Best possible solution:

Preserve active duplicate-poller protection and solve recovery through explicit stopped or aborted lifecycle state, or through the gateway stale-task recovery path, with redacted real Telegram or equivalent runtime proof.

Do we have a high-confidence way to reproduce the issue?

Yes for the PR-introduced regression at source level: current main lets a healthy Telegram poller hold a non-aborted lease indefinitely, so this PR would replace it after five minutes. The original transient-timeout crash loop still needs live or equivalent proof for the exact recovery path.

Is this the best way to solve the issue?

No. Lease age is not a safe owner-death signal for a long-running poller; explicit stopped/aborted lifecycle state or gateway-owned stale-task recovery is the safer fix boundary.

Full review comments:

• [P1] Keep refusing live leases after five minutes — extensions/telegram/src/polling-lease.ts:164-174
  A normal Telegram monitor acquires this lease before runUntilAbort() and releases it only after that loop exits, so a healthy poller can hold a non-aborted lease longer than five minutes. Deleting that entry by age lets a second same-token poller start, risking getUpdates conflicts or missed inbound delivery; only explicit stopped or aborted lifecycle state should permit replacement.
  Confidence: 0.94

Overall correctness: patch is incorrect
Overall confidence: 0.93

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 7b9ddbda997a.

Label justifications:

• P1: The PR targets a real Telegram polling outage where inbound channel delivery can remain down until a full gateway restart.
• merge-risk: 🚨 message-delivery: The diff changes the guard that prevents competing same-token Telegram pollers from consuming updates concurrently.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🧂 unranked krab.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body supplies simulated steps and a unit-test result, but needs redacted live Telegram, gateway-log, terminal, or equivalent runtime proof before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

PR surface:

Source +9. Total +9 across 1 file.

What I checked:

• Repository policy applied: Root AGENTS.md and the scoped extensions guide were read; Telegram behavior PRs need source, sibling tests, and real Telegram or equivalent proof for transport changes. (AGENTS.md:28, 7b9ddbda997a)
• PR diff changes active-lease behavior: The patch replaces the duplicate-polling throw for a non-aborted same-token lease with a five-minute age check that deletes the registry entry and continues acquisition. (extensions/telegram/src/polling-lease.ts:164, ec92e88feb87)
• Current main protects non-aborted leases: Current main treats an existing same-token lease with no aborted signal as active and throws the duplicate-polling error before any replacement path. (extensions/telegram/src/polling-lease.ts:160, 7b9ddbda997a)
• Runtime caller holds the lease for session lifetime: monitorTelegramProvider acquires the lease before creating TelegramPollingSession and releases it only after runUntilAbort returns. (extensions/telegram/src/monitor.ts:207, 7b9ddbda997a)
• Polling session is intentionally long-lived: TelegramPollingSession.runUntilAbort loops while the provider abort signal is not aborted, so a healthy poller can hold a non-aborted lease far longer than five minutes. (extensions/telegram/src/polling-session.ts:378, 7b9ddbda997a)
• Existing tests encode the duplicate-poller invariant: Current monitor and lease tests assert concurrent same-token polling is refused and non-aborted active leases are not released. (extensions/telegram/src/monitor.test.ts:637, 7b9ddbda997a)

Likely related people:

• joshavant: Authored and merged the stopped Telegram polling lease cleanup and tests on the same helper while preserving active duplicate protection. (role: recent lease cleanup contributor; confidence: high; commits: 726b0b53f5c5; files: extensions/telegram/src/polling-lease.ts, extensions/telegram/src/polling-lease.test.ts, extensions/telegram/src/channel.ts)
• obviyus: Authored merged Telegram polling liveness work and later queued recovery-start behavior in adjacent channel lifecycle paths. (role: recent Telegram and gateway recovery contributor; confidence: high; commits: 5d15b13b65b2, 02b80ea1d22b; files: extensions/telegram/src/polling-session.ts, extensions/telegram/src/polling-liveness.ts, src/gateway/server-channels.ts)
• kevinslin: Authored merged gateway stop-timeout recovery work in the same channel manager and health monitor area implicated by the linked issue. (role: adjacent recovery-stop fix author; confidence: high; commits: d55639a92d51, b77aec55c2bc; files: src/gateway/server-channels.ts, src/gateway/channel-health-monitor.ts, src/gateway/server-channels.test.ts)
• vincentkoc: Current compact blame maps the central Telegram lease/monitor lines to a recent snapshot under this name, and live review comments show maintainer review on the stale-lease and gateway recovery direction. (role: recent area contributor and reviewer; confidence: medium; commits: 3df4341e5af9; files: extensions/telegram/src/polling-lease.ts, extensions/telegram/src/monitor.ts, src/gateway/server-channels.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.