fix: time out hung capture and profile child processes

[SebTardif]

What Problem This Solves

Fixes an issue where users capturing or profiling plugins could hang indefinitely, retain ordinary child processes after a timeout, or receive a successful result after cancellation or a timeout handler exited zero. Unbounded output and process sampling could also keep the inspection alive or grow its memory use.

Why This Change Was Made

Builds on @SebTardif's original timeout and JSON-flush repair. One owned-process lifecycle now handles capture, profiles, and their bounded sampler: finite deadlines, bounded output, TERM-to-KILL escalation, and completion through stdio close. POSIX cleanup targets the owned process group even after its leader exits.

Default import-loop samples and their baseline launch the existing mock capture runner directly, so the profile budget owns the actual plugin process. The runner finishes its JSON artifact before exiting; only a fresh, valid, bounded artifact from a successful, noncancelled capture is accepted. Capture artifacts retain the shipped 10 MiB limit, independently of the profile's 1 MiB stdout/stderr caps. Explicit overrides remain supported.

Custom capture commands/scripts retain their launch and artifact contracts. The public in-process capture API retains handler identity; this patch does not pretend to cancel synchronous in-process code or retained callbacks.

User Impact

• Child work defaults to 30 seconds. Valid finite positive API options override environment values, then defaults; zero and invalid values cannot disable the bounds.
• Timeout and cancellation cannot become successful capture/profile results. Healthy JSON is completely flushed, including when plugins leave timers running.
• POSIX ordinary descendants are cleaned after timeout, cancellation, or normal leader exit. Windows remains direct-child-only; deliberately detached custom groups are outside this guarantee.
• Default import-loop RSS/CPU now describe the runner, and wall time excludes intermediate CLI startup. Baseline and plugin samples use the same new route; historical measurements are not directly comparable.
• Stable finding codes/report fields remain intact. No runtime dependencies, package version changes, or release operations.

Evidence

Candidate: 6499f33ff204a2705eaaf0f3d8289d12343f88c0. Contributor head cb9ccfe708e97867ac84ea842743f8efeba0f572 remains an ancestor; current main 98751f9333a840f8d2978975910feed397ff9f63 was merged without rebasing. The only conflict was the changelog, where every entry from both sides was retained.

Sanitized direct AWS proof for repair commit e8e81a4b6d12e82dd2f460408d8af9abcd60ed8b used Node 22.19.0, a fresh PR checkout plus the exact candidate patch, no instance role, no Tailscale, no hydrated credentials, and an isolated environment:

node --test test/capture-timeout.test.js test/process-profile.test.js
npm run check

• AWS repair candidate: 37/37 focused tests, 278/278 full tests, package contents pass. The task-owned lease is released with cleanup complete.
• Before/after: five selected regression assertions fail on the contributor baseline for the intended reasons, including a surviving nested default runner, premature descendant completion, unbounded sampling, and false success. The outer watchdog was not their failure cause.
• Real process tests cover busy loops, retained intervals, TERM-resistant descendants holding stdio after leader exit, cancellation, output floods, late rejection, complete healthy JSON, actual PID disappearance, and survival of an unrelated sentinel.
• Default import-loop proof covers healthy baseline/sample, retained intervals, stale artifacts plus early exit, write failures, invalid/oversized artifacts, and custom command/script compatibility.
• Capture-limit compatibility: a healthy 1.4 MiB artifact passes on both the original branch and the repaired route. A serialized result above the actual 10 MiB capture cap fails visibly; explicit smaller caps and direct oversized-file bypasses also fail.
• Final-head delta: current-main reconciliation plus a backpressure-aware producer in the existing profile flood test, with its assertions unchanged. Final-head validation uses fresh secretless GitHub CI.
• Fresh P2 review of the complete final diff against 98751f9333a840f8d2978975910feed397ff9f63: no actionable P0-P2 findings. Diff whitespace and privacy checks pass.

Final-head secretless GitHub CI: Check run 34369845453, bound to 6499f33ff204a2705eaaf0f3d8289d12343f88c0, passed on Node 22.23.2: 312/312 tests, zero failures/skips, package contents pass.

After maintainer review, exact head 6499f33ff204a2705eaaf0f3d8289d12343f88c0 was squash-merged as f5e66bb6fb3b6168186a9b9fba45ad2a18a0c5a1. The merged tree exactly matches the reviewed candidate. The approved policy is a finite 30-second default with validated finite overrides, not an unlimited zero-value mode.

Windows descendant cleanup and downstream Crabpot integration/release are not claimed by the Linux proof and remain outside this explicitly bounded unit. No release is included.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review in progress

ClawSweeper is reviewing this revision. This supersedes any previous blocked status.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed September 7, 2026, 3:16 PM ET / 19:16 UTC.

ClawSweeper review

What this changes

Adds configurable capture and profiling deadlines, escalates child termination, caps profiling output, and flushes capture JSON before exiting.

Merge readiness

⛔ Blocked before merge - 10 items remain

This PR addresses a remaining subprocess hang on main, but all five prior correctness concerns remain supported by the rebased source. The related timeout PRs cover distinct execution paths and do not replace this work.

Priority: P2
Reviewed head: cb9ccfe708e97867ac84ea842743f8efeba0f572
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	Useful implementation and partial real capture evidence remain outweighed by unresolved lifecycle and compatibility defects.
Proof confidence	🦐 gold shrimp (3/6)	Needs stronger real behavior proof before merge: The captured macOS/Node 26 evidence demonstrates successful mock capture and reports SIGKILL recovery on 694d9ec. It does not demonstrate profile timeout failure, nested-runner cleanup, or slow-workload compatibility; the body explicitly excludes required Crabpot smoke. These are coverage gaps in the supplied evidence, independent of the reviewer's failed GitHub access. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🦐 gold shrimp (3/6)	5 actionable review findings remain.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs stronger real behavior proof before merge: The captured macOS/Node 26 evidence demonstrates successful mock capture and reports SIGKILL recovery on 694d9ec. It does not demonstrate profile timeout failure, nested-runner cleanup, or slow-workload compatibility; the body explicitly excludes required Crabpot smoke. These are coverage gaps in the supplied evidence, independent of the reviewer's failed GitHub access. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	8 items	Applicable repository policy: Read the complete root AGENTS.md; no additional scoped AGENTS.md or maintainer-note directory was found. Behavior changes require Crabpot follow-through and smoke validation while preserving stable report fields. Main and release still lack these deadlines: Main uses execFile without a timeout for mock capture and waits for profile exit without a deadline. The local v0.3.24 tag points at the supplied main revision. No supplied merged PR implements this request. Capture completion and buffering: The introduced spawn wrapper parses accumulated JSON on exit rather than stream closure, buffers stderr without a limit, and rejects zero as a disabled capture deadline.
Findings	5 actionable findings	[P1] Wait for capture streams to close before parsing output [P1] Preserve an explicit no-deadline capture mode [P1] Make an expired profile fail after a clean SIGTERM exit
Security	None	None.

How this fits together

Plugin Inspector executes opted-in plugin captures and profiling commands in subprocesses. Their output and exit status feed compatibility captures and performance reports.

flowchart TD
  A[Plugin entrypoint or profile command] --> B[Capture and profile helpers]
  B --> C[Child process]
  C --> D[Output collection]
  B --> E[Deadline and termination]
  E --> C
  D --> F[Capture result or profile report]

Loading

Decision needed

Question	Recommendation
Should existing callers acquire a 30-second deadline by default, or should deadlines initially require explicit opt-in?	Preserve existing defaults: Keep unbounded execution as the compatibility default and enable deadlines explicitly through the new options.

Why: Previously valid long-running work will now be terminated, and the supplied discussion does not establish approval or upgrade proof for that default change.

Before merge

• Add real behavior proof - Needs stronger real behavior proof before merge: The captured macOS/Node 26 evidence demonstrates successful mock capture and reports SIGKILL recovery on 694d9ec. It does not demonstrate profile timeout failure, nested-runner cleanup, or slow-workload compatibility; the body explicitly excludes required Crabpot smoke. These are coverage gaps in the supplied evidence, independent of the reviewer's failed GitHub access. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Wait for capture streams to close before parsing output (P1) - The replacement for execFile resolves on exit, which can precede delivery of the remaining stdout/stderr data. A sufficiently large successful capture can therefore reach JSON.parse with incomplete JSON. The runner's write callback confirms its write completed, not that the parent consumed every byte. Finalize on stream closure while retaining bounded cleanup.
• Preserve an explicit no-deadline capture mode (P1) - Capture previously allowed legitimate registration work of arbitrary duration. Both timeoutMs: 0 and an environment value of 0 now fall back to 30 seconds, so callers cannot preserve that behavior; profiling already accepts zero. Support and document an explicit disabled deadline, and settle the default separately before terminating existing slow workloads.
• Make an expired profile fail after a clean SIGTERM exit (P1) - A command handling SIGTERM with process.exit(0) produces timedOut: true and exitCode: 0. Runtime validation only checks exit codes, while import-loop capture also uses zero to accept output, so the interrupted run can be reported as successful. Normalize expired runs to failure or propagate timeout checks through every success decision.
• Restore the capture stderr buffer limit (P2) - Replacing execFile removes its 10 MiB stderr limit, but the new listener retains every stderr chunk. A plugin writing directly to descriptor 2, or its inherited-stderr subprocess, can now grow inspector memory until the deadline. Bound retained stderr and report overflow explicitly rather than allowing unbounded buffering.
• Terminate the nested capture runner when profiling times out (P1) - The default import-loop path profiles cli.js capture, which spawns a separate mock runner. This deadline kills only the CLI; the runner survives, and its timeout timer disappears with its parent. The outer default timer starts earlier than the runner's own timer, making this reachable with the normal defaults. Terminate the owned process tree or propagate cancellation so timed-out samples cannot leave plugin processes running.
• Resolve merge risk (P1) - The new default terminates previously valid captures and profiling commands lasting over 30 seconds; slow-workload upgrade compatibility and the permanent default contract remain unproven.
• Resolve merge risk (P1) - Required Crabpot consumer smoke and corresponding pin/docs follow-through remain unestablished.
• Complete next step (P2) - Resolve the five findings, confirm the deadline compatibility contract, and provide profile-cleanup, slow-workload, and required Crabpot smoke evidence before merge.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Findings

• [P1] Wait for capture streams to close before parsing output — src/inspector.js:330-332
• [P1] Preserve an explicit no-deadline capture mode — src/inspector.js:262-270
• [P1] Make an expired profile fail after a clean SIGTERM exit — src/process-profile.js:102-105

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test growth	Production +297/-57; tests +326/-0	Production growth implements subprocess lifecycle management, with focused tests covering ordinary hangs but not all identified failure paths.

Merge-risk options

Maintainer options:

1. Repair lifecycle handling and preserve compatibility (recommended)
   Resolve the five findings, retain a compatibility path for slow workloads, and supply timeout-cleanup and Crabpot smoke evidence.
2. Pause for a bounded-default decision
   Hold the change until the deadline policy and consumer upgrade expectations are agreed.

Technical review

Best possible solution:

Provide complete-output capture, bounded diagnostics, reliable process-tree cleanup, and unambiguous timeout failures while preserving slow-workload compatibility under an agreed deadline policy.

Do we have a high-confidence way to reproduce the issue?

Yes, source establishes that main waits indefinitely for a live capture or profile child that never exits. No target code or artifact-producing tests were executed during this read-only review.

Is this the best way to solve the issue?

No, the deadline approach is useful but incomplete: termination must cover owned descendants, output must finish before parsing, and expired profiles must fail regardless of graceful exit status.

Full review comments:

• [P1] Wait for capture streams to close before parsing output — src/inspector.js:330-332
  The replacement for execFile resolves on exit, which can precede delivery of the remaining stdout/stderr data. A sufficiently large successful capture can therefore reach JSON.parse with incomplete JSON. The runner's write callback confirms its write completed, not that the parent consumed every byte. Finalize on stream closure while retaining bounded cleanup.
  Confidence: 0.97
• [P1] Preserve an explicit no-deadline capture mode — src/inspector.js:262-270
  Capture previously allowed legitimate registration work of arbitrary duration. Both timeoutMs: 0 and an environment value of 0 now fall back to 30 seconds, so callers cannot preserve that behavior; profiling already accepts zero. Support and document an explicit disabled deadline, and settle the default separately before terminating existing slow workloads.
  Confidence: 0.98
• [P1] Make an expired profile fail after a clean SIGTERM exit — src/process-profile.js:102-105
  A command handling SIGTERM with process.exit(0) produces timedOut: true and exitCode: 0. Runtime validation only checks exit codes, while import-loop capture also uses zero to accept output, so the interrupted run can be reported as successful. Normalize expired runs to failure or propagate timeout checks through every success decision.
  Confidence: 0.99
• [P2] Restore the capture stderr buffer limit — src/inspector.js:326-327
  Replacing execFile removes its 10 MiB stderr limit, but the new listener retains every stderr chunk. A plugin writing directly to descriptor 2, or its inherited-stderr subprocess, can now grow inspector memory until the deadline. Bound retained stderr and report overflow explicitly rather than allowing unbounded buffering.
  Confidence: 0.99
• [P1] Terminate the nested capture runner when profiling times out — src/process-profile.js:104-111
  The default import-loop path profiles cli.js capture, which spawns a separate mock runner. This deadline kills only the CLI; the runner survives, and its timeout timer disappears with its parent. The outer default timer starts earlier than the runner's own timer, making this reachable with the normal defaults. Terminate the owned process tree or propagate cancellation so timed-out samples cannot leave plugin processes running.
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.97

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 92db8c57e1d5.

Labels

Label justifications:

• P2: This repairs bounded, opt-in inspection workflows without evidence of an urgent core-product outage.
• merge-risk: 🚨 compatibility: A new 30-second default changes previously unbounded workloads, and capture currently has no disable mode.
• merge-risk: 🚨 availability: Direct-child termination can orphan the nested capture runner, and capture stderr buffering loses its existing bound.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The captured macOS/Node 26 evidence demonstrates successful mock capture and reports SIGKILL recovery on 694d9ec. It does not demonstrate profile timeout failure, nested-runner cleanup, or slow-workload compatibility; the body explicitly excludes required Crabpot smoke. These are coverage gaps in the supplied evidence, independent of the reviewer's failed GitHub access. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• Applicable repository policy: Read the complete root AGENTS.md; no additional scoped AGENTS.md or maintainer-note directory was found. Behavior changes require Crabpot follow-through and smoke validation while preserving stable report fields. (AGENTS.md:13, cb9ccfe708e9)
• Main and release still lack these deadlines: Main uses execFile without a timeout for mock capture and waits for profile exit without a deadline. The local v0.3.24 tag points at the supplied main revision. No supplied merged PR implements this request. (src/inspector.js:237, 92db8c57e1d5)
• Capture completion and buffering: The introduced spawn wrapper parses accumulated JSON on exit rather than stream closure, buffers stderr without a limit, and rejects zero as a disabled capture deadline. (src/inspector.js:330, cb9ccfe708e9)
• Profile timeout propagation and cleanup: The timeout sends signals only to the direct child. Its exit handler preserves exit code zero even after timeout, while runtime validation checks exitCodes and import-loop capture accepts output when exitCode is zero. (src/process-profile.js:102, cb9ccfe708e9)
• Production nested-process path: The default import-loop command launches cli.js capture, which calls captureEntrypoint and spawns the mock runner. Killing only the profiled CLI leaves the runner without the parent that owns its timeout timer. (src/import-loop-profile.js:414, cb9ccfe708e9)
• Captured proof and review continuity: The supplied snapshot, sourceRevision a0b764646efe59395909a806c2932123cfce57d0dca29d12cd83c632bb568134, contains successful CLI capture output on 694d9ec and a reported 258ms SIGTERM-ignore recovery on macOS/Node 26. It explicitly excludes Crabpot smoke and legitimate slow-plugin validation. The completed prior review records the same five remaining findings; earlier fixes for runner flushing and SIGKILL escalation are present. (694d9ecde807)

Likely related people:

• Vincent Koc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Peter Steinberger: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Resolve the five findings with focused coverage for complete output, disabled deadlines, graceful timeout exits, bounded diagnostics, and descendant cleanup.
• Agree the deadline default and demonstrate both ordinary capture and legitimate slow-workload compatibility.
• Attach redacted terminal output or recordings for profile timeout and cleanup plus required Crabpot smoke; remove private endpoints, IPs, keys, and other private data. Update the PR body for automatic re-review, or ask a maintainer to comment @clawsweeper re-review.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (36 earlier review cycles; latest 8 shown)

• reviewed 2026-08-29T07:10:01.954Z sha 694d9ec :: needs real behavior proof before merge. :: [P1] Wait for capture pipes to close before parsing output | [P1] Preserve an explicit no-deadline capture mode | [P2] Bound mock-capture stderr before retaining it | [P2] Complete the required Crabpot plugin-inspector smoke
• reviewed 2026-08-29T11:55:41.787Z sha 694d9ec :: needs real behavior proof before merge. :: [P1] Wait for capture pipes to close before parsing output | [P1] Preserve an explicit no-deadline capture mode | [P1] Fail profiles that exceeded their timeout | [P2] Bound mock-capture diagnostic buffering | [P2] Complete the required Crabpot plugin-inspector smoke
• reviewed 2026-08-29T16:59:39.415Z sha 694d9ec :: needs real behavior proof before merge. :: [P1] Wait for capture pipes to close before parsing output | [P1] Preserve an explicit no-deadline capture mode | [P2] Bound mock-capture diagnostic buffering | [P2] Complete the required Crabpot plugin-inspector smoke
• reviewed 2026-08-31T02:41:47.188Z sha 694d9ec :: needs real behavior proof before merge. :: [P1] Wait for child streams to close before parsing capture output | [P1] Allow capture callers to disable the deadline | [P1] Make a timed-out profile fail regardless of its exit code | [P2] Cap capture stderr before retaining it | [P2] Complete the required Crabpot consumer smoke
• reviewed 2026-08-31T13:04:43.801Z sha 694d9ec :: needs real behavior proof before merge. :: [P1] Wait for capture pipes to close before parsing output | [P1] Preserve an explicit no-deadline capture mode | [P1] Make timed-out profiles fail even after a clean SIGTERM exit | [P2] Bound capture stderr before retaining it | [P2] Run the required Crabpot consumer smoke
• reviewed 2026-09-03T13:55:09.077Z sha 694d9ec :: needs real behavior proof before merge. :: [P1] Wait for capture streams to close before parsing output | [P1] Preserve an explicit no-deadline capture mode | [P1] Fail profiles that have exceeded their timeout | [P2] Cap mock-capture stderr before retaining it | [P2] Complete the required Crabpot consumer smoke
• reviewed 2026-09-04T20:54:30.666Z sha 694d9ec :: needs real behavior proof before merge. :: [P1] Wait for child streams to close before parsing capture output | [P1] Preserve an explicit no-deadline capture mode | [P1] Mark SIGTERM-exiting profiles as failed timeouts | [P2] Cap mock-capture stderr before retaining it | [P2] Complete the required Crabpot consumer smoke
• reviewed 2026-09-04T22:57:13.582Z sha 694d9ec :: needs real behavior proof before merge. :: [P1] Wait for capture streams to close before parsing output | [P1] Preserve an explicit no-deadline capture mode | [P1] Make an expired profile fail even after a clean SIGTERM exit | [P2] Restore the capture stderr buffer limit | [P1] Terminate the nested capture runner when profiling times out

[SebTardif]

@clawsweeper re-review

[P1] Wait for capture output to flush before forcing exit

Pushed 0c98869: flushWrite waits for the stdout/stderr write callback before process.exit. Added a CLI pipe test that parses complete successful capture JSON from stdout.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/31910882712
• Updated: 2026-08-15T21:58:29.045Z

[SebTardif]

@clawsweeper re-review

[P1] Escalate capture termination after SIGTERM

Pushed 694d9ec: mock-SDK capture now SIGTERM then SIGKILL after a short grace, matching profiling. CLI capture on this head prints complete JSON (status: captured). Body updated with that exact-head transcript.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/31912402134
• Updated: 2026-08-15T22:32:49.149Z

[SebTardif]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/34155051302
• Updated: 2026-09-07T19:18:22.933Z