Best possible solution:

Land the semantic scheduler-state fix after maintainer review confirms the new due-slot advancement is the intended contract and the proof bar is acceptable for the linked availability regression.

Do we have a high-confidence way to reproduce the issue?

Yes. Source inspection gives a high-confidence reproduction path on current main: stale nextDueMs plus a disabled skip or non-retry deferral reaches scheduleNext() with a 0ms delay; I did not run tests because this review is read-only.

Is this the best way to solve the issue?

Yes. The proposed direction is a narrower, more maintainable fix than a timer-floor mitigation because it repairs stale scheduler state while preserving wake-layer retries for busy runtimes.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 57c88dd46e2d.

Label changes:

• add P1: The PR targets an urgent gateway heartbeat scheduler regression that can pin CPU and stall channel processing for affected users.
• add merge-risk: 🚨 availability: The diff changes core heartbeat scheduler rearm behavior, so an incorrect merge could alter liveness, retry cadence, or process availability even with focused tests passing.
• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body supplies focused fake-timer scheduler tests and Testbox check output, but no after-fix real gateway or ARM64 Docker run on this exact branch; add redacted logs, terminal output, or an artifact and update the PR body to trigger review.

Label justifications:

• P1: The PR targets an urgent gateway heartbeat scheduler regression that can pin CPU and stall channel processing for affected users.
• merge-risk: 🚨 availability: The diff changes core heartbeat scheduler rearm behavior, so an incorrect merge could alter liveness, retry cadence, or process availability even with focused tests passing.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body supplies focused fake-timer scheduler tests and Testbox check output, but no after-fix real gateway or ARM64 Docker run on this exact branch; add redacted logs, terminal output, or an artifact and update the PR body to trigger review.

PR surface:

Source +13, Tests +59. Total +72 across 2 files.

What I checked:

• Repository policy read: Root AGENTS.md was read fully; its protected-label, ClawSweeper PR-review, proof, scheduler hot-path, and security-review guidance apply to this item. (AGENTS.md:1, 57c88dd46e2d)
• Current main can rearm stale due slots immediately: scheduleNext() computes rawDelay = Math.max(0, nextDue - now) and resolves it with minMs: 0, so a stale nextDueMs can rearm the heartbeat timer at 0ms. (src/infra/heartbeat-runner.ts:2234, 57c88dd46e2d)
• Current main leaves disabled skips stale: On current main, non-retryable disabled skips record bookkeeping but skip advanceAgentSchedule, leaving the old due slot for scheduleNext() to observe. (src/infra/heartbeat-runner.ts:2400, 57c88dd46e2d)
• Current main deferrals return without due-slot repair: Targeted and broadcast deferral paths return without updating nextDueMs; the cooldown contract shows flood and min-spacing are non-retry deferrals, while wake-layer retry is reserved for busy skip reasons. (src/infra/heartbeat-runner.ts:2368, 57c88dd46e2d)
• PR patch targets the implicated scheduler state: The PR adds advanceStaleScheduleAfterDeferral, calls it on targeted and broadcast deferrals, and removes the disabled-skip exception so non-retryable outcomes advance due slots. (src/infra/heartbeat-runner.ts:2171, 213003a85412)
• PR patch adds focused regression coverage: The PR adds tests for non-retryable disabled skips and flood deferrals without wake-layer retry, asserting the scheduler no longer keeps rearming immediately. (src/infra/heartbeat-runner.scheduler.test.ts:363, 213003a85412)

Likely related people:

• steipete: Current scheduler/cooldown lines blame to 3fc0df953cf17b8bc47e45250c84965765cfed76, a recent merged core refactor touching this heartbeat path; the same person also authored this PR, so they are relevant through prior current-main history, not just this branch. (role: recent area contributor; confidence: high; commits: 3fc0df953cf1, 733f7af92b01; files: src/infra/heartbeat-runner.ts, src/infra/heartbeat-cooldown.ts)
• George Zhang: Commit 9a4a9a5993cc7862efa4bd876be755fe6c399702 changed stable heartbeat phase scheduling, which is adjacent to due-slot calculation and interval scheduling. (role: scheduler feature contributor; confidence: medium; commits: 9a4a9a5993cc; files: src/infra/heartbeat-runner.ts)
• MiloStack: Commit b33ad4d7cb45b27faf7b21cf8333b5c5f630fc07 previously fixed heartbeat timer re-arm behavior with try/finally, making them relevant to scheduler liveness history. (role: availability fix contributor; confidence: medium; commits: b33ad4d7cb45; files: src/infra/heartbeat-runner.ts)
• Joseph Krug: Commit 5147656d6533158904f8eccafa0449a6f94fabcf fixed heartbeat scheduler death when runOnce throws, another nearby scheduler-liveness path. (role: availability fix contributor; confidence: medium; commits: 5147656d6533; files: src/infra/heartbeat-runner.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.