fix(bay): derive metrics from durable review lifecycle

[brokemac79]

Summary

Make OpenClaw Bay's review timing and completed-tide metrics derive from durable exact-review lifecycle facts, rather than incomplete worker or journey samples.

This update also fixes a user-visible gap found during the deeper review: a finished review card was hidden whenever the same PR had a newer active review. Finished revisions now remain in the completed tide alongside active work, have a separate UI identity, and preserve legacy public-reference deep links.

Problem

The earlier Bay model combined short-lived journey records with worker and closed-item samples. It therefore missed valid reviews triggered by PR creation, new commits, PR-body edits, @clawsweeper review, and @clawsweeper re-review; terminal/tide state could also be incomplete after recovery or retries.

The original production failure in the durable solution was separate: its raw SQLite SAVEPOINT use is accepted by the in-memory test harness but rejected in a Cloudflare Durable Object. That made terminal metric materialization recover/fail closed in production. This branch replaces that transaction path with Durable Object-safe storage transactions and durable outbox recovery.

The lower Durable lifecycle Kanban is intentionally a separate bounded historical projection. This PR fixes the public Bay timing indicator, completed tide, and last-tide display; it does not redefine that Kanban's distinct over_cap semantics.

Implementation

• Record durable lifecycle admission for every admitted review, preserving the true timestamp for PR events and commands.
• Materialize every terminal lifecycle outcome into a bounded durable telemetry stream, with atomic source marking and retry/recovery.
• Derive the one-hour timing window, completed buffer, tide generation, and last_tide_at solely from that stream.
• Scope public status cache validity and lifecycle coverage to the configured public repository allowlist; a scope change begins a new warming epoch and cannot reuse an old-scope snapshot.
• Keep a terminal review revision visible and clickable even when that PR has a newer active revision, without allowing it to create a stale CHECKING card or collide with the active card's identity.
• Preserve the v1 timings.sample_kind: completed_review_journeys contract and add explicit durable-lifecycle provenance.

Validation

• node --experimental-strip-types --test test/dashboard-worker-bay-records-routes.test.ts — 94 passed
• Focused dashboard/status/observability/privacy range — 190 passed
• pnpm run check:dashboard-queue-boundary
• pnpm run check:dashboard-strict
• pnpm run lint:dashboard
• pnpm run lint:scripts
• pnpm run build:all
• git diff --check

Windows note: this checkout has Git core.autocrlf enabled. oxfmt reports the CRLF worktree representation as non-canonical even for the same files on origin/main; formatting it produces no Git-normalized content diff. No repository-wide line-ending-policy change is included in this PR.

Real Behavior Proof

Claim: all five review ingress paths contribute terminal reviews to the durable public Bay metrics, and all public terminal completions drive the completed tide/last-tide display. A completed revision remains visible and opens the correct terminal drawer even while its PR has active work.

• Head: 021feff4cb1f2cd3d6b2b781faeaf9342791ade5 (rebased onto main 9a09faa3da3b94957e021a98fd00bb5061bff904)

• Surface: local Wrangler Worker, real Cloudflare Durable Object runtime, and rendered Bay page

• Scenario: 21 public terminal reviews spanning opened, synchronize, edited, review, and re_review; one private terminal review; a released 20-item tide and one completion in the next tide

• Command/environment:

  C:\Users\marti\.local\bin\crabbox.exe run --provider local-container --local-container-image mcr.microsoft.com/playwright:v1.60.0-noble --no-hydrate --timing-json --script "sed 's/\r$//' docs/proof/bay-authoritative-lifecycle/run-proof.sh > /tmp/bay-authoritative-lifecycle-proof.sh && bash /tmp/bay-authoritative-lifecycle-proof.sh"
  

• Provider/run: Docker-backed Crabbox local-container; lease cbx_c9430b1f6fca (blue-barnacle); run run_2329cbf4baf9; image mcr.microsoft.com/playwright:v1.60.0-noble; no hydration

• Observed: 56/56 assertions passed on this exact head: {"ok":true,"assertions":56,"status":{"metrics_state":"warming","timing_samples":21,"tide_generation":1,"terminal_count":1,"last_tide_at":"2026-08-22T02:33:26.083Z"}}. The rendered page showed 1 / 20, a visible COMPLETED 1 terminal card, and its terminal drawer opened successfully. The private completion was excluded.

• Trace/artifact: exact-head Crabbox run run_2329cbf4baf9; the earlier matching rendered-page capture run_33da8d5336a2-artifacts.tgz contains proof-summary.json and bay-lifecycle-metrics.png (1,638,171 bytes). The rebase introduced only upstream reviewer-policy commits, not Bay product changes.

• Limits: deterministic signed local lifecycle traffic only; no GitHub or production mutation. The UI deliberately shows warming coverage rather than a partial average until it has a complete one-hour window.

Review closeout

• The prior hosted ClawSweeper finding about scope-blind cache reuse was fixed in this branch and is superseded by this head.
• Dirty Codex review: clean after accepted follow-up fixes for terminal-card identity, stale confirmation suppression, and legacy deep-link fallback.
• Committed Codex review against current origin/main 9a09faa3da3b94957e021a98fd00bb5061bff904: no actionable correctness issues.
• Local ClawSweeper committed-range review against current origin/main 9a09faa3da3b94957e021a98fd00bb5061bff904 and this head: complete, keep_open with high confidence; no discrete correctness or security defect. Its only requested merge evidence was the exact-head Worker/Durable Object proof above, which has now completed.

Risks and rollout

• Timing coverage deliberately warms for one hour after rollout or a public-allowlist change; old-scope facts cannot be reused.
• The public telemetry window is bounded and fails closed on malformed, over-cap, or recovery-pending data.
• The completed beach pool represents the current 20-item tide buffer; the separate historical lifecycle Kanban remains a bounded operational record.

Attribution

Initial investigation was performed by Roboclaw. Martin Cleary (@brokemac79) authored the branch commits; Codex completed recovery hardening, validation, proof, and review follow-through.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[brokemac79]

@clawsweeper review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Waiting
• Detail: A newer exact-review queue owner superseded this run. This run completed as a no-op.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/32530848255
• Updated: 2026-08-21T21:58:46.729Z

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 21, 2026, 10:56 PM ET / August 22, 2026, 02:56 UTC.

ClawSweeper review

What this changes

The PR derives Bay’s public review timing and completed-tide metrics from durable exact-review lifecycle records, scopes caches to public repositories, and retains completed cards alongside newer active revisions.

Merge readiness

⚠️ Ready for maintainer review - 3 items remain

Keep open for maintainer review: current main does not contain this durable lifecycle implementation, and the current PR head has no discrete correctness or security finding. Its exact-head Worker/Durable Object proof is strong; the remaining choice is whether to accept the intentional one-hour warming period after rollout or public-scope changes.

Priority: P2
Reviewed head: 021feff4cb1f2cd3d6b2b781faeaf9342791ade5
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A large but focused dashboard reliability patch with strong exact-head runtime proof and no actionable review finding.
Proof confidence	🦞 diamond lobster (5/6)	Sufficient (live_output): The PR records exact-head real behavior proof through a Docker-backed local Worker and Cloudflare Durable Object, with 56 passing assertions and rendered Bay verification; redact any private details if reposting artifacts.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (live_output): The PR records exact-head real behavior proof through a Docker-backed local Worker and Cloudflare Durable Object, with 56 passing assertions and rendered Bay verification; redact any private details if reposting artifacts.
Evidence reviewed	5 items	Current-main gap: The durable telemetry implementation differs from current main, so the central change is not already implemented. Durable scope and recovery path: The new telemetry store records scope epochs, writes terminal facts through a durable outbox, and returns unavailable rather than partial metrics while recovery is pending. Public boundary enforcement: The Worker requests lifecycle metrics with the configured public repository allowlist and validates the returned durable aggregate before exposing it in status.
Findings	None	None.
Security	None	None.

Live Verification

Command: BAY_LIFECYCLE_PROOF_OUTPUT=/tmp/bay-lifecycle-metrics crabbox run --provider local-container --local-container-image mcr.microsoft.com/playwright:v1.60.0-noble --no-hydrate --timing-json --script docs/proof/bay-authoritative-lifecycle/run-proof.sh

Result: FAIL (partial) — step 2 expect_output "ok":true: expected terminal output was not visible within 30 seconds: "\"ok\":true"

BAY_LIFECYCLE_PROOF_OUTPUT=/tmp/bay-lifecycle-metrics crabbox run --provider local-container --local-container-image mcr.microsoft.com/playwright:v1.60.0-noble
--no-hydrate --timing-json --script docs/proof/bay-authoritative-lifecycle/run-proof.sh
runner@runnervm76f27:/tmp/clawsweeper-live-proof-1222-3NDTY1/target$ BAY_LIFECYCLE_PROOF_OUTPUT=/tmp/bay-lifecycle-metrics crabbox run --provider local-containe
r --local-container-image mcr.microsoft.com/playwright:v1.60.0-noble --no-hydrate --timing-json --script docs/proof/bay-authoritative-lifecycle/run-proof.sh
crabbox: command not found
runner@runnervm76f27:/tmp/clawsweeper-live-proof-1222-3NDTY1/target$ BAY_LIFECYCLE_PROOF_OUTPUT=/tmp/bay-lifecycle-metrics crabbox run --provider local-containe
r --local-container-image mcr.microsoft.com/playwright:v1.60.0-noble --no-hydrate --timing-json --script docs/proof/bay-authoritative-lifecycle/run-proof.sh
crabbox: command not found
runner@runnervm76f27:/tmp/clawsweeper-live-proof-1222-3NDTY1/target$

Assertions:

• FAIL expect_output: "ok":true
• FAIL expect_output: "assertions":56

How this fits together

OpenClaw Bay is the public status dashboard. Exact-review admissions and terminal outcomes enter the Durable Object, which aggregates public-scope metrics for the status API and Bay page.

flowchart LR
  A[Review ingress] --> B[Lifecycle projection]
  B --> C[Durable terminal telemetry]
  C --> D[Public repository scope]
  D --> E[Status API]
  E --> F[Bay dashboard]

Loading

Decision needed

Question	Recommendation
Should Bay intentionally show a one-hour warming state after deployment or a public-repository allowlist change instead of reusing partial or prior-scope timing metrics?	Accept scoped warming: Keep the fail-closed one-hour warming epoch so Bay never reuses incomplete or prior-scope timing data.

Why: This is a public dashboard behavior and privacy/correctness rollout tradeoff, not a mechanical code choice.

Before merge

• Resolve merge risk (P1) - After rollout or a public-repository allowlist change, Bay intentionally withholds timing averages for one hour while durable coverage warms; maintainers should explicitly accept that privacy-safe temporary loss of the metric.
• Complete next step (P2) - A maintainer must decide whether the intentional scoped warming behavior is acceptable before merge.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Patch surface	15 files; 4,114 added, 289 removed	The change spans Durable Object storage, public status projection, Bay UI, proof tooling, and focused tests.
Production versus tests	production +1,779, tests +1,996	The substantial implementation is accompanied by more test coverage than production-line growth.

Merge-risk options

Maintainer options:

1. Accept scoped warming (recommended)
   Accept the documented one-hour post-rollout and post-scope-change warming state as the privacy-safe behavior for authoritative Bay timing.
2. Pause for rollout direction
   Hold the PR if Bay must preserve a continuous timing display through scope changes, since that needs a different approved data policy.

Technical review

Best possible solution:

Land the durable lifecycle source only with explicit acceptance of scoped one-hour warming, preserving fail-closed public metrics and the existing v1 timing field with additive provenance.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a current-main bug reproduction in this read-only review; the PR supplies exact-head after-fix proof through a real local Worker, Durable Object, and rendered Bay page.

Is this the best way to solve the issue?

Yes, subject to rollout approval: durable lifecycle facts plus scope-bound, fail-closed aggregation are more reliable than the prior short-lived journey and worker samples.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 9a09faa3da3b.

Labels

Label justifications:

• P2: This is a bounded public-dashboard correctness and observability change without evidence of an active service outage or data loss.
• merge-risk: 🚨 other: Scope-aware durable metrics deliberately change Bay’s post-rollout behavior by withholding timing data until coverage warms.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR records exact-head real behavior proof through a Docker-backed local Worker and Cloudflare Durable Object, with 56 passing assertions and rendered Bay verification; redact any private details if reposting artifacts.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR records exact-head real behavior proof through a Docker-backed local Worker and Cloudflare Durable Object, with 56 passing assertions and rendered Bay verification; redact any private details if reposting artifacts.

Evidence

What I checked:

• Current-main gap: The durable telemetry implementation differs from current main, so the central change is not already implemented. (dashboard/exact-review-lifecycle-telemetry.ts:439, 021feff4cb1f)
• Durable scope and recovery path: The new telemetry store records scope epochs, writes terminal facts through a durable outbox, and returns unavailable rather than partial metrics while recovery is pending. (dashboard/exact-review-lifecycle-telemetry.ts:370, 021feff4cb1f)
• Public boundary enforcement: The Worker requests lifecycle metrics with the configured public repository allowlist and validates the returned durable aggregate before exposing it in status. (dashboard/worker.ts:5200, 021feff4cb1f)
• Real behavior proof: The PR body records an exact-head Docker-backed Crabbox run against a real local Worker and Durable Object: 56/56 assertions passed, including five ingress paths, exclusion of a private repository, tide progression, and a completed-card drawer. (docs/proof/bay-authoritative-lifecycle/run-proof.mjs:66, 021feff4cb1f)
• Feature history: Current-main Bay lifecycle and dashboard history is concentrated in commits by brokemac79, with adjacent queue work by Vincent Koc. (dashboard/exact-review-queue.ts:730, d389e6addf4d)

Likely related people:

• brokemac79: Authored prior merged Bay lifecycle/dashboard commits and the current branch head. (role: recent Bay lifecycle contributor; confidence: high; commits: a0f08226cb0d, df60d3384987, 021feff4cb1f; files: dashboard/exact-review-lifecycle.ts, dashboard/exact-review-queue.ts, dashboard/worker.ts)
• Vincent Koc: Recent current-main queue work touches the same exact-review queue surface. (role: recent adjacent queue contributor; confidence: medium; commits: eb8e2caabeb2; files: dashboard/exact-review-queue.ts)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Obtain explicit maintainer acceptance of the one-hour scoped warming behavior before merge.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (5 earlier review cycles)

• reviewed 2026-08-21T21:29:56.027Z sha 1084da9 :: needs changes before merge. :: [P2] Scope timing coverage to the public repository filter
• reviewed 2026-08-21T22:10:17.737Z sha 4f414fb :: needs changes before merge. :: [P2] Invalidate Bay snapshots when the public scope changes
• reviewed 2026-08-21T22:52:05.328Z sha 4f414fb :: needs changes before merge. :: [P2] Bind status cache reuse to the public Bay scope
• reviewed 2026-08-22T02:14:41.455Z sha 51d5d1b :: needs maintainer review before merge. :: none
• reviewed 2026-08-22T02:48:38.896Z sha 021feff :: needs maintainer review before merge. :: none

[brokemac79]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Review in progress
• Detail: The exact-review queue leased this run; Codex is reviewing the item.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/32530906729
• Updated: 2026-08-21T21:59:20.666Z

[brokemac79]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/32535721024
• Updated: 2026-08-21T23:07:55.188Z

[brokemac79]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/32546268335
• Updated: 2026-08-22T02:27:12.489Z

[brokemac79]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/32547431819
• Updated: 2026-08-22T02:52:50.000Z