cf885 (opened) in 33m 11s Run: https://github.com/openclaw/clawsweeper/actions/runs/26606382977 open_fix_pr

ClawSweeper 🐠 reef update

Thanks for the work here. GitHub would not let ClawSweeper push to this branch with the available credentials, so the fix moved to a narrow replacement PR. nothing personal, just permission currents.

Why replacement: ClawSweeper could not update the source PR branch directly; GitHub did not grant sufficient push rights to the bot for that branch.
Replacement PR: #87810
Why close: this run explicitly closes the superseded source PR after the credited replacement PR is open, so review continues in one place.
This closeout is intentional for this run: the replacement PR is now the active review lane.
The replacement PR keeps the contributor trail visible for review and release notes.
Co-author credit kept:

• @scotthuang: Co-authored-by: scotthuang 1670837+scotthuang@users.noreply.github.com

fish notes: model gpt-5.5, reasoning high; reviewed against e4d4995.