diff --git a/CHANGELOG/2026.1.10.md b/CHANGELOG/2026.1.10.md
new file mode 100644
index 0000000000000000000000000000000000000000..22c76e46cf66594ca7642cb39caa6430196bb555
--- /dev/null
+++ b/CHANGELOG/2026.1.10.md
@@ -0,0 +1,97 @@
+## 2026.1.10
+
+### Highlights
+
+- CLI: `openclaw status` now table-based + shows OS/update/gateway/daemon/agents/sessions; `status --all` adds a full read-only debug report (tables, log tails, Tailscale summary, and scan progress via OSC-9 + spinner).
+- CLI Backends: add Codex CLI fallback with resume support (text output) and JSONL parsing for new runs, plus a live CLI resume probe.
+- CLI: add `openclaw update` (safe-ish git checkout update) + `--update` shorthand. (#673) - thanks @fm1randa.
+- Gateway: add OpenAI-compatible `/v1/chat/completions` HTTP endpoint (auth, SSE streaming, per-agent routing). (#680).
+
+### Changes
+
+- Onboarding/Models: add first-class Z.AI (GLM) auth choice (`zai-api-key`) + `--zai-api-key` flag.
+- CLI/Onboarding: add OpenRouter API key auth option in configure/onboard. (#703) - thanks @mteam88.
+- Agents: add human-delay pacing between block replies (modes: off/natural/custom, per-agent configurable). (#446) - thanks @tony-freedomology.
+- Agents/Browser: add `browser.target` (sandbox/host/custom) with sandbox host-control gating via `agents.defaults.sandbox.browser.allowHostControl`, allowlists for custom control URLs/hosts/ports, and expand browser tool docs (remote control, profiles, internals).
+- Onboarding/Models: add catalog-backed default model picker to onboarding + configure. (#611) - thanks @jonasjancarik.
+- Agents/OpenCode Zen: update fallback models + defaults, keep legacy alias mappings. (#669) - thanks @magimetal.
+- CLI: add `openclaw reset` and `openclaw uninstall` flows (interactive + non-interactive) plus docker cleanup smoke test.
+- Providers: move provider wiring to a plugin architecture. (#661).
+- Providers: unify group history context wrappers across providers with per-provider/per-account `historyLimit` overrides (fallback to `messages.groupChat.historyLimit`). Set `0` to disable. (#672).
+- Gateway/Heartbeat: optionally deliver heartbeat `Reasoning:` output (`agents.defaults.heartbeat.includeReasoning`). (#690).
+- Docker: allow optional home volume + extra bind mounts in `docker-setup.sh`. (#679) - thanks @gabriel-trigo.
+
+### Fixes
+
+- Auto-reply: suppress draft/typing streaming for `NO_REPLY` (silent system ops) so it doesn't leak partial output (#57018). Thanks @hydro13.
+- CLI/Status: expand tables to full terminal width; clarify provider setup vs runtime warnings; richer per-provider detail; token previews in `status` while keeping `status --all` redacted; add troubleshooting link footer; keep log tails pasteable; show gateway auth used when reachable; surface provider runtime errors (Signal/iMessage/Slack); harden `tailscale status --json` parsing; make `status --all` scan progress determinate; and replace the footer with a 3-line "Next steps" recommendation (share/debug/probe) (#57018). Thanks @hydro13.
+- CLI/Gateway: clarify that `openclaw gateway status` reports RPC health (connect + RPC) and shows RPC failures separately from connect failures.
+- CLI/Update: gate progress spinner on stdout TTY and align clean-check step label. (#701) - thanks @bjesuiter.
+- Telegram: add `/whoami` + `/id` commands to reveal sender id for allowlists; allow `@username` and prefixed ids in `allowFrom` prompts (with stability warning).
+- Heartbeat: strip markup-wrapped `HEARTBEAT_OK` so acks don't leak to external providers (e.g., Telegram) (#57018). Thanks @hydro13.
+- Control UI: stop auto-writing `telegram.groups["*"]` and warn/confirm before enabling wildcard groups.
+- WhatsApp: send ack reactions only for handled messages and ignore legacy `messages.ackReaction` (doctor copies to `whatsapp.ackReaction`). (#629) - thanks @pasogott.
+- Sandbox/Skills: mirror skills into sandbox workspaces for read-only mounts so SKILL.md stays accessible.
+- Terminal/Table: ANSI-safe wrapping to prevent table clipping/color loss; add regression coverage.
+- Docker: allow optional apt packages during image build and document the build arg. (#697) - thanks @gabriel-trigo.
+- Gateway/Heartbeat: deliver reasoning even when the main heartbeat reply is `HEARTBEAT_OK`. (#694) - thanks @antons.
+- Agents/Pi: inject config `temperature`/`maxTokens` into streaming without replacing the session streamFn; cover with live maxTokens probe. (#732) - thanks @peschee.
+- macOS: clear unsigned launchd overrides on signed restarts and warn via doctor when attach-only/disable markers are set. (#695) - thanks @jeffersonwarrior.
+- Agents: enforce single-writer session locks and drop orphan tool results to prevent tool-call ID failures (MiniMax/Anthropic-compatible APIs).
+- Docs: make `openclaw status` the first diagnostic step, clarify `status --deep` behavior, and document `/whoami` + `/id`.
+- Docs/Testing: clarify live tool+image probes and how to list your testable `provider/model` ids.
+- Tests/Live: make gateway bash+read probes resilient to provider formatting while still validating real tool calls.
+- WhatsApp: detect @lid mentions in groups using authDir reverse mapping + resolve self JID E.164 for mention gating. (#692) - thanks @peschee.
+- Gateway/Auth: default to token auth on loopback during onboarding, add doctor token generation flow, and tighten audio transcription config to Whisper-only.
+- Providers: dedupe inbound messages across providers to avoid duplicate LLM runs on redeliveries/reconnects. (#689) - thanks @adam91holt.
+- Agents: strip `<thought>`/`<antthinking>` tags from hidden reasoning output and cover tag variants in tests. (#688) - thanks @theglove44.
+- macOS: save model picker selections as normalized provider/model IDs and keep manual entries aligned. (#683) - thanks @benithors.
+- Agents: recognize "usage limit" errors as rate limits for failover. (#687) - thanks @evalexpr.
+- CLI: avoid success message when daemon restart is skipped. (#685) - thanks @carlulsoe.
+- Commands: disable `/config` + `/debug` by default; gate via `commands.config`/`commands.debug` and hide from native registration/help output.
+- Agents/System: clarify that sub-agents remain sandboxed and cannot use elevated host access.
+- Gateway: disable the OpenAI-compatible `/v1/chat/completions` endpoint by default; enable via `gateway.http.endpoints.chatCompletions.enabled=true` (#686).
+- macOS: stabilize bridge tunnels, guard invoke senders on disconnect, and drain stdout/stderr to avoid deadlocks. (#676) - thanks @ngutman.
+- Agents/System: clarify sandboxed runtime in system prompt and surface elevated availability when sandboxed.
+- Auto-reply: prefer `RawBody` for command/directive parsing (WhatsApp + Discord) and prevent fallback runs from clobbering concurrent session updates. (#643) - thanks @mcinteerj.
+- WhatsApp: fix group reactions by preserving message IDs and sender JIDs in history; normalize participant phone numbers to JIDs in outbound reactions. (#640) - thanks @mcinteerj.
+- WhatsApp: expose group participant IDs to the model so reactions can target the right sender.
+- Cron: `wakeMode: "now"` waits for heartbeat completion (and retries when the main lane is busy). (#666) - thanks @roshanasingh4.
+- Agents/OpenAI: fix Responses tool-only → follow-up turn handling (avoid standalone `reasoning` items that trigger 400 "required following item") and replay reasoning items in Responses/Codex Responses history for tool-call-only turns (#57018). Thanks @hydro13.
+- Sandbox: add `openclaw sandbox explain` (effective policy inspector + fix-it keys); improve "sandbox jail" tool-policy/elevated errors with actionable config key paths; link to docs (#57018). Thanks @hydro13.
+- Hooks/Gmail: keep Tailscale serve path at `/` while preserving the public path. (#668) - thanks @antons.
+- Hooks/Gmail: allow Tailscale target URLs to preserve internal serve paths.
+- Auth: update Claude Code keychain credentials in-place during refresh sync; share JSON file helpers; add CLI fallback coverage.
+- Auth: throttle external CLI credential syncs (Claude/Codex), reduce Keychain reads, and skip sync when cached credentials are still fresh.
+- CLI: respect `CLAWDBOT_STATE_DIR` for node pairing + voice wake settings storage. (#664) - thanks @azade-c.
+- Onboarding/Gateway: persist non-interactive gateway token auth in config; add WS wizard + gateway tool-calling regression coverage.
+- Gateway/Control UI: make `chat.send` non-blocking, wire Stop to `chat.abort`, and treat `/stop` as an out-of-band abort. (#653).
+- Gateway/Control UI: allow `chat.abort` without `runId` (abort active runs), suppress post-abort chat streaming, and prune stuck chat runs. (#653).
+- Gateway/Control UI: sniff image attachments for chat.send, drop non-images, and log mismatches. (#670) - thanks @cristip73.
+- macOS: force `restart-mac.sh --sign` to require identities and keep bundled Node signed for relay verification. (#580) - thanks @jeffersonwarrior.
+- Gateway/Agent: accept image attachments on `agent` (multimodal message) and add live gateway image probe (`CLAWDBOT_LIVE_GATEWAY_IMAGE_PROBE=1`).
+- CLI: `openclaw sessions` now includes `elev:*` + `usage:*` flags in the table output.
+- CLI/Pairing: accept positional provider for `pairing list|approve` (npm-run compatible); update docs/bot hints.
+- Branding: normalize legacy casing/branding to "OpenClaw" (CLI, status, docs) (#57018). Thanks @hydro13.
+- Auto-reply: fix native `/model` not updating the actual chat session (Telegram/Slack/Discord). (#646).
+- Doctor: offer to run `openclaw update` first on git installs (keeps doctor output aligned with latest).
+- Doctor: avoid false legacy workspace warning when install dir is `~/openclaw`. (#660).
+- iMessage: fix reasoning persistence across DMs; avoid partial/duplicate replies when reasoning is enabled. (#655) - thanks @antons.
+- Models/Auth: allow MiniMax API configs without `models.providers.minimax.apiKey` (auth profiles / `MINIMAX_API_KEY`). (#656) - thanks @mneves75.
+- Agents: avoid duplicate replies when the message tool sends. (#659) - thanks @mickahouan.
+- Agents: harden Cloud Code Assist tool ID sanitization (toolUse/toolCall/toolResult) and scrub extra JSON Schema constraints. (#665) - thanks @sebslight.
+- Agents: sanitize tool results + Cloud Code Assist tool IDs at context-build time (prevents mid-run strict-provider request rejects).
+- Agents/Tools: resolve workspace-relative Read/Write/Edit paths; align bash default cwd. (#642) - thanks @mukhtharcm.
+- Discord: include forwarded message snapshots in agent session context. (#667) - thanks @rubyrunsstuff.
+- Telegram: add `telegram.draftChunk` to tune draft streaming chunking for `streamMode: "block"`. (#667) - thanks @rubyrunsstuff.
+- Tests/Agents: add regression coverage for workspace tool path resolution and bash cwd defaults.
+- iOS/Android: enable stricter concurrency/lint checks; fix Swift 6 strict concurrency issues + Android lint errors (ExifInterface, obsolete SDK check). (#662) - thanks @KristijanJovanovski.
+- Auth: read Codex CLI keychain tokens on macOS before falling back to `~/.codex/auth.json`, preventing stale refresh tokens from breaking gateway live tests.
+- Security/Exec approvals: reject shell command substitution (`$()` and backticks) inside double quotes to prevent exec allowlist bypass when exec allowlist mode is explicitly enabled (the default configuration does not use this mode). Thanks @simecek.
+- iOS/macOS: share `AsyncTimeout`, require explicit `bridgeStableID` on connect, and harden tool display defaults (avoids missing-resource label fallbacks).
+- Telegram: serialize media-group processing to avoid missed albums under load.
+- Signal: handle `dataMessage.reaction` events (signal-cli SSE) to avoid broken attachment errors. (#637) - thanks @neist.
+- Docs: showcase entries for ParentPay, R2 Upload, iOS TestFlight, and Oura Health. (#650) - thanks @henrino3.
+- Agents: repair session transcripts by dropping duplicate tool results across the whole history (unblocks Anthropic-compatible APIs after retries).
+- Tests/Live: reset the gateway session between model runs to avoid cross-provider transcript incompatibilities (notably OpenAI Responses reasoning replay rules).
+
diff --git a/CHANGELOG/2026.1.11.md b/CHANGELOG/2026.1.11.md
new file mode 100644
index 0000000000000000000000000000000000000000..99bfd23a1003f918be6e3e3c431361278e320e81
--- /dev/null
+++ b/CHANGELOG/2026.1.11.md
@@ -0,0 +1,94 @@
+## 2026.1.11
+
+### Highlights
+
+- Plugins are now first-class: loader + CLI management, plus the new Voice Call plugin.
+- Config: modular `$include` support for split config files. (#731) - thanks @pasogott.
+- Agents/Pi: reserve compaction headroom so pre-compaction memory writes can run before auto-compaction.
+- Agents: automatic pre-compaction memory flush turn to store durable memories before compaction.
+
+### Changes
+
+- CLI/Onboarding: simplify MiniMax auth choice to a single M2.1 option.
+- CLI: configure section selection now loops until Continue.
+- Docs: explain MiniMax vs MiniMax Lightning (speed vs cost) and restore LM Studio example.
+- Docs: add Cerebras GLM 4.6/4.7 config example (OpenAI-compatible endpoint).
+- Onboarding/CLI: group model/auth choice by provider and label Z.AI as GLM 4.7.
+- Onboarding/Docs: add Moonshot AI (Kimi K2) auth choice + config example.
+- CLI/Onboarding: prompt to reuse detected API keys for Moonshot/MiniMax/Z.AI/Gemini/Anthropic/OpenCode.
+- Auto-reply: add compact `/model` picker (models + available providers) and show provider endpoints in `/model status`.
+- Control UI: add Config tab model presets (MiniMax M2.1, GLM 4.7, Kimi) for one-click setup.
+- Plugins: add extension loader (tools/RPC/CLI/services), discovery paths, and config schema + Control UI labels (uiHints).
+- Plugins: add `openclaw plugins install` (path/tgz/npm), plus `list|info|enable|disable|doctor` UX.
+- Plugins: voice-call plugin now real (Twilio/log), adds start/status RPC/CLI/tool + tests.
+- Docs: add plugins doc + cross-links from tools/skills/gateway config.
+- Docs: add beginner-friendly plugin quick start + expand Voice Call plugin docs.
+- Tests: add Docker plugin loader + tgz-install smoke test.
+- Tests: extend Docker plugin E2E to cover installing from local folders (`plugins.load.paths`) and `file:` npm specs.
+- Tests: add coverage for pre-compaction memory flush settings.
+- Tests: modernize live model smoke selection for current releases and enforce tools/images/thinking-high coverage. (#769).
+- Agents/Tools: add `apply_patch` tool for multi-file edits (experimental; gated by tools.exec.applyPatch; OpenAI-only).
+- Agents/Tools: rename the bash tool to exec (config alias maintained). (#748) - thanks @myfunc.
+- Agents: add pre-compaction memory flush config (`agents.defaults.compaction.*`) with a soft threshold + system prompt.
+- Config: add `$include` directive for modular config files. (#731) - thanks @pasogott.
+- Build: set pnpm minimum release age to 2880 minutes (2 days). (#718) - thanks @dan-dr.
+- macOS: prompt to install the global `openclaw` CLI when missing in local mode; install via `openclaw.ai/install-cli.sh` (no onboarding) and use external launchd/CLI instead of the embedded gateway runtime.
+- Docs: add gog calendar event color IDs from `gog calendar colors`. (#715) - thanks @mjrussell.
+- Cron/CLI: add `--model` flag to cron add/edit commands. (#711) - thanks @mjrussell.
+- Cron/CLI: trim model overrides on cron edits and document main-session guidance. (#711) - thanks @mjrussell.
+- Skills: bundle `skill-creator` to guide creating and packaging skills.
+- Providers: add per-DM history limit overrides (`dmHistoryLimit`) with provider-level config. (#728) - thanks @pkrmf.
+- Discord: expose channel/category management actions in the message tool. (#730) - thanks @NicholasSpisak.
+- Docs: rename README "macOS app" section to "Apps". (#733) - thanks @AbhisekBasu1.
+- Gateway: require `client.id` in WebSocket connect params; use `client.instanceId` for presence de-dupe; update docs/tests.
+- macOS: remove the attach-only gateway setting; local mode now always manages launchd while still attaching to an existing gateway if present.
+
+### Fixes
+
+- Models/Onboarding: configure MiniMax (minimax.io) via Anthropic-compatible `/anthropic` endpoint by default (keep `minimax-api` as a legacy alias).
+- Models: normalize Gemini 3 Pro/Flash IDs to preview names for live model lookups. (#769).
+- CLI: fix guardCancel typing for configure prompts. (#769).
+- Gateway/WebChat: include handshake validation details in the WebSocket close reason for easier debugging; preserve close codes.
+- Gateway/Auth: send invalid connect responses before closing the handshake; stabilize invalid-connect auth test.
+- Gateway: tighten gateway listener detection.
+- Control UI: hide onboarding chat when configured and guard the mobile chat sidebar overlay.
+- Auth: read Codex keychain credentials and make the lookup platform-aware.
+- macOS/Release: avoid bundling dist artifacts in relay builds and generate appcasts from zip-only sources.
+- Doctor: surface plugin diagnostics in the report.
+- Plugins: treat `plugins.load.paths` directory entries as package roots when they contain `package.json` + `openclaw.extensions`; load plugin packages from config dirs; extract archives without system tar.
+- Config: expand `~` in `CLAWDBOT_CONFIG_PATH` and common path-like config fields (including `plugins.load.paths`); guard invalid `$include` paths. (#731) - thanks @pasogott.
+- Memory/QMD: honor `memorySearch.sync.watch` and first-session warm sync for the QMD backend, so managed collections refresh after watched file changes and on the first search in a new session. (#47482) Thanks @Ryce and @vincentkoc.
+- Agents: stop pre-creating session transcripts so first user messages persist in JSONL history.
+- Agents: skip pre-compaction memory flush when the session workspace is read-only.
+- Auto-reply: ignore inline `/status` directives unless the message is directive-only.
+- Auto-reply: align `/think` default display with model reasoning defaults. (#751) - thanks @gabriel-trigo.
+- Auto-reply: flush block reply buffers on tool boundaries. (#750) - thanks @sebslight.
+- Auto-reply: allow sender fallback for command authorization when `SenderId` is empty (WhatsApp self-chat). (#755) - thanks @juanpablodlc.
+- Auto-reply: treat whitespace-only sender ids as missing for command authorization (WhatsApp self-chat). (#766).
+- Heartbeat: refresh prompt text for updated defaults.
+- Memory/QMD: prefer `qmd collection add --glob` for current QMD releases and fall back to legacy `--mask` when older builds reject it. (#55123) Thanks @ForceConstant and @vincentkoc.
+- Agents/Tools: use PowerShell on Windows to capture system utility output. (#748) - thanks @myfunc.
+- Docker: tolerate unset optional env vars in docker-setup.sh under strict mode. (#725) - thanks @petradonka.
+- CLI/Update: preserve base environment when passing overrides to update subprocesses. (#713) - thanks @danielz1z.
+- Agents: treat message tool errors as failures so fallback replies still send; require `to` + `message` for `action=send`. (#717) - thanks @theglove44.
+- Agents: preserve reasoning items on tool-only turns.
+- Agents/Subagents: wait for completion before announcing, align wait timeout with run timeout, and make announce prompts more emphatic.
+- Agents: route subagent transcripts to the target agent sessions directory and add regression coverage. (#708) - thanks @xMikeMickelson.
+- Agents/Tools: preserve action enums when flattening tool schemas. (#708) - thanks @xMikeMickelson.
+- Gateway/Agents: canonicalize main session aliases for store writes and add regression coverage. (#709) - thanks @xMikeMickelson.
+- Agents: reset sessions and retry when auto-compaction overflows instead of crashing the gateway.
+- Providers/Telegram: normalize command mentions for consistent parsing. (#729) - thanks @obviyus.
+- Providers: skip DM history limit handling for non-DM sessions. (#728) - thanks @pkrmf.
+- Sandbox: fix non-main mode incorrectly sandboxing the main DM session and align `/status` runtime reporting with effective sandbox state.
+- Sandbox/Gateway: treat `agent:<id>:main` as a main-session alias when `session.mainKey` is customized (backwards compatible).
+- Auto-reply: fast-path allowlisted slash commands (inline `/help`/`/commands`/`/status`/`/whoami` stripped before model).
+
+### Installer
+
+- Postinstall: replace `git apply` with builtin JS patcher (works npm/pnpm/bun; no git dependency) plus regression tests.
+- Postinstall: skip pnpm patch fallback when the new patcher is active.
+- Installer tests: add root+non-root docker smokes, CI workflow to fetch openclaw.ai scripts and run install sh/cli with onboarding skipped.
+- Installer UX: support `CLAWDBOT_NO_ONBOARD=1` for non-interactive installs; fix npm prefix on Linux and auto-install git.
+- Installer UX: add `install.sh --help` with flags/env and git install hint.
+- Installer UX: add `--install-method git|npm` and auto-detect source checkouts (prompt to update git checkout vs migrate to npm).
+
diff --git a/CHANGELOG/2026.1.12.md b/CHANGELOG/2026.1.12.md
new file mode 100644
index 0000000000000000000000000000000000000000..826eb8130426720d41a58a664619d66a518d6425
--- /dev/null
+++ b/CHANGELOG/2026.1.12.md
@@ -0,0 +1,60 @@
+## 2026.1.12
+
+### Highlights
+
+- **BREAKING:** rename chat "providers" (Slack/Telegram/WhatsApp/...) to **channels** across CLI/RPC/config; legacy config keys auto-migrate on load (and are written back as `channels.*`) (#57018). Thanks @hydro13.
+- Memory: add vector search for agent memories (Markdown-only) with SQLite index, chunking, lazy sync + file watch, and per-agent enablement/fallback.
+- Plugins: restore full voice-call plugin parity (Telnyx/Twilio, streaming, inbound policies, tools/CLI).
+- Models: add Synthetic provider plus Moonshot Kimi K2 0905 + turbo/thinking variants (with docs). (#811) - thanks @siraht; (#818) - thanks @mickahouan.
+- Cron: one-shot schedules accept ISO timestamps (UTC) with optional delete-after-run; cron jobs can target a specific agent (CLI + macOS/Control UI).
+- Agents: add compaction mode config with optional safeguard summarization and per-agent model fallbacks. (#700) - thanks @thewilloftheshadow; (#583) - thanks @mitschabaude-bot.
+
+### New & Improved
+
+- Memory: add custom OpenAI-compatible embedding endpoints; support OpenAI/local `node-llama-cpp` embeddings with per-agent overrides and provider metadata in tools/CLI. (#819) - thanks @mukhtharcm.
+- Memory: new `openclaw memory` CLI plus `memory_search`/`memory_get` tools with snippets + line ranges; index stored under `~/.openclaw/memory/{agentId}.sqlite` with watch-on-by-default.
+- Agents: strengthen memory recall guidance; make workspace bootstrap truncation configurable (default 20k) with warnings; add default sub-agent model config.
+- Tools/Sandbox: add tool profiles + group shorthands; support tool-policy groups in `tools.sandbox.tools`; drop legacy `memory` shorthand; allow Docker bind mounts via `docker.binds`. (#790) - thanks @akonyer.
+- Tools: add provider/model-specific tool policy overrides (`tools.byProvider`) to trim tool exposure per provider.
+- Tools: add browser `scrollintoview` action; allow Claude/Gemini tool param aliases; allow thinking `xhigh` for GPT-5.2/Codex with safe downgrades. (#793) - thanks @hsrvc; (#444) - thanks @grp06.
+- Gateway/CLI: add Tailscale binary discovery, custom bind mode, and probe auth retry; add `openclaw dashboard` auto-open flow; default native slash commands to `"auto"` with per-provider overrides. (#740) - thanks @jeffersonwarrior.
+- Auth/Onboarding: add Chutes OAuth (PKCE + refresh + onboarding choice); normalize API key inputs; default TUI onboarding to `deliver: false`. (#726) - thanks @FrieSei; (#791) - thanks @roshanasingh4.
+- Providers: add `discord.allowBots`; trim legacy MiniMax M2 from default catalogs; route MiniMax vision to the Coding Plan VLM endpoint (also accepts `@/path/to/file.png` inputs). (#802) - thanks @zknicker.
+- Gateway: allow Tailscale Serve identity headers to satisfy token auth; rebuild Control UI assets when protocol schema is newer. (#823) - thanks @roshanasingh4; (#786) - thanks @meaningfool.
+- Heartbeat: default `ackMaxChars` to 300 so short `HEARTBEAT_OK` replies stay internal.
+
+### Fixes
+
+- Doctor: warn on pnpm workspace mismatches, missing Control UI assets, and missing tsx binaries; offer UI rebuilds.
+- Tools: apply global tool allow/deny even when agent-specific tool policy is set.
+- Models/Providers: treat credential validation failures as auth errors to trigger fallback; normalize `${ENV_VAR}` apiKey values and auto-fill missing provider keys; preserve explicit GitHub Copilot provider config + agent-dir auth profiles. (#822) - thanks @sebslight; (#705) - thanks @TAGOOZ.
+- Auth: drop invalid auth profiles from ordering so environment keys can still be used for providers like MiniMax.
+- Gemini: normalize Gemini 3 ids to preview variants; strip Gemini CLI tool call/response ids; downgrade missing `thought_signature`; strip Claude `msg_*` thought_signature fields to avoid base64 decode errors. (#795) - thanks @thewilloftheshadow; (#783) - thanks @ananth-vardhan-cn; (#793) - thanks @hsrvc; (#805) - thanks @marcmarg.
+- Agents: auto-recover from compaction context overflow by resetting the session and retrying; propagate overflow details from embedded runs so callers can recover.
+- MiniMax: strip malformed tool invocation XML; include `MiniMax-VL-01` in implicit provider for image pairing. (#809) - thanks @latitudeki5223.
+- Onboarding/Auth: honor `CLAWDBOT_AGENT_DIR` / `PI_CODING_AGENT_DIR` when writing auth profiles (MiniMax). (#829) - thanks @roshanasingh4.
+- Anthropic: handle `overloaded_error` with a friendly message and failover classification. (#832) - thanks @danielz1z.
+- Anthropic: merge consecutive user turns (preserve newest metadata) before validation to avoid incorrect role errors. (#804) - thanks @ThomsenDrake.
+- Messaging: enforce context isolation for message tool sends; keep typing indicators alive during tool execution. (#793) - thanks @hsrvc; (#450, #447) - thanks @thewilloftheshadow.
+- Auto-reply: `/status` allowlist behavior, reasoning-tag enforcement on fallback, and system-event enqueueing for elevated/reasoning toggles. (#810) - thanks @mcinteerj.
+- System events: include local timestamps when events are injected into prompts. (#245) - thanks @thewilloftheshadow.
+- Auto-reply: resolve ambiguous `/model` matches; fix streaming block reply media handling; keep >300 char heartbeat replies instead of dropping.
+- Discord/Slack: centralize reply-thread planning; fix autoThread routing + add per-channel autoThread; avoid duplicate listeners; keep reasoning italics intact; allow clearing channel parents via message tool. (#800, #807) - thanks @davidguttman; (#744) - thanks @thewilloftheshadow.
+- Telegram: preserve forum topic thread ids, persist polling offsets, respect account bindings in webhook mode, and show typing indicator in General topics. (#727, #739) - thanks @thewilloftheshadow; (#821) - thanks @gumadeiras; (#779) - thanks @azade-c.
+- Slack: accept slash commands with or without leading `/` for custom command configs. (#798) - thanks @thewilloftheshadow.
+- Cron: persist disabled jobs correctly; accept `jobId` aliases for update/run/remove params. (#205, #252) - thanks @thewilloftheshadow.
+- Gateway/CLI: honor `CLAWDBOT_LAUNCHD_LABEL` / `CLAWDBOT_SYSTEMD_UNIT` overrides; `agents.list` respects explicit config; reduce noisy loopback WS logs during tests; run `openclaw doctor --non-interactive` during updates. (#781) - thanks @ronyrus.
+- Onboarding/Control UI: refuse invalid configs (run doctor first); quote Windows browser URLs for OAuth; keep chat scroll position unless the user is near the bottom. (#764) - thanks @mukhtharcm; (#794) - thanks @roshanasingh4; (#217) - thanks @thewilloftheshadow.
+- Tools/UI: harden tool input schemas for strict providers; drop null-only union variants for Gemini schema cleanup; treat `maxChars: 0` as unlimited; keep TUI last streamed response instead of "(no output)". (#782) - thanks @AbhisekBasu1; (#796) - thanks @gabriel-trigo; (#747) - thanks @thewilloftheshadow.
+- Connections UI: polish multi-account account cards. (#816).
+
+### Installer
+
+- Install: run `openclaw doctor --non-interactive` after git installs/updates and nudge daemon restarts when detected.
+
+### Maintenance
+
+- Dependencies: bump Pi packages to 0.45.3 and refresh patched pi-ai.
+- Testing: update Vitest + browser-playwright to 4.0.17.
+- Docs: add Amazon Bedrock provider notes and link from models/FAQ.
+
diff --git a/CHANGELOG/2026.1.13.md b/CHANGELOG/2026.1.13.md
new file mode 100644
index 0000000000000000000000000000000000000000..dbf3a547197bdebb6ac12ef9964c84358e180184
--- /dev/null
+++ b/CHANGELOG/2026.1.13.md
@@ -0,0 +1,7 @@
+## 2026.1.13
+
+### Fixes
+
+- Postinstall: treat already-applied pnpm patches as no-ops to avoid npm/bun install failures.
+- Packaging: pin `@mariozechner/pi-ai` to 0.45.7 and refresh patched dependency to match npm resolution.
+
diff --git a/CHANGELOG/2026.1.14.md b/CHANGELOG/2026.1.14.md
new file mode 100644
index 0000000000000000000000000000000000000000..9dd2ffd6cc5fd5c0f842b168f4983cced24a739b
--- /dev/null
+++ b/CHANGELOG/2026.1.14.md
@@ -0,0 +1,44 @@
+## 2026.1.14
+
+### Changes
+
+- Usage: add MiniMax coding plan usage tracking.
+- Auth: label Claude Code CLI auth options. (#915) - thanks @SeanZoR.
+- Docs: standardize Claude Code CLI naming across docs and prompts. (follow-up to #915).
+- Telegram: add message delete action in the message tool. (#903) - thanks @sleontenko.
+- Config: add `channels.<provider>.configWrites` gating for channel-initiated config writes; migrate Slack channel IDs.
+
+### Fixes
+
+- Mac: pass auth token/password to dashboard URL for authenticated access. (#918) - thanks @rahthakor.
+- UI: use application-defined WebSocket close code (browser compatibility). (#918) - thanks @rahthakor.
+- TUI: render picker overlays via the overlay stack so /models and /settings display. (#921) - thanks @grizzdank.
+- TUI: add a bright spinner + elapsed time in the status line for send/stream/run states.
+- TUI: show LLM error messages (rate limits, auth, etc.) instead of `(no output)`. Thanks @kkarimi.
+- Gateway/Dev: ensure `pnpm gateway:dev` always uses the dev profile config + state (`~/.openclaw-dev`).
+
+#### Agents / Auth / Tools / Sandbox
+
+- Agents: make user time zone and 24-hour time explicit in the system prompt. (#859) - thanks @CashWilliams.
+- Agents: strip downgraded tool call text without eating adjacent replies and filter thinking-tag leaks. (#905) - thanks @erikpr1994.
+- Agents: cap tool call IDs for OpenAI/OpenRouter to avoid request rejections. (#875) - thanks @j1philli.
+- Sandbox: restore `docker.binds` config validation and preserve configured PATH for `docker exec`. (#873) - thanks @akonyer.
+
+#### macOS / Apps
+
+- macOS: ensure launchd log directory exists with a test-only override. (#909) - thanks @roshanasingh4.
+- macOS: format ConnectionsStore config to satisfy SwiftFormat lint. (#852) - thanks @mneves75.
+- macOS: pass auth token/password to dashboard URL for authenticated access. (#918) - thanks @rahthakor.
+- macOS: reuse launchd gateway auth and skip wizard when gateway config already exists. (#917) Thanks @kkarimi.
+- macOS: prefer the default bridge tunnel port in remote mode for node bridge connectivity; document macOS remote control + bridge tunnels. (#960, fixes #865) - thanks @kkarimi.
+- Apps: use canonical main session keys from gateway defaults across macOS/iOS/Android to avoid creating bare `main` sessions. Thanks @kkarimi.
+- macOS: fix cron preview/testing payload to use `channel` key. (#867) - thanks @wes-davis.
+- Telegram: honor `channels.telegram.timeoutSeconds` for grammY API requests. (#863) - thanks @Snaver.
+- Telegram: split long captions into media + follow-up text messages. (#907) - thanks @jalehman.
+- Telegram: migrate group config when supergroups change chat IDs. (#906) - thanks @sleontenko.
+- Messaging: unify markdown formatting + format-first chunking for Slack/Telegram/Signal. (#920) - thanks @TheSethRose.
+- Slack: drop Socket Mode events with mismatched `api_app_id`/`team_id`. (#889) - thanks @roshanasingh4.
+- Discord: isolate autoThread thread context. (#856) - thanks @davidguttman.
+- WhatsApp: fix context isolation using wrong ID (was bot's number, now conversation ID). (#911) - thanks @tristanmanchester.
+- WhatsApp: normalize user JIDs with device suffix for allowlist checks in groups. (#838) - thanks @peschee.
+
diff --git a/CHANGELOG/2026.1.16-1.md b/CHANGELOG/2026.1.16-1.md
new file mode 100644
index 0000000000000000000000000000000000000000..0b4552d1f407608fb313a7c2c33691937d045510
--- /dev/null
+++ b/CHANGELOG/2026.1.16-1.md
@@ -0,0 +1,111 @@
+## 2026.1.16-1
+
+### Highlights
+
+- Hooks: add hooks system with bundled hooks, CLI tooling, and docs. (#1028) - thanks @ThomsenDrake. https://docs.openclaw.ai/hooks
+- Media: add inbound media understanding (image/audio/video) with provider + CLI fallbacks. https://docs.openclaw.ai/nodes/media-understanding.
+- Plugins: add Zalo Personal plugin (`@openclaw/zalouser`) and unify channel directory for plugins. (#1032) - thanks @suminhthanh. https://docs.openclaw.ai/plugins/zalouser
+- Models: add Vercel AI Gateway auth choice + onboarding updates. (#1016) - thanks @timolins. https://docs.openclaw.ai/providers/vercel-ai-gateway
+- Sessions: add `session.identityLinks` for cross-platform DM session li nking. (#1033) - thanks @thewilloftheshadow. https://docs.openclaw.ai/concepts/session
+- Web search: add `country`/`language` parameters (schema + Brave API) and docs. (#1046) - thanks @YuriNachos. https://docs.openclaw.ai/tools/web
+
+### Changes
+
+- Plugins: ship bundled plugins disabled by default and allow overrides by installed versions. (#1066) - thanks @ItzR3NO.
+- Plugins: add bundled Antigravity + Gemini CLI OAuth + Copilot Proxy provider plugins. (#1066) - thanks @ItzR3NO.
+- Tools: improve `web_fetch` extraction using Readability (with fallback).
+- Tools: add Firecrawl fallback for `web_fetch` when configured.
+- Tools: send Chrome-like headers by default for `web_fetch` to improve extraction on bot-sensitive sites.
+- Tools: Firecrawl fallback now uses bot-circumvention + cache by default; remove basic HTML fallback when extraction fails.
+- Tools: default `exec` exit notifications and auto-migrate legacy `tools.bash` to `tools.exec`.
+- Tools: add `exec` PTY support for interactive sessions. https://docs.openclaw.ai/tools/exec.
+- Tools: add tmux-style `process send-keys` and bracketed paste helpers for PTY sessions.
+- Tools: add `process submit` helper to send CR for PTY sessions.
+- Tools: respond to PTY cursor position queries to unblock interactive TUIs.
+- Tools: include tool outputs in verbose mode and expand verbose tool feedback.
+- Skills: update coding-agent guidance to prefer PTY-enabled exec runs and simplify tmux usage.
+- TUI: refresh session token counts after runs complete or fail. (#1079) - thanks @d-ploutarchos.
+- Status: trim `/status` to current-provider usage only and drop the OAuth/token block.
+- Directory: unify `openclaw directory` across channels and plugin channels.
+- UI: allow deleting sessions from the Control UI.
+- Memory: add sqlite-vec vector acceleration with CLI status details.
+- Memory: add experimental session transcript indexing for memory_search (opt-in via memorySearch.experimental.sessionMemory + sources).
+- Skills: add user-invocable skill commands and expanded skill command registration.
+- Telegram: default reaction level to minimal and enable reaction notifications by default.
+- Telegram: allow reply-chain messages to bypass mention gating in groups. (#1038) - thanks @adityashaw2.
+- iMessage: add remote attachment support for VM/SSH deployments.
+- Messages: refresh live directory cache results when resolving targets.
+- Messages: mirror delivered outbound text/media into session transcripts. (#1031) - thanks @TSavo.
+- Messages: avoid redundant sender envelopes for iMessage + Signal group chats. (#1080) - thanks @tyler6204.
+- Media: normalize Deepgram audio upload bytes for fetch compatibility.
+- Cron: isolated cron jobs now start a fresh session id on every run to prevent context buildup.
+- Docs: add `/help` hub, Node/npm PATH guide, and expand directory CLI docs.
+- Config: support env var substitution in config values. (#1044) - thanks @sebslight.
+- Health: add per-agent session summaries and account-level health details, and allow selective probes. (#1047) - thanks @gumadeiras.
+- Hooks: add hook pack installs (npm/path/zip/tar) with `openclaw.hooks` manifests and `openclaw hooks install/update`.
+- Plugins: add zip installs and `--link` to avoid copying local paths.
+
+### Fixes
+
+- macOS: drain subprocess pipes before waiting to avoid deadlocks. (#1081) - thanks @thesash.
+- Verbose: wrap tool summaries/output in markdown only for markdown-capable channels.
+- Tools: include provider/session context in elevated exec denial errors.
+- Tools: normalize exec tool alias naming in tool error logs.
+- Logging: reuse shared ANSI stripping to keep console capture lint-clean.
+- Logging: prefix nested agent output with session/run/channel context.
+- Telegram: accept tg/group/telegram prefixes + topic targets for inline button validation. (#1072) - thanks @danielz1z.
+- Telegram: split long captions into follow-up messages.
+- Config: block startup on invalid config, preserve best-effort doctor config, and keep rolling config backups. (#1083) - thanks @mukhtharcm.
+- Sub-agents: normalize announce delivery origin + queue bucketing by accountId to keep multi-account routing stable. (#1061, #1058) - thanks @adam91holt.
+- Sessions: include deliveryContext in sessions.list and reuse normalized delivery routing for announce/restart fallbacks. (#1058).
+- Sessions: propagate deliveryContext into last-route updates to keep account/channel routing stable. (#1058).
+- Sessions: preserve overrides on `/new` reset.
+- Memory: prevent unhandled rejections when watch/interval sync fails. (#1076) - thanks @roshanasingh4.
+- Memory: avoid gateway crash when embeddings return 429/insufficient_quota (disable tool + surface error). (#1004).
+- Gateway: honor explicit delivery targets without implicit accountId fallback; preserve lastAccountId for implicit routing.
+- Gateway: avoid reusing last-to/accountId when the requested channel differs; sync deliveryContext with last route fields.
+- Build: allow `@lydell/node-pty` builds on supported platforms.
+- Repo: fix oxlint config filename and move ignore pattern into config. (#1064) - thanks @connorshea.
+- Messages: `/stop` now hard-aborts queued followups and sub-agent runs; suppress zero-count stop notes.
+- Messages: honor message tool channel when deduping sends.
+- Messages: include sender labels for live group messages across channels, matching queued/history formatting. (#1059).
+- Sessions: reset `compactionCount` on `/new` and `/reset`, and preserve `sessions.json` file mode (0600).
+- Sessions: repair orphaned user turns before embedded prompts.
+- Sessions: hard-stop `sessions.delete` cleanup.
+- Channels: treat replies to the bot as implicit mentions across supported channels.
+- Channels: normalize object-format capabilities in channel capability parsing.
+- Security: default-deny slash/control commands unless a channel computed `CommandAuthorized` (fixes accidental "open" behavior), and ensure WhatsApp + Zalo plugin channels gate inline `/...` tokens correctly. https://docs.openclaw.ai/gateway/security (#57018) Thanks @hydro13.
+- Security: redact sensitive text in gateway WS logs.
+- Tools: cap pending `exec` process output to avoid unbounded buffers.
+- CLI: speed up `openclaw sandbox-explain` by avoiding heavy plugin imports when normalizing channel ids.
+- Browser: remote profile tab operations prefer persistent Playwright and avoid silent HTTP fallbacks. (#1057) - thanks @mukhtharcm.
+- Browser: remote profile tab ops follow-up: shared Playwright loader, Playwright-based focus, and more coverage (incl. opt-in live Browserless test). (follow-up to #1057) - thanks @mukhtharcm.
+- Browser: refresh extension relay tab metadata after navigation so `/json/list` stays current. (#1073) - thanks @roshanasingh4.
+- WhatsApp: scope self-chat response prefix; inject pending-only group history and clear after any processed message.
+- WhatsApp: include `linked` field in `describeAccount`.
+- Agents: drop unsigned Gemini tool calls and avoid JSON Schema `format` keyword collisions.
+- Agents: hide the image tool when the primary model already supports images.
+- Agents: avoid duplicate sends by replying with `NO_REPLY` after `message` tool sends.
+- Auth: inherit/merge sub-agent auth profiles from the main agent.
+- Gateway: resolve local auth for security probe and validate gateway token/password file modes. (#1011, #1022) - thanks @ivanrvpereira, @kkarimi.
+- Signal/iMessage: bound transport readiness waits to 30s with periodic logging. (#1014) - thanks @Szpadel.
+- iMessage: avoid RPC restart loops.
+- OpenAI image-gen: handle URL + `b64_json` responses and remove deprecated `response_format` (use URL downloads).
+- CLI: auto-update global installs when installed via a package manager.
+- Routing: migrate legacy `accountID` bindings to `accountId` and remove legacy fallback lookups. (#1047) - thanks @gumadeiras.
+- Discord: truncate skill command descriptions to 100 chars for slash command limits. (#1018) - thanks @evalexpr.
+- Security: bump `tar` to 7.5.3.
+- Models: align ZAI thinking toggles.
+- iMessage/Signal: include sender metadata for non-queued group messages. (#1059).
+- Discord: preserve whitespace when chunking long lines so message splits keep spacing intact.
+- Skills: fix skills watcher ignored list typing (tsc).
+
+### Breaking
+
+- **BREAKING:** `openclaw message` and message tool now require `target` (dropping `to`/`channelId` for destinations). (#1034) - thanks @tobalsan.
+- **BREAKING:** Channel auth now prefers config over env for Discord/Telegram/Matrix (env is fallback only). (#1040) - thanks @thewilloftheshadow.
+- **BREAKING:** Drop legacy `chatType: "room"` support; use `chatType: "channel"`.
+- **BREAKING:** remove legacy provider-specific target resolution fallbacks; target resolution is centralized with plugin hints + directory lookups.
+- **BREAKING:** `openclaw hooks` is now `openclaw webhooks`; hooks live under `openclaw hooks`. https://docs.openclaw.ai/cli/webhooks.
+- **BREAKING:** `openclaw plugins install <path>` now copies into `~/.openclaw/extensions` (use `--link` to keep path-based loading).
+
diff --git a/CHANGELOG/2026.1.16-2.md b/CHANGELOG/2026.1.16-2.md
new file mode 100644
index 0000000000000000000000000000000000000000..27212121862f937356e8cedd8c5051f76607ed09
--- /dev/null
+++ b/CHANGELOG/2026.1.16-2.md
@@ -0,0 +1,7 @@
+## 2026.1.16-2
+
+### Changes
+
+- CLI: stamp build commit into dist metadata so banners show the commit in npm installs.
+- CLI: close memory manager after memory commands to avoid hanging processes. (#1127) - thanks @NicholasSpisak.
+
diff --git a/CHANGELOG/2026.1.20.md b/CHANGELOG/2026.1.20.md
new file mode 100644
index 0000000000000000000000000000000000000000..6c9bb482ef9bbc0ee1ed7c971a86a9f85a1efd7e
--- /dev/null
+++ b/CHANGELOG/2026.1.20.md
@@ -0,0 +1,183 @@
+## 2026.1.20
+
+### Changes
+
+- Control UI: add copy-as-markdown with error feedback. (#1345) https://docs.openclaw.ai/web/control-ui.
+- Control UI: drop the legacy list view. (#1345) https://docs.openclaw.ai/web/control-ui.
+- TUI: add syntax highlighting for code blocks. (#1200) https://docs.openclaw.ai/tui.
+- TUI: session picker shows derived titles, fuzzy search, relative times, and last message preview. (#1271) https://docs.openclaw.ai/tui.
+- TUI: add a searchable model picker for quicker model selection. (#1198) https://docs.openclaw.ai/tui.
+- TUI: add input history (up/down) for submitted messages. (#1348) https://docs.openclaw.ai/tui.
+- ACP: add `openclaw acp` for IDE integrations. https://docs.openclaw.ai/cli/acp.
+- ACP: add `openclaw acp client` interactive harness for debugging. https://docs.openclaw.ai/cli/acp.
+- Skills: add download installs with OS-filtered options. https://docs.openclaw.ai/tools/skills.
+- Skills: add the local sherpa-onnx-tts skill. https://docs.openclaw.ai/tools/skills.
+- Memory: add hybrid BM25 + vector search (FTS5) with weighted merging and fallback. https://docs.openclaw.ai/concepts/memory.
+- Memory: add SQLite embedding cache to speed up reindexing and frequent updates. https://docs.openclaw.ai/concepts/memory.
+- Memory: add OpenAI batch indexing for embeddings when configured. https://docs.openclaw.ai/concepts/memory.
+- Memory: enable OpenAI batch indexing by default for OpenAI embeddings. https://docs.openclaw.ai/concepts/memory.
+- Memory: allow parallel OpenAI batch indexing jobs (default concurrency: 2). https://docs.openclaw.ai/concepts/memory.
+- Memory: render progress immediately, color batch statuses in verbose logs, and poll OpenAI batch status every 2s by default. https://docs.openclaw.ai/concepts/memory.
+- Memory: add `--verbose` logging for memory status + batch indexing details. https://docs.openclaw.ai/concepts/memory.
+- Memory: add native Gemini embeddings provider for memory search. (#1151) https://docs.openclaw.ai/concepts/memory.
+- Browser: allow config defaults for efficient snapshots in the tool/CLI. (#1336) https://docs.openclaw.ai/tools/browser.
+- Nostr: add the Nostr channel plugin with profile management + onboarding defaults. (#1323) https://docs.openclaw.ai/channels/nostr.
+- Matrix: migrate to matrix-bot-sdk with E2EE support, location handling, and group allowlist upgrades. (#1298) https://docs.openclaw.ai/channels/matrix.
+- Slack: add HTTP webhook mode via Bolt HTTP receiver. (#1143) https://docs.openclaw.ai/channels/slack.
+- Telegram: enrich forwarded-message context with normalized origin details + legacy fallback. (#1090) https://docs.openclaw.ai/channels/telegram.
+- Discord: fall back to `/skill` when native command limits are exceeded. (#1287).
+- Discord: expose `/skill` globally. (#1287).
+- Zalouser: add channel dock metadata, config schema, setup wiring, probe, and status issues. (#1219) https://docs.openclaw.ai/plugins/zalouser.
+- Plugins: require manifest-embedded config schemas with preflight validation warnings. (#1272) https://docs.openclaw.ai/plugins/manifest.
+- Plugins: move channel catalog metadata into plugin manifests. (#1290) https://docs.openclaw.ai/plugins/manifest.
+- Plugins: align Nextcloud Talk policy helpers with core patterns. (#1290) https://docs.openclaw.ai/plugins/manifest.
+- Plugins/UI: let channel plugin metadata drive UI labels/icons and cron channel options. (#1306) https://docs.openclaw.ai/web/control-ui.
+- Agents/UI: add agent avatar support in identity config, IDENTITY.md, and the Control UI. (#1329) https://docs.openclaw.ai/gateway/configuration.
+- Plugins: add plugin slots with a dedicated memory slot selector. https://docs.openclaw.ai/plugins/agent-tools.
+- Plugins: ship the bundled BlueBubbles channel plugin (disabled by default). https://docs.openclaw.ai/channels/bluebubbles.
+- Plugins: migrate bundled messaging extensions to the plugin SDK and resolve plugin-sdk imports in the loader.
+- Plugins: migrate the Zalo plugin to the shared plugin SDK runtime. https://docs.openclaw.ai/channels/zalo.
+- Plugins: migrate the Zalo Personal plugin to the shared plugin SDK runtime. https://docs.openclaw.ai/plugins/zalouser.
+- Plugins: allow optional agent tools with explicit allowlists and add the plugin tool authoring guide. https://docs.openclaw.ai/plugins/agent-tools.
+- Plugins: auto-enable bundled channel/provider plugins when configuration is present.
+- Plugins: sync plugin sources on channel switches and update npm-installed plugins during `openclaw update`.
+- Plugins: share npm plugin update logic between `openclaw update` and `openclaw plugins update`.
+
+- Gateway/API: add `/v1/responses` (OpenResponses) with item-based input + semantic streaming events. (#1229).
+- Gateway/API: expand `/v1/responses` to support file/image inputs, tool_choice, usage, and output limits. (#1229).
+- Usage: add `/usage cost` summaries and macOS menu cost charts. https://docs.openclaw.ai/reference/api-usage-costs.
+- Security: warn when <=300B models run without sandboxing while web tools are enabled. https://docs.openclaw.ai/cli/security.
+- Exec: add host/security/ask routing for gateway + node exec. https://docs.openclaw.ai/tools/exec.
+- Exec: add `/exec` directive for per-session exec defaults (host/security/ask/node). https://docs.openclaw.ai/tools/exec.
+- Exec approvals: migrate approvals to `~/.openclaw/exec-approvals.json` with per-agent allowlists + skill auto-allow toggle, and add approvals UI + node exec lifecycle events. https://docs.openclaw.ai/tools/exec-approvals.
+- Nodes: add headless node host (`openclaw node start`) for `system.run`/`system.which`. https://docs.openclaw.ai/cli/node.
+- Nodes: add node daemon service install/status/start/stop/restart. https://docs.openclaw.ai/cli/node.
+- Bridge: add `skills.bins` RPC to support node host auto-allow skill bins.
+- Sessions: add daily reset policy with per-type overrides and idle windows (default 4am local), preserving legacy idle-only configs. (#1146) https://docs.openclaw.ai/concepts/session.
+- Sessions: allow `sessions_spawn` to override thinking level for sub-agent runs. https://docs.openclaw.ai/tools/subagents.
+- Channels: unify thread/topic allowlist matching + command/mention gating helpers across core providers. https://docs.openclaw.ai/concepts/groups.
+- Models: add Qwen Portal OAuth provider support. (#1120) https://docs.openclaw.ai/providers/qwen.
+- Onboarding: add allowlist prompts and username-to-id resolution across core and extension channels. https://docs.openclaw.ai/start/onboarding.
+- Docs: clarify allowlist input types and onboarding behavior for messaging channels. https://docs.openclaw.ai/start/onboarding.
+- Docs: refresh Android node discovery docs for the Gateway WS service type. https://docs.openclaw.ai/platforms/android.
+- Docs: surface Amazon Bedrock in provider lists and clarify Bedrock auth env vars. (#1289) https://docs.openclaw.ai/bedrock.
+- Docs: clarify WhatsApp voice notes. https://docs.openclaw.ai/channels/whatsapp.
+- Docs: clarify Windows WSL portproxy LAN access notes. https://docs.openclaw.ai/platforms/windows.
+- Docs: refresh bird skill install metadata and usage notes. (#1302) https://docs.openclaw.ai/tools/browser-login.
+- Agents: add local docs path resolution and include docs/mirror/source/community pointers in the system prompt.
+- Agents: clarify node_modules read-only guidance in agent instructions.
+- Config: stamp last-touched metadata on write and warn if the config is newer than the running build.
+- macOS: hide usage section when usage is unavailable instead of showing provider errors.
+- Android: migrate node transport to the Gateway WebSocket protocol with TLS pinning support + gateway discovery naming.
+- Android: send structured payloads in node events/invokes and include user-agent metadata in gateway connects.
+- Android: remove legacy bridge transport code now that nodes use the gateway protocol.
+- Android: bump okhttp + dnsjava to satisfy lint dependency checks.
+- Build: update workspace + core/plugin deps.
+- Build: use tsgo for dev/watch builds by default (opt out with `OPENCLAW_TS_COMPILER=tsc`).
+- Repo: remove the Peekaboo git submodule now that the SPM release is used.
+- macOS: switch PeekabooBridge integration to the tagged Swift Package Manager release.
+- macOS: stop syncing Peekaboo in postinstall.
+- Swabble: use the tagged Commander Swift package release.
+
+### Fixes
+
+- Discovery: shorten Bonjour DNS-SD service type to `_moltbot-gw._tcp` and update discovery clients/docs.
+- Diagnostics: export OTLP logs, correct queue depth tracking, and document message-flow telemetry.
+- Diagnostics: emit message-flow diagnostics across channels via shared dispatch. (#1244).
+- Diagnostics: gate heartbeat/webhook logging. (#1244).
+- Gateway: strip inbound envelope headers from chat history messages to keep clients clean.
+- Gateway: clarify unauthorized handshake responses with token/password mismatch guidance.
+- Gateway: allow mobile node client ids for iOS + Android handshake validation. (#1354).
+- Gateway: clarify connect/validation errors for gateway params. (#1347).
+- Gateway: preserve restart wake routing + thread replies across restarts. (#1337).
+- Gateway: reschedule per-agent heartbeats on config hot reload without restarting the runner.
+- Gateway: require authorized restarts for SIGUSR1 (restart/apply/update) so config gating can't be bypassed.
+- Cron: auto-deliver isolated agent output to explicit targets without tool calls. (#1285).
+- Agents: preserve subagent announce thread/topic routing + queued replies across channels. (#1241).
+- Agents: propagate accountId into embedded runs so sub-agent announce routing honors the originating account. (#1058).
+- Agents: avoid treating timeout errors with "aborted" messages as user aborts, so model fallback still runs. (#1137).
+- Agents: sanitize oversized image payloads before send and surface image-dimension errors.
+- Sessions: fall back to session labels when listing display names. (#1124).
+- Compaction: include tool failure summaries in safeguard compaction to prevent retry loops. (#1084).
+- Config: log invalid config issues once per run and keep invalid-config errors stackless.
+- Config: allow Perplexity as a web_search provider in config validation. (#1230).
+- Config: allow custom fields under `skills.entries.<name>.config` for skill credentials/config. (#1226).
+- Doctor: clarify plugin auto-enable hint text in the startup banner.
+- Doctor: canonicalize legacy session keys in session stores to prevent stale metadata. (#1169).
+- Docs: make docs:list fail fast with a clear error if the docs directory is missing.
+- Plugins: add Nextcloud Talk manifest for plugin config validation. (#1297).
+- Plugins: surface plugin load/register/config errors in gateway logs with plugin/source context.
+- CLI: preserve cron delivery settings when editing message payloads. (#1322).
+- CLI: keep `openclaw logs` output resilient to broken pipes while preserving progress output.
+- CLI: avoid duplicating --profile/--dev flags when formatting commands.
+- CLI: centralize CLI command registration to keep fast-path routing and program wiring in sync. (#1207).
+- CLI: keep banners on routed commands, restore config guarding outside fast-path routing, and tighten fast-path flag parsing while skipping console capture for extra speed. (#1195).
+- CLI: skip runner rebuilds when dist is fresh. (#1231).
+- CLI: add WSL2/systemd unavailable hints in daemon status/doctor output.
+- Status: route native `/status` to the active agent so model selection reflects the correct profile. (#1301).
+- Status: show both usage windows with reset hints when usage data is available. (#1101).
+- UI: keep config form enums typed, preserve empty strings, protect sensitive defaults, and deepen config search. (#1315).
+- UI: preserve ordered list numbering in chat markdown. (#1341).
+- UI: allow Control UI to read gatewayUrl from URL params for remote WebSocket targets. (#1342).
+- UI: prevent double-scroll in Control UI chat by locking chat layout to the viewport. (#1283).
+- UI: enable shell mode for sync Windows spawns to avoid `pnpm ui:build` EINVAL. (#1212).
+- TUI: keep thinking blocks ordered before content during streaming and isolate per-run assembly. (#1202).
+- TUI: align custom editor initialization with the latest pi-tui API. (#1298).
+- TUI: show generic empty-state text for searchable pickers. (#1201).
+- TUI: highlight model search matches and stabilize search ordering.
+- Configure: hide OpenRouter auto routing model from the model picker. (#1182).
+- Memory: show total file counts + scan issues in `openclaw memory status`.
+- Memory: fall back to non-batch embeddings after repeated batch failures.
+- Memory: apply OpenAI batch defaults even without explicit remote config.
+- Memory: index atomically so failed reindex preserves the previous memory database. (#1151).
+- Memory: avoid sqlite-vec unique constraint failures when reindexing duplicate chunk ids. (#1151).
+- Memory: retry transient 5xx errors (Cloudflare) during embedding indexing.
+- Memory: parallelize embedding indexing with rate-limit retries.
+- Memory: split overly long lines to keep embeddings under token limits.
+- Memory: skip empty chunks to avoid invalid embedding inputs.
+- Memory: split embedding batches to avoid OpenAI token limits during indexing.
+- Memory: probe sqlite-vec availability in `openclaw memory status`.
+- Exec approvals: enforce allowlist when ask is off.
+- Exec approvals: prefer raw command for node approvals/events.
+- Tools: show exec elevated flag before the command and keep it outside markdown in tool summaries.
+- Tools: return a companion-app-required message when node exec is requested with no paired node.
+- Tools: return a companion-app-required message when `system.run` is requested without a supporting node.
+- Exec: default gateway/node exec security to allowlist when unset (sandbox stays deny).
+- Exec: prefer bash when fish is default shell, falling back to sh if bash is missing. (#1297).
+- Exec: merge login-shell PATH for host=gateway exec while keeping daemon PATH minimal. (#1304).
+- Streaming: emit assistant deltas for OpenAI-compatible SSE chunks. (#1147).
+- Discord: make resolve warnings avoid raw JSON payloads on rate limits.
+- Discord: process message handlers in parallel across sessions to avoid event queue blocking. (#1295).
+- Discord: stop reconnecting the gateway after aborts to prevent duplicate listeners.
+- Discord: only emit slow listener warnings after 30s.
+- Discord: inherit parent channel allowlists for thread slash commands and reactions. (#1123).
+- Telegram: honor pairing allowlists for native slash commands.
+- Telegram: preserve hidden text_link URLs by expanding entities in inbound text. (#1118).
+- Slack: resolve Bolt import interop for Bun + Node. (#1191).
+- Web search: infer Perplexity base URL from API key source (direct vs OpenRouter).
+- Web fetch: harden SSRF protection with shared hostname checks and redirect limits. (#1346).
+- Browser: register AI snapshot refs for act commands. (#1282).
+- Voice call: include request query in Twilio webhook verification when publicUrl is set. (#864).
+- Anthropic: default API prompt caching to 1h with configurable TTL override.
+- Anthropic: ignore TTL for OAuth.
+- Auth profiles: keep auto-pinned preference while allowing rotation on failover. (#1138).
+- Auth profiles: user pins stay locked. (#1138).
+- Model catalog: avoid caching import failures, log transient discovery errors, and keep partial results. (#1332).
+- Tests: stabilize Windows gateway/CLI tests by skipping sidecars, normalizing argv, and extending timeouts.
+- Tests: stabilize plugin SDK resolution and embedded agent timeouts.
+- Windows: install gateway scheduled task as the current user.
+- Windows: show friendly guidance instead of failing on access denied.
+- macOS: load menu session previews asynchronously so items populate while the menu is open.
+- macOS: use label colors for session preview text so previews render in menu subviews.
+- macOS: suppress usage error text in the menubar cost view.
+- macOS: Doctor repairs LaunchAgent bootstrap issues for Gateway + Node when listed but not loaded. (#1166).
+- macOS: avoid touching launchd in Remote over SSH so quitting the app no longer disables the remote gateway. (#1105).
+- macOS: bundle Textual resources in packaged app builds to avoid code block crashes. (#1006).
+- Daemon: include HOME in service environments to avoid missing HOME errors. (#1214).
+
+Thanks @AlexMikhalev, @CoreyH, @John-Rood, @KrauseFx, @MaudeBot, @Nachx639, @NicholaiVogel, @RyanLisse, @ThePickle31, @VACInc, @Whoaa512, @YuriNachos, @aaronveklabs, @abdaraxus, @alauppe, @ameno-, @artuskg, @austinm911, @bradleypriest, @cheeeee, @dougvk, @fogboots, @gnarco, @gumadeiras, @jdrhyne, @joelklabo, @longmaba, @mukhtharcm, @odysseus0, @oscargavin, @rhjoh, @sebslight, @sibbl, @sleontenko, @suminhthanh, @thewilloftheshadow, @tyler6204, @vignesh07, @visionik, @ysqander, @zerone0x.
+
+### Breaking
+
+- **BREAKING:** Reject invalid/unknown config entries and refuse to start the gateway for safety. Run `openclaw doctor --fix` to repair, then update plugins (`openclaw plugins update`) if you use any.
+
diff --git a/CHANGELOG/2026.1.22.md b/CHANGELOG/2026.1.22.md
new file mode 100644
index 0000000000000000000000000000000000000000..60606acd01f64ac593548a1e7204b795a459695c
--- /dev/null
+++ b/CHANGELOG/2026.1.22.md
@@ -0,0 +1,39 @@
+## 2026.1.22
+
+### Changes
+
+- Highlight: Compaction safeguard now uses adaptive chunking, progressive fallback, and UI status + retries. (#1466) Thanks @dlauer.
+- Providers: add Antigravity usage tracking to status output. (#1490) Thanks @patelhiren.
+- Slack: add chat-type reply threading overrides via `replyToModeByChatType`. (#1442) Thanks @stefangalescu.
+- BlueBubbles: add `asVoice` support for MP3/CAF voice memos in sendAttachment. (#1477, #1482) Thanks @Nicell.
+- Onboarding: add hatch choice (TUI/Web/Later), token explainer, background dashboard seed on macOS, and showcase link.
+
+### Fixes
+
+- BlueBubbles: stop typing indicator on idle/no-reply. (#1439) Thanks @Nicell.
+- Message tool: keep path/filePath as-is for send; hydrate buffers only for sendAttachment. (#1444) Thanks @hopyky.
+- Auto-reply: only report a model switch when session state is available. (#1465) Thanks @robbyczgw-cla.
+- Control UI: resolve local avatar URLs with basePath across injection + identity RPC. (#1457) Thanks @dlauer.
+- Agents: sanitize assistant history text to strip tool-call markers. (#1456) Thanks @zerone0x.
+- Discord: clarify Message Content Intent onboarding hint. (#1487) Thanks @kyleok.
+- Gateway: stop the service before uninstalling and fail if it remains loaded.
+- Agents: surface concrete API error details instead of generic AI service errors.
+- Exec: fall back to non-PTY when PTY spawn fails (EBADF). (#1484).
+- Exec approvals: allow per-segment allowlists for chained shell commands on gateway + node hosts. (#1458) Thanks @czekaj.
+- Agents: make OpenAI sessions image-sanitize-only; gate tool-id/repair sanitization by provider.
+- Doctor: honor CLAWDBOT_GATEWAY_TOKEN for auth checks and security audit token reuse. (#1448) Thanks @azade-c.
+- Agents: make tool summaries more readable and only show optional params when set.
+- Agents: honor SOUL.md guidance even when the file is nested or path-qualified. (#1434) Thanks @neooriginal.
+- Matrix (plugin): persist m.direct for resolved DMs and harden room fallback. (#1436, #1486) Thanks @sibbl.
+- CLI: prefer `~` for home paths in output.
+- Mattermost (plugin): enforce pairing/allowlist gating, keep @username targets, and clarify plugin-only docs. (#1428) Thanks @damoahdominic.
+- Agents: centralize transcript sanitization in the runner; keep <final> tags and error turns intact.
+- Auth: skip auth profiles in cooldown during initial selection and rotation. (#1316) Thanks @odrobnik.
+- Agents/TUI: honor user-pinned auth profiles during cooldown and preserve search picker ranking. (#1432) Thanks @tobiasbischoff.
+- Docs: fix gog auth services example to include docs scope. (#1454) Thanks @zerone0x.
+- Slack: reduce WebClient retries to avoid duplicate sends. (#1481).
+- Slack: read thread replies for message reads when threadId is provided (replies-only). (#1450) Thanks @rodrigouroz.
+- Discord: honor accountId across message actions and cron deliveries. (#1492) Thanks @svkozak.
+- macOS: prefer linked channels in gateway summary to avoid false "not linked" status (#57018). Thanks @hydro13.
+- macOS/tests: fix gateway summary lookup after guard unwrap; prevent browser opens during tests. (ECID-1483).
+
diff --git a/CHANGELOG/2026.1.23-1.md b/CHANGELOG/2026.1.23-1.md
new file mode 100644
index 0000000000000000000000000000000000000000..cd761782d37939f6279cf1e5703838c90fb52489
--- /dev/null
+++ b/CHANGELOG/2026.1.23-1.md
@@ -0,0 +1,6 @@
+## 2026.1.23-1
+
+### Fixes
+
+- Packaging: include dist/tts output in npm tarball (fixes missing dist/tts/tts.js).
+
diff --git a/CHANGELOG/2026.1.23.md b/CHANGELOG/2026.1.23.md
new file mode 100644
index 0000000000000000000000000000000000000000..1577d1f8d6dd7ce8148afeac2eab267adbb1def2
--- /dev/null
+++ b/CHANGELOG/2026.1.23.md
@@ -0,0 +1,62 @@
+## 2026.1.23
+
+### Highlights
+
+- TTS: move Telegram TTS into core + enable model-driven TTS tags by default for expressive audio replies. (#1559) Thanks @Glucksberg. https://docs.openclaw.ai/tts
+- Gateway: add `/tools/invoke` HTTP endpoint for direct tool calls (auth + tool policy enforced). (#1575) Thanks @vignesh07. https://docs.openclaw.ai/gateway/tools-invoke-http-api
+- Heartbeat: per-channel visibility controls (OK/alerts/indicator). (#1452) Thanks @dlauer. https://docs.openclaw.ai/gateway/heartbeat
+- Deploy: add Fly.io deployment support + guide. (#1570) https://docs.openclaw.ai/platforms/fly.
+- Channels: add Tlon/Urbit channel plugin (DMs, group mentions, thread replies). (#1544) Thanks @wca4a. https://docs.openclaw.ai/channels/tlon
+
+### Changes
+
+- Channels: allow per-group tool allow/deny policies across built-in + plugin channels. (#1546) Thanks @adam91holt. https://docs.openclaw.ai/multi-agent-sandbox-tools
+- Agents: add Bedrock auto-discovery defaults + config overrides. (#1553) Thanks @fal3. https://docs.openclaw.ai/bedrock
+- CLI: add `openclaw system` for system events + heartbeat controls; remove standalone `wake`. (commit 71203829d) https://docs.openclaw.ai/cli/system.
+- CLI: add live auth probes to `openclaw models status` for per-profile verification. (commit 40181afde) https://docs.openclaw.ai/cli/models.
+- CLI: restart the gateway by default after `openclaw update`; add `--no-restart` to skip it. (commit 2c85b1b40).
+- Browser: add node-host proxy auto-routing for remote gateways (configurable per gateway/node). (commit c3cb26f7c).
+- Plugins: add optional `llm-task` JSON-only tool for workflows. (#1498) Thanks @vignesh07. https://docs.openclaw.ai/tools/llm-task
+- Markdown: add per-channel table conversion (bullets for Signal/WhatsApp, code blocks elsewhere). (#1495) Thanks @odysseus0.
+- Agents: keep system prompt time zone-only and move current time to `session_status` for better cache hits. (commit 66eec295b).
+- Agents: remove redundant bash tool alias from tool registration/display. (#1571) Thanks @Takhoffman.
+- Docs: add cron vs heartbeat decision guide (with Lobster workflow notes). (#1533) Thanks @JustYannicc. https://docs.openclaw.ai/automation/cron-vs-heartbeat
+- Docs: clarify HEARTBEAT.md empty file skips heartbeats, missing file still runs. (#1535) Thanks @JustYannicc. https://docs.openclaw.ai/gateway/heartbeat
+
+### Fixes
+
+- Sessions: accept non-UUID sessionIds for history/send/status while preserving agent scoping. (#1518).
+- Heartbeat: accept plugin channel ids for heartbeat target validation + UI hints.
+- Messaging/Sessions: mirror outbound sends into target session keys (threads + dmScope), create session entries on send, and normalize session key casing. (#1520, commit 4b6cdd1d3).
+- Sessions: reject array-backed session stores to prevent silent wipes. (#1469).
+- Gateway: compare Linux process start time to avoid PID recycling lock loops; keep locks unless stale. (#1572).
+- Gateway: accept null optional fields in exec approval requests. (#1511) Thanks @pvoo.
+- Exec approvals: persist allowlist entry ids to keep macOS allowlist rows stable. (#1521) Thanks @ngutman.
+- Exec: honor tools.exec ask/security defaults for elevated approvals (avoid unwanted prompts). (commit 5662a9cdf).
+- Daemon: use platform PATH delimiters when building minimal service paths. (commit a4e57d3ac).
+- Linux: include env-configured user bin roots in systemd PATH and align PATH audits. (#1512) Thanks @robbyczgw-cla.
+- Tailscale: retry serve/funnel with sudo only for permission errors and keep original failure details. (#1551) Thanks @sweepies.
+- Docker: update gateway command in docker-compose and Hetzner guide. (#1514).
+- Agents: show tool error fallback when the last assistant turn only invoked tools (prevents silent stops). (commit 8ea8801d0).
+- Agents: ignore IDENTITY.md template placeholders when parsing identity. (#1556).
+- Agents: drop orphaned OpenAI Responses reasoning blocks on model switches. (#1562) Thanks @roshanasingh4.
+- Agents: add CLI log hint to "agent failed before reply" messages. (#1550) Thanks @sweepies.
+- Agents: warn and ignore tool allowlists that only reference unknown or unloaded plugin tools. (#1566).
+- Agents: treat plugin-only tool allowlists as opt-ins; keep core tools enabled. (#1467).
+- Agents: honor enqueue overrides for embedded runs to avoid queue deadlocks in tests. (#45459) Thanks @LyttonFeng and @vincentkoc.
+- Slack: honor open groupPolicy for unlisted channels in message + slash gating. (#1563) Thanks @itsjaydesu.
+- Discord: limit autoThread mention bypass to bot-owned threads; keep ack reactions mention-gated. (#1511) Thanks @pvoo.
+- Discord: retry rate-limited allowlist resolution + command deploy to avoid gateway crashes. (commit f70ac0c7c).
+- Mentions: ignore mentionPattern matches when another explicit mention is present in group chats (Slack/Discord/Telegram/WhatsApp). (commit d905ca0e0).
+- Telegram: render markdown in media captions. (#1478).
+- MS Teams: remove `.default` suffix from Graph scopes and Bot Framework probe scopes. (#1507, #1574) Thanks @Evizero.
+- Browser: keep extension relay tabs controllable when the extension reuses a session id after switching tabs. (#1160).
+- Voice wake: auto-save wake words on blur/submit across iOS/Android and align limits with macOS. (commit 69f645c66).
+- UI: keep the Control UI sidebar visible while scrolling long pages. (#1515) Thanks @pookNast.
+- UI: cache Control UI markdown rendering + memoize chat text extraction to reduce Safari typing jank. (commit d57cb2e1a).
+- TUI: forward unknown slash commands, include Gateway commands in autocomplete, and render slash replies as system output. (commit 1af227b61, commit 8195497ce, commit 6fba598ea).
+- CLI: auth probe output polish (table output, inline errors, reduced noise, and wrap fixes in `openclaw models status`). (commit da3f2b489, commit 00ae21bed, commit 31e59cd58, commit f7dc27f2d, commit 438e782f8, commit 886752217, commit aabe0bed3, commit 81535d512, commit c63144ab1).
+- Media: only parse `MEDIA:` tags when they start the line to avoid stripping prose mentions. (#1206).
+- Media: preserve PNG alpha when possible; fall back to JPEG when still over size cap. (#1491) Thanks @robbyczgw-cla.
+- Skills: gate bird Homebrew install to macOS. (#1569) Thanks @bradleypriest.
+
diff --git a/CHANGELOG/2026.1.24.md b/CHANGELOG/2026.1.24.md
new file mode 100644
index 0000000000000000000000000000000000000000..08838fde45b30d5fa4902e7b764248be86ed18c3
--- /dev/null
+++ b/CHANGELOG/2026.1.24.md
@@ -0,0 +1,71 @@
+## 2026.1.24
+
+### Highlights
+
+- Providers: Ollama discovery + docs; Venice guide upgrades + cross-links. (#1606) Thanks @abhaymundhara. https://docs.openclaw.ai/providers/ollama https://docs.openclaw.ai/providers/venice
+- Channels: LINE plugin (Messaging API) with rich replies + quick replies. (#1630) Thanks @plum-dawg.
+- TTS: Edge fallback (keyless) + `/tts` auto modes. (#1668, #1667) Thanks @sebslight. https://docs.openclaw.ai/tts
+- Exec approvals: approve in-chat via `/approve` across all channels (including plugins). (#1621) Thanks @czekaj. https://docs.openclaw.ai/tools/exec-approvals https://docs.openclaw.ai/tools/slash-commands
+- Telegram: DM topics as separate sessions + outbound link preview toggle. (#1597, #1700) Thanks @rohannagpal, @zerone0x. https://docs.openclaw.ai/channels/telegram
+
+### Changes
+
+- Channels: add LINE plugin (Messaging API) with rich replies, quick replies, and plugin HTTP registry. (#1630) Thanks @plum-dawg.
+- TTS: add Edge TTS provider fallback, defaulting to keyless Edge with MP3 retry on format failures. (#1668) https://docs.openclaw.ai/tts.
+- TTS: add auto mode enum (off/always/inbound/tagged) with per-session `/tts` override. (#1667) Thanks @sebslight. https://docs.openclaw.ai/tts
+- Telegram: treat DM topics as separate sessions and keep DM history limits stable with thread suffixes. (#1597) Thanks @rohannagpal.
+- Telegram: add `channels.telegram.linkPreview` to toggle outbound link previews. (#1700) Thanks @zerone0x. https://docs.openclaw.ai/channels/telegram
+- Web search: add Brave freshness filter parameter for time-scoped results. (#1688) Thanks @JonUleis. https://docs.openclaw.ai/tools/web
+- UI: refresh Control UI dashboard design system (colors, icons, typography). (#1745, #1786) Thanks @EnzeD, @mousberg.
+- Exec approvals: forward approval prompts to chat with `/approve` for all channels (including plugins). (#1621) Thanks @czekaj. https://docs.openclaw.ai/tools/exec-approvals https://docs.openclaw.ai/tools/slash-commands
+- Gateway: expose config.patch in the gateway tool with safe partial updates + restart sentinel. (#1653).
+- Diagnostics: add diagnostic flags for targeted debug logs (config + env override). https://docs.openclaw.ai/diagnostics/flags.
+- Docs: expand FAQ (migration, scheduling, concurrency, model recommendations, OpenAI subscription auth, Pi sizing, hackable install, docs SSL workaround).
+- Docs: add verbose installer troubleshooting guidance.
+- Docs: add macOS VM guide with local/hosted options + VPS/nodes guidance. (#1693) Thanks @f-trycua.
+- Docs: add Bedrock EC2 instance role setup + IAM steps. (#1625) Thanks @sergical. https://docs.openclaw.ai/bedrock
+- Docs: update Fly.io guide notes.
+- Dev: add prek pre-commit hooks + dependabot config for weekly updates. (#1720) Thanks @dguido.
+
+### Fixes
+
+- Web UI: fix config/debug layout overflow, scrolling, and code block sizing. (#1715) Thanks @saipreetham589.
+- Web UI: show Stop button during active runs, swap back to New session when idle. (#1664) Thanks @ndbroadbent.
+- Web UI: clear stale disconnect banners on reconnect; allow form saves with unsupported schema paths but block missing schema. (#1707).
+- Web UI: hide internal `message_id` hints in chat bubbles.
+- Gateway: allow Control UI token-only auth to skip device pairing even when device identity is present (`gateway.controlUi.allowInsecureAuth`). (#1679).
+- Matrix: decrypt E2EE media attachments with preflight size guard. (#1744) Thanks @araa47.
+- BlueBubbles: route phone-number targets to DMs, avoid leaking routing IDs, and auto-create missing DMs (Private API required). (#1751) Thanks @tyler6204. https://docs.openclaw.ai/channels/bluebubbles
+- BlueBubbles: keep part-index GUIDs in reply tags when short IDs are missing.
+- iMessage: normalize chat_id/chat_guid/chat_identifier prefixes case-insensitively and keep service-prefixed handles stable. (#1708) Thanks @aaronn.
+- Signal: repair reaction sends (group/UUID targets + CLI author flags). (#1651) Thanks @vilkasdev.
+- Signal: add configurable signal-cli startup timeout + external daemon mode docs. (#1677) https://docs.openclaw.ai/channels/signal.
+- Telegram: set fetch duplex="half" for uploads on Node 22 to avoid sendPhoto failures. (#1684) Thanks @commdata2338.
+- Telegram: use wrapped fetch for long-polling on Node to normalize AbortSignal handling. (#1639).
+- Telegram: honor per-account proxy for outbound API calls. (#1774) Thanks @radek-paclt.
+- Telegram: fall back to text when voice notes are blocked by privacy settings. (#1725) Thanks @foeken.
+- Voice Call: return stream TwiML for outbound conversation calls on initial Twilio webhook. (#1634).
+- Voice Call: serialize Twilio TTS playback and cancel on barge-in to prevent overlap. (#1713) Thanks @dguido.
+- Google Chat: tighten email allowlist matching, typing cleanup, media caps, and onboarding/docs/tests. (#1635) Thanks @iHildy.
+- Google Chat: normalize space targets without double `spaces/` prefix.
+- Agents: auto-compact on context overflow prompt errors before failing. (#1627) Thanks @rodrigouroz.
+- Agents: use the active auth profile for auto-compaction recovery.
+- Media understanding: skip image understanding when the primary model already supports vision. (#1747) Thanks @tyler6204.
+- Models: default missing custom provider fields so minimal configs are accepted.
+- Messaging: keep newline chunking safe for fenced markdown blocks across channels.
+- Messaging: treat newline chunking as paragraph-aware (blank-line splits) to keep lists and headings together. (#1726) Thanks @tyler6204.
+- TUI: reload history after gateway reconnect to restore session state. (#1663).
+- Heartbeat: normalize target identifiers for consistent routing.
+- Exec: keep approvals for elevated ask unless full mode. (#1616) Thanks @ivancasco.
+- Exec: treat Windows platform labels as Windows for node shell selection. (#1760) Thanks @ymat19.
+- Gateway: include inline config env vars in service install environments. (#1735) Thanks @Seredeep.
+- Gateway: skip Tailscale DNS probing when tailscale.mode is off. (#1671).
+- Gateway: reduce log noise for late invokes + remote node probes; debounce skills refresh. (#1607) Thanks @petter-b.
+- Gateway: clarify Control UI/WebChat auth error hints for missing tokens. (#1690).
+- Gateway: listen on IPv6 loopback when bound to 127.0.0.1 so localhost webhooks work.
+- Gateway: store lock files in the temp directory to avoid stale locks on persistent volumes. (#1676).
+- macOS: default direct-transport `ws://` URLs to port 18789; document `gateway.remote.transport`. (#1603) Thanks @ngutman.
+- Tests: cap Vitest workers on CI macOS to reduce timeouts. (#1597) Thanks @rohannagpal.
+- Tests: avoid fake-timer dependency in embedded runner stream mock to reduce CI flakes. (#1597) Thanks @rohannagpal.
+- Tests: increase embedded runner ordering test timeout to reduce CI flakes. (#1597) Thanks @rohannagpal.
+
diff --git a/CHANGELOG/2026.1.30.md b/CHANGELOG/2026.1.30.md
new file mode 100644
index 0000000000000000000000000000000000000000..b76f0731c15acffb951baf5e7e46a6dfbc34e990
--- /dev/null
+++ b/CHANGELOG/2026.1.30.md
@@ -0,0 +1,36 @@
+## 2026.1.30
+
+### Changes
+
+- CLI: add `completion` command (Zsh/Bash/PowerShell/Fish) and auto-setup during postinstall/onboarding.
+- CLI: add per-agent `models status` (`--agent` filter). (#4780) Thanks @jlowin.
+- Agents: add Kimi K2.5 to the synthetic model catalog. (#4407) Thanks @manikv12.
+- Auth: switch Kimi Coding to built-in provider; normalize OAuth profile email.
+- Auth: add MiniMax OAuth plugin + onboarding option. (#4521) Thanks @Maosghoul.
+- Agents: update pi SDK/API usage and dependencies.
+- Web UI: refresh sessions after chat commands and improve session display names.
+- Build: move TypeScript builds to `tsdown` + `tsgo` (faster builds, CI typechecks), update tsconfig target, and clean up lint rules.
+- Build: align npm tar override and bin metadata so the `openclaw` CLI entrypoint is preserved in npm publishes.
+- Docs: add pi/pi-dev docs and update OpenClaw branding + install links.
+- Docker E2E: stabilize gateway readiness, plugin installs/manifests, and cleanup/doctor switch entrypoint checks.
+
+### Fixes
+
+- Security: restrict local path extraction in media parser to prevent LFI. (#4880).
+- Gateway: prevent token defaults from becoming the literal "undefined". (#4873) Thanks @Hisleren.
+- Control UI: fix assets resolution for npm global installs. (#4909) Thanks @YuriNachos.
+- macOS: avoid stderr pipe backpressure in gateway discovery. (#3304) Thanks @abhijeet117.
+- Telegram: normalize account token lookup for non-normalized IDs. (#5055) Thanks @jasonsschin.
+- Telegram: preserve delivery thread fallback and fix threadId handling in delivery context.
+- Telegram: fix HTML nesting for overlapping styles/links. (#4578) Thanks @ThanhNguyxn.
+- Telegram: accept numeric messageId/chatId in react actions. (#4533) Thanks @Ayush10.
+- Telegram: honor per-account proxy dispatcher via undici fetch. (#4456) Thanks @spiceoogway.
+- Telegram: scope skill commands to bound agent per bot. (#4360) Thanks @robhparker.
+- BlueBubbles: debounce by messageId to preserve attachments in text+image messages. (#4984).
+- Routing: prefer requesterOrigin over stale session entries for sub-agent announce delivery. (#4957).
+- Extensions: restore embedded extension discovery typings.
+- CLI: fix `tui:dev` port resolution.
+- LINE: fix status command TypeError. (#4651).
+- OAuth: skip expired-token warnings when refresh tokens are still valid. (#4593).
+- Build: skip redundant UI install step in Dockerfile. (#4584) Thanks @obviyus.
+
diff --git a/CHANGELOG/2026.1.5.md b/CHANGELOG/2026.1.5.md
new file mode 100644
index 0000000000000000000000000000000000000000..eb2b9bdff35038158bfde9b69b565e7b8833d1be
--- /dev/null
+++ b/CHANGELOG/2026.1.5.md
@@ -0,0 +1,34 @@
+## 2026.1.5
+
+### Highlights
+
+- Models: add image-specific model config (`agent.imageModel` + fallbacks) and scan support.
+- Agent tools: new `image` tool routed to the image model (when configured).
+- Config: default model shorthands (`opus`, `sonnet`, `gpt`, `gpt-mini`, `gemini`, `gemini-flash`).
+- Docs: document built-in model shorthands + precedence (user config wins).
+- Bun: optional local install/build workflow without maintaining a Bun lockfile (see `docs/bun.md`).
+
+### Fixes
+
+- Control UI: render Markdown in tool result cards.
+- Control UI: prevent overlapping action buttons in Discord guild rules on narrow layouts.
+- Android: tapping the foreground service notification brings the app to the front. (#179) - thanks @Syhids
+- Cron tool uses `id` for update/remove/run/runs (aligns with gateway params). (#180) - thanks @adamgall
+- Control UI: chat view uses page scroll with sticky header/sidebar and fixed composer (no inner scroll frame).
+- macOS: treat location permission as always-only to avoid iOS-only enums. (#165) - thanks @Nachx639
+- macOS: make generated gateway protocol models `Sendable` for Swift 6 strict concurrency. (#195) - thanks @andranik-sahakyan
+- macOS: bundle QR code renderer modules so DMG gateway boot doesn't crash on missing qrcode-terminal vendor files.
+- macOS: parse JSON5 config safely to avoid wiping user settings when comments are present.
+- WhatsApp: suppress typing indicator during heartbeat background tasks. (#190) - thanks @mcinteerj
+- WhatsApp: mark offline history sync messages as read without auto-reply. (#193) - thanks @mcinteerj
+- Discord: avoid duplicate replies when a provider emits late streaming `text_end` events (OpenAI/GPT).
+- CLI: use tailnet IP for local gateway calls when bind is tailnet/auto (fixes #176).
+- Env: load global `$OPENCLAW_STATE_DIR/.env` (`~/.openclaw/.env`) as a fallback after CWD `.env`.
+- Env: optional login-shell env fallback (opt-in; imports expected keys without overriding existing env).
+- Agent tools: OpenAI-compatible tool JSON Schemas (fix `browser`, normalize union schemas).
+- Onboarding: when running from source, auto-build missing Control UI assets (`bun run ui:build`).
+- Discord/Slack: route reaction + system notifications to the correct session (no main-session bleed).
+- Agent tools: honor `agent.tools` allow/deny policy even when sandbox is off.
+- Discord: avoid duplicate replies when OpenAI emits repeated `message_end` events.
+- Commands: unify /status (inline) and command auth across providers; group bypass for authorized control commands; remove Discord /clawd slash handler.
+- CLI: run `openclaw agent` via the Gateway by default; use `--local` to force embedded mode. Thanks @vignesh07.
diff --git a/CHANGELOG/2026.1.8.md b/CHANGELOG/2026.1.8.md
new file mode 100644
index 0000000000000000000000000000000000000000..ff0451630d28188e4a64c0367d3a02b9b82afef9
--- /dev/null
+++ b/CHANGELOG/2026.1.8.md
@@ -0,0 +1,43 @@
+## 2026.1.8
+
+### Highlights
+
+- Security: DMs locked down by default across providers; pairing-first + allowlist guidance.
+- Sandbox: per-agent scope defaults + workspace access controls; tool/session isolation tuned.
+- Agent loop: compaction, pruning, streaming, and error handling hardened.
+- Providers: Telegram/WhatsApp/Discord/Slack reliability, threading, reactions, media, and retries improved.
+- Control UI: logs tab, streaming stability, focus mode, and large-output rendering fixes.
+- CLI/Gateway/Doctor: daemon/logs/status, auth migration, and diagnostics significantly expanded.
+
+### Fixes
+
+- **CLI/Gateway/Doctor:** daemon runtime selection + improved logs/status/health/errors; auth/password handling for local CLI; richer close/timeout details; auto-migrate legacy config/sessions/state; integrity checks + repair prompts; `--yes`/`--non-interactive`; `--deep` gateway scans; better restart/service hints.
+- **Agent loop + compaction:** compaction/pruning tuning, overflow handling, safer bootstrap context, and per-provider threading/confirmations; opt-in tool-result pruning + compact tracking.
+- **Sandbox + tools:** per-agent sandbox overrides, workspaceAccess controls, session tool visibility, tool policy overrides, process isolation, and tool schema/timeout/reaction unification.
+- **Providers (Telegram/WhatsApp/Discord/Slack/Signal/iMessage):** retry/backoff, threading, reactions, media groups/attachments, mention gating, typing behavior, and error/log stability; long polling + forum topic isolation for Telegram.
+- **Gateway/CLI UX:** `openclaw logs`, cron list colors/aliases, docs search, agents list/add/delete flows, status usage snapshots, runtime/auth source display, and `/status`/commands auth unification.
+- **Control UI/Web:** logs tab, focus mode polish, config form resilience, streaming stability, tool output caps, windowed chat history, and reconnect/password URL auth.
+- **macOS/Android/TUI/Build:** macOS gateway races, QR bundling, JSON5 config safety, Voice Wake hardening; Android EXIF rotation + APK naming/versioning; TUI key handling; tooling/bundling fixes.
+- **Packaging/compat:** npm dist folder coverage, Node 25 qrcode-terminal import fixes, Bun/Playwright/WebSocket patches, and Docker Bun install.
+- **Docs:** new FAQ/ClawHub/config examples/showcase entries and clarified auth, sandbox, and systemd docs.
+
+### Breaking
+
+- **SECURITY (update ASAP):** inbound DMs are now **locked down by default** on Telegram/WhatsApp/Signal/iMessage/Discord/Slack.
+  - Previously, if you didn't configure an allowlist, your bot could be **open to anyone** (especially discoverable Telegram bots).
+  - New default: DM pairing (`dmPolicy="pairing"` / `discord.dm.policy="pairing"` / `slack.dm.policy="pairing"`).
+  - To keep old "open to everyone" behavior: set `dmPolicy="open"` and include `"*"` in the relevant `allowFrom` (Discord/Slack: `discord.dm.allowFrom` / `slack.dm.allowFrom`).
+  - Approve requests via `openclaw pairing list <provider>` + `openclaw pairing approve <provider> <code>`.
+- Sandbox: default `agent.sandbox.scope` to `"agent"` (one container/workspace per agent). Use `"session"` for per-session isolation; `"shared"` disables cross-session isolation.
+- Timestamps in agent envelopes are now UTC (compact `YYYY-MM-DDTHH:mmZ`); removed `messages.timestampPrefix`. Add `agent.userTimezone` to tell the model the user's local time (system prompt only) (#57018). Thanks @hydro13.
+- Model config schema changes (auth profiles + model lists); doctor auto-migrates and the gateway rewrites legacy configs on startup.
+- Commands: gate all slash commands to authorized senders; add `/compact` to manually compact session context.
+- Groups: `whatsapp.groups`, `telegram.groups`, and `imessage.groups` now act as allowlists when set. Add `"*"` to keep allow-all behavior.
+- Auto-reply: removed `autoReply` from Discord/Slack/Telegram channel configs; use `requireMention` instead (Telegram topics now support `requireMention` overrides).
+- CLI: remove `update`, `gateway-daemon`, `gateway {install|uninstall|start|stop|restart|daemon status|wake|send|agent}`, and `telegram` commands; move `login/logout` to `providers login/logout` (top-level aliases hidden); use `daemon` for service control, `send`/`agent`/`wake` for RPC, and `nodes canvas` for canvas ops.
+
+### Maintenance
+
+- Skills additions (Himalaya email, CodexBar, 1Password).
+- Dependency refreshes (pi-\* stack, Slack SDK, discord-api-types, file-type, zod, Biome, Vite). Thanks @cpojer.
+
diff --git a/CHANGELOG/2026.2.1.md b/CHANGELOG/2026.2.1.md
new file mode 100644
index 0000000000000000000000000000000000000000..09581c6d50ec342084a7a3dd8d7d8bfef815f9d8
--- /dev/null
+++ b/CHANGELOG/2026.2.1.md
@@ -0,0 +1,59 @@
+## 2026.2.1
+
+### Changes
+
+- Docs: onboarding/install/i18n/exec-approvals/Control UI/exe.dev/cacheRetention updates + misc nav/typos. (#3050, #3461, #4064, #4675, #4729, #4763, #5003, #5402, #5446, #5474, #5663, #5689, #5694, #5967, #6270, #6300, #6311, #6416, #6487, #6550, #6789).
+- Telegram: use shared pairing store. (#6127) Thanks @obviyus.
+- Agents: add OpenRouter app attribution headers. Thanks @alexanderatallah.
+- Agents: add system prompt safety guardrails. (#5445) Thanks @joshp123.
+- Agents: update pi-ai to 0.50.9 and rename cacheControlTtl -> cacheRetention (with back-compat mapping).
+- Agents: extend CreateAgentSessionOptions with systemPrompt/skills/contextFiles.
+- Agents: add tool policy conformance snapshot (no runtime behavior change). (#6011)
+- Auth: update MiniMax OAuth hint + portal auth note copy.
+- Discord: inherit thread parent bindings for routing. (#3892) Thanks @aerolalit.
+- Gateway: inject timestamps into agent and chat.send messages. (#3705) Thanks @conroywhitney, @CashWilliams.
+- Gateway: require TLS 1.3 minimum for TLS listeners. (#5970) Thanks @loganaden.
+- Web UI: refine chat layout + extend session active duration.
+- CI: add formal conformance + alias consistency checks. (#5723, #5807)
+
+### Fixes
+
+- Security: guard remote media fetches with SSRF protections (block private/localhost, DNS pinning).
+- Updates: clean stale global install rename dirs and extend gateway update timeouts to avoid npm ENOTEMPTY failures.
+- Security/Plugins/Hooks: validate install paths and reject traversal-like names (prevents path traversal outside the state dir). Thanks @logicx24.
+- Telegram: add download timeouts for file fetches. (#6914) Thanks @hclsys.
+- Telegram: enforce thread specs for DM vs forum sends. (#6833) Thanks @obviyus.
+- Streaming: flush block streaming on paragraph boundaries for newline chunking. (#7014)
+- Streaming: stabilize partial streaming filters.
+- Auto-reply: avoid referencing workspace files in /new greeting prompt. (#5706) Thanks @bravostation.
+- Tools: align tool execute adapters/signatures (legacy + parameter order + arg normalization).
+- Tools: treat "\*" tool allowlist entries as valid to avoid spurious unknown-entry warnings. Thanks @shakkernerd.
+- Skills: update session-logs paths from .clawdbot to .openclaw. (#4502)
+- Slack: harden media fetch limits and Slack file URL validation. (#6639) Thanks @davidiach.
+- Lint: satisfy curly rule after import sorting. (#6310)
+- Process: resolve Windows `spawn()` failures for npm-family CLIs by appending `.cmd` when needed. (#5815) Thanks @thejhinvirtuoso.
+- Discord: resolve PluralKit proxied senders for allowlists and labels. (#5838) Thanks @thewilloftheshadow.
+- Tlon: add timeout to SSE client fetch calls (CWE-400). (#5926)
+- Memory search: L2-normalize local embedding vectors to fix semantic search. (#5332)
+- Agents: align embedded runner + typings with pi-coding-agent API updates (pi 0.51.0).
+- Agents: ensure OpenRouter attribution headers apply in the embedded runner.
+- Agents: cap context window resolution for compaction safeguard. (#6187) Thanks @iamEvanYT.
+- System prompt: resolve overrides and hint using session_status for current date/time. (#1897, #1928, #2108, #3677)
+- Agents: fix Pi prompt template argument syntax. (#6543)
+- Subagents: fix announce failover race (always emit lifecycle end; timeout=0 means no-timeout). (#6621)
+- Teams: gate media auth retries.
+- Telegram: restore draft streaming partials. (#5543) Thanks @obviyus.
+- Onboarding: friendlier Windows onboarding message. (#6242) Thanks @shanselman.
+- TUI: prevent crash when searching with digits in the model selector.
+- Agents: wire before_tool_call plugin hook into tool execution. (#6570, #6660) Thanks @ryancnelson.
+- Browser: secure Chrome extension relay CDP sessions.
+- Docker: use container port for gateway command instead of host port. (#5110) Thanks @mise42.
+- Docker: start gateway CMD by default for container deployments. (#6635) Thanks @kaizen403.
+- fix(lobster): block arbitrary exec via lobsterPath/cwd injection (GHSA-4mhr-g7xj-cg8j). (#5335) Thanks @vignesh07.
+- Security: sanitize WhatsApp accountId to prevent path traversal. (#4610)
+- Security: restrict MEDIA path extraction to prevent LFI. (#4930)
+- Security: validate message-tool filePath/path against sandbox root. (#6398)
+- Security: block LD*/DYLD* env overrides for host exec. (#4896) Thanks @HassanFleyah.
+- Security: harden web tool content wrapping + file parsing safeguards. (#4058) Thanks @VACInc.
+- Security: enforce Twitch `allowFrom` allowlist gating (deny non-allowlisted senders). Thanks @MegaManSec.
+
diff --git a/CHANGELOG/2026.2.19.md b/CHANGELOG/2026.2.19.md
new file mode 100644
index 0000000000000000000000000000000000000000..2cb41b66de985ffbb26320b60824b68c14fbbed8
--- /dev/null
+++ b/CHANGELOG/2026.2.19.md
@@ -0,0 +1,95 @@
+## 2026.2.19
+
+### Changes
+
+- iOS/Watch: add an Apple Watch companion MVP with watch inbox UI, watch notification relay handling, and gateway command surfaces for watch status/send flows. (#20054) Thanks @mbelinky.
+- iOS/Gateway: wake disconnected iOS nodes via APNs before `nodes.invoke` and auto-reconnect gateway sessions on silent push wake to reduce invoke failures while the app is backgrounded. (#20332) Thanks @mbelinky.
+- Gateway/CLI: add paired-device hygiene flows with `device.pair.remove`, plus `openclaw devices remove` and guarded `openclaw devices clear --yes [--pending]` commands for removing paired entries and optionally rejecting pending requests. (#20057) Thanks @mbelinky.
+- Mattermost: add opt-in native slash command support with registration lifecycle, callback route/token validation, multi-account token routing, and callback URL/path configuration (`channels.mattermost.commands.*`). (#16515) Thanks @echo931.
+- Mattermost: harden native slash callback auth-bypass behavior for configurable callback paths, add callback validation coverage, and clarify callback reachability/allowlist docs. (#32467) Thanks @mukhtharcm and @echo931.
+- iOS/APNs: add push registration and notification-signing configuration for node delivery. (#20308) Thanks @mbelinky.
+- Gateway/APNs: add a push-test pipeline for APNs delivery validation in gateway flows. (#20307) Thanks @mbelinky.
+- Security/Audit: add `gateway.http.no_auth` findings when `gateway.auth.mode="none"` leaves Gateway HTTP APIs reachable, with loopback warning and remote-exposure critical severity, plus regression coverage and docs updates.
+- Skills: harden coding-agent skill guidance by removing shell-command examples that interpolate untrusted issue text directly into command strings.
+- Dev tooling: align `oxfmt` local/CI formatting behavior. (#12579) Thanks @vincentkoc.
+
+### Fixes
+
+- Security: strip hidden text from `web_fetch` extracted content to prevent indirect prompt injection, covering CSS-hidden elements, class-based hiding (sr-only, d-none, etc.), invisible Unicode, color:transparent, offscreen transforms, and non-content tags. (#8027, #21074) Thanks @hydro13 for the fix and @LucasAIBuilder for reporting.
+- Agents/Streaming: keep assistant partial streaming active during reasoning streams, handle native `thinking_*` stream events consistently, dedupe mixed reasoning-end signals, and clear stale mutating tool errors after same-target retry success. (#20635) Thanks @obviyus.
+- iOS/Chat: use a dedicated iOS chat session key for ChatSheet routing to avoid cross-client session collisions with main-session traffic. (#21139) thanks @mbelinky.
+- iOS/Chat: auto-resync chat history after reconnect sequence gaps, clear stale pending runs, and avoid dead-end manual refresh errors after transient disconnects. (#21135) thanks @mbelinky.
+- UI/Usage: reload usage data immediately when timezone changes so Local/UTC toggles apply the selected date range without requiring a manual refresh. (#17774) Thanks @huntharo.
+- iOS/Screen: move `WKWebView` lifecycle ownership into `ScreenWebView` coordinator and explicit attach/detach flow to reduce gesture/lifecycle crash risk (`__NSArrayM insertObject:atIndex:` paths) during screen tab updates. (#20366) Thanks @ngutman.
+- iOS/Onboarding: prevent pairing-status flicker during auto-resume by keeping resumed state transitions stable. (#20310) Thanks @mbelinky.
+- iOS/Onboarding: stabilize pairing and reconnect behavior by resetting stale pairing request state on manual retry, disconnecting both operator and node gateways on operator failure, and avoiding duplicate pairing loops from operator transport identity attachment. (#20056) Thanks @mbelinky.
+- iOS/Signing: restore local auto-selected signing-team overrides during iOS project generation by wiring `.local-signing.xcconfig` into the active signing config and emitting `OPENCLAW_DEVELOPMENT_TEAM` in local signing setup. (#19993) Thanks @ngutman.
+- Telegram: unify message-like inbound handling so `message` and `channel_post` share the same dedupe/access/media pipeline and remain behaviorally consistent. (#20591) Thanks @obviyus.
+- Telegram: keep media-group processing resilient by skipping recoverable per-item download failures while still failing loud on non-recoverable media errors. (#20598) thanks @mcaxtr.
+- Telegram/Agents: gate exec/bash tool-failure warnings behind verbose mode so default Telegram replies stay clean while verbose sessions still surface diagnostics. (#20560) Thanks @obviyus.
+- Telegram/Cron/Heartbeat: honor explicit Telegram topic targets in cron and heartbeat delivery (`<chatId>:topic:<threadId>`) so scheduled sends land in the configured topic instead of the last active thread. (#19367) Thanks @Lukavyi.
+- Telegram/DM routing: prevent DM inbound origin metadata from leaking into main-session `lastRoute` updates and normalize DM `lastRoute.to` to provider-prefixed `telegram:<chatId>`. (#19491) thanks @guirguispierre.
+- Gateway/Daemon: forward `TMPDIR` into installed service environments so macOS LaunchAgent gateway runs can open SQLite temp/journal files reliably instead of failing with `SQLITE_CANTOPEN`. (#20512) Thanks @Clawborn.
+- Agents/Billing: include the active model that produced a billing error in user-facing billing messages (for example, `OpenAI (gpt-5.3)`) across payload, failover, and lifecycle error paths, so users can identify exactly which key needs credits. (#20510) Thanks @echoVic.
+- Gateway/TUI: honor `agents.defaults.blockStreamingDefault` for `chat.send` by removing the hardcoded block-streaming disable override, so replies can use configured block-mode delivery. (#19693) Thanks @neipor.
+- UI/Sessions: accept the canonical main session-key alias in Chat UI flows so main-session routing stays consistent. (#20311) Thanks @mbelinky.
+- OpenClawKit/Protocol: preserve JSON boolean literals (`true`/`false`) when bridging through `AnyCodable` so Apple client RPC params no longer re-encode booleans as `1`/`0`. Thanks @mbelinky.
+- Commands/Doctor: skip embedding-provider warnings when `memory.backend` is `qmd`, because QMD manages embeddings internally and does not require `memorySearch` providers. (#17263) Thanks @miloudbelarebia.
+- Canvas/A2UI: improve bundled-asset resolution and empty-state handling so UI fallbacks render reliably. (#20312) Thanks @mbelinky.
+- Commands/Doctor: avoid rewriting invalid configs with new `gateway.auth.token` defaults during repair and only write when real config changes are detected, preventing accidental token duplication and backup churn.
+- Gateway/Auth: default unresolved gateway auth to token mode with startup auto-generation/persistence of `gateway.auth.token`, while allowing explicit `gateway.auth.mode: "none"` for intentional open loopback setups. (#20686) thanks @gumadeiras.
+- Channels/Matrix: fix mention detection for `formatted_body` Matrix-to links by handling matrix.to mention formats consistently. (#16941) Thanks @zerone0x.
+- Heartbeat/Cron: skip interval heartbeats when `HEARTBEAT.md` is missing or empty and no tagged cron events are queued, while preserving cron-event fallback for queued tagged reminders. (#20461) thanks @vikpos.
+- Browser/Relay: reuse an already-running extension relay when the relay port is occupied by another OpenClaw process, while still failing on non-relay port collisions to avoid masking unrelated listeners. (#20035) Thanks @mbelinky.
+- Scripts: update clawdock helper command support to include `docker-compose.extra.yml` where available. (#17094) Thanks @zerone0x.
+- Lobster/Config: remove Lobster executable-path overrides (`lobsterPath`), require PATH-based execution, and add focused Windows wrapper-resolution tests to keep shell-free behavior stable.
+- Gateway/WebChat: block `sessions.patch` and `sessions.delete` for WebChat clients so session-store mutations stay restricted to non-WebChat operator flows. Thanks @allsmog for reporting.
+- Gateway: clarify launchctl GUI domain bootstrap failure on macOS. (#13795) Thanks @vincentkoc.
+- Lobster/CI: fix flaky test Windows cmd shim script resolution. (#20833) Thanks @vincentkoc.
+- Browser/Relay: require gateway-token auth on both `/extension` and `/cdp`, and align Chrome extension setup to use a single `gateway.auth.token` input for relay authentication. Thanks @tdjackey for reporting.
+- Gateway/Hooks: run BOOT.md startup checks per configured agent scope, including per-agent session-key resolution, startup-hook regression coverage, and non-success boot outcome logging for diagnosability. (#20569) thanks @mcaxtr.
+- Protocol/Apple: regenerate Swift gateway models for `push.test` so `pnpm protocol:check` stays green on main. Thanks @mbelinky.
+- Sandbox/Registry: serialize container and browser registry writes with shared file locks and atomic replacement to prevent lost updates and delete rollback races from desyncing `sandbox list`, `prune`, and `recreate --all`. Thanks @kexinoh.
+- OTEL/diagnostics-otel: complete OpenTelemetry v2 API migration. (#12897) Thanks @vincentkoc.
+- Cron/Webhooks: protect cron webhook POST delivery with SSRF-guarded outbound fetch (`fetchWithSsrFGuard`) to block private/metadata destinations before request dispatch. Thanks @Adam55A-code.
+- Security/Voice Call: harden `voice-call` telephony TTS override merging by blocking unsafe deep-merge keys (`__proto__`, `prototype`, `constructor`) and add regression coverage for top-level and nested prototype-pollution payloads.
+- Security/Windows Daemon: harden Scheduled Task `gateway.cmd` generation by quoting cmd metacharacter arguments, escaping `%`/`!` expansions, and rejecting CR/LF in arguments, descriptions, and environment assignments (`set "KEY=VALUE"`), preventing command injection in Windows daemon startup scripts. Thanks @tdjackey for reporting.
+- Security/Gateway/Canvas: replace shared-IP fallback auth with node-scoped session capability URLs for `/__openclaw__/canvas/*` and `/__openclaw__/a2ui/*`, fail closed when trusted-proxy requests omit forwarded client headers, and add IPv6/proxy-header regression coverage. Thanks @aether-ai-agent for reporting.
+- Security/Net: enforce strict dotted-decimal IPv4 literals in SSRF checks and fail closed on unsupported legacy forms (octal/hex/short/packed, for example `0177.0.0.1`, `127.1`, `2130706433`) before DNS lookup.
+- Security/Discord: enforce trusted-sender guild permission checks for moderation actions (`timeout`, `kick`, `ban`) and ignore untrusted `senderUserId` params to prevent privilege escalation in tool-driven flows. Thanks @aether-ai-agent for reporting.
+- Security/ACP+Exec: add `openclaw acp --token-file/--password-file` secret-file support (with inline secret flag warnings), redact ACP working-directory prefixes to `~` home-relative paths, constrain exec script preflight file inspection to the effective `workdir` boundary, and add security-audit warnings when `tools.exec.host="sandbox"` is configured while sandbox mode is off.
+- Security/Plugins/Hooks: enforce runtime/package path containment with realpath checks so `openclaw.extensions`, `openclaw.hooks`, and hook handler modules cannot escape their trusted roots via traversal or symlinks.
+- Security/Discord: centralize trusted sender checks for moderation actions in message-action dispatch, share moderation command parsing across handlers, and clarify permission helpers with explicit any/all semantics.
+- Security/ACP: harden ACP bridge session management with duplicate-session refresh, idle-session reaping, oldest-idle soft-cap eviction, and burst rate limiting on session creation to reduce local DoS risk without disrupting normal IDE usage.
+- Security/ACP: bound ACP prompt text payloads to 2 MiB before gateway forwarding, account for join separator bytes during pre-concatenation size checks, and avoid stale active-run session state when oversized prompts are rejected. Thanks @aether-ai-agent for reporting.
+- Security/Plugins/Hooks: add optional `--pin` for npm plugin/hook installs, persist resolved npm metadata (`name`, `version`, `spec`, integrity, shasum, timestamp), warn/confirm on integrity drift during updates, and extend `openclaw security audit` to flag unpinned specs, missing integrity metadata, and install-record version drift.
+- Security/Plugins: harden plugin discovery by blocking unsafe candidates (root escapes, world-writable paths, suspicious ownership), add startup warnings when `plugins.allow` is empty with discoverable non-bundled plugins, and warn on loaded plugins without install/load-path provenance.
+- Security/Gateway: rate-limit control-plane write RPCs (`config.apply`, `config.patch`, `update.run`) to 3 requests per minute per `deviceId+clientIp`, add restart single-flight coalescing plus a 30-second restart cooldown, and log actor/device/ip with changed-path audit details for config/update-triggered restarts.
+- Security/Webhooks: harden Feishu and Zalo webhook ingress with webhook-mode token preconditions, loopback-default Feishu bind host, JSON content-type enforcement, per-path rate limiting, replay dedupe for Zalo events, constant-time Zalo secret comparison, and anomaly status counters.
+- Security/Plugins: for the next npm release, clarify plugin trust boundary and keep `runtime.system.runCommandWithTimeout` available by default for trusted in-process plugins. Thanks @markmusson for reporting.
+- Security/Skills: for the next npm release, reject symlinks during skill packaging to prevent external file inclusion in distributed `.skill` archives. Thanks @aether-ai-agent for reporting.
+- Security/Gateway: fail startup when `hooks.token` matches `gateway.auth.token` so hooks and gateway token reuse is rejected at boot. (#20813) Thanks @coygeek.
+- Security/Network: block plaintext `ws://` connections to non-loopback hosts and require secure websocket transport elsewhere. (#20803) Thanks @jscaldwell55.
+- Security/Config: parse frontmatter YAML using the YAML 1.2 core schema to avoid implicit coercion of `on`/`off`-style values. (#20857) Thanks @davidrudduck.
+- Security/Discord: escape backticks in exec-approval embed content to prevent markdown formatting injection via command text. (#20854) Thanks @davidrudduck.
+- Security/Agents: replace shell-based `execSync` usage with `execFileSync` in command lookup helpers to eliminate shell argument interpolation risk. (#20655) Thanks @mahanandhi.
+- Security/Media: use `crypto.randomBytes()` for temp file names and set owner-only permissions for TTS temp files. (#20654) Thanks @mahanandhi.
+- Security/Gateway: set baseline security headers (`X-Content-Type-Options: nosniff`, `Referrer-Policy: no-referrer`) on gateway HTTP responses. (#10526) Thanks @abdelsfane.
+- Security/iMessage: harden remote attachment SSH/SCP handling by requiring strict host-key verification, validating `channels.imessage.remoteHost` as `host`/`user@host`, and rejecting unsafe host tokens from config or auto-detection. Thanks @allsmog for reporting.
+- Security/Feishu: prevent path traversal in Feishu inbound media temp-file writes by replacing key-derived temp filenames with UUID-based names. Thanks @allsmog for reporting.
+- Security/Feishu: escape mention regex metacharacters in `stripBotMention` so crafted mention metadata cannot trigger regex injection or ReDoS during inbound message parsing. (#20916) Thanks @orlyjamie for the fix and @allsmog for reporting.
+- LINE/Security: harden inbound media temp-file naming by using UUID-based temp paths for downloaded media instead of external message IDs. (#20792) Thanks @mbelinky.
+- Security/Media: harden local media ingestion against TOCTOU/symlink swap attacks by pinning reads to a single file descriptor with symlink rejection and inode/device verification in `saveMediaSource`. Thanks @dorjoos for reporting.
+- Security/Lobster (Windows): for the next npm release, remove shell-based fallback when launching Lobster wrappers (`.cmd`/`.bat`) and switch to explicit argv execution with wrapper entrypoint resolution, preventing command injection while preserving Windows wrapper compatibility. Thanks @allsmog for reporting.
+- Security/Exec: require `tools.exec.safeBins` binaries to resolve from trusted bin directories (system defaults plus gateway startup `PATH`) so PATH-hijacked trojan binaries cannot bypass allowlist checks. Thanks @jackhax for reporting.
+- Security/Exec: remove file-existence oracle behavior from `tools.exec.safeBins` by using deterministic argv-only stdin-safe validation and blocking file-oriented flags (for example `sort -o`, `jq -f`, `grep -f`) so allow/deny results no longer disclose host file presence. Thanks @nedlir for reporting.
+- Security/Browser: route browser URL navigation through one SSRF-guarded validation path for tab-open/CDP-target/Playwright navigation flows and block private/metadata destinations by default (configurable via `browser.ssrfPolicy`). Thanks @dorjoos for reporting.
+- Security/Exec: for the next npm release, harden safe-bin stdin-only enforcement by blocking output/recursive flags (`sort -o/--output`, grep recursion) and tightening default safe bins to remove `sort`/`grep`, preventing safe-bin allowlist bypass for file writes/recursive reads. Thanks @nedlir for reporting.
+- Security/Exec: block grep safe-bin positional operand bypass by setting grep positional budget to zero, so `-e/--regexp` cannot smuggle bare filename reads (for example `.env`) via ambiguous positionals; safe-bin grep patterns must come from `-e/--regexp`. Thanks @athuljayaram for reporting.
+- Security/Gateway/Agents: remove implicit admin scopes from agent tool gateway calls by classifying methods to least-privilege operator scopes, and enforce owner-only tooling (`cron`, `gateway`, `whatsapp_login`) through centralized tool-policy wrappers plus tool metadata to prevent non-owner DM privilege escalation. Ships in the next npm release. Thanks @Adam55A-code for reporting.
+- Security/Gateway: centralize gateway method-scope authorization and default non-CLI gateway callers to least-privilege method scopes, with explicit CLI scope handling, full core-handler scope classification coverage, and regression guards to prevent scope drift.
+- Security/Net: block SSRF bypass via NAT64 (`64:ff9b::/96`, `64:ff9b:1::/48`), 6to4 (`2002::/16`), and Teredo (`2001:0000::/32`) IPv6 transition addresses, and fail closed on IPv6 parse errors. Thanks @jackhax.
+- Security/OTEL: sanitize OTLP endpoint URL resolution. (#13791) Thanks @vincentkoc.
+- Security: patch Dependabot security issues in pnpm lock. (#20832) Thanks @vincentkoc.
+- Security: migrate request dependencies to `@cypress/request`. (#20836) Thanks @vincentkoc.
+
diff --git a/CHANGELOG/2026.2.2.md b/CHANGELOG/2026.2.2.md
new file mode 100644
index 0000000000000000000000000000000000000000..1dcec507eff8ac2bdb85f61f6bc073264aa94d1f
--- /dev/null
+++ b/CHANGELOG/2026.2.2.md
@@ -0,0 +1,39 @@
+## 2026.2.2
+
+### Changes
+
+- Feishu: add Feishu/Lark plugin support + docs. (#7313) Thanks @jiulingyun (openclaw-cn).
+- Web UI: add Agents dashboard for managing agent files, tools, skills, models, channels, and cron jobs. Thanks @gumadeiras.
+- Subagents: discourage direct messaging tool use unless a specific external recipient is requested. Thanks @tyler6204.
+- Memory: implement the opt-in QMD backend for workspace memory. (#3160) Thanks @vignesh07.
+- Security: add healthcheck skill and bootstrap audit guidance. (#7641) Thanks @Takhoffman.
+- Config: allow setting a default subagent thinking level via `agents.defaults.subagents.thinking` (and per-agent `agents.list[].subagents.thinking`). (#7372) Thanks @tyler6204.
+- Docs: zh-CN translations seed + polish, pipeline guidance, nav/landing updates, and typo fixes. (#8202, #6995, #6619, #7242, #7303, #7415) Thanks @AaronWander, @taiyi747, @Explorer1092, @rendaoyuan, @joshp123, @lailoo.
+- Docs: add zh-CN i18n guardrails to avoid editing generated translations. (#8416) Thanks @joshp123.
+
+### Fixes
+
+- Docs: finish renaming the QMD memory docs to reference the OpenClaw state dir (#8193). Thanks @obviyus.
+- Onboarding: keep TUI flow exclusive (skip completion prompt + background Web UI seed) (#8193). Thanks @obviyus.
+- Onboarding: drop completion prompt now handled by install/update (#8193). Thanks @obviyus.
+- TUI: block onboarding output while TUI is active and restore terminal state on exit (#8193). Thanks @obviyus.
+- CLI: cache shell completion scripts in state dir and source cached files in profiles (#8193). Thanks @obviyus.
+- Zsh completion: escape option descriptions to avoid invalid option errors (#8193). Thanks @obviyus.
+- Agents: repair malformed tool calls and session transcripts. (#7473) Thanks @justinhuangcode.
+- fix(agents): validate AbortSignal instances before calling AbortSignal.any() (#7277) (thanks @Elarwei001).
+- fix(webchat): respect user scroll position during streaming and refresh (#7226) (thanks @marcomarandiz).
+- Telegram: recover from grammY long-poll timed out errors. (#7466) Thanks @macmimi23.
+- Media understanding: skip binary media from file text extraction. (#7475) Thanks @AlexZhangji.
+- Security: enforce access-group gating for Slack slash commands when channel type lookup fails.
+- Security: require validated shared-secret auth before skipping device identity on gateway connect. Thanks @simecek.
+- Security: guard skill installer downloads with SSRF checks (block private/localhost URLs).
+- Security/Gateway: require `operator.approvals` for in-chat `/approve` when invoked from gateway clients. Thanks @yueyueL.
+- Security: harden Windows exec allowlist; block cmd.exe bypass via single &. Thanks @simecek.
+- Media understanding: apply SSRF guardrails to provider fetches; allow private baseUrl overrides explicitly.
+- fix(voice-call): harden inbound allowlist; reject anonymous callers; require Telnyx publicKey for allowlist; token-gate Twilio media streams; cap webhook body size (thanks @simecek)
+- Onboarding: keep TUI flow exclusive (skip completion prompt + background Web UI seed); completion prompt now handled by install/update.
+- CLI/Zsh completion: cache scripts in state dir and escape option descriptions to avoid invalid option errors.
+- fix(ui): resolve Control UI asset path correctly. Thanks @gumadeiras.
+- fix(ui): refresh agent files after external edits. Thanks @gumadeiras.
+- Tests: stub SSRF DNS pinning in web auto-reply + Gemini video coverage. (#6619) Thanks @joshp123.
+
diff --git a/CHANGELOG/2026.2.3.md b/CHANGELOG/2026.2.3.md
new file mode 100644
index 0000000000000000000000000000000000000000..1cbc5fad4c31b647ff3339780a2f68d067e7022b
--- /dev/null
+++ b/CHANGELOG/2026.2.3.md
@@ -0,0 +1,54 @@
+## 2026.2.3
+
+### Changes
+
+- Telegram: remove last `@ts-nocheck` from `bot-handlers.ts`, use Grammy types directly, deduplicate `StickerMetadata`. Zero `@ts-nocheck` remaining in `src/telegram/`. (#9206).
+- Telegram: remove `@ts-nocheck` from `bot-message.ts`, type deps via `Omit<BuildTelegramMessageContextParams>`, widen `allMedia` to `TelegramMediaRef[]`. (#9180).
+- Telegram: remove `@ts-nocheck` from `bot.ts`, fix duplicate `bot.catch` error handler (Grammy overrides), remove dead reaction `message_thread_id` routing, harden sticker cache guard. (#9077).
+- Onboarding: add Cloudflare AI Gateway provider setup and docs. (#7914) Thanks @roerohan.
+- Onboarding: add Moonshot (.cn) auth choice and keep the China base URL when preserving defaults. (#7180) Thanks @waynelwz.
+- Docs: clarify tmux send-keys for TUI by splitting text and Enter. (#7737) Thanks @Wangnov.
+- Docs: mirror the landing page revamp for zh-CN (features, quickstart, docs directory, network model, credits). (#8994) Thanks @joshp123.
+- Messages: add per-channel and per-account responsePrefix overrides across channels. (#9001) Thanks @mudrii.
+- Cron: add announce delivery mode for isolated jobs (CLI + Control UI) and delivery mode config.
+- Cron: default isolated jobs to announce delivery; accept ISO 8601 `schedule.at` in tool inputs.
+- Cron: hard-migrate isolated jobs to announce/none delivery; drop legacy post-to-main/payload delivery fields and `atMs` inputs.
+- Cron: delete one-shot jobs after success by default; add `--keep-after-run` for CLI.
+- Cron: suppress messaging tools during announce delivery so summaries post consistently.
+- Cron: avoid duplicate deliveries when isolated runs send messages directly.
+
+### Fixes
+
+- Control UI: add hardened fallback for asset resolution in global npm installs. (#4855) Thanks @anapivirtua.
+- Update: remove dead restore control-ui step that failed on gitignored dist/ output (#2402). Thanks @ramin-shirali.
+- Update: avoid wiping prebuilt Control UI assets during dev auto-builds (`tsdown --no-clean`), run update doctor via `openclaw.mjs`, and auto-restore missing UI assets after doctor. (#10146) Thanks @gumadeiras.
+- Models: add forward-compat fallback for `openai-codex/gpt-5.3-codex` when model registry hasn't discovered it yet. (#9989) Thanks @w1kke.
+- Auto-reply/Docs: normalize `extra-high` (and spaced variants) to `xhigh` for Codex thinking levels, and align Codex 5.3 FAQ examples. (#9976) Thanks @slonce70.
+- Compaction: remove orphaned `tool_result` messages during history pruning to prevent session corruption from aborted tool calls. (#9868, fixes #9769, #9724, #9672) (#2402) Thanks @ramin-shirali.
+- Telegram: pass `parentPeer` for forum topic binding inheritance so group-level bindings apply to all topics within the group. (#9789, fixes #9545, #9351) (#2402) Thanks @ramin-shirali.
+- CLI: pass `--disable-warning=ExperimentalWarning` as a Node CLI option when respawning (avoid disallowed `NODE_OPTIONS` usage; fixes npm pack). (#9691) Thanks @18-RAJAT.
+- CLI: resolve bundled Chrome extension assets by walking up to the nearest assets directory; add resolver and clipboard tests. (#8914) Thanks @kelvinCB.
+- Tests: stabilize Windows ACL coverage with deterministic os.userInfo mocking. (#9335) Thanks @M00N7682.
+- Exec approvals: coerce bare string allowlist entries to objects to prevent allowlist corruption. (#9903, fixes #9790) Thanks @mcaxtr.
+- Exec approvals: ensure two-phase approval registration/decision flow works reliably by validating `twoPhase` requests and exposing `waitDecision` as an approvals-scoped gateway method. (#3357, fixes #2402) Thanks @ramin-shirali.
+- Heartbeat: allow explicit accountId routing for multi-account channels. (#8702) Thanks @lsh411.
+- TUI/Gateway: handle non-streaming finals, refresh history for non-local chat runs, and avoid event gap warnings for targeted tool streams. (#8432) Thanks @gumadeiras.
+- Shell completion: auto-detect and migrate slow dynamic patterns to cached files for faster terminal startup; add completion health checks to doctor/update/onboard.
+- Telegram: honor session model overrides in inline model selection. (#8193) Thanks @gildo.
+- Web UI: fix agent model selection saves for default/non-default agents and wrap long workspace paths. Thanks @Takhoffman.
+- Web UI: resolve header logo path when `gateway.controlUi.basePath` is set. (#7178) Thanks @Yeom-JinHo.
+- Web UI: apply button styling to the new-messages indicator.
+- Onboarding: infer auth choice from non-interactive API key flags. (#8484) Thanks @f-trycua.
+- Security: keep untrusted channel metadata out of system prompts (Slack/Discord). Thanks @KonstantinMirin.
+- Security: enforce sandboxed media paths for message tool attachments. (#9182) Thanks @victormier.
+- Security: require explicit credentials for gateway URL overrides to prevent credential leakage. (#8113) Thanks @victormier.
+- Security: gate `whatsapp_login` tool to owner senders and default-deny non-owner contexts. (#8768) Thanks @victormier.
+- Voice call: harden webhook verification with host allowlists/proxy trust and keep ngrok loopback bypass.
+- Voice call: add regression coverage for anonymous inbound caller IDs with allowlist policy. (#8104) Thanks @victormier.
+- Cron: accept epoch timestamps and 0ms durations in CLI `--at` parsing.
+- Cron: reload store data when the store file is recreated or mtime changes.
+- Cron: deliver announce runs directly, honor delivery mode, and respect wakeMode for summaries. (#8540) Thanks @tyler6204.
+- Telegram: include forward_from_chat metadata in forwarded messages and harden cron delivery target checks. (#8392) Thanks @sleontenko.
+- macOS: fix cron payload summary rendering and ISO 8601 formatter concurrency safety.
+- Discord: enforce DM allowlists for agent components (buttons/select menus), honoring pairing store approvals and tag matches. (#11254) Thanks @thedudeabidesai.
+
diff --git a/CHANGELOG/2026.2.6.md b/CHANGELOG/2026.2.6.md
new file mode 100644
index 0000000000000000000000000000000000000000..8158dcf290f750a81c5a9debe30a7970f3f99cf7
--- /dev/null
+++ b/CHANGELOG/2026.2.6.md
@@ -0,0 +1,38 @@
+## 2026.2.6
+
+### Added
+
+- Cron: run history deep-links to session chat from the dashboard. (#10776) Thanks @tyler6204.
+- Cron: per-run session keys in run log entries and default labels for cron sessions. (#10776) Thanks @tyler6204.
+- Cron: legacy payload field compatibility (`deliver`, `channel`, `to`, `bestEffortDeliver`) in schema. (#10776) Thanks @tyler6204.
+
+### Changes
+
+- Cron: default `wakeMode` is now `"now"` for new jobs (was `"next-heartbeat"`). (#10776) Thanks @tyler6204.
+- Cron: `cron run` defaults to force execution; use `--due` to restrict to due-only. (#10776) Thanks @tyler6204.
+- Models: support Anthropic Opus 4.6 and OpenAI Codex gpt-5.3-codex (forward-compat fallbacks). (#9853, #10720, #9995) Thanks @TinyTb, @calvin-hpnet, @tyler6204.
+- Providers: add xAI (Grok) support. (#9885) Thanks @grp06.
+- Providers: add Baidu Qianfan support. (#8868) Thanks @ide-rea.
+- Web UI: add token usage dashboard. (#10072) Thanks @Takhoffman.
+- Web UI: add RTL auto-direction support for Hebrew/Arabic text in chat composer and rendered messages. (#11498) Thanks @dirbalak.
+- Memory: native Voyage AI support. (#7078) Thanks @mcinteerj.
+- Sessions: cap sessions_history payloads to reduce context overflow. (#10000) Thanks @gut-puncture.
+- CLI: sort commands alphabetically in help output. (#8068) Thanks @deepsoumya617.
+- CI: optimize pipeline throughput (macOS consolidation, Windows perf, workflow concurrency). (#10784) Thanks @mcaxtr.
+- Agents: bump pi-mono to 0.52.7; add embedded forward-compat fallback for Opus 4.6 model ids.
+
+### Fixes
+
+- TTS: add missing OpenAI voices (ballad, cedar, juniper, marin, verse) to the allowlist so they are recognized instead of silently falling back to Edge TTS. (#2393) Thanks @lailoo.
+- Cron: scheduler reliability (timer drift, restart catch-up, lock contention, stale running markers). (#10776) Thanks @tyler6204.
+- Cron: store migration hardening (legacy field migration, parse error handling, explicit delivery mode persistence). (#10776) Thanks @tyler6204.
+- Telegram: auto-inject DM topic threadId in message tool + subagent announce. (#7235) Thanks @Lukavyi.
+- Security: require auth for Gateway canvas host and A2UI assets. (#9518) Thanks @coygeek.
+- Cron: fix scheduling and reminder delivery regressions; harden next-run recompute + timer re-arming + legacy schedule fields. (#9733, #9823, #9948, #9932) Thanks @tyler6204, @pycckuu, @j2h4u, @fujiwara-tofu-shop.
+- Update: harden Control UI asset handling in update flow. (#10146) Thanks @gumadeiras.
+- Security: add skill/plugin code safety scanner; redact credentials from config.get gateway responses. (#9806, #9858) Thanks @abdelsfane.
+- Exec approvals: coerce bare string allowlist entries to objects. (#9903) Thanks @mcaxtr.
+- Slack: add mention stripPatterns for /new and /reset. (#9971) Thanks @ironbyte-rgb.
+- Chrome extension: fix bundled path resolution. (#8914) Thanks @kelvinCB.
+- Compaction/errors: allow multiple compaction retries on context overflow; show clear billing errors. (#8928, #8391) Thanks @Glucksberg.
+
diff --git a/CHANGELOG/2026.3.1.md b/CHANGELOG/2026.3.1.md
new file mode 100644
index 0000000000000000000000000000000000000000..0eab7e6df88b5e2f85e918d0adf15d223e8e46c5
--- /dev/null
+++ b/CHANGELOG/2026.3.1.md
@@ -0,0 +1,126 @@
+## 2026.3.1
+
+### Changes
+
+- OpenAI/Streaming transport: make `openai` Responses WebSocket-first by default (`transport: "auto"` with SSE fallback), add shared OpenAI WS stream/connection runtime wiring with per-session cleanup, and preserve server-side compaction payload mutation (`store` + `context_management`) on the WS path.
+- Gateway/Container probes: add built-in HTTP liveness/readiness endpoints (`/health`, `/healthz`, `/ready`, `/readyz`) for Docker/Kubernetes health checks, with fallback routing so existing handlers on those paths are not shadowed. (#31272) Thanks @vincentkoc.
+- Android/Nodes: add `camera.list`, `device.permissions`, `device.health`, and `notifications.actions` (`open`/`dismiss`/`reply`) on Android nodes, plus first-class node-tool actions for the new device/notification commands. (#28260) Thanks @obviyus.
+- Discord/Thread bindings: replace fixed TTL lifecycle with inactivity (`idleHours`, default 24h) plus optional hard `maxAgeHours` lifecycle controls, and add `/session idle` + `/session max-age` commands for focused thread-bound sessions. (#27845) Thanks @osolmaz.
+- Telegram/DM topics: add per-DM `direct` + topic config (allowlists, `dmPolicy`, `skills`, `systemPrompt`, `requireTopic`), route DM topics as distinct inbound/outbound sessions, and enforce topic-aware authorization/debounce for messages, callbacks, commands, and reactions. Landed from contributor PR #30579 by @kesor. Thanks @kesor.
+- Android/Gateway capability refresh: add live Android capability integration coverage and node canvas capability refresh wiring, plus runtime hardening for A2UI readiness retries, scoped canvas URL normalization, debug diagnostics JSON, and JavaScript MIME delivery. (#28388) Thanks @obviyus.
+- Android/Nodes parity: add `system.notify`, `photos.latest`, `contacts.search`/`contacts.add`, `calendar.events`/`calendar.add`, and `motion.activity`/`motion.pedometer`, with motion sensor-aware command gating and improved activity sampling reliability. (#29398) Thanks @obviyus.
+- Agents/Thinking defaults: set `adaptive` as the default thinking level for Anthropic Claude 4.6 models (including Bedrock Claude 4.6 refs) while keeping other reasoning-capable models at `low` unless explicitly configured.
+- Web UI/Cron i18n: localize cron page labels, filters, form help text, and validation/error messaging in English and zh-CN. (#29315) Thanks @BUGKillerKing.
+- CLI/Config: add `openclaw config file` to print the active config file path resolved from `OPENCLAW_CONFIG_PATH` or the default location. (#26256) thanks @cyb1278588254.
+- Feishu/Docx tables + uploads: add `feishu_doc` actions for Docx table creation/cell writing (`create_table`, `write_table_cells`, `create_table_with_values`) and image/file uploads (`upload_image`, `upload_file`) with stricter create/upload error handling for missing `document_id` and placeholder cleanup failures. (#20304) Thanks @xuhao1.
+- Feishu/Reactions: add inbound `im.message.reaction.created_v1` handling, route verified reactions through synthetic inbound turns, and harden verification with timeout + fail-closed filtering so non-bot or unverified reactions are dropped. (#16716) Thanks @schumilin.
+- Feishu/Chat tooling: add `feishu_chat` tool actions for chat info and member queries, with configurable enablement under `channels.feishu.tools.chat`. (#14674) Thanks @liuweifly.
+- Feishu/Doc permissions: support optional owner permission grant fields on `feishu_doc` create and report permission metadata only when the grant call succeeds, with regression coverage for success/failure/omitted-owner paths. (#28295) Thanks @zhoulongchao77.
+- Web UI/i18n: add German (`de`) locale support and auto-render language options from supported locale constants in Overview settings. (#28495) thanks @dsantoreis.
+- Tools/Diffs: add a new optional `diffs` plugin tool for read-only diff rendering from before/after text or unified patches, with gateway viewer URLs for canvas and PNG image output. Thanks @gumadeiras.
+- Memory/LanceDB: support custom OpenAI `baseUrl` and embedding dimensions for LanceDB memory. (#17874) Thanks @rish2jain and @vincentkoc.
+- ACP/ACPX streaming: pin ACPX plugin support to `0.1.15`, add configurable ACPX command/version probing, and streamline ACP stream delivery (`final_only` default + reduced tool-event noise) with matching runtime and test updates. (#30036) Thanks @osolmaz.
+- Shell env markers: set `OPENCLAW_SHELL` across shell-like runtimes (`exec`, `acp`, `acp-client`, `tui-local`) so shell startup/config rules can target OpenClaw contexts consistently, and document the markers in env/exec/acp/TUI docs. Thanks @vincentkoc.
+- Cron/Heartbeat light bootstrap context: add opt-in lightweight bootstrap mode for automation runs (`--light-context` for cron agent turns and `agents.*.heartbeat.lightContext` for heartbeat), keeping only `HEARTBEAT.md` for heartbeat runs and skipping bootstrap-file injection for cron lightweight runs. (#26064) Thanks @jose-velez.
+- OpenAI/WebSocket warm-up: add optional OpenAI Responses WebSocket warm-up (`response.create` with `generate:false`), enable it by default for `openai/*`, and expose `params.openaiWsWarmup` for per-model enable/disable control.
+- Agents/Subagents runtime events: replace ad-hoc subagent completion system-message handoff with typed internal completion events (`task_completion`) that are rendered consistently across direct and queued announce paths, with gateway/CLI plumbing for structured `internalEvents`.
+
+### Fixes
+
+- Feishu/Streaming card text fidelity: merge throttled/fragmented partial updates without dropping content and avoid newline injection when stitching chunk-style deltas so card-stream output matches final reply text. (#29616) Thanks @HaoHuaqing.
+- Security/Feishu webhook ingress: bound unauthenticated webhook rate-limit state with stale-window pruning and a hard key cap to prevent unbounded pre-auth memory growth from rotating source keys. (#26050) Thanks @bmendonca3.
+- Security/Compaction audit: remove the post-compaction audit injection message. (#28507) Thanks @fuller-stack-dev and @vincentkoc.
+- Web tools/RFC2544 fake-IP compatibility: allow RFC2544 benchmark range (`198.18.0.0/15`) for trusted web-tool fetch endpoints so proxy fake-IP networking modes do not trigger false SSRF blocks. Landed from contributor PR #31176 by @sunkinux. Thanks @sunkinux.
+- Feishu/Sessions announce group targets: normalize `group:` and `channel:` Feishu targets to `chat_id` routing so `sessions_send` announce delivery no longer sends group chat IDs via `user_id` API params. Fixes #31426. Thanks @liuxiaopai-ai.
+- Windows/Plugin install: avoid `spawn EINVAL` on Windows npm/npx invocations by resolving to `node` + npm CLI scripts instead of spawning `.cmd` directly. Landed from contributor PR #31147 by @codertony. Thanks @codertony.
+- Web UI/Cron: include configured agent model defaults/fallbacks in cron model suggestions so scheduled-job model autocomplete reflects configured models. (#29709) Thanks @Sid-Qin.
+- Cron/Delivery: disable the agent messaging tool when `delivery.mode` is `"none"` so cron output is not sent to Telegram or other channels. (#21808) Thanks @lailoo.
+- CLI/Cron: clarify `cron list` output by renaming `Agent` to `Agent ID` and adding a `Model` column for isolated agent-turn jobs. (#26259) Thanks @openperf.
+- Gateway/Control UI origins: honor `gateway.controlUi.allowedOrigins: ["*"]` wildcard entries (including trimmed values) and lock behavior with regression tests. Landed from contributor PR #31058 by @byungsker. Thanks @byungsker.
+- Agents/Sessions list transcript paths: handle missing/non-string/relative `sessions.list.path` values and per-agent `{agentId}` templates when deriving `transcriptPath`, so cross-agent session listings resolve to concrete agent session files instead of workspace-relative paths. (#24775) Thanks @martinfrancois.
+- Gateway/Control UI CSP: allow required Google Fonts origins in Control UI CSP. (#29279) Thanks @vincentkoc.
+- CLI/Install: add an npm-link fallback to fix CLI startup `Permission denied` failures (`exit 127`) on affected installs. (#17151) Thanks @sskyu and @vincentkoc.
+- Plugins/NPM spec install: fix npm-spec plugin installs when `npm pack` output is empty by detecting newly created `.tgz` archives in the pack directory. (#21039) Thanks @graysurf and @vincentkoc.
+- Plugins/Install: clear stale install errors when an npm package is not found so follow-up install attempts report current state correctly. (#25073) Thanks @dalefrieswthat.
+- Gateway/macOS supervised restart: actively `launchctl kickstart -k` during intentional supervised restarts to bypass LaunchAgent `ThrottleInterval` delays, and fall back to in-process restart when kickstart fails. Landed from contributor PR #29078 by @cathrynlavery. Thanks @cathrynlavery.
+- Sessions/Internal routing: preserve established external `lastTo`/`lastChannel` routes for internal/non-deliverable turns, with added coverage for no-fallback internal routing behavior. Landed from contributor PR #30941 by @graysurf. Thanks @graysurf.
+- Auto-reply/NO_REPLY: strip `NO_REPLY` token from mixed-content messages instead of leaking raw control text to end users. Landed from contributor PR #31080 by @scoootscooob. Thanks @scoootscooob.
+- Inbound metadata/Multi-account routing: include `account_id` in trusted inbound metadata so multi-account channel sessions can reliably disambiguate the receiving account in prompt context. Landed from contributor PR #30984 by @Stxle2. Thanks @Stxle2.
+- Cron/Delivery mode none: send explicit `delivery: { mode: "none" }` from cron editor for both add and update flows so previous announce delivery is actually cleared. Landed from contributor PR #31145 by @byungsker. Thanks @byungsker.
+- Cron editor viewport: make the sticky cron edit form independently scrollable with viewport-bounded height so lower fields/actions are reachable on shorter screens. Landed from contributor PR #31133 by @Sid-Qin. Thanks @Sid-Qin.
+- Agents/Thinking fallback: when providers reject unsupported thinking levels without enumerating alternatives, retry with `think=off` to avoid hard failure during model/provider fallback chains. Landed from contributor PR #31002 by @yfge. Thanks @yfge.
+- Agents/Failover reason classification: avoid false rate-limit classification from incidental `tpm` substrings by matching TPM as a standalone token/phrase and keeping auth-context errors on the auth path. Landed from contributor PR #31007 by @HOYALIM. Thanks @HOYALIM.
+- Gateway/WS: close repeated post-handshake `unauthorized role:*` request floods per connection and sample duplicate rejection logs, preventing a single misbehaving client from degrading gateway responsiveness. (#20168) Thanks @acy103, @vibecodooor, and @vincentkoc.
+- Gateway/Auth: improve device-auth v2 migration diagnostics so operators get clearer guidance when legacy clients connect. (#28305) Thanks @vincentkoc.
+- CLI/Ollama config: allow `config set` for Ollama `apiKey` without predeclared provider config. (#29299) Thanks @vincentkoc.
+- Agents/Ollama: demote empty-discovery logging from `warn` to `debug` to reduce noisy warnings in normal edge-case discovery flows. (#26379) Thanks @byungsker.
+- Sandbox/Browser Docker: pass `OPENCLAW_BROWSER_NO_SANDBOX=1` to sandbox browser containers and bump sandbox browser security hash epoch so existing containers are recreated and pick up the env on upgrade. (#29879) Thanks @Lukavyi.
+- Tools/Edit workspace boundary errors: preserve the real `Path escapes workspace root` failure path instead of surfacing a misleading access/file-not-found error when editing outside workspace roots. Landed from contributor PR #31015 by @haosenwang1018. Thanks @haosenwang1018.
+- Browser/Open & navigate: accept `url` as an alias parameter for `open` and `navigate`. (#29260) Thanks @vincentkoc.
+- Sandbox/mkdirp boundary checks: allow directory-safe boundary validation for existing in-boundary subdirectories, preventing false `cannot create directories` failures in sandbox write mode. (#30610) Thanks @glitch418x.
+- Android/Nodes reliability: reject `facing=both` when `deviceId` is set to avoid mislabeled duplicate captures, allow notification `open`/`reply` on non-clearable entries while still gating dismiss, trigger listener rebind before notification actions, and scale invoke-result ack timeout to invoke budget for large clip payloads. (#28260) Thanks @obviyus.
+- LINE/Voice transcription: classify M4A voice media as `audio/mp4` (not `video/mp4`) by checking the MPEG-4 `ftyp` major brand (`M4A ` / `M4B `), restoring voice transcription for LINE voice messages. Landed from contributor PR #31151 by @scoootscooob. Thanks @scoootscooob.
+- Slack/Announce target account routing: enable session-backed announce-target lookup for Slack so multi-account announces resolve the correct `accountId` instead of defaulting to bot-token context. Landed from contributor PR #31028 by @taw0002. Thanks @taw0002.
+- Android/Voice screen TTS: stream assistant speech via ElevenLabs WebSocket in Talk Mode, stop cleanly on speaker mute/barge-in, and ignore stale out-of-order stream events. (#29521) Thanks @gregmousseau.
+- Android/Photos permissions: declare Android 14+ selected-photo access permission (`READ_MEDIA_VISUAL_USER_SELECTED`) and align Android permission/settings paths with current minSdk behavior for more reliable permission state handling.
+- Feishu/Reply media attachments: send Feishu reply `mediaUrl`/`mediaUrls` payloads as attachments alongside text/streamed replies in the reply dispatcher, including legacy fallback when `mediaUrls` is empty. (#28959) Thanks @icesword0760.
+- Slack/User-token resolution: normalize Slack account user-token sourcing through resolved account metadata (`SLACK_USER_TOKEN` env + config) so monitor reads, Slack actions, directory lookups, onboarding allow-from resolution, and capabilities probing consistently use the effective user token. (#28103) Thanks @chilu18.
+- Feishu/Outbound session routing: stop assuming bare `oc_` identifiers are always group chats, honor explicit `dm:`/`group:` prefixes for `oc_` chat IDs, and default ambiguous bare `oc_` targets to direct routing to avoid DM session misclassification. (#10407) Thanks @Bermudarat.
+- Feishu/Group session routing: add configurable group session scopes (`group`, `group_sender`, `group_topic`, `group_topic_sender`) with legacy `topicSessionMode=enabled` compatibility so Feishu group conversations can isolate sessions by sender/topic as configured. (#17798) Thanks @yfge.
+- Feishu/Reply-in-thread routing: add `replyInThread` config (`disabled|enabled`) for group replies, propagate `reply_in_thread` across text/card/media/streaming sends, and align topic-scoped session routing so newly created reply threads stay on the same session root. (#27325) Thanks @kcinzgg.
+- Feishu/Probe status caching: cache successful `probeFeishu()` bot-info results for 10 minutes (bounded cache with per-account keying) to reduce repeated status/onboarding probe API calls, while bypassing cache for failures and exceptions. (#28907) Thanks @hou-rong.
+- Feishu/Opus media send type: send `.opus` attachments with `msg_type: "audio"` (instead of `"media"`) so Feishu voice messages deliver correctly while `.mp4` remains `msg_type: "media"` and documents remain `msg_type: "file"`. (#28269) Thanks @PinoHouse.
+- Feishu/Mobile video media type: treat inbound `message_type: "media"` as video-equivalent for media key extraction, placeholder inference, and media download resolution so mobile-app video sends ingest correctly. (#25502) Thanks @4ier.
+- Feishu/Inbound sender fallback: fall back to `sender_id.user_id` when `sender_id.open_id` is missing on inbound events, and use ID-type-aware sender lookup so mobile-delivered messages keep stable sender identity/routing. (#26703) Thanks @NewdlDewdl.
+- Feishu/Reply context metadata: include inbound `parent_id` and `root_id` as `ReplyToId`/`RootMessageId` in inbound context, and parse interactive-card quote bodies into readable text when fetching replied messages. (#18529) Thanks @qiangu.
+- Feishu/Post embedded media: extract `media` tags from inbound rich-text (`post`) messages and download embedded video/audio files alongside existing embedded-image handling, with regression coverage. (#21786) Thanks @laopuhuluwa.
+- Feishu/Local media sends: propagate `mediaLocalRoots` through Feishu outbound media sending into `loadWebMedia` so local path attachments work with post-CVE local-root enforcement. (#27884) Thanks @joelnishanth.
+- Feishu/Group wildcard policy fallback: honor `channels.feishu.groups["*"]` when no explicit group match exists so unmatched groups inherit wildcard reply-policy settings instead of falling back to global defaults. (#29456) Thanks @WaynePika.
+- Feishu/Inbound media regression coverage: add explicit tests for message resource type mapping (`image` stays `image`, non-image maps to `file`) to prevent reintroducing unsupported Feishu `type=audio` fetches. (#16311, #8746) Thanks @Yaxuan42.
+- TTS/Voice bubbles: use opus output and enable `audioAsVoice` routing for Feishu and WhatsApp (in addition to Telegram) so supported channels receive voice-bubble playback instead of file-style audio attachments. (#27366) Thanks @smthfoxy.
+- Telegram/Reply media context: include replied media files in inbound context when replying to media, defer reply-media downloads to debounce flush, gate reply-media fetch behind DM authorization, and preserve replied media when non-vision sticker fallback runs (including cached-sticker paths). (#28488) Thanks @obviyus.
+- Android/Nodes notification wake flow: enable Android `system.notify` default allowlist, emit `notifications.changed` events for posted/removed notifications (excluding OpenClaw app-owned notifications), canonicalize notification session keys before enqueue/wake routing, and skip heartbeat wakes when consecutive notification summaries dedupe. (#29440) Thanks @obviyus.
+- Telegram/Voice fallback reply chunking: apply reply reference, quote text, and inline buttons only to the first fallback text chunk when voice delivery is blocked, preventing over-quoted multi-chunk replies. Landed from contributor PR #31067 by @xdanger. Thanks @xdanger.
+- Feishu/Multi-account + reply reliability: add `channels.feishu.defaultAccount` outbound routing support with schema validation, keep quoted-message extraction text-first (post/interactive/file placeholders instead of raw JSON), route Feishu video sends as `msg_type: "file"`, and avoid websocket event blocking by using non-blocking event handling in monitor dispatch. Landed from contributor PRs #29610, #30432, #30331, and #29501. Thanks @hclsys, @bmendonca3, @patrick-yingxi-pan, and @zwffff.
+- Feishu/Inbound rich-text parsing: preserve `share_chat` payload summaries when available and add explicit parsing for rich-text `code`/`code_block`/`pre` tags so forwarded and code-heavy messages keep useful context in agent input. (#28591) Thanks @kevinWangSheng.
+- Feishu/Post markdown parsing: parse rich-text `post` payloads through a shared markdown-aware parser with locale-wrapper support, preserved mention/image metadata extraction, and inline/fenced code fidelity for agent input rendering. (#12755) Thanks @WilsonLiu95.
+- Telegram/Outbound chunking: route oversize splitting through the shared outbound pipeline (including subagents), retry Telegram sends when escaped HTML exceeds limits, and preserve boundary whitespace when retry re-splitting rendered chunks so plain-text/transcript fidelity is retained. (#29342, #27317; follow-up to #27461) Thanks @obviyus.
+- Slack/Native commands: register Slack native status as `/agentstatus` (Slack-reserved `/status`) so manifest slash command registration stays valid while text `/status` still works. Landed from contributor PR #29032 by @maloqab. Thanks @maloqab.
+- Android/Camera clip: remove `camera.clip` HTTP-upload fallback to base64 so clip transport is deterministic and fail-loud, and reject non-positive `maxWidth` values so invalid inputs fall back to the safe resize default. (#28229) Thanks @obviyus.
+- Android/Gateway canvas capability refresh: send `node.canvas.capability.refresh` with object `params` (`{}`) from Android node runtime so gateway object-schema validation accepts refresh retries and A2UI host recovery works after scoped capability expiry. (#28413) Thanks @obviyus.
+- Onboarding/Custom providers: improve verification reliability for slower local endpoints (for example Ollama) during setup. (#27380) Thanks @Sid-Qin.
+- Daemon/macOS TLS certs: default LaunchAgent service env `NODE_EXTRA_CA_CERTS` to `/etc/ssl/cert.pem` (while preserving explicit overrides) so HTTPS clients no longer fail with local-issuer errors under launchd. (#27915) Thanks @Lukavyi.
+- Daemon/Linux systemd user-bus fallback: when `systemctl --user` cannot reach the user bus due missing session env, fall back to `systemctl --machine <user>@ --user` so daemon checks/install continue in headless SSH/server sessions. (#34884) Thanks @vincentkoc.
+- Gateway/Linux restart health: reduce false `openclaw gateway restart` timeouts by falling back to `ss -ltnp` when `lsof` is missing, confirming ambiguous busy-port cases via local gateway probe, and targeting the original `SUDO_USER` systemd user scope for restart commands. (#34874) Thanks @vincentkoc.
+- Discord/Components wildcard handlers: use distinct internal registration sentinel IDs and parse those sentinels as wildcard keys so select/user/role/channel/mentionable/modal interactions are not dropped by raw customId dedupe paths. Landed from contributor PR #29459 by @Sid-Qin. Thanks @Sid-Qin.
+- Feishu/Reaction notifications: add `channels.feishu.reactionNotifications` (`off | own | all`, default `own`) so operators can disable reaction ingress or allow all verified reaction events (not only bot-authored message reactions). (#28529) Thanks @cowboy129.
+- Feishu/Typing backoff: re-throw Feishu typing add/remove rate-limit and quota errors (`429`, `99991400`, `99991403`) and detect SDK non-throwing backoff responses so the typing keepalive circuit breaker can stop retries instead of looping indefinitely. (#28494) Thanks @guoqunabc.
+- Feishu/Zalo runtime logging: replace direct `console.log/error` usage in Feishu typing-indicator paths and Zalo monitor paths with runtime-gated logger calls so verbosity controls are respected while preserving typing backoff behavior. (#18841) Thanks @Clawborn.
+- Feishu/Group sender allowlist fallback: add global `channels.feishu.groupSenderAllowFrom` sender authorization for group chats, with per-group `groups.<id>.allowFrom` precedence and regression coverage for allow/block/precedence behavior. (#29174) Thanks @1MoreBuild.
+- Feishu/Docx append/write ordering: insert converted Docx blocks sequentially (single-block creates) so Feishu append/write preserves markdown block order instead of returning shuffled sections in asynchronous batch inserts. (#26172, #26022) Thanks @echoVic.
+- Feishu/Docx convert fallback chunking: recursively split oversized markdown chunks (including long no-heading sections) when `document.convert` hits content limits, while keeping fenced-code-aware split boundaries whenever possible. (#14402) Thanks @lml2468.
+- Feishu/API quota controls: add `typingIndicator` and `resolveSenderNames` config flags (top-level and per-account) so operators can disable typing reactions and sender-name lookup requests while keeping default behavior unchanged. (#10513) Thanks @BigUncle.
+- Feishu/System preview prompt leakage: stop enqueuing inbound Feishu message previews as system events so user preview text is not injected into later turns as trusted `System:` context. Landed from contributor PR #31209 by @stakeswky. Thanks @stakeswky.
+- Feishu/Typing replay suppression: skip typing indicators for stale replayed inbound messages after compaction using message-age checks with second/millisecond timestamp normalization, preventing old-message reaction floods while preserving typing for fresh messages. Landed from contributor PR #30709 by @arkyu2077. Thanks @arkyu2077.
+- Control UI/Debug log layout: render Debug Event Log payloads at full width to prevent payload JSON from being squeezed into a narrow side column. Landed from contributor PR #30978 by @stozo04. Thanks @stozo04.
+- Install/npm: fix npm global install deprecation warnings. (#28318) Thanks @vincentkoc.
+- Update/Global npm: fallback to `--omit=optional` when global `npm update` fails so optional dependency install failures no longer abort update flows. (#24896) Thanks @xinhuagu and @vincentkoc.
+- Model directives/Auth profiles: split `/model` profile suffixes at the first `@` after the last slash so email-based auth profile IDs (for example OAuth profile IDs) resolve correctly. Landed from contributor PR #30932 by @haosenwang1018. Thanks @haosenwang1018.
+- Ollama/Embedded runner base URL precedence: prioritize configured provider `baseUrl` over model defaults for embedded Ollama runs so Docker and remote-host setups avoid localhost fetch failures. (#30964) Thanks @stakeswky.
+- Ollama/Autodiscovery: harden autodiscovery and warning behavior. (#29201) Thanks @marcodelpin and @vincentkoc.
+- Ollama/Context window: unify context window handling across discovery, merge, and OpenAI-compatible transport paths. (#29205) Thanks @Sid-Qin, @jimmielightner, and @vincentkoc.
+- fix(model): preserve reasoning in provider fallback resolution. (#29285) Fixes #25636. Thanks @vincentkoc.
+- Docker/Image permissions: normalize `/app/extensions`, `/app/.agent`, and `/app/.agents` to directory mode `755` and file mode `644` during image build so plugin discovery does not block inherited world-writable paths. (#30191) Fixes #30139. Thanks @edincampara.
+- OpenAI Responses/Compaction: rewrite and unify the OpenAI Responses store patches to treat empty `baseUrl` as non-direct, honor `compat.supportsStore=false`, and auto-inject server-side compaction `context_management` for compatible direct OpenAI models (with per-model opt-out/threshold overrides). Landed from contributor PRs #16930 (@OiPunk), #22441 (@EdwardWu7), and #25088 (@MoerAI). Thanks @OiPunk, @EdwardWu7, and @MoerAI.
+- Agents/Compaction safeguard: preserve recent turns verbatim with stable user/assistant pairing, keep multimodal and tool-result hints in preserved tails, and avoid empty-history fallback text in compacted output. (#25554) thanks @rodrigouroz.
+- Usage normalization: clamp negative prompt/input token values to zero (including `prompt_tokens` alias inputs) so `/usage` and TUI usage displays cannot show nonsensical negative counts. Landed from contributor PR #31211 by @scoootscooob. Thanks @scoootscooob.
+- Secrets/Auth profiles: normalize inline SecretRef `token`/`key` values to canonical `tokenRef`/`keyRef` before persistence, and keep explicit `keyRef` precedence when inline refs are also present. Landed from contributor PR #31047 by @minupla. Thanks @minupla.
+- Codex/Usage window: label weekly usage window as `Week` instead of `Day`. (#26267) Thanks @Sid-Qin.
+- Signal/Sync message null-handling: treat `syncMessage` presence (including `null`) as sync envelope traffic so replayed sentTranscript payloads cannot bypass loop guards after daemon restart. Landed from contributor PR #31138 by @Sid-Qin. Thanks @Sid-Qin.
+- Infra/fs-safe: sanitize directory-read failures so raw `EISDIR` text never leaks to messaging surfaces, with regression tests for both root-scoped and direct safe reads. Landed from contributor PR #31205 by @polooooo. Thanks @polooooo.
+
+### Breaking
+
+- **BREAKING:** Node exec approval payloads now require `systemRunPlan`. `host=node` approval requests without that plan are rejected.
+- **BREAKING:** Node `system.run` execution now pins path-token commands to the canonical executable path (`realpath`) in both allowlist and approval execution flows. Integrations/tests that asserted token-form argv (for example `tr`) must now accept canonical paths (for example `/usr/bin/tr`).
+
diff --git a/CHANGELOG/2026.3.11.md b/CHANGELOG/2026.3.11.md
new file mode 100644
index 0000000000000000000000000000000000000000..4d654a9d27f4e944854333d0c8b763fd3cc2de9f
--- /dev/null
+++ b/CHANGELOG/2026.3.11.md
@@ -0,0 +1,142 @@
+## 2026.3.11
+
+### Changes
+
+- OpenRouter/models: add temporary Hunter Alpha and Healer Alpha entries to the built-in catalog so OpenRouter users can try the new free stealth models during their roughly one-week availability window. (#43642) Thanks @ping-Toven.
+- iOS/Home canvas: add a bundled welcome screen with a live agent overview that refreshes on connect, reconnect, and foreground return, and move the compact connection pill off the top-left canvas overlay. (#42456) Thanks @ngutman.
+- iOS/Home canvas: replace floating controls with a docked toolbar, make the bundled home scaffold adapt to smaller phones, and open chat in the resolved main session instead of a synthetic `ios` session. (#42456) Thanks @ngutman.
+- macOS/chat UI: add a chat model picker, persist explicit thinking-level selections across relaunch, and harden provider-aware session model sync for the shared chat composer. (#42314) Thanks @ImLukeF.
+- Onboarding/Ollama: add first-class Ollama setup with Local or Cloud + Local modes, browser-based cloud sign-in, curated model suggestions, and cloud-model handling that skips unnecessary local pulls. (#41529) Thanks @BruceMacD.
+- OpenCode/onboarding: add new OpenCode Go provider, treat Zen and Go as one OpenCode setup in the wizard/docs while keeping the runtime providers split, store one shared OpenCode key for both profiles, and stop overriding the built-in `opencode-go` catalog routing. (#42313) Thanks @ImLukeF and @vincentkoc.
+- Memory: add opt-in multimodal image and audio indexing for `memorySearch.extraPaths` with Gemini `gemini-embedding-2-preview`, strict fallback gating, and scope-based reindexing. (#43460) Thanks @gumadeiras.
+- Memory/Gemini: add `gemini-embedding-2-preview` memory-search support with configurable output dimensions and automatic reindexing when the configured dimensions change. (#42501) Thanks @BillChirico and @gumadeiras.
+- macOS/onboarding: detect when remote gateways need a shared auth token, explain where to find it on the gateway host, and clarify when a successful check used paired-device auth instead. (#43100) Thanks @ngutman.
+- Discord/auto threads: add `autoArchiveDuration` channel config for auto-created threads so Discord thread archiving can stay at 1 hour, 1 day, 3 days, or 1 week instead of always using the 1-hour default. (#35065) Thanks @davidguttman.
+- iOS/TestFlight: add a local beta release flow with Fastlane prepare/archive/upload support, canonical beta bundle IDs, and watch-app archive fixes. (#42991) Thanks @ngutman.
+- ACP/sessions_spawn: add optional `resumeSessionId` for `runtime: "acp"` so spawned ACP sessions can resume an existing ACPX/Codex conversation instead of always starting fresh. (#41847) Thanks @pejmanjohn.
+- Gateway/node pending work: add narrow in-memory pending-work queue primitives (`node.pending.enqueue` / `node.pending.drain`) and wake-helper reuse as a foundation for dormant-node work delivery. (#41409) Thanks @mbelinky.
+- Git/runtime state: ignore the gateway-generated `.dev-state` file so local runtime state does not show up as untracked repo noise. (#41848) Thanks @smysle.
+- Exec/child commands: mark child command environments with `OPENCLAW_CLI` so subprocesses can detect when they were launched from the OpenClaw CLI. (#41411) Thanks @vincentkoc.
+- LLM Task/Lobster: add an optional `thinking` override so workflow calls can explicitly set embedded reasoning level with shared validation for invalid values and unsupported `xhigh` modes. (#15606) Thanks @xadenryan and @ImLukeF.
+- Mattermost/reply threading: add `channels.mattermost.replyToMode` for channel and group messages so top-level posts can start thread-scoped sessions without the manual reply-then-thread workaround. (#29587) Thanks @teconomix.
+- iOS/push relay: add relay-backed official-build push delivery with App Attest + receipt verification, gateway-bound send delegation, and config-based relay URL setup on the gateway. (#43369) Thanks @ngutman.
+
+### Fixes
+
+- Windows/install: stop auto-installing `node-llama-cpp` during normal npm CLI installs so `openclaw@latest` no longer fails on Windows while building optional local-embedding dependencies.
+- Windows/update: mirror the native installer environment during global npm updates, including portable Git fallback and Windows-safe npm shell settings, so `openclaw update` works again on native Windows installs.
+- Gateway/status: expose `runtimeVersion` in gateway status output so install/update smoke tests can verify the running version before and after updates.
+- Windows/onboarding: explain when non-interactive local onboarding is waiting for an already-running gateway, and surface native Scheduled Task admin requirements more clearly instead of failing with an opaque gateway timeout.
+- Windows/gateway install: fall back from denied Scheduled Task creation to a per-user Startup-folder login item, so native `openclaw gateway install` and `--install-daemon` keep working without an elevated PowerShell shell.
+- Agents/text sanitization: strip leaked model control tokens (`<|...|>` and full-width `<|...|>` variants) from user-facing assistant text, preventing GLM-5 and DeepSeek internal delimiters from reaching end users. (#42173) Thanks @imwyvern.
+- iOS/gateway foreground recovery: reconnect immediately on foreground return after stale background sockets are torn down, so the app no longer stays disconnected until a later wake path happens. (#41384) Thanks @mbelinky.
+- Gateway/Control UI: keep dashboard auth tokens in session-scoped browser storage so same-tab refreshes preserve remote token auth without restoring long-lived localStorage token persistence, while scoping tokens to the selected gateway URL and fragment-only bootstrap flow. (#40892) thanks @velvet-shark.
+- Gateway/macOS launchd restarts: keep the LaunchAgent registered during explicit restarts, hand off self-restarts through a detached launchd helper, and recover config/hot reload restart paths without unloading the service. Fixes #43311, #43406, #43035, and #43049.
+- macOS/LaunchAgent install: tighten LaunchAgent directory and plist permissions during install so launchd bootstrap does not fail when the target home path or generated plist inherited group/world-writable modes.
+- Discord/reply chunking: resolve the effective `maxLinesPerMessage` config across live reply paths and preserve `chunkMode` in the fast send path so long Discord replies no longer split unexpectedly at the default 17-line limit. (#40133) thanks @rbutera.
+- Feishu/local image auto-convert: pass `mediaLocalRoots` through the `sendText` local-image shim so allowed local image paths upload as Feishu images again instead of falling back to raw path text. (#40623) Thanks @ayanesakura.
+- Telegram/outbound HTML sends: chunk long HTML-mode messages, preserve plain-text fallback and silent-delivery params across retries, and cut over to plain text when HTML chunk planning cannot safely preserve the full message. (#42240) thanks @obviyus.
+- Telegram/final preview delivery: split active preview lifecycle from cleanup retention so missing archived preview edits avoid duplicate fallback sends without clearing the live preview or blocking later in-place finalization. (#41662) thanks @hougangdev.
+- Telegram/final preview delivery followup: keep ambiguous missing-`message_id` finals only when a preview was already visible, while first-preview/no-id cases still fall back so Telegram users do not lose the final reply. (#41932) thanks @hougangdev.
+- Telegram/final preview cleanup follow-up: clear stale cleanup-retain state only for transient preview finals so archived-preview retains no longer leave a stale partial bubble beside a later fallback-sent final. (#41763) Thanks @obviyus.
+- Telegram/poll restarts: scope process-level polling restarts to real Telegram `getUpdates` failures so unrelated network errors, such as Slack DNS misses, no longer bounce Telegram polling. (#43799) Thanks @obviyus.
+- Gateway/auth: allow one trusted device-token retry on shared-token mismatch with recovery hints to prevent reconnect churn during token drift. (#42507) Thanks @joshavant.
+- Gateway/config errors: surface up to three validation issues in top-level `config.set`, `config.patch`, and `config.apply` error messages while preserving structured issue details. (#42664) Thanks @huntharo.
+- Agents/Azure OpenAI Responses: include the `azure-openai` provider in the Responses API store override so Azure OpenAI multi-turn cron jobs and embedded agent runs no longer fail with HTTP 400 "store is set to false". (#42934, fixes #42800) Thanks @ademczuk.
+- Agents/error rendering: ignore stale assistant `errorMessage` fields on successful turns so background/tool-side failures no longer prepend synthetic billing errors over valid replies. (#40616) Thanks @ingyukoh.
+- Agents/billing recovery: probe single-provider billing cooldowns on the existing throttle so topping up credits can recover without a manual gateway restart. (#41422) thanks @altaywtf.
+- Agents/fallback: treat HTTP 499 responses as transient in both raw-text and structured failover paths so Anthropic-style client-closed overload responses trigger model fallback reliably. (#41468) thanks @zeroasterisk.
+- Agents/fallback: recognize Venice `402 Insufficient USD or Diem balance` billing errors so configured model fallbacks trigger instead of surfacing the raw provider error. (#43205) Thanks @Squabble9.
+- Agents/fallback: recognize Poe `402 You've used up your points!` billing errors so configured model fallbacks trigger instead of surfacing the raw provider error. (#42278) Thanks @CryUshio.
+- Agents/failover: treat Gemini `MALFORMED_RESPONSE` stop reasons as retryable timeouts so preview-model enum drift falls back cleanly instead of crashing the run, without also reclassifying malformed function-call errors. (#42292) Thanks @jnMetaCode.
+- Agents/cooldowns: default cooldown windows with no recorded failure history to `unknown` instead of `rate_limit`, avoiding false API rate-limit warnings while preserving cooldown recovery probes. (#42911) Thanks @VibhorGautam.
+- Auth/cooldowns: reset expired auth-profile cooldown error counters before computing the next backoff so stale on-disk counters do not re-escalate into long cooldown loops after expiry. (#41028) thanks @zerone0x.
+- Agents/memory flush: forward `memoryFlushWritePath` through `runEmbeddedPiAgent` so memory-triggered flush turns keep the append-only write guard without aborting before tool setup. Follows up on #38574. (#41761) Thanks @frankekn.
+- Agents/context pruning: prune image-only tool results during soft-trim, align context-pruning coverage with the new tool-result contract, and extend historical image cleanup to the same screenshot-heavy session path. (#43045) Thanks @MoerAI.
+- Sessions/reset model recompute: clear stale runtime model, context-token, and system-prompt metadata before session resets recompute the replacement session, so resets pick up current defaults and explicit overrides instead of reusing old runtime model state. (#41173) thanks @PonyX-lab.
+- Channels/allowlists: remove stale matcher caching so same-array allowlist edits and wildcard replacements take effect immediately, with regression coverage for in-place mutation cases.
+- Discord/Telegram outbound runtime config: thread runtime-resolved config through Discord and Telegram send paths so SecretRef-based credentials stay resolved during message delivery. (#42352) Thanks @joshavant.
+- Tools/web search: treat Brave `llm-context` grounding snippets as plain strings so `web_search` no longer returns empty snippet arrays in LLM Context mode. (#41387) thanks @zheliu2.
+- Tools/web search: recover OpenRouter Perplexity citation extraction from `message.annotations` when chat-completions responses omit top-level citations. (#40881) Thanks @laurieluo.
+- CLI/skills JSON: strip ANSI and C1 control bytes from `skills list --json`, `skills info --json`, and `skills check --json` so machine-readable output stays valid for terminals and skill metadata with embedded control characters. Fixes #27530. Related #27557. Thanks @Jimmy-xuzimo and @vincentkoc.
+- CLI/tables: default shared tables to ASCII borders on legacy Windows consoles while keeping Unicode borders on modern Windows terminals, so commands like `openclaw skills` stop rendering mojibake under GBK/936 consoles. Fixes #40853. Related #41015. Thanks @ApacheBin and @vincentkoc.
+- CLI/memory teardown: close cached memory search/index managers in the one-shot CLI shutdown path so watcher-backed memory caches no longer keep completed CLI runs alive after output finishes. (#40389) thanks @Julbarth.
+- Control UI/Sessions: restore single-column session table collapse on narrow viewport or container widths by moving the responsive table override next to the base grid rule and enabling inline-size container queries. (#12175) Thanks @benjipeng.
+- Telegram/network env-proxy: apply configured transport policy to proxied HTTPS dispatchers as well as direct `NO_PROXY` bypasses, so resolver-scoped IPv4 fallback and network settings work consistently for env-proxied Telegram traffic. (#40740) Thanks @sircrumpet.
+- Mattermost/Markdown formatting: preserve first-line indentation when stripping bot mentions so nested list items and indented code blocks keep their structure, and render Mattermost tables natively by default instead of fenced-code fallback. (#18655) thanks @echo931.
+- Mattermost/plugin send actions: normalize direct `replyTo` fallback handling so threaded plugin sends trim blank IDs and reuse the correct reply target again. (#41176) Thanks @hnykda.
+- MS Teams/allowlist resolution: use the General channel conversation ID as the resolved team key (with Graph GUID fallback) so Bot Framework runtime `channelData.team.id` matching works for team and team/channel allowlist entries. (#41838) Thanks @BradGroux.
+- Signal/config schema: accept `channels.signal.accountUuid` in strict config validation so loop-protection configs no longer fail with an unrecognized-key error. (#35578) Thanks @ingyukoh.
+- Telegram/config schema: accept `channels.telegram.actions.editMessage` and `createForumTopic` in strict config validation so existing Telegram action toggles no longer fail as unrecognized keys. (#35498) Thanks @ingyukoh.
+- Telegram/docs: clarify that `channels.telegram.groups` allowlists chats while `groupAllowFrom` allowlists users inside those chats, and point invalid negative chat IDs at the right config key. (#42451) Thanks @altaywtf.
+- Discord/config typing: expose channel-level `autoThread` on the canonical guild-channel config type so strict config loading matches the existing Discord schema and runtime behavior. (#35608) Thanks @ingyukoh.
+- fix(models): guard optional model.input capability checks (#42096) thanks @andyliu.
+- Models/Alibaba Cloud Model Studio: wire `MODELSTUDIO_API_KEY` through shared env auth, implicit provider discovery, and shell-env fallback so onboarding works outside the wizard too. (#40634) Thanks @pomelo-nwu.
+- Resolve web tool SecretRefs atomically at runtime. (#41599) Thanks @joshavant.
+- Secret files: harden CLI and channel credential file reads against path-swap races by requiring direct regular files for `*File` secret inputs and rejecting symlink-backed secret files.
+- Archive extraction: harden TAR and external `tar.bz2` installs against destination symlink and pre-existing child-symlink escapes by extracting into staging first and merging into the canonical destination with safe file opens.
+- Secrets/SecretRef: reject exec SecretRef traversal ids across schema, runtime, and gateway. (#42370) Thanks @joshavant.
+- Sandbox/fs bridge: pin staged writes to verified parent directories so temporary write files cannot materialize outside the allowed mount before atomic replace. Thanks @tdjackey.
+- Gateway/auth: fail closed when local `gateway.auth.*` SecretRefs are configured but unavailable, instead of silently falling back to `gateway.remote.*` credentials in local mode. (#42672) Thanks @joshavant.
+- Commands/config writes: enforce `configWrites` against both the originating account and the targeted account scope for `/config` and config-backed `/allowlist` edits, blocking sibling-account mutations while preserving gateway `operator.admin` flows. Thanks @tdjackey for reporting.
+- Security/system.run: fail closed for approval-backed interpreter/runtime commands when OpenClaw cannot bind exactly one concrete local file operand, while extending best-effort direct-file binding to additional runtime forms. Thanks @tdjackey for reporting.
+- Gateway/session reset auth: split conversation `/new` and `/reset` handling away from the admin-only `sessions.reset` control-plane RPC so write-scoped gateway callers can no longer reach the privileged reset path through `agent`. Thanks @tdjackey for reporting.
+- Security/plugin runtime: stop unauthenticated plugin HTTP routes from inheriting synthetic admin gateway scopes when they call `runtime.subagent.*`, so admin-only methods like `sessions.delete` stay blocked without gateway auth. Thanks @hydro13.
+- Security/nodes: treat the `nodes` agent tool as owner-only fallback policy so non-owner senders cannot reach paired-node approval or invoke paths through the shared tool set. Thanks @hydro13.
+- Sandbox/sessions_spawn: restore real workspace handoff for read-only sandboxed sessions so spawned subagents mount the configured workspace at `/agent` instead of inheriting the sandbox copy. Related #40582 (#44307). Thanks @mcaxtr.
+- Security/external content: treat whitespace-delimited `EXTERNAL UNTRUSTED CONTENT` boundary markers like underscore-delimited variants so prompt wrappers cannot bypass marker sanitization. (#35983) Thanks @urianpaul94.
+- Telegram/exec approvals: reject `/approve` commands aimed at other bots, keep deterministic approval prompts visible when tool-result delivery fails, and stop resolved exact IDs from matching other pending approvals by prefix. (#37233) Thanks @huntharo.
+- Subagents/authority: persist leaf vs orchestrator control scope at spawn time and route tool plus slash-command control through shared ownership checks, so leaf sessions cannot regain orchestration privileges after restore or flat-key lookups. Thanks @tdjackey.
+- ACP/ACPX plugin: bump the bundled `acpx` pin to `0.1.16` so plugin-local installs and strict version checks match the latest published CLI. (#41975) Thanks @dutifulbob.
+- ACP/sessions.patch: allow `spawnedBy` and `spawnDepth` lineage fields on ACP session keys so `sessions_spawn` with `runtime: "acp"` no longer fails during child-session setup. Fixes #40971. (#40995) thanks @xaeon2026.
+- ACP/stop reason mapping: resolve gateway chat `state: "error"` completions as ACP `end_turn` instead of `refusal` so transient backend failures are not surfaced as deliberate refusals. (#41187) thanks @pejmanjohn.
+- ACP/setSessionMode: propagate gateway `sessions.patch` failures back to ACP clients so rejected mode changes no longer return silent success. (#41185) thanks @pejmanjohn.
+- ACP/bridge mode: reject unsupported per-session MCP server setup and propagate rejected session-mode changes so IDE clients see explicit bridge limitations instead of silent success. (#41424) Thanks @mbelinky.
+- ACP/session UX: replay stored user and assistant text on `loadSession`, expose Gateway-backed session controls and metadata, and emit approximate session usage updates so IDE clients restore context more faithfully. (#41425) Thanks @mbelinky.
+- ACP/tool streaming: enrich `tool_call` and `tool_call_update` events with best-effort text content and file-location hints so IDE clients can follow bridge tool activity more naturally. (#41442) Thanks @mbelinky.
+- ACP/runtime attachments: forward normalized inbound image attachments into ACP runtime turns so ACPX sessions can preserve image prompt content on the runtime path. (#41427) Thanks @mbelinky.
+- ACP/regressions: add gateway RPC coverage for ACP lineage patching, ACPX runtime coverage for image prompt serialization, and an operator smoke-test procedure for live ACP spawn verification. (#41456) Thanks @mbelinky.
+- ACP/follow-up hardening: make session restore and prompt completion degrade gracefully on transcript/update failures, enforce bounded tool-location traversal, and skip non-image ACPX turns the runtime cannot serialize. (#41464) Thanks @mbelinky.
+- ACP/sessions_spawn: implicitly stream `mode="run"` ACP spawns to parent only for eligible subagent orchestrator sessions (heartbeat `target: "last"` with a usable session-local route), restoring parent progress relays without thread binding. (#42404) Thanks @davidguttman.
+- ACP/main session aliases: canonicalize `main` before ACP session lookup so restarted ACP main sessions rehydrate instead of failing closed with `Session is not ACP-enabled: main`. (#43285, fixes #25692) (#43285) Thanks @frankekn.
+- Plugins/context-engine model auth: expose `runtime.modelAuth` and plugin-sdk auth helpers so plugins can resolve provider/model API keys through the normal auth pipeline. (#41090) thanks @xinhuagu.
+- Hooks/plugin context parity followup: pass `trigger` and `channelId` through embedded `llm_input`, `agent_end`, and `llm_output` hook contexts so plugins receive the same agent metadata across hook phases. (#42362) Thanks @zhoulf1006.
+- Plugins/global hook runner: harden singleton state handling so shared global hook runner reuse does not leak or corrupt runner state across executions. (#40184) Thanks @vincentkoc.
+- Context engine/tests: add bundled-registry regression coverage for cross-chunk resolution, plugin-sdk re-exports, and concurrent chunk registration. (#40460) thanks @dsantoreis.
+- Agents/embedded runner: bound compaction retry waiting and drain embedded runs during SIGUSR1 restart so session lanes recover instead of staying blocked behind compaction. (#40324) thanks @cgdusek.
+- Agents/embedded logs: add structured, sanitized lifecycle and failover observation events so overload and provider failures are easier to tail and filter. (#41336) thanks @altaywtf.
+- Agents/embedded overload logs: include the failing model and provider in error-path console output, with lifecycle regression coverage for the rendered and sanitized `consoleMessage`. (#41236) thanks @jiarung.
+- Agents/fallback observability: add structured, sanitized model-fallback decision and auth-profile failure-state events with correlated run IDs so cooldown probes and failover paths are easier to trace in logs. (#41337) thanks @altaywtf.
+- Logging/probe observations: suppress structured embedded and model-fallback probe warnings on the console without hiding error or fatal output. (#41338) thanks @altaywtf.
+- Agents/context-engine compaction: guard thrown engine-owned overflow compaction attempts and fire compaction hooks for `ownsCompaction` engines so overflow recovery no longer crashes and plugin subscribers still observe compact runs. (#41361) thanks @davidrudduck.
+- Gateway/node pending drain followup: keep `hasMore` true when the deferred baseline status item still needs delivery, and avoid allocating empty pending-work state for drain-only nodes with no queued work. (#41429) Thanks @mbelinky.
+- Protocol/Swift model sync: regenerate pending node work Swift bindings after the landed `node.pending.*` schema additions so generated protocol artifacts are consistent again. (#41477) Thanks @mbelinky.
+- Cron/subagent followup: do not misclassify empty or `NO_REPLY` cron responses as interim acknowledgements that need a rerun, so deliberately silent cron jobs are no longer retried. (#41383) thanks @jackal092927.
+- ACP/run-mode delivery: restore inline delivery for one-shot ACP run spawns from non-subagent (main) requester sessions so completions reach the originating Discord/Telegram/etc. channel again. Subagent orchestrators continue to use stream-to-parent when an active heartbeat relay route is available. (#52426) Thanks @distractedCoding.
+- Cron/state errors: record `lastErrorReason` in cron job state and keep the gateway schema aligned with the full failover-reason set, including regression coverage for protocol conformance. (#14382) thanks @futuremind2026.
+- Browser/Browserbase 429 handling: surface stable no-retry rate-limit guidance without buffering discarded HTTP 429 response bodies from remote browser services. (#40491) thanks @mvanhorn.
+- CI/CodeQL Swift toolchain: select Xcode 26.1 before installing Swift build tools so the CodeQL Swift job uses Swift tools 6.2 on `macos-latest`. (#41787) thanks @BunsDev.
+- Sandbox/subagents: pass the real configured workspace through `sessions_spawn` inheritance when a parent agent runs in a copied-workspace sandbox, so child `/agent` mounts point at the configured workspace instead of the parent sandbox copy. (#40757) Thanks @dsantoreis.
+- Agents/fallback cooldown probing: cap cooldown-bypass probing to one attempt per provider per fallback run so multi-model same-provider cooldown chains can continue to cross-provider fallbacks instead of repeatedly stalling on duplicate cooldown probes. (#41711) Thanks @cgdusek.
+- Telegram/direct delivery: bridge direct delivery sends to internal `message:sent` hooks so internal hook listeners observe successful Telegram deliveries. (#40185) Thanks @vincentkoc.
+- Dependencies: refresh workspace dependencies except the pinned Carbon package, and harden ACP session-config writes against non-string SDK values so newer ACP clients fail fast instead of tripping type/runtime mismatches.
+- Telegram/polling restarts: clear bounded cleanup timeout handles after `runner.stop()` and `bot.stop()` settle so stall recovery no longer leaves stray 15-second timers behind on clean shutdown. (#43188) thanks @kyohwang.
+- Status/context windows: normalize provider-qualified override cache keys so `/status` resolves the active provider's configured context window even when `models.providers` keys use mixed case or surrounding whitespace. (#36389) Thanks @haoruilee.
+- Agents/embedded runner: recover canonical allowlisted tool names from malformed `toolCallId` and malformed non-blank tool-name variants before dispatch, while failing closed on ambiguous matches. (#34485) thanks @yuweuii.
+- Agents/failover: classify ZenMux quota-refresh `402` responses as `rate_limit` so model fallback retries continue instead of stopping on a temporary subscription window. (#43917) thanks @bwjoke.
+- Agents/failover: classify HTTP 422 malformed-request responses as `format` and recognize OpenRouter "requires more credits" billing errors so provider fallback triggers instead of surfacing raw errors. (#43823) thanks @jnMetaCode.
+- Memory/QMD Windows: fail closed when `qmd.cmd` or `mcporter.cmd` wrappers cannot be resolved to a direct entrypoint, so memory search no longer falls back to shell execution on Windows.
+- macOS/remote gateway: stop PortGuardian from killing Docker Desktop and other external listeners on the gateway port in remote mode, so containerized and tunneled gateway setups no longer lose their port-forward owner on app startup. (#6755) Thanks @teslamint.
+- Feishu/streaming recovery: clear stale `streamingStartPromise` when card creation fails (HTTP 400) so subsequent messages can retry streaming instead of silently dropping all future replies. Fixes #43322. Thanks @ademczuk.
+- Exec/env sandbox: block JVM agent injection (`JAVA_TOOL_OPTIONS`, `_JAVA_OPTIONS`, `JDK_JAVA_OPTIONS`), Python breakpoint hijack (`PYTHONBREAKPOINT`), and .NET startup hooks (`DOTNET_STARTUP_HOOKS`) from the host exec environment. (#49025) Thanks @ademczuk.
+- Android/camera clip cleanup: delete temporary clip files even when `readBytes()` fails so failed clip captures do not leak cache storage. (#41890) Thanks @Kaneki-x.
+- Android/photos: recycle decoded and intermediate bitmaps in `photos.latest` so repeated photo fetches stop leaking native memory. (#41888) Thanks @Kaneki-x.
+
+### Security
+
+- Gateway/WebSocket: enforce browser origin validation for all browser-originated connections regardless of whether proxy headers are present, closing a cross-site WebSocket hijacking path in `trusted-proxy` mode that could grant untrusted origins `operator.admin` access. (GHSA-5wcw-8jjv-m286).
+
+### Breaking
+
+- Cron/doctor: tighten isolated cron delivery so cron jobs can no longer notify through ad hoc agent sends or fallback main-session summaries, and add `openclaw doctor --fix` migration for legacy cron storage and legacy notify/webhook delivery metadata. (#40998) Thanks @mbelinky.
+
diff --git a/CHANGELOG/2026.3.12.md b/CHANGELOG/2026.3.12.md
new file mode 100644
index 0000000000000000000000000000000000000000..db6f55dba7b5e56e07cd357927b7065668496360
--- /dev/null
+++ b/CHANGELOG/2026.3.12.md
@@ -0,0 +1,92 @@
+## 2026.3.12
+
+### Changes
+
+- Control UI/dashboard-v2: refresh the gateway dashboard with modular overview, chat, config, agent, and session views, plus a command palette, mobile bottom tabs, and richer chat tools like slash commands, search, export, and pinned messages. (#41503) Thanks @BunsDev.
+- OpenAI/GPT-5.4 fast mode: add configurable session-level fast toggles across `/fast`, TUI, Control UI, and ACP, with per-model config defaults and OpenAI/Codex request shaping.
+- Anthropic/Claude fast mode: map the shared `/fast` toggle and `params.fastMode` to direct Anthropic API-key `service_tier` requests, with live verification for both Anthropic and OpenAI fast-mode tiers.
+- Models/plugins: move Ollama, vLLM, and SGLang onto the provider-plugin architecture, with provider-owned onboarding, discovery, model-picker setup, and post-selection hooks so core provider wiring is more modular.
+- Docs/Kubernetes: Add a starter K8s install path with raw manifests, Kind setup, and deployment docs. Thanks @sallyom @dzianisv @egkristi
+- Agents/subagents: add `sessions_yield` so orchestrators can end the current turn immediately, skip queued tool work, and carry a hidden follow-up payload into the next session turn. (#36537) thanks @jriff.
+- Slack/agent replies: support `channelData.slack.blocks` in the shared reply delivery path so agents can send Block Kit messages through standard Slack outbound delivery. (#44592) Thanks @vincentkoc.
+- Slack/interactive replies: add opt-in Slack button and select reply directives behind `channels.slack.capabilities.interactiveReplies`, disabled by default unless explicitly enabled. (#44607) Thanks @vincentkoc.
+
+### Fixes
+
+- Security/device pairing: switch `/pair` and `openclaw qr` setup codes to short-lived bootstrap tokens so the next release no longer embeds shared gateway credentials in chat or QR pairing payloads. Thanks @lintsinghua.
+- Security/plugins: disable implicit workspace plugin auto-load so cloned repositories cannot execute workspace plugin code without an explicit trust decision. (`GHSA-99qw-6mr3-36qr`)(#44174) Thanks @lintsinghua and @vincentkoc.
+- Models/Kimi Coding: send `anthropic-messages` tools in native Anthropic format again so `kimi-coding` stops degrading tool calls into XML/plain-text pseudo invocations instead of real `tool_use` blocks. (#38669, #39907, #40552) Thanks @opriz.
+- TUI/chat log: reuse the active assistant message component for the same streaming run so `openclaw tui` no longer renders duplicate assistant replies. (#35364) Thanks @lisitan.
+- Telegram/model picker: make inline model button selections persist the chosen session model correctly, clear overrides when selecting the configured default, and include effective fallback models in `/models` button validation. (#40105) Thanks @avirweb.
+- Cron/proactive delivery: keep isolated direct cron sends out of the write-ahead resend queue so transient-send retries do not replay duplicate proactive messages after restart. (#40646) Thanks @openperf and @vincentkoc.
+- Models/Kimi Coding: send the built-in `User-Agent: claude-code/0.1.0` header by default for `kimi-coding` while still allowing explicit provider headers to override it, so Kimi Code subscription auth can work without a local header-injection proxy. (#30099) Thanks @Amineelfarssi and @vincentkoc.
+- Models/OpenAI Codex Spark: keep `gpt-5.3-codex-spark` working on the `openai-codex/*` path via resolver fallbacks and clearer Codex-only handling, while continuing to suppress the stale direct `openai/*` Spark row that OpenAI rejects live.
+- Ollama/Kimi Cloud: apply the Moonshot Kimi payload compatibility wrapper to Ollama-hosted Kimi models like `kimi-k2.5:cloud`, so tool routing no longer breaks when thinking is enabled. (#41519) Thanks @vincentkoc.
+- Moonshot CN API: respect explicit `baseUrl` (api.moonshot.cn) in implicit provider resolution so platform.moonshot.cn API keys authenticate correctly instead of returning HTTP 401. (#33637) Thanks @chengzhichao-xydt.
+- Kimi Coding/provider config: respect explicit `models.providers["kimi-coding"].baseUrl` when resolving the implicit provider so custom Kimi Coding endpoints no longer get overwritten by the built-in default. (#36353) Thanks @2233admin.
+- Gateway/main-session routing: keep TUI and other `mode:UI` main-session sends on the internal surface when `deliver` is enabled, so replies no longer inherit the session's persisted Telegram/WhatsApp route. (#43918) Thanks @obviyus.
+- BlueBubbles/self-chat echo dedupe: drop reflected duplicate webhook copies only when a matching `fromMe` event was just seen for the same chat, body, and timestamp, preventing self-chat loops without broad webhook suppression. Related to #32166. (#38442) Thanks @vincentkoc.
+- iMessage/self-chat echo dedupe: drop reflected duplicate copies only when a matching `is_from_me` event was just seen for the same chat, text, and `created_at`, preventing self-chat loops without broad text-only suppression. Related to #32166. (#38440) Thanks @vincentkoc.
+- Subagents/completion announce retries: raise the default announce timeout to 90 seconds and stop retrying gateway-timeout failures for externally delivered completion announces, preventing duplicate user-facing completion messages after slow gateway responses. Fixes #41235. Thanks @vasujain00 and @vincentkoc.
+- Mattermost/block streaming: fix duplicate message delivery (one threaded, one top-level) when block streaming is active by excluding `replyToId` from the block reply dedup key and adding an explicit `threading` dock to the Mattermost plugin. (#41362) Thanks @mathiasnagler and @vincentkoc.
+- Mattermost/reply media delivery: pass agent-scoped `mediaLocalRoots` through shared reply delivery so allowed local files upload correctly from button, slash-command, and model-picker replies. (#44021) Thanks @LyleLiu666.
+- macOS/Reminders: add the missing `NSRemindersUsageDescription` to the bundled app so `apple-reminders` can trigger the system permission prompt from OpenClaw.app. (#8559) Thanks @dinakars777.
+- Gateway/session discovery: discover disk-only and retired ACP session stores under custom templated `session.store` roots so ACP reconciliation, session-id/session-label targeting, and run-id fallback keep working after restart. (#44176) thanks @gumadeiras.
+- Plugins/env-scoped roots: fix plugin discovery/load caches and provenance tracking so same-process `HOME`/`OPENCLAW_HOME` changes no longer reuse stale plugin state or misreport `~/...` plugins as untracked. (#44046) thanks @gumadeiras.
+- Models/OpenRouter native ids: canonicalize native OpenRouter model keys across config writes, runtime lookups, fallback management, and `models list --plain`, and migrate legacy duplicated `openrouter/openrouter/...` config entries forward on write.
+- Windows/native update: make package installs use the npm update path instead of the git path, carry portable Git into native Windows updates, and mirror the installer's Windows npm env so `openclaw update` no longer dies early on missing `git` or `node-llama-cpp` download setup.
+- Sandbox/write: preserve pinned mutation-helper payload stdin so sandboxed `write` no longer reports success while creating empty files. (#43876) Thanks @glitch418x.
+- Security/exec approvals: escape invisible Unicode format characters in approval prompts so zero-width command text renders as visible `\u{...}` escapes instead of spoofing the reviewed command. (`GHSA-pcqg-f7rg-xfvv`)(#43687) Thanks @EkiXu and @vincentkoc.
+- Hooks/loader: fail closed when workspace hook paths cannot be resolved with `realpath`, so unreadable or broken internal hook paths are skipped instead of falling back to unresolved imports. (#44437) Thanks @vincentkoc.
+- Hooks/agent deliveries: dedupe repeated hook requests by optional idempotency key so webhook retries can reuse the first run instead of launching duplicate agent executions. (#44438) Thanks @vincentkoc.
+- Security/exec detection: normalize compatibility Unicode and strip invisible formatting code points before obfuscation checks so zero-width and fullwidth command tricks no longer suppress heuristic detection. (`GHSA-9r3v-37xh-2cf6`)(#44091) Thanks @wooluo and @vincentkoc.
+- Security/exec allowlist: preserve POSIX case sensitivity and keep `?` within a single path segment so exact-looking allowlist patterns no longer overmatch executables across case or directory boundaries. (`GHSA-f8r2-vg7x-gh8m`)(#43798) Thanks @zpbrent and @vincentkoc.
+- Security/commands: require sender ownership for `/config` and `/debug` so authorized non-owner senders can no longer reach owner-only config and runtime debug surfaces. (`GHSA-r7vr-gr74-94p8`)(#44305) Thanks @tdjackey and @vincentkoc.
+- Security/gateway auth: clear unbound client-declared scopes on shared-token WebSocket connects so device-less shared-token operators cannot self-declare elevated scopes. (`GHSA-rqpp-rjj8-7wv8`)(#44306) Thanks @LUOYEcode and @vincentkoc.
+- Security/browser.request: block persistent browser profile create/delete routes from write-scoped `browser.request` so callers can no longer persist admin-only browser profile changes through the browser control surface. (`GHSA-vmhq-cqm9-6p7q`)(#43800) Thanks @tdjackey and @vincentkoc.
+- Security/agent: reject public spawned-run lineage fields and keep workspace inheritance on the internal spawned-session path so external `agent` callers can no longer override the gateway workspace boundary. (`GHSA-2rqg-gjgv-84jm`)(#43801) Thanks @tdjackey and @vincentkoc.
+- Security/session_status: enforce sandbox session-tree visibility and shared agent-to-agent access guards before reading or mutating target session state, so sandboxed subagents can no longer inspect parent session metadata or write parent model overrides via `session_status`. (`GHSA-wcxr-59v9-rxr8`)(#43754) Thanks @tdjackey and @vincentkoc.
+- Security/agent tools: mark `nodes` as explicitly owner-only and document/test that `canvas` remains a shared trusted-operator surface unless a real boundary bypass exists.
+- Security/exec approvals: fail closed for Ruby approval flows that use `-r`, `--require`, or `-I` so approval-backed commands no longer bind only the main script while extra local code-loading flags remain outside the reviewed file snapshot.
+- Security/device pairing: cap issued and verified device-token scopes to each paired device's approved scope baseline so stale or overbroad tokens cannot exceed approved access. (`GHSA-2pwv-x786-56f8`)(#43686) Thanks @tdjackey and @vincentkoc.
+- Docs/onboarding: align the legacy wizard reference and `openclaw onboard` command docs with the Ollama onboarding flow so all onboarding reference paths now document `--auth-choice ollama`, Cloud + Local mode, and non-interactive usage. (#43473) Thanks @BruceMacD.
+- Models/secrets: enforce source-managed SecretRef markers in generated `models.json` so runtime-resolved provider secrets are not persisted when runtime projection is skipped. (#43759) Thanks @joshavant.
+- Security/WebSocket preauth: shorten unauthenticated handshake retention and reject oversized pre-auth frames before application-layer parsing to reduce pre-pairing exposure on unsupported public deployments. (`GHSA-jv4g-m82p-2j93`)(#44089) (`GHSA-xwx2-ppv2-wx98`)(#44089) Thanks @ez-lbz and @vincentkoc.
+- Security/proxy attachments: restore the shared media-store size cap for persisted browser proxy files so oversized payloads are rejected instead of overriding the intended 5 MB limit. (`GHSA-6rph-mmhp-h7h9`)(#43684) Thanks @tdjackey and @vincentkoc.
+- Security/host env: block inherited `GIT_EXEC_PATH` from sanitized host exec environments so Git helper resolution cannot be steered by host environment state. (`GHSA-jf5v-pqgw-gm5m`)(#43685) Thanks @zpbrent and @vincentkoc.
+- Security/Feishu webhook: require `encryptKey` alongside `verificationToken` in webhook mode so unsigned forged events are rejected instead of being processed with token-only configuration. (`GHSA-g353-mgv3-8pcj`)(#44087) Thanks @lintsinghua and @vincentkoc.
+- Security/Feishu reactions: preserve looked-up group chat typing and fail closed on ambiguous reaction context so group authorization and mention gating cannot be bypassed through synthetic `p2p` reactions. (`GHSA-m69h-jm2f-2pv8`)(#44088) Thanks @zpbrent and @vincentkoc.
+- Security/LINE webhook: require signatures for empty-event POST probes too so unsigned requests no longer confirm webhook reachability with a `200` response. (`GHSA-mhxh-9pjm-w7q5`)(#44090) Thanks @TerminalsandCoffee and @vincentkoc.
+- Security/Zalo webhook: rate limit invalid secret guesses before auth so weak webhook secrets cannot be brute-forced through unauthenticated churned requests without pre-auth `429` responses. (`GHSA-5m9r-p9g7-679c`)(#44173) Thanks @zpbrent and @vincentkoc.
+- Security/Zalouser groups: require stable group IDs for allowlist auth by default and gate mutable group-name matching behind `channels.zalouser.dangerouslyAllowNameMatching`. Thanks @zpbrent.
+- Security/Slack and Teams routing: require stable channel and team IDs for allowlist routing by default, with mutable name matching only via each channel's `dangerouslyAllowNameMatching` break-glass flag.
+- Security/exec approvals: fail closed for ambiguous inline loader and shell-payload script execution, bind the real script after POSIX shell value-taking flags, and unwrap `pnpm`/`npm exec`/`npx` script runners before approval binding. (`GHSA-57jw-9722-6rf2`)(`GHSA-jvqh-rfmh-jh27`)(`GHSA-x7pp-23xv-mmr4`)(`GHSA-jc5j-vg4r-j5jx`)(#44247) Thanks @tdjackey and @vincentkoc.
+- Doctor/gateway service audit: canonicalize service entrypoint paths before comparing them so symlink-vs-realpath installs no longer trigger false "entrypoint does not match the current install" repair prompts. (#43882) Thanks @ngutman.
+- Doctor/gateway service audit: earlier groundwork for this fix landed in the superseded #28338 branch. Thanks @realriphub.
+- Gateway/session stores: regenerate the Swift push-test protocol models and align Windows native session-store realpath handling so protocol checks and sync session discovery stop drifting on Windows. (#44266) thanks @jalehman.
+- Context engine/session routing: forward optional `sessionKey` through context-engine lifecycle calls so plugins can see structured routing metadata during bootstrap, assembly, post-turn ingestion, and compaction. (#44157) thanks @jalehman.
+- Agents/failover: classify z.ai `network_error` stop reasons as retryable timeouts so provider connectivity failures trigger fallback instead of surfacing raw unhandled-stop-reason errors. (#43884) Thanks @hougangdev.
+- Config/Anthropic startup: inline Anthropic alias normalization during config load so gateway startup no longer crashes on dated Anthropic model refs like `anthropic/claude-sonnet-4-20250514`. (#45520) Thanks @BunsDev.
+- Memory/session sync: add mode-aware post-compaction session reindexing with `agents.defaults.compaction.postIndexSync` plus `agents.defaults.memorySearch.sync.sessions.postCompactionForce`, so compacted session memory can refresh immediately without forcing every deployment into synchronous reindexing. (#25561) thanks @rodrigouroz.
+- Telegram/native command sync: suppress expected `BOT_COMMANDS_TOO_MUCH` retry error noise, add a final fallback summary log, and document the difference between command-menu overflow and real Telegram network failures.
+- Browser/existing-session: stop reporting fake CDP ports/URLs for live attached Chrome sessions, render `transport: chrome-mcp` in CLI/status output instead of `port: 0`, and keep timeout diagnostics transport-aware when no direct CDP URL exists.
+- Feishu/event dedupe: keep early duplicate suppression aligned with the shared Feishu message-id contract and release the pre-queue dedupe marker after failed dispatch so retried events can recover instead of being dropped until the short TTL expires. (#43762) Thanks @yunweibang.
+- Gateway/hooks: bucket hook auth failures by forwarded client IP behind trusted proxies and warn when `hooks.allowedAgentIds` leaves hook routing unrestricted.
+- Agents/compaction: skip the post-compaction `cache-ttl` marker write when a compaction completed in the same attempt, preventing the next turn from immediately triggering a second tiny compaction. (#28548) thanks @MoerAI.
+- Native chat/macOS: add `/new`, `/reset`, and `/clear` reset triggers, keep shared main-session aliases aligned, and ignore stale model-selection completions so native chat state stays in sync across reset and fast model changes. (#10898) Thanks @Nachx639.
+- Agents/compaction safeguard: route missing-model and missing-API-key cancellation warnings through the shared subsystem logger so they land in structured and file logs. (#9974) Thanks @dinakars777.
+- Cron/doctor: stop flagging canonical `agentTurn` and `systemEvent` payload kinds as legacy cron storage, while still normalizing whitespace-padded and non-canonical variants. (#44012) Thanks @shuicici.
+- ACP/client final-message delivery: preserve terminal assistant text snapshots before resolving `end_turn`, so ACP clients no longer drop the last visible reply when the gateway sends the final message body on the terminal chat event. (#17615) Thanks @pjeby.
+- Telegram/Discord status reactions: show a temporary compacting reaction during auto-compaction pauses and restore thinking afterward so the bot no longer appears frozen while context is being compacted. (#35474) thanks @Cypherm.
+- Delivery/dedupe: trim completed direct-cron delivery cache correctly and keep mirrored transcript dedupe active even when transcript files contain malformed lines. (#44666) thanks @frankekn.
+- CLI/thinking help: add the missing `xhigh` level hints to `openclaw cron add`, `openclaw cron edit`, and `openclaw agent` so the help text matches the levels already accepted at runtime. (#44819) Thanks @kiki830621.
+- Agents/Anthropic replay: drop replayed assistant thinking blocks for native Anthropic and Bedrock Claude providers so persisted follow-up turns no longer fail on stored thinking blocks. (#44843) Thanks @jmcte.
+- Docs/Brave pricing: escape literal dollar signs in Brave Search cost text so the docs render the free credit and per-request pricing correctly. (#44989) Thanks @keelanfh.
+- Feishu/file uploads: preserve literal UTF-8 filenames in `im.file.create` so Chinese and other non-ASCII filenames no longer appear percent-encoded in chat. (#34262) Thanks @fabiaodemianyang and @KangShuaiFu.
+- Agents/compaction safeguard: trim large kept `toolResult` payloads consistently for budgeting, pruning, and identifier seeding, then restore preserved payloads after prune so oversized safeguard summaries stay stable. (#44133) thanks @SayrWolfridge.
+- Agents/Ollama overflow: rewrite Ollama `prompt too long` API payloads through the normal context-overflow sanitizer so embedded sessions keep the friendly overflow copy and auto-compaction trigger. (#34019) thanks @lishuaigit.
+
+- Control UI/auth: restore one-time legacy `?token=` imports for shared Control UI links while keeping `#token=` preferred, and carry pending query tokens through gateway URL confirmation so compatibility links still authenticate after confirmation. (#43979) Thanks @stim64045-spec.
+- Plugins/context engines: retry legacy lifecycle calls once without `sessionKey` when older plugins reject that field, memoize legacy mode after the first strict-schema fallback, and preserve non-compat runtime errors without retry. (#44779) thanks @hhhhao28.
+- Agents/compaction: treat markup-wrapped heartbeat boilerplate as non-meaningful session history when deciding whether to compact, so heartbeat-only sessions no longer keep compaction alive due to wrapper formatting. (#42119) thanks @samzong.
+
diff --git a/CHANGELOG/2026.3.13.md b/CHANGELOG/2026.3.13.md
new file mode 100644
index 0000000000000000000000000000000000000000..fb1622eed5ed1007a658b13b0566ed59ed45a898
--- /dev/null
+++ b/CHANGELOG/2026.3.13.md
@@ -0,0 +1,81 @@
+## 2026.3.13
+
+### Changes
+
+- Android/chat settings: redesign the chat settings sheet with grouped device and media sections, refresh the Connect and Voice tabs, and tighten the chat composer/session header for a denser mobile layout. (#44894) Thanks @obviyus.
+- iOS/onboarding: add a first-run welcome pager before gateway setup, stop auto-opening the QR scanner, and show `/pair qr` instructions on the connect step. (#45054) Thanks @ngutman.
+- Browser/existing-session: add an official Chrome DevTools MCP attach mode for signed-in live Chrome sessions, with docs for `chrome://inspect/#remote-debugging` enablement and direct backlinks to Chrome's own setup guides (#57018). Thanks @hydro13.
+- Browser/agents: add built-in `profile="user"` for the logged-in host browser and `profile="chrome-relay"` for the extension relay, so agent browser calls can prefer the real signed-in browser without the extra `browserSession` selector.
+- Browser/act automation: add batched actions, selector targeting, and delayed clicks for browser act requests with normalized batch dispatch. Thanks @vincentkoc.
+- Docker/timezone override: add `OPENCLAW_TZ` so `docker-setup.sh` can pin gateway and CLI containers to a chosen IANA timezone instead of inheriting the daemon default. (#34119) Thanks @Lanfei.
+- Dependencies/pi: bump `@mariozechner/pi-agent-core`, `@mariozechner/pi-ai`, `@mariozechner/pi-coding-agent`, and `@mariozechner/pi-tui` to `0.58.0`.
+- Cron/sessions: add `sessionTarget: "current"` and `session:<id>` support so cron jobs can bind to the creating session or a persistent named session instead of only `main` or `isolated`. Thanks @kkhomej33-netizen and @ImLukeF.
+- Telegram/message send: add `--force-document` so Telegram image and GIF sends can upload as documents without compression. (#45111) Thanks @thepagent.
+
+### Fixes
+
+- Dashboard/chat UI: stop reloading full chat history on every live tool result in dashboard v2 so tool-heavy runs no longer trigger UI freeze/re-render storms while the final event still refreshes persisted history. (#45541) Thanks @BunsDev.
+- Gateway/client requests: reject unanswered gateway RPC calls after a bounded timeout and clear their pending state, so stalled connections no longer leak hanging `GatewayClient.request()` promises indefinitely (#45689). Thanks @Takhoffman.
+- Build/plugin-sdk bundling: bundle plugin-sdk subpath entries in one shared build pass so published packages stop duplicating shared chunks and avoid the recent plugin-sdk memory blow-up. (#45426) Thanks @TarasShyn.
+- Ollama/reasoning visibility: stop promoting native `thinking` and `reasoning` fields into final assistant text so local reasoning models no longer leak internal thoughts in normal replies. (#45330) Thanks @xi7ang.
+- Android/onboarding QR scan: switch setup QR scanning to Google Code Scanner so onboarding uses a more reliable scanner instead of the legacy embedded ZXing flow. (#45021) Thanks @obviyus.
+- Browser/existing-session: harden driver validation and session lifecycle so transport errors trigger reconnects while tool-level errors preserve the session, and extract shared ARIA role sets to deduplicate Playwright and Chrome MCP snapshot paths. (#45682) Thanks @odysseus0.
+- Browser/existing-session: accept text-only `list_pages` and `new_page` responses from Chrome DevTools MCP so live-session tab discovery and new-tab open flows keep working when the server omits structured page metadata.
+- Control UI/insecure auth: preserve explicit shared token and password auth on plain-HTTP Control UI connects so LAN and reverse-proxy sessions no longer drop shared auth before the first WebSocket handshake. (#45088) Thanks @velvet-shark.
+- Gateway/session reset: preserve `lastAccountId` and `lastThreadId` across gateway session resets so replies keep routing back to the same account and thread after `/reset`. (#44773) Thanks @Lanfei.
+- macOS/onboarding: avoid self-restarting freshly bootstrapped launchd gateways and give new daemon installs longer to become healthy, so `openclaw onboard --install-daemon` no longer false-fails on slower Macs and fresh VM snapshots.
+- Gateway/status: add `openclaw gateway status --require-rpc` and clearer Linux non-interactive daemon-install failure reporting so automation can fail hard on probe misses instead of treating a printed RPC error as green.
+- macOS/exec approvals: respect per-agent exec approval settings in the gateway prompter, including allowlist fallback when the native prompt cannot be shown, so gateway-triggered `system.run` requests follow configured policy instead of always prompting or denying unexpectedly. (#13707) Thanks @sliekens.
+- Telegram/media downloads: thread the same direct or proxy transport policy into SSRF-guarded file fetches so inbound attachments keep working when Telegram falls back between env-proxy and direct networking. (#44639) Thanks @obviyus.
+- Telegram/inbound media IPv4 fallback: retry SSRF-guarded Telegram file downloads once with the same IPv4 fallback policy as Bot API calls so fresh installs on IPv6-broken hosts no longer fail to download inbound images.
+- Commands/onboarding: split static auth-choice help from the plugin-backed onboarding catalog so `openclaw onboard` registration no longer pulls provider-wizard imports just to describe `--auth-choice`. (#47545) Thanks @vincentkoc.
+- Windows/gateway install: bound `schtasks` calls and fall back to the Startup-folder login item when task creation hangs, so native `openclaw gateway install` fails fast instead of wedging forever on broken Scheduled Task setups (#44691). Thanks @jalehman.
+- Windows/gateway stop: resolve Startup-folder fallback listeners from the installed `gateway.cmd` port, so `openclaw gateway stop` now actually kills fallback-launched gateway processes before restart.
+- Windows/gateway status: reuse the installed service command environment when reading runtime status, so startup-fallback gateways keep reporting the configured port and running state in `gateway status --json` instead of falling back to `gateway port unknown`.
+- Windows/gateway auth: stop attaching device identity on local loopback shared-token and password gateway calls, so native Windows agent replies no longer log stale `device signature expired` fallback noise before succeeding.
+- Discord/gateway startup: treat plain-text and transient `/gateway/bot` metadata fetch failures as transient startup errors so Discord gateway boot no longer crashes on unhandled rejections. (#44397) Thanks @jalehman.
+- Slack/probe: keep `auth.test()` bot and team metadata mapping stable while simplifying the probe result path. (#44775) Thanks @Cafexss.
+- Dashboard/chat UI: render oversized plain-text replies as normal paragraphs instead of capped gray code blocks, so long desktop chat responses stay readable without tab-switching refreshes.
+- Dashboard/chat UI: restore the `chat-new-messages` class on the New messages scroll pill so the button uses its existing compact styling instead of rendering as a full-screen SVG overlay. (#44856) Thanks @Astro-Han.
+- Gateway/Control UI: restore the operator-only device-auth bypass and classify browser connect failures so origin and device-identity problems no longer show up as auth errors in the Control UI and web chat. (#45512) thanks @sallyom.
+- macOS/voice wake: stop crashing wake-word command extraction when speech segment ranges come from a different transcript instance.
+- Discord/allowlists: honor raw `guild_id` when hydrated guild objects are missing so allowlisted channels and threads like `#maintainers` no longer get false-dropped before channel allowlist checks.
+- macOS/runtime locator: require Node >=22.16.0 during macOS runtime discovery so the app no longer accepts Node versions that the main runtime guard rejects later. Thanks @sumleo.
+- Agents/custom providers: preserve blank API keys for loopback OpenAI-compatible custom providers by clearing the synthetic Authorization header at runtime, while keeping explicit apiKey and oauth/token config from silently downgrading into fake bearer auth. (#45631) Thanks @xinhuagu.
+- Models/google-vertex Gemini flash-lite normalization: apply existing bare-ID preview normalization to `google-vertex` model refs and provider configs so `google-vertex/gemini-3.1-flash-lite` resolves as `gemini-3.1-flash-lite-preview`. (#42435) thanks @scoootscooob.
+- iMessage/remote attachments: reject unsafe remote attachment paths before spawning SCP, so sender-controlled filenames can no longer inject shell metacharacters into remote media staging. Thanks @lintsinghua.
+- Telegram/webhook auth: validate the Telegram webhook secret before reading or parsing request bodies, so unauthenticated requests are rejected immediately instead of consuming up to 1 MB first. Thanks @space08.
+- Security/device pairing: make bootstrap setup codes single-use so pending device pairing requests cannot be silently replayed and widened to admin before approval. Thanks @tdjackey.
+- Security/external content: strip zero-width and soft-hyphen marker-splitting characters during boundary sanitization so spoofed `EXTERNAL_UNTRUSTED_CONTENT` markers fall back to the existing hardening path instead of bypassing marker normalization.
+- CLI/startup: stop `openclaw devices list` and similar loopback gateway commands from failing during startup by isolating heavy import-time side effects from the normal CLI path. (#50212) Thanks @obviyus.
+- Security/exec approvals: unwrap more `pnpm` runtime forms during approval binding, including `pnpm --reporter .. exec` and direct `pnpm node` file runs, with matching regression coverage and docs updates.
+- Security/exec approvals: fail closed for Perl `-M` and `-I` approval flows so preload and load-path module resolution stays outside approval-backed runtime execution unless the operator uses a broader explicit trust path.
+- Security/exec approvals: recognize PowerShell `-File` and `-f` wrapper forms during inline-command extraction so approval and command-analysis paths treat file-based PowerShell launches like the existing `-Command` variants.
+- Security/exec approvals: unwrap `env` dispatch wrappers inside shell-segment allowlist resolution on macOS so `env FOO=bar /path/to/bin` resolves against the effective executable instead of the wrapper token.
+- Security/exec approvals: treat backslash-newline as shell line continuation during macOS shell-chain parsing so line-continued `$(` substitutions fail closed instead of slipping past command-substitution checks.
+- Security/exec approvals: bind macOS skill auto-allow trust to both executable name and resolved path so same-basename binaries no longer inherit trust from unrelated skill bins.
+- Cron/isolated sessions: route nested cron-triggered embedded runner work onto the nested lane so isolated cron jobs no longer deadlock when compaction or other queued inner work runs. Thanks @vincentkoc.
+- Agents/OpenAI-compatible compat overrides: respect explicit user `models[].compat` opt-ins for non-native `openai-completions` endpoints so usage-in-streaming capability overrides no longer get forced off when the endpoint actually supports them. (#44432) Thanks @cheapestinference.
+- Agents/Azure OpenAI startup prompts: rephrase the built-in `/new`, `/reset`, and post-compaction startup instruction so Azure OpenAI deployments no longer hit HTTP 400 false positives from the content filter. (#43403) Thanks @xingsy97.
+- Agents/compaction: compare post-compaction token sanity checks against full-session pre-compaction totals and skip the check when token estimation fails, so sessions with large bootstrap context keep real token counts instead of falling back to unknown. (#28347) thanks @efe-arv.
+- Agents/compaction: preserve safeguard compaction summary language continuity via default and configurable custom instructions so persona drift is reduced after auto-compaction. (#10456) Thanks @keepitmello.
+- Agents/tool warnings: distinguish gated core tools like `apply_patch` from plugin-only unknown entries in `tools.profile` warnings, so unavailable core tools now report current runtime/provider/model/config gating instead of suggesting a missing plugin.
+- Config/validation: accept documented `agents.list[].params` per-agent overrides in strict config validation so `openclaw config validate` no longer rejects runtime-supported `cacheRetention`, `temperature`, and `maxTokens` settings. (#41171) Thanks @atian8179.
+- Config/web fetch: restore runtime validation for documented `tools.web.fetch.readability` and `tools.web.fetch.firecrawl` settings so valid web fetch configs no longer fail with unrecognized-key errors. (#42583) Thanks @stim64045-spec.
+- Signal/config validation: add `channels.signal.groups` schema support so per-group `requireMention`, `tools`, and `toolsBySender` overrides no longer get rejected during config validation. (#27199) Thanks @unisone.
+- Config/discovery: accept `discovery.wideArea.domain` in strict config validation so unicast DNS-SD gateway configs no longer fail with an unrecognized-key error. (#35615) Thanks @ingyukoh.
+- Telegram/media errors: redact Telegram file URLs before building media fetch errors so failed inbound downloads do not leak bot tokens into logs. Thanks @space08.
+- Agents/failover: normalize abort-wrapped `429 RESOURCE_EXHAUSTED` provider failures before abort short-circuiting so wrapped Google/Vertex rate limits continue across configured fallback models, including the embedded runner prompt-error path. (#39820) Thanks @lupuletic.
+- Mattermost/thread routing: non-inbound reply paths (TUI/WebUI turns, tool-call callbacks, subagent responses) now correctly route to the originating Mattermost thread when `replyToMode: "all"` is active; also prevents stale `origin.threadId` metadata from resurrecting cleared thread routes. (#44283) thanks @teconomix
+- Gateway/websocket pairing bypass for disabled auth: skip device-pairing enforcement when `gateway.auth.mode=none` so Control UI connections behind reverse proxies no longer get stuck on `pairing required` (code 1008) despite auth being explicitly disabled. (#42931) Thanks @odysseus0.
+- Auth/login lockout recovery: clear stale `auth_permanent` and `billing` disabled state for all profiles matching the target provider when `openclaw models auth login` is invoked, so users locked out by expired or revoked OAuth tokens can recover by re-authenticating instead of waiting for the cooldown timer to expire. (#43057) Thanks @ademczuk.
+- Auto-reply/context-engine compaction: persist the exact embedded-run metadata compaction count for main and followup runner session accounting, so metadata-only auto-compactions no longer undercount multi-compaction runs. (#42629) thanks @uf-hy.
+- Auth/Codex CLI reuse: sync reused Codex CLI credentials into the supported `openai-codex:default` OAuth profile instead of reviving the deprecated `openai-codex:codex-cli` slot, so doctor cleanup no longer loops. (#45353) thanks @Gugu-sugar.
+- Deps/audit: bump the pinned `fast-xml-parser` override to the first patched release so `pnpm audit --prod --audit-level=high` no longer fails on the AWS Bedrock XML builder path. Thanks @vincentkoc.
+- Hooks/after_compaction: forward `sessionFile` for direct/manual compaction events and add `sessionFile` plus `sessionKey` to wired auto-compaction hook context so plugins receive the session metadata already declared in the hook types. (#40781) Thanks @jarimustonen.
+- Sessions/BlueBubbles/cron: persist outbound session routing and transcript mirroring for new targets, auto-create BlueBubbles chats before attachment sends, and only suppress isolated cron deliveries when the run started hours late instead of merely finishing late. (#50092) Thanks @tyler6204.
+
+### Breaking
+
+- **BREAKING:** Agents now load at most one root memory bootstrap file. `MEMORY.md` wins; `memory.md` is only used when `MEMORY.md` is absent. If you intentionally kept both files and depended on both being injected, merge them before upgrade. This also fixes duplicate memory injection on case-insensitive Docker mounts. (#26054) Thanks @Lanfei.
+
diff --git a/CHANGELOG/2026.3.22.md b/CHANGELOG/2026.3.22.md
new file mode 100644
index 0000000000000000000000000000000000000000..35025a8e2ab4e1e951ed7359da9c896bed5bfd07
--- /dev/null
+++ b/CHANGELOG/2026.3.22.md
@@ -0,0 +1,314 @@
+## 2026.3.22
+
+### Breaking
+
+- Plugins/install: bare `openclaw plugins install <package>` now prefers ClawHub before npm for npm-safe names, and only falls back to npm when ClawHub does not have that package or version. Docs: https://docs.openclaw.ai/tools/clawhub.
+- Browser/Chrome MCP: remove the legacy Chrome extension relay path, bundled extension assets, `driver: "extension"`, and `browser.relayBindHost`. Run `openclaw doctor --fix` to migrate host-local browser config to `existing-session` / `user`; Docker, headless, sandbox, and remote browser flows still use raw CDP. Docs: https://docs.openclaw.ai/gateway/doctor and https://docs.openclaw.ai/tools/browser (#47893) Thanks @vincentkoc.
+- Tools/image generation: standardize the stock image create/edit path on the core `image_generate` tool. The old `nano-banana-pro` docs/examples are gone; if you previously copied that sample-skill config, switch to `agents.defaults.imageGenerationModel` for built-in image generation or install a separate third-party skill explicitly.
+- Skills/image generation: remove the bundled `nano-banana-pro` skill wrapper. Use `agents.defaults.imageGenerationModel.primary: "google/gemini-3-pro-image-preview"` for the native Nano Banana-style path instead.
+- Plugins/SDK: the new public plugin SDK surface is `openclaw/plugin-sdk/*`; `openclaw/extension-api` is removed with no compatibility shim. Bundled plugins must use injected runtime for host-side operations (for example `api.runtime.agent.runEmbeddedPiAgent`) and any remaining direct imports must come from narrow `openclaw/plugin-sdk/*` subpaths instead of the monolithic SDK root. Docs: https://docs.openclaw.ai/plugins/sdk-migration and https://docs.openclaw.ai/plugins/sdk-overview.
+- Plugins/message discovery: require `ChannelMessageActionAdapter.describeMessageTool(...)` for shared `message` tool discovery. The legacy `listActions`, `getCapabilities`, and `getToolSchema` adapter methods are removed. Plugin authors should migrate message discovery to `describeMessageTool(...)` and keep channel-specific action runtime code inside the owning plugin package. Thanks @gumadeiras.
+- Plugins/Matrix: add a new Matrix plugin backed by the official `matrix-js-sdk`. If you are upgrading from the previous public Matrix plugin, follow the migration guide: https://docs.openclaw.ai/install/migrating-matrix Thanks @gumadeiras.
+- Config/env: remove legacy `CLAWDBOT_*` and `MOLTBOT_*` compatibility env names across runtime, installers, and test tooling. Use the matching `OPENCLAW_*` env names instead.
+- Config/state: remove legacy `.moltbot` state-dir and `moltbot.json` auto-detection/migration fallback. If you still keep state under `~/.moltbot`, move it to `~/.openclaw` or set `OPENCLAW_STATE_DIR` / `OPENCLAW_CONFIG_PATH` explicitly. Docs: https://docs.openclaw.ai/install/migrating and https://docs.openclaw.ai/start/getting-started.
+- Exec/env sandbox: block build-tool JVM injection (`MAVEN_OPTS`, `SBT_OPTS`, `GRADLE_OPTS`, `ANT_OPTS`), glibc tunable exploitation (`GLIBC_TUNABLES`), and .NET dependency resolution hijack (`DOTNET_ADDITIONAL_DEPS`) from the host exec environment, and restrict Gradle init script redirect (`GRADLE_USER_HOME`) as an override-only block so user-configured Gradle homes still propagate. (#49702).
+- Discord/commands: switch native command deployment to Carbon reconcile by default so Discord restarts stop churning slash commands through OpenClaw's local deploy path. (#46597) Thanks @huntharo and @thewilloftheshadow.
+- Security/exec approvals: treat `time` as a transparent dispatch wrapper during allowlist evaluation and allow-always persistence so approved `time ...` commands bind the inner executable instead of the wrapper path. Thanks @YLChen-007 for reporting.
+- Voice-call/webhooks: reject missing provider signature headers before body reads, drop the pre-auth body budget to `64 KB` / `5s`, and cap concurrent pre-auth requests per source IP so unauthenticated callers cannot force the old `1 MB` / `30s` buffering path. Thanks @SEORY0 for reporting.
+- Plugins/Matrix: stop mention-gated or otherwise dropped room chatter from refreshing focused thread bindings before the message is actually routed, so idle ACP and session bindings can still expire normally in mention-required rooms. Thanks @vincentkoc, @dinakars777 and @mvanhorn.
+- Plugins/Matrix: durably dedupe inbound room events across gateway restarts so previously handled Matrix messages are not replayed as new, while preserving clean-restart backlog delivery for unseen events. (#50922) thanks @gumadeiras.
+- Agents/media replies: migrate the remaining browser, canvas, and nodes snapshot outputs onto `details.media` so generated media keeps attaching to assistant replies after the collect-then-attach refactor. (#51731) Thanks @christianklotz.
+- Android/contacts search: escape literal `%` and `_` in contact-name queries so searches like `100%` or `_id` no longer match unrelated contacts through SQL `LIKE` wildcards. (#41891) Thanks @Kaneki-x.
+- Gateway/usage: include reset and deleted archived session transcripts in usage totals, session discovery, and archived-only session detail fallback so the Usage view no longer undercounts rotated sessions. (#43215) Thanks @rcrick.
+
+### Changes
+
+- ClawHub/install: add native `openclaw skills search|install|update` flows plus `openclaw plugins install clawhub:<package>` with tracked update metadata, gateway skill-install/update support for ClawHub-backed requests, and regression coverage/docs for the new source path.
+- Plugins/marketplaces: add Claude marketplace registry resolution, `plugin@marketplace` installs, marketplace listing, and update support, plus Docker E2E coverage for local and official marketplace flows. (#48058) Thanks @vincentkoc.
+- Commands/plugins: add owner-gated `/plugins` and `/plugin` chat commands for plugin list/show and enable/disable flows, alongside explicit `commands.plugins` config gating. Thanks @vincentkoc.
+- Install/update: allow package-manager installs from GitHub `main` via `openclaw update --tag main`, installer `--version main`, or direct npm/pnpm git specs. (#47630) Thanks @vincentkoc.
+- Plugins/bundles: add compatible Codex, Claude, and Cursor bundle discovery/install support, map bundle skills into OpenClaw skills, and apply Claude bundle `settings.json` defaults to embedded Pi with shell overrides sanitized.
+- CLI/hooks: route hook-pack install and update through `openclaw plugins`, keep `openclaw hooks` focused on hook visibility and per-hook controls, and show plugin-managed hook details in CLI output.
+- Models/OpenAI: switch the default OpenAI setup model to `openai/gpt-5.4`, keep Codex on `openai-codex/gpt-5.4`, and centralize OpenAI chat, image, TTS, transcription, and embedding defaults in one shared module so future default-model updates stay low-churn. Thanks @vincentkoc.
+- Agents: add per-agent thinking/reasoning/fast defaults and auto-revert disallowed model overrides to the agent's default selection. Thanks @xuanmingguo and @vincentkoc.
+- Commands/btw: add `/btw` side questions for quick tool-less answers about the current session without changing future session context, with dismissible in-session TUI answers and explicit BTW replies on external channels. (#45444) Thanks @ngutman.
+- Sandbox/runtime: add pluggable sandbox backends, ship an OpenShell backend with `mirror` and `remote` workspace modes, and make sandbox list/recreate/prune backend-aware instead of Docker-only.
+- Sandbox/SSH: add a core SSH sandbox backend with secret-backed key, certificate, and known_hosts inputs, move shared remote exec/filesystem tooling into core, and keep OpenShell focused on sandbox lifecycle plus optional `mirror` mode.
+- Browser/existing-session: support `browser.profiles.<name>.userDataDir` so Chrome DevTools MCP can attach to Brave, Edge, and other Chromium-based browsers through their own user data directories. (#48170) Thanks @velvet-shark.
+- Plugins/bundles: make enabled bundle MCP servers expose runnable tools in embedded Pi, and default relative bundle MCP launches to the bundle root so marketplace bundles like Context7 work through Pi instead of stopping at config import.
+- Plugins/providers: move OpenRouter, GitHub Copilot, and OpenAI Codex provider/runtime logic into bundled plugins, including dynamic model fallback, runtime auth exchange, stream wrappers, capability hints, and cache-TTL policy.
+- Models/Anthropic Vertex: add core `anthropic-vertex` provider support for Claude via Google Vertex AI, including GCP auth/discovery and main run-path routing. (#43356) Thanks @sallyom and @yossiovadia.
+- Plugins/Chutes: add a bundled Chutes provider with plugin-owned OAuth/API-key auth, dynamic model discovery, and default-on extension wiring. (#41416) Thanks @Veightor.
+- Web tools/Exa: add Exa as a bundled web-search plugin with Exa-native date filters, search-mode selection, and optional content extraction under `plugins.entries.exa.config.webSearch.*`. Thanks @V-Gutierrez and @vincentkoc.
+- Web tools/Tavily: add Tavily as a bundled web-search provider with dedicated `tavily_search` and `tavily_extract` tools, using canonical plugin-owned config under `plugins.entries.tavily.config.webSearch.*`. (#49200) thanks @lakshyaag-tavily.
+- Web tools/Firecrawl: add Firecrawl as an `onboard`/configure search provider via a bundled plugin, expose explicit `firecrawl_search` and `firecrawl_scrape` tools, and align core `web_fetch` fallback behavior with Firecrawl base-URL/env fallback plus guarded endpoint fetches.
+- Models/OpenAI: add native forward-compat support for `gpt-5.4-mini` and `gpt-5.4-nano` in the OpenAI provider catalog, runtime resolution, and reasoning capability gates. Thanks @vincentkoc.
+- Control UI/chat: add an expand-to-canvas button on assistant chat bubbles and in-app session navigation from Sessions and Cron views. Thanks @BunsDev.
+- Control UI/appearance: unify theme border radii across Claw, Knot, and Dash, and add a Roundness slider to the Appearance settings so users can adjust corner radius from sharp to fully rounded. Thanks @BunsDev.
+- Control UI/usage: improve usage overview styling, localization, and responsive chat/context-notice presentation, including safer theme color handling and unclipped usage-header menus. (#51951) Thanks @BunsDev.
+- Control UI/usage: drop the empty session-detail placeholder card so the usage view stays single-column until a real session detail panel is selected. (#52013) Thanks @BunsDev.
+- Android/mobile: add a system-aware dark theme across onboarding and post-onboarding screens so the app follows the device theme through setup, chat, and voice flows. (#46249) Thanks @sibbl.
+- Android/Talk: move Talk speech synthesis behind gateway `talk.speak`, keep Talk secrets on the gateway, and switch Android playback to final-response audio instead of device-local ElevenLabs streaming. (#50849).
+- Android/nodes: add `callLog.search` plus shared Call Log permission wiring so Android nodes can search recent call history through the gateway. (#44073) Thanks @lixuankai.
+- Android/nodes: add `sms.search` plus shared SMS permission wiring so Android nodes can search device text messages through the gateway. (#48299) Thanks @lixuankai.
+- Telegram/apiRoot: add per-account custom Bot API endpoint support across send, probe, setup, doctor repair, and inbound media download paths so proxied or self-hosted Telegram deployments work end to end. (#48842) Thanks @Cypherm.
+- Telegram/topics: auto-rename DM forum topics on first message with LLM-generated labels, with per-account and per-DM `autoTopicLabel` overrides. (#51502) Thanks @Lukavyi.
+- Telegram/actions: add `topic-edit` for forum-topic renames and icon updates while sharing the same Telegram topic-edit transport used by the plugin runtime. (#47798) Thanks @obviyus.
+- Telegram/error replies: add a default-off `channels.telegram.silentErrorReplies` setting so bot error replies can be delivered silently across regular replies, native commands, and fallback sends. (#19776) Thanks @ImLukeF.
+- Feishu/cards: add structured interactive approval and quick-action launcher cards, preserve callback user and conversation context through routing, and keep legacy card-action fallback behavior so common actions can run without typing raw commands. (#47873) Thanks @Takhoffman.
+- Feishu/ACP: add current-conversation ACP and subagent session binding for supported DMs and topic conversations, including completion delivery back to the originating Feishu conversation. (#46819) Thanks @Takhoffman.
+- Feishu/streaming: add `onReasoningStream` and `onReasoningEnd` support to streaming cards, so `/reasoning stream` renders thinking tokens as markdown blockquotes in the same card - matching the Telegram channel's reasoning lane behavior. (#46029) Thanks @day253.
+- Feishu/cards: add identity-aware structured card headers and note footers for Feishu replies and direct sends, while keeping that presentation wired through the shared outbound identity path. (#29938) Thanks @nszhsl.
+- Plugins/Matrix: add `allowBots` room policy so configured Matrix bot accounts can talk to each other, with optional mention-only gating. Thanks @gumadeiras.
+- Plugins/Matrix: add per-account `allowPrivateNetwork` opt-in for private/internal homeservers, while keeping public cleartext homeservers blocked. Thanks @gumadeiras.
+- Plugins/MiniMax: add MiniMax-M2.7 and MiniMax-M2.7-highspeed models and update the default model from M2.5 to M2.7. (#49691) Thanks @liyuan97.
+- MiniMax/fast mode: map shared `/fast` and `params.fastMode` to MiniMax `-highspeed` models for M2.1, M2.5, and M2.7 API-key and OAuth runs. Thanks @vincentkoc.
+- Models/MiniMax defaults: raise bundled MiniMax M2.5/M2.7 context-window, max-token, and pricing metadata to the higher defaults shipped by the current upstream Pi SDK. Thanks @vincentkoc.
+- Models/MiniMax: add bundled `MiniMax-M2`, `MiniMax-M2.1`, and `MiniMax-M2.1-highspeed` catalog entries so OpenClaw's provider metadata and OAuth aliases stay aligned with the current upstream Pi SDK. Thanks @vincentkoc.
+- Plugins/MiniMax: merge the bundled MiniMax API and MiniMax OAuth plugin surfaces into a single default-on `minimax` plugin, while keeping legacy `minimax-portal-auth` config ids aliased for compatibility.
+- Agents/Pi compatibility: align OpenClaw's bundled MiniMax runtime behavior with the current upstream Pi 0.61.1 release so embedded runs stay in sync with the latest published Pi SDK semantics. Thanks @vincentkoc.
+- Models/GitHub Copilot: allow forward-compat dynamic model ids without code updates, while preserving configured provider and per-model overrides for those synthetic models. (#51325) Thanks @fuller-stack-dev.
+- xAI/models: sync the bundled Grok catalog to current Pi-backed IDs, limits, and pricing metadata, while keeping older Grok fast and 4.20 aliases resolving cleanly at runtime. Thanks @vincentkoc.
+- xAI/fast mode: map shared `/fast` and `params.fastMode` to the current xAI Grok fast model family so direct Grok runs can opt into the faster Pi-backed variants. Thanks @vincentkoc.
+- CLI/config: expand `config set` with SecretRef and provider builder modes, JSON/batch assignment support, and `--dry-run` validation with structured JSON output. (#49296) Thanks @joshavant.
+- Z.AI/models: sync the bundled GLM catalog to current Pi metadata, including newer 4.5/4.6 model families, updated multimodal entries, and current pricing and token limits. Thanks @vincentkoc.
+- Mistral/models: sync the bundled default Mistral metadata to current Pi pricing so the built-in default no longer advertises zero-cost usage. Thanks @vincentkoc.
+- Plugins/Xiaomi: switch the bundled Xiaomi provider to the `/v1` OpenAI-compatible endpoint and add MiMo V2 Pro plus MiMo V2 Omni to the built-in catalog. (#49214) thanks @DJjjjhao.
+- Agents/compaction: notify users when followup auto-compaction starts and finishes, keeping those notices out of TTS and preserving reply threading for the real assistant reply. (#38805) Thanks @zidongdesign.
+- Memory/plugins: let the active memory plugin register its own system-prompt section while preserving cache-clear and snapshot-load prompt isolation. (#40126) Thanks @jarimustonen.
+- Gateway/health monitor: add configurable stale-event thresholds and restart limits, plus per-channel and per-account `healthMonitor.enabled` overrides, while keeping the existing global disable path on `gateway.channelHealthCheckMinutes=0`. (#42107) Thanks @rstar327.
+- Plugins/agent integrations: broaden the plugin surface for app-server integrations with channel-aware commands, interactive callbacks, inbound claims, and Discord/Telegram conversation binding support. (#45318) Thanks @huntharo and @vincentkoc.
+- Plugins/binding: add `onConversationBindingResolved(...)` so plugins can react immediately after bind approvals or denies without blocking channel interaction acknowledgements. (#48678) Thanks @huntharo.
+- Plugins/context engines: expose `delegateCompactionToRuntime(...)` on the public plugin SDK, refactor the legacy engine to use the shared helper, and clarify `ownsCompaction` delegation semantics for non-owning engines. (#49061) Thanks @jalehman.
+- Plugins/context engines: pass the embedded runner `modelId` into context-engine `assemble()` so plugins can adapt context formatting per model. (#47437) thanks @jscianna.
+- Plugins/context engines: add transcript maintenance rewrites for context engines, preserve active-branch transcript metadata during rewrites, and harden overflow-recovery truncation to rewrite sessions under the normal session write lock. (#51191) Thanks @jalehman.
+- Skills/prompt budget: preserve all registered skills via a compact catalog fallback before dropping entries when the full prompt format exceeds `maxSkillsPromptChars`. (#47553) Thanks @snese.
+- Hooks/workspace: keep repo-local `<workspace>/hooks` disabled until explicitly enabled, block workspace hook name collisions from shadowing bundled/managed/plugin hooks, and treat `hooks.internal.load.extraDirs` as trusted managed hook sources.
+- Security/plugins: reject remote marketplace manifest entries that expand installation outside the cloned marketplace repo, including external git/GitHub sources, HTTP archives, and absolute paths.
+- Gateway/docs: clarify that empty URL input allowlists are treated as unset, document `allowUrl: false` as the deny-all switch, and add regression coverage for the normalization path.
+- secrets: harden read-only SecretRef command paths and diagnostics. (#47794) Thanks @joshavant.
+- Scope message SecretRef resolution and harden doctor/status paths. (#48728) Thanks @joshavant.
+- Build/memory tools: emit `dist/cli/memory-cli.js` as a stable core entry so runtime `memory_search` loading no longer depends on hashed `memory-cli-*` bundle names. (#51759) Thanks @oliviareid-svg.
+- Plugins/testing: add a public `openclaw/plugin-sdk/testing` surface for plugin-author test helpers, and move bundled-plugin-only test bridges into private repo test helpers.
+- Agents/steering docs: update embedded Pi steering docs and runner comments for the current upstream behavior, where queued steering is injected after the active assistant turn finishes its tool calls instead of skipping the remaining tools mid-turn. Thanks @vincentkoc.
+- Doctor/refactor: start splitting doctor provider checks into `src/commands/doctor/providers/*` by extracting Telegram first-run and group allowlist warnings into a provider-specific module, keeping the current setup guidance and warning behavior intact. Thanks @vincentkoc.
+- Refactor/channels: remove the legacy channel shim directories and point channel-specific imports directly at the extension-owned implementations. (#45967) Thanks @scoootscooob.
+- Docs/Zalo: clarify the Marketplace-bot support matrix and config guidance so the Zalo channel docs match current Bot Creator behavior more closely. (#47552) Thanks @No898.
+- Docs/plugins: add the community DingTalk plugin listing to the docs catalog. (#29913) Thanks @sliverp.
+- Docs/plugins: add the community QQbot plugin listing to the docs catalog. (#29898) Thanks @sliverp.
+- Docs/plugins: add the community wecom plugin listing to the docs catalog. (#29905) Thanks @sliverp.
+
+### Fixes
+
+- Web tools/search provider lists: keep onboarding, configure, and docs provider lists alphabetical while preserving the separate runtime auto-detect precedence used for credential-based provider selection.
+- Media/Windows security: block remote-host `file://` media URLs and UNC/network paths before local filesystem resolution in core media loading and adjacent prompt/sandbox attachment seams, so the next release no longer allows structured local-media inputs to trigger outbound SMB credential handshakes on Windows. Thanks @RacerZ-fighting for reporting.
+- Gateway/discovery: fail closed on unresolved Bonjour and DNS-SD service endpoints in CLI discovery, onboarding, and `gateway status` so TXT-only hints can no longer steer routing or SSH auto-target selection. Thanks @nexrin for reporting.
+- Security/pairing: bind iOS setup codes to the intended node profile and reject first-use bootstrap redemption that asks for broader roles or scopes. Thanks @tdjackey.
+- Memory/core tools: register `memory_search` and `memory_get` independently so one unavailable memory tool no longer suppresses the other in new sessions. (#50198) Thanks @artwalker.
+- Web tools/Exa: align the bundled Exa plugin with the current Exa API by supporting newer search types and richer `contents` options, while fixing the result-count cap to honor Exa's higher limit. Thanks @vincentkoc.
+- Plugins/Matrix: move bundled plugin `KeyedAsyncQueue` imports onto the stable `plugin-sdk/core` surface so Matrix Docker/runtime builds do not depend on the brittle keyed-async-queue subpath. Thanks @ecohash-co and @vincentkoc.
+- Nostr/security: enforce inbound DM policy before decrypt, route Nostr DMs through the standard reply pipeline, and add pre-crypto rate and size guards so unknown senders cannot bypass pairing or force unbounded crypto work. Thanks @kuranikaran.
+- Synology Chat/security: keep reply delivery bound to stable numeric `user_id` by default, and gate mutable username/nickname recipient lookup behind `dangerouslyAllowNameMatching` with new regression coverage. Thanks @nexrin.
+- Agents/default timeout: raise the shared default agent timeout from `600s` to `48h` so long-running ACP and agent sessions do not fail unless you configure a shorter limit (#52668). Thanks @frankekn.
+- Gateway/startup: load bundled channel plugins from compiled `dist/extensions` entries in built installs, so gateway boot no longer recompiles bundled extension TypeScript on every startup and WhatsApp-class cold starts drop back to seconds instead of tens of seconds or worse. (#47560) Thanks @ngutman.
+- Gateway/startup: prewarm the configured primary model before channel startup and retry one transient provider-runtime miss so the first Telegram or Discord message after boot no longer fails with `Unknown model: openai-codex/gpt-5.4`. Thanks @vincentkoc.
+- CLI/startup: lazy-load channel add and root help startup paths to trim avoidable RSS and help latency on constrained hosts. (#46784) Thanks @vincentkoc.
+- Configure/startup: move outbound send-deps resolution into a lightweight helper so `openclaw configure` no longer stalls after the banner while eagerly loading channel plugins. (#46301) Thanks @scoootscooob.
+- CLI/auth choice: lazy-load plugin/provider fallback resolution so mapped auth choices stay on the static path and only unknown choices pay the heavy provider load. (#47495) Thanks @vincentkoc.
+- Gateway/Discord startup: load only configured channel plugins during gateway boot, and lazy-load Discord provider/session runtime setup so startup stops importing unrelated providers and trims cold-start delay. Thanks @vincentkoc.
+- Agents/inbound: lazy-load media and link understanding for plain-text turns and cache synced auth stores by auth-file state so ordinary inbound replies avoid unnecessary startup churn. Thanks @vincentkoc.
+- Agents/openai-responses: strip `prompt_cache_key` and `prompt_cache_retention` for non-OpenAI-compatible Responses endpoints while keeping them on direct OpenAI and Azure OpenAI paths, so third-party OpenAI-compatible providers no longer reject those requests with HTTP 400. (#49877) Thanks @ShaunTsai.
+- Models/OpenRouter runtime capabilities: fetch uncatalogued OpenRouter model metadata on first use so newly added vision models keep image input instead of silently degrading to text-only, with top-level capability field fallbacks for `/api/v1/models`. (#45824) Thanks @DJjjjhao.
+- Control UI/session routing: preserve established external delivery routes when webchat views or sends in externally originated sessions, so subagent completions still return to the original channel instead of the dashboard. (#47797) Thanks @brokemac79.
+- Telegram/replies: set `allow_sending_without_reply` on reply-targeted sends and media-error notices so deleted parent messages no longer drop otherwise valid replies. (#52524) Thanks @moltbot886.
+- Telegram/polling: hard-timeout stuck `getUpdates` requests so wedged network paths fail over sooner instead of waiting for the polling stall watchdog. Thanks @vincentkoc.
+- Android/location: make current-location requests drop late callbacks after timeout instead of crashing with `Already resumed`. (#52318) Thanks @Kaneki-x.
+- Android/pairing: resolve portless secure setup URLs to `443` while preserving direct cleartext gateway defaults and explicit `:80` manual endpoints in onboarding. (#43540) Thanks @fmercurio.
+- Android/canvas: ignore bridge messages from pages outside the bundled scaffold and trusted A2UI surfaces. Thanks @vincentkoc.
+- CLI/status: keep `status --json` stdout clean by skipping plugin compatibility scans that were not rendered in the JSON payload. (#52449) Thanks @cgdusek.
+- WhatsApp/reconnect: restore the append recency filter in the extension inbox monitor and handle protobuf `Long` timestamps correctly, so fresh post-reconnect append messages are processed while stale history sync stays suppressed. (#42588) Thanks @MonkeyLeeT.
+- WhatsApp/login: wait for pending creds writes before reopening after Baileys `515` pairing restarts in both QR login and `channels login` flows, and keep the restart coverage pinned to the real wrapped error shape plus per-account creds queues. (#27910) Thanks @asyncjason.
+- Android/canvas: serialize A2UI action-status event strings before evaluating WebView JS, so action ids and multiline errors do not break the callback dispatch. (#43784) Thanks @Kaneki-x.
+- Android/camera: recycle intermediate and final snap bitmaps in `camera.snap` so repeated captures do not leak native image memory. (#41902) Thanks @Kaneki-x.
+- Control UI/logging: make browser-safe logger imports avoid eager temp-dir resolution so the bundled Control UI no longer crashes to a blank screen when logging reaches `tmp-openclaw-dir`. (#48469) Fixes #48062. Thanks @7inspire.
+- Control UI/chat sessions: show human-readable labels in the grouped session dropdown again, keep unique scoped fallbacks when metadata is missing, and disambiguate duplicate labels only when needed. (#45130) Thanks @luzhidong.
+- Telegram/replies: ignore malformed non-string reply text and caption fields when describing reply context, so unexpected Telegram reply payloads no longer break inbound context assembly. (#50500) Thanks @p3nchan.
+- Control UI/dashboard: preserve structured gateway shutdown reasons across restart disconnects so config-triggered restarts no longer fall back to `disconnected (1006): no reason`. (#46580) Fixes #46532. Thanks @vincentkoc.
+- Android/chat: theme the thinking dropdown and TLS trust dialogs explicitly so popup surfaces match the active app theme instead of falling back to mismatched Material defaults.
+- Node/startup: remove leftover debug `console.log("node host PATH: ...")` that printed the resolved PATH on every `openclaw node run` invocation. (#46515) Fixes #46411. Thanks @ademczuk.
+- Slack/startup: harden `@slack/bolt` import interop across current bundled runtime shapes so Slack monitors no longer crash with `App is not a constructor` after plugin-sdk bundling changes. (#45953) Thanks @merc1305.
+- Control UI/model switching: preserve the selected provider prefix when switching models from the chat dropdown, so multi-provider setups no longer send `anthropic/gpt-5.2`-style mismatches when the user picked `openai/gpt-5.2`. (#47581) Thanks @chrishham.
+- Control UI/storage: scope persisted settings keys by gateway base path, with migration from the legacy shared key, so multiple gateways under one domain stop overwriting each other's dashboard preferences. (#47932) Thanks @bobBot-claw.
+- Control UI/overview: keep the language dropdown aligned with the persisted locale during dashboard startup so refreshing the page does not fall back to English before locale hydration completes. (#48019) Thanks @git-jxj.
+- macOS/node service startup: use `openclaw node start/stop --json` from the Mac app instead of the removed `openclaw service node ...` command shape, so current CLI installs expose the full node exec surface again. (#46843) Fixes #43171. Thanks @Br1an67.
+- ACP/gateway startup: use direct Telegram and Discord startup/status helpers instead of routing probes through the plugin runtime, and prepend the selected daemon Node bin dir to service PATH so plugin-local installs can still find `npm` and `pnpm`.
+- WhatsApp/active-listener: pin the active listener registry to a `globalThis` singleton so split WhatsApp bundle chunks share one listener map and outbound sends stop missing the registered session. (#47433) Thanks @clawdia67.
+- Gateway/probe: honor caller `--timeout` for active local loopback probes in `gateway status`, keep inactive remote-mode loopback probes fast, and clamp probe timers to JS-safe bounds so slow local/container gateways stop reporting false timeouts. (#47533) Thanks @MonkeyLeeT.
+- Config/startup: keep bundled web-search allowlist compatibility on a lightweight manifest path so config validation no longer pulls bundled web-search registry imports into startup, while still avoiding accidental auto-allow of config-loaded override plugins. (#51574) Thanks @RichardCao.
+- Gateway/chat.send: persist uploaded image references across reloads and compaction without delaying first-turn dispatch or double-submitting the same image to vision models. (#51324) Thanks @fuller-stack-dev.
+- Android/canvas: recycle captured and scaled snapshot bitmaps so repeated canvas snapshots do not leak native image memory. (#41889) Thanks @Kaneki-x.
+- Android/theme: switch status bar icon contrast with the active system theme so Android light mode no longer leaves unreadable light icons over the app header. (#51098) Thanks @goweii.
+- Gateway/openresponses: preserve assistant commentary and session continuity across hosted-tool `/v1/responses` turns, and emit streamed tool-call payloads before finalization so client tool loops stay resumable. (#52171) Thanks @CharZhou.
+- Android/Talk: serialize `TalkModeManager` player teardown so rapid interrupt/restart cycles stop double-releasing or overlapping TTS playback. (#52310) Thanks @Kaneki-x.
+- WhatsApp/reconnect: preserve the last inbound timestamp across reconnect attempts so the watchdog can still recycle linked-but-dead listeners after a restart instead of leaving them stuck connected forever.
+- Gateway/network discovery: guard LAN, tailnet, and pairing interface enumeration so WSL2 and restricted hosts degrade to missing-address fallbacks instead of crashing on `uv_interface_addresses` errors. (#44180, #47590).
+- Gateway/bonjour: suppress the non-fatal `@homebridge/ciao` IPv4-loss assertion during interface churn so WiFi/VPN/sleep-wake changes no longer take down the gateway. (#38628, #47159, #52431).
+- Browser/launch: stop forcing an extra blank tab on browser launch so managed browser startup no longer opens an unwanted empty page. (#52451) Thanks @rogerdigital.
+- CLI/onboarding: import static provider definitions directly for onboarding model/config helpers so those paths no longer pull provider discovery just for built-in defaults. (#47467) Thanks @vincentkoc.
+- Agents/exec: return plain-text failed tool output for timeouts and other non-success exec outcomes so models no longer parrot raw JSON error payloads back to users. (#52508) Thanks @martingarramon.
+- CLI/config: make `config set --strict-json` enforce real JSON, prefer `JSON.parse` with JSON5 fallback for machine-written cron/subagent stores, and relabel raw config surfaces as `JSON/JSON5` to match actual compatibility. Related: #48415, #43127, #14529, #21332. Thanks @adhitShet and @vincentkoc.
+- CLI/Ollama onboarding: keep the interactive model picker for explicit `openclaw onboard --auth-choice ollama` runs so setup still selects a default model without reintroducing pre-picker auto-pulls. (#49249) Thanks @BruceMacD.
+- CLI/configure: clarify fresh-setup memory-search warnings so they say semantic recall needs at least one embedding provider, and scope the initial model allowlist picker to the provider selected in configure. Thanks @vincentkoc.
+- Mattermost/threading: honor `replyToMode: "off"` for already-threaded inbound posts so threaded follow-ups can fall back to top-level replies when configured. (#52543) Thanks @RichardCao.
+- Onboarding/custom providers: store Azure OpenAI and Azure AI Foundry custom endpoints with the Responses API config shape, normalized `/openai/v1` base URLs, and Azure-safe defaults so TUI and agent runs work after setup. (#49543) Thanks @kunalk16.
+- CLI/completion: reduce recursive completion-script string churn and fix nested PowerShell command-path matching so generated nested completions resolve on PowerShell too. (#45537) Thanks @yiShanXin and @vincentkoc.
+- macOS/launch at login: stop emitting `KeepAlive` for the desktop app launch agent so OpenClaw no longer relaunches immediately after a manual quit while launch at login remains enabled. (#40213) Thanks @stablegenius49.
+- Mattermost/DM send: retry transient direct-channel creation failures for DM deliveries, with configurable backoff and per-request timeout. (#42398) Thanks @JonathanJing.
+- Secrets/exec refs: require explicit `--allow-exec` for `secrets apply` write plans that contain exec SecretRefs/providers, and align audit/configure/apply dry-run behavior to skip exec checks unless opted in to prevent unexpected command side effects. (#49417) Thanks @restriction and @joshavant.
+- Signal/runtime API: re-export `SignalAccountConfig` so Signal account resolution type-checks again. (#49470) Thanks @scoootscooob.
+- Google Chat/runtime API: thin the private runtime barrel onto the curated public SDK surface while keeping public Google Chat exports intact. (#49504) Thanks @scoootscooob.
+- Onboarding/custom providers: keep Azure AI Foundry `*.services.ai.azure.com` custom endpoints on the selected compatibility path instead of forcing Responses, so chat-completions Foundry models still work after setup. Fixes #50528. (#50535) Thanks @obviyus.
+- make `openclaw update status` explicitly say `up to date` when the local version already matches npm latest, while keeping the availability logic unchanged. (#51409) Thanks @dongzhenye.
+- Browser/node proxy: enforce `nodeHost.browserProxy.allowProfiles` across `query.profile` and `body.profile`, block proxy-side profile create/delete when the allowlist is set, and keep the default full proxy surface when the allowlist is empty.
+- Security/device pairing: harden `device.token.rotate` deny handling by keeping public failures generic while logging internal deny reasons and preserving approved-baseline enforcement. (`GHSA-7jrw-x62h-64p8`).
+- Security/exec safe bins: remove `jq` from the default safe-bin allowlist and fail closed on the `jq` `env` builtin when operators explicitly opt `jq` back in, so `jq -n env` cannot dump host secrets without an explicit trust path. Thanks @gladiator9797 for reporting.
+- Security/exec approvals: escape blank Hangul filler code points in approval prompts across gateway/chat and the macOS native approval UI so visually empty Unicode padding cannot hide reviewed command text.
+- Security/exec approvals: unify transparent dispatch-wrapper handling across resolution and allow-always persistence so wrapper metadata cannot silently drift and broaden approvals.
+- Security/exec: harden macOS allowlist resolution against wrapper and `env` spoofing, require fresh approval for inline interpreter eval with `tools.exec.strictInlineEval`, wrap Discord guild message bodies as untrusted external content, and add audit findings for risky exec approval and open-channel combinations.
+- Security/network: harden explicit-proxy SSRF pinning by translating target-hop transport hints onto HTTPS proxy tunnels and failing closed for plain HTTP guarded fetches that cannot preserve pinned DNS.
+- Security/Synology Chat: require explicit per-account webhook paths for multi-account setups by default, reject duplicate exact webhook paths fail-closed, and keep inherited-path behavior behind an explicit dangerous opt-in so shared routes can no longer collapse DM policy contexts across accounts. Thanks @tdjackey for reporting.
+- Browser/remote CDP: honor strict browser SSRF policy during remote CDP reachability and `/json/version` discovery checks, redact sensitive `cdpUrl` tokens from status output, and warn when remote CDP targets private/internal hosts.
+- Media/security: bound remote-media error-body snippets with the same streaming caps and idle timeouts as successful downloads, so malicious HTTP error responses cannot force unbounded buffering before OpenClaw throws.
+- Gateway/auth: ignore spoofed loopback hops in trusted forwarding chains and block device approvals that request scopes above the caller session. (#46800) Thanks @vincentkoc.
+- Gateway/auth: clear self-declared scopes for device-less trusted-proxy Control UI sessions so proxy-authenticated connects cannot claim admin or secrets scopes without a bound device identity.
+- Hardening: refresh stale device pairing requests and pending metadata (#50695) Thanks @smaeljaish771 and @joshavant.
+- Gateway/auth: add regression coverage that keeps device-less trusted-proxy Control UI sessions off privileged pairing approval RPCs. Thanks @vincentkoc.
+- Agents/models: cache `models.json` readiness by config and auth-file state so embedded runner turns stop paying repeated model-catalog startup work before replies. Thanks @vincentkoc.
+- Gateway/status: tolerate network interface discovery failures in status, onboarding control-UI links, and self-presence display paths so those surfaces fall back cleanly instead of crashing. (#52195) Thanks @meng-clb.
+- Gateway/Linux: auto-detect nvm-managed Node TLS CA bundle needs before CLI startup and refresh installed services that are missing `NODE_EXTRA_CA_CERTS`. (#51146) Thanks @GodsBoy.
+- Google auth/Node 25: patch `gaxios` to use native fetch without injecting `globalThis.window`, while translating proxy and mTLS transport settings so Google Vertex and Google Chat auth keep working on Node 25. (#47914) Thanks @pdd-cli.
+- Gateway/plugins: pin runtime webhook routes to the gateway startup registry so channel webhooks keep working across plugin-registry churn, and make plugin auth + dispatch resolve routes from the same live HTTP-route registry. (#47902) Fixes #46924 and #47041.
+- Gateway/restart: defer externally signaled unmanaged restarts through the in-process idle drain, and preserve the restored subagent run as remap fallback during orphan recovery so resumed sessions do not duplicate work. (#47719) Thanks @joeykrug.
+- Telegram/setup: seed fresh setups with `channels.telegram.groups["*"].requireMention=true` so new bots stay mention-gated in groups unless you explicitly open them up. Thanks @vincentkoc.
+- Inbound policy hardening: tighten callback and webhook sender checks across Mattermost and Google Chat, match Nextcloud Talk rooms by stable room token, and treat explicit empty Twitch allowlists as deny-all. (#46787) Thanks @zpbrent, @ijxpwastaken and @vincentkoc.
+- Webhooks/runtime: move auth earlier and tighten pre-auth body limits and timeouts across bundled webhook handlers, including slow-body handling for Mattermost slash commands. (#46802) Thanks @vincentkoc.
+- Email/webhook wrapping: sanitize sender and subject metadata before external-content wrapping so metadata fields cannot break the wrapper structure. (#46816) Thanks @vincentkoc.
+- Gateway/chat: only reap orphaned stale chat buffers after the abort controller is gone, and clear abort-time streaming metadata so long-running sessions do not lose buffered output while stale maps still get reclaimed. (#52428) Thanks @karanuppal.
+- Tools/apply-patch: revalidate workspace-only delete and directory targets immediately before mutating host paths. (#46803) Thanks @vincentkoc.
+- Gateway/config views: strip embedded credentials from URL-based endpoint fields before returning read-only account and config snapshots. (#46799) Thanks @vincentkoc.
+- ACP/approvals: use canonical tool identity for prompting decisions and fail closed when conflicting tool identity hints are present. (#46817) Thanks @zpbrent and @vincentkoc.
+- ACP: require admin scope for mutating internal actions. (#46789) Thanks @tdjackey and @vincentkoc.
+- Subagents/follow-ups: require the same controller ownership checks for `/subagents send` as other control actions, so leaf sessions cannot message nested child runs they do not control. (#46801) Thanks @vincentkoc.
+- Web search/onboarding: clarify provider labels, key prompts, and missing-key notes so setup/configure more clearly names the required provider credential for Gemini, Kimi, Grok, Brave Search, Firecrawl, Perplexity, and Tavily. Thanks @vincentkoc.
+- macOS/canvas actions: keep unattended local agent actions on trusted in-app canvas surfaces only, and stop exposing the deep-link fallback key to arbitrary page scripts. (#46790) Thanks @vincentkoc.
+- Agents/compaction: extend the enclosing run deadline once while compaction is actively in flight, and abort the underlying SDK compaction on timeout/cancel so large-session compactions stop freezing mid-run. (#46889) Thanks @asyncjason.
+- Gateway/Telegram shutdown: abort stalled Telegram polling fetches on shutdown, clean up per-cycle abort listeners, and keep the in-process watchdog ahead of supervisor stop timeouts so SIGTERM no longer leaves zombie gateways behind. (#51242) Thanks @juliabush.
+- Telegram/setup: warn when setup leaves DMs on pairing without an allowlist, and show valid account-scoped remediation commands. (#50710) Thanks @ernestodeoliveira.
+- Doctor/Telegram: replace the fresh-install empty group-allowlist false positive with first-run guidance that explains DM pairing approval and the next group setup steps, so new Telegram installs get actionable setup help instead of a broken-config warning. Thanks @vincentkoc.
+- Doctor/extensions: keep Matrix DM `allowFrom` repairs on the canonical `dm.allowFrom` path and stop treating Zalouser group sender gating as if it fell back to `allowFrom`, so doctor warnings and `--fix` stay aligned with runtime access control. Thanks @vincentkoc.
+- Doctor/refactor: centralize built-in channel doctor semantics in one static capability registry with conservative fallback behavior for unknown/external channels, so future extension changes stop depending on scattered shared string checks. Thanks @vincentkoc.
+- Channels/plugins: keep shared interactive payloads merge-ready by fixing Slack custom callback routing and repeat-click dedupe, allowing interactive-only sends, and preserving ordered Discord shared text blocks. (#47715) Thanks @vincentkoc.
+- Slack/interactive replies: preserve `channelData.slack.blocks` through live DM delivery and preview-finalized edits so Block Kit button and select directives render instead of falling back to raw text. (#45890) Thanks @vincentkoc.
+- Feishu/actions: expand the runtime action surface with message read/edit, explicit thread replies, pinning, and operator-facing chat/member inspection so Feishu can operate more of the workspace directly. (#47968) Thanks @Takhoffman.
+- Feishu/topic threads: fetch full thread context, including prior bot replies, when starting a topic-thread session so follow-up turns in Feishu topics keep the right conversation state. (#45254) Thanks @Coobiw.
+- Feishu/media: keep native image, file, audio, and video/media handling aligned across outbound sends, inbound downloads, thread replies, directory/action aliases, and capability docs so unsupported areas are explicit instead of implied. (#47968) Thanks @Takhoffman.
+- Feishu/webhooks: harden signed webhook verification to use constant-time signature comparison and keep malformed short signatures fail-closed in webhook E2E coverage.
+- Ollama/tool replay: deserialize stringified tool-call arguments on native and OpenAI-compatible Ollama paths while preserving unsafe integer ids across round-trips. (#52253) Thanks @Adam-Researchh.
+- WhatsApp/reconnect: restore the append recency filter in the extension inbox monitor and handle protobuf `Long` timestamps correctly, so fresh post-reconnect append messages are processed while stale history sync stays suppressed. (#42588) Thanks @MonkeyLeeT.
+- WhatsApp/login: wait for pending creds writes before reopening after Baileys `515` pairing restarts in both QR login and `channels login` flows, and keep the restart coverage pinned to the real wrapped error shape plus per-account creds queues. (#27910) Thanks @asyncjason.
+- Telegram/message send: forward `--force-document` through the `sendPayload` path as well as `sendMedia`, so Telegram payload sends with `channelData` keep uploading images as documents instead of silently falling back to compressed photo sends. (#47119) Thanks @thepagent.
+- Telegram/message chunking: preserve spaces, paragraph separators, and word boundaries when HTML overflow rechunking splits formatted replies. (#47274) Thanks @obviyus.
+- Z.AI/onboarding: detect a working default model even for explicit `zai-coding-*` endpoint choices, so Coding Plan setup can keep the selected endpoint while defaulting to `glm-5` when available or `glm-4.7` as fallback. (#45969) Thanks @obviyus.
+- CI/onboarding smoke: surface `ensure-base-commit` fetch failures as workflow warnings and fail the onboarding Docker smoke when expected setup prompts drift instead of continuing silently. Thanks @Takhoffman.
+- Z.AI/onboarding: add `glm-5-turbo` to the default Z.AI provider catalog so onboarding-generated configs expose the new model alongside the existing GLM defaults. (#46670) Thanks @tomsun28.
+- Zalo Personal/group gating: stop reapplying `dmPolicy.allowFrom` as a sender gate for already-allowlisted groups when `groupAllowFrom` is unset, so any member of an allowed group can trigger replies while DMs stay restricted. (#46663) Fixes #40146. Thanks @Takhoffman.
+- Zalo/plugin runtime: export `resolveClientIp` from `openclaw/plugin-sdk/zalo` so installed builds no longer crash on startup when the webhook monitor loads from the packaged extension instead of the monorepo source tree. (#46549) Thanks @No898.
+- Docker/live tests: mount external CLI auth homes into writable container copies, derive Codex OAuth expiry from JWT `exp`, refresh synced CLI creds instead of trusting stale cached expiry, and make gateway live probes wait on transcript output so `pnpm test:docker:all` stays green in Linux.
+- Gateway/watch mode: restart on bundled-plugin package and manifest metadata changes, rebuild `dist` for extension source and `tsdown.config.ts` changes, and still ignore extension docs. (#47571) Thanks @gumadeiras.
+- Gateway/watch mode: recreate bundled plugin runtime metadata after clean or stale `dist` states, so `pnpm gateway:watch` no longer fails on missing bundled-plugin manifests after a rebuild. Thanks @gumadeiras.
+- Control UI: scope persisted session selection per gateway, prevent stale session bleed across tokenized gateway opens, and cap stored gateway session history. (#47453) Thanks @sallyom.
+- Models/OpenAI Codex OAuth: start the remote manual-input race for Codex login and keep the pasted-input prompt aligned with the actual accepted values, so remote/VPS auth no longer stalls waiting on an unreachable localhost callback. (#51631) Thanks @cash-echo-bot.
+- Group mention gating: reject invalid and unsafe nested-repetition `mentionPatterns`, reuse the shared safe config-regex compiler across mention stripping and detection, and cache strip-time regex compilation so noisy groups avoid repeated recompiles.
+- Browser/profiles: drop the auto-created `chrome-relay` browser profile; users who need the Chrome extension relay must now create their own profile via `openclaw browser create-profile`. (#46596) Fixes #45777. Thanks @odysseus0.
+- CI/channel test routing: move the built-in channel suites into `test:channels` and keep them out of `test:extensions`, so extension CI no longer fails after the channel migration while targeted test routing still sends Slack, Signal, and iMessage suites to the right lane. (#46066) Thanks @scoootscooob.
+- Gateway/config validation: stop treating the implicit default memory slot as a required explicit plugin config, so startup no longer fails with `plugins.slots.memory: plugin not found: memory-core` when `memory-core` was only inferred. (#47494) Thanks @ngutman.
+- Tlon: honor explicit empty allowlists and defer cite expansion. (#46788) Thanks @zpbrent and @vincentkoc.
+- Tlon/DM auth: defer cited-message expansion until after DM authorization and owner command handling, so unauthorized DMs and owner approval/admin commands no longer trigger cross-channel cite fetches before the deny or command path.
+- Gateway/agent events: stop broadcasting false end-of-run `seq gap` errors to clients, and isolate node-driven ingress turns with per-turn run IDs so stale tail events cannot leak into later session runs. (#43751) Thanks @caesargattuso.
+- Nodes/pending actions: re-check queued foreground actions against the current node command policy before returning them to the node. (#46815) Thanks @zpbrent and @vincentkoc.
+- Windows/gateway status: accept `schtasks` `Last Result` output as an alias for `Last Run Result`, so running scheduled-task installs no longer show `Runtime: unknown`. (#47844) Thanks @MoerAI.
+- ACP/acpx: resolve the bundled plugin root from the actual plugin directory so plugin-local installs stay under the bundled dist plugin tree instead of escaping upward and failing runtime setup. (#47601) Thanks @ngutman.
+- Gateway/WS handshake: raise the default pre-auth handshake timeout to 10 seconds and add `OPENCLAW_HANDSHAKE_TIMEOUT_MS` as a runtime override so busy local gateways stop dropping healthy CLI connections at 3 seconds. (#49262) Thanks @fuller-stack-dev.
+- Gateway/websocket pairing bypass for disabled auth: skip device-pairing enforcement for Control UI operator sessions when `gateway.auth.mode=none`, so reverse-proxied dashboards no longer get stuck on `pairing required` despite auth being explicitly disabled. (#47148) Thanks @ademczuk.
+- Agents/usage tracking: stop forcing `supportsUsageInStreaming: false` on non-native OpenAI-completions providers so compatible backends report token usage and cost again instead of showing all zeros. (#46500) Fixes #46142. Thanks @ademczuk.
+- ACP/acpx: keep plugin-local backend installs under the bundled ACPX plugin package in live repo checkouts so rebuilds no longer delete the runtime binary, and avoid package-lock churn during runtime repair.
+- Agents/compaction: rerun transcript repair after `session.compact()` so orphaned `tool_result` blocks cannot survive compaction and break later Anthropic requests. (#16095) thanks @claw-sylphx.
+- Agents/compaction: trigger overflow recovery from the tool-result guard once post-compaction context still exceeds the safe threshold, so long tool loops compact before the next model call hard-fails. (#29371) thanks @keshav55.
+- macOS/exec approvals: harden exec-host request HMAC verification to use a timing-safe compare and keep malformed or truncated signatures fail-closed in focused IPC auth coverage.
+- Gateway/exec approvals: surface requested env override keys in gateway-host approval prompts so operators can review surviving env context without inheriting noisy base host env.
+- Telegram/network: preserve sticky IPv4 fallback state across polling restarts so hosts with unstable IPv6 to `api.telegram.org` stop re-triggering repeated Telegram timeouts after each restart. (#48282) Thanks @yassinebkr.
+- Agents/compaction: write minimal boundary summaries for empty preparations while keeping split-turn prefixes on the normal path, so no-summarizable-message sessions stop retriggering the safeguard loop. (#42215) thanks @lml2468.
+- Models/chat commands: keep `/model ...@YYYYMMDD` version suffixes intact by default, but still honor matching stored numeric auth-profile overrides for the same provider. (#48896) Thanks @Alix-007.
+- Gateway/channels: serialize per-account channel startup so overlapping starts do not boot the same provider twice, preventing MS Teams `EADDRINUSE` crash loops during startup and restart. (#49583) Thanks @sudie-codes.
+- Discord: enforce strict DM component allowlist auth (#49997) Thanks @joshavant.
+- Stabilize plugin loader and Docker extension smoke (#50058) Thanks @joshavant.
+- Telegram: stabilize pairing/session/forum routing and reply formatting tests (#50155) Thanks @joshavant.
+- Gateway: harden OpenResponses file-context escaping (#50782) Thanks @YLChen-007 and @joshavant.
+- LINE: harden Express webhook parsing to verified raw body (#51202) Thanks @gladiator9797 and @joshavant.
+- Exec: harden host env override handling across gateway and node (#51207) Thanks @gladiator9797 and @joshavant.
+- Voice Call: enforce spoken-output contract and fix stream TTS silence regression (#51500) Thanks @joshavant.
+- xAI/models: rename the bundled Grok 4.20 catalog entries to the GA IDs and normalize saved deprecated beta IDs at runtime so existing configs and sessions keep resolving. (#50772) thanks @Jaaneek
+- WhatsApp/outbound media: fix HTML, XML, and CSS files being silently dropped on outbound send by adding missing MIME entries and falling back to `application/octet-stream` for unknown media types. (#51562) Thanks @bobbyt74
+- Agents/bootstrap warnings: move bootstrap truncation warnings out of the system prompt and into the per-turn prompt body so prompt-cache reuse stays stable when truncation warnings appear or disappear. (#48753) Thanks @scoootscooob and @obviyus.
+- Telegram/DM topic session keys: route named-account DM topics through the same per-account base session key across inbound messages, native commands, and session-state lookups so `/status` and thread recovery stop creating phantom `agent:main:main:thread:...` sessions. (#48204) Thanks @vincentkoc.
+- ACP/configured bindings: reinitialize configured ACP sessions that are stuck in `error` state instead of reusing the failed runtime (#48197). Thanks @dutifulbob.
+- Telegram/network: unify API and media fetches under the same sticky IPv4 and pinned-IP fallback chain, and re-validate pinned override addresses against SSRF policy. (#49148) Thanks @obviyus.
+- Agents/prompt composition: append bootstrap truncation warnings to the current-turn prompt and add regression coverage for stable system-prompt cache invariants. (#49237) Thanks @scoootscooob.
+- Synology Chat/multi-account: scope direct-message sessions by account and sender so identical webhook `user_id` values on different Synology accounts no longer share transcript or delivery state.
+- Telegram/security: add regression coverage proving pinned fallback host overrides stay bound to Telegram and delegate non-matching hostnames back to the original lookup path. Thanks @vincentkoc.
+- Tools/image generation: add bundled fal image generation support so `image_generate` can target `fal/*` models with `FAL_KEY`, including single-image edit flows via FLUX image-to-image. Thanks @vincentkoc.
+- Gateway/hooks: preserve immutable hook ingress provenance across async isolated-agent dispatch so normalized hook session routes keep external wrapping, Gmail-specific policy, and Gmail model selection intact.
+- Messages/polls: treat zero-valued poll params on `message.send` as unset defaults while keeping non-zero poll params on the poll validation path. (#52150) Fixes #52118. Thanks @Bartok9.
+- xAI/web search: add missing Grok credential metadata so the bundled provider registration type-checks again. (#49472) thanks @scoootscooob.
+- Agents/session cache: opportunistically sweep expired embedded-runner session cache entries during later cache activity, so one-shot session files do not accumulate forever. (#52427) Thanks @karanuppal.
+- WhatsApp: stabilize inbound monitor and setup tests (#50007) Thanks @joshavant.
+- Matrix: make onboarding status runtime-safe (#49995) Thanks @joshavant.
+- Channels: stabilize lane harness and monitor tests (#50167) Thanks @joshavant.
+- Agents/compaction: add an opt-in post-compaction session JSONL truncation step that drops summarized transcript entries while preserving the retained branch tail and live session metadata. (#41021) thanks @thirumaleshp.
+- Telegram/routing: fail loud when `message send` targets an unknown non-default Telegram `accountId`, instead of silently falling back to the channel-level bot token and sending through the wrong bot. (#50853) Thanks @hclsys.
+- Web search: align onboarding, configure, and finalize with plugin-owned provider contracts, including disabled-provider recovery, config-aware credential hooks, and runtime-visible summaries. (#50935) Thanks @gumadeiras.
+- Agents/replay: sanitize malformed assistant tool-call replay blocks before provider replay so follow-up Anthropic requests do not inherit the downstream `replace` crash. (#50005) Thanks @jalehman.
+- Discord/startup logging: report client initialization while the gateway is still connecting instead of claiming Discord is logged in before readiness is reached. (#51425) Thanks @scoootscoob.
+- Agents/compaction safeguard: preserve split-turn context and preserved recent turns when capped retry fallback reuses the last successful summary. (#27727) thanks @Pandadadadazxf.
+- Agents/memory flush: keep transcript-hash dedup active across memory-flush fallback retries so a write-then-throw flush attempt cannot append duplicate `MEMORY.md` entries before the fallback cycle completes. (#34222) Thanks @lml2468.
+- Discord/ACP: forward worker abort signals into ACP turns so timed-out Discord jobs cancel the running turn instead of silently leaving the bound ACP session working in the background (#52148). Thanks @dutifulbob.
+- ACP/Codex session replay: preserve hidden assistant thinking when loading or rebinding existing ACP sessions so stored thought chunks do not replay into visible assistant text. Thanks @vincentkoc.
+- Gateway/commands: keep internal `chat.send` slash-command UX while requiring `operator.admin` before internal callers can persist `/exec` defaults or mutate `phone-control` node policy through `/phone arm|disarm`.
+- Plugins/context engines: enforce owner-aware context-engine registration on both loader and public SDK paths so plugins cannot spoof privileged ownership, claim the core `legacy` engine id, or overwrite an existing engine id through direct SDK imports. (#47595) Thanks @vincentkoc.
+- Plugins/bundler TDZ: fix `RESERVED_COMMANDS` temporal dead zone error that prevented device-pair, phone-control, and talk-voice plugins from registering when the bundler placed the commands module after call sites in the same output chunk. Thanks @BunsDev.
+- Plugins/imports: fix stale googlechat runtime-api import paths and signal SDK circular re-exports broken by recent plugin-sdk refactors. Thanks @BunsDev.
+- Plugins/install precedence: keep bundled plugins ahead of auto-discovered globals by default, but let an explicitly installed plugin record win its own duplicate-id tie so installed channel plugins load from `~/.openclaw/extensions` after `openclaw plugins install`. (#46722) Thanks @Takhoffman.
+- Plugins/scoped ids: preserve scoped plugin ids during install and config keying, and keep bundled plugins ahead of discovered duplicate ids by default so `@scope/name` plugins no longer collide with unscoped installs. (#47413) Thanks @vincentkoc.
+- Docs/Mintlify: fix MDX marker syntax on Perplexity, Model Providers, Moonshot, and exec approvals pages so local docs preview no longer breaks rendering or leaves stale pages unpublished. (#46695) Thanks @velvet-shark.
+- Plugins/runtime barrels: route bundled extension runtime imports through public `openclaw/plugin-sdk/*` subpaths and block relative cross-package escapes so packaged extensions stop depending on monorepo-only relative paths. (#51939) Thanks @vincentkoc.
+- Docs/security audit: spell out that `gateway.controlUi.allowedOrigins: ["*"]` is an explicit allow-all browser-origin policy and should be avoided outside tightly controlled local testing.
+- Plugins/subagents: preserve gateway-owned plugin subagent access across runtime, tool, and embedded-runner load paths so gateway plugin tools and context engines can still spawn and manage subagents after the loader cache split. (#46648) Thanks @jalehman.
+- Plugins/subagents: forward per-run provider and model overrides through gateway plugin subagent dispatch so plugin-launched agent delegations honor explicit model selection again. (#48277) Thanks @jalehman.
+- Tests/OpenAI Codex auth: align login expectations with the default `gpt-5.4` model so CI coverage stays consistent with the current OpenAI Codex default. (#44367) Thanks @jrrcdev.
+- Plugins/discovery: distinguish missing package entry files from package-path escape violations so startup skips absent plugin entry paths without raising false security diagnostics. (#52491) Thanks @hclsys.
+- Plugins/Matrix: accept shared send-tool media aliases (`mediaUrl`, `filePath`, `path`) and preserve `asVoice` / `audioAsVoice` through Matrix action dispatch so media-only sends and voice-message intents reach the plugin send layer correctly. Thanks @psacc and @vincentkoc.
+- Plugins/runtime-api: pin extension runtime-api export surfaces with explicit guardrail coverage so future surface creep becomes a deliberate diff. Thanks @vincentkoc.
+- Plugins/WhatsApp: share split-load singleton state for plugin command registration and active WhatsApp listeners so duplicate module graphs no longer lose native plugin commands or outbound listener state. (#50418) Thanks @huntharo.
+- Plugins/update: let `openclaw plugins update <npm-spec>` target tracked npm installs by dist-tag or exact version, and preserve the recorded npm spec for later id-based updates. (#49998) Thanks @huntharo.
+- Tests/CLI: reduce command-secret gateway test import pressure while keeping the real protocol payload validator in place, so the isolated lane no longer carries the heavier runtime-web and message-channel graphs. (#50663) Thanks @huntharo.
+- Gateway/plugins: share plugin interactive callback routing and plugin bind approval state across duplicate module graphs so Telegram Codex picker buttons and plugin bind approvals no longer fall through to normal inbound message routing. (#50722) Thanks @huntharo.
+- Plugins/runtime state: share plugin-facing infra singleton state across duplicate module graphs and keep session-binding adapter ownership stable until the active owner unregisters. (#50725) thanks @huntharo.
+- Discord/pickers: keep `/codex_resume --browse-projects` picker callbacks alive in Discord by sharing component callback state across duplicate module graphs, preserving callback fallbacks, and acknowledging matched plugin interactions before dispatch. (#51260) Thanks @huntharo.
+- Telegram/Mattermost message tool: keep plugin button schemas optional in isolated and cron sessions so plain sends do not fail validation when no current channel is active. (#52589) Thanks @tylerliu612.
+- Release/npm publish: fail the npm release check when `dist/control-ui/index.html` is missing from the packed tarball, so broken Control UI asset releases are blocked before publish. Fixes #52808. (#52852) Thanks @kevinheinrichs.
+- Slack/embedded delivery: suppress transcript-only `delivery-mirror` assistant messages before embedded re-delivery and raise the default Slack chunk fallback so messages just over 4000 characters stay in a single post. (#45489) Thanks @theo674.
+
+### Fixes
+
+- Agents/edit tool: accept common path/text alias spellings, show current file contents on exact-match failures, and avoid false edit failures after successful writes. (#52516) thanks @mbelinky.
+
diff --git a/CHANGELOG/2026.3.23.md b/CHANGELOG/2026.3.23.md
new file mode 100644
index 0000000000000000000000000000000000000000..cc1c9c3229fdf65cff619489e7fae85d0c7239ac
--- /dev/null
+++ b/CHANGELOG/2026.3.23.md
@@ -0,0 +1,60 @@
+## 2026.3.23
+
+### Changes
+
+- ModelStudio/Qwen: add standard (pay-as-you-go) DashScope endpoints for China and global Qwen API keys alongside the existing Coding Plan endpoints, and relabel the provider group to `Qwen (Alibaba Cloud Model Studio)`. (#43878).
+- UI/clarity: consolidate button primitives (`btn--icon`, `btn--ghost`, `btn--xs`), refine the Knot theme to a black-and-red palette with WCAG 2.1 AA contrast, add config icons for Diagnostics/CLI/Secrets/ACP/MCP sections, replace the roundness slider with discrete stops, and improve accessibility with aria-labels across usage filters. (#53272) Thanks @BunsDev.
+- CSP/Control UI: compute SHA-256 hashes for inline `<script>` blocks in the served `index.html` and include them in the `script-src` CSP directive, keeping inline scripts blocked by default while allowing explicitly hashed bootstrap code. (#53307) Thanks @BunsDev.
+
+### Fixes
+
+- Plugins/bundled runtimes: ship bundled plugin runtime sidecars like WhatsApp `light-runtime-api.js`, Matrix `runtime-api.js`, and other plugin runtime entry files in the npm package again, so global installs stop failing on missing bundled plugin runtime surfaces.
+- CLI/channel auth: auto-select the single configured login-capable channel for `channels login`/`logout`, harden channel ids against prototype-chain and control-character abuse, and fall back cleanly to catalog-backed channel installs, so channel auth works again for single-channel setups and on-demand channel installs. (#53254) Thanks @BunsDev.
+- Auth/OpenAI tokens: stop live gateway auth-profile writes from reverting freshly saved credentials back to stale in-memory values, and make `models auth paste-token` write to the resolved agent store, so Configure, Onboard, and token-paste flows stop snapping back to expired OpenAI tokens. Fixes #53207. Related to #45516.
+- Control UI/auth: preserve operator scopes through the device-auth bypass path, ignore cached under-scoped operator tokens, and show a clear `operator.read` fallback message when a connection really lacks read scope, so operator sessions stop failing or blanking on read-backed pages. (#53110) Thanks @BunsDev.
+- Plugins/ClawHub: resolve plugin API compatibility against the active runtime version at install time, and add regression coverage for current `>=2026.3.22` ClawHub package checks so installs no longer fail behind the stale `1.2.0` constant. (#53157) Thanks @futhgar.
+- Plugins/uninstall: accept installed `clawhub:` specs and versionless ClawHub package names as uninstall targets, so `openclaw plugins uninstall clawhub:<package>` works again even when the recorded install was pinned to a version.
+- Browser/Chrome MCP: wait for existing-session browser tabs to become usable after attach instead of treating the initial Chrome MCP handshake as ready, which reduces user-profile timeouts and repeated consent churn on macOS Chrome attach flows. Fixes #52930. Thanks @vincentkoc.
+- Browser/CDP: reuse an already-running loopback browser after a short initial reachability miss instead of immediately falling back to relaunch detection, which fixes second-run browser start/open regressions on slower headless Linux setups. Fixes #53004. Thanks @vincentkoc.
+- Agents/web_search: use the active runtime `web_search` provider instead of stale/default selection, so agent turns keep hitting the provider you actually configured. Fixes #53020. Thanks @jzakirov.
+- Mistral/models: lower bundled Mistral max-token defaults to safe output budgets and teach `openclaw doctor --fix` to repair old persisted Mistral provider configs that still carry context-sized output limits, avoiding deterministic Mistral 422 rejects on fresh and existing setups. Fixes #52599. Thanks @vincentkoc.
+- ClawHub/macOS auth: honor macOS auth config and XDG auth paths for saved ClawHub credentials, so `openclaw skills ...` and gateway skill browsing keep using the signed-in auth state instead of silently falling back to unauthenticated mode. Fixes #53034.
+- ClawHub/macOS: read the local ClawHub login from the macOS Application Support path and still honor XDG config on macOS, so skill browsing uses the logged-in token on both default and XDG-style setups. Fixes #52949. Thanks @scoootscooob.
+- ClawHub/skills: resolve the local ClawHub auth token for gateway skill browsing and switch browse-all requests to search so ClawControl stops falling into unauthenticated 429s and empty authenticated skill lists. Fixes #52949. Thanks @vincentkoc.
+- Config/warnings: suppress the confusing "newer OpenClaw" warning when a config written by a same-base correction release like `2026.3.23-2` is read by `2026.3.23`, while still warning for truly newer or incompatible versions (#57018). Thanks @hydro13.
+- CLI/cron: make `openclaw cron add|edit --at .. --tz <iana>` honor the requested local wall-clock time for offset-less one-shot datetimes, including DST boundaries, and keep `--tz` rejected for `--every`. (#53224) Thanks @RolfHegr.
+- Commands/auth: stop slash-command authorization from crashing or dropping valid allowlists when channel `allowFrom` resolution hits unresolved SecretRef-backed accounts, and fail closed only for the affected provider inference path. (#52791) Thanks @Lukavyi.
+- Agents/failover: classify generic `api_error` payloads as retryable only when they include transient failure signals, so MiniMax-style backend failures still trigger model fallback without misclassifying billing, auth, or format/context errors. (#49611) Thanks @ayushozha.
+- LINE/runtime-api: pre-export overlapping runtime symbols before the `line-runtime` star export so jiti no longer throws `TypeError: Cannot redefine property` on startup. (#53221) Thanks @Drickon.
+- Telegram/threading: populate `currentThreadTs` in the threading tool-context fallback for Telegram DM topics so thread-aware tools still receive the active topic context when the main thread metadata is missing. (#52217).
+- Diagnostics/cache trace: strip credential fields from cache-trace JSONL output while preserving non-sensitive diagnostic fields and image redaction metadata.
+- Docs/Feishu: replace `botName` with `name` in the channel config examples so the docs match the strict account schema for per-account display names. (#52753) Thanks @haroldfabla2-hue.
+- Doctor/plugins: make `openclaw doctor --fix` remove stale `plugins.allow` and `plugins.entries` refs left behind after plugin removal. Thanks @sallyom
+- Agents/replay: canonicalize malformed assistant transcript content before session-history sanitization so legacy or corrupted assistant turns stop crashing Pi replay and subagent recovery paths.
+- ClawHub/skills: keep updating already-tracked legacy Unicode slugs after the ASCII-only slug hardening, so older installs do not get stuck behind `Invalid skill slug` errors during `openclaw skills update`. (#53206) Thanks @drobison00.
+- Infra/exec trust: preserve shell-multiplexer wrapper binaries for policy checks without breaking approved-command reconstruction, so BusyBox/ToyBox allowlist and audit flows bind to the real wrapper while execution plans stay coherent. (#53134) Thanks @vincentkoc.
+- Plugins/message tool: make Discord `components` and Slack `blocks` optional again, and route Feishu `message(..., media=...)` sends through the outbound media path, so pin/unpin/react flows stop failing schema validation and Feishu file/image attachments actually send. Fixes #52970 and #52962. Thanks @vincentkoc.
+- Gateway/model pricing: stop `openrouter/auto` pricing refresh from recursing indefinitely during bootstrap, so OpenRouter auto routes can populate cached pricing and `usage.cost` again. Fixes #53035. Thanks @vincentkoc.
+- Models/OpenAI Codex OAuth: bootstrap the env-configured HTTP/HTTPS proxy dispatcher on the stored-credential refresh path before token renewal runs, so expired Codex OAuth profiles can refresh successfully in proxy-required environments instead of locking users out after the first token expiry.
+- Models/OpenAI Codex OAuth and Plugins/MiniMax OAuth: ensure env-configured HTTP/HTTPS proxy dispatchers are initialized before OAuth preflight and token exchange requests so proxy-required environments can complete MiniMax and OpenAI Codex sign-in flows again. (#52228; fixes #51619, #51569) Thanks @openperf.
+- Plugins/memory-lancedb: bootstrap LanceDB into plugin runtime state on first use when the bundled npm install does not already have it, so `plugins.slots.memory="memory-lancedb"` works again after global npm installs without moving LanceDB into OpenClaw core dependencies. Fixes #26100.
+- Config/plugins: treat stale unknown `plugins.allow` ids as warnings instead of fatal config errors, so recovery commands like `plugins install`, `doctor --fix`, and `status` still run when a plugin is missing locally. Fixes #52992. Thanks @vincentkoc.
+- Doctor/WhatsApp: stop auto-enable from appending built-in channel ids like `whatsapp` to `plugins.allow`, so `openclaw doctor --fix` no longer writes schema-invalid plugin allowlist entries when repairing built-in channels. Fixes #52931. Thanks @vincentkoc.
+- Telegram/auto-reply: preserve same-chat inbound debounce order without stranding stale busy-session followups, and keep same-key overflow turns ordered when tracked debounce keys are saturated. (#52998) Thanks @osolmaz.
+- Telegram/message tool: add `asDocument` as a user-facing alias for `forceDocument` on image and GIF sends, while preserving explicit `forceDocument` precedence when both flags are present. (#52461) Thanks @bakhtiersizhaev.
+- Discord/commands: return an explicit unauthorized reply for privileged native slash commands instead of falling through to Discord's misleading generic completion when auth gates reject the sender. Fixes #53041. Thanks @scoootscooob.
+- Channels/catalog: let external channel catalogs override shipped fallback metadata and honor overridden npm specs during channel setup, so custom channel catalogs no longer fall back to bundled packages when a channel id matches. (#52988).
+- Voice-call/Plivo: stabilize Plivo v2 replay keys so webhook retries and replay protection stop colliding on valid follow-up deliveries.
+- Agents/skills: prefer the active resolved runtime snapshot for embedded skill config and env injection, so `skills.entries.<skill>.apiKey` SecretRefs resolve correctly during embedded startup instead of failing on raw source config. Fixes #53098. Thanks @vincentkoc.
+- Agents/subagents: recheck timed-out worker waits against the latest runtime snapshot before sending completion events, so fast-finishing workers stop being reported as timed out when they actually succeeded. Fixes #53106. Thanks @vincentkoc.
+- Agents/Anthropic: preserve latest assistant thinking and redacted-thinking block ordering during transcript image sanitization so follow-up turns do not trip Anthropic's unmodified-thinking validation. (#52961) Thanks @vincentkoc.
+- Plugins/DeepSeek: refactor the bundled DeepSeek provider onto the shared single-provider plugin entry, move its coverage into the extension test lane, and keep bundled auth env-var metadata on the generated manifest path. (#48762) Thanks @07akioni.
+- Plugins/Matrix: avoid duplicate `resolveMatrixAccountStringValues` runtime-api exports under Jiti so bundled Matrix installs no longer crash at startup with `Cannot redefine property: resolveMatrixAccountStringValues`. Fixes #52909 and #52891. Thanks @vincentkoc.
+- Security/exec approvals: keep shell-wrapper positional-argv allowlist matching on real direct carriers only by rejecting single-quoted `$0`/`$n` tokens, disallowing newline-separated `exec`, and still accepting `exec --` carrier forms. Thanks @vincentkoc.
+- Gateway/probe: stop successful gateway handshakes from timing out as unreachable while post-connect detail RPCs are still loading, so slow devices report a reachable RPC failure instead of a false negative dead gateway. Fixes #52927. Thanks @vincentkoc.
+- Gateway/supervision: stop lock conflicts from crash-looping under launchd and systemd by keeping the duplicate process in a retry wait instead of exiting as a failure while another healthy gateway still owns the lock. Fixes #52922. Thanks @vincentkoc.
+- Gateway/auth: require auth for canvas routes and admin scope for agent session reset, so anonymous canvas access and non-admin reset requests fail closed.
+- Release/install: keep previously released bundled plugins and Control UI assets in published openclaw npm installs, and fail release checks when those shipped artifacts are missing. Thanks @vincentkoc.
+- WhatsApp/outbound sends: keep the active Web listener on a direct process-global symbol so split runtime chunks keep sharing the connected Baileys session and `openclaw message send --channel whatsapp` stops failing after connect. Fixes #52574. Thanks @MonkeyLeeT.
+- Agents/process: fail loud when `send-keys` tries cursor-sensitive keys before a background PTY reports its cursor mode, so startup races no longer silently send the wrong arrow/Home/End sequences. (#51490) Thanks @liuy.
+
diff --git a/CHANGELOG/2026.3.24-beta.1.md b/CHANGELOG/2026.3.24-beta.1.md
new file mode 100644
index 0000000000000000000000000000000000000000..07694c927240c6cdd1f88d7f3821f32b34640a60
--- /dev/null
+++ b/CHANGELOG/2026.3.24-beta.1.md
@@ -0,0 +1,38 @@
+## 2026.3.24-beta.1
+
+### Fixes
+
+- Doctor/image generation: seed migrated legacy Nano Banana Google provider config with the `/v1beta` API root and an empty model list so `openclaw doctor --fix` completes and the migrated native Google image path keeps hitting the correct endpoint. (#53757) Thanks @mahopan.
+- Models/google: normalize bare Google Generative AI API roots for custom provider names, and keep built-in Google model-id rewrites working when `api` is declared only on individual models, so custom Google lanes and older configs stop missing `/v1beta` or preview-id normalization. (#44969) Thanks @Kathie-yu.
+- Feishu/startup: treat unresolved `SecretRef` app credentials as not configured during account resolution so CLI startup and read-only Feishu config surfaces stop crashing before runtime-backed secret resolution is available. (#53675) Thanks @hpt.
+- Feishu/groups: when `groupPolicy` is `open`, stop implicitly requiring @mentions for unset `requireMention`, so image, file, audio, and other non-text group messages reach the bot unless operators explicitly keep mention gating on. (#54058) Thanks @byungsker.
+- Feishu/startup: keep `requireMention` enforcement strict when bot identity startup probes fail, raise the startup bot-info timeout to 30s, and add cancellable background identity recovery so mention-gated groups recover without noisy fallback. (#43788) Thanks @lefarcen.
+- Feishu/MSTeams message tool: keep provider-native `card` payloads optional in merged tool schemas so media-only sends stop failing validation before channel runtime dispatch. (#53715) Thanks @lndyzwdxhs.
+- Feishu/docx block ordering: preserve the document tree order from `docx.document.convert` when inserting blocks, fixing heading/paragraph/list misordering in newly written Feishu documents. (#40524) Thanks @TaoXieSZ.
+- Telegram/native commands: run native slash-command execution against the resolved runtime snapshot so DM commands still reply when fresh config reads surface unresolved SecretRefs. (#53179) Thanks @nimbleenigma.
+- Gateway/ports: parse Docker Compose-style `OPENCLAW_GATEWAY_PORT` host publish values correctly without reviving the legacy `CLAWDBOT_GATEWAY_PORT` override. (#44083) Thanks @bebule.
+- Plugins/memory-lancedb: bootstrap the env-configured HTTP/HTTPS proxy dispatcher before OpenAI embeddings requests so memory capture and recall work in proxy-required environments again. (#54119) Thanks @neeravmakwana.
+- Runtime/build: stabilize long-lived lazy `dist` runtime entry paths and harden bundled plugin npm staging so local rebuilds stop breaking on missing hashed chunks or broken shell `npm` shims. (#53855) Thanks @vincentkoc.
+- Security/skills: validate skill installer metadata against strict regex allowlists per package manager, sanitize skill metadata for terminal output, add URL protocol allowlisting in markdown preview and skill homepage links, warn on non-bundled skill install sources, and remove unsafe `file://` workspace links. (#53471) Thanks @BunsDev.
+- Memory/builtin sqlite: cut redundant sync and status query churn by snapshotting file state once per source, reusing sync statements, and consolidating status aggregation reads, which reduces builtin memory overhead on sync/status/doctor-style paths. Thanks @vincentkoc.
+- TUI/chat: preserve pending user messages when a slow local run emits an empty final event, but still defer and flush the needed history reload after the newer active run finishes so silent/tool-only runs do not stay incomplete. (#53130) Thanks @joelnishanth.
+- DeepSeek/pricing: replace the zero-cost DeepSeek catalog rates with the current DeepSeek V3.2 pricing so usage totals stop showing `$0.00` for DeepSeek sessions. (#54143) Thanks @arkyu2077.
+- CLI/logging: make pretty log timestamps always include an explicit timezone offset in default UTC and `--local-time` modes, so incident triage no longer mixes ambiguous clock displays. (#38904) Thanks @sahilsatralkar.
+- Browser/default detection: recognize macOS LaunchServices Edge bundle ids so default Chromium detection stops falling back to Chrome when Edge is the system default. (#48561) Thanks @zoherghadyali.
+- CLI/Telegram topics: route `message thread create` through Telegram `topic-create` with the required topic `name` field so Telegram forum topic creation works from the CLI again. (#54336) Thanks @andyliu.
+- Telegram/pairing: render pairing codes and approval commands as Telegram-only code blocks while keeping shared pairing replies plain text for other channels. (#52784) Thanks @sumukhj1219.
+- Agents/cron: suppress the default heartbeat system prompt for cron-triggered embedded runs even when they target non-cron session keys, so cron tasks stop reading `HEARTBEAT.md` and polluting unrelated threads. (#53152) Thanks @Protocol-zero-0.
+- Agents/cron: mark best-effort announce runs as not delivered when any payload fails, and log those partial delivery failures instead of silently reporting success. (#42535) Thanks @MoerAI.
+- Plugins: enforce terminal hook decision semantics for tool/message guards (#54241) Thanks @joshavant.
+- Marketplace/agents: correct the ClawHub skill URL in agent docs and stream marketplace archive downloads to disk so installs avoid excess memory use and fail cleanly on empty responses. (#54160) Thanks @QuinnH496.
+- Discord/config types: add missing `autoArchiveDuration` to `DiscordGuildChannelConfig` so TypeScript config definitions match the existing schema and runtime support. (#43427) Thanks @davidguttman.
+- Docs/IRC: fix five `json55` code-fence typos in the IRC channel examples so Mintlify applies JSON5 syntax highlighting correctly. (#50842) Thanks @Hollychou924.
+- Discord/commands: trim overlong slash-command descriptions to Discord's 100-character limit and map rejected deploy indexes from Discord validation payloads back to command names/descriptions, so deploys stop failing on long descriptions and startup logs identify the rejected commands. (#54118) thanks @huntharo
+- Media/store: enforce the intended media file mode after writes and redirect downloads so restrictive umasks do not silently narrow saved media permissions.
+- Security/gateway auth: enforce `operator.read` and `models.list` on `/v1/models` so write-scoped callers cannot list models through the OpenAI-compatible HTTP surface.
+- Security/allowlist commands: require `operator.admin` for internal `/allowlist` mutations and channel allowlist persistence reached through `chat.send`.
+- Security/Feishu webhook: cap pre-auth webhook body reads with strict size and timeout guards before JSON parsing so slow-body requests cannot hold the webhook handler open.
+- Security/session policy: require sender ownership for `/send` policy changes so command-authorized non-owners cannot rewrite owner-only session delivery policy.
+- Security/bash stop: route `/bash stop` through the hardened process-tree killer so invalid or attacker-influenced SIGKILL targets cannot escape the intended bash-session scope.
+- Security/installer: hide staged project `.npmrc` files during skill and package installs so npm registry and git settings inside the stage directory cannot hijack trusted installs.
+
diff --git a/CHANGELOG/2026.3.24-beta.2.md b/CHANGELOG/2026.3.24-beta.2.md
new file mode 100644
index 0000000000000000000000000000000000000000..a11bd973ff94c50236a78379fda492e0b7229551
--- /dev/null
+++ b/CHANGELOG/2026.3.24-beta.2.md
@@ -0,0 +1,6 @@
+## 2026.3.24-beta.2
+
+### Fixes
+
+- Tests/security audit: isolate audit-test home and personal skill resolution so local `~/.agents/skills` installs no longer make maintainer prep runs fail nondeterministically. (#54473) thanks @huntharo
+
diff --git a/CHANGELOG/2026.3.24.md b/CHANGELOG/2026.3.24.md
new file mode 100644
index 0000000000000000000000000000000000000000..2459108bdf6726cd28cc33827eca14c5e1a1a11c
--- /dev/null
+++ b/CHANGELOG/2026.3.24.md
@@ -0,0 +1,58 @@
+## 2026.3.24
+
+### Breaking
+
+- Providers/Qwen: remove the deprecated `qwen-portal-auth` OAuth integration for `portal.qwen.ai`; migrate to Model Studio with `openclaw onboard --auth-choice modelstudio-api-key`. (#52709) Thanks @pomelo-nwu.
+- Config/Doctor: drop automatic config migrations older than two months; very old legacy keys now fail validation instead of being rewritten on load or by `openclaw doctor`.
+
+## 2026.3.24
+
+### Changes
+
+- Gateway/OpenAI compatibility: add `/v1/models` and `/v1/embeddings`, and forward explicit model overrides through `/v1/chat/completions` and `/v1/responses` for broader client and RAG compatibility. Thanks @vincentkoc.
+- Agents/tools: make `/tools` show the tools the current agent can actually use right now, add a compact default view with an optional detailed mode, and add a live "Available Right Now" section in the Control UI so it is easier to see what will work before you ask.
+- Microsoft Teams: migrate to the official Teams SDK and add AI-agent UX best practices including streaming 1:1 replies, welcome cards with prompt starters, feedback/reflection, informative status updates, typing indicators, and native AI labeling. (#51808).
+- Microsoft Teams: add message edit and delete support for sent messages, including in-thread fallbacks when no explicit target is provided. (#49925).
+- Skills/install metadata: add one-click install recipes to bundled skills (coding-agent, gh-issues, openai-whisper-api, session-logs, tmux, trello, weather) so the CLI and Control UI can offer dependency installation when requirements are missing. (#53411) Thanks @BunsDev.
+- Control UI/skills: add status-filter tabs (All / Ready / Needs Setup / Disabled) with counts, replace inline skill cards with a click-to-detail dialog showing requirements, toggle switch, install action, API key entry, source metadata, and homepage link. (#53411) Thanks @BunsDev.
+- Slack/interactive replies: restore rich reply parity for direct deliveries, auto-render simple trailing `Options:` lines as buttons/selects, improve Slack interactive setup defaults, and isolate reply controls from plugin interactive handlers. (#53389) Thanks @vincentkoc.
+- CLI/containers: add `--container` and `OPENCLAW_CONTAINER` to run `openclaw` commands inside a running Docker or Podman OpenClaw container. (#52651) Thanks @sallyom.
+- Discord/auto threads: add optional `autoThreadName: "generated"` naming so new auto-created threads can be renamed asynchronously with concise LLM-generated titles while keeping the existing message-based naming as the default. (#43366) Thanks @davidguttman.
+- Plugins/hooks: add `before_dispatch` with canonical inbound metadata and route handled replies through the normal final-delivery path, preserving TTS and routed delivery semantics. (#50444) Thanks @gfzhx.
+- Control UI/agents: convert agent workspace file rows to expandable `<details>` with lazy-loaded inline markdown preview, and add comprehensive `.sidebar-markdown` styles for headings, lists, code blocks, tables, blockquotes, and details/summary elements. (#53411) Thanks @BunsDev.
+- Control UI/markdown preview: restyle the agent workspace file preview dialog with a frosted backdrop, sized panel, and styled header, and integrate `@create-markdown/preview` v2 system theme for rich markdown rendering (headings, tables, code blocks, callouts, blockquotes) that auto-adapts to the app's light/dark design tokens. (#53411) Thanks @BunsDev.
+- macOS app/config: replace horizontal pill-based subsection navigation with a collapsible tree sidebar using disclosure chevrons and indented subsection rows. (#53411) Thanks @BunsDev.
+- CLI/skills: soften missing-requirements label from "missing" to "needs setup" and surface API key setup guidance (where to get a key, CLI save command, storage path) in `openclaw skills info` output. (#53411) Thanks @BunsDev.
+- macOS app/skills: add "Get your key" homepage link and storage-path hint to the API key editor dialog, and show the config path in save confirmation messages. (#53411) Thanks @BunsDev.
+- Control UI/agents: add a "Not set" placeholder to the default agent model selector dropdown. (#53411) Thanks @BunsDev.
+- Runtime/install: lower the supported Node 22 floor to `22.14+` while continuing to recommend Node 24, so npm installs and self-updates do not strand Node 22.14 users on older releases.
+- CLI/update: preflight the target npm package `engines.node` before `openclaw update` runs a global package install, so outdated Node runtimes fail with a clear upgrade message instead of attempting an unsupported latest release.
+
+### Fixes
+
+- Outbound media/local files: align outbound media access with the configured fs policy so host-local files and inbound-media paths keep sending when `workspaceOnly` is off, while strict workspace-only agents remain sandboxed.
+- Security/sandbox media dispatch: close the `mediaUrl`/`fileUrl` alias bypass so outbound tool and message actions cannot escape media-root restrictions. (#54034).
+- Gateway/restart sentinel: wake the interrupted agent session via heartbeat after restart instead of only sending a best-effort restart note, retry outbound delivery once on transient failure, and preserve explicit thread/topic routing through the wake path so replies land in the correct Telegram topic or Slack thread. (#53940) Thanks @VACInc.
+- Docker/setup: avoid the pre-start `openclaw-cli` shared-network namespace loop by routing setup-time onboard/config writes through `openclaw-gateway`, so fresh Docker installs stop failing before the gateway comes up. (#53385) Thanks @amsminn.
+- Gateway/channels: keep channel startup sequential while isolating per-channel boot failures, so one broken channel no longer blocks later channels from starting. (#54215) Thanks @JonathanJing.
+- Embedded runs/secrets: stop unresolved `SecretRef` config from crashing embedded agent runs by falling back to the resolved runtime snapshot when needed. Fixes #45838.
+- WhatsApp/groups: track recent gateway-sent message IDs and suppress only matching group echoes, preserving owner `/status`, `/new`, and `/activation` commands from linked-account `fromMe` traffic. (#53624) Thanks @w-sss.
+- WhatsApp/reply-to-bot detection: restore implicit group reply detection by unwrapping `botInvokeMessage` payloads and reading `selfLid` from `creds.json`, so reply-based mentions reach the bot again in linked-account group chats.
+- Telegram/forum topics: recover `#General` topic `1` routing when Telegram omits forum metadata, including native commands, interactive callbacks, inbound message context, and fallback error replies. (#53699) thanks @huntharo.
+- Discord/gateway supervision: centralize gateway error handling behind a lifetime-owned supervisor so early, active, and late-teardown Carbon gateway errors stay classified consistently and stop surfacing as process-killing teardown crashes.
+- Discord/timeouts: send a visible timeout reply when the inbound Discord worker times out before a final reply starts, including created auto-thread targets and queued-run ordering. (#53823) Thanks @Kimbo7870.
+- ACP/direct chats: always deliver a terminal ACP result when final TTS does not yield audio, even if block text already streamed earlier, and skip redundant empty-text final synthesis. (#53692) Thanks @w-sss.
+- Telegram/outbound errors: preserve actionable 403 membership/block/kick details and treat `bot not a member` as a permanent delivery failure so Telegram sends stop retrying doomed chats. (#53635) Thanks @w-sss.
+- Telegram/photos: preflight Telegram photo dimension and aspect-ratio rules, and fall back to document sends when image metadata is invalid or unavailable so photo uploads stop failing with `PHOTO_INVALID_DIMENSIONS`. (#52545) Thanks @hnshah.
+- Slack/runtime defaults: trim Slack DM reply overhead, restore Codex auto transport, and tighten Slack/web-search runtime defaults around DM preview threading, cache scoping, warning dedupe, and explicit web-search opt-in. (#53957) Thanks @vincentkoc.
+- Security/gateway config: block agent `config.apply` and `config.patch` writes to `tools.exec.ask` and `tools.exec.security` so gateway config tools cannot silently disable exec approvals or broaden exec security.
+- Security/chat provenance: require `operator.admin` for system provenance injection so `chat.send` callers cannot spoof ACP-only provenance through client identity metadata.
+- Security/exec approvals: treat `/usr/bin/script` as a transparent wrapper during trust-plan resolution and allow-always persistence so wrapper registration cannot broaden exec approvals.
+- Security/Feishu uploads: route local doc and image upload inputs through media local-roots enforcement so Feishu uploads cannot read arbitrary host files outside the allowed sandbox and file policy.
+- Security/dotenv: filter untrusted CWD and workspace-config `.env` entries before startup and config loading so dotenv-based host-env takeover paths can no longer rewrite runtime state or package registries.
+- Security/media parsing: reject traversal and home-directory patterns in the shared media parse layer so parsed media paths cannot escape into arbitrary file reads.
+- Security/path resolution: prefer non-user-writable absolute helper binaries for OpenClaw CLI, ffmpeg, and OpenSSL resolution so PATH hijacks cannot replace trusted helpers with attacker-controlled executables.
+- Security/gateway command scopes: require `operator.admin` before Telegram target writeback and Talk Voice `/voice set` config writes persist through gateway message flows.
+- Security/OpenShell mirror: exclude workspace `hooks/` from mirror sync so untrusted sandbox files cannot become trusted host hooks on gateway startup.
+- Exec env policy: block Mercurial config redirects, Rust compiler wrappers, and GNU make flag env vars in host exec sanitization so inherited env and request-scoped overrides cannot redirect build-tool execution (#317). Thanks @drobison00.
+
diff --git a/CHANGELOG/2026.3.31.md b/CHANGELOG/2026.3.31.md
new file mode 100644
index 0000000000000000000000000000000000000000..eb56001672e4607a942436832232120bf45d8854
--- /dev/null
+++ b/CHANGELOG/2026.3.31.md
@@ -0,0 +1,110 @@
+## 2026.3.31
+
+### Breaking
+
+- Nodes/exec: remove the duplicated `nodes.run` shell wrapper from the CLI and agent `nodes` tool so node shell execution always goes through `exec host=node`, keeping node-specific capabilities on `nodes invoke` and the dedicated media/location/notify actions.
+- Plugin SDK: deprecate the legacy provider compat subpaths plus the older bundled provider setup and channel-runtime compatibility shims, emit migration warnings, and keep the current documented `openclaw/plugin-sdk/*` entrypoints plus local `api.ts` / `runtime-api.ts` barrels as the forward path ahead of a future major-release removal.
+- Skills/install and Plugins/install: built-in dangerous-code `critical` findings and install-time scan failures now fail closed by default, so plugin installs and gateway-backed skill dependency installs that previously succeeded may now require an explicit dangerous override such as `--dangerously-force-unsafe-install` to proceed.
+- Gateway/auth: `trusted-proxy` now rejects mixed shared-token configs, and local-direct fallback requires the configured token instead of implicitly authenticating same-host callers. Thanks @zhangning-agent, @jacobtomlinson, and @vincentkoc.
+- Gateway/node commands: node commands now stay disabled until node pairing is approved, so device pairing alone is no longer enough to expose declared node commands. (#57777) Thanks @jacobtomlinson.
+- Gateway/node events: node-originated runs now stay on a reduced trusted surface, so notification-driven or node-triggered flows that previously relied on broader host/session tool access may need adjustment. (#57691) Thanks @jacobtomlinson.
+
+### Changes
+
+- ACP/plugins: add an explicit default-off ACPX plugin-tools MCP bridge config, document the trust boundary, and harden the built-in bridge packaging/logging path so global installs and stdio MCP sessions work reliably. (#56867) Thanks @joe2643.
+- Agents/LLM: add a configurable idle-stream timeout for embedded runner requests so stalled model streams abort cleanly instead of hanging until the broader run timeout fires. (#55072) Thanks @liuy.
+- Docs/plugins: update the community wecom and qqbot plugin listing to the docs catalog. (#57641) Thanks @sliverp.
+- Agents/MCP: materialize bundle MCP tools with provider-safe names (`serverName__toolName`), support optional `streamable-http` transport selection plus per-server connection timeouts, and preserve real tool results from aborted/error turns unless truncation explicitly drops them. (#49505) Thanks @ziomancer.
+- Android/notifications: add notification-forwarding controls with package filtering, quiet hours, rate limiting, and safer picker behavior for forwarded notification events. (#40175) Thanks @nimbleenigma.
+- Background tasks: turn tasks into a real shared background-run control plane instead of ACP-only bookkeeping by unifying ACP, subagent, cron, and background CLI execution under one SQLite-backed ledger, routing detached lifecycle updates through the executor seam, adding audit/maintenance/status visibility, tightening auto-cleanup and lost-run recovery, improving task awareness in internal status/tool surfaces, and clarifying the split between heartbeat/main-session automation and detached scheduled runs. Thanks @mbelinky and @vincentkoc.
+- Background tasks: add the first linear task flow control surface with `openclaw tasks list|show|cancel`, keep manual multi-task flows separate from one-task auto-sync flows, and surface doctor recovery hints for obviously orphaned or broken flow/task linkage. Thanks @mbelinky and @vincentkoc.
+- Channels/QQ Bot: add QQ Bot as a bundled channel plugin with multi-account setup, SecretRef-aware credentials, slash commands, reminders, and media send/receive support. (#52986) Thanks @sliverp.
+- Diffs: skip unused viewer-versus-file SSR preload work so `diffs` view-only and file-only runs do less render work while keeping mode outputs aligned. (#57909) thanks @gumadeiras.
+- Tasks: add a minimal SQLite-backed task flow registry plus task-to-flow linkage scaffolding, so orchestrated work can start gaining a first-class parent record without changing current task delivery behavior. Thanks @mbelinky and @vincentkoc.
+- Tasks: persist blocked state on one-task task flows and let the same flow reopen cleanly on retry, so blocked detached work can carry a parent-level reason and continue without fragmenting into a new job. Thanks @mbelinky and @vincentkoc.
+- Tasks: route one-task ACP and subagent updates through a parent task-flow owner context, so detached work can emerge back through the intended parent thread/session instead of speaking only as a raw child task. Thanks @mbelinky and @vincentkoc.
+- LINE/outbound media: add LINE image, video, and audio outbound sends on the LINE-specific delivery path, including explicit preview/tracking handling for videos while keeping generic media sends on the existing image-only route. (#45826) Thanks @masatohoshino.
+- Matrix/history: add optional room history context for Matrix group triggers via `channels.matrix.historyLimit`, with per-agent watermarks and retry-safe snapshots so failed trigger retries do not drift into newer room messages. (#57022) thanks @chain710.
+- Matrix/network: add explicit `channels.matrix.proxy` config for routing Matrix traffic through an HTTP(S) proxy, including account-level overrides and matching probe/runtime behavior. (#56931) thanks @patrick-yingxi-pan.
+- Matrix/streaming: add draft streaming so partial Matrix replies update the same message in place instead of sending a new message for each chunk. (#56387) Thanks @jrusz.
+- Matrix/threads: add per-DM `threadReplies` overrides and keep thread session isolation aligned with the effective room or DM thread policy from the triggering message onward. (#57995) thanks @teconomix.
+- MCP: add remote HTTP/SSE server support for `mcp.servers` URL configs, including auth headers and safer config redaction for MCP credentials. (#50396) Thanks @dhananjai1729.
+- Memory/QMD: add per-agent `memorySearch.qmd.extraCollections` so agents can opt into cross-agent session search without flattening every transcript collection into one shared QMD namespace. Thanks @vincentkoc.
+- Microsoft Teams/member info: add a Graph-backed member info action so Teams automations and tools can resolve channel member details directly from Microsoft Graph. (#57528) Thanks @sudie-codes.
+- Nostr/inbound DMs: verify inbound event signatures before pairing or sender-authorization side effects, so forged DM events no longer create pairing requests or trigger reply attempts. Thanks @smaeljaish771 and @vincentkoc.
+- OpenAI/Responses: forward configured `text.verbosity` across Responses HTTP and WebSocket transports, surface it in `/status`, and keep per-agent verbosity precedence aligned with runtime behavior. (#47106) Thanks @merc1305 and @vincentkoc.
+- Pi/Codex: add native Codex web search support for embedded Pi runs, including config/docs/wizard coverage and managed-tool suppression when native Codex search is active. (#46579) Thanks @Evizero.
+- Slack/exec approvals: add native Slack approval routing and approver authorization so exec approval prompts can stay in Slack instead of falling back to the Web UI or terminal. Thanks @vincentkoc.
+- TTS: Add structured provider diagnostics and fallback attempt analytics. (#57954) Thanks @joshavant.
+- WhatsApp/reactions: agents can now react with emoji on incoming WhatsApp messages, enabling more natural conversational interactions like acknowledging a photo with ❤️ instead of typing a reply. Thanks @mcaxtr.
+- Agents/BTW: force `/btw` side questions to disable provider reasoning so Anthropic adaptive-thinking sessions stop failing with `No BTW response generated`. Fixes #55376. Thanks @Catteres and @vincentkoc.
+- CLI/onboarding: reset the remote gateway URL prompt to the safe loopback default after declining a discovered endpoint, so onboarding does not keep a previously rejected remote URL. (#57828).
+- Agents/exec defaults: honor per-agent `tools.exec` defaults when no inline directive or session override is present, so configured exec host, security, ask, and node settings actually apply. (#57689).
+- Sandbox/networking: sanitize SSH subprocess env vars through the shared sandbox policy and route marketplace archive downloads plus Ollama discovery, auth, and pull requests through the guarded fetch path so sandboxed execution and remote fetches follow the repo's trust boundaries. (#57848, #57850).
+
+### Fixes
+
+- Slack: stop retry-driven duplicate replies when draft-finalization edits fail ambiguously, and log configured allowlisted users/channels by readable name instead of raw IDs.
+- Agents/OpenAI Responses: normalize raw bundled MCP tool schemas on the WebSocket/Responses path so bare-object, object-ish, and top-level union MCP tools no longer get rejected by OpenAI during tool registration. (#58299) Thanks @yelog.
+- ACP/security: replace ACP's dangerous-tool name override with semantic approval classes, so only narrow readonly reads/searches can auto-approve while indirect exec-capable and control-plane tools always require explicit prompt approval. Thanks @vincentkoc.
+- ACP: derive owner-only approval classes from the shared tool-policy fallback map so `cron`, `nodes`, and `whatsapp_login` cannot drift out of prompt-required coverage (#201). Thanks @drobison00.
+- ACP/sessions_spawn: register ACP child runs for completion tracking and lifecycle cleanup, and make registration-failure cleanup explicitly best-effort so callers do not assume an already-started ACP turn was fully aborted. (#40885) Thanks @xaeon2026 and @vincentkoc.
+- ACP/tasks: mark cleanly exited ACP runs as blocked when they end on deterministic write or authorization blockers, and wake the parent session with a follow-up instead of falsely reporting success (#57816). Thanks @ForestDengHK.
+- ACPX/runtime: derive the bundled ACPX expected version from the extension package metadata instead of hardcoding a separate literal, so plugin-local ACPX installs stop drifting out of health-check parity after version bumps. (#49089) Thanks @jiejiesks and @vincentkoc.
+- Agents/Anthropic failover: treat Anthropic `api_error` payloads with `An unexpected error occurred while processing the response` as transient so retry/fallback can engage instead of surfacing a terminal failure. (#57441) Thanks @zijiess and @vincentkoc.
+- Agents/compaction: keep late compaction-retry completions from double-resolving finished compaction futures, so interrupted or timed-out compactions stop surfacing spurious second-completion races. (#57796) Thanks @joshavant.
+- Agents/disabled providers: make disabled providers disappear from default model selection and embedded provider fallback, while letting explicitly pinned disabled providers fail with a clear config error instead of silently taking traffic. (#57735) Thanks @rileybrown-dev and @vincentkoc.
+- Agents/OAuth output: force exec-host OAuth output readers through the gateway fs policy so embedded gateway runs stop crashing when provider auth writes land outside the current sandbox workspace. (#58249) Thanks @joshavant.
+- Agents/system prompt: fix `agent.name` interpolation in the embedded runtime system prompt and make provider/model fallback text reflect the effective runtime selection after start. (#57625) Thanks @StllrSvr and @vincentkoc.
+- Android/device info: read the app's version metadata from the package manager instead of hidden APIs so Android 15+ onboarding and device info no longer fail to compile or report placeholder values. (#58126) Thanks @L3ER0Y.
+- Android/pairing: stop appending duplicate push receiver entries to `gateway-service.conf` on repeated QR pairing and keep push registration bounded to the current successful pairing, so Android push delivery stays healthy across re-pair and token rotation. (#58256) Thanks @surrealroad.
+- App install smoke: pin the latest-release lookup to `latest`, cache the first stable install version across the rerun, and relax prerelease package assertions so the Parallels smoke lane can validate stable-to-main upgrades even when `beta` moves ahead or the guest starts from an older stable. (#58177) Thanks @vincentkoc.
+- Auth/profiles: keep the last successful config load in memory for the running process and refresh that snapshot on successful writes/reloads, so hot paths stop reparsing `openclaw.json` between watcher-driven swaps.
+- Config/SecretRef + Control UI: harden SecretRef redaction round-trip restore, block unsafe raw fallback (force Form mode when raw is unavailable), and preflight submitted-config SecretRefs before config write RPC persistence. (#58044) Thanks @joshavant.
+- Config/update: stop `openclaw doctor` write-backs from persisting plugin-injected channel defaults, so `openclaw update` no longer seeds config keys that later break service refresh validation. (#56834) Thanks @openperf.
+- Control UI/agents: auto-load agent workspace files on initial Files panel open, and populate overview model/workspace/fallbacks from effective runtime agent metadata so defaulted models no longer show as `Not set`. (#56637) Thanks @dxsx84.
+- Control UI/slash commands: make `/steer` and `/redirect` work from the chat command palette with visible pending state for active-run `/steer`, correct redirected-run tracking, and a single canonical `/steer` entry in the command menu. (#54625) Thanks @fuller-stack-dev.
+- Cron/announce: preserve all deliverable text payloads for announce mode instead of collapsing to the last chunk, so multi-line cron reports deliver in full to Telegram forum topics (#57816). Thanks @ForestDengHK.
+- Cron/isolated sessions: carry the full live-session provider, model, and auth-profile selection across retry restarts so cron jobs with model overrides no longer fail or loop on mid-run model-switch requests. (#57972) Thanks @issaba1.
+- Diffs/config: preserve schema-shaped plugin config parsing from `diffsPluginConfigSchema.safeParse()`, so direct callers keep `defaults` and `security` sections instead of receiving flattened tool defaults. (#57904) Thanks @gumadeiras.
+- Diffs: fall back to plain text when `lang` hints are invalid during diff render and viewer hydration, so bad or stale language values no longer break the diff viewer. (#57902) Thanks @gumadeiras.
+- Discord/voice: enforce the same guild channel and member allowlist checks on spoken voice ingress before transcription, so joined voice channels no longer accept speech from users outside the configured Discord access policy. Thanks @cyjhhh and @vincentkoc.
+- Docker/setup: force BuildKit for local image builds (including sandbox image builds) so `./docker-setup.sh` no longer fails on `RUN --mount=...` when hosts default to Docker's legacy builder. (#56681) Thanks @zhanghui-china.
+- Docs/anchors: fix broken English docs links and make Mint anchor audits run against the English-source docs tree. (#57039) thanks @velvet-shark.
+- Doctor/plugins: skip false Matrix legacy-helper warnings when no migration plans exist, and keep bundled `enabledByDefault` plugins in the gateway startup set. (#57931) Thanks @dinakars777.
+- Exec approvals/macOS: unwrap `arch` and `xcrun` before deriving shell payloads and allow-always patterns, so wrapper approvals stay bound to the carried command instead of the outer carrier. Thanks @tdjackey and @vincentkoc.
+- Exec approvals: unwrap `caffeinate` and `sandbox-exec` before persisting allow-always trust so later shell payload changes still require a fresh approval. Thanks @tdjackey and @vincentkoc.
+- Exec/approvals: infer Discord and Telegram exec approvers from existing owner config when `execApprovals.approvers` is unset, extend the default approval window to 30 minutes, and clarify approval-unavailable guidance so approvals do not appear to silently disappear (#57816). Thanks @ForestDengHK.
+- Pi/TUI: flush message-boundary replies at `message_end` so turns stop looking stuck until the next nudge when the final reply was already ready. Thanks @vincentkoc.
+- Status/tasks: fall back to same-agent task counts in `/status` when the current session has no linked tasks, keeping the default view useful without exposing other sessions' task details. Thanks @vincentkoc.
+- Status/auto-reply: stop status-only turns from replying twice when inline `/status` handling already produced the reply, so Discord and other chat surfaces no longer emit duplicate status cards. Thanks @vincentkoc.
+- Exec/approvals: keep `awk` and `sed` family binaries out of the low-risk `safeBins` fast path, and stop doctor profile scaffolding from treating them like ordinary custom filters. Thanks @vincentkoc.
+- Exec/env: block proxy, TLS, and Docker endpoint env overrides in host execution so request-scoped commands cannot silently reroute outbound traffic or trust attacker-supplied certificate settings. Thanks @AntAISecurityLab.
+- Exec/env: block Python package index override variables from request-scoped host exec environment sanitization so package fetches cannot be redirected through a caller-supplied index. Thanks @nexrin and @vincentkoc.
+- Exec/node: stop gateway-side workdir fallback from rewriting explicit `host=node` cwd values to the gateway filesystem, so remote node exec approval and runs keep using the intended node-local directory. (#50961) Thanks @openperf.
+- Exec/runtime: default implicit exec to `host=auto`, resolve that target to sandbox only when a sandbox runtime exists, keep explicit `host=sandbox` fail-closed without sandbox, and show `/exec` effective host state in runtime status/docs (#57816). Thanks @ForestDengHK.
+- Exec: fail closed when the implicit sandbox host has no sandbox runtime, and stop denied async approval followups from reusing prior command output from the same session. (#56800) Thanks @scoootscooob.
+- Feishu/groups: keep quoted replies and topic bootstrap context aligned with group sender allowlists so only allowlisted thread messages seed agent context. Thanks @AntAISecurityLab and @vincentkoc.
+- Gateway/attachments: offload large inbound images without leaking `media://` markers into text-only runs, preserve mixed attachment order for model input/transcripts, and fail closed when model image capability cannot be resolved. (#55513) Thanks @Syysean.
+- Gateway/auth: keep shared-auth rate limiting active during WebSocket handshake attempts even when callers also send device-token candidates, so bogus device-token fields no longer suppress shared-secret brute-force tracking. Thanks @kexinoh and @vincentkoc.
+- Gateway/auth: reject mismatched browser `Origin` headers on trusted-proxy HTTP operator requests while keeping origin-less headless proxy clients working. Thanks @AntAISecurityLab and @vincentkoc.
+- Gateway/device tokens: disconnect active device sessions after token rotation so newly rotated credentials revoke existing live connections immediately instead of waiting for those sockets to close naturally. Thanks @zsxsoft and @vincentkoc.
+- Gateway/health: carry webhook-vs-polling account mode from channel descriptors into runtime snapshots so passive channels like LINE and BlueBubbles skip false stale-socket health failures. (#47488) Thanks @karesansui-u.
+- Gateway/pairing: restore QR bootstrap onboarding handoff so fresh `/pair qr` iPhone setup can auto-approve the initial node pairing, receive a reusable node device token, and stop retrying with spent bootstrap auth. (#58382) Thanks @ngutman.
+- Gateway/OpenAI compatibility: accept flat Responses API function tool definitions on `/v1/responses` and preserve `strict` when normalizing hosted tools into the embedded runner, so spec-compliant clients like Codex no longer fail validation or silently lose strict tool enforcement. Thanks @malaiwah and @vincentkoc.
+- Gateway/OpenAI HTTP: restore default operator scopes for bearer-authenticated requests that omit `x-openclaw-scopes`, so headless `/v1/chat/completions` and session-history callers work again after the recent method-scope hardening. (#57596) Thanks @openperf.
+- Gateway/plugins: scope plugin-auth HTTP route runtime clients to read-only access and keep gateway-authenticated plugin routes on write scope, so plugin-owned webhook handlers do not inherit write-capable runtime access by default. Thanks @davidluzsilva and @vincentkoc.
+- Gateway/SecretRef: resolve restart token drift checks with merged service/runtime env sources and hard-fail unsupported mutable SecretRef plus OAuth-profile combinations so restart warnings and policy enforcement match runtime behavior. (#58141) Thanks @joshavant.
+- Gateway/tools HTTP: tighten HTTP tool-invoke authorization so owner-only tools stay off HTTP invoke paths. (#57773) Thanks @jacobtomlinson.
+- Harden async approval followup delivery in webchat-only sessions (#57359) Thanks @joshavant.
+- Heartbeat/auth: prevent exec-event heartbeat runs from inheriting owner-only tool access from the session delivery target, so node exec output stays on the non-owner tool surface even when the target session belongs to the owner. Thanks @AntAISecurityLab and @vincentkoc.
+- Hooks/config: accept runtime channel plugin ids in `hooks.mappings[].channel` (for example `feishu`) instead of rejecting non-core channels during config validation. (#56226) Thanks @AiKrai001.
+- Hooks/session routing: rebind hook-triggered `agent:` session keys to the actual target agent before isolated dispatch so dedicated hook agents keep their own session-scoped tool and plugin identity. Thanks @kexinoh and @vincentkoc.
+- Host exec/env: block additional request-scoped env overrides that can redirect Docker endpoints, trust roots, compiler include paths, package resolution, or Python environment roots during approved host runs. Thanks @tdjackey and @vincentkoc.
+- Image generation/build: write stable runtime alias files into `dist/` and route provider-auth runtime lookups through those aliases so image-generation providers keep resolving auth/runtime modules after rebuilds instead of crashing on missing hashed chunk files (#57816). Thanks @ForestDengHK.
+- iOS/Live Activities: mark the `ActivityKit` import in `LiveActivityManager.swift` as `@preconcurrency` so Xcode 26.4 / Swift 6 builds stop failing on strict concurrency checks. (#57180) Thanks @ngutman.
+- LINE/ACP: add current-conversation binding and inbound binding-routing parity so `/acp spawn .. --thread here`, configured ACP bindings, and active conversation-bound ACP sessions work on LINE like the other conversation channels (#57816). Thanks @ForestDengHK.
+- LINE/markdown: preserve underscores inside Latin, Cyrillic, and CJK words when stripping markdown, while still removing standalone `_italic_` markers on the shared text-runtime path used by LINE and TTS. (#47465) Thanks @jackjin1997.
+- Agents/failover: make overloaded same-provider retry count and retry delay configurable via `auth.cooldowns`, default to one retry with no delay, and document the model-fallback behavior.
+- Ollama/model picker: include configured Ollama models in the opted-in non-PI-native model catalog path so Ollama onboarding shows available models directly after provider selection. (#55290) Thanks @Luckymingxuan.
+
diff --git a/CHANGELOG/2026.3.7.md b/CHANGELOG/2026.3.7.md
new file mode 100644
index 0000000000000000000000000000000000000000..40e35cab962e8b8cd173f4b9b53e891048c5619d
--- /dev/null
+++ b/CHANGELOG/2026.3.7.md
@@ -0,0 +1,362 @@
+## 2026.3.7
+
+### Changes
+
+- Agents/context engine plugin interface: add `ContextEngine` plugin slot with full lifecycle hooks (`bootstrap`, `ingest`, `assemble`, `compact`, `afterTurn`, `prepareSubagentSpawn`, `onSubagentEnded`), slot-based registry with config-driven resolution, `LegacyContextEngine` wrapper preserving existing compaction behavior, scoped subagent runtime for plugin runtimes via `AsyncLocalStorage`, and `sessions.get` gateway method. Enables plugins like `lossless-claw` to provide alternative context management strategies without modifying core compaction logic. Zero behavior change when no context engine plugin is configured. (#22201) thanks @jalehman.
+- ACP/persistent channel bindings: add durable Discord channel and Telegram topic binding storage, routing resolution, and CLI/docs support so ACP thread targets survive restarts and can be managed consistently. (#34873) Thanks @dutifulbob.
+- Telegram/ACP topic bindings: accept Telegram Mac Unicode dash option prefixes in `/acp spawn`, support Telegram topic thread binding (`--thread here|auto`), route bound-topic follow-ups to ACP sessions, add actionable Telegram approval buttons with prefixed approval-id resolution, and pin successful bind confirmations in-topic. (#36683) Thanks @huntharo.
+- Telegram/topic agent routing: support per-topic `agentId` overrides in forum groups and DM topics so topics can route to dedicated agents with isolated sessions. (#33647; based on #31513) Thanks @kesor and @Sid-Qin.
+- Web UI/i18n: add Spanish (`es`) locale support in the Control UI, including locale detection, lazy loading, and language picker labels across supported locales. (#35038) Thanks @DaoPromociones.
+- Onboarding/web search: add provider selection step and full provider list in configure wizard, with SecretRef ref-mode support during onboarding. (#34009) Thanks @kesku and @thewilloftheshadow.
+- Tools/Web search: switch Perplexity provider to Search API with structured results plus new language/region/time filters. (#33822) Thanks @kesku.
+- Gateway: add SecretRef support for gateway.auth.token with auth-mode guardrails. (#35094) Thanks @joshavant.
+- Docker/Podman extension dependency baking: add `OPENCLAW_EXTENSIONS` so container builds can preinstall selected bundled extension npm dependencies into the image for faster and more reproducible startup in container deployments. (#32223) Thanks @sallyom.
+- Plugins/before_prompt_build system-context fields: add `prependSystemContext` and `appendSystemContext` so static plugin guidance can be placed in system prompt space for provider caching and lower repeated prompt token cost. (#35177) thanks @maweibin.
+- Plugins/hook policy: add `plugins.entries.<id>.hooks.allowPromptInjection`, validate unknown typed hook names at runtime, and preserve legacy `before_agent_start` model/provider overrides while stripping prompt-mutating fields when prompt injection is disabled. (#36567) thanks @gumadeiras.
+- Hooks/Compaction lifecycle: emit `session:compact:before` and `session:compact:after` internal events plus plugin compaction callbacks with session/count metadata, so automations can react to compaction runs consistently. (#16788) thanks @vincentkoc.
+- Agents/compaction post-context configurability: add `agents.defaults.compaction.postCompactionSections` so deployments can choose which `AGENTS.md` sections are re-injected after compaction, while preserving legacy fallback behavior when the documented default pair is configured in any order. (#34556) thanks @efe-arv.
+- TTS/OpenAI-compatible endpoints: add `messages.tts.openai.baseUrl` config support with config-over-env precedence, endpoint-aware directive validation, and OpenAI TTS request routing to the resolved base URL. (#34321) thanks @RealKai42.
+- Slack/DM typing feedback: add `channels.slack.typingReaction` so Socket Mode DMs can show reaction-based processing status even when Slack native assistant typing is unavailable. (#19816) Thanks @dalefrieswthat.
+- Discord/allowBots mention gating: add `allowBots: "mentions"` to only accept bot-authored messages that mention the bot. Thanks @thewilloftheshadow.
+- Agents/tool-result truncation: preserve important tail diagnostics by using head+tail truncation for oversized tool results while keeping configurable truncation options. (#20076) thanks @jlwestsr.
+- Cron/job snapshot persistence: skip backup during normalization persistence in `ensureLoaded` so `jobs.json.bak` keeps the pre-edit snapshot for recovery, while preserving backup creation on explicit user-driven writes. (#35234) Thanks @0xsline.
+- CLI: make read-only SecretRef status flows degrade safely (#37023) thanks @joshavant.
+- Tools/Diffs guidance: restore a short system-prompt hint for enabled diffs while keeping the detailed instructions in the companion skill, so diffs usage guidance stays out of user-prompt space. (#36904) thanks @gumadeiras.
+- Tools/Diffs guidance loading: move diffs usage guidance from unconditional prompt-hook injection to the plugin companion skill path, reducing unrelated-turn prompt noise while keeping diffs tool behavior unchanged. (#32630) thanks @sircrumpet.
+- Docs/Web search: remove outdated Brave free-tier wording and replace prescriptive AI ToS guidance with neutral compliance language in Brave setup docs. (#26860) Thanks @HenryLoenwind.
+- Config/Compaction safeguard tuning: expose `agents.defaults.compaction.recentTurnsPreserve` and quality-guard retry knobs through the validated config surface and embedded-runner wiring, with regression coverage for real config loading and schema metadata. (#25557) thanks @rodrigouroz.
+- iOS/App Store Connect release prep: align iOS bundle identifiers under `ai.openclaw.client`, refresh Watch app icons, add Fastlane metadata/screenshot automation, and support Keychain-backed ASC auth for uploads. (#38936) Thanks @ngutman.
+- Mattermost/model picker: add Telegram-style interactive provider/model browsing for `/oc_model` and `/oc_models`, fix picker callback updates, and emit a normal confirmation reply when a model is selected. (#38767) thanks @mukhtharcm.
+- Docker/multi-stage build: restructure Dockerfile as a multi-stage build to produce a minimal runtime image without build tools, source code, or Bun; add `OPENCLAW_VARIANT=slim` build arg for a bookworm-slim variant. (#38479) Thanks @sallyom.
+- Google/Gemini 3.1 Flash-Lite: add first-class `google/gemini-3.1-flash-lite-preview` support across model-id normalization, default aliases, media-understanding image lookups, Google Gemini CLI forward-compat fallback, and docs.
+- Agents/compaction model override: allow `agents.defaults.compaction.model` to route compaction summarization through a different model than the main session, and document the override across config help/reference surfaces. (#38753) thanks @starbuck100.
+
+### Fixes
+
+- Models/MiniMax: stop advertising removed `MiniMax-M2.5-Lightning` in built-in provider catalogs, onboarding metadata, and docs; keep the supported fast-tier model as `MiniMax-M2.5-highspeed`.
+- Models/Vercel AI Gateway: synthesize the built-in `vercel-ai-gateway` provider from `AI_GATEWAY_API_KEY` and auto-discover the live `/v1/models` catalog so `/models vercel-ai-gateway` exposes current refs including `openai/gpt-5.4`.
+- Security/Config: fail closed when `loadConfig()` hits validation or read errors so invalid configs cannot silently fall back to permissive runtime defaults. (#9040) Thanks @joetomasone.
+- Memory/Hybrid search: preserve negative FTS5 BM25 relevance ordering in `bm25RankToScore()` so stronger keyword matches rank above weaker ones instead of collapsing or reversing scores. (#33757) Thanks @lsdcc01.
+- LINE/`requireMention` group gating: align inbound and reply-stage LINE group policy resolution across raw, `group:`, and `room:` keys (including account-scoped group config), preserve plugin-backed reply-stage fallback behavior, and add regression coverage for prefixed-only group/room config plus reply-stage policy resolution. (#35847) Thanks @kirisame-wang.
+- Onboarding/local setup: default unset local `tools.profile` to `coding` instead of `messaging`, restoring file/runtime tools for fresh local installs while preserving explicit user-set profiles. (from #38241, overlap with #34958) Thanks @cgdusek.
+- Gateway/Telegram stale-socket restart guard: only apply stale-socket restarts to channels that publish event-liveness timestamps, preventing Telegram providers from being misclassified as stale solely due to long uptime and avoiding restart/pairing storms after upgrade. (openclaw#38464) (#38643) Thanks @Takhoffman.
+- Onboarding/headless Linux daemon probe hardening: treat `systemctl --user is-enabled` probe failures as non-fatal during daemon install flow so onboarding no longer crashes on SSH/headless VPS environments before showing install guidance. (#37297) Thanks @acarbajal-web.
+- Memory/QMD mcporter Windows spawn hardening: when `mcporter.cmd` launch fails with `spawn EINVAL`, retry via bare `mcporter` shell resolution so QMD recall can continue instead of falling back to builtin memory search. (#27402) Thanks @i0ivi0i.
+- Tools/web_search Brave language-code validation: align `search_lang` handling with Brave-supported codes (including `zh-hans`, `zh-hant`, `en-gb`, and `pt-br`), map common alias inputs (`zh`, `ja`) to valid Brave values, and reject unsupported codes before upstream requests to prevent 422 failures. (#37260) Thanks @heyanming.
+- Models/openai-completions streaming compatibility: force `compat.supportsUsageInStreaming=false` for non-native OpenAI-compatible endpoints during model normalization, preventing usage-only stream chunks from triggering `choices[0]` parser crashes in provider streams. (#8714) Thanks @nonanon1.
+- Tools/xAI native web-search collision guard: drop OpenClaw `web_search` from tool registration when routing to xAI/Grok model providers (including OpenRouter `x-ai/*`) to avoid duplicate tool-name request failures against provider-native `web_search`. (#14749) Thanks @realsamrat.
+- TUI/token copy-safety rendering: treat long credential-like mixed alphanumeric tokens (including quoted forms) as copy-sensitive in render sanitization so formatter hard-wrap guards no longer inject visible spaces into auth-style values before display. (#26710) Thanks @jasonthane.
+- WhatsApp/self-chat response prefix fallback: stop forcing `"[openclaw]"` as the implicit outbound response prefix when no identity name or response prefix is configured, so blank/default prefix settings no longer inject branding text unexpectedly in self-chat flows. (#27962) Thanks @ecanmor.
+- Memory/QMD search result decoding: accept `qmd search` hits that only include `file` URIs (for example `qmd://collection/path.md`) without `docid`, resolve them through managed collection roots, and keep multi-collection results keyed by file fallback so valid QMD hits no longer collapse to empty `memory_search` output. (#28181) Thanks @0x76696265.
+- Memory/QMD collection-name conflict recovery: when `qmd collection add` fails because another collection already occupies the same `path + pattern`, detect the conflicting collection from `collection list`, remove it, and retry add so agent-scoped managed collections are created deterministically instead of being silently skipped; also add warning-only fallback when qmd metadata is unavailable to avoid destructive guesses. (#25496) Thanks @Ramsbaby.
+- Slack/app_mention race dedupe: when `app_mention` dispatch wins while same-`ts` `message` prepare is still in-flight, suppress the later message dispatch so near-simultaneous Slack deliveries do not produce duplicate replies; keep single-retry behavior and add regression coverage for both dropped and successful message-prepare outcomes. (#37033) Thanks @Takhoffman.
+- Gateway/chat streaming tool-boundary text retention: merge assistant delta segments into per-run chat buffers so pre-tool text is preserved in live chat deltas/finals when providers emit post-tool assistant segments as non-prefix snapshots. (#36957) Thanks @Datyedyeguy.
+- TUI/model indicator freshness: prevent stale session snapshots from overwriting freshly patched model selection (and reset per-session freshness when switching session keys) so `/model` updates reflect immediately instead of lagging by one or more commands. (#21255) Thanks @kowza.
+- TUI/final-error rendering fallback: when a chat `final` event has no renderable assistant content but includes envelope `errorMessage`, render the formatted error text instead of collapsing to `"(no output)"`, preserving actionable failure context in-session. (#14687) Thanks @Mquarmoc.
+- TUI/session-key alias event matching: treat chat events whose session keys are canonical aliases (for example `agent:<id>:main` vs `main`) as the same session while preserving cross-agent isolation, so assistant replies no longer disappear or surface in another terminal window due to strict key-form mismatch. (#33937) Thanks @yjh1412.
+- OpenAI Codex OAuth/login parity: keep `openclaw models auth login --provider openai-codex` on the built-in path even without provider plugins, preserve Pi-generated authorize URLs without local scope rewriting, and stop validating successful Codex sign-ins against the public OpenAI Responses API after callback. (#37558; follow-up to #36660 and #24720) Thanks @driesvints, @Skippy-Gunboat, and @obviyus.
+- Agents/config schema lookup: add `gateway` tool action `config.schema.lookup` so agents can inspect one config path at a time before edits without loading the full schema into prompt context. (#37266) Thanks @gumadeiras.
+- Onboarding/API key input hardening: strip non-Latin1 Unicode artifacts from normalized secret input (while preserving Latin-1 content and internal spaces) so malformed copied API keys cannot trigger HTTP header `ByteString` construction crashes; adds regression coverage for shared normalization and MiniMax auth header usage. (#24496) Thanks @fa6maalassaf.
+- Kimi Coding/Anthropic tools compatibility: normalize `anthropic-messages` tool payloads to OpenAI-style `tools[].function` + compatible `tool_choice` when targeting Kimi Coding endpoints, restoring tool-call workflows that regressed after v2026.3.2. (#37038) Thanks @mochimochimochi-hub.
+- Heartbeat/workspace-path guardrails: append explicit workspace `HEARTBEAT.md` path guidance (and `docs/heartbeat.md` avoidance) to heartbeat prompts so heartbeat runs target workspace checklists reliably across packaged install layouts. (#37037) Thanks @stofancy.
+- Node/system.run approvals: bind approval prompts to the exact executed argv text and show shell payload only as a secondary preview, closing basename-spoofed wrapper approval mismatches. Thanks @tdjackey.
+- Subagents/kill-complete announce race: when a late `subagent-complete` lifecycle event arrives after an earlier kill marker, clear stale kill suppression/cleanup flags and re-run announce cleanup so finished runs no longer get silently swallowed. (#37024) Thanks @cmfinlan.
+- Agents/tool-result cleanup timeout hardening: on embedded runner teardown idle timeouts, clear pending tool-call state without persisting synthetic `missing tool result` entries, preventing timeout cleanups from poisoning follow-up turns; adds regression coverage for timeout clear-vs-flush behavior. (#37081) Thanks @Coyote-Den.
+- Agents/openai-completions stream timeout hardening: ensure runtime undici global dispatchers use extended streaming body/header timeouts (including env-proxy dispatcher mode) before embedded runs, reducing forced mid-stream `terminated` failures on long generations; adds regression coverage for dispatcher selection and idempotent reconfiguration. (#9708) Thanks @scottchguard.
+- Agents/fallback cooldown probe execution: thread explicit rate-limit cooldown probe intent from model fallback into embedded runner auth-profile selection so same-provider fallback attempts can actually run when all profiles are cooldowned for `rate_limit` (instead of failing pre-run as `No available auth profile`), while preserving default cooldown skip behavior and adding regression tests at both fallback and runner layers. (#13623) Thanks @asfura.
+- Cron/OpenAI Codex OAuth refresh hardening: when `openai-codex` token refresh fails specifically on account-id extraction, reuse the cached access token instead of failing the run immediately, with regression coverage to keep non-Codex and unrelated refresh failures unchanged. (#36604) Thanks @laulopezreal.
+- TUI/session isolation for `/new`: make `/new` allocate a unique `tui-<uuid>` session key instead of resetting the shared agent session, so multiple TUI clients on the same agent stop receiving each other's replies; also sanitize `/new` and `/reset` failure text before rendering in-terminal. Landed from contributor PR #39238 by @widingmarcus-cyber. Thanks @widingmarcus-cyber.
+- Synology Chat/rate-limit env parsing: honor `SYNOLOGY_RATE_LIMIT=0` as an explicit value while still falling back to the default limit for malformed env values instead of partially parsing them. Landed from contributor PR #39197 by @scoootscooob. Thanks @scoootscooob.
+- Voice-call/OpenAI Realtime STT config defaults: honor explicit `vadThreshold: 0` and `silenceDurationMs: 0` instead of silently replacing them with defaults. Landed from contributor PR #39196 by @scoootscooob. Thanks @scoootscooob.
+- Voice-call/OpenAI TTS speed config: honor explicit `speed: 0` instead of silently replacing it with the default speed. Landed from contributor PR #39318 by @ql-wade. Thanks @ql-wade.
+- launchd/runtime PID parsing: reject `pid <= 0` from `launchctl print` so the daemon state parser no longer treats kernel/non-running sentinel values as real process IDs. Landed from contributor PR #39281 by @mvanhorn. Thanks @mvanhorn.
+- Cron/file permission hardening: enforce owner-only (`0600`) cron store/backup/run-log files and harden cron store + run-log directories to `0700`, including pre-existing directories from older installs. (#36078) Thanks @aerelune.
+- Gateway/remote WS break-glass hostname support: honor `OPENCLAW_ALLOW_INSECURE_PRIVATE_WS=1` for `ws://` hostname URLs (not only private IP literals) across onboarding validation and runtime gateway connection checks, while still rejecting public IP literals and non-unicast IPv6 endpoints. (#36930) Thanks @manju-rn.
+- Routing/binding lookup scalability: pre-index route bindings by channel/account and avoid full binding-list rescans on channel-account cache rollover, preventing multi-second `resolveAgentRoute` stalls in large binding configurations. (#36915) Thanks @songchenghao.
+- Browser/session cleanup: track browser tabs opened by session-scoped browser tool runs and close tracked tabs during `sessions.reset`/`sessions.delete` runtime cleanup, preventing orphaned tabs and unbounded browser memory growth after session teardown. (#36666) Thanks @Harnoor6693.
+- Plugin/hook install rollback hardening: stage installs under the canonical install base, validate and run dependency installs before publish, and restore updates by rename instead of deleting the target path, reducing partial-replace and symlink-rebind risk during install failures.
+- Slack/local file upload allowlist parity: propagate `mediaLocalRoots` through the Slack send action pipeline so workspace-rooted attachments pass `assertLocalMediaAllowed` checks while non-allowlisted paths remain blocked. (synthesis: #36656; overlap considered from #36516, #36496, #36493, #36484, #32648, #30888) Thanks @2233admin.
+- Agents/compaction safeguard pre-check: skip embedded compaction before entering the Pi SDK when a session has no real conversation messages, avoiding unnecessary LLM API calls on idle sessions. (#36451) thanks @Sid-Qin.
+- Config/schema cache key stability: build merged schema cache keys with incremental hashing to avoid large single-string serialization and prevent `RangeError: Invalid string length` on high-cardinality plugin/channel metadata. (#36603) Thanks @powermaster888.
+- iMessage/cron completion announces: strip leaked inline reply tags (for example `[[reply_to:6100]]`) from user-visible completion text so announcement deliveries do not expose threading metadata. (#24600) Thanks @vincentkoc.
+- Cron/manual run enqueue flow: queue `cron.run` requests behind the cron execution lane, return immediate `{ ok: true, enqueued: true, runId }` acknowledgements, preserve `{ ok: true, ran: false, reason }` skip responses for already-running and not-due jobs, and document the asynchronous completion flow. (#40204) Thanks @tyler6204.
+- Control UI/iMessage duplicate reply routing: keep internal webchat turns on dispatcher delivery (instead of origin-channel reroute) so Control UI chats do not duplicate replies into iMessage, while preserving webchat-provider relayed routing for external surfaces. Fixes #33483. Thanks @alicexmolt.
+- Sessions/daily reset transcript archival: archive prior transcript files during stale-session scheduled/daily resets by capturing the previous session entry before rollover, preventing orphaned transcript files on disk. (#35493) Thanks @byungsker.
+- Feishu/group slash command detection: normalize group mention wrappers before command-authorization probing so mention-prefixed commands (for example `@Bot/model` and `@Bot /reset`) are recognized as gateway commands instead of being forwarded to the agent. (#35994) Thanks @liuxiaopai-ai.
+- Control UI/auth token separation: keep the shared gateway token in browser auth validation while reserving cached device tokens for signed device payloads, preventing false `device token mismatch` disconnects after restart/rotation. Landed from contributor PR #37382 by @FradSer. Thanks @FradSer.
+- Gateway/browser auth reconnect hardening: stop counting missing token/password submissions as auth rate-limit failures, and stop auto-reconnecting Control UI clients on non-recoverable auth errors so misconfigured browser tabs no longer lock out healthy sessions. Landed from contributor PR #38725 by @ademczuk. Thanks @ademczuk.
+- Gateway/service token drift repair: stop persisting shared auth tokens into installed gateway service units, flag stale embedded service tokens for reinstall, and treat tokenless service env as canonical so token rotation/reboot flows stay aligned with config/env resolution. Landed from contributor PR #28428 by @l0cka. Thanks @l0cka.
+- Control UI/agents-page selection: keep the edited agent selected after saving agent config changes and reloading the agents list, so `/agents` no longer snaps back to the default agent. Landed from contributor PR #39301 by @MumuTW. Thanks @MumuTW.
+- Gateway/auth follow-up hardening: preserve systemd `EnvironmentFile=` precedence/source provenance in daemon audits and doctor repairs, block shared-password override flows from piggybacking cached device tokens, and fail closed when config-first gateway SecretRefs cannot resolve. Follow-up to #39241.
+- Agents/context pruning: guard assistant thinking/text char estimation against malformed blocks (missing `thinking`/`text` strings or null entries) so pruning no longer crashes with malformed provider content. (openclaw#35146) thanks @Sid-Qin.
+- Agents/transcript policy: set `preserveSignatures` to Anthropic-only handling in `resolveTranscriptPolicy` so Anthropic thinking signatures are preserved while non-Anthropic providers remain unchanged. (#32813) thanks @Sid-Qin.
+- Agents/schema cleaning: detect Venice + Grok model IDs as xAI-proxied targets so unsupported JSON Schema keywords are stripped before requests, preventing Venice/Grok `Invalid arguments` failures. (openclaw#35355) thanks @Sid-Qin.
+- Skills/native command deduplication: centralize skill command dedupe by canonical `skillName` in `listSkillCommandsForAgents` so duplicate suffixed variants (for example `_2`) are no longer surfaced across interfaces outside Discord. (#27521) thanks @shivama205.
+- Agents/xAI tool-call argument decoding: decode HTML-entity encoded xAI/Grok tool-call argument values (`&amp;`, `&quot;`, `&lt;`, `&gt;`, numeric entities) before tool execution so commands with shell operators and quotes no longer fail with parse errors. (#35276) Thanks @Sid-Qin.
+- Linux/WSL2 daemon install hardening: add regression coverage for WSL environment detection, WSL-specific systemd guidance, and `systemctl --user is-enabled` failure paths so WSL2/headless onboarding keeps treating bus-unavailable probes as non-fatal while preserving real permission errors. Related: #36495. Thanks @vincentkoc.
+- Linux/systemd status and degraded-session handling: treat degraded-but-reachable `systemctl --user status` results as available, preserve early errors for truly unavailable user-bus cases, and report externally managed running services as running instead of `not installed`. Thanks @vincentkoc.
+- Agents/thinking-tag promotion hardening: guard `promoteThinkingTagsToBlocks` against malformed assistant content entries (`null`/`undefined`) before `block.type` reads so malformed provider payloads no longer crash session processing while preserving pass-through behavior. (#35143) thanks @Sid-Qin.
+- Gateway/Control UI version reporting: align runtime and browser client version metadata to avoid `dev` placeholders, wait for bootstrap version before first UI websocket connect, and only forward bootstrap `serverVersion` to same-origin gateway targets to prevent cross-target version leakage. (from #35230, #30928, #33928) Thanks @Sid-Qin, @joelnishanth, and @MoerAI.
+- Control UI/markdown parser crash fallback: catch `marked.parse()` failures and fall back to escaped plain-text `<pre>` rendering so malformed recursive markdown no longer crashes Control UI session rendering on load. (#36445) Thanks @BinHPdev.
+- Control UI/markdown fallback regression coverage: add explicit regression assertions for parser-error fallback behavior so malformed markdown no longer risks reintroducing hard-crash rendering paths in future markdown/parser upgrades. (#36445) Thanks @BinHPdev.
+- Web UI/config form: treat `additionalProperties: true` object schemas as editable map entries instead of unsupported fields so Accounts-style maps stay editable in form mode. (#35380, supersedes #32072) Thanks @stakeswky and @liuxiaopai-ai.
+- Feishu/streaming card delivery synthesis: unify snapshot and delta streaming merge semantics, apply overlap-aware final merge, suppress duplicate final text delivery (including text+media final packets), prefer topic-thread `message.reply` routing when a reply target exists, and tune card print cadence to avoid duplicate incremental rendering. (from #33245, #32896, #33840) Thanks @rexl2018, @kcinzgg, and @aerelune.
+- macOS/tray menu: keep injected sessions and device rows below the controls section so toggles and action buttons stay visible even when many sessions are active. (#38079) Thanks @bernesto.
+- Feishu/group mention detection: carry startup-probed bot display names through monitor dispatch so `requireMention` checks compare against current bot identity instead of stale config names, fixing missed `@bot` handling in groups while preserving multi-bot false-positive guards. (#36317, #34271) Thanks @liuxiaopai-ai.
+- Security/dependency audit: patch transitive Hono vulnerabilities by pinning `hono` to `4.12.5` and `@hono/node-server` to `1.19.10` in production resolution paths. Thanks @shakkernerd.
+- Security/dependency audit: bump `tar` to `7.5.10` (from `7.5.9`) to address the high-severity hardlink path traversal advisory (`GHSA-qffp-2rhf-9h96`). Thanks @shakkernerd.
+- Cron/announce delivery robustness: bypass pending-descendant announce guards for cron completion sends, ensure named-agent announce routes have outbound session entries, and fall back to direct delivery only when an announce send was actually attempted and failed. (from #35185, #32443, #34987) Thanks @Sid-Qin, @scoootscooob, and @bmendonca3.
+- Cron/announce best-effort fallback: run direct outbound fallback after attempted announce failures even when delivery is configured as best-effort, so Telegram cron sends are not left as attempted-but-undelivered after `cron announce delivery failed` warnings. Thanks @Takhoffman.
+- Auto-reply/system events: restore runtime system events to the message timeline (`System:` lines), preserve think-hint parsing with prepended events, and carry events into deferred followup/collect/steer-backlog prompts to keep cache behavior stable without dropping queued metadata. (#34794) Thanks @anisoptera.
+- Security/audit account handling: avoid prototype-chain account IDs in audit validation by using own-property checks for `accounts`. (#34982) Thanks @HOYALIM.
+- Cron/restart catch-up semantics: replay interrupted recurring jobs and missed immediate cron slots on startup without replaying interrupted one-shot jobs, with guarded missed-slot probing to avoid malformed-schedule startup aborts and duplicate-trigger drift after restart. (from #34466, #34896, #34625, #33206) Thanks @dunamismax, @dsantoreis, @Octane0411, and @Sid-Qin.
+- Venice/provider onboarding hardening: align per-model Venice completion-token limits with discovery metadata, clamp untrusted discovery values to safe bounds, sync the static Venice fallback catalog with current live model metadata, and disable tool wiring for Venice models that do not support function calling so default Venice setups no longer fail with `max_completion_tokens` or unsupported-tools 400s. Fixes #38168. Thanks @Sid-Qin, @powermaster888 and @vincentkoc.
+- Agents/session usage tracking: preserve accumulated usage metadata on embedded Pi runner error exits so failed turns still update session `totalTokens` from real usage instead of stale prior values. (#34275) thanks @RealKai42.
+- Slack/reaction thread context routing: carry Slack native DM channel IDs through inbound context and threading tool resolution so reaction targets resolve consistently for DM `To=user:*` sessions (including `toolContext.currentChannelId` fallback behavior). (from #34831; overlaps #34440, #34502, #34483, #32754) Thanks @dunamismax.
+- Subagents/announce completion scoping: scope nested direct-child completion aggregation to the current requester run window, harden frozen completion capture for deterministic descendant synthesis, and route completion announce delivery through parent-agent announce turns with provenance-aware internal events. (#35080) Thanks @tyler6204.
+- Nodes/system.run approval hardening: use explicit argv-mutation signaling when regenerating prepared `rawCommand`, and cover the `system.run.prepare -> system.run` handoff so direct PATH-based `nodes.run` commands no longer fail with `rawCommand does not match command`. (#33137) thanks @Sid-Qin.
+- Models/custom provider headers: propagate `models.providers.<name>.headers` across inline, fallback, and registry-found model resolution so header-authenticated proxies consistently receive configured request headers. (#27490) thanks @Sid-Qin.
+- Ollama/remote provider auth fallback: synthesize a local runtime auth key for explicitly configured `models.providers.ollama` entries that omit `apiKey`, so remote Ollama endpoints run without requiring manual dummy-key setup while preserving env/profile/config key precedence and missing-config failures. (#11283) Thanks @cpreecs.
+- Ollama/custom provider headers: forward resolved model headers into native Ollama stream requests so header-authenticated Ollama proxies receive configured request headers. (#24337) thanks @echoVic.
+- Ollama/compaction and summarization: register custom `api: "ollama"` handling for compaction, branch-style internal summarization, and TTS text summarization on current `main`, so native Ollama models no longer fail with `No API provider registered for api: ollama` outside the main run loop. Thanks @JaviLib.
+- Daemon/systemd install robustness: treat `systemctl --user is-enabled` exit-code-4 `not-found` responses as not-enabled by combining stderr/stdout detail parsing, so Ubuntu fresh installs no longer fail with `systemctl is-enabled unavailable`. (#33634) Thanks @Yuandiaodiaodiao.
+- Slack/system-event session routing: resolve reaction/member/pin/interaction system-event session keys through channel/account bindings (with sender-aware DM routing) so inbound Slack events target the correct agent session in multi-account setups instead of defaulting to `agent:main`. (#34045) Thanks @paulomcg, @daht-mad and @vincentkoc.
+- Slack/native streaming markdown conversion: stop pre-normalizing text passed to Slack native `markdown_text` in streaming start/append/stop paths to prevent Markdown style corruption from double conversion. (#34931)
+- Gateway/HTTP tools invoke media compatibility: preserve raw media payload access for direct `/tools/invoke` clients by allowing media `nodes` invoke commands only in HTTP tool context, while keeping agent-context media invoke blocking to prevent base64 prompt bloat. (#34365) Thanks @obviyus.
+- Security/archive ZIP hardening: extract ZIP entries via same-directory temp files plus atomic rename, then re-open and reject post-rename hardlink alias races outside the destination root.
+- Agents/Nodes media outputs: add dedicated `photos_latest` action handling, block media-returning `nodes invoke` commands, keep metadata-only `camera.list` invoke allowed, and normalize empty `photos_latest` results to a consistent response shape to prevent base64 context bloat. (#34332) Thanks @obviyus.
+- TUI/session-key canonicalization: normalize `openclaw tui --session` values to lowercase so uppercase session names no longer drop real-time streaming updates due to gateway/TUI key mismatches. (#33866, #34013) thanks @lynnzc.
+- iMessage/echo loop hardening: strip leaked assistant-internal scaffolding from outbound iMessage replies, drop reflected assistant-content messages before they re-enter inbound processing, extend echo-cache text retention for delayed reflections, and suppress repeated loop traffic before it amplifies into queue overflow. (#33295) Thanks @joelnishanth.
+- Skills/workspace boundary hardening: reject workspace and extra-dir skill roots or `SKILL.md` files whose realpath escapes the configured source root, and skip syncing those escaped skills into sandbox workspaces.
+- Outbound/send config threading: pass resolved SecretRef config through outbound adapters and helper send paths so send flows do not reload unresolved runtime config. (#33987) Thanks @joshavant.
+- gateway: harden shared auth resolution across systemd, discord, and node host (#39241) Thanks @joshavant.
+- Secrets/models.json persistence hardening: keep SecretRef-managed api keys + headers from persisting in generated models.json, expand audit/apply coverage, and harden marker handling/serialization. (#38955) Thanks @joshavant.
+- Sessions/subagent attachments: remove `attachments[].content.maxLength` from `sessions_spawn` schema to avoid llama.cpp GBNF repetition overflow, and preflight UTF-8 byte size before buffer allocation while keeping runtime file-size enforcement unchanged. (#33648) Thanks @anisoptera.
+- Runtime/tool-state stability: recover from dangling Anthropic `tool_use` after compaction, serialize long-running Discord handler runs without blocking new inbound events, and prevent stale busy snapshots from suppressing stuck-channel recovery. (from #33630, #33583) Thanks @kevinWangSheng and @theotarr.
+- ACP/Discord startup hardening: clean up stuck ACP worker children on gateway restart, unbind stale ACP thread bindings during Discord startup reconciliation, and add per-thread listener watchdog timeouts so wedged turns cannot block later messages. (#33699) Thanks @dutifulbob.
+- Extensions/media local-root propagation: consistently forward `mediaLocalRoots` through extension `sendMedia` adapters (Google Chat, Slack, iMessage, Signal, WhatsApp), preserving non-local media behavior while restoring local attachment resolution from configured roots. Synthesis of #33581, #33545, #33540, #33536, #33528. Thanks @bmendonca3.
+- Gateway/plugin HTTP auth hardening: require gateway auth when any overlapping matched route needs it, block mixed-auth fallthrough at dispatch, and reject mixed-auth exact/prefix route overlaps during plugin registration.
+- Feishu/video media send contract: keep mp4-like outbound payloads on `msg_type: "media"` (including reply and reply-in-thread paths) so videos render as media instead of degrading to file-link behavior, while preserving existing non-video file subtype handling. (from #33720, #33808, #33678) Thanks @polooooo, @dingjianrui, and @kevinWangSheng.
+- Gateway/security default response headers: add `Permissions-Policy: camera=(), microphone=(), geolocation=()` to baseline gateway HTTP security headers for all responses. (#30186) thanks @habakan.
+- Plugins/startup loading: lazily initialize plugin runtime, split startup-critical plugin SDK imports into `openclaw/plugin-sdk/core` and `openclaw/plugin-sdk/telegram`, and preserve `api.runtime` reflection semantics for plugin compatibility. (#28620) thanks @hmemcpy.
+- Plugins/startup performance: reduce bursty plugin discovery/manifest overhead with short in-process caches, skip importing bundled memory plugins that are disabled by slot selection, and speed legacy root `openclaw/plugin-sdk` compatibility via runtime root-alias routing while preserving backward compatibility. Thanks @gumadeiras.
+- Build/lazy runtime boundaries: replace ineffective dynamic import sites with dedicated lazy runtime boundaries across Slack slash handling, Telegram audit, CLI send deps, memory fallback, and outbound delivery paths while preserving behavior. (#33690) thanks @gumadeiras.
+- Gateway/password CLI hardening: add `openclaw gateway run --password-file`, warn when inline `--password` is used because it can leak via process listings, and document env/file-backed password input as the preferred startup path. Fixes #27948. Thanks @vibewrk and @vincentkoc.
+- Config/heartbeat legacy-path handling: auto-migrate top-level `heartbeat` into `agents.defaults.heartbeat` (with merge semantics that preserve explicit defaults), and keep startup failures on non-migratable legacy entries in the detailed invalid-config path instead of generic migration-failed errors. (#32706) thanks @xiwan.
+- Plugins/SDK subpath parity: expand plugin SDK subpaths across bundled channels/extensions (Discord, Slack, Signal, iMessage, WhatsApp, LINE, and bundled companion plugins), with build/export/type/runtime wiring so scoped imports resolve consistently in source and dist while preserving compatibility. (#33737) thanks @gumadeiras.
+- Google/Gemini Flash model selection: switch built-in `gemini-flash` defaults and docs/examples from the nonexistent `google/gemini-3.1-flash-preview` ID to the working `google/gemini-3-flash-preview`, while normalizing legacy OpenClaw config that still uses the old Flash 3.1 alias.
+- Plugins/bundled scoped-import migration: migrate bundled plugins from monolithic `openclaw/plugin-sdk` imports to scoped subpaths (or `openclaw/plugin-sdk/core`) across registration and startup-sensitive runtime files, add CI/release guardrails to prevent regressions, and keep root `openclaw/plugin-sdk` support for external/community plugins. Thanks @gumadeiras.
+- Routing/session duplicate suppression synthesis: align shared session delivery-context inheritance, channel-paired route-field merges, and reply-surface target matching so dmScope=main turns avoid cross-surface duplicate replies while thread-aware forwarding keeps intended routing semantics. (from #33629, #26889, #17337, #33250) Thanks @Yuandiaodiaodiao, @kevinwildenradt, @Glucksberg, and @bmendonca3.
+- Routing/legacy session route inheritance: preserve external route metadata inheritance for legacy channel session keys (`agent:<agent>:<channel>:<peer>` and `...:thread:<id>`) so `chat.send` does not incorrectly fall back to webchat when valid delivery context exists. Follow-up to #33786. Thanks @Takhoffman.
+- Routing/legacy route guard tightening: require legacy session-key channel hints to match the saved delivery channel before inheriting external routing metadata, preventing custom namespaced keys like `agent:<agent>:work:<ticket>` from inheriting stale non-webchat routes. Thanks @Takhoffman.
+- Gateway/internal client routing continuity: prevent webchat/TUI/UI turns from inheriting stale external reply routes by requiring explicit `deliver: true` for external delivery, keeping main-session external inheritance scoped to non-Webchat/UI clients, and honoring configured `session.mainKey` when identifying main-session continuity. (from #35321, #34635, #35356) Thanks @alexyyyander and @Octane0411.
+- Security/auth labels: remove token and API-key snippets from user-facing auth status labels so `/status` and `/models` do not expose credential fragments. (#33262) thanks @cu1ch3n.
+- Models/MiniMax portal vision routing: add `MiniMax-VL-01` to the `minimax-portal` provider, route portal image understanding through the MiniMax VLM endpoint, and align media auto-selection plus Telegram sticker description with the shared portal image provider path. (#33953) Thanks @tars90percent.
+- Auth/credential semantics: align profile eligibility + probe diagnostics with SecretRef/expiry rules and harden browser download atomic writes. (#33733) thanks @joshavant.
+- Security/audit denyCommands guidance: suggest likely exact node command IDs for unknown `gateway.nodes.denyCommands` entries so ineffective denylist entries are easier to correct. (#29713) thanks @liquidhorizon88-bot.
+- Agents/overload failover handling: classify overloaded provider failures separately from rate limits/status timeouts, add short overload backoff before retry/failover, record overloaded prompt/assistant failures as transient auth-profile cooldowns (with probeable same-provider fallback) instead of treating them like persistent auth/billing failures, and keep one-shot cron retry classification aligned so overloaded fallback summaries still count as transient retries (#38301). Thanks @altaywtf.
+- Docs/security hardening guidance: document Docker `DOCKER-USER` + UFW policy and add cross-linking from Docker install docs for VPS/public-host setups. (#27613) thanks @dorukardahan.
+- Docs/security threat-model links: replace relative `.md` links with Mintlify-compatible root-relative routes in security docs to prevent broken internal navigation. (#27698) thanks @clawdoo.
+- Plugins/Update integrity drift: avoid false integrity drift prompts when updating npm-installed plugins from unpinned specs, while keeping drift checks for exact pinned versions. (#37179) Thanks @vincentkoc.
+- iOS/Voice timing safety: guard system speech start/finish callbacks to the active utterance to avoid misattributed start events during rapid stop/restart cycles. (#33304) thanks @mbelinky; original implementation direction by @ngutman.
+- Gateway/chat.send command scopes: require `operator.admin` for persistent `/config set|unset` writes routed through gateway chat clients while keeping `/config show` available to normal write-scoped operator clients, preserving messaging-channel config command behavior without widening RPC write scope into admin config mutation. Thanks @tdjackey for reporting.
+- iOS/Talk incremental speech pacing: allow long punctuation-free assistant chunks to start speaking at safe whitespace boundaries so voice responses begin sooner instead of waiting for terminal punctuation. (#33305) thanks @mbelinky; original implementation by @ngutman.
+- iOS/Watch reply reliability: make watch session activation waiters robust under concurrent requests so status/send calls no longer hang intermittently, and align delegate callbacks with Swift 6 actor safety. (#33306) thanks @mbelinky; original implementation by @Rocuts.
+- Docs/tool-loop detection config keys: align `docs/tools/loop-detection.md` examples and field names with the current `tools.loopDetection` schema to prevent copy-paste validation failures from outdated keys. (#33182) Thanks @Mylszd.
+- Gateway/session agent discovery: include disk-scanned agent IDs in `listConfiguredAgentIds` even when `agents.list` is configured, so disk-only/ACP agent sessions remain visible in gateway session aggregation and listings. (#32831) thanks @Sid-Qin.
+- Discord/inbound debouncer: skip bot-own MESSAGE_CREATE events before they reach the debounce queue to avoid self-triggered slowdowns in busy servers. Thanks @thewilloftheshadow.
+- Discord/Agent-scoped media roots: pass `mediaLocalRoots` through Discord monitor reply delivery (message + component interaction paths) so local media attachments honor per-agent workspace roots instead of falling back to default global roots. Thanks @thewilloftheshadow.
+- Discord/slash command handling: intercept text-based slash commands in channels, register plugin commands as native, and send fallback acknowledgments for empty slash runs so interactions do not hang. Thanks @thewilloftheshadow.
+- Discord/thread session lifecycle: reset thread-scoped sessions when a thread is archived so reopening a thread starts fresh without deleting transcript history. Thanks @thewilloftheshadow.
+- Discord/presence defaults: send an online presence update on ready when no custom presence is configured so bots no longer appear offline by default. Thanks @thewilloftheshadow.
+- Discord/typing cleanup: stop typing indicators after silent/NO_REPLY runs by marking the run complete before dispatch idle cleanup. Thanks @thewilloftheshadow.
+- ACP/sandbox spawn parity: block `/acp spawn` from sandboxed requester sessions with the same host-runtime guard already enforced for `sessions_spawn({ runtime: "acp" })`, preserving non-sandbox ACP flows while closing the command-path policy gap. Thanks @patte.
+- Discord/config SecretRef typing: align Discord account token config typing with SecretInput so SecretRef tokens typecheck. (#32490) Thanks @scoootscooob.
+- Discord/voice messages: request upload slots with JSON fetch calls so voice message uploads no longer fail with content-type errors. Thanks @thewilloftheshadow.
+- Discord/voice decoder fallback: drop the native Opus dependency and use opusscript for voice decoding to avoid native-opus installs. Thanks @thewilloftheshadow.
+- Discord/auto presence health signal: add runtime availability-driven presence updates plus connected-state reporting to improve health monitoring and operator visibility. (#33277) Thanks @thewilloftheshadow.
+- HEIC image inputs: accept HEIC/HEIF `input_image` sources in Gateway HTTP APIs, normalize them to JPEG before provider delivery, and document the expanded default MIME allowlist. Thanks @vincentkoc.
+- Gateway/HEIC input follow-up: keep non-HEIC `input_image` MIME handling unchanged, make HEIC tests hermetic, and enforce chat-completions `maxTotalImageBytes` against post-normalization image payload size. Thanks @vincentkoc.
+- Telegram/draft-stream boundary stability: materialize DM draft previews at assistant-message/tool boundaries, serialize lane-boundary callbacks before final delivery, and scope preview cleanup to the active preview so multi-step Telegram streams no longer lose, overwrite, or leave stale preview bubbles. (#33842) Thanks @ngutman.
+- Telegram/DM draft finalization reliability: require verified final-text draft emission before treating preview finalization as delivered, and fall back to normal payload send when final draft delivery is not confirmed (preventing missing final responses and preserving media/button delivery). (#32118) Thanks @OpenCils.
+- Telegram/DM draft final delivery: materialize text-only `sendMessageDraft` previews into one permanent final message and skip duplicate final payload sends, while preserving fallback behavior when materialization fails. (#34318) Thanks @Brotherinlaw-13.
+- Telegram/DM draft duplicate display: clear stale DM draft previews after materializing the real final message, including threadless fallback when DM topic lookup fails, so partial streaming no longer briefly shows duplicate replies. (#36746) Thanks @joelnishanth.
+- Telegram/draft preview boundary + silent-token reliability: stabilize answer-lane message boundaries across late-partial/message-start races, preserve/reset finalized preview state at the correct boundaries, and suppress `NO_REPLY` lead-fragment leaks without broad heartbeat-prefix false positives. (#33169) Thanks @obviyus.
+- Telegram/native commands `commands.allowFrom` precedence: make native Telegram commands honor `commands.allowFrom` as the command-specific authorization source, including group chats, instead of falling back to channel sender allowlists. (#28216) Thanks @toolsbybuddy and @vincentkoc.
+- Telegram/`groupAllowFrom` sender-ID validation: restore sender-only runtime validation so negative chat/group IDs remain invalid entries instead of appearing accepted while still being unable to authorize group access. (#37134) Thanks @qiuyuemartin-max and @vincentkoc.
+- Telegram/native group command auth: authorize native commands in groups and forum topics against `groupAllowFrom` and per-group/topic sender overrides, while keeping auth rejection replies in the originating topic thread. (#39267) Thanks @edwluo.
+- Telegram/named-account DMs: restore non-default-account DM routing when a named Telegram account falls back to the default agent by keeping groups fail-closed but deriving a per-account session key for DMs, including identity-link canonicalization and regression coverage for account isolation. (from #32426; fixes #32351) Thanks @chengzhichao-xydt.
+- Discord/audit wildcard warnings: ignore "\*" wildcard keys when counting unresolved guild channels so doctor/status no longer warns on allow-all configs. (#33125) Thanks @thewilloftheshadow.
+- Discord/channel resolution: default bare numeric recipients to channels, harden allowlist numeric ID handling with safe fallbacks, and avoid inbound WS heartbeat stalls. (#33142) Thanks @thewilloftheshadow.
+- Discord/chunk delivery reliability: preserve chunk ordering when using a REST client and retry chunk sends on 429/5xx using account retry settings. (#33226) Thanks @thewilloftheshadow.
+- Discord/mention handling: add id-based mention formatting + cached rewrites, resolve inbound mentions to display names, and add optional ignoreOtherMentions gating (excluding @everyone/@here). (#33224) Thanks @thewilloftheshadow.
+- Discord/media SSRF allowlist: allow Discord CDN hostnames (including wildcard domains) in inbound media SSRF policy to prevent proxy/VPN fake-ip blocks. (#33275) Thanks @thewilloftheshadow.
+- Telegram/device pairing notifications: auto-arm one-shot notify on `/pair qr`, auto-ping on new pairing requests, and add manual fallback via `/pair approve latest` if the ping does not arrive. (#33299) thanks @mbelinky.
+- Exec heartbeat routing: scope exec-triggered heartbeat wakes to agent session keys so unrelated agents are no longer awakened by exec events, while preserving legacy unscoped behavior for non-canonical session keys. (#32724) thanks @altaywtf.
+- macOS/Tailscale remote gateway discovery: add a Tailscale Serve fallback peer probe path (`wss://<peer>.ts.net`) when Bonjour and wide-area DNS-SD discovery return no gateways, and refresh both discovery paths from macOS onboarding. (#32860) Thanks @ngutman.
+- iOS/Gateway keychain hardening: move gateway metadata and TLS fingerprints to device keychain storage with safer migration behavior and rollback-safe writes to reduce credential loss risk during upgrades. (#33029) thanks @mbelinky.
+- iOS/Concurrency stability: replace risky shared-state access in camera and gateway connection paths with lock-protected access patterns to reduce crash risk under load. (#33241) thanks @mbelinky.
+- iOS/Security guardrails: limit production API-key sourcing to app config and make deep-link confirmation prompts safer by coalescing queued requests instead of silently dropping them. (#33031) thanks @mbelinky.
+- iOS/TTS playback fallback: keep voice playback resilient by switching from PCM to MP3 when provider format support is unavailable, while avoiding sticky fallback on generic local playback errors. (#33032) thanks @mbelinky.
+- Plugin outbound/text-only adapter compatibility: allow direct-delivery channel plugins that only implement `sendText` (without `sendMedia`) to remain outbound-capable, gracefully fall back to text delivery for media payloads when `sendMedia` is absent, and fail explicitly for media-only payloads with no text fallback. (#32788) thanks @liuxiaopai-ai.
+- Telegram/multi-account default routing clarity: warn only for ambiguous (2+) account setups without an explicit default, add `openclaw doctor` warnings for missing/invalid multi-account defaults across channels, and document explicit-default guidance for channel routing and Telegram config. (#32544) thanks @Sid-Qin.
+- Telegram/plugin outbound hook parity: run `message_sending` + `message_sent` in Telegram reply delivery, include reply-path hook metadata (`mediaUrls`, `threadId`), and report `message_sent.success=false` when hooks blank text and no outbound message is delivered. (#32649) Thanks @KimGLee.
+- CLI/Coding-agent reliability: switch default `claude-cli` non-interactive args to `--permission-mode bypassPermissions`, auto-normalize legacy `--dangerously-skip-permissions` backend overrides to the modern permission-mode form, align coding-agent + live-test docs with the non-PTY Claude path, and emit session system-event heartbeat notices when CLI watchdog no-output timeouts terminate runs. (#28610, #31149, #34055). Thanks @niceysam, @cryptomaltese and @vincentkoc.
+- Gateway/OpenAI chat completions: parse active-turn `image_url` content parts (including parameterized data URIs and guarded URL sources), forward them as multimodal `images`, accept image-only user turns, enforce per-request image-part/byte budgets, default URL-based image fetches to disabled unless explicitly enabled by config, and redact image base64 data in cache-trace/provider payload diagnostics. (#17685) Thanks @vincentkoc
+- ACP/ACPX session bootstrap: retry with `sessions new` when `sessions ensure` returns no session identifiers so ACP spawns avoid `NO_SESSION`/`ACP_TURN_FAILED` failures on affected agents. (#28786, #31338, #34055). Thanks @Sid-Qin and @vincentkoc.
+- ACP/sessions_spawn parent stream visibility: add `streamTo: "parent"` for `runtime: "acp"` to forward initial child-run progress/no-output/completion updates back into the requester session as system events (instead of direct child delivery), and emit a tail-able session-scoped relay log (`<sessionId>.acp-stream.jsonl`, returned as `streamLogPath` when available), improving orchestrator visibility for blocked or long-running harness turns. (#34310, #29909; reopened from #34055). Thanks @vincentkoc.
+- Agents/bootstrap truncation warning handling: unify bootstrap budget/truncation analysis across embedded + CLI runtime, `/context`, and `openclaw doctor`; add `agents.defaults.bootstrapPromptTruncationWarning` (`off|once|always`, default `once`) and persist warning-signature metadata so truncation warnings are consistent and deduped across turns. (#32769) Thanks @gumadeiras.
+- Agents/Skills runtime loading: propagate run config into embedded attempt and compaction skill-entry loading so explicitly enabled bundled companion skills are discovered consistently when skill snapshots do not already provide resolved entries. Thanks @gumadeiras.
+- Agents/Session startup date grounding: substitute `YYYY-MM-DD` placeholders in startup/post-compaction AGENTS context and append runtime current-time lines for `/new` and `/reset` prompts so daily-memory references resolve correctly. (#32381) Thanks @chengzhichao-xydt.
+- Agents/Compaction template heading alignment: update AGENTS template section names to `Session Startup`/`Red Lines` and keep legacy `Every Session`/`Safety` fallback extraction so post-compaction context remains intact across template versions. (#25098) thanks @echoVic.
+- Agents/Compaction continuity: expand staged-summary merge instructions to preserve active task status, batch progress, latest user request, and follow-up commitments so compaction handoffs retain in-flight work context. (#8903) thanks @joetomasone.
+- Agents/Compaction safeguard structure hardening: require exact fallback summary headings, sanitize untrusted compaction instruction text before prompt embedding, and keep structured sections when preserving all turns. (#25555) thanks @rodrigouroz.
+- Gateway/status self version reporting: make Gateway self version in `openclaw status` prefer runtime `VERSION` (while preserving explicit `OPENCLAW_VERSION` override), preventing stale post-upgrade app version output. (#32655) thanks @liuxiaopai-ai.
+- Memory/QMD index isolation: set `QMD_CONFIG_DIR` alongside `XDG_CONFIG_HOME` so QMD config state stays per-agent despite upstream XDG handling bugs, preventing cross-agent collection indexing and excess disk/CPU usage. (#27028) thanks @HenryLoenwind.
+- Memory/QMD collection safety: stop destructive collection rebinds when QMD `collection list` only reports names without path metadata, preventing `memory search` from dropping existing collections if re-add fails. (#36870) Thanks @Adnannnnnnna.
+- Memory/QMD duplicate-document recovery: detect `UNIQUE constraint failed: documents.collection, documents.path` update failures, rebuild managed collections once, and retry update so periodic QMD syncs recover instead of failing every run; includes regression coverage to avoid over-matching unrelated unique constraints. (#27649) Thanks @MiscMich.
+- Memory/local embedding initialization hardening: add regression coverage for transient initialization retry and mixed `embedQuery` + `embedBatch` concurrent startup to lock single-flight initialization behavior. (#15639) thanks @SubtleSpark.
+- CLI/Coding-agent reliability: switch default `claude-cli` non-interactive args to `--permission-mode bypassPermissions`, auto-normalize legacy `--dangerously-skip-permissions` backend overrides to the modern permission-mode form, align coding-agent + live-test docs with the non-PTY Claude path, and emit session system-event heartbeat notices when CLI watchdog no-output timeouts terminate runs. Related to #28261. Landed from contributor PRs #28610 and #31149. Thanks @niceysam, @cryptomaltese and @vincentkoc.
+- ACP/ACPX session bootstrap: retry with `sessions new` when `sessions ensure` returns no session identifiers so ACP spawns avoid `NO_SESSION`/`ACP_TURN_FAILED` failures on affected agents. Related to #28786. Landed from contributor PR #31338. Thanks @Sid-Qin and @vincentkoc.
+- LINE/auth boundary hardening synthesis: enforce strict LINE webhook authn/z boundary semantics across pairing-store account scoping, DM/group allowlist separation, fail-closed webhook auth/runtime behavior, and replay/duplication controls (including in-flight replay reservation and post-success dedupe marking). (from #26701, #26683, #25978, #17593, #16619, #31990, #26047, #30584, #18777) Thanks @bmendonca3, @davidahmann, @harshang03, @haosenwang1018, @liuxiaopai-ai, @coygeek, and @Takhoffman.
+- LINE/media download synthesis: fix file-media download handling and M4A audio classification across overlapping LINE regressions. (from #26386, #27761, #27787, #29509, #29755, #29776, #29785, #32240) Thanks @kevinWangSheng, @loiie45e, @carrotRakko, @Sid-Qin, @codeafridi, and @bmendonca3.
+- LINE/context and routing synthesis: fix group/room peer routing and command-authorization context propagation, and keep processing later events in mixed-success webhook batches. (from #21955, #24475, #27035, #28286) Thanks @lailoo, @mcaxtr, @jervyclaw, @Glucksberg, and @Takhoffman.
+- LINE/status/config/webhook synthesis: fix status false positives from snapshot/config state and accept LINE webhook HEAD probes for compatibility. (from #10487, #25726, #27537, #27908, #31387) Thanks @BlueBirdBack, @stakeswky, @loiie45e, @puritysb, and @mcaxtr.
+- LINE cleanup/test follow-ups: fold cleanup/test learnings into the synthesis review path while keeping runtime changes focused on regression fixes. (from #17630, #17289) Thanks @Clawborn and @davidahmann.
+- Mattermost/interactive buttons: add interactive button send/callback support with directory-based channel/user target resolution, and harden callbacks via account-scoped HMAC verification plus sender-scoped DM routing. (#19957) thanks @tonydehnke.
+- Feishu/groupPolicy legacy alias compatibility: treat legacy `groupPolicy: "allowall"` as `open` in both schema parsing and runtime policy checks so intended open-group configs no longer silently drop group messages when `groupAllowFrom` is empty. (from #36358) Thanks @Sid-Qin.
+- Mattermost/plugin SDK import policy: replace remaining monolithic `openclaw/plugin-sdk` imports in Mattermost mention-gating paths/tests with scoped subpaths (`openclaw/plugin-sdk/compat` and `openclaw/plugin-sdk/mattermost`) so `pnpm check` passes `lint:plugins:no-monolithic-plugin-sdk-entry-imports` on baseline. (#36480) Thanks @Takhoffman.
+- Telegram/polls: add Telegram poll action support to channel action discovery and tool/CLI poll flows, with multi-account discoverability gated to accounts that can actually execute polls (`sendMessage` + `poll`). (#36547) thanks @gumadeiras.
+- Agents/failover cooldown classification: stop treating generic `cooling down` text as provider `rate_limit` so healthy models no longer show false global cooldown/rate-limit warnings while explicit `model_cooldown` markers still trigger failover. (#32972) thanks @stakeswky.
+- Agents/failover service-unavailable handling: stop treating bare proxy/CDN `service unavailable` errors as provider overload while keeping them retryable via the timeout/failover path, so transient outages no longer show false rate-limit warnings or block fallback. (#36646) thanks @jnMetaCode.
+- Plugins/HTTP route migration diagnostics: rewrite legacy `api.registerHttpHandler(...)` loader failures into actionable migration guidance so doctor/plugin diagnostics point operators to `api.registerHttpRoute(...)` or `registerPluginHttpRoute(...)`. (#36794) Thanks @vincentkoc
+- Doctor/Heartbeat upgrade diagnostics: warn when heartbeat delivery is configured with an implicit `directPolicy` so upgrades pin direct/DM behavior explicitly instead of relying on the current default. (#36789) Thanks @vincentkoc.
+- Agents/current-time UTC anchor: append a machine-readable UTC suffix alongside local `Current time:` lines in shared cron-style prompt contexts so agents can compare UTC-stamped workspace timestamps without doing timezone math. (#32423) thanks @jriff.
+- Ollama/local model handling: preserve explicit lower `contextWindow` / `maxTokens` overrides during merge refresh, and keep native Ollama streamed replies from surfacing fallback `thinking` / `reasoning` text once real content starts streaming. (#39292) Thanks @vincentkoc.
+- TUI/webchat command-owner scope alignment: treat internal-channel gateway sessions with `operator.admin` as owner-authorized in command auth, restoring cron/gateway/connector tool access for affected TUI/webchat sessions while keeping external channels on identity-based owner checks. (from #35666, #35673, #35704) Thanks @Naylenv, @Octane0411, and @Sid-Qin.
+- Discord/inbound timeout isolation: separate inbound worker timeout tracking from listener timeout budgets so queued Discord replies are no longer dropped when listener watchdog windows expire mid-run. (#36602) Thanks @dutifulbob.
+- Memory/doctor SecretRef handling: treat SecretRef-backed memory-search API keys as configured, and fail embedding setup with explicit unresolved-secret errors instead of crashing. (#36835) Thanks @joshavant.
+- Memory/flush default prompt: ban timestamped variant filenames during default memory flush runs so durable notes stay in the canonical daily `memory/YYYY-MM-DD.md` file. (#34951) thanks @zerone0x.
+- Agents/reply delivery timing: flush embedded Pi block replies before waiting on compaction retries so already-generated assistant replies reach channels before compaction wait completes. (#35489) thanks @Sid-Qin.
+- Agents/gateway config guidance: stop exposing `config.schema` through the agent `gateway` tool, remove prompt/docs guidance that told agents to call it, and keep agents on `config.get` plus `config.patch`/`config.apply` for config changes. (#7382) thanks @kakuteki.
+- Provider/KiloCode: Keep duplicate models after malformed discovery rows, and strip legacy `reasoning_effort` when proxy reasoning injection is skipped. (#32352) Thanks @pandemicsyn and @vincentkoc.
+- Agents/failover: classify periodic provider limit exhaustion text (for example `Weekly/Monthly Limit Exhausted`) as `rate_limit` while keeping explicit `402 Payment Required` variants in billing, so failover continues without misclassifying billing-wrapped quota errors. (#33813) thanks @zhouhe-xydt.
+- Mattermost/interactive button callbacks: allow external callback base URLs and stop requiring loopback-origin requests so button clicks work when Mattermost reaches the gateway over Tailscale, LAN, or a reverse proxy. (#37543) thanks @mukhtharcm.
+- Gateway/chat.send route inheritance: keep explicit external delivery for channel-scoped sessions while preventing shared-main and other channel-agnostic webchat sessions from inheriting stale external routes, so Control UI replies stay on webchat without breaking selected channel-target sessions. (#34669) Thanks @vincentkoc.
+- Telegram/Discord media upload caps: make outbound uploads honor channel `mediaMaxMb` config, raise Telegram's default media cap to 100MB, and remove MIME fallback limits that kept some Telegram uploads at 16MB. Thanks @vincentkoc.
+- Skills/nano-banana-pro resolution override: respect explicit `--resolution` values during image editing and only auto-detect output size from input images when the flag is omitted. (#36880) Thanks @shuofengzhang and @vincentkoc.
+- Skills/openai-image-gen CLI validation: validate `--background` and `--style` inputs early, normalize supported values, and warn when those flags are ignored for incompatible models. (#36762) Thanks @shuofengzhang and @vincentkoc.
+- Skills/openai-image-gen output formats: validate `--output-format` values early, normalize aliases like `jpg -> jpeg`, and warn when the flag is ignored for incompatible models. (#36648) Thanks @shuofengzhang and @vincentkoc.
+- ACP/skill env isolation: strip skill-injected API keys from ACP harness child-process environments so tools like Codex CLI keep their own auth flow instead of inheriting billed provider keys from active skills. (#36316) Thanks @taw0002 and @vincentkoc.
+- WhatsApp media upload caps: make outbound media sends and auto-replies honor `channels.whatsapp.mediaMaxMb` with per-account overrides so inbound and outbound limits use the same channel config. Thanks @vincentkoc.
+- Windows/Plugin install: when OpenClaw runs on Windows via Bun and `npm-cli.js` is not colocated with the runtime binary, fall back to `npm.cmd`/`npx.cmd` through the existing `cmd.exe` wrapper so `openclaw plugins install` no longer fails with `spawn EINVAL`. (#38056) Thanks @0xlin2023.
+- Telegram/send retry classification: retry grammY `Network request .. failed after N attempts` envelopes in send flows without reclassifying plain `Network request .. failed!` wrappers as transient, restoring the intended retry path while keeping broad send-context message matching tight. (#38056) Thanks @0xlin2023.
+- Gateway/probes: keep `/health`, `/healthz`, `/ready`, and `/readyz` reachable when the Control UI is mounted at `/`, preserve plugin-owned route precedence on those paths, and make `/ready` and `/readyz` report channel-backed readiness with startup grace plus `503` on disconnected managed channels, while `/health` and `/healthz` stay shallow liveness probes. (#18446) Thanks @vibecodooor, @mahsumaktas, and @vincentkoc.
+- Feishu/media downloads: drop invalid timeout fields from SDK method calls now that client-level `httpTimeoutMs` applies to requests. (#38267) Thanks @ant1eicher and @thewilloftheshadow.
+- Pi embedded runner/Feishu docs: propagate sender identity into embedded attempts so Feishu doc auto-grant restores requester access for embedded-runner executions. (#32915) thanks @cszhouwei.
+- Agents/usage normalization: normalize missing or partial assistant usage snapshots before compaction accounting so `openclaw agent --json` no longer crashes when provider payloads omit `totalTokens` or related usage fields. (#34977) thanks @sp-hk2ldn.
+- Venice/default model refresh: switch the built-in Venice default to `kimi-k2-5`, update onboarding aliasing, and refresh Venice provider docs/recommendations to match the current private and anonymized catalog. (from #12964) Fixes #20156. Thanks @sabrinaaquino and @vincentkoc.
+- Agents/skill API write pacing: add a global prompt guardrail that treats skill-driven external API writes as rate-limited by default, so runners prefer batched writes, avoid tight request loops, and respect `429`/`Retry-After`. Thanks @vincentkoc.
+- Google Chat/multi-account webhook auth fallback: when `channels.googlechat.accounts.default` carries shared webhook audience/path settings (for example after config normalization), inherit those defaults for named accounts while preserving top-level and per-account overrides, so inbound webhook verification no longer fails silently for named accounts missing duplicated audience fields. Fixes #38369 (#38492). Thanks @Takhoffman.
+- Models/tool probing: raise the tool-capability probe budget from 32 to 256 tokens so reasoning models that spend tokens on thinking before returning a required tool call are less likely to be misclassified as not supporting tools. (#7521) Thanks @jakobdylanc.
+- Gateway/transient network classification: treat wrapped `...: fetch failed` transport messages as transient while avoiding broad matches like `Web fetch failed (404): ...`, preventing Discord reconnect wrappers from crashing the gateway without suppressing non-network tool failures. (#38530) Thanks @xinhuagu.
+- ACP/console silent reply suppression: filter ACP `NO_REPLY` lead fragments and silent-only finals before `openclaw agent` logging/delivery so console-backed ACP sessions no longer leak `NO`/`NO_REPLY` placeholders. (#38436) Thanks @ql-wade.
+- Feishu/reply delivery reliability: disable block streaming in Feishu reply options so plain-text auto-render replies are no longer silently dropped before final delivery. (#38258) Thanks @xinhuagu.
+- Agents/reply MEDIA delivery: normalize local assistant `MEDIA:` paths before block/final delivery, keep media dedupe aligned with message-tool sends, and contain malformed media normalization failures so generated files send reliably instead of falling back to empty responses. (#38572) Thanks @obviyus.
+- Sessions/bootstrap cache rollover invalidation: clear cached workspace bootstrap snapshots whenever an existing `sessionKey` rolls to a new `sessionId` across auto-reply, command, and isolated cron session resolvers, so `AGENTS.md`/`MEMORY.md`/`USER.md` updates are reloaded after daily, idle, or forced session resets instead of staying stale until gateway restart. (#38494) Thanks @LivingInDrm.
+- Gateway/Telegram polling health monitor: skip stale-socket restarts for Telegram long-polling channels and thread channel identity through shared health evaluation so polling connections are not restarted on the WebSocket stale-socket heuristic. (#38395) Thanks @ql-wade and @Takhoffman.
+- Daemon/systemd fresh-install probe: check for OpenClaw's managed user unit before running `systemctl --user is-enabled`, so first-time Linux installs no longer fail on generic missing-unit probe errors. (#38819) Thanks @adaHubble.
+- Gateway/container lifecycle: allow `openclaw gateway stop` to SIGTERM unmanaged gateway listeners and `openclaw gateway restart` to SIGUSR1 a single unmanaged listener when no service manager is installed, so container and supervisor-based deployments are no longer blocked by `service disabled` no-op responses. Fixes #36137. Thanks @vincentkoc.
+- Gateway/Windows restart supervision: relaunch task-managed gateways through Scheduled Task with quoted helper-script command paths, distinguish restart-capable supervisors per platform, and stop orphaned Windows gateway children during self-restart. (#38825) Thanks @obviyus.
+- Telegram/native topic command routing: resolve forum-topic native commands through the same conversation route as inbound messages so topic `agentId` overrides and bound topic sessions target the active session instead of the default topic-parent session. (#38871) Thanks @obviyus.
+- Markdown/assistant image hardening: flatten remote markdown images to plain text across the Control UI, exported HTML, and shared Swift chat while keeping inline `data:image/...` markdown renderable, so model output no longer triggers automatic remote image fetches. (#38895) Thanks @obviyus.
+- Config/compaction safeguard settings: regression-test `agents.defaults.compaction.recentTurnsPreserve` through `loadConfig()` and cover the new help metadata entry so the exposed preserve knob stays wired through schema validation and config UX. (#25557) thanks @rodrigouroz.
+- iOS/Quick Setup presentation: skip automatic Quick Setup when a gateway is already configured (active connect config, last-known connection, preferred gateway, or manual host), so reconnecting installs no longer get prompted to connect again. (#38964) Thanks @ngutman.
+- CLI/Docs memory help accuracy: clarify `openclaw memory status --deep` behavior and align memory command examples/docs with the current search options. (#31803) Thanks @JasonOA888 and @Avi974.
+- Auto-reply/allowlist store account scoping: keep `/allowlist .. --store` writes scoped to the selected account and clear legacy unscoped entries when removing default-account store access, preventing cross-account default allowlist bleed-through from legacy pairing-store reads. Thanks @tdjackey for reporting and @vincentkoc for the fix.
+- Security/Nostr: harden profile mutation/import loopback guards by failing closed on non-loopback forwarded client headers (`x-forwarded-for` / `x-real-ip`) and rejecting `sec-fetch-site: cross-site`; adds regression coverage for proxy-forwarded and browser cross-site mutation attempts.
+- CLI/bootstrap Node version hint maintenance: replace hardcoded nvm `22` instructions in `openclaw.mjs` with `MIN_NODE_MAJOR` interpolation so future minimum-Node bumps keep startup guidance in sync automatically. (#39056) Thanks @onstash.
+- Discord/native slash command auth: honor `commands.allowFrom.discord` (and `commands.allowFrom["*"]`) in guild slash-command pre-dispatch authorization so allowlisted senders are no longer incorrectly rejected as unauthorized. (#38794) Thanks @jskoiz and @thewilloftheshadow.
+- Outbound/message target normalization: ignore empty legacy `to`/`channelId` fields when explicit `target` is provided so valid target-based sends no longer fail legacy-param validation; includes regression coverage. (#38944) Thanks @Narcooo.
+- Models/auth token prompts: guard cancelled manual token prompts so `Symbol(clack:cancel)` values cannot be persisted into auth profiles; adds regression coverage for cancelled `models auth paste-token`. (#38951) Thanks @MumuTW.
+- Gateway/loopback announce URLs: treat `http://` and `https://` aliases with the same loopback/private-network policy as websocket URLs so loopback cron announce delivery no longer fails secure URL validation. (#39064) Thanks @Narcooo.
+- Models/default provider fallback: when the hardcoded default provider is removed from `models.providers`, resolve defaults from configured providers instead of reporting stale removed-provider defaults in status output. (#38947) Thanks @davidemanuelDEV.
+- Agents/cache-trace stability: guard stable stringify against circular references in trace payloads so near-limit payloads no longer crash with `Maximum call stack size exceeded`; adds regression coverage. (#38935) Thanks @MumuTW.
+- Extensions/diffs CI stability: add `headers` to the diffs plugin `localReq` test helper so forwarding-hint checks no longer crash with `req.headers` undefined. (supersedes #39063) Thanks @Shennng.
+- Agents/compaction thresholding: apply `agents.defaults.contextTokens` cap to the model passed into embedded run and `/compact` session creation so auto-compaction thresholds use the effective context window, not native model max context. (#39099) Thanks @MumuTW.
+- Models/merge mode provider precedence: when `models.mode: "merge"` is active and config explicitly sets a provider `baseUrl`, keep config as source of truth instead of preserving stale runtime `models.json` `baseUrl` values; includes normalized provider-key coverage. (#39103) Thanks @BigUncle.
+- UI/Control chat tool streaming: render tool events live in webchat without requiring refresh by enabling `tool-events` capability, fixing stream/event correlation, and resetting/reloading stream state around tool results and terminal events. (#39104) Thanks @jakepresent.
+- Models/provider apiKey persistence hardening: when a provider `apiKey` value equals a known provider env var value, persist the canonical env var name into `models.json` instead of resolved plaintext secrets. (#38889) Thanks @gambletan.
+- Discord/model picker persistence check: add a short post-dispatch settle delay before reading back session model state so picker confirmations stop reporting false mismatch warnings after successful model switches. (#39105) Thanks @akropp.
+- Agents/OpenAI WS compat store flag: omit `store` from `response.create` payloads when model compat sets `supportsStore: false`, preventing strict OpenAI-compatible providers from rejecting websocket requests with unknown-field errors. (#39113) Thanks @scoootscooob.
+- Config/validation log sanitization: sanitize config-validation issue paths/messages before logging so control characters and ANSI escape sequences cannot inject misleading terminal output from crafted config content. (#39116) Thanks @powermaster888.
+- Agents/compaction counter accuracy: count successful overflow-triggered auto-compactions (`willRetry=true`) in the compaction counter while still excluding aborted/no-result events, so `/status` reflects actual safeguard compaction activity. (#39123) Thanks @MumuTW.
+- Gateway/chat delta ordering: flush buffered assistant deltas before emitting tool `start` events so pre-tool text is delivered to Control UI before tool cards, avoiding transient text/tool ordering artifacts in streaming. (#39128) Thanks @0xtangping.
+- Voice-call plugin schema parity: add missing manifest `configSchema` fields (`webhookSecurity`, `streaming.preStartTimeoutMs|maxPendingConnections|maxPendingConnectionsPerIp|maxConnections`, `staleCallReaperSeconds`) so gateway AJV validation accepts already-supported runtime config instead of failing with `additionalProperties` errors. (#38892) Thanks @giumex.
+- Agents/OpenAI WS reconnect retry accounting: avoid double retry scheduling when reconnect failures emit both `error` and `close`, so retry budgets track actual reconnect attempts instead of exhausting early. (#39133) Thanks @scoootscooob.
+- Daemon/Windows schtasks runtime detection: use locale-invariant `Last Run Result` running codes (`0x41301`/`267009`) as the primary running signal so `openclaw node status` no longer misreports active tasks as stopped on non-English Windows locales. (#39076) Thanks @ademczuk.
+- Usage/token count formatting: round near-million token counts to millions (`1.0m`) instead of `1000k`, with explicit boundary coverage for `999_499` and `999_500`. (#39129) Thanks @CurryMessi.
+- Gateway/session bootstrap cache invalidation ordering: clear bootstrap snapshots only after active embedded-run shutdown wait completes, preventing dying runs from repopulating stale cache between `/new`/`sessions.reset` turns. (#38873) Thanks @MumuTW.
+- Browser/dispatcher error clarity: preserve dispatcher-side failure context in browser fetch errors while still appending operator guidance and explicit no-retry model hints, preventing misleading `"Can't reach service"` wrapping and avoiding LLM retry loops. (#39090) Thanks @NewdlDewdl.
+- Telegram/polling offset safety: confirm persisted offsets before polling startup while validating stored `lastUpdateId` values as non-negative safe integers (with overflow guards) so malformed offset state cannot cause update skipping/dropping. (#39111) Thanks @MumuTW.
+- Telegram/status SecretRef read-only resolution: resolve env-backed bot-token SecretRefs in config-only/status inspection while respecting provider source/defaults and env allowlists, so status no longer crashes or reports false-ready tokens for disallowed providers. (#39130) Thanks @neocody.
+- Agents/OpenAI WS max-token zero forwarding: treat `maxTokens: 0` as an explicit value in websocket `response.create` payloads (instead of dropping it as falsy), with regression coverage for zero-token forwarding. (#39148) Thanks @scoootscooob.
+- Podman/.env gateway bind precedence: evaluate `OPENCLAW_GATEWAY_BIND` after sourcing `.env` in `run-openclaw-podman.sh` so env-file overrides are honored. (#38785) Thanks @majinyu666.
+- Models/default alias refresh: bump `gpt` to `openai/gpt-5.4` and Gemini defaults to `gemini-3.1` preview aliases (including normalization/default wiring) to track current model IDs. (#38638) Thanks @ademczuk.
+- Config/env substitution degraded mode: convert missing `${VAR}` resolution in config reads from hard-fail to warning-backed degraded behavior, while preventing unresolved placeholders from being accepted as gateway credentials. (#39050) Thanks @akz142857.
+- Discord inbound listener non-blocking dispatch: make `MESSAGE_CREATE` listener handoff asynchronous (no per-listener queue blocking), so long runs no longer stall unrelated incoming events. (#39154) Thanks @yaseenkadlemakki.
+- Daemon/Windows PATH freeze fix: stop persisting install-time `PATH` snapshots into Scheduled Task scripts so runtime tool lookup follows current host PATH updates; also refresh local TUI history on silent local finals. (#39139) Thanks @Narcooo.
+- Gateway/systemd service restart hardening: clear stale gateway listeners by explicit run-port before service bind, add restart stale-pid port-override support, tune systemd start/stop/exit handling, and disable detached child mode only in service-managed runtime so cgroup stop semantics clean up descendants reliably. (#38463) Thanks @spirittechie.
+- Discord/plugin native command aliases: let plugins declare provider-specific slash names so native Discord registration can avoid built-in command collisions; the bundled Talk voice plugin now uses `/talkvoice` natively on Discord while keeping text `/voice`.
+- Daemon/Windows schtasks status normalization: derive runtime state from locale-neutral numeric `Last Run Result` codes only (without language string matching) and surface unknown when numeric result data is unavailable, preventing locale-specific misclassification drift. (#39153) Thanks @scoootscooob.
+- Telegram/polling conflict recovery: reset the polling `webhookCleared` latch on `getUpdates` 409 conflicts so webhook cleanup re-runs on restart cycles and polling avoids infinite conflict loops. (#39205) Thanks @amittell.
+- Heartbeat/requests-in-flight scheduling: stop advancing `nextDueMs` and avoid immediate `scheduleNext()` timer overrides on requests-in-flight skips, so wake-layer retry cooldowns are honored and heartbeat cadence no longer drifts under sustained contention. (#39182) Thanks @MumuTW.
+- Memory/SQLite contention resilience: re-apply `PRAGMA busy_timeout` on every sync-store and QMD connection open so process restarts/reopens no longer revert to immediate `SQLITE_BUSY` failures under lock contention. (#39183) Thanks @MumuTW.
+- Gateway/webchat route safety: block webchat/control-ui clients from inheriting stored external delivery routes on channel-scoped sessions (while preserving route inheritance for UI/TUI clients), preventing cross-channel leakage from scoped chats. (#39175) Thanks @widingmarcus-cyber.
+- Telegram error-surface resilience: return a user-visible fallback reply when dispatch/debounce processing fails instead of going silent, while preserving draft-stream cleanup and best-effort thread-scoped fallback delivery. (#39209) Thanks @riftzen-bit.
+- Gateway/password auth startup diagnostics: detect unresolved provider-reference objects in `gateway.auth.password` and fail with a specific bootstrap-secrets error message instead of generic misconfiguration output. (#39230) Thanks @ademczuk.
+- Agents/OpenAI-responses compatibility: strip unsupported `store` payload fields when `supportsStore=false` (including OpenAI-compatible non-OpenAI providers) while preserving server-compaction payload behavior. (#39219) Thanks @ademczuk.
+- Agents/model fallback visibility: warn when configured model IDs cannot be resolved and fallback is applied, with log-safe sanitization of model text to prevent control-sequence injection in warning output. (#39215) Thanks @ademczuk.
+- Outbound delivery replay safety: use two-phase delivery ACK markers (`.json` -> `.delivered` -> unlink) and startup marker cleanup so crash windows between send and cleanup do not replay already-delivered messages. (#38668) Thanks @Gundam98.
+- Nodes/system.run approval binding: carry prepared approval plans through gateway forwarding and bind interpreter-style script operands across approval to execution, so post-approval script rewrites are denied while unchanged approved script runs keep working. Thanks @tdjackey for reporting.
+- Nodes/system.run PowerShell wrapper parsing: treat `pwsh`/`powershell` `-EncodedCommand` forms as shell-wrapper payloads so allowlist mode still requires approval instead of falling back to plain argv analysis. Thanks @tdjackey for reporting.
+- Control UI/auth error reporting: map generic browser `Fetch failed` websocket close errors back to actionable gateway auth messages (`gateway token mismatch`, `authentication failed`, `retry later`) so dashboard disconnects stop hiding credential problems. Landed from contributor PR #28608 by @KimGLee. Thanks @KimGLee.
+- Media/mime unknown-kind handling: return `undefined` (not `"unknown"`) for missing/unrecognized MIME kinds and use document-size fallback caps for unknown remote media, preventing phantom `<media:unknown>` Signal events from being treated as real messages. (#39199) Thanks @nicolasgrasset.
+- Nodes/system.run allow-always persistence: honor shell comment semantics during allowlist analysis so `#`-tailed payloads that never execute are not persisted as trusted follow-up commands. Thanks @tdjackey for reporting.
+- Signal/inbound attachment fan-in: forward all successfully fetched inbound attachments through `MediaPaths`/`MediaUrls`/`MediaTypes` (instead of only the first), and improve multi-attachment placeholder summaries in mention-gated pending history. (#39212) Thanks @joeykrug.
+- Nodes/system.run dispatch-wrapper boundary: keep shell-wrapper approval classification active at the depth boundary so `env` wrapper stacks cannot reach `/bin/sh -c` execution without the expected approval gate. Thanks @tdjackey for reporting.
+- Docker/token persistence on reconfigure: reuse the existing `.env` gateway token during `docker-setup.sh` reruns and align compose token env defaults, so Docker installs stop silently rotating tokens and breaking existing dashboard sessions. Landed from contributor PR #33097 by @chengzhichao-xydt. Thanks @chengzhichao-xydt.
+- Agents/strict OpenAI turn ordering: apply assistant-first transcript bootstrap sanitization to strict OpenAI-compatible providers (for example vLLM/Gemma via `openai-completions`) without adding Google-specific session markers, preventing assistant-first history rejections. (#39252) Thanks @scoootscooob.
+- Discord/exec approvals gateway auth: pass resolved shared gateway credentials into the Discord exec-approvals gateway client so token-auth installs stop failing approvals with `gateway token mismatch`. Related to #38179. Thanks @0riginal-claw for the adjacent PR #35147 investigation.
+- Subagents/workspace inheritance: propagate parent workspace directory to spawned subagent runs so child sessions reliably inherit workspace-scoped instructions (`AGENTS.md`, `SOUL.md`, etc.) without exposing workspace override through tool-call arguments. (#39247) Thanks @jasonQin6.
+- Exec approvals/gateway-node policy: honor explicit `ask=off` from `exec-approvals.json` even when runtime defaults are stricter, so trusted full/off setups stop re-prompting on gateway and node exec paths. Landed from contributor PR #26789 by @pandego. Thanks @pandego.
+- Exec approvals/config fallback: inherit `ask` from `exec-approvals.json` when `tools.exec.ask` is unset, so local full/off defaults no longer fall back to `on-miss` for exec tool and `nodes run`. Landed from contributor PR #29187 by @Bartok9. Thanks @Bartok9.
+- Exec approvals/allow-always shell scripts: persist and match script paths for wrapper invocations like `bash scripts/foo.sh` while still blocking `-c`/`-s` wrapper bypasses. Landed from contributor PR #35137 by @yuweuii. Thanks @yuweuii.
+- Queue/followup dedupe across drain restarts: dedupe queued redelivery `message_id` values after queue recreation so busy-session followups no longer duplicate on replayed inbound events. Landed from contributor PR #33168 by @rylena. Thanks @rylena.
+- Telegram/preview-final edit idempotence: treat `message is not modified` errors during preview finalization as delivered so partial-stream final replies do not fall back to duplicate sends. Landed from contributor PR #34983 by @HOYALIM. Thanks @HOYALIM.
+- Telegram/DM streaming transport parity: use message preview transport for all DM streaming lanes so final delivery can edit the active preview instead of sending duplicate finals. Landed from contributor PR #38906 by @gambletan. Thanks @gambletan.
+- Telegram/DM draft streaming restoration: restore native `sendMessageDraft` preview transport for DM answer streaming while keeping reasoning on message transport, with regression coverage to keep draft finalization from sending duplicate finals. (#39398) Thanks @obviyus.
+- Telegram/send retry safety: retry non-idempotent send paths only for pre-connect failures and make custom retry predicates strict, preventing ambiguous reconnect retries from sending duplicate messages. Landed from contributor PR #34238 by @hal-crackbot. Thanks @hal-crackbot.
+- ACP/run spawn delivery bootstrap: stop reusing requester inline delivery targets for one-shot `mode: "run"` ACP spawns, so fresh run-mode workers bootstrap in isolation instead of inheriting thread-bound session delivery behavior. (#39014) Thanks @lidamao633.
+- Discord/DM session-key normalization: rewrite legacy `discord:dm:*` and phantom direct-message `discord:channel:<user>` session keys to `discord:direct:*` when the sender matches, so multi-agent Discord DMs stop falling into empty channel-shaped sessions and resume replying correctly.
+- Discord/native slash session fallback: treat empty configured bound-session keys as missing so `/status` and other native commands fall back to the routed slash session and routed channel session instead of blanking Discord session keys in normal channel bindings.
+- Agents/tool-call dispatch normalization: normalize provider-prefixed tool names before dispatch across `toolCall`, `toolUse`, and `functionCall` blocks, while preserving multi-segment tool suffixes when stripping provider wrappers so malformed-but-recoverable tool names no longer fail with `Tool not found`. (#39328) Thanks @vincentkoc.
+- Agents/parallel tool-call compatibility: honor `parallel_tool_calls` / `parallelToolCalls` extra params only for `openai-completions` and `openai-responses` payloads, preserve higher-precedence alias overrides across config and runtime layers, and ignore invalid non-boolean values so single-tool-call providers like NVIDIA-hosted Kimi stop failing on forced parallel tool-call payloads. (#37048) Thanks @vincentkoc.
+- Config/invalid-load fail-closed: stop converting `INVALID_CONFIG` into an empty runtime config, keep valid settings available only through explicit best-effort diagnostic reads, and route read-only CLI diagnostics through that path so unknown keys no longer silently drop security-sensitive config. (#28140) Thanks @bobsahur-robot and @vincentkoc.
+- Agents/codex-cli sandbox defaults: switch the built-in Codex backend from `read-only` to `workspace-write` so spawned coding runs can edit files out of the box. Landed from contributor PR #39336 by @0xtangping. Thanks @0xtangping.
+- Gateway/health-monitor restart reason labeling: report `disconnected` instead of `stuck` for clean channel disconnect restarts, so operator logs distinguish socket drops from genuinely stuck channels. (#36436) Thanks @Sid-Qin.
+- Control UI/agents-page overrides: auto-create minimal per-agent config entries when editing inherited agents, so model/tool/skill changes enable Save and inherited model fallbacks can be cleared by writing a primary-only override. Landed from contributor PR #39326 by @dunamismax. Thanks @dunamismax.
+- Gateway/Telegram webhook-mode recovery: add `webhookCertPath` to re-upload self-signed certificates during webhook registration and skip stale-socket detection for webhook-mode channels, so Telegram webhook setups survive health-monitor restarts. Landed from contributor PR #39313 by @fellanH. Thanks @fellanH.
+- Discord/config schema parity: add `channels.discord.agentComponents` to the strict Zod config schema so valid `agentComponents.enabled` settings (root and account-scoped) no longer fail with unrecognized-key validation errors. Landed from contributor PR #39378 by @gambletan. Thanks @gambletan and @thewilloftheshadow.
+- ACPX/MCP session bootstrap: inject configured MCP servers into ACP `session/new` and `session/load` for acpx-backed sessions, restoring Canva and other external MCP tools. Landed from contributor PR #39337. Thanks @goodspeed-apps.
+- Control UI/Telegram sender labels: preserve inbound sender labels in sanitized chat history so dashboard user-message groups split correctly and show real group-member names instead of `You`. (#39414) Thanks @obviyus.
+- Agents/failover 402 recovery: keep temporary spend-limit `402` payloads retryable, preserve explicit insufficient-credit billing detection even in long provider payloads, and allow throttled billing-cooldown probes so single-provider setups can recover instead of staying locked out. (#38533) Thanks @xialonglee.
+- Browser/config schema: accept `browser.profiles.*.driver: "openclaw"` while preserving legacy `"clawd"` compatibility in validated config. (#39374; based on #35621) Thanks @gambletan and @ingyukoh.
+- Memory flush/bootstrap file protection: restrict memory-flush runs to append-only `read`/`write` tools and route host-side memory appends through root-enforced safe file handles so flush turns cannot overwrite bootstrap files via `exec` or unsafe raw rewrites. (#38574) Thanks @frankekn.
+- Mattermost/DM media uploads: resolve bare 26-character Mattermost IDs user-first for direct messages so media sends no longer fail with `403 Forbidden` when targets are configured as unprefixed user IDs. (#29925) Thanks @teconomix.
+- Voice-call/OpenAI TTS config parity: add missing `speed`, `instructions`, and `baseUrl` fields to the OpenAI TTS config schema and gate `instructions` to supported models so voice-call overrides validate and route cleanly through core TTS. (#39226) Thanks @ademczuk.
+
+### Breaking
+
+- **BREAKING:** Gateway auth now requires explicit `gateway.auth.mode` when both `gateway.auth.token` and `gateway.auth.password` are configured (including SecretRefs). Set `gateway.auth.mode` to `token` or `password` before upgrade to avoid startup/pairing/TUI failures. (#35094) Thanks @joshavant.
+
diff --git a/CHANGELOG/2026.4.18.md b/CHANGELOG/2026.4.18.md
new file mode 100644
index 0000000000000000000000000000000000000000..4eaec4d93d1c899ce7bffdab26ec3eede4331769
--- /dev/null
+++ b/CHANGELOG/2026.4.18.md
@@ -0,0 +1,77 @@
+## 2026.4.18
+
+### Changes
+
+- Anthropic/models: add Claude Opus 4.7 `xhigh` reasoning effort support and keep it separate from adaptive thinking.
+- Control UI/settings: overhaul the settings and slash-command experience with faster presets, quick-create flows, and refreshed command discovery. (#67819) Thanks @BunsDev.
+- macOS/gateway: add `screen.snapshot` support for macOS app nodes, including runtime plumbing, default macOS allowlisting, and docs for monitor preview flows. (#67954) Thanks @BunsDev.
+
+### Fixes
+
+- Codex/gateway: fix gateway crashes when the codex-acp subprocess terminates abruptly; pending requests now shut down gracefully instead of propagating an uncaught EPIPE through the gateway daemon and connected channels. Fixes #67886. (#67947) Thanks @openperf.
+- Agents/bootstrap: resolve bootstrap from workspace truth instead of stale session transcript markers, keep embedded bootstrap instructions on a hidden user-context prelude, suppress normal `/new` and `/reset` greetings while `BOOTSTRAP.md` is still pending, and make the embedded runner read the bootstrap ritual before replying normally (#68000). Thanks @Takhoffman.
+- Agents/bootstrap: dedupe repeated bootstrap-truncation warnings so startup logs stay actionable. (#67906) Thanks @rubencu.
+- WhatsApp/multi-account: centralize named-account inbound policy, isolate per-account group activation and scoped session keys, preserve legacy activation backfill, and keep `accounts.default` shared defaults aligned across runtime, setup, and compat migration paths. Thanks @mcaxtr.
+- Cron/delivery: clean up isolated sessions after direct deliveries when `deleteAfterRun` is enabled, covering structured and threaded branches that previously bypassed cleanup. (#67807) Thanks @MonkeyLeeT.
+- Gateway/hello-ok: always report negotiated auth metadata and preserve scopes for reused device tokens on successful shared-auth handshakes, including control-ui bypass coverage when no device token is issued. (#67810, #68039) Thanks @BunsDev.
+- Onboarding/non-interactive: preserve existing gateway auth tokens during re-onboard so active local gateway clients are not disconnected by an implicit token rotation. (#67821) Thanks @BKF-Gitty.
+- OpenAI Codex/Responses: unify native Responses API capability detection so Codex OAuth requests emit the required `store: false` field on the native Responses path. (#67918) Thanks @obviyus.
+- WhatsApp/setup: guard personal-phone and allowlist prompt values so setup fails with clear validation errors instead of crashing on undefined prompt text. (#67895) Thanks @lawrence3699.
+- Models/config: preserve an existing `models.json` provider `baseUrl` during merge-mode regeneration so custom endpoints do not get reset on restart. (#67893) Thanks @lawrence3699.
+- Plugin SDK: preserve `secret-input-runtime` function exports in published builds so provider plugins can read SecretRef-backed setup inputs.
+- Plugins/discovery: reuse bundled and global plugin discovery results across workspace cache misses so Windows multi-workspace startup stops redoing the shared synchronous scan. (#67940) Thanks @obviyus.
+- Bundled plugins/install: keep staged bundled plugin runtime imports resolving through the packaged Plugin SDK while omitting checkout-only aliases from the dist inventory, so published installs do not fail on repo-local paths.
+- Plugins/webhooks: enforce synchronous plugin registration with full rollback of failed plugin side effects, and cache SecretRef-backed webhook auth per route so plugin startup and inbound webhook auth stay deterministic. (#67941) Thanks @obviyus.
+- Telegram/polling transport: give the Telegram undici dispatcher pool bounded keep-alive defaults and an explicit lifecycle. Previously every recoverable network error and stall watchdog trip silently replaced the transport, abandoning the old dispatcher pool and its sockets; long-running gateway processes accumulated hundreds of ESTABLISHED connections to `api.telegram.org`, saturating per-IP upstream proxy quotas and causing the actively-used outbound proxy node to time out while every other node still tested healthy. Transports now expose `close()`, `TelegramPollingTransportState` destroys the stale transport on dirty-rebuild, and `TelegramPollingSession` disposes the transport when polling exits — backed by a strict per-origin pool cap on every constructed `Agent`, `ProxyAgent`, and `EnvHttpProxyAgent` as defence in depth (#69476).
+- Telegram/polling: publish successful `getUpdates` calls as account health liveness, avoid false stall restarts after recoverable `getUpdates` errors, and force Telegram API dispatchers to HTTP/1.1 so stalled polling recovers instead of sitting connected-but-dead (#69476).
+- Telegram/ACP bindings: drop persisted DM bindings that still point at missing or failed ACP sessions on restart, while preserving plugin-owned bindings and uncertain store reads. (#67822) Thanks @chinar-amrutkar.
+- Telegram/streaming: keep a transient preview on the same Telegram message when auto-compaction retries an in-flight answer, so streamed replies no longer appear duplicated after compaction. (#66939) Thanks @rubencu.
+- Memory/sqlite-vec: emit the degraded sqlite-vec warning once per degraded episode instead of repeating it for every file write, while preserving the latch across safe-reindex rollback and resetting it when vector state is genuinely rebuilt. (#67898) Thanks @rubencu.
+- Memory-core: preserve stored vector dimensions during read-only recovery so memory indexes do not lose vector metadata while repairing read-only state.
+- Reply/block streaming: preserve post-stream incomplete-turn error payloads after block streaming already emitted content, so users get the warning instead of silence. (#67991) Thanks @obviyus.
+- Telegram/streaming: clear the compaction replay guard after visible non-final boundaries so a post-tool assistant reply rotates to a fresh preview instead of editing the pre-compaction message. (#67993) Thanks @obviyus.
+- Matrix: fix `sessions_spawn --thread` subagent session spawning — thread binding creation, cleanup on session end, and completion-message delivery target resolution now work end-to-end. (#67643) Thanks @eejohnso-ops and @gumadeiras.
+- Slack/streaming: resolve native streaming recipient teams from the inbound user when available, with a monitor-team fallback, so DM and shared-workspace streams target the right recipient more reliably.
+- macOS/webchat: enable Undo and Redo in the composer text input by turning on the native `NSTextView` undo manager. (#34962) Thanks @tylerbittner.
+- macOS/remote SSH: require an already-trusted host key on the macOS remote command, gateway probe, port tunnel, and pairing probe paths by switching `StrictHostKeyChecking=accept-new` to `StrictHostKeyChecking=yes` and centralizing the shared SSH option fragments in `CommandResolver`, so first-time macOS remote connections no longer silently accept an unknown host key and must be trusted ahead of time via `~/.ssh/known_hosts`. (#68199) Thanks @drobison00.
+- CLI/configure: show the channel picker before probing statuses and let remove mode delete configured channel blocks directly from config. (#68007) Thanks @gumadeiras.
+- Control UI/settings: reset scroll position when switching settings pages and align details headers. (#68150) Thanks @BunsDev.
+- WhatsApp/gateway: harden WhatsApp auth persistence and backup recovery, model unstable auth state explicitly in setup/status/health, recover backup-backed login without forcing a fresh QR, and keep local gateway handoff and channel restarts truthful after login. Thanks @mcaxtr.
+- OpenAI Codex/OAuth: keep OpenClaw as the canonical owner for imported Codex CLI OAuth sessions, stop writing refreshed credentials back into `.codex`, and prefer fresher OpenClaw credentials over stale imported CLI state so refresh recovery stays stable. Thanks @vincentkoc.
+- OpenAI Codex/OAuth: treat the OpenAI TLS prerequisites probe as advisory instead of a hard blocker, so Codex sign-in can still proceed when the speculative Node/OpenSSL precheck fails but the real OAuth flow still works. Thanks @vincentkoc.
+- Models status/OAuth health: align OAuth health reporting with the same effective credential view runtime uses, so expired refreshable sessions stop showing healthy by default and fresher imported Codex CLI credentials surface correctly in `models status`, doctor, and gateway auth status. Thanks @vincentkoc.
+- OpenAI Codex/OAuth: keep external CLI OAuth imports runtime-only by overlaying fresher Codex CLI credentials without mutating `auth-profiles.json`, so `.codex` stays a bootstrap/runtime input instead of becoming durable OpenClaw state. Thanks @vincentkoc.
+- OpenAI Codex/OAuth: drop legacy CLI-manager routing from the remaining bootstrap path so Codex and MiniMax CLI imports are matched by their canonical OpenClaw profile ids instead of stale `managedBy` metadata. Thanks @vincentkoc.
+- OpenAI Codex/OAuth: only bootstrap from external CLI OAuth when the local OpenClaw profile is missing or unusable, so healthy local sessions are no longer overridden by fresher `.codex` tokens. Thanks @vincentkoc.
+- OpenAI Codex/OAuth: rename the external CLI bootstrap helper, reuse the same usable-oauth check across runtime fallback paths, and add debug logs plus health coverage so bootstrap decisions stay legible. Thanks @vincentkoc.
+- Twitch/setup: load Twitch through the bundled setup-entry discovery path and keep setup/status account detection aligned with runtime config. (#68008) Thanks @gumadeiras.
+- Feishu/card actions: resolve card-action chat type from the Feishu chat API when stored context is missing, preferring `chat_mode` over `chat_type`, so DM-originated card actions no longer bypass `dmPolicy` by falling through to the group handling path. (#68201) Thanks @drobison00.
+- Cron/isolated-agent: preserve `trusted: false` on isolated cron awareness events mirrored into the main session, and forward the optional `trusted` flag through the gateway cron wrapper so explicit trust downgrades survive session-key scoping. (#68210) Thanks @drobison00.
+- Agents/fallback: recognize bare leading ZenMux `402 ...` quota-refresh errors without misclassifying plain numeric `402 ...` text, and keep the embedded fallback regression coverage stable. (#47579) Thanks @bwjoke.
+- Failover/google: only treat `INTERNAL` status payloads as retryable timeouts when they also carry a `500` code, so malformed non-500 payloads do not enter the retry path. (#68238) Thanks @altaywtf and @Openbling.
+- Agents/tools: filter bundled MCP/LSP tools through the final owner-only and tool-policy pipeline after merging them into the effective tool list, so existing allowlists, deny rules, sandbox policy, subagent policy, and owner-only restrictions apply to bundled tools the same way they apply to core tools. (#68195) Thanks @drobison00.
+- Gateway/assistant media: require `operator.read` scope for assistant-media file and metadata requests on identity-bearing HTTP auth paths so callers without a read scope can no longer access assistant media. (#68175) Thanks @eleqtrizit.
+- Gateway/web: allow same-origin microphone access in the Permissions-Policy header so browser voice capture can work from the Control UI and webchat origin. (#68368).
+- Exec approvals/display: escape raw control characters (including newline and carriage return) in the shared and macOS approval-prompt command sanitizers, so trailing command payloads no longer render on hidden extra lines in the approval UI. (#68198) Thanks @drobison00.
+- Telegram/streaming: fence same-session stale preview and finalization work after aborts so Telegram no longer replays an older reply or flushes a hidden short preview after the abort confirmation lands. (#68100) Thanks @rubencu.
+- OpenAI Codex/OAuth + Pi: keep imported Codex CLI OAuth bootstrap, Pi auth export, and runtime overlay handling aligned so Codex sessions survive refresh and health checks without leaking transient CLI state into saved auth files. Thanks @vincentkoc.
+- OpenAI Codex/OAuth: keep Codex-specific auth bridging inside the owning plugins, preserve canonical imported CLI profiles, and allow legacy identity-less main-store OAuth sessions to upgrade during refresh mirroring. (#68284) Thanks @vincentkoc.
+- Config/redact: add `browser.cdpUrl` and `browser.profiles.*.cdpUrl` to sensitive URL config paths so embedded credentials (query tokens and HTTP Basic auth) are properly redacted in `config.get` API responses and availability error messages. (#67679) Thanks @Ziy1-Tan.
+- Agents/TTS: report failed speech synthesis as a real tool error so unconfigured providers no longer feed successful TTS failure output back into agent loops. (#67980) Thanks @lawrence3699.
+- Gateway/wake: allow unknown properties on wake payloads so external senders like Paperclip can attach opaque metadata without failing schema validation. (#68355) Thanks @kagura-agent.
+- Matrix: honor `channels.matrix.network.dangerouslyAllowPrivateNetwork` when creating clients for private-network homeservers. (#68332) Thanks @kagura-agent.
+- Cron/message tool: keep cron-owned runs with `delivery.mode: "none"` on the normal message-tool path so they can still send explicit messages, create threads, and route conditionally when no runner-owned delivery target is active. (#68482) Thanks @obviyus.
+- Agents/failover: avoid treating bare leading `402 ...` prose as billing errors while still recognizing proxy subscription failures. (#45827) Thanks @junyuc25.
+- Config/$schema: preserve root-authored `$schema` during partial config rewrites without injecting include-only schema URLs into the root config. (#47322) Thanks @EfeDurmaz16.
+- Agents/CLI delivery: run the same reply-media path normalizer the auto-reply flow uses before shipping `openclaw agent --deliver` payloads, so relative `MEDIA:./out/photo.png` tokens resolve against the agent workspace instead of being rejected downstream with `LocalMediaAccessError: Local media path is not under an allowed directory`. Thanks @frankekn.
+- Agents/Google: strip `thinkingBudget=0` for the thinking-required `gemini-2.5-pro` model in embedded-runner and native Google payloads, so requests no longer fail with `Budget 0 is invalid. This model only works in thinking mode.` and the API uses its default thinking behavior instead. (#68607) Thanks @josmithiii.
+- Slack/threads: log failed thread starter and history fetches at verbose level while preserving best-effort fallback behavior, so missing Slack thread context is diagnosable without interrupting inbound handling. (#68594) Thanks @martingarramon.
+- Gateway/restart: keep stale-gateway cleanup from terminating the current process's parent or ancestors, so plugin sidecars like WeChat no longer kill the active gateway and trigger an infinite supervisor restart loop. Fixes #68451. (#68517) Thanks @openperf.
+- Gateway/auth: reject gateway auth credentials that match published example placeholders at startup and secret reload, and keep cloud install snippets from publishing copy-paste gateway/keyring secrets. (#68404) Thanks @coygeek.
+- CLI/update: preserve macOS restart helper launchctl failures in the update restart log without letting log setup block the restart path. (#68492) Thanks @hclsys.
+- Slack/threads: keep file-only root messages as starter context so first thread replies can still hydrate starter media. (#68594) Thanks @martingarramon.
+- Google/Antigravity: resolve forward-compatible Gemini 3.1 Pro custom-tools and Flash variants from the bundled Google plugin templates, so `google-antigravity/gemini-3.1-pro-preview-customtools` no longer falls through to an unknown-model error. Fixes #35512.
+- Active Memory: raise the blocking recall timeout ceiling to 120 seconds and reject larger config values during plugin schema validation. Fixes #68410. (#68480) Thanks @Bartok9.
+- Control UI/chat: keep history-backed user image uploads visible after chat reload while filtering blocked or non-image transcript media paths. (#68415) Thanks @mraleko.
+- Matrix/plugins: keep remaining Matrix event helpers on the canonical `matrix-js-sdk` subpath so build and plugin-load entrypoint checks stay consistent. (#68498) Thanks @masatohoshino.
+
diff --git a/CHANGELOG/2026.4.19-beta.2.md b/CHANGELOG/2026.4.19-beta.2.md
new file mode 100644
index 0000000000000000000000000000000000000000..4b617c862f839810e85a560e4f69b3776c2ad827
--- /dev/null
+++ b/CHANGELOG/2026.4.19-beta.2.md
@@ -0,0 +1,9 @@
+## 2026.4.19-beta.2
+
+### Fixes
+
+- Agents/openai-completions: always send `stream_options.include_usage` on streaming requests, so local and custom OpenAI-compatible backends report real context usage instead of showing 0%. (#68746) Thanks @kagura-agent.
+- Agents/nested lanes: scope nested agent work per target session so a long-running nested run on one session no longer head-of-line blocks unrelated sessions across the gateway. (#67785) Thanks @stainlu.
+- Agents/status: preserve carried-forward session token totals for providers that omit usage metadata, so `/status` and `openclaw sessions` keep showing the last known context usage instead of dropping back to unknown/0%. (#67695) Thanks @stainlu.
+- Install/update: keep legacy update verification compatible with the QA Lab runtime shim, so updating older global installs to beta no longer fails after npm installs the package successfully.
+
diff --git a/CHANGELOG/2026.4.22.md b/CHANGELOG/2026.4.22.md
new file mode 100644
index 0000000000000000000000000000000000000000..0293eac81ac9e0efa6f32bcd3aa9426e0b19b620
--- /dev/null
+++ b/CHANGELOG/2026.4.22.md
@@ -0,0 +1,201 @@
+## 2026.4.22
+
+### Changes
+
+- Providers/xAI: add image generation, text-to-speech, and speech-to-text support, including `grok-imagine-image` / `grok-imagine-image-pro`, reference-image edits, six live xAI voices, MP3/WAV/PCM/G.711 TTS formats, `grok-stt` audio transcription, and xAI realtime transcription for Voice Call streaming. (#68694) Thanks @KateWilkins.
+- Providers/STT: add Voice Call streaming transcription for Deepgram, ElevenLabs, and Mistral, alongside the existing OpenAI and xAI realtime STT paths; ElevenLabs also gains Scribe v2 batch audio transcription for inbound media.
+- TUI: add local embedded mode for running terminal chats without a Gateway while keeping plugin approval gates enforced. (#66767) Thanks @fuller-stack-dev.
+- Onboarding: auto-install missing provider and channel plugins during setup so first-run configuration can complete without manual plugin recovery. Thanks @vincentkoc.
+- OpenAI/Responses: use OpenAI's native `web_search` tool automatically for direct OpenAI Responses models when web search is enabled and no managed search provider is pinned; explicit providers such as Brave keep the managed `web_search` tool.
+- Models/commands: add `/models add <provider> <modelId>` so you can register a model from chat and use it without restarting the gateway; keep `/models` as a simple provider browser while adding clearer add guidance and copy-friendly command examples. (#70211) Thanks @Takhoffman.
+- WhatsApp: add configurable native reply quoting with replyToMode for WhatsApp conversations. Thanks @mcaxtr.
+- WhatsApp/groups+direct: forward per-group and per-direct `systemPrompt` config into inbound context `GroupSystemPrompt` so configured per-chat behavioral instructions are injected on every turn. Supports `"*"` wildcard fallback and account-scoped overrides under `channels.whatsapp.accounts.<id>.{groups,direct}`; account maps fully replace root maps (no deep merge), matching the existing `requireMention` pattern. Closes #7011. (#59553) Thanks @Bluetegu.
+- Agents/sessions: add mailbox-style `sessions_list` filters for label, agent, and search plus visibility-scoped derived title and last-message previews. (#69839) Thanks @dangoZhang.
+- Control UI/settings+chat: add a browser-local personal identity for the operator (name plus local-safe avatar), route user identity rendering through the shared chat/avatar path used by assistant and agent surfaces, and tighten Quick Settings, agent fallback chips, and narrow-screen chat layouts so personalization no longer wastes space or clips controls. (#70362) Thanks @BunsDev.
+- Gateway/diagnostics: enable payload-free stability recording by default and add a support-ready diagnostics export with sanitized logs, status, health, config, and stability snapshots for bug reports. (#70324) Thanks @gumadeiras.
+- Agents/trajectory export: add default-on local trajectory capture plus `/export-trajectory` bundles with redacted transcripts, runtime events, prompts, metadata, and artifacts for reproducible debugging and dataset export. (#70291) Thanks @scoootscooob.
+- Providers/Tencent: add the bundled Tencent Cloud provider plugin with TokenHub onboarding, docs, `hy3-preview` model catalog entries, and tiered Hy3 pricing metadata. (#68460) Thanks @JuniperSling.
+- WeCom: surface the official WeCom channel plugin during setup and refresh its display name and description so onboarding points at the supported bundled channel. Thanks @vincentkoc.
+- Providers/Amazon Bedrock Mantle: add Claude Opus 4.7 through Mantle's Anthropic Messages route with provider-owned bearer-auth streaming, so the model is actually callable without treating AWS bearer tokens like Anthropic API keys. Thanks @wirjo.
+- Providers/GPT-5: move the GPT-5 prompt overlay into the shared provider runtime so compatible GPT-5 models receive the same behavior and heartbeat guidance through OpenAI, OpenRouter, OpenCode, Codex, and other GPT providers; add `agents.defaults.promptOverlays.gpt5.personality` as the global friendly-style toggle while keeping the OpenAI plugin setting as a fallback.
+- Providers/OpenAI Codex: remove the Codex CLI auth import path from onboarding and provider discovery so OpenClaw no longer copies `~/.codex` OAuth material into agent auth stores; use browser login or device pairing instead. (#70390) Thanks @pashpashpash.
+- CLI/Claude: default `claude-cli` runs to warm stdio sessions, including custom configs that omit transport fields, and resume from the stored Claude session after Gateway restarts or idle exits. (#69679) Thanks @obviyus.
+- Pi/models: update the bundled pi packages to `0.68.1` and let the OpenCode Go catalog come from pi instead of plugin-maintained model aliases, adding the refreshed `opencode-go/kimi-k2.6`, Qwen, GLM, MiMo, and MiniMax entries.
+- Tokenjuice: add bundled native OpenClaw support for tokenjuice as an opt-in plugin that compacts noisy `exec` and `bash` tool results in Pi embedded runs. (#69946) Thanks @vincentkoc.
+- ACPX: add an explicit `openClawToolsMcpBridge` option that injects a core OpenClaw MCP server for selected built-in tools, starting with `cron`.
+- CLI/doctor plugins: lazy-load doctor plugin paths and prefer installed plugin `dist/*` runtime entries over source-adjacent JavaScript fallbacks, reducing the measured `doctor --non-interactive` runtime by about 74% while keeping cold doctor startup on built plugin artifacts. (#69840) Thanks @gumadeiras.
+- CLI/debugging: add an opt-in temporary debug timing helper for local CLI performance investigations, with readable stderr output, JSONL capture, and docs for removing probes before landing fixes. (#70469) Thanks @shakkernerd.
+- Docs/i18n: add Thai translation support for the docs site.
+- Providers/OpenAI-compatible: mark known local backends such as vLLM, SGLang, llama.cpp, LM Studio, LocalAI, Jan, TabbyAPI, and text-generation-webui as streaming-usage compatible, so their token accounting no longer degrades to unknown/stale totals. (#68711) Thanks @gaineyllc.
+- Providers/OpenAI-compatible: recover streamed token usage from llama.cpp-style `timings.prompt_n` / `timings.predicted_n` metadata and sanitize usage counts before accumulation, fixing unknown or stale totals when compatible servers do not emit an OpenAI-shaped `usage` object. (#41056) Thanks @xaeon2026.
+- Plugins/startup: prefer native Jiti loading for built bundled plugin dist modules on supported runtimes, cutting measured bundled plugin load time by 82-90% while keeping source TypeScript on the transform path. (#69925) Thanks @aauren.
+- Plugin SDK/STT: share realtime transcription WebSocket transport and multipart batch transcription form helpers across bundled STT providers, reducing provider plugin boilerplate while preserving proxy capture, reconnects, audio queueing, close flushing, upload filename normalization, and ready handshakes.
+- Plugin SDK/Pi embedded runs: add a bundled-plugin embedded extension factory seam so native plugins can extend Pi embedded runs with async runtime hooks such as `tool_result` handling instead of falling back to the older synchronous persistence path. (#69946) Thanks @vincentkoc.
+- Codex harness/hooks: route native Codex app-server turns through `before_prompt_build` and emit `before_compaction` / `after_compaction` for native compaction items so prompt and compaction hooks stop drifting from Pi. Thanks @vincentkoc.
+- Codex harness/plugins: add a bundled-plugin Codex app-server extension seam for async `tool_result` middleware, fire `after_tool_call` for Codex tool runs, and route mirrored Codex transcript writes through `before_message_write` so tool integrations stop diverging from Pi. Thanks @vincentkoc.
+- Codex harness/hooks: fire `llm_input`, `llm_output`, and `agent_end` for native Codex app-server turns so lifecycle hooks stop drifting from Pi. Thanks @vincentkoc.
+- QA/Telegram: record per-scenario reply RTT in the live Telegram QA report and summary, starting with the canary response. (#70550) Thanks @obviyus.
+- Status: add an explicit `Runner:` field to `/status` so sessions now report whether they are running on embedded Pi, a CLI-backed provider, or an ACP harness agent/backend such as `codex (acp/acpx)` or `gemini (acp/acpx)`. (#70595) Thanks @Takhoffman.
+
+### Fixes
+
+- Dependencies: refresh workspace package pins and lockfile entries for AWS SDK, Anthropic SDK, ACP SDK, Matrix crypto, TypeBox, Vite, tsdown, Slack Bolt, CopilotKit AIMock, and related bundled plugin packages.
+- Gateway/env: import each missing expected login-shell env var independently, so an existing gateway token no longer prevents `env.shellEnv` from loading plugin credentials such as `TWILIO_*` from `.profile`.
+- macOS/Gateway pairing: silently accept same-host native app `metadata-upgrade` reconnects, so macOS patch-version changes update paired metadata instead of spamming security audit warnings and `pairing required` disconnects.
+- CLI/Gateway: wait for one-shot gateway RPC clients to finish WebSocket teardown before the CLI process exits, reducing hangs where commands like `openclaw status` or `openclaw version` could finish their work but stay alive until an external timeout killed them (#70691). Thanks @Takhoffman.
+- Thinking defaults/status: raise the implicit default thinking level for reasoning-capable models from legacy `off`/`low` fallback behavior to a safe provider-supported `medium` equivalent when no explicit config default is set, preserve configured-model reasoning metadata when runtime catalog loading is empty, and make `/status` report the same resolved default as runtime (#70601). Thanks @Takhoffman.
+- Gateway/model pricing: extend OpenRouter and LiteLLM catalog fetch timeouts to 60 seconds, reducing noisy timeout warnings during slow upstream responses.
+- Agents/failover: classify bare undici transport failures (`terminated`, `UND_ERR_SOCKET`, `UND_ERR_CONNECT_TIMEOUT`, body/header timeouts, aborted streams) and pi-ai's openai-codex `Request failed` sentinel as `timeout`, so Cloudflare 502s with empty bodies and mid-response socket resets actually enter the configured fallback chain instead of surfacing as unclassified errors. Fixes #69368. (#69677) Thanks @sk7n4k3d.
+- Providers/Anthropic Vertex: restore ADC-backed model discovery after the lightweight provider-discovery path by resolving emitted discovery entries, exposing synthetic auth on bootstrap discovery, and honoring copied env snapshots when probing the default GCP ADC path. Fixes #65715. (#65716) Thanks @feiskyer.
+- Plugins/install: add newly installed plugin ids to an existing `plugins.allow` list before enabling them, so allowlisted configs load installed plugins after restart.
+- Status: show `Fast` in `/status` when fast mode is enabled, including config/default-derived fast mode, and omit it when disabled.
+- OpenAI/image generation: detect Azure OpenAI-style image endpoints, use Azure `api-key` auth plus deployment-scoped image URLs, and honor `AZURE_OPENAI_API_VERSION` so image generation and edits work against Azure-hosted OpenAI resources. (#70570) Thanks @zhanggpcsu.
+- Control UI/chat: include cache-read and cache-write tokens when computing the message footer context percentage, so cached Claude/OpenAI sessions no longer show `0% ctx` while `/status` reports substantial context use. Fixes #70491. (#70532) Thanks @chen-zhang-cs-code.
+- Models/auth: merge provider-owned default-model additions from `openclaw models auth login` instead of replacing `agents.defaults.models`, so re-authenticating an OAuth provider such as OpenAI Codex no longer wipes other providers' aliases and per-model params. Migrations that must rename keys (Anthropic -> Claude CLI) opt in with `replaceDefaultModels`. Fixes #69414. (#70435) Thanks @neeravmakwana.
+- Media understanding/audio: prefer configured or key-backed STT providers before auto-detected local Whisper CLIs, so installed local transcription tools no longer shadow API providers such as Groq/OpenAI in `tools.media.audio` auto mode. Fixes #68727.
+- Providers/OpenAI: lock the auth picker wording for OpenAI API key, Codex browser login, and Codex device pairing so the setup choices no longer imply a mixed Codex/API-key auth path. (#67848) Thanks @tmlxrd.
+- Agents/BTW: route `/btw` side questions through provider stream registration with the session workspace, so Ollama provider URL construction and workspace-scoped hooks apply correctly. Fixes #68336. (#70413) Thanks @suboss87.
+- Agents/sessions: make session transcript write locks non-reentrant by default, so same-process transcript writers contend unless a helper explicitly opts into nested lock ownership.
+- ACPX/probe: expose an optional `probeAgent` plugin config field so the embedded ACP runtime health probe can target a configured agent (for example `opencode` or `claude`) instead of hardcoding `codex`, and stop marking the entire ACP runtime backend unavailable when the default probe agent is simply not installed or not authenticated. (#68409) Thanks @lyfuci.
+- Memory search: use sqlite-vec KNN for vector recall while preserving full post-filter result limits in multi-model indexes. Fixes #69666. (#69680) Thanks @aalekh-sarvam.
+- Providers/OpenAI Codex: stop stale per-agent `openai-codex:default` OAuth profiles from shadowing a newer main-agent identity-scoped profile, and let `openclaw doctor` offer the matching cleanup. (#70393) Thanks @pashpashpash.
+- ACPX: route OpenClaw ACP bridge commands through the MCP-free runtime path even when the command is wrapped with `env`, has bridge flags, or is resumed from persisted session state, so documented `acpx openclaw` setups no longer fail on per-session MCP injection. (#68741) Thanks @alexlomt.
+- Codex harness: route Codex-tagged MCP tool approval elicitations through OpenClaw plugin approvals, including current empty-schema app-server requests, while leaving generic user-input prompts fail-closed. (#68807) Thanks @kesslerio.
+- WhatsApp/outbound: hold an in-memory active-delivery claim while a live outbound send is in flight, so a concurrent reconnect drain no longer re-drives the same pending queue entry and duplicates cron sends 7-12x after the 30-minute inbound-silence watchdog fires mid-delivery. Crash-replay of fresh queue entries left behind by a dead process is preserved because the claim is intentionally process-local. Fixes #70386. (#70428) Thanks @neeravmakwana.
+- Matrix/commands: keep Matrix DM allowlist state out of room control-command authorization, so trusted DM senders do not accidentally gain room-command access.
+- Providers/SDK retry: cap long `Retry-After` sleeps in Stainless-based Anthropic/OpenAI model SDKs so 60s+ retry windows surface immediately for OpenClaw failover instead of blocking the run. (#68474) Thanks @jetd1.
+- Agents/TTS: preserve spoken text in TTS tool results while defusing reply directives in transcript content, so future turns remember voice replies without treating spoken `MEDIA:` or voice tags as delivery metadata. (#68869) Thanks @zqchris.
+- Providers/OpenAI: harden Voice Call realtime transcription against OpenAI Realtime session-update drift, forward language and prompt hints, and add live coverage for realtime STT.
+- Agents/Pi embedded runs: suppress the "⚠️ Agent couldn't generate a response" warning when the assistant already delivered user-visible content through a messaging tool and the turn ended cleanly (`stopReason=stop`). Real failure modes (tool errors, provider `stopReason=error`, interrupted tool use) still surface the existing "verify before retrying" warning. Fixes #70396. (#70425) Thanks @neeravmakwana.
+- Auto-reply/WebChat: preserve the active session mapping when context-overflow recovery or auto-compaction fails, and return retry, `/compact`, and `/new` guidance instead of silently rotating to a fresh session. Fixes #70472. (#70479) Thanks @fuller-stack-dev.
+- Gateway/Linux: wrap gateway-managed supervisor, PTY, MCP stdio, and browser child processes in a tiny `/bin/sh` shim that raises the child's own `oom_score_adj` on Linux, so under cgroup memory pressure the kernel prefers transient workers over the long-lived gateway. Opt out with `OPENCLAW_CHILD_OOM_SCORE_ADJ=0`. Fixes #70404. (#70419) Thanks @neeravmakwana.
+- Providers/Moonshot: stop strict-sanitizing Kimi's native tool_call IDs (shaped like `functions.<name>:<index>`) on the OpenAI-compatible transport, so multi-turn agentic flows through Kimi K2.6 no longer break after 2-3 tool-calling rounds when the serving layer fails to match mangled IDs against the original tool definitions. Adds a `sanitizeToolCallIds` opt-out to the shared `openai-compatible` replay family helper and wires Moonshot to it. Fixes #62319. (#70030) Thanks @LeoDu0314.
+- Dependencies/security: override transitive `uuid` to `14.0.0`, clearing the runtime advisory across dependencies.
+- Codex harness: ignore dynamic tool descriptions when deciding whether to reuse a native app-server thread while still fingerprinting tool schemas, so channel-specific copy changes no longer reset otherwise compatible Codex conversations. (#69976) Thanks @chen-zhang-cs-code.
+- Codex harness: expose the Codex app-server model catalog in `models list/status`, avoid startup hangs from app-server discovery timeouts, and accept current Codex turn-completion notifications so Docker live gateway turns finish reliably.
+- Codex harness: drop invalid legacy app-server `serviceTier` values such as `"priority"` before native thread and turn requests, while keeping supported Codex tiers limited to `"fast"` and `"flex"`. Fixes #64815.
+- Codex harness: show bounded, sanitized permission target samples in app-server approval prompts, so native permission requests keep their specific hosts, roots, and paths visible without leaking home usernames or URL credentials. (#70340) Thanks @Lucenx9.
+- Docs/Codex harness: narrow native compaction docs to the current start/completion signals, without promising a readable summary or kept-entry audit list yet. (#69612) Thanks @91wan.
+- Providers/Amazon Bedrock: use known context-window metadata for discovered models while keeping the unknown-model fallback conservative, so compaction and overflow handling improve for newer Bedrock models without overstating unlisted model limits. Thanks @wirjo.
+- Providers/Amazon Bedrock Mantle: refresh IAM-backed bearer tokens at runtime instead of baking discovery-time tokens into provider config, so long-lived Mantle sessions keep working after the initial token ages out. Thanks @wirjo.
+- Config/includes: write through single-file top-level includes for isolated OpenClaw-owned mutations, so `plugins install` and `plugins update` update an included `plugins.json5` file instead of flattening modular `$include` configs. Fixes #41050 and #66048.
+- Config/reload: plan gateway reloads from source-authored config instead of runtime-materialized snapshots, so plugin update writes no longer trigger false restarts from derived provider/plugin config paths. Fixes #68732.
+- Plugins/update: skip npm plugin reinstall/config rewrites when the installed version and recorded artifact identity already match the registry target, let bare npm package names resolve back to tracked install records, and point already-installed `plugins install` attempts at `plugins update` / `--force` instead of a hook-pack fallback. Fixes #46955, #67957, and #68073.
+- Agents/MCP: keep `mcp.servers` and bundle MCP tools available in Pi embedded runs. `coding` and `messaging` sessions while preserving `minimal` profile and `tools.deny: ["bundle-mcp"]` opt-out behavior. Fixes #68875 and #68818.
+- Plugins/startup: tolerate transient bundled-channel catalog/metadata drift while auto-enabling configured plugins, so CLI and gateway startup no longer crash when a channel id is known but its display metadata is unavailable.
+- CLI/Claude: report CLI-backed reply runs as streaming while Claude/Codex CLI turns are still in flight, so WebChat keeps visible response state until the backend finishes. Fixes #70125.
+- Slack/streaming: fall back to normal Slack replies for Slack Connect streams rejected before the SDK flushes its local buffer, so short replies no longer disappear or report success before Slack acknowledges delivery. Fixes #70295. (#70370) Thanks @mvanhorn.
+- Codex harness: rotate the shared app-server websocket client when the configured bearer token changes, so auth-token refreshes reconnect with the new `Authorization` header instead of reusing a stale socket. (#70328) Thanks @Lucenx9.
+- Channels/sandbox: derive runtime policy keys for external direct messages that share the main conversation, so sandbox/tool policy no longer treats channel-originated DMs as local main-session runs.
+- Config/models: merge provider-scoped model allowlist updates and protect model/provider map writes from accidental full replacement, adding `config set --merge` for additive updates and `--replace` for intentional clobbers. Fixes #65920, #68392, and #68653.
+- Agents/Pi auth: preserve AWS SDK-authenticated Bedrock runs for IMDS and task-role setups, clear stale refresh timers on sentinel fallback, and log unexpected runtime-auth prep failures instead of silently leaving the provider unauthenticated. Thanks @wirjo.
+- Config/gateway: restore last-known-good config on critical clobber signatures such as missing metadata, missing `gateway.mode`, or sharp size drops, preventing gateway crash loops when a valid backup exists. Fixes #70336.
+- Config/gateway: recover configs accidentally prefixed with non-JSON output during gateway startup or `openclaw doctor --fix`, preserving the clobbered file as a backup while leaving normal config reads read-only.
+- Agents/GitHub Copilot: normalize connection-bound Responses item IDs in the Copilot provider wrapper so replayed histories no longer fail after the upstream connection changes. (#69362) Thanks @Menci.
+- Pi embedded runs: pass real built-in tools into Pi session creation and then narrow active tool names after custom tool registration, so the runner and compaction paths compile cleanly and keep OpenClaw-managed custom tool allowlists without feeding string arrays into `createAgentSession`. Thanks @vincentkoc.
+- Agents/OpenAI websocket: route native OpenAI websocket metadata and session-header decisions through the shared endpoint classifier so local mocks and custom `models.providers.openai.baseUrl` endpoints stay out of the native OpenAI path consistently across embedded-runner and websocket transport code. Thanks @vincentkoc.
+- Cron/MCP: retire bundled MCP runtimes through one shared cleanup path for isolated cron run ends, persistent cron session rollover, and direct cron `deleteAfterRun` fallback cleanup. Fixes #69145, #68623, and #68827.
+- Cron: default legacy persisted jobs that are missing `sessionTarget` during store load and report a clear validation error if a malformed job still reaches execution, preventing undefined `startsWith` crashes on scheduled ticks. Fixes #70360 and #63383. (#70367) Thanks @mvanhorn.
+- MCP/gateway: tear down stdio MCP process trees on transport close and dispose bundled MCP runtimes during session delete/reset, preventing orphaned wrapper/server processes from accumulating. Fixes #68809 and #69465.
+- Agents/MCP: retire bundled MCP runtimes after completed one-shot subagent cleanup and nested `sessions_send` steps, while keeping persistent subagent sessions warm.
+- Config: render validation warnings with real line breaks instead of a literal `\n` sequence in CLI/audit output. Fixes #70140.
+- Cron/doctor: repair malformed persisted cron job IDs through `openclaw doctor`, including legacy `jobId`, non-string `id`, and missing `id` rows, so `cron list` no longer needs display-layer coercion for corrupt store data. Fixes #70128.
+- Discord: normalize prefixed channel targets only at the thread-binding API boundary, so `sessions_spawn({ runtime: "acp", thread: true })` can create child threads from Discord channels without breaking current-channel ACP bindings. (#68034) Thanks @Zetarcos.
+- Discord: harden inbound thread metadata handling against partial Carbon channel getters, so non-command thread messages and queued jobs no longer crash when `name`, `parentId`, `parent`, or `ownerId` requires fetched raw data. Thanks @neeravmakwana.
+- Discord: let `message` tool reactions resolve `user:<id>` DM targets and preserve `channels.discord.guilds.<guild>.channels.<channel>.requireMention: false` during reply-stage activation fallback. Fixes #70165 and #69441.
+- Plugins/startup: pre-normalize and cache Jiti alias maps before creating plugin loaders, so module-scoped loader filenames do not reintroduce per-plugin alias-normalization startup cost. Fixes #70186.
+- ACP/Codex: run the bundled Codex ACP harness with an isolated `CODEX_HOME` and avoid writing incomplete ChatGPT auth bridge files, so Codex ACP sessions no longer clobber the user's real Codex CLI auth. Fixes #70234. Thanks @Lonobers88.
+- Gateway/client: keep long-running RPCs such as ACP `agent.wait` calls in charge of their own timeout instead of closing the websocket on a missed app-level tick while work is still pending.
+- Telegram/webhooks: lower the grammY webhook callback timeout to 5s so Telegram gets an early 200 response instead of retrying long-running updates as read timeouts. (#70146) Thanks @friday-james.
+- Telegram/polling: rebuild the polling HTTP transport after `getUpdates` 409 conflicts, so retries use a fresh TCP connection instead of looping on a Telegram-terminated keep-alive socket. (#69873) Thanks @hclsys.
+- Media delivery: strip persisted base64 audio payloads from webchat history, resolve stored `media://inbound/*` attachments before local-root checks, suppress duplicate Telegram voice/audio sends when TTS emits the same media twice, and support custom image-model IDs that already include their provider prefix.
+- Slack/files: resolve `downloadFile` bot tokens from the runtime config when callers provide `cfg` without an explicit token or prebuilt client, preserving cfg-only file downloads outside the action runtime path. (#70160) Thanks @martingarramon.
+- Slack/HTTP: dispatch registered Request URL webhooks through the same handler registry used by Slack monitor setup, so HTTP-mode Slack events no longer 404 after successful route registration. (#70275) Thanks @FroeMic.
+- Slack/runtime bindings: route focused Slack thread replies through their bound ACP session instead of preparing replies against the default agent shell. Fixes #67739. Thanks @Frankla20.
+- CLI/Claude: keep stored Claude CLI sessions through OAuth refresh-token rotation by keying auth epochs on stable account identity instead of mutable OAuth token material. (#70452) Thanks @obviyus.
+- CLI/Claude: verify stored Claude CLI session ids have a readable project transcript before resuming, clearing phantom bindings with `reason=transcript-missing` instead of silently starting fresh under `--resume`. Fixes #70177.
+- CLI sessions: persist CLI session clearing through the atomic session-store merge path, so expired Claude/Codex CLI bindings are actually removed before retrying without the stale session id. (#70298) Thanks @HFConsultant.
+- ACP/sessions_spawn: honor explicit `model` overrides for ACP child sessions instead of silently falling back to the target agent default model. (#70210) Thanks @felix-miao.
+- Diffs/viewer: re-read remote viewer access policy from live runtime config on each request, so toggling `plugins.entries.diffs.config.security.allowRemoteViewer` closes proxied viewer access immediately instead of waiting for a restart. Thanks @vincentkoc.
+- Diffs/tooling: re-read `viewerBaseUrl`, presentation defaults, and viewer access policy from live runtime config, and fail closed when the live `diffs` plugin entry disappears instead of reviving startup viewer settings. Thanks @vincentkoc.
+- Memory/LanceDB: stop resurrecting removed live `memory-lancedb` hook config from startup snapshots, so deleting or disabling the plugin entry shuts off auto-recall and auto-capture without a restart. Thanks @vincentkoc.
+- Memory/LanceDB: keep auto-recall and auto-capture hooks wired when those settings start disabled, so turning them on in live config starts recall and capture without waiting for a restart. Thanks @vincentkoc.
+- Skill Workshop: keep the tool plus `before_prompt_build` / `agent_end` hooks wired while the plugin is disabled at startup, so turning the plugin back on in live config starts guidance and capture without waiting for a restart. Thanks @vincentkoc.
+- Active Memory: stop reviving removed live `active-memory` config from startup snapshots, so removing the plugin entry turns the hook off immediately instead of waiting for a restart. Thanks @vincentkoc.
+- GitHub Copilot: re-read plugin discovery config from the live runtime snapshot, so toggling `plugins.entries.github-copilot.config.discovery.enabled` takes effect without a restart. Thanks @vincentkoc.
+- Ollama: re-read plugin discovery config from the live runtime snapshot, so toggling `plugins.entries.ollama.config.discovery.enabled` takes effect without a restart. Thanks @vincentkoc.
+- OpenAI: re-read the plugin prompt-overlay personality from live runtime config, so GPT-5 system prompt contributions update without a restart when `plugins.entries.openai.config.personality` changes. Thanks @vincentkoc.
+- Amazon Bedrock: re-read live discovery and guardrail plugin config, so toggling `plugins.entries.amazon-bedrock.config.discovery` or `plugins.entries.amazon-bedrock.config.guardrail` takes effect without a restart. Thanks @vincentkoc.
+- Codex: re-read the plugin discovery config from the live runtime snapshot, so toggling `plugins.entries.codex.config.discovery` takes effect without a restart. Thanks @vincentkoc.
+- Agents/subagents: drop bare `NO_REPLY` from the parent turn when the session still has pending spawned children, so direct-conversation surfaces such as Telegram DMs no longer rewrite the sentinel into visible fallback chatter while waiting for the child completion event. (#69942) Thanks @neeravmakwana.
+- Plugins/install: keep bundled plugin dependencies off npm install while repairing them when plugins activate from a packaged install, including Feishu/Lark, Browser, and direct bundled channel setup-entry loads.
+- CLI/channels: skip and cache bundled channel plugin, setup, and secrets load failures during read-only discovery, so one broken unused bundled channel cannot crash `openclaw status` or bootstrap secret scans.
+- Memory/LanceDB: retry initialization after a failed LanceDB load and report unsupported Intel macOS native runtime clearly instead of caching the failure or repeatedly attempting an install that cannot work.
+- CLI/Claude: hash only static extra system prompt parts when deciding whether to reuse a CLI session, so per-message inbound metadata no longer resets Claude CLI conversations on every turn. (#70122) Thanks @zijunl.
+- Hooks/Slack: standardize shared message hook routing fields (`threadId` / `replyToId`) and stop Slack outbound delivery from re-running `message_sending` inside the channel adapter, so plugins like thread-ownership make one outbound routing decision per reply. Thanks @vincentkoc.
+- Auto-reply/media: share one run-scoped reply media context between streamed block delivery and final payload filtering, so a local `MEDIA:` attachment is staged once and duplicate media sends are suppressed reliably. (#68111) Thanks @ayeshakhalid192007-dev.
+- Plugins/gateway hooks: expose startup config, workspace dir, and a live cron getter on the typed `gateway_start` hook, and move memory-core managed dreaming off the internal `gateway:startup` bridge so cron reconciliation stays on the public plugin hook path. Thanks @vincentkoc.
+- Plugins/config: read plugin trust decisions from the source config snapshot when a resolved runtime snapshot is active, so `plugins.allow` remains enforced and `doctor`/gateway startup no longer warn that the allowlist is empty when it is configured. Fixes #70161. Also fixes #70141.
+- Agents/openai-completions: enable malformed streamed tool-call argument repair for self-hosted OpenAI-compatible backends such as Kimi/SGLang, so fragmented tool-call arguments no longer reach tools as empty or unusable objects. Fixes #69672. (#70294) Thanks @MonkeyLeeT.
+- Gateway/restart: preserve group and channel chat context when resuming an agent turn after a Gateway restart, so continuation replies keep the same prompt, routing, and tool-status behavior as the original conversation. Thanks @obviyus.
+- Gateway/pairing: shared-secret loopback CLI clients now silently auto-approve `metadata-upgrade` pairing (platform / device family refresh) instead of being disconnected with `1008 pairing required`. This matches the scope-upgrade and role-upgrade behavior added in #69431 and unblocks non-interactive CLI automation when a paired-device record has a stale platform string (e.g. device key replicated across hosts, install migrated between OSes, or platform-string format changed between OpenClaw versions). Browser / Control-UI clients keep the existing approval-required flow for metadata changes (#70224). Thanks @perlowja.
+- Gateway/pairing: treat any forwarded-header evidence (`Forwarded`, `X-Forwarded-*`, or `X-Real-IP`) as proxied WebSocket traffic before pairing locality checks, so reverse-proxy topologies cannot use the loopback shared-secret helper auto-pairing path.
+- Agents/OpenAI: treat exact `NO_REPLY` assistant output as a deliberate silent reply in embedded runs, so GPT-5.4 turns with signed reasoning plus a silent final no longer surface a false incomplete-turn error.
+- Auto-reply/streaming: preserve streamed reply directives through chunk boundaries and phase-aware `final_answer` delivery, so split `MEDIA:<path>` lines, voice tags, and reply targets reach channel delivery instead of leaking as text or being dropped. (#70243) Thanks @zqchris.
+- Anthropic/Claude Opus 4.7: normalize Opus 4.7 and `claude-cli` Opus 4.7 variants to a 1M context window in resolved runtime metadata and active-agent status/context reporting, so they no longer inherit the stale 200k fallback. Thanks @BunsDev.
+- Gateway/pairing webchat: render `/pair qr` replies as structured media instead of raw markdown text, preserve inline reply threading and silent-control handling on media replies, avoid persisting sensitive QR images into transcript history, and keep local webchat media embedding behind internal-only trust markers. (#70047) Thanks @BunsDev.
+- Codex harness: default app-server runs to unchained local execution, so OpenAI heartbeats can use network and shell tools without stalling behind native Codex approvals or the workspace-write sandbox (#70082). Thanks @pashpashpash.
+- Codex harness: fail closed for unknown native app-server approval methods instead of routing unsupported future approval shapes through OpenClaw approval grants. (#70356) Thanks @Lucenx9.
+- Codex harness: apply the GPT-5 behavior and heartbeat prompt overlay to native Codex app-server runs, so `codex/gpt-5.x` sessions get the same follow-through, tool-use, and proactive heartbeat guidance as OpenAI GPT-5 runs (#70175). Thanks @pashpashpash.
+- WhatsApp/login QR: propagate refreshed QR images through `web.login.wait` consumers and compare against each caller's current QR instead of shared waiter state, so rotated QR codes stay synchronized across Control UI, macOS, and concurrent waiters. (#70009) Thanks @BunsDev.
+- Codex harness: add an explicit Guardian mode for Codex app-server approvals, plus a Docker live probe for approved and ask-back Guardian decisions, while keeping default app-server runs unchained for unattended local heartbeats. The legacy `OPENCLAW_CODEX_APP_SERVER_GUARDIAN` shortcut is removed; use plugin config `appServer.mode: "guardian"` or `OPENCLAW_CODEX_APP_SERVER_MODE=guardian`. Thanks @pashpashpash.
+- OpenAI/Responses: keep embedded OpenAI Responses runs on HTTP when `models.providers.openai.baseUrl` points at a local mock or other non-public endpoint, so mocked/custom endpoints no longer drift onto the hardcoded public websocket transport. (#69815) Thanks @vincentkoc.
+- Channels/config: require resolved runtime config on channel send/action/client helpers and block runtime helper `loadConfig()` calls, so SecretRefs are resolved at startup/boundaries instead of being re-read during sends.
+- Discord: pass resolved runtime config through guild and moderation action helpers, so thread-originated Discord commands can run channel, member, role, and guild actions without falling back to runtime config reads. (#70215) Thanks @szponeczek.
+- CLI/channels: preserve bundled setup promotion metadata when a loaded partial channel plugin omits it, so adding a non-default account still moves legacy single-account fields such as Telegram `streaming` into `accounts.default`.
+- Telegram: keep the sent-message ownership cache isolated per configured session store, so own-message reaction filtering remains correct with custom `session.store` paths.
+- Security/update: fail closed when exact pinned npm plugin or hook-pack updates detect integrity drift, and expose aborted plugin drift details in `openclaw update --json`.
+- Ollama: forward OpenClaw thinking control to native `/api/chat` requests as top-level `think`, so `/think off` and `openclaw agent --thinking off` suppress thinking on models such as qwen3 instead of idling until the watchdog fires. Fixes #69902. (#69967) Thanks @WZH8898.
+- Memory-core/dreaming: suppress the startup-only managed dreaming cron unavailable warning when the cron service is still attaching, while preserving the runtime warning if cron genuinely remains unavailable. Fixes #69939. (#69941) Thanks @Sanjays2402.
+- Mattermost: suppress reasoning-only payloads even when they arrive as blockquoted `> Reasoning:` text, preventing `/reasoning on` from leaking thinking into channel posts. (#69927) Thanks @lawrence3699.
+- Discord: read `channel.parentId` through a safe accessor in the slash-command, reaction, and model-picker paths so partial `GuildThreadChannel` prototype getters no longer throw `Cannot access rawData on partial Channel` when commands like `/new` run from inside a thread. Fixes #69861. (#69908) Thanks @neeravmakwana.
+- Discord: use safe channel name and parent accessors across voice command authorization, so `/vc` commands from partial Discord thread channels no longer crash on Carbon rawData getters. (#70199) Thanks @hanamizuki.
+- Discord: make auto-thread parent transcript inheritance opt-in via `channels.discord.thread.inheritParent`, keeping newly created Discord thread sessions isolated by default while preserving explicit inheritance for configured accounts. Fixes #69907. (#69986) Thanks @Blahdude.
+- Browser/Chrome MCP: reset cached existing-session control sessions when a `navigate_page` call times out, so one stuck navigation no longer poisons the browser profile until a gateway restart. (#69733) Thanks @ayeshakhalid192007-dev.
+- Browser/Chrome MCP: propagate click timeouts and abort signals to existing-session actions so a stuck click fails fast and reconnects instead of poisoning the browser tool until gateway restart. (#63524) Thanks @dongseok0.
+- Amazon Bedrock/prompt caching: resolve opaque application inference profile targets before injecting Bedrock cache points, require every routed target to support explicit cache points, and retry transient profile lookups instead of caching a false negative for the rest of the process. (#69953) Thanks @anirudhmarc and @vincentkoc.
+- Gateway/channel health: base stale-socket recovery on provider-proven transport activity instead of inbound app-event freshness, preventing quiet Slack, Discord, Telegram, Matrix, and local-style channels from being restarted solely because no user traffic arrived. (#69833) Thanks @bek91.
+- OpenCode Go: canonicalize stale bundled `opencode-go` base URLs from `/go` or `/go/v1` to `/zen/go` or `/zen/go/v1`, so older generated model metadata stops hitting the 404 HTML endpoint. (#69898).
+- Plugins/channels: keep persisted channel auth state out of configured-channel and plugin auto-enable detection, so stale WhatsApp credentials alone no longer trigger plugin activation or runtime dependency repair. (#72836, #72844) Thanks @xiao398008 and @haishmg.
+- CLI/channels: honor `channels.<id>.enabled=false` as a hard read-only presence opt-out, so env vars, manifest env vars, or stale persisted auth state no longer make disabled channel plugins appear in status, doctor, or setup-only discovery.
+- Channels/preview streaming: centralize draft-preview finalization so Slack, Discord, Mattermost, and Matrix no longer flush temporary preview messages for media/error finals, and preserve first-reply threading for normal fallback delivery.
+- Discord: keep slash command follow-up chunks ephemeral when the command is configured for ephemeral replies, so long `/status` output no longer leaks fallback model or runtime details into the public channel. (#69869) thanks @gumadeiras.
+- Gateway/session history: re-check current auth and `chat.history` scope before later SSE keepalives and transcript updates, so active session-history streams close before delivering post-revocation events (#70237). Thanks @drobison00.
+- Plugins/discovery: reject package plugin source entries that escape the package directory before explicit runtime entries or inferred built JavaScript peers can be used. (#69868) thanks @gumadeiras.
+- CLI/channels: resolve channel presence through a shared policy that keeps ambient env vars and stale persisted auth from surfacing disabled bundled plugins in status, doctor, security audit, and cron delivery validation unless the channel or plugin is effectively enabled or explicitly configured. (#69862) Thanks @gumadeiras.
+- Doctor/plugins: hydrate legacy partial interactive handler state before plugin reload clears dedupe caches, so `openclaw doctor` and post-update doctor runs no longer crash with `Cannot read properties of undefined (reading 'clear')`. (#70135) Thanks @ngutman.
+- Control UI/config: preserve intentionally empty raw config snapshots when clearing pending updates so reset restores the original bytes instead of synthesizing JSON for blank config files. (#68178) Thanks @BunsDev.
+- Cron/run-log: report generic `message` tool sends under the resolved delivery channel when they match the cron target, while preserving account-specific mismatch checks for delivery traces. (#69940) Thanks @davehappyminion.
+- Doctor/channels: merge configured-channel doctor hooks across read-only, loaded, setup, and runtime plugin discovery so partial adapters no longer hide runtime-only compatibility repair or allowlist warnings, preserve disabled-channel opt-outs, and ignore malformed hook values before they can mask valid fallbacks. (#69919) Thanks @gumadeiras.
+- Models/CLI: show bundled provider-owned static catalog rows in `models list --all` before auth is configured, including Kimi K2.6 rows for Moonshot, OpenRouter, and Vercel AI Gateway, while keeping local-only and workspace plugin catalog paths isolated. (#69909) Thanks @shakkernerd.
+- Models/CLI: clarify that `models list --provider` expects provider ids and reject display labels before loading model discovery. (#70504) Thanks @shakkernerd.
+- Configure: skip generic CLI startup bootstrap for `openclaw configure` and bound hint-only gateway probes so the onboarding TUI reaches its first prompt faster when the Gateway is unavailable. (#69984) Thanks @obviyus.
+- Agents/harness: surface selected plugin harness failures directly instead of replaying the same turn through embedded PI, preventing misleading secondary PI auth errors and avoiding duplicate side effects (#69981). Thanks @pashpashpash.
+- OpenAI Codex: add a ChatGPT device-code auth option beside browser OAuth, so headless or callback-hostile setups can sign in without relying on the localhost browser callback. (#69557) Thanks @vincentkoc.
+- CLI sessions: keep provider-owned CLI sessions through implicit daily expiry while preserving explicit reset behavior, and retain Claude CLI binding metadata across gateway agent requests. (#70106) Thanks @obviyus.
+- fix(config): accept truncateAfterCompaction (#68395). Thanks @MonkeyLeeT
+- CLI/Claude: keep Claude CLI session bindings stable across OAuth access-token refreshes, so gateway restarts continue the same Claude conversation instead of minting a fresh one. (#70132) Thanks @obviyus.
+- QQBot: add `INTERACTION` intent (`1 << 26`) to the gateway constants and include it in the `FULL_INTENTS` mask so interaction events are received. (#70143) Thanks @cxyhhhhh.
+- Gateway/restart: preserve one-shot continuation instructions across gateway restarts so agents can resume and reply back to the original chat after reboot. (#63406) Thanks @VACInc.
+- Gateway/restart: write restart sentinel files atomically so interrupted writes cannot leave a truncated sentinel behind. (#70225) Thanks @obviyus.
+- Pairing: remove stale pending requests for a device when that paired device is deleted, so an old repair approval cannot recreate the removed device from leftover state (#70239). Thanks @drobison00.
+- Security/dotenv: block workspace `.env` overrides for Matrix, Mattermost, IRC, and Synology endpoint settings so cloned workspaces cannot redirect bundled connector traffic through local endpoint config. (#70240) Thanks @drobison00.
+- Telegram: require the same `/models` authorization for group model-picker callbacks, so unauthorized participants can no longer browse or change the session model through inline buttons. (#70235) Thanks @drobison00.
+- Agents/Pi: keep the filtered tool-name allowlist active for embedded OpenAI/OpenAI Codex GPT-5 runs and compaction sessions, so bundled and client tools still execute after the Pi `0.68.1` session-tool allowlist change instead of stopping at plan-only replies with no tool call. (#70281) Thanks @jalehman.
+- Agents/Pi: honor explicit `strict-agentic` execution contracts for incomplete-turn retry guards across providers, so manually opted-in local or compatible models get the same retry behavior without relying on OpenAI model inference. (#66750) Thanks @ziomancer.
+- OpenShell/sandbox: pin verified file reads to an already-opened descriptor, walk the ancestor chain for symlinked parents on platforms without fd-path readlink, and re-check file identity so parent symlink swaps cannot redirect in-sandbox reads to host files outside the allowed mount root. (#69798) Thanks @drobison00.
+- Gateway/Control UI: require authenticated Control UI read access before serving `/__openclaw/control-ui-config.json` when `gateway.auth` is enabled, so unauthenticated callers can no longer read bootstrap metadata. (#70247) Thanks @drobison00.
+- Gateway/restart: default session-scoped restart sentinels to a one-shot agent continuation, so chat-initiated Gateway restarts acknowledge successful boot automatically. (#70269) Thanks @obviyus.
+- Build/npm publish: fail postpublish verification when root `dist/*` files import bundled plugin runtime dependencies without mirroring them in the root package manifest, so Slack-style plugin deps cannot silently ship on the wrong module-resolution path again. (#60112) thanks @medns.
+- Gateway/sessions: extend the webchat session-mutation guard to `sessions.compact` and `sessions.compaction.restore`, so `WEBCHAT_UI` clients are rejected from compaction-side session mutations consistently with the existing patch/delete guards. (#70716) Thanks @drobison00.
+
diff --git a/CHANGELOG/2026.4.29.md b/CHANGELOG/2026.4.29.md
new file mode 100644
index 0000000000000000000000000000000000000000..8cebaac33321bf7fd8bab7fb59632f4f8f149d53
--- /dev/null
+++ b/CHANGELOG/2026.4.29.md
@@ -0,0 +1,553 @@
+## 2026.4.29
+
+### Highlights
+
+- Messaging and automation get active-run steering by default, visible-reply enforcement, spawned subagent routing metadata, and opt-in follow-up commitments for heartbeat-delivered reminders. Thanks @vincentkoc, @scoootscooob, @samzong, and @vignesh07.
+- Memory grows into a people-aware wiki with provenance views, per-conversation Active Memory filters, partial recall on timeout, and bounded REM preview diagnostics. Thanks @vincentkoc, @quengh, @joeykrug, and @samzong.
+- Provider/model coverage expands with NVIDIA onboarding/catalogs plus faster manifest-backed model/auth paths, Bedrock Opus 4.7 thinking parity, and safer Codex/OpenAI-compatible replay and streaming behavior. Thanks @eleqtrizit, @shakkernerd, @prasad-yashdeep, @woodhouse-bot, and @LyHug.
+- Gateway and packaged-plugin reliability focuses on slow-host startup, reusable model catalogs, event-loop readiness diagnostics, runtime-dependency repair, stale-session recovery, and version-scoped update caches. Thanks @lpendeavors, @DerFlash, @vincentkoc, @pashpashpash, and @jhsmith409.
+- Channel fixes cluster around Slack Block Kit limits, Telegram proxy/webhook/polling/send resilience, Discord startup/rate-limit handling, WhatsApp delivery/liveness, and Microsoft Teams/Matrix/Feishu edge cases. Thanks @slackapi, @SymbolStar, @djgeorg3, @TinyTb, @dseravalli, @nklock, and @alex-xuweilong.
+- Security and operations add OpenGrep scanning, sharper GHSA triage policy, safer exec/pairing/owner-scope handling, Docker/onboarding automation, and web-fetch IPv6 ULA opt-in for trusted proxy stacks. Thanks @jesse-merhi, @pgondhi987, @mmaps, @jinjimz, and @jeffrey701.
+
+### Changes
+
+- Dependencies: refresh bundled runtime and plugin dependency pins, including Pi 0.71.1, OpenAI 6.35.0, Codex 0.128.0, Zod 4.4.1, and Matrix 41.4.0. Thanks @mariozechner.
+- Agents/workspace: add `agents.defaults.skipOptionalBootstrapFiles` for skipping selected optional workspace files during bootstrap without disabling required workspace setup. (#62110) Thanks @mainstay22.
+- Plugins/CLI: add first-class `git:` plugin installs with ref checkout, commit metadata, normal scanner/staging, and `plugins update` support for recorded git sources. Thanks @badlogic.
+- Google Meet: add live caption health for Chrome transcribe mode, including caption observer state, transcript counters, last caption text, and recent transcript lines in status and doctor output. Refs #72478. Thanks @DougButdorf.
+- Voice Call/Google Meet: add Twilio Meet join phase logs around pre-connect DTMF, realtime stream setup, and initial greeting handoff for easier live-call debugging. Thanks @donkeykong91 and @PfanP.
+- macOS app: move recent session context rows into a Context submenu while keeping usage and cost details root-level, so the menu bar companion stays compact with many active sessions. Thanks @guti.
+- Gateway/SDK: add SDK-facing tools.invoke RPC with shared HTTP policy, typed approval/refusal results, and SDK helper support. Refs #74705. Thanks @BunsDev and @ai-hpc.
+- Discord: keep active buttons, selects, and forms working across Gateway restarts until they expire, so multi-step Discord interactions are less likely to break during upgrades or restarts. Thanks @amknight.
+- Messages/docs: clarify that `BodyForAgent` is the primary inbound model text while `Body` is the legacy envelope fallback, and add Signal coverage so channel hardening patches target the real prompt path. Refs #66198. Thanks @defonota3box.
+- Slack: publish a safe default App Home tab view on `app_home_opened` and include the Home tab event in setup manifests. Fixes #11655; refs #52020. Thanks @TinyTb.
+- Slack: keep track of bot-participated threads across restarts, so ongoing threaded conversations can continue auto-replying after the Gateway is restarted. Thanks @amknight.
+- Control UI/Usage: add UTC quarter-hour token buckets for the Usage Mosaic and reuse them for hour filtering, keeping the legacy session-span fallback for older summaries. (#74337) Thanks @konanok.
+- BlueBubbles: add opt-in `channels.bluebubbles.replyContextApiFallback` that fetches the original message from the BlueBubbles HTTP API when the in-memory reply-context cache misses (multi-instance deployments sharing one BB account, post-restart, after long-lived TTL/LRU eviction). Off by default; channel-level setting propagates to accounts that omit the flag through `mergeAccountConfig`; routed through the typed `BlueBubblesClient` so every fetch is SSRF-guarded by the same three-mode policy as every other BB client request; reply-id shape is validated and part-index prefixes (`p:0/<guid>`) are stripped before the request; concurrent webhooks for the same `replyToId` coalesce into one fetch and successful responses populate the reply cache for subsequent hits. Also promotes BlueBubbles attachment download failures from verbose to runtime error so silently-dropped inbound images are visible at default log level, and extends `sanitizeForLog` to redact `?password=…`/`?token=…` query params and `Authorization:` headers before they reach the log sink (CWE-532). (#71820) Thanks @coletebou and @zqchris.
+- CLI/proxy: add `openclaw proxy validate` so operators can verify effective proxy configuration, proxy reachability, and expected allow/deny destination behavior before deploying proxy-routed OpenClaw commands. (#73438) Thanks @jesse-merhi.
+- Agents/Codex: default Codex app-server dynamic tools to native-first, keeping OpenClaw integration tools while leaving file, patch, exec, and process ownership to the Codex harness. (#75308) Thanks @pashpashpash.
+- Agents/Codex: default Codex-harness direct source replies to the OpenClaw `message` tool when visible reply delivery is not explicitly configured, keeping channel-visible output as a deliberate tool call. (#75765) Thanks @pashpashpash.
+- Heartbeats/agents: add a structured `heartbeat_respond` tool for tool-capable heartbeat runs so agents can record quiet outcomes or explicit notification text without relying only on `HEARTBEAT_OK` parsing. (#75765) Thanks @pashpashpash.
+- Gateway/config: allow `$include` directives to read files from operator-approved `OPENCLAW_INCLUDE_ROOTS` directories while preserving default config-directory confinement. Thanks @ificator.
+- Security/tools: configured tool sections (`tools.exec`, `tools.fs`) no longer implicitly widen restrictive profiles (`messaging`, `minimal`). Users who need those tools under a restricted profile must add explicit `alsoAllow` entries; a startup warning identifies affected configs. Fixes #47487. Thanks @amknight.
+- Gateway/SDK: add SDK-facing artifact list/get/download RPCs and App SDK helpers with transcript provenance and download-source guardrails. Refs #74706. Thanks @tmimmanuel.
+- Agents/commitments: add opt-in inferred follow-up commitments with hidden batched extraction, per-agent/per-channel scoping, heartbeat delivery, CLI management, a simple `commitments.enabled`/`commitments.maxPerDay` config, and heartbeat-interval due-time clamping so magical check-ins do not echo immediately. (#74189) Thanks @vignesh07.
+- Messages/queue: make `steer` drain all pending Pi steering messages at the next model boundary, keep legacy one-at-a-time steering as `queue`, and add a dedicated steering queue docs page. Thanks @vincentkoc.
+- Messages/queue: default active-run queueing to `steer` with a 500ms followup fallback debounce, and document the queue modes, precedence, and drop policies on the command queue page. Thanks @vincentkoc.
+- Messages: add global `messages.visibleReplies` so operators can require visible output to go through `message(action=send)` for any source chat, while `messages.groupChat.visibleReplies` stays available as the group/channel override. Thanks @scoootscooob.
+- Gateway/events: surface `spawnedBy` on subagent chat and agent broadcast payloads so clients can route child session events without an extra session lookup. (#63244) Thanks @samzong.
+- Memory/wiki: add agent-facing people wiki metadata, canonical aliases, person cards, relationship graphs, privacy/provenance reports, evidence-kind drilldown, and search modes for person lookup, question routing, source evidence, and raw claims. Thanks @vincentkoc.
+- Active Memory: add optional per-conversation `allowedChatIds` and `deniedChatIds` filters so operators can enable recall only for selected direct, group, or channel conversations while keeping broad sessions skipped. (#67977) Thanks @quengh.
+- Active Memory: return bounded partial recall summaries when the hidden memory sub-agent times out, including the default temporary-transcript path, so useful recovered context is not discarded. (#73219) Thanks @joeykrug.
+- Gateway/memory: add a read-only `doctor.memory.remHarness` RPC so operator clients can preview bounded REM dreaming output without running mutation paths. (#66673) Thanks @samzong.
+- Providers/NVIDIA: add the NVIDIA provider with API-key onboarding, setup docs, static catalog metadata, and literal model-ref picker support so NVIDIA hosted models can be selected with their provider prefix intact. (#71204) Thanks @eleqtrizit.
+- Models: suppress explicitly configured openai-codex/gpt-5.4-mini inline entries so a stale models config written by `openclaw doctor --fix` cannot bypass the manifest capability block and cause repeated assistant-turn failures when the runtime switches to that model on ChatGPT-backed Codex accounts. Conditional suppressions (e.g. qwen Coding Plan endpoint guards) remain bypassable by explicit user configuration. (#74451) Thanks @0xCyda, @hclsys, and @Marvae.
+- Added SQLite-backed plugin state store (`api.runtime.state.openKeyedStore`) for restart-safe keyed registries with TTL, eviction, and automatic plugin isolation. Thanks @amknight.
+- Plugin SDK: mark remaining legacy alias exports and diffs tool/config aliases with deprecation metadata, and add a guard so future legacy alias comments require `@deprecated` tags. Thanks @vincentkoc.
+- CLI/QR/dependencies: internalize small terminal progress and QR wrapper helpers while keeping the real QR encoder dependency direct, reducing the default runtime dependency graph without changing QR output behavior. Thanks @vincentkoc.
+- Dependencies: refresh workspace runtime, plugin, and tooling packages, including ACP, Pi, AWS SDK, TypeBox, pnpm, oxlint, oxfmt, jsdom, pdfjs, ciao, and tokenjuice, while keeping patched ACP behavior and lint gates current. Thanks @mariozechner.
+- Gateway/dev: run `pnpm gateway:watch` through a named tmux session by default, with `gateway:watch:raw` and `OPENCLAW_GATEWAY_WATCH_TMUX=0` for foreground mode, so repeated starts respawn an inspectable watcher without trapping the invoking agent shell. Thanks @vincentkoc.
+- Gateway/diagnostics: emit an opt-in startup diagnostics timeline that records gateway lifecycle and plugin-load phases behind a config flag, so slow-start diagnosis no longer requires bespoke instrumentation. Thanks @shakkernerd.
+- Control UI/i18n: extend the locale registry with new Persian (fa), Dutch (nl), Vietnamese (vi), Italian (it), Arabic (ar), and Thai (th) entries and ship `fa`, `nl`, `vi`, and `zh-TW` docs glossaries, so the docs translation pipeline and the Control UI language picker stay aligned across surfaces. Thanks @vincentkoc.
+- Channels: add Yuanbao channel docs entrance so the Tencent Yuanbao bot appears in the channel listing and sidebar navigation. (#73443) Thanks @loongfay.
+- Channels/Yuanbao: update plugin GitHub location to YuanbaoTeam/yuanbao-openclaw-plugin and add "yuanbao" alias to channel catalog. (#74253) Thanks @loongfay.
+- Docker setup: add `OPENCLAW_SKIP_ONBOARDING` so automated Docker installs can skip the interactive onboarding step while still applying gateway defaults. (#55518) Thanks @jinjimz.
+- Security policy: classify media/base64 decode and format-conversion overhead after configured acceptance limits as performance-only for GHSA triage unless a report demonstrates a limit bypass, crash, exhaustion, data exposure, or another boundary bypass. (#74311)
+- Security/OpenGrep: add a precise OpenGrep rulepack, source-rule compiler, provenance metadata check, and PR/full scan workflows that validate first-party code and rulepack-only changes while uploading SARIF to GitHub Code Scanning. (#69483) Thanks @jesse-merhi.
+
+### Fixes
+
+- Skills/OpenAI Whisper: restore executable bits for bundled Whisper and video-frame shell helpers and add a release check for non-executable bundled skill shell scripts, so packaged installs no longer fail with permission-denied errors. Fixes #9303. Thanks @nikolasdehor.
+- Agents/tools: skip unavailable media generation and PDF tool factories from the live reply path when Gateway metadata and the active auth store prove no configured provider can back them, while keeping explicit config and auth-backed providers on the normal factory path. Thanks @shakkernerd.
+- Agents/runtime: reuse the Gateway metadata startup plan when ensuring reply runtime plugins are loaded, so live agent turns do not broad-load plugin runtimes after the Gateway already scoped startup activation. Thanks @shakkernerd.
+- Agents/runtime: delegate scoped reply runtime registry reuse to the plugin loader cache-key compatibility checks, so config changes with the same startup plugin ids cannot keep stale runtime hooks or tools active. Thanks @shakkernerd.
+- Agents/runtime: let compatible wider plugin registries satisfy scoped reply runtime requests when they already contain the requested plugins, avoiding redundant runtime loading without bypassing loader cache-key freshness checks. Thanks @shakkernerd.
+- Agents/runtime: validate agent model allowlists against manifest model catalog metadata during reply startup, avoiding broad provider runtime catalog loading before the agent run lane starts. Thanks @shakkernerd.
+- Agents/runtime: keep allowlisted configured model thinking metadata available when manifest catalog rows are absent, so explicit high-reasoning levels remain valid for custom configured models. Thanks @shakkernerd.
+- Agents/tools: preserve plugin-declared config-only generation providers such as local Comfy workflows during reply tool pre-gating, and share manifest auth/config availability checks between the planner and final tool factories. Thanks @shakkernerd.
+- Agents/tools: keep Comfy generation tools visible from legacy local workflow config and cloud API-key config when no Gateway metadata snapshot is active, using plugin-declared manifest signals instead of loading provider runtimes. Thanks @shakkernerd.
+- Agents/tools: route media and generation capability lookups through the Gateway plugin metadata snapshot during reply tool registration, avoiding repeated manifest registry reloads on the live reply path. Thanks @shakkernerd.
+- Agents/tools: let plugins declare media generation auth aliases and base-url guards in manifests, preserving OpenAI Codex OAuth image generation availability without core-owned provider special cases. Thanks @shakkernerd.
+- Agents/tools: reuse the auth profile store already loaded for the active run when deciding media and generation tool availability, avoiding repeated provider-auth runtime discovery during reply startup. Thanks @shakkernerd.
+- Agents/tools: keep image, video, and music generation tool registration on manifest/auth control-plane checks instead of loading runtime provider registries during reply startup, reducing live-path tool-prep blocking while leaving provider runtime resolution for execution and list actions. Thanks @shakkernerd.
+- Discord: document canonical mention formatting in agent prompt hints and channel docs so outbound replies use `<@USER_ID>`, `<#CHANNEL_ID>`, and `<@&ROLE_ID>` instead of legacy nickname mentions. (#75173)
+- Heartbeat scheduler: gate exec-event/notification/spawn/retry wakes through a centralized cooldown so backgrounded `process.start` exit notifications can no longer self-feed runaway heartbeat runs (configured `every: "30m"` was firing every ~10s in production, pegging the gateway event loop with `eventLoopDelayMaxMs >6s` spikes that stalled control-UI asset serving and TUI handshakes). Documented wake-now paths (`manual`, `wake`, task completion, blocked-task follow-up, `/hooks/wake mode=now`, and cron `--wake now`) remain immediate; retryable busy skips no longer poison the cooldown for the next retry; per-agent flood guard caps any unexpected feedback loop at 5 runs/60s. (#64016, refs #17797 and #75436) Thanks @hexsprite.
+- fix: block workspace CLOUDSDK_PYTHON override and always set trusted interpreter for gcloud. (#74492) Thanks @pgondhi987.
+- Providers/Z.AI: move the bundled GLM catalog and auth env metadata into the plugin manifest, so `models list --all --provider zai` shows the full known catalog without duplicated runtime seed data. Thanks @shakkernerd.
+- Providers/Qianfan and Providers/Stepfun: declare setup auth metadata (`api-key` method, `QIANFAN_API_KEY`, `STEPFUN_API_KEY`) in the plugin manifest so onboarding and `models setup` surface the expected env var without falling back to legacy `providerAuthEnvVars` runtime seed data. Thanks @shakkernerd.
+- fix(infra): block ambient Homebrew env vars from brew resolution. (#74463) Thanks @pgondhi987.
+- Onboarding/configure: avoid staging every default plugin runtime dependency after config writes, so skipped setup flows only prepare config-selected plugin deps instead of pulling broad feature-plugin packages. Thanks @vincentkoc.
+- Thinking/providers: resolve bundled provider thinking profiles through lightweight provider policy artifacts when startup-lazy providers are not active, so OpenAI Codex GPT-5.x keeps xhigh available in Gateway session validation. Fixes #74796. Thanks @maxschachere.
+- Security/Windows: ignore workspace `.env` system-path variables and resolve stale-process `taskkill.exe` from the validated Windows install root, preventing repository-local env files from redirecting cleanup helpers. Thanks @pgondhi987.
+- CLI/plugins: refresh persisted plugin registry policy in place for `plugins enable` and `plugins disable`, so routine toggles no longer rebuild and hash every plugin source when the target is already indexed. Thanks @vincentkoc.
+- Windows/install: run npm from a writable installer temp directory and pin the Bedrock runtime dependency below a Windows ARM Node 24 npm resolver failure, so global OpenClaw installs no longer fail before onboarding. Thanks @mariozechner.
+- CLI/plugins: scope install and enable slot selection to the selected plugin manifest/runtime fallback, so plugin installs no longer load every plugin runtime or broad status snapshot just to update memory/context slots. Thanks @vincentkoc.
+- Browser/snapshot: propagate the configured snapshot timeout through the agent tool, Chrome MCP, and Playwright snapshot paths so snapshot actions honor the requested deadline instead of hanging. Fixes #72934. Thanks @masatohoshino.
+- Plugins/TTS: keep bundled speech-provider discovery available on cold package Gateway paths and add bundled plugin matrix runtime probes for health, readiness, RPC, TTS discovery, and post-ready runtime-deps watchdog coverage. Refs #75283. Thanks @vincentkoc.
+- Google Meet/Twilio: show delegated voice call ID, DTMF, and intro-greeting state in `googlemeet doctor`, and avoid claiming DTMF was sent when no Meet PIN sequence was configured. Refs #72478. Thanks @DougButdorf.
+- Plugins/tools: prefer built bundled plugin code during tool discovery and skip channel runtime hydration while preserving companion provider registrations, reducing per-run plugin-tool prep cost without dropping executable plugin tools. Fixes #75290. Thanks @thanos-openclaw.
+- Plugins/loader: scope plugin-tool registry reuse to the enabled plugin plan and stored Gateway method keys, so embedded runner tool lookup can reuse compatible startup registries without hiding enabled non-startup plugin tools. Fixes #75520. Thanks @whtoo.
+- Voice Call/Twilio: send notify-mode initial TwiML directly in the outbound create-call request while keeping conversation and pre-connect DTMF calls webhook-driven, so one-shot notify calls do not depend on a first-answer webhook fetch. Supersedes #72758. Thanks @tyshepps.
+- Discord/Slack: defer status-reaction cleanup until run finalization so queued, thinking, tool, and terminal reactions no longer flicker during normal progress updates. (#75582)
+- Discord/voice: leave Discord voice off for text-only configs unless `channels.discord.voice` is explicitly configured, avoiding default `GuildVoiceStates` traffic and idle gateway CPU pressure for bots that do not use `/vc`. Fixes #73753; refs #74044. Thanks @sanchezm86 and @SecureCloudProjO.
+- Discord/voice: rerun configured voice auto-join after Discord gateway RESUMED events and ignore already-destroyed stale voice connections during reconnect cleanup, so health-monitor account restarts can rejoin configured channels. Fixes #40665. Thanks @liz709.
+- Plugins/CLI: reuse the cold manifest registry while building plugin status and inspect reports, so large configured plugin sets no longer rediscover the bundled/plugin registry once per inspect row. Thanks @vincentkoc.
+- Discord/voice: lengthen the default voice join Ready wait, add configurable `voice.connectTimeoutMs`/`voice.reconnectGraceMs`, and warn before destroying unrecovered disconnected sessions so slow Discord voice handshakes and reconnects no longer fail silently. Fixes #63098; refs #39825 and #65039. Thanks @darealgege, @kzicherman, and @ayochim.
+- Gateway/health: refresh cached health RPC snapshots when channel runtime state diverges, so Discord and other channel status reads no longer report stale running or connected values until the cache TTL expires. (#75423)
+- Gateway/sessions: keep session-store reads from running stale prune and entry-count cap maintenance during startup, so oversized stores no longer block chat history readiness after updates while writes and `sessions cleanup --enforce` still preserve the cleanup safeguards. Fixes #70050. Thanks @tangda18.
+- Security/audit: keep plain `security audit` on the cold config/filesystem path and reserve plugin runtime security collectors for `--deep`, so large plugin installs cannot execute every plugin runtime during routine audits. Thanks @vincentkoc.
+- Discord/voice: merge configured media-understanding providers such as Deepgram into partial active provider registries, so follow-up voice turns keep transcribing after another media plugin is already active. Fixes #65687. Thanks @OneMintJulep.
+- WhatsApp: stage `qrcode` through root mirrored runtime dependencies so packaged QR pairing can render from staged plugin-runtime-deps installs. Fixes #75394. Thanks @FelipeX2001.
+- Discord/voice: apply per-channel Discord `systemPrompt` overrides to voice transcript turns by forwarding the trusted channel prompt through the voice agent run. Fixes #47095. Thanks @qearlyao.
+- Discord/native commands: send component-only interaction replies from slash command and status handlers instead of treating renderable Discord components as an empty response. Thanks @vincentkoc.
+- Slack/slash commands: send block-only slash command replies instead of dropping Slack block payloads with no plain-text fallback. Thanks @vincentkoc.
+- Telegram/messages: derive fallback text from interactive button/select labels before sending button-only payloads, so Telegram replies are not rejected as empty messages. Thanks @vincentkoc.
+- LINE/messages: send quick-reply-only payloads with fallback option text instead of accepting the payload and returning an empty delivery. Thanks @vincentkoc.
+- Auto-reply/docking: require `/dock-*` route switches to start from direct chats, so group or channel participants cannot reroute a shared session's future replies into a linked DM. Thanks @vincentkoc.
+- Discord: keep text-DM main-session route updates pinned to the configured DM owner, matching component interactions so another direct-message sender cannot redirect future main-session replies. Thanks @vincentkoc.
+- Mattermost/Matrix: keep direct-message main-session route updates pinned to the configured DM owner so paired or temporarily allowed senders cannot redirect future shared-session replies. Thanks @vincentkoc.
+- Discord: keep SecretRef-backed bot tokens discoverable for message actions without resolving the token during schema generation, and resolve scoped channel SecretRefs before outbound agent message sends even when the tool is built from a config snapshot. Fixes #75324. Thanks @slideshow-dingo and @Conan-Scott.
+- Updates: run package post-install doctor repair with the managed Gateway service profile and state paths when a daemon is installed, so shell/profile mismatches no longer repair the caller state while the restarted Gateway keeps stale config. Thanks @vincentkoc.
+- Models/DeepInfra: declare DeepInfra manifest catalog discovery and derive its runtime fallback catalog from the manifest, restoring provider-filtered `models list --all --provider deepinfra` rows without duplicated static model data. Thanks @shakkernerd.
+- CLI/update: verify managed gateway restarts against the installed service port instead of the caller shell port, so package updates do not report a healthy daemon as failed when profiles use different gateway ports. Thanks @vincentkoc.
+- Gateway/agent: reject strict `openclaw agent --deliver` requests with missing delivery targets before starting the agent run, so users do not wait for a completed turn that cannot send anywhere. Thanks @vincentkoc.
+- Setup/import: honor non-interactive `--import-from` onboarding flags by running the migration import path instead of silently completing normal setup without importing anything. Thanks @vincentkoc.
+- Discord/voice: run voice-channel turns under a voice-output policy that hides the agent `tts` tool and asks for spoken reply text, so `/vc join` sessions synthesize and play agent replies instead of ending with `NO_REPLY`. Fixes #61536. Thanks @aounakram.
+- Doctor/plugins: keep plain `doctor --non-interactive` from installing bundled plugin runtime dependencies, so headless health checks report missing deps while `doctor --fix` remains the explicit repair path. Thanks @vincentkoc.
+- Doctor/gateway: require an interactive confirmation before installing or rewriting the Gateway service, so `doctor --fix --non-interactive` can repair plugin/config drift without replacing the operator's launchd/systemd service from a temporary environment. Thanks @vincentkoc.
+- Plugins/runtime-deps: include packaged OpenClaw identity in bundled plugin loader cache keys, so same-path package upgrades stop reusing stale versioned runtime-deps mirrors. Fixes #75045. Thanks @sahilsatralkar.
+- Plugin SDK: restore reply-prefix and reply-pipeline helpers on the deprecated root/compat SDK surface so external plugins still using `openclaw/plugin-sdk` do not fail message dispatch after update. Fixes #75171. Thanks @zhangxiliang.
+- Plugins/runtime-deps: prune inactive same-package versioned runtime-deps roots after bundled dependency repair, so upgrades do not leave old `openclaw-<version>-<hash>` package caches behind after doctor runs. Thanks @vincentkoc.
+- Plugins/runtime-deps: prune legacy version-scoped plugin runtime-deps roots during bundled dependency repair and cover the path in Package Acceptance's upgrade-survivor matrix, so upgrades from 2026.4.x no longer leave stale per-plugin runtime trees after doctor runs. Thanks @vincentkoc.
+- Plugins/runtime-deps: keep Gateway startup plugin imports and runtime plugin fallback loads verify-only after startup/config repair planning, so packaged installs no longer spawn package-manager repair from hot paths after readiness. Refs #75283 and #75069. Thanks @brokemac79 and @xiaohuaxi.
+- Plugins/runtime-deps: treat package.json runtime-deps manifests as supersets when generated materialization metadata is absent, so bundled plugin activation stops restaging already-installed dependency subsets on every activation. Fixes #75429. (#75431) Thanks @loyur.
+- iMessage: add stdin write callback and error listener to IMessageRpcClient so async EPIPE from a closed child process rejects the pending request instead of crashing the gateway with uncaughtException. Fixes #75438.
+- MCP/stdio: settle MCP stdio transport send() from the write callback instead of resolving immediately on buffer acceptance, so async write errors reject the promise instead of being lost. Refs #75438.
+- Process/exec: add stdin error listener in runCommandWithTimeout so EPIPE from a prematurely-exited child is swallowed instead of escaping to uncaughtException. Refs #75438.
+- Voice Call/realtime: add default-off fast memory/session context for `openclaw_agent_consult`, giving live calls a bounded answer-or-miss path before the full agent consult. Fixes #71849. Thanks @amzzzzzzz.
+
+- Google Meet: interrupt Realtime provider output when local barge-in clears playback, so command-pair audio stops model speech instead of only restarting Chrome playback. Fixes #73850. (#73834) Thanks @shhtheonlyperson.
+- Gateway/config: cap oversized plugin-owned schemas in the full `config.schema` response so large installed plugin sets cannot balloon Gateway RSS or crash schema clients. Thanks @vincentkoc.
+- Plugins/update: skip ClawHub and marketplace plugin updates when the bundled version is newer than the recorded installed version, so `openclaw update` no longer overwrites working bundled plugins with older external packages. Fixes #75447. Thanks @amknight.
+- Gateway/sessions: use bounded tail reads for sessions-list transcript usage fallbacks and cap bulk title/last-message hydration, keeping large session stores responsive when rows request derived previews. Thanks @vincentkoc.
+- Gateway/sessions: yield during bulk transcript title/preview hydration and copy compaction checkpoints asynchronously, keeping the Gateway event loop responsive for large session stores and large transcripts. Refs #75330 and #75414. Thanks @amknight.
+- Gateway/sessions: stream bounded transcript reads for session detail, history, artifacts, compaction, and send/subscribe sequence paths so small Gateway requests no longer materialize large transcripts or OOM on oversized session logs. Thanks @vincentkoc.
+- Gateway/chat: bound chat-history transcript reads to the requested display window so large session logs no longer OOM the Gateway when clients ask for a small history page. Thanks @vincentkoc.
+- BlueBubbles: detect audio attachments by Apple UTIs (`public.audio`, `public.mpeg-4-audio`, `com.apple.m4a-audio`, `com.apple.coreaudio-format`) in addition to `audio/*` MIME, so iMessage voice notes whose webhook payload only carries the UTI are now classified as audio in the inbound `<media:audio>` placeholder instead of falling through to the generic `<media:attachment>` tag. Thanks @omarshahine.
+- Active Memory: classify topic-threaded Telegram DM main session keys as direct chats, so recall and transcript persistence run for `agent:main:main:thread:{chatId}:{topicId}` sessions. Fixes #70061. (#75533) Thanks @vyctorbrzezowski.
+- Voice Call/Twilio: honor stored pre-connect TwiML before realtime webhook shortcuts and reject DTMF sequences outside conversation mode, so Meet PIN entry cannot be skipped or silently dropped. Thanks @donkeykong91 and @PfanP.
+- Docs/sandboxing: clarify that sandbox setup scripts (`sandbox-setup.sh`, `sandbox-common-setup.sh`, `sandbox-browser-setup.sh`) are only available from a source checkout, and add inline `docker build` commands for npm-installed users so sandbox image setup works without cloning the repo. Fixes #75485. Thanks @amknight.
+- Google Meet/Voice Call: play Twilio Meet DTMF before opening the realtime media stream and carry the intro as the initial Voice Call message, so the greeting is generated after Meet admits the phone participant instead of racing a live-call TwiML update. Thanks @donkeykong91 and @PfanP.
+- Google Meet/Voice Call: make Twilio setup preflight honor explicit `--transport twilio` and fail local/private Voice Call webhook URLs, including IPv6 loopback and unique-local forms, before joins. Thanks @donkeykong91 and @PfanP.
+- Voice Call/Twilio: retry transient 21220 live-call TwiML updates and catch answered-path initial-greeting failures, so a fast answered callback no longer crashes the Gateway or drops the Twilio greeting/listen transition. (#74606) Thanks @Sivan22.
+- CLI/startup: preserve `OPENCLAW_HIDE_BANNER` banner suppression for route-first startup callers that rely on the default process environment while keeping read-only status/channel paths from repairing bundled plugin runtime dependencies. Refs #75183.
+- Voice Call/Twilio: register accepted media streams immediately but wait for realtime transcription readiness before speaking the initial greeting, so reconnect grace handling stays live while OpenAI STT startup is no longer starved by TTS. Fixes #75197. (#75257) Thanks @donkeykong91 and @PfanP.
+- Voice Call CLI: run gateway-delegated `voicecall continue` through operation-id polling and protocol-shaped errors, so long conversational turns keep their transcript result without blocking a single Gateway RPC. (#75459) Thanks @serrurco and @DougButdorf.
+- Voice Call CLI: delegate operational `voicecall` commands to the running Gateway runtime and skip webhook startup during CLI-only plugin loading, preventing webhook port conflicts and `setup --json` hangs. Fixes #72345. Thanks @serrurco and @DougButdorf.
+- Agents/pi-embedded-runner: extract the `abortable` provider-call wrapper from `runEmbeddedAttempt` to module scope so its promise handlers no longer close over the run lexical context, releasing transcripts, tool buffers, and subscription callbacks when a provider call hangs past abort. (#74182) Thanks @cjboy007.
+- Docker: restore `python3` in the gateway runtime image after the slim-runtime switch. Fixes #75041.
+- Agents/session-repair: fix resumed sessions failing with repeated 400 errors on Anthropic and strict OpenAI-compatible providers (Qwen, mlx-vlm) after an interrupted conversation or blank user input. Fixes #75271 and #75313. Thanks @amknight.
+- CLI/Voice Call: scope `voicecall` command activation to the Voice Call plugin so setup and smoke checks no longer broad-load unrelated plugin runtimes or hang after printing JSON. Thanks @vincentkoc.
+- Doctor/plugins: warn when restrictive `plugins.allow` is paired with wildcard or plugin-owned tool allowlists, making the exclusive plugin allowlist behavior visible before users hit empty callable-tool runs. Refs #58009 and #64982. Thanks @KR-Python and @BKF-Gitty.
+- Google Meet/Voice Call: keep Twilio Meet joins in conversation mode and reuse the realtime intro prompt when no voice-call-specific intro is configured, so answered phone bridge calls speak instead of joining silently. Refs #72478. Thanks @DougButdorf.
+- Auto-reply/group chats: keep the `message` tool available for message-tool-only visible replies and apply group-scoped tool policy before deciding fallback delivery, so Discord/Slack-style rooms reply visibly in the correct channel after upgrades. Fixes #74842; refs #75207. Thanks @davelutztx and @aa-on-ai.
+- Agents/commitments: keep inferred follow-ups internal when heartbeat target is none, strip raw source text from stored commitments, disable tools during due-commitment heartbeat turns, bound hidden extraction queue growth, expire stale commitments, and add QA/Docker safety coverage. Thanks @vignesh07.
+- Telegram/agents: keep typing indicators and optional generation tools off the reply critical path, so fresh Telegram replies no longer stall while provider catalogs and media models load. (#75360) Thanks @obviyus.
+- Agents/commitments: run hidden follow-up extraction on the configured agent/default model instead of falling back to direct OpenAI, so OpenAI Codex OAuth-only gateways no longer spam background API-key failures. Fixes #75334. Thanks @sene1337.
+- Agents/media: keep async music generation completions on the requester-session wake path even when direct-send completion is enabled, so finished audio stays agent-mediated while video can still opt into direct channel delivery. (#75335) Thanks @vincentkoc.
+- Agents/media: keep image and video provider inventory internal when tool output is hidden, so shared chat surfaces no longer expose provider/model/auth-hint details from list results. Fixes #75166. Thanks @MkDev11.
+- Security/config-audit: redact CLI argv and execArgv secrets before persisting config audit records, covering write, observe, and recovery paths. Fixes #60826. Thanks @koshaji.
+- Gateway/models: keep default and configured model-list views responsive when provider catalog discovery stalls, without hiding real catalog load failures, while `--all` still waits for the exact full catalog. Fixes #75297; refs #74404. Thanks @lisandromachado and @najef1979-code.
+- Plugins/runtime-deps: accept already materialized package-level runtime-deps supersets as converged, so later lazy plugin activation no longer prunes and relaunches `pnpm install` after gateway startup pre-staging, reducing event-loop pressure from repeated runtime-deps repair on packaged installs. Fixes #75283; refs #75297 and #72338. Thanks @brokemac79, @lisandromachado, and @midhunmonachan.
+- Plugins/runtime-deps: remove OpenClaw-owned legacy runtime-deps symlinks before replacing staged bundled plugin dependencies, so updates can recover from older symlinked installs instead of failing the symlink safety guard. Thanks @goldmar.
+- Discord: retry queued REST 429s against learned bucket/global cooldowns and reacquire fresh voice upload URLs after CDN upload rate limits, so outbound sends recover without reusing stale single-use upload URLs. Thanks @discord.
+- TTS/providers: keep bundled speech-provider compat fallback available when plugins are globally disabled, so cold gateway and CLI startup can still resolve fallback speech providers instead of leaving explicit TTS provider selection with no registered providers. Refs #75265. Thanks @sliekens.
+- Discord: collapse repeated native slash-command deploy rate-limit startup logs into one non-fatal warning while keeping per-request REST timing in verbose output. Thanks @discord.
+- Discord: report native slash-command deploy aborts as REST timeouts with method, path, timeout budget, and observed duration, so startup logs explain slow Discord API calls instead of showing a generic aborted operation. Thanks @discord.
+- Security/logging: redact payment credential field names such as card number, CVC/CVV, shared payment token, and payment credential across default log and tool-payload redaction patterns so wallet-style MCP tools do not expose raw payment credentials in UI events or transcripts. Thanks @stainlu.
+- Providers/OpenAI Codex: preserve existing wrapped Codex streams during OpenAI attribution so PI OAuth bearer injection reaches ChatGPT/Codex Responses, and strip native Codex-only unsupported payload fields without touching custom compatible endpoints. (#75111) Thanks @keshavbotagent.
+- Plugins/runtime-deps: materialize newly required bundled plugin packages after local `openclaw onboard` and `openclaw configure` config writes, while keeping remote setup read-only, so first Gateway startup no longer discovers missing channel/provider deps after setup claimed success. Fixes #75309; refs #75069. Thanks @scottgl9 and @xiaohuaxi.
+- Plugins/runtime-deps: expire stale legacy install locks whose live PID cannot be tied to the current process incarnation, so Docker PID reuse no longer leaves bundled dependency repair stuck behind old `.openclaw-runtime-deps.lock` directories. Fixes #74948; refs #74950 and #74346. Thanks @dchekmarev.
+- Plugins/runtime-deps: recover interrupted bundled runtime-dependency installs whose package sentinels exist but generated materialization is incomplete, forcing npm/pnpm repair in Gateway startup, doctor, and lazy plugin loads instead of leaving channels crash-looping on missing packages. Fixes #75309; refs #75310, #75296, and #75304. Thanks @scottgl9.
+- Plugins/runtime-deps: treat no-main and export-map package sentinels without reachable entry files as incomplete, so Gateway startup, doctor, and lazy plugin loads repair interrupted bundled dependency installs instead of accepting package.json-only partial installs. Fixes #75309; refs #75183. Thanks @shakkernerd.
+- Plugins/runtime-deps: keep runtime inspection and channel maintenance commands from downloading bundled plugin dependencies, route explicit repairs through `openclaw plugins deps --repair`, and still allow Gateway/DO paths to repair missing deps before import. Refs #75069. Thanks @xiaohuaxi.
+- Updates: force non-deferred, no-cooldown update restarts after package-manager updates requested through the live Gateway control plane and fail release validation on post-swap stale chunk import crashes, so Telegram/Discord imports do not stay pointed at removed dist files. Fixes #75206. Thanks @xonaman and @faux123.
+- Agents/tool-result guard: use the resolved runtime context token budget for non-context-engine tool-result overflow checks, so long tool-heavy sessions no longer compact early when `contextTokens` is larger than native `contextWindow`. Fixes #74917. Thanks @kAIborg24.
+- Gateway/systemd: exit with sysexits 78 for supervised lock and `EADDRINUSE` conflicts so `RestartPreventExitStatus=78` stops `Restart=always` restart loops instead of repeatedly reloading plugins against an occupied port. Fixes #75115. Thanks @yhyatt.
+- Agents/runtime: skip blank visible user prompts at the embedded-runner boundary before provider submission while still allowing internal runtime-only turns and media-only prompts, so Telegram/group sessions no longer leak raw empty-input provider errors when replay history exists. Fixes #74137. Thanks @yelog, @Gracker, and @nhaener.
+- Agents/Codex: isolate local Codex app-server `CODEX_HOME` and `HOME` per agent and add a deliberate Codex migration path with selectable skill copies, so personal Codex CLI skills, plugins, config, and hooks no longer leak into OpenClaw agents unless the operator migrates them into the workspace. Thanks @pashpashpash.
+- Security/Nextcloud Talk: make webhook signature validation use the padded timing-safe compare path even when the supplied signature length is wrong, keep normalized header lookup behavior, and extend regression coverage for tampered bodies, wrong secrets, array-backed headers, and truncated signatures. Carries forward earlier contributor work from #50516 by teddytennant. (#58097) Thanks @gavyngong.
+- Plugins/runtime-deps: replace stale symlinked mirror target roots before writing runtime-mirror temp files and skip rewriting already materialized hardlinks, so cross-version container upgrades no longer crash-loop on read-only image-layer paths while warm mirrors do less churn. Fixes #75108; refs #75069. Thanks @coletebou and @xiaohuaxi.
+- Auto-reply/group chats: fall back to automatic source delivery when a channel precomputes message-tool-only replies but the `message` tool is unavailable, so Discord/Slack-style group turns do not silently complete without a visible reply. Fixes #74868. Thanks @kagura-agent.
+- Browser/gateway: share one browser control runtime across the HTTP control server and `browser.request`, and refresh browser profile config from the source snapshot, so CLI status/start honors configured `browser.executablePath`, `headless`, and `noSandbox` instead of falling back to stale auto-detection. Fixes #75087; repairs #73617. Thanks @civiltox and @martingarramon.
+- Agents/subagents: bound automatic orphan recovery with persisted recovery attempts and a wedged-session tombstone, and teach task maintenance/doctor to reconcile those sessions so restart loops no longer require manual `sessions.json` surgery. Fixes #74864. Thanks @solosage1.
+- Plugins/runtime-deps: keep bundled provider policy config loading from staging plugin runtime dependencies, so config reads no longer fail on locked-down `/var/lib/openclaw/plugin-runtime-deps` directories. Fixes #74971. Thanks @eurojojo.
+- Memory/runtime-deps: retain the native `node-llama-cpp` runtime only when local memory search is configured, so packaged installs can repair local embeddings without relying on unreachable global npm installs. Fixes #74777. Thanks @LLagoon3.
+- Gateway/startup: skip pre-bind web-fetch provider discovery for credential-free `tools.web.fetch` config, so Docker/Kubernetes gateways bind even when optional fetch limits are present. Fixes #74896. Thanks @KoykL.
+- Signal: match group allowlists against inbound Signal group ids as well as sender ids, and process explicitly configured Signal groups without requiring mentions unless `requireMention` is set. Fixes #53308. Thanks @minupla and @juan-flores077.
+- Signal: bound `signal-cli` installer release and archive downloads with explicit timeouts, declared and streamed size checks, and partial-file cleanup. Fixes #54153. Thanks @jinduwang1001-max and @juan-flores077.
+- Slack: require bot-authored room messages with `allowBots=true` to come from an explicitly channel-allowlisted bot or from a room where an explicit Slack owner is present, so broad bot relays cannot run unattended. Fixes #59284. Thanks @andrewhong-translucent.
+- Signal: derive `getAttachment` HTTP response caps from `channels.signal.mediaMaxMb` with base64 headroom, so inbound photos and videos no longer drop behind the 1 MiB RPC default. Fixes #73564. Thanks @heyhudson.
+- Signal: keep the long-lived receive SSE monitor open while idle instead of applying the 10s RPC/check deadline, so `signal-cli` 0.14.3 event streams no longer reconnect before inbound messages arrive. Fixes #74741. Thanks @fgabelmannjr and @k7n4n5t3w4rt.
+- CLI/progress: suppress nested progress spinners and line clears while TUI input owns raw stdin, so Crestodian `/status` no longer disturbs the active input row. (#75003) Thanks @velvet-shark.
+- Models/OpenAI Codex: restore `openai-codex/gpt-5.4-mini` for ChatGPT/Codex OAuth PI runs after live OAuth proof, and align the manifest, forward-compat metadata, docs, and regression tests so stale cron and heartbeat configs resolve again. Fixes #74451. Thanks @0xCyda, @hclsys, and @Marvae.
+- Plugins/runtime-deps: always write a dependency map in generated runtime-deps install manifests, so npm does not crash or prune staged bundled-plugin packages when the plan is empty. Fixes #74949. Thanks @hclsys.
+- Telegram: use durable message edits for streaming previews instead of native draft state, so generated replies no longer flicker through draft-to-message transitions that look like duplicates. (#75073) Thanks @obviyus.
+- Telegram: echo preflighted DM voice-note transcripts back to the originating chat, including Telegram DM topic thread metadata, instead of only echoing later media-understanding transcripts. Fixes #75084. Thanks @M-Lietz.
+- Telegram: clamp low long-polling client timeouts so configured `timeoutSeconds` values below the `getUpdates` poll window no longer force a fresh HTTPS connection every few seconds. Fixes #75114. Thanks @hpinho77.
+- Web search: describe `web_search` as using the configured provider instead of hard-coding Brave when DuckDuckGo or another provider is active. Fixes #75088. Thanks @sun-rongyang.
+- Infra/tmp: tolerate concurrent temp-dir permission repairs by rechecking directories that another process already tightened, so parallel ACP subprocess startup no longer throws `Unsafe fallback OpenClaw temp dir`. Fixes #66867. Thanks @Kane808-AI and @jarvisz8.
+- Agents/compaction: add an opt-in `agents.defaults.compaction.midTurnPrecheck` mid-turn precheck that detects tool-loop context pressure and triggers compaction before the next tool call instead of waiting for end-of-turn. (#73499) Thanks @marchpure and @haoxingjun.
+- Gateway/approvals: let loopback token/password-backed native approval clients resolve exec approvals without attaching stale paired Gateway identities, while remote and unauthenticated approval clients keep normal device identity behavior. (#74472)
+- Gateway/config: include rejected validation paths in foreground and service last-known-good recovery logs plus main-agent notices, so unsupported direct edits explain which key caused restore instead of looking like silent reversion. Fixes #75060. Thanks @amknight.
+- Plugins/runtime-deps: hash the OS-canonical `packageRoot` via `fs.realpathSync.native` (with `path.resolve` fallback) when computing the bundled runtime-deps stage key, so loader and channel `bundled-root` callers no longer derive divergent stage directories under `~/.openclaw/plugin-runtime-deps/openclaw-<version>-<hash>/` and bundled channels stop failing with `ENOENT` on shared dist chunks under Windows npm symlinks, junctions, or PM2 multi-instance worker layouts. Fixes #74963. (#75048) Thanks @openperf and @vincentkoc.
+- fix(logging): add redaction patterns for Tencent Cloud, Alibaba Cloud, HuggingFace and Replicate API keys (#58162). Thanks @gavyngong
+- Pairing: surface unexpected allowlist filesystem stat errors instead of treating the allowlist as missing, so permission and I/O failures are visible during pairing authorization checks. (#63324) Thanks @franciscomaestre.
+- macOS app: reserve layout space for exec approval command details so the allow dialog no longer overlaps the command, context, and action buttons. (#75470) Thanks @ngutman.
+- Agents/failover: carry `sessionId`, `lane`, `provider`, `model`, and `profileId` attribution through `FailoverError` and `describeFailoverError`/`coerceToFailoverError` so structured error logs (e.g. `gateway.err.log` ingestion) can attribute exhausted-fallback wrapper errors to the originating session and last-attempted provider instead of dropping the metadata after the per-profile errors. Fixes #42713. (#73506) Thanks @wenxu007.
+- Context Engine: treat assembled prompt as the default authority for preemptive overflow prechecks so engines that return a windowed, self-contained context no longer trigger false hard-fail compactions on huge raw history. Engines whose assembled view can hide overflow risk can opt back into the legacy behavior with `AssembleResult.promptAuthority: "preassembly_may_overflow"`. (#74255) Thanks @100yenadmin.
+- Mattermost: refresh current native slash command registrations before accepting callbacks so stale tokens from deleted or regenerated commands stop being accepted without a gateway restart while failed validations stay briefly cached and lookup starts are rate-limited per command, gate each callback against the resolved command's own startup token so a token leaked for one slash command cannot poison another command's failure cache, redact slash validation lookup errors, and add a body read timeout to the multi-account routing path so slow callback senders cannot tie up the dispatcher. Thanks @feynman-hou and @eleqtrizit.
+- Security/dotenv: block `COMSPEC` in workspace `.env` so a malicious repo cannot redirect Windows `cmd.exe` resolution, and lock in case-insensitive workspace-`.env` regression coverage for the full Windows shell trust-root family (`COMSPEC`, `PROGRAMFILES`, `PROGRAMW6432`, `SYSTEMROOT`, `WINDIR`). (#74460) Thanks @mmaps.
+- Gateway/install: drop stale version-manager and package-manager PATH entries preserved from old service files during `gateway install --force` and doctor repair, so the repair path no longer recreates `gateway-path-nonminimal` warnings. Fixes #75220. (#75440) Thanks @leonaIee, @renaudcerrato, and @aaajiao.
+
+## 2026.4.29
+
+### Highlights
+
+- Messaging and automation get active-run steering by default, visible-reply enforcement, spawned subagent routing metadata, and opt-in follow-up commitments for heartbeat-delivered reminders. Thanks @vincentkoc, @scoootscooob, @samzong, and @vignesh07.
+- Memory grows into a people-aware wiki with provenance views, per-conversation Active Memory filters, partial recall on timeout, and bounded REM preview diagnostics. Thanks @vincentkoc, @quengh, @joeykrug, and @samzong.
+- Provider/model coverage expands with NVIDIA onboarding/catalogs plus faster manifest-backed model/auth paths, Bedrock Opus 4.7 thinking parity, and safer Codex/OpenAI-compatible replay and streaming behavior. Thanks @eleqtrizit, @shakkernerd, @prasad-yashdeep, @woodhouse-bot, and @LyHug.
+- Gateway and packaged-plugin reliability focuses on slow-host startup, reusable model catalogs, event-loop readiness diagnostics, runtime-dependency repair, stale-session recovery, and version-scoped update caches. Thanks @lpendeavors, @DerFlash, @vincentkoc, @pashpashpash, and @jhsmith409.
+- Channel fixes cluster around Slack Block Kit limits, Telegram proxy/webhook/polling/send resilience, Discord startup/rate-limit handling, WhatsApp delivery/liveness, and Microsoft Teams/Matrix/Feishu edge cases. Thanks @slackapi, @SymbolStar, @djgeorg3, @TinyTb, @dseravalli, @nklock, and @alex-xuweilong.
+- Security and operations add OpenGrep scanning, sharper GHSA triage policy, safer exec/pairing/owner-scope handling, Docker/onboarding automation, and web-fetch IPv6 ULA opt-in for trusted proxy stacks. Thanks @jesse-merhi, @pgondhi987, @mmaps, @jinjimz, and @jeffrey701.
+
+### Changes
+
+- Security/tools: configured tool sections (`tools.exec`, `tools.fs`) no longer implicitly widen restrictive profiles (`messaging`, `minimal`). Users who need those tools under a restricted profile must add explicit `alsoAllow` entries; a startup warning identifies affected configs. Fixes #47487. Thanks @amknight.
+- Gateway/SDK: add SDK-facing artifact list/get/download RPCs and App SDK helpers with transcript provenance and download-source guardrails. Refs #74706. Thanks @tmimmanuel.
+- Agents/commitments: add opt-in inferred follow-up commitments with hidden batched extraction, per-agent/per-channel scoping, heartbeat delivery, CLI management, a simple `commitments.enabled`/`commitments.maxPerDay` config, and heartbeat-interval due-time clamping so magical check-ins do not echo immediately. (#74189) Thanks @vignesh07.
+- Messages/queue: make `steer` drain all pending Pi steering messages at the next model boundary, keep legacy one-at-a-time steering as `queue`, and add a dedicated steering queue docs page. Thanks @vincentkoc.
+- Messages/queue: default active-run queueing to `steer` with a 500ms followup fallback debounce, and document the queue modes, precedence, and drop policies on the command queue page. Thanks @vincentkoc.
+- Messages: add global `messages.visibleReplies` so operators can require visible output to go through `message(action=send)` for any source chat, while `messages.groupChat.visibleReplies` stays available as the group/channel override. Thanks @scoootscooob.
+- Gateway/events: surface `spawnedBy` on subagent chat and agent broadcast payloads so clients can route child session events without an extra session lookup. (#63244) Thanks @samzong.
+- Gateway/SDK: add read-only `environments.list` and `environments.status` RPCs so app clients can discover Gateway-local and node environment candidates without enabling provisioning. (#74708) Thanks @BunsDev.
+- Memory/wiki: add agent-facing people wiki metadata, canonical aliases, person cards, relationship graphs, privacy/provenance reports, evidence-kind drilldown, and search modes for person lookup, question routing, source evidence, and raw claims. Thanks @vincentkoc.
+- Active Memory: add optional per-conversation `allowedChatIds` and `deniedChatIds` filters so operators can enable recall only for selected direct, group, or channel conversations while keeping broad sessions skipped. (#67977) Thanks @quengh.
+- Active Memory: return bounded partial recall summaries when the hidden memory sub-agent times out, including the default temporary-transcript path, so useful recovered context is not discarded. (#73219) Thanks @joeykrug.
+- Gateway/memory: add a read-only `doctor.memory.remHarness` RPC so operator clients can preview bounded REM dreaming output without running mutation paths. (#66673) Thanks @samzong.
+- Providers/NVIDIA: add the NVIDIA provider with API-key onboarding, setup docs, static catalog metadata, and literal model-ref picker support so NVIDIA hosted models can be selected with their provider prefix intact. (#71204) Thanks @eleqtrizit.
+- Models: suppress explicitly configured openai-codex/gpt-5.4-mini inline entries so a stale models config written by `openclaw doctor --fix` cannot bypass the manifest capability block and cause repeated assistant-turn failures when the runtime switches to that model on ChatGPT-backed Codex accounts. Conditional suppressions (e.g. qwen Coding Plan endpoint guards) remain bypassable by explicit user configuration. (#74451) Thanks @0xCyda, @hclsys, and @Marvae.
+- Added SQLite-backed plugin state store (`api.runtime.state.openKeyedStore`) for restart-safe keyed registries with TTL, eviction, and automatic plugin isolation. Thanks @amknight.
+- Plugin SDK: mark remaining legacy alias exports and diffs tool/config aliases with deprecation metadata, and add a guard so future legacy alias comments require `@deprecated` tags. Thanks @vincentkoc.
+- CLI/QR/dependencies: internalize small terminal progress and QR wrapper helpers while keeping the real QR encoder dependency direct, reducing the default runtime dependency graph without changing QR output behavior. Thanks @vincentkoc.
+- Dependencies: refresh workspace runtime, plugin, and tooling packages, including ACP, Pi, AWS SDK, TypeBox, pnpm, oxlint, oxfmt, jsdom, pdfjs, ciao, and tokenjuice, while keeping patched ACP behavior and lint gates current. Thanks @mariozechner.
+- Gateway/dev: run `pnpm gateway:watch` through a named tmux session by default, with `gateway:watch:raw` and `OPENCLAW_GATEWAY_WATCH_TMUX=0` for foreground mode, so repeated starts respawn an inspectable watcher without trapping the invoking agent shell. Thanks @vincentkoc.
+- Gateway/diagnostics: emit an opt-in startup diagnostics timeline that records gateway lifecycle and plugin-load phases behind a config flag, so slow-start diagnosis no longer requires bespoke instrumentation. Thanks @shakkernerd.
+- Control UI/i18n: extend the locale registry with new Persian (fa), Dutch (nl), Vietnamese (vi), Italian (it), Arabic (ar), and Thai (th) entries and ship `fa`, `nl`, `vi`, and `zh-TW` docs glossaries, so the docs translation pipeline and the Control UI language picker stay aligned across surfaces. Thanks @vincentkoc.
+- Channels: add Yuanbao channel docs entrance so the Tencent Yuanbao bot appears in the channel listing and sidebar navigation. (#73443) Thanks @loongfay.
+- Channels/Yuanbao: update plugin GitHub location to YuanbaoTeam/yuanbao-openclaw-plugin and add "yuanbao" alias to channel catalog. (#74253) Thanks @loongfay.
+- Docker setup: add `OPENCLAW_SKIP_ONBOARDING` so automated Docker installs can skip the interactive onboarding step while still applying gateway defaults. (#55518) Thanks @jinjimz.
+- Security policy: classify media/base64 decode and format-conversion overhead after configured acceptance limits as performance-only for GHSA triage unless a report demonstrates a limit bypass, crash, exhaustion, data exposure, or another boundary bypass. (#74311)
+- Security/OpenGrep: add a precise OpenGrep rulepack, source-rule compiler, provenance metadata check, and PR/full scan workflows that validate first-party code and rulepack-only changes while uploading SARIF to GitHub Code Scanning. (#69483) Thanks @jesse-merhi.
+
+### Fixes
+
+- Voice Call: resolve SecretRef-backed Twilio auth tokens and realtime/streaming provider API keys before initializing call providers, so SecretRef-backed voice-call credentials reach runtime as strings. (#73632) Thanks @VACInc.
+- Security/outbound: strip re-formed HTML tags during plain-text sanitization so nested tag fragments cannot leave a CodeQL-detected `<script>` sequence behind. Thanks @vincentkoc.
+- Security/secrets: compare credential bytes with padded timing-safe buffers instead of hashing candidate passwords before equality checks. Thanks @vincentkoc.
+- Security/QQBot: sanitize debug log arguments before writing to `console.*`, so gateway payload fields cannot forge extra log lines when debug logging is enabled. Thanks @vincentkoc.
+- QQBot: unify slash command auth and c2cOnly gating in the command registry, pass `allowQQBotDataDownloads` when sending slash command file attachments, align clear-storage with actual downloads directory, and add `/bot-me` to display sender user ID. (#73616) Thanks @cxyhhhhh.
+- CLI/agents/status: keep `openclaw agents`, text `agents list`, and plain text `status` on read-only metadata paths so human output no longer preloads plugin runtimes or live channel scans before printing. Fixes #74195. Thanks @NianJiuZst.
+- Agents/local models: derive context-window guard thresholds from the effective model window with 4k/8k safety floors, so small local models are no longer rejected by fixed 16k/32k preflight cutoffs. Fixes #42999. Thanks @chengjialu8888.
+- Providers/media: retry transient provider 5xx, timeout, and selected network failures on the same API key for opted-in media and Google embedding calls while preserving 429 key rotation. Fixes #60422. Thanks @sqsge.
+- PDF extraction: resolve PDF.js standard fonts from the installed package root and pass a filesystem path to the Node fallback extractor, so built-in font PDFs render without `file://` URL lookup failures. Fixes #51455; carries forward #70936, #54447, and #62175. Thanks @anyech, @JuanRdBO, and @solomonneas.
+- Media: treat legacy Word/OLE attachments with `application/msword` or `application/x-cfb` MIME as binary so printable-looking `.doc` files are not embedded into prompts as text. Fixes #54176; carries forward #54380. Thanks @andyliu.
+- Config: accept documented `browser.tabCleanup` keys in strict root config validation, so configured tab cleanup no longer fails before runtime reads it. Fixes #74577. Thanks @lonexreb and @ezdlp.
+- Cron: validate disabled job schedule edits before persisting updates, so invalid cron changes no longer partially mutate stored jobs. Fixes #74459. Thanks @yfge.
+- CLI/cron: warn when `openclaw cron add --message` omits a nonblank `--agent`, including blank agent values and session-key jobs, so scheduled agent-turn jobs make default-agent fallback explicit while system events stay quiet. Fixes #42196; carries forward #42245. Thanks @ethanclaw.
+- Channels/status: keep Telegram, Slack, and Google Chat read-only allowlist/default-target accessors on config-only paths, so status and channel summaries do not resolve SecretRef-backed runtime credentials. Thanks @eusine.
+- Active Memory: clarify the deprecated `modelFallbackPolicy` warning and config help so `modelFallback` is described as a chain-resolution last resort, not runtime failover. (#74602) Thanks @jeffrey701.
+- Channels/Discord: keep read-only allowlist/default-target accessors from resolving SecretRef-backed bot tokens, so status and channel summaries no longer fail when tokens are only available in gateway runtime. (#74737) Thanks @eusine.
+- Gateway/sessions: align session abort wait semantics across `chat`, `agent`, and `sessions` server methods so abort RPCs return after the targeted sessions actually halt instead of resolving early while runs are still draining. (#74751) Thanks @BunsDev.
+- Gateway/sessions: reuse one subagent registry read index for `sessions.list` `spawnedBy` filtering and row enrichment so subagent ownership stays consistent without repeated registry reloads. Carries forward #75013. Thanks @anyech.
+- Agents/output: drop copied inbound metadata-only assistant replay turns before provider replay instead of synthesizing a placeholder, so Telegram and other channels cannot receive `[assistant copied inbound metadata omitted]` as model output. Fixes #74745. Thanks @adamwdear and @Marvae.
+- Doctor/memory: suppress skipped embedding-readiness warnings for key-optional providers such as Ollama and LM Studio while preserving timeout and not-ready diagnostics. Fixes #74608 and #73882. Thanks @hclsys.
+- Channels/groups: preserve observe-only turn suppression for prepared dispatch paths and restore deprecated channel turn runtime aliases, so passive observer/group flows stay silent while older plugins keep compiling. Thanks @vincentkoc.
+- Feishu: skip empty-text messages (e.g. `{"text":""}`) that carry no media, so no blank user turn is written to the session and downstream LLM providers cannot reject the request with "messages must not be empty". (#74634) Thanks @xdengli and @hclsys.
+- Feishu/Bitable: clean up newly created placeholder rows whose fields contain only default empty values while preserving meaningful link, attachment, user, number, boolean, and location values during create-app cleanup. (#73920) Carries forward #40602. Thanks @boat2moon.
+- macOS app: keep attach-only mode and the Debug Settings launchd toggle marker-only, so launching with `--attach-only`/`--no-launchd` no longer uninstalls the Gateway LaunchAgent or drops active sessions. (#72174) Thanks @DolencLuka.
+- macOS Canvas: stop auto-reloading the current A2UI host during push/eval/snapshot flows, so pushed A2UI content remains visible instead of returning to the empty Canvas shell. Fixes #73337. Thanks @Gr4via.
+- Plugin SDK: restore the deprecated `plugin-sdk/zalouser` command-auth facade so published Lark/Zalo plugins that import it load on current hosts. Fixes #74702. Thanks @Goron01.
+- Plugins/runtime-deps: include bundled provider plugins when `models.providers`, auth profiles, agent defaults, or subagent model refs configure that provider, while keeping inactive default-enabled provider plugins out of doctor repair. Refs #74307. Thanks @Skeptomenos.
+- Plugins/runtime: resolve relative plugin `api.resolvePath` inputs against the plugin root instead of the host working directory, while keeping absolute and home paths user-resolved. Fixes #74718. Thanks @jimdawdy-hub.
+- Plugins/runtime-deps: refresh mirrored root chunks through a temporary file before replacing the active copy, so failed refreshes do not delete chunks that running plugin imports still need. Thanks @shakkernerd.
+- Plugins/runtime-deps: prefer `require` conditional exports when building staged dependency aliases, so CommonJS-only plugin runtime deps such as `ws` do not resolve to ESM wrappers under Jiti. Fixes #74547. Thanks @aderius.
+- Bonjour/Gateway: cap flapping advertiser restarts in a sliding window, so mDNS probing/name-conflict loops disable discovery instead of churning indefinitely on constrained hosts. Refs #74209 and #74242. Thanks @ndj888 and @Sanjays2402.
+- Plugins/runtime-deps: verify staged package entry files before reusing mirrored runtime roots, so browser-control repairs incomplete `ajv`/MCP SDK installs after update instead of failing after restart on a missing `ajv/dist/ajv.js`. Refs #74630. Thanks @spickeringlr.
+- Heartbeat: resolve `responsePrefix` template variables with the selected provider, model, and thinking context before delivering alerts or suppressing prefixed `HEARTBEAT_OK` replies. Fixes #43064; repairs #43065; supersedes #46858. Thanks @yweiii and @JunJD.
+- Memory/LanceDB: show full memory UUIDs in the `memory_forget` candidate list so agents can pass the displayed ID back to targeted deletion without hitting the full-UUID validator. (#66913) Thanks @amittell.
+- File-transfer plugin: require canonical read-path preflight authorization for `file.fetch`, fail closed when `dir.fetch` preflight entries are missing, absolute, or traversing, and recheck returned archive entries before handing archive bytes to callers. Carries forward #74134. Thanks @omarshahine.
+- Channels/Feishu: retry file-typed iOS video resource downloads as `media` after a Feishu/Lark HTTP 502 and preserve the original 502 when the fallback also fails. Fixes #49855; carries forward #50164 and #73986. Thanks @alex-xuweilong.
+- Providers/Amazon Bedrock: expose the full Claude Opus 4.7 thinking profile (`xhigh`, `adaptive`, and `max`) for Bedrock model refs, while keeping Opus/Sonnet 4.6 on adaptive-by-default, so `/think` menus and validation match the Anthropic transport behavior. Fixes #74701. Thanks @prasad-yashdeep, @sparkleHazard, @Sanjays2402, and @hclsys.
+- Plugins/tokenjuice: compile the bundled plugin against tokenjuice 0.7.0's published OpenClaw host types instead of a local compatibility shim, so package contract drift fails in OpenClaw validation before release. Thanks @vincentkoc.
+- OAuth/secrets: ignore root-level Google OAuth `client_secret_*.json` downloads so local client-secret files do not appear as commit candidates. (#74689) Thanks @jeongdulee.
+- Memory: mirror `sqlite-vec` into packaged bundled-plugin runtime deps for the default memory plugin, so builtin vector search does not lose its SQLite extension after upgrading to 2026.4.27. Fixes #74692. Thanks @mozi1924.
+- Gateway/startup: bound local discovery advertisement during startup, so a stuck discovery plugin can no longer keep the Gateway from reaching ready. Fixes #73865; refs #74630 and #74633. Thanks @lpendeavors, @moltar-bot, and @Saboor711.
+- Gateway/models: serve the last successful model catalog while stale reloads refresh in the background, so Gateway control-plane and OpenAI-compatible requests no longer block behind model-provider rediscovery after model config changes. Refs #74135, #74630, and #74633. Thanks @DerFlash, @moltar-bot, and @Saboor711.
+- CLI/status: resolve read-only channel setup runtime fallback from the packaged OpenClaw dist root, so `status --all`, `status --deep`, channel, and doctor paths do not crash when an external channel plugin needs setup metadata. Fixes #74693. Thanks @giangthb.
+- SDK/events: keep per-run SDK event streams from surfacing duplicate raw chat projection frames, while normalizing chat-only projection frames and preserving raw access through `rawEvents`. Refs #74704. Thanks @BunsDev.
+- SDK: report Gateway terminal `agent.wait` timeout snapshots with lifecycle metadata as `timed_out` while keeping bare wait deadlines non-terminal.
+- Google Meet: block managed Chrome intro/test speech until browser health proves the participant is in-call, and expose `speechReady` diagnostics so login, admission, permission, and audio-bridge blockers no longer look like successful speech. Refs #72478. Thanks @DougButdorf.
+- Slack/commands: keep native command argument menus on select controls for encoded choice values up to Slack's option limit and truncate fallback button labels to Slack's button-text limit, so long valid choices no longer render invalid Slack blocks. Thanks @slackapi.
+- Agents/Codex: flush accepted debounced steering messages before normal app-server turn cleanup, so inbound follow-ups acknowledged as queued are not dropped when the turn completes before the debounce fires. Thanks @vincentkoc.
+- Slack/interactive replies: keep rendered buttons and selects within Slack Block Kit value and count limits, and align command argument select values with Slack's option limit, so overlong agent-authored choices no longer make Slack reject the whole block payload. Thanks @slackapi.
+- Slack/interactive replies: drop overlong Block Kit button URLs while preserving valid callback values, so malformed link buttons no longer make Slack reject the whole interactive reply. Thanks @slackapi.
+- Slack/commands: truncate native command argument-menu confirmation text to Slack's dialog limit, so long plugin arg names no longer make fallback buttons render invalid Block Kit payloads. Thanks @slackapi.
+- Slack/exec approvals: cap native approval metadata context to Slack's element and text limits, so large approval details no longer make Slack reject the approval card. Thanks @slackapi.
+- Slack/exec approvals: cap native approval update fallback text to Slack's message limit while preserving the rendered approval blocks, so long commands no longer make resolved or expired approval cards stay stale after `chat.update` rejects `msg_too_long`. Thanks @slackapi.
+- Slack/commands: cap native command argument-menu fallback rows to Slack's message block limit, so large plugin choice lists no longer make Slack reject the generated menu. Thanks @slackapi.
+- Slack/commands: drop fallback command argument buttons whose encoded values exceed Slack's button-value limit, so one oversized plugin choice no longer makes Slack reject the whole menu. Thanks @slackapi.
+- Slack/messages: merge message-tool presentation and interactive blocks on Slack sends, so buttons and selects are no longer dropped when a structured message body is also present. Thanks @slackapi.
+- Slack/messages: cap Block Kit fallback text to Slack's send limit while preserving the rendered blocks, so long context fallbacks no longer make rich Slack messages fail with `msg_too_long`. Thanks @slackapi.
+- Slack/messages: cap Block Kit fallback text on message edits while preserving the rendered blocks, so long context fallbacks no longer make Slack reject `chat.update` calls with `msg_too_long`. Thanks @slackapi.
+- Channels/WhatsApp: require Baileys outbound message ids before marking auto-replies delivered, so transcript text and ack reactions no longer make failed group replies look sent. Fixes #49225. Thanks @TinyTb.
+- CLI/update: scope packaged Node compile caches by OpenClaw version and install metadata, so global installs no longer reuse stale compiled chunks after package updates. Thanks @pashpashpash.
+- Channels/Voice call: keep pre-auth webhook in-flight limiting active when socket remote address metadata is missing, so slow-body requests from stripped-IP proxy paths still share the fallback bucket. (#74453) Thanks @davidangularme.
+- Plugin SDK/testing: lazy-load TypeScript from the plugin test-contract runtime and add release checks for critical SDK contract entrypoint imports and bundle size, so published packages fail preflight before shipping ESM-incompatible or oversized contract helpers. Thanks @vincentkoc.
+- Channels/Microsoft Teams: treat configured `19:...@thread.tacv2` and legacy `19:...@thread.skype` team/channel IDs as already resolved during startup, avoiding false `channels unresolved` warnings while preserving Graph name lookup for display-name entries. Fixes #74683. Thanks @dseravalli.
+- CLI/browser: preserve parent flags while lazy-loading browser subcommands, so `openclaw browser --json open` and `openclaw browser --json tabs` keep machine-readable output after reparsing. Fixes #74574. Thanks @devintegeritsm.
+- Exec/elevated: preserve `turnSourceChannel` as `messageProvider` on approval-followup runs so `tools.elevated.allowFrom.<provider>` checks no longer fail with `provider=null` after the user approves an async elevated command. Fixes #74646. Thanks @xhd2015.
+- Plugins/runtime-deps: add `openclaw plugins deps` inspection and repair with script-free package-manager defaults shared across plugin installers, so operators can repair missing bundled runtime deps without corrupting JSON output or blocking unrelated conflict-free deps. Thanks @vincentkoc.
+- Agents/output: strip internal `[tool calls omitted]` replay placeholders from user-facing replies while preserving visible reply whitespace. Fixes #74573. Thanks @blaspat.
+- Providers/Google Vertex: route authorized_user ADC credentials through OpenClaw's REST transport so Docker installs using gcloud application-default credentials no longer crash in the Google SDK before requests are sent. Fixes #74628. Thanks @frankhal2001-design.
+- ACP/resolver: fall through to thread-bound session resolution when an explicit `--session` token cannot be resolved while preserving the bad-token diagnostic when no thread binding exists, so Discord slash commands that auto-fill the current thread ID as the positional ACP target no longer return "Unable to resolve session target" errors. Fixes #66299. Thanks @hclsys, @kindomLee, and @martingarramon.
+- macOS/Talk: route remote and custom Talk providers through Gateway `talk.speak` before falling back to the system voice, so configured providers such as OpenAI are no longer treated as local-voice-only. (#74645) Thanks @Fuma2013.
+- Agents/sessions: emit a terminal lifecycle backstop when embedded timeout/error turns return without `agent_end`, so Gateway sessions no longer stay stuck in `running` after failover surfaces a timeout. Fixes #74607. Thanks @millerc79.
+- Gateway/diagnostics: include stuck-session reason hints and recovery skip causes in warnings, so operators can tell whether a lane is waiting on active work, queued work, or stale bookkeeping. Thanks @vincentkoc.
+- Providers/DeepSeek: expose native DeepSeek V4 `xhigh` and `max` thinking levels through the provider `resolveThinkingProfile` hook so `/think xhigh|max` applies the intended effort instead of falling back to base levels. (#73008) Thanks @ai-hpc.
+- Agents/Codex: bound embedded-run cleanup, trajectory flushing, and command-lane task timeouts after runtime failures, so Discord and other chat sessions return to idle instead of staying stuck in processing. Thanks @vincentkoc.
+- Heartbeat/exec: consume successful metadata-only async exec completions silently so Telegram and other chat surfaces no longer ask users for missing command logs after `No session found`. Fixes #74595. Thanks @gkoch02.
+- Active Memory/Memory: materialize allowlisted memory plugin tools for lightweight embedded recall runs so Memory Core tools do not collapse to an empty runtime allowlist. Fixes #74572. (#74592) Thanks @LaFleurAdvertising and @vyctorbrzezowski.
+- Web fetch: add a documented `tools.web.fetch.ssrfPolicy.allowIpv6UniqueLocalRange` opt-in and thread it through cache keys and DNS/IP checks so trusted fake-IP proxy stacks using `fc00::/7` can work without broad private-network access. Fixes #74351. Thanks @jeffrey701.
+- OpenAI Codex: restore `/verbose full` persistence and app-server tool-output forwarding, and retry Gateway E2E temp-home cleanup so debug runs do not regress on stale validation or cleanup flakes. Thanks @vincentkoc.
+- Anthropic/Meridian: preserve text and thinking content seeded on `content_block_start` in anthropic-messages streams, so `[thinking, text]` replies no longer persist as empty turns or trigger empty-response fallbacks. Fixes #74410. Thanks @vyctorbrzezowski.
+- Channels/Matrix: complete the cross-signing handshake on `openclaw matrix verify confirm-sas` so the operator's other Matrix device clears its `Verifying…` loop instead of staying stuck after the agent confirms. (#74542) Thanks @nklock.
+- CLI/status: honor channel-specific model context-window overrides when reporting effective context, so channel-scoped sessions reflect the active window in `openclaw status`. Thanks @HemantSudarshan.
+- Sandbox/Docker: tolerate Docker daemon unavailability when sandbox mode is off, so doctor and preflight checks no longer fail on installs that do not run the Docker daemon. Fixes #73671. Thanks @kaseonedge.
+- Control UI/mobile: persist mobile chat settings through Lit-managed state and route mobile navigation through the same view-state path so chat panel toggles survive transitions on small viewports. Thanks @BunsDev.
+- Control UI/exports: align sidebar trigger affordances across the resizable divider, mobile layout, and exported-HTML transcript template so the sidebar toggle and exported transcript sidebar render with consistent hit areas and styling. Thanks @BunsDev.
+- Control UI/chat: disable the page refresh affordance while a chat run is active so accidental refreshes do not abort an in-flight reply. Thanks @Angfr95 and @BunsDev.
+- Memory/LanceDB: return real memory records from `openclaw ltm list` (with optional `--limit` and createdAt ordering) instead of an empty placeholder, so the CLI surface matches the documented LTM listing contract. (#67952) Thanks @zhangyue19921010.
+- Media: include redacted per-attempt resize failures and resolved model input capabilities in vision-pipeline errors so ARM64 image failures are diagnosable without closing the remaining routing investigation. Refs #74552. Thanks @1yihui.
+- Control UI/i18n: route zh-CN agent, debug, channel-refresh, and exec-approval copy through the locale source while preserving the English `Cron Jobs` agent tab label and the security-audit command styling. Carries forward #39692 repair context. Thanks @hepeng154833488 and @vincentkoc.
+- Auto-reply: honor explicit `silentReply.direct: "allow"` for clean empty or reasoning-only direct chat turns while keeping the default direct-chat empty-response guard conservative. Fixes #74409. Thanks @jesuskannolis.
+- OpenAI Codex: send a non-empty Responses input item when a Codex turn only has systemPrompt-backed instructions, avoiding ChatGPT backend 400s from `input: []`. Fixes #73820. Thanks @woodhouse-bot.
+- Ollama: normalize provider-prefixed tool-call names at the native stream boundary so Kimi/Ollama calls such as `functions.exec` dispatch as `exec` instead of missing configured tools. Fixes #74487. Thanks @afurm and @carreipeia.
+- Security/audit: resolve configured model aliases before model-tier and small-parameter checks, so alias-based GPT-5/Codex configs no longer report false weak-model warnings. Fixes #74455. Thanks @blaspat.
+- CLI/agent: isolate Gateway-timeout embedded fallback runs under explicit `gateway-fallback-*` sessions so accepted Gateway runs cannot race transcript locks or replace the routed conversation session. Fixes #62981. Thanks @HemantSudarshan.
+- CLI/QR/device-pair: reject malformed public setup URLs before issuing mobile pairing bootstrap tokens, while keeping valid bare host:port setup URLs supported. Thanks @Lucenx9.
+- Models/UI: hide unauthenticated providers from the default Web chat, `/models`, and model setup pickers while keeping explicit full-catalog browse paths through `view: "all"`, `/models <provider> all`, and `models list --all`. Fixes #74423. Thanks @guarismo and @SymbolStar.
+- Ollama: keep explicit local model runs on target-provider runtime hooks when PI discovery is skipped, so one-shot Ollama calls no longer cold-load unrelated provider runtimes before streaming. Fixes #74078. Thanks @sakalaboator.
+- Slack/prompts: rely on Slack `interactiveReplies` guidance instead of generic `inlineButtons` config hints so enabled Slack button directives are not contradicted. Fixes #46647. Thanks @jeremykoerber.
+- Slack/reactions: treat duplicate `already_reacted` responses as idempotent success so repeated agent reaction adds no longer surface as tool failures. Fixes #69005. Thanks @shipitsteven and @martingarramon.
+- Channels/Discord: cool down Cloudflare/Error 1015 HTML 429 REST failures during startup application lookup and gateway metadata fetches, add `channels.discord.applicationId` as an app-id lookup bypass, sanitize HTML bodies before logging, and honor Retry-After before falling back to a conservative cooldown. Fixes #38853. (#74489) Thanks @djgeorg3 and @Garyko0730.
+- Slack/tools: expose `fileId` in the shared message tool schema so `download-file` can receive Slack attachment IDs from inbound placeholders. Fixes #45574. Thanks @chadvegas.
+- Exec: reject invalid per-call `host` values instead of silently falling back to the default target, so hostname-like values fail before commands run. Fixes #74426. Thanks @scr00ge-00 and @vyctorbrzezowski.
+- Google/Gemini: send non-empty placeholder content when a Gemini run is triggered with empty or filtered user content, avoiding `contents is not specified` API errors. Thanks @CaoYuhaoCarl.
+- Heartbeat: preserve non-task `HEARTBEAT.md` context around `tasks:` blocks and apply `agents.defaults.heartbeat` to all agents unless per-agent heartbeat entries restrict scope. Thanks @Sekhar03.
+- Markdown: preserve paragraph breaks inside loose list items in shared outbound formatting while keeping tight list spacing stable. Thanks @Lucenx9.
+- Build/Gateway: route restart, shutdown, respawn, diagnostics, command-queue cleanup, and runtime cleanup through one stable gateway lifecycle runtime entry so rebuilt packages do not strand long-running gateways on stale hashed chunks. Carries forward #73964. Thanks @pashpashpash.
+- Memory/wiki: keep broad shared-source and generated related-link blocks from turning every page into a search hit, cap noisy backlinks, support all-term searches such as people-routing queries, and prefer readable page body snippets over generated metadata. Thanks @vincentkoc.
+- Cron/Gateway: abort and bounded-clean up timed-out isolated agent turns before recording the timeout, so stale cron sessions cannot leave Discord or other chat lanes stuck in `processing` after a timeout. Thanks @vincentkoc.
+- Agents/errors: suppress malformed streaming tool-call JSON fragments before they reach chat surfaces while preserving provider request-validation diagnostics. Fixes #59076; keeps #59080 as duplicate coverage. (#59118) Thanks @singleGanghood.
+- CLI/models: restore provider-filtered `models list --all --provider <id>` rows for providers without manifest/static catalog coverage, including Anthropic and Amazon Bedrock, while keeping the compatibility fallback off expensive availability and resolver paths. Thanks @shakkernerd.
+- CLI/models: keep manifest auth-evidence credentials visible across `models status`, auth probes, and PI model discovery so workspace-scoped provider auth does not disagree between listing, probing, and execution. Thanks @shakkernerd.
+- CLI/models: move local credential evidence such as Google Vertex ADC into generic plugin manifest setup metadata so the model-list auth index stays declarative without provider-specific runtime branches. Thanks @shakkernerd.
+- CLI/models: compute the `models list` Auth column through one command-local provider auth index so row rendering no longer repeats auth profile, env, configured-provider, AWS, or synthetic-auth checks per model row. Thanks @shakkernerd.
+- CLI/models: move the OpenAI listable catalog into the plugin manifest so `models list --all --provider openai` uses the manifest fast path instead of loading provider runtime normalization hooks. Thanks @shakkernerd.
+- CLI/tools: keep the Gateway `tools.*` RPC namespace out of plugin command discovery and managed proxy startup, so stray commands like `openclaw tools effective` fail quickly instead of cold-loading plugin metadata. Refs #73477. Thanks @oromeis.
+- CLI/status: keep default text `openclaw status --usage` on metadata-only channel scans unless `--deep` or `--all` is set, and send stray `openclaw tools --help` through the precomputed root-help fast path so latency-triage commands avoid plugin/runtime cold loads before printing. Refs #73477 and #74220. Thanks @oromeis and @NianJiuZst.
+- Agents/diagnostics: trace embedded-run startup and preparation stage timings before model I/O, and warn only on severe slow stages, so Docker/VPS latency reports can identify whether plugin loading, auth/model resolution, tool inventory, bootstrap, MCP/LSP, resource loading, or stream setup is dominating pre-run latency without noisy normal logs. Refs #73428. Thanks @Dimaoggg, @quangtran88, and @Heyvhuang.
+- Agents/subagents: cache persisted subagent run registry reads by file signature while preserving fresh-parse isolation, so busy gateways stop reparsing unchanged `subagents/runs.json` on controller/list/status hot paths. Refs #72338. Thanks @argus-as.
+- Gateway/clients: wait for the event loop to become responsive before opening Gateway WebSocket RPC/probe/client connections while charging that readiness wait to caller timeouts, so Windows deferred module-evaluation stalls no longer turn healthy loopback gateways into false handshake timeouts across status, TUI, ACP, MCP, node-host, and plugin client paths. Refs #74279 and #48270. Thanks @wongcode and @joost-heijden.
+- Gateway/Windows: read listener command lines via PowerShell before falling back to `wmic`, so restart health can recognize OpenClaw listeners on modern Windows installs and avoid long anonymous-port waits. Refs #74280. Thanks @zym951223.
+- Plugins/runtime-deps: record process start-time in bundled dependency install locks and expire recycled-PID locks, so Docker gateway restarts recover from stale `.openclaw-runtime-deps.lock` directories without waiting through repeated five-minute timeouts. Fixes #74346. (#74361) Thanks @jhsmith409.
+- Plugins/runtime-deps: memoize packaged bundled runtime dist-mirror preparation after the first successful pass while keeping source-checkout mirrors refreshable, so constrained Docker/VPS installs avoid repeated root scans before chat turns. Refs #73428, #73421, #73532, and #73477. Thanks @Dimaoggg, @oromeis, @oadiazp, @jmfraga, @bstanbury, @antoniusfelix, and @jkobject.
+- Channels/Discord: treat bare numeric outbound targets that match the effective Discord DM allowlist as user DMs while preserving account-specific legacy `dm.allowFrom` precedence over inherited root `allowFrom`. (#74303) Thanks @Squirbie.
+- Channels/Discord/Slack: share one DM policy/allowlist resolver across runtime, setup, allowlist editing, and doctor repair, so legacy `dm.policy` / `dm.allowFrom` compatibility migrates to canonical `dmPolicy` / `allowFrom` without divergent access checks. Thanks @Squirbie.
+- Control UI: make the chat sidebar split divider focusable, keyboard-resizable, ARIA-described, and pointer-event based so sidebar resizing works without a mouse. Thanks @BunsDev.
+- Control UI/chat: wire the slash-command autocomplete menu to the composer with stable ARIA relationships so screen readers announce the active command or argument option. Thanks @BunsDev.
+- Agents/usage: keep PI embedded-run telemetry attributed to the resolved model provider instead of the PI harness label, so OpenRouter and other provider-backed turns report the right provider in session usage and traces. Thanks @vincentkoc.
+- Agents/attribution: send OpenClaw attribution headers on native OpenAI and Codex traffic, including SDK transports, realtime voice and TTS, device-code auth, WHAM usage, and remote embeddings, so PI-origin defaults no longer leak into provider requests. Thanks @vincentkoc.
+- Agents/auth: keep OAuth auth profiles inherited from the main agent read-through instead of copying refresh tokens into secondary agents, and refresh Codex app-server tokens against the owning store so multi-agent swarms avoid reused refresh-token failures. Fixes #74055. Thanks @ClarityInvest.
+- Channels/Telegram: honor `ALL_PROXY` / `all_proxy` and service-level `OPENCLAW_PROXY_URL` when constructing the HTTP/1-only Telegram Bot API transport, so Windows and service installs that rely on those proxy settings no longer fall back to direct egress. Fixes #74014; refs #74086. Thanks @SymbolStar.
+- Channels/Telegram: keep raw host/network-unreachable Bot API connect failures non-fatal and route tagged polling uncaught exceptions through the Telegram restart path, so transient reachability failures no longer kill the Gateway or leave long polling stuck. Fixes #60515; refs #74540. Thanks @HemantSudarshan, @thacid22, and @ewimsatt.
+- Channels/Telegram: continue polling when `deleteWebhook` hits a transient network failure but `getWebhookInfo` confirms no webhook is configured, so startup does not retry cleanup forever after the webhook was already removed. Refs #74086; carries forward #47384. Thanks @clovericbot.
+- Channels/Telegram: retry native quote replies without `reply_parameters.quote` when Telegram returns `QUOTE_TEXT_INVALID`, so stale or truncated quote excerpts no longer drop the whole reply. Fixes #74581. Thanks @moeedahmed.
+- Channels/Telegram: apply strict safe-send retry to inbound final replies when grammY wraps a pre-connect failure, while leaving ambiguous plain network envelopes single-shot to avoid duplicate visible messages. Fixes #74203. Thanks @nanli2000cn.
+- Channels/Telegram: surface polling liveness warnings in channel status and doctor when a running long-poller has not completed `getUpdates` after startup grace or its transport activity is stale, so silent polling failures no longer look clean. Refs #74299. Thanks @lolaopenclaw.
+- Channels/Telegram: publish webhook runtime state and warn when `setWebhook` has not completed after startup grace, so webhook-mode accounts no longer look healthy while registration is still failing or retrying. Refs #74299. Thanks @lolaopenclaw and @martingarramon.
+- Channels/Telegram: bound native command menu `deleteMyCommands` and `setMyCommands` Bot API calls and allow the same timeout-triggered transport fallback retry as other startup control calls, so Windows/WSL network stalls cannot leave command sync hanging behind an otherwise running provider. Refs #74086. Thanks @SymbolStar.
+- ACP/commands: accept forwarded ACP timeout config controls in the OpenClaw bridge, treat unsupported discard-close controls as recoverable cleanup, and restore native `/verbose full` plus no-arg status behavior, so Discord command menus and nested ACP turns no longer fail on supported session controls. Thanks @vincentkoc.
+- Codex harness: interrupt and release native app-server turns that go quiet after an OpenClaw dynamic-tool response without sending `turn/completed`, so Discord and other chat lanes do not stay stuck in `processing`. Thanks @vincentkoc.
+- Codex harness: bound OpenClaw dynamic tool responses to 30 seconds and fail closed with an explicit tool result when the app-server bridge would otherwise strand the turn in `processing`. Thanks @vincentkoc.
+- TUI/status: clear stale `streaming` footer state when a final event arrives after the active run was already cleared and no tracked runs remain, while preserving concurrent-run ownership and inactive local `/btw` terminal handling. Fixes #64825; carries forward #64842, #64843, #64847, and #64862. Thanks @briandevans and @Yanhu007.
+- Channels/Discord: fail startup closed when Discord cannot resolve the bot's own identity and keep mention gating active when only configured mention patterns can detect mentions, so the provider no longer continues with a missing bot id. Fixes #42219; carries forward #46856 and #49218. Thanks @education-01 and @BenediktSchackenberg.
+- Channels/Discord: split long CJK replies at punctuation and code-point-safe fallback boundaries so Discord chunking stays readable without corrupting astral characters. Fixes #38597; repairs #71384. Thanks @p3nchan.
+- TUI: keep the streaming watchdog alive across active tool/lifecycle proof-of-life, pause it during disconnects, and reload history after stale reconnect runs so long-running chats stop flipping to false idle or hanging on stale streaming. Fixes #69081. Thanks @EenvoudJasper.
+- Browser/gateway: ignore Playwright dialog-close races from `Page.handleJavaScriptDialog` so browser automation no longer crashes the Gateway when a dialog disappears before Playwright accepts it. (#40067) Thanks @randyjtw.
+- Cron/Gateway: defer missed isolated agent-turn catch-up out of the channel startup window, so overdue cron work cannot starve Discord or Telegram while providers connect after a restart. Thanks @vincentkoc.
+- Heartbeat/cron: defer heartbeat turns while cron work is active or queued, add opt-in `heartbeat.skipWhenBusy` for subagent/nested lane pressure, and retry busy skips without advancing the schedule so local Ollama hosts do not run heartbeat and cron prompts concurrently. Fixes #50773. Thanks @scottgl9.
+- Agents/thinking: honor configured model `compat.supportedReasoningEfforts` entries that include `xhigh`, so custom OpenAI-compatible provider refs expose and validate `/think xhigh` consistently across command menus, Gateway sessions, agent CLI, and `llm-task`. Carries forward #48904. Thanks @Milchstrassse and @wufunc.
+- Vercel AI Gateway: expose provider-owned `/think xhigh` for trusted OpenAI/Codex upstream refs and Claude adaptive thinking for Anthropic upstream refs, while leaving untrusted namespaced refs on base levels. Carries forward #41561. Thanks @Zcg2021.
+- Plugins/runtime-deps: prune stale `openclaw-unknown-*` bundled runtime dependency roots during Gateway startup while keeping recent or locked roots, so old staging debris cannot keep growing across restarts. Thanks @vincentkoc.
+- Plugins/runtime-deps: include ten more root-package runtime dependencies (`@agentclientprotocol/sdk`, `@lydell/node-pty`, `croner`, `dotenv`, `jiti`, `json5`, `jszip`, `markdown-it`, `tar`, `web-push`) in `MIRRORED_CORE_RUNTIME_DEP_NAMES` so they are mirrored into the runtime-deps tree alongside `semver` and `tslog`, preventing `Cannot find package 'X'` failures from core dist code (for example `qmd-manager`, `cron/schedule`, `infra/archive`, `infra/push-web`, `infra/backup-create`, `process/supervisor/adapters/pty`) when no enabled extension owns the dependency. Adds a static drift guard test that scans `src/` for value imports of root-package deps and fails CI when one is missing from the mirror allowlist or extension-owned set. Refs #74199. Thanks @maxpuppet.
+- Ollama: compose caller abort signals with guarded-fetch timeouts for native `/api/chat` streams, so `/stop` and early cancellation still interrupt local Ollama requests that also carry provider timeout budgets. Refs #74133. Thanks @obviyus.
+- Doctor/TTS: migrate legacy `messages.tts.enabled`, agent TTS, channel TTS, and voice-call plugin TTS toggles to `auto` mode during `openclaw doctor --fix`, matching the documented TTS config contract. Thanks @vincentkoc.
+- CLI/logs: fall back to the configured Gateway file log when implicit loopback Gateway connections close or time out before or during `logs.tail`, so `openclaw logs` still works while diagnosing local-model Gateway disconnects. Refs #74078. Thanks @sakalaboator.
+- MCP/plugins: stringify non-array plugin tool results with chat-content coercion instead of default object stringification, so MCP callers receive useful JSON/text content from plugin tools. Thanks @vincentkoc.
+- Active Memory/QMD: make gateway-start QMD refresh opt-in via `memory.qmd.update.startup`, keep normal memory access lazy, preserve interactive file watching, and align watcher dependency/build ignores with QMD's scanner so cold gateway startup no longer imports or initializes QMD by default. Thanks @codexGW.
+- Channels/Discord: remove Discord-owned queued-run timeout replies through the shared channel lifecycle queue while preserving message ordering and compatibility timeout constants, so long Discord turns stay governed by session/tool/runtime lifecycle instead of channel fallback errors. Thanks @codexGW.
+- Agents/tools: clamp `process.poll` waits to 30 seconds, advertise that cap in the tool schema, and honor abort signals while waiting, so long command polls cannot pin agent responsiveness after cancellation. Thanks @vincentkoc.
+- Plugin SDK: add tracked Discord component-message helpers and a Telegram account-resolution compatibility facade, so existing plugins using those subpaths resolve while new plugins stay on generic channel SDK contracts. Thanks @vincentkoc.
+- Shared labels: preserve Unicode combining marks and NFC-equivalent accented text in group/channel slug normalization so non-Latin labels no longer lose meaningful characters. Fixes #58932; carries forward #58942 and #58995. Thanks @fengqing-git, @Starhappysh, and @koen666.
+- Channels/Telegram: include probed video width and height when sending regular Telegram videos, so portrait clips render with the correct orientation instead of being stretched by clients. (#18915) Thanks @storyarcade.
+- Docs/Hetzner: clarify that SSH tunnel access requires `AllowTcpForwarding local` before running `ssh -L`, so hardened VPS sshd configs do not block loopback Gateway access. Fixes #54557; carries forward #54564; refs #54954. Thanks @satishkc7, @blackstrype, and @Aftabbs.
+- Agents/config: preserve authored `agents.defaults.params` and per-model `agents.defaults.models[].params` during narrowed internal config writes, so OpenAI transport overrides such as `transport: "sse"` and `openaiWsWarmup: false` are not stripped from `openclaw.json`. Fixes #73607; refs #73428. Thanks @quangtran88.
+- Agents/model config: resolve per-model extra params through canonical model keys while preserving legacy double-prefixed fallback entries, so provider-prefixed model ids such as `openrouter/auto` keep their configured runtime params. (#44319) Thanks @HenryXiaoYang.
+- Gateway/shutdown: report structured shutdown warnings and HTTP close timeout warnings through `ShutdownResult` while preserving lifecycle hook hardening. Carries forward #41296. Thanks @edenfunf.
+- Control UI: keep Agents Overview and config-form select dropdowns on their configured value after options render while preserving inherited agent model placeholders. Fixes #40352; carries forward #52948. Thanks @xiaoquanidea.
+- Agents/exec: launch zsh, bash, and fish host exec shells with startup files suppressed while preserving existing PATH fallbacks, so daemon env is not overridden by shell startup files. Carries forward #40200; fixes #40179. Thanks @NewdlDewdl.
+- Plugins/QA: prebuild the private QA channel runtime before plugin gauntlet source runs so wrapper CPU/RSS measurements are not polluted by private QA dist rebuild work. Thanks @vincentkoc.
+- Plugins/QA: add a Kitchen Sink plugin gauntlet that installs the external package, checks command inventory, MCP tools, channel status, provider turns, gateway RSS, CPU, and fatal log anomalies. Thanks @vincentkoc.
+- Plugins/config: reuse the bundled plugin alias scan within a single config normalization pass, so Kitchen Sink-style plugin configs no longer peg Gateway CPU by repeatedly rescanning bundled metadata before agent turns. Thanks @vincentkoc.
+- Plugins/channels: reject malformed runtime channel registrations that omit required config helpers before they can poison channel status. Thanks @vincentkoc.
+- MCP/plugins: serialize raw plugin tool return values through the plugin-tools MCP bridge so Kitchen Sink-style tools no longer surface `undefined` content. Thanks @vincentkoc.
+- Gateway/reload: bound default restart deferral and SIGUSR1 restart drain to five minutes while preserving explicit `deferralTimeoutMs: 0` indefinite waits, so stale active work accounting cannot block config reloads forever. Thanks @vincentkoc.
+- Active Memory: register the prompt-build hook with the configured recall timeout plus setup grace instead of the 150s maximum budget, so default memory recall cannot delay turn startup for multiple minutes. Thanks @vincentkoc.
+- Gateway/readiness: include an `eventLoop` diagnostic block in local or authenticated `/readyz` responses with event-loop delay (p99 and max), event-loop utilization, CPU core ratio, and a `degraded` flag, so operators can see when slow startups or runaway turns stall the event loop. Thanks @vincentkoc.
+- Gateway/agents: schedule accepted agent runs after the accepted RPC frame has a chance to flush, so pre-turn prompt/context work is less likely to starve immediate `agent.wait` callers. Thanks @vincentkoc.
+- CLI/update: tolerate stale memory-runtime import failures during best-effort CLI process teardown, so `openclaw update` replacing hashed runtime chunks before the finalizer runs no longer surfaces as exit-time `Cannot find module` noise. Thanks @vincentkoc.
+- CLI/channels logs: reuse the rolling log-file resolver so `openclaw channels logs` falls back to the active dated log across date boundaries without reading unrelated custom log files. Fixes #42875; carries forward #42904 and #43043. Thanks @ethanclaw and @wdskuki.
+- CLI/update: skip tracked plugins disabled in config during post-update plugin sync before npm, ClawHub, or marketplace update checks, preserving their install records without failing the update. Fixes #73880. Thanks @islandpreneur007.
+- Control UI: fix Peak Error Hours showing incorrect hourly rates when the browser's timezone observes DST, by storing hourly message counts with UTC date keys and using DST-aware `Date.getHours()` for local conversion. Also extract `accumulateMessageCounts` helper to reduce duplicated daily/hourly aggregation logic. (#49396) Thanks @konanok.
+- iMessage: normalize known leading attributedBody corruption markers on sent-message echo text keys so delayed reflected echoes with U+FFFD/U+FFFE/U+FFFF/FEFF prefixes are dropped without collapsing interior text. Fixes #59973; carries forward #59980 and #62191. Thanks @neeravmakwana and @maguilar631697.
+- Security/audit: recognize dangerous node command IDs as valid `gateway.nodes.denyCommands` entries, so audit only warns on real typos or unsupported patterns. (#56923) Thanks @chziyue.
+- Cron: treat implicit text payloads with agent-turn overrides as agent turns, preserving model overrides for scheduled text prompts instead of pruning them as system events. Fixes #28905. (#64060) Thanks @liaoandi.
+- Telegram/exec approvals: stop treating general Telegram chat allowlists and `defaultTo` routes as native exec approvers; Telegram now uses explicit `execApprovals.approvers` or owner identity from `commands.ownerAllowFrom`, matching the first-pairing owner bootstrap path. Thanks @pashpashpash.
+- Plugins/providers: keep Gateway startup primary-model discovery on metadata-only provider entries and reuse active non-speech capability providers even with explicit plugin entries, avoiding unnecessary provider registry loads during startup and media capability checks. Fixes #73729, #73835, and #73793; carries forward #73853 and #73794. Thanks @sg1416-zg, @brokemac79, and @poolside-ventures.
+- Chat commands: route sensitive group `/diagnostics` and `/export-trajectory` approvals and results to a private owner route, preferring same-surface DMs before falling back to the first configured owner route, so Discord group invocations can land in Telegram when that is the primary owner interface. Thanks @pashpashpash.
+- Gateway/hooks: keep successful `deliver:false` agent hooks silent, log a hook audit record for suppressed success announcements, and suppress fallback summaries after attempted hook delivery while still surfacing failed hook runs. Repairs #55761; builds on #36332 and #49234. Thanks @EffortlessSteven, @cioclawcode, and @BrennerSpear.
+- Plugin SDK/Discord: restore a deprecated `openclaw/plugin-sdk/discord` compatibility facade and the legacy compat group-policy warning export for the published `@openclaw/discord@2026.3.13` package, covering its config, account, directory, status, and thread-binding imports while keeping new plugins on generic SDK subpaths. Fixes #73685; supersedes #73703. Thanks @rderickson9 and @SymbolStar.
+- Channels/Discord: suppress duplicate gateway monitors when multiple enabled accounts resolve to the same bot token, preferring config tokens over default env fallback and reporting skipped duplicates as disabled. Supersedes #73608. Thanks @kagura-agent.
+- CLI/health: build channel health summaries from inspected credential metadata plus runtime state, so `openclaw health --json` reports Discord `running`, `connected`, and `tokenSource` consistently with channel status. Fixes #44354. Thanks @ferenc-acs.
+- Control UI/Talk: decode Google Live binary WebSocket JSON frames and stop queued browser audio on interruption or shutdown, so browser Talk leaves `Connecting Talk...` and barge-in no longer plays stale audio. Fixes #73601 and #73460; supersedes #73466. Thanks @Spolen23 and @WadydX.
+- Channels/Discord: ignore stale route-shaped conversation bindings after a Discord channel is reconfigured to another agent, while preserving explicit focus and subagent bindings. Fixes #73626. Thanks @ramitrkar-hash.
+- Agents/bootstrap: pass pending BOOTSTRAP.md contents through the first-run user prompt while keeping them out of privileged system context, and show limited bootstrap guidance when workspace file access is unavailable. Fixes #73622. Thanks @mark1010.
+- ACP/tasks: classify parent-owned ACP sessions as background work regardless of persistent runtime mode, and close terminal stale ACP sessions when no active binding remains, so delegated ACP output reports through the parent task notifier instead of acting like a normal foreground chat session. Refs #73609. Thanks @joerod26.
+- Tasks: keep terminal mirrored TaskFlow timestamps pinned to task completion time and let maintenance repair stale mirrors, so ACP terminal delivery updates no longer leave inconsistent flow audits. Refs #73609. Thanks @joerod26.
+- Gateway/sessions: add conservative stuck-session recovery that releases only stale session lanes while active embedded runs, reply operations, and lane tasks remain serialized, so queued follow-ups can drain without aborting legitimate long-running turns. Refs #73581, #73655, #73652, #73705, #73647, #73602, #73592, and #73601. Thanks @WS-Q0758, @bryangauvin, @spenceryang1996-dot, @bmilne1981, @mattmcintyre, @Vksh07, and @Spolen23.
+- Plugins: cache unchanged plugin manifest loads by file signature, reducing repeated JSON/JSON5 parsing and manifest normalization in bursty startup and runtime registry paths. Refs #73532 and #73647; carries forward #73678. Thanks @TheDutchRuler.
+- Plugins/runtime-deps: cache unchanged bundled runtime mirror dist-file materialization decisions and close file-lock handles on owner-write failures, reducing repeated startup chunk scans and avoiding FileHandle-GC recovery stalls. Refs #73532. Thanks @oadiazp and @bstanbury.
+- Plugins/runtime-deps: retry and defer transient cleanup failures for owned runtime staging directories so CLI startup no longer aborts after a successful bundled dependency swap. Refs #73903. Thanks @bobfreeman1989.
+- Plugins/runtime-deps: cache bundled runtime-deps JSON/package files by file signature, reducing repeated staged-runtime metadata reads during bundled channel startup. Refs #73647 and #73705. Thanks @mattmcintyre and @bmilne1981.
+- Plugins/runtime-deps: delegate bundled plugin dependency staging to complete npm/pnpm install plans with durable runtime state, removing retained-manifest and source-checkout cache reconciliation from Gateway startup. Refs #73532. Thanks @oadiazp, @bstanbury, and @jmfraga.
+- Plugins/runtime-deps: replace Gateway-start root chunk dependency inference with explicit mirrored-root dependency metadata, reducing staged runtime scans while preserving lazy per-plugin installs. Refs #73532. Thanks @oadiazp and @bstanbury.
+- Plugins/runtime-deps: run pnpm staged installs outside the repository workspace and disable pnpm release-age gates for exact bundled runtime dependency materialization, so bundled plugin dependency repair writes packages into the generated stage without blocking fresh packaged dependencies. Refs #73532. Thanks @oadiazp and @bstanbury.
+- CLI/TUI: keep `chat.history` off model-catalog discovery so initial Gateway-backed TUI history loads cannot block behind slow provider/plugin model scans on low-core hosts. Refs #73524. Thanks @harshcatsystems-collab.
+- Channels/WhatsApp: flag recently reconnected linked accounts in channel status even when the socket is currently healthy, so flapping WhatsApp Web sessions no longer look clean after a brief reconnect. Refs #73602. Thanks @Vksh07.
+- Channels/WhatsApp: log shared dispatcher delivery failures with reply kind, message id, chat id, and connection id, so typing-without-send reports can identify whether the WhatsApp send path rejected a generated reply. Refs #74269. Thanks @tomcosta-git.
+- Feishu: suppress distinct late `final` text deliveries after a streaming card has already closed, while keeping media attachments deliverable, so late-finals no longer reopen duplicate Feishu cards. Fixes #71977. (#72294) Thanks @MonkeyLeeT.
+- Gateway: expose `gateway.handshakeTimeoutMs` in config, schema, and docs while preserving `OPENCLAW_HANDSHAKE_TIMEOUT_MS` precedence, so loaded or low-powered hosts can tune local WebSocket pre-auth handshakes without patching dist files. Supersedes #51282; refs #73592 and #73652. Thanks @henry-the-frog.
+- Gateway/TUI/status: align configured and env-based WebSocket handshake budgets across local clients, probes, and fallback RPCs while preserving explicit status timeouts and paired-device auth fallback, so slow local gateways are not marked unreachable by a shorter client watchdog. Refs #73524, #73535, #73592, and #73602. Thanks @harshcatsystems-collab, @DJBlackhawk, and @Vksh07.
+- Gateway/startup: return retryable `UNAVAILABLE` during the sidecar startup window and keep CLI/TUI/status clients retrying inside their existing timeout budget, so early connects no longer surface as terminal handshake failures. Fixes #73652. Thanks @spenceryang1996-dot.
+- Gateway/proxy: bypass inherited proxy environment for local Gateway control-plane WebSockets to `localhost` as well as loopback IPs, so Windows/WSL proxy settings cannot intercept local CLI/TUI Gateway connections. Supersedes #73474; refs #73602. Thanks @DhtIsCoding.
+- Doctor/Gateway: use a lightweight `status` RPC without channel summary work for doctor Gateway liveness, so slow health snapshots do not falsely drive service restart repair. Fixes #64400; supersedes #64511. Thanks @CHE10X and @EronFan.
+- Agents/auth: scope external CLI credential discovery to configured providers during model auth status and startup prewarm, so opencode-only and other single-provider gateways do not block on unrelated Claude CLI Keychain probes. Fixes #73908. Thanks @Ailuras.
+- Agents/model selection: resolve slash-form aliases before provider/model parsing and keep alias-resolved primary models subject to transient provider cooldowns, so cron and persisted sessions do not retry cooled-down raw aliases. Fixes #73573 and #73657. Thanks @akai-shuuichi and @hashslingers.
+- Agents/Claude CLI: reuse already-cached macOS Keychain credentials for no-prompt Claude credential reads, so doctor/runtime checks do not miss fresh interactive Claude auth. Fixes #73682. Thanks @RyanSandoval.
+- Agents/Claude CLI doctor: scope workspace and project-dir checks to agents that actually use the Claude CLI runtime, so non-default Claude agents no longer make the default agent look Claude-backed. Fixes #73903. Thanks @bobfreeman1989.
+- Gateway/sessions: expose effective agent runtime metadata on session rows, `sessions.patch`, and local `openclaw sessions --json`, while keeping Claude CLI-backed rows on the canonical model provider so runtime backend and model identity are no longer conflated. Fixes #73090. Thanks @vishutdhar.
+- Gateway/auth status: scope external CLI credential overlays to configured providers, runtimes, or profiles and keep status reads off new Keychain prompts, so single-provider Gateway configs no longer probe unrelated Claude/Codex/MiniMax auth on startup. Fixes #73908. Thanks @Ailuras.
+- Agents/runtime status: expose effective agent runtime metadata in `agents.list`, Control UI agent panels, and `/agents`, and avoid rendering stale or cumulative CLI token totals as live context usage. Fixes #73660, #73578, and #45268. Thanks @spartman, @DashLabsDev, and @xyooz.
+- Agents/transcripts: strip empty assistant text blocks while preserving valid text, images, and signatures, so Anthropic-style providers no longer reject sanitized transcript turns. Fixes #73640. Thanks @jowhee327.
+- Gateway/sessions: preserve session keys on hidden lifecycle events so channel-routed runs still persist terminal session state and do not strand session status as running after Codex turn completion. Thanks @cathrynlavery.
+- Providers/Bedrock: omit deprecated `temperature` for Claude Opus 4.7 Bedrock model ids, named and application inference profiles, including dotted `opus-4.7` refs, and classify the nested validation response for failover. Fixes #73663. Thanks @bstanbury.
+- Gateway: raise the preauth/connect-challenge timeout to 15s so cold CLI starts on slower hosts have more time to process the WebSocket challenge before the Gateway closes the connection. Fixes #51469; refs #73592 and #62060. Thanks @GothicFox and @jackychen-png.
+- CLI/status: fall back to a bounded local `status` RPC when loopback detail probes time out or report unknown capability, so reachable local gateways are no longer marked unreachable by slow read diagnostics. Fixes #73535; refs #48360, #62762, #51357, and #42019. Thanks @RacecarGuy, @justinschille, @DJBlackhawk, @tianyaqpzm, and @0xrsydn.
+- CLI/gateway: reuse cached paired-device auth during `gateway probe` and report post-connect diagnostic failures as degraded reachability, so healthy local gateways are no longer marked unreachable after loopback auth or read timeouts. Fixes #48360. Thanks @RacecarGuy.
+- Channels/Discord: give Discord Gateway WebSocket handshakes a 30s timeout so stalled TLS/network transitions emit an error and Carbon can continue its reconnect loop instead of leaving the bot silent until restart. Refs #50046. Thanks @codexGW.
+- Mattermost/WebSocket: send protocol ping/pong keepalives and terminate stale sessions when pongs stop arriving, so silent TCP drops reconnect instead of leaving monitoring idle. Fixes #41837; carries forward #57621; refs #50138, #44160, and #51104. Thanks @JasonWang1124.
+- Channels/Telegram: suppress standalone failed edit/write warning payloads when a user-facing assistant error reply already covers the turn, while keeping unresolved mutating failures visible behind success-looking or suppressed-error replies. Fixes #39631; refs #73750; carries forward #39636 and #39717; leaves #39406 for configurable delivery policy. Thanks @Bartok9 and @Bortlesboat.
+- Control UI/agents: persist the Set Default action through `agents.list[].default` instead of writing the unsupported `agents.defaultId` field, so saved default-agent changes survive config validation. Fixes #65565; carries forward #72585. Thanks @luyao618.
+- NVIDIA/NIM: persist the `NVIDIA_API_KEY` provider marker and mark bundled NVIDIA Chat Completions models as string-content compatible, so NIM models load from `models.json` and OpenAI-compatible subagent calls send plain text content. Fixes #73013 and #50107; refs #73014. Thanks @bautrey, @iot2edge, @ifearghal, and @futhgar.
+- Channels/Discord: let text-only configs drop the `GuildVoiceStates` gateway intent and expose a bounded `/gateway/bot` metadata timeout with rate-limited fallback logs, reducing idle CPU and warning floods. Fixes #73709 and #73585. Thanks @sanchezm86 and @trac3r00.
+- Agents/sessions: mark same-turn `sessions_send` and A2A reply prompts with an inter-session `isUser=false` envelope before they reach the model, so foreign session output no longer lands as bare active user text. Fixes #73702; refs #73698, #73609, #73595, and #73622. Thanks @alvelda.
+- Channels/Telegram: fail closed when account-level public DM settings conflict with a restrictive top-level `allowFrom`, and require an effective wildcard before `dmPolicy="open"` behaves as public access. Fixes #73756; refs #73698. Thanks @Hilo-Hilo and @xace1825.
+- Channels/security: move open-DM allowlist semantics into the shared policy helpers and align Discord, Slack, Mattermost, Matrix, Feishu, LINE, IRC, Google Chat, Zalo, Zalo User, QQ Bot, and Synology Chat so `dmPolicy="open"` is public only with an effective wildcard and otherwise still respects sender allowlists. Refs #73756 and #73698. Thanks @Hilo-Hilo and @xace1825.
+- ACP/tasks: sweep orphaned parent-owned ACP sessions whose task records are gone, preserving bound persistent sessions but clearing unbound stale ACPX metadata so old child sessions cannot silently respawn into chat. Fixes #73609. Thanks @joerod26.
+- Outbound/security: strip known internal runtime scaffolding such as `<system-reminder>` and `<previous_response>` at the final channel delivery boundary and keep Discord output on targeted tag stripping, so degraded harness replies cannot leak those tags to users. Fixes #73595. Thanks @gabrielexito-stack and @martingarramon.
+- Security/Telegram: load Telegram security adapters in read-only audit/doctor, audit malformed Telegram DM `allowFrom` entries even when groups are disabled, and keep allowlist DM audits from counting stale pairing-store senders, so public/shared-DM risk checks stay accurate. Refs #73698. Thanks @xace1825.
+- Plugins: remove hidden manifest, provider-owner, bootstrap, and channel metadata caches so plugin installs, manifest edits, and bundled-root changes are visible on the next metadata read while keeping runtime/module loader caches for actual plugin code. Thanks @shakkernerd.
+- Control UI/WebChat: create a fresh dashboard session from the New Chat button instead of resetting the current transcript with `/new`, preserving in-progress composer edits during delayed session creation or when creation cannot safely switch sessions, and showing clear retry feedback when creation is blocked, refreshing, or returns no new session. Carries forward #52042 and #52746. Thanks @bobashopcashier and @vincentkoc.
+- CLI/plugins: use plugin metadata snapshots for install slot selection and add opt-in plugin lifecycle timing traces, so plugin install avoids runtime-loading the plugin registry for metadata-only decisions. Thanks @shakkernerd.
+- fix(plugins): restrict bundled plugin dir resolution to trusted package roots. (#73275) Thanks @pgondhi987.
+- fix(security): prevent workspace PATH injection via service env and trash helpers. (#73264) Thanks @pgondhi987.
+- Active Memory: allow `allowedChatTypes` to include explicit portal/webchat sessions and classify `agent:...:explicit:...` session keys before opaque session ids can shadow the chat type. Fixes #65775. (#66285) Thanks @Lidang-Jiang.
+- Active Memory: allow the hidden recall sub-agent to use both `memory_recall` and the legacy `memory_search`/`memory_get` memory tool contract, so bundled `memory-lancedb` recall works without breaking the default `memory-core` path. Fixes #73502. (#73584) Thanks @Takhoffman.
+- fix(device-pairing): validate callerScopes against resolved token scopes on repair [AI]. (#72925) Thanks @pgondhi987.
+- Active Memory docs: document the `cacheTtlMs` 1000-120000 ms range and 15000 ms default so setup snippets do not lead users past the schema limit. Fixes #65708. (#65737) Thanks @WuKongAI-CMU.
+- fix(agents): canonicalize provider aliases in byProvider tool policy lookup [AI]. (#72917) Thanks @pgondhi987.
+- fix(security): block npm_execpath injection from workspace .env [AI-assisted]. (#73262) Thanks @pgondhi987.
+- Tools/web_fetch: decode response bodies from raw bytes using declared HTTP, XML, or HTML meta charsets before extraction, so Shift_JIS and other legacy-charset pages no longer return mojibake. Fixes #72916. Thanks @amknight.
+- Active Memory: skip payload-less `memory_search` transcript tool results when building debug telemetry, so newer empty entries no longer hide the latest useful debug payload. (#68773) Thanks @SimbaKingjoe.
+- Active Memory: keep recall setup time from consuming the configured model timeout while giving the hook runner an explicit bounded budget for the plugin, so slow embedded-run setup no longer causes immediate recall timeouts. Fixes #72606. (#72620) Thanks @hyspacex.
+- Channels/Discord: bound message read/search REST calls, route those actions through Gateway execution, and fall back to `CommandTargetSessionKey` for inbound hook session keys so Discord reads do not hang and hooks still fire when `SessionKey` is empty. Fixes #73431. (#73521) Thanks @amknight.
+- Plugins/media: auto-enable provider plugins referenced by `agents.defaults.imageGenerationModel`, `videoGenerationModel`, and `musicGenerationModel` primary/fallback refs, so configured Google and MiniMax media providers do not stay disabled behind a restrictive plugin allowlist. Thanks @vincentkoc.
+- Memory-core/dreaming: retry managed dreaming cron registration after startup when the cron service is not reachable yet, so the scheduled Memory Dreaming Promotion sweep recovers without waiting for heartbeat traffic. Fixes #72841. Thanks @amknight.
+- Acpx/runtime: validate the runtime session mode at the `AcpxRuntime.ensureSession` wrapper boundary so callers that pass anything other than `persistent` or `oneshot` get a clear `ACP_INVALID_RUNTIME_OPTION` error instead of silently round-tripping through the encoded handle as a default `persistent` mode and later throwing `SessionResumeRequiredError`. Investigation context: #73071. (#73548) Thanks @amknight.
+- CLI/infer: keep web-search fallback on missing provider API keys, preserve structured validation errors from the selected provider, and let per-request image describe prompts override configured media-entry prompts. (#63263) Thanks @Spolen23.
+- Chat commands: include configured model-catalog reasoning metadata when building `/think` argument menus so Ollama Cloud and other provider-owned reasoning models show supported levels instead of only `off`. Fixes #73515; supersedes #73568. Thanks @danielzinhu99 and @neeravmakwana.
+- Channels/Telegram: suppress generic tool-progress chatter when preview streaming is off, so non-streaming Telegram turns only deliver final replies while approvals, media, and errors still route normally. Refs #72363 and #72482. Thanks @neeravmakwana and @SweetSophia.
+- CLI/model probes: add repeatable image `--file` inputs to `infer model run` for local and gateway multimodal model smokes, so vision models such as Ollama Qwen VL and Gemini can be tested through the raw model-probe surface. Fixes #63700. Thanks @cedricjanssens.
+- CLI/model probes: request trusted operator scope for `infer model run --gateway --model <provider/model>` so Gateway raw model smokes can use one-off provider/model overrides instead of being rejected before provider auth resolution. Fixes #73759. Thanks @chrislro.
+- CLI/image describe: pass `--prompt` and `--timeout-ms` through `infer image describe` and `describe-many`, so custom vision instructions and slow local model budgets reach media-understanding providers such as Ollama, OpenAI, Google, and OpenRouter. Refs #63700. Thanks @cedricjanssens.
+- Model selection: include the rejected provider/model ref and allowlist recovery hint when a stored session override is cleared, so local model selections such as Gemma GGUF variants do not fall back to the default with a generic message. Refs #71069. Thanks @CyberRaccoonTeam.
+- OpenAI-compatible providers: drop malformed event-only or blank-data SSE frames before the OpenAI SDK stream parser sees them, so proxies that split `event:` from `data:` no longer crash streaming runs with `Unexpected end of JSON input`. Fixes #52802. Thanks @LyHug.
+- Gateway/OpenAI-compatible streaming: strip `<final>` tags split across streamed model deltas before they reach SSE clients, so `/v1/chat/completions` no longer emits tag remnants or drops content when final-answer wrappers cross chunk boundaries. Fixes #63325. Thanks @tzwickl.
+- Ollama: resolve explicitly selected signed-in `:cloud` models through `/api/show` when `/api/tags` omits them, so working models such as `gemini-3-flash-preview:cloud` and `deepseek-v4-pro:cloud` do not fail dynamic model resolution before the native `/api/chat` transport runs. Fixes #73909. Thanks @chtse53.
+- Discord/exec approvals: keep the local `/approve` prompt when no native Discord approval runtime is active, and send a manual fallback notice when native approval delivery reaches no targets, so failed DM cards no longer leave approval turns silent or dependent on model-written shell commands. Fixes #73954; carries forward #74027. Thanks @guarismo and @brokemac79.
+- Local model prompt caching: keep stable Project Context above volatile channel/session prompt guidance and stop embedding current channel names in the message tool description, so Ollama, MLX, llama.cpp, and other prefix-cache backends avoid avoidable full prompt reprocessing across channel turns. Fixes #40256; supersedes #40296. Thanks @rhclaw and @sriram369.
+- Gateway/OpenAI-compatible API: guard provider policy lookup against runtime providers with non-array `models` values, so `/v1/chat/completions` no longer fails with `provider?.models?.some is not a function`. Fixes #66744; carries forward #66761. Thanks @MightyMoud, @MukundaKatta.
+- WhatsApp/Web: pass explicit Baileys socket timings into every WhatsApp Web socket and expose `web.whatsapp.*` keepalive, connect, and query timeout settings so unstable networks can avoid repeated 408 disconnect and opening-handshake timeout loops. Fixes #56365. (#73580) Thanks @velvet-shark.
+- WhatsApp/Web: recover recently active listeners when a post-408 reconnect keeps receiving transport frames but stops delivering app messages, while keeping group metadata fallback off Baileys sends. Fixes #63855 and #66920; refs #7433, #67986, #70856, #60007, and #72621. Thanks @legonhilltech-jpg, @octopuslabs-fl, @Kanorin-chan, and @stuswan.
+- Channels/Telegram: persist native command metadata on target sessions so topic, helper, and ACP-bound slash commands keep their session metadata attached to the routed conversation. (#57548) Thanks @GaosCode.
+- Channels/native commands: keep validated native slash command replies visible in group chats while preserving explicit owner allowlists for command authorization. (#73672) Thanks @obviyus.
+- Pairing/doctor: bootstrap `commands.ownerAllowFrom` from the first approved DM pairing when no command owner exists, and have doctor explain missing owners so privileged slash commands are not accidentally unusable after onboarding. Thanks @pashpashpash.
+- Telegram/exec: infer native exec approvers from `commands.ownerAllowFrom` and auto-enable the Telegram approval client when an owner is resolvable, so owner-only commands such as `/diagnostics` can be approved in Telegram without duplicate per-channel approver config. Thanks @pashpashpash.
+- Auto-reply/session: carry the tail of user/assistant turns into the freshly-rotated transcript on silent in-reply session resets (compaction failure, role-ordering conflict) so direct-chat continuity survives the rebind. Fixes #70853. (#70898) Thanks @neeravmakwana.
+- Skills: load grouped skill directories such as `skills/<group>/<skill>/SKILL.md` from configured skill roots while keeping grouped discovery capped for large directories. Fixes #56915. (#72534) Thanks @ottodeng, @MoerAI, and @i010542.
+- Config: skip malformed non-string `env.vars` entries before env-reference checks, so config loading no longer crashes on JSON values like numbers or booleans. (#42402) Thanks @MiltonHeYan.
+- Docker Compose: default missing config and workspace bind mounts to `${HOME:-/tmp}/.openclaw` so manual compose runs do not create invalid empty-source volume specs. (#64485) Thanks @jlapenna.
+- Agents/context engines: preserve the child agent's configured `agentDir` when subagent cleanup re-resolves a context engine, so `onSubagentEnded` hooks keep operating on the correct per-agent state. (#67243) Thanks @jarimustonen.
+- Channels/WhatsApp: restrict pairing verification replies to real inbound user content, preventing unsolicited prompts from receipts, typing indicators, presence updates, and other non-message Baileys upserts. Fixes #73797. (#73823) Thanks @hclsys.
+- Configure/Ollama: show the configured Ollama model allowlist after Cloud only or Cloud + Local setup and skip slow per-model cloud metadata fetches. (#73995) Thanks @obviyus.
+- Channels/WhatsApp: detect explicit group `@mentions` again when the bot's own E.164 is in `allowFrom`, so shared-number setups no longer skip group pings that directly mention the bot. Fixes #49317. (#73453) Thanks @juan-flores077.
+- WhatsApp/reliability: publish real transport-liveness into WhatsApp channel status and force earlier reconnects on silent transport stalls, so quiet healthy sessions stay connected while wedged sockets recover before the later remote 408 path. (#72656) Thanks @Sathvik-1007.
+- Core/channels: tighten selected runtime, media, and plugin edge-case handling while preserving existing behavior. Thanks @jesse-merhi.
+- Channels/WhatsApp: strip leaked plural tool-call XML wrappers on every WhatsApp-visible outbound path and keep channel error payloads out of WhatsApp chats. (#71830) Thanks @rubencu.
+- Agents/embedded-runner: inject the resolved OAuth bearer (and forward the run abort signal) on the boundary-aware embedded stream fallback so models that route through `openai-codex-responses` and other boundary-aware transports stop failing with `401 Unauthorized: Missing bearer or basic authentication in header`. Fixes #73559. (#73588) Thanks @openperf.
+- Telegram/gateway: bound outbound Bot API calls and cache bundled plugin alias lookup so slow Telegram sends or WSL2 filesystem scans no longer wedge gateway replies. (#74210) Thanks @obviyus.
+- Configure/GitHub Copilot: reuse existing Copilot auth during configure and show the provider's manifest model catalog in the model picker. (#74276) Thanks @obviyus.
+- Configure/models: keep the model picker scoped to the selected manifest provider and enable its bundled plugin before catalog lookup, so choosing GitHub Copilot no longer falls back to Ollama or skips the catalog. (#74322) Thanks @obviyus.
+- Auto-reply/subagents: reject `/focus` from leaf subagents and scope fallback target resolution to the requesting subagent's children, so subagents cannot bind conversations outside their control boundary. (#73613) Thanks @drobison00.
+- Gateway/startup: skip inherited workspace startup memory for sandboxed spawned sessions without real-workspace write access, so `/new` no longer preloads host workspace memory into isolated child runs. (#73611) Thanks @drobison00.
+- Agents/tool policy: validate caller group IDs against session or spawned context before applying group-scoped tool policies or persisting gateway group metadata, so forged group IDs cannot unlock more permissive tools. (#73720) Thanks @mmaps.
+- Commands: keep channel-prefixed owner allowlist entries scoped to matching providers so webchat command contexts cannot inherit external channel owners. Thanks @zsxsoft.
+- Auth/device pairing: bound bootstrap handoff token issuance, redemption, and approved pairing baselines to the documented per-role scope allowlist, so bootstrap approvals cannot persistently grant `operator.admin`, `operator.pairing`, or `node.exec` scopes. Thanks @eleqtrizit.
+- Providers/GitHub Copilot: support the GUI/RPC wizard device-code auth flow so onboarding from non-TTY clients (gateway RPC bridge, GUI wizards) completes instead of returning empty profiles. Dangerous-state handling now distinguishes `access_denied` and `expired_token` from transport errors. (#73290) Thanks @indierawk2k2.
+- Installer/Linux: warn before switching an unwritable npm global prefix to `~/.npm-global`, then tell users to run future global updates with `npm i -g openclaw@latest` without `sudo` so npm keeps using the redirected user prefix. Fixes #44365; carries forward #50479. Thanks @Sayeem3051.
+- Gateway/plugins: enable the native `require()` fast path on Windows for bundled plugin modules so plugin loading uses `require()` instead of Jiti's transform pipeline, reducing startup from ~39s to ~2s on typical 6-plugin setups. Fixes #68656. (#74173) Thanks @galiniliev.
+- macOS app: detect stale Gateway TLS certificate pins, automatically repair trusted Tailscale Serve rotations, and surface paired-but-disconnected Mac companion nodes so partial Gateway connections no longer look healthy. Thanks @guti.
+- Feishu: recreate WebSocket clients with monitor-owned backoff only after SDK reconnect exhaustion, preserving heartbeat defaults and shutdown cleanup without treating recoverable SDK callback errors as terminal, so persistent connections recover without manual gateway restart. Fixes #52618; duplicate evidence #59753; related #55532, #68766, #72411, and #73739. Thanks @vincentkoc, @schumilin, @alex-xuweilong, @120106835, @sirfengyu, and @tianhaocui.
+
diff --git a/CHANGELOG/2026.4.7-1.md b/CHANGELOG/2026.4.7-1.md
new file mode 100644
index 0000000000000000000000000000000000000000..8cc2dbc6e31b8b82837a201dc47f6e79b6eeef7b
--- /dev/null
+++ b/CHANGELOG/2026.4.7-1.md
@@ -0,0 +1,2 @@
+## 2026.4.7-1
+
diff --git a/CHANGELOG/2026.4.8.md b/CHANGELOG/2026.4.8.md
new file mode 100644
index 0000000000000000000000000000000000000000..b8a68b6789c180cc7424d8fbd23970b385a31230
--- /dev/null
+++ b/CHANGELOG/2026.4.8.md
@@ -0,0 +1,13 @@
+## 2026.4.8
+
+### Fixes
+
+- Telegram/setup: load setup and secret contracts through packaged top-level sidecars so installed npm builds no longer try to import missing `dist/extensions/telegram/src/*` files during gateway startup.
+- Bundled channels/setup: load shared secret contracts through packaged top-level sidecars across BlueBubbles, Feishu, Google Chat, IRC, Matrix, Mattermost, Microsoft Teams, Nextcloud Talk, Slack, and Zalo so installed npm builds no longer rely on missing `dist/extensions/*/src/*` files during gateway startup.
+- Bundled plugins: align packaged plugin compatibility metadata with the release version so bundled channels and providers load on OpenClaw 2026.4.8.
+- Agents/progress: keep `update_plan` available for OpenAI-family runs while returning compact success payloads and allowing `tools.experimental.planTool=false` to opt out.
+- Agents/exec: keep `/exec` current-default reporting aligned with real runtime behavior so `host=auto` sessions surface the correct host-aware fallback policy (`full/off` on gateway or node, `deny/off` on sandbox) instead of stale stricter defaults.
+- Slack: honor ambient HTTP(S) proxy settings for Socket Mode WebSocket connections, including NO_PROXY exclusions, so proxy-only deployments can connect without a monkey patch. (#62878) Thanks @mjamiv.
+- Slack/actions: pass the already resolved read token into `downloadFile` so SecretRef-backed bot tokens no longer fail after a raw config re-read. (#62097) Thanks @martingarramon.
+- Network/fetch guard: skip target DNS pinning when trusted env-proxy mode is active so proxy-only sandboxes can let the trusted proxy resolve outbound hosts. (#59007) Thanks @cluster2600.
+
diff --git a/CHANGELOG/2026.4.9.md b/CHANGELOG/2026.4.9.md
new file mode 100644
index 0000000000000000000000000000000000000000..18c84610600a87d587967647a411d84d0337f32c
--- /dev/null
+++ b/CHANGELOG/2026.4.9.md
@@ -0,0 +1,50 @@
+## 2026.4.9
+
+### Changes
+
+- Memory/dreaming: add a grounded REM backfill lane with historical `rem-harness --path`, diary commit/reset flows, cleaner durable-fact extraction, and live short-term promotion integration so old daily notes can replay into Dreams and durable memory without a second memory stack. Thanks @mbelinky.
+- Control UI/dreaming: add a structured diary view with timeline navigation, backfill/reset controls, traceable dreaming summaries, and a grounded Scene lane with promotion hints plus a safe clear-grounded action for staged backfill signals. (#63395) Thanks @mbelinky.
+- QA/lab: add character-vibes evaluation reports with model selection and parallel runs so live QA can compare candidate behavior faster.
+- Plugins/provider-auth: let provider manifests declare `providerAuthAliases` so provider variants can share env vars, auth profiles, config-backed auth, and API-key onboarding choices without core-specific wiring.
+- iOS: pin release versioning to an explicit CalVer in `apps/ios/version.json`, keep TestFlight iteration on the same short version until maintainers intentionally promote the next gateway version, and add the documented `pnpm ios:version:pin -- --from-gateway` workflow for release trains. (#63001) Thanks @ngutman.
+- Tools/video_generate: extend the tool and the Plugin SDK with `providerOptions` (vendor-specific options forwarded as a JSON object), `inputAudios` / `audioRef` / `audioRefs` reference audio inputs, per-asset semantic role hints (`imageRoles` / `videoRoles` / `audioRoles`) using a typed `VideoGenerationAssetRole` union, a new `"adaptive"` aspect-ratio sentinel, and `maxInputAudios` provider capability declarations. Providers opt into `providerOptions` by declaring a typed `capabilities.providerOptions` schema (`{ seed: "number", draft: "boolean", .. }`); unknown keys and type mismatches cause the runtime fallback loop to skip the candidate with a visible warning and an `attempts` entry, so vendor-specific options never silently reach the wrong provider. Also raises the in-tool image input cap to 9 and updates the docs table to list all new parameters. (#61987) Thanks @xieyongliang.
+
+### Fixes
+
+- Browser/security: re-run blocked-destination safety checks after interaction-driven main-frame navigations from click, evaluate, hook-triggered click, and batched action flows, so browser interactions cannot bypass the SSRF quarantine when they land on forbidden URLs. (#63226) Thanks @eleqtrizit.
+- Security/dotenv: block runtime-control env vars plus browser-control override and skip-server env vars from untrusted workspace `.env` files, and reject unsafe URL-style browser control override specifiers before lazy loading. (#62660, #62663) Thanks @eleqtrizit.
+- Gateway/node exec events: mark remote node `exec.started`, `exec.finished`, and `exec.denied` summaries as untrusted system events and sanitize node-provided command/output/reason text before enqueueing them, so remote node output cannot inject trusted `System:` content into later turns. (#62659) Thanks @eleqtrizit.
+- Plugins/onboarding auth choices: prevent untrusted workspace plugins from colliding with bundled provider auth-choice ids during non-interactive onboarding, so bundled provider setup keeps operator secrets out of untrusted workspace plugin handlers unless those plugins are explicitly trusted. (#62368) Thanks @pgondhi987.
+- Security/dependency audit: force `basic-ftp` to `5.2.1` for the CRLF command-injection fix and bump Hono plus `@hono/node-server` in production resolution paths.
+- Android/pairing: clear stale setup-code auth on new QR scans, bootstrap operator and node sessions from fresh pairing, prefer stored device tokens after bootstrap handoff, and pause pairing auto-retry while the app is backgrounded so scan-once Android pairing recovers reliably again. (#63199) Thanks @obviyus.
+- Matrix/gateway: wait for Matrix sync readiness before marking startup successful, keep Matrix background handler failures contained, and route fatal Matrix sync stops through channel-level restart handling instead of crashing the whole gateway. (#62779) Thanks @gumadeiras.
+- Slack/media: preserve bearer auth across same-origin `files.slack.com` redirects while still stripping it on cross-origin Slack CDN hops, so `url_private_download` image attachments load again. (#62960) Thanks @vincentkoc.
+- Reply/doctor: use the active runtime snapshot for queued reply runs, resolve reply-run SecretRefs before preflight helpers touch config, surface gateway OAuth reauth failures to users, and make `openclaw doctor` call out exact reauth commands. (#62693, #63217) Thanks @mbelinky.
+- Control UI: guard stale session-history reloads during fast session switches so the selected session and rendered transcript stay in sync. (#62975) Thanks @scoootscooob.
+- Gateway/chat: suppress exact and streamed `ANNOUNCE_SKIP` / `REPLY_SKIP` control replies across live chat updates and history sanitization so internal agent-to-agent control tokens no longer leak into user-facing gateway chat surfaces. (#51739) Thanks @Pinghuachiu.
+- Auto-reply/NO_REPLY: strip glued leading `NO_REPLY` tokens before reply normalization and ACP-visible streaming so silent sentinel text no longer leaks into user-visible replies while preserving substantive `NO_REPLY ...` text. Thanks @frankekn.
+- Sessions/routing: preserve established external routes on inter-session announce traffic so `sessions_send` follow-ups do not steal delivery from Telegram, Discord, or other external channels. (#58013) Thanks @duqaXxX.
+- Gateway/sessions: clear auto-fallback-pinned model overrides on `/reset` and `/new` while still preserving explicit user model selections, including legacy sessions created before override-source tracking existed. (#63155) Thanks @frankekn.
+- Slack/ACP: treat Slack ACP block replies as visible delivered output so OpenClaw stops re-sending the final fallback text after Slack already rendered the reply. (#62858) Thanks @gumadeiras.
+- Slack/partial streaming: key turn-local dedupe by dispatch kind and keep the final fallback reply path active when preview finalization fails so stale preview text cannot suppress the actual final answer. (#62859) Thanks @gumadeiras.
+- Matrix/doctor: migrate legacy `channels.matrix.dm.policy: "trusted"` configs back to compatible DM policies during `openclaw doctor --fix`, preserving explicit `allowFrom` boundaries as `allowlist` and defaulting empty legacy configs to `pairing`. (#62942) Thanks @lukeboyett.
+- npm packaging: mirror bundled channel runtime deps, stage Nostr runtime deps, derive required root mirrors from manifests and built chunks, and test packed release tarballs without repo `node_modules` so fresh installs fail fast on missing plugin deps instead of crashing at runtime. (#63065) Thanks @scoootscooob.
+- QA/live auth: fail fast when live QA scenarios hit classified auth or runtime failure replies, including raw scenario wait paths, and sanitize missing-key guidance so gateway auth problems surface as actionable errors instead of timeouts. (#63333) Thanks @shakkernerd.
+- Providers/OpenAI: default missing reasoning effort to `high` on OpenAI Responses, WebSocket, and compatible completions transports, while still honoring explicit per-run reasoning levels.
+- Providers/Ollama: allow Ollama models using the native `api: "ollama"` path to optionally display thinking output when `/think` is set to a non-off level. (#62712) Thanks @hoyyeva.
+- Codex CLI: pass OpenClaw's system prompt through Codex's `model_instructions_file` config override so fresh Codex CLI sessions receive the same prompt guidance as Claude CLI sessions.
+- Auth/profiles: persist explicit auth-profile upserts directly and skip external CLI sync for local writes so profile changes are saved without stale external credential state.
+- Agents/timeouts: make the LLM idle timeout inherit `agents.defaults.timeoutSeconds` when configured, disable the unconfigured idle watchdog for cron runs, and improve idle-timeout recovery guidance. Thanks @drvoss.
+- Agents/failover: classify Z.ai vendor code `1311` as billing and `1113` as auth, including long wrapped `1311` payloads, so these errors stop falling through to generic failover handling. (#49552) Thanks @1bcMax.
+- QQBot/media-tags: support HTML entity-encoded angle brackets (`&lt;`/`&gt;`), URL slashes in attributes, and self-closing media tags so upstream `<qqimg>` payloads are correctly parsed and normalized. (#60493) Thanks @ylc0919.
+- Memory/dreaming: harden grounded backfill inputs, diary writes, status payloads, and diary action classification by preserving source-day labels, rejecting missing or symlinked targets cleanly, normalizing diary headings in gateway backfills, and tightening claim splitting plus diary source metadata. Thanks @mbelinky.
+- Memory/dreaming: accept embedded heartbeat trigger tokens so light and REM dreaming still run when runtime wrappers include extra heartbeat text.
+- Android/manual connect: allow blank port input only for TLS manual gateway endpoints so standard HTTPS Tailscale hosts default to `443` without silently changing cleartext manual connects. (#63134) Thanks @Tyler-RNG.
+- Windows/update: add heap headroom to Windows `pnpm build` steps during dev updates so update preflight builds stop failing on low default Node memory.
+- Plugin SDK: export the channel plugin base and web-search config contract through the public package so plugins can use them without private imports.
+- Plugins/contracts: keep test-only helpers out of production contract barrels, load shared contract harnesses through bundled test surfaces, and harden guardrails so indirect re-exports and canonical `*.test.ts` files stay blocked. (#63311) Thanks @altaywtf.
+- Control UI/models: preserve provider-qualified refs for OpenRouter catalog models whose ids already contain slashes so picker selections submit allowlist-compatible model refs instead of dropping the `openrouter/` prefix. (#63416) Thanks @sallyom.
+- Plugin SDK/command auth: split command status builders onto the lightweight `openclaw/plugin-sdk/command-status` subpath while preserving deprecated `command-auth` compatibility exports, so auth-only plugin imports no longer pull status/context warmup into CLI onboarding paths. (#63174) Thanks @hxy91819.
+- Wizard/plugin config: coerce integer-typed plugin config fields from interactive text input so integer schema values persist as numbers instead of failing validation. (#63346) Thanks @jalehman.
+- npm packaging: derive required root runtime mirrors from bundled plugin manifests and built root chunks, then install packed release tarballs without the repo `node_modules` so release checks catch missing plugin deps before publish (#63222). Thanks @fuller-stack-dev.
+
diff --git a/CHANGELOG/2026.5.12.md b/CHANGELOG/2026.5.12.md
new file mode 100644
index 0000000000000000000000000000000000000000..4ad343c22380d4e7e1e1fad98684442c9ee75852
--- /dev/null
+++ b/CHANGELOG/2026.5.12.md
@@ -0,0 +1,824 @@
+## 2026.5.12
+
+### Changes
+
+- Amazon Bedrock: externalize the Bedrock and Bedrock Mantle provider packages so core installs no longer pull AWS SDK dependencies unless those providers are installed.
+- Plugins: externalize Slack, OpenShell sandbox, and Anthropic Vertex so their runtime dependency cones install only when those plugins are installed.
+- Control UI/WebChat: add a persisted auto-scroll mode selector so users can keep the current near-bottom behavior, always follow streaming output, or turn automatic streaming scroll off and use the New messages button manually. Fixes #7648 and #81287. Thanks @BunsDev.
+- ACP: add `acp.fallbacks` so ACP turns can try configured backup runtime backends when the primary backend is unavailable before any output is emitted. (#69542) Thanks @kaseonedge.
+- Gateway/OpenAI HTTP: honor `max_completion_tokens` and `max_tokens` on inbound `/v1/chat/completions` requests so client-provided token caps reach the upstream provider via `streamParams.maxTokens`, with `max_completion_tokens` taking precedence when both are sent. Thanks @Lellansin.
+- Models/OpenAI CLI auth: make `openclaw models auth login --provider openai` start the ChatGPT/Codex account login by default, while `--method api-key` remains the explicit OpenAI API-key setup path.
+- Google/Gemini: normalize retired Gemini 3 Pro Preview ids inside explicit SDK OAuth auth-result config patches, so provider helpers emit `google/gemini-3.1-pro-preview` for Gemini 3.1 testing.
+- Google/Gemini: normalize retired Gemini 3 Pro Preview ids inside SDK OAuth auth-result default config patches, so helper-built provider auth flows emit `google/gemini-3.1-pro-preview` for Gemini 3.1 testing.
+- Google/Gemini: normalize retired Gemini 3 Pro Preview ids returned by direct `openclaw models auth login --set-default` provider auth flows before writing config, so Gemini testing targets `google/gemini-3.1-pro-preview`.
+- Google/Gemini: normalize retired Gemini 3 Pro Preview ids in per-agent config defaults and auth patches, so agent-specific emitted config keeps targeting `google/gemini-3.1-pro-preview`.
+- Google/Gemini: normalize retired Gemini 3 Pro Preview ids in provider catalog rows when API-key onboarding only reapplies the agent default, so emitted config keeps testing `google/gemini-3.1-pro-preview`.
+- Google/Gemini: normalize retired Gemini 3 Pro Preview ids in `config set` mutation output for agent overrides and provider catalog rows, so current config emits `google/gemini-3.1-pro-preview`.
+- Google/Gemini: canonicalize provider-qualified retired Gemini 3 Pro Preview refs during Google forward-compatible model resolution, so emitted config uses `google/gemini-3.1-pro-preview` for Gemini 3.1 testing.
+- Google/Gemini: normalize proxy-prefixed retired Gemini 3 Pro Preview catalog rows, so emitted configs use `google/gemini-3.1-pro-preview` for Gemini 3.1 testing.
+- Google/Gemini: normalize retired Gemini 3 Pro Preview ids inside per-agent model overrides before writing config, so agent-specific config emits `google/gemini-3.1-pro-preview` for Gemini 3.1 testing.
+- Google/Gemini: normalize retired Gemini 3 Pro Preview ids in subagent, heartbeat, compaction, and subagent-tool model config during writes, so current config keeps emitting `google/gemini-3.1-pro-preview`.
+- Docs/subagents: document `agents.defaults.subagents.announceTimeoutMs` in the sub-agent and configuration references. (#75509) Thanks @akrimm702.
+- Cron: add direct `cron.get`, `openclaw cron get <id>`, and agent-tool `get` support for inspecting one stored cron job by id. (#75117) Thanks @samzong.
+- Agents/tools: add per-sender tool policies with canonical channel-scoped sender keys, so operators can restrict dangerous tools by requester identity across global, agent, group, core, bundled, and plugin tool surfaces. (#66933) Thanks @JerranC.
+- ACP: expose Gateway session lineage metadata through ACP session listings and session info snapshots so clients can render subagent graphs without private Gateway side channels. (#73458) Thanks @samzong.
+- Channels/iMessage: add `openclaw channels status --channel <name>` filtering and document the BlueBubbles-to-imsg cutover path so operators can probe iMessage without starting both channel monitors. (#80706) Thanks @omarshahine.
+- CI: add a non-blocking `plugin-inspector-advisory` artifact to Plugin Prerelease so release runs capture bundled plugin compatibility triage without changing the blocking gate.
+- Runtime/Fly: detect Fly Machines as container environments from their runtime env vars, so gateway bind and Bonjour defaults match remote container launches. (#80209) Thanks @liorb-mountapps.
+- Providers/fal: route GPT Image 2 and Nano Banana 2 reference-image edit requests to `/edit` with `image_urls` array, enforce NB2 edit geometry using `aspect_ratio` and `resolution` params, lift Fal edit mode input-image caps to 10 for GPT Image 2 and 14 for Nano Banana 2, and allow aspect-ratio hints in edit mode. (#77295) Thanks @leoge007.
+- Control UI: show a plain HTML recovery panel when the app module never registers, giving blank dashboard pages a retry path and browser-extension troubleshooting link. Fixes #44107. Thanks @BunsDev.
+- Docs: rename the broad tools nav to Capabilities, keep automation and agent coordination as sections, and keep the tools overview focused on tools, skills, and plugins. https://docs.openclaw.ai/tools
+- Build: enable additional low-churn oxlint rules for promise, TypeScript, and runtime footgun checks.
+- Build: enable stricter Vitest lint rules for focused, disabled, conditional, hook, matcher, and expectation hazards.
+- Build: pin explicit oxfmt defaults in the shared formatter config to keep formatting behavior stable across upgrades.
+- TypeScript: enable stricter compiler checks for implicit returns, side-effect imports, overrides, and unused production code.
+- Logging: add targeted model transport, payload, SSE, and code-mode diagnostics with redacted URL handling.
+- Agents/code mode: add opt-in generic QuickJS-WASI code mode that exposes `exec`/`wait` while hiding enabled tools behind a catalog bridge.
+- Agents: allow `session.agentToAgent.maxPingPongTurns` up to 20 while keeping the default at 5 for longer agent-to-agent reply chains. Fixes #52382. (#52400) Thanks @thirumaleshp.
+- Agents: add per-agent `tools.message.crossContext` overrides so sandboxed/public agents can restrict message sends to the current conversation without changing the global bot policy.
+- Agents: add per-agent `tools.message.actions.allow` overrides so sandboxed/public agents can expose and enforce send-only message tools.
+- Agents: omit the sandbox workspace marker from compact command progress previews while keeping internal sandbox diagnostics unchanged.
+- Agents: widen progress draft command preview lines by 50% so Discord inline tool updates preserve more useful command context.
+- Codex app-server: retire timed-out app-server clients after bounded turn interrupts so Discord agents do not reuse a CPU-spinning Codex process after an attempt timeout.
+- Codex app-server: default migrated native plugin destructive-action policy to enabled while preserving explicit global and per-plugin false overrides.
+- Build: upgrade workspace package management to pnpm 11 and keep Docker, install, update, and release workflows on the pnpm 11 config surface. (#79414) Thanks @altaywtf.
+- Build: align Telegram QA workflows and git source installs with the pnpm 11 workspace build allowlist surface. (#80588) Thanks @altaywtf.
+- Models: add provider-level `localService` startup for on-demand local model servers before OpenAI-compatible requests, including one-shot model probes.
+- Agents: trim default system prompt guidance and send-only message tool schemas to reduce prompt tokens while preserving GPT-5 personality guidance.
+- Context: add `/context map` to send a treemap image of the current session context contributors. (#79867)
+- Slack: add `unfurlLinks` and `unfurlMedia` config for bot `chat.postMessage` replies, including per-account overrides, so Slack link and media previews can be suppressed without workspace-wide settings. Fixes #48435. (#80145) Thanks @esegev1 and @HemantSudarshan.
+- Slack: add explicit `replyBroadcast` support for text and Block Kit thread replies so agents can opt into Slack's parent-channel `reply_broadcast` behavior. (#64365) Thanks @tony88331.
+- Slack: preserve mention target/source metadata in inbound prompt context so agents can distinguish direct bot mentions from implicit thread wakes that mention someone else. Fixes #79025. (#75356) Thanks @tmimmanuel.
+- Slack: canonicalize outbound delivery-mirror routes for native DM channel IDs to the peer user session so `message.send` calls to `D...` targets do not split the same Slack DM thread into a channel session. Fixes #80091. (#80111) Thanks @bek91.
+- Plugin SDK: deprecate public subpaths that existed for at least one month and have no bundled extension production imports, keep legacy barrel/test/zod subpath package exports for backwards compatibility, and track both sets in the SDK surface report.
+- Plugin SDK: deprecate public subpaths currently used by only one or two bundled plugin owners, keeping them importable while steering new plugin code to focused shared SDK seams or plugin-owned APIs.
+- Plugin SDK: remove the owner-specific `provider-auth-login` public subpath after moving Chutes, GitHub Copilot, and OpenAI Codex auth flows back to provider-owned modules.
+- Plugin SDK: remove provider-specific model, stream, and xAI compatibility helpers from public exports after moving bundled callers to provider-owned modules.
+- Plugin SDK: expose runtime-supplied active model metadata to native plugin tool factories for diagnostics and plugin-owned policy decisions. Fixes #77857. Thanks @jamiezigelbaum.
+- QA/Mantis: add Telegram live PR evidence automation with Convex-leased credentials, Crabbox transcript capture, motion GIF previews, and inline PR comments.
+- QA/Mantis: add a Telegram desktop scenario builder that leases Crabbox, installs native Telegram Desktop, configures an OpenClaw Telegram gateway with leased bot credentials, and records VNC screenshot/video artifacts.
+- Discord/voice: add realtime voice diagnostics for speaker turns, playback resets, barge-in detection, and audio cutoff analysis.
+- Talk: add `talk.realtime.instructions` so operators can append realtime voice style instructions while preserving OpenClaw's built-in agent-consult guidance. (#79081) Thanks @VACInc.
+- Discord/voice: default test and source installs to the pure-JS `opusscript` decoder by ignoring optional native `@discordjs/opus` builds, avoiding slow native addon compiles outside dedicated voice-performance lanes.
+- Discord/voice: add an opt-in native `@discordjs/opus` install script and decoder preference for live voice-performance lanes without charging unrelated Docker/tests for native addon builds.
+- Discord/voice: add `voice.allowedChannels` to restrict voice joins and bot voice-state moves to configured channels while preserving open voice behavior when unset.
+- Gateway/skills: add an opt-in private skill archive upload install path gated by `skills.install.allowUploadedArchives`, so trusted Gateway clients can stage and install zip-backed skills only when operators explicitly enable the code-install surface. (#74430) Thanks @samzong.
+- Codex app-server: enable Codex native code-mode-only for harness threads so deferred OpenClaw dynamic tools run through Codex's own searchable code execution surface instead of a PI-style wrapper.
+- Dependencies: refresh workspace pins and patch targets, including ACPX `@agentclientprotocol/claude-agent-acp` `0.33.1`, Codex ACP `0.14.0`, Baileys `7.0.0-rc10`, Google GenAI `2.0.1`, OpenAI `6.37.0`, AWS SDK `3.1045.0`, Kysely `0.29.0`, Tlon skill `0.3.6`, Aimock `1.19.5`, and tsdown `0.22.0`.
+- Dependencies: refresh workspace pins for Anthropic SDK, Smithy shared ini loading, Playwright, YAML, Aimock, TypeScript native preview, Vitest, Oxlint/Oxfmt, Vite, and pnpm 11.1.0.
+- Dependencies: hard-pin non-peer direct dependency specs across bundled packages and add a changed-check guard so runtime installs resolve the exact versions tested by maintainers.
+- Dependencies: move embedded Pi packages to the `@earendil-works` namespace, refresh Twitch Twurple packages, and move `@openclaw/fs-safe` from the GitHub release pin to the published npm package.
+- Build: route Testbox changed-check delegation through Crabbox and remove the OpenClaw-specific Blacksmith Testbox helper scripts.
+- Agents/compaction: preserve scoped background exec/process session references across embedded compaction and after-turn runtime contexts without exposing sessions from unrelated scopes. Fixes #79284. (#79307) Thanks @TurboTheTurtle.
+- Agents/process: tell agents to inspect background sessions with `process log` before sending interactive input and to use `waitingForInput`/`stdinWritable` hints from `log`/`poll`.
+- CLI/onboarding: improve setup, onboarding, configure, and channel command wayfinding so terminal flows explain the next useful command instead of relying on terse setup labels.
+- Agents/Codex: remove the configurable Codex dynamic-tools profile so Codex app-server always owns workspace, edit, patch, exec, process, and plan tools while OpenClaw integration tools remain available.
+- macOS app: update the Peekaboo bridge dependency to Peekaboo 3.0.0.
+- Dependencies: refresh workspace pins and move the WhatsApp plugin from `@whiskeysockets/baileys` to `baileys` while keeping the `7.0.0-rc10` runtime.
+- Plugin SDK: add bundled-plugin session actions, `sendSessionAttachment`, and Cron-backed `scheduleSessionTurn`/tag cleanup under the grouped session namespace. Replaces #75578/#75581/#75588 and part of #73384/#74483. Thanks @100yenadmin.
+- Plugin SDK/media-understanding: add `extractStructuredWithModel(...)` plus the optional provider-side `extractStructured(...)` seam so trusted plugins can run bounded image-first structured extraction with optional supplemental text context through provider-owned runtimes such as Codex.
+- Exec approvals: add `tools.exec.commandHighlighting` so parser-derived command highlighting in approval prompts can be enabled globally or per agent. (#79348) Thanks @jesse-merhi.
+- Codex app-server: mirror native Codex subagent spawn lifecycle events into Task Registry so app-server child agents appear in task/status surfaces without relying on transcript text. (#79512) Thanks @mbelinky.
+- Skills: add `skills.load.allowSymlinkTargets` so intentional symlinked skill folders can resolve into trusted sibling repos without disabling root containment.
+- Agents/tools: add core Tool Search so agents can search and call large OpenClaw, MCP, and client tool catalogs through one compact PI bridge.
+- Doctor: warn when a per-agent model config omits the `fallbacks` key and `agents.defaults.model.fallbacks` is non-empty. Covers both string-form (`"model": "..."`) and partial-object form (`"model": { "primary": "..." }`) — both silently clobber the defaults chain at runtime. Use `"fallbacks": []` to explicitly opt out of fallbacks, or add `"fallbacks": [...]` to inherit or override. Fixes #79369.
+- Chat commands: add `/think default` and `/fast default` to clear session overrides and inherit configured/provider defaults. (#79385) Thanks @VACInc.
+- Dependencies: refresh workspace dependency pins and lockfile, including `@openai/codex` `0.130.0`, `acpx` `0.7.0`, AWS SDK `3.1044.0`, OpenTelemetry `0.217.0`, `typebox` `1.1.38`, `vite` `8.0.11`, `oxfmt` `0.48.0`, and `oxlint` `1.63.0`, and update the Codex harness model snapshot for the new bundled app-server catalog.
+- Plugins/install: add guarded plugin install overrides so onboarding and repair tests can route specific plugins to registry specs or local `npm pack` artifacts via environment variables.
+- Tests/Docker: add Codex on-demand install and live plugin-tool dependency E2E lanes for packaged onboarding and npm-pack plugin proof.
+- Plugins/ACPX: accept an optional `args` array in `agents.<name>` config so paths and flag values containing spaces stay intact when spawning ACP agent processes. Thanks @TheArchitectit and @BunsDev.
+- Agents: inject the current provider/model identity into system prompts, including configured prompt overrides and CLI hook prompt replacements, so agents can answer model-identity questions from the actual runtime selection.
+- Agents/subagents: add prompt-only `agents.defaults.subagents.delegationMode` and per-agent overrides with `suggest`/`prefer` modes, and centralize config-backed system prompt resolution across embedded, CLI, compaction, and command-export prompt surfaces.
+- Agents/subagents: add stronger delegation orchestration guidance, `sessions_yield` wait guidance, stable `taskName` aliases, and active-child runtime prompt context for spawned sub-agent work.
+- Plugins/CLI: add the optional bundled `oc-path` plugin, providing `openclaw path` for surgical `oc://` access to markdown, JSONC, and JSONL workspace files.
+- Plugins/SDK: add unified model catalog registration for text, image, video, and music providers, including `providerCatalogEntry` manifests, shared media list help, live catalog caching, and per-model video capability overlays.
+- Plugin SDK: add presentation helpers for controls-only interactive rendering and opt-in empty fallback text so rich channel renderers can share `MessagePresentation` semantics without duplicating native cards or components.
+- CLI: make parser, startup, config, guardrail, channel, agent, task, session, and MCP failures explain what happened and point to the next recovery command.
+- GitHub Copilot: refresh the model catalog from `${baseUrl}/models` so per-account entitlement and accurate context windows surface at runtime; static manifest catalog (now including `gpt-5.5`) remains the fallback when discovery is disabled or the API is unreachable.
+- Active Memory: support concrete `plugins.entries.active-memory.config.toolsAllow` recall tool names for custom memory plugins while keeping the built-in memory-core default on `memory_search`/`memory_get` and preserving `memory_recall` automatically for `plugins.slots.memory: "memory-lancedb"`.
+- Active Memory: report normal `NONE` recall decisions as `status=no_relevant_memory`, keep unavailable and failed recall paths distinct, and avoid caching no-summary recall results so ordinary no-context turns no longer look like broken `status=empty` memory. Fixes #79812. (#80015) Thanks @TurboTheTurtle.
+- Telegram: share the grammY API throttler across polling and ad hoc send clients for the same bot token, so visible draft previews and CLI sends use one quota gate. Thanks @anagnorisis2peripeteia.
+- Feishu: resolve group policy/tool context from the trusted chat target for group turns while keeping the speaker in `From`, so @mention replies do not drop the configured group id. Fixes #79457. Thanks @greyxiong.
+- Telegram/Feishu: honor configured per-agent and global `reasoningDefault` values when deciding whether channel reasoning previews should stream or stay hidden, addressing the preview-default part of #73182. Thanks @anagnorisis2peripeteia.
+- QQBot: mark recognized framework slash commands as text-command turns before reply dispatch so `/models`, `/status`, and `/new` responses stay visible in QQ Bot C2C conversations. Fixes #79310. Thanks @rollingshmily.
+- Docker: run the runtime image under `tini` so long-lived containers reap orphaned child processes and forward signals correctly. (#77885) Thanks @VintageAyu.
+- Logging/redaction: redact quoted HTTP client secret fields and auth/cookie headers in shared log and formatted error output. Related #71211 and #65623. (#75033) Thanks @liaoandi.
+- Gateway/SDK: document and stabilize the task ledger RPC surface for `tasks.list`, `tasks.get`, and `tasks.cancel`, including generated Swift model typing for optional task summaries. Thanks @BunsDev.
+- Google/Gemini: normalize retired `google/gemini-3-pro-preview` and `google-gemini-cli/gemini-3-pro-preview` selections to `google/gemini-3.1-pro-preview` before they are written to model config.
+- Google/Gemini: emit canonical `google/gemini-3.1-pro-preview` ids from configured provider catalog rows so model list and selection paths can test Gemini 3.1 instead of retired Gemini 3 Pro.
+- Google/Gemini: normalize nested proxy-provider catalog ids like `google/gemini-3-pro-preview` to `google/gemini-3.1-pro-preview`, so Kilo-style configured catalogs test Gemini 3.1 instead of the retired Gemini 3 Pro id.
+- Google/Gemini: canonicalize provider-onboarding model alias maps so setup flows preserve settings under `google/gemini-3.1-pro-preview` instead of re-emitting retired Gemini 3 Pro config keys.
+- Google/Gemini: canonicalize retired Gemini 3 Pro Preview ids inside Google dynamic model resolution so runtime clones also use `google/gemini-3.1-pro-preview`.
+- Google/Gemini: canonicalize provider-auth default model results before setup hooks and picker returns so auth flows do not re-emit retired `google/gemini-3-pro-preview` selections.
+- Amazon Bedrock: support `serviceTier` parameter for Bedrock models, configurable via `agents.defaults.params.serviceTier` or per-model in `agents.defaults.models`. Valid values: `default`, `flex`, `priority`, `reserved`. (#64512) Thanks @mobilinkd.
+- Control UI: read the Quick Settings exec policy badge from `tools.exec.security` instead of the non-schema `agents.defaults.exec.security` path, so configured `full`/`deny` values render accurately. Fixes #78311. Thanks @FriedBack.
+- Control UI/usage: add transcript-backed historical lineage rollups for rotated logical sessions, with current-instance vs historical-lineage scope controls and long-range presets so usage history stays visible after restarts and updates. Fixes #50701. Thanks @dev-gideon-llc and @BunsDev.
+- Agents/failover: harden state-aware lane suspension by persisting quota resume transitions, restoring configured lane concurrency, preserving non-quota failure reasons, and exporting model failover events through diagnostics OTLP. Thanks @BunsDev.
+- Control UI/Windows: add the SPA-side WebView2 bridge for native hosts so draft text can update the chat composer and the ready handshake is wired through the app lifecycle. (#69633) Thanks @AlexAlves87.
+- Channels/streaming: make progress draft labels scroll away with other progress lines, render structured tool rows as compact emoji/title/details, show web-search queries from provider-native argument shapes, and skip empty Discord apply-patch starts until a patch summary exists. (#79146)
+- Runtime/performance: avoid full-array sorting while auto-selecting providers, resolving supported thinking levels, picking node last-seen timestamps, and extracting Codex usage-limit messages. Thanks @shakkernerd.
+- Plugins/doctor: avoid full-array sorting while selecting ClawHub search/archive results and bounded dreaming doctor entries. Thanks @shakkernerd.
+- Agents/compaction: keep contributor diagnostics to a bounded top-three selection without sorting the full history. Thanks @shakkernerd.
+- Sessions/UI: avoid full-array sorting while selecting ACPX leases, Google Meet calendar events, and latest chat sessions. Thanks @shakkernerd.
+- Plugin SDK: mark direct `deliverOutboundPayloads` and legacy reply-dispatch bridges as deprecated compatibility substrate, enrich `sendDurableMessageBatch` with explicit durable send outcomes, migrate bundled send/turn paths off deprecated APIs, and enforce the split with `check:deprecated-api-usage`.
+- OpenAI/Talk: add browser realtime Talk controls, Google Meet `test_speech` support for `mode: "bidi"`, and the `gpt-realtime-2` default. Correction: the announced `openai-codex` OAuth fallback does not have a supported public realtime transport; Talk, Gateway relay/Voice Call, and realtime transcription require OpenAI Platform credentials. Thanks @Solvely-Colin.
+- Telegram: preserve the channel-specific 10-option poll cap in the unified outbound adapter so over-limit polls are rejected before send. (#78762) Thanks @obviyus.
+- Telegram/streaming: continue over-limit draft previews in a new message instead of stopping when rendered preview text crosses Telegram's message limit. (#74508) Thanks @anagnorisis2peripeteia.
+- Slack: route handled top-level channel turns in implicit-conversation channels to thread-scoped sessions when Slack reply threading is enabled, keeping the root turn and later thread replies on one OpenClaw session. (#78522) Thanks @zeroth-blip.
+- Telegram: re-probe the primary fetch transport after repeated sticky fallback success so transient IPv4 or pinned-IP fallback promotion can recover without a gateway restart. Fixes #77088. (#77157) Thanks @MkDev11.
+- Agents/harness: skip tool-result middleware validation when no handler is registered, and sanitize incoming tool result `details` (functions, symbols, bigints, cycles, oversized payloads) before middleware sees them. Tool emitters legitimately produce raw dependency payloads on `details`, and the harness owes any registered middleware a JSON-safe view of that payload; otherwise a no-op middleware (e.g. bundled `tokenjuice` on the `pi` runtime) causes the validator to reject every tool result and silently substitute a failure sentinel, dropping outbound Discord messages, exec output, cron results, and any other tool whose payload carries non-serializable values. Thanks @solomonneas.
+- Runtime/install: raise the supported Node 22 floor to `22.16+` so native SQLite query handling can rely on the `node:sqlite` statement metadata API while continuing to recommend Node 24. (#78921)
+- Discord/voice: make duplicate same-guild auto-join entries resolve to the last configured channel so moving an agent between voice channels does not keep joining the stale channel.
+- Discord/voice: add realtime `/vc` modes so Discord voice channels can run as STT/TTS, a realtime talk buffer with the OpenClaw agent brain, or a bidi realtime session with `openclaw_agent_consult`.
+- Discord/voice: add bounded realtime gateway logs for voice channel joins, realtime model/voice selection, transcripts, consult routing/answers, and playback start, allow OpenAI realtime Discord sessions to disable input-triggered response interruption for echo-heavy rooms while keeping explicit Discord barge-in available for new and already-active speakers, and allow voice turns to target an existing Discord channel agent session.
+- Discord/voice: add `voice.realtime.minBargeInAudioEndMs` and let the realtime provider own playback clearing, so speaker echo no longer cuts OpenAI realtime model audio at `audioEndMs=0` while low-echo rooms can opt back into immediate barge-in with `0`.
+- Discord/voice: make `agent-proxy` the default voice mode so realtime voice acts as the microphone/speaker extension of the routed OpenClaw agent session, with `stt-tts` remaining available as an explicit fallback.
+- Discord/voice: route default `agent-proxy` realtime turns through the OpenClaw consult handoff with owner-level tool access and a forced-consult transcript fallback, matching the Codex-style voice front end while keeping the routed agent authoritative.
+- Discord/voice: keep OpenAI realtime bidi consults quiet while the supervisor agent is still working, accept Codex-style `conversation.item.done` function-call events, and preserve continuing tool results through the gateway relay so the OpenAI realtime bridge reliably routes consults before speaking the final answer.
+- Discord/voice: include a bounded one-line STT transcript preview in verbose voice logs so live voice debugging shows what speakers said before the agent reply.
+- Codex app-server: pin the managed Codex harness and Codex CLI smoke package to `@openai/codex@0.129.0`, defer OpenClaw integration dynamic tools behind Codex tool search by default, and accept current Codex service-tier values so legacy `fast` settings survive the stable harness upgrade as `priority`.
+- Codex app-server: annotate message-tool-only direct chat turns in the dynamic `message` tool spec so visible replies are sent through `message(action="send")` instead of staying private. (#79704)
+- Agents/PI: route explicit OpenAI Codex Responses runs through PI's native WebSocket-capable transport and remove OpenClaw's custom OpenAI Responses WebSocket stack while preserving auth injection, run abort signals, and prompt cache boundary stripping.
+- Models/config: allow `compat.thinkingFormat` values `qwen` and `qwen-chat-template` for configured OpenAI-compatible Qwen models, preserving them through catalog normalization and mapping `/think` levels to `enable_thinking` or `chat_template_kwargs.enable_thinking`. Fixes #79677. (#79777) Thanks @indulgeback.
+- Codex app-server: default implicit local stdio app-server permissions to guardian when Codex system requirements disallow the YOLO approval, reviewer, or sandbox value, including hostname-scoped remote sandbox entries, avoiding turn-start failures on managed hosts that permit only reviewed approval or narrower sandboxes.
+- Plugins/install: run managed npm-root install, uninstall, prune, and repair commands from the managed root without a redundant `--prefix .`, avoiding npm 10.9.3 Arborist crashes on native Windows WhatsApp plugin installs. Fixes #78514. (#78902) Thanks @melihselamett-stack.
+- Config/schema/Windows: detect direct execution of the base config schema generator with `pathToFileURL` so Windows paths with backslashes still run the `--check` and `--write` command body. (#52989) Thanks @easyteacher.
+- Discord/voice: stream ElevenLabs TTS directly into Discord playback and send ElevenLabs latency optimization as the documented query parameter so spoken replies can start sooner.
+- Discord/voice: keep TTS playback running when another user starts speaking, ignore new capture during playback to avoid feedback loops, and downgrade expected receive-stream aborts to verbose diagnostics.
+- iMessage: expose native private-API message actions through `imsg rpc` for reactions, edits, unsends, replies, rich sends, attachments, and group management when `imsg status --json` reports the required bridge capabilities.
+- Gateway/tasks: reconcile stale CLI run-context tasks whose live run context disappeared even when a child session row remains, and apply the default bounded reload deferral timeout to channel hot reloads so stale task records cannot block Discord/Slack/Telegram reloads forever.
+- Gateway/heartbeat: keep stripped `HEARTBEAT_OK` acknowledgements out of pending final-delivery replay and let recent ack-only pending state proceed to the next heartbeat run instead of creating a self-refreshing requests-in-flight loop. Fixes #79258. Thanks @haumanto.
+- Gateway/sessions: keep session-store index writes atomic while skipping durable fsync inside the writer lock, reducing cron and channel-turn starvation on slow filesystems and addressing the session-store strand of #73655. Thanks @mmartoccia.
+- Discord/voice: make `openclaw channels capabilities --channel discord --target channel:<id>` and `channels status --probe` audit voice-channel permissions, including auto-join targets, so missing Connect/Speak/Read Message History permissions show up before `/vc join`.
+- Gateway/restart: expose `skipDeferral` on the `gateway.restart.request` RPC and add `openclaw gateway restart --safe --skip-deferral` so operators can bypass the safe-restart deferral gate when a pinned task run prevents the OpenClaw-aware restart from draining. Surfaces the existing internal `scheduleGatewaySigusr1Restart({ skipDeferral })` semantics added in #71637 to a public surface, complementing `gateway.reload.deferralTimeoutMs`. Refs #76162. Thanks @solomonneas.
+- Discord/streaming: default Discord replies to progress draft previews so tool/work activity appears in one edited Discord message unless `channels.discord.streaming.mode` is set to `off`.
+- OpenAI/realtime: default realtime voice to `gpt-realtime-2`, use the GA Realtime WebSocket session shape for backend OpenAI bridges, and cover backend, WebRTC, Google Live, and Gateway relay paths in the live Talk smoke. (#79130)
+- Update/Windows: spawn the post-core-update child process with `stdio:"pipe"` on Windows so PowerShell/CMD console handles are not inherited, preventing the terminal from hanging after `openclaw update` completes. Fixes #78445. (#78483) Thanks @Beandon13.
+- Plugins/install: add `npm-pack:<path.tgz>` installs so local npm pack artifacts run through the same managed npm-root install, lockfile verification, dependency scan, and install-record path as registry npm plugins.
+- Channels/plugins: show configured official external channels as missing-plugin status rows and send errors with exact install/doctor repair commands after raw package-manager upgrades leave Feishu or WhatsApp uninstalled. Fixes #78702 and #78593. Thanks @MarkMa84 and @mkupiainen.
+- Matrix: move the Matrix channel back to an official external ClawHub/npm plugin so core installs no longer need Matrix SDK runtime dependencies.
+- Matrix: attach `com.openclaw.presentation` metadata to semantic presentation replies so OpenClaw-aware Matrix clients can render rich buttons, selects, context rows, and dividers while stock clients keep the plain text fallback. (#73312) Thanks @kakahu2015.
+- Codex app-server: disarm the short post-tool completion watchdog after current-turn activity, expose `appServer.turnCompletionIdleTimeoutMs`, and include raw assistant item context in idle-timeout diagnostics so status-only post-tool stalls stop failing as idle. Fixes #77984. Thanks @roseware-dev and @rubencu.
+- Codex app-server: release the session lane after a completed assistant message item goes quiet without `turn/completed`, and stop global rate-limit notifications from keeping stuck turns alive.
+- Plugin skills/Windows: publish plugin-provided skill directories as junctions on Windows so standard users without Developer Mode can register plugin skills without symlink EPERM failures. Fixes #77958. (#77971) Thanks @hclsys and @jarro.
+- Process tool: show input-wait hints from `log` and `poll` for idle interactive background sessions so operators can inspect stuck CLIs and resume them with existing input actions. Fixes #33957. Thanks @bitloi and @vincentkoc.
+- Shell env/Windows: hide the login-shell environment probe child window so gateway startup and shell-env refreshes do not flash a console on Windows. Fixes #78159. (#78266) Thanks @BradGroux.
+- MS Teams: surface blocked Bot Framework egress by logging JWKS fetch network failures and adding a Bot Connector send hint for transport-level reply failures. Fixes #77674. (#78081) Thanks @Beandon13.
+- Windows/restart: skip duplicate scheduled-task `/Run` calls when the gateway task is already running, using a locale-stable PowerShell task-state probe before retrying. Fixes #52044. (#52487) Thanks @andyk-ms.
+- Media/host-read: allow buffer-verified ZIP archives in the host-local media validator so agents can send ZIP attachments via the message tool. Fixes #78057. (#78292) Thanks @Linux2010.
+- Gateway/sessions: fast-path already-qualified model refs while building session-list rows so `openclaw sessions` and Control UI session lists avoid heavyweight model resolution on large stores. (#77902) Thanks @ragesaq.
+- Contributor PRs: remind external contributors to redact private information like IP addresses, API keys, phone numbers, and non-public endpoints from real behavior proof. Thanks @pashpashpash.
+- ACP bridge: relay Gateway exec approval prompts from active ACP turns to the ACP client's `session/request_permission` handler before resolving the Gateway approval. Thanks @amknight.
+- Codex/plugins: enable migrated source-installed `openai-curated` Codex plugins in the same Codex harness thread with explicit `codexPlugins` config, cached app readiness, and fail-closed destructive-action policy. Thanks @kevinslin.
+- Codex/plugins: enforce native plugin destructive-action policy with Codex app-level `destructive_enabled` config instead of OpenClaw-maintained per-tool deny lists, leave plugin app `open_world_enabled` on by default, and invalidate existing plugin app thread bindings so old generated app config is rebuilt. Thanks @kevinslin.
+- QQBot/Skills: translate QQBot skill descriptions surfaced in the Skills UI so English-language users no longer see Chinese metadata. Fixes #77810. Thanks @eabase.
+- Image generation: include enabled generation providers such as fal in provider discovery even when another image provider is already active. Fixes #78141. Thanks @leoge007.
+- Slack: keep Socket Mode's native reconnect enabled so transient ping/pong misses can recover without forcing a full provider rebuild. Fixes #77933. Thanks @bmoran1022 and @brokemac79.
+- Cron: preserve cron timeout results when an isolated agent turn's `cron-nested` lane watchdog fires, preventing internal command-lane or model-fallback timeout text from being persisted. Fixes #77703. (#78168) Thanks @brokemac79 and @transxtech.
+- PR triage: mark external pull requests with `proof: supplied` when Barnacle finds structured real behavior proof, keep stale negative proof labels in sync across CRLF-edited PR bodies, and let ClawSweeper own the stronger `proof: sufficient` judgement.
+- ACPX/Codex: preserve trusted Codex project declarations when launching isolated Codex ACP sessions, avoiding interactive trust prompts in headless runs. Thanks @Stedyclaw.
+- ACPX/Codex: reap stale OpenClaw-owned ACPX/Codex ACP process trees on startup and after ACP session close, preventing orphaned harness processes from slowing the Gateway. Thanks @91wan.
+- ACP bridge: implement stable session list, resume, and close handlers so ACP clients can page Gateway sessions, rebind existing sessions without replay, and close bridge sessions cleanly. Thanks @amknight.
+- ACP bridge: replay complete ledger-backed ACP sessions on load, including user prompts, tool updates, session metadata, and usage snapshots, while keeping older sessions on the existing transcript fallback. Thanks @amknight.
+- ACP sessions: allow parent agents to inspect and message their own spawned cross-agent ACP sessions without enabling broad agent-to-agent visibility. Thanks @barronlroth.
+- Talk/voice: unify realtime relay, transcription relay, managed-room handoff, Voice Call, Google Meet, VoiceClaw, and native clients around a shared Talk session controller and add the Gateway-managed `talk.session.*` RPC surface.
+- Diagnostics/Talk: export bounded Talk lifecycle/audio metrics and session recovery metrics through OpenTelemetry and Prometheus without exposing transcripts, audio payloads, room ids, turn ids, or session ids.
+- Logging/Talk: route shared Talk lifecycle events into bounded file and OTLP log records while keeping transcript text, audio payloads, turn ids, call ids, and provider item ids out of logs.
+- Voice Call/realtime: add opt-in OpenClaw agent voice context capsules and consult-cadence guidance so Gemini/OpenAI realtime calls can sound like the configured agent without consulting the full agent on every ordinary turn. Thanks @scoootscooob.
+- Telegram/streaming: keep draft preview rotation from reusing a pre-tool assistant preview after visible tool or media output lands between compaction replay and the next assistant message. Thanks @vincentkoc.
+- Telegram/performance: skip non-forum topic-cache setup, defer status reaction variant work until reactions are needed, and reuse ack reaction gating during message context assembly. Thanks @vincentkoc.
+- Telegram/performance: reduce command-menu CPU and allocation work when many native, plugin, and custom commands are registered. (#79717) Thanks @drsolveit.
+- CLI/migrate: add bulk on/off and skip controls to interactive Codex skill migration, leaving conflicting skill copies unchecked by default. (#77597) Thanks @kevinslin.
+- CLI/migrate: show native Codex plugin names before truncated plan items and prompt for plugin activation explicitly during interactive Codex migration instead of silently keeping every planned plugin. Thanks @kevinslin.
+- CLI/migrate: leave already configured target Codex plugins unchecked in the interactive plugin selector and show a `plugin exists` conflict hint while keeping new plugin activations selected by default. Thanks @kevinslin.
+- CLI/migrate: return cleanly without apply confirmation when interactive Codex migration leaves both skill copies and native plugin activations unselected. Thanks @kevinslin.
+- Gateway/sessions: extend the per-call sessions-list `rowContext` cache with memoization for `resolveSessionDisplayModelIdentityRef`, thinking metadata, and `resolveModelCostConfig` so deterministic per-row resolvers run once per unique `(provider, model[, agentId])` tuple instead of once per session. Cuts CPU on `sessions.list` for stores with many sessions sharing a small set of model tuples; behavior is unchanged for callers that pass no `rowContext`. Thanks @rolandrscheel.
+- Cron CLI: add `openclaw cron list --agent <id>`, normalize the requested agent id, and include jobs without a stored agent id under the configured default agent while keeping `cron list` unfiltered when no agent is supplied. Fixes #77118. Thanks @zhanggttry.
+- Slack/performance: reduce message preparation, stream recipient lookup, and thread-context allocation overhead on Slack reply hot paths. Thanks @vincentkoc.
+- Control UI/chat: strip untrusted sender metadata from live streams and transcript display, preserve canvas preview anchors, and stop operator UI clients from injecting their internal client id as sender identity. Fixes #78739. Thanks @tmimmanuel, @guguangxin-eng, @hclsys, and @BunsDev.
+- Control UI/chat: collapse consecutive duplicate text messages into one bubble with a count so repeated text-only messages stay compact without hiding nearby context.
+- Control UI/chat and Sessions: label inherited thinking defaults separately from explicit overrides while preserving provider-supplied option labels. Fixes #77581. Thanks @BunsDev and @Beandon13.
+- Agents/runtime: add prepared runtime foundation contracts for carrying provider, model, tool, TTS, and outbound runtime facts through later reply-path migrations. Thanks @mcaxtr.
+- Control UI/WhatsApp: keep Show QR available for unlinked WhatsApp accounts while switching linked accounts to the explicit Relink action and showing Wait for scan only when a QR is active. Thanks @BunsDev.
+- Gateway/performance: reuse the compatible plugin metadata snapshot across dashboard and channel agent turns so auto-enabled runtime config does not repeatedly rescan plugin metadata before provider calls. Thanks @shakkernerd.
+- Gateway/performance: reuse current plugin metadata for provider activation, auth/env candidate lookup, and bundle settings during dashboard and channel agent turns while keeping the configless secret-target cache unscoped and refusing stale unscoped reuse when plugin discovery roots differ. Thanks @shakkernerd.
+- Gateway/performance: avoid resolving plugin auto-enable metadata twice in one runtime config pass, reducing repeated dashboard turn metadata scans. Thanks @shakkernerd.
+- Control UI/performance: pre-scope config tab schemas before rendering, load Channels with cached/runtime status before manual probes, preserve channel rows through failed status summaries, and keep stale slow probes from replacing newer snapshots. Thanks @BunsDev.
+- Auth/providers: pass `config` and `workspaceDir` lookup context through to provider-id resolution so workspace-scoped auth aliases resolve correctly when no explicit alias map is supplied. Thanks @shakkernerd.
+- Gateway/diagnostics: add startup phase spans, active work labels, stale terminal bridge markers, and opt-in sync-I/O tracing in `pnpm gateway:watch` so slow Gateway turns are easier to attribute from logs and stability diagnostics.
+- QA/Mantis: add an opt-in Discord thread attachment before/after scenario that creates a real thread, calls `message.thread-reply` with `filePath`, and captures baseline/candidate screenshot evidence.
+- Discord: preserve `filePath` and `path` attachments when replying to a thread with the message tool.
+- QA/Mantis: add visual desktop tasks with Crabbox MP4 recording, screenshot capture, and optional image-understanding assertions, and preserve video artifacts in Mantis before/after reports.
+- QA/WhatsApp: add `pnpm openclaw qa whatsapp` for live DM canary and pairing-gate coverage using two pre-linked WhatsApp Web sessions from the QA credential pool.
+- CI/Crabbox: default owned AWS fallback to `standard` multi-region capacity with broker hints enabled, reserving `beast` for explicit CPU-bound maintainer lanes.
+- Plugins/install: run managed npm-root install, rollback, repair, and uninstall mutations with legacy peer resolution so removing one plugin cannot rehydrate a stale registry `openclaw` package into the shared root. Thanks @vincentkoc.
+- Plugin SDK: add `openclaw/plugin-sdk/channel-message` lifecycle helpers for `defineChannelMessageAdapter`, `deliverInboundReplyWithMessageSendContext`, send/receive/live/state contracts, durable final-delivery capability derivation, capability proof helpers, and normalized message receipts.
+- Plugin SDK: add `createChannelMessageAdapterFromOutbound` so channel plugins can derive durable message adapters from proven outbound adapters without duplicating send/receipt bridge code.
+- Plugin SDK: add `actions.prepareSendPayload(...)` so channel plugins can shape message-tool sends into durable payloads while core owns queueing, hooks, retry, recovery, and acknowledgements.
+- Plugin SDK: make the legacy `channel-reply-pipeline` subpath a compatibility wrapper over the shared reply core while steering root compat deprecations toward `plugin-sdk/channel-message`.
+- Plugin SDK: move Discord, Slack, Mattermost, and Matrix live-preview finalization onto `plugin-sdk/channel-message` and attach message receipts to Telegram finalized previews plus Teams native stream finals, so preview edits and stream finals are represented in the message lifecycle instead of draft-only helpers.
+- Telegram: persist the polling restart watermark after successful update dispatch instead of at handler entry, leaving failed updates retryable while still coalescing completed offsets safely.
+- Plugin SDK/fs-safe: expose reusable atomic replacement, sibling-temp writes, and cross-device move fallback helpers through `plugin-sdk/security-runtime`, and move OpenClaw's duplicated safe filesystem write paths onto the shared `@openclaw/fs-safe` package.
+- Plugin SDK/fs-safe: route browser, media, channel, and QA external output producers through staged fs-safe writes before final publication. (#78768)
+- Plugin SDK/fs-safe: rename the public temp workspace helpers to `tempWorkspace`, `withTempWorkspace`, `tempWorkspaceSync`, and `withTempWorkspaceSync`, matching the cleaner `@openclaw/fs-safe` API before the package is published.
+- Core/performance: trim reply payload routing, heartbeat filtering, tool display, core tool assembly, channel directory, task status, and Slack approval formatting helper chains with direct bounded scans. Thanks @vincentkoc.
+- Control UI/performance: keep chat, config, and channel refreshes responsive by decoupling slow history/schema/status work, reducing the client history window, and logging over-budget chat/config renders. Refs #77060, #45698, #47979, #44107. Thanks @BunsDev.
+- QA/Mantis: reuse Crabbox desktop/browser capture tooling and pnpm store caches during Slack desktop smoke runs, reducing per-scenario setup work before screenshots and videos are captured.
+- QA/Mantis: add Slack desktop hydrate modes and per-phase timing reports so warm prehydrated VNC leases can skip source install/build while cold runs still prove the full source checkout.
+- QA/Mantis: pass the runtime env through desktop-browser Crabbox and artifact-copy child commands, so embedded Mantis callers can provide Crabbox credentials without mutating the parent process. Thanks @vincentkoc.
+- QA/Mantis: return the copied Slack desktop screenshot path even when remote Slack QA fails, so the CLI still prints the failure screenshot artifact. Thanks @vincentkoc.
+- QA/Mantis: accept Blacksmith Testbox `tbx_...` lease ids from desktop smoke warmup, so provider overrides do not fail before inspect/run. Thanks @vincentkoc.
+- Plugins/SDK: add bounded `before_agent_finalize` retry instructions so workflow plugins can request one more model pass. Thanks @100yenadmin.
+- Plugin SDK: add plugin-owned `SessionEntry` slot projection and scoped trusted-policy session extension reads. (#75609; replaces part of #73384/#74483) Thanks @100yenadmin.
+- Plugin SDK/Gateway: add scoped `plugins.sessionAction` dispatch and plugin-attributed `emitAgentEvent` support so plugins can expose typed session actions and workflow events to trusted clients. (#75578; replaces part of #73384/#74483) Thanks @100yenadmin.
+- Plugins/SDK: expose host-derived tool target paths to `before_tool_call` and trusted policy hooks so workflow plugins can reason about known file targets without reparsing tool envelopes. (#75605) Thanks @100yenadmin.
+- Control UI/WebChat: show a persistent compact context usage indicator from fresh session token data before the high-pressure warning state, while keeping the existing compaction prompt threshold. Fixes #46398; refs #45048, #50071, and #73744. Thanks @walterwkchoy, @AxelrodAI, @Brissux, @vincentkoc, and @BunsDev.
+- Contributor PRs: require external pull requests to include after-fix real behavior proof from a real OpenClaw setup, with terminal screenshots, console output, redacted runtime logs, linked artifacts, and copied live output treated as valid evidence while unit tests, mocks, lint, typechecks, snapshots, and CI remain supplemental only.
+- Plugins/catalog: add an `@tencent-weixin/openclaw-weixin` external entry pinned to `2.4.1` so onboarding and `openclaw channels add` can install the Tencent Weixin (personal WeChat) channel by default. (#77269) Thanks @pumpkinxing1.
+- Developer tooling: add checked-in VS Code Gateway debugging configs and an opt-in `OUTPUT_SOURCE_MAPS=1` source-map build path for breakpoints in TypeScript source. (#45710) Thanks @SwissArmyBud.
+- Managed proxy: add `proxy.loopbackMode` for Gateway loopback control-plane traffic, allowing operators to keep the default Gateway loopback bypass, force loopback Gateway traffic through the proxy, or block it. (#77018) Thanks @jesse-merhi.
+- Telegram/native commands: show the current thinking level above the `/think` level picker so users can see the active setting before changing it. (#78278) Thanks @obviyus.
+- Plugins/hooks: add a `before_agent_run` pass/block gate that can stop a user prompt before model submission while preserving a redacted transcript entry for the user, and clarify that raw conversation hooks require `hooks.allowConversationAccess=true`. (#75035) Thanks @jesse-merhi.
+- Config/Nix: keep startup-derived plugin enablement, gateway auth tokens, control UI origins, and owner-display secrets runtime-only instead of rewriting `openclaw.json`; in Nix mode, config writers, mutating `openclaw update`, plugin lifecycle mutators, and doctor repair/token-generation now refuse with agent-first nix-openclaw guidance. (#78047) Thanks @joshp123.
+- Plugin SDK: add a generic `api.runtime.llm.complete` host completion helper with runtime-derived caller attribution, config-gated model/agent overrides, session-bound context-engine access, request-scoped config, audit metadata, and normalized usage attribution. (#64294) Thanks @DaevMithran.
+- Control UI/exec approvals: highlight parsed shell command fragments that may deserve extra review in approval prompts. (#77153) Thanks @jesse-merhi.
+- Channels/iMessage: honor `channels.imessage.groups.<chat_id>.systemPrompt` (and the `groups["*"]` wildcard) by forwarding it as `GroupSystemPrompt` on inbound group turns, mirroring the byte-identical resolver semantic from WhatsApp where defining the key as an empty string on a specific group suppresses the wildcard fallback. Brings iMessage to parity with the per-group `systemPrompt` pattern already supported by Discord, Telegram, IRC, Slack, GoogleChat, and the retired BlueBubbles channel. Fixes #78285. (#79383) Thanks @omarshahine.
+- iMessage: add opt-in inbound catchup that replays messages received while the gateway was offline (crash, restart, mac sleep) on next startup. Enable with `channels.imessage.catchup.enabled: true`; tunables for `maxAgeMinutes`, `perRunLimit`, `firstRunLookbackMinutes`, and `maxFailureRetries`. Persists a per-account cursor under the OpenClaw state dir (`<openclawStateDir>/imessage/catchup/`), replays each row through the live dispatch path so allowlists/group policy/dedupe behave identically on replayed and live messages, and force-advances past wedged guids after `maxFailureRetries` to prevent stuck cursors. Extends the persisted echo-cache retention window so the agent's own outbound rows from before a gap are not re-fed as inbound on replay. Includes a regenerated `src/config/bundled-channel-config-metadata.generated.ts` so the runtime AJV schema accepts the new `channels.imessage.catchup` block. Fixes #78649. (#79387) Thanks @omarshahine.
+- Channels/Yuanbao: bump the bundled `openclaw-plugin-yuanbao` npm spec from `2.11.0` to `2.13.0` in the official external channel catalog and refresh the pinned integrity hash, so fresh installs and catalog-driven reinstalls pick up the newer Yuanbao channel plugin release. (#79620) Thanks @loongfay.
+- Gateway/OpenAI-compatible Chat Completions: support function `tools`, `tool_choice`, `tool_calls`, and `role: "tool"` follow-up turns while keeping tool-call stream finalization aligned with the command result and reporting client-tool name conflicts as invalid requests. (#66278) Thanks @Lellansin.
+- Providers/Mistral: add `mistral-medium-3-5` to the bundled catalog with reasoning support. Thanks @sliekens.
+- Docs/Mistral: document Medium 3.5 setup, local infer smoke usage, adjustable reasoning, and the Mistral HTTP 400 caveat for `reasoning_effort="high"` with `temperature: 0`.
+
+### Breaking
+
+- Channels/iMessage: remove the bundled BlueBubbles channel surface and deprecate BlueBubbles-backed iMessage setup in OpenClaw. Existing `channels.bluebubbles` configs must migrate to `channels.imessage` using `imsg` on a signed-in Mac or an SSH wrapper, and non-macOS default `imsg` configs now report remote-Mac wrapper guidance.
+- Proxy: replace OpenClaw managed HTTP/WebSocket/fetch interception internals with Proxyline while preserving Gateway loopback routing policy. (#79857) Thanks @jesse-merhi.
+
+### Fixes
+
+- Agents: honor `OPENCLAW_WORKSPACE_DIR` when resolving the default agent workspace, preserving explicit config precedence while keeping env-backed deployments out of the system prompt fallback path. Fixes #66786.
+- Doctor/Codex: stop warning that the message tool is unavailable for source-reply paths where OpenClaw grants `message` at runtime, keeping update and doctor output aligned with the OpenAI happy path. Thanks @pashpashpash.
+- Channels/Weixin: bump the external Weixin catalog entry to `@tencent-weixin/openclaw-weixin@2.4.3` with the matching package integrity. (#81730) Thanks @scotthuang.
+- Agents/subagents: apply `agents.defaults.subagents.model` before target agent primary models during `sessions_spawn`, so model-scoped runtimes such as `claude-cli` stay attached to default child runs. Fixes #81395. (#81783) Thanks @joshavant.
+- Telegram: keep Bot API polling alive during main event-loop stalls by moving ingress to an isolated worker with a durable local spool. Fixes #81132. (#81746) Thanks @joshavant.
+- Telegram: preserve rendered HTML formatting through lazy cron announce delivery so Markdown links stay clickable instead of falling back to literal anchor tags. Fixes #81742. (#81758)
+- Telegram: skip unmentioned group media before download when `requireMention` is active, avoiding failed media-download replies for messages that should be ignored. Fixes #81181. (#81785) Thanks @joshavant.
+- CLI/plugins: keep bare plugin and parent-command help on the lightweight path, avoiding plugin registry discovery before rendering help.
+- Gateway/session history: carry monotonic transcript message sequence through live updates and refresh SSE history when stale sequence input would otherwise append bad incremental state. (#81474) Thanks @samzong.
+- Security/sandbox: include Windows `USERPROFILE` in the sandbox blocked home roots so credential-bearing binds (such as `.codex`, `.openclaw`, or `.ssh` under the Windows user profile) are denied even when `HOME` points at a different shell home. (#63074) Thanks @luoyanglang.
+- Models config/auth: stop inferring provider env-var markers from broad `^[A-Z_][A-Z0-9_]*$` strings, and resolve config-backed provider `apiKey` values only through structured env SecretRefs (`secrets.providers[id]` / `secrets.defaults`), so unrelated env vars cannot accidentally become provider credentials. Thanks @sallyom.
+- Media fetch: skip allocating and buffering the response body for bodyless media responses (HEAD probes and 204-style empty bodies), avoiding wasted heap on streams that carry no payload. Thanks @shakkernerd.
+- CLI/onboarding: forward provider-specific auth flags (e.g. `--openai-api-key`) through the onboarding wizard so they reach provider auth methods via `ctx.opts`, letting `--openai-api-key "$OPENAI_API_KEY"` skip the redundant "use existing env var?" prompt in non-interactive harnesses. (#81669) Thanks @sjf.
+- CLI/migrate: drop trailing periods from Codex migrate item messages and `REASON_CODE_MESSAGES` strings so plan/result rows read as labels instead of sentence fragments. (#81705) Thanks @sjf.
+- Slack: treat malformed private-file redirect `Location` headers as unfollowable redirects instead of failing Slack media downloads.
+- Plugins: discover provider plugins from `setup.providers[].envVars` credentials during provider discovery while keeping the deprecated `providerAuthEnvVars` fallback. (#81542) Thanks @JARVIS-Glasses.
+- Docs/Codex harness: clarify that per-agent `CODEX_HOME` isolates `~/.codex` while inherited `HOME` intentionally keeps `.agents` discovery and subprocess user-home state available.
+- Auth: reclaim dead-owner stale file locks before retrying locked writes, so crashed OAuth refreshes no longer wedge `auth-profiles.json` until manual cleanup.
+- CLI tables: preserve muted/color styling on wrapped continuation lines after multiline cells, keeping `openclaw plugins list` descriptions readable.
+- Process execution: collapse case-insensitive duplicate child environment keys on Windows so caller-provided overrides such as `PATH` cannot be shadowed by host `Path`.
+- Gateway/diagnostics: suppress cold-start liveness warnings during the startup grace window while still sampling liveness metrics. Fixes #79915. (#81699) Thanks @joshavant.
+- Codex harness: keep `oauthRef`-backed Codex OAuth profiles usable and stop high-confidence app-server OAuth refresh invalidation from retry-spamming raw token-refresh errors without turning entitlement or usage-limit payloads into re-auth prompts.
+- Browser CLI: request the existing `operator.admin` gateway scope explicitly for browser control commands, avoiding unnecessary scope-upgrade approval loops. Fixes #81555. (#81716) Thanks @joshavant.
+- Plugin SDK: restore the deprecated `openclaw/plugin-sdk/memory-core` package subpath as an alias of `memory-host-core`, so published memory companion plugins that still import it resolve on current hosts.
+- Control UI/i18n: use the installed workspace pi runtime for locale refreshes, update the fallback package pin, prefer the Anthropic CI provider when available, and skip invalid provider credentials instead of failing main.
+- Codex harness: classify native app-server token-refresh logout and relogin failures as authentication refresh errors, so users get re-authentication guidance instead of a raw runtime failure.
+- Codex startup: treat selectable configured OpenAI agent models as Codex runtime requirements during plugin auto-enable, startup planning, and doctor install repair, so Anthropic-primary configs can still switch to OpenAI/Codex cleanly.
+- Agents: preserve source-reply delivery metadata when merging tool-returned media into the final reply, keeping message-tool-only replies deliverable and mirrored. Thanks @pashpashpash and @vincentkoc.
+- Replies: treat rich presentation, interactive controls, and channel-native payload data as outbound content across follow-up, heartbeat, cron, ACP, and block-streaming delivery paths, preventing card/button-only replies from being dropped as empty.
+- WebChat/TUI: route Codex `tools.message` source replies to the active internal UI turn and mirror them to session history, so message-tool-only harness replies, including rich presentation and button-only replies, no longer disappear while WebChat and TUI remain non-targetable outbound channels. (#81586) Thanks @pashpashpash.
+- Replies: deliver rich-only block replies even when block-streaming coalescing is enabled, keeping card and button payloads from being dropped by the text coalescer. Thanks @pashpashpash.
+- macOS/companion: require system TLS trust before pinning a first-use direct `wss://` gateway certificate and honor `gateway.remote.tlsFingerprint` as the explicit pin for remote node-mode sessions, so fresh endpoints fail closed when macOS cannot trust the certificate unless configured out of band. Fixes #50642. Thanks @BunsDev.
+- Update: snapshot config before update-time repair and restart writes, preserve plugin install records through doctor cleanup, and keep update-time config size drops from blocking the update while pointing users to the pre-update backup. Fixes #80077. (#80257) Thanks @Jerry-Xin and @vincentkoc.
+- Sessions/status: classify ACP spawn-child sessions as `kind: "spawn-child"` instead of `"direct"` in `openclaw sessions` and status output; extract the duplicated session-kind classifier into a shared helper (`src/sessions/classify-session-kind.ts`) so both surfaces stay in sync. Fixes catalog #19. (#79544)
+- Sessions/Gateway: report `agentRuntime.id: "acpx"` (or stored backend id) with `source: "session-key"` for ACP control-plane session rows in `openclaw sessions --json`, `openclaw status`, and Gateway session RPC responses instead of the incorrect `"auto"` / `"pi"` implicit fallback. Fixes catalog #18. (#79550)
+- Telegram: delete tool-progress-only draft bubbles before rotating to the real answer, preventing orphaned progress messages in streamed replies.
+- Codex app-server: keep per-agent `CODEX_HOME` isolation without rewriting `HOME` by default, so Codex-run subprocesses can still find normal user-home config, tokens, and CLI state unless the launch explicitly overrides `HOME`. Thanks @pashpashpash.
+- iMessage: stop sending visible `<media:image>` placeholder text for media-only native image sends while preserving the internal echo key that prevents self-echo duplicate replies. (#81209) Thanks @homer-byte.
+- Agents/sessions: create configured agent main sessions before first `sessions_send` or gateway send, so agent-to-agent messages no longer fail when the target agent has not started yet.
+- Google models: honor configured `reasoning: false` when resolving thinking policy, preventing non-thinking Google/Gemma models from advertising `thinking=medium`. Fixes #81424.
+- gateway: pass Talk session scope to resolver [AI]. (#81379) Thanks @pgondhi987.
+- Gateway protocol: require v4 clients and stream explicit chat `deltaText`/`replace` frames so SDK clients can consume assistant updates without local diffing. (#80725) Thanks @samzong.
+- GitHub Copilot: exchange OAuth tokens for Copilot API tokens on image understanding requests and route Gemini image payloads through Chat Completions, fixing Copilot Gemini image descriptions. (#80393, #80442) Thanks @afunnyhy.
+- Gateway: hide pending Node pairing commands, capabilities, and permissions until approval, and refresh the live approved surface when pairings change. (#80741) Thanks @samzong.
+- Plugins/Feishu/WhatsApp/Line: enforce inbound media size caps while reading download streams, avoiding full buffering of oversized attachments. (#81044, #81050) Thanks @samzong.
+- Plugins/install: limit install-time code safety scans to plugin-owned runtime entrypoints while keeping dependency manifest denylist checks, so trusted packages with large dependency trees no longer get blocked or warned on third-party runtime internals.
+- Config: serialize and retry semantic config mutations centrally, so concurrent commands can rebase safe changes instead of clobbering or hand-rolling command-local retry loops. (#76601)
+- Installer: honor `--no-git-update` for existing git checkouts before resolving release refs, preventing pinned source installs from moving during reinstall.
+- Plugins/install: refresh OpenClaw-managed peer dependency pins when installed plugin peer ranges change, while preserving user-owned dependency pins.
+- Require approval for setup-code device pairing [AI]. (#81292) Thanks @pgondhi987.
+- Plugins/install: preserve third-party peer dependencies in the managed npm root when later plugin installs or updates recalculate the shared dependency tree. Thanks @shakkernerd.
+- Plugins/memory: prefer the npm-installed memory-lancedb plugin over the bundled fallback during duplicate resolution, keeping Active Memory's `memory_recall` tool visible after managed installs. Fixes #81193. Thanks @julio-arcila.
+- Plugins/uninstall: prune managed third-party peer dependencies after their owning npm plugin is removed, without blocking plugin cleanup on peer-prune failures.
+- Docker: pin setup-time container paths so stale host `.env` OpenClaw paths cannot leak into Linux containers. Fixes #80381. (#81105) Thanks @brokemac79.
+- Channels/WeCom: refresh the official onboarding install to `@wecom/wecom-openclaw-plugin@2026.5.7` and update existing managed npm installs instead of failing on the package directory. Fixes #79884. (#80390) Thanks @brokemac79.
+- Anthropic: reseed Claude CLI fresh-session retries from bounded OpenClaw transcript history after session rotation, preventing conversation amnesia. Fixes #80905. (#80934) Thanks @bitloi.
+- Require explicit browser device pairing [AI]. (#81289) Thanks @pgondhi987.
+- Require Control UI pairing before proxy-scoped access [AI]. (#81288) Thanks @pgondhi987.
+- Installer: honor `--version` for git installs and install from the checked-in lockfile, preventing recent dependency pins from tripping pnpm's minimum-release-age gate during tag installs.
+- Agents: deliver same-process subagent completion handoffs through the in-process agent dispatcher instead of opening a Gateway RPC loopback.
+- Harden trusted-proxy source validation [AI]. (#81290) Thanks @pgondhi987.
+- Agents: add permissive item schemas to array tool parameters before provider submission, preventing OpenAI-compatible schema validation from rejecting plugin tools that omit `items`. Fixes #81175. (#81217) Thanks @JARVIS-Glasses.
+- Agents: escalate LLM idle watchdog timeouts through profile rotation and configured model fallback instead of leaving agent turns stuck after a silent model stream. Fixes #76877. (#80449) Thanks @jimdawdy-hub.
+- Discord voice: treat OpenAI Realtime startup auth failures as fatal, suppress duplicate realtime error logs, and stop autoJoin from retrying the same broken voice channel until credentials are fixed.
+- ACPX: stop forwarding unsupported timeout config options to Claude ACP while preserving OpenClaw's own turn timeout. (#80812) Thanks @sxxtony.
+- Session transcripts: redact sensitive message content in the centralized JSONL append path so CLI turns, gateway transcript injection, transcript mirrors, and guarded tool results use the same configured redaction behavior. Fixes #73565. Refs #73563. (#79645) Thanks @Ziy1-Tan.
+- Channels/iMessage: ignore Apple link-preview plugin payload attachments when users paste URLs, keeping the URL text while avoiding phantom media context. (#79374) Thanks @homer-byte.
+- Telegram: detect polling stalls from `getUpdates` liveness only, so outbound API calls no longer mask dead inbound polling; log polling-cycle starts after transport rebuilds. Fixes #78473.
+- fix: scan plugin runtime entries during install [AI]. (#80998) Thanks @pgondhi987.
+- fix(plugins): scan installed dependency runtime code [AI]. (#81066) Thanks @pgondhi987.
+- Inherit tool restrictions for delegated sessions [AI]. (#80979) Thanks @pgondhi987.
+- Telegram: discard legacy long-poll update offsets that cannot be tied to the current bot token, so token rotation no longer leaves bots silently skipping new messages. (#80671) Thanks @sxxtony.
+- browser: enforce navigation checks for act interactions [AI]. (#81070) Thanks @pgondhi987.
+- Validate node exec event provenance [AI]. (#81071) Thanks @pgondhi987.
+- Gateway: keep active reply runs visible to stuck-session diagnostics and clear no-active-work recovery state, preventing stale queued lanes after compaction or tool failures. Fixes #80677. (#81302)
+- Codex app-server: rotate incompatible context-engine-managed native threads so Lossless-managed sessions do not resume stale hidden Codex history. (#81223) Thanks @jalehman.
+- Codex cron: execute scheduled command-style automation payloads before workspace bootstrap or memory review, preserving existing isolated cron jobs after Codex harness migration. (#81510) Thanks @jalehman.
+- Plugin LLM completions: honor Codex agent-runtime policy for canonical OpenAI model refs, so context-engine summarizers can use Codex OAuth instead of requiring direct `OPENAI_API_KEY` auth. (#81511) Thanks @jalehman.
+- Gateway/OpenAI HTTP: return OpenAI-compatible 400 errors for invalid sampling params and provider validation failures instead of collapsing them to 500s. (#81275) Thanks @Lellansin.
+- Telegram: publish plugin and skill command description localizations to native command menus while filtering unsupported locale codes and preserving Telegram command limits. (#81351) Thanks @jzakirov.
+- Limit hook CLI tool authority [AI]. (#81065) Thanks @pgondhi987.
+- Require admin scope for node device token management [AI]. (#81067) Thanks @pgondhi987.
+- Restrict chat sender allowlist matching [AI]. (#80898) Thanks @pgondhi987.
+- Update: suppress the false newer-config warning during restart health probing after an update handoff, while keeping future-version mutation guards intact. (#78652)
+- Bundled MCP: inline local `$ref` parameter schemas before exposing tools, so Notion-style `oneOf` inputs validate through the bridge. Fixes #78737.
+- Sessions: redact persisted tool result detail metadata before writing transcripts so diagnostic secrets do not survive tool output redaction. (#80444) Thanks @nimbleenigma.
+- Codex runtime: allow the official installed `@openclaw/codex` package to use its private task-runtime and MCP projection SDK helpers, fixing `MODULE_NOT_FOUND` during migrated OpenAI/Codex beta runs.
+- Codex migration: make Enter activate the highlighted checkbox row before continuing, so `Skip for now` and bulk-selection rows work even when planned items start preselected.
+- Codex harness: keep auth-profile-backed media tools such as `image_generate` available when OpenAI auth lives in the agent's auth-profile store instead of environment variables.
+- WhatsApp/install: allow Baileys' pinned libsignal git subdependency under pnpm 11 so source installs and local checks can complete.
+- Require auth for sandbox browser CDP relay [AI]. (#81002) Thanks @pgondhi987.
+- fix: detect carried exec command forms [AI]. (#81000) Thanks @pgondhi987.
+- Reject truncated exec approval commands [AI]. (#81001) Thanks @pgondhi987.
+- Enforce inline shell wrapper payload matching [AI]. (#80978) Thanks @pgondhi987.
+- fix(node-pairing): replace changed pending requests [AI]. (#80894) Thanks @pgondhi987.
+- Rate limit Google Chat webhook requests [AI]. (#80974) Thanks @pgondhi987.
+- Docker: mount the auth-profile secret key directory so OAuth-backed auth profiles survive container rebuilds. (#80991)
+- Onboarding: accept Codex auth profiles for canonical OpenAI model checks, avoiding false missing-auth warnings. (#80913) Thanks @rubencu.
+- fix(feishu): normalize webhook rate-limit client keys [AI]. (#80975) Thanks @pgondhi987.
+- fix(auth): prevent bootstrap pairing scope changes [AI]. (#80976) Thanks @pgondhi987.
+- Validate Control UI loopback retry endpoints [AI]. (#80900) Thanks @pgondhi987.
+- Harden exported markdown link rendering [AI]. (#80902) Thanks @pgondhi987.
+- fix(gateway): honor minimal discovery mode for wide-area DNS-SD [AI]. (#80903) Thanks @pgondhi987.
+- slack: enforce reaction notification policy [AI]. (#80907) Thanks @pgondhi987.
+- Enforce gateway command scopes by caller context [AI]. (#80891) Thanks @pgondhi987.
+- Telegram/groups: in single-account setups, treat an explicit empty `accounts.<id>.groups: {}` map the same as undefined so the root `channels.telegram.groups` allowlist still applies, instead of silently dropping every group update under the default `groupPolicy: "allowlist"`. Multi-account semantics are unchanged so per-account explicit-empty groups still scope-disable a single account without affecting siblings; the explicit way to block all groups for any account remains `groupPolicy: "disabled"`. Fixes #79427. (#81030) Thanks @kinjitakabe.
+- Codex (app-server): project user-configured `mcp.servers` into new Codex thread configs, matching the codex-cli runtime's existing `-c mcp_servers=...` behavior so app-server-runtime agents see the same user MCP servers the CLI runtime already exposes. Plugin-curated apps remain attached via the separate `apps` config patch. Fixes #80814. Thanks @kinjitakabe.
+- Enforce Slack plugin approval button authorization [AI]. (#80899) Thanks @pgondhi987.
+- Recognize PowerShell -ec inline commands [AI]. (#80893) Thanks @pgondhi987.
+- fix(qqbot): authorize approval button callbacks [AI]. (#80892) Thanks @pgondhi987.
+- Telegram: render supported HTML tags in streamed and durable replies instead of showing literal markup. (#80977)
+- Scrub streamable MCP redirect headers [AI]. (#80906) Thanks @pgondhi987.
+- fix(memory-wiki): require admin scope for ingest [AI]. (#80897) Thanks @pgondhi987.
+- memory-wiki: require write scope for Obsidian search [AI]. (#80904) Thanks @pgondhi987.
+- WhatsApp: externalize the channel as a ClawHub/npm plugin outside the core npm runtime bundle, and bump Baileys to `7.0.0-rc11` so libsignal resolves from the registry instead of a GitHub tarball.
+- WhatsApp: keep optional audio decoding dependencies local to the external plugin so the core npm install no longer pulls WhatsApp-only media helpers.
+- Build: skip copied metadata for bundled plugins that are excluded from build entries, preventing update/status rebuilds from advertising missing QQ Bot runtime files. (#80925)
+- Control UI/sessions: nest subagent sessions under their parent session in the session picker dropdown using a visual `└─ ` prefix, making the parent-child relationship clear. Fixes #77628. (#78623) Thanks @chinar-amrutkar.
+- Auto-reply: surface a visible error when the configured model backend fails and fallback produces no visible reply, while preserving intentional silent turns and side-effect-only deliveries. (#80917) Thanks @dutifulbob.
+- Agents/exec: skip redundant heartbeat wake-ups for subagent session exec completions, preventing spurious LLM invocations on parent sessions. Fixes #66748. (#66749) Thanks @ggzeng.
+- Provider streams: keep OpenAI-compatible SSE and JSON fallback streams draining across split chunks and fail Azure Responses streams with a bounded first-event diagnostic instead of stalling. Refs #80926. (#80927) Thanks @galiniliev and @CaptainTimon.
+- Agents: rewrite generic provider internal errors with support request IDs into user-friendly transient error copy. (#49401) Thanks @y471823206.
+- WhatsApp: finish handling pending debounced inbound messages before closing the socket. (#81246) Thanks @mcaxtr.
+- CLI/commitments: write `--json` output to stdout instead of diagnostic logs so automation can parse commitment list and dismiss results. (#81215) Thanks @giodl73-repo.
+- Update: allow pnpm GitHub-source OpenClaw updates to approve the OpenClaw package build, so source installs complete their prepare/prepack lifecycle. (#81294) Thanks @fuller-stack-dev.
+- Telegram: preserve supported HTML tags in visible replies and durable mirrors so formatted messages render correctly instead of degrading to escaped text. (#80977) Thanks @obviyus.
+- Plugins/runtime: attribute deprecated runtime config load/write warnings to the plugin id and source that triggered them so logs and plugin doctor runs are actionable. Refs #81394. (#81425) Thanks @BKF-Gitty.
+- Agents/cron: honor a cron payload's explicit `timeoutSeconds` for the LLM idle watchdog even when it numerically equals `agents.defaults.timeoutSeconds`, preserving explicit per-run timeout intent and preventing stalled streaming replies from being cut to the implicit 120s cap. (#79426) Thanks @legolaz8451.
+- Codex app-server: keep the short post-tool completion watchdog armed across dynamic tool completion bookkeeping so embedded Codex runs fail fast and release their session lane when Codex goes quiet after a tool result. (#81697) Thanks @mbelinky.
+- Control UI/WebChat: wrap long inline code tokens inside chat bubbles instead of clipping them at the bubble edge. Fixes #81932. (#81931) Thanks @galiniliev.
+- CLI/media: render terminal QR codes with full-block characters by default so the bundled `qrcode` terminal renderer does not emit a pathologically dense ANSI final row in compact half-block mode that breaks scanning in some terminals. Fixes #77820. Thanks @KrasimirKralev.
+- Agents/compaction: read post-compaction AGENTS.md refresh context from the queued run workspace instead of the runner process cwd, so CLI-backed follow-up turns re-inject the correct workspace startup rules after compaction. Fixes #70541. (#75532) Thanks @vyctorbrzezowski.
+- Agents/read tool: treat positive offsets beyond EOF as empty ranges instead of surfacing the upstream read error, so stale pagination cursors no longer crash tool calls while unrelated read failures still fail loud. Fixes #62466. (#75536) Thanks @vyctorbrzezowski.
+- Google/Gemini: normalize retired Gemini 3 Pro Preview refs left in Google API-key onboarding model allowlists and fallbacks, so setup-emitted config keeps testing `google/gemini-3.1-pro-preview` instead of `google/gemini-3-pro-preview`.
+- Telegram/context: bound selected topic context to the active session so messages from before `/new` or `/reset` are not replayed into later turns. (#80848) Thanks @VACInc.
+- Docs/providers/openai: clarify that OpenAI Realtime voice goes through the OpenAI Platform Realtime API and requires Platform credits — Codex/ChatGPT subscription quota does not cover this route. Fixes #76498. Thanks @lonexreb.
+- Google/Gemini: normalize retired nested Gemini 3 Pro Preview ids when resolving exact configured proxy-provider refs, so `kilocode/google/gemini-3-pro-preview` resolves to `kilocode/google/gemini-3.1-pro-preview` for Gemini 3.1 testing.
+- CLI: strip generic OSC terminal escape payloads from sanitized output fields, preventing clipboard/title escape bodies from leaking into commitment tables and other terminal-safe text. Thanks @shakkernerd.
+- Codex app-server: match connector-backed plugin approval elicitations by stable connector id so enabled destructive actions no longer fall through to display-name-only rejection.
+- Build: replace selected build utility `tsx` preloads with Node native type stripping so Node 26 build paths no longer emit `DEP0205` module loader deprecation warnings. (#78584) Thanks @keshavbotagent.
+- Media generation: honor configured music and video generation timeouts when tool calls omit `timeoutMs`, matching image generation behavior. (#80687)
+- CLI/update/status: label beta-channel plugin fallback and model-pricing refresh failures as warnings, keeping mixed beta/latest plugin cohorts visible without making core update or Gateway reachability look failed. Fixes #80689. Thanks @BKF-Gitty.
+- Doctor/plugins: relink managed npm plugin `openclaw` peer dependencies during `doctor --fix`, while refusing to follow package-local `node_modules` symlinks outside the plugin package. (#77412) Thanks @TheCrazyLex.
+- iMessage: route inbound tapbacks as reaction system events instead of normal messages, defaulting to bot-authored-message notifications while allowing `reactionNotifications: "off" | "own" | "all"` overrides. Fixes #60274; refs #39031 and #39322. Thanks @hyperclaw.
+- Control UI/performance: scope Nodes polling to the active Nodes tab, debounce stale session-list reconciliation, and bound chat-side session refreshes so long-running dashboards avoid background reload churn. Thanks @BunsDev.
+- Plugins/channels: explain bundled channel entry files that reach the legacy plugin loader as setup-runtime loader mismatches instead of generic missing-register failures. Thanks @chinar-amrutkar.
+- Plugins/session-end: fire a typed `session_end` plugin hook with reason `shutdown` (or `restart` when a restart is expected) for every session that was still active when the gateway process stops. Previously SIGTERM/SIGINT/restart paths closed the gateway without enumerating active sessions, leaving downstream `session_end` plugins (e.g. claude-mem) with ghost rows accumulating across restarts. The new shutdown finalizer drains an in-memory tracker that is populated by `session_start` and forgotten by replace / reset / delete / compaction emitters, so previously-finalized sessions are never double-fired. The drain is bounded to a 2 s total budget so a slow plugin cannot block process exit. Adds `"shutdown"` and `"restart"` to `PluginHookSessionEndReason`. Fixes #57790. Thanks @pandadev66.
+- Codex app-server: clamp Codex code-mode sandboxing to workspace-write when an OpenClaw sandbox is active, preventing Docker gateway socket access from becoming a danger-full-access Codex turn.
+- TUI: exit immediately on Ctrl+C/SIGINT after gateway disconnect and bound shutdown drain so terminal teardown cannot strand sessions. Fixes #75379. (#75381) Thanks @udaymanish6.
+- Matrix: default outbound markdown tables to bullet lists instead of fenced code blocks. Fixes #78990. (#80890) Thanks @kinjitakabe.
+- Bonjour/Gateway: treat active ciao probing and fresh name-conflict renames as in-progress so the mDNS watchdog waits for probe settlement before retrying, preventing rapid re-advertise loops on Windows, WSL, and other multicast-hostile hosts. (#74778) Refs #74242. Thanks @fuller-stack-dev.
+- Providers/MiniMax: send a minimal Anthropic-compatible user fallback when message conversion filters a turn to an empty payload, so MiniMax M2.7 no longer returns `chat content is empty` after tool-heavy sessions. Fixes #74589. Thanks @neeravmakwana and @DerekEXS.
+- Tools/media: preserve implicit allow-all semantics from `tools.alsoAllow`-only policies when preconstructing built-in media generation and PDF tools, so configured media tools become live without forcing `tools.allow: ["*", ...]`. Fixes #77841. Thanks @trialanderrorstudios.
+- Codex/Telegram: separate code-mode tool progress from final replies, render bridged tool calls with native tool labels, and repair persisted missing tool results for safer follow-up turns. (#80663) Thanks @jalehman.
+- Memory/search: load the platform-specific `sqlite-vec-<platform>-<arch>` variant directly when the meta `sqlite-vec` package is missing from a global install, so vector recall keeps working on `npm install -g openclaw@latest` upgrades where optionalDependencies left only the platform variant on disk. Fixes #77838. Thanks @corevibe555 and @Simon2256928.
+- Cron: keep long manual cron runs active in the task registry until completion, preventing transient `lost` markers before durable recovery reconciles. Fixes #78233. (#78243) Thanks @Feelw00.
+- Doctor/GitHub CLI: surface a `GH_CONFIG_DIR` hint when the GitHub skill is usable but `gh` auth lives under a different operator HOME than the agent process, without warning for disabled or filtered skills. Fixes #78063. (#78095) Thanks @tmimmanuel.
+- Gateway: dedupe concurrent `send`, `poll`, and `message.action` requests while delivery is still in flight, preventing duplicate outbound work for the same idempotency key. (#68341) Thanks @thesomewhatyou.
+- Cron: keep main-session `systemEvent` heartbeat wakes on their bound session route for both direct and queued wake paths by dropping inherited explicit heartbeat destinations when forcing `target: "last"`. Fixes #73900. Thanks @richardmqq.
+- Telegram: honor forced document delivery for video media so `--force-document` sends MP4s as documents instead of typed videos. Fixes #80389. (#80405) Thanks @jbetala7.
+- Gateway: clear speculative node wake state when APNs registration is missing, preventing unregistered or mistyped node IDs from retaining wake throttle entries. Fixes #68847. (#68848) Thanks @Feelw00.
+- Auto-reply: keep late follow-up queue drain finalizers from deleting a replacement queue registered after `/stop`, preventing immediate follow-up messages from being orphaned. Fixes #68838. (#68839) Thanks @Feelw00.
+- Feishu: make manual App ID/App Secret setup the default channel-binding path while keeping QR scan-to-create as an optional best-effort flow, and document the manual fallback for domestic Feishu mobile clients that do not react to the QR code. Fixes #80591. Thanks @wei-wei-zhao.
+- Memory: cap dreaming promotion writes to `MEMORY.md` by compacting oldest auto-promoted sections while preserving user-authored notes, keeping active memory below the bootstrap budget. Fixes #73691. (#74088) Thanks @YB0y.
+- Telegram: show resolved thinking defaults in native `/status` and `/think` menus while preserving explicit session overrides. (#80341) Thanks @VACInc.
+- Channels: cache selected channel registry lookups against the active fallback snapshot so pinned-empty registries refresh native command and alias routing after active registry swaps. (#80333) Thanks @samzong.
+- Codex app-server: reuse native Codex CLI OAuth for isolated app-server harness login, refresh, and app inventory cache keys so ChatGPT-authenticated Codex runs no longer fall back to unauthenticated OpenAI API calls. (#79877) Thanks @jeffjhunter.
+- Gateway: scope `sessions.resolve` sessionId and label store loads to the requested agent so large unrelated agent stores are not parsed for scoped lookups. Fixes #51264. (#79474) Thanks @samzong.
+- Gateway: share serialized streaming event envelopes across eligible WebSocket and node subscribers while preserving per-client sequence numbers. (#80299) Thanks @samzong.
+- Gateway: consolidate duplicate `openclaw doctor` service config panels while preserving the declined-repair `--force` hint. Fixes #80287. (#78688) Thanks @YB0y.
+- Browser: report Chrome MCP existing-session page readiness in browser status without letting status probes exceed the client timeout. Fixes #80268. (#80280) Thanks @ai-hpc.
+- WhatsApp: route opening-phase Baileys 428 connectionClosed through the WhatsApp reconnect policy and keep post-open 428 closes retryable, so transient setup socket closes retry with WhatsApp diagnostics instead of escaping as a bare `channel exited` error. Fixes #75736; mitigates #77443. Thanks @dataCenter430.
+- Agents: disable Pi's default filesystem resource discovery for embedded runs while keeping OpenClaw inline extension factories active, avoiding Windows event-loop stalls during first WhatsApp-triggered agent startup. Fixes #77443. Thanks @dataCenter430.
+- Providers/self-hosted: read model-scoped llama.cpp runtime context from `/props.default_generation_settings.n_ctx` while keeping top-level `n_ctx` as a fallback, so session budgeting reflects the loaded context window. Fixes #73664. (#74057) Thanks @brokemac79.
+- Memory: reject symlinked directory components in configured extra memory paths before reading Markdown files. (#80331) Thanks @samzong.
+- Sessions/transcripts: replace whole-file `readFile` scans with shared streaming helpers (`streamSessionTranscriptLines` and `streamSessionTranscriptLinesReverse`) for idempotency lookup, latest/tail assistant text reads, delivery-mirror dedupe, and compaction fork loading, so long-running sessions no longer materialize the full transcript in memory. Forward scans use `readline` over a bounded `createReadStream`; reverse scans read bounded chunks from the file end and decode complete JSONL lines newest-first without a fixed tail cap. Synthetic 200 MiB transcript: peak RSS delta drops from +252 MiB to +27 MiB while preserving malformed-line tolerance and idempotency-key return semantics. Fixes #54296. Thanks @jack-stormentswe.
+- Browser/CDP: filter browser-internal targets from raw CDP and persistent Playwright tab selection so navigation opens real page tabs. Fixes #55734. Thanks @Demine4.
+- WhatsApp: apply hot-reloaded `dmPolicy` and `allowFrom` settings to the active Web listener before processing new inbound DMs. Fixes #80538. Thanks @Ampaskopi129.
+- Plugins: let `openclaw doctor --fix` repair managed plugin installs whose package entrypoints fail package-directory boundary validation after local state moves. Fixes #80592. Thanks @wei-wei-zhao.
+- Voice-call: resume voice-originated exec approval follow-ups as internal non-delivery turns instead of rejecting them as `unknown channel: voice`. Fixes #80540. Thanks @patrickmch.
+- Control UI: preserve the composer draft when Stop is tapped during an active chat run, preventing accidental prompt loss on mobile. Fixes #80586. Thanks @KCALLC.
+- Infra/retry: keep jittered retry delays at or above server-supplied Retry-After lower bounds when the hint can be honored. Fixes #68541. (#68543) Thanks @Feelw00.
+- Docs: clarify that `/model provider/model` is an exact session route, while duplicate bare model ids only use configured fallback order on non-session override paths. Refs #80562. Thanks @gaodaabao.
+- Redact persisted secret-shaped payloads [AI]. (#79006) Thanks @pgondhi987.
+- Agents: label `.openclaw/sandboxes` exec workdirs as sandbox runs in compact tool summaries instead of showing the full path.
+- OpenAI Codex: surface browser OAuth and device-code login failures instead of treating failed logins as empty successful auth results. Refs #80363.
+- CLI agents: carry runtime-only current-turn sender/reply context into CLI model prompts while keeping prompt-build hook input and transcript text clean.
+- Control UI: keep workspace file presence checks from treating `fs-safe` stat helper failures as missing files, restoring Agents file status for existing Windows workspace files. Fixes #79953. Thanks @lovelefeng-glitch.
+- Microsoft Foundry: report an explicit error when the Azure subscription prompt returns an id that is not present in the enabled subscription list, instead of continuing from an unsafe subscription assertion. (#62742) Thanks @oliviareid-svg.
+- fix(matrix): gate name-based allowlist resolution [AI]. (#79007) Thanks @pgondhi987.
+- Slack: include the bot's own root/parent message in new thread sessions so in-thread replies reach the agent with the parent text the user is responding to, instead of only `reply_to_id` metadata. Fixes #79338. Thanks @sxxtony.
+- Docker: keep image builds on the source pnpm workspace policy so pnpm 11 can prune production dependencies without a Docker-only workspace rewrite.
+- Agents/compaction: restore info-level gateway logs for embedded compaction start, completion, and incomplete outcomes. (#71961) Thanks @rubencu.
+- Telegram: build reply-aware inbound turns through the shared channel context path so agents see the current reply target inline with the current message.
+- Telegram: recover legacy message cache files that mixed JSON-array and line-delimited entries so restarted gateways preserve reply-window context. (#80567)
+- Telegram: update the reply-context cache when messages are edited, so streamed bot replies appear in later agent context with their final text instead of the first draft.
+- Skills/Windows: normalize compacted skill prompt locations to forward slashes after home-prefix compaction so Windows skill paths remain readable by model file tools. (#52200) Thanks @chienchandler.
+- Control UI/Windows: update `@openclaw/fs-safe` so agent workspace file presence checks fall back correctly on Windows, preventing existing AGENTS.md, SOUL.md, TOOLS.md, IDENTITY.md, USER.md, HEARTBEAT.md, and MEMORY.md files from showing as missing. Fixes #79953. Thanks @lovelefeng-glitch.
+- Memory: skip managed dreaming cron reconciliation warnings for ordinary cron and heartbeat hook contexts that cannot manage Gateway cron. (#77027) Thanks @rubencu.
+- Cron: treat Codex app-server turn acceptance, CLI process spawn, and tool starts as execution milestones, preventing isolated runs from tripping the early startup watchdog after work has begun.
+- Codex app-server: treat current-turn `<turn_aborted>` raw markers as terminal so interrupted native-tool turns release Discord agent sessions instead of waiting for the outer timeout.
+- Yuanbao: bump `openclaw-plugin-yuanbao` to 2.13.1 to support `sourceReplyDeliveryMode: "automatic"` for group chat. (#79814) Thanks @loongfay.
+- Memory: keep `memory_search` result `corpus` labels aligned with the hit source, so session transcript hits surface as `sessions` and memory-file hits stay `memory`. Fixes #72885. (#71898, #72886) Thanks @rubencu.
+- Codex app-server: default native plugin app tool approvals to automatic so non-destructive read tools run when destructive actions are disabled.
+- Plugins: allow untracked local source plugins in the global extensions directory to load TypeScript package entries while keeping managed installs strict about compiled runtime output. Fixes #80503. Thanks @Kaspre.
+- Google/Gemini: normalize retired nested Gemini 3 Pro Preview ids while converting manifest catalog rows into emitted provider config, so `google/gemini-3.1-pro-preview` is used for testing instead of `google/gemini-3-pro-preview`.
+- Google/Gemini: normalize retired nested Gemini 3 Pro Preview ids inside saved model allowlists and fallback chains, so proxy routes like `openrouter/google/gemini-3-pro-preview` are persisted as Gemini 3.1 Pro Preview.
+- Google/Gemini: normalize retired nested Gemini 3 Pro Preview ids in configured proxy/provider-auth model catalogs, so regenerated config keeps testing `google/gemini-3.1-pro-preview` instead of `google/gemini-3-pro-preview`.
+- Google/Gemini: normalize retired nested Gemini 3 Pro Preview ids while onboarding provider catalog presets, so setup-emitted proxy configs test `google/gemini-3.1-pro-preview` instead of `google/gemini-3-pro-preview`.
+- Google/Gemini: normalize retired Gemini 3 Pro Preview ids in provider catalog rows during generic config writes, so unrelated config changes keep testing `google/gemini-3.1-pro-preview`.
+- Models: keep configured fallback chains ahead of configured primary models for override selections with duplicate model ids, preventing fallback jumps to the wrong provider. Fixes #80562.
+- Native apps: advertise the Gateway protocol compatibility range so chat and node sessions can connect to v3 gateways after additive v4 client updates.
+- Gateway/agents: keep stale `sessions_send` ACP manager and `web_fetch` runtime chunks importable after package updates, preventing live gateways from breaking before restart. Fixes #78804. Thanks @Gomesy72.
+- Gateway/install: preserve service environment value-source metadata in `openclaw gateway install`, so systemd reinstall paths keep env-file-backed secrets out of inline unit metadata. Refs #77406, #77427. Thanks @stainlu and @brokemac79.
+- Auto-reply/reset: include inbound sender context in bare `/new` and `/reset` model prompts while keeping startup instructions out of transcript prompts, so agents see sender identity on the first reset turn. Fixes #77360. Thanks @srb11e.
+- Gateway: avoid synchronous restart-sentinel state probes during post-attach startup, preventing slow Windows or redirected state directories from blocking channel turns. Fixes #79264. Thanks @liyi58.
+- Agents/auth: update successful model auth profile status with one locked store write, reducing post-model reply latency from duplicate `auth-profiles.json` saves. Thanks @mcaxtr.
+- Agents/image: honor explicit `image` tool model overrides even when `agents.defaults.imageModel` is unset, restoring one-off vision calls for configured multimodal providers. Fixes #79341. Thanks @haumanto.
+- Doctor/update: leave live systemd gateway units unchanged during noninteractive update-mode service repair, so update-time doctor does not silently overwrite operator-owned unit directives. Refs #80462.
+- Update: accept optional leading `v` prefixes when verifying exact npm package install targets, so `openclaw update --tag v2026...` does not roll back after installing the matching bare package version. Refs #74069; #80480. Thanks @Kaspre.
+- Doctor: treat missing plugin ids in `plugins.deny` as stale config warnings instead of fatal validation errors, and remove them during stale plugin cleanup so update repair does not restore last-known-good config for deny-only stale plugin refs. Refs #77802. Thanks @Kaspre.
+- Codex app-server: preserve prompt-local current-turn context through context-engine prompt projection, so replied-to Telegram messages stay visible to the Codex model input.
+- Telegram: pass agent-scoped media roots through gateway message actions so workspace-local media from the active agent is not rejected as cross-agent access. Thanks @frankekn.
+- CLI/gateway: keep `gateway status --deep` plugin-aware so configured plugin manifest warnings, including missing channel config metadata, stay visible during install and update smoke checks.
+- Doctor/status: clarify gateway token source conflict warnings and suppress them inside the managed Gateway service credential context.
+- Feishu: accept Schema 2 card callbacks whose operator identity is nested under `operator.user_id`, so card buttons dispatch instead of being dropped as malformed. Fixes #71670. (#71787) Thanks @rubencu.
+- Feishu: fall back to a top-level group send when normal group quoted replies target a withdrawn or missing message, preventing replies from disappearing silently while preserving native topic safety. Fixes #79349. Thanks @arlen8411.
+- Doctor: stop flagging the live compatibility agent directory as orphaned when the configured default agent is not `main`. Fixes #74313. (#74438) Thanks @carlos4s.
+- Auth/Claude CLI: persist fresher managed external CLI OAuth credentials back to `auth-profiles.json`, preventing stale `anthropic:claude-cli` profiles from repeatedly bootstrapping and flooding debug logs. Fixes #80129. Thanks @Caulderein.
+- Context: render `/context map` only from actual run context and persist Codex app-server run reports without counting deferred tool-search schemas as prompt-loaded tool schemas.
+- Codex app-server: report Codex-native tool execution to diagnostics so long-running native `bash`, web, file, and MCP tools no longer look like stale embedded runs to the watchdog. (#80217)
+- Codex app-server: refresh Codex account rate limits after subscription usage-limit failures so Discord and other channel replies can show the next reset time instead of saying Codex returned none. Thanks @pashpashpash.
+- Agents/auth: let Codex-backed OpenAI agent turns use `auth.order.openai` entries for Codex-compatible OAuth and API-key profiles while keeping existing `openai-codex` profile ordering valid.
+- Codex app-server: emit async `after_tool_call` observations for native tool completions not covered by the native hook relay so observability plugins can record Codex-native tools. (#80372) Thanks @VACInc.
+- Tasks: route group and channel task completions through the requester session so the parent agent can send the visible summary instead of stopping at a generic task-status line. Fixes #77251. (#77365) Thanks @funmerlin.
+- Telegram: preserve blank lines between manually indented bullet blocks and following numbered sections in rendered replies. Fixes #76998. Thanks @evgyur.
+- Agents/sandbox: allow read-only sandbox sessions to read the `/agent` workspace mount while keeping write/edit/apply_patch workspace-only guarded, restoring `read /agent/...` for `workspaceAccess: "ro"`. Fixes #39497. Thanks @stainlu and @teosborne.
+- Slack: pass configured agent identity through draft preview sends so partial streaming replies keep custom username/avatar on the initial Slack message. Fixes #38235. (#38237) Thanks @lacymorrow.
+- Slack: support `allowBots: "mentions"` for bot-authored messages that mention the receiving bot, matching the documented Discord-style mode without accepting every bot message. Fixes #43587. (#43588) Thanks @raw34.
+- Slack: refresh private file URLs with `files.info` when inbound DM file events omit or stale attachment URLs, preventing file attachments from being dropped before media hydration. Fixes #50129. (#50200) Thanks @smartchainark.
+- Slack: add scoped message-tool formatting hints so agents use Markdown for plain sends and direct mrkdwn for Block Kit fields. Fixes #34609. (#50979) Thanks @carrotRakko.
+- Slack: describe `download-file` file ids separately from message timestamps and return a targeted recovery error when agents pass `messageId` instead of `fileId`. (#74155) Thanks @jarvis-ai-gregmoser.
+- Slack: retain processed room messages for `requireMention=false` channels so always-on Slack rooms keep recent conversation context between turns. (#38658) Thanks @syedamaann.
+- Slack: compile interactive reply directives for direct outbound sends without bypassing the `interactiveReplies` capability gate, preserving Block Kit for Slack CLI and cron deliveries. (#78220) Thanks @kazamak.
+- Slack: keep DM last-route updates scoped to the active non-main DM session, including threaded DM turns, so isolated Slack DM sessions do not overwrite the shared main route. (#73085) Thanks @clawSean.
+- Slack/ACP: route Slack channel and DM messages through configured ACP bindings when no runtime binding exists, keeping bound thread replies pinned to the persistent ACP session and dropping unavailable configured targets instead of falling back to `main`. (#73101) Thanks @Raasl.
+- Slack: mark unresolved thread replies as ambiguous and skip them instead of treating them as root channel messages, keeping thread continuation on the SDK-backed participation store. (#75630) Thanks @soichiyo.
+- Slack: let same-channel message tool sends opt out of inherited thread context with `topLevel: true` or `threadId: null`, allowing agents to post a new parent-channel message from inside a Slack thread. Fixes #79807. Thanks @vexclawx31.
+- Slack: prefer full rich-text block content over truncated socket-mode message previews so long inbound Slack messages reach agents intact. Fixes #79027. Thanks @BobAccentWebDev.
+- Slack: include structured Slack API error details in setup, probe, streaming, and reply logs while preserving token redaction. (#53966) Thanks @deucemask.
+- Gateway/agents: keep structured reasons when active-run queueing fails and deprecate the legacy boolean queue helper, so steering and subagent wake diagnostics distinguish completed, non-streaming, and compacting runs. Fixes #80156. Thanks @markus-lassfolk.
+- System events: dedupe keyed events across the queue while preserving unkeyed, delivery-route, and trust-boundary event identity. (#73040) Thanks @statxc.
+- Agents/UI: compact exec and tool progress rows by hiding redundant shell tool names, replacing known workspace paths with short context markers, and preserving Discord trace scrubbing for compact command lines.
+- ACPX: run and await the embedded ACP backend startup probe by default so the gateway `ready` signal no longer fires before the acpx runtime has either become usable or reported a probe failure; set `OPENCLAW_ACPX_RUNTIME_STARTUP_PROBE=0` to restore lazy startup. Fixes #79596. Thanks @bzelones.
+- Gateway/status: surface model-pricing bootstrap and refresh failures as degraded health/status warnings while keeping Gateway liveness healthy. Fixes #79599. Thanks @bzelones.
+- OpenAI-compatible models: strip prior assistant reasoning fields from replayed Chat Completions history by default, preventing oMLX/vLLM Qwen follow-up turns from rejecting or stalling on stale `reasoning` payloads. Fixes #46637. Thanks @zipzagster and @lexhoefsloot.
+- CLI/onboarding: give non-Azure custom providers a safe generated context window and heal legacy 4k wizard entries without overwriting explicit valid small model limits, preventing first-turn compaction loops. Fixes #79428. (#79911) Thanks @Jefsky.
+- OpenAI-compatible models: add `compat.strictMessageKeys` to strip Chat Completions replay messages to `role` and `content` for strict providers that reject OpenAI-style tool and metadata keys. Fixes #50374. Thanks @choutos.
+- Bedrock Mantle: add `plugins.entries.amazon-bedrock-mantle.config.discovery.enabled=false` to suppress automatic Mantle discovery and IAM bearer-token generation while keeping the plugin enabled. Fixes #67288. Thanks @kanekoh.
+- Ollama: stop native `/api/chat` requests from copying catalog `contextWindow` or `maxTokens` into `options.num_ctx` unless `params.num_ctx` is explicitly configured, avoiding pathological prompt-ingestion latency on local large-context models. Fixes #62267. Thanks @BenSHPD.
+- Ollama: keep the model idle watchdog enabled for `*:cloud` models routed through a local Ollama host, so cloud-backed tool-loop stalls fail over visibly instead of inheriting local-model no-idle behavior. Fixes #79350. Thanks @geek111.
+- Voice/Ollama: honor routed voice agent `tools.allow` for classic embedded voice responses, including empty allowlists, so no-tool Ollama agents do not receive tool schemas. Fixes #79506. Thanks @donkeykong91.
+- Agents/doctor: warn when channel-routed agents cannot call the `message` tool, so operators can fix tool policy mismatches before explicit channel actions such as attachments or thread replies fail. Refs #80128. Thanks @jeffjhunterai.
+- Gateway: reread config from disk after the first in-process restart loop startup, preventing SIGUSR1 restarts from reusing a stale startup snapshot and dropping config written after boot. Fixes #79947. Thanks @TheLevti.
+- Codex app-server: deliver native image-generation outputs from Codex `savedPath` events as reply media, so blank-text image generation turns still attach the generated file. Thanks @keshavbotagent.
+- Network/SSRF: keep pinned automatic DNS lookups on IPv4 when dual-stack hosts also publish AAAA records, and treat `EADDRNOTAVAIL` as a transient gateway network failure instead of a fatal crash. Fixes #80078. Thanks @takamasa-aiso.
+- Control UI: show compact one-line live/idle/terminal run status badges in the Sessions table and rename the active-minute filter to its updated-within meaning. Fixes #78307. Thanks @BunsDev.
+- Control UI: scope chat session-list refreshes by agent and skip disk-only agent store discovery for configured-only lists, preventing post-first-message session switching stalls on large Windows stores. Fixes #79675. Thanks @lovelefeng-glitch, @BunsDev.
+- Control UI: allow Appearance tweakcn theme imports through the served CSP so browser-local custom theme links no longer fail with a `connect-src` violation. Fixes #78504. Thanks @BunsDev.
+- Control UI/config: remove plugin allowlist entries that the form auto-added when a plugin enable toggle is reverted before saving, so reverting the visible toggle clears dirty state without persisting unintended allowlist changes. (#78329) Thanks @samzong.
+- Gateway/mobile: reuse bootstrap-issued device-token scopes on handoff reconnects and surface device-token scope mismatches separately from token mismatches while preserving full shared-token dashboard/native sessions. Fixes #79292. Thanks @BunsDev.
+- Media/host-read: allow buffer-verified gzip, tar, and 7z archives in the shared host-local media validator alongside ZIP and document attachments.
+- Plugins/install: retry managed npm plugin installs without npm alias overrides after npm's `Invalid comparator: npm:` failure, so older npm versions can install official plugins instead of aborting. (#80539) Thanks @rubencu.
+- Plugins/doctor: invalidate persisted plugin registry snapshots when plugin diagnostics point at deleted source paths, so `openclaw doctor` stops repeating stale warnings after a local extension is replaced by a managed npm plugin. Fixes #80087. (#80134) Thanks @hclsys.
+- Doctor/OpenAI Codex: preserve Codex auth intent when auto-repairing legacy `openai-codex/*` model refs to canonical `openai/*` by adding provider/model-scoped Codex runtime policy, preventing repaired configs from falling through to direct OpenAI API-key auth. Fixes #78533 and #78570. Thanks @superck110 and @Azmodump.
+- CLI/agents: surface durable message delivery status from `sendDurableMessageBatch` in `deliverAgentCommandResult` and `openclaw agent --json --deliver`, preserving suppressed hook outcomes as terminal no-retry results while exposing partial and failed sends for automation. Supersedes #53961 and #57755. Thanks @Kaspre.
+- Agents: apply the LLM idle watchdog while provider stream setup is still pending, preventing silent pre-stream model hangs from waiting for the full agent timeout.
+- Cron: let isolated self-cleanup runs inspect their own job run history while keeping other cron jobs and mutation actions blocked. Fixes #80019. Thanks @hclsys.
+- Cron: report isolated agent-turn setup and pre-model stalls with phase-specific timeout errors instead of waiting for the full job budget when no model call starts. Fixes #74803. Thanks @jeffsteinbok-openclaw and @dgkim311.
+- CLI/plugins: treat arbitrary unknown subcommands outside plugin CLI metadata as normal unknown commands instead of suggesting `plugins.allow`, while preserving allowlist guidance for real plugin command roots. Fixes #80109. (#80123) Thanks @kagura-agent.
+- CLI/config: persist explicit `config set` and `config patch` values that equal runtime defaults instead of reporting success while dropping them. Fixes #79856. (#80106) Thanks @abodanty and @hclsys.
+- OpenAI/realtime voice: accept Codex-compatible legacy audio and transcript event aliases so provider protocol drift does not drop assistant audio or captions.
+- Discord/voice: keep default agent-proxy realtime sessions from auto-speaking filler before the forced OpenClaw consult answer, finish Discord playback on realtime response completion, and queue later exact-speech answers until playback idles to avoid mid-sentence replacement.
+- Gateway: return deterministic `400 invalid_request_error` responses for malformed encoded session-kill HTTP paths instead of letting route-shaped requests fall through to later Gateway handlers. (#72439) Thanks @rubencu.
+- Control UI: serve root PWA and favicon assets from `/__openclaw__/` SPA routes so tab icons, install metadata, and the service worker do not 404 after internal navigation. Fixes #80072. Thanks @CodeNovice2017.
+- Exec/safe bins: compare trusted safe-bin dirs with path-specific case folding on case-insensitive filesystems so Windows and default macOS paths match without weakening case-sensitive mounts. (#42131) Thanks @hkochar.
+- OpenAI/realtime voice: honor disabled input-audio interruption locally so server VAD speech-start events do not clear Discord playback after operators set `interruptResponseOnInputAudio: false`.
+- Telegram: keep no-response DM turns quiet instead of rewriting them into visible silent-reply chatter. Fixes #78188. (#78228) Thanks @Beandon13.
+- Telegram: handle managed select button callbacks before the raw callback fallback while preserving delimiter-containing option values such as `env|prod`. (#79816) Thanks @moeedahmed.
+- OpenAI-compatible models: handle JSON chat-completion bodies returned to streaming requests, preserving reasoning fields and visible text instead of completing an empty agent turn. Fixes #77870.
+- Discord/models: defer model picker component interactions before loading route, model, and preference data, preventing "This interaction failed" timeouts under gateway load. Fixes #77283. Thanks @colin-chang.
+- xAI: expose `/think low|medium|high` for reasoning-capable Grok models and keep `reasoning.effort` on native Responses payloads while preserving off-only behavior for non-reasoning routes. Fixes #79210. Thanks @colinmcintosh.
+- CLI/media: let explicit image description model refs use bundled static provider catalogs and generic model-backed image hooks, so `openclaw infer image describe --model zai/glm-4.6v` works like direct model runs and Anthropic auth probes avoid stale Claude 3 Haiku catalog entries.
+- Models/Anthropic: add `anthropic/claude-haiku-4-5` to Anthropic API-key agent allowlist defaults when an Anthropic default model is configured, so cron model overrides can select the current Haiku alias. Fixes #78000.
+- Agents/compaction: initialize built-in context engines before CLI transcript compaction resolves the default engine, preventing clean-process `legacy` engine registration failures during CLI session persistence. Fixes #79446. Thanks @TurboTheTurtle.
+- Agents/Anthropic-compatible: strip replayed thinking blocks for custom Anthropic-compatible models that explicitly declare `supportsReasoningEffort: false`, preventing Kimi-compatible providers from resending unsupported `thinking` content. Fixes #47452.
+- Kimi: keep Anthropic-compatible thinking streams valid by supplying required thinking budgets and enough output room for hidden reasoning plus final text. (#80481) Thanks @InTheCloudDan.
+- Browser: wait longer for existing-session Chrome MCP status and non-deep doctor probes so slow first attaches do not falsely report offline while keeping raw CDP status probes short. (#77473) Thanks @rubencu.
+- Gateway/logging: install console capture before foreground Gateway fast-path parsing and suppress known libsignal session dumps even in verbose mode, preventing raw terminal logs from printing WhatsApp session key material. (#76306) Thanks @rubencu.
+- Exec approvals: keep `exec.approval.list` on the lightweight policy-summary path so listing pending approvals no longer loads the rich tree-sitter command explainer. (#76943) Thanks @rubencu.
+- Agents: surface concise default-visible warnings when `exec`/`bash` tool calls fail after the assistant claims success, while keeping raw stderr hidden unless verbose details are enabled. Fixes #60497. (#80003) Thanks @jbetala7.
+- Channels/iMessage: keep redacted failed probe details in non-sensitive health snapshots so Full Disk Access failures no longer appear as configured/OK in status output. Fixes #79795.
+- Agents: stop blank model-emitted tool calls before dispatch while preserving id-based tool-name recovery, preventing Kimi/NVIDIA blank-name retry loops without creating a callable `_blank` sentinel. Fixes #34129. (#56391) Thanks @smartchainark.
+- Agents/Telegram: deliver the canonical final assistant answer instead of replaying accumulated pre-tool text blocks, preventing duplicate Telegram replies and raw-looking tool-output fragments from leaking into chat delivery. Fixes #79621 and #79986. Thanks @nonzeroclaw and @dudaefj.
+- Auto-reply/TUI: keep fallback timeout recovery deliverable after a primary model lifecycle error by emitting fallback progress and deferring terminal TUI errors until recovery has a chance to finish. Fixes #80000. (#80009) Thanks @TurboTheTurtle.
+- Heartbeat: clear stale auto fallback model overrides when the configured default model changes, so heartbeat runs follow updated `agents.defaults.model.primary` without requiring a manual reset. Fixes #74284. Thanks @brtkwr and @bitloi.
+- CLI/agent: let `openclaw agent --model` use the backend/admin Gateway scope without cached device-token scopes silently downscoping the request. (#78837) Thanks @VACInc.
+- CLI/help: keep help and version invocations configless while improving shared port, channel, plugin, task, session, message, pairing, and auth recovery text.
+- CLI/config: explain strict JSON parse failures with a valid example and the plain-string escape hatch.
+- CLI/secrets: turn offline Gateway reload failures into actionable recovery text.
+- CLI/channels: explain missing or ambiguous channel selections with next commands.
+- CLI/channels: defer guided channel status collection until a channel is selected, keeping `openclaw channels add` first screen quieter.
+- CLI/channels: exit guided channel setup cleanly on cancellation instead of printing the internal wizard error.
+- Plugins/CLI: route disabled Matrix and LanceDB memory command roots to plugin-enable guidance instead of generic unknown-command errors.
+- Browser/Docker: detect Playwright-managed Chromium from `PLAYWRIGHT_BROWSERS_PATH` and the default Playwright cache on Linux, so Docker installs that persist `/home/node/.cache/ms-playwright` no longer need `browser.executablePath`.
+- Ollama: keep DeepSeek V4 cloud models thinking-capable even when Ollama Cloud `/api/show` omits the `thinking` capability, so `/think high` no longer rejects `ollama/deepseek-v4-*:cloud`.
+- ACPX/Claude ACP: keep foreground prompts waiting for their own result when autonomous task-notification results arrive during the same session, and retarget the patch for Claude Agent ACP `0.33.1`.
+- WhatsApp: keep Baileys media uploads from passing non-Dispatcher agents to undici in `7.0.0-rc10`, and patch the bundled Baileys declaration so the latest tsdown build stays warning-clean.
+- Build: keep tsdown `0.22.0` warning-clean by externalizing known third-party declaration edges and replacing relative channel config module augmentations with explicit built-in channel fields.
+- ACP sessions: map canonical runtime options to backend-advertised ACP config keys like Claude's `effort` while keeping persisted OpenClaw state canonical. (#79926) Thanks @InTheCloudDan.
+- Models/Discord: support `provider/*` entries in `agents.defaults.models` so `/model`, `/models`, and model pickers can show dynamically discovered models for selected providers without exact model allowlists. Fixes #79485. Thanks @rendrag-git.
+- Gateway/watch: rebuild or restage missing bundled-plugin dist and runtime-postbuild outputs before launching the Gateway from a source checkout, preventing incomplete watch-mode runtime trees. (#70805) Thanks @rubencu.
+- CLI/update: allow restart health probes from the previous gateway protocol during self-update, and make plugin dry-runs report exact npm target versions instead of `unknown` while preserving unchanged status.
+- OpenAI/Codex: forward persisted `openai-codex` OAuth profile metadata into Codex plugin harness attempts after canonical `openai/*` migration, so OAuth-only installs keep using native Codex auth instead of falling through to direct OpenAI API-key auth. Fixes #79978.
+- OpenAI/Codex: point gateway missing-key recovery and wizard docs at the canonical `openai/gpt-5.5` plus Codex OAuth route, and fix trajectory export errors so they suggest the valid `openclaw sessions` command.
+- Google/Gemini: normalize retired `google/gemini-3-pro-preview` primary, fallback, and model-map refs during config load and unrelated config writes so saved config keeps targeting Gemini 3.1 Pro Preview.
+- Google/Gemini: normalize retired Gemini 3 Pro Preview ids inside emitted Google provider model config, so regenerated models.json rows test `google/gemini-3.1-pro-preview`.
+- Google/Gemini: normalize retired Gemini 3 Pro Preview ids for explicit OpenAI-compatible Google and Gemini CLI provider configs, so emitted config targets `google/gemini-3.1-pro-preview`.
+- Google/Gemini: normalize retired Gemini 3 Pro Preview ids preserved from existing merged models.json providers so config emission keeps targeting `google/gemini-3.1-pro-preview`.
+- Google/Gemini: normalize retired Gemini 3 Pro Preview ids inside provider auth config patches so setup-emitted provider catalogs test `google/gemini-3.1-pro-preview`.
+- GitHub Copilot: mint short-lived Copilot API tokens with the same `vscode-chat` integration identity used by runtime requests, and refresh legacy cached tokens missing that identity so image-capable Copilot models no longer inherit the `copilot-language-server` scope. Fixes #79946, #80074. Thanks @TurboTheTurtle.
+- Plugins/doctor: drop stale managed npm install records when `openclaw doctor --fix` removes npm packages that shadow bundled plugins, so the rebuilt registry no longer resurrects the removed package metadata.
+- Doctor: warn when a per-agent model config omits the `fallbacks` key and `agents.defaults.model.fallbacks` is non-empty. Covers both string-form (`"model": "..."`) and partial-object form (`"model": { "primary": "..." }`) — both silently clobber the defaults chain at runtime. Use `"fallbacks": []` to explicitly opt out of fallbacks, or add `"fallbacks": [...]` to inherit or override. Fixes #79369. Thanks @Kaspre.
+- Discord/voice: reuse or suppress late realtime consult tool calls without stealing newer speaker context or speaking forced fallback answers twice.
+- Discord/voice: skip likely incomplete realtime forced-consult transcript fragments and non-actionable closings so stale partial speech does not queue delayed answers over the next turn.
+- Discord/voice: keep realtime forced consults from clearing active exact-speech playback, so back-to-back voice answers queue instead of cutting each other off.
+- Discord/voice: synthesize realtime playback timestamps from emitted Discord PCM so OpenAI realtime barge-in truncation no longer sees `audioEndMs=0` and skips legitimate interruptions.
+- Plugin SDK: keep activated linked plugin runtime facades loadable when bundled plugin fallback is disabled. Thanks @shakkernerd.
+- Feishu: auto-thread `message(action="send")` replies inside the topic when the active session is group_topic or group_topic_sender, and propagate `replyInThread` through text, card, and media outbound adapters so topic-scoped sessions no longer post at the group root. Fixes #74903. (#77151) Thanks @ai-hpc.
+- WhatsApp: pass routing context into voice-note transcript echo preflight so echoed transcripts can deliver to the originating chat. Fixes #79778. (#79788) Thanks @hclsys.
+- Cron/failover: classify structured OpenAI-compatible `server_error` payloads as `server_error`, expose that reason in cron state, and let one-shot cron retry policy honor `retryOn: ["server_error"]` without requiring raw `5xx` text. (#45594) Thanks @clovericbot.
+- Slack: wake the resolved thread session after interactive reply button/select clicks and carry Slack delivery context through the queued interaction event, so clicks continue the visible conversation. Fixes #79676 and #61502. (#79836) Thanks @velvet-shark, @tianxiaochannel-oss88, and @Saicheg.
+- WhatsApp/streaming: send only the new suffix when text-end block replies repeat prior preambles across tool-call cycles, preventing cumulative WhatsApp preamble messages. Fixes #78946. (#79120) Thanks @brokemac79 and @papawattu.
+- Tests/security audit: sandbox `audit-exec-surface.test.ts` under a per-case OpenClaw home tempdir, redirecting `OPENCLAW_HOME` (which wins over `HOME`/`USERPROFILE` in `resolveRawHomeDir`) alongside `HOME` and `USERPROFILE`, so its `saveExecApprovals(...)` calls never touch the live `~/.openclaw/exec-approvals.json` on the host running the suite. Sibling exec-approvals tests already used the tempdir pattern; this file did not, so running `pnpm test` against a contributor's local checkout was silently truncating their real approvals to `{ "version": 1, "agents": {} }`. (#79885) Thanks @omarshahine.
+- ACP/gateway: preserve `AcpRuntimeError` cause chain (code/method/JSON-RPC detail) through the lifecycle boundary so gateway logs, telegram replies, and tool-result text show the actual upstream failure instead of opaque `Internal error`/`[object Object]`, with redaction applied before the chain reaches log or reply surfaces.
+- Channels/iMessage: wire `action: "reply"` attachments through `imsg send-rich --file` when the installed imsg build advertises that capability (probed once via `imsg send-rich --help` and cached on the private-API status). Reply now hydrates `media`/`mediaUrl`/`fileUrl`/`mediaUrls[0]`/`filePath`/`path`/base64 `buffer`+`filename` through the shared outbound resolver, stages buffers via the existing `withTempFile` helper, rejects `http(s)://` URL attachments with a targeted error pointing callers at `send`'s full attachment-resolver pipeline, and falls back to the explicit `imsg#114 not landed yet` error on older imsg builds. Depends on the upstream `openclaw/imsg#114` capability landing in an installable release; until then the new path stays gated and users see the same explicit fallback `#79822` introduced. (#79864) Thanks @omarshahine.
+- Telegram: preserve the first-preview debounce while appending true partial-stream deltas, so edited draft previews no longer duplicate earlier text when providers emit incremental output. (#80045) Thanks @TurboTheTurtle.
+- Agents/Anthropic: report 1M session context for Claude Opus/Sonnet 4 models even when local model config still advertises 200k, matching model discovery and preventing premature status/UI overflow. Fixes #66766.
+- Models/OpenRouter: hide missing-auth direct provider rows in `/model status` when they are only duplicated by a nested OpenRouter model id such as `openrouter/google/...`, while preserving explicitly configured direct providers. Fixes #62317.
+- Models: preserve an explicitly selected provider/model such as `opencode-go/deepseek-v4-pro` when another provider owns the same bare model alias. Fixes #79325.
+- Models/config: explain missing `models.providers.<provider>.models[]` registration when a model exists only in `agents.defaults.models`, instead of returning a bare unknown-model error. Fixes #80089.
+- MCP/tools: prefix bundle MCP server/tool fragments that would start with digits, keeping generated tool names valid for Moonshot/Kimi and other strict providers. Fixes #79179.
+- Models/OpenRouter: treat `403 API key budget limit exceeded` as billing so model fallback advances instead of retrying the exhausted primary. Fixes #60191. Thanks @omgitsgela.
+- Models/OpenRouter: repair stale session overrides that lost the outer `openrouter/` provider wrapper, so sessions return to the configured OpenRouter model instead of failing as an unknown direct-provider model. Fixes #78161. Thanks @hjamal7-bit.
+- Google/Gemini: default API-key onboarding back to `google/gemini-3.1-pro-preview` so fresh Gemini test configs exercise Gemini 3.1 Pro Preview.
+- Telegram: show full provider/model labels for nested OpenRouter model ids in the model picker, so `openrouter/openai/gpt-5.4-mini` no longer displays as `openai/gpt-5.4-mini`. Fixes #67792. (#72752) Thanks @iot2edge.
+- Models/OpenRouter: preserve live `supported_parameters` tool support metadata so non-tool Perplexity Sonar models no longer receive agent tool payloads and fall back unnecessarily. Fixes #64175. Thanks @Catfish-75.
+- Models/OpenRouter: add MoonshotAI Kimi K2.5 to the bundled OpenRouter catalog so onboarding/model pickers can offer it without waiting for live discovery. Fixes #14601.
+- Models/OpenRouter: keep keyRef/tokenRef-backed auth profiles visible to read-only PI model discovery, so OpenRouter models stay available in model pickers without storing plaintext keys. Fixes #58106. Thanks @ThalynLabs.
+- Models/list: include explicit configured provider rows and read-only auth-backed catalog rows in the default configured view without loading PI's full registry, keeping Control UI pickers aligned with usable model auth. Refs #79381. Thanks @ismael-81.
+- Security/audit: honor `tools.byProvider["provider/model"].deny` when reporting small-model web/browser exposure, so per-model OpenRouter mitigations clear the `models.small_params` exposure signal. Fixes #80118.
+- Models/Moonshot: accept direct `moonshotai/...` and `moonshot-ai/...` refs as aliases for canonical `moonshot/...`, so copied OpenRouter Kimi ids no longer fail as unknown direct models. Fixes #73876. (#74946) Thanks @jeffrey701.
+- Kimi Code: use Kimi's stable `kimi-for-coding` API model id in bundled catalog, onboarding, and docs while normalizing legacy `kimi-code` and `k2p5` refs. Fixes #79965.
+- Telegram: render cached reply targets and nearby group chatter as one selected conversation context window, so stale replies no longer split JSON reply chains from local chat context.
+- Volcengine/Kimi: strip provider-unsupported tool schema length and item constraint keywords for direct and coding-plan models so hosted Kimi runs do not reject message tools with `minLength`. Fixes #38817.
+- DeepSeek: backfill V4 `reasoning_content` replay fields for unowned OpenAI-compatible proxy providers, preventing follow-up request failures outside the bundled DeepSeek and OpenRouter routes. Fixes #79608.
+- iMessage: emit a WARN log when an action is blocked because the imsg private API bridge is not attached, so operators see the silent-drop in `~/.openclaw/logs/openclaw.log` instead of having to read per-session trajectory JSONL `tool.result` payloads. Common after a gateway restart un-injects the dylib from Messages.app. (#80035) Thanks @omarshahine.
+- Codex: cross-fill missing `thread.id` and `thread.sessionId` before schema validation so live Codex app-server responses that omit `sessionId` no longer fail `thread/start` or `thread/resume`. Fixes #80124. (#80137) Thanks @kagura-agent.
+- Agents/Pi: wait for embedded abort cleanup to settle before releasing the session write lock, preventing follow-up turns from racing previous prompt teardown. (#80239) Thanks @samzong.
+- WhatsApp: downgrade OpenClaw watchdog-triggered Web reconnects from runtime errors to recovery warnings and clear the recovered reconnect status after the next healthy connection. (#77026) Thanks @rubencu.
+- ACPX/Windows: hide the MCP proxy target child process window on Windows so ACP-backed agents do not flash or fail because of terminal window handling. Fixes #60672. (#60678) Thanks @KChow-ctrl.
+- Agents: abort generic repeated no-progress tool loops at the critical threshold when identical calls keep returning identical outcomes. (#80668) Thanks @frankekn.
+- Exec approvals: omit generated command highlights for non-POSIX Windows and shell-wrapper approval commands until those command languages have native highlighting support. (#80566) Thanks @jesse-merhi.
+- Telegram: keep verbose tool progress and result drafts separate from the final assistant answer so tool output no longer blends into the final Telegram message. (#80294) Thanks @jalehman.
+- Plugin SDK/Windows: enable the native require fast path for root `openclaw/plugin-sdk` dist aliases instead of forcing Jiti transforms. (#80878) Thanks @medns.
+- Agents/compaction: keep the recent tail after manual `/compact` when Pi returns an empty or no-op compaction summary, preventing blank checkpoints from replacing the live context.
+- Native commands: handle slash commands before workspace and agent-reply bootstrap so Telegram `/status` and other command-only native replies do not wait behind full agent turn setup.
+- Telegram/groups: include the recent local chat window and nearby reply-target window as generic inbound context so stale reply ancestry does not overshadow the live group conversation.
+- Plugins/Nix: allow externally configured plugin roots under `/nix/store` to load in `OPENCLAW_NIX_MODE=1` while keeping normal external plugin hardlink rejection unchanged. Thanks @joshp123.
+- Nextcloud Talk: include the required bot `response` feature in setup, explain missing `--feature response` on rejected sends, and surface missing response capability in doctor/status checks. Fixes #78935. (#79657) Thanks @joshavant.
+- Cron/diagnostics: emit the existing `message.queued`, `session.state` (processing/idle), and `message.processed` lifecycle events for isolated-cron agent turns in `runCronIsolatedAgentTurn`, matching the dispatch and embedded-runner paths so subscribers (diagnostics OTLP, OTel exporters, custom observability plugins) get per-run session attribution instead of bucketing isolated cron LLM calls under static fallback ids. Events are gated on `isDiagnosticsEnabled(cfg)` so the documented `diagnostics.enabled: false` master toggle continues to silence the recorder. (#79214) Thanks @arniesaha.
+- fix(discord): gate user allowlist name resolution [AI]. (#79002) Thanks @pgondhi987.
+- fix(msteams): gate startup user allowlist resolution [AI]. (#79003) Thanks @pgondhi987.
+- Infra/fetch-timeout: pass `operation` and `url` context to `buildTimeoutAbortSignal` from the music-generate reference fetch and the Matrix guarded redirect transport, so the `fetch timeout reached; aborting operation` warning carries actionable structured fields instead of a bare line. Fixes #79195. Thanks @pandadev66.
+- Harden macOS shell wrapper allowlist parsing [AI]. (#78518) Thanks @pgondhi987.
+- macOS/config: reject stale or destructive app fallback config writes before direct replacement and keep rejected payloads as private audit artifacts, so `gateway.mode`, metadata, and auth are not silently clobbered. Fixes #64973 and #74890. Thanks @BunsDev.
+- Gateway/macOS: include Apple Silicon Homebrew bin and sbin directories in generated LaunchAgent service PATHs and service-audit expectations so `openclaw gateway restart` keeps Homebrew Node installs reachable. Fixes #79232. Thanks @BunsDev and @TurboTheTurtle.
+- Doctor/OpenAI: stop pinning migrated `openai-codex/*` routes to the Codex runtime so mixed-provider agents keep automatic PI routing for MiniMax, Anthropic, and other non-OpenAI model switches.
+- Doctor/OpenAI: remove stale whole-agent Codex runtime pins while repairing legacy OpenAI-Codex routes, so upgraded agents do not force an unregistered Codex harness before provider/model routing can choose the right runtime.
+- Gateway/macOS: `openclaw gateway stop` now uses `launchctl bootout` by default instead of unconditionally calling `launchctl disable`, so KeepAlive auto-recovery still works after unexpected crashes; use the new `--disable` flag to opt into the persistent-disable behavior when a manual stop should survive reboots. Fixes #77934. Thanks @bmoran1022.
+- Gateway/macOS: `repairLaunchAgentBootstrap` no longer kickstarts an already-running LaunchAgent, preventing unnecessary service restarts and session disconnects when repair runs against a healthy gateway. Fixes #77428. Thanks @ramitrkar-hash.
+- Gateway/macOS: `openclaw gateway stop --disable` now persists the LaunchAgent disable bit even after a previous bootout left the service not loaded, keeping the explicit stay-down path reliable. (#78412) Thanks @wdeveloper16.
+- CLI/status: keep lean `openclaw status --json` off manifest-backed channel discovery so configured-channel checks do not repeatedly rescan plugin metadata. Fixes #79129.
+- Gateway/Tailscale: add opt-in `gateway.tailscale.preserveFunnel` so when `tailscale.mode = "serve"` and an externally configured Tailscale Funnel route already covers the gateway port, OpenClaw skips re-applying `tailscale serve` on startup and skips the `resetOnExit` teardown for that run, keeping operator-managed Funnel exposure alive across gateway restarts. Fixes #57241. Thanks @RenzoMXD.
+- Control UI/chat: hide retired and non-public Google Gemini model IDs from chat model catalogs and route the bare `gemini-3-pro` alias to Gemini 3.1 Pro Preview instead of the shut-down Gemini 3 Pro Preview. Thanks @BunsDev.
+- CLI/infer: canonicalize case-only catalog model refs in `infer model run --model` so mixed-case provider/model strings resolve to the canonical catalog entry instead of failing with `Unknown model`. (#78940) Thanks @ai-hpc.
+- CLI/infer: allow explicit local `infer model run --model <provider/model>` probes to use exact bundled static catalog rows before the provider is written to config, surfacing missing credentials as auth errors instead of `Unknown model`.
+- CLI/install: revert the beta-only global root-refusal guard so existing root-managed VPS installs keep working; the DigitalOcean split-brain protection will move to a narrower image/install-specific path. Refs #67478 and #67509. Thanks @vincentkoc.
+- Auto-reply/media: resolve `scp` from `PATH` when staging sandbox media so nonstandard OpenSSH installs can copy remote attachments.
+- Agents/PI: route PI-native OpenAI-compatible default streams through OpenClaw boundary-aware transports so local-compatible model runs keep API-key injection and transport policy.
+- Gateway/media: require authenticated owner or admin context for managed outgoing image bytes instead of trusting requester-session headers.
+- Doctor/gateway: avoid duplicate Node runtime warnings when the daemon install plan already selected a supported Node runtime.
+- Gateway/nodes: ignore malformed non-string capability entries from live nodes instead of throwing while listing the node catalog.
+- Gateway/pairing: preserve deliberately narrowed role-token scopes when approving device scope upgrades instead of regranting the whole approved baseline.
+- Telegram/ACP: keep chat-bound ACP replies durable by delivering final-only ACP output as final text instead of transient Telegram preview blocks. Thanks @shakkernerd.
+- Telegram: hydrate replied-to messages as a persisted nearest-first reply chain so agents can see observed parent text, media refs, captions, senders, timestamps, and nested replies instead of guessing from a shallow reply id.
+- Telegram: skip the rewritten silent-reply fallback when the dispatcher reports a final reply was queued in the same turn so a "No extra answer from me." filler cannot race ahead of the actual reply when lane delivery state never observes the send. Fixes #78929.
+- Gateway/watch: leave `OPENCLAW_TRACE_SYNC_IO` disabled by default in `pnpm gateway:watch:raw` so watch mode avoids noisy Node sync-I/O stack traces unless explicitly requested.
+- Codex app-server: close stdio stdin before force-killing the managed app-server, matching Codex single-client shutdown behavior and avoiding unsettled CLI exits after successful runs.
+- CLI/Codex: dispose registered agent harnesses during short-lived CLI shutdown so successful Codex-backed `agent --local` runs do not leave app-server child processes alive.
+- Agents/Codex: auto-enable the Codex harness plugin for one-shot OpenAI model overrides so `openclaw agent --local --model openai/...` does not fail with an unregistered `codex` harness.
+- Gateway/live tests: avoid full model-registry enumeration for explicit provider-qualified live model filters, preventing `.profile` OpenAI gateway profile runs from hanging before provider dispatch.
+- Gateway/status: surface CLI and gateway runtime versions, warn about stale PATH/global wrappers when they differ, and add stale-wrapper checks to the newer-config warning. Refs #79091. Thanks @RamaAditya49 and @sallyom.
+- Google/Gemini: retry stalled Gemini 3 preview direct API-key streams with a lean first-response payload and share Gemini tool-schema cleanup across direct Google and Gemini CLI providers, so main sessions with coding tools can recover before the LLM idle watchdog fires. (#79668) Thanks @joshavant.
+- Update/plugins: run a mandatory post-core convergence pass after `openclaw update` swaps the core package and before the gateway restarts, repairing missing configured plugin payloads, validating active install records including `openclaw.extensions`, and exiting with structured repair guidance instead of restarting the gateway with broken plugins. (#79143) Thanks @BKF-Gitty.
+- Providers: preserve non-OK `text/event-stream` response bodies so provider HTTP errors keep their JSON detail instead of collapsing to generic streaming failures. Fixes #78180.
+- Gateway/auth: make explicit `trusted-proxy` mode fail closed instead of accepting local password fallback credentials after trusted-proxy identity checks fail. Fixes #78684.
+- Active memory: treat Google Chat `spaces/...` conversation ids as scoped targets instead of runnable channel names so recall runs no longer fail bundled-plugin dirName validation. Fixes #78918.
+- Active memory: make `/active-memory status` honor the configured agent allowlist instead of reporting on for agents where recall is disabled. Fixes #78986.
+- Mistral: normalize structured OpenAI-compatible completions content blocks so thinking objects are not persisted as `[object Object]` visible reply text. Fixes #78846.
+- Tools/session status: render the active heartbeat/run model for `session_status({"sessionKey":"current"})` instead of falling back to the persisted session default. Fixes #77493.
+- Doctor/secrets: allow safe inherited exec SecretRef `passEnv` names such as `HOME` while still blocking dangerous runtime env hooks. Fixes #78216.
+- Chat commands: make `/model default` reset the session model override instead of treating it as a literal model name. Fixes #78182.
+- Cron: make rejected `payload.model` errors show the configured `agents.defaults.models` allowlist instead of echoing the rejected model twice. Fixes #79058.
+- Agents/subagents: retry parent wake announces when the announce-summary model run fails with fallback cooldown exhaustion instead of dropping the wake on the first transient provider overload. Refs #78581.
+- Providers/network: honor IPv4 CIDR and octet-wildcard `NO_PROXY` entries such as `100.64.0.0/10` and `100.64.*` before enabling trusted env-proxy mode for model-provider requests. Fixes #79030.
+- Skills: cap skills watcher directory traversal at the same depth used by skill discovery so large non-skill trees under configured skill roots do not exhaust file descriptors on startup. Fixes #75501. Thanks @wzq-xzwj.
+- Docs/Docker: document a local Compose override for Docker Desktop DNS failures in the shared-network `openclaw-cli` sidecar, keeping the default compose setup hardened while unblocking `openclaw plugins install` when users opt in. Fixes #79018. Thanks @Jason-Vaughan.
+- Installer: when npm installs `openclaw` outside the parent shell PATH, print follow-up commands with the resolved binary path instead of telling users to run `openclaw` from a shell that will report `command not found`. Fixes #72382. Thanks @jbob762.
+- Plugins/runtime: share MIME and JSON Schema helpers across bundled plugins while preserving canonical media MIME inference, browser URL wildcard semantics, migration home-path resolution, QA request-limit responses, and extensionless text file previews.
+- Agents/memory flush: persist the pre-increment compaction counter after flush-triggered compaction so consecutive eligible compaction cycles run memoryFlush instead of alternating. Fixes #12590. Refs #12760, #26145, and #46513. Thanks @Kaspre, @lailoo, @drvoss, @Br1an67, and @dial481.
+- Status: treat CLI runtime aliases such as `claude-cli/<model>` as the canonical selected provider route in `/status`, avoiding spurious fallback/unknown-auth display and preserving fresh context usage from CLI usage snapshots. Fixes #79015. Thanks @ItsThierry.
+- Agents/subagents: stop the `sessions_spawn` accepted note from recommending `sessions_yield` as the default wait path in push-based chat and CLI flows. Fixes #78913. Thanks @oiGaDio.
+- Compute plugin callback authorization dynamically [AI]. (#78866) Thanks @pgondhi987.
+- Telegram: deduplicate media attachments in non-streaming mode so block-delivered images are not resent in the final reply, and clear legacy `mediaUrl` fallback when all media URLs are filtered. Fixes #78372.
+- Gateway/auth: allow `gateway.auth.mode: "none"` loopback backend RPC clients to skip device identity only for local non-browser backend connections, restoring subagent spawns and gateway tools without opening remote or browser-origin bypasses. Fixes #75780. Thanks @yozakura-ava.
+- Canvas plugin: keep legacy root `canvasHost` configs valid until `openclaw doctor --fix` migrates them into `plugins.entries.canvas.config.host`, move Canvas/A2UI clients to gateway protocol v4 plugin surfaces, and refresh the generated A2UI bundle hash so normal builds stay clean.
+- feishu: honor config write policy for dynamic agents [AI]. (#78520) Thanks @pgondhi987.
+- fix(skill-workshop): honor pending approval for tool suggestions [AI]. (#78516) Thanks @pgondhi987.
+- BytePlus: mark Kimi K2.5 and Kimi K2 Thinking catalog entries as reasoning-capable, raise their output cap to 32k tokens, and fill Kimi cache-read pricing. Fixes #54149.
+- Control UI/chat: wait for an in-flight model dropdown patch before sending the next chat message, so immediate sends use the selected session model instead of racing the previous override. Fixes #54240.
+- Native chat: decode gateway-provided thinking metadata for the iOS/macOS picker so provider-specific levels such as `adaptive`, `xhigh`, and `max` appear without leaking unsupported default-model options. Thanks @BunsDev.
+- Agents/compaction: cap summarization output reserve tokens to the selected model's `maxTokens` so 1M-context Anthropic compactions do not request more output than the API permits. Fixes #54383.
+- Control UI/login: replace raw connection failures with structured, actionable login guidance for auth, pairing, insecure HTTP, origin, protocol, and transport failures. Thanks @BunsDev.
+- Agents/tools: fail `exec host=node` before `system.run` when the selected node is known to be disconnected, with an actionable reconnect message instead of a raw node invoke failure. Thanks @BunsDev.
+- Agents/tool-result guard: ignore internal tool-result `details` when estimating model-visible context, so large diagnostic metadata no longer triggers unnecessary truncation or compaction even though the provider boundary already strips `details` before model conversion. (#75525) Thanks @zqchris.
+- Agents/models: accept legacy `anthropic-cli/*` model refs as Claude CLI runtime refs instead of failing model resolution with `Unknown model`. Thanks @BunsDev.
+- Agents/tools: keep restrictive-profile tool-section warnings scoped to the configured sections whose tools are still missing from `alsoAllow`, so already re-allowed filesystem tools do not make exec-only fixes look broader than they are. Thanks @BunsDev.
+- Agents/tools: avoid warning messaging-only agents about inherited global `tools.exec` or `tools.fs` sections when the agent profile did not configure those tool sections itself. Thanks @BunsDev.
+- Codex dynamic tools: normalize runtime `toolsAllow` entries the same way as Pi tool policy, so aliases like `bash` and `apply-patch` still expose the intended OpenClaw tools. Thanks @BunsDev.
+- Memory/dreaming: read OpenAI-style `output_text` assistant parts from narrative subagent transcripts, so light-phase Dream Diary entries are not dropped as empty. Thanks @BunsDev.
+- OpenAI-compatible providers: honor `compat.supportsTools=false` by stripping tool payload fields before dispatch to chat-only endpoints. Fixes #74664.
+- OpenAI-compatible providers: apply model-declared unsupported tool-schema keyword stripping to native OpenAI transport payloads and mark Fireworks Kimi K2.5 as rejecting `not` schemas. Fixes #75467.
+- OpenAI-compatible gateway: sanitize images supplied through request content even when the prompt text contains no image file references, preventing oversized attachment payloads from bypassing the resize/drop pipeline. Fixes #59913.
+- Auth profiles: normalize inline API keys and tokens loaded from `auth-profiles.json` so masked or rich-text credential artifacts fail as auth errors instead of crashing HTTP header construction. Fixes #77624.
+- llm-task: resolve configured model aliases before embedded dispatch so `model="gemini-flash"` and other aliases route to the intended provider instead of the agent default. Fixes #54166.
+- Media generation: resolve slash-containing model-only overrides like `fal-ai/flux/dev` through registered provider model metadata so FAL image/video models do not get misparsed as provider `fal-ai`. Fixes #77444.
+- CLI backends: keep versioned OAuth identity matches reusable when auth profile ids rotate, so Claude CLI sessions do not reset and lose continuity during same-account OAuth refresh/profile alias changes. Fixes #78541.
+- Amazon Bedrock: refresh shared AWS profile/config file credentials before Bedrock model, discovery, and embedding requests so long-running Gateway processes pick up renewed profile credentials without restart. Fixes #77551.
+- Amazon Bedrock: treat named `aws-sdk` auth profiles as config routing metadata instead of stored credentials, and let `doctor --fix` move legacy markers out of `auth-profiles.json`. Fixes #69708.
+- Anthropic: reject uppercase provider-prefixed forward-compat model ids locally instead of sending malformed dynamic ids upstream. Fixes #73715.
+- OpenAI/embeddings: pass configured output dimensionality through single and batched embedding requests so memory embedding indexes can request smaller vectors. Fixes #55126.
+- CLI/infer: normalize HEIC/HEIF image files to JPEG before model-run requests, avoiding providers that reject Apple image container formats. Fixes #50081.
+- CLI/infer: fall back to macOS `sips` when optional image tooling cannot decode HEIC/HEIF input files before model-run requests. Refs #50081.
+- OpenRouter: keep the default `openrouter/auto` model ref canonical while preventing TUI and Control UI catalog pickers from displaying or submitting `openrouter/openrouter/auto`. Fixes #62655.
+- Status/Claude CLI: show `oauth (claude-cli)` for working Claude CLI OAuth runtime sessions instead of `unknown` when no local auth profile exists. Fixes #78632. Thanks @gorkem2020.
+- Memory search: preserve keyword-only hybrid FTS matches when vector scoring is unavailable or below the configured minimum score, so exact lexical hits are not dropped by weighted min-score filtering.
+- Heartbeat/async exec: remap cron-run session keys to agent-main (or `"global"` under `session.scope=global`) at the bash exec, ACP, gateway node-event, and CLI watchdog enqueue sites, and treat cron-run descendants as ephemeral for retention pruning, so async exec completion events land in the same queue the heartbeat drains instead of being stranded under the ephemeral cron-run key. Refs #52305. Thanks @Kaspre.
+- Wake protocol/system event CLI: type an optional `sessionKey` on `WakeParamsSchema`, add `--session-key` to `openclaw system event`, and keep cron enqueue/wake adapters resolving session-key-only targets symmetrically so callers can target a specific session for async-task completion relays instead of always hitting the agent's main session. Refs #52305. Thanks @Kaspre.
+- Exec approvals/node: let trusted backend node invokes complete no-device Control UI approvals after the original request connection changes, while keeping node, command, cwd, env, and allow-once replay bindings enforced. Fixes #78569. Thanks @naturedogdog.
+- Agents/subagents: keep background completion delivery on the requester-agent handoff/queue-retry path instead of raw-sending child results directly, and strip child-result wrapper or OpenClaw runtime-context scaffolding from queued outbound retries. Fixes #78531. Thanks @EthanSK.
+- Sandbox: recreate cached browser bridges when JavaScript-evaluation permission changes, keep failed prune removals tracked for retry, and make cross-device directory moves copy-then-commit without partially emptying the source on failure.
+- CLI/completion: guard the shell-profile source line written by `openclaw completion --install` with a file existence check (`[ -f ... ] && source ...` for bash/zsh, `test -f ...; and source ...` for fish) so uninstalling OpenClaw no longer makes new login shells error on a missing completion cache. (#78659) Thanks @sjf.
+- Telegram: fail private-topic sends instead of retrying them as plain DMs when Telegram rejects the topic id, keeping private-topic `message_thread_id` routing intact. Fixes #79455. (#78575) Thanks @tmimmanuel.
+- Discord/groups: instruct group-chat agents to stay silent when a message is addressed to someone else, replying only when invited or correcting key facts. (#78615)
+- Discord/groups: tell Discord-channel agents to wrap bare URLs as `<https://example.com>` so link previews do not expand into uninvited embeds. (#78614)
+- Agents/fallback: fail fast on session write-lock timeouts instead of trying fallback models for local file contention. Fixes #66646. Thanks @sallyom.
+- Browser/SSRF: stop closing user-owned Chrome tabs when a read-only operation (snapshot/screenshot/interactions) is rejected by the SSRF guard — only OpenClaw-initiated navigations now close on policy denial. Thanks @scotthuang.
+- iMessage: stage native inbound attachments into OpenClaw-managed media and convert HEIC/HEIF images to JPEG before dispatch, so image tools can read photos sent over native iMessage without requiring BlueBubbles.
+- Agents/Gateway: throttle and cap live exec command-output events so noisy tool runs cannot flood Gateway WebSocket clients or starve RPC handling. (#78645) Thanks @joshavant.
+- Memory Wiki: skip empty and whitespace-only source pages when refreshing generated Related blocks, preventing blank pages from being rewritten into Related-only stubs. Fixes #78121. Thanks @amknight.
+- Telegram: keep duplicate message-tool-only Codex turns from posting generic silent-reply fallback text, so private finals stay private after inbound dedupe. Thanks @rubencu.
+- Telegram/sessions: gap-fill delivered embedded final replies into the session JSONL even when the runner trace is missing, so Telegram answers after tool calls do not vanish from the durable transcript. Fixes #77814. (#78426) Thanks @obviyus, @ChushulSuri, and @DougButdorf.
+- Cron/heartbeat: let restricted cron-triggered runs read their own status and current-job list metadata again, preventing heartbeat STATUS freshness checks from going stale while preserving self-remove-only mutation limits. Fixes #78208. Thanks @amknight.
+- Channels/cron: ignore stale runtime conversation bindings that point at completed isolated cron run sessions, so follow-up DMs fall back to their normal route instead of reusing a closed cron task prompt. Fixes #78074. Thanks @amknight.
+- ACP: preserve streamed chunk boundaries in background-task progress summaries so CJK text, paths, URLs, and identifiers are no longer split with synthetic spaces. Fixes #78312. Thanks @amknight.
+- Agents/DeepSeek: suppress provider-private DSML transport syntax (tool-use-error, tool-call, function-call shadow blocks) so it never leaks into assistant-visible text; native `delta.tool_calls` remains the only authoritative tool-call source. (#78331) Thanks @samzong.
+- Agents/subagents: preserve the delegated task prompt when a spawned target agent uses `systemPromptOverride`, so `sessions_spawn(mode: "run")` child runs still see their assigned task. Fixes #77950. Thanks @amknight.
+- Node/Windows: fall back to the Startup-folder launcher when Spanish-localized `schtasks` reports `Acceso denegado`, matching the existing access-denied fallback path. Fixes #77993. Thanks @jackonedev.
+- Plugins/diagnostics: make source-only TypeScript package warnings actionable by explaining that missing compiled runtime output is a publisher packaging issue and pointing users to update/reinstall or disable/uninstall the plugin. Fixes #77835. Thanks @googlerest.
+- Control UI/chat: keep persisted assistant progress text visible when the same transcript turn also contains tool-use metadata, so chat.history reloads no longer make those replies vanish after the next user message. Fixes #77374. Thanks @BunsDev.
+- Cron: repair persisted future `nextRunAtMs` values that no longer line up with the cron schedule, so daily timezone-aware jobs do not stay jumped to stale future dates. Fixes #77867. Thanks @hongfangsong.
+- Agents/memory: keep error payloads visible during silent maintenance turns, so restricted memory-flush tool writes surface as chat errors instead of disappearing behind a silent run. Fixes #77821. Thanks @praxstack.
+- TUI: skip the generic CLI respawn wrapper for interactive launches, exit cleanly on terminal loss, and refuse to restore heartbeat sessions as the remembered chat session, preventing stale heartbeat history and orphaned `openclaw-tui` processes on first boot. Thanks @vincentkoc.
+- Doctor/sessions: move heartbeat-poisoned default main session store entries to recovery keys and clear stale TUI restore pointers, so `doctor --fix` can repair instances already stuck on `agent:main:main` heartbeat history. Thanks @vincentkoc.
+- Agents/context engines: keep hidden OpenClaw runtime-context custom messages out of context-engine assemble, afterTurn, and ingest hooks so transcript reconstruction plugins only see conversation messages. Thanks @vincentkoc.
+- Agents/compaction: treat visible custom-message, bash, and branch-summary entries as real conversation anchors so safeguard mode does not write empty fallback summaries for cron and split-turn sessions with substantive tool work. Fixes #78300. Thanks @amknight.
+- Network/runtime: avoid importing Undici's package dispatcher during no-proxy timeout bootstrap so external channel plugin fetch requests with explicit Content-Length keep working. Fixes #78007. Thanks @shakkernerd.
+- Status/doctor: treat a single healthy OpenClaw Gateway listener on loopback, LAN, or wildcard bind as the expected configured gateway instead of warning that the port is already in use. Fixes #77939. Thanks @GitHoubi and @brokemac79.
+- Agents/TTS: send media-bearing block replies directly when block streaming is off, so agent `tts` tool audio attached to a final text reply is delivered instead of being consumed before final Telegram/media delivery. Thanks @Conan-Scott.
+- Doctor: avoid crashing on partial Linux environments when the legacy crontab probe or terminal note wrapper receives missing or non-string output. Fixes #77773. Thanks @brokemac79 and @blackflame7983.
+- Gateway/performance: reuse the current compatible plugin metadata snapshot across hot read-only status, channel, auth, skills, and embedded agent settings paths, avoiding repeated synchronous plugin metadata scans during Gateway activity. Fixes #77983. Thanks @shakkernerd.
+- Tasks/maintenance: prune stale cron run session registry entries while preserving running cron jobs and non-cron sessions. Fixes #73867. Thanks @brokemac79.
+- Plugins: dispatch cached descriptor-backed tools by the resolved runtime tool name for unnamed factories, fixing multi-tool plugins whose shared manifest contracts exposed sibling tools but failed at execution. Fixes #78671. Thanks @zanni098.
+- Plugins/update: repair plugin-local `openclaw` peer links for all recorded npm plugins after any npm update mutates the shared managed npm tree, so targeted or batch updates cannot leave Codex, Discord, or Brave with pruned SDK imports. (#77787) Thanks @ProspectOre.
+- Codex harness: honor `models.providers.openai-codex.models[].contextTokens` for native `openai/*` Codex runtime runs and `/status` context reporting, so subscription-backed Codex agents use the configured OAuth context cap without inflating past the runtime model window. Fixes #77858. Thanks @lilesjtu.
+- Sessions cleanup: add `openclaw sessions cleanup --fix-dm-scope` so operators who return `session.dmScope` to `main` can dry-run and retire stale direct-DM session rows while preserving transcripts as deleted archives. Fixes #47561 and #45554. Thanks @BunsDev.
+- Doctor/Codex: repair legacy `openai-codex/*` routes and cron payload model refs to canonical `openai/*`, keep OpenAI agent turns on Codex by default, ignore stale whole-agent/session runtime pins, preserve explicit provider/model runtime policy, and migrate legacy runtime model refs to model-scoped runtime entries. Thanks @vincentkoc.
+- Video generation: wait up to 20 minutes for slow fal/MiniMax queue-backed jobs, stop forwarding unsupported Google Veo generated-audio options, and normalize MiniMax `720P` requests to its supported `768P` resolution with the usual override warning/details instead of failing fallback.
+- Channels/durable delivery: preserve channel-specific final reply semantics when using durable sends, including Telegram selected quotes and silent error replies plus WhatsApp message-sending cancellations.
+- Channels/message lifecycle: build legacy channel delivery results from message receipts and add receipts to BlueBubbles, Feishu, Google Chat, iMessage, IRC, LINE, Nextcloud Talk, QQ Bot, Signal, Synology Chat, Tlon, Twitch, WhatsApp, Zalo, and Zalo Personal send results and owner-path reply delivery plus Discord, Matrix, Mattermost, Slack, and Teams send results while preserving existing message id compatibility.
+- iMessage: run durable final replies through the iMessage outbound sanitizer before sending, matching direct auto-reply delivery and preventing assistant-internal scaffolding from leaking through queued delivery.
+- CLI/plugins: handle closed stdin during `plugins uninstall` confirmation prompt and exit 1 with actionable `--force` guidance instead of crashing with Node exit 13 unsettled top-level await. Fixes #73562. (#73566) Thanks @ai-hpc.
+- Control UI/Sessions: hide disk-discovered unregistered-agent sessions by default and fall back from restored unconfigured agent session keys before chat refresh, preventing deleted-agent stores from reopening the wrong workspace. Fixes #41685. Thanks @BunsDev.
+- Slack: keep health-monitor recovery stops from poisoning manual-stop state after channel stop timeouts, allowing Socket Mode accounts to reconnect after event-loop stalls instead of staying dead until Gateway restart. Fixes #77651. Thanks @Gusty3055.
+- Codex app-server: ignore account and rate-limit notifications when measuring active-turn liveness and suppress duplicate generic timeout replies after a visible messaging-tool delivery, so lost completion signals no longer keep Telegram/Discord turns active behind a delivered reply. (#79667) Thanks @joshavant.
+- Control UI/Gateway: preserve verified trusted-proxy operator scopes for browser WebSocket sessions so nginx/Authelia deployments can load chat history, models, sessions, nodes, and logs instead of failing with missing operator.read. Fixes #78508. (#79643) Thanks @joshavant.
+- Cloudflare AI Gateway: preserve boundary-aware Anthropic Messages transport when runtime auth creates a custom session stream, keeping the upstream x-api-key header intact for Gateway runs. (#79673) Thanks @joshavant.
+- Webhooks/Gmail/Windows: resolve `gcloud`, `gog`, and `tailscale` PATH/PATHEXT shims before setup and watcher spawns, using the Windows-safe `.cmd` wrapper for long-lived `gog serve` processes. (#74881, fixes #54470) Thanks @Angfr95.
+- Control UI/chat: suppress `HEARTBEAT_OK` acknowledgement history, streams, deltas, and final events before they enter the transcript view, so repeated heartbeat no-op turns do not stack noisy bubbles. Thanks @BunsDev.
+- Agents/skills: require exact `<location>` skill paths for both single-skill and multi-skill prompt selection, so agents do not guess or hard-code skill file paths. (#74161) Thanks @lanzhi-lee.
+- Agents/skills: rebuild sandboxed non-rw run skill prompts from the sandbox workspace copy, so `<available_skills>` no longer points at host-only `~/.openclaw/skills` paths. Fixes #50590. Thanks @kidroca and @sallyom.
+- Agents/media: tell async music and video completion agents when normal final replies are private, and send completion fallbacks directly to message-tool-only group/channel routes when the completion agent still only writes a private final reply, so generated media does not disappear behind the delivery contract.
+- CLI/update: report corrupt or unloadable managed plugins as post-update warnings instead of disabling them or turning a successful OpenClaw package update into a failed update result. Thanks @vincentkoc and @Patrick-Erichsen.
+- Update/restart: probe managed Gateway restarts with the service environment and add a Docker product lane that exercises candidate-owned `openclaw update --yes --json` restarts, so SecretRef-backed local gateway auth cannot regress behind mocked restart checks. Thanks @vincentkoc.
+- Gateway/sessions: cache selected model override resolution while building session-list rows so `openclaw sessions` and Control UI session lists stay responsive on model-heavy stores. (#77650) Thanks @ragesaq.
+- Gateway/diagnostics: make stuck-session recovery outcome-driven and generation-guarded, add `diagnostics.stuckSessionAbortMs`, and emit structured recovery requested/completed events so stale or skipped recovery no longer looks like a successful abort.
+- Messaging: queue assembled channel-turn final replies before sending to reduce response loss when the gateway restarts between assistant completion and channel delivery. Refs #77000.
+- Agents/replay-history: drop trailing assistant turns whose content is empty or carries only the stream-error sentinel before sending the transcript to the provider, so prefill-strict providers (such as github-copilot/claude-opus-4.6) no longer reject the request with `400 The conversation must end with a user message` after a session whose last turn errored before producing content. Refs #77228. (#77287) Thanks @openperf.
+- Agents/session-file-repair: drop `type: "message"` entries with a missing, `null`, or blank role during the on-disk repair pass so sessions that accumulated null-role JSONL corruption (such as the 935+ corrupt entries in #77228) get fully cleaned up rather than carried forward into the repaired file. Refs #77228. (#77288) Thanks @openperf.
+- Doctor/device pairing: stop suggesting `openclaw devices rotate --role <role>` for stale local cached device auth when that role is no longer approved by the gateway pairing record, so doctor no longer points users at a command that must be denied. (#77688) Thanks @Conan-Scott.
+- Ollama/thinking: expose the lightweight Ollama provider thinking profile through the public provider-policy artifact too, so reasoning-capable Ollama models such as `ollama/deepseek-v4-pro:cloud` keep `/think max` available even before the full plugin runtime activates. (#77617, fixes #77612) Thanks @rriggs and @yfge.
+- Codex/app-server: stabilize transcript mirror dedupe across re-mirrored turns so reordered snapshots no longer drop reasoning entries or duplicate the assistant reply. Refs #77012. (#77046) Thanks @openperf.
+- Agents/auth-profiles: do not record request-shape (`format`) rejections as auth-profile health failures, so a single per-session transcript-shape error (such as a prefill-strict 400 "conversation must end with a user message") no longer triggers a profile-wide cooldown that blocks every other healthy session sharing the same auth profile. Refs #77228. (#77280) Thanks @openperf.
+- CLI/update: stop dev-channel source updates immediately when `git fetch` fails, so tag conflicts cannot keep preflight, rebase, or build steps running against stale refs while the Gateway is still on the old runtime. (#77845) Thanks @obviyus.
+- Config/recovery: chmod restored `openclaw.json` back to owner-only (`0600`) after suspicious-read backup recovery on POSIX hosts, so a previously world-readable config mode cannot persist into a freshly restored credential-bearing config. (#77488) Thanks @drobison00.
+- Memory/dreaming: persist last dreaming-ingestion calendar day per daily note in `daily-ingestion.json` so unchanged notes are still re-ingested once per dreaming day for promotion signals toward deep thresholds. Fixes #76225. (#76359) Thanks @neeravmakwana.
+- Agents/embed: keep message_end safety delivery armed when a silent text_end chunk produces no block reply, fixing dropped Telegram/forum replies. Fixes #77833. (#77840) Thanks @neeravmakwana.
+- Install/postinstall: skip noisy compile-cache prune warnings when `EACCES`/`EPERM` prevent removing shared `/tmp/node-compile-cache` entries owned by another user. Fixes #76353. (#76362) Thanks @RayWoo and @neeravmakwana.
+- Agents/messaging: surface CLI subprocess watchdog/turn timeout messages to chat users when verbose failures are off, instead of collapsing them into generic external-run failure copy. Fixes #77007. (#77015) Thanks @neeravmakwana.
+- Agents/sessions: after embedded Pi runs, append assistant-visible reply text to session JSONL only when Pi did not already persist an equivalent tail assistant entry, without re-mirroring the user prompt Pi owns. Fixes #77823. (#77839) Thanks @neeravmakwana.
+- Plugins/CLI: load the install-records ledger when listing channel-catalog entries, so npm-installed third-party channel plugins resolve through `openclaw channels login`/`channels add` instead of failing with `Unsupported channel`. (#77269) Thanks @pumpkinxing1.
+- Memory wiki/Security: enforce session visibility on shared-memory `wiki_search` and `wiki_get` so sandboxed subagents cannot read transcript content from sibling or parent sessions. Fixes GHSA-72fw-cqh5-f324. Thanks @zsxsoft.
+- Exec approvals: enforce allowlist `argPattern` argument restrictions on Linux and macOS as well as Windows, so an entry like `{ pattern: "python3", argPattern: "^safe\.py$" }` no longer silently relaxes to a path-only match on non-Windows hosts. (#75143) Thanks @eleqtrizit.
+- Security/exec allowlist: collapse `.` and `..` segments in wildcard exec allowlist match targets and canonicalize absolute executable path candidates before regex matching, so a target like `/usr/bin/../../bin/sh` no longer string-matches a `/usr/bin/**` allowlist entry while resolving outside the declared root. (#75723) Thanks @eleqtrizit and @zsxsoft.
+- Agents/compaction: disable Pi auto-compaction whenever OpenClaw effectively owns safeguard compaction, including provider-backed safeguard mode, so Pi and OpenClaw no longer fight over long-session compaction. Fixes #73003. (#73839) Thanks @bradhallett.
+- Telegram/streaming: finalize text replies by stopping the edited stream message instead of sending a second answer bubble, so Telegram turns cannot duplicate the streamed final response. (#77947) Thanks @obviyus.
+- web_search/Brave: fix provider selection when Brave is installed as an external plugin and `tools.web.search.provider: "brave"` is explicitly configured — a redundant provider re-resolution at startup could race and return an empty list, causing a spurious `WEB_SEARCH_PROVIDER_INVALID_AUTODETECT` warning and treating the explicitly configured provider as absent. Fixes #77676. Thanks @openperf.
+- Doctor/plugins: discover doctor contracts from load-path channel plugins during `openclaw doctor --fix`, so plugin-owned legacy config repair runs before validation. (#77477) Thanks @jalehman.
+- Dependencies: bump transitive `basic-ftp` to 5.3.1 so the runtime lockfile no longer includes the vulnerable 5.3.0 build flagged by the production dependency audit. (#78637) Thanks @sallyom.
+- Hooks/cron: log returned `/hooks/agent` isolated-run errors and failed cron jobs with cron diagnostic summaries, so rejected `payload.model` values are visible instead of looking like accepted-but-missing runs. Fixes #78597. (#78655) Thanks @kevinslin.
+- Managed proxy/security: classify raw socket callsites and proxy runtime mutations in boundary checks so new direct egress or unmanaged proxy-state changes cannot land without explicit review. (#77126) Thanks @jesse-merhi.
+- Memory indexing: propagate memory directory creation failures immediately instead of reporting an unusable directory as ready. Thanks @he-yufeng.
+- Channels/iMessage: surface the silent group-allowlist drop at default log level by emitting a one-time `warn` per account at monitor startup when `channels.imessage.groupPolicy: "allowlist"` is set without a `channels.imessage.groups` block, plus a one-time `warn` per `chat_id` when the runtime gate drops a specific group, naming the exact `channels.imessage.groups[...]` key to add to allow it. Fixes #78749. (#79190) Thanks @omarshahine.
+- WhatsApp: stop Gateway-originated outbound echoes from advancing inbound activity in `openclaw channels status`, so outbound self-sends no longer look like handled inbound messages. Fixes #79056. (#79057) Thanks @ai-hpc and @bittoby.
+- Gateway/nodes: preserve the live node registry session and invoke ownership when an older same-node WebSocket closes after reconnecting. (#78351) Thanks @samzong.
+- Browser/downloads: route explicit and managed browser download output directories through `fs-safe` validation before staging final files, so symlinked output roots are rejected before writes. (#78780) Thanks @jesse-merhi.
+- Agents/PI: skip the idle wait during aborted embedded-run cleanup, so stopped or timed-out runs clear pending tool state and release the session lock promptly. (#74919) Thanks @medns.
+- Agents/current-time: split UTC into a separate `Reference UTC:` prompt line so local `Current time:` stays anchored to the user's timezone. (#42654) Thanks @chencheng-li.
+- Agents/reasoning: keep embedded reasoning deltas raw for correct same-line streaming while preserving formatted Telegram, Feishu, Discord, and heartbeat delivery at the channel edge. (#78397) Thanks @medns.
+- Agents/failover: rotate auth profiles before deferred cooldown marking on rate-limit failures, so file-lock contention cannot stall profile failover. Fixes #57281. (#57283) Thanks @jeremyknows.
+- Gateway/sessions: when `session.dmScope: "main"` is configured, route a bare webchat `/new` against the agent's main session (`sessions.create` with `emitCommandHooks=true`) to an in-place reset instead of creating a parallel `dashboard:` child, matching `/new` behavior on Telegram/Discord. Fixes #77434. (#71170) Thanks @statxc.
+- Scripts/UI/Windows: launch `.cmd` and `.bat` UI runners through the shared cmd.exe escaping path with shell mode disabled, avoiding Node.js v24 DEP0190 warnings while preserving argument boundaries. (#62910) Thanks @nandanadileep.
+- Agents/CLI runner: disable supervisor stdout/stderr capture for prepared CLI runs while keeping bounded diagnostics and incremental JSONL output parsing, preventing long CLI output from being retained in memory. (#79617) Thanks @samzong.
+- Telegram: treat a DM binding that carries the chat id in both `conversationId` and `parentConversationId` as a direct conversation instead of a topic, so reverse delivery for Telegram DMs is not misrouted through a topic-shaped target. (#79700) Thanks @TSHOGX.
+
diff --git a/CHANGELOG/2026.5.14.md b/CHANGELOG/2026.5.14.md
new file mode 100644
index 0000000000000000000000000000000000000000..6257795b483ed3eb6cd3db5d2ddcb49b521db40d
--- /dev/null
+++ b/CHANGELOG/2026.5.14.md
@@ -0,0 +1,278 @@
+## 2026.5.14
+
+### Changes
+
+- Channels/SDK: add normalized command turn facts to channel turn construction and expose command-turn helpers for plugin inbound contexts.
+- Agents/config: support per-agent bootstrap profile overrides for `contextInjection`, `bootstrapMaxChars`, and `bootstrapTotalMaxChars`, inheriting from `agents.defaults` when omitted. Fixes #69966. Thanks @BunsDev.
+- Dependencies: route root ambient Node proxy agents through `@openclaw/proxyline` and drop root `proxy-agent`, `https-proxy-agent`, and `minimatch` dependencies.
+- Canvas: lazy-load HTTP host, hosted media resolver, CLI implementation, and tool runtime modules so Gateway startup only pays Canvas implementation cost on first use. (#82001) Thanks @samzong.
+- Control UI/i18n: add a `pnpm ui:i18n:report` baseline report for hardcoded-copy focus areas and locale fallback metadata. (#81320) Thanks @samzong.
+- Maintainer tooling: add a repo-local `codex-review` skill for Codex closeout reviews, including local dirty-work and PR-branch review helpers that rerun until no accepted/actionable findings remain and avoid unsupported inline prompts with `--base`.
+- Maintainer tooling: fail CI when pull requests add package patch files or pnpm patched dependencies, preserving the upstream-and-bump dependency workflow.
+- Codex app-server: stream commentary preambles into editable channel progress drafts without promoting them to final answers.
+- Codex migration: remove the bundled `codex-cli` backend and repair legacy `codex-cli/*` model refs to the Codex app-server route on `openai/*`.
+- Gateway/plugins: add a descriptor-backed gateway method registry so plugin-owned RPC methods carry scope metadata, preserve hidden core collision checks, and keep advertised method lists separate from internal core handlers. (#82063)
+- Gateway/startup: add owner-level startup trace attribution for auth, plugin loading, lookup counts, and plugin sidecar services. (#81738) Thanks @samzong.
+- Plugins/hooks: expose the resolved effective `contextTokenBudget` plus source/reference metadata on `llm_output` and sanitized `model_call_*` hook events/contexts so plugin cost and context-health alerts can use agent-level context caps. Fixes #64327. Thanks @BunsDev.
+- Channels/status reactions: wire `StatusReactionController` into WhatsApp message turns (queued → thinking → tool → done/error lifecycle, on par with Telegram and Discord), add `deploy`/`build`/`concierge` emoji categories with tool-token routing, and replace the status reaction defaults with self-explanatory emoji (🧠 thinking, 🛠️ tool, 💻 coding, 🌐 web, ⏳ stallSoft, ⚠️ stallHard, ✅ done, ❌ error, 🗜️ compacting) so stall and lifecycle reactions read as status indicators instead of emotional commentary. Fixes #59077. (#80612) Thanks @gado-ships-it.
+- Control UI: add a browser-local Text size setting in Appearance and Quick Settings, scaling chat and dense UI text while keeping inputs above the mobile Safari focus-zoom threshold. Fixes #8547. Thanks @BunsDev.
+- Gateway/plugins: add a default-off `admin-http-rpc` plugin for selected control-plane methods, with security docs and no core endpoint config. (#81806) Thanks @liorb-mountapps.
+- Docs: add a dedicated ds4 provider page with local DeepSeek V4 Flash config, on-demand startup, context sizing, and live verification steps.
+- Release validation: add a package-installed Docker user-journey lane that verifies onboarding, mocked model setup, external plugin install/uninstall, ClickClack outbound/inbound messaging, Gateway restart survival, and doctor.
+- Release validation: add package-installed Docker lanes for real TTY onboarding, media and memory persistence, published-package upgrade journeys, and local marketplace plugin install/update/uninstall coverage.
+- Maintainers: add a Clawdtributor skill for Discrawl-backed contributor PR triage, live status checks, and compact review formatting.
+- Telegram: support Mini App `web_app` buttons in generic message presentation payloads, allowing `openclaw message send --presentation` to render Telegram Web App inline buttons for private chats. (#81356) Thanks @jzakirov.
+- Scripts: add `OPENCLAW_HEAVY_CHECK_LOCK_SCOPE=worktree` so high-capacity local worktrees can use independent heavy-check locks while shared locks remain the default. Fixes #80729. (#80734) Thanks @samzong.
+- Agents/subagents: deliver native `sessions_spawn` tasks in the child session's first visible `[Subagent Task]` message instead of hiding the task in the sub-agent system prompt, keeping delegation auditable without duplicating tokens. Fixes #78592. Thanks @bradestes and @stainlu.
+- Messages/queue: make mid-turn prompts steer active runs by default via `/queue steer`, preserve `/queue followup` and `/queue collect` for users who want messages to queue by default, and make `/steer` continue as a normal prompt when steering is unavailable. (#77023) Thanks @fuller-stack-dev.
+- Voice Call/Telnyx: add realtime media-streaming call support for conversational voice calls. (#81024) Thanks @dynamite-bud.
+- Dependencies: add release dependency evidence reports, npm advisory gating, and PR dependency-change awareness so maintainers can review dependency risk before and during releases. Thanks @joshavant.
+- Gateway: expose optional `isHeartbeat` metadata on agent event payloads so clients can distinguish scheduled heartbeat runs from ordinary chat runs. (#80610) Thanks @medns.
+- Agents: add `agents.defaults.runRetries` and `agents.list[].runRetries` config for embedded Pi runner retry loop limits. (#80661) Thanks @medns.
+- Codex: add node-backed Codex CLI session listing and binding so an OpenClaw conversation can continue an existing Codex CLI session running on a paired node.
+
+### Fixes
+
+- Models/providers: trust the exact configured custom/local provider `baseUrl` origin for guarded model HTTP requests, so loopback, LAN, tailnet, and private DNS endpoints work without broad private-network access while different ports and metadata/link-local pivots remain blocked. Fixes #80732. (#80751) Thanks @Kaspre and @msitarzewski.
+- Bind shell script operands after combined options [AI]. (#81882) Thanks @pgondhi987.
+- fix(canvas): validate snapshot response formats [AI]. (#81881) Thanks @pgondhi987.
+- Constrain provider catalog entry paths [AI]. (#81884) Thanks @pgondhi987.
+- Require canonical node platform IDs [AI]. (#81880) Thanks @pgondhi987.
+- Agents/Azure OpenAI Responses: default unset Azure OpenAI API versions to `preview` so `/openai/v1/responses` calls use Azure's current Responses API route. (#82026) Thanks @leoge007.
+- Control UI/WebChat: compact the desktop chat header controls into a single aligned row so the session, model, thinking, and action controls no longer waste vertical space. Thanks @BunsDev.
+- Control UI/settings: widen the Personal quick-settings card to a 3/1 desktop split and keep Appearance/Automations below it on narrower layouts. Thanks @BunsDev.
+- Agents/model catalog: reuse manifest model-id normalization metadata while loading persisted read-only catalog rows, avoiding repeated metadata scans.
+- Agents: retry empty final turns for generic `anthropic-messages` providers instead of limiting non-visible recovery to Kimi, so custom/proxied Anthropic-compatible routes can recover with a visible answer. Addresses #46080. Thanks @wmgx, @w1tv, and @iFwu.
+- Agents/replies: strip workflow `<function_response>` scaffolding from user-visible sanitizer paths so raw tool output does not leak into chat history, transcript mirrors, or channel replies. Fixes #47444. Thanks @5toCode.
+- Agents/media: deliver generated image, music, and video results through structured attachments, keep message-tool-only Codex completions on the message tool, and fail completion handoff when expected media is not actually sent.
+- Diagnostics/Codex: recover stalled embedded Codex app-server runs after the shorter default stalled-run window so queued turns resume sooner.
+- Codex app-server: fall back to same-account Codex CLI OAuth tokens at runtime when the local OpenAI Codex refresh token is rejected, without overwriting the canonical OpenClaw auth profile. Fixes #82069. Thanks @aaajiao.
+- Control UI: rotate browser service-worker caches per build so updated Gateways are less likely to keep serving stale dashboard bundles that trigger protocol mismatch errors.
+- Gateway/protocol: lazy-compile protocol validators on first use instead of compiling every AJV schema during cold import, reducing startup CPU and RSS. (#82064) Thanks @samzong.
+- File transfer: lazy-load node.invoke policy enforcement so gateway startup only registers static command metadata until file-transfer commands run. (#82211) Thanks @samzong.
+- Discord: report unresolved configured bot-token SecretRefs during startup instead of treating the account as unconfigured. (#82009) Thanks @giodl73-repo.
+- Discord: pass an explicit Ogg muxer to ffmpeg when transcoding voice-message audio through staged temp files, restoring TTS voice-message delivery. Fixes #82074. Thanks @hwlbb.
+- Discord/Feishu: allow Discord voice uploads through RFC2544 fake-IP proxy DNS and pass Feishu's voice ffmpeg transcode through an explicit Ogg muxer. (#82088) Thanks @hwlbb and @6peng888.
+- Audio/STT: pass explicit WAV/Ogg muxers to ffmpeg for whisper-cli and WhatsApp staged temp outputs so `.part` filenames do not break transcription or voice-message delivery. Fixes #82094. (#82110) Thanks @civiltox.
+- CLI/config: preserve numeric-looking object keys such as Discord guild IDs during `config patch` recursive merges. (#81999) Thanks @giodl73-repo.
+- Gateway/OpenAI-compatible HTTP: forward `response_format` from `/v1/chat/completions` requests through agent stream params to upstream Chat Completions and Responses transports, restoring structured-output support. Fixes #82003. (#82004) Thanks @Lellansin.
+- Control UI/WebChat: let sidebar markdown code-block Copy buttons use the same delegated clipboard handler as chat messages. (#58709) Thanks @tikitoki.
+- Discord/streaming: only mark partial draft previews delivered after final edit or fallback delivery succeeds, so failed finalization cleanup removes stale truncated drafts instead of leaving them as the visible reply. Fixes #82035. Thanks @compoodment.
+- macOS/Gateway: surface leftover `ai.openclaw.update.*` launchd updater jobs in `openclaw gateway status --deep` and doctor so post-update launchd loops point at the stale job cleanup. Fixes #81859. Thanks @BKF-Gitty.
+- macOS/screen snapshots: reject malformed `screen.snapshot` params before capture, bound base64 results against the projected `node.invoke.result` frame, and preserve stable caller-facing errors for oversized payloads and capture failures. Fixes #68181. Thanks @shaun0927 and @BunsDev.
+- Config/doctor: rotate capped `.clobbered.*` repair snapshots by artifact timestamp so repeated repairs keep the newest forensic copy instead of preserving only the first capped set. (#82012) Thanks @Kaspre.
+- Telegram: initialize the bot before isolated polling drains spooled updates so default isolated polling no longer retries every update with `Bot not initialized` and stalls replies. Fixes #81973. (#81975) Thanks @neeravmakwana.
+- Codex app-server: keep Codex-runtime compaction on native Codex threads, warn when stale OpenClaw compaction summarizer overrides are ignored, and let doctor remove those unsupported overrides, avoiding public OpenAI Responses summarization with Codex OAuth tokens. Fixes #82008. (#82027) Thanks @pashpashpash.
+- Telegram: apply method-aware Bot API request timeouts to direct message/action clients so `openclaw message delete --channel telegram` no longer waits on grammY's 500-second default when the API request wedges. Fixes #81908. Thanks @DashLabsDev.
+- Cron: treat attempt dispatch and assembled context as execution-start milestones so isolated agent jobs that have reached backend dispatch are governed by their configured job timeout instead of the 60s pre-execution watchdog. Fixes #81368. (#81871) Thanks @alexph-dev.
+- Doctor/auth: warn about stale per-agent OAuth auth profile shadows and let `openclaw doctor --fix` remove the local shadow so agents inherit the fresher main-agent credential.
+- Status/channels: show configured channels whose plugin setup failed to load as `plugin load failed: dependency tree corrupted; run openclaw doctor --fix` instead of silently dropping them from `openclaw status`.
+- Status/update: show pending or failed update restart handoffs in `openclaw status` and make `openclaw update` print explicit gateway restart verified, skipped, or failed guidance.
+- QA/update: add an E2E corrupt plugin dependency lane that verifies `status --all` guidance, `doctor --fix` cleanup, and channel status recovery.
+- Discord/channels: make `openclaw channels list --all` prefer reachable Gateway runtime account status and mark configured-but-unavailable credentials, avoiding false `not configured` output when Discord is running from service-only env. Fixes #79343. Thanks @EricY019.
+- WhatsApp: mark text slash commands as command turns so authorized group command replies stay visible under message-tool-only group reply mode. (#81972) Thanks @barbarhan.
+- Providers/OpenCode Go: stop sending unsupported reasoning parameters to Kimi K2.5/K2.6, avoiding OpenCode Go payload-validation failures while preserving DeepSeek V4 reasoning support.
+- Providers/OpenRouter: normalize invalid Chat Completions reasoning replay fields while preserving valid OpenRouter reasoning pass-back, avoiding follow-up turn 500s without affecting stock OpenAI calls. (#82101) Thanks @sliverp.
+- Installer: handle noninteractive git installs from moving refs without tag-fetch conflicts, while keeping immutable refs on frozen lockfile installs. (#81875) Thanks @keshavbotagent.
+- Codex app-server: inject native client factories per run and compaction attempt instead of using module-scope test state, avoiding temporal-dead-zone reads during cyclic startup. (#81148) Thanks @bdjben.
+- Plugin skills: replace generated Windows plugin-skill directories before publishing the current skill link, avoiding repeated `EINVAL` warnings from stale non-symlink entries. Fixes #81432. (#81446) Thanks @hclsys and @vincentkoc.
+- Channels/config: treat channel entries with only `enabled: true` as configured state so plugin-backed channels can auto-enable from an explicit on switch. Fixes #81323. (#81331) Thanks @EvanYao826 and @vincentkoc.
+- CLI/update: add an update finalization path for externally swapped core runtimes, running update-time doctor repair and plugin convergence from post-doctor config and install-record state before reporting completion. Thanks @shakkernerd.
+- CLI/update: refresh config after package-update doctor repairs before post-update plugin sync, avoiding stale-hash conflicts during package upgrade journeys.
+- macOS/Gateway: hand managed LaunchAgent package self-updates to the post-exit CLI path and report handoff failures through the update restart sentinel instead of leaving agent-invoked updates pending. Fixes #81894. (#81945) Thanks @BKF-Gitty.
+- Agents/WebChat: stop a successful assistant turn whose stale `errorMessage` matches a billing, auth, or rate-limit pattern from rotating profiles, falling back, or surfacing a hard `FailoverError` unless the current attempt has a real failover failure. (#70900) Thanks @truffle-dev.
+- Control UI/usage: remove the duplicated inner Usage page heading so the shared dashboard header is the only page title. Thanks @BunsDev.
+- Control UI/WebChat: keep mobile PWA composer controls above the iOS home indicator when standalone safe-area insets under-report. Fixes #77408. Thanks @BunsDev.
+- Control UI/logs: make the Gateway Logs stream height responsive to the viewport with a minimum height floor, so larger screens can show substantially more log lines without collapsing on shorter viewports. (#53916) Thanks @extrasmall0.
+- ACP/Codex: surface redacted Codex wrapper stderr for generic ACP internal failures and preserve safe Codex model/provider routing in isolated `CODEX_HOME`, making `sessions_spawn(runtime="acp", agentId="codex")` failures actionable. Fixes #80079. (#80718) Thanks @leoge007.
+- Agents/trace: mark execution traces as fallback-used when merged fallback attempts prove a primary model failed before the winning attempt, keeping `/trace raw` and agent JSON telemetry consistent. Addresses fallback telemetry in #81213. Thanks @BKF-Gitty.
+- ACP: treat rejected timeout config options as best-effort hints so ACP turns continue with adapters that do not support `session/set_config_option` timeout keys. Fixes #81250. (#81603) Thanks @qkal.
+- Cron/Codex: default exact-command scheduled agent turns to lightweight bootstrap context so automation runs the command before loading workspace identity or memory context.
+- Codex cron: disable native Codex project-doc loading for lightweight app-server cron turns so scheduled jobs avoid project-doc injection after OpenClaw suppresses bootstrap context. (#81822) Thanks @jalehman.
+- Codex plugin/Gateway: strip unpaired UTF-16 surrogates from Codex app-server JSON-RPC payloads and let stale reply-work recovery abort stalled reply runs, preventing malformed media turns from wedging gateway lanes.
+- Codex app server: force OAuth refresh requests to perform a real token refresh instead of reusing unchanged inherited auth-profile tokens after refresh failures. (#80738) Thanks @simplyclever914.
+- Control UI/WebChat: render `/tts audio` replies as playable audio attachments through the assistant-media ticket path, with structured-audio compatibility for older live payloads. (#81722) Thanks @Conan-Scott.
+- Bind gateway approval access to requester metadata [AI]. (#81380) Thanks @pgondhi987.
+- Telegram: let isolated polling drain independent topics, DMs, and status/control commands concurrently while preserving same-lane order. (#81849) Thanks @VACInc.
+- Telegram: derive readable plain-text retries from HTML fallback sends so parse failures show `label (url)` links instead of raw anchors. (#81764) Thanks @alexph-dev.
+- Ollama/Doctor: copy explicit native Ollama `contextWindow` or `maxTokens` provider/model budgets into `params.num_ctx` during `openclaw doctor --fix`, preserving large-context configs after native Ollama stopped inferring per-request `num_ctx`. Fixes #81878. (#81928) Thanks @joshavant and @ArthurusDent.
+- Discord: honor `threadName` on `message send` to existing threads by renaming the thread after successful delivery, and warn when the rename cannot be applied. Fixes #81836. (#81933) Thanks @joshavant.
+- Build: keep externalized Slack, OpenShell sandbox, and Anthropic Vertex runtime dependency declarations out of the root dist artifact build.
+- ClawHub: include Amazon Bedrock and Bedrock Mantle provider packages in the published registry metadata so the externalized providers are discoverable from ClawHub as well as npm.
+- Codex account/status: hide empty rate-limit buckets and show server-reported usage-limit blocks without calling them available.
+- Auto-reply/Claude CLI: bridge CLI-runtime assistant text-delta agent events into the chat reasoning preview through `onReasoningStream`, mirroring the existing assistant-text (#76914) and tool-event (#80046) bridges and adding gating so non-CLI runtimes are unaffected. Thanks @anagnorisis2peripeteia and @pashpashpash.
+- Mantis: keep QA evidence in Actions artifacts only and stop publishing evidence files to Git-backed artifact branches.
+- CLI/migrate: handle delayed Codex plugin marketplace responses so warnings, next-steps, and conflict states render with ⚠️ glyphs and post-install migration retries the marketplace fetch instead of silently skipping plugin items. (#81625) Thanks @sjf.
+- Channels/Weixin: bump the bundled `@tencent-weixin/openclaw-weixin` external entry to `2.4.3` (from `2.4.1`) so onboarding and `openclaw channels add` install the current Tencent Weixin (personal WeChat) plugin release. (#81730) Thanks @scotthuang.
+- CLI: lazy-load model, plugin, and device runtime helpers and keep channel option help on generated startup metadata or generic fallback text so parent/help output renders without importing those runtime paths.
+- CLI: route `plugins list --json` through the parsed command fast path and cover it in response budgets so plugin JSON inventory avoids full CLI registration work.
+- Control UI/Overview: render recent session rows through the shared session display resolver so label/displayName priority, key-equivalent labels, and channel fallbacks stay consistent with the chat selector. (#50696) Thanks @Maple778 and @BunsDev.
+- Gateway/network: keep OpenClaw-installed undici dispatchers on HTTP/1.1 and treat destroyed HTTP/2 session errors as recoverable network teardown, preventing `ERR_HTTP2_INVALID_SESSION` from crashing active gateway turns. Fixes #81627. (#81838) Thanks @joshavant.
+- Memory/daily-files: widen the daily-memory file matcher used by Dreaming, rem-backfill, rem-harness, the doctor sweep, and short-term promotion so `memory/YYYY-MM-DD-<slug>.md` files written by the bundled session-memory hook (and any future slugged variants) are discovered alongside the date-only `memory/YYYY-MM-DD.md` shape. Date extraction still uses the leading `YYYY-MM-DD` capture group, so per-day ingestion/promotion semantics are unchanged for existing date-only files; slugged files now flow through the same paths instead of being silently skipped. Fixes #69536. Thanks @jack-stormentswe.
+- macOS/Gateway: fail managed LaunchAgent stop and restart when the configured gateway port remains busy after cleanup instead of reporting success while a listener survives. Fixes #73132. Thanks @BunsDev.
+- Telegram: reuse the sticky IPv4 Bot API transport for periodic getMe health checks, so IPv4-working hosts with broken IPv6 egress stop logging repeated probe timeouts. Fixes #76852. (#76856) Thanks @SymbolStar.
+- Telegram: ship the isolated polling worker at the root dist path used by the bundled worker loader, avoiding startup failures looking for `dist/telegram-ingress-worker.runtime.js`.
+- Control UI/Gateway: stop stale token-mismatch reconnect loops when no trusted device-token retry is available, and cap rendered chat history by raw tool-output size so dashboard auth/history work cannot keep degrading channel sockets. Fixes #72139. Thanks @BunsDev.
+- Memory/daily-files: prioritize the canonical `memory/YYYY-MM-DD.md` daily note before same-day slugged session captures during capped live ingestion and historical seeding, preserving existing daily-note behavior when slugged files exist.
+- Gateway/OpenAI-compatible HTTP: parse shared JSON endpoint paths without trusting malformed Host headers, avoiding 500s before `/v1/chat/completions`, `/v1/responses`, and `/v1/embeddings` request handling.
+- Telegram: resolve plugin native commands with the active runtime config so commands like `/codex ...` stay on the native command path.
+- Voice-call webhooks: parse webhook and realtime upgrade paths without trusting malformed Host headers, avoiding 500s before provider signature checks or path rejection.
+- Media store: reject malformed redirect `Location` headers as media-download failures instead of letting URL parsing escape the async response callback.
+- ClickClack: skip malformed realtime websocket frames instead of stopping the channel monitor on a single bad JSON event.
+- Browser tool: treat malformed node proxy `payloadJSON` responses as browser proxy failures instead of leaking raw JSON parser errors.
+- Gateway HTTP: match models, session kill, and session history route paths without trusting malformed Host headers, avoiding pre-auth 500s on those endpoints.
+- Google Meet/Codex: report malformed node proxy `payloadJSON` responses with plugin-owned errors instead of leaking raw JSON parser failures.
+- Debug proxy: reject malformed relative-form proxy targets with a controlled 400 response instead of letting URL parsing escape the request handler.
+- File transfer: reject malformed inline `file_write` base64 before computing hashes or invoking paired nodes, avoiding Node's lenient base64 decoder.
+- QA channel: skip malformed inline inbound attachment base64 instead of staging silently corrupted media for agent turns.
+- Microsoft Teams: reject malformed inline HTML image base64 padding instead of decoding corrupted `data:` image attachments.
+- Voice-call realtime: ignore malformed provider media-frame base64 before forwarding audio into bridge and transcription paths.
+- QQBot: reject malformed stored cron payload base64 before JSON decoding structured reminder data.
+- Telnyx voice-call: use the raw `client_state` fallback when webhook state is malformed base64 instead of using silently corrupted decoded text.
+- Google Meet: report malformed node-host params JSON with plugin-owned errors instead of leaking raw JSON parser failures.
+- CLI/export-trajectory: report malformed encoded request JSON with a stable CLI error instead of leaking raw parser output.
+- ComfyUI: report malformed workflow API JSON responses with owned errors instead of leaking raw parser failures.
+- DeepInfra video: report malformed successful API JSON responses with provider-owned errors instead of leaking raw parser failures.
+- Brave Search: report malformed web and LLM-context API JSON with provider-owned errors instead of leaking raw parser failures.
+- xAI tools: report malformed web search, X search, and code execution JSON with provider-owned errors instead of leaking raw parser failures.
+- Nextcloud Talk: report malformed room-info and bot-admin JSON with channel-owned errors instead of leaking raw parser failures.
+- Microsoft Teams: report malformed Graph and delegated OAuth JSON with channel-owned errors instead of leaking raw parser failures.
+- Google Chat: report malformed Chat API and certificate JSON with channel-owned errors instead of leaking raw parser failures.
+- Firecrawl: report malformed search and scrape API JSON with provider-owned errors instead of leaking raw parser failures.
+- Tavily: report malformed search and extract API JSON with provider-owned errors instead of leaking raw parser failures.
+- Perplexity: report malformed Search API and chat completion JSON with provider-owned errors instead of leaking raw parser failures.
+- Exa: report malformed search API JSON with a provider-owned error instead of leaking raw parser failures.
+- Memory host SDK: report malformed remote JSON with caller-scoped errors for POST and batch file upload responses instead of leaking raw parser failures.
+- Media providers: report malformed operation-poll and audio-transcription JSON with provider-owned errors instead of leaking raw parser failures.
+- MiniMax, Gemini, Kimi, and Ollama web search: report malformed API JSON with provider-owned errors instead of leaking raw parser failures.
+- Image and video generation: reject malformed base64 payloads from OpenAI-compatible image responses, DeepInfra video data URLs, and MiniMax image responses instead of accepting Node's lenient decoder output.
+- Media MIME sniffing: reject malformed base64 payloads before sniffing chat/tool image MIME types instead of accepting Node's lenient decoder output.
+- Web search: mark the managed `web_search` `query` argument as required in the advertised tool schema, so schema-following local models stop emitting `queries` payloads that fail at execution. Fixes #82097. Thanks @SpidFightFR.
+- Twilio voice-call: report malformed successful API JSON responses with provider-owned errors instead of leaking raw parser failures.
+- Voice-call provider APIs: report malformed successful guarded JSON responses with provider-prefixed errors instead of leaking raw parser failures.
+- Realtime transcription: report malformed provider websocket JSON frames with owned parser errors instead of leaking raw `SyntaxError` objects.
+- Microsoft Foundry: report malformed Azure CLI token JSON with owned auth errors instead of leaking raw parser failures.
+- Gateway/model pricing: report malformed external pricing catalog JSON with source-owned errors instead of leaking raw parser failures.
+- QA Lab: report malformed model-catalog subprocess JSON with an owned error and ignore invalid catalog rows.
+- Google Meet: report malformed browser-control status JSON with plugin-owned errors instead of leaking raw parser failures.
+- Google provider: report malformed SSE stream JSON with provider-owned errors instead of leaking raw parser failures.
+- Node host: report malformed built-in invoke `paramsJSON` with stable invalid-request errors instead of leaking raw parser failures.
+- Amazon Bedrock embeddings: report malformed provider response JSON with provider-owned errors instead of leaking raw parser failures.
+- QQBot: report malformed access-token JSON with provider-owned errors instead of leaking raw parser failures.
+- OpenAI embeddings: report malformed batch output JSONL with provider-owned errors instead of leaking raw parser failures.
+- Synology Chat: report malformed JSON webhook payloads with stable channel-owned parser errors.
+- Mattermost: report malformed interaction callback JSON with stable channel-owned parser errors.
+- Twilio voice-call: report malformed media stream WebSocket JSON with an owned parser error instead of logging raw parser failures.
+- Tlon/Urbit: report malformed SSE event JSON with an owned parser error instead of logging raw parser failures.
+- Signal: return a stable installer error when GitHub release metadata is malformed JSON.
+- ClawHub: report malformed successful marketplace JSON responses with owned errors instead of leaking raw parser failures.
+- Provider usage: report malformed successful usage JSON responses with stable provider errors instead of leaking raw parser failures.
+- Tlon/Urbit: report malformed scry response JSON with owned errors instead of leaking raw parser failures.
+- LM Studio: report malformed model list and model load JSON with owned errors instead of leaking raw parser failures.
+- Matrix: ignore malformed percent-encoding in optional location URI parameters instead of letting a bad `geo:` event abort inbound message handling.
+- Web search: auto-detect Brave through its legacy `tools.web.search.apiKey` compatibility fallback while keeping doctor migration to `plugins.entries.brave.config.webSearch.apiKey` as the canonical repair, so allowlisted isolated cron runs do not report `web_search` unavailable before migration. Fixes #81538. Thanks @atomicmonk.
+- Plugins: memoize repeated in-process plugin metadata snapshots and keep vanished managed-install residue from forcing full derived discovery, reducing gateway/status startup scans under large plugin sets. Fixes #81143 and #79806. (#81570) Thanks @Kaspre, @holgergruenhagen, @JanPlessow, and @mjamiv.
+- CLI/plugins: route lazy plugin command-registration chatter to stderr only during JSON-output command registration, keeping plugin-backed `--json` stdout parseable without changing parse-only or pass-through `--json` behavior. Fixes #81535. (#81536) Thanks @ScientificProgrammer and @vincentkoc.
+- Plugins: treat git plugin install refs as refs instead of checkout flags, so option-like selectors fail checkout instead of silently installing the default branch. Fixes #79898. (#79901) Thanks @afurm and @vincentkoc.
+- Doctor/memory: stop warning that no memory plugin is active when an enabled alternate memory plugin explicitly owns the memory slot, while preserving the warning for missing or disabled slot entries. Fixes #78540. (#78557) Thanks @carladams1299-lab and @vincentkoc.
+- Plugins: keep derived plugin metadata snapshots uncached when the persisted registry is missing, disabled, or stale, so newly added plugins are discovered without restarting. (#81064) Thanks @Kaspre.
+- Plugins: discover provider plugins from `setup.providers[].envVars` credentials during provider discovery while keeping the deprecated `providerAuthEnvVars` fallback. (#81542) Thanks @JARVIS-Glasses.
+- Docs/Codex harness: clarify that per-agent `CODEX_HOME` isolates `~/.codex` while inherited `HOME` intentionally keeps `.agents` discovery and subprocess user-home state available.
+- CLI/plugins: keep bare plugin and parent-command help on the lightweight path, avoiding plugin registry discovery before rendering help.
+- Auth: reclaim dead-owner stale file locks before retrying locked writes, so crashed OAuth refreshes no longer wedge `auth-profiles.json` until manual cleanup.
+- CLI tables: preserve muted/color styling on wrapped continuation lines after multiline cells, keeping `openclaw plugins list` descriptions readable.
+- Process execution: collapse case-insensitive duplicate child environment keys on Windows so caller-provided overrides such as `PATH` cannot be shadowed by host `Path`.
+- Browser CLI: request the existing `operator.admin` gateway scope explicitly for browser control commands, avoiding unnecessary scope-upgrade approval loops. Fixes #81555. (#81716) Thanks @joshavant.
+- Web: honor explicitly configured global `web_search` providers during provider ownership resolution while keeping sandboxed `web_fetch` limited to bundled providers.
+- Plugins/doctor: repair configured legacy npm declaration stubs by reinstalling their npm packages into the managed plugin root instead of loading workspace `node_modules`, and warn when discovery sees those stubs. Fixes #79632. Thanks @Dylanzhang1128 and @vincentkoc.
+- Channels: keep configured third-party channel plugins visible in `openclaw channels list` when their manifest declares `channels` but has not added `channelConfigs` metadata yet. Fixes #81334. (#81340) Thanks @AllynSheep and @vincentkoc.
+- Agents: skip bootstrap file and hook preload work on completed `continuation-skip` turns when no workspace bootstrap is pending, reducing isolated-agent prep latency without changing first-turn bootstrap behavior. Fixes #81548. Thanks @delizaran-unpa.
+- Config: validate JSON dry-runs against plugin-owned channel schemas, so external channel fields are not rejected by stale bundled schemas. Fixes #77887. (#81504) Thanks @giodl73-repo.
+- iOS: restore first-use Contacts, Calendar, and Reminders permission prompts and add Privacy & Access status/actions in Settings. Thanks @BunsDev.
+- Canvas: return not found for malformed percent-encoded Canvas/A2UI/document asset paths and keep decoded parent traversal blocked before path normalization.
+- Telegram: allow trusted local Bot API media files whose filenames start with dots instead of falling back to remote download.
+- Agents/Codex app-server: remap injected context files under dot-dot-prefixed workspace directories when a run switches to an effective sandbox workspace.
+- Control UI/i18n: use the installed workspace pi runtime for locale refreshes, update the fallback package pin, and skip scheduled refreshes with invalid provider credentials instead of failing main.
+- CI/performance: authenticate the clawgrit report repository remote during both checkout and publish so performance report pushes do not fail after benchmarks complete.
+- Hooks: load workspace-relative legacy hook modules from dot-dot-prefixed directories without treating the filename prefix as parent traversal.
+- Plugins: preserve installed package metadata and persisted registry freshness checks for plugin package paths under dot-dot-prefixed directories.
+- Agents: allow dot-dot-prefixed filenames such as `..note.txt` through sandbox FS bridge, remote sandbox reads, and apply_patch summaries without mistaking the name for parent traversal.
+- CLI/migrate: hide per-item source/plugin hints on non-conflicting Codex skill and plugin selection prompts, keeping the hint text reserved for rows that actually need attention. Thanks @sjf.
+- Codex harness: treat high-confidence app-server OAuth refresh invalidation as a terminal auth-profile failure, stopping repeated raw token-refresh errors without turning entitlement or usage-limit payloads into re-auth prompts.
+- CLI/migrate: humanize Codex conflict-status messaging across the migrate UI so selection prompts and plan/result rows say "Codex skill already installed in workspace" instead of surfacing internal `MIGRATION_REASON_*` codes. Thanks @sjf.
+- CLI/migrate: render migrate result rows with distinct glyphs for manual-review (🔍) and archive (📖) items instead of the misleading "skipped" and "migrated" checkmarks, so users can see which entries still need attention versus which were filed away. Thanks @sjf.
+- CLI/migrate: split Codex migrate output into separate preview and result phases so the Before plan and After result render through clack with independently tunable copy. Thanks @sjf.
+- Codex app-server: project bundle and user MCP servers into Codex threads, rotate threads when an MCP server is disabled, scope bundle MCP injection to bundled servers, and resend user MCP config on resume so MCP changes take effect mid-session without restarting the agent. (#81551) Thanks @jalehman.
+- Codex migration: invoke the managed Codex binary instead of a stale system `codex` for source-config migration plans, so users running the bundled Codex runtime get plan output that matches the binary the gateway will actually use. (#81582) Thanks @fuller-stack-dev.
+- Subagents/maintenance: preserve pending subagent registry sessions during session-store cleanup, pruning, and disk-budget enforcement so in-flight subagent runs are not deleted by background maintenance before they complete. (#81498) Thanks @ai-hpc.
+- Control UI/chat: reconcile terminal and reconnect run cleanup with cached session activity, stale compaction/fallback indicators, and a compact composer run-status chip so completed or interrupted turns do not leave Stop active. Fixes #76874 and #64220; refs #71630. Thanks @BunsDev.
+- Maintainer tooling: clarify which pnpm test/check commands are safe locally versus inside Codex worktrees, routing linked-worktree gates through node wrappers and Crabbox/Testbox.
+- Auto-reply: preserve same-key ordering when debounced inbound work falls back to immediate flushes, so follow-up turns cannot overtake an active buffered flush.
+- Telegram/WhatsApp: keep Telegram same-chat replies ordered behind active no-delay turns without blocking WhatsApp follow-up message dispatch.
+- Codex migration: avoid duplicate cached plugin bundle warnings when app-server plugin inventory is available.
+- Agents: suppress aborted embedded assistant partials, reasoning text, reply directives, and stale prior replies before user-facing delivery while preserving clean timeout/error payloads. Fixes #48241. Thanks @BunsDev, @andyliu, and @yassinebkr.
+- Agents: allow dot-dot-prefixed filenames such as `..file.txt` inside workspace and sandbox path policy while still rejecting real parent traversal.
+- Native image input: detect Windows drive image paths in plain prompts so `C:\...\screenshot.png` references are not missed.
+- Media: normalize Windows-style filename hints before staging attachments, remote media, audio transcodes, and saved-media display names, so POSIX hosts do not preserve drive or directory text in generated filenames.
+- Media references: resolve first-level inbound media files whose IDs start with dots instead of treating names like `..photo.png` as parent traversal.
+- iOS/chat: resize PhotosPicker image attachments to capped JPEGs before staging and sending, stripping source metadata and keeping oversized camera photos under the chat upload budget. Fixes #68524. Thanks @BunsDev.
+- Control UI: keep shared form, config, and usage text-entry controls at 16px on touch-primary devices while preserving chat composer input sizing, so iOS Safari no longer auto-zooms focused fields. Fixes #64651; carries forward #64673. Thanks @NianJiuZst and @BunsDev.
+- Agents/trajectory: make the trajectory flush cleanup timeout configurable with `OPENCLAW_TRAJECTORY_FLUSH_TIMEOUT_MS`, preserving the 10s default while slower stores drain. Refs #75839. Thanks @BunsDev.
+- Skills: load ClawHub and local-manager skill-directory symlinks from managed `~/.openclaw/skills` and personal `~/.agents/skills` roots while keeping workspace, extra, bundled, and per-skill `SKILL.md` containment fail-closed. Fixes #44051. Refs #59219. Thanks @Devattom, @ArthurNie, and @luoxiao6645.
+- Config: return the canonical persisted config from `config.set`, `config.apply`, and `config.patch` responses after write-time shaping. Fixes #77455.
+- Codex auth: accept OAuth profiles backed by `oauthRef` during runtime auth selection, so official Codex OAuth logins are used by app-server agent runs. (#81633) Thanks @obviyus.
+- Telegram: release stopped polling leases after the gateway stop grace so in-process restarts can reuse the same bot token without weakening active duplicate-poller protection. Fixes #81507. (#81890) Thanks @joshavant.
+- ACP: preserve redacted numeric JSON-RPC `RequestError` details in runtime failure text, so backend diagnostics are visible instead of only `Internal error`. Fixes #81126. (#81188) Thanks @vyctorbrzezowski.
+- Agents: cache unchanged PI model discovery stores and model lookups, reducing repeated model-resolution startup latency under large model configs. Fixes #78851.
+- Onboarding: carry returned Codex plugin migration config through the OpenAI model wizard so accepted plugin migrations are saved with the final config write.
+- Security/Windows ACL audit: classify Anonymous Logon, Guests, Interactive, Local, and Network SIDs as world-equivalent principals so broadly writable paths stay critical instead of being downgraded to group-writable. Fixes #74350. (#74383) Thanks @dwc1997.
+- Media-understanding: retry transient remote attachment fetch failures before audio or vision processing, so Discord voice notes are not lost after one network/CDN blip. Fixes #74316. Thanks @vyctorbrzezowski and @gabrielexito-stack.
+- Control UI: order timestamped live stream and tool items before untimestamped history fallbacks, keeping chat history in visible time order. Fixes #80759. (#81016) Thanks @akrimm702.
+- ClawHub: cancel stalled archive body reads for skill, package, and ClawPack downloads instead of leaving installs hanging after headers arrive. Fixes #52073. Refs #80006. Thanks @xinhuagu and @stainlu.
+- macOS/Chat: render persisted assistant provider failures from `errorMessage` in refreshed chat history while keeping stale non-error provider details hidden. (#65689) Thanks @javierdici.
+- Control UI/config: discard stale redacted placeholders from form-mode config saves while preserving restorable saved secrets, so unrelated settings changes no longer submit `__OPENCLAW_REDACTED__` as real data. Fixes #60917. Thanks @giodl73-repo and @BunsDev.
+- OpenAI plugin: clarify remote Codex OAuth login copy so tunneled users know sign-in may finish automatically before they paste the redirect URL. (#81301) Thanks @rubencu.
+- SGLang: preserve replayed reasoning history for OpenAI-compatible chat completions, keeping thinking-capable local models from losing prior reasoning turns. (#81091) Thanks @akrimm702.
+- Plugins/install: derive managed peer dependency pins from npm's lockfile planner instead of recursively scanning `node_modules`, while keeping OpenClaw host peers out of managed root ownership and preserving active root-managed runtimes. Thanks @fuller-stack-dev.
+- OC Path: restore YAML/YML/.lobster support through the bundled YAML document parser and add `$first` positional addressing alongside `$last`.
+- Control UI/WebChat: keep short assistant replies clear of in-bubble copy/open action buttons by applying the existing reserved action spacing in the grouped chat renderer. Fixes #79509. (#81244) Thanks @JARVIS-Glasses.
+- Codex harness: make the live test wrapper portable to Windows and defer locked temp cleanup so native Windows and WSL2 live runs complete.
+- Telegram: discard legacy long-poll update offsets that cannot be tied to the current bot token, so token rotation no longer leaves bots silently skipping new messages. (#80671) Thanks @sxxtony.
+- browser: enforce navigation checks for act interactions [AI]. (#81070) Thanks @pgondhi987.
+- Validate node exec event provenance [AI]. (#81071) Thanks @pgondhi987.
+- Gateway: keep active reply runs visible to stuck-session diagnostics and clear no-active-work recovery state, preventing stale queued lanes after compaction or tool failures. Fixes #80677. (#81302)
+- Codex app-server: rotate incompatible context-engine-managed native threads so Lossless-managed sessions do not resume stale hidden Codex history. (#81223) Thanks @jalehman.
+- Codex cron: execute scheduled command-style automation payloads before workspace bootstrap or memory review, preserving existing isolated cron jobs after Codex harness migration. (#81510) Thanks @jalehman.
+- Plugin LLM completions: honor Codex agent-runtime policy for canonical OpenAI model refs, so context-engine summarizers can use Codex OAuth instead of requiring direct `OPENAI_API_KEY` auth. (#81511) Thanks @jalehman.
+- Gateway/OpenAI HTTP: return OpenAI-compatible 400 errors for invalid sampling params and provider validation failures instead of collapsing them to 500s. (#81275) Thanks @Lellansin.
+- Telegram: publish plugin and skill command description localizations to native command menus while filtering unsupported locale codes and preserving Telegram command limits. (#81351) Thanks @jzakirov.
+- Limit hook CLI tool authority [AI]. (#81065) Thanks @pgondhi987.
+- Require admin scope for node device token management [AI]. (#81067) Thanks @pgondhi987.
+- Restrict chat sender allowlist matching [AI]. (#80898) Thanks @pgondhi987.
+- Update: suppress the false newer-config warning during restart health probing after an update handoff, while keeping future-version mutation guards intact. (#78652)
+- Claude CLI: clear a reused stored session id after aborts or non-expired failover errors so the next turn does not resume a poisoned CLI session. Fixes #78785.
+- Sessions: redact persisted tool result detail metadata before writing transcripts so diagnostic secrets do not survive tool output redaction. (#80444) Thanks @nimbleenigma.
+- Codex runtime: allow the official installed `@openclaw/codex` package to use its private task-runtime and MCP projection SDK helpers, fixing `MODULE_NOT_FOUND` during migrated OpenAI/Codex beta runs.
+- Codex migration: make Enter activate the highlighted checkbox row before continuing, so `Skip for now` and bulk-selection rows work even when planned items start preselected.
+- Link understanding: fetch page content through the SSRF guard before running configured CLI summarizers, preventing curl/wget-style link fetchers from reaching private redirect or DNS-rebound targets.
+- fix: harden safe-bin argument validation [AI]. (#80999) Thanks @pgondhi987.
+- Codex/status: align `/codex status` rate-limit wording with `/status` by showing remaining quota and compact reset durations instead of used quota and raw ISO timestamps. Thanks @MatthewSchleder.
+- Mattermost: log a structured `mattermost no-visible-reply` diagnostic when a substantive (non-reasoning) final reply payload reaches `deliverMattermostReplyPayload` but the underlying `deliverTextOrMediaReply` returns `"empty"` — previously the run completed with a misleading `delivered reply to <channel>` log even though no Mattermost API send happened, masking silent completions in channel/thread contexts. No behavior change; the diagnostic surfaces the failure so operators can detect it instead of seeing the agent appear to go silent. Fixes #80501. Thanks @robbyproc87.
+- Telegram: limit concurrent startup `getMe` probes across multi-account bots so large Telegram configs do not fan out all account probes at once during gateway startup. Refs #80695. (#80986) Thanks @stainlu.
+- fix(config): reject auto-managed meta.lastTouched\* paths in config set/unset (#80856). Thanks @ai-hpc
+- Test state: seed isolated auth-profile secret keys for generated homes, preventing helper-backed proof runs from falling back to host Keychain secrets. (#81393) Thanks @altaywtf.
+- Plugins/update: clear stale allow/deny entries and selected plugin slots when disabling a plugin after update failure, keeping failed external plugin updates from leaving half-disabled config. (#81512) Thanks @JARVIS-Glasses.
+- Memory/LanceDB: make auto-capture recognize short CJK memory phrases and configurable literal triggers, so Chinese, Japanese, and Korean users can capture memories without regex or LLM intent detection. Fixes #75680. Thanks @vyctorbrzezowski and @guokewuming.
+- Plugins doctor: report stale plugin config warnings and avoid claiming full plugin health when config warnings remain. (#81515) Thanks @BKF-Gitty.
+- Sessions: display `model: "<agentId>-acp"` / `modelProvider: "acpx"` (ACP-runtime sentinel) for ACP control-plane sessions in `openclaw sessions` output, instead of the agent's configured model which was misleading. Catalog finding 20. (#79543)
+- Slack: normalize message read `before` and `after` timestamp bounds before calling Slack history or thread reply APIs. Fixes #80835. (#81338) Thanks @honor2030.
+- Gateway: throttle assistant/thinking agent event fanout during streaming bursts without dropping buffered deltas. (#80335) Thanks @samzong.
+- Models: restore authenticated CLI runtime providers in the `/models` picker while keeping legacy runtime aliases hidden from setup/default model choices. Closes #81212. (#81239) Thanks @anagnorisis2peripeteia.
+- Changelog gates: reject bot/app handles as `Thanks` attribution and require explicit human credit for bot/app-authored changelog entries. (#81357) Thanks @hxy91819.
+- Agents/heartbeat: fix seven layered issues that broke multi-agent heartbeat cadence — (1) fan out the scheduler broadcast wake across agents in parallel via `Promise.all` instead of awaiting each `runOnce` sequentially, so one agent doing real work no longer starves every later agent in iteration order; (2) scope `skipWhenBusy` to lanes attributable to the firing agent via session-key parsing of `session:agent:<id>:…` / `nested:agent:<id>:…` lane names, instead of consulting the global `subagent` lane, so a single stuck subagent on one agent no longer silently disables every other agent's heartbeat; (3) always append workspace `HEARTBEAT.md` directives (everything outside an optional `tasks:` block) to the dispatch prompt, so prose-runbook `HEARTBEAT.md` files reach the model directly instead of being silently dropped unless periodic tasks are declared; (4) race the initial stream-establishment promise inside `streamWithIdleTimeout` against the same watchdog timer that previously only guarded inter-token gaps, so SDK requests stuck at TCP/TLS handshake or before the first response byte no longer hang indefinitely (the stalled-session diagnostic's `recovery=none` case); (5) emit an `openclaw doctor` warning when `heartbeat.session` pins a session key that has no entry in the agent's session store, so silently-dropped heartbeat deliveries surface at config-validation time; (6) also route the commitment-only task dispatch path (tasks configured, none due) through `appendHeartbeatFileDirectives` so prose directives outside the `tasks:` block reach the model on this path as well; (7) wrap the synchronous `baseFn(...)` invocation inside `streamWithIdleTimeout` in a try/catch that clears the connect watchdog timer before rethrowing, so a provider stream function that throws during setup no longer leaves a live timer that can fire `onIdleTimeout` later with a stale error and keep the process open past the real failure. Thanks @zeroaltitude.
+- Matrix: stop running `npm install`/`pnpm install` at runtime from a parent-derived plugin path; missing Matrix runtime dependencies now fail with repair guidance instead of mutating the wrong `node_modules` tree. Fixes #80758. (#80876) Thanks @kinjitakabe.
+- Agents/memory-flush: surface non-abort memory-flush failures (provider timeout, transport error, generic agent failure) as visible reply payloads so the outer reply loop short-circuits and isolated cron runs propagate the error into `meta.error` instead of completing silently with `status: "ok"` and an empty payload. Previously only the specific "Memory flush writes are restricted to ..." message was surfaced. Fixes #80755. Thanks @nailujac.
+- Channels/loop-guard: enforce shared per-pair bot loop protection in the core channel-turn kernel, with Discord, Slack, Matrix, and Google Chat supplying bot-pair facts where they can reliably identify accepted bot-authored messages. The generic guard keys on `(scope, conversation, participant pair)`, suppresses every additional bot-to-bot event in either direction once a pair crosses the configured budget, and lifts suppression after `cooldownSeconds`. Defaults are `maxEventsPerWindow: 20`, `windowSeconds: 60`, and `cooldownSeconds: 60` whenever a channel lets bot-authored messages reach dispatch; they can be set globally via `channels.defaults.botLoopProtection` and overridden per channel/account or supported per-conversation config. Fixes #58789. Thanks @pandadev66.
+- Agents/memory-flush: surface non-abort memory-flush failures (provider timeout, transport error, generic agent failure) as visible reply payloads so the outer reply loop short-circuits and isolated cron runs propagate the error into `meta.error` instead of completing silently with `status: "ok"` and an empty payload. Previously only the specific "Memory flush writes are restricted to ..." message was surfaced. Refs #80755. Thanks @kinjitakabe and @nailujac.
+- Codex harness: use the active Codex runtime context window for OpenAI-selected budgeting, manual `/compact`, and `/status`, so stale OpenAI session metadata no longer overstates context limits. (#81906) thanks @jalehman.
+
diff --git a/CHANGELOG/2026.5.17.md b/CHANGELOG/2026.5.17.md
new file mode 100644
index 0000000000000000000000000000000000000000..980cb92b30c8747c5e91ae1db3349fb692f436c0
--- /dev/null
+++ b/CHANGELOG/2026.5.17.md
@@ -0,0 +1,321 @@
+## 2026.5.17
+
+### Changes
+
+- Control UI: move settings-only destinations into the Settings workspace and add sidebar recent-session shortcuts plus a one-click new-session action.
+- Control UI: speed up scoped settings pages by loading required config before schema refreshes, caching burst schema responses, and opening Communications on lighter message settings first.
+- Control UI: simplify the Cron Jobs workspace with modal job creation, collapsed filters, and an empty state aimed at first-time setup.
+- Security/audit: add `security.audit.suppressions` for intentionally accepted audit findings, keeping suppressed matches out of the active summary while preserving them in JSON output with an active suppression notice. (#76949) Thanks @100menotu001.
+- Agents/subagents: label delegated task and subagent completion handoffs as ready for parent review, and tell requester agents to review/verify results before calling them done. (#78985) Thanks @100menotu001.
+- Providers/media: add fal and OpenRouter music-generation providers for the shared `music_generate` tool, including fal MiniMax/ACE/Stable Audio endpoints and OpenRouter Lyria audio output.
+- Maintainer tooling: warn before running JS package commands on raw Crabbox AWS boxes, pointing maintainers to Actions hydration or Blacksmith Testbox for CI-like proof.
+- Control UI: show provider quota usage in the Overview card and Chat header, and recover stale Chat in-progress state after missed terminal events. (#82647)
+- Mac app remote setup can now be preconfigured from `openclaw-mac configure-remote`, skips onboarding when config is already complete, supports direct LAN/Tailnet gateway URLs, allows private same-origin Control UI loads, and owns the SSH tunnel process when SSH is selected.
+- Providers/xAI: add xAI Grok OAuth login for SuperGrok subscribers, letting `xai/*` models and xAI media/tool providers authenticate without `XAI_API_KEY`.
+- CLI/cron: add `openclaw cron run --wait` with timeout and poll interval controls, plus exact `cron.runs --run-id` filtering so automation can block on one queued manual run. (#81929) Thanks @ificator.
+- Maintainer tooling: route Crabbox skill defaults through the repo brokered AWS config, leaving Blacksmith Testbox as an explicit opt-in instead of the broad-proof default.
+- CLI/onboarding: localize the setup wizard and bundled channel setup flows for English, Simplified Chinese, and Traditional Chinese. (#80645) Thanks @GaosCode.
+- Agents/skills: cache hydrated `resolvedSkills` across warm gateway turns while keying reuse by the redacted effective config, reducing redundant skill snapshot rebuilds without crossing config-gated skill boundaries. (#81451) Thanks @solodmd.
+- Group chat: add core inbound event classification with opt-in `messages.groupChat.unmentionedInbound: "room_event"`, so always-on unmentioned room chatter can run as quiet context and speak visibly only via the message tool. (#81317) Thanks @obviyus.
+- Codex/context engines: bind thread-bootstrap projection epochs to Codex app-server threads, carry redacted tool-result context into fresh threads, and rotate backend threads when projection state changes. (#82351) Thanks @jalehman.
+- Agents/media: run `image_generate` through the shared async media-generation task lifecycle in session-backed chats, with task status, duplicate guarding, and message-tool completion delivery matching music/video.
+- Gateway: add opt-in restart trace logs for restart signal, active-work drain, close, next-start, ready, and memory spans. (#82396) Thanks @samzong.
+- Gateway/performance: split startup benchmark HTTP-listen timing from full gateway-ready timing and add post-bind plugin and sidecar diagnostics to restart-readiness traces. (#82603) Thanks @samzong.
+- QA-Lab: add a deterministic local personal-agent scenario pack covering reminders, threaded replies, scoped memory recall, redaction, and safe tool followthrough. (#78219) Thanks @iFiras-Max1.
+- QA-Lab: add `--pack personal-agent` for `openclaw qa suite` so maintainers can run the accepted personal-agent scenario pack by selector. (#82760) Thanks @iFiras-Max1.
+- QA-Lab: add a private Codex-vs-Pi runtime parity axis with runtime-pair suite runs, parity reports, and release-check wiring. (#80238) Thanks @100yenadmin.
+- Slack: add Slack assistant thread lifecycle support with assistant view manifest entries, suggested prompts, thread-scoped assistant sessions, and Slack-provided assistant context. Fixes #80787. Thanks @mobybot27.
+
+### Fixes
+
+- Codex/app-server: cover `/btw` side-question native hooks and app-server command approvals without relying on unsupported turn-scoped hook config. (#82559) Thanks @Kaspre.
+- Gateway/Docker: fail closed for non-loopback gateway starts without explicit shared-secret or trusted-proxy auth, and stop the image default command from bypassing config validation. Fixes #82865. (#82866) Thanks @coygeek.
+- Agents/followups: route queued followup turns through CLI runtime backends instead of embedded harness lookup, preventing `claude-cli`/`google-gemini-cli` followups from failing before delivery. Fixes #82847. (#82857) Thanks @hclsys.
+- CLI/sessions: let `openclaw sessions cleanup --fix-missing` prune malformed rows with unresolvable transcript metadata instead of throwing. Fixes #80970. (#82745) Thanks @IWhatsskill.
+- Gateway/usage: refresh large session usage summaries in the background and reuse durable transcript metadata so `sessions.usage` no longer blocks Gateway requests on full transcript rescans. Fixes #82773. (#82778) Thanks @hclsys.
+- CLI/MiniMax media: let `openclaw infer image describe --file` accept HTTP(S) image URLs without treating them as local paths, and keep automatic MiniMax image understanding routed through `MiniMax-VL-01` even when legacy MiniMax M2.x chat metadata claims image input. Fixes #82837. Thanks @mGaolin.
+- TUI: restore the submitted draft when chat is busy instead of clearing it or queueing another run. Fixes #45326. (#82774) Thanks @hyspacex.
+- Cron/memory: treat claimed `before_agent_reply` cron hooks as execution progress, so long memory dreaming promotion jobs are not aborted by the isolated-run pre-execution watchdog. Fixes #82811.
+- Discord: recover transcript-backed full answers when progress-mode final payloads are ellipsis-truncated, so long replies fall back to normal chunked delivery instead of replacing the preview with a shortened message. Fixes #82807. Thanks @blueberry6401.
+- Browser plugin: redact attach-details from Chrome MCP diagnostics and keep raw Chrome launch error output around long enough to surface in user reports without leaking sensitive paths.
+- System prompts: clarify MEMORY guidance over generic TTS hints in the embedded speech-core/system-prompt scaffolding so agents prefer memory-store usage over speech defaults. Fixes #81930. Thanks @giodl73-repo.
+- Agents/auth: include the checked credential source in missing API key errors, so users can see which env var, profile, or config path to fix. Fixes #82785. Thanks @loeclos.
+- Providers/GitHub Copilot: hash Responses replay item ids with sha256 instead of a weak 32-bit hash and build same-provider Copilot tool-call ids distinctly, so concurrent tool-call replays no longer collide and reject follow-up turns.
+- Agents/replay: normalize malformed assistant replay content before transport conversion while preserving empty-stop replay repair, so bad provider history no longer crashes with non-iterable content. Fixes #43795. (#82748) Thanks @IWhatsskill.
+- Gateway/macOS: write LaunchAgent stdout under `~/Library/Logs/openclaw`, suppress stderr, and attach stdin to `/dev/null` so launchd startup avoids symlinked state-dir log failures and silent module-evaluation hangs. Fixes #40207 and #46153. Thanks @dhruvkelawala and @frankr.
+- CLI/configure: let model-only section setup enter provider auth directly instead of first asking where the Gateway runs, unblocking OAuth/token setup in terminals where that unrelated prompt is unresponsive. Fixes #39223. Thanks @LevityLeads.
+- Providers/Anthropic-messages: extract `reasoning_content` from `thinking` blocks during assistant replay so proxy providers that route through the Anthropic-messages transport preserve reasoning context across tool-call follow-up turns. Thanks @Sunnyone2three.
+- Agents/GitHub Copilot: normalize replayed Responses tool-call IDs before dispatch so resumed sessions with historical overlong tool IDs continue instead of failing Copilot schema validation. (#82750) Thanks @galiniliev.
+- CLI/infer: resolve plugin-scoped web search and fetch SecretRefs on the exact command credential surface, keeping non-selected and unrelated plugin secrets inactive. Fixes #82621. (#82699) Thanks @leno23.
+- Providers/Anthropic Vertex: resolve installed provider public surfaces from package-local `dist/`, restoring `anthropic-vertex/*` model calls after plugin externalization. Fixes #82781. Thanks @0L1v3DaD.
+- Gateway/exec approvals: bind path-shaped allowlists, safe-bin trust, skill auto-allow, Allow Always persistence, and approval audit metadata to the executable realpath so symlinked binaries cannot keep approvals after retargeting. Fixes #45595. Thanks @jasonftl.
+- Mac app: reorganize Settings around a grouped sidebar, with separate Connection and Exec Approvals pages so everyday permissions and app toggles are easier to scan.
+- Mac app: redraw the animated menu bar critter to match the rounded app mascot with antennae, side arms, two feet, and smoother template rendering.
+- Mac app: cache settings config schema/drafts and load channel config in parallel with channel probes, making repeated Channels and Config tab switches responsive over remote tunnels.
+- Control UI: negotiate the Gateway protocol from shared constants so rebuilt dashboards connect to current gateways instead of reporting a protocol mismatch.
+- Mac app: let menu gateway/session error text wrap across a few lines and stop rebuilding dynamic Context/Gateway menu rows while the menu is open, reducing flicker.
+- QA-Lab: expose Codex runtime tools during private parity runs and treat completed structural/tool-shape runtime drift as advisory, while preserving real runtime failures as lane blockers.
+- Mac app: make device pairing approval sheets friendlier, with concise Mac/device copy, shortened identifiers, friendly scope labels, and Approve as the primary action.
+- Providers/Qwen: honor session thinking level for `qwen-chat-template` payloads so `/think off` disables nested llama.cpp chat-template thinking controls. Fixes #82768. Thanks @bfox55.
+- Feishu/wiki: reject numeric wiki space IDs before creating Lark clients and keep numeric-looking IDs documented as quoted opaque strings, preventing JavaScript precision loss in knowledge base calls. Fixes #45301. (#82769) Thanks @hyspacex.
+- Control UI: simplify Talk settings to Voice, Model, and Sensitivity defaults, with provider, transport, exact VAD, and timing controls behind Advanced.
+- Telegram: let catch-all mention patterns match captionless group photos, so media-only group messages reach the agent when the group is intentionally configured to respond to all messages. Fixes #44833. (#82756) Thanks @IWhatsskill.
+- Gateway/pairing: reject forged loopback Control UI origins from non-local proxy paths, and keep mobile pairing setup on Tailscale bind mode pointing users to Tailscale Serve/Funnel instead of cleartext tailnet WebSockets.
+- Telegram/Gateway: persist isolated polling offsets only after main-thread dispatch and preserve gateway caller scopes for Telegram message actions, fixing consumed-but-unrouted polling updates and recursive CLI send scope approvals. Fixes #82277. (#82705) Thanks @udaymanish6.
+- Memory-core: abort timed-out embedding provider calls so remote embedding HTTP requests do not continue running after memory query or indexing timeouts. Fixes #82732. Thanks @adityarya24.
+- Channels/stream previews: contain rejected background draft-stream flushes so preview send failures do not surface as fatal unhandled rejections. Fixes #82712. (#82713) Thanks @coygeek.
+- Codex/app-server: keep shared native app-server clients isolated per agent runtime key so starting one agent no longer closes another agent's active Codex turn. Fixes #82758. Thanks @PashaGanson.
+- Providers/OpenAI Codex: include base `gpt-5.5` and `gpt-5.4` reasoning metadata in the bundled Codex catalog so `/think xhigh` remains available for those models. Fixes #82744.
+- Providers/OpenAI Codex: keep the native hook relay as the final Codex app-server thread config patch so hook-backed approvals stay enabled even when lower-priority config disables hooks. Thanks @solomonneas.
+- Providers/MiniMax: declare CN endpoint auth aliases in the plugin manifest so `minimax-cn` and `minimax-portal-cn` reuse the correct base auth profiles instead of falling back to unrelated models after 401s. Fixes #63823. Thanks @kamusis.
+- Secrets/audit: treat `$VAR` auth-profile values as env SecretRefs and stop reporting env-ref credentials as plaintext, including mixed `keyRef` plus env-ref profile states. Fixes #53998. Thanks @schirloc and @artwalker.
+- Agents/model fallback: suppress fallback notices when the active OpenAI Codex runtime reports the same canonical OpenAI model.
+- Agents/music generation: remove model-controlled request timeouts, default internal provider requests to five minutes, and keep configured timeouts at a 120-second floor.
+- Cron: let isolated best-effort deliveries send the parent result immediately while fire-and-forget subagents keep running, avoiding false run timeouts. Fixes #44428. Thanks @amknight.
+- Agents/media generation: stop logging delivered failure summaries as missing message-tool delivery when no generated media was expected.
+- Agents/sessions: prioritize manual user turns ahead of queued cron and maintenance work in the same session lane, so visible follow-ups no longer wait behind background runs. Fixes #82764. (#82765) Thanks @galiniliev.
+- Agents/edit tool: honor `file_path` and related path aliases when resolving edit-recovery targets, so post-write errors no longer surface false edit failures after the file actually changed. Fixes #81909. Thanks @giodl73-repo.
+- QQBot: treat only explicit truthy `QQBOT_DEBUG` values as enabling debug logs, so false-like values such as `0` no longer expose debug output. Fixes #82644. (#82697) Thanks @leno23.
+- Agents/session_status: resolve implicit no-arg status lookups against the live run session, so `/think` changes report the current thinking level instead of stale sandbox state. Fixes #82669. (#82696) Thanks @leno23.
+- Discord: keep progress drafts visible for message-tool-only guild replies under the default coding tool profile. Fixes #82747. Thanks @eliranwong.
+- Agents: prefer current structured assistant final answers when assembling final reply payloads, reducing reliance on streamed preview fragments after channel transcript recovery. (#82850) Thanks @joshavant.
+- Discord: keep unmentioned room-event history until a visible Discord send succeeds, so quiet ambient context does not disappear before message-tool delivery. (#82573) Thanks @obviyus.
+- CLI/setup: order the model/auth provider picker as OpenAI, Anthropic, xAI, Google, then the remaining providers alphabetically.
+- Diagnostics/usage/voice-call: treat explicit zero and non-finite limits as empty results and reject invalid voice-call numeric CLI flags. Fixes #82646, #82650, #82651, and #82653. (#82679) Thanks @leno23.
+- CLI/config: avoid redundant startup config/plugin checks for the guided `openclaw config` flow and show progress while source checkout CLI artifacts build or load.
+- Config/Mac app: accept `gateway.remote.remotePort` in core config validation so Mac SSH remote setup stays compatible with the CLI.
+- Gateway/diagnostics: add opt-in critical memory pressure stability snapshots with gateway logs, V8 heap, cgroup, active-resource, and redacted large session-file evidence. Fixes #82518.
+- Doctor/Gateway: avoid treating unrelated macOS LaunchAgents as legacy gateways just because their environment values mention old checkout paths.
+- Gateway/heartbeat: defer heartbeat runs while the target reply operation is queued or active, preventing heartbeat prompts from interleaving with WebChat responses before the streaming lane starts. Fixes #82722. Thanks @Andy-Xie-1145.
+- CLI/setup: collapse raw gateway config keys in existing-config summaries into friendly `Model` and `Gateway` rows.
+- CLI/config: show concise human config-write output with an indented backup path instead of printing checksum-heavy overwrite audit details by default.
+- Skills/onboarding: hide brew-only dependency installers in Linux containers without Homebrew and show container-specific guidance instead of a broken install path. Fixes #14593. Thanks @amknight.
+- CLI/docs: call the canonical lowercase docs MCP search tool and surface MCP errors instead of returning empty search results. Fixes #82702. (#82704) Thanks @hclsys.
+- QA-Lab: add gateway log sentinels for plugin hook failures, Codex app-server stalls/timeouts, cron allowlist drift, live quota blockers, and direct-reply self-message transcripts so harness proof fails on self-health regressions. (#80323) Thanks @100yenadmin.
+- QA-Lab: ignore heartbeat-only operational transcripts when capturing runtime parity cells so background checks cannot replace the scenario reply. (#80323) Thanks @100yenadmin.
+- QA-Lab: pin threaded-memory parity runs to `memory-core`, keep bundled plugin resolution enabled for QA commands, and retry transient session-store lock reads. (#72045) Thanks @WuKongAI-CMU.
+- QA-Lab/qa-channel: keep mock memory ranking, inbound media notes, and opened-file realpath checks stable for mock OpenAI qa-channel runs. (#66826) Thanks @gumadeiras.
+- Gateway/exec approvals: wait for accepted async approval follow-up runs instead of direct-fallback sending duplicate completions when retries use different nonce keys. Fixes #82711. (#82717) Thanks @udaymanish6.
+- Agents/subagents: mark completed subagent handoffs as ready for parent review so requester agents verify results and continue required follow-up work before reporting done. (#82724) Thanks @100menotu001.
+- QA-Lab: validate Capture saved views loaded from browser storage so malformed local state cannot poison Capture inspector filters or layout controls. (#77722) Thanks @AsaZhou923.
+- Agents/performance: reuse prepared plugin manifest metadata across local CLI turns, model catalog normalization, auth lookups, and tool capability checks, restoring fast pre-provider startup for plugin-heavy installs. Thanks @shakkernerd.
+- CLI/config: add `--dry-run` support to `openclaw config unset`, with `--json` output and allow-exec validation parity with `config set`/`config patch` dry-run handling. (#81895) Thanks @giodl73-repo.
+- CLI/infer: resolve command SecretRefs before local provider-backed capability runs, so web search/fetch and other local infer commands can use plugin-scoped credential refs. Fixes #82621. (#82798) Thanks @joshavant.
+- Memory-core: retry disabled dreaming cron cleanup until cron is available after startup, so persisted managed dreaming jobs are removed after restart. Fixes #82383. (#82389) Thanks @neeravmakwana.
+- Providers/xAI: keep retired Grok 3, Grok 4 Fast, Grok 4.1 Fast, and Grok Code slugs out of model pickers while preserving compatibility resolution for existing configs.
+- Providers/xAI: replace the retired `grok-imagine-image-pro` image model with `grok-imagine-image-quality` in the bundled image-generation provider and docs. (#81399) Thanks @KateWilkins.
+- Providers/OAuth: let browser-hosted identity provider pages read successful localhost callback responses, preventing xAI Grok OAuth from showing a false connection failure after OpenClaw completes login.
+- Gateway/security: reject malformed HTTP and WebSocket request targets with the existing auth failure response instead of letting invalid URL parsing crash the Gateway. Fixes GHSA-6hc3-f4rg-377m.
+- Browser/CDP: redact credential-bearing Chrome MCP and managed Chrome launch diagnostics, and require exact loopback entries before treating `NO_PROXY` as already covering local CDP proxy bypasses.
+- Gateway/auth: reuse prepared startup auth SecretRef snapshots when the gateway startup config is unchanged, avoiding duplicate runtime secret preparation. (#82991) Thanks @samzong.
+- Gateway/diagnostics: redact credential-bearing gateway target URLs and client diagnostics while preserving raw connection URLs for programmatic use, so connect-failure logs no longer surface embedded tokens.
+- Gateway/auth: honor `OPENCLAW_GATEWAY_TOKEN` as the remote interactive fallback when no remote token is configured, keeping remote TUI setup aligned with documented auth precedence.
+- Providers/xAI: continue polling video generations while xAI reports in-flight jobs as `pending`, so Grok video requests no longer fail before the final `done` response. (#82610) Thanks @Manzojunior.
+- Logs: redact raw Basic auth and named security headers from `logs.tail` output before returning lines to read-scoped clients. Fixes #66832. Thanks @Magicray1217.
+- CLI/gateway: emit structured JSON for gateway transport close/timeout failures when `--json` is requested by health, gateway health, and devices list commands. Fixes #79108. Thanks @TurboTheTurtle.
+- Agents/Telegram: retry Bedrock non-visible terminal turns and mark non-deliverable attempts as trajectory errors instead of silent success. Fixes #82394. (#82905) Thanks @joshavant.
+- Telegram: normalize announce group targets via a new `resolveSessionTarget` channel hook so scheduled announcements resolve consistently against the same Telegram session conversation registry as inbound turns. Fixes #81229. Thanks @giodl73-repo.
+- QA/RTT: let `pnpm rtt` lease Convex-backed Telegram credentials while preserving RTT sample counts, sample timeouts, and result stats on the RTT harness path.
+- Discord: bind delayed gateway `identify` retries to the originating socket generation so retries triggered after a reconnect do not identify against a fresh socket. Fixes #82225. Thanks @giodl73-repo.
+- ACP/control plane: refresh cached runtime handles when agent config changes so ACP sessions stop using stale runtimes after `agents.defaults` edits. Fixes #82237. Thanks @giodl73-repo.
+- Gateway/sessions: scope session data lookups by agent id so multi-agent gateway state cannot cross-leak session records across configured agents. (#81386) Thanks @pgondhi987.
+- Gateway/restart: mark active main sessions as restart-aborted before forced restarts so startup recovery can resume interrupted turns instead of leaving them stranded as running. Fixes #82433. (#82772) Thanks @joshavant.
+- Gateway/heartbeat: report heartbeat runner failures with background-specific copy instead of foreground `/new` recovery guidance. Fixes #82708. (#82848) Thanks @joshavant.
+- Agents/media: require generated music/video completion agents to use the message tool for visible delivery and stop merging generated image attachments into message-tool-only source reply mirrors, avoiding direct fallback posts that can duplicate media the model already sent.
+- Agents/media: accept generated media attachments on internal completion events and report delivery-loss failures as errors, so completed background music/video tasks do not disappear after provider success.
+- Matrix/approvals: release in-flight reaction bindings when the channel approval handler stops mid-delivery, preventing stale approval targets after restart. Fixes #82485. (#82482) Thanks @Feelw00.
+- Matrix/E2EE: stop requesting MSC4222 `state_after` sync responses so homeservers with incomplete state-after data do not leave fresh encrypted rooms without outbound room encryptors. Fixes #82515. Thanks @nickdecooman.
+- TUI: update the displayed model in real time when an auto-fallback resolution swaps in a different model mid-turn, so the status line reflects the actual model handling the run. Fixes #82296. Thanks @giodl73-repo.
+- Gateway/sessions: estimate context usage from local/OpenAI-compatible transcripts when provider usage telemetry is missing, so status no longer shows empty usage for real local-model sessions. Fixes #73990. (#82317) Thanks @giodl73-repo.
+- Update/installers: override npm `min-release-age` quarantine for OpenClaw-managed package installs, so `openclaw update`, plugin updates, and hosted installer scripts can install the requested latest release immediately.
+- Agents/sessions: preserve fresh post-compaction token snapshots across stale usage updates, preventing repeated auto-compaction after every message. Fixes #82576. (#82578) Thanks @njuboy11.
+- Agents/replies: preserve active inbound reply context at the LLM boundary so Discord referenced-message turns do not answer from stale session history. Fixes #82608. (#82801) Thanks @joshavant.
+- Agents/sessions: expose session transcript lock stale and max-hold tuning, and release the embedded run's coarse transcript lock before model I/O while locking persistence and cleanup separately. Fixes #13744. Thanks @amknight.
+- Agents/OpenAI Responses: log redacted diagnostics for detail-less `response.failed` events while preserving failed response ids, so operators can correlate provider-side failures. Fixes #82558.
+- Agents/OpenRouter: strip non-replayable Anthropic/xAI reasoning provenance tags from follow-up requests, preventing poisoned thinking signatures from breaking second turns. Fixes #82335. (#82380) Thanks @hclsys.
+- Providers/xAI: send configurable reasoning effort only for Grok 4.3, preserving xAI's default low reasoning while omitting unsupported controls for Grok 4.20 reasoning models. (#81227) Thanks @jason-allen-oneal.
+- Image generation: raise Google, OpenRouter, and xAI hosted provider default timeouts to 180 seconds so slow hosted image requests have more time to complete. (#75337)
+- Agents/auth: redact OAuth refresh failure causes against in-memory, attempted, and reloaded credentials before generic token masking while ensuring failed ACP dispatch cleanup closes initialized runtimes.
+- Google/Gemini CLI OAuth: add provider-owned refresh support for `google-gemini-cli` so expired Gemini CLI tokens refresh in OpenClaw instead of falling through to the generic unknown-provider path. Fixes #42541. Thanks @jason-allen-oneal.
+- Agents/Anthropic transport: replay `reasoning_content` from compatible thinking blocks for Xiaomi/MiMo-style Anthropic Messages routes, preventing follow-up turns from losing required reasoning context. Fixes #81261. Thanks @Sunnyone2three.
+- Telegram: cache successful startup bot identity by account and token fingerprint for up to 24 hours, so restarts can skip redundant `getMe` probes during Telegram API slow periods without permanently pinning renamed bots. Refs #82525.
+- Telegram: keep streamed text replies in place when delayed TTS audio arrives, sending the audio as a follow-up instead of deleting the preview. Fixes #82570. (#82820) Thanks @joshavant.
+- Channels/TTS: deliver TTS supplements across live-preview channels without duplicating text replies, covering WebChat, Telegram, Discord, Slack, Mattermost, and Matrix. (#82935) Thanks @joshavant.
+- Gateway/sessions: discard stale metadata when recreating dead main session rows, so replacement sessions do not inherit old labels or transcript paths.
+- Codex app-server: mark native context compaction completion events as successful, preventing false "Compaction incomplete" notices after successful Codex-managed compaction. Fixes #82470. (#81593) Thanks @Kyzcreig.
+- Codex app-server: keep long-running turns alive while current-turn approvals, user input, dynamic tools, and notifications make progress, and carry that progress into the outer run timeout. (#82601) Thanks @100yenadmin.
+- Gateway/channels: hand off traced channel account startup outside the startup diagnostic phase so long-lived channel tasks do not keep liveness warnings pinned to channel startup. Refs #82398.
+- Gateway/restart: queue restart and shutdown signals received while the gateway startup loop is still returning its server handle, so startup-time restarts are not dropped during update churn. (#82660) Thanks @samzong.
+- Gateway/restart: carry operator restart intent reasons into macOS LaunchAgent restart traces, so cascade diagnostics identify `gateway.restart` instead of a bare SIGTERM.
+- GitHub Copilot: route device-login requests through the plugin SSRF guard with a GitHub-only policy.
+- Group/channel replies: keep message-tool-preferred final replies private when the agent misses the message tool, and log suppressed payload metadata in the gateway debug log for quieter diagnosis.
+- Gateway/WebChat: route image attachments through a configured vision-capable `imageModel` plan before inlining images, and carry that image-model fallback chain through runtime retries. (#82524) Thanks @frankekn.
+- macOS app: open the Dashboard in a native WebKit window with standard macOS traffic-light controls, keep the Dock icon visible by default, and reuse the app's connected gateway auth for automatic Control UI login.
+- WebChat: show progress while manual `/compact` is running by streaming a session operation event to subscribed Control UI clients. Fixes #82407. Thanks @Conan-Scott.
+- Codex app-server: limit canonical OpenAI Codex app-server attribution rewrites to local transcript and trajectory records, leaving runtime/tool routing on the selected OpenAI model metadata so OpenAI API-key backup profiles keep their billing path.
+- Codex app-server: hide native tool-search control tools from dynamic tool exposure while preserving the message tool.
+- Android/chat: make bare and markdown URLs in chat messages tappable by preserving Compose URL annotations in rendered markdown. Fixes #82187. (#82392) Thanks @neeravmakwana.
+- Plugins/doctor: migrate legacy top-level plugin `tools` declarations into `contracts.tools`, so `openclaw doctor --fix` repairs local plugins for the manifest tool contract. (#81112) Thanks @100yenadmin.
+- Slack: guide agents to use stable `<@USER_ID>` mention tokens from context instead of plain `@name` text, so user mentions link and notify correctly. Fixes #82090. (#82152) Thanks @neeravmakwana.
+- Auth: serialize provider login writes through the auth-profile lock for OpenAI Codex, Anthropic, Cloudflare AI Gateway, GitHub Copilot, and z.ai, preserving upsert semantics so a live Gateway cannot overwrite freshly refreshed OAuth credentials with an expired in-memory snapshot.
+- Auth/Codex: remove runtime support for `oauthRef` sidecar-backed OAuth profiles and add a doctor repair that migrates affected Codex profiles back to inline `auth-profiles.json` credentials. (#82777) Thanks @joshavant.
+- Slack: keep DM thread replies on the main direct-message session instead of routing them to invisible thread-scoped sessions. Refs #82390. (#82418) Thanks @kagura-agent.
+- Auth/macOS: avoid creating the OAuth profile master key in Keychain automatically, falling back to the file-backed secret key so headless agents do not trigger a Keychain prompt.
+- Codex app-server: release raw assistant completions when `turn/completed` is missing while keeping commentary/status items as progress, preventing completed Codex runs from hanging until timeout. Fixes #82343. (#82403) Thanks @IWhatsskill.
+- Codex app-server: keep a bounded terminal guard after post-tool raw assistant completions so missing `turn/completed` events fail fast instead of leaving embedded runs stuck. Fixes #82775. (#82816) Thanks @joshavant.
+- Agents/sessions: remove the transient `*.bak-<pid>-<ts>` backup written by `repairSessionFileIfNeeded` once the atomic replace succeeds, so a stuck session with a persistently malformed JSONL line no longer accumulates one snapshot per repair invocation. Fixes #80960. (#80969) Thanks @100yenadmin. Co-authored by @tynamite.
+- CLI/status: show plain empty-state messages instead of empty Channels and Sessions tables when no channels or sessions exist.
+- CLI/dashboard: probe Gateway readiness before handing out the dashboard URL, prompting to start or install the managed service when the Gateway is stopped and printing recovery commands instead of opening a dead browser tab.
+- CLI/dashboard: treat Gateway `device identity required` probes as proof that the dashboard listener is reachable, so `openclaw dashboard` can still open the Control UI.
+- CLI: hide decorative startup and status emoji on terminals that are unlikely to render them correctly, keeping semantic message and identity emoji intact.
+- CLI/gateway: recover the Linux user systemd bus environment when `openclaw dashboard` starts the Gateway from stripped desktop shells such as VNC terminals.
+- Gateway/WebSocket: log expected startup `1013 gateway starting` retry closes at debug instead of warn while preserving WARN for unexpected pre-connect failures. Fixes #76361. (#82457) Thanks @IWhatsskill.
+- Providers/Xiaomi: strip synthetic empty array `items` from MiMo tool schemas while preserving typed array items, avoiding strict OpenAI-compatible schema rejection.
+- Telegram: send the transcript-backed full final answer after progress-mode tool drafts when the dispatcher final payload is an ellipsis-truncated snapshot. Fixes #82409. Thanks @PashaGanson.
+- Providers/Ollama: omit truthy native `think` payloads for models marked non-reasoning while preserving supported thinking models and explicit `think: false`. (#82445) Thanks @leno23.
+- Update/channels: preserve pre-update channel config through package-swap doctor and post-core plugin repair so externalized channel upgrades do not drop configured chat channels. Fixes #82533. Thanks @imbaig.
+- Update/doctor: repair configured externalized plugin installs during legacy 2026.4.x upgrades so configured Discord channels remain available after 2026.5.x package updates. Fixes #82813. (#82859) Thanks @joshavant.
+- CLI/context engines: bootstrap and finalize non-legacy context engines for CLI turns while preserving transcript snapshots and deferred maintenance ownership. (#81869) Thanks @sahilsatralkar.
+- Telegram: persist polling updates through restart replay so queued same-topic messages resume in order instead of losing context after a gateway restart. (#82256) Thanks @VACInc.
+- Gateway/Gmail: abort in-flight Gmail watcher startup and hot-reload restarts before shutdown so reloads cannot spawn `gog serve` after the Gateway is closing. Thanks @frankekn.
+- Agents/Codex: fall back to the embedded PI runner when OpenAI's implicit Codex harness preference cannot find a registered Codex plugin, preventing OpenAI-compatible gateway requests from failing with an unregistered harness error. Fixes #82437.
+- Agents/OpenAI: honor `openai-codex:*` entries placed ahead of API-key backups in `auth.order.openai` for explicit OpenAI PI runs, and accept `models auth login --provider openai-codex --device-code` for headless sign-in. Fixes #82521. (#82605)
+- CLI/channels: install missing externalized same-id channel plugins during `channels add --channel <id>`, so recovery for WhatsApp and other externalized stock channels does not require a separate `plugins enable` step. Fixes #82533.
+- Windows node install: launch the node host through a hidden Windows launcher so login startup does not leave a persistent `cmd` window open. Fixes #81254.
+- MCP plugin tools: forward host MCP `tools/call` `AbortSignal` through `createPluginToolsMcpHandlers().callTool` into plugin `tool.execute`, so host cancellation actually cancels in-flight plugin tool calls instead of letting them run to completion. Fixes #82424. (#82443) Thanks @joshavant.
+- Agents/sandbox: honor explicit Docker sandbox env variables with credential-looking names during container creation, and recreate affected sandbox containers when the effective env policy changes. Fixes #82695. (#82763) Thanks @joshavant.
+- Plugins: accept deprecated `api.on("deactivate")` registrations as a dated compatibility alias for `gateway_stop`, so external plugin cleanup handlers run on Gateway shutdown while authors get migration guidance.
+- Plugins: resolve bundled entry, dist-runtime, package-state, and public artifact paths from packaged roots, so bundled plugin probes and hardlinked public surfaces no longer fall back to source files or fail during restart. Fixes #78462. Fixes #75797. Refs #76865. Thanks @ginishuh and @ymebosma.
+- Media: ignore image MIME and filename hints when bytes sniff as generic containers, so zip/octet-stream payloads mislabeled as images do not become local image media or keep image file extensions when staged.
+- Update/doctor: avoid materializing `groupAllowFrom` for channel schemas that reject it, so package-swap doctor repairs do not fail on externalized Slack configs.
+- Gateway/media: prevent image filenames from overriding generic non-image byte sniffing, so zip/octet-stream payloads mislabeled as images are offloaded or rejected before they become inline image attachments.
+- Plugins/web search: downgrade stale optional provider installs to warnings so Gateway and doctor repair paths keep running after startup provider selection. Refs #82313. Thanks @crackmac.
+- Telegram/Gateway: route targeted Telegram `/stop@bot` messages onto the control lane without cached bot metadata and match gateway stop requests across raw/canonical session aliases. (#82298) Thanks @VACInc.
+- MS Teams/media: sniff inline `data:image/*` attachment bytes before staging them, skipping payloads that are not actually images.
+- WebChat/media: require trusted local-media provenance before preserving local audio reply paths for display, so untrusted audio-looking paths go through normal staging and read-policy checks.
+- WebChat: trust local Auto-TTS audio on block-streamed replies, including ACP-dispatched tails, so synthesized browser audio renders instead of being silently dropped. Fixes #82628. (#82701) Thanks @leno23.
+- Agents/tool media: preserve trusted local-media provenance when merging generated tool attachments into final reply payloads, so trusted audio/media survives outbound display normalization.
+- Anthropic/Claude CLI: write model-scoped `claude-cli` runtime policy when reusing local Claude CLI auth, so upgraded Telegram and Dashboard gateway turns keep using the CLI backend instead of falling through to Anthropic API billing. Fixes #82344. Thanks @amknight.
+- Update: let package-swap `doctor --fix` persist core config repairs while plugin schemas are still converging, preventing update failures on externalized channel configs.
+- Update: carry plugin-validation bypasses into config mutation pre-write reads, so package update doctor repairs can finish while externalized plugin schemas are converging.
+- Update/doctor: keep plugin-validation bypasses on the top-level `$include` config write path, so package repair can update included plugin config files without flattening them into the root config.
+- Agents/subagents: warn and continue completion announce cleanup when lifecycle cleanup fails, preventing ended subagent runs from becoming silent ghosts. Fixes #82306. Thanks @SebTardif.
+- Telegram: let authorized text `/stop` commands use the fast-abort path before queued agent work, so active turns stop immediately instead of processing the abort after the turn finishes; foreign-bot `/stop@otherbot` mentions now stay on the regular topic lane instead of being routed into our control lane. Fixes #82162. Thanks @civiltox.
+- Sessions: drop persisted entries with invalid session ids and strip malformed transcript file metadata before hydrating session runtime state.
+- Auth/device: normalize malformed persisted device-auth token metadata before returning or preserving token entries.
+- Pairing: skip malformed persisted pending pairing requests before approving valid channel pairing codes.
+- Commitments: strip malformed optional reminder scope metadata from persisted commitments before matching pending follow-ups.
+- Config persistence: normalize malformed auth profile credential fields/state, skip JSON-valid garbage transcript checkpoint rows, and let `openclaw doctor --fix` remove unrepairable cron job rows.
+- Cron: skip persisted job rows with malformed schedule or payload shapes in memory, leaving the store for `openclaw doctor --fix` instead of hydrating them into runtime state.
+- Cron: keep legacy string schedules and blank system-event jobs available for runtime repair/skip handling instead of dropping them as malformed persisted rows.
+- Task persistence: drop malformed array/scalar requester-origin JSON from task and task-flow SQLite sidecars instead of restoring it as delivery metadata.
+- Agents/timeouts: clarify model idle-timeout errors and docs so provider `timeoutSeconds` is shown as bounded by the whole agent/run timeout ceiling.
+- Agents/OpenAI streams: yield cooperatively while processing bursty Completions and Responses chunks, keeping aborts, channel liveness timers, and startup heartbeats responsive under noisy model output. Refs #82462.
+- Media/images: avoid broad model/plugin discovery while preparing image requests, preventing Windows event-loop stalls that could block Telegram polling. Fixes #82338. (#82799) Thanks @joshavant.
+- Release tooling: align the published launcher Node floor, `npm start`, package script checks, sharded lint locking, Vitest root project coverage, and plugin-SDK declaration build cache metadata so release/package validation does not silently skip or ship stale surfaces.
+- Cron/agents: honor configured subagent model fallbacks for isolated scheduled runs and forward that fallback policy into embedded agent timeout failover. Fixes #74985. Thanks @chrisgwynne.
+- Codex app-server/MCP: scope user MCP servers to specific OpenClaw agent ids through an optional `mcp.servers.<name>.codex.agents` list and accept `codex.defaultToolsApprovalMode` (`auto`/`prompt`/`approve`) for native Codex approval defaults; OpenClaw strips the `codex` block before handing `mcp_servers` config to Codex. (#82180) Thanks @sercada.
+- Agents/OpenAI Responses: clamp `input_tokens - cached_tokens` at zero and reconstruct `totalTokens` from input + output + cached components so Responses-API streams report consistent usage when providers under-report `input_tokens` relative to `cached_tokens`.
+- Agents: mark adapter-caught tool execution failures as error tool results in embedded Pi sessions, so models can retry recoverable edit failures instead of seeing a successful tool result. Fixes #81546. (#81564) Thanks @najef1979-code and @MonkeyLeeT.
+- Plugins: reject malformed `package.json` `openclaw.extensions` metadata during install, discovery, and post-update payload smoke instead of silently dropping invalid entries.
+- Plugins: reject package metadata records whose `package.json` resolves outside the plugin root instead of trusting persisted or reconstructed registry snapshots.
+- Plugins: ignore malformed persisted package channel/install metadata instead of crashing catalog reconstruction or leaking invalid install hints.
+- Plugin releases: reject package `files` negations that would omit advertised package-local runtime entries from npm plugin tarballs.
+- Media/files: sniff `input_file` bytes before trusting declared MIME headers, rejecting spoofed image or zip payloads before they become agent-visible text.
+- Plugins/dependencies: scrub stale managed-root `openclaw` ownership metadata without deleting a linked active host package, preventing plugin installs from downgrading npm-global hosts. Fixes #79462. Thanks @lisandromachado.
+- Gateway/update: keep shutdown hook-runner imports on a stable dist entry and ship a legacy chunk alias so package swaps do not strand running gateways on missing shutdown chunks. Fixes #81819. Thanks @najef1979-code.
+- Config persistence: ignore malformed array/scalar auth profile, cron job state, and session store entries instead of hydrating them into numeric profile ids, crashed cron rows, or invalid session records.
+- Config persistence: strip malformed pending final-delivery session fields on load so replay/recovery paths skip poisoned reply metadata instead of crashing on raw objects.
+- Config persistence: strip malformed plugin extension state and promoted session-slot ownership on load so corrupted session rows do not leak poisoned plugin metadata into replay/projection paths.
+- Gateway/sessions: ignore malformed compaction checkpoint rows during session projection so corrupted stores do not crash session list/describe responses or show bogus checkpoint counts.
+- Gateway/sessions: keep reachable transcript history when imported tree transcripts reference missing or legacy parent rows, preventing session history reads from going empty after a partial import.
+- Trajectory export: report incomplete transcript parent chains and stop cyclic branch walks so malformed imports cannot hang `/export-trajectory`.
+- Session replay: skip malformed user/assistant-shaped transcript rows during silent session resets instead of copying invalid entries into the fresh transcript.
+- Transcript state: skip malformed persisted JSONL entries before compaction/rewrite helpers choose the active leaf.
+- Backup verify: report malformed archive manifests with a stable error instead of leaking raw JSON parser details.
+- Session export: report skipped malformed transcript JSONL rows instead of silently omitting them from exported HTML archives.
+- Providers: reject malformed successful Runway, BytePlus, and Ollama embedding responses with provider-owned errors instead of raw parser/type failures, silent bad vectors, or long bogus polling.
+- Providers/images: reject malformed successful OpenAI-compatible, OpenAI, Google, fal, and OpenRouter image responses with provider-owned errors instead of raw shape failures, silent invalid base64 skips, or empty image results.
+- Providers/videos: reject malformed successful xAI, OpenRouter, and fal video create, poll, and result responses with provider-owned errors instead of raw parser failures or long bogus polling.
+- Providers/videos: let selected-model capability overlays clear inherited `providerOptions`, so fallback skips models that explicitly accept no provider-specific options instead of forwarding unsupported knobs.
+- TTS/providers: honor preferred provider aliases when routing model override directives, so alias-selected speech providers receive unqualified `[[tts:*]]` overrides.
+- Providers/audio: reject malformed successful OpenAI-compatible, ElevenLabs, and Deepgram speech responses with provider-owned errors instead of raw parser failures, wrong-shaped transcripts, or JSON/text bodies treated as audio.
+- Providers/embeddings: reject malformed successful OpenAI-compatible, Google Gemini, and Amazon Bedrock embedding responses instead of silently returning empty or coerced vectors.
+- Providers/catalogs: reject malformed successful LM Studio, GitHub Copilot, DeepInfra, Vercel AI Gateway, and Kilocode model-list responses with provider-owned errors instead of raw parser/type failures or silent fallback catalogs.
+- Providers/polling: reject array, null, or scalar successful operation status responses with provider-owned malformed JSON errors instead of waiting until timeout.
+- ACPX/Codex: reap plugin-local Codex ACP adapter orphans on startup after wrapper crashes while keeping direct adapter commands out of launch-lease injection. Fixes #82364. (#82459) Thanks @joshavant.
+- Agents/model fallback: periodically probe the configured primary for auto-pinned fallback sessions, announce fallback/recovery transitions, and clear the pin when it recovers, preventing sessions from staying on a fallback model indefinitely. Fixes #82544. Thanks @crpol.
+- Telegram: send presentation-only payloads by rendering fallback text and inline buttons instead of treating them as empty. Fixes #82404. (#82449) Thanks @joshavant.
+- Providers/Kimi: preserve Kimi Coding `reasoning_content` replay and backfill assistant tool-call placeholders when thinking is enabled, so `kimi-for-coding` follow-up tool turns no longer fail after prior tool use. Fixes #82161. Thanks @amknight.
+- Providers/search tools: reject malformed successful xAI, Gemini, and Kimi web/code search responses with provider-owned errors instead of silent `No response` payloads or ungrounded fallback state.
+- Trajectory export: skip and report malformed session/runtime JSONL rows in `manifest.json` instead of letting wrong-shaped session rows crash support bundle export.
+- Voice calls: persist rejected inbound-call replay keys so duplicate carrier webhook retries stay ignored after a Gateway restart.
+- Config/doctor: copy fallback-enabled channel `allowFrom` entries into explicit `groupAllowFrom` allowlists during `openclaw doctor --fix`, preserving current group access without adding runtime fallback-transition flags.
+- Config/doctor: replace source-only official Brave and Slack plugin installs from trusted catalog metadata during `openclaw doctor --fix`, unblocking externalized stock plugin recovery after upgrade. (#82425) Thanks @joshavant.
+- Config/memory: warn instead of rejecting configs that select the official external `memory-lancedb` slot before the plugin is installed, with an explicit no-persistent-memory startup warning and install hint. Fixes #82428. (#82438) Thanks @giodl73-repo.
+- Agents/bootstrap: ignore stale completed root `BOOTSTRAP.md` context after workspace setup cleanup fails, preventing channel agent turns from treating it as a directory. (#82463) Thanks @joshavant.
+- Update/doctor: re-enable the Codex plugin during `openclaw doctor --fix` when configured OpenAI agent models require the Codex runtime, preventing upgraded configs from failing with an unregistered Codex harness. Fixes #82368. (#82502) Thanks @joshavant.
+- Configure: show one OpenAI provider entry with ChatGPT/Codex sign-in and API key choices, and keep browsed Codex models in the saved `/model` picker allowlist.
+- Agents/model fallback: preserve auto fallback chains across deferred config reloads when session fallback provenance survives but `modelOverrideSource` is missing. Fixes #81982. Thanks @joshavant.
+- Hooks: raise bounded gateway lifecycle hook wait budgets to 5 seconds for shutdown and 10 seconds for pre-restart, giving short restart notification handlers time to finish before shutdown continues. (#82273) Thanks @bryanbaer.
+- Plugin releases: require external package compatibility metadata in the npm plugin publish plan, matching the ClawHub package contract before packages ship.
+- Agents/OpenAI-compatible: honor per-model `max_completion_tokens`/`max_tokens` params in embedded OpenAI-completions runs so high-token Kimi-style routes keep their configured completion cap. Fixes #82230. Thanks @albert-zen.
+- Agents/local: install a local gateway request scope around trusted `openclaw agent --local` runs, so subagent completion announces can use in-process gateway dispatch without crashing. Fixes #82140. Thanks @Kushmaro.
+- Cron: keep failed isolated-agent runs from marking successful result delivery when only the failure notification was delivered. Fixes #72985. Thanks @Allenbluff.
+- Discord: validate message-read results before normalizing channel history and report unexpected payloads with a Discord boundary error instead of `map is not a function`. Fixes #82252. Thanks @jessewunderlich.
+- Agents/runtime: apply `agents.defaults.models["provider/*"].agentRuntime` as provider-wide model runtime policy while preserving exact model runtime precedence. Fixes #82243. Thanks @rendrag-git.
+- Model picker: show the effective Codex runtime first for official OpenAI routes while keeping Pi available as an alternate and preserving Pi-first custom OpenAI-compatible providers. Fixes #82269. Thanks @rendrag-git.
+- Agents/auto-reply: restrict `NO_REPLY` prompt guidance to automatic group/channel replies, remove legacy silent-reply rewrites, and suppress accidental direct-chat silent tokens instead of delivering fallback text. Fixes #82254. Thanks @absol89.
+- Telegram: retain a longer partial-stream preview when a final callback only carries an ellipsis-truncated snapshot, preventing the visible answer and transcript mirror from being replaced by the short preview. Fixes #82239. Thanks @crash2kx.
+- Telegram/active-memory: run blocking memory recall through the Telegram provider for direct-message turns even when the hook context carries the raw chat id, preventing embedded recall from launching against an invalid numeric channel. Fixes #82177. Thanks @cslash-zz.
+- Control UI/WebChat: keep optimistic image messages from embedding large inline `data:` previews and preserve image-only user turns in chat history, avoiding browser stack overflows when sending image attachments. Fixes #82182. Thanks @ExploreSheep.
+- Agents/media: preserve message-tool-only delivery for generated music and video completion handoffs, so group/channel completions do not finish without posting the generated attachment.
+- Telegram: drain queued outbound deliveries after polling reconnect confirms fresh `getUpdates` activity, so stale-socket and network recovery do not leave failed replies stranded. Fixes #50040. Refs #82175. Thanks @dmitriiforpost-commits and @shellyrocklobster.
+- Gateway/model auth: abort active provider runs when saved auth is removed through the Gateway control plane, refresh live runtime auth snapshots, and surface `stopReason: "auth-revoked"` to clients. Fixes #81987. (#82346) Thanks @joshavant.
+- Codex app-server: keep the raw tool-output idle watchdog armed after `custom_tool_call_output` notifications, so post-tool stream silence fails fast instead of waiting for the terminal idle timeout. Fixes #82274. (#82378) Thanks @joshavant.
+- Codex app-server: enforce OpenClaw `before_tool_call` policy for Codex-native app-server shell and approval paths, preventing native tool execution from bypassing plugin policy. Fixes #82372. (#82496) Thanks @joshavant.
+- Telegram: mark isolated polling ingress unhealthy when a spooled inbound backlog stalls while Bot API polling still succeeds, so gateway/channel health no longer stays green after Telegram DM processing wedges. Fixes #82175. Thanks @shellyrocklobster.
+- Telegram: drop expired approval callbacks from isolated polling after approval id expiry so stale inline-button updates do not retry forever across restarts. Fixes #82347. (#82455) Thanks @joshavant.
+- Agents: strip Gemini/Gemma `<final>` tags with attributes or self-closing syntax from delivered replies, including strict final-tag streaming enforcement. Fixes #65867. Thanks @grizdum.
+- macOS/update: disarm legacy `ai.openclaw.update.*` LaunchAgents when `openclaw update` starts from one, preventing KeepAlive relaunch loops that repeatedly restart the Gateway and replay update continuations. Fixes #82167. Thanks @DougButdorf.
+- Agents/replay: strip internal runtime-context metadata and `NO_REPLY` sentinels from provider replay and pending final-delivery recovery so restart and heartbeat resumes do not feed control text back to the model. Fixes #76629. Thanks @fuyizheng3120, @bryan-chx, and @cael-dandelion-cult.
+- Agents/replay: skip malformed transcript tail rows when deduping embedded assistant gap-fill, preventing truncated JSONL from duplicating the final assistant reply during replay recovery.
+- LINE: acknowledge signed webhook events before agent processing so slow model replies do not cause LINE `request_timeout` delivery failures. Fixes #65375. Thanks @myericho.
+- LINE: stop cron recovery from inferring lowercased LINE recipients from canonical session keys, so long-running task replies do not silently retry undeliverable push targets. Fixes #81628. (#81704) Thanks @edenfunf.
+- TTS: preserve channel-derived voice-note delivery for `/tts audio` replies even when the provider output is not natively voice-compatible. (#82174) Thanks @xuruiray.
+- Codex app-server: preserve inbound sender metadata and source-channel provenance on mirrored user prompts, including failure snapshots, so channel history keeps the original sender identity. (#82184) Thanks @zknicker.
+- Codex app-server: yield projector work to the event loop between embedded-run notifications while preserving pre-turn rate-limit capture, reducing gateway stalls from account and MCP status notifications. Fixes #81936. (#82333) Thanks @joshavant.
+- Plugins/web search: start the configured web_search provider plugin during gateway startup, including auto-enabled external providers behind allowlists. Fixes #82313. (#82376) Thanks @joshavant.
+- Codex account/status: treat metadata-only rate-limit buckets as returned but empty so `/codex status` and `/codex account` report `none returned` instead of counting phantom limits.
+- Codex/Lossless: keep Codex explicit compaction on native app-server threads while allowing Lossless through the context-engine slot; `openclaw doctor --fix` now migrates legacy `compaction.provider: "lossless-claw"` config to `plugins.slots.contextEngine`.
+- Cron/doctor: report scheduled jobs with explicit `payload.model` overrides, including provider namespace counts and default-model mismatches, so stale cron model pins are visible during auth or billing investigations. Fixes #82151. Thanks @mgonto.
+- Codex app-server: keep the short turn-completion idle watchdog armed after the last non-assistant current-turn item completes, so a quiet Codex app-server releases the OpenClaw session lane before the outer attempt timeout. Fixes #82171. (#82172) Thanks @funmerlin.
+- Providers/OpenRouter: stop adding empty DeepSeek V4 `reasoning_content` placeholders to assistant tool-call replay messages and strip empty replay artifacts before follow-up Chat Completions requests, so `openrouter/deepseek/deepseek-v4-pro` no longer fails after tool use. Fixes #82150. (#82158) Thanks @luyao618 and @Suquir0.
+- OpenAI-compatible providers: honor streaming-usage compatibility metadata when deciding whether to send `stream_options.include_usage`, while keeping bundled Volcengine routes opted in to Ark streaming usage. Refs #44845. (#82181) Thanks @xuruiray.
+- Gateway/approvals: treat `turnSourceTo` as optional in `canBridgeNoDeviceChatApprovalFromBackend`, matching the existing optional handling of `turnSourceAccountId` and `turnSourceThreadId`. Channels without a recipient concept (webchat, control-ui) leave `turnSourceTo` null on both the approval snapshot and the replay params, so the prior required-string check rejected every backend replay with `APPROVAL_CLIENT_MISMATCH`. Cross-channel replay is still gated by the required `turnSourceChannel` and `sessionKey` checks. Fixes #82132. (#82136) Thanks @ottodeng.
+- OC Path: add `openclaw path set --dry-run --diff` so addressed edits can be reviewed as a unified diff before writing.
+
+- Cron: load runtime plugins before isolated cron model and delivery resolution so external channels can be selected for scheduled runs. (#82111) Thanks @medns.
+- Cron: mirror successful direct scheduled deliveries into the resolved destination session transcript while preserving isolated-delivery awareness policy. (#80786) Thanks @cavit99.
+- Cron: preserve rotated transcript identity after session-bound scheduled runs compact, so `sessionTarget: "current"` keeps the next user message on the same conversation. Fixes #82164. Thanks @weissfl.
+- Twitch: keep gateway accounts running until shutdown instead of treating successful monitor startup as a clean channel exit, preventing immediate auto-restart loops. Fixes #60071. (#81853) Thanks @edenfunf.
+- Agents/auto-reply: honor `agents.defaults.silentReply` and per-surface group silent-reply policy when generic agent-run failure fallbacks decide whether to send visible fallback text. Fixes #82060. (#82086) Thanks @taozengabc.
+- Discord: render channel topic context as structured untrusted metadata in reply prompts and stop duplicating inbound message bodies or exposing raw `EXTERNAL_UNTRUSTED_CONTENT` envelopes. Fixes #82168. Thanks @ronan-dandelion-cult.
+- Codex app-server: arm the short idle watchdog as soon as Codex accepts a turn, so accepted turns with no current-turn progress release the OpenClaw session lane before the outer model timeout. Fixes #82129. Thanks @Francois3d.
+- Agents/replies: also strip `<function_response>` workflow output when it becomes visible after an adjacent stripped tool-call XML block, closing the remaining sanitizer leak from #47444. Thanks @5toCode.
+- Control UI/WebChat: focus the composer when users click the visible input chrome and restore larger, labeled desktop composer controls while preserving compact mobile taps. Fixes #45656. Thanks @BunsDev.
+- Discord: suppress generated link embeds on outbound messages by default so agent-sent URLs stay as plain links unless `channels.discord.suppressEmbeds` is disabled.
+- System events: keep owner downgrades in structured metadata while rendering queued prompt text as plain `System:` lines, preserving least-privilege wakeups without prompt-visible trust labels. (#82067)
+- Gateway/agents: abort active embedded runs when diagnostics detect a stale native tool call, preventing nested agent sessions from staying deadlocked through restart recovery. Fixes #81976. (#82369) Thanks @joshavant.
+- Slack: default outbound bot link unfurls off so agent-sent URLs no longer expand into inline previews unless `channels.slack.unfurlLinks` is enabled. (#82123) Thanks @kibi-bsp.
+- Slack: keep finalized draft-preview replies visible when a later same-turn tool warning is delivered normally instead of clearing the edited answer. Fixes #81903. (#81979) Thanks @neeravmakwana.
+- Providers/Xiaomi: preserve MiMo `reasoning_content` on multi-turn tool-call replay, including custom Xiaomi-compatible proxy routes, so follow-up turns no longer fail with `400 Param Incorrect`. Fixes #81419. (#81589) Thanks @lovelefeng-glitch and @jimdawdy-hub.
+- Slack/plugins: route plugin-owned modal `view_submission` and `view_closed` events through Slack interactive handlers before compacting the agent-visible system event, so plugins can persist full submitted form state while the transcript stays compact. Fixes #82102. Thanks @shannon0430.
+- Providers/Xiaomi: promote legacy MiMo V2 reasoning-only final answers to visible text, including Xiaomi-compatible proxy routes, so `mimo-v2-pro` and `mimo-v2-omni` replies no longer appear blank when the answer arrives in `reasoning_content`. Fixes #60261. (#60304) Thanks @HiddenPuppy.
+- Providers: preserve required `reasoning_content` replay for Kimi K2.6/K2 thinking and MiMo V2.6 OpenAI-compatible tool-call follow-up turns while keeping the stock OpenAI/Qwen strip path intact. Fixes #82139. Thanks @yimao.
+- Memory search: stop using chokidar write-stability polling for memory and QMD watchers so large Markdown extraPath trees no longer build up regular file descriptors; changed files now settle through the existing debounced sync queue. Fixes #77327 and #78224. (#81802) Thanks @frankekn, @loyur, and @JanPlessow.
+- Message tool: rename the Discord channel-create schema field exposed to models from `type` to `channelType`, avoiding NVIDIA NIM JSON Schema parser failures while still accepting legacy `type` tool calls. (#78920) Thanks @YashSaliya.
+- Feishu: send CardKit streaming cards as delivered deltas and retry failed updates, preventing duplicated or dropped streamed text. Fixes #82417. (#82419) Thanks @hclsys.
+- WhatsApp: accept `group:`-prefixed group JIDs for outbound targets so `whatsapp:group:<jid>@g.us` resolves to the canonical group JID. Thanks @mcaxtr.
+- Gateway/Gmail: stop queued post-ready Gmail sidecars before hot reload and abort stale Tailscale setup, so cancelled watcher restarts cannot rewrite an old public hook target or report abort-killed commands as success. (#82395) Thanks @samzong.
+
diff --git a/CHANGELOG/2026.5.20.md b/CHANGELOG/2026.5.20.md
new file mode 100644
index 0000000000000000000000000000000000000000..329640faf71906f634b84ab5f6cd8c5e97a75564
--- /dev/null
+++ b/CHANGELOG/2026.5.20.md
@@ -0,0 +1,97 @@
+## 2026.5.20
+
+### Changes
+
+- Exec approvals: remove the old `cat SKILL.md && printf ... && <skill-wrapper>` allowlist compatibility path so skill files must be loaded with the read tool and only the real skill executable is auto-allowed.
+- Discord: let voice sessions follow configured Discord users into voice channels, with allowed-channel checks, multi-user handoff, bounded reconciliation, and DAVE recovery preservation. (#84264) Thanks @fuller-stack-dev.
+- Discord/voice: include bounded `IDENTITY.md`, `USER.md`, and `SOUL.md` profile context in realtime voice session instructions by default, with `voice.realtime.bootstrapContextFiles: []` available to disable it. (#84499) Thanks @fuller-stack-dev.
+- Dependencies: bump the bundled Codex harness to `@openai/codex` `0.132.0` and refresh the app-server model-list docs for the new catalog.
+- CLI/policy: add the bundled Policy plugin for policy-backed channel conformance checks, doctor lint findings, and opt-in workspace repair. (#80407) Thanks @giodl73-repo.
+- Agents/config: allow `agents.list[].experimental.localModelLean` so lean local-model mode can be enabled for one configured agent instead of globally. (#84073) Thanks @dutifulbob.
+- Providers/xAI: add device-code OAuth login so remote and headless setups can authorize xAI without a localhost browser callback. (#84005) Thanks @fuller-stack-dev.
+- Providers/OpenRouter: honor provider-level `params.provider` routing policy for OpenRouter requests, with model and agent params overriding the defaults. Thanks @amknight.
+
+### Fixes
+
+- Agents: validate a forced plugin harness against the candidate provider/model before pinning it, so unsupported fallback-chain candidates fail with a clear harness error instead of producing a late `Model provider X not found` from the underlying harness. Codex harness `supports()` now also accepts the canonical `openai` and `openai-codex` routing ids so documented Codex configs keep working. Thanks @cathrynlavery.
+- Control UI/WebChat: keep selected external-channel sessions live by mirroring Codex prompts at turn start, streaming hidden runs only to exact selected-session subscribers, and deduplicating accumulated stream snapshots around tool cards. Fixes #83528, #82611, refs #83949. Thanks @BunsDev.
+- CLI/tasks: include stale-running task maintenance decisions in `openclaw tasks maintenance --json` so retained and reconcile candidates explain backing-session, cron, CLI, and wedged-subagent state. (#84691) Thanks @efpiva.
+- Codex app-server: keep system-prompt reports working when bootstrap hooks provide workspace files with only a path and content, so hook-supplied SOUL/IDENTITY/TOOLS/USER context still reports injected characters correctly. (#84736) Thanks @JARVIS-Glasses.
+- Providers/MiniMax music: stop advertising `durationSeconds` control and remove prompt-injected duration hints, so `music_generate` reports MiniMax duration as an unsupported override instead of suggesting MiniMax can enforce track length. Fixes #84508. Thanks @neeravmakwana.
+- Doctor: warn when sandbox tool policy hides configured MCP server tools before provider requests. (#84699) Thanks @nxmxbbd.
+- WhatsApp: update Baileys to `7.0.0-rc12`.
+- Build: suppress per-locale `rolldown-plugin-dts:fake-js` CommonJS dts warnings emitted while bundling the intentionally-inlined `zod/v4/locales/*.d.cts` files, so `pnpm build` output stays readable after the 0.25.1 plugin bump. Thanks @RomneyDa.
+- CLI/nodes: route lazy plugin-registration logs to stderr for JSON-mode `openclaw nodes` commands so stdout stays parseable. (#84684) Thanks @TurboTheTurtle.
+- Approvals: route manual `/approve` decisions through the trusted approval runtime so active exec and plugin approvals no longer look unknown or expired.
+- Mac app: update the About settings copyright year to 2026. (#84385) Thanks @pejmanjohn.
+- Dependencies: update `@openclaw/fs-safe` to `0.2.7` so OpenClaw's default Python-helper-off policy keeps best-effort Node write fallbacks for private stores, secret writes, run logs, and media attachments on Linux/macOS.
+- Infra/secrets: restore the fail-closed contract for `tryReadSecretFileSync` so credential loaders that pass `rejectSymlink: true` (Telegram, LINE, Zalo, IRC, Nextcloud Talk tokens) refuse symlinked credential files instead of silently accepting them, and the infra-state CI shard's secret-file symlink test passes again. Thanks @RomneyDa.
+- Browser: honor the configured image sanitization limit for screenshots and labeled snapshots so browser-captured images follow the same resize policy as other image results. (#84595)
+- Doctor: remove unrecognized `models.providers.*.models[*].compat.thinkingFormat` values during `doctor --fix` so stale provider model config can validate after upgrade. Fixes #77803.
+- Doctor: warn when `openclaw.json` stores plaintext secret-bearing config fields, including model provider API keys and sensitive provider headers. (#84718) Thanks @lukaIvanic.
+- Status: show the configured default, session-selected model, reason, clear hint, and docs link when a session remains pinned to a model that differs from `agents.defaults.model.primary`.
+- WebChat: clear stale typing indicators when session change events mark the active chat run complete.
+- Mac app: keep local packaging signed with a stable app identity for permission testing and fix Control UI production builds under current Vite/Highlight.js exports.
+- macOS app: update the embedded Peekaboo bridge to 3.2.1 so OpenClaw-hosted UI automation works with current Peekaboo CLI capture flows.
+- Cron: deliver preferred final assistant output for successful scheduled runs when trailing plain tool warnings remain in diagnostics instead of marking the run failed.
+- fix(mattermost): fail closed on missing channel type [AI]. (#84091) Thanks @pgondhi987.
+- Recheck rebuilt system.run argv [AI]. (#84090) Thanks @pgondhi987.
+- CLI: keep the private QA subcommand out of exported command descriptors unless `OPENCLAW_ENABLE_PRIVATE_QA_CLI=1`, so root help and subcommand markers match runtime registration. (#84519)
+- CLI/cron: bound `openclaw cron show` job lookup pagination so non-advancing or unbounded `cron.list` responses fail instead of hanging the command. Fixes #83856. (#83989)
+- Agents/messages: stop message-tool-only turns after a successful source-channel `message` send while keeping transcript mirrors under the session write lock. (#84289)
+- Agents: filter silent heartbeat response-tool transcript artifacts out of embedded context snapshots so later user turns are not polluted by heartbeat no-op messages. (#83477) Thanks @fuller-stack-dev.
+- Agents/OpenAI: log repeated strict tool-schema downgrade diagnostics once per provider/model/tool signature, reducing duplicate debug noise while preserving `strict=false` fallback behavior. Fixes #82930. (#82933) Thanks @galiniliev.
+- Agents/code mode: spell out the `exec` tool's JavaScript/TypeScript, no Node module, and catalog-bridge constraints in model-visible schema text so agents can use enabled tools without trial-and-error. (#84269) Thanks @Kaspre.
+- Codex: give `image_generate` dynamic-tool calls a 120s default watchdog when no per-call or configured image timeout is set, so image generation no longer falls back to the generic 30s bridge timeout. (#84254) Thanks @moritzmmayerhofer.
+- Codex: avoid duplicate dynamic tool terminal diagnostics while large diagnostic backlogs drain without blocking tool responses. (#82937) Thanks @galiniliev.
+- CLI/message: include a stable top-level `messageId` in `openclaw message --json` output when channel sends return one. (#84191) Thanks @100menotu001.
+- Cron: preserve legacy top-level array `jobs.json` stores when loading or adding scheduled jobs so old cron jobs are no longer treated as an empty store during upgrade. Fixes #60799. (#84433) Thanks @IWhatsskill.
+- Gateway/agents: use an agent's `identity.name` in Gateway agent summaries when `agents.list[].name` is unset, so configured agent labels remain visible in clients. (#84355; refs #57835) Thanks @luoyanglang.
+- Channels/replies: keep normal `/verbose` failed-tool progress compact in message-tool replies and prevent late text-only tool output from appearing after the final answer. (#84303) Thanks @VACInc.
+- Plugins/hooks: apply a default 30-second timeout to `before_compaction` and `after_compaction` hooks so a hung plugin handler no longer blocks compaction completion. (#84153)
+- Discord: preserve reusable presentation buttons through portable conversion and Discord component registration. (#84187) Thanks @100menotu001.
+- Discord: preserve disabled presentation buttons when adapting and rendering Discord message controls. (#84188) Thanks @100menotu001.
+- Twitch: add a test-only client-manager registry reset helper so non-isolated Twitch tests can clear cached managers between cases. Fixes #83887. (#84244) Thanks @hclsys.
+- Cron: run main-session scheduled work on a cron-owned wake lane while preserving reply delivery context, so background cron turns no longer block human main-session chat. Fixes #82766. (#82767) Thanks @galiniliev.
+- Auto-reply/slash commands: require a word boundary after the matched prefix in `parseSlashCommandActionArgs` so `/config-check <args>` (or any skill that shares a built-in command prefix) is no longer captured by the shorter built-in handler. Fixes #84572. Thanks @infracore.
+- Cron: use structured embedded-run denial metadata for isolated scheduled tasks so blocked exec requests fail the job without treating ordinary assistant prose as a denial. (#84067) Thanks @abnershang.
+- Cron: keep recovered tool warnings diagnostic for successful scheduled runs so final cron output is delivered instead of being replaced by a post-processing warning. (#84045) Thanks @abnershang.
+- Plugins/perf: thread explicit plugin discovery results through `loadBundledCapabilityRuntimeRegistry`, `resolveBundledPluginSources`, and `listChannelCatalogEntries` so callers that already hold a discovery result skip redundant filesystem walks. Thanks @SebTardif.
+- harden update restart script creation [AI]. (#84088) Thanks @pgondhi987.
+- Android/Control UI Talk: split realtime voice transcript turns, queue PCM playback writes, and add opt-in OpenClaw consult routing for Gateway relay when a realtime provider skips `openclaw_agent_consult`. (#84181) Thanks @VACInc.
+- Docker: keep the bundled Codex plugin in official release image keep lists so the default OpenAI agent harness remains available after Docker pruning. Fixes #83613. (#83626) Thanks @YuanHanzhong.
+- CLI/channels: preserve the first line of `openclaw channels logs` output when the rolling tail window starts exactly on a line boundary, mirroring the already-fixed `readLogSlice` behavior in `src/logging/log-tail.ts`.
+- Control UI: treat terminal session status as authoritative over stale active-run flags so completed terminal runs stop showing abort/live UI. (#84057)
+- CLI: preserve embedded equals signs in inline root option values instead of truncating after the second separator. (#83995) Thanks @ThiagoCAltoe.
+- Matrix/config: accept `messages.queue.byChannel.matrix` queue overrides and keep queue provider schema/type keys aligned for Matrix, Google Chat, and Mattermost. Thanks @bdjben.
+- CLI: format `openclaw acp client` failures through the shared error formatter so object-shaped errors stay readable instead of printing `[object Object]`. Fixes #83904. (#84080)
+- Agents/message-tool: normalize non-canonical message body aliases (`SendMessage`, `content`, `text`) to `message` before send validation so model-emitted tool calls with aliased body keys are delivered instead of rejected. (#84079)
+- Providers/Ollama: default unknown-capabilities models to tool-capable so discovered native Ollama models can use tools when `/api/show` omits capabilities. (#84055) Thanks @dutifulbob.
+- Codex app-server: disable native Code Mode, user MCP, and app-backed plugin execution while OpenClaw sandboxing is active, routing shell access through `sandbox_exec`/`sandbox_process` instead. (#84388) Thanks @joshavant.
+- Installer/Windows: launch `install.ps1` onboarding as an attached child process so fresh native Windows installs do not freeze visibly at `Starting setup...` or corrupt the wizard's terminal rendering.
+- CLI/update: keep restart health checks working across one-version CLI/Gateway protocol skew and use the managed Gateway service Node for all follow-up commands even when the package root is unchanged, so `openclaw update` no longer silently switches the gateway to a different Node binary when multiple Node installations are present. Thanks @amknight.
+- CLI/gateway: include the running Gateway version in `gateway status` JSON output, preserving existing server metadata while falling back to status RPC data for read probes. Fixes #56222. Thanks @galiniliev.
+- Memory/search: close local embedding providers when active-memory searches time out so pending local model loads and embedding contexts are aborted and released. (#83858) Thanks @brokemac79.
+- CLI/nodes: request pending node surface approval scopes before `openclaw nodes approve` so exec-capable node approval can use admin-scoped Gateway credentials instead of failing with `missing scope: operator.admin`. (#84392) Thanks @joshavant.
+- Gateway: reject slow node event sends before outbound buffers grow unbounded and log the rejected payload diagnostic. (#84387) Thanks @samzong.
+- Agents: include bounded trajectory queued-writer diagnostics in `pi-trajectory-flush` timeout warnings so flush stalls show pending writes, queued bytes, and append state. Fixes #82961. (#82962) Thanks @galiniliev.
+- Agents/subagents: recover stale completion announces by retrying unsupported transcript-wait wakes without transcript waiting and forcing a message-tool handoff when the requester run is already stale. Fixes #83699. (#83700) Thanks @galiniliev.
+- Agents/subagents: constrain wildcard subagent target allowlists to configured agents while preserving explicitly listed compatibility targets. Fixes #84040. (#84357) Thanks @joshavant.
+- Providers/Anthropic: route Anthropic model refs selected with Claude CLI auth through the Claude CLI runtime so shorthand refs such as `anthropic/opus-4.7` no longer fall back to embedded Anthropic billing. Fixes #84222. (#84374) Thanks @joshavant.
+- Agents: honor explicit `models.providers.<id>.timeoutSeconds` values above the default idle watchdog for cloud and self-hosted providers, so long first-token waits no longer fall back at ~120s when the provider timeout is higher. (#83979) Thanks @yujiawei.
+- Agents/Codex: keep encrypted Responses reasoning replay provenance-bound so stale mirrored Codex transcripts drop invalid encrypted content before request assembly while preserving matching same-session replay. Fixes #83836. (#84367) Thanks @joshavant.
+- Agents/subagents: skip stale embedded-run wake probes for dormant completion requesters, so late subagent completions go straight to requester-agent/direct handoff instead of producing `reason=no_active_run` queue noise. (#82964) Thanks @galiniliev.
+- CLI: retry config snapshot reads after a transient failure so one rejected read no longer poisons later commands in the same process. (#83931) Thanks @honor2030.
+- TUI: handle German-layout Kitty keyboard input by ignoring printable release events and accepting AltGr-produced printable characters such as `@` and `€`. Fixes #48897.
+- Media: decode URL path basenames before using them as remote media fallback filenames, so files like `My%20Report.pdf` are surfaced as `My Report.pdf`. Fixes #84050. (#84052) Thanks @jbetala7.
+- WhatsApp: clarify inbound group diagnostics so observed but unregistered groups point to `channels.whatsapp.groups` without changing routing or sender authorization. (#83846) Thanks @neeravmakwana.
+- WhatsApp: drain pending outbound deliveries on a 30s periodic timer in addition to the reconnect handler, so messages enqueued while the provider is already connected no longer wait for the next reconnect to send. (#79083) Thanks @Oviemudiaga.
+- CLI/TUI: include gateway plugin slash commands in TUI autocomplete, so connected sessions can suggest plugin-owned commands exposed by the running Gateway. (#83640) Thanks @se7en-agent.
+- Gateway/mobile: restore QR setup-code handoff of bounded operator tokens for iOS and Android onboarding while keeping admin and pairing scopes out of bootstrap. (#83684) Thanks @ngutman.
+- iOS: repair Release archive compilation for the TestFlight build. (#84255) Thanks @ngutman.
+- Agents/compaction: bound plugin-owned CLI transcript compaction with the host safety timeout so a hung context engine can no longer stall post-turn cleanup. (#84083) Thanks @100yenadmin.
+- Control UI/usage: truncate long context skill, tool, and file names in the usage panel while keeping the full name available on hover. (#42197) Thanks @Rain120.
+- Codex: respect explicit `models auth order set` and `config.auth.order` precedence over stale `lastGood` in `/codex account`, and show `no working credential` when every explicit-order profile is ineligible instead of marking a lower-ranked profile as active. Fixes #84386. (#84412) Thanks @openperf.
+- Agents: honor `messages.suppressToolErrors` for mutating tool failures so configured chat surfaces do not receive separate warning payloads. (#81561) Thanks @moeedahmed.
+- Agents/fallback: surface billing guidance for mixed rate-limit plus billing fallback exhaustion instead of generic failure copy. Fixes #79396. (#79489) Thanks @aayushprsingh.
+
diff --git a/CHANGELOG/2026.5.22.md b/CHANGELOG/2026.5.22.md
new file mode 100644
index 0000000000000000000000000000000000000000..a857fa1ee062839b500367cb581d64728116b905
--- /dev/null
+++ b/CHANGELOG/2026.5.22.md
@@ -0,0 +1,271 @@
+## 2026.5.22
+
+### Changes
+
+- Gateway/perf: reuse process-stable channel catalog reads, avoid repeated bundled-channel boundary checks, and rotate gateway watch CPU profiles so benchmark runs do not accumulate unbounded artifacts.
+- Gateway/perf: reuse immutable plugin metadata snapshots across startup, config, model, channel, setup, and secret metadata readers so hot paths avoid repeated plugin file stats and manifest registry reloads.
+- Gateway/perf: lazy-load startup-idle plugin work, core gateway method handlers, and the embedded ACPX runtime so Gateway health and ready signals no longer wait on unused handler trees or ACPX probes.
+- Gateway/perf: cache plugin SDK public-surface alias maps and skip irrelevant macOS Linuxbrew PATH probes so Gateway startup avoids repeated filesystem walks and slow missing-directory stats.
+- Transcripts: add the initial transcript capture and source-provider foundation, including auto-start capture config, manual transcript imports, read-only transcript access, and Discord voice as the first live source.
+- Docs/channels/config: add Signal `configPath`, Telegram wildcard topic defaults, local-time backup archive names, Termux home fallback, include-path validation, secret-scanner-safe placeholder guidance, Gemini CLI/Antigravity media guidance, and macOS VM auto-login guidance. Thanks @NorseGaud, @yudistiraashadi, @huangqian8, @VibhorGautam, @maweibin, @tianxingleo, @IgnacioPro, and @xzcxzcyy-claw.
+- Docs: clarify model-usage portability, Codex migration prerequisites, status bootstrap wording, thread-bound subagent limits, hook ownership, and config-preserving safety guidance. Thanks @aniruddhaadak80, @leno23, @TomDjerry, @matthewxmurphy, @vincentkoc, and @stablegenius49.
+- Docs: clarify README onboarding and Gateway startup paths, WhatsApp QR/408 recovery, cron output language prompts, skill advanced features, gateway upstream 403 troubleshooting, and plugin fallback override guidance. Thanks @deepujain, @Zacxxx, @Jah-yee, @neyric, @usimic, @Renu-Cybe, @BigUncle, and @SeashoreShi.
+- Docs: clarify context-pruning ratio bounds, local dashboard recovery, CLI env markers, remote onboarding token behavior, and Peekaboo Bridge permissions for subprocess agents. Thanks @ayesha-aziz123, @dishraters, @hougangdev, and @brandonlipman.
+- Docs: clarify browser CDP diagnostics, Plugin SDK allowlist imports, status-reaction timing defaults, queue steering behavior, limited-tool troubleshooting, cron HEARTBEAT handling, Telegram multi-agent groups, Bitwarden SecretRef setup, and EasyRunner deployments. Thanks @Quratulain-bilal, @mbelinky, @Mickey-, @vancece, @xenouzik, @posigit, @surlymochan, @janaka, and @choiking.
+- Crabbox/Testbox: run clean sparse-checkout Testbox syncs from a temporary full checkout and route remote changed gates through Corepack pnpm.
+- Docs: clarify IPv4-only Gateway BYOH binding, trusted-proxy scope clearing, Android pairing approval, macOS Accessibility grants, Zalo profile env vars, password-store SecretRef setup, and Chinese memory navigation. Thanks @itskai-dev, @gwh7078, @longstoryscott, @MoeJaberr, and @yuaiccc.
+- Docs: consolidate GLM under Z.AI, add the Upstash Box install guide and Gateway exposure runbook, clarify MEDIA directives, Copilot and Voyage setup, config path quoting, real behavior proof, and memory-file write guidance. Thanks @BobDu, @alitariksahin, @Jefsky, @musaabhasan, @OmerZeyveli, @leno23, @WuKongAI-CMU, @luoyanglang, and @majin1102.
+- Docs: clarify media provider credentials, Codex/OpenClaw code-mode boundaries, Slack and Telegram ack reactions, Feishu dynamic agents, secrets plaintext boundaries, memory guidance, and Chinese glossary terms. Thanks @nielskaspers, @cosmopolitan033, @drclaw-iq, @alexgduarte, @zccyman, @chengoak, and @cassthebandit.
+- Packaging: exclude documentation images and assets from the npm tarball, reducing published package size without affecting runtime docs search or CLI behavior. Thanks @SebTardif.
+- Media understanding: stop auto-probing Gemini CLI and use Antigravity CLI only as a lower-priority image/video fallback after configured provider APIs.
+- Agents/subagents: limit default sub-agent bootstrap context to `AGENTS.md` and `TOOLS.md`, keeping persona, identity, user, memory, heartbeat, and setup files out of delegated workers by default. (#85283) Thanks @100yenadmin.
+- Maintainer skills: exclude plugin SDK/API boundary work from `openclaw-landable-bug-sweep` so bugbash sweeps stay focused on small paper-cut fixes.
+- QA-Lab/diagnostics: extend the OpenTelemetry smoke harness to prove trace, metric, and log export, and add first-class Prometheus and observability smoke aliases.
+- Plugin SDK: add a generic channel-message poll sender so channel plugins can expose poll delivery without depending on channel-specific SDK facades.
+- Crabbox: keep the local wrapper's provider validation synced with the installed Crabbox binary while preserving supported aliases such as `docker` and `blacksmith`. (#85302) Thanks @hxy91819.
+- Maintainer skills: add `openclaw-landable-bug-sweep` for producing five small, reviewed, CI-green OpenClaw bugfix PRs from issue/PR sweeps.
+- Control UI/chat: add search and Load More pagination to the chat session picker, keeping initial session loads bounded while making older conversations reachable. (#85237) Thanks @amknight.
+- CLI/onboarding: start classic onboarding when bare `openclaw` runs before an authored config exists, while keeping configured installs on Crestodian. (#72343) Thanks @fuller-stack-dev.
+- Agents/runtime: internalize the former Pi agent runtime into OpenClaw, remove legacy package dependencies, and keep Pi-named SDK aliases only as deprecated plugin compatibility.
+- Discord: allow configuring a bounded `agentComponents.ttlMs` callback registry lifetime for long-running component workflows, with per-account overrides and a 24-hour cap. (#84189) Thanks @100menotu001.
+- xAI/Grok: reuse xAI OAuth auth profiles for Grok `web_search`, thread active-agent auth through web search, add Grok model aliases, and let media providers declare default operation timeouts. (#85182) Thanks @fuller-stack-dev.
+- Plugin SDK: add row-level session workflow helpers and deprecate `loadSessionStore` so plugins can read and patch sessions without depending on the legacy whole-store shape. (#84693) Thanks @efpiva.
+- Gateway/plugins: reuse a compatible Gateway startup plugin registry during dispatch so safe plugin dispatches avoid redundant registry loading. (#84324) Thanks @ai-hpc.
+- Plugins/SDK: add a general `embeddingProviders` capability contract and registration API so embeddings can become a reusable provider surface outside memory-specific adapters.
+- Dependencies: refresh provider, plugin, UI, and tooling packages, update `protobufjs` to 8.4.0 to clear the current npm advisory, and carry the Claude ACP completion patch forward to `@agentclientprotocol/claude-agent-acp` 0.36.1.
+- Agents/tools: remove the old sender-owner tool gating path so configured tools stay visible for trusted sessions while command and channel-action auth still carry real sender identity.
+- QA-Lab: add curated mock JSONL replay fixtures and first-drift reporting for runtime-parity audits. (#80323, refs #80176) Thanks @100yenadmin.
+- QA-Lab: add a QA bus tool-trace visibility scenario for sanitized tool-call assertions.
+- QA-Lab: replace generic evidence framing in seeded scenario prompts with concrete observed QA behavior.
+- QA-Lab: list named scenario packs in the coverage report so personal-agent privacy coverage stays visible in audits.
+- QA-Lab: list live transport lane membership in the coverage report so real transport checks stay separate from seeded qa-channel scenarios.
+- Release/package: run package integrity checks before package acceptance lanes so public install/update validation fails before private QA assets can leak into the package.
+- QA-Lab: include the optional 100-turn runtime parity soak in release-soak artifacts so long-run Codex/Pi transcript drift stays visible outside the default gate. (#80395) Thanks @100yenadmin.
+- QA-Lab: add a live-only long-context progress watchdog scenario for Codex app-server timeout and stalled-run sentinels. (#80323) Thanks @100yenadmin.
+- QA-Lab: tag gateway restart recovery and streaming final-integrity scenarios as live-only runtime parity lanes. (#80323) Thanks @100yenadmin.
+- QA-Lab: add a personal-agent failure recovery scenario that checks honest partial status, retry boundaries, and local recovery artifacts. (#83872) Thanks @iFiras-Max1.
+- QA-Lab: include an opt-in `update.run` package self-upgrade sentinel for destructive latest-package recovery checks.
+- QA-Lab: add Codex plugin lifecycle and auth-profile fixture coverage for missing installs, pinned-version drift, first-turn install ordering, and doctor migration safety. (#80323, refs #80174) Thanks @100yenadmin.
+- Models/perf: pre-warm the provider auth-state map at gateway startup so `/models` and every model-listing call short-circuits the per-provider plugin / external-CLI discovery on the hot path. Per-call cost drops from ~20 s to ~5 ms (~4,100×); the one-time startup warm resets and re-warms after hot reloads. (#84816) Thanks @sjf.
+- Release/security: ship the root npm package and OpenClaw-owned npm plugins with generated shrinkwrap, support bundled plugin runtime dependencies for suitable plugin tarballs, and require review for lockfile/shrinkwrap changes so published installs use locked dependency graphs.
+- Tests/perf: isolate doctor core health check unit coverage from real skills/workspace discovery so `doctor-core-checks` no longer dominates unit perf while keeping one real skills-readiness smoke. (#84493) Thanks @frankekn.
+
+### Fixes
+
+- WebChat: summarize internal message-tool source replies so tool cards no longer duplicate the visible reply body. (#84773) Thanks @jason-allen-oneal.
+- Gateway: preserve deferred lifecycle-error cleanup across later non-terminal events so provider timeouts can persist failed session state instead of leaving sessions stuck running. (#85256, fixes #63819) Thanks @samzong.
+- Agents/subagents: report tool-only child progress during timeout summaries instead of showing no visible output.
+- Telegram/ACP: preserve explicit `:topic:` conversation suffixes when inbound ACP targets do not carry a separate thread id.
+- Browser/proxy: bypass the managed proxy for the exact local managed Chrome CDP readiness and DevTools WebSocket endpoints, so `openclaw browser start` works when the operator proxy blocks loopback egress. (#83255) Thanks @lightcap.
+- Ollama: bypass the managed proxy for configured local embedding origins while keeping SSRF guardrails on unconfigured targets. Thanks @Kaspre.
+- OpenAI/images: route Codex API-key image generation through the native OpenAI Images API instead of the Codex OAuth streaming backend, avoiding 401s from valid API keys.
+- Agents/OpenAI completions: omit empty tool payload fields for proxy-like OpenAI-compatible endpoints so strict vLLM-style servers accept tool-free turns. (#85835) Thanks @rendrag-git.
+- Checks/Windows: route full `pnpm check` stage commands through the managed child runner so Windows avoids Node shell-argv deprecation warnings there too.
+- Checks/Windows: run managed child commands through explicit `cmd.exe` wrapping instead of Node shell mode with argv, avoiding Node 24 subprocess deprecation warnings during changed checks.
+- Gateway: omit internal stream-error placeholder entries from agent prompt history so failed assistant turns are not replayed as model-authored text. (#85652) Thanks @anyech.
+- Sessions: enforce the session write-lock max-hold policy during lock acquisition so long-held locks can be reclaimed before the stale-lock window. (#85764) Thanks @njuboy11.
+- Models: prune retired Groq, GitHub Copilot, OpenAI, xAI, and old Claude catalog entries, with doctor migration to upgrade existing configs to current provider refs.
+- Doctor/update: recognize junction-backed source checkouts as git installs by comparing canonical paths before showing package-manager update guidance. Fixes #82215. Thanks @igormf.
+- Channels: honor `/verbose on` for tool/progress summaries across direct chats, groups, channels, and forum topics while preserving quiet default behavior. (#85488) Thanks @kurplunkin.
+- CLI/skills: show an all-ready note with next-step commands when skill setup has no missing dependencies to install. (#85032) Thanks @aniruddhaadak80.
+- Microsoft Foundry: route DeepSeek V4 Pro and Flash models through the Foundry Responses API while keeping older DeepSeek models on their existing path. (#85549) Thanks @roslinmahmud.
+- Status/usage: show configured cost estimates for AWS SDK models in full usage output while keeping token-only usage replies cost-free. (#85619) Thanks @ItsOtherMauridian.
+- Agents/OpenAI Responses: retry non-visible reasoning-only turns for OpenAI Responses API families instead of treating them as empty failed turns. (#85603) Thanks @SebTardif.
+- Directive tags: preserve message and content-part object identity when display stripping makes no directive-tag changes. (#85682) Thanks @willamhou.
+- Telegram: send local `path`/`filePath` and structured attachment media from `sendMessage` actions instead of dropping them or sending text-only messages. (#85219) Thanks @keshavbotagent.
+- Sessions/status: show the estimated context budget when fresh provider usage is unavailable and clear stale estimates across session resets and compaction boundaries. (#84830) Thanks @giodl73-repo.
+- Gateway/config: pin relative `OPENCLAW_STATE_DIR` overrides to an absolute path at startup so later working-directory changes cannot retarget gateway state. (#52264) Thanks @PerfectPan.
+- Release/package: run npm release, prepublish, and postpublish verification through Windows-safe npm command shims so native Windows checks can execute `npm.cmd` instead of treating it as a binary.
+- Agents/harness: pass CLI runtime aliases through harness selection so provider-owned CLI aliases no longer get rejected before reaching the right runtime. (#85631) Thanks @potterdigital.
+- Secrets: show the irreversible apply warning after interactive `secrets configure` confirmation so confirmed migrations still get the final safety prompt. (#85638) Thanks @alkor2000.
+- Agents/CLI output: ignore cumulative Claude `stream-json` result usage when assistant usage events are present, preventing inflated cache-read accounting. (#85625) Thanks @zhouhe-xydt.
+- CLI: keep `waitForever()` alive by leaving its keep-alive interval ref'd so the public helper no longer exits immediately with Node's unsettled-await code. (#85694) Thanks @m1qaweb.
+- Agents/bootstrap: guard bootstrap name checks against missing file names so malformed bootstrap entries warn and truncate instead of crashing. Fixes #85523. (#85615) Thanks @zhouhe-xydt.
+- CLI/tasks: reject partially numeric `openclaw tasks audit --limit` values so audit limits must be real positive integers instead of accepting strings like `5abc`. (#84901) Thanks @jbetala7.
+- Status/diagnostics: bound deep Docker audit probes so `openclaw status --deep` reports slow container checks instead of hanging behind unbounded inspection. (#85476) Thanks @giodl73-repo.
+- Providers/Anthropic: migrate 1M context handling to GA-capable Claude 4.x models by sizing eligible models at 1M without the retired `context-1m-2025-08-07` beta, ignoring that retired beta in older configs, and preserving OAuth-required Anthropic beta headers. (#45613) Thanks @haoyu-haoyu.
+- Cron/Telegram: parse forum-topic delivery targets through the Telegram plugin instead of cron core, including `:topic:` and `:topicId` forms for announce delivery. Thanks @etticat.
+- Twitch: keep stale message-handler cleanup callbacks from removing newer handler registrations for the same account, preserving inbound message delivery after reconnects. Fixes #83888. (#85425) Thanks @alkor2000.
+- Memory/LanceDB: expose public memory artifacts through the active memory provider bridge so memory-wiki imports durable memory files, daily notes, dream reports, and event logs without depending on memory-core internals. Fixes #83604. (#85060) Thanks @brokemac79.
+- Crabbox: keep AWS hydration compatible with local Actions replay by inlining the hydrate workflow's Node/pnpm setup instead of invoking repo-local composite actions.
+- Agents/subagents: simplify native sub-agent completion handoff so children report their latest visible assistant result to the requester without using `message`, while keeping parent-owned message-tool delivery policy intact. Fixes #85070. (#85089) Thanks @brokemac79.
+- Docker setup: stop printing the Gateway bearer token in setup logs and printed follow-up commands.
+- Agents: let embedded compaction fallback retries proceed when PI-compatible candidates do not need agent harness plugin preparation.
+- Agents/tools: honor configured custom provider API keys when deciding whether media, image-generation, video-generation, music-generation, and PDF tools are available. (#85570)
+- StepFun: stop advertising stale generic API key auth choices so onboarding only offers runtime-backed Standard and Step Plan choices.
+- Diagnostics: keep OpenTelemetry log bodies behind explicit content capture and scrub scoped agent-session keys from OpenTelemetry and Prometheus labels while preserving bounded queue-lane prefixes.
+- Windows installer: fail Git checkout installs when `pnpm install` or `pnpm build` fails instead of writing a wrapper to a missing CLI build.
+- Sessions: surface previous-transcript archive failures during `/new` rotation so disk rename errors are logged instead of silently hiding stranded transcript files. Fixes #81984. (#85586, from #82081) Thanks @0xghost42.
+- TUI/agents: mirror internal-ui message-tool replies into final chat output so message-tool-only agents remain visible in `openclaw tui`. Fixes #85538. Thanks @danpolasek.
+- Agents: keep parallel OpenAI-compatible tool-call deltas in separate argument buffers so interleaved tool calls no longer corrupt streamed arguments. (#82263) Thanks @luna-system.
+- Memory/doctor: report missing or unusable QMD workspace directories as workspace failures instead of generic binary failures. (#63167) Thanks @sercada.
+- Debug proxy: record CONNECT client-socket errors and destroy the paired upstream socket so abrupt client disconnects no longer leak tunnel resources. (#82444) Thanks @SebTardif.
+- Diffs: continue hydrating later diff cards when one card fails so a single broken card no longer blanks the whole diff viewer. (#84775) Thanks @cosmopolitan033.
+- Mac app: use the native settings sidebar window chrome so the sidebar toggle stays on the left and content no longer clips under oversized titlebar padding.
+- QA-Lab/Codex: bundle auth/plugin fixture imports for flow scenarios and let terminal async media tools end Codex app-server turns without timing out. (#80397, refs #80323) Thanks @100yenadmin.
+- Gateway/agents: preserve fresh session overrides and metadata when stale cached agent-session entries race with store updates, so subagent model/provider overrides and routing policy survive concurrent writes. (#19328) Thanks @CodeReclaimers.
+- Control UI/chat: keep chat session search inline with the session selector so the header no longer shows a duplicate standalone search row.
+- Control UI/chat: collapse focused-mode header chrome and suppress hidden-header scroll updates so focus mode no longer jumps while scrolling. Thanks @amknight.
+- Codex app-server: restart the native app-server and retry once when server-side compaction times out, so preflight compaction stalls recover instead of failing every dispatch. (#85500)
+- Restore Control UI gateway token pairing [AI]. (#85459) Thanks @pgondhi987.
+- OpenAI video: honor configured provider request private-network opt-in for local/custom video endpoints so explicitly trusted mock and self-hosted providers are not blocked. Thanks @shakkernerd.
+- OpenAI video: send uploaded video edit requests to the documented `/videos/edits` endpoint with a `video` file instead of posting MP4 references to `/videos`. Thanks @shakkernerd.
+- Agents/channels: preserve message-tool delivery evidence through gateway agent completion handoffs so successful generated media sends are not followed by false failure messages. Thanks @shakkernerd.
+- CLI/update: repair managed npm plugin `openclaw` peer links during post-core convergence and reject stale or wrong-target peer links before restart. (#83794) Thanks @fuller-stack-dev.
+- CLI/agents: default new omitted-account bindings to all accounts when the channel has multiple configured accounts, and clarify account-scope docs. (#49769) Thanks @Gcaufy.
+- Codex app-server: let authorized `/codex` control commands such as `/codex detach` escape plugin-owned conversation bindings while keeping unknown or unauthorized slash text routed to the bound plugin. Fixes #85157. (#85188) Thanks @TurboTheTurtle.
+- Auto-reply/models: keep `/models` browse replies fast by sharing the bounded read-only catalog path with Gateway model listing. (#84735) Thanks @safrano9999.
+- Codex app-server: disable native Code Mode when the effective exec host is `node` and keep OpenClaw `exec`/`process` available, so `/exec host=node` routes shell commands through the selected node instead of the gateway. Fixes #85012. (#85090) Thanks @sahilsatralkar.
+- Agents: bound embedded auto-compaction session write-lock watchdogs to the compaction timeout instead of the full run timeout, so stuck compaction cannot hold the live session lock for the whole run window. (#84949) Thanks @luoyanglang.
+- Gateway/agents: return phase-aware `agent.wait` timeout attribution and only cool auth profiles on provider-started timeouts. Refs #65504. Thanks @100yenadmin.
+- Gateway: defer provider auth-state prewarm until after startup readiness so early gateway tool/session requests are not blocked by provider auth discovery. (#85272) Thanks @dutifulbob.
+- Gateway/models: coalesce provider auth-state rewarms after auth-profile failures and log event-loop delay for warm/rewarm work, so provider auth bursts no longer stack full auth sweeps behind channel replies.
+- Gateway/models: stop cancelled provider auth-state prewarms from continuing full provider sweeps, so reload and auth-failure bursts no longer keep startup busy.
+- Agents/Codex: show the first plan update as a transient chat status notice without counting it as final assistant content.
+- CLI/update: walk the macOS process ancestry and honor the inherited Gateway runtime PID before package updates stop the managed Gateway service, so nested in-band updater children can refuse instead of killing the LaunchAgent-supervised Gateway that owns them. Fixes #85120.
+- Gateway/LaunchAgent: wait for launchd reload bootout to finish and fall back to kickstart when bootstrap races, so reload handoff does not leave the service deregistered. Fixes #84630. (#84641) Thanks @NianJiuZst.
+- Gateway/LaunchAgent: treat a concurrent launchd bootstrap as a successful restart when the service is already loaded, avoiding false macOS Gateway restart failures. Fixes #84721. (#84722) Thanks @googlerest.
+- Gateway/service: include the active `openclaw` command bin directory in managed service PATH generation and doctor audit expectations for npm-global macOS installs. Fixes #84201. (#84475) Thanks @jbetala7.
+- Control UI/chat: disable the thinking selector for known non-reasoning models instead of showing duplicate Off choices. Fixes #84069. Thanks @DrippingMellow.
+- Memory: expand `~` in configured extra memory paths before resolving them, so home-relative folders are not treated as workspace-relative. Fixes #58026. Thanks @stadman.
+- Skills: treat `openclaw.os: macos` as Darwin when checking skill requirements, so macOS-only skills no longer report as missing on macOS hosts. Fixes #61338. Thanks @Jessecq1995.
+- Control UI/logs: strip ANSI escape sequences from displayed Gateway log messages so color codes no longer appear as raw text. Fixes #64399. Thanks @guguangxin-eng.
+- Docker: pre-create the workspace and auth-profile config mount points with `node` ownership so first-run named volumes do not start root-owned. Fixes #85076. Thanks @Noerr.
+- Telegram: pass configured markdown table mode through outbound markdown chunking so chunked sends render tables consistently. Fixes #85085. Thanks @ShuaiHui.
+- CLI/update: preserve managed Gateway service environment during package cutovers so macOS LaunchAgent repair/restart reads the pre-update service state instead of caller shell state. (#83026)
+- Agents/providers: honor per-model `api` and `baseUrl` overrides in custom provider auth hooks and transport selection. Fixes #80487. (#80488) Thanks @huveewomg.
+- Gateway/restart: eager-load the lifecycle runtime before in-place upgrade signal handling so package replacement does not deadlock restart imports. (#84890) Thanks @myps6415.
+- CLI/update: start managed Gateway update handoff helpers from a stable existing directory and tolerate deleted cwd/package roots during macOS LaunchAgent handoff. Fixes #83808. (#83875) Thanks @jason-allen-oneal.
+- Skills: watch each shared skill directory once across agent workspaces instead of once per agent, preventing file-descriptor exhaustion (`EMFILE`) that disposed bundle-mcp processes and stalled sessions on multi-agent gateways. Fixes #84968. (#85130) Thanks @openperf.
+- Release/security: keep generated npm shrinkwrap package versions inside the pnpm lock graph so published package locks cannot bypass pnpm dependency age and override policy.
+- Cron: honor `cron.retry.retryOn: ["network"]` for common network error codes such as `EAI_AGAIN`, `EHOSTUNREACH`, and `ENETUNREACH`.
+- Gateway chat: broadcast returned agent-run error payloads after an agent starts so ACP/WebChat clients receive terminal idle-timeout errors. Fixes #84945.
+- Gateway chat display: preserve OpenAI-compatible `prompt_tokens`, `completion_tokens`, and `total_tokens` usage fields in sanitized chat history so llama.cpp sessions keep context counts. Fixes #77992. Thanks @MarTT79.
+- Dashboard/CLI: allow macOS browser launching through `open` even when SSH environment variables are present, while preserving Linux SSH no-display protection. Fixes #67088. Thanks @theglove44.
+- Codex app-server: keep native web search observations out of mirrored chat transcripts while preserving tool progress telemetry. Fixes #85109. Thanks @ugitmebaby.
+- OpenCode Go: strip unsupported Kimi reasoning replay fields before provider requests so repeated `kimi-k2.6` turns do not fail schema validation. Fixes #83812. Thanks @Sleeck.
+- Browser/CDP: add a WSL2 portproxy self-loop hint when Chrome DevTools endpoints accept connections but return an empty HTTP reply. Fixes #59209. Thanks @Owlock.
+- Agents/OpenAI: preserve structured provider error code, type, and redacted body metadata on boundary-aware transport failures.
+- Doctor/Codex: point native Codex asset warnings at the canonical `openclaw migrate plan codex` preview command. Fixes #84948. Thanks @markoa.
+- CLI/models: make `capability model auth logout --agent` remove auth profiles from the selected non-default agent store. Fixes #85092. Thanks @islandpreneur007.
+- Gateway/models: reuse prepared provider auth metadata during model-listing auth checks so repeated lookups avoid broad plugin discovery while preserving synthetic local auth.
+- CLI/status: suppress systemd user-service setup hints when `openclaw status --deep` can already reach a running Gateway RPC service. Fixes #85094. Thanks @islandpreneur007.
+- CLI/devices: recover local approval when a same-device repair request replaces the request ID being approved.
+- CLI/agents: retry transient normal-close Gateway handshakes before falling back to embedded `openclaw agent` execution.
+- CLI/update: keep managed Gateway service stop/restart status lines out of `openclaw update --json` stdout so package-update automation can parse the JSON payload.
+- Plugins: resolve OpenClaw plugin SDK subpaths for native external plugin runtimes without mutating package installs or broadening process-wide module resolution.
+- Agents/OpenAI: preserve Responses and Chat Completions `reasoning_tokens` usage metadata without double-counting it in aggregate output tokens. (#85319)
+- Control UI/chat: convert pasted `data:image/...;base64,...` clipboard text into an image attachment instead of dumping the payload into the composer. Fixes #62604. Thanks @cpwilhelmi.
+- Providers/Gemini: strip fractional seconds from web-search time range filters so Gemini accepts freshness-bound search requests. (#85071) Thanks @Noerr.
+- OpenAI Codex: preserve image input support for sparse `openai-codex/gpt-5.5` catalog rows. (#85095) Thanks @sercada.
+- CLI/models: add a piped or pasted API-key path for OpenAI Codex auth and warn when API keys are pasted into token-mode auth. (#85533) Thanks @joshavant.
+- Telegram: dead-letter missing-harness isolated ingress failures so a poisoned spooled update no longer blocks later same-lane messages. Fixes #85470. (#85605) Thanks @joshavant.
+- Plugins/discovery: strip `-plugin` package suffixes when deriving plugin id hints so package names line up with manifest ids. (#85170) Thanks @JulyanXu.
+- Tlon: stop advertising a non-existent agent tool contract in the plugin manifest.
+- Telegram: preserve fenced code block languages through Markdown rendering so Telegram receives `language-*` code classes. (#85209) Thanks @leno23.
+- Windows installer: run npm and Corepack command shims from a Windows-local directory so installs launched from WSL2 UNC paths do not fail before OpenClaw is installed.
+- Windows updates: roll back git-backed updates to the previous checkout when dependency install, build, UI build, or doctor repair fails.
+- Windows installer: persist user-local portable Git on PATH and activate the repo-pinned pnpm version for git-backed installs and updates.
+- Windows installer: bootstrap a user-local portable Node.js when native Windows has no Node and no winget, Chocolatey, or Scoop, so first-run installs can continue on raw hosts.
+- Windows installer: extract the downloaded portable Node.js directory with native `tar` before falling back to .NET zip extraction, avoiding PowerShell 5.1 archive and path-length failures.
+- fix(integrations): enforce channel read target allowlists [AI]. (#84982) Thanks @pgondhi987.
+- Agents/heartbeat: route single-owner `session.dmScope=main` direct-message exec and cron event wakes back to the agent main session so async completions no longer strand context in orphan direct-DM queues. Fixes #71581. (#83743) Thanks @Kaspre.
+- Agents/code-mode: expose outer code-mode `exec` source through the `command` hook alias with `toolKind`/`toolInputKind` discriminators so exec-shaped policies can distinguish code-mode cells. (#83483) Thanks @Kaspre.
+- Agents/code mode: return structured timeout and runtime-unavailable error codes for known worker failures. Fixes #83389. (#83444) Thanks @Kaspre.
+- QA-Lab: isolate multi-scenario suite workers when scenarios need startup config patches, preventing message-routing config from leaking into unrelated scenarios.
+- QA-Lab: make the commitments heartbeat-target-none scenario request an immediate heartbeat instead of waiting for the next scheduled heartbeat.
+- Codex/Plugin SDK: deliver Codex-native subagent completions through a generic harness task runtime so harness-backed plugins can mirror durable task lifecycle and completion delivery without Codex-specific SDK imports. (#83445) Thanks @bryanpearson.
+- Gateway CLI: surface local post-challenge connect assembly failures immediately instead of waiting for the wrapper timeout. Fixes #68944. (#85253) Thanks @samzong.
+- Messages: strip unsupported web-search citation control markers from outbound replies before they reach WebChat or external channels. Fixes #85193. (#85204) Thanks @neeravmakwana.
+- Agents/exec: treat denied exec approvals as terminal instead of feeding them back into agent follow-up work, and recognize Chinese stop phrases in abort handling. Fixes #69386. (#85194) Thanks @samzong.
+- CLI/agents: abort accepted Gateway-backed `openclaw agent` runs on SIGINT/SIGTERM so cron and supervisor timeouts do not leave remote agent work alive. Fixes #71710. (#84381) Thanks @Kaspre.
+- Codex app-server: retry replay-safe stdio client-close turns once using structured failure metadata, while surfacing idle `turn/completed` timeouts instead of blindly replaying active shared-server turns. Thanks @VACInc.
+- Codex app-server: reject command overrides that embed Node or package-manager arguments and point users to `appServer.args`, so Windows startup avoids shell parsing failures. (#84417) Thanks @TurboTheTurtle.
+- Agents/Copilot: drop unsafe GitHub Copilot Responses reasoning replay items before send so Telegram direct sessions no longer fail on overlong replay IDs. Fixes #85197. (#85198) Thanks @galiniliev.
+- UI: add accessible tooltips to the topbar color-mode buttons so System, Light, and Dark choices are labeled on hover and focus. (#85227) Thanks @amknight.
+- fix: constrain Windows task script names [AI]. (#85064) Thanks @pgondhi987.
+- Control UI: keep the chat session picker from hiding older or cross-agent configured conversations while preserving the bounded configured-agent refresh. (#85211) Thanks @amknight.
+- Agents/Anthropic: preserve unsafe integer tool-call input values in streamed Anthropic tool-use JSON, preventing Discord-style IDs from being rounded before dispatch. Fixes #47229. (#83063) Thanks @leno23.
+- Agents/Codex: estimate tool-heavy prompt pressure at the LLM boundary before provider submission, so persistent sessions compact before overflowing context windows. (#85541) Thanks @fuller-stack-dev and @joshavant.
+- Agents/hooks: wait for local one-shot CLI and Codex `agent_end` plugin hooks before process cleanup so terminal observability flushes reliably. (#85007)
+- Providers/Google: preserve Gemini 3 cron `thinkingDefault: "low"` when stale catalog metadata says `reasoning:false`, so scheduled runs keep provider-supported thinking instead of downgrading to off. (#85185) Thanks @neeravmakwana.
+- CLI/agents: allow `openclaw agent --session-key` to target explicit session keys, including agent-scoped legacy keys. (#85121) Thanks @Kaspre.
+- Auto-reply/ACP: wait for same-channel block reply delivery before starting tool work, while still honoring ACP dispatch aborts so stopped turns do not wait on slow channel sends. (#83722) Thanks @IWhatsskill.
+- Codex/ACP: mark required child-run completions that only report progress, omit a final deliverable, or fail requester delivery as blocked while preserving real final reports. (#85110) Thanks @IWhatsskill.
+- Channels: treat bare abort messages such as `stop`, `abort`, and `wait` as immediate control commands in inbound debounce paths so stop requests are not delayed behind pending message coalescing. (#83348) Thanks @IWhatsskill.
+- Channels/message tool: resolve configured external channel plugins during in-agent channel selection, so `openclaw agent --local` message-tool sends no longer report an available channel as unavailable. (#85022) Thanks @Kaspre.
+- Agents/heartbeat: honor group/channel `message_tool` visible-reply policy and model-specific Codex runtime config for scheduled heartbeat runs, so failed internal tool output stays private. Fixes #85310. (#85357) Thanks @neeravmakwana.
+- Gateway/ACP: close child ACP sessions spawned via `sessions_spawn` when their parent session is reset or deleted, instead of leaving orphaned `claude-agent-acp` processes that accumulate and exhaust memory. Fixes #68916. (#85190) Thanks @openperf.
+- Codex app-server: block native execution paths when OpenClaw exec resolves to a node host while preserving the first-party CLI node binding path. Fixes #85012. (#85534) Thanks @joshavant.
+- Diagnostics: bound cleanup timeout detail logs, emit drop summaries when async diagnostic bursts exceed the queue cap, and surface async queue drops through diagnostic telemetry.
+- Agents/subagents: surface blocked child-run completions as errors instead of successful subagent finishes. (#80886) Thanks @TurboTheTurtle.
+- Context engines: fail closed with a descriptive error when the selected agent runtime cannot satisfy declared context-engine host requirements.
+- Agents/Pi: treat accepted embedded `sessions_spawn` child-session handoffs as terminal progress so parent turns no longer report false non-deliverable failures. (#85054) Thanks @samzong.
+- CLI/models: resolve `openclaw models set` aliases from the runtime config while keeping authored aliases ahead of runtime-only defaults. (#83262) Thanks @IWhatsskill.
+- Doctor: show personal Codex CLI asset notices as info instead of warnings. Fixes #84859.
+- WhatsApp: update Baileys to `7.0.0-rc13` and drop the obsolete logger type patch.
+- CLI/update: pre-pack GitHub/git package update targets before the staged npm install, restoring `openclaw update --tag main` for one-off package updates. (#81296) Thanks @fuller-stack-dev.
+- Gateway: mirror successful same-source message-tool sends into session transcripts so delivered replies stay in later history/context. (#84837) Thanks @iFiras-Max1.
+- Media generation: keep image, music, and video completion delivery from duplicating or losing task ownership when generated media finishes through active session replies. (#84006) Thanks @fuller-stack-dev.
+- Infra/json: retry transient `File changed during read` races while loading JSON state so config and state reads recover instead of failing the turn. (#84285)
+- Plugins/providers: fail closed for workspace provider plugins during setup-mode discovery unless explicitly trusted, preventing untrusted workspace plugin code from running during provider setup. (#81069) Thanks @mmaps.
+- Providers/Ollama: resolve configured Ollama Cloud `OLLAMA_API_KEY` markers to the real discovery key so cloud provider entries keep authenticated model catalog access. (#85037)
+- Discord: keep persistent component registry fallback warnings actionable by forwarding structured error and cause metadata through the runtime logger. Fixes #84185. (#84190) Thanks @100menotu001.
+- Gateway/sessions: preserve compatible session auth profile overrides when switching models within the same provider, including provider-auth aliases. Fixes #81837. (#81886) Thanks @TurboTheTurtle.
+- Gateway/status: surface inbound delivery telemetry counters and transport-liveness warnings in `openclaw status --all`. Fixes #49577. (#72724)
+- Docker: prune package-excluded plugin source workspaces and dependency closures so runtime images do not keep packages for plugins that were not opted in.
+- Providers/Ollama: treat Docker/OrbStack host aliases as local Ollama endpoints so `ollama-local` marker auth works when OpenClaw runs inside a VM/container and Ollama runs on the host. Fixes #84875.
+- QA-Lab: keep explicitly searchable/deferred OpenClaw dynamic tool rows report-only by default so tool-coverage gates do not treat mock discovery gaps as hard product failures. (#80319) Thanks @100yenadmin.
+- Agents/config: keep non-Google provider model refs from being rewritten by Google Gemini preview-id normalization. (#84762) Thanks @zhangguiping-xydt.
+- Installer: require a real controlling terminal before launching onboarding so headless `curl | bash` installs finish cleanly after installing the CLI.
+- Agents/Codex: promote a completed final assistant response when a prompt timeout races Codex app-server completion instead of returning an empty timeout envelope. Refs #84516.
+- Codex app-server: keep interrupted turn statuses from being treated as OpenClaw aborts by themselves, so tool-only turns remain eligible for no-visible-answer recovery. Fixes #84492.
+- Agents: cap heartbeat model bleed context hints by the stored session window when runtime model metadata is unavailable, so overflow recovery advice does not suggest a larger window than the active session actually has.
+- Control UI/Web Push: use `https://openclaw.ai` as the generated default VAPID subject instead of the old localhost mailbox so iOS PWA push setup uses an Apple-acceptable subject when `OPENCLAW_VAPID_SUBJECT` is unset. Fixes #83134. (#83317) Thanks @IWhatsskill.
+- Control UI: distinguish inherited thinking-off settings from explicit Off selections so the thinking selector no longer shows two identical Off rows. (#85223) Thanks @amknight.
+- Agents/Pi: keep embedded session transcript writes from tripping false takeover detection after packaged npm onboarding agent turns.
+- Codex/TUI: surface Codex-native post-turn compaction failures instead of continuing uncompacted, and keep successful native compaction serialized before local idle/next-turn handling. Fixes #84305. (#85160) Thanks @joshavant.
+- Memory/search: stop recall tracking from writing dreaming side-effect artifacts when `dreaming.enabled=false`, while preserving normal search results. Fixes #84436. (#84444) Thanks @NianJiuZst.
+- Diffs: render viewer toolbar icons from a closed icon-name map instead of HTML strings, removing the toolbar icon XSS sink. (#83955) Thanks @tanshanshan.
+- QA: keep `pnpm qa:e2e` self-check runs inside the private QA runtime envelope even when inherited shell env disables bundled plugins.
+- fix(config): validate browser sandbox bind sources [AI]. (#84799) Thanks @pgondhi987.
+- doctor: constrain legacy plugin cleanup paths [AI]. (#84801) Thanks @pgondhi987.
+- Update/doctor: prune stale local bundled plugin install records that point at old compiled bundled output so current bundled plugin schemas win after upgrade. (#84863) Thanks @fuller-stack-dev.
+- Providers/Ollama: preserve native Ollama tool-call IDs across assistant replay so Gemini over Ollama Cloud can keep its hidden function-call thought-signature handle.
+- Discord: keep session recovery and `/stop` abort ownership on the source dispatch lane while bound ACP turns continue routing to their target session, so stalled pre-run work and late replies are cleared instead of leaking after stop. Fixes #84477. (#85100) Thanks @joshavant.
+- Codex app-server: mark missing turn completion after observed execution as replay-unsafe and release the session so follow-up turns can run. Fixes #84076. (#85107) Thanks @joshavant.
+- Codex app-server: give visible `message` dynamic tool sends a longer timeout budget so slow channel delivery can return its own result or error instead of hitting the 30-second Codex wrapper. (#85216) Thanks @amknight.
+- Codex app-server: add a dedicated post-tool raw assistant completion idle timeout config so trusted heavy turns can wait longer after tool handoff without weakening final assistant release.
+- Matrix: keep explicitly configured two-person rooms on the room route before stale `m.direct` or strict two-member DM fallback can bypass mention gating. Fixes #85017. (#85137) Thanks @joshavant.
+- Agents/subagents: require explicit subagent allowlist targets to be configured agents so stale deleted-agent ids are omitted from `agents_list` and rejected by `sessions_spawn`. Fixes #84811. (#85154) Thanks @joshavant.
+- PDF tool: time out idle remote PDF body reads after 120 seconds so stalled remote documents return an error instead of wedging the session. Fixes #68649. (#84768) Thanks @luoyanglang.
+- Diagnostics/OpenTelemetry plugin: suppress handled OTLP exporter promise rejections so collector shutdowns no longer crash the Gateway. (#81085) Thanks @luoyanglang.
+- Agents/exec: omit raw command text and env values from denied exec failure logs while keeping safe correlation metadata. Fixes #85049. (#85140) Thanks @joshavant.
+- Media/audio: skip empty structured sherpa-onnx transcripts instead of treating the raw JSON payload as spoken text. (#84667) Thanks @TurboTheTurtle.
+- Agents/exec: preserve inherited XDG base-directory environment values for subprocesses while still rejecting agent-supplied XDG overrides. Fixes #84854. (#85139) Thanks @joshavant.
+- Node/Linux: keep `OPENCLAW_GATEWAY_TOKEN` out of generated systemd unit files by writing node service token values to a node-specific env file. (#84408)
+- Memory-core/dreaming: reuse stable narrative subagent session keys per workspace and phase while keeping per-run idempotency and bounded cleanup, so stale `dreaming-narrative-*` sessions do not accumulate. Fixes #68252, #69187, and #70402. (#70464) Thanks @chiyouYCH.
+- Trajectory/support: tolerate partial skill snapshot entries when building support metadata so rejected skill path scans no longer abort trajectory capture. (#71185) Thanks @lukeboyett.
+- TUI: coalesce repeated idle Esc abort notices into a single `no active run xN` system row instead of appending duplicate rows.
+- Telegram: honor `channels.telegram.pollingStallThresholdMs` in the default isolated polling path, restarting silent workers instead of leaving inbound updates wedged. Fixes #83950. (#84861) Thanks @joshavant.
+- Telegram: dedupe replayed message dispatches by Telegram chat/message identity so isolated-ingress replays do not trigger duplicate model dispatches. Fixes #84886. (#85208) Thanks @joshavant.
+- Slack: suppress reasoning payloads before reply delivery and dispatch accounting, so Slack monitor, slash-command, fallback, and direct reply paths do not leak model reasoning. Fixes #84319. (#84322) Thanks @ffluk3 and @joshavant.
+- Slack: deliver native plugin approval prompts and updates when Slack native approvals are enabled, while keeping plugin approval authorization separate from exec approvers.
+- Slack: keep native plugin approval prompts in the originating app conversation thread when the live Slack turn source is a `D...` conversation.
+- Agents/Pi: disable the embedded pi-coding-agent runtime auto-retry so OpenClaw's own retry and failover loop does not replay failed tool calls through a nested SDK retry. Fixes #73781. (#74434) Thanks @yelog.
+- CLI/perf: keep `setup --help`, `onboard --help`, and `configure --help` out of the full wizard runtime while preserving the existing help output. (#84488) Thanks @frankekn.
+- CLI/perf: keep `agents --help` out of agents action/runtime imports so help, completion, and command discovery paths avoid loading the full agents runtime. (#84483) Thanks @frankekn.
+- CLI/perf: keep `secrets --help` and `nodes --help` on the precomputed help path so parent help avoids loading action-heavy command runtime modules. (#84818) Thanks @frankekn.
+- CLI/perf: serve `doctor`, `gateway`, `models`, and `plugins` parent help from startup metadata so common subcommand help avoids full CLI program construction. (#84786) Thanks @frankekn.
+- Codex/Lossless: keep context-engine history on the canonical run session when Telegram DMs use per-peer runtime policy keys. Fixes #84936. (#84954) Thanks @neeravmakwana.
+- Codex: keep heartbeat response tool schemas durable without exposing dynamic tools disabled by turn policy, so heartbeat wakeups can reuse threads while scoped tool allowlists stay enforced. (#84681) Thanks @jalehman.
+- Auth/OAuth: skip the refresh adapter when a stored OAuth credential has no refresh token so agent turns fail fast on missing-key instead of waiting on the 120s refresh timeout. Thanks @RomneyDa.
+- Auth/Codex: load legacy OAuth sidecar credentials in the embedded runner's secrets-runtime auth loaders so Telegram replies, cron-triggered turns, and other isolated sub-agent lanes can reach the existing #83312 refresh-and-rewrite migration instead of failing with `No API key found for provider "openai-codex"` until the user runs `openclaw doctor`. Thanks @Totalsolutionsync and @RomneyDa.
+- Codex/failover: classify `deactivated_workspace` as a permanent auth failure so configured fallback models can advance when a Codex workspace is deactivated. (#55893) Thanks @litang9.
+- Exec: keep configured `tools.exec.pathPrepend` entries ahead of user shell startup PATH changes on POSIX gateway runs. (#81403) Thanks @medns.
+- Gateway/sessions: allow shared-secret bearer callers to read and stream session history without an explicit scope header. (#81815) Thanks @medns.
+- Agents/embedded runner: classify HTML auth provider responses as `auth_html` and return a re-authentication hint instead of the CDN-blocked copy that `upstream_html` returns. Cloudflare Access login pages, nginx basic-auth challenges, and gateway login walls all produce HTML auth bodies that were previously misdiagnosed as transient CDN blocks. (#79900) Thanks @martingarramon.
+- TUI/streaming watchdog: dismiss the `This response is taking longer than expected` notice as soon as a chat event for the same run arrives, so the message no longer sits next to the recovered response when the run was only briefly silent. Refs #67052, #69081 (closed), prior attempt #69026. Thanks @jpruit20 and @RomneyDa.
+- Agents/auth profiles: replace the bare `No available auth profile for <provider> (all in cooldown or unavailable)` TUI error with plain-language copy that explains what happened in user terms (sign-in expired, provider asking us to slow down, billing issue on the account, etc.) and suggests the matching `openclaw models auth login --provider <provider>` recovery command for sign-in and billing causes, while falling back to the underlying provider error for cases without a clear recovery path. Thanks @RomneyDa.
+- Agents/Pi: tolerate OpenClaw-owned transcript writes while embedded prompts are released for model I/O, keeping long-running Feishu, Slack, Telegram, and cron turns from failing with false session-takeover errors. Fixes #84059. (#84250) Thanks @tianxiaochannel-oss88.
+
diff --git a/CHANGELOG/2026.5.26.md b/CHANGELOG/2026.5.26.md
new file mode 100644
index 0000000000000000000000000000000000000000..8f5aec29e1c6e52503a93e74b02398e14befc227
--- /dev/null
+++ b/CHANGELOG/2026.5.26.md
@@ -0,0 +1,204 @@
+## 2026.5.26
+
+### Highlights
+
+- Faster Gateway and replies: startup avoids repeated plugin, channel, session, usage-cost, warning, scheduled-service, and filesystem scans; visible replies separate user-facing sends from slower follow-up work; Gateway runtime/session caches churn less under load.
+- Transcripts are core: transcript-backed meeting summaries, source-provider chunks, cleaned user turns, media provenance, Codex mirrors, WebChat replies, and CLI/TUI replay now use one more reliable transcript path.
+- More channels are production-ready: Telegram keeps typing/progress context and forum topics, iMessage handles attachment roots, remote media staging, and duplicate local Messages sources, WhatsApp restores group/media behavior, Discord improves voice playback and model picking, and Signal/iMessage/WhatsApp get reaction approvals.
+- Better voice and Talk: realtime Talk runs can be inspected, steered, cancelled, or followed up from Web UI and Discord voice; wake-name handling is more tolerant without letting ambient speech trigger agents.
+- Safer content boundaries: Browser snapshot reads honor SSRF policy, system-event text cannot spoof nested prompt markers, fetched file text is wrapped as external content, ClickClack inbound sender allowlists run before agent dispatch, stale device tokens are rejected, and serialized tool-call text is scrubbed from replies.
+- Providers, Codex, and local models are steadier: named auth profiles, OpenAI sampling params, Codex app-server resume/timeout/usage-limit recovery, dynamic tool-schema guards, xAI usage-limit surfacing, Ollama top-p normalization, and local approval resolution reduce provider-specific dead ends.
+- More reliable install/update/release paths: Alpine installs, trusted runtime fallback roots, stable update channels, Docker/package timeouts, Windows Scheduled Tasks, Windows/macOS proof lanes, Testbox/Crabbox delegation, plugin publish checks, and macOS runner bootstraps all got hardened.
+- Better observability: Activity tab, gateway secret-prep traces, tool/model stream progress, explicit fast-mode status, systemd Gateway hygiene, OpenTelemetry LLM spans, release performance evidence, and richer telemetry signals make failures easier to inspect.
+
+### Changes
+
+- Transcripts: add core transcript capture and source-provider support for transcript-backed meeting summaries, including the renamed Transcripts docs, CLI surface, source-provider chunks, and cleaned user-turn persistence.
+- Auth: add named model login profiles and supported credential migration for Hermes, OpenCode, and Codex auth profiles, with explicit opt-out and non-interactive controls. (#85667) Thanks @fuller-stack-dev.
+- Diagnostics: trace gateway secret preparation, classify skill/tool usage, surface model stream progress, add OpenTelemetry LLM content spans, and expose alertable telemetry for blocked tools, failover, stale sessions, liveness, oversized payloads, and webhook ingress. (#83019, #80370, #86191)
+- Channels: add Signal reaction approvals, iMessage thumb approval reactions, and WhatsApp thumb approval reaction support so mobile approval flows work without textual `/approve` commands. (#85894, #85952, #85477)
+- Agents/API: forward OpenAI sampling params through the Gateway and expose estimated context-budget status for active agent runs. (#84094)
+- TUI/status: queue prompts submitted while an agent is busy and show explicit fast-mode state plus richer systemd Gateway hygiene in status output. (#86722, #87115, #86976)
+- Exec approvals: hide durable approval actions that are unavailable for the current prompt and keep approval runtime tokens local-only so stale prompts cannot offer misleading controls. (#86270, #86359)
+- Plugin SDK: add reaction approval helpers and keep diagnostic event root exports discoverable across function-name and alias-bound module graphs. (#86735, #87084)
+- Android/iOS: add the Android pair-new-gateway action and improve mobile Talk mode surfaces, including iOS realtime Talk mode and Android offline voice/gateway recovery. (#86798, #86355) Thanks @ngutman.
+- Performance: cache plugin metadata snapshots, package realpaths, stable gateway metadata, model cost indexes, channel resolution, usage-cost indexes, and session/auth hot-path facts so common Gateway and reply paths do less rediscovery. (#84649, #85843, #86517, #86678)
+- Voice: expose shared realtime turn-context tracking through the realtime voice SDK and reuse it for Discord speaker attribution and wake-name context recovery.
+- Voice: reuse shared realtime output activity tracking in Google Meet command and node audio bridges, including recent-output checks for local barge-in detection.
+- Voice: expose shared realtime output activity tracking through the realtime voice SDK and reuse it for Discord playback activity and barge-in decisions.
+- Voice: expose shared realtime consult question matching, speakable-result extraction, and alias-aware forced-consult coordination through the realtime voice SDK, then reuse it in Gateway Talk, Voice Call, and Discord voice paths.
+- Voice: share activation-name matching and consult-transcript screening through the realtime voice SDK so Discord, browser voice, and meeting surfaces can reuse one implementation.
+- Cron: default `cron.maxConcurrentRuns` to 8 so scheduled automations and their isolated agent turns can make progress in parallel without explicit configuration.
+- QA-Lab: add `qa coverage --match <query>` so focused proof selection can discover matching scenarios from existing metadata before running live or remote lanes.
+- Discord/model picker: surface an alpha-bucket select (e.g. `A–G (12) · H–N (18) · O–Z (5)`) when the provider list or a provider's model list exceeds 25 items, so configs with `provider/*` wildcards stay one click from the right page instead of paginating through prev/next; falls back to numeric chunks when every item shares the same first letter. (#86181) Thanks @rendrag-git.
+- Control UI: add an ephemeral Activity tab for sanitized live tool activity summaries without persisting raw telemetry. Fixes #12831. Thanks @BunsDev.
+- Build: include `ui:build` in the `full` and `ciArtifacts` profiles of `scripts/build-all.mjs` so `pnpm build` always rebuilds `dist/control-ui` after `tsdown` cleans `dist`, removing the second-command requirement and the missing-asset failure mode for source/runtime installs and CI artifact uploads. (#85206)
+- iOS: improve Talk mode with direct realtime voice sessions, compact toolbar status, and responsive voice waveform feedback. (#86355) Thanks @ngutman.
+- Media: replace the Sharp image backend with Rastermill for metadata, resizing, EXIF orientation, and PNG alpha-preserving optimization so OpenClaw no longer installs Sharp or the WhatsApp Jimp fallback for image processing. (#86437)
+- Codex: update the bundled Codex CLI to 0.134.0 and keep native compaction disabled for budget-triggered app-server turns so OpenClaw owns the recovery boundary. (#86772)
+
+### Fixes
+
+- Memory/security: reject prompt-like text submitted through the explicit `memory_store` tool before embedding or storage, matching the existing auto-capture prompt-injection filter. (#87142)
+- Gateway/security: enable the default auth rate limiter for remote non-browser and HTTP gateway auth failures when `gateway.auth.rateLimit` is unset, while preserving the loopback exemption. (#87148)
+- Prompt hardening: route untrusted group prompt metadata through sanitized untrusted structured context while preserving trusted operator-configured group system prompts and aligning the plugin SDK docs/test helpers. (#87144)
+- Security/content boundaries: validate Browser snapshot tab URLs against SSRF policy before ChromeMCP or direct CDP reads, sanitize queued system-event text so untrusted plugin/channel labels cannot spoof nested prompt markers, wrap fetched file text and metadata as external content, apply ClickClack `allowFrom` sender allowlists before agent dispatch, reject RPCs from invalidated device-token clients during rotation, require staged sandbox media refs, and scrub serialized tool-call text from replies. (#78526, #87094, #87062, #83741, #70707, #86924) Thanks @zsxsoft, @ttzero25, and @mmaps.
+- Transcripts/user turns: persist CLI, WebChat, media, follow-up, hook, and Codex-mirror user turns to the admitted session target; keep cleaned transcript text, inline image routing, provenance metadata, replay hooks, and fallback paths idempotent when runtimes fail or restart.
+- TUI/status/onboarding/UI: queue busy TUI prompts instead of dropping them, preserve the configured default model during onboarding, show failed tool results as errors, show config-open failures in Control UI, keep status JSON plugin scans healthy, preserve xAI usage-limit errors locally, and expose explicit fast-mode/systemd state. (#86722, #87000, #85786, #87108, #87001, #86614, #87115, #86976)
+- Plugin commands/SDK: preserve plugin LLM command auth, bind native plugin command dispatch to the host agent's LLM auth, keep `onDiagnosticEvent` exports discoverable through `Function.name`, stabilize diagnostic event root aliases, correlate pathless read diagnostics, suppress transient runner failures in channel command paths, and repair local approval resolution. (#85936, #87084, #86977, #87069, #86771)
+- Codex/providers: keep WebChat delivery hints out of user prompts, avoid false queued-terminal idle timeouts, share the native hook relay registry, quarantine unsupported dynamic tool schemas, preserve Claude resumed-session system prompts, normalize greedy Ollama `top_p`, preserve per-agent thinking defaults for ingress runs, and avoid native compaction takeover on budget-triggered Codex turns. (#87096, #73950, #87049, #86689, #86772)
+- Gateway/perf/release: reuse startup-warning metadata and prepared auth stores, avoid cloning live-switch and lifecycle session caches on read paths, defer warning and scheduled-service fallback imports, trim Gateway session/startup/runtime CPU churn, skip duplicate turn session touches, stop chat timeout fallback cascades, drop stale subagent announce history, bound benchmark/watch/kitchen-sink teardown waits, bound macOS/package/onboarding/plugin smoke commands, bound install finalization probes, resolve Parallels npm-update commands from guest `PATH`, and bootstrap raw AWS macOS Node/pnpm commands through `/usr/bin/env`. (#86997)
+- Reply/perf: reduce visible reply delivery latency by preserving Telegram typing/progress context, lazy-loading slash-command startup metadata, avoiding hot-path model hydration, flag-gating Codex profiler timing, deferring context compaction maintenance, and tracking delivery timing. (#86989, #86990, #86991, #86992, #86993, #86994) Thanks @keshavbotagent.
+- Reply/source delivery: keep TUI, Control UI, media, TTS, transcript, and Codex source-reply finals live without duplicate terminal events or stale replay artifacts.
+- Agents/replay: repair legacy tool results before replay, preserve `sessions_spawn` transcript payloads, restore current guard checks, stage sandboxed workspace media, and keep duplicate transcripts tool display metadata from reappearing. (#82203, #86934, #87025) Thanks @martingarramon, @vincentkoc, and @joshavant.
+- Agents/sessions: handle active-fallback failures in `sessions_send` so fallback routing reports the real failure and does not leave callers with an ambiguous dropped send. (#86638)
+- Agents/hooks/subagents: enforce default hook agent allowlists, recover failed subagent lifecycle completions, and keep node task lifecycle cleanup from closing the Gateway listener. (#86101)
+- Codex: project newer OpenClaw chat history into resumed app-server threads and keep Codex turn timeouts inside the Codex runtime boundary so timeouts do not poison shared app-server clients or fall through to unrelated provider fallback. (#86677, #86476) Thanks @TurboTheTurtle and @pashpashpash.
+- Config/doctor/update: narrow profiled tool-section doctor repair, keep runtime-injected legacy web-search provider config out of user-authored config validation, and keep prerelease tags excluded from stable updater resolution. (#87030, #86818, #86559) Thanks @joshavant, @luoyanglang, and @stevenepalmer.
+- Doctor/runtime: validate active bundled MCP tool schemas through the same runtime projection path so unsupported MCP input schemas are reported and quarantined instead of poisoning assistant startup.
+- CLI/Windows: add a Windows-only stack-size respawn for stack-heavy startup paths, default CLI logs to local timestamps, and validate timeout/banner TTY state more strictly. (#87031, #85387) Thanks @giodl73-repo and @vincentkoc.
+- Locking/security: require owner identity proof before stale plugin lock removal, memoize session lock owner arguments, and avoid writing default exec approval stores unless policy state actually changed. (#86814, #86964) Thanks @Alix-007 and @vincentkoc.
+- Install/release: bound Docker package build, inventory, pack, and tarball preparation with process-group timeouts; pin shrinkwrap patch drift to the pnpm lock; harden macOS restart and dSYM packaging; and run release Docker/live timeout wrappers in the foreground so child processes cannot wedge gates.
+- QA/Telegram: bound Telegram user credential tar and broker calls so live proof setup fails with a timeout instead of waiting for the outer Crabbox job deadline.
+- QA/Tool Search: bound gateway E2E HTTP probes, run only the fixture plugin, and clean up temporary fixture trees after the compact tool-catalog proof completes.
+- Telegram/network: treat `ENETDOWN` as a transient pre-connect network failure so Telegram sends, gateway unhandled-rejection handling, and cron network retries follow the same recovery path as sibling network outages. (#86762) Thanks @TurboTheTurtle.
+- Telegram: preserve inbound text entities, overlapping DM replies, account topic cache sidecars, outbound reply context, targeted bot-command mentions, durable group retry targets, forum topic names, and native progress callbacks. (#83873, #85361, #85555, #85656, #85709, #86299, #86553) Thanks @SebTardif, @luoyanglang, and @neeravmakwana.
+- iMessage: read image attachments from local Messages attachment roots, dedupe duplicate local Messages-source accounts, seed direct DM history, fix image/group media attachment commands, advance catchup cursors after live handling, and keep slash-command acknowledgements in the source conversation. (#82642, #85475, #86569, #86705, #86706, #86770) Thanks @homer-byte, @TurboTheTurtle, @swang430, and @OmarShahine.
+- WhatsApp/QQ/Twitch/IRC/Slack: restore WhatsApp ack identity and group-drop warnings, make QQ Bot media respect `OPENCLAW_HOME`, serialize Twitch auth disconnects, store IRC channel routes canonically, and keep Slack downloaded files out of reply media. (#83833, #85309, #85777, #85794, #85906, #86318, #86697) Thanks @sliverp, @neeravmakwana, and @Kailigithub.
+- Discord/voice: improve voice playback and wake replies, bucket large model picker menus, merge media captions into one message, route metadata through configured proxies, restore numeric channel sends, suppress self-reply echoes, and tighten wake matching without breaking fuzzy wake phrases. (#80227, #86238, #86487, #86571, #86595, #86601)
+- Codex: preserve native web-search metadata, keep oversized native thread reuse, bridge CLI API-key auth into the app server, preserve sandbox bootstrap path style, recover context-window prompt errors, honor yolo approval policy, disable native thread personality, and route compaction through Codex auth. (#85378, #85542, #85891, #85909, #86408)
+- Agents/runtime: enforce session lock max-hold reclaim, release embedded-attempt locks on all exits, treat aborted subagent runs as terminal, avoid runtime model hydration on hot paths, disclose scoped session list counts, derive overflow budgets from provider errors, and keep fallback errors scoped to the active model candidate. (#70473, #85764, #86014, #86134, #86427, #86944) Thanks @openperf, @fuller-stack-dev, @zhangguiping-xydt, and @ferminquant.
+- Config/update/doctor: retry config recovery after failed backup restore, skip shell env fallback on Windows, exclude prerelease tags from the stable git channel, support deep config edits, warn instead of aborting on unreadable cron stores, prune stale bundled plugin paths, and avoid duplicate restart prompts when the Gateway is already healthy. (#85739, #85787, #86060, #86260, #86384, #86533) Thanks @liaoyl830.
+- Install/release: support Alpine CLI installs and runtime floors, prefer trusted startup argv runtime fallback roots, reject stale CLI node runtimes, avoid npm `min-release-age` installer failures, bound npm/package/Docker install phases, restore config parent ownership in Docker, seed Docker lockfile package tarballs before prune, make release/plugin prerelease checks fail closed instead of hanging or false-greening, and use host-visible Crabbox local work roots for Docker-backed proof. (#85491)
+- Windows daemon: keep Scheduled Task gateway launches running on battery power and avoid workgroup-machine prompts for a domain user during task installation. (#59299)
+- Security: avoid printing Gateway tokens in Docker, validate plugin model-pattern regexes safely, escape transcript metadata field names, harden session allowlist glob matching, audit Claude permission overrides under YOLO, and require explicit allow for ACP auto approvals. (#85849, #85934, #86046, #86557)
+- Media/images: replace Sharp with Rastermill, keep EXIF normalization best-effort, normalize HEIC/HEIF before image descriptions, route Codex image API keys through OpenAI, preserve image compression metadata, and auto-scale live tool result caps. (#85776, #86037, #86437, #86857, #86923)
+- Memory: prevent semantic vector indexes from silently degrading when embeddings are unavailable, stop doctor OOMs on large session stores, preserve sidecar hooks/artifacts, write fallback dream diaries, use CJK-aware dreaming dedupe, and avoid per-file watcher FD fan-out. (#80613, #82928, #85060, #85704, #85967, #86701) Thanks @brokemac79, @openperf, and @yaaboo-gif.
+- Agents/sessions: include visibility metadata on restricted `sessions_list` results so scoped counts are clearly reported without widening access or exposing hidden-session counts. (#86944) Thanks @ferminquant.
+- Gateway/DNS: validate wide-area discovery domains before deriving zone paths or writing zone files, so invalid `discovery.wideArea.domain` and `dns setup --domain` values fail with a DNS-name diagnostic instead of falling through to unrelated configuration errors. Thanks @mmaps.
+- Agents/BTW: route fallback side-question streams through the embedded stream resolver so Anthropic-compatible MiniMax requests use the same capped transport as normal chat. (#86312) Thanks @neeravmakwana.
+- Telegram: treat `/command@TargetBot` bot-command entities as explicit mentions for the addressed bot so `requireMention` groups no longer drop targeted commands or captions. Fixes #84462. (#86553) Thanks @luoyanglang.
+- CI: bound Docker/Bash E2E tarball npm installs with `OPENCLAW_E2E_NPM_INSTALL_TIMEOUT` so package, onboarding, plugin, and upgrade lanes fail instead of hanging on a stuck npm install.
+- CI: fail Parallels npm-update smoke jobs after the guest command timeout and cleanup backstop instead of only logging a timeout line.
+- CI: bound kitchen-sink RPC HTTP probes so stalled gateway readiness or response bodies fail and retry instead of wedging the walker.
+- CI: bound Telegram user Crabbox proof Bot API calls so stalled Telegram responses fail instead of wedging credential and desktop proof cleanup.
+- CI: bound MCP channel stdio client initialization so Docker channel proof fails and closes the bridge transport instead of waiting for the outer job timeout.
+- CI: keep `OPENCLAW_TESTBOX=1 pnpm check:changed` delegating to Blacksmith Testbox through Crabbox without forwarding local Testbox or worker env into the remote command.
+- CI: send KILL after the TERM grace period for manual checkout fetch timeouts so stuck Testbox and workflow checkout retries cannot hang behind a wedged `git fetch`.
+- CI: send KILL after the TERM grace period for Bun global install smoke command timeouts so trapped `openclaw` child processes cannot wedge the scheduled install smoke.
+- iMessage: thread current channel/account inbound attachment roots into the image tool so iMessage-saved attachments under `~/Library/Messages/Attachments` (including the wildcard `/Users/*/Library/Messages/Attachments` root) are read through the existing inbound path policy instead of being rejected as `path-not-allowed`. Literal `localRoots` stays workspace-scoped. Fixes #30170. (#86569)
+- QQ Bot: respect `OPENCLAW_HOME` for outbound media path resolution so `<qqmedia>` sends no longer silently fail when `HOME` and `OPENCLAW_HOME` differ (Docker / multi-user hosts). Persisted QQ Bot data (sessions, known users, refs) stays anchored on the OS home for upgrade compatibility. Fixes #83562. Thanks @sliverp.
+- Update: report the primary malformed `openclaw.extensions` payload error without adding a duplicate missing-main diagnostic. (#86596) Thanks @ferminquant.
+- Control UI: keep host-local Markdown file paths inert while preserving app-relative links. (#86620) Thanks @BryanTegomoh.
+- Gateway: dampen repeated unauthenticated device-required probes per URL while preserving explicit-auth and paired recovery paths. (#86575) Thanks @ferminquant.
+- IRC: store inbound channel routes with the canonical `channel:#name` target and join transient channel sends before writing. (#85906) Thanks @Kailigithub.
+- Usage: surface unknown all-zero model pricing as missing cost entries instead of a confident `$0` total. (#85882) Thanks @MichaelZelbel.
+- Agents/Codex: honor yolo app-server approval policy only for the full `never` plus `danger-full-access` case. (#85909) Thanks @earlvanze.
+- Gateway/Gmail: clear Gmail watcher renewal intervals on re-entry so hot reloads do not leak lifecycle timers. (#82947) Thanks @SebTardif.
+- Logging: exit cleanly on broken stdout/stderr pipes without masking existing failure exit codes. (#80059) Thanks @pavelzak.
+- Gateway/security: escape transcript metadata field names while extracting oversized session line prefixes. (#85934) Thanks @SebTardif.
+- Plugins/security: validate manifest model pattern regexes with the safe-regex compiler so unsafe patterns are ignored before matching. (#86046) Thanks @SebTardif.
+- Discord: route gateway metadata REST lookups through the configured Discord proxy so proxied accounts do not fall back to direct `discord.com` connections before opening the WebSocket. Fixes #80227. Thanks @Clivilwalker.
+- Agents/media: hydrate current-turn image attachments from filename-derived MIME types so active vision can see generated or forwarded images whose source omitted an image content type. (#84812) Thanks @marchpure.
+- Agents/fs: point workspace-only scratch-path guidance at in-workspace temp directories while keeping host-root writes rejected by the tool guard. (#86501) Thanks @tianxiaochannel-oss88.
+- Agents/media: keep async cron media completions scoped to their run session while preserving direct delivery for stale generated-media success and failure notifications. (#86529) Thanks @ai-hpc.
+- Gateway: emit plugin `session_end`/`session_start` hooks when `agent.send` rotates or replaces a session id, keeping hook lifecycle state aligned with `sessions.changed` notifications. Fixes #83507. (#85875) Thanks @brokemac79.
+- OpenShell/SSH: reject malformed generated exec commands before sandbox/session setup so unresolved workflow placeholders fail fast instead of reaching the remote shell. Fixes #72373. Thanks @brokemac79.
+- Google: stop normalizing `gemini-3.1-flash-lite` to the retired preview endpoint and update Flash Lite alias guidance to the GA model id. Fixes #86151. (#86240) Thanks @SebTardif.
+- Installer: make Alpine apk installs cover Git, verify the Node runtime floor, try `nodejs-current`, and report Alpine version guidance when repositories only provide older Node packages.
+- Agents/status: prefer the active Claude CLI OAuth auth label over an unused Anthropic env API-key label for equivalent runtime aliases. Fixes #80184. (#86570) Thanks @brokemac79.
+- Agents/media: send direct fallback for generated media still missing after an active requester wake fails. (#85489) Thanks @fuller-stack-dev.
+- Agents: derive overflow compaction budgets from provider-reported and synthetic over-budget token counts so confirmed context overflows compact before retrying. (#70473) Thanks @fuller-stack-dev.
+- Agents/Codex: recover Codex context-window prompt errors through overflow compaction and surface reset guidance when recovery is exhausted. (#85542) Thanks @fuller-stack-dev.
+- Agents/Codex: allow Codex app-server runs to bootstrap from `CODEX_API_KEY` or `OPENAI_API_KEY` when no Codex auth profile is configured.
+- Agents/Codex: keep selected Codex runtime routing on OpenAI-Codex while preserving direct OpenAI API-key compaction fallback. (#86408) Thanks @funmerlin and @VACInc.
+- Agent transcript: include OpenClaw agent session logs when finding local transcript candidates.
+- Crabbox: bootstrap raw AWS macOS shell commands wrapped in absolute `time` paths so RSS probes can run Node and pnpm on fresh macOS runners.
+- Crabbox: bootstrap raw AWS macOS shell commands even when setup statements precede Node or pnpm usage.
+- TUI/local: skip unnecessary secret resolution, gateway model catalog loading, bootstrap, and skill scans in explicit local-model runs so startup reaches the model request faster.
+- Sessions/doctor: load large session stores without clone amplification during read-only doctor checks and reclaim stale `sessions.json.*.tmp` sidecars. Fixes #56827. Thanks @openperf.
+- Tests: clean successful plugin gateway gauntlet isolated temp roots while keeping an explicit preservation switch for failed/debug runs.
+- Plugins/perf: reuse derived plugin metadata snapshots for the lifetime of the process so reply-time skill setup no longer rescans plugin metadata on every turn.
+- Discord/OpenAI voice: keep wake-name master consults using the current speaker context after ignored ambient transcripts and shorten the default capture silence grace.
+- Doctor: skip redundant Gateway restart prompts when a recent supervisor restart leaves the Gateway healthy. Fixes #86518. (#86533) Thanks @liaoyl830.
+- Cron: restore suspended cron lanes to the configured/default concurrency instead of falling back to one after quota or circuit-breaker auto-resume.
+- Gateway: keep session-only Control UI tool-start mirrors flowing during diagnostic queue pressure instead of silently dropping non-terminal tool updates.
+- Agents/memory: return optional not-found context for missing date-only daily memory reads instead of logging benign first-run `ENOENT` failures. Fixes #82928. Thanks @galiniliev.
+- Discord: merge streamed text captions into following media block replies so captions and attachments send as one message. (#86487) Thanks @neeravmakwana.
+- Gateway: avoid sending duplicate tool-event frames to Control UI connections that are subscribed by both run and session.
+- Discord/OpenAI voice: accept broader edge-position fuzzy wake-name transcripts while keeping ambient speech gated.
+- Discord/OpenAI voice: accept longer leading wake-name mistranscripts such as "Open Club" for OpenClaw.
+- Agents/OpenAI-compatible: stop ModelStudio-compatible chat requests before sending system/tool-only payloads that have no usable user or assistant turn. (#86177) Thanks @TurboTheTurtle.
+- Gateway/plugins: reuse plugin package realpath checks while building installed plugin indexes so startup avoids repeated filesystem resolution work.
+- Kilo Gateway: send string `stop` sequences as arrays so Kilo accepts OpenAI-compatible chat completions. (#86461) Thanks @SebTardif.
+- Discord/OpenAI voice: accept leading fuzzy wake-name transcripts such as "Monty" or "Moti" for a Molty agent while keeping ambient speech gated.
+- Media understanding: convert HEIC and HEIF images to JPEG before image description providers run so iPhone photos work in direct and configured image-description flows. (#86037)
+- Agents: release embedded-attempt session locks from outer teardown so post-prompt exceptions cannot wedge later requests behind `SessionWriteLockTimeoutError`. Fixes #86014. Thanks @openperf.
+- Discord/OpenAI voice: rotate Realtime sessions at provider max duration without logging the expected session-expiry event as an error.
+- Sessions: skip metadata-only entries during QMD-slugified session lookup so one incomplete row does not block transcript hit resolution. (#86327) Thanks @abnershang.
+- Agents/media: derive bundled plugin local-media trust from plugin tool metadata instead of importing the full plugin registry on subscription paths. (#84409) Thanks @samzong.
+- Image tool: keep config-backed custom-provider API keys usable for auto-discovered vision models, including deferred image-tool execution without env keys or auth profiles. (#85733)
+- Memory/local embeddings: run local GGUF embeddings in an isolated worker sidecar and degrade to configured fallback or keyword search on worker failure so native embedding crashes do not take down the Gateway. (#85348) Thanks @osolmaz.
+- Gateway: clear the runtime config snapshot before `SIGUSR1` in-process restarts so config changes survive the next gateway loop. (#86388) Thanks @XuZehan-iCenter.
+- Models: show OAuth delegation markers as configured `models.json` auth while keeping runtime route usability checks strict. (#86378) Thanks @rohitjavvadi.
+- Cron: seed active scheduled and manual cron task rows with a progress summary so status surfaces do not look blank while jobs run. (#86313) Thanks @ferminquant.
+- Cron: preserve unsupported persisted cron payload rows during routine store writes while keeping those rows non-runnable. Fixes #84922. (#86415) Thanks @IWhatsskill.
+- Updater: exclude prerelease git tags from stable channel resolution so source updates do not check out newer alpha/rc/preview/canary tags. (#86260) Thanks @stevenepalmer.
+- Security/Audit: flag webhook `hooks.token` reuse of active Gateway password auth in `openclaw security audit` while keeping password-mode startup compatibility. (#84338) Thanks @coygeek.
+- QQBot: derive the outbound reply watchdog from configured agent and provider timeouts so slow local model replies are not cut off at five minutes. Fixes #85267. (#85271) Thanks @SymbolStar.
+- Agents/heartbeat: stop heartbeat turns after the first valid `heartbeat_respond` so repeated response loops do not burn tokens. (#86357) Thanks @udaymanish6.
+- Tasks: keep retained lost tasks out of default status health counts, explain their cleanup window during maintenance, and prune lost task records after 24 hours instead of the general 7-day terminal retention.
+- Memory-core: keep REM dreaming focused on live light-staged memories and mark staged entries as considered so old recall history no longer dominates fresh candidates. (#86302) Thanks @SebTardif.
+- Memory: abort sync instead of downgrading an existing semantic vector index to FTS-only when the configured embedding provider is temporarily unavailable. (#85704) Thanks @yaaboo-gif.
+- Telegram: propagate forum topic names through the account-scoped topic cache for native command context and topic create/edit actions. (#86299) Thanks @SebTardif.
+- Slack: keep downloaded read-only files out of reply media so Slack file reads do not echo files back to the conversation. (#86318) Thanks @neeravmakwana.
+- Cron: accept leading-plus relative durations such as `+5m` for one-shot `--at` schedules. (#86341) Thanks @mushuiyu886.
+- Agents/media: preserve async-started media tool metadata so background generation starts no longer surface generic incomplete-turn warnings while replay stays unsafe. (#85933) Thanks @fuller-stack-dev.
+- Docker E2E: dedupe scheduler lane resources so npm/service package lanes are not over-counted and serialized unnecessarily.
+- QA/diagnostics: add a collector-backed OpenTelemetry smoke lane, make the OTLP payload leak check scenario-aware, and keep source QA builds from failing on optional dependency imports resolved through pnpm's temp module path.
+- Crabbox: bootstrap Git metadata for sparse remote changed gates so raw synced workspaces can run `pnpm check:changed` from the intended diff.
+- xAI/LM Studio: avoid buffering ordinary bracketed or `final` prose until stream completion while watching for plain-text tool-call fallbacks.
+- Doctor: warn and continue when the cron job store exists but cannot be read so later health checks still run. Fixes #86102. (#86384) Thanks @1052326311.
+- Discord: suppress a bot's previous reply body and referenced media from prompt context when a user replies to that bot message, while keeping reply metadata for routing. (#86238) Thanks @fuller-stack-dev.
+- Discord: restore bare numeric channel IDs for outbound message-tool sends while keeping explicit DM targets unambiguous. (#86571) Thanks @joshavant.
+- Docker E2E: avoid rebuilding the Control UI twice while preparing the shared OpenClaw package tarball for package-backed scenario runs.
+- Tests: avoid rebuilding the Control UI twice during the installer Docker smoke now that `pnpm build` includes `ui:build`.
+- Tests: give QA config mutation RPCs enough native Windows budget to finish gateway config writes and restart settle after hot scenario runs.
+- Tests: keep the gateway restart-inflight QA scenario focused on restart recovery on native Windows by allowing expected embedded prompt handoff errors and using the Windows-safe timeout budget.
+- QA-Lab: make the synthetic OpenAI provider honor generic `reply exactly:` directives after required kickoff reads so restart-recovery scenarios do not fall through to generic repo-summary prose.
+- Gateway: abort active `agent` RPC runs during forced restart shutdown so stale in-process turns cannot keep writing a session after the Gateway lifecycle restarts.
+- Crabbox: sync clean sparse worktrees through a temporary full checkout even when reusing an existing lease so tracked build-time files are not omitted.
+- Build: route `scripts/ui.js` through the shared pnpm runner and keep Control UI chunking helpers in sparse-included source so native Windows Corepack builds can produce `dist/control-ui`.
+- Tests: give the memory fallback QA scenario enough turn budget to exercise native Windows gateway runs instead of failing on the client timeout while the mock agent is still dispatching.
+- Tests: collect QA gateway CPU/RSS metrics on native Windows and give the channel baseline enough turn budget to report slow gateway runs instead of timing out before proof.
+- Install/update: bypass npm `min-release-age` policies with `--min-release-age=0` instead of `--before` so hosted installers keep working on npm versions that reject the combined config. (#84749) Thanks @TeodoroRodrigo.
+- Diagnostics: reclaim wedged session lanes when stale active-run bookkeeping blocks queued work despite no forward progress. Fixes #85639. Thanks @openperf.
+- WebChat: keep message-tool replies visible in the chat while still summarizing internal tool results for the model. Fixes #86347. Thanks @shakkernerd.
+- Gateway/perf: fail startup benchmark samples when the Gateway process exits before benchmark teardown, including signal deaths after readiness probes.
+- Gateway/perf: fail restart benchmark samples when the Gateway exits before benchmark teardown, including clean exits and signal deaths after successful restart probes.
+- Agents/tests: keep model catalog visibility on static selection helpers so catalog visibility checks avoid the broad model-selection barrel import.
+- Agents/commitments: serialize commitment store load-modify-save writes so concurrent heartbeat and CLI updates no longer lose dismissal, sent, or attempt state. (#81153) Thanks @ai-hpc.
+- xAI/LM Studio: promote plain-text tool-call fallbacks into structured tool calls and strip leaked internal tool syntax before user-facing delivery. (#86222) Thanks @fuller-stack-dev.
+- CLI: suppress benign self-update version-skew warnings during package post-update finalization.
+- Gateway/perf: tighten restart and startup benchmark failure handling so long profiling runs, failed probes, and fresh Linux runners no longer produce false passing or `n/a` results.
+- Checks: keep intentional Knip unused-file findings optional so full CI and sparse proof workspaces stay aligned.
+- Docker: restore writable `~/.config` in runtime images. Fixes #85968. Thanks @hkoessler and @Bartok9.
+- Plugin SDK: keep legacy root diagnostic subscriptions connected when built plugin SDK aliases resolve diagnostic helpers through a separate module graph.
+- Diagnostics: export alertable OTel and Prometheus signals for blocked tools, model failover, stale sessions, liveness warnings, oversized payloads, and webhook ingress while fixing shared OTLP endpoints with query strings.
+- Tests: normalize macOS canonical temp paths in exec allowlists, fs-safe trash assertions, installed plugin matching, Telegram topic-name stores, and built ACPX MCP server expectations so native macOS proof runners cover the intended behavior.
+- Codex/app-server: preserve message-tool-only source reply delivery mode on active runs so sub-agent completion wakeups can steer the active Codex turn instead of being rejected. (#86287) Thanks @ferminquant.
+- Tests: sample the Windows kitchen-sink RPC gateway directly and serialize RSS probes so native runs keep the memory guard active.
+- Tests: normalize bundled plugin lifecycle probe paths and state-root lookup so native Windows release sweeps accept valid packaged plugin installs.
+- Agents/Claude CLI: route live native Bash permission requests through OpenClaw exec policy so Claude turns no longer stall on `control_request`, and document that OpenClaw exec policy is authoritative. Fixes #80819. (#86330, from #81971) Thanks @guthirry and @sallyom.
+- Security audit: warn when YOLO OpenClaw exec policy overrides a restrictive raw Claude `--permission-mode` for managed live sessions. (#86557) Thanks @sallyom.
+- Config: keep benign legacy metadata write anomalies out of default doctor and config command output while preserving explicit anomaly logging for diagnostics.
+- Codex: log when implicit app-server `never` approvals are promoted for OpenClaw tool policy, including whether the trigger was a `before_tool_call` hook or trusted tool policy.
+- Codex harness: make subscription usage-limit errors without reset times explain that OpenClaw cannot determine the reset and point users to wait until Codex is available, use another Codex account, or switch to another configured model/provider. Thanks @amknight.
+- Google Vertex: support production ADC modes such as Workload Identity Federation, service-account credentials, and metadata-server ADC for the native Vertex transport. (#83971) Thanks @damianFelixPago.
+- Telegram: route normal `[telegram][diag]` polling diagnostics through `runtime.log` while keeping non-diag warnings and persistence failures on `runtime.error`, so healthy polling startup no longer looks like an error. Fixes #82957. (#82958) Thanks @galiniliev.
+- Providers/Ollama: strip inline Kimi cloud reasoning prefixes from streamed and final visible replies while keeping ordinary Kimi answers append-only. (#86286) Thanks @jason-allen-oneal.
+
+- Gateway: require Talk secret authority before setup-code handoff can include Talk secrets. (#85690) Thanks @ngutman.
+- Agents: keep fallback error reporting scoped to the active model candidate so stale prior-provider quota/auth text is not reported for later fallback attempts. (#86134) Thanks @zhangguiping-xydt.
+- iMessage: dedupe watcher startup when `channels.imessage.accounts` lists both `default` and a named account that point at the same local Messages source, so the gateway no longer spawns two `imsg rpc` processes or doubles inbound replies; the dedupe is scoped to watcher startup, leaving duplicate accounts addressable for outbound sends, status, and capability listings, and `openclaw doctor` flags the redundant account with a rebinding hint. Fixes #65141. (#86705) Thanks @swang430.
+
diff --git a/CHANGELOG/2026.5.27.md b/CHANGELOG/2026.5.27.md
new file mode 100644
index 0000000000000000000000000000000000000000..fbb30e9d3397c7b754fcd6092ca5f60352a9bc1e
--- /dev/null
+++ b/CHANGELOG/2026.5.27.md
@@ -0,0 +1,30 @@
+## 2026.5.27
+
+### Highlights
+
+- Safer local/runtime boundaries: OpenClaw now rejects unsafe command wrappers, malformed CLI numeric options, unsafe Node runtime env overrides, no-auth Tailscale exposure, and non-admin device-role pairing approvals before they can affect live runs. (#87308, #87305, #87292, #87146)
+- Matrix and auto-reply delivery are steadier: mention previews stay inert, final mention replies deliver normally, shared-DM notices are awaited, MXID parsing ignores filenames, and reasoning-prefixed `NO_REPLY` responses stay suppressed.
+- Provider and agent reliability improved across OpenAI-compatible embeddings, cached token usage, Anthropic/Codex/Claude runtime state, unsupported tool-schema quarantine, heartbeat templates, and session fallback errors. (#85269, #82062, #85416, #86855)
+- Plugin and package release paths got tighter: Pixverse ships as an external video plugin with region selection, package exclusions and shrinkwrap inventory match the published npm shape, and release/package smoke commands fail bounded instead of hanging.
+- Gateway hot paths do less rediscovery by reusing current plugin metadata fingerprints, stable plugin index fingerprints, read-only session metadata, active working stores, status fast paths, and auth/env snapshots. (#86439)
+
+### Changes
+
+- Memory: add a core OpenAI-compatible embedding provider for local and hosted OpenAI-style endpoints, with config, doctor, and docs support. (#85269) Thanks @dutifulbob.
+- Plugin SDK: mark memory-specific embedding provider registration as deprecated compatibility and surface non-bundled usage in plugin compatibility diagnostics. (#85072) Thanks @mbelinky.
+- Pixverse: add video generation provider support, API region selection, and external plugin publishing.
+- Plugins: expose approval action metadata for plugin-driven approval surfaces.
+
+### Fixes
+
+- Security/CLI/runtime: harden hostname normalization for repeated trailing dots, block side-effecting command wrappers, reject unsafe Node runtime env overrides, reject loose numeric CLI and gateway options, require admin approval for node device-role pairing, and reject no-auth Tailscale exposure. (#87305, #87292, #87308, #87146) Thanks @pgondhi987.
+- Doctor: validate runtime tool schemas for every configured embedded agent while skipping ACP-only profiles, so bad non-default plugin or MCP tools are reported before assistant turns.
+- Telegram: route `sendMessage` action replies through durable outbound delivery so completed agent responses remain retryable when the gateway send path times out. (#87261) Thanks @mbelinky.
+- Matrix/auto-reply: keep draft previews mention-inert, preserve final mention delivery, send mention finals normally, await shared DM notices, ignore filename-embedded MXIDs, and suppress reasoning-prefixed `NO_REPLY` responses.
+- Agents/providers: add OpenAI-compatible cache retention, forward cached token usage in chat completions, preserve runtime context before active user turns, strip stale Anthropic thinking, load Claude CLI OAuth for Pi auth profiles, avoid false Codex runtime live switches, and quarantine unsupported tool schemas. (#82062, #87167, #86855)
+- Gateway/performance: cache plugin metadata fingerprints and stable plugin index fingerprints, borrow read-only session metadata safely, keep the active session working store hot, keep status on a bounded fast path, and preserve model auth profile suffixes. (#86439)
+- Package/install/release: align npm package exclusions and inventory, omit unpacked test helpers, skip Homebrew until macOS packages need it, cap tsdown heap in containers, bound install/release smoke waits, and harden post-publish verification.
+- Codex/Auth: bound ChatGPT OAuth token exchange and refresh requests, and honor cancellation across Codex and Anthropic OAuth login flows.
+- QA/E2E/CI: bound Telegram, kitchen-sink, Open WebUI, ClawHub, MCP, Discord, realtime, labeler, and GitHub API waits; fail empty explicit test, live-media, gateway CPU, startup benchmark, plugin gauntlet, and beta-smoke runs instead of false-greening.
+- Agents/Codex: keep spawned agent bootstrap files rooted in the agent workspace while running task commands, transcripts, and compaction from the requested cwd. (#87218) Thanks @mbelinky.
+
diff --git a/CHANGELOG/2026.5.3-1.md b/CHANGELOG/2026.5.3-1.md
new file mode 100644
index 0000000000000000000000000000000000000000..5d0a25f7f03f06979f8a3ded39fc68f5fc4cfa8b
--- /dev/null
+++ b/CHANGELOG/2026.5.3-1.md
@@ -0,0 +1,6 @@
+## 2026.5.3-1
+
+### Fixes
+
+- Plugins/security: stop the install scanner from blocking official bundled plugin packages when `process.env` access and normal API sends only appear in distant parts of the same compiled bundle. Thanks @vincentkoc.
+
diff --git a/CHANGELOG/2026.5.31.md b/CHANGELOG/2026.5.31.md
new file mode 100644
index 0000000000000000000000000000000000000000..4dde8148605de4ac0b71d20df2f7c1c256f65493
--- /dev/null
+++ b/CHANGELOG/2026.5.31.md
@@ -0,0 +1,430 @@
+## 2026.5.31
+
+### Highlights
+
+- **Faster Control UI chat:** transcript rendering, draft persistence, pending-send paint, scrolling, and first-message work no longer block one another while a conversation is active. (#88952, #88960, #88998) Thanks @vincentkoc.
+- **More reliable agent recovery:** fallback auth state, legacy Codex app-server auth, stale bootstrap history, and streamed reasoning cleanup recover cleanly instead of carrying stale turn state forward. (#87484, #88924) Thanks @neeravmakwana, @vincentkoc, @bgmbgm94, and @kdonthar.
+- **Clearer cron and channel history:** external `sessions_send` routes, single-job history, and channel reply state retain the right destination and job context through restarts. (#88294, #88803) Thanks @kip-claw, @MonkeyLeeT, @vincentkoc, and @Lvan185.
+- **Better operator coordination:** core session goals and durable plugin-install state make long-running work easier to inspect and resume after reloads. (#87469, #88794) Thanks @vincentkoc.
+- **Safer mobile reconnects:** iOS realtime sessions retain their WebSocket continuation instead of failing a healthy Talk connection, with hosted push/realtime paths kept aligned. (#88231) Thanks @ngutman and @vincentkoc.
+
+### Changes
+
+- Workboard task details, Android notification app selection, and Dreaming candidate scoring gained broader operator controls.
+- Control UI now streams stable Markdown blocks and records more chat responsiveness signals to guide first-reply performance work. Thanks @vincentkoc.
+
+### Fixes
+
+- Chat/UI: keep first Control UI sends responsive, retain pending sends while history catches up, cache transcript renders, and avoid draft persistence or navigation churn from blocking the active conversation. (#88952, #88960, #88998) Thanks @vincentkoc.
+- Agents/Codex/auth: repair automatic fallback state, accept supported legacy Codex app-server auth, remove stale bootstrap history, strip streamed reasoning tags, and validate shell snapshots against trusted environment data. (#87484, #88924) Thanks @RomneyDa, @neeravmakwana, @vincentkoc, @bgmbgm94, and @kdonthar.
+- Cron/channels: preserve external `sessions_send` routes, include the job name in single-job history, keep Mattermost attachments on the upload path, and bound Telegram/installer/Parallels proof cleanup. (#88294, #88803) Thanks @kip-claw, @MonkeyLeeT, @vincentkoc, and @Lvan185.
+
+### Complete contribution record
+
+This audited record covers the complete v2026.5.28..v2026.5.31-beta.4 history: 402 merged PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.
+
+#### Pull requests
+
+- **PR #87469** feat: add core session goals.
+- **PR #88129** fix: keep live OpenClaw session locks during cleanup.
+- **PR #88133** Fix heartbeat default run timeout. Related #87438. Thanks @ovrsr.
+- **PR #88132** fix: move compaction planning off the event loop. Related #86358. Thanks @Mithril1991.
+- **PR #88137** fix ci mainline checks. Thanks @RomneyDa.
+- **PR #88140** perf: centralize skills indexing and visibility. Thanks @shakkernerd.
+- **PR #82326** Add plugin manifest contract for SecretRef provider integrations. Thanks @sallyom and @joshavant.
+- **PR #88141** fix: route generated media completions through requester agent.
+- **PR #87770** refactor: share native approval route gates. Thanks @kevinslin.
+- **PR #88156** Refactor SQLite state base and plugin migration.
+- **PR #87781** fix(codex): prevent false completion stalls during native streams. Thanks @keshavbotagent.
+- **PR #88136** fix(agents): centralize terminal run outcome precedence. Related #87444. Thanks @ssdatye.
+- **PR #88155** test(infra): avoid max fake-timer jumps. Thanks @RomneyDa.
+- **PR #88160** test(unit-fast): isolate fake-timer files. Thanks @RomneyDa.
+- **PR #84535** fix(gateway): resolve message actions against runtime config. Related #84530. Thanks @funmerlin and @joshavant.
+- **PR #88107** feat: only include the current changelog section in tarball. Thanks @RomneyDa.
+- **PR #88130** fix(agents): preserve Codex auth for compaction fallback. Related #86820. Thanks @kopl-blip.
+- **PR #84814** fix(agents): classify embedded provider business denials for fallback. Related #48680. Thanks @Takhoffman and @yu-xin-c and @lovensky1992-wk.
+- **PR #88178** feat(workboard): add orchestration primitives.
+- **PR #88162** fix(agents): extend terminal outcome projections.
+- **PR #88182** Fix subagent DM completion delivery after yield. Related #88042. Thanks @joshavant and @ksiyuna-claw.
+- **PR #88191** Fix Codex raw image generation media projection. Related #87948. Thanks @joshavant and @mazetsoligarh-cell.
+- **PR #88134** fix(imessage): preserve SMS approval reply routes. Thanks @kevinslin.
+- **PR #88161** Fix restart sentinel internal continuations. Related #87792. Thanks @joshavant and @chrispydizzle.
+- **PR #88199** ci: extend platform checkout fetch timeout. Thanks @RomneyDa.
+- **PR #87796** feat(ci): autoscrub dependency lockfile-only PR changes. Thanks @RomneyDa.
+- **PR #88200** Refactor task state onto shared SQLite.
+- **PR #88083** fix(agent): preserve media task success on delivery miss. Thanks @obviyus.
+- **PR #88127** perf(test): fix explicit-file Vitest wrapper hangs. Thanks @RomneyDa.
+- **PR #88183** fix(whatsapp): retry QR login 408 timeouts. Thanks @mcaxtr.
+- **PR #84234** fix(cli-runner): write-side flush gate + orphan-tool-use invalidator. Thanks @adele-with-a-b.
+- **PR #88231** fix(ios): guard websocket ping continuation. Thanks @ngutman.
+- **PR #88117** refactor: extract LLM core packages.
+- **PR #88248** fix: show chat errors as visible messages.
+- **PR #88250** refactor(agents): type media completion delivery misses.
+- **PR #88207** Fix Codex native thread overflow rotation. Thanks @fuller-stack-dev.
+- **PR #88109** refactor: extract media generation core package.
+- **PR #88247** feat: add hosted model providers.
+- **PR #88259** feat(workboard): add board ops recovery metadata.
+- **PR #87788** fix(codex): move skills list and memory pointer to collaboration instructions. Thanks @lastguru-net.
+- **PR #88262** fix(codex): stop injecting mirrored history into prompts.
+- **PR #88177** fix(codex): prevent post-tool edit stream timeouts. Thanks @keshavbotagent.
+- **PR #88265** refactor: extract markdown core package.
+- **PR #88279** refactor: move terminal core into package.
+- **PR #86179** feat:Add Xiaomi Token Plan provider support. Related #86169. Thanks @NianJiuZst and @openclaws420.
+- **PR #88211** fix(plugins): resolve ${ENV_VAR} references in plugin config before handoff. Related #88195. Thanks @Marvinthebored and @Peetiegonzalez.
+- **PR #88284** fix(agents): harden autoreview Windows harness. Thanks @vincentkoc.
+- **PR #88260** Persist subagent registry in SQLite.
+- **PR #88217** refactor: unify OpenAI provider identity.
+- **PR #88297** refactor: extract media understanding common package.
+- **PR #88299** fix(gateway): recover channels after reload stop timeout. Thanks @obviyus.
+- **PR #88326** perf(cli): reduce room-event Claude cache churn. Thanks @obviyus.
+- **PR #88310** fix(test): include workflow lint target in routing expectation. Thanks @vincentkoc.
+- **PR #88225** fix(ui): stop pulsing completed stream segments. Thanks @scotthuang.
+- **PR #88298** fix: classify ws pre-handshake close as benign. Related #88257. Thanks @akrimm702 and @survivor998.
+- **PR #88338** feat(workboard): persist orchestration metadata in sqlite.
+- **PR #88266** refactor: extract model catalog core package.
+- **PR #88235** feat(ios): refresh app store metadata. Thanks @ngutman.
+- **PR #85258** fix(qqbot): deliver partial tool progress. Related #66509. Thanks @samzong and @vincentkoc and @gabrielduartesignart.
+- **PR #88349** Add per-agent SQLite cache store.
+- **PR #88135** fix(codex): refresh stale managed runtime plugin. Related #87650. Thanks @brokemac79 and @thoth-ctl.
+- **PR #68844** fix(outbound): pack newline-mode paragraphs up to limit. Thanks @kesslerio.
+- **PR #88236** fix(plugins): ignore helper files in extension roots. Related #88198. Thanks @mushuiyu886 and @mmhzlrj.
+- **PR #86089** [Fix] Deliver restart recovery replies. Related #69249. Thanks @samzong and @slideshow-dingo.
+- **PR #88375** refactor: route model catalog imports to core package.
+- **PR #85511** feat(ui): add collapsible toggle for recent sessions in sidebar. Related #85510. Thanks @NianJiuZst.
+- **PR #80560** fix(tui): distinguish /new and /reset command descriptions. Related #49517. Thanks @KhanCold and @KaysonYeh.
+- **PR #88229** fix(agents): normalize sessions_send message aliases. Related #88146. Thanks @zhangguiping-xydt and @jsonmez.
+- **PR #88387** refactor(matrix): move ephemeral state to plugin sqlite.
+- **PR #86755** test(tasks): cover task domain view mappers. Thanks @leno23.
+- **PR #76355** fix(install): show progress during npm install in non-interactive mode. Related #82305. Thanks @SebTardif.
+- **PR #77279** fix(media): dedupe identical path/url in inbound media-note formatter (#47587). Thanks @MoerAI and @yzjJosh.
+- **PR #82824** fix(gateway): explain ignored config-triggered restart when restart command is disabled. Thanks @wAngByg.
+- **PR #85979** fix(discord): omit undefined component registry fields [AI]. Thanks @funmerlin.
+- **PR #76091** Fix Discord reply typing lifecycle. Thanks @zhuisDEV.
+- **PR #88232** fix(models): prefer exact configured provider refs before aliases. Related #88218. Thanks @stevenepalmer and @herculeanfit1.
+- **PR #88276** fix(feishu): stream plain replies as cards. Thanks @qiangu.
+- **PR #80037** Expose resolved subagent model metadata. Thanks @guanbear.
+- **PR #78288** Agents/exec: show target node name in exec tool transparency messages. Related #77719. Thanks @JiataiWang and @civiltox.
+- **PR #88408** feat: expand workboard orchestration metadata.
+- **PR #87920** feat(gateway): forward OpenAI stop sequences through chat completions. Thanks @Lellansin.
+- **PR #87886** fix(skill-creator): sort files for deterministic .skill package order. Related #37748. Thanks @coder999999999 and @shuofengzhang.
+- **PR #88399** Improve MCP operability.
+- **PR #88398** refactor: move model catalog refs into core package.
+- **PR #88328** feat: add Skill Workshop and skill research. Thanks @shakkernerd.
+- **PR #88271** fix(export-html): guard msg.content and result.content filter/iteration paths against non-array values. Related #88255. Thanks @Alix-007 and @survivor998.
+- **PR #88429** ci: keep harness changes on fast checks.
+- **PR #88430** fix(scripts): quiet minimal runtime asset copies. Thanks @vincentkoc.
+- **PR #88321** fix(codex): keep app-server continuation turns alive. Related #88196, #88331. Thanks @abnershang and @aounakram.
+- **PR #88435** refactor: move model catalog normalization into core package.
+- **PR #88226** fix(llm): repair \u escapes that lack four hex digits in streaming JSON. Thanks @coder999999999.
+- **PR #88380** fix(ui): keep chat model selected after session switch. Related #86597. Thanks @brokemac79 and @xuli500177.
+- **PR #88285** Move cron persistence to SQLite.
+- **PR #87915** fix(build): avoid stale agent-core dts warnings. Thanks @keshavbotagent.
+- **PR #68669** fix(agents): dedupe subagent browser session cleanup wrapper with dispatch flag. Related #68668. Thanks @Feelw00.
+- **PR #88411** refactor(msteams): persist conversation and poll stores in sqlite.
+- **PR #88303** Skip browser cleanup when browser is disabled. Thanks @poison.
+- **PR #88416** Refactor subagent thread binding into core.
+- **PR #83956** feat(cli): add sessions tail progress view. Related #83441. Thanks @spacegeologist and @ndj888.
+- **PR #71648** fix(mcp): bound pendingClaudePermissions / pendingApprovals via TTL sweeper + close clear. Related #71646. Thanks @Feelw00.
+- **PR #88346** refactor: extract web content core package.
+- **PR #71280** test(gateway): avoid brittle shutdown timer assertion. Thanks @hansolo949.
+- **PR #80686** fix(agents): extend session-write-lock payload-less orphan grace from 5s to 30s. Thanks @wAngByg.
+- **PR #88067** fix(responses): drop orphaned assistant msg\_\* id when reasoning is dropped (#88019). Thanks @BSG2000.
+- **PR #88417** [codex] Route denied exec approval followups to sessions. Related #88167. Thanks @brokemac79 and @jhartman00.
+- **PR #85996** fix #85782: surface terminal TUI lifecycle errors. Thanks @zhangguiping-xydt and @vincentkoc and @shakkernerd.
+- **PR #88445** refactor: source model catalog types from core.
+- **PR #88444** Classify release dependency ownership metadata.
+- **PR #82415** Fix /acp spawn cwd inheritance for target agent workspaces. Thanks @summerview1997.
+- **PR #88448** refactor: simplify sqlite cron persistence.
+- **PR #88268** fix #88214: [Feature]: Dashboard sidebar Recent sessions should filter by currently selected agent. Thanks @zhangguiping-xydt and @wujitianya.
+- **PR #86642** feat: pass structured provider error signals to hooks. Thanks @fuller-stack-dev.
+- **PR #63840** fix(slack): preserve thread context for Agents & Assistants DM root messages. Related #63659. Thanks @zozo123 and @dev-ithitchhiker.
+- **PR #86924** fix: scrub serialized tool-call text from replies. Thanks @fuller-stack-dev.
+- **PR #87093** fix: promote serialized tool calls via repair package. Thanks @fuller-stack-dev.
+- **PR #88452** chore(release): update appcast for 2026.5.28.
+- **PR #88043** feat: add internal code mode namespaces.
+- **PR #78748** fix(ui): add agent selector to dreaming tab. Related #63558. Thanks @stevenepalmer and @ttomiczek.
+- **PR #88455** Refactor cron migrations under doctor.
+- **PR #87929** fix(cron): preserve plugin delivery targets. Related #87905. Thanks @TurboTheTurtle and @xmoxmo.
+- **PR #87390** fix(ci): ignore fenced headings in proof parser. Thanks @MonkeyLeeT.
+- **PR #85248** fix(gateway): strip spurious tool call blocks when provider signals stop. Related #85161. Thanks @Jerry-Xin and @syncword.
+- **PR #83660** fix(browser): allow upload from inbound media directory. Related #83544. Thanks @spacegeologist and @scorpiord.
+- **PR #88467** feat: improve MCP operator workflows.
+- **PR #84247** Refactor browser screenshot vision through shared media understanding. Thanks @scotthuang.
+- **PR #88464** Move Workboard to relational SQLite.
+- **PR #88451** refactor: unify OpenAI provider identity.
+- **PR #88459** refactor: extract normalization core package.
+- **PR #84670** [codex] fix webchat full-message reader for truncated history. Related #84651. Thanks @NianJiuZst and @100yenadmin.
+- **PR #88462** fix(heartbeat): advance stale scheduler deferrals. Related #79380. Thanks @jorgemarmor.
+- **PR #88461** refactor(cron): split service timer helpers.
+- **PR #88427** fix(auth): bound inherited oauth expiry.
+- **PR #88458** fix: clarify generated media reply prompts.
+- **PR #88421** [codex] Fix Telegram DM topic session routing. Related #80212. Thanks @brokemac79 and @SergeyKerj.
+- **PR #88113** fix(commands): make /skill load workspace skills. Related #88056. Thanks @MonkeyLeeT and @shakkernerd.
+- **PR #85904** fix(slack): keep DM thread turns out of active steering. Thanks @guanbear.
+- **PR #88395** build(OpenClawKit): make ElevenLabsKit (talk/TTS) an optional package trait. Thanks @mochiexists and @atlascodesai.
+- **PR #88469** refactor(telegram): persist plugin state in sqlite.
+- **PR #88406** Fix iMessage startup watch replay. Thanks @obviyus.
+- **PR #87179** fix(discord): deliver same-session channel replies. Related #87157. Thanks @stevenepalmer and @neo-jacked-in.
+- **PR #88115** docs: remove divider comments.
+- **PR #88319** fix(agents): skip below-target CLI compaction failures. Thanks @frankekn.
+- **PR #88552** Remove channel test isolation hack.
+- **PR #86176** Fix Telegram media message edits. Related #86161. Thanks @TurboTheTurtle and @crowneglobal.
+- **PR #88476** feat: add Twilio SMS channel.
+- **PR #83992** fix(webchat): preserve refresh-visible history and composer state. Related #83344. Thanks @spacegeologist and @zachisfine.
+- **PR #88496** fix(auto-reply): redact secrets in config show output. Related #65623. Thanks @jason-allen-oneal and @coygeek.
+- **PR #88536** feat: improve MCP operator controls.
+- **PR #84290** Doctor: expose UI freshness health findings. Thanks @giodl73-repo.
+- **PR #88539** refactor(telegram): keep topic thread mapping plugin-local.
+- **PR #80391** fix(scripts): timeout crabbox wrapper sanity checks. Thanks @ejames-dev.
+- **PR #85990** Prefer Talk source-reply final text. Related #85275. Thanks @TurboTheTurtle and @BsnizND.
+- **PR #65914** fix(memory): respect qmd status timeout and skip checkpoint exports. Thanks @shawnduggan.
+- **PR #88555** feat(workboard): add worker dispatch CLI.
+- **PR #88018** fix(infra): guard against overwriting corrupt target session store during migration. Related #88017. Thanks @Feelw00.
+- **PR #88185** fix(cron): accept sub-second --at datetimes resolved in a timezone. Thanks @coder999999999.
+- **PR #88378** fix(xiaomi): support MiMo voicedesign TTS. Thanks @GimingRao.
+- **PR #70864** feat: add scoped mention pattern policy. Thanks @patrick-slimelab.
+- **PR #87998** fix(agents): route per-turn media task hints below the cache boundary. Related #85203. Thanks @nxmxbbd and @AV500group.
+- **PR #75181** test(plugins): cover Link agent wallet bundle shape. Thanks @stainlu.
+- **PR #88347** fix(agents): strip malformed arg-value suffixes. Related #48780. Thanks @vincentkoc and @koden588-blip.
+- **PR #88578** docs: document scoped mention patterns.
+- **PR #81808** chore(lint): enable object-shorthand. Thanks @tanshanshan.
+- **PR #70789** fix(ui): fix tool result pairing for sequential same-name tool calls. Related #70746. Thanks @chinar-amrutkar and @tarvis0523.
+- **PR #88011** fix(logging): align diagnostic recovery in-flight dedup keys. Related #88010. Thanks @Feelw00.
+- **PR #88574** Fix silent internal aborts after tool-use turns. Thanks @obviyus.
+- **PR #82219** fix(codex): accept first-party OpenAI plugin marketplaces (bundled and primary-runtime). Related #82216. Thanks @yaanfpv.
+- **PR #83719** feat(dreaming): add report-only shadow trial runner. Thanks @iFiras-Max1.
+- **PR #87772** fix(reply): deliver plugin binding replies. Related #87721. Thanks @MonkeyLeeT and @wingleungron.
+- **PR #74493** fix(cli): identity-only auth-epoch hashing for token credentials (#74312). Thanks @stainlu and @aderius.
+- **PR #88534** refactor: extract media and ACP core packages.
+- **PR #79447** fix(model-auth): resolve per-entry apiKey profile ID references. Related #67423. Thanks @kinjitakabe and @presidenzo.
+- **PR #88577** fix(sms): diagnose Twilio webhook setup.
+- **PR #84628** [AI-assisted] fix(plugins): scope startup metadata manifest reads. Related #70533. Thanks @IWhatsskill and @jpippo364.
+- **PR #88582** Refactor cron SQLite runtime paths.
+- **PR #88595** perf: speed up chat hydration and add 3D workboard.
+- **PR #75005** fix(media): allow explicit synthetic auth for media providers. Related #74644. Thanks @sqsge and @mozi1924.
+- **PR #75128** fix(boot): wrap BOOT.md in internal-runtime-context, strip from message-tool args (#53732). Thanks @stainlu and @alvaro630.
+- **PR #88599** fix(memory): retry transient embedding failures. Related #44166, #71784. Thanks @MrGeDiao and @kevinheinrichs.
+- **PR #88466** fix(gateway): guide dashboard auth after service repair. Related #88290. Thanks @sallyom and @drarturryzhov-boop.
+- **PR #88463** fix(ui): keep transient chat errors out of page headers. Thanks @sallyom.
+- **PR #88474** [AI-assisted] fix(gateway): avoid restarts for auth cooldown reloads. Related #88443. Thanks @IWhatsskill and @MrMaturin.
+- **PR #88603** fix(media): use typed auth for no-auth media providers. Related #74644. Thanks @mozi1924.
+- **PR #88605** refactor: make OpenAI Codex legacy doctor-only.
+- **PR #88440** Retry stale CLI sessions inside runner lifecycle. Related #77089. Thanks @brokemac79 and @clawdbotv2.
+- **PR #88393** fix(browser): document stable tab references. Thanks @FMLS and @hxy91819.
+- **PR #88340** fix(agents): classify expired thinking signatures. Related #88020. Thanks @Takhoffman and @BryanTegomoh and @bryanbaer.
+- **PR #88607** fix(devices): refresh paired device last-seen metadata. Related #81169. Thanks @vyctorbrzezowski and @deminson.
+- **PR #88613** fix: queue subagent completion handoffs.
+- **PR #88609** refactor: move plugin state stores to SQLite.
+- **PR #79363** fix(exec): allow known safe shell builtins in allowlist mode. Related #46056. Thanks @kinjitakabe and @aukei.
+- **PR #88617** fix(agents): preserve reasoning replay from model metadata. Related #88068. Thanks @syncword.
+- **PR #77953** fix(auto-reply): honor per-model thinking params. Thanks @tynamite.
+- **PR #88626** refactor(openai): confine legacy codex repair to doctor.
+- **PR #87887** fix(hooks): isolate slug-generator failures from shared auth profile (#71709). Thanks @openperf and @nikolaykazakovvs-ux.
+- **PR #88281** fix(tasks): reclaim ACP zombie runs blocking gateway restart. Related #88205. Thanks @openperf and @subaochen.
+- **PR #88619** refactor: unify subagent handoffs into agent steering queue.
+- **PR #88004** fix(tui): skip history reload when final event has displayable output. Related #87922. Thanks @SebTardif and @darconadalabarga.
+- **PR #87962** fix(webchat): suppress stale active session row racing a completed turn (#87875). Thanks @MukundaKatta and @TunMax.
+- **PR #88050** fix(tui): use middle truncation for paths and commands in tool display. Related #87936. Thanks @SebTardif and @Joel-Claw.
+- **PR #86463** fix(auto-reply): warn on substantive private message-tool finals. Thanks @yaoyi1222.
+- **PR #88554** docs: clarify Android token comments.
+- **PR #87959** fix(tui): preserve pending local runs during session sync. Thanks @nao860226-rgb and @vincentkoc.
+- **PR #82224** feat(codex): add portable Codex command pickers. Thanks @yaanfpv.
+- **PR #88637** chore: bump OpenClaw version to 2026.5.31.
+- **PR #88587** fix(agents): normalize prefixed Anthropic fallback model ids (#88560). Thanks @TurboTheTurtle and @cjalden.
+- **PR #88351** fix(doctor): diagnose malformed provider catalogs. Thanks @vincentkoc.
+- **PR #88618** refactor: expand acp core package.
+- **PR #87538** fix(agents): model-scope cooldown for transport timeout (#87462). Thanks @openperf and @fenglanhua.
+- **PR #88623** fix(agents): release session lock on manual abort. Related #88600. Thanks @williammu.
+- **PR #88588** fix(agents): avoid synthetic tool results during parallel races (#88168). Thanks @TurboTheTurtle and @jhartman00.
+- **PR #88636** feat: add MCP code-mode namespace.
+- **PR #88558** fix(gateway): enforce OpenAI tool_choice required/function contracts. Thanks @Lellansin.
+- **PR #88628** fix: scope plugin tools and async media starts.
+- **PR #84007** fix(agents): inherit subagent thinking defaults. Related #55790. Thanks @stevenepalmer and @vrurg.
+- **PR #81795** Fix Control UI agent thinking defaults. Related #81760. Thanks @jbetala7 and @caiming0331.
+- **PR #74418** fix(agents): recognize params.thinking=false and "disabled"/"none" as thinking=off. Related #74374. Thanks @yelog and @simmssun-hashh.
+- **PR #88583** fix(gateway): reject pre-reset run lifecycle events from clobbering the rotated session row. Related #88538. Thanks @openperf and @tianxiaochannel-oss88.
+- **PR #88612** fix(models): keep auth login out of main config. Related #88565. Thanks @corleonexie-maker.
+- **PR #88655** fix(gateway): reject stale lifecycle session updates. Related #88538. Thanks @tianxiaochannel-oss88.
+- **PR #88658** fix(agents): report stale session locks without cleanup.
+- **PR #88661** ci: stabilize Testbox changed checks.
+- **PR #88641** feat: add exec shell snapshot cache.
+- **PR #84232** fix(messages): use best-effort for implicit tool-only source replies. Related #84078. Thanks @tianxiaochannel-oss88.
+- **PR #88381** fix(agents): preserve runtime tools in lean mode. Thanks @vincentkoc.
+- **PR #88527** fix(discord): ping mention-bearing final replies under live preview (#88360). Thanks @openperf and @hughbeyond.
+- **PR #88659** refactor: clean up ACP package metadata and helpers.
+- **PR #88652** fix(codex): restore bounded recovery continuity. Related #88352, #88354. Thanks @100yenadmin.
+- **PR #82739** fix(macos): prevent duplicate menu bar icons. Thanks @afalk42.
+- **PR #87975** fix(slack): avoid forced threads for replyToMode off. Thanks @lawrencetran.
+- **PR #86397** fix(discord): PluralKit DM pairing identity + `direct` peer regex (#86332). Thanks @Sanjays2402.
+- **PR #88601** fix(sms): cover native proof follow-ups. Thanks @clawSean.
+- **PR #88670** fix(agents): retry transient stale session locks.
+- **PR #80996** Fix Google Chat message tool thread replies. Related #80995. Thanks @franco-viotti.
+- **PR #88549** fix(memory-core): reclaim orphaned dreaming sessions with surviving transcripts. Related #88322. Thanks @Alix-007 and @TheDenStudios.
+- **PR #88557** fix(terminal): clamp wide graphemes in narrow table cells. Related #88556. Thanks @jbetala7.
+- **PR #87904** fix: route iMessage DM media through attachment handoff. Related #87597. Thanks @HOYALIM and @omarshahine and @TurboTheTurtle.
+- **PR #88547** feat(github-copilot): add Claude Opus 4.8 to default model catalog. Thanks @saju01.
+- **PR #88428** fix(discord): route thread bindings to plugin owners. Related #64199. Thanks @SYU8384 and @hoh-dev-bot.
+- **PR #85612** fix(slack): keep one draft message in progress mode. Thanks @mycarrysun.
+- **PR #88500** fix: release abandoned provider streams. Related #67461. Thanks @samzong and @jakedwyer.
+- **PR #85691** fix(doctor): auto-repair stale session snapshot paths on --fix. Related #85689. Thanks @ggzeng.
+- **PR #86737** fix(ios): subscribe to per-session transcripts so group chats update in real time (#80231). Thanks @yetval and @jm7v7fgpdy-sketch.
+- **PR #88642** fix(whatsapp): suppress spurious typing indicator on silent tool-only runs. Related #450. Thanks @Bluetegu and @thesash.
+- **PR #88635** fix(secrets): treat Codex app-server marker as non-secret. Thanks @vortexopenclaw.
+- **PR #88525** feat(deepseek): show provider balance in usage status. Thanks @litang9.
+- **PR #88563** fix(agents): resolve exact static-catalog models for plugin-harness cold start (#88510). Thanks @yetval and @wlassalle724.
+- **PR #87818** fix(ollama): yield during dense stream processing. Thanks @vincentkoc and @udaymanish6.
+- **PR #88665** refactor: move delivery queues to SQLite.
+- **PR #88676** fix(auto-reply): add memory flush failure tracking with retry exhaustion. Thanks @Jerry-Xin.
+- **PR #88672** fix(plugins): reuse current metadata snapshot in provider hot paths. Thanks @masatohoshino.
+- **PR #88678** feat: add typed MCP code-mode API.
+- **PR #77882** fix(feishu): gate bitable tools by tools config. Thanks @glfruit.
+- **PR #59172** fix(cli): extend holiday tagline dates through 2030. Thanks @alkor2000.
+- **PR #88252** fix(agents): avoid full stream replay on text deltas. Thanks @vincentkoc.
+- **PR #59500** fix: extend CA bundle auto-injection to all 8 Node version managers. Related #59494. Thanks @alkor2000.
+- **PR #87855** fix(telegram): handle ENOENT race in spool drain recovery rename. Related #87847. Thanks @SebTardif and @ppanphper.
+- **PR #88677** refactor: clean up ACP translator and manager tests.
+- **PR #88715** perf(plugins): avoid duplicate provider hook load probes.
+- **PR #88675** refactor: move plugin state slices to sqlite.
+- **PR #88153** fix(agents): count stream deltas incrementally. Thanks @vincentkoc.
+- **PR #87698** fix(gateway): emit subagent_ended hook for api.runtime.subagent.run() (#59164). Thanks @sweetcornna and @Amyssjj.
+- **PR #81692** fix(doctor): detect stale gateway service version metadata. Thanks @wAngByg.
+- **PR #87549** fix(agents): validate context engine assemble result shape. Related #75541. Thanks @Pluviobyte and @tyyim.
+- **PR #88720** refactor: extract ACP translator session updates.
+- **PR #85666** fix #85124: skip Anthropic API keys for usage status. Thanks @zhangguiping-xydt and @rqlangley.
+- **PR #88722** refactor: make Telegram message cache SQLite-only.
+- **PR #88724** fix: persist ACP metadata in SQLite.
+- **PR #86917** fix(session-store): rewrite generated transcript paths on rollover. Thanks @Sunjae-k and @sunjae-1.
+- **PR #84419** fix(session): prefer real tool result over synthetic error in transcript repair. Thanks @Jerry-Xin.
+- **PR #88725** refactor: extract ACP manager runtime handle cache.
+- **PR #88721** feat(plugin-sdk): add typed presentation command actions.
+- **PR #79658** Allow validated TXT/JSON/YAML media sends. Thanks @simplyclever914.
+- **PR #87618** fix(daemon): detect system-scope systemd gateway units on Linux (#87577). Thanks @yetval and @fisherman86-ai.
+- **PR #84988** Refresh Node Docker base image digests. Related #84981. Thanks @LibraHo.
+- **PR #85931** fix(memory): serialize qmd update writes across processes to stop SQLITE_BUSY. Related #66339. Thanks @openperf and @SakenW.
+- **PR #78793** fix(approvals): interpolate request id into "Reply with:" line. Thanks @itsuzef.
+- **PR #88730** fix(codex): stream final answer partials. Related #88405. Thanks @crash2kx.
+- **PR #80801** fix(auth): force re-login flag, remediation hint, and session-scoped fallback skip cache. Thanks @MertBasar0.
+- **PR #88729** refactor: extract ACP runtime handle ensure flow.
+- **PR #79040** fix(gateway): guard buildGroupDisplayName behind group/channel chatType. Related #55354. Thanks @sebuh-infsol and @toruvieI.
+- **PR #77952** fix(discord): bound REST entity cache to prevent unbounded Map growth. Related #77975. Thanks @fede-kamel.
+- **PR #88733** refactor: extract ACP runtime resume state.
+- **PR #77924** fix(memory-core): preserve phase signals on read errors. Related #77881. Thanks @bennewell35 and @SimbaKingjoe.
+- **PR #88314** fix #76284: [Bug]: openclaw agents add blocked — cannot add Jon/Atlas as separate agents. Thanks @zhangguiping-xydt and @RicardoUKMX.
+- **PR #77394** fix(agents): sanitize raw HTTP 401 provider errors in user-visible replies (#56197). Thanks @jeffrey701 and @lokamir.
+- **PR #88739** refactor: extract ACP turn runner.
+- **PR #77998** fix(skills): clear workspaceVersions entry when skills watcher is disabled. Related #77997. Thanks @fede-kamel.
+- **PR #77527** fix(gateway): rate-limit pre-auth bootstrap-token verify to prevent mutex DoS. Related #77978. Thanks @fede-kamel.
+- **PR #88744** refactor: extract ACP close session flow.
+- **PR #88731** refactor: migrate voice-call call logs through doctor.
+- **PR #87522** fix: force preflight compaction before oversized agent turns. Related #87234. Thanks @ArthurNie.
+- **PR #75061** fix: preserve workspaces during state-only uninstall. Related #75052. Thanks @Jason-Bai and @XueJourney.
+- **PR #79465** Fix ACP command bypass for channel text commands. Thanks @RoeeJ.
+- **PR #88747** refactor: extract ACP runtime option commands.
+- **PR #74715** fix(ui): show Communication Notifications tab. Thanks @VladyslavLevchuk.
+- **PR #88691** feat(gateway): support Tailscale Serve service names. Related #88629. Thanks @charles-openclaw and @resYuto.
+- **PR #88749** fix(channels): recover failed progress draft starts. Related #83115. Thanks @SebTardif.
+- **PR #88029** fix(agents): atomic auth.json write to prevent credential lockout on crash. Related #88028. Thanks @Feelw00.
+- **PR #85277** fix(openai): avoid stale Responses message id replay. Thanks @latensified.
+- **PR #79173** fix: skip disabled skill snapshot env overrides. Related #79072. Thanks @zeus1959 and @maverikva.
+- **PR #88752** refactor: split ACP manager session flows.
+- **PR #79149** fix(ci): guard workflow template injection. Related #68428. Thanks @WT-WSL and @visionik.
+- **PR #74089** fix(openai/tts): handle [[tts:speed]] directive in OpenAI speech provider (#12163). Thanks @stainlu and @useramuser.
+- **PR #88763** feat: add code-mode MCP API files.
+- **PR #87896** fix(feishu): fallback when accepted turns send no visible reply. Thanks @ArthurNie.
+- **PR #88761** [codex] Surface disabled Codex plugin routes in doctor lint. Related #88751. Thanks @brokemac79 and @jalehman.
+- **PR #88759** fix: repair providerless Codex session overrides. Thanks @earlvanze.
+- **PR #88740** fix(hooks): pass media metadata to internal message_received hook. Thanks @SebTardif.
+- **PR #88695** fix(agents): wait for cron media completions. Related #88001. Thanks @nailujac.
+- **PR #88762** fix(ui): show Workboard comments in edit modal. Thanks @MonkeyLeeT.
+- **PR #88765** fix(agents): publish owned announcement session writes. Related #88703. Thanks @TurboTheTurtle and @neo-hu.
+- **PR #59196** feat(doctor): add disk space health check for state directory. Thanks @alkor2000.
+- **PR #79260** feat(doctor): add --post-upgrade --json mode for plugin-compat findings. Thanks @arniesaha.
+- **PR #88486** fix(diagnostics): carry session UUID on interactive dispatch events. Thanks @arniesaha.
+- **PR #84904** fix: avoid replaying Responses item ids when store is disabled. Thanks @zhanghang02.
+- **PR #82828** fix(daemon): preserve container service env across regen. Thanks @wAngByg.
+- **PR #88755** fix(agents): expose session status route context. Related #84544. Thanks @nxmxbbd and @lykeion-dev.
+- **PR #88781** fix(models): strip remaining provider self prefixes. Related #88770. Thanks @charles-openclaw and @cjalden.
+- **PR #88131** fix(logging): refresh file log hostname per write. Related #87258. Thanks @lonexreb and @mmhzlrj.
+- **PR #88667** fix #81214: [Bug]: OpenClaw 2026.5.7 subagent regression. Thanks @zhangguiping-xydt and @GreyWolfRon.
+- **PR #88764** fix(update): recognize manual-update launchd jobs. Related #88736. Thanks @TurboTheTurtle and @deonkretch.
+- **PR #88727** fix(feishu): preserve long streaming replies. Related #88631. Thanks @MonkeyLeeT and @Leorand-dev.
+- **PR #88512** fix: resolve google provider default API to google-generative-ai. Related #88480. Thanks @1052326311 and @Xin and @azgardtek.
+- **PR #88756** feat: add Skill Workshop Control UI. Thanks @shakkernerd.
+- **PR #88610** fix: suppress raw provider errors in channel delivery. Related #69737. Thanks @jason-allen-oneal and @alexisperumal.
+- **PR #88808** perf: hydrate chat history session metadata.
+- **PR #88735** fix(agents): harden runtime tool schema quarantine. Thanks @vincentkoc.
+- **PR #88221** fix(nostr): decode npub allowFrom entries to hex correctly. Thanks @DocNR and @hypoxicdrive.
+- **PR #88772** feat: calm composer controls.
+- **PR #88388** fix(agents): guard transport payload sanitizer against non-string input. Related #60113. Thanks @Pluviobyte and @cursoragent and @wujiaming88.
+- **PR #88149** fix(agents): cap bootstrap snapshot cache. Thanks @yozakura-ava.
+- **PR #88545** fix(memory-core): stop dream diary fallback from leaking raw staging fragments. Related #88391. Thanks @Alix-007 and @Carme99.
+- **PR #88289** fix(microsoft-foundry): skip DeepSeek V4 thinking params on Foundry fallback. Thanks @silvesterxm.
+- **PR #88209** fix(subagents): roll formatTokenShort over to "m" at 1000k. Thanks @coder999999999.
+- **PR #88008** fix(tasks): persist task store before in-memory mutation to prevent sqlite divergence. Related #88007. Thanks @Feelw00.
+- **PR #88306** fix(gateway): hide phantom agent store rows from sessions.list. Related #57376. Thanks @Alix-007 and @smarchetti.
+- **PR #88760** fix(doctor): report runtime tool schema errors. Thanks @vincentkoc.
+- **PR #88495** fix(imessage): tolerate sub-second self-chat reflection skew. Thanks @colmbrogan.
+- **PR #88797** Migrate iMessage monitor state to SQLite.
+- **PR #87981** fix(cron): retire MCP runtimes on isolated cron timeout and dispose. Related #87821. Thanks @Jerry-Xin and @zachisfine.
+- **PR #88410** fix(gateway): harden MCP loopback tool schemas. Thanks @vincentkoc.
+- **PR #88100** fix(doctor): quiet tool policy removal audits. Related #87798. Thanks @giodl73-repo and @oalansilva.
+- **PR #88804** fix(agents): preserve stop-finished OpenAI tool calls. Related #88791. Thanks @MonkeyLeeT and @kiagentkronos-cell.
+- **PR #88802** test(agents): cover nonfatal trajectory flush timeout. Related #88520. Thanks @TurboTheTurtle and @novac42code.
+- **PR #88819** fix(workboard): wire task-backed board runs. Thanks @vincentkoc.
+- **PR #88608** fix(minimax): use account OAuth device endpoints. Thanks @MatthewSchleder.
+- **PR #88794** Persist plugin install index in SQLite.
+- **PR #88827** Add Vertex API key model config regression coverage. Related #88816. Thanks @TurboTheTurtle and @randompup.
+- **PR #77237** Preserve managed npm plugin root when install validation blocks update. Thanks @zhuisDEV.
+- **PR #88288** fix(config): skip state-dir dotenv values that are unresolved shell references. Related #88274. Thanks @Alix-007 and @mathias15010.
+- **PR #87848** fix(status): resolve gateway auth secrets for deep audit. Related #87815. Thanks @ai-hpc and @kAIborg24.
+- **PR #88807** fix(plugins): isolate web provider factory failures. Thanks @vincentkoc.
+- **PR #88518** fix(plugins): isolate cached tool runtime siblings. Thanks @vincentkoc.
+- **PR #88851** Persist OpenRouter model cache in SQLite.
+- **PR #88485** fix(agents): guard vanished workspaces. Related #88333. Thanks @TurboTheTurtle and @HT-Moh.
+- **PR #88825** perf: streamline chat startup metadata.
+- **PR #88723** fix(doctor): respect explicit PI runtime policy. Related #88706. Thanks @toruvieI.
+- **PR #88365** fix(infra): bridge WSL clipboard through shell. Related #88080. Thanks @vincentkoc and @YaneCheung.
+- **PR #88785** fix: restore backgrounded in-flight runs on TUI switch-back via gateway snapshot. Thanks @williamliu-ai.
+- **PR #87992** feat(ios): support native iPad display. Thanks @EmpX2025.
+- **PR #88846** fix: preserve no-policy native hook fallback. Thanks @woodym-dotcom.
+- **PR #81264** fix(installer): align Node version floor with package engine. Thanks @kiranmagic7.
+- **PR #87838** test(agents): include Ollama in small live model matrix. Thanks @vincentkoc.
+- **PR #88860** feat(minimax): add MiniMax M3 support.
+- **PR #88305** fix(browser): isolate Chrome MCP pending attach aborts. Related #88304. Thanks @rohitjavvadi.
+- **PR #88814** fix(ci): repair current main checks. Thanks @vincentkoc.
+- **PR #88855** fix(microsoft-foundry): satisfy extension lint. Thanks @RomneyDa.
+- **PR #88824** test: consolidate plugin registration contracts. Thanks @RomneyDa.
+- **PR #88847** test(ui): remove stylesheet grep tests. Thanks @RomneyDa.
+- **PR #88704** fix(memory): rehydrate daily list promotions. Related #87854. Thanks @MonkeyLeeT and @KingYiKa.
+- **PR #88848** test(agents): use neutral tool schema fixtures. Thanks @vincentkoc.
+- **PR #88817** fix(agents): return schema lookup misses in-band. Related #88813. Thanks @ksj3421 and @cjalden.
+- **PR #88866** Persist Discord thread bindings in SQLite.
+- **PR #88801** fix(hooks): expose inbound reply metadata before dispatch. Related #88521. Thanks @TurboTheTurtle and @hoyanhan.
+- **PR #88865** docs: clarify diffs language pack additions. Thanks @RomneyDa.
+- **PR #88849** docs: continue inline comment pass.
+- **PR #87077** fix(ui): bypass service worker for top-level navigations. Thanks @nayrosk.
+- **PR #88394** fix(plugins): fail closed on trusted policy errors. Thanks @vincentkoc.
+- **PR #88758** docs(imessage): document SSH wrapper TCC send failure. Related #79289. Thanks @TurboTheTurtle.
+- **PR #88859** fix(mattermost): route send attachments through upload. Related #87930. Thanks @vincentkoc and @NewCoffee7477.
+- **PR #88830** feat(dreaming): score candidates with shadow trial results. Thanks @iFiras-Max1.
+- **PR #88803** fix(reply): preserve sessions_send external routes. Related #88044. Thanks @MonkeyLeeT and @Lvan185.
+- **PR #88294** fix(cron): include job name when reading single-job run history. Thanks @kip-claw.
+- **PR #88896** fix: harden CLI and plugin edge cases.
+- **PR #88767** fix(plugin-sdk): isolate provider catalog projection failures. Thanks @vincentkoc.
+- **PR #88892** feat(ui): improve Workboard task details. Thanks @vincentkoc.
+- **PR #88806** fix(memory-lancedb): reject envelope metadata sludge (incl. marker-free shapes). Thanks @amittell.
+- **PR #88921** fix(ui): keep first control chat sends responsive. Thanks @vincentkoc.
+- **PR #87484** fix(agents): clear legacy auto fallback pins. Related #87467. Thanks @neeravmakwana and @bgmbgm94.
+- **PR #88904** fix(android): add notification app picker. Thanks @Tosko4.
+- **PR #88820** fix(diagnostics): clear embedded-run activity when recovery declares lane idle. Related #88660. Thanks @openperf and @Iman-Sharif.
+- **PR #88897** refactor(copilot): compact sessions through SDK state.
+- **PR #88924** fix(agents): strip streamed reasoning tags. Related #88741. Thanks @kdonthar.
+- **PR #88937** fix(ui): render pending sends in chat thread. Thanks @vincentkoc.
+- **PR #88949** fix(ui): scroll pending sends into view. Thanks @vincentkoc.
+- **PR #88952** perf(ui): cache chat transcript renders. Thanks @vincentkoc.
+- **PR #88960** perf(ui): record pending send paint timing. Thanks @vincentkoc.
+- **PR #88972** perf(ui): debounce chat draft persistence. Thanks @vincentkoc.
+- **PR #88978** perf(ui): skip closed slash menu rerenders. Thanks @vincentkoc.
+- **PR #88982** fix(test): wait for telegram timer flushes. Thanks @vincentkoc.
+- **PR #88989** perf(ui): guard chat transcript rerenders. Thanks @vincentkoc.
+
diff --git a/CHANGELOG/2026.6.7.md b/CHANGELOG/2026.6.7.md
new file mode 100644
index 0000000000000000000000000000000000000000..bb90393066f118f10a405c57c116cfb0f3299d54
--- /dev/null
+++ b/CHANGELOG/2026.6.7.md
@@ -0,0 +1,87 @@
+## 2026.6.7
+
+### Highlights
+
+- **Durable channel replies:** Telegram polling and preview failures recover instead of ending a stream, Slack keeps delivered replies in the transcript, and top-level image sends retain their intended media source. (#92281, #92498, #92416) Thanks @joshavant, @TurboTheTurtle, @xydigit-sj, @ichirokyoto, @TalkingHeadsJed, and @riseandshinefutures.
+- **More dependable provider sessions:** SecretRef-backed profiles, configured DeepSeek transports, static model fallback, Anthropic thinking replay, and Codex prompt memory all recover cleanly instead of leaving a turn unusable. (#92265, #92235, #92293, #92286, #92350) Thanks @joshavant, @rubencu, @sallyom, @marcoraepple-sys, @LINSUISHENG034, @mattsfraser, and @reginaldomarcilon.
+- **Kimi K2.7 Code support:** the provider catalog now includes the new Kimi coding model, with replay handling that preserves its reasoning content across tool turns. (#92554, #92396) Thanks @xialonglee and @RoseKongPS.
+- **Safer operations:** SQLite-backed cron status, disabled heartbeat retries, Linux service updates, and external-plugin diagnosis now expose clearer, actionable state to operators. (#92144, #92225, #92282, #86629) Thanks @liuhao1024, @joshavant, @brokemac79, @AaronFaby, @cdeyoung67, @ooiuuii, @shakkernerd, @A1fred-AI, and @hanyizuo.
+- **Guarded skill installs:** Skill Workshop support-file targets now go through trusted lifecycle writes instead of unbounded filesystem updates, while ClawHub package checks stay on the current release path. (#91311) Thanks @abnershang.
+
+### Changes
+
+- Skills and plugin workflows now permit trusted Skill Workshop support-file targets only through guarded lifecycle writes, and package publishing uses the current ClawHub plugin checks. (#91311) Thanks @abnershang and @vincentkoc.
+- Providers: add Kimi K2.7 Code support. (#92554)
+
+### Fixes
+
+- Channels and delivery: recover Telegram preview and polling failures, retain Slack final replies in transcripts, preserve top-level outbound image parameters, and make channel-action result pages available to callers. (#92281, #92498, #92407, #88993) Thanks @joshavant, @TurboTheTurtle, @xydigit-sj, @fuller-stack-dev, @TalkingHeadsJed, and @riseandshinefutures.
+- Agent/provider reliability: preserve configured model transport/auth resolution, fail closed for unsupported CLI-backed `/btw` fallback, continue after source message-tool replies, repair Anthropic thinking replay, and keep Codex memory prompts registered. (#92265, #92226, #92343, #92286, #92350) Thanks @joshavant, @rubencu, @sallyom, @marcoraepple-sys, @wangwllu, @elyalvarado, and @reginaldomarcilon.
+- Operations: make cron and daemon status resilient, preserve disabled heartbeat one-shot retries, hand off Linux service auto-updates, and keep lifecycle timeout cleanup alive after leader exit. (#92144, #92225, #92282, #92566) Thanks @liuhao1024, @joshavant, @RomneyDa, @AaronFaby, @A1fred-AI, and @hanyizuo.
+
+### Complete contribution record
+
+This audited record covers the complete v2026.6.6..v2026.6.7-beta.1 history: 59 merged PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.
+
+#### Pull requests
+
+- **PR #92144** fix(cron): report SQLite storage path in cron.status instead of legacy jobs.json. Related #91766. Thanks @liuhao1024 and @AaronFaby.
+- **PR #92175** fix(channel): harden local setup trust. Thanks @hxy91819.
+- **PR #91528** fix #73837: stop after failed Node package installs. Thanks @mushuiyu886 and @ItsMeForLua.
+- **PR #91561** fix(wizard): report keyless web_search providers as ready, not missing a key. Thanks @NormallyGaussian.
+- **PR #92073** fix: handle explicit silent assistant replies. Related #92038. Thanks @sallyom and @vultusv.
+- **PR #91311** Allow Skill Workshop apply through trusted skill symlinks. Thanks @abnershang.
+- **PR #88245** refactor(whatsapp): introduce inbound message contexts. Thanks @mcaxtr.
+- **PR #92212** refactor: move workspace skill writes to lifecycle. Thanks @shakkernerd.
+- **PR #92248** Remove ClawHub owner preflight. Thanks @Patrick-Erichsen.
+- **PR #91617** test(sqlite): add state perf query plan harness. Related #91616. Thanks @galiniliev.
+- **PR #91626** fix(daemon): keep status readable on unsupported services. Related #25621. Thanks @mushuiyu886 and @kucharskim.
+- **PR #92295** fix(cron): preserve tz and staggerMs when --cron replaces expression. Related #92291. Thanks @liuhao1024 and @dcapclaw.
+- **PR #92087** fix(docker): bundle QA Lab runtime in the image. Thanks @jesse-merhi.
+- **PR #92004** fix(telegram): classify streaming preview edit failures instead of killing the draft. Thanks @obviyus.
+- **PR #91997** fix(telegram): survive getUpdates conflicts in isolated polling ingress. Thanks @obviyus.
+- **PR #92387** fix(anthropic-vertex): stop re-marking cache_control on transport-budgeted payloads. Related #91982. Thanks @openperf and @Takhoffman and @danieljimz.
+- **PR #92229** Fix doctor preview channel SecretRef resolution. Related #91939. Thanks @joshavant and @Niriakot.
+- **PR #92225** Fix disabled heartbeat one-shot cron retries. Related #91775. Thanks @joshavant and @A1fred-AI.
+- **PR #92265** Fix configured DeepSeek model transport inheritance. Related #92148. Thanks @joshavant and @marcoraepple-sys.
+- **PR #92226** Fail closed for CLI-backed /btw fallback. Related #92168. Thanks @joshavant and @wangwllu.
+- **PR #92231** Fix suppressed heartbeat commitment delivery. Related #91948. Thanks @joshavant and @bizzle12368239.
+- **PR #92280** fix(agents): classify structured unsupported model errors. Related #92118. Thanks @joshavant and @pikaqqqqqq.
+- **PR #92276** Fix OTLP log trace correlation. Related #91865. Thanks @joshavant and @sinzin91.
+- **PR #92282** fix(update): hand off Linux service auto-updates. Related #91823. Thanks @joshavant and @hanyizuo.
+- **PR #92235** fix: resolve managed SecretRef provider auth. Related #92097. Thanks @joshavant and @LINSUISHENG034.
+- **PR #92293** Fix provider static model fallback resolution. Related #92009. Thanks @joshavant and @mattsfraser.
+- **PR #92343** fix(agent): continue after source message tool replies. Related #92169. Thanks @joshavant and @elyalvarado.
+- **PR #92350** fix(codex): preserve memory prompt registration. Thanks @rubencu and @sallyom.
+- **PR #92290** fix: clarify gateway SecretRef auth diagnostics. Related #91815. Thanks @joshavant and @mattsfraser.
+- **PR #92286** fix: repair rejected Anthropic thinking replay. Related #91983. Thanks @joshavant and @reginaldomarcilon.
+- **PR #92281** Fix Telegram spooled buffered replay. Related #92129. Thanks @joshavant and @riseandshinefutures.
+- **PR #47493** fix(doctor): show per-step progress spinners during update. Thanks @amersheeny.
+- **PR #92416** fix(outbound): honor top-level image param as send media source (#92407). Thanks @xydigit-sj and @ichirokyoto.
+- **PR #92508** fix(sandbox): render CLI skill prompts from materialized paths. Thanks @brokemac79.
+- **PR #92540** chore: fix esbuild production audit failure. Thanks @RomneyDa.
+- **PR #91484** Add QA evidence artifact output. Thanks @RomneyDa.
+- **PR #91500** Add QA scorecard taxonomy validation. Thanks @RomneyDa.
+- **PR #84082** fix(telegram): allow expandable blockquotes. Thanks @jzakirov.
+- **PR #92554** feat(moonshot): add Kimi K2.7 Code support.
+- **PR #92396** fix(moonshot): backfill reasoning_content on assistant tool-call replay messages. Related #71491. Thanks @xialonglee and @RoseKongPS.
+- **PR #92566** Fix lifecycle timeout cleanup after leader exit. Thanks @RomneyDa.
+- **PR #92311** ci: split plugin ClawHub publishing paths. Thanks @Patrick-Erichsen.
+- **PR #92216** fix(gateway): mirror hidden commentary-phase assistant events. Thanks @ragesaq.
+- **PR #87596** fix(moonshot): rewrite duplicate native Kimi tool_call ids on replay. Related #51593. Thanks @Pluviobyte and @Faaab84.
+- **PR #88993** Expose paged channel action results. Thanks @fuller-stack-dev.
+- **PR #90326** fix(fireworks): resolve catalog model params from plugin.json via core. Thanks @obuchowski.
+- **PR #86629** fix(doctor): warn for untrusted external Discord plugin. Related #83212. Thanks @brokemac79 and @ooiuuii and @cdeyoung67.
+- **PR #90242** fix(providers): skip unreadable Mistral tool schemas. Thanks @vincentkoc.
+- **PR #92498** fix(reply): mirror same-channel Slack final replies. Related #92489. Thanks @TurboTheTurtle and @TalkingHeadsJed.
+- **PR #92083** fix(channels): default boundary logger for swallowed progress-draft start errors. Thanks @hansraj316.
+- **PR #92564** fix(agents): isolate invalid plugin model catalogs [AI-assisted]. Related #92553. Thanks @tangtaizong666 and @fxstein.
+- **PR #89827** docs: UX-013 — design system documentation. Thanks @BunsDev.
+- **PR #89615** feat(ui): hide empty workboard columns. Thanks @BunsDev.
+- **PR #89822** fix(a11y): B-1+B-2+B-3 — contrast, focus states, minimum font sizes. Thanks @BunsDev.
+- **PR #92618** fix #92218: memory_search tool disabled with QMD backend. Thanks @mushuiyu886 and @zhbcher.
+- **PR #92608** docs(gateway): add uptime monitoring guidance to health check docs (fixes #55768). Thanks @liuhao1024 and @faahim.
+- **PR #92605** fix(docs): pin Windows Hub download links to v2026.6.5. Related #92470. Thanks @lzyyzznl and @arjkul.
+- **PR #92593** #92589: fix(internal-runtime-context): wrap prompt-preface runtime context body in delimiters. Thanks @zhangqueping and @jovi2014-cyber.
+- **PR #92606** Run Vitest and Playwright scenarios from qa suite. Thanks @RomneyDa.
+
diff --git a/CHANGELOG/2026.6.8.md b/CHANGELOG/2026.6.8.md
new file mode 100644
index 0000000000000000000000000000000000000000..ccbcd6a423aa67544d1ffb0d96b20e93d37ccd02
--- /dev/null
+++ b/CHANGELOG/2026.6.8.md
@@ -0,0 +1,233 @@
+## 2026.6.8
+
+### Highlights
+
+- **Richer channel delivery:** Telegram and WhatsApp are less brittle: Telegram renders structured text with tables, lists, expandable blockquotes, preserved intentional line breaks, and CLI-backed replies, while WhatsApp now honors configured ACP bindings. (#92679, #93164, #84082, #89421, #92513) Thanks @obviyus, @vincentkoc, @jzakirov, @spacegeologist, @TurboTheTurtle, @mcaxtr, @myrzka, and @dmorn.
+- **More reliable agent runs:** account-scoped DM sends, generated media completions, auto-reply message-tool final replies, reset archive fallback reads, restart shutdown aborts, yielded subagent pauses, and session identity prompts all stay on the correct recovery path. (#92788, #91246, #92879, #91357, #92631, #92468) Thanks @yetval, @TurboTheTurtle, @masatohoshino, @CadanHu, @vincentkoc, @ooiuuii, @openperf, @zhangguiping-xydt, @QQSHI13, @kumaxs, and @aleps001.
+- **Safer model routing:** new GLM-5.2 and Claude Haiku 4.5 catalog support arrives with normalized provider IDs, managed SecretRef auth, bounded model browsing, and safer OpenAI/Anthropic tool-schema recovery. (#92796, #90116, #92627, #90686, #92247, #92941) Thanks @arkyu2077, @liuhao1024, @lijenhsin, @rohitjavvadi, @samson910022, @maaron34, @syfvb, and @samson1357924.
+- **Useful usage footers:** `/usage` and reply payload hooks now have a native full footer renderer, default template, fixed-decimal formatting, credential-aware limits, better partial-count handling, and warnings for broken templates instead of silent bad output. (#92657, #89835, #89629) Thanks @Marvinthebored.
+- **Predictable web search defaults:** key-free providers such as Parallel Free, DuckDuckGo, Ollama, and Codex Hosted Search remain explicit opt-ins rather than surprising automatic fallbacks. (#93616) Thanks @davemorin and @vincentkoc.
+- **Calmer UI and mobile sessions:** workspace files start collapsed, WebChat backscroll survives streaming, the desktop session picker remains interactive, reset arguments survive dispatch, and iOS reconnects stale foreground Gateways. (#92779, #92622, #92705, #91353, #92552) Thanks @shakkernerd, @TurboTheTurtle, @NianJiuZst, @zhouhe-xydt, @Solvely-Colin, @MaBeitian, @vincentkoc, @Chang2020618, and @DrtyMorty.
+- **Resilient memory and state:** oversized OpenAI embedding batches split before 431s, QMD search stays available in transient mode, SQLite avoids WAL on NFS volumes, and full reindexes preserve rollback/cache recovery. (#92650, #92618, #92639, #91247, #92881) Thanks @mushuiyu886, @BrettHamlin, @zhbcher, @TurboTheTurtle, @Takhoffman, @849261680, @TSHOGX, @vincentkoc, and @AFabyTWE.
+
+### Changes
+
+- Providers/models: add GLM-5.2 support and Claude Haiku 4.5 catalog entries while keeping provider-qualified model IDs normalized across OpenRouter and Google Vertex paths. (#92796, #90116, #92627, #91218) Thanks @arkyu2077, @liuhao1024, @bymle, @maaron34, @lijenhsin, @davemorin, and @vincentkoc.
+- Web search: keep key-free providers such as Parallel Free, DuckDuckGo, Ollama, and Codex Hosted Search as explicit opt-ins instead of selecting them automatically when no API-backed provider is configured. (#93616) Thanks @davemorin and @vincentkoc.
+- Channel plugins: ship Telegram rich-message delivery and WhatsApp ACP binding support, including preserved intentional line breaks, rich prompt handoff to CLI backends, and transport fixtures for richer drafts. (#92679, #93164, #92513) Thanks @obviyus, @TurboTheTurtle, @vincentkoc, @mcaxtr, and @dmorn.
+- Agent commands: support `/btw` in CLI-backed sessions and keep CLI usage-error exits classified as usage failures instead of successful runs. (#92669, #92162) Thanks @joshavant, @Pandah97, @marcospaulo, @davemorin, and @vincentkoc.
+- Usage hooks: add built-in full footer rendering, default footer templates, per-turn usage state, credential-aware limits, and fixed-decimal formatting for usage-bar templates. (#92657, #89835, #89629) Thanks @Marvinthebored.
+
+### Fixes
+
+- Channels and delivery: preserve account-scoped DM channel send policy, intentional rich-message line breaks in Telegram and status output, rich Telegram final replies, rich Telegram tables and lists, Telegram thread-create CLI remapping, Feishu dynamic-agent routes after persisted binding reuse, Slack outbound `message_sent` hooks, contributed message-tool schema optionality, same-channel generated media completions, and channel chunking around surrogate pairs and Infinity limits. (#92788, #93164, #92679, #89421, #89943, #42837, #92814, #91137, #91246, #92735) Thanks @yetval, @obviyus, @spacegeologist, @rishitamrakar, @liuhao1024, @lundog, @TurboTheTurtle, @yhterrance, @vincentkoc, @myrzka, @cwlong163-afk, @kumaxs, @shakkernerd, and @RewardsPal.
+- Gemini CLI: use the selected OpenClaw OAuth/API-key auth profile in an isolated Gemini CLI runtime home, preventing ambient Google machine credentials from overriding the chosen profile. (#88748) Thanks @jason-allen-oneal and @shakkernerd.
+- Feishu: fetch quoted/replied message content before the empty-message guard so a mention-only reply that quotes a message with meaningful content is no longer dropped. (#90192) Thanks @bladin.
+- Discord: give generated auto-thread titles a 60-second timeout and 4,096-token reasoning-model output budget, clamped to the selected model output cap. (#64734) Thanks @hanamizuki.
+- Agent, cron, and Gateway runtime: mark active main sessions before restart shutdown aborts, pause yielded subagent runs whose terminal also signals abort, clamp trusted subagent thinking overrides through provider/model fallback, preserve yielded media completions, deliver channel message-tool final replies through auto-reply while hiding internal delivery hints, restore reset archive fallback reads when active async transcripts are missing, de-duplicate main-session heartbeat events, expose session identity in runtime prompts, reject unknown OpenAI agent selectors, keep generated media completions, slash-command block replies, and trajectory export commands in WebChat, and require admin privileges for HTTP session/model override surfaces. (#91357, #92631, #92412, #92146, #92879, #91287, #92468, #92510, #91246, #92651, #92646) Thanks @ooiuuii, @openperf, @IWhatsskill, @masatohoshino, @CadanHu, @ZengWen-DT, @zhangguiping-xydt, @TurboTheTurtle, @oiGaDio, @aleps001, @vincentkoc, @GSL-R, @QQSHI13, @ryanhelms, @kumaxs, @steipete-oai, @hxy91819, @davemorin, and @nailujac.
+- Providers and model replay: preserve storeless OpenAI Responses replay compatibility, recover invalid OpenAI reasoning signatures and genericized Anthropic thinking-signature replay errors, route OAuth image defaults through Codex for eligible OpenAI profiles, avoid eager tool streaming for Claude 4.5 in Copilot, quarantine unreadable and post-hook OpenAI/Anthropic-family tool schemas without broadening allowed tool choices, deliver explicit thinking-off requests to LM Studio binary-thinking models, honor profile auth for SecretRef model entries, bound model browsing, strip provider prefixes where runtimes need bare IDs, and surface nested embedding fetch failures. (#90706, #92941, #92201, #92916, #92824, #75393, #92908, #92921, #92928, #92002, #90686, #92247, #92627, #91218, #92628) Thanks @snowzlm, @mmyzwl, @CarlCapital, @bek91, @Kailigithub, @vincentkoc, @rohitjavvadi, @samson910022, @nxmxbbd, @liuhao1024, @bymle, @mushuiyu886, @finchinslc, @syfvb, @lijenhsin, @crsnpalmer-art, @samson1357924, @shakkernerd, and @mlaihk.
+- Memory, state, diagnostics, and config: split header-too-large embedding batches, keep QMD memory search enabled in transient mode, avoid SQLite WAL on NFS volumes, preserve recovery scheduling outside stuck-session warning backoff, preserve full-reindex rollback/cache recovery, and treat raw Memory Wiki source pages as source evidence. (#92650, #92618, #92639, #91247, #92752, #92881, #59137, #92876) Thanks @mushuiyu886, @TurboTheTurtle, @849261680, @gnanam1990, @TSHOGX, @vincentkoc, @arlen8411, @BrettHamlin, @zhbcher, @Takhoffman, @AFabyTWE, @davemorin, and @zhuyankarl.
+- UI/mobile/TUI: preserve dashboard session parent lineage, WebChat backscroll, reset soft command args, sidebar session picker interactivity, collapsed workspace files, resolved `/model` confirmation refs, stale foreground iOS Gateway reconnects, and paused setup-parent stdin after inherited-stdio child exit. (#90658, #92622, #91353, #92705, #92779, #92773, #92552, #93159) Thanks @luoyanglang, @TurboTheTurtle, @zhouhe-xydt, @NianJiuZst, @shakkernerd, @NarahariRaghava, @Solvely-Colin, @fuller-stack-dev, @lily-oc, @MaBeitian, @vincentkoc, @obviyus, @DrtyMorty, and @Chang2020618.
+- Plugins and updates: repair missing required platform packages during managed plugin installs and updates, including omitted Codex platform binaries. Thanks @vincentkoc.
+- Dependencies: update Hono to 4.12.25 so published OpenClaw and ACPX packages use the patched runtime. Thanks @vincentkoc.
+- Updates: avoid a false downgrade prompt when the latest tag cannot resolve. (#92911) Thanks @Andy312432 and @vincentkoc.
+
+### Complete contribution record
+
+This audited record covers the complete v2026.6.6..v2026.6.8 history: 192 merged PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.
+
+#### Pull requests
+
+- **PR #92144** fix(cron): report SQLite storage path in cron.status instead of legacy jobs.json. Related #91766. Thanks @liuhao1024 and @AaronFaby.
+- **PR #92175** fix(channel): harden local setup trust. Thanks @hxy91819.
+- **PR #91528** fix #73837: stop after failed Node package installs. Thanks @mushuiyu886 and @ItsMeForLua.
+- **PR #91561** fix(wizard): report keyless web_search providers as ready, not missing a key. Thanks @NormallyGaussian.
+- **PR #92073** fix: handle explicit silent assistant replies. Related #92038. Thanks @sallyom and @vultusv.
+- **PR #91311** Allow Skill Workshop apply through trusted skill symlinks. Thanks @abnershang.
+- **PR #88245** refactor(whatsapp): introduce inbound message contexts. Thanks @mcaxtr.
+- **PR #92212** refactor: move workspace skill writes to lifecycle. Thanks @shakkernerd.
+- **PR #92248** Remove ClawHub owner preflight. Thanks @Patrick-Erichsen.
+- **PR #91617** test(sqlite): add state perf query plan harness. Related #91616. Thanks @galiniliev.
+- **PR #91626** fix(daemon): keep status readable on unsupported services. Related #25621. Thanks @mushuiyu886 and @kucharskim.
+- **PR #92295** fix(cron): preserve tz and staggerMs when --cron replaces expression. Related #92291. Thanks @liuhao1024 and @dcapclaw.
+- **PR #92087** fix(docker): bundle QA Lab runtime in the image. Thanks @jesse-merhi.
+- **PR #92004** fix(telegram): classify streaming preview edit failures instead of killing the draft. Thanks @obviyus.
+- **PR #91997** fix(telegram): survive getUpdates conflicts in isolated polling ingress. Thanks @obviyus.
+- **PR #92387** fix(anthropic-vertex): stop re-marking cache_control on transport-budgeted payloads. Related #91982. Thanks @openperf and @Takhoffman and @danieljimz.
+- **PR #92229** Fix doctor preview channel SecretRef resolution. Related #91939. Thanks @joshavant and @Niriakot.
+- **PR #92225** Fix disabled heartbeat one-shot cron retries. Related #91775. Thanks @joshavant and @A1fred-AI.
+- **PR #92265** Fix configured DeepSeek model transport inheritance. Related #92148. Thanks @joshavant and @marcoraepple-sys.
+- **PR #92226** Fail closed for CLI-backed /btw fallback. Related #92168. Thanks @joshavant and @wangwllu.
+- **PR #92231** Fix suppressed heartbeat commitment delivery. Related #91948. Thanks @joshavant and @bizzle12368239.
+- **PR #92280** fix(agents): classify structured unsupported model errors. Related #92118. Thanks @joshavant and @pikaqqqqqq.
+- **PR #92276** Fix OTLP log trace correlation. Related #91865. Thanks @joshavant and @sinzin91.
+- **PR #92282** fix(update): hand off Linux service auto-updates. Related #91823. Thanks @joshavant and @hanyizuo.
+- **PR #92235** fix: resolve managed SecretRef provider auth. Related #92097. Thanks @joshavant and @LINSUISHENG034.
+- **PR #92293** Fix provider static model fallback resolution. Related #92009. Thanks @joshavant and @mattsfraser.
+- **PR #92343** fix(agent): continue after source message tool replies. Related #92169. Thanks @joshavant and @elyalvarado.
+- **PR #92350** fix(codex): preserve memory prompt registration. Thanks @rubencu and @sallyom.
+- **PR #92290** fix: clarify gateway SecretRef auth diagnostics. Related #91815. Thanks @joshavant and @mattsfraser.
+- **PR #92286** fix: repair rejected Anthropic thinking replay. Related #91983. Thanks @joshavant and @reginaldomarcilon.
+- **PR #92281** Fix Telegram spooled buffered replay. Related #92129. Thanks @joshavant and @riseandshinefutures.
+- **PR #47493** fix(doctor): show per-step progress spinners during update. Thanks @amersheeny.
+- **PR #92416** fix(outbound): honor top-level image param as send media source (#92407). Thanks @xydigit-sj and @ichirokyoto.
+- **PR #92508** fix(sandbox): render CLI skill prompts from materialized paths. Thanks @brokemac79.
+- **PR #92540** chore: fix esbuild production audit failure. Thanks @RomneyDa.
+- **PR #91484** Add QA evidence artifact output. Thanks @RomneyDa.
+- **PR #91500** Add QA scorecard taxonomy validation. Thanks @RomneyDa.
+- **PR #84082** fix(telegram): allow expandable blockquotes. Thanks @jzakirov.
+- **PR #92554** feat(moonshot): add Kimi K2.7 Code support.
+- **PR #92396** fix(moonshot): backfill reasoning_content on assistant tool-call replay messages. Related #71491. Thanks @xialonglee and @RoseKongPS.
+- **PR #92566** Fix lifecycle timeout cleanup after leader exit. Thanks @RomneyDa.
+- **PR #92311** ci: split plugin ClawHub publishing paths. Thanks @Patrick-Erichsen.
+- **PR #92216** fix(gateway): mirror hidden commentary-phase assistant events. Thanks @ragesaq.
+- **PR #87596** fix(moonshot): rewrite duplicate native Kimi tool_call ids on replay. Related #51593. Thanks @Pluviobyte and @Faaab84.
+- **PR #88993** Expose paged channel action results. Thanks @fuller-stack-dev.
+- **PR #90326** fix(fireworks): resolve catalog model params from plugin.json via core. Thanks @obuchowski.
+- **PR #86629** fix(doctor): warn for untrusted external Discord plugin. Related #83212. Thanks @brokemac79 and @ooiuuii and @cdeyoung67.
+- **PR #90242** fix(providers): skip unreadable Mistral tool schemas. Thanks @vincentkoc.
+- **PR #92498** fix(reply): mirror same-channel Slack final replies. Related #92489. Thanks @TurboTheTurtle and @TalkingHeadsJed.
+- **PR #92083** fix(channels): default boundary logger for swallowed progress-draft start errors. Thanks @hansraj316.
+- **PR #92564** fix(agents): isolate invalid plugin model catalogs [AI-assisted]. Related #92553. Thanks @tangtaizong666 and @fxstein.
+- **PR #89827** docs: UX-013 — design system documentation. Thanks @BunsDev.
+- **PR #89615** feat(ui): hide empty workboard columns. Thanks @BunsDev.
+- **PR #89822** fix(a11y): B-1+B-2+B-3 — contrast, focus states, minimum font sizes. Thanks @BunsDev.
+- **PR #92618** fix #92218: memory_search tool disabled with QMD backend. Thanks @mushuiyu886 and @zhbcher.
+- **PR #92608** docs(gateway): add uptime monitoring guidance to health check docs (fixes #55768). Thanks @liuhao1024 and @faahim.
+- **PR #92605** fix(docs): pin Windows Hub download links to v2026.6.5. Related #92470. Thanks @lzyyzznl and @arjkul.
+- **PR #92593** #92589: fix(internal-runtime-context): wrap prompt-preface runtime context body in delimiters. Thanks @zhangqueping and @jovi2014-cyber.
+- **PR #92606** Run Vitest and Playwright scenarios from qa suite. Thanks @RomneyDa.
+- **PR #89629** feat(hooks): per-turn usageState on reply_payload_sending. Thanks @Marvinthebored.
+- **PR #89835** feat(usage): native templated /usage full footer renderer. Thanks @Marvinthebored.
+- **PR #92247** fix(models): bound /models and models list catalog loading. Related #91809. Thanks @samson910022 and @samson1357924 and @syfvb.
+- **PR #92646** fix: require admin for HTTP model overrides. Thanks @steipete-oai.
+- **PR #90686** fix(gateway): honor profile auth for SecretRef model entries. Related #90685. Thanks @rohitjavvadi.
+- **PR #92651** fix: require admin for HTTP session kills. Thanks @steipete-oai.
+- **PR #92652** test(models): stabilize plugin auth marker fixtures.
+- **PR #89438** fix(slack): warn when channels map is keyed by name instead of channel ID. Related #81665. Thanks @Alix-007 and @cjalden.
+- **PR #92631** fix(agents): pause yielded subagent runs whose terminal also signals abort. Related #92448. Thanks @openperf and @vincentkoc and @aleps001.
+- **PR #92622** fix(ui): preserve WebChat backscroll during streaming. Related #92386. Thanks @TurboTheTurtle and @vincentkoc and @DrtyMorty.
+- **PR #92627** fix(openrouter): strip openrouter/ prefix from model ID in normalizeResolvedModel hook (fixes #92611). Thanks @liuhao1024 and @lijenhsin.
+- **PR #92146** fix(cron): preserve yielded media completions. Related #92120. Thanks @IWhatsskill and @nailujac.
+- **PR #90116** fix: add Claude Haiku 4.5 static catalog entries. Related #90088. Thanks @arkyu2077 and @maaron34.
+- **PR #91137** fix(channels): keep contributed message-tool schema properties optional. Related #67852. Thanks @lundog and @RewardsPal.
+- **PR #75393** fix(copilot): disable eager tool streaming for Claude 4.5. Related #75348. Thanks @Kailigithub and @finchinslc.
+- **PR #92628** fix #73713: surface nested embedding fetch failures. Thanks @mushuiyu886 and @crsnpalmer-art.
+- **PR #92510** fix(gateway): reject unknown OpenAI agent selectors. Related #92504. Thanks @zhangguiping-xydt and @ryanhelms.
+- **PR #91453** fix #91420: [Bug]: Delivery retry loop corrupts active sessions (R-004) — retry selector bypasses delivery.mode=none. Thanks @zhangguiping-xydt and @CarotaWealth.
+- **PR #92468** fix #92453: add session identity to runtime prompt. Thanks @zhangguiping-xydt and @QQSHI13.
+- **PR #89943** fix(slack): emit message_sent hook on outbound delivery (mirror Telegram). Related #89942. Thanks @rishitamrakar.
+- **PR #92668** fix(docs): finalize i18n postprocess before skip. Thanks @hxy91819.
+- **PR #92673** fix: split image setup and request timeout semantics. Thanks @hxy91819.
+- **PR #92162** #92069: fix(cli): usage errors exit 0. Thanks @Pandah97 and @marcospaulo.
+- **PR #91185** fix(browser): remove dead requireRef import and void expression in register.navigation.ts. Related #83878. Thanks @whiteyzy and @davinci282828.
+- **PR #90706** fix(OpenAI Responses): disable item id replay for storeless providers. Related #89728. Thanks @snowzlm.
+- **PR #90247** fix(disk-space): promote 1024 MiB to 1.0 GiB in disk warnings. Related #90245. Thanks @jbetala7.
+- **PR #92657** feat(usage): ship built-in /usage full footer. Thanks @Marvinthebored.
+- **PR #90464** perf(terminal): reuse ANSI scanner during truncation. Thanks @yyzquwu.
+- **PR #91281** fix(feishu): clear client cache when SDK is replaced via setFeishuClientRuntimeForTest. Related #83911. Thanks @whiteyzy and @davinci282828.
+- **PR #92639** fix(memory): keep memory_search in transient qmd mode. Related #92464. Thanks @TurboTheTurtle and @Takhoffman and @BrettHamlin.
+- **PR #91287** fix(cron): de-duplicate main-session systemEvent in heartbeat model input. Related #44922. Thanks @ZengWen-DT and @GSL-R.
+- **PR #91246** Fix webchat media completion handoff. Related #91003. Thanks @TurboTheTurtle and @kumaxs.
+- **PR #91353** fix(ui): preserve /reset soft args in Control UI dispatch. Related #91316. Thanks @zhouhe-xydt and @MaBeitian.
+- **PR #92679** feat(telegram): send rich message text. Thanks @obviyus.
+- **PR #92705** fix(ui): restore sidebar session picker interactivity above desktop workbench. Related #92707. Thanks @NianJiuZst and @vincentkoc.
+- **PR #91218** fix(google): strip provider prefix from Vertex model path. Thanks @bymle.
+- **PR #92669** feat: support /btw in CLI-backed sessions. Thanks @joshavant.
+- **PR #91357** fix(gateway): mark active main sessions before restart shutdown aborts. Related #91355. Thanks @ooiuuii.
+- **PR #91066** fix(parallel): send openclaw-parallel User-Agent on free Search MCP requests. Thanks @NormallyGaussian.
+- **PR #90658** fix(ui): preserve dashboard session parent lineage when session list is stale. Related #90623. Thanks @luoyanglang and @lily-oc.
+- **PR #92552** fix(ios): force stale foreground gateway reconnects. Thanks @Solvely-Colin.
+- **PR #89421** fix(telegram): expose thread create CLI remap. Related #81581. Thanks @spacegeologist and @myrzka.
+- **PR #92779** fix: start workspace files collapsed. Related #90359. Thanks @shakkernerd and @Chang2020618.
+- **PR #91247** fix(state): avoid sqlite wal on nfs state volumes. Related #90491. Thanks @849261680 and @AFabyTWE.
+- **PR #92773** fix(tui): show resolved canonical model ref in /model confirmation. Thanks @NarahariRaghava.
+- **PR #92752** fix(diagnostics): keep recovery scheduling out of the stuck-session warning backoff. Related #92742. Thanks @gnanam1990 and @Takhoffman and @zhuyankarl.
+- **PR #92735** fix(markdown-core): treat Infinity chunk limit as unbounded, not 1. Related #92734. Thanks @yhterrance.
+- **PR #92695** docs(config): correct maxConcurrent default in agent-defaults type comments (AI-assisted). Thanks @ArielSmoliar.
+- **PR #92766** clarify before_install hook scope. Related #91593. Thanks @sallyom and @Trump-last.
+- **PR #92677** docs(nodes): add openclaw.json config example to Nodes overview. Related #92662. Thanks @liuhao1024 and @Casper-Mars.
+- **PR #92513** Honor WhatsApp configured ACP bindings. Related #92449. Thanks @TurboTheTurtle and @mcaxtr and @dmorn.
+- **PR #92650** fix #92465: split OpenAI 431 embedding batches. Thanks @mushuiyu886 and @BrettHamlin.
+- **PR #92796** feat(providers): add GLM-5.2 support.
+- **PR #92788** fix(sessions): derive channel from account-scoped DM session keys in send-policy. Thanks @yetval.
+- **PR #92590** Docker image ships an extraneous stale openclaw in /app/node_modules (extensions pin the published release). Related #92551. Thanks @lzyyzznl and @fxstein.
+- **PR #92393** chore(deps): bump the swift-deps group across 1 directory with 3 updates.
+- **PR #92476** fix(agents): preserve compatible CLI session runtime pins. Thanks @yu-xin-c.
+- **PR #92483** fix(matrix): validate CLI numeric option ranges. Related #92482. Thanks @rohitjavvadi.
+- **PR #92490** fix(canvas): validate CLI numeric options. Related #92487. Thanks @rohitjavvadi.
+- **PR #92802** fix(ui): reflow composer beside workspace rail. Thanks @Solvely-Colin and @shakkernerd.
+- **PR #91059** fix(configure): mask gateway token input in CLI wizard prompt. Thanks @anurag-bg-neu.
+- **PR #91143** fix(ports): only classify SSH -L/-R tunnels on the queried port as ssh. Related #91142. Thanks @jbetala7.
+- **PR #91110** fix(tavily): keep web_search contract executable. Related #91096. Thanks @extrasmall0 and @xucongyuan98-sys.
+- **PR #91181** fix(daemon): strip schtasks backslash prefix when matching gateway task name. Related #90494. Thanks @425072024 and @Darnellicious.
+- **PR #91187** fix(cron): isolate auth profile failure policy so cron runs don't pollute shared cooldowns. Related #90991. Thanks @openperf and @cx306806112.
+- **PR #92807** fix(heartbeat): route outbound mirror to isolated session key. Thanks @agent-merkava.
+- **PR #92745** fix(memory): explain skipped short-term recall hits. Related #92706. Thanks @mushuiyu886 and @armarinho.
+- **PR #92488** fix(gateway): forward image-only input on /v1/responses (parity with chat completions). Thanks @s554097550 and @cursoragent.
+- **PR #92604** fix(status): avoid cumulative usage for context percent. Related #83526. Thanks @ashishpatel26 and @darconadalabarga.
+- **PR #92810** fix: reject unvalidated voice media streams. Thanks @steipete-oai.
+- **PR #92800** fix(telegram): answer callback queries before sequentialize delays them. Related #42156. Thanks @liuhao1024 and @Diaspar4u.
+- **PR #92547** fix(nodes): surface pending reapproval diagnostics. Thanks @fuller-stack-dev.
+- **PR #92690** fix(doctor): avoid false-positive legacy cron store warning when store was already migrated (fixes #92683). Thanks @liuhao1024 and @motteman.
+- **PR #92806** fix(telegram): skip IPv4 fallback when user explicitly configures non-ipv4first dnsResultOrder (fixes #41671). Thanks @liuhao1024 and @vincentkoc and @leandroirani933-ctrl.
+- **PR #92778** fix(macos): defer isOverflowing mutation to break SwiftUI render loop (fixes #43480). Thanks @liuhao1024 and @vincentkoc and @gdiab.
+- **PR #92795** fix(gateway): use resolveNonNegativeNumber for totalTokens to display 0 instead of ? (fixes #43009). Thanks @liuhao1024 and @vincentkoc and @ltxy12138-ai.
+- **PR #92746** fix(gateway): preserve active runs during plugin finalization. Thanks @scotthuang and @vincentkoc.
+- **PR #92820** UI: localize Logs tab labels. Thanks @rubensfox20.
+- **PR #92825** fix(telegram): preserve command callbacks while prefixing generic callback data. Related #54909. Thanks @hnshah and @timt80.
+- **PR #90889** fix: cap session context overrides by model window. Related #39857. Thanks @xdanger.
+- **PR #92830** fix(copilot): strip replayed thinking blocks. Related #81520. Thanks @giodl73-repo and @warcold.
+- **PR #92834** feat(browser): extend --labels overlay to full-page and element captures. Thanks @hxy91819 and @FMLS and @cursoragent.
+- **PR #92836** fix(discord): raise thread title timeout and tokens to fit reasoning models. Thanks @hanamizuki.
+- **PR #92095** fix #92039: [Bug]: WhatsApp login reports success before auth is durably persisted, so Docker rebuilds/upgrades can force relink. Thanks @zhangguiping-xydt and @dinorastoder.
+- **PR #92801** fix(stale): exempt ClawSweeper actionable labels from stale lifecycle (fixes #89564). Thanks @liuhao1024 and @brokemac79.
+- **PR #89736** fix(status): render sub-1000 token counts as plain integers. Related #89735. Thanks @jbetala7 and @vincentkoc.
+- **PR #92792** fix(agents): catch malformed image blocks in sanitizeContentBlocksImages. Thanks @LowCode191 and @vincentkoc.
+- **PR #92555** ci: gate stable releases on Windows companion assets. Thanks @fuller-stack-dev.
+- **PR #91824** fix(agents): add usage guidance to sessions_spawn tool description (fixes #91814). Thanks @zenglingbiao and @vincentkoc and @cattails-lgao.
+- **PR #92840** fix(feishu): await HTTP server shutdown during monitor cleanup. Related #48183. Thanks @alex-xuweilong and @ai-nurmamat.
+- **PR #91632** feat: add tool search directory mode. Thanks @fuller-stack-dev.
+- **PR #92823** fix(qqbot): surface failed media sends. Thanks @zhangguiping-xydt and @vincentkoc.
+- **PR #92849** fix(tailscale): preserve parse errors for malformed JSON. Thanks @franciscomaestre.
+- **PR #92045** Fix diagnostics OTEL runtime install trust. Thanks @efpiva.
+- **PR #92853** fix(acp): accept MCP date protocolVersion in ACP server. Related #56102. Thanks @bugkill3r and @moliveto.
+- **PR #92854** fix(hooks): reject slug-generator error payloads. Thanks @Cypherm.
+- **PR #92855** fix(ui): repair iOS Safari chat viewport handling. Thanks @macdao.
+- **PR #91586** fix(update): continue after package doctor warnings. Thanks @fuller-stack-dev.
+- **PR #92862** fix(feishu): target typing reaction on inbound message. Thanks @huiwen01.
+- **PR #92861** fix(lobster): surface workflow path errors. Related #68101. Thanks @vvitovec and @MPC7500.
+- **PR #69975** fix(cli): clarify --tz help text for offset-less --at values. Related #59456. Thanks @rrrrrredy.
+- **PR #90682** fix(openai): preserve opaque reasoning transcript fields. Related #90093. Thanks @toruvieI and @richardmqq.
+- **PR #92373** fix(anthropic): strip thinking blocks from history when thinking is disabled (fixes #92360). Thanks @liuhao1024 and @notnaji.
+- **PR #87346** fix(anthropic): merge consecutive assistant turns in turn validation. Related #87329. Thanks @Jefsky and @travellingsoldier85.
+- **PR #92896** fix(anthropic): quarantine invalid direct tool schemas. Thanks @vincentkoc.
+- **PR #90739** fix(active-memory): preserve verbose recall summaries. Related #90454. Thanks @brokemac79 and @nocode-ananas.
+- **PR #92558** Simplify QA scorecard mapping shape. Thanks @RomneyDa.
+- **PR #92876** fix(memory-wiki): stop flagging raw source pages as malformed. Thanks @vincentkoc.
+- **PR #92908** fix(providers): quarantine unreadable Anthropic payload tools. Thanks @vincentkoc.
+- **PR #92881** fix(memory): preserve reindex rollback recovery. Thanks @TSHOGX and @vincentkoc.
+- **PR #92921** fix(openai): quarantine unreadable tool schemas. Thanks @vincentkoc.
+- **PR #92550** Fold Telegram RTT sampling into live QA evidence. Thanks @RomneyDa.
+- **PR #92824** fix(media): route OAuth image defaults through Codex. Related #87168. Thanks @bek91.
+- **PR #92928** fix(openai): guard post-hook tool payloads. Thanks @vincentkoc.
+- **PR #92814** fix(feishu): re-resolve route when dynamic agent binding already exists in runtime config (fixes #42837). Thanks @liuhao1024 and @vincentkoc and @cwlong163-afk.
+- **PR #89055** fix: restart gateway after isolated cron setup timeout. Thanks @ghitafilali.
+- **PR #90574** fix(openai): omit gpt-5.5 tool reasoning effort. Thanks @BSG2000.
+- **PR #92941** fix(openai): recover invalid reasoning signatures.
+- **PR #92914** fix(agents): clamp unsupported thinking for subagent spawns instead of hard-failing. Related #92412. Thanks @openperf and @oiGaDio.
+- **PR #92573** fix: preserve config-selected subagent model overrides. Related #92486. Thanks @arkyu2077 and @PatrickTrent.
+- **PR #92852** fix(gateway): fall back to polling when config watcher exhausts inotify retries. Related #92851. Thanks @danbao.
+- **PR #92362** fix(gateway): build row metadata context for single session lists. Thanks @anyech.
+- **PR #92897** fix(memory-wiki): tolerate public artifacts without agent ids. Related #92207. Thanks @yu-xin-c and @qq230849622-a11y.
+- **PR #92002** fix(lmstudio): deliver thinking "off" to binary-thinking models. Related #91913. Thanks @nxmxbbd and @mlaihk.
+- **PR #92738** Forward suppressed-source progress for message-tool channel replies. Thanks @ragesaq.
+- **PR #92916** #92201: Embedded runner: freshly streamed thinking signatures intermittently invalid on replay (Anthropic); recovery wrapper never fires because error text is genericized. Thanks @mmyzwl and @CarlCapital.
+- **PR #90936** fix(agents): do not misclassify client-disconnect abort as run timeout. Related #90764. Thanks @openperf and @reginaldomarcilon.
+- **PR #93009** fix(agents): make wrapToolWithBeforeToolCallHook idempotent to prevent double hook execution (fixes #92973). Thanks @zenglingbiao and @dertbv.
+- **PR #92318** fix(cron): require explicit message target proof. Thanks @hxy91819.
+- **PR #93022** fix(gateway): repair usage cost aggregation across agents. Thanks @luke-skywalker-open-claw and @stablegenius49.
+- **PR #93159** fix(tui): keep parent stdin paused after exit. Thanks @fuller-stack-dev.
+- **PR #93616** Keep key-free web search providers opt-in. Thanks @davemorin and @vincentkoc.
+- **PR #93164** fix(telegram): preserve rich markdown line breaks. Thanks @vincentkoc.
+
diff --git a/CHANGELOG/2026.6.9.md b/CHANGELOG/2026.6.9.md
new file mode 100644
index 0000000000000000000000000000000000000000..190f787d4ecfb0e38cdefed0f82577800b4b480c
--- /dev/null
+++ b/CHANGELOG/2026.6.9.md
@@ -0,0 +1,460 @@
+## 2026.6.9
+
+### Highlights
+
+- **Richer Telegram delivery:** Telegram now sends rich HTML, preserves rich markdown and sticker paths, renders progress drafts and command output more faithfully, normalizes HTML tables safely, and keeps mentions and spooled handlers on the right delivery path. (#93286, #93164, #93124, #93364, #93130, #93002, #93088, #93281, #94891, #94856) Thanks @obviyus, @vincentkoc, @goutamadwant, @kesslerio, @NianJiuZst, @SweetSophia, @Marvinthebored, @aaajiao, @zhangguiping-xydt, @zhangqueping, and @jairrab.
+- **More dependable agent recovery:** retries, terminal outcomes, usage after compaction, session history repair, and reply reconciliation now keep more interrupted or partial turns moving toward a visible final result. (#92191, #93073, #93228, #93084, #93469, #93291, #90943) Thanks @ai-hpc, @lml2468, @fuller-stack-dev, @Hollychou924, @leno23, @de1tydev, @425072024, @wuwahe3, @drvoss, @yetval, @sandieman2, and @vincentkoc.
+- **A stronger Codex integration:** Codex gains automatic plugin approvals, GPT-5.3 Spark OAuth routing, remote-node `exec` as a dynamic tool, and more reliable app-server teardown and terminal outcomes. (#92625, #89133, #93654, #91767, #93287) Thanks @kevinslin, @VACInc, @vincentkoc, @JPKay-AI, and @aliahnaf2013-max.
+- **Standalone official provider plugins:** external provider packages are now first-class npm releases, externally installed channel plugins load at Gateway startup, and StepFun is available from npm and ClawHub. (#93470) Thanks @sunlit-deng, @cxdnicole, and @vincentkoc.
+- **More capable web and native clients:** the Control UI adds a session workspace rail and extension health, iOS adds Watch controls, and Android shows chat context. (#92856, #91952, #93387, #92837) Thanks @Solvely-Colin, @jalehman, @joshavant, and @Tosko4.
+- **More useful search and skills:** Codex Hosted Search is available, key-free search providers remain deliberate opt-ins, and ClawHub skill installs retain verified source provenance. (#93446, #93616, #93283, #93506) Thanks @fuller-stack-dev, @davemorin, @momothemage, @nmccready-tars, and @vincentkoc.
+
+### Changes
+
+- Providers and auth: add Codex Hosted Search, improve Gemini CLI OAuth behind proxies, and keep external provider onboarding on current choices and package metadata. (#93446, #92815) Thanks @fuller-stack-dev, @yetval, @EvetteYoung, and @vincentkoc.
+- Plugins and installs: externalized official providers publish as independent npm packages, Gateway discovers installed channel plugins at startup, and StepFun installs from npm or ClawHub. (#93470) Thanks @sunlit-deng, @cxdnicole, and @vincentkoc.
+- Dashboard and mobile: add a session workspace rail, plugin health in status, compact cron lists, and iOS Watch controls. (#92856, #91952, #93395, #93387) Thanks @Solvely-Colin, @jalehman, @yu-xin-c, @centralpc, @joshavant, and @vincentkoc.
+- Codex, observability, and skills: add automatic plugin approvals and SecretRefs, preserve ClawHub skill provenance, add OpenTelemetry log export, and expose remote-node execution to Codex when a node is connected. (#92625, #94324, #93283, #94561, #93654) Thanks @kevinslin, @kevinlin-openai, @momothemage, @nmccready-tars, @jesse-merhi, @vincentkoc, and @JPKay-AI.
+- QA and release engineering: QA scenarios now use YAML, with broader profile evidence and release coverage for the plugin and channel matrix. Thanks @vincentkoc.
+
+### Fixes
+
+- Security and privacy: redact secrets from debug/config output, block internal HTTP session overrides, audit open-DM tool exposure, and retain plugin write ownership checks. (#93333, #88496, #93443, #92883, #93353) Thanks @Alix-007, @jason-allen-oneal, @coygeek, @RichardCao, @yu-xin-c, @cjg20ss, @eleqtrizit, and @vincentkoc.
+- Agent and session runtime: retry thinking-only and empty post-tool turns, prevent duplicate hook execution, preserve pending subagent delivery, preserve fresh usage through compaction, and repair partial JSON/history artifacts. (#92191, #93073, #93009, #93084, #93469, #94349, #92383, #94257) Thanks @ai-hpc, @lml2468, @fuller-stack-dev, @zenglingbiao, @dertbv, @Hollychou924, @leno23, @de1tydev, @425072024, @wuwahe3, @drvoss, @vincentkoc, @sallyom, @oiGaDio, @Hidetsugu55, and @Nas01010101.
+- Channels and replies: fix Telegram rich delivery, table rendering, action-error handling, progress draft cleanup before visible tool output, and ingress recovery; preserve command progress detail across channel adapters; retain WhatsApp opening text after a media failure; keep Mattermost thread replies intact; and harden Discord action handling. (#93286, #93364, #93281, #93002, #93076, #93334, #93424, #93488, #94868, #94891, #94856, #94810, #93823) Thanks @obviyus, @NianJiuZst, @mcaxtr, @zhangguiping-xydt, @rushindrasinha, @amknight, @lzyyzznl, @darealgege, @vincentkoc, @zhangqueping, @jairrab, @ZOOWH, @parveshsaini, and @yetval.
+- Storage and migrations: avoid SQLite WAL on network filesystems, clean reindex artifacts, keep setup state out of workspace dot-directories, and import default-agent auth profiles into SQLite. (#93454, #92891, #93182, #93295, #93520, #93156) Thanks @vincentkoc, @ZengWen-DT, @Zeng-wen, @potterdigital, @Alix-007, @Pick-cat, @sallyom, @1qh, and @Tazio7.
+- Provider and model behavior: fix Gemini CLI proxy OAuth, restore Codex Spark OAuth routing, correct Bedrock embedding model IDs, and preserve configured defaults in embedded runs. (#92815, #89133, #93452, #93428) Thanks @yetval, @EvetteYoung, @VACInc, @LiuwqGit, @aleck31, @zenglingbiao, @danielgerlag, and @vincentkoc.
+- CLI, TUI, and apps: accept global flags after subcommands, keep terminal output and activity indicators visible, preserve CJK IME composition, and refresh stale UI state. (#93455, #93460, #93006, #93427, #93498, #93606) Thanks @ooiuuii, @Alix-007, @ZengWen-DT, @Zeng-wen, @AlethiaQuizForge, @Zhaoqj2016, @liuhao1024, @BrianClaw1955, @vincentkoc, and @NicoBoom13.
+- Operations and updates: harden official plugin recovery, restart managed Gateways after failed update handoff, keep safe cron delivery defaults, avoid Node-specific npm prefixes, and keep package validation paths reliable. (#93325, #92111, #93650, #94453, #91685) Thanks @vincentkoc, @yetval, @ofan, @yaanfpv, @jincheng-xydt, @sallyom, @davectr, and @nxmxbbd.
+
+### Complete contribution record
+
+This audited record covers the complete v2026.6.8..HEAD history: 423 merged PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.
+
+#### Pull requests
+
+- **PR #92154** fix(qqbot): gate private group commands and close strict command visibility gaps. Thanks @sliverp.
+- **PR #90463** refactor: add session accessor seam with gateway consumer. Thanks @jalehman.
+- **PR #88656** Drop reasoning-only length turns from replay. Thanks @abel-zer0.
+- **PR #92856** feat(webui): add session workspace rail. Thanks @Solvely-Colin.
+- **PR #92845** docs(browser-control): document OPENCLAW_EAGER_BROWSER_CONTROL_SERVER requirement. Related #92841. Thanks @liuhao1024 and @jeugregg.
+- **PR #82366** fix: use passive periodic sqlite wal checkpoints. Related #81715. Thanks @honor2030 and @KrasimirKralev.
+- **PR #92815** fix(google): route Gemini CLI OAuth through the env proxy (#46184). Thanks @yetval and @EvetteYoung.
+- **PR #91331** fix(mattermost): merge progress preview lines by identity. Related #89761. Thanks @iloveleon19 and @leonthe8th and @vincentkoc.
+- **PR #92909** fix(tui): keep spinner active when toggling tools. Related #49763. Thanks @ZengWen-DT and @Zeng-wen and @vincentkoc and @CrimsonDump.
+- **PR #92904** fix(elevenlabs): use current TTS model ids. Thanks @vortexopenclaw and @vincentkoc.
+- **PR #92642** fix #86872: Subagent run reports success but fails to write output file. Thanks @zhangguiping-xydt and @vincentkoc and @zapper35.
+- **PR #89122** refactor: route command session reads through seam. Thanks @jalehman.
+- **PR #90943** fix(reply): deliver final reply when queued follow-up claims session; scope dedupe to routed thread. Thanks @sandieman2 and @vincentkoc.
+- **PR #92894** fix(skills): keep managed prompt paths readable. Related #92875. Thanks @kesslerio and @sallyom.
+- **PR #39617** fix: reload config in slash command routing so dmScope is respected. Related #39605. Thanks @Ciward.
+- **PR #92191** fix(agents): retry thinking-only errored turns. Related #91953. Thanks @ai-hpc and @lml2468.
+- **PR #92891** fix(memory): clean stale reindex temp files. Related #92874. Thanks @ZengWen-DT and @Zeng-wen and @vincentkoc and @potterdigital.
+- **PR #93005** Add OpenRouter Fusion guidance and prompt context. Related #92984. Thanks @sallyom.
+- **PR #88792** fix(state): harden sqlite path caching. Thanks @vincentkoc.
+- **PR #93022** fix(gateway): repair usage cost aggregation across agents. Thanks @luke-skywalker-open-claw and @stablegenius49.
+- **PR #93020** fix(telegram): cool down transient sendChatAction failures. Related #56096. Thanks @Boulea7 and @sumaiazaman and @Pick-cat and @cal-rufus.
+- **PR #93002** fix(telegram): clear progress drafts before visible tool output. Thanks @zhangguiping-xydt.
+- **PR #89160** fix(agents): detect truncated API responses to prevent silent session hang. Related #89051. Thanks @joelnishanth and @ArthurusDent.
+- **PR #93009** fix(agents): make wrapToolWithBeforeToolCallHook idempotent to prevent double hook execution (fixes #92973). Thanks @zenglingbiao and @dertbv.
+- **PR #92991** fix(agents): tolerate missing attribution baseUrl. Related #92974. Thanks @samrusani and @Haderach-Ram.
+- **PR #92913** fix(opencode-go): register model catalog to fix context window detection. Related #92912. Thanks @kumaxs.
+- **PR #89129** refactor: route bundled plugin session callers through seam. Thanks @jalehman.
+- **PR #93084** fix(agents): preserve fresh usage after compaction. Related #50795. Thanks @Hollychou924 and @leno23 and @de1tydev and @425072024 and @vincentkoc and @wuwahe3.
+- **PR #92869** fix #90333: [Bug]: Discord image build aborts at step 66 — openclaw-build-messaging-plugins.py exits 1. Thanks @zhangguiping-xydt and @vincentkoc and @chriskosys.
+- **PR #93011** fix(gateway): accept file-only input on /v1/responses (parity with image-only). Thanks @yetval and @vincentkoc.
+- **PR #92915** Convert QA scenarios to YAML files. Thanks @RomneyDa.
+- **PR #91767** Fix one-shot Codex app-server teardown. Thanks @aliahnaf2013-max.
+- **PR #92625** feat(codex): add auto plugin approvals. Thanks @kevinslin.
+- **PR #91587** test(qa): add qa run --qa-profile and unified output summary/evidence. Thanks @RomneyDa.
+- **PR #93104** test(reply): seed channel fixtures for dedupe tests. Thanks @RomneyDa.
+- **PR #93107** test(reply): preserve telegram dedupe fallback. Thanks @RomneyDa.
+- **PR #92954** fix(memory): accept local default model path migration. Thanks @mushuiyu886 and @vincentkoc.
+- **PR #90936** fix(agents): do not misclassify client-disconnect abort as run timeout. Related #90764. Thanks @openperf and @reginaldomarcilon.
+- **PR #90812** fix(voice-call): preserve live Twilio streams in stale reaper. Related #79121. Thanks @Takhoffman and @sahibzada-allahyar and @donkeykong91.
+- **PR #93094** fix(whatsapp): bound socket operations. Thanks @mcaxtr.
+- **PR #91629** fix(scripts): add database-first legacy store guard. Related #91628. Thanks @galiniliev.
+- **PR #93124** fix(telegram): render progress drafts as rich previews. Thanks @Marvinthebored.
+- **PR #93109** test(qa): embed profile scorecard evidence. Thanks @RomneyDa.
+- **PR #87298** test: add temp directory helper guidance. Thanks @hxy91819.
+- **PR #92318** fix(cron): require explicit message target proof. Thanks @hxy91819.
+- **PR #93137** fix(imessage): honor disabled reply actions. Related #92142. Thanks @omarshahine and @dprev.
+- **PR #93134** fix(feishu): pass card_msg_content_type to get full card content (fixes #78289). Thanks @liuhao1024 and @vincentkoc and @longdoubled7.
+- **PR #93138** fix(agents): preserve literal current session resolution. Thanks @liuhao1024 and @vincentkoc.
+- **PR #91225** fix #83830: [Bug]: Dreaming diary repeats "first day" narrative every sweep — same early memories dominate snippets. Thanks @mushuiyu886 and @YinLiuLiu66.
+- **PR #93153** simplify QA evidence profile and mappings/coverage shape. Thanks @RomneyDa.
+- **PR #93164** fix(telegram): preserve rich markdown line breaks. Thanks @vincentkoc.
+- **PR #93119** fix: accept mixed source/dist bundled roots. Related #87730. Thanks @arkyu2077 and @vincentkoc and @jasonftl.
+- **PR #93130** fix(telegram): preserve sticker media paths. Related #83748. Thanks @goutamadwant and @vincentkoc and @aaajiao.
+- **PR #93073** fix(agents): retry empty post-tool final turns. Thanks @fuller-stack-dev.
+- **PR #91784** fix(voice-call): require realtime websocket path boundary. Thanks @jason-allen-oneal.
+- **PR #89133** Restore GPT-5.3 Codex Spark OAuth routing. Thanks @VACInc.
+- **PR #91996** refactor: prune unused iOS code. Thanks @zats.
+- **PR #90231** fix #69443: [Bug] Subagent RPC callback to WeChat session key routed to main session instead. Thanks @zhangguiping-xydt and @sliverp and @chen11221.
+- **PR #89920** fix(matrix): replace recovered command progress lines. Thanks @bdjben and @jesse-merhi.
+- **PR #93159** fix(tui): keep parent stdin paused after exit. Thanks @fuller-stack-dev.
+- **PR #93201** fix(auto-reply): clear pending-final state before honoring post-send abort (#89115). Thanks @amknight and @danashburn.
+- **PR #93228** fix(agents): replace prose terminal classifiers. Thanks @fuller-stack-dev.
+- **PR #93231** fix(status): correct pinned model clear hint. Thanks @hxy91819.
+- **PR #92428** fix(qqbot): keep markdown table chunks valid. Thanks @sliverp.
+- **PR #93220** fix(status): avoid stale session context windows. Thanks @hxy91819.
+- **PR #91957** perf(sessions): share one enumeration across archive retention sweeps. Thanks @amknight.
+- **PR #93281** fix(telegram): recover pid-reused ingress claims. Thanks @obviyus.
+- **PR #93287** fix(codex): preserve terminal outcome ordering.
+- **PR #93182** fix(memory): clean rollback-journal reindex temp sidecar on NFS stores. Thanks @Alix-007.
+- **PR #93283** Persist ClawHub skill install provenance. Related #92077. Thanks @momothemage and @nmccready-tars.
+- **PR #88872** fix: attribute spawned task runs to child agent. Related #66670. Thanks @Alix-007 and @Neomail2.
+- **PR #92837** fix(android): show live chat context usage. Thanks @Tosko4.
+- **PR #93325** fix(cli): harden official plugin recovery. Thanks @vincentkoc.
+- **PR #93286** feat(telegram): send rich messages as rich html. Thanks @obviyus.
+- **PR #92910** fix(memory-core): safely refresh qmd index during collection repair.
+- **PR #93329** fix(cli): allow zero Discord timeout duration. Related #93327. Thanks @rohitjavvadi.
+- **PR #91625** fix(cron): add cron edit --clear-model to clear a job's model override. Thanks @ly-wang19.
+- **PR #91691** [AI] fix(memory): prevent empty-string expectedModel in resolveMemory…. Thanks @xydt-tanshanshan.
+- **PR #93006** fix(tui): keep stderr visible when local shell stdout fills the output cap. Thanks @Alix-007.
+- **PR #93001** fix(daemon): prefer stderr over stale stdout in gateway restart diagnostics. Thanks @Alix-007.
+- **PR #91117** refactor: remove dead code and improve string concatenation. Thanks @Pommelle.
+- **PR #90893** fix(models): mask paste-token input in CLI auth prompt. Thanks @anurag-bg-neu.
+- **PR #90571** fix(configure): mask gateway password input in CLI wizard prompt. Thanks @anurag-bg-neu.
+- **PR #91768** fix(ios): respect chat header safe area. Thanks @zats.
+- **PR #93245** fix(cron): resolve lastRunStatus in cron list/show human output. Thanks @ly-wang19.
+- **PR #78765** fix(tui): avoid inserting spaces into long CJK text. Thanks @hpt.
+- **PR #91776** fix(ios): refresh permission rows after grants. Thanks @zats.
+- **PR #92817** fix(cron): trust agent output when channel is unresolved without explicit delivery. Related #90664. Thanks @fsdwen and @dertbv.
+- **PR #93297** fix(control-ui): respect agents.defaults.timeFormat for timestamps. Related #58147. Thanks @ZengWen-DT and @Zeng-wen and @TommoT2.
+- **PR #93364** Fix Telegram rich progress command output. Thanks @obviyus.
+- **PR #91952** feat(status): surface plugin health. Thanks @jalehman.
+- **PR #75025** fix(heartbeat): refresh stale Current time line on every helper call (#44993). Thanks @MoerAI and @mclee1975.
+- **PR #90992** docs(windows): fix WSL gateway-autostart recipe for WSL ≥ 2.6.1.0 idle-termination. Thanks @spencer2211.
+- **PR #86544** fix(cli): show Gemini CLI runtime auth status. Related #79585. Thanks @giodl73-repo and @fabricefoy.
+- **PR #88945** fix(plugins): serialize binding approval saves. Related #64065. Thanks @Alix-007 and @lihaokun.
+- **PR #90115** fix(gateway): pass managed inbound PDFs through chat.send. Related #90097. Thanks @harjothkhara and @joeykrug.
+- **PR #74613** docs(cli): add agent selector to CLI backend quick start. Related #68940. Thanks @vyctorbrzezowski and @drmarcopapa.
+- **PR #89121** refactor: add transcript reader seam. Thanks @jalehman.
+- **PR #84434** fix(cli): disable ScheduleWakeup/CronCreate in --print claude runs. Thanks @SkyWolfDreamer.
+- **PR #66985** fix(agents): resolve requestedNode to canonical ID before boundNode comparison. Related #87213. Thanks @mujiannan.
+- **PR #91488** fix(reply): project preflight compaction gate by next-input size on fresh tokens. Thanks @yetval.
+- **PR #93353** fix(plugins): require owner for plugin writes. Thanks @eleqtrizit.
+- **PR #91499** fix(cron): preserve scheduled turn tool policy [AI]. Thanks @mmaps.
+- **PR #90412** fix(sessions): cache warm transcript reads to avoid per-turn re-parse. Related #83943. Thanks @Alix-007 and @yyds-xxxx.
+- **PR #93118** fix(gateway): guard fast-path startup migrations. Related #93032. Thanks @openperf and @Haderach-Ram.
+- **PR #93355** fix(ci): verify performance workflow downloads. Thanks @eleqtrizit.
+- **PR #93358** fix(outbound): guard cross-context message mutations. Thanks @eleqtrizit.
+- **PR #93362** fix(flock): bind allow-always to wrapped command. Thanks @eleqtrizit.
+- **PR #92578** refactor(whatsapp): add inbound admission foundation. Thanks @mcaxtr.
+- **PR #89547** Control Telegram group history context. Thanks @mmaps.
+- **PR #89201** refactor: add transcript runtime identity contract. Thanks @jalehman.
+- **PR #93357** fix(plugins): enforce install policy in wrappers. Thanks @eleqtrizit.
+- **PR #93156** fix(doctor): import default-agent auth profiles into sqlite. Related #93145. Thanks @Pick-cat and @sallyom and @Tazio7.
+- **PR #93179** Add slim evidence mode for QA profile evidence. Thanks @RomneyDa.
+- **PR #93349** fix(control-ui): keep workboard card titles visible in overflowing columns (fixes #91717). Thanks @Pick-cat and @NicoBoom13.
+- **PR #93324** fix(cli): accept --no-color after subcommands. Thanks @ooiuuii.
+- **PR #89621** Return Google Chat thread metadata from message sends. Thanks @franco-viotti.
+- **PR #82458** fix(infra): drop duplicated "restart" word in restart-sentinel summary. Thanks @jameswniu.
+- **PR #85471** Suppress cron announce control replies. Related #85421. Thanks @TurboTheTurtle and @leatherneck-33.
+- **PR #85316** fix(auth): keep alias-compatible auth-profile overrides instead of clearing them. Thanks @SkyWolfDreamer.
+- **PR #89260** fix(doctor): separate platform-incompatible skills from missing requirements. Related #89232. Thanks @Alix-007 and @CameronWeller.
+- **PR #90846** fix(media): stop pruning media on write; let the configured timer do it. Thanks @lundog.
+- **PR #88062** fix(logging): avoid stalled warnings for active model calls. Thanks @litang9.
+- **PR #93308** fix(discord): reject malformed realtime consult calls. Thanks @khoek.
+- **PR #93334** fix(whatsapp): notify user when trailing media send fails instead of silent drop. Thanks @rushindrasinha.
+- **PR #92575** fix(sessions): preserve user behavior overrides across daily/idle rollover (#92562) [AI-assisted]. Thanks @harjothkhara and @civiltox.
+- **PR #89124** refactor: route auto-reply sessions through session seam. Thanks @jalehman.
+- **PR #93431** fix: stabilize transcript cache and CLI env isolation. Thanks @shakkernerd.
+- **PR #93412** fix(discord): suppress tool progress for message-tool replies. Thanks @mgunnin and @vincentkoc.
+- **PR #93409** fix(whatsapp): stop markdownToWhatsApp dropping code spans followed by a digit. Thanks @rushindrasinha.
+- **PR #93295** fix(memory): swap rollback-journal sidecar during atomic reindex. Thanks @Alix-007.
+- **PR #93076** fix(whatsapp): preserve auth on terminal disconnects. Thanks @mcaxtr.
+- **PR #93435** fix(agents): bound autoreview scope. Thanks @vincentkoc.
+- **PR #93279** fix(telegram): restore readable default text sends. Related #93263. Thanks @NianJiuZst and @SweetSophia.
+- **PR #93429** fix(line): cap carousel column text at 60 chars when a title or image is set. Thanks @harjothkhara and @vincentkoc.
+- **PR #93428** fix(agents): resolve configured default model in runEmbeddedAgent (fixes #93419). Thanks @zenglingbiao and @vincentkoc and @danielgerlag.
+- **PR #93427** fix(tui): show activity indicator for system-injected runs. Related #51825. Thanks @ZengWen-DT and @vincentkoc and @Zeng-wen and @AlethiaQuizForge.
+- **PR #90003** feat(policy): cover exec approvals artifact. Thanks @giodl73-repo.
+- **PR #93448** fix(guards): allow auth profile sqlite reader. Thanks @amknight.
+- **PR #93424** fix(mattermost): keep message tool replies in threads. Thanks @amknight and @vincentkoc.
+- **PR #93418** fix(telegram): forward Bot API 10.1 rich_message content to agent. Related #93410. Thanks @xzh-icenter and @vincentkoc and @0pen7ech.
+- **PR #93175** test(qa): taxonomy profiles: includeAllCategories for release profile, update some coverage. Thanks @RomneyDa.
+- **PR #93456** fix(agents): handle string assistant message content. Thanks @vincentkoc.
+- **PR #93441** fix(outbound): ignore schema-padded poll metadata on send. Related #43015. Thanks @weichengdeng and @charzhou.
+- **PR #93443** fix(gateway): block internal HTTP session overrides. Thanks @RichardCao.
+- **PR #93454** fix(sqlite): disable WAL on network filesystems. Thanks @vincentkoc.
+- **PR #90275** test: make install-safe-path symlink tests compatible with Windows. Thanks @aniruddhaadak80.
+- **PR #93464** fix(qa): suppress empty WhatsApp debug artifacts. Thanks @vincentkoc.
+- **PR #90861** fix(cli): preserve sessions_yield over MCP. Related #77426. Thanks @zhangguiping-xydt and @jarvisagimuspicard-hub.
+- **PR #90946** fix(infra): preserve inherited gateway PID across reparent during cleanup. Thanks @amittell.
+- **PR #92220** fix(media): extract large managed inbound PDFs via media-understanding. Related #90096, #90097. Thanks @amknight and @joeykrug.
+- **PR #91208** fix #91047: Plugin session-extension registry not pinned; sessions.pluginPatch fails after agent/subagent plugin-load churn. Thanks @mushuiyu886 and @teamadams.
+- **PR #92111** fix(update): restart managed gateway when update handoff fails after stop. Related #92088. Thanks @yetval and @ofan.
+- **PR #93238** fix(agents): honor disabled envelope timestamps at model boundary. Thanks @osolmaz.
+- **PR #93343** fix(codex): de-duplicate commentary notes across the raw response lane. Related #93296. Thanks @Marvinthebored and @Peetiegonzalez.
+- **PR #93361** fix(openshell): pin mirror remote mutations. Thanks @eleqtrizit.
+- **PR #93354** fix(discord): block cross-provider guild admin actions. Thanks @eleqtrizit.
+- **PR #92178** fix(gateway): normalize malformed paired access lists. Related #90654. Thanks @wangmiao0668000666 and @EmilioNicolas.
+- **PR #85254** perf(plugins): thread prepared manifestPlugins through runtime model-id normalize chain. Thanks @zeroaltitude.
+- **PR #93489** Add ClawHub content rights docs to sidebar. Thanks @Patrick-Erichsen.
+- **PR #93466** [AI] fix(feishu): guard against missing inbound in channelRuntime fallback. Thanks @xydt-tanshanshan.
+- **PR #93460** fix(cli): honor --log-level in route-first commands. Related #93457. Thanks @ooiuuii.
+- **PR #93495** fix(cron): clear delivery routing fields from cron edit. Thanks @ly-wang19 and @vincentkoc.
+- **PR #93494** docs: point PR landing at maintainer workflow. Thanks @fuller-stack-dev and @vincentkoc.
+- **PR #93487** fix(ui): add agent selector to skills page. Related #78553. Thanks @goutamadwant and @vincentkoc and @xiaobu1112.
+- **PR #93488** fix(discord): apply tool status emojis immediately to avoid override by thinking reactions. Related #92715. Thanks @lzyyzznl and @vincentkoc and @darealgege.
+- **PR #93055** fix(ui): restore provider usage pill in desktop chat composer [AI]. Thanks @harjothkhara.
+- **PR #83156** fix(matrix): accept bracketed display-name mentions. Related #83142. Thanks @wdx-agent-io and @wdongxv.
+- **PR #93333** fix(auto-reply): redact secrets in /debug show and /debug set output. Thanks @Alix-007.
+- **PR #88496** fix(auto-reply): redact secrets in config show output. Related #65623. Thanks @jason-allen-oneal and @coygeek.
+- **PR #93105** fix(doctor): repair null agents.list[].workspace values. Related #77718. Thanks @xydigit-sj and @slideshow-dingo.
+- **PR #73923** fix(ui): preserve gateway token during safe websocket url edits. Related #41545. Thanks @wsyjh8.
+- **PR #88970** fix #85871: [Bug]: Heartbeat scheduler silently fails to fire on 5.20 and all 5.x versions (regression from 4.23). Thanks @zhangguiping-xydt and @vincentkoc and @carlbjson.
+- **PR #93511** fix(imessage): normalize leading NUL echo-cache prefixes. Thanks @vincentkoc and @drvoss.
+- **PR #92594** [Bug]: ollama-cloud runtime fails DNS lookup for ai.ollama.com, while ollama/<model>:cloud works. Related #92391. Thanks @zhangguiping-xydt and @vincentkoc and @kvzsolt.
+- **PR #93512** build(docs): finish PowerShell-safe docs formatting. Related #44293. Thanks @vincentkoc and @yil337 and @aniruddhaadak80.
+- **PR #93513** fix(skills): refresh persisted snapshots after restart. Thanks @vincentkoc and @fif911 and @skadauke.
+- **PR #93517** fix(skills): quote skill-creator template description. Thanks @vincentkoc and @parubets.
+- **PR #73976** fix(memory): use per-keyword FTS search in hybrid mode #39484. Thanks @joshuakeithpa-sudo.
+- **PR #93520** fix(workspace): store setup state outside workspace dot-dir. Thanks @vincentkoc and @1qh.
+- **PR #93521** fix(onboard): skip Homebrew prompt on unsupported platforms. Related #68893. Thanks @vincentkoc and @yurivict.
+- **PR #93522** fix(feishu): send post mentions as native at elements. Thanks @vincentkoc and @gavin-ali and @YizukiAme and @Panniantong.
+- **PR #93496** fix(gateway): rotate already-stale generated transcript filename on /reset. Thanks @harjothkhara and @vincentkoc.
+- **PR #93471** fix(cron): preserve aborted isolated-run failure. Thanks @BhargavSatya and @vincentkoc.
+- **PR #93473** fix(memory): report skipped QMD embedding probe. Related #77645. Thanks @TurboTheTurtle and @vincentkoc and @aderius.
+- **PR #93498** fix(ui): preserve CJK IME composition. Related #86035. Thanks @Zhaoqj2016 and @vincentkoc.
+- **PR #93088** fix(telegram): bind bot mentions to assistant identity. Thanks @kesslerio and @vincentkoc.
+- **PR #93499** fix(nodes): return screen snapshots as media. Related #90126. Thanks @zenglingbiao and @vincentkoc and @JeffSteinbok.
+- **PR #93506** fix(skills): trust verified ClawHub source provenance. Thanks @vincentkoc.
+- **PR #93525** agents: notify chat exec empty-success completions. Thanks @vincentkoc and @wenkang-xie.
+- **PR #93446** feat: add Codex hosted web search. Thanks @fuller-stack-dev.
+- **PR #92883** fix(security): audit open dm tool exposure. Related #55612. Thanks @yu-xin-c and @vincentkoc and @cjg20ss.
+- **PR #93476** fix(mattermost): preserve Codex progress preview. Related #88766. Thanks @goutamadwant and @vincentkoc and @KelTech-Services.
+- **PR #93395** feat(cron): add compact list responses. Related #93366. Thanks @yu-xin-c and @vincentkoc and @centralpc.
+- **PR #93527** fix(cron): preserve model overrides for text payloads. Thanks @vincentkoc and @liaoandi.
+- **PR #90487** fix: harden ChatGPT Responses missing content-type streams. Thanks @anyech and @vincentkoc.
+- **PR #93528** fix(gateway): tolerate transient pre-hello clean closes. Thanks @vincentkoc and @ruanrrn.
+- **PR #93529** fix(auto-reply): allow message tool for group attachments. Related #43146. Thanks @vincentkoc and @Robcis.
+- **PR #93291** fix(reply): preserve pending thread evidence when reconciling partial send results. Thanks @yetval and @vincentkoc.
+- **PR #90572** fix(feishu): drop self-authored receive echoes. Thanks @baskduf.
+- **PR #93455** fix(cli): accept --log-level after subcommands. Thanks @ooiuuii and @vincentkoc.
+- **PR #93452** fix(bedrock): strip inference profile prefix from model ID in embedding adapter. Related #79212. Thanks @LiuwqGit and @vincentkoc and @aleck31.
+- **PR #89799** fix(cli): skip compile cache on early Node 24.x to avoid startup deadlock. Related #86550. Thanks @zhangguiping-xydt and @vincentkoc and @renyuliang000.
+- **PR #93469** fix(agents): drop partialJson streaming artifacts from session history repair. Thanks @drvoss and @vincentkoc.
+- **PR #93463** fix(codex): log app-server compaction completion. Related #83932. Thanks @goutamadwant and @vincentkoc and @aounakram.
+- **PR #93562** fix(tui): refresh after external session reset. Related #38966. Thanks @vincentkoc and @wsyjh8 and @yizhanzjz.
+- **PR #93470** fix(plugins): load externally-installed channel plugins at gateway startup. Related #93219. Thanks @sunlit-deng and @vincentkoc and @cxdnicole.
+- **PR #88796** fix(discord): resolve guildId from session channel for search actions. Related #88790. Thanks @SebTardif and @vincentkoc and @mugabuga.
+- **PR #93194** fix(agents): preserve prompt-released session metadata. Related #93193. Thanks @snowzlm.
+- **PR #89483** fix(gateway): project failed agent turns in chat history. Related #89197. Thanks @IWhatsskill and @vincentkoc and @yangiit.
+- **PR #93434** fix: avoid parent group allowlist false positive. Related #92684. Thanks @kingrubic and @vincentkoc and @motteman.
+- **PR #93449** fix(feishu): dedupe redelivered text by stable retry identity. Related #46778. Thanks @ZengWen-DT and @vincentkoc and @kingcuty.
+- **PR #93407** AGT-80 AGT-81 Fix Discord ingress ack ordering. Thanks @mgunnin and @vincentkoc.
+- **PR #93439** fix(agents): honor embedded run default model. Related #93419. Thanks @harjothkhara and @vincentkoc and @danielgerlag.
+- **PR #93565** fix(cli): summarize cleanup dry-run by label. Related #76826. Thanks @AgentArcLab and @vincentkoc and @renatomaluhy.
+- **PR #93509** fix(skills): clear orphaned idempotency pointer on corrupt-metadata re-begin. Thanks @Alix-007 and @vincentkoc.
+- **PR #93274** Clarify plugin channel config additional-property errors. Thanks @zhangguiping-xydt and @vincentkoc.
+- **PR #93555** fix(read): route text decoding through shared Windows codepage fallba…. Thanks @zhanxingxin1998 and @vincentkoc.
+- **PR #93314** fix(skills): preserve ClawHub origin provenance on readback. Thanks @Alix-007 and @vincentkoc.
+- **PR #93573** fix(acp): keep bridge sessions out of stale ACP classification [AI-assisted]. Related #38907. Thanks @eldar702 and @vincentkoc and @ninaopenclaw.
+- **PR #93398** fix(cron): emit isolated model usage diagnostics. Related #92338. Thanks @849261680 and @vincentkoc and @niks999.
+- **PR #93367** Fix SSH sandbox remote directory args. Related #93344. Thanks @dmorn and @vincentkoc.
+- **PR #93574** fix(feishu): suppress log noise for bot_p2p_chat_entered_v1 event [AI-assisted]. Related #42351. Thanks @eldar702 and @vincentkoc and @sunking0223.
+- **PR #93269** Fix tokenjuice bash results without details. Thanks @moeedahmed and @vincentkoc.
+- **PR #93575** fix(telegram): hydrate group reply-chain media into model context [AI-assisted]. Thanks @eldar702 and @vincentkoc.
+- **PR #93261** fix(plugins): resolve provider policy surface for plugin-owned CLI backends. Related #93259. Thanks @BitmapAsset and @vincentkoc.
+- **PR #93303** fix(whatsapp): bound stalled read-receipt socket operations. Thanks @Alix-007 and @vincentkoc.
+- **PR #93242** fix(mattermost): keep bare @mention with empty body instead of dropping it. Related #93205. Thanks @iloveleon19 and @vincentkoc.
+- **PR #93606** fix(ui): clear stale Talk error when session transitions to non-error state (fixes #88176). Thanks @liuhao1024 and @vincentkoc and @BrianClaw1955.
+- **PR #93607** perf(tasks): memoize reconcileInspectableTasks for same-tick calls (fixes #73531). Thanks @liuhao1024 and @vincentkoc and @slideshow-dingo.
+- **PR #93612** fix(gateway): compute sessions.usage aggregate totals from all sessions, not just the limited page (fixes #76496). Thanks @liuhao1024 and @vincentkoc and @bobsahur-robot.
+- **PR #93615** fix(telegram): recover lone active spooled handler on timeout (#84158). Thanks @0xghost42 and @vincentkoc and @crash2kx.
+- **PR #93616** Keep key-free web search providers opt-in. Thanks @davemorin and @vincentkoc.
+- **PR #93298** fix #93044: control-ui webchat double-renders agent replies when dmScope=main. Thanks @zhangguiping-xydt and @vincentkoc and @cfmilam.
+- **PR #93618** fix(feishu): filter temporary card-action-c-\* IDs from reply target to prevent Invalid open_message_id errors (fixes #56818). Thanks @liuhao1024 and @vincentkoc and @SwordImmortal.
+- **PR #93387** feat(ios): add watch action surface. Thanks @Solvely-Colin and @joshavant.
+- **PR #93648** fix(doctor): archive superseded plugin install index conflicts. Related #90418. Thanks @vincentkoc and @ramitrkar-hash.
+- **PR #93649** fix(qwen): place DashScope image prompts in user content. Related #92688. Thanks @vincentkoc and @Yachiyo404.
+- **PR #93650** fix(update): avoid per-Node npm prefixes during self-update. Related #80387. Thanks @vincentkoc and @yaanfpv.
+- **PR #93653** fix(skill-workshop): skip helper sessions during auto-capture. Thanks @vincentkoc and @zhangguiping-xydt.
+- **PR #93654** fix(codex): expose remote node exec as a Codex dynamic tool. Related #92141. Thanks @vincentkoc and @JPKay-AI.
+- **PR #93662** fix(discord): protect mention aliases in code fences. Thanks @vincentkoc and @rohitjavvadi.
+- **PR #93663** fix(clawdock): open dashboard on published port without starting deps. Related #77344. Thanks @vincentkoc and @dhoman.
+- **PR #93670** fix(browser): recover stale managed Chrome CDP listener. Related #41750. Thanks @vincentkoc and @rohitjavvadi and @kissman911.
+- **PR #93672** fix(commands): preserve multiline slash skill args. Related #79155. Thanks @vincentkoc and @web3blind.
+- **PR #93674** fix(browser): accept top-level act fields with nested requests. Related #38762. Thanks @vincentkoc and @angelusbr and @Lumos-789.
+- **PR #93678** fix(plugins): allow Dreaming sidecar through restrictive memory allowlists. Related #92536. Thanks @vincentkoc and @pradeep7127 and @resYuto.
+- **PR #93306** fix(status): ignore stale context after model switch. Thanks @hxy91819.
+- **PR #93666** fix(control-ui): copy code blocks over plain HTTP via clipboard fallback. Related #93628. Thanks @Pick-cat and @pjq2926.
+- **PR #93629** fix(reply): preserve unsent text-only finals after block pipeline streamed partial content (fixes #81078). Thanks @liuhao1024 and @Jackten.
+- **PR #93690** fix(telegram): dispatch MEDIA directives as attachments. Related #77702. Thanks @vincentkoc and @butttersbot.
+- **PR #93693** fix(gateway): ignore stale sudo scope for root user services. Related #81410. Thanks @vincentkoc and @Ericksza.
+- **PR #93646** fix(agents): return string assistant content in getLastAssistantText. Thanks @Alix-007 and @vincentkoc.
+- **PR #93687** fix(i18n): retain Codex error tails in logs. Thanks @hxy91819.
+- **PR #93630** fix(heartbeat): bootstrap plugin session targets. Thanks @ZengWen-DT and @vincentkoc.
+- **PR #93658** fix(wizard): preserve existing default model during setup auth choice [AI-assisted]. Related #64129. Thanks @ml12580 and @vegapunk9527.
+- **PR #93671** fix(respawn): rewrite pnpm versioned entry paths to stable wrapper (fixes #52313). Thanks @liuhao1024 and @vincentkoc and @RichardCao.
+- **PR #93698** Fix Telegram rich progress detail updates. Thanks @obviyus.
+- **PR #93656** fix(gateway): send approval route notices with write scope. Related #93563. Thanks @mushuiyu886 and @vincentkoc and @clawbot247-commits.
+- **PR #93665** fix(gateway): surface codex app-server returned failures. Thanks @litang9 and @vincentkoc.
+- **PR #93727** fix(context-engine): avoid turn-maintenance lane livelock. Related #77340. Thanks @vincentkoc and @baghvn and @Veda-openclaw.
+- **PR #93681** fix(llm): handle string assistant content on the OpenAI-compatible completion path. Thanks @Alix-007.
+- **PR #93722** chore(release): update appcast for 2026.6.8. Thanks @vincentkoc.
+- **PR #93677** fix(google-meet): declare realtime provider secret inputs. Related #81891. Thanks @goutamadwant and @vincentkoc and @chachi-max.
+- **PR #92947** fix(qqbot): deliver cron auto-TTS voice by trusting OpenClaw temp root. Related #92816. Thanks @ZengWen-DT and @Zeng-wen and @lewiswu1209.
+- **PR #93679** fix(whatsapp): extract GIF metadata and distinguish gifPlayback in media placeholders (fixes #49099). Thanks @liuhao1024 and @vincentkoc and @bugkill3r.
+- **PR #93688** fix(minimax): check base_resp envelope errors in TTS provider. Related #76904. Thanks @dwc1997 and @najef1979-code.
+- **PR #93714** fix: isolate async model resolution mock from sync mock in flaky test. Related #92117. Thanks @lsr911 and @wangwllu.
+- **PR #93705** test(macos): cover root command dispatch. Related #83879. Thanks @markoub and @vincentkoc and @davinci282828.
+- **PR #93711** Keep command text in progress drafts. Thanks @keshavbotagent and @vincentkoc.
+- **PR #93712** fix: scope assistant avatar override to agent ID. Related #90890. Thanks @lsr911 and @vincentkoc and @najef1979-code.
+- **PR #93725** fix(usage): prune stale usage cache temp files. Related #78939. Thanks @markoub and @Tramsrepus.
+- **PR #93726** fix(typing): start typing on reasoning deltas in thinking mode before visible text. Related #79681. Thanks @xialonglee and @novaflash82.
+- **PR #93716** fix(discord): propagate timeout through channel capabilities diagnostics. Related #77040. Thanks @xialonglee and @vincentkoc and @unicebondoc.
+- **PR #93729** fix(ollama): preserve configured API during discovery. Related #93710. Thanks @zhangguiping-xydt and @vincentkoc and @obnoxious2011-cmd.
+- **PR #93719** fix: pin plugin workspace dir for sessions.list to avoid O(rows) memo busting. Related #90814. Thanks @lsr911 and @vincentkoc and @k-l-lambda.
+- **PR #93732** fix(agents): preserve re-sent user prompt during compaction transcript rotation. Thanks @yetval.
+- **PR #93738** fix: break plugin registry type import cycle. Thanks @giodl73-repo.
+- **PR #93740** fix(sessions): release retained locks after takeover. Thanks @TurboTheTurtle.
+- **PR #93745** fix(usage): reject invalid explicit dates in usage RPC date parsing. Thanks @harjothkhara and @vincentkoc.
+- **PR #93746** fix(ui): populate realtime talk provider and transport options from talk.catalog. Thanks @shushushv and @vincentkoc.
+- **PR #93751** fix(ios): fix quick setup sheet layout design. Thanks @zats.
+- **PR #93749** fix(compaction): ignore stale persisted totalTokens in preflight gate. Thanks @yetval.
+- **PR #93753** fix: correct tautological uppercase check in tool description summarizer. Thanks @GautamKumarOffical.
+- **PR #89123** refactor: route transcript writers through session seam. Thanks @jalehman.
+- **PR #93758** feat(memory): apply outputDimensionality truncation to local GGUF embeddings (fixes #58765). Thanks @liuhao1024 and @vincentkoc and @losz5000.
+- **PR #93754** feat(inbound-meta): expose per-turn source modality. Related #50482. Thanks @liuhao1024 and @vincentkoc and @JTOrca.
+- **PR #93767** fix(reasoning-tags): strip MiniMax `mm:` namespaced reasoning tags. Thanks @DrHack1 and @vincentkoc.
+- **PR #93772** fix(feishu): recover CJK filenames from JSON file_name field (fixes #81103). Thanks @liuhao1024 and @vincentkoc and @pjuneye.
+- **PR #93773** fix(ui): scope Skill Workshop proposals to selected agent. Related #93760. Thanks @TurboTheTurtle and @vincentkoc and @hannesrudolph.
+- **PR #88750** feat(context-engine): pass runtime settings into lifecycle. Thanks @ragesaq and @jalehman.
+- **PR #93763** fix(agents): use neutral billing copy for subscription auth. Related #80877. Thanks @eldar702 and @vincentkoc and @22kyasue.
+- **PR #93818** List all ClawHub docs in sidebar. Thanks @Patrick-Erichsen.
+- **PR #93779** fix(webchat): skip textarea resize during IME composition to eliminate typing lag. Related #90800. Thanks @joelnishanth and @vincentkoc and @w10497-create.
+- **PR #93786** fix(plugins): treat refreshable catalogs as requiring runtime discovery (fixes #93775). Thanks @liuhao1024 and @St0rmz1.
+- **PR #93791** fix(memory): await search-sync before returning results to prevent stale index (fixes #52115). Thanks @liuhao1024 and @vincentkoc and @FicheallADa.
+- **PR #93780** fix(google): keep parallel Gemini tool responses in the turn after the model. Thanks @yetval and @vincentkoc.
+- **PR #93789** fix(agents): make lane suspension consistent across cooldown-precheck and embedded-runner paths. Related #93036. Thanks @joelnishanth and @vincentkoc and @kumaxs.
+- **PR #93798** fix(status): show 0 (not ?) for fresh-session context tokens. Related #93771. Thanks @Alix-007 and @vincentkoc and @anarchia-99.
+- **PR #93810** fix(cron): preserve startup overflow catch-up deferrals in start() maintenance pass. Thanks @yetval.
+- **PR #93811** Strip UTF-8 BOM when reading SKILL.md in quick_validate. Thanks @HrachShah.
+- **PR #93803** fix(ui): preserve WebChat visible messages across session switches. Related #80855. Thanks @LiuwqGit and @vincentkoc and @viagarsuker.
+- **PR #93792** fix(android): wait for node capability approval before onboarding. Thanks @Solvely-Colin and @vincentkoc.
+- **PR #93796** fix(feishu): paginate wiki node and space listing (#37626). Thanks @ZengWen-DT and @vincentkoc and @ritou11.
+- **PR #93797** fix(browser): use openTab return value to prevent wsUrl race in ensureTabAvailable (fixes #63343). Thanks @liuhao1024 and @vincentkoc and @OpenCodeEngineer.
+- **PR #93806** fix(reasoning-tags): strip MiniMax mm: tags on silent-reply and streaming paths missed by #93767. Thanks @Alix-007 and @vincentkoc.
+- **PR #93691** refactor: add gateway sessions.create lifecycle seam. Thanks @jalehman.
+- **PR #88748** fix(gemini): bridge OAuth profiles into CLI runtime. Related #88742. Thanks @jason-allen-oneal.
+- **PR #93857** fix(deps): remediate Dependabot alerts. Thanks @vincentkoc.
+- **PR #93874** fix(slack): recognize MiniMax mm: namespaced reasoning tags in monitor preview. Thanks @Alix-007.
+- **PR #93832** feat(providers): add ClawRouter managed proxy. Thanks @vincentkoc.
+- **PR #93880** fix(macos): preserve approvals migration data. Thanks @vincentkoc.
+- **PR #93903** fix(cron): reject invalid absolute timestamps. Thanks @Alix-007 and @vincentkoc.
+- **PR #93879** fix(update): use configured npm registry for update metadata. Related #79140. Thanks @vincentkoc and @sixerLiu.
+- **PR #93924** revert(providers): remove ClawRouter provider. Thanks @vincentkoc.
+- **PR #93955** fix(telegram): surface rich-message disabled state. Thanks @obviyus.
+- **PR #93881** fix(agents): route BTW through canonical Codex runtime. Related #88902. Thanks @vincentkoc and @TurboTheTurtle and @khalil-omer.
+- **PR #90192** fix(feishu): fetch quoted content before empty-message guard. Related #90177. Thanks @bladin and @sliverp and @lkxlaz.
+- **PR #93237** Fix Mattermost open DM validation. Thanks @amknight.
+- **PR #93945** feat(diagnostics): add SIEM security events. Thanks @vincentkoc.
+- **PR #87487** fix(cli): clarify mcp list registry scope. Related #65209. Thanks @Alix-007 and @slideshow-dingo.
+- **PR #24661** feat(cohere): add provider plugin. Thanks @vincentkoc.
+- **PR #93532** Expose verified ClawHub source in skill verify output. Thanks @momothemage.
+- **PR #93538** feat(codex): support app-server network proxy profiles. Thanks @vincentkoc.
+- **PR #93938** fix(telegram): guard UTF-16 surrogate pairs in outbound chunkers. Related #93921. Thanks @Nas01010101 and @vincentkoc.
+- **PR #94104** feat(agents): trace compaction summarization model calls. Thanks @amknight.
+- **PR #94108** Fix package Telegram temp root. Thanks @obviyus.
+- **PR #94113** Fix Telegram package output mount. Thanks @obviyus.
+- **PR #89062** feat(docker): support offline setup reruns. Related #70443. Thanks @Alix-007 and @safrano9999.
+- **PR #93929** fix(secrets): explicitly pass BWS_SERVER_URL to resolver for self-hosted instances. Related #93851. Thanks @Pandah97 and @vincentkoc and @AdoShan.
+- **PR #90057** Polish Workboard operations view. Thanks @fuller-stack-dev.
+- **PR #89396** fix(doctor): drop inert legacy cron notify when cron.webhook is unset. Related #44460. Thanks @Alix-007.
+- **PR #94138** fix(session): prevent stale finalizer from recreating deleted session rows. Related #40840. Thanks @xialonglee and @vincentkoc and @AL-knows.
+- **PR #93739** refactor: add session patch projection seam. Thanks @jalehman.
+- **PR #94178** fix(workspace): skip optional bootstrap files when workspace setup is already completed. Related #83593. Thanks @dwc1997 and @jsompis.
+- **PR #93363** fix(feishu): enforce account tool family gates. Thanks @eleqtrizit.
+- **PR #93813** fix(codex): keep message registered for internal turns. Related #93750. Thanks @jalehman and @hannesrudolph.
+- **PR #93659** refactor: add session reset delete lifecycle seam. Thanks @jalehman.
+- **PR #93852** ci(release): harden release controls. Thanks @vincentkoc.
+- **PR #94203** feat(codex): support remote app-server plugins. Thanks @kevinslin.
+- **PR #94263** chore: migrate claw-score skill. Thanks @RomneyDa and @kevinslin.
+- **PR #93695** refactor: add compact trim lifecycle seam. Thanks @jalehman.
+- **PR #93114** test: fold lifecycle and package proof into QA Lab. Thanks @RomneyDa.
+- **PR #93181** test: fold otel smoke into qa e2e. Thanks @RomneyDa.
+- **PR #93178** test: fold gateway smoke into qa e2e. Thanks @RomneyDa.
+- **PR #94276** qa-lab: support script-backed evidence scenarios. Thanks @Solvely-Colin and @RomneyDa.
+- **PR #94282** Support owner-qualified ClawHub skill installs. Thanks @Patrick-Erichsen.
+- **PR #93704** refactor: add session cleanup lifecycle seam. Thanks @jalehman.
+- **PR #94296** fix: require all taxonomy coverage ids for a feature - AND not OR. Thanks @RomneyDa.
+- **PR #92016** fix(plugins): compose live hook registry view for tool-call hooks. Related #91918. Thanks @amknight and @vokaplok.
+- **PR #89596** fix(policy): recognize declared tool allowlists. Thanks @giodl73-repo.
+- **PR #93713** fix: route deleted-agent session purge through lifecycle seam. Thanks @jalehman.
+- **PR #84172** fix(exec): rebuild command authorization on the Tree-sitter command planner. Thanks @jesse-merhi.
+- **PR #94332** docs: add ClawHub namespace claims to sidebar. Thanks @Patrick-Erichsen.
+- **PR #86360** fix(codex): honor bound agent exec host policy. Thanks @jesse-merhi.
+- **PR #73162** fix(slack): remove socket reconnect attempt cap so gateway stays connected indefinitely. Related #72808. Thanks @suboss87 and @tleyden.
+- **PR #94156** fix: expose OpenAI image quality and moderation CLI options. Thanks @lastguru-net and @fuller-stack-dev.
+- **PR #94350** feat: externalize GMI provider plugin. Thanks @Patrick-Erichsen and @vincentkoc.
+- **PR #94543** fix(gateway): bound config.get middleware results. Related #94265. Thanks @vincentkoc and @v-s-gusev.
+- **PR #91409** fix(update): run plugin convergence after RPC git updates. Thanks @masatohoshino.
+- **PR #94556** chore(extensions): bump tokenjuice to 0.8.1. Thanks @vincentkoc.
+- **PR #94580** fix(ci): stabilize update run gates.
+- **PR #94394** fix(infra): probe 127.0.0.1 in ensurePortAvailable to detect IPv4-only occupants. Related #94379. Thanks @Pandah97 and @wangwllu.
+- **PR #94421** fix(agents): preserve active compaction retries. Related #94391. Thanks @dexiosmb.
+- **PR #94428** fix(feishu): preserve replies before error finals. Related #94360. Thanks @xunx33.
+- **PR #93735** refactor: add restart recovery lifecycle seam. Thanks @jalehman.
+- **PR #94591** docs(release): backfill complete contribution records. Thanks @vincentkoc.
+- **PR #94588** fix(cron): retry isolated setup timeouts. Thanks @aaroneden.
+- **PR #94082** fix(cron): prevent lane timeout during long tool execution. Related #94033. Thanks @ajwan8998 and @JingWang-Star996.
+- **PR #94551** feat(firecrawl): add keyless scrape support. Thanks @vincentkoc and @developersdigest.
+- **PR #94619** test(ci): stabilize timeout-sensitive shards. Thanks @vincentkoc.
+- **PR #94048** fix(telegram): set richMessages default to false explicitly in schema. Related #93770, #93794. Thanks @Monkey-wusky and @obviyus and @Nardoa375 and @laurenceputra.
+- **PR #94118** [codex] Fix Telegram rich local Markdown link hrefs. Related #94117. Thanks @dankarization and @obviyus.
+- **PR #94646** refactor(sqlite): land database-first memory and proxy alignment. Thanks @vincentkoc.
+- **PR #94658** test(sqlite): use shared temp directory helper. Thanks @vincentkoc.
+- **PR #92135** fix(openai-embedding): preserve openai/ prefix for non-native base URLs. Related #92124. Thanks @xialonglee and @Kambrian.
+- **PR #93737** refactor: add session maintenance transaction seam. Thanks @jalehman.
+- **PR #93685** refactor(auto-reply): add lifecycle storage seams. Thanks @jalehman.
+- **PR #94349** fix(agents): preserve pending subagent completion announces. Related #93323. Thanks @sallyom and @oiGaDio.
+- **PR #93174** test: fold channel message flows into qa e2e. Thanks @RomneyDa.
+- **PR #94093** Prevent Codex thread rotation from losing next-step context. Thanks @VACInc.
+- **PR #53920** fix(scripts): avoid mutating tracked auth-monitor template during setup. Thanks @JackWuGlobal.
+- **PR #94702** Standardize QA coverage IDs on dotted names. Thanks @RomneyDa.
+- **PR #81825** fix(skills/1password): stop forcing tmux for desktop app auth (#52540). Thanks @koshaji and @tylerbittner.
+- **PR #94725** fix(doctor): warn on volatile SQLite state. Thanks @vincentkoc.
+- **PR #88551** fix(agents): skip auth gate for CLI-owned transport. Thanks @yu-xin-c.
+- **PR #88581** feat(commands): add /name to rename the current session from chat. Thanks @BSG2000.
+- **PR #94324** feat(codex): support app-server SecretRefs. Thanks @kevinlin-openai and @kevinslin.
+- **PR #90882** fix: add self-knowledge docs rule to system prompt. Related #90713. Thanks @SutraHsing.
+- **PR #94684** fix: #80507 show dry-run output for message send/poll. Thanks @lzyyzznl and @YB0y.
+- **PR #93823** fix(whatsapp): keep opening text chunk when first media fails on multi-chunk reply. Thanks @yetval.
+- **PR #89203** refactor: route SDK session compatibility through seam. Thanks @jalehman.
+- **PR #94453** fix: default cron runMode to "due" instead of "force" (#94270). Thanks @jincheng-xydt and @sallyom and @davectr.
+- **PR #94746** fix(note): prevent clack from re-breaking copy-sensitive tokens. Related #94730. Thanks @xzh-icenter and @berkgungor.
+- **PR #89904** refactor: route sdk session compatibility through accessor. Thanks @jalehman.
+- **PR #86719** fix(skills): retarget stale plugin skill symlinks. Related #85925. Thanks @stevenepalmer and @shakkernerd.
+- **PR #94337** fix(tui): show 0 not ? for fresh-session context tokens in footer. Thanks @mushuiyu886.
+- **PR #94539** fix(android): group settings by intent. Thanks @Tosko4.
+- **PR #92383** fix(gateway): never return an empty chat.history transcript. Thanks @Hidetsugu55.
+- **PR #92574** test(browser): cover action-input CLI request bodies. Related #83877. Thanks @yu-xin-c and @davinci282828.
+- **PR #92873** test(diffs): add viewerState, toolbar toggle, shadow root, and hydrateProps tests (fixes #83915). Thanks @liuhao1024 and @davinci282828.
+- **PR #94257** fix(sessions): preserve Media\* index alignment when reading user-turn fields. Thanks @Nas01010101.
+- **PR #94756** fix(codex): bound turn/start text when context budget is non-positive. Related #94748. Thanks @Nas01010101.
+- **PR #94729** fix(skills/trello): add curl to requires.bins to match body examples (fixes #94727). Thanks @liuhao1024 and @berkgungor.
+- **PR #94790** feat(slack): log INFO receipt for inbound app_mention events. Related #94691. Thanks @ZengWen-DT and @BryceMurray.
+- **PR #81696** fix: guard tool event callbacks (AI-assisted). Thanks @enjoylife1243.
+- **PR #94809** chore: forward-port alpha release fixes.
+- **PR #94612** fix(macos): open NSOpenPanel for embedded Control UI file inputs (#94468). Thanks @bbblending and @DINGDANGMAOUP.
+- **PR #89806** fix(feishu): avoid axios interceptor internals. Related #83913. Thanks @sweetcornna and @davinci282828.
+- **PR #91923** fix(ios): clean up notification settings state. Thanks @zats.
+- **PR #91345** fix: suggest close CLI commands. Related #83999. Thanks @glenn-agent and @HannesOberreiter.
+- **PR #94561** Add stdout diagnostics OTEL log exporter. Thanks @jesse-merhi.
+- **PR #91013** fix(gateway): ignore stale abort markers for fresh chat events. Related #91012. Thanks @nxmxbbd.
+- **PR #89279** fix(tasks): deliver ACP completions to bound Discord threads. Related #84022. Thanks @anyech and @h-mascot.
+- **PR #91656** test(cron): expand parseAbsoluteTimeMs test coverage to 39 cases. Related #91654. Thanks @SpecialLeon.
+- **PR #94810** fix(telegram): classify sendChatAction 401 by structured error_code, not bare substring match. Related #94787. Thanks @ZOOWH and @parveshsaini.
+- **PR #94737** fix(reply): clarify provider internal error copy. Thanks @snowzlmbot.
+- **PR #94868** fix(channels): preserve command progress detail. Thanks @vincentkoc.
+- **PR #94891** fix(telegram): send progress previews as html text. Thanks @obviyus.
+- **PR #94683** fix(outbound): keep direct-only targets out of group sessions. Related #92384. Thanks @scotthuang and @haiwei01.
+- **PR #92477** fix: migrate watch app to single-target app (Xcode 27+ compat). Thanks @zats and @joshavant.
+- **PR #94812** test(perf): compare saved CLI startup benchmarks. Thanks @FelixIsaac.
+- **PR #94856** fix(telegram): normalize all HTML tables before entity-escaping in rich messages. Related #94317. Thanks @zhangqueping and @jairrab.
+- **PR #91685** fix(cron): refuse keyless implicit isolated cron delivery inherited from shared agent-main bucket. Thanks @nxmxbbd.
+
diff --git a/CHANGELOG/2026.9.4.md b/CHANGELOG/2026.9.4.md
new file mode 100644
index 0000000000000000000000000000000000000000..faaf063e797c1d9e8547393bfb970486b21d2560
--- /dev/null
+++ b/CHANGELOG/2026.9.4.md
@@ -0,0 +1,5336 @@
+<!-- openclaw-docs-mirror-v1 {"version":"2026.9.4","sources":["docs/releases/2026.9.4.md"],"sourceDigest":"sha256:4063f732546593f79619fbe1eda330fbc14d4e38efcce398e4a713ec5ab72176"} -->
+
+## 2026.9.4
+
+
+### v2026.9.4
+
+**Reading formats:** [Release notes for readers](https://docs.openclaw.ai/releases/2026.9.4) · [Plain Markdown for AI agents and tools](https://raw.githubusercontent.com/openclaw/openclaw/main/CHANGELOG/2026.9.4.md).
+
+OpenClaw 2026.9.4 makes plugins and skills easier to find, and lets you turn past conversations into reusable skills through a chat you can steer.
+
+It also adds GPT Image 2.5 support, more control over cloud sessions, and interactive questions in the terminal, alongside fixes for updates, memory, and messaging.
+
+**Release scale:** 1,558 pull requests, 20 direct commits, and 294 contributors.
+
+#### Installation and Onboarding
+
+OpenClaw can help you get past a Node version problem without replacing your computer's existing Node installation. New-agent setup also works with securely saved API keys, and the instructions for connecting a phone or removing OpenClaw now fill in steps that were missing.
+
+
+
+
+##### Start OpenClaw when Node needs attention
+
+
+If OpenClaw will not start because of Node, the software it runs on, it can now find a compatible copy already on your computer or [offer to install one just for OpenClaw](https://docs.openclaw.ai/install/node#update-from-the-cli). You approve the first installation; after that, OpenClaw can reuse it automatically. This gives you a way past the startup problem without changing Node for your other apps. Some systems, including Alpine Linux, still need manual installation. If you cannot start normally, basic help and troubleshooting commands remain available on some older Node versions.
+
+If the background service is still using an old Node after an upgrade, `openclaw gateway install` can now switch it to an available supported version. This is a separate repair from getting the command line working.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Avoid loading error diagnostics during healthy startup [#142371](https://github.com/openclaw/openclaw/pull/142371).
+- Offer a private Node.js update when the CLI cannot start [#142742](https://github.com/openclaw/openclaw/pull/142742). Thanks @jason-allen-oneal, @morrow-bluedot, @jialele.
+
+**Bug fixes**
+
+- Explain unusable macOS SQLite overrides [#141948](https://github.com/openclaw/openclaw/pull/141948).
+- Check the selected SQLite library during Bun installation and diagnostics [#142186](https://github.com/openclaw/openclaw/pull/142186).
+- Repair stale Gateway service Node runtimes without forcing reinstall [#143159](https://github.com/openclaw/openclaw/pull/143159). Thanks @jialele, @TheAngryPit.
+- Restore diagnostics on unsupported Node runtimes [#143344](https://github.com/openclaw/openclaw/pull/143344).
+- Reuse compatible installed Node during startup and upgrades [#143464](https://github.com/openclaw/openclaw/pull/143464). Thanks @aeoess.
+- Allow short help and version flags during Node recovery [#143485](https://github.com/openclaw/openclaw/pull/143485).
+- Preserve macOS Bun SQLite settings in managed services [#143651](https://github.com/openclaw/openclaw/pull/143651).
+
+**Documentation**
+
+- Document Node as a workaround for Bun SQLite file-release limits [#141846](https://github.com/openclaw/openclaw/pull/141846).
+- Add Node.js and Bun compatibility references [#142156](https://github.com/openclaw/openclaw/pull/142156).
+
+**Limits and compatibility**
+
+- Check SQLite behavior before accepting Node runtimes [#143312](https://github.com/openclaw/openclaw/pull/143312). Thanks @aeoess.
+
+
+
+
+
+
+##### Install on Mac, Linux, and Docker
+
+
+Mac installation no longer gets stuck in the affected Homebrew Bash setups, and people building their own [Docker image](https://docs.openclaw.ai/install/docker) can get past the missing-file error that stopped installation. Linux instructions now explain which user account should run OpenClaw so it finds the right settings, while installation help makes clear when it will start or restart the background service. For people who manage their own terminal settings, supported command-completion entries are also preserved instead of being added again.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Prevent installer hangs with newer Homebrew Bash [#141884](https://github.com/openclaw/openclaw/pull/141884).
+- Restore Docker source dependency installation [#142073](https://github.com/openclaw/openclaw/pull/142073). Thanks @vincentkoc.
+- Preserve portable shell completion hooks during installation [#143282](https://github.com/openclaw/openclaw/pull/143282). Thanks @LiuwqGit, @obviyus, @jlapenna.
+
+**Documentation**
+
+- Clarify the Node 26 recommendation for package installs [#135539](https://github.com/openclaw/openclaw/pull/135539). Thanks @kvnloo, @obviyus.
+- Clarify Gateway service account and shutdown guidance [#136266](https://github.com/openclaw/openclaw/pull/136266). Thanks @yetval, @obviyus, @abacha.
+- Explain startup and restart effects before service installation [#139562](https://github.com/openclaw/openclaw/pull/139562). Thanks @TheCrazyLex, @obviyus.
+- Clarify automatic system-Bash handling for installers [#142038](https://github.com/openclaw/openclaw/pull/142038).
+- Split Docker reference material into focused guides [#143087](https://github.com/openclaw/openclaw/pull/143087). Thanks @vincentkoc.
+
+
+
+
+
+
+##### Connect a provider and reach the first conversation
+
+
+A new agent can now use an API key you have already saved in OpenClaw's protected storage, fixing a setup failure that left ordinary chats working but new-agent setup stuck. Moonshot's China API-key setup also stops asking you to reinstall a provider that is already installed, and browser sign-in explains when you have pasted a phone setup code into the wrong place.
+
+An empty background memory check no longer makes a fresh Claw think setup is already finished, so you still get its first naming conversation.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Explain mobile setup codes pasted into browser sign-in [#141717](https://github.com/openclaw/openclaw/pull/141717). Thanks @DonnieFi.
+
+**Bug fixes**
+
+- Use protected provider keys in New Agent setup [#141586](https://github.com/openclaw/openclaw/pull/141586). Thanks @miguelbranco80, @IWhatsskill, @wenbiyou, @lisheguo.
+- Preserve first-run setup after empty dreaming sweeps [#141808](https://github.com/openclaw/openclaw/pull/141808). Thanks @SunnyShu0925, @obviyus, @dh-js, @ayaangazali.
+- Stop Moonshot China authentication reinstall loops [#143742](https://github.com/openclaw/openclaw/pull/143742). Thanks @zwyhmcn.
+
+**Documentation**
+
+- Align setup and rotation guidance around one Gateway secret [#141723](https://github.com/openclaw/openclaw/pull/141723).
+- Correct Gateway-host provider setup instructions [#143983](https://github.com/openclaw/openclaw/pull/143983). Thanks @vincentkoc.
+
+
+
+
+
+
+##### Choose the agent for setup
+
+
+If you have several agents, guided messaging setup now lets you choose whose workspace to configure before separately choosing who should receive the messages. You can also [choose an agent when managing setup recommendations](https://docs.openclaw.ai/cli/onboard), so you work with the intended workspace. Setup scripts still need an explicit `--agent` choice when no default is configured. The device setup instructions also explain that connecting a device and approving the commands it can run are separate steps.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Choose an agent workspace during guided channel setup [#128738](https://github.com/openclaw/openclaw/pull/128738). Thanks @Leon-SK668, @obviyus, @JunfXiao.
+- Select an agent for onboarding recommendations [#141775](https://github.com/openclaw/openclaw/pull/141775). Thanks @ChrisCantwell, @obviyus.
+- Resolve environment values for channel setup checks [#141781](https://github.com/openclaw/openclaw/pull/141781).
+- Accept agent selection after recommendation subcommands [#142019](https://github.com/openclaw/openclaw/pull/142019). Thanks @obviyus.
+
+**Documentation**
+
+- Complete node setup and command-approval instructions [#136268](https://github.com/openclaw/openclaw/pull/136268). Thanks @yetval, @obviyus, @ccaprani.
+
+
+
+
+
+
+##### Connect a phone to OpenClaw
+
+
+Phone setup help now points you to [`openclaw qr`](https://docs.openclaw.ai/cli/qr), and the [Android instructions](https://docs.openclaw.ai/platforms/android) explain how to connect to the computer running OpenClaw and set up the login your phone needs. They cover both a trusted home network and Tailscale. Use HTTPS for browser access when possible, because HTTP does not encrypt your login details or messages.
+
+
+
+###### Sources and complete change list
+
+
+**Documentation**
+
+- Correct Android pairing and browser access guidance [4ccdd7e](https://github.com/openclaw/openclaw/commit/4ccdd7e005754b426483d78d2c00064df14216a6). Thanks @yetval.
+- Point mobile setup users to the QR command in CLI help [#141756](https://github.com/openclaw/openclaw/pull/141756). Thanks @chelsealong, @obviyus, @tomdailey55.
+
+
+
+
+
+
+##### Finish importing an existing setup
+
+
+An error at the very end of an import no longer has to hide work that already finished. OpenClaw preserves completed memory-import results when the final cleanup fails, and can recognize a retry of the same request without copying everything again. If an error says the import completed, [check the report and imported files](https://docs.openclaw.ai/web/control-ui/settings) before starting over. That retry protection is temporary and does not survive restarting OpenClaw.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Preserve completed import results through cleanup errors and matching request retries [#142738](https://github.com/openclaw/openclaw/pull/142738).
+
+
+
+
+
+
+##### Remove an installation
+
+
+Removing OpenClaw now comes with instructions that match how you installed it, including Git and installations kept in their own folder. The [uninstall guide](https://docs.openclaw.ai/install/uninstall) explains which files and launchers to remove and which may be shared with other tools. Remove the background service first, and save any settings or workspaces you want to keep before deleting files.
+
+
+
+###### Sources and complete change list
+
+
+**Documentation**
+
+- Explain removal for Git and dedicated-prefix installations [#127254](https://github.com/openclaw/openclaw/pull/127254).
+- Correct uninstall help and completion guidance [#142629](https://github.com/openclaw/openclaw/pull/142629).
+
+
+
+
+
+
+##### Follow complete setup instructions
+
+
+The [first-run help](https://docs.openclaw.ai/help/faq-first-run/quick-start) separates getting started from choosing a provider or hosting service, so you can find the answer for the step you are on. Setup examples also fill in missing tools, credentials, and commands, including how to match the Mac app with the right command-line version. When you ask the setup agent to inspect a setting, it can now find names containing dots or brackets that it previously reported as missing, while keeping secret values hidden.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Read quoted configuration keys in the setup agent [#143601](https://github.com/openclaw/openclaw/pull/143601).
+
+**Documentation**
+
+- Correct setup routing, Gateway port spacing, logging styles, and existing Windows, channel, Codex, and provider guidance [#141214](https://github.com/openclaw/openclaw/pull/141214). Thanks @vincentkoc.
+- Split Why OpenClaw architecture and comparison references into focused pages [#142989](https://github.com/openclaw/openclaw/pull/142989). Thanks @vincentkoc.
+- Link workspace templates, macOS Skills, and related setup guides directly [#143022](https://github.com/openclaw/openclaw/pull/143022). Thanks @vincentkoc.
+- Correct copied setup commands, token-display instructions, memory examples, and retry and heartbeat guidance [#143029](https://github.com/openclaw/openclaw/pull/143029). Thanks @vincentkoc.
+- Split first-run FAQ into focused setup and hosting pages [#143148](https://github.com/openclaw/openclaw/pull/143148). Thanks @vincentkoc.
+- Correct Diffs installation, Ollama credentials, IMAP account examples, and CLI and tool guidance [#143179](https://github.com/openclaw/openclaw/pull/143179). Thanks @vincentkoc.
+- Clarify explicit ClawHub skill selection [#143371](https://github.com/openclaw/openclaw/pull/143371).
+- Clarify voice-call and acpx prerequisites, text-model validation, memory setup, and delegate examples [#143927](https://github.com/openclaw/openclaw/pull/143927). Thanks @vincentkoc.
+- Correct transcription models, camera flags, Matrix defaults, Signal checks, and existing media-migration guidance [#143950](https://github.com/openclaw/openclaw/pull/143950). Thanks @vincentkoc.
+- Complete remote Mac, Arcee, and plugin SDK examples and clarify documented version history [#144032](https://github.com/openclaw/openclaw/pull/144032). Thanks @vincentkoc.
+- Clarify memory CLI defaults, stop/backup/start migration steps, Reef setup, and status and group links [#144083](https://github.com/openclaw/openclaw/pull/144083). Thanks @vincentkoc.
+- Add installation prerequisites and clarify Render troubleshooting, Ollama credentials, Mac version matching, and existing client controls [#144085](https://github.com/openclaw/openclaw/pull/144085). Thanks @vincentkoc.
+
+
+
+
+
+
+
+#### The New Web UI
+
+In the web app, you can preview an earlier message before jumping back to it, bring a quote into your next reply, and see what Codex's helper agents did while working on your request. There are also fixes for the interruptions that make a conversation harder to follow, from disappearing image previews to finished tasks that still look busy.
+
+
+
+
+##### Find and organize conversations
+
+
+[Your conversation list](https://docs.openclaw.ai/web/control-ui/sessions-and-sidebar) now keeps the names you choose and avoids changing them back when an older update arrives. Chats can get a useful title even when automatic naming fails, making them easier to recognize later. If the app tries to reopen a chat you deleted, it takes you to a usable conversation instead of leaving you stuck; it does not recover the deleted messages.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Start ungrouped sessions from the Other heading [#142544](https://github.com/openclaw/openclaw/pull/142544). Thanks @Patrick-Erichsen.
+
+**Bug fixes**
+
+- Recover stale remembered chats when opening the web UI [#133653](https://github.com/openclaw/openclaw/pull/133653). Thanks @RomneyDa.
+- Keep readable chat titles and preserve manual names [#141600](https://github.com/openclaw/openclaw/pull/141600). Thanks @DonnieFi, @IWhatsskill, @jjjhenriksen.
+- Align sidebar session counts [#141924](https://github.com/openclaw/openclaw/pull/141924). Thanks @RomneyDa.
+- Prevent overlapping sidebar session controls [#142042](https://github.com/openclaw/openclaw/pull/142042). Thanks @RomneyDa.
+- Clear previous session timing when a new run starts [#142187](https://github.com/openclaw/openclaw/pull/142187).
+- Remove unintended underlines from Online sidebar names [#142217](https://github.com/openclaw/openclaw/pull/142217). Thanks @vyctorbrzezowski.
+- Remove phantom sidebar children after subagent deletion [#142438](https://github.com/openclaw/openclaw/pull/142438). Thanks @jalehman, @vyctorbrzezowski.
+- Finish opening the mobile sidebar after a swipe [#142578](https://github.com/openclaw/openclaw/pull/142578). Thanks @jalehman.
+- Keep session details, child breadcrumbs and history retries consistent [#143049](https://github.com/openclaw/openclaw/pull/143049).
+- Restore multi-agent session lists after model fallback [#143337](https://github.com/openclaw/openclaw/pull/143337).
+- Preserve native session actions after adoption [#143342](https://github.com/openclaw/openclaw/pull/143342). Thanks @sunlit-deng, @obviyus, @bricelb.
+- Name device and cloud sessions before their first turn [#143760](https://github.com/openclaw/openclaw/pull/143760).
+
+
+
+
+
+
+##### Move through a long conversation
+
+
+A slim [message navigator](https://docs.openclaw.ai/web/control-ui/chat) on the left lets you preview a message before jumping to it, so you can find a particular answer without scrolling through the whole conversation. In shared chats, previews also show who wrote the message when that information is available. It appears on desktop when there is enough room and covers the messages already loaded.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Navigate long chats with a compact per-message rail [#142227](https://github.com/openclaw/openclaw/pull/142227). Thanks @vyctorbrzezowski.
+- Show senders in shared-chat navigation previews [#143486](https://github.com/openclaw/openclaw/pull/143486). Thanks @vyctorbrzezowski.
+
+**Bug fixes**
+
+- Render Markdown in conversation rail previews [#142442](https://github.com/openclaw/openclaw/pull/142442). Thanks @jalehman.
+- Smooth the Scroll to latest transition [#142720](https://github.com/openclaw/openclaw/pull/142720). Thanks @vyctorbrzezowski.
+
+
+
+
+
+
+##### Read your saved conversation while reconnecting
+
+
+When you reload the app, it can show a saved copy of your conversation and sidebar while it reconnects, so you have something to read during the wait. [This works with remembered Gateway tokens or paired-device sign-ins](https://docs.openclaw.ai/web/control-ui/offline-and-reconnect#warm-reload); other sign-in methods still show the connection screen. Sending messages and other actions wait for the connection.
+
+If you use the same web address to connect to several Gateways, a conversation saved from another Gateway can briefly appear. Wait for the live conversation to load before relying on that view.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Delay and fade conversation loading placeholders [3c322522](https://github.com/openclaw/openclaw/commit/3c322522d8413702c8bfed211fb02a443e047906). Context [#134868](https://github.com/openclaw/openclaw/pull/134868). Thanks @jesse-merhi.
+- Show cached chat and sidebar content while reconnecting [#141121](https://github.com/openclaw/openclaw/pull/141121). Context [#141690](https://github.com/openclaw/openclaw/issues/141690).
+- Reduce startup JavaScript while retaining translated Settings help [#143376](https://github.com/openclaw/openclaw/pull/143376). Thanks @vincentkoc.
+
+
+
+
+
+
+##### Quote text and keep drafts readable
+
+
+Highlight a passage and choose Add to chat to put an editable quote into your draft without losing what you have already written. Quotes include up to 300 characters, and nothing is sent until you send the message yourself. Long drafts are also easier to edit because the line you are typing no longer fades out at the edge of the message box.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Add selected text to the main chat draft [#142543](https://github.com/openclaw/openclaw/pull/142543). Thanks @Patrick-Erichsen.
+- Translate Add to chat across 20 existing locales [#142576](https://github.com/openclaw/openclaw/pull/142576).
+
+**Bug fixes**
+
+- Fix mobile chat spacing, scrolling previews, and keyboard focus [#142143](https://github.com/openclaw/openclaw/pull/142143). Thanks @IWhatsskill, @vyctorbrzezowski.
+- Refresh attachment overflow cues after changes and resizing [#142577](https://github.com/openclaw/openclaw/pull/142577).
+- Align composer attachments with draft text [#142658](https://github.com/openclaw/openclaw/pull/142658). Thanks @vyctorbrzezowski.
+- Keep long drafts readable while typing [#142955](https://github.com/openclaw/openclaw/pull/142955). Thanks @jalehman.
+- Refresh shared-chat previews when a tab stops typing [#143400](https://github.com/openclaw/openclaw/pull/143400).
+
+
+
+
+
+
+##### Follow images and documents in chat
+
+
+Images you send stay visible while the conversation updates, and scrolling back to a recently loaded image avoids another loading placeholder when its preview is still available. Documents sit above the text that goes with them, making files easier to spot in a busy conversation. Opening a file now shows that it is loading instead of briefly claiming the preview is unavailable.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Place file cards above text and align participant media [#142671](https://github.com/openclaw/openclaw/pull/142671). Thanks @vyctorbrzezowski.
+
+**Bug fixes**
+
+- Keep loaded images visible when scrolling back through chat [#138303](https://github.com/openclaw/openclaw/pull/138303). Context [#138301](https://github.com/openclaw/openclaw/issues/138301). Thanks @vyctorbrzezowski.
+- Make chat attachment spacing consistent [#142246](https://github.com/openclaw/openclaw/pull/142246). Thanks @vyctorbrzezowski.
+- Prevent duplicate final replies as chat history loads [#142422](https://github.com/openclaw/openclaw/pull/142422). Thanks @jalehman.
+- Show loading progress while attachment previews resolve [#142613](https://github.com/openclaw/openclaw/pull/142613). Thanks @vyctorbrzezowski.
+- Align attachment placeholders with Open buttons [#142665](https://github.com/openclaw/openclaw/pull/142665). Thanks @vyctorbrzezowski.
+- Align sender avatars with attachment text [#142694](https://github.com/openclaw/openclaw/pull/142694). Thanks @vyctorbrzezowski.
+- Prevent duplicate bubbles after CLI history refresh [#142725](https://github.com/openclaw/openclaw/pull/142725).
+- Keep sent images visible during history loading [#143407](https://github.com/openclaw/openclaw/pull/143407).
+
+
+
+
+
+
+##### Preview videos before sending
+
+
+Selected videos can now show a still image in the message box, so you can tell similar recordings apart before sending one. The preview is made on your device without uploading the video. Sent videos also have previews in the conversation that open in Files when selected; if your browser cannot make a preview, the usual file card or icon remains.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Preview selected videos before sending [#142623](https://github.com/openclaw/openclaw/pull/142623). Thanks @vyctorbrzezowski.
+- Show user video previews above chat text [#142639](https://github.com/openclaw/openclaw/pull/142639). Thanks @vyctorbrzezowski.
+
+
+
+
+
+
+##### Browse files and protect newer edits
+
+
+[Files](https://docs.openclaw.ai/web/control-ui/chat) keeps search and filters within reach while you scroll through long lists. You can find files the agent changed, read, or created, and a failed preview explains why the file could not open. Phone previews also leave more room for the document while keeping its name visible.
+
+If an agent file changes after you open it for editing, Save now warns you and keeps your draft. Choose Reload to use the newer file, or Overwrite to replace it with your version. Overwrite discards the newer changes rather than combining them, and the warning cannot catch every simultaneous edit made by another program.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Protect newer workspace edits from stale editor saves [#135865](https://github.com/openclaw/openclaw/pull/135865). Context [#127592](https://github.com/openclaw/openclaw/issues/127592). Thanks @yetval, @obviyus.
+- Correct expanded file-preview tooltips [#142039](https://github.com/openclaw/openclaw/pull/142039).
+- Compact phone file previews and retain fullscreen identity [#142536](https://github.com/openclaw/openclaw/pull/142536). Thanks @vyctorbrzezowski.
+- Browse long file lists with search and filters [#143854](https://github.com/openclaw/openclaw/pull/143854).
+- Show why a file could not open [#143958](https://github.com/openclaw/openclaw/pull/143958). Thanks @Marvinthebored, @Peetiegonzalez, @obviyus.
+
+
+
+
+
+
+##### See what Codex's helper agents did
+
+
+Open a Codex helper agent in Tasks to read its conversation, see its work, and load earlier messages. You can look at a file and return without making the conversation load again. Newly created tasks also stay readable as the main chat continues, although some older tasks still lack readable history, and resetting the chat or changing Codex accounts can prevent access.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Read native Codex subagent transcripts in the Tasks sidebar [#143747](https://github.com/openclaw/openclaw/pull/143747).
+
+**Bug fixes**
+
+- Retain subagent transcripts across parent turns [#143869](https://github.com/openclaw/openclaw/pull/143869).
+- Preserve Review transcripts across Files navigation [#144073](https://github.com/openclaw/openclaw/pull/144073).
+
+
+
+
+
+
+##### Follow ongoing and completed work
+
+
+Finished and cancelled helper tasks stop showing their old working messages, while their summaries of changed files remain available. Long reports stay readable without hiding the button back to the conversation that started the task, and short progress updates no longer show stray formatting symbols. Agents also get clearer instructions to skip progress cards for quick questions and save them for substantial work.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Clear stale activity text when subagent tasks finish [#129610](https://github.com/openclaw/openclaw/pull/129610). Thanks @jalehman.
+- Keep tool commentary single and visible after refresh [#140834](https://github.com/openclaw/openclaw/pull/140834). Thanks @leapdragon, @obviyus.
+- Preserve paragraphs and code blocks in displayed reasoning [#142231](https://github.com/openclaw/openclaw/pull/142231).
+- Keep subagent reports above the view-only footer [#142275](https://github.com/openclaw/openclaw/pull/142275). Thanks @vyctorbrzezowski.
+- Preserve literal text in tool activity previews [#142436](https://github.com/openclaw/openclaw/pull/142436).
+- Discourage progress cards for quick requests [#142696](https://github.com/openclaw/openclaw/pull/142696). Thanks @vyctorbrzezowski.
+- Make subagent activity previews readable [#143741](https://github.com/openclaw/openclaw/pull/143741).
+
+
+
+
+
+
+##### Enlarge Dashboard and restore your layout
+
+
+Click the [Dashboard](https://docs.openclaw.ai/web/dashboards) tab to give it the full task area, then click again to return to your previous layout. Your draft and anything entered into the dashboard stay in place. Dashboard progress also follows the conversation it belongs to, so selecting a different agent elsewhere does not make running work look paused.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Expand Dashboard and restore the original split [#143579](https://github.com/openclaw/openclaw/pull/143579). Thanks @fuller-stack-dev.
+
+**Bug fixes**
+
+- Show activity for the dashboard widget's target session [#137255](https://github.com/openclaw/openclaw/pull/137255). Context [#137188](https://github.com/openclaw/openclaw/issues/137188). Thanks @sunlit-deng, @obviyus, @Richard355168, @benjaml4.
+
+
+
+
+
+
+##### Upload files and restore terminal tabs
+
+
+When you use Claude Code, Codex, OpenCode, or Pi in a terminal on a paired computer, choosing or dropping a file now puts its location into the terminal for you to use. You can edit it before pressing Enter. Reloading while several terminal tabs are reconnecting also keeps tabs that previously disappeared from the list.
+
+If uploads remain blocked after a crash, follow the [terminal recovery steps](https://docs.openclaw.ai/web/control-ui/panels). Stop all OpenClaw host processes sharing the upload folder on the computer running that terminal before removing the lock named in the error.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Recover terminal uploads after failed lock release [#141250](https://github.com/openclaw/openclaw/pull/141250). Context [#137116](https://github.com/openclaw/openclaw/issues/137116). Thanks @shakkernerd.
+- Insert uploaded paths into paired-node coding terminals [#142001](https://github.com/openclaw/openclaw/pull/142001). Thanks @shakkernerd.
+- Keep terminal tabs during interrupted restoration [#144015](https://github.com/openclaw/openclaw/pull/144015). Thanks @vincentkoc.
+
+**Documentation**
+
+- Translate terminal upload-path errors [#142077](https://github.com/openclaw/openclaw/pull/142077).
+
+
+
+
+
+
+##### Search and edit Settings
+
+
+In [Settings](https://docs.openclaw.ai/web/control-ui/settings), removing an earlier list item no longer throws away unfinished text in another item. Correct and save that text before leaving the page, since unfinished drafts are not kept after a reload. Number buttons also stop skipping the first allowed value, and Web search clearly stays off when the person managing OpenClaw has disabled it.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Open Agents settings on Overview [#142884](https://github.com/openclaw/openclaw/pull/142884). Thanks @jalehman.
+
+**Bug fixes**
+
+- Match Web search controls to the global disable setting [#121557](https://github.com/openclaw/openclaw/pull/121557). Context [#121401](https://github.com/openclaw/openclaw/issues/121401). Thanks @zyw02, @obviyus.
+- Distinguish Mac and iPad browser labels [#136545](https://github.com/openclaw/openclaw/pull/136545). Context [#136544](https://github.com/openclaw/openclaw/issues/136544). Thanks @TheAngryPit, @obviyus.
+- Keep shortened account labels valid Unicode [#137686](https://github.com/openclaw/openclaw/pull/137686). Thanks @ly85206559, @obviyus.
+- Start empty numeric settings at the first allowed value [#142201](https://github.com/openclaw/openclaw/pull/142201).
+- Keep unfinished Settings edits when list rows move [#142564](https://github.com/openclaw/openclaw/pull/142564).
+- Preserve Settings phrase matches around tag filters [#142618](https://github.com/openclaw/openclaw/pull/142618).
+- Keep agent identity fields inside their card [#143763](https://github.com/openclaw/openclaw/pull/143763).
+
+
+
+
+
+
+##### Recognize people and agents
+
+
+The mention picker keeps suggestions available while you refine a search, making it easier to choose someone for a shared chat. Agent pictures now load in the picker and Settings on token-protected connections, and changing an agent's name or emoji updates an open chat without losing your draft.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Simplify mention labels and improve picker layout [#142274](https://github.com/openclaw/openclaw/pull/142274). Thanks @vyctorbrzezowski.
+- Reduce repeated presence reads across watched sessions [#142612](https://github.com/openclaw/openclaw/pull/142612).
+
+**Bug fixes**
+
+- Restore picker avatars on authenticated Gateways [#140954](https://github.com/openclaw/openclaw/pull/140954). Context [#140879](https://github.com/openclaw/openclaw/issues/140879). Thanks @LiuwqGit, @obviyus, @dimonnld, @rondavis007.
+- Label shared Gateway owner presence in the web UI [#141863](https://github.com/openclaw/openclaw/pull/141863).
+- Restore saved avatars in agent settings [#142015](https://github.com/openclaw/openclaw/pull/142015). Thanks @LiuwqGit, @obviyus, @lei-happy.
+- Keep person mention suggestions available while typing [#142332](https://github.com/openclaw/openclaw/pull/142332). Thanks @vyctorbrzezowski.
+- Refresh open-chat identity after agent edits [#142581](https://github.com/openclaw/openclaw/pull/142581). Thanks @aim9sour.
+- Save smaller replacement agent avatars without size-drop rejection [#143147](https://github.com/openclaw/openclaw/pull/143147). Thanks @LiuwqGit, @obviyus, @skaneta.
+
+
+
+
+
+
+##### Read usage and system status
+
+
+Usage keeps conversation details with the correct agent and counts the conversations actually shown in the list, with the total displayed separately. If you run OpenClaw on Linux with Bun, System busyness can show CPU and delay readings again instead of leaving permanent dashes. A dash just after starting still means the first reading is not ready.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Match Usage session counts to the visible list [#141749](https://github.com/openclaw/openclaw/pull/141749).
+- Keep Usage details tied to the selected agent [#143457](https://github.com/openclaw/openclaw/pull/143457).
+- Restore CPU and delay readings on Linux Bun [#143805](https://github.com/openclaw/openclaw/pull/143805).
+
+
+
+
+
+
+##### Get back to chatting after a stalled screen
+
+
+If a reply has finished but the screen still shows Stop, clicking it can bring back the completed reply and Send button without a page reload. On phones, failed messages keep Retry or Discard visible when those actions are available, and a request that times out before replying can leave an explanation that remains after reloading. Before sending again, check whether the first request already did the work, since a connection problem can leave delivery uncertain.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Keep chat delivery recovery controls visible on mobile [#141798](https://github.com/openclaw/openclaw/pull/141798). Thanks @Takhoffman.
+- Keep no-reply timeout notices in conversation history [#142135](https://github.com/openclaw/openclaw/pull/142135). Thanks @chelsealong, @obviyus, @von8794.
+- Ask for a Gateway token after remembered device credentials fail [#143156](https://github.com/openclaw/openclaw/pull/143156).
+- Restore Send when Stop finds a finished run [#143437](https://github.com/openclaw/openclaw/pull/143437). Thanks @ylcn91, @obviyus, @YanHE1169.
+
+**Documentation**
+
+- Match connection guidance to Gateway UI labels [#141789](https://github.com/openclaw/openclaw/pull/141789).
+
+
+
+
+
+
+##### Read replies and use familiar controls
+
+
+Opening the command palette no longer blurs the conversation behind it, so you can refer to a message while choosing an action. Copying a reply gives a compact green check, GitHub links avoid empty preview popups, and the first reply no longer triggers confetti. On Mac, use Command+B, Command+F, and Command+K for the sidebar, conversation search, and command palette; the Control versions are left for text editing. Windows and Linux keep Control for these shortcuts.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Use a neutral border around user avatars [#138285](https://github.com/openclaw/openclaw/pull/138285). Context [#138277](https://github.com/openclaw/openclaw/issues/138277). Thanks @vyctorbrzezowski.
+- Prepare the Inbox panel before opening [#142316](https://github.com/openclaw/openclaw/pull/142316). Thanks @vyctorbrzezowski.
+- Keep background text readable behind the command palette [#142944](https://github.com/openclaw/openclaw/pull/142944). Thanks @jalehman.
+- Remove first-reply confetti from chat [#143167](https://github.com/openclaw/openclaw/pull/143167). Thanks @Patrick-Erichsen.
+
+**Bug fixes**
+
+- Offer automatic host selection in the exec picker [#137565](https://github.com/openclaw/openclaw/pull/137565). Thanks @jalehman.
+- Preserve Unicode when shortening Mermaid errors [#137669](https://github.com/openclaw/openclaw/pull/137669). Thanks @ly85206559, @obviyus.
+- Keep unavailable GitHub previews quiet [#141896](https://github.com/openclaw/openclaw/pull/141896). Thanks @RomneyDa.
+- Skip rejected read updates in restricted chats [#142043](https://github.com/openclaw/openclaw/pull/142043).
+- Match menu highlights to the active theme [#142243](https://github.com/openclaw/openclaw/pull/142243). Thanks @vyctorbrzezowski.
+- Release temporary focus handlers after using chat pickers [#142258](https://github.com/openclaw/openclaw/pull/142258).
+- Remove unintended underlines from button links [#142335](https://github.com/openclaw/openclaw/pull/142335). Thanks @vyctorbrzezowski.
+- Reject invalid custom chat message widths [#142635](https://github.com/openclaw/openclaw/pull/142635).
+- Remove duplicate tooltips from GitHub preview links [#142637](https://github.com/openclaw/openclaw/pull/142637). Thanks @vyctorbrzezowski.
+- Preserve Mac text-editing Control shortcuts [#142674](https://github.com/openclaw/openclaw/pull/142674). Thanks @jalehman.
+- Show the correct Option/Alt+Click session-selection shortcut [#143051](https://github.com/openclaw/openclaw/pull/143051). Thanks @vincentkoc.
+- Align chat actions and retain green copy confirmation [#143425](https://github.com/openclaw/openclaw/pull/143425). Thanks @Patrick-Erichsen.
+
+
+
+
+
+
+##### Get an explanation when an interactive card breaks
+
+
+OpenClaw can catch some coding mistakes in [widgets](https://docs.openclaw.ai/tools/show-widget), the small interactive apps an agent can place in chat, before they appear. If a recent card fails while you use it, the web app can show a Script error notice and tell the agent what happened, giving it a chance to help you recover.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Show widget script failures and notify the agent [#142225](https://github.com/openclaw/openclaw/pull/142225).
+
+**Bug fixes**
+
+- Catch widget script syntax errors before display [#141939](https://github.com/openclaw/openclaw/pull/141939).
+
+
+
+
+
+
+##### Read updated interface guidance
+
+
+More labels and help text are translated in Settings, plugin browsing, Files, and cloud-worker controls. Settings also uses available translations when you search for a field, making it easier to find an option in your chosen language.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Translate connection progress and setup-code guidance [#141750](https://github.com/openclaw/openclaw/pull/141750).
+- Translate Shared owner labels in the web UI [#141881](https://github.com/openclaw/openclaw/pull/141881).
+- Translate board-widget script error labels [#142147](https://github.com/openclaw/openclaw/pull/142147).
+- Translate model-discovery status and retry messages [#142334](https://github.com/openclaw/openclaw/pull/142334).
+- Refresh translations across 20 interface languages [#142699](https://github.com/openclaw/openclaw/pull/142699).
+- Refresh plugin-screen translations in 20 languages [#143622](https://github.com/openclaw/openclaw/pull/143622).
+- Refresh cloud-worker and notice translations [#143868](https://github.com/openclaw/openclaw/pull/143868).
+- Translate file and snapshot controls [#143924](https://github.com/openclaw/openclaw/pull/143924).
+- Translate snapshot-building controls and errors [#144011](https://github.com/openclaw/openclaw/pull/144011).
+
+**Bug fixes**
+
+- Apply available translations to core Settings fields [#137192](https://github.com/openclaw/openclaw/pull/137192). Context [#137190](https://github.com/openclaw/openclaw/issues/137190). Thanks @husodrn46, @obviyus.
+- Localize the picker's No matches message [#142255](https://github.com/openclaw/openclaw/pull/142255).
+- Correct parent-session and dashboard translations [#142327](https://github.com/openclaw/openclaw/pull/142327).
+
+**Documentation**
+
+- Refresh translated Gateway connection guidance [#141803](https://github.com/openclaw/openclaw/pull/141803).
+- Align maturity documentation with current product names [#142065](https://github.com/openclaw/openclaw/pull/142065). Thanks @RomneyDa.
+
+
+
+
+
+
+
+#### Updates and Maintenance
+
+Updating OpenClaw gets fixes for stalled upgrades, plugins left behind, and confusing recovery messages. There are also improvements to bringing older conversations and settings forward, backing up the files you need, and cleaning up history without getting in the way of other work.
+
+
+
+
+##### Complete an update
+
+
+Updates from recent stable releases can get past failures that prevented them from finishing or left OpenClaw stopped afterward. Updating from the browser also gets a startup fix, and active conversations are less likely to hold up an update. Some fixes only help after the newer updater is installed, so if your current version is stuck, follow the [update guidance](https://docs.openclaw.ai/cli/update/how-updates-run) rather than repeatedly trying the same failing command.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Let older updaters finish and restart the Gateway [#142195](https://github.com/openclaw/openclaw/pull/142195) Thanks @Newsstand.
+- Check Node compatibility before dev-update installation [#142248](https://github.com/openclaw/openclaw/pull/142248) Thanks @TheAngryPit, @jialele, @obviyus.
+- Correct Node compatibility advice during updates [#142322](https://github.com/openclaw/openclaw/pull/142322) Thanks @SunnyShu0925, @guarismo.
+- Allow update checks while agent databases are busy [#142419](https://github.com/openclaw/openclaw/pull/142419) Thanks @jalehman.
+- Restore restart launch after updates from the 2026.9.1 Git build 0229a108 [#142631](https://github.com/openclaw/openclaw/pull/142631) Thanks @jason-allen-oneal.
+- Follow the activated package directory during managed pnpm updates [#143137](https://github.com/openclaw/openclaw/pull/143137) Thanks @timetrvlr.
+- Preserve bundled-plugin trust during update trials [#143190](https://github.com/openclaw/openclaw/pull/143190) Thanks @DonnieFi.
+- Restore upgrades from older stable releases [#143859](https://github.com/openclaw/openclaw/pull/143859)
+- Verify the same Gateway through update checks [#143863](https://github.com/openclaw/openclaw/pull/143863) Thanks @fuller-stack-dev.
+- Fix managed-update helper startup [#144031](https://github.com/openclaw/openclaw/pull/144031) Thanks @IWhatsskill, @fuller-stack-dev.
+- Allow confirmed service-less Linux updates, keep transcript stdout clean, preserve custom root/account schema types, and reuse warm Claude CLI processes when prepared skills are unchanged [#144402](https://github.com/openclaw/openclaw/pull/144402) Thanks @vincentkoc.
+
+**Limits and compatibility**
+
+- Align package versions and extension compatibility requirements [86ef455b](https://github.com/openclaw/openclaw/commit/86ef455b05483a94947ba26777ca94a9cc5d27d9)
+
+
+
+
+
+
+##### Update an installation built from source
+
+
+If you run OpenClaw from a Git checkout, updates can recover when an upstream release tag changes, and Windows gets a fix for updates failing before they begin. Status now warns when a failed update check left its information out of date. That warning clears after the updater next fetches successfully. If your checkout has several possible update sources, the [development-channel guide](https://docs.openclaw.ai/install/development-channels) explains how to choose one.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Recover Git updates when upstream release tags move [#126816](https://github.com/openclaw/openclaw/pull/126816) Thanks @ruel225, @zhangguiping-xydt, @ToneLoke. Context [#123318](https://github.com/openclaw/openclaw/issues/123318).
+- Sync source assets with unusual filenames [#142024](https://github.com/openclaw/openclaw/pull/142024)
+- Warn when failed update fetches leave status information stale [#142199](https://github.com/openclaw/openclaw/pull/142199) Thanks @ToneLoke.
+- Fix Windows Git configuration paths for updates and cloning [#142749](https://github.com/openclaw/openclaw/pull/142749) Thanks @pengzh1, @aevgeniou, @jalehman.
+
+
+
+
+
+
+##### Recover from a failed update
+
+
+When an update fails, OpenClaw can put the previous app version back if it still works with your current settings and data. If that cannot be checked, recovery stops and leaves the available recovery files in place for inspection. An interrupted update may still need manual help. Rolling back the app does not restore your data, so [make and verify a backup before updating](https://docs.openclaw.ai/install/updating/rollback-and-recovery).
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Preserve existing state when Gateway startup needs repair [#141451](https://github.com/openclaw/openclaw/pull/141451) Thanks @Lendersmark, @jerabinovich.
+- Correct version checks after failed-update recovery [#142817](https://github.com/openclaw/openclaw/pull/142817) Thanks @wangmiao0668000666.
+- Stop rollback after updater ownership is lost [#143791](https://github.com/openclaw/openclaw/pull/143791) Thanks @vincentkoc, @fuller-stack-dev.
+- Report failed temporary-copy cleanup [#143844](https://github.com/openclaw/openclaw/pull/143844) Thanks @fuller-stack-dev.
+- Stop plugin writes after update ownership loss [#144130](https://github.com/openclaw/openclaw/pull/144130) Thanks @fuller-stack-dev.
+
+**Limits and compatibility**
+
+- Guard compatible package rollback and interrupted updates, finish plugin work before restart, add copied-agent preflight, honor same-version package artifacts, and suppress unsolicited standalone restart notices [000af986](https://github.com/openclaw/openclaw/commit/000af986dc991e9cef3d10663c121503606f25cc) Thanks @fuller-stack-dev. Context [#140339](https://github.com/openclaw/openclaw/pull/140339).
+
+
+
+
+
+
+##### Clear a stuck update message
+
+
+An old “update in progress” message can stop blocking settings changes and account sign-in even when the update itself is no longer running. `openclaw update repair` can clear eligible stuck updates once it confirms the updater has stopped and OpenClaw is working. Some older requests that never got started clear automatically after a day, provided nothing still needs recovery. They remain in history as failed attempts, with guidance to retry.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Repair abandoned update runs without an unnecessary 30-minute wait [#143136](https://github.com/openclaw/openclaw/pull/143136) Thanks @yncubys, @guarismo, @SunnyShu0925.
+- Clear abandoned legacy updates that block settings writes [#143774](https://github.com/openclaw/openclaw/pull/143774) Thanks @Colton-Harris, @syfvb, @ElvisIO7, @rlosito, @alexph-dev, @aaajiao, @c0ncatenate, @unknowbug, @KingAkrej, @DasX, @jlacroix82, @mikronn2, @najef1979-code.
+
+**Documentation**
+
+- Explain automatic expiry of old update records [#143974](https://github.com/openclaw/openclaw/pull/143974)
+
+
+
+
+
+
+##### Give lengthy repairs time to finish
+
+
+Updates on larger installations now give Doctor, OpenClaw's repair tool, time to finish work that used to be cut short. Some failures to remove disposable files become warnings with cleanup advice, while problems that prevent the updated app from working still stop the update. A stuck repair can keep waiting unless you set a limit, and stopping the update may leave repair work running, so use the [repair guidance](https://docs.openclaw.ai/cli/update/repair-and-recovery) if progress stops.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Allow long update Doctor repairs to finish [#143321](https://github.com/openclaw/openclaw/pull/143321) Thanks @fuller-stack-dev.
+- Continue updates after recoverable cleanup failures [#143767](https://github.com/openclaw/openclaw/pull/143767)
+
+
+
+
+
+
+##### Choose what follows a failed update
+
+
+If an update fails but the previous installation is restored and checked, the menu defaults to Exit. You can choose to investigate or preview a report before sending it. For other interactive update failures, the repair prompt tells you which AI agent will run and that it uses your account allowance or paid tokens. You can decline, but pressing Enter accepts and leaving the prompt unanswered starts the agent after 30 seconds.
+
+Claude-assisted repairs start without project customizations that could delay them. If your repair needs those custom tools or instructions, use the manual command provided instead. The [repair-agent guide](https://docs.openclaw.ai/cli/triage) explains the choices and Claude requirements.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Offer a choice before automatic update repair launches an agent [#143139](https://github.com/openclaw/openclaw/pull/143139)
+
+**Bug fixes**
+
+- Make diagnosis optional after verified update rollback [#143657](https://github.com/openclaw/openclaw/pull/143657) Thanks @fuller-stack-dev.
+
+**Documentation**
+
+- Clarify update failure recovery choices [#143723](https://github.com/openclaw/openclaw/pull/143723)
+
+**Limits and compatibility**
+
+- Start direct Claude triage in safe mode with advertised support, documented for Claude Code 2.1.169 or newer [#143474](https://github.com/openclaw/openclaw/pull/143474) Thanks @RomneyDa.
+
+
+
+
+
+
+##### Understand update progress and warnings
+
+
+Update progress and the final report now agree about what happened, including when an update failed but the previous version was successfully restored. Warnings keep useful repair advice and identify leftover backup files, and a problem reading history no longer hides other update guidance. If an update stalls, more of its troubleshooting information is kept. You can [inspect the update report](https://docs.openclaw.ai/cli/update/status-and-history), or run `openclaw doctor` afterward for checks that are not needed during the update itself.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Identify child processes in stalled update diagnostics [#141740](https://github.com/openclaw/openclaw/pull/141740) Thanks @hannesrudolph.
+- Skip unrelated Doctor diagnostics during updates [#142675](https://github.com/openclaw/openclaw/pull/142675) Thanks @fuller-stack-dev.
+
+**Bug fixes**
+
+- Skip optional update probes and retain Doctor warnings [#141995](https://github.com/openclaw/openclaw/pull/141995) Thanks @hannesrudolph.
+- Preserve core Doctor warnings during updates [#142091](https://github.com/openclaw/openclaw/pull/142091)
+- Retain Doctor diagnostics when update finalization times out [#142672](https://github.com/openclaw/openclaw/pull/142672) Thanks @fuller-stack-dev.
+- Show refreshed commit counts before updating [#142837](https://github.com/openclaw/openclaw/pull/142837) Thanks @jalehman.
+- Keep update guidance available when history fails [#143557](https://github.com/openclaw/openclaw/pull/143557)
+- Load update history without pausing other Gateway work [#143605](https://github.com/openclaw/openclaw/pull/143605)
+- Stop advertising unavailable update-report files [#143748](https://github.com/openclaw/openclaw/pull/143748)
+- Correct agent guidance for authorized SSH updates to a different host while retaining normal approvals [#143754](https://github.com/openclaw/openclaw/pull/143754)
+- Report final update results and retained backups [#143921](https://github.com/openclaw/openclaw/pull/143921) Thanks @fuller-stack-dev.
+- Keep update progress consistent with final reports [#143965](https://github.com/openclaw/openclaw/pull/143965)
+
+**Documentation**
+
+- Split update documentation into focused guides [#142858](https://github.com/openclaw/openclaw/pull/142858) Thanks @vincentkoc.
+- Split updating guidance into focused pages [#142993](https://github.com/openclaw/openclaw/pull/142993) Thanks @vincentkoc.
+
+
+
+
+
+
+##### Update plugins when OpenClaw is already current
+
+
+Running `openclaw update` now checks eligible plugins even if the main app is already up to date, including after you updated it separately. When nothing changes, it skips unnecessary follow-up work. If you deliberately kept a plugin at a particular version, that choice stays in place and notices of newer official releases explain how to change it. Plugin updates may need a restart, and plugin downloads during an app update can extend the time OpenClaw is unavailable.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Skip unnecessary plugin scans during updates [#143783](https://github.com/openclaw/openclaw/pull/143783)
+
+**Bug fixes**
+
+- Report newer releases without replacing official plugin pins [#137892](https://github.com/openclaw/openclaw/pull/137892) Thanks @pfrederiksen, @vincentkoc. Context [#137624](https://github.com/openclaw/openclaw/issues/137624).
+- Show warnings for retained official plugin pins [#142457](https://github.com/openclaw/openclaw/pull/142457) Thanks @PollyBot13, @obviyus, @martins-oss.
+- Run plugin maintenance when core is already current [#143174](https://github.com/openclaw/openclaw/pull/143174) Thanks @martins-oss, @fulgerulnegru, @kesslerio, @guojiongming, @soroyue, @Sedrak-Hovhannisyan.
+- Skip redundant completion when updates change nothing [#143462](https://github.com/openclaw/openclaw/pull/143462) Thanks @RomneyDa.
+- Skip plugins already repaired under new IDs [#143861](https://github.com/openclaw/openclaw/pull/143861)
+
+
+
+
+
+
+##### Repair older settings and moved workspaces
+
+
+Doctor can bring more older settings and saved accounts forward without losing your model choices or asking you to edit configuration files by hand. It can also recognize a moved workspace and preserve its setup history, while leaving uncertain matches for review.
+
+If an older Claude conversation has not been converted to the current format, run `openclaw doctor --fix` before resuming it. The [Doctor checks guide](https://docs.openclaw.ai/cli/doctor/checks) explains that step and the cases that still need manual help.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Fix optional Codex checks, configuration-less update finalization, and private Doctor snapshot cleanup [f212072e](https://github.com/openclaw/openclaw/commit/f212072e4c6e5f67f356b4b213a0059bbdb07db2)
+- Repair moved workspaces without blocking queued messages [#133198](https://github.com/openclaw/openclaw/pull/133198) Thanks @safzanpirani, @obviyus. Context [#133172](https://github.com/openclaw/openclaw/issues/133172).
+- Preserve Unicode in shortened SQLite worker errors [#137675](https://github.com/openclaw/openclaw/pull/137675) Thanks @ly85206559, @obviyus.
+- Wait for cooperating plugins to release Doctor inspection resources through their registration-local disposal callback [#141692](https://github.com/openclaw/openclaw/pull/141692)
+- Show backup recovery guidance for unreadable Doctor state [#141776](https://github.com/openclaw/openclaw/pull/141776)
+- Stop Doctor suggesting the skill repair already underway [#141866](https://github.com/openclaw/openclaw/pull/141866)
+- Explain shallow snapshot failures and incomplete clones [#141936](https://github.com/openclaw/openclaw/pull/141936)
+- Preserve model choices and backends during Doctor migration [#142284](https://github.com/openclaw/openclaw/pull/142284) Thanks @obviyus.
+- Respect search-provider choice in missing-plugin repair; the separate release-repair path can still select Brave from environment credentials [#142640](https://github.com/openclaw/openclaw/pull/142640) Thanks @vincentkoc.
+- Correct full Doctor lint paths and preserve inspected sidecars and skill links; ordinary lint retains its separate shared-memory limitation [#142839](https://github.com/openclaw/openclaw/pull/142839) Thanks @thien-ngn, @obviyus.
+- Restore legacy multi-agent backups without manual ownership edits [#143202](https://github.com/openclaw/openclaw/pull/143202) Thanks @GitHoubi.
+- Repair legacy music-model references with Doctor [#143235](https://github.com/openclaw/openclaw/pull/143235) Thanks @obviyus.
+- Preserve saved accounts through Doctor migration [#143429](https://github.com/openclaw/openclaw/pull/143429) Thanks @obviyus.
+
+**Documentation**
+
+- Organize Doctor guidance by repair task [#141961](https://github.com/openclaw/openclaw/pull/141961) Thanks @vincentkoc.
+- Organize Doctor CLI documentation by task [#142855](https://github.com/openclaw/openclaw/pull/142855) Thanks @vincentkoc.
+
+**Limits and compatibility**
+
+- Migrate legacy Claude conversation bindings with Doctor [#143347](https://github.com/openclaw/openclaw/pull/143347) Thanks @obviyus.
+
+
+
+
+
+
+##### Bring older conversations forward
+
+
+Importing older Codex conversations now keeps assistant replies that could previously go missing, in their original order. If you already imported an affected conversation, recovery can add missing replies, but it adds them at the end rather than rebuilding the original conversation order. Repairs to attachment information also survive when saved conversation archives are recreated. If a backup-linked file blocks an import, the error points to the file and the [safe recovery steps](https://docs.openclaw.ai/cli/doctor/sqlite-maintenance#hard-linked-legacy-artifacts).
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Preserve Codex replies during legacy session import [#140296](https://github.com/openclaw/openclaw/pull/140296) Thanks @ylcn91, @ikenraf. Context [#140100](https://github.com/openclaw/openclaw/issues/140100).
+- Explain hard-linked session migration refusals with recovery guidance [#143195](https://github.com/openclaw/openclaw/pull/143195) Thanks @GitHoubi.
+- Preserve repaired media metadata in session archives [#143595](https://github.com/openclaw/openclaw/pull/143595) Thanks @fuller-stack-dev.
+
+
+
+
+
+
+##### Back up all the settings files you need
+
+
+If you split your settings across several files, a full backup now includes the files your main configuration refers to, even outside the usual backup folders. It stops with repair guidance if those files cannot be captured completely. The `--only-config` option still saves just the main file.
+
+Backups also handle a disappearing temporary database file when its contents are already safely captured. A backup does not freeze the whole installation at one instant, so changes made while it runs may not all be included. Treat the archive as sensitive because settings files can contain secrets, and follow the [backup guide](https://docs.openclaw.ai/cli/backup) when checking or restoring it.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Keep backups running when snapshotted SQLite sidecars disappear [#141161](https://github.com/openclaw/openclaw/pull/141161) Thanks @LiuwqGit, @vincentkoc, @Cobblestone-Digital1, @legupsystems. Context [#141042](https://github.com/openclaw/openclaw/issues/141042). Context [#67417](https://github.com/openclaw/openclaw/issues/67417).
+- Preserve required configuration includes in full backups [#143693](https://github.com/openclaw/openclaw/pull/143693) Thanks @fuller-stack-dev.
+
+
+
+
+
+
+##### Check larger installations
+
+
+Installations with a lot of saved data get more time to finish database checks, and some checks need less temporary disk space and avoid repeated work. This helps when maintenance previously stopped before it could finish, while keeping the checks for damaged data. If something goes wrong, errors give more useful clues about where the check stopped and when Doctor may be able to help.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Show the last observed database integrity-check phase [#141669](https://github.com/openclaw/openclaw/pull/141669)
+- Reduce temporary disk space for applicable SQLite inspection snapshots [#141773](https://github.com/openclaw/openclaw/pull/141773)
+- Report slow session-cleanup worker operations [#142525](https://github.com/openclaw/openclaw/pull/142525)
+- Reduce database snapshot startup overhead [#144022](https://github.com/openclaw/openclaw/pull/144022)
+
+**Bug fixes**
+
+- Allow large databases more startup-check time [#141918](https://github.com/openclaw/openclaw/pull/141918)
+- Give large database inspections a size-based timeout [#142179](https://github.com/openclaw/openclaw/pull/142179)
+- Avoid redundant database scans during Doctor repair [#142669](https://github.com/openclaw/openclaw/pull/142669) Thanks @fuller-stack-dev.
+- Keep healthy memory database handles open when no repair is needed and skip GitHub credential and bootstrap-size advisories during updates [#143361](https://github.com/openclaw/openclaw/pull/143361) Thanks @fuller-stack-dev.
+- Name the Doctor repair command in SQLite startup errors [#143531](https://github.com/openclaw/openclaw/pull/143531) Thanks @RomneyDa.
+
+**Documentation**
+
+- Organize database reference and recovery guidance [#143152](https://github.com/openclaw/openclaw/pull/143152) Thanks @vincentkoc.
+
+
+
+
+
+
+##### Keep working during history cleanup
+
+
+Deleting sessions and cleaning up old conversations are less likely to pause other work while OpenClaw checks its saved data. Cleanup also checks again before deleting more history, so it can stop when enough space has been freed and leave newly protected conversations alone. Your retention settings still decide what can be removed.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Recheck protected history and disk pressure during cleanup [#142505](https://github.com/openclaw/openclaw/pull/142505) Thanks @HermanZeng.
+- Move cold session-cleanup checks off the Gateway main thread [#143226](https://github.com/openclaw/openclaw/pull/143226)
+- Stop excess session cleanup after disk pressure clears [#143285](https://github.com/openclaw/openclaw/pull/143285)
+- Move cold database checks out of history cleanup planning [#143332](https://github.com/openclaw/openclaw/pull/143332)
+- Avoid Gateway pauses during archive database reopening [#143379](https://github.com/openclaw/openclaw/pull/143379)
+- Keep session updates responsive during database reopening [#143434](https://github.com/openclaw/openclaw/pull/143434)
+- Reopen cleanup databases without blocking other work [#143602](https://github.com/openclaw/openclaw/pull/143602)
+
+
+
+
+
+
+##### Restart and shut down OpenClaw
+
+
+Linux users get fixes for restarts that stayed stuck and for conflicting settings that made OpenClaw restart over and over. Those conflicts now leave an error to fix before starting again. Shutdown also gives plugins and voice connections time to finish their cleanup and final writes, though a stuck plugin can still delay it.
+
+Reconnecting avoids repeating unnecessary [health checks](https://docs.openclaw.ai/gateway/health), while fresh checks remain available when needed.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Avoid false repair advice for masked systemd services [#137869](https://github.com/openclaw/openclaw/pull/137869) Thanks @teddytennant, @obviyus, @aniruddhaadak80. Context [#128928](https://github.com/openclaw/openclaw/issues/128928).
+- Prevent managed systemd restarts from hanging [#140914](https://github.com/openclaw/openclaw/pull/140914) Thanks @NianJiuZst, @rboy1, @obviyus. Context [#140821](https://github.com/openclaw/openclaw/issues/140821).
+- Keep affected CLI-started Gateways running after transient DNS rejections without retrying the failed operation [#141163](https://github.com/openclaw/openclaw/pull/141163) Thanks @ly85206559, @orangejon. Context [#141123](https://github.com/openclaw/openclaw/issues/141123).
+- Return service-unavailable responses when a Gateway handshake fails before WebSocket transfer [#141303](https://github.com/openclaw/openclaw/pull/141303) Thanks @hugenshen, @obviyus.
+- Wait for Talk connection cleanup during shutdown [#141706](https://github.com/openclaw/openclaw/pull/141706)
+- Keep startup logs current after plugin reloads [#141736](https://github.com/openclaw/openclaw/pull/141736)
+- Stop restart loops caused by conflicting Gateway settings [#141771](https://github.com/openclaw/openclaw/pull/141771) Thanks @chelsealong, @tomdailey55, @jalehman.
+- Keep shared Gateway state available through cleanup [#142286](https://github.com/openclaw/openclaw/pull/142286)
+- Finish pending cleanup before automatic macOS CLI exit [#142814](https://github.com/openclaw/openclaw/pull/142814)
+- Avoid repeated health collection on reconnects [#143384](https://github.com/openclaw/openclaw/pull/143384)
+- Preserve restart options during schema upgrades [#143738](https://github.com/openclaw/openclaw/pull/143738) Thanks @RomneyDa.
+
+**Documentation**
+
+- Split Gateway CLI reference by operator task [#143005](https://github.com/openclaw/openclaw/pull/143005) Thanks @vincentkoc.
+- Organize Gateway troubleshooting by symptom [#143160](https://github.com/openclaw/openclaw/pull/143160) Thanks @vincentkoc.
+
+
+
+
+
+
+##### Manage settings outside OpenClaw
+
+
+If another tool manages your OpenClaw settings, a new [read-only configuration option](https://docs.openclaw.ai/cli/config#externally-managed-config) keeps OpenClaw from overwriting them, including during automatic recovery. Set `OPENCLAW_CONFIG_READONLY=1` for both the running service and terminal commands. Conversations and other working data still need somewhere writable, and model changes can apply to the current session without changing the saved default.
+
+Settings edits after creating or changing an agent also avoid false “changed since last load” errors. Saving and applying settings remain separate, so if you turned automatic reload off, restart OpenClaw to use the changes.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Add a read-only mode for externally managed configuration [#140719](https://github.com/openclaw/openclaw/pull/140719) Thanks @sallyom. Context [#140706](https://github.com/openclaw/openclaw/issues/140706). Context [#103606](https://github.com/openclaw/openclaw/issues/103606).
+
+**Bug fixes**
+
+- Refresh configuration revisions after agent changes [#142169](https://github.com/openclaw/openclaw/pull/142169) Thanks @ceckert, @obviyus.
+- Explain managed-configuration refusals without crash diagnostics [#143140](https://github.com/openclaw/openclaw/pull/143140)
+
+**Documentation**
+
+- Clarify manual restart requirements in reload-off mode [#127205](https://github.com/openclaw/openclaw/pull/127205) Context [#127203](https://github.com/openclaw/openclaw/issues/127203).
+- Split Gateway configuration guidance into topic pages [#143456](https://github.com/openclaw/openclaw/pull/143456) Thanks @vincentkoc.
+
+
+
+
+
+
+##### Stop and update OpenClaw on Windows
+
+
+For Windows installations using OpenClaw’s standard launcher, stopping the scheduled Gateway task now stops the work it started too, allowing a fresh start without a leftover copy getting in the way. Early startup failures also reach the log. Custom executable wrappers or extra command-shell layers can still prevent startup. Slow Windows service checks get another chance during updates, but a check that keeps hanging can make the wait much longer; if the service cannot be checked, the update stops before replacing the app.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Stop Windows Gateway task descendants and log child failures [#141744](https://github.com/openclaw/openclaw/pull/141744) Thanks @akagifreeez, @Devin-Linux, @unknowbug.
+- Honor update timeouts for Windows service checks [#143292](https://github.com/openclaw/openclaw/pull/143292) Thanks @fanyuantaier.
+
+
+
+
+
+
+##### Find monitoring help
+
+
+The [monitoring guide](https://docs.openclaw.ai/gateway/opentelemetry) makes it easier to find help setting up monitoring, understanding what information it captures, or using that information in dashboards. The instructions are organized around those tasks, with existing links still leading to the right place.
+
+
+
+###### Sources and complete change list
+
+
+**Documentation**
+
+- Split OpenTelemetry guidance into focused pages [#142951](https://github.com/openclaw/openclaw/pull/142951) Thanks @vincentkoc.
+
+
+
+
+
+
+
+#### Messaging
+
+This update fixes several ways a conversation could lose its words, its reply, or its place. Long answers keep their formatting, Feishu document tools work again in affected chats, and Talk can bring an answer back after handing work to another agent.
+
+
+
+
+##### Replies and progress updates
+
+
+Messages arriving while OpenClaw is paused now wait until it is ready again, and unfinished replies are no longer mistaken for completed sends. If you show detailed progress, newer work stays visible instead of being crowded out by old command failures. Missing-reply notices also give a clearer explanation and a reference your administrator can use to investigate.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Hide internal finalizer placeholders in message-only groups [73ca607b1d99](https://github.com/openclaw/openclaw/commit/73ca607b1d9940ecb040527da0a3c610d15bc64a). Thanks @razvangirgiz, @obviyus, @omarshahine. Contextual provenance [#138645](https://github.com/openclaw/openclaw/pull/138645).
+- Keep unfinished replies pending during forced cleanup [#141900](https://github.com/openclaw/openclaw/pull/141900). Thanks @Takhoffman.
+- Pause message retries during Gateway suspension [#142064](https://github.com/openclaw/openclaw/pull/142064). Thanks @goutamadwant, @obviyus, @Stephane-fci.
+- Keep plans and newer activity visible after repeated command exits [#142802](https://github.com/openclaw/openclaw/pull/142802). Thanks @obviyus.
+
+**Improvements**
+
+- Add clearer missing-reply notices and run references [#136462](https://github.com/openclaw/openclaw/pull/136462). Thanks @RomneyDa, @sloptop-the-terrible.
+
+
+
+
+
+
+##### Readable long replies
+
+
+[Long replies](https://docs.openclaw.ai/concepts/streaming) break at more natural places, and code keeps its formatting when it continues into another message. Code that arrived successfully no longer causes the whole answer to be repeated at the end. Quoted examples also keep their spacing, making them easier to read and copy.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Preserve paragraph boundaries between streamed assistant messages [#140833](https://github.com/openclaw/openclaw/pull/140833). Thanks @leapdragon, @obviyus.
+- Preserve quoted code spacing when removing delivery directives [#141767](https://github.com/openclaw/openclaw/pull/141767). Thanks @Alix-007, @obviyus.
+- Preserve message-ID code examples in conversation displays [#141769](https://github.com/openclaw/openclaw/pull/141769). Thanks @Alix-007, @obviyus.
+- Preserve converted images that retain HEIC filenames [#142263](https://github.com/openclaw/openclaw/pull/142263).
+- Align short and empty code-table columns [#142406](https://github.com/openclaw/openclaw/pull/142406).
+- Keep streamed prose and code formatted without duplicate finals [#143722](https://github.com/openclaw/openclaw/pull/143722). Thanks @obviyus, @rgregg.
+
+
+
+
+
+
+##### Telegram formatting and stickers
+
+
+If you enable [Telegram rich messages](https://docs.openclaw.ai/channels/telegram), links inside lists, quotes, and expandable sections stay clickable and keep their styling. Code examples keep their spacing in messages and photo captions too. Sticker descriptions now use your chosen image model and reach your Claw in time for its first reply.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Preserve styled links and formatting in rich messages [#139976](https://github.com/openclaw/openclaw/pull/139976).
+- Honor image defaults and retain sticker descriptions [#142023](https://github.com/openclaw/openclaw/pull/142023). Thanks @obviyus.
+- Preserve code-example spacing in Telegram text and captions [#142504](https://github.com/openclaw/openclaw/pull/142504).
+
+
+
+
+
+
+##### Telegram mentions and commands
+
+
+[Telegram](https://docs.openclaw.ai/channels/telegram) recognizes mentions that tag the bot’s account in messages and photo captions. If you have native commands turned off, you can write `/think high` on one line and your request below it without losing the request. The `/think` menu also shows the setting for the agent handling that chat, and canceled attempts no longer leave a misleading “stalled” reaction afterward.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Recognize bot identity mentions in text and captions [#140266](https://github.com/openclaw/openclaw/pull/140266). Thanks @cai-ops, @obviyus.
+- Stop stale stall reactions after cancelled preparation [#141079](https://github.com/openclaw/openclaw/pull/141079). Thanks @ooiuuii, @obviyus.
+- Preserve tasks after multiline Telegram directives [#142008](https://github.com/openclaw/openclaw/pull/142008). Thanks @wangmiao0668000666, @obviyus.
+- Show the routed agent's thinking default in Telegram [#143789](https://github.com/openclaw/openclaw/pull/143789).
+
+**Documentation**
+
+- Organize Telegram documentation by task [#142963](https://github.com/openclaw/openclaw/pull/142963). Thanks @vincentkoc.
+
+
+
+
+
+
+##### Telegram replies after proxy failures
+
+
+If you connect Telegram through a proxy and it refuses the connection before a reply is sent, OpenClaw can keep that reply for another attempt when the connection returns. It still avoids resending messages whose delivery is uncertain, so this does not automatically recover every previously failed reply.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Recover queued replies after proxy tunnel refusals [#140388](https://github.com/openclaw/openclaw/pull/140388). Thanks @Hekzory, @MAG-Linares-Andalucia.
+
+
+
+
+
+
+##### Discord messages, voice notes, and progress
+
+
+In [Discord](https://docs.openclaw.ai/channels/discord) channels where your Claw can already read messages without being mentioned, voice notes now keep their spoken words in the conversation. Attachment captions also keep repeated instructions, and progress updates remain visible if the final answer cannot be sent.
+
+Requests such as checking OpenClaw’s system status can work again from server messages when you have permission, fixing a case where the request was refused despite the tool being available.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Populate member presence from startup and reconnect snapshots [#141218](https://github.com/openclaw/openclaw/pull/141218). Thanks @harshitgupta31415, @vincentkoc, @nissl24.
+- Preserve Discord commentary and progress after send failures [#141621](https://github.com/openclaw/openclaw/pull/141621). Thanks @anyech, @obviyus, @dw1161.
+- Preserve repeated Discord captions and link-button emoji [#142342](https://github.com/openclaw/openclaw/pull/142342).
+- Preserve voice-note words in Discord ambient conversations [#142860](https://github.com/openclaw/openclaw/pull/142860). Thanks @ericcaiwx-star, @aatreya, @jalehman.
+- Restore permitted system-agent delegation in Discord guild messages [#143006](https://github.com/openclaw/openclaw/pull/143006). Thanks @Marvinthebored, @Peetiegonzalez, @obviyus, @0xCyda, @lisheguo.
+
+**Documentation**
+
+- Organize Discord documentation into focused guides [#142666](https://github.com/openclaw/openclaw/pull/142666). Thanks @vincentkoc.
+
+
+
+
+
+
+##### Slack reactions and message formatting
+
+
+Slack can show its configured reaction when it picks up your mention even if you have ongoing status reactions turned off. [Messages containing Windows paths](https://docs.openclaw.ai/channels/slack/media) also keep their formatting without accidentally turning the text that follows into code.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Resolve a shared workspace for owner heartbeat DMs [#138689](https://github.com/openclaw/openclaw/pull/138689). Thanks @Kimiyu-186.
+- Keep Slack prose out of code formatting after Windows paths [#142288](https://github.com/openclaw/openclaw/pull/142288).
+- Keep Slack acknowledgements when status reactions are off [#142595](https://github.com/openclaw/openclaw/pull/142595). Thanks @sunlit-deng, @alexjpanagis.
+
+
+
+
+
+
+##### Feishu documents and formatted messages
+
+
+If a separately installed Feishu plugin stopped letting your Claw work with documents, wikis, Drive, or Bitable from chat, those tools are available again with your existing permissions. Changes to [tool and account settings](https://docs.openclaw.ai/channels/feishu/advanced-configuration) now apply to new requests without restarting OpenClaw, while work already underway keeps its earlier settings. Your Claw also receives the emphasis you put in formatted messages, links, and mentions.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Skip unnecessary table parsing for plain Feishu cards and stop checking over-limit cards [#141770](https://github.com/openclaw/openclaw/pull/141770). Table-heavy cases do not share a general speedup.
+
+**Bug fixes**
+
+- Restore Feishu workspace tools in message-driven runs [#141984](https://github.com/openclaw/openclaw/pull/141984). Thanks @SunnyShu0925, @hayden-cc, @lizhengwu, @jalehman, @seven7763, @itanyplus.
+- Apply updated Feishu tool settings to new turns [#141993](https://github.com/openclaw/openclaw/pull/141993).
+- Preserve Feishu inline styles in received posts [#142627](https://github.com/openclaw/openclaw/pull/142627).
+
+**Documentation**
+
+- Organize Feishu documentation by task [#143085](https://github.com/openclaw/openclaw/pull/143085). Thanks @vincentkoc.
+
+
+
+
+
+
+##### Matrix messages and reactions
+
+
+[Matrix](https://docs.openclaw.ai/channels/matrix) keeps message text that could previously be mistaken for an attachment and disappear from quoted replies or conversation history. A mention marked as plain text also stays plain when earlier code formatting is unfinished. In the terminal, reaction lists show which emoji people used instead of leaving the label blank.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Preserve Matrix text for unknown message types [#135359](https://github.com/openclaw/openclaw/pull/135359). Thanks @teddytennant, @obviyus.
+- Show Matrix reaction labels in CLI listings [#141811](https://github.com/openclaw/openclaw/pull/141811).
+- Keep escaped Matrix mentions literal after unmatched backticks [#142369](https://github.com/openclaw/openclaw/pull/142369).
+
+**Documentation**
+
+- Organize Matrix documentation into focused guides [#142996](https://github.com/openclaw/openclaw/pull/142996). Thanks @vincentkoc.
+
+
+
+
+
+
+##### Teams message text
+
+
+Your Claw now reads punctuation and symbols correctly in [Teams messages](https://docs.openclaw.ai/channels/msteams) supplied as HTML, instead of receiving formatting codes in their place. For example, a copyright symbol arrives as © rather than the code used to represent it.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Decode HTML-only Teams message text correctly [#142496](https://github.com/openclaw/openclaw/pull/142496).
+
+**Documentation**
+
+- Organize Teams documentation into focused guides [#142986](https://github.com/openclaw/openclaw/pull/142986). Thanks @vincentkoc.
+
+
+
+
+
+
+##### Signal reply quotes
+
+
+If you set [Signal](https://docs.openclaw.ai/channels/signal) to quote your message only on the first reply, that quote now stays available when an earlier send fails. The first reply that actually arrives shows what it is answering.
+
+
+
+###### Sources and complete change list
+
+
+**Documentation**
+
+- Document Signal table modes, default bullets, and block-to-code fallback [#138160](https://github.com/openclaw/openclaw/pull/138160). Thanks @SunnyShu0925, @obviyus.
+
+**Bug fixes**
+
+- Preserve Signal quotes after failed streamed sends [#142600](https://github.com/openclaw/openclaw/pull/142600).
+
+
+
+
+
+
+##### WhatsApp reply labels
+
+
+If you use a custom label at the start of your Claw’s WhatsApp replies, it no longer gets added to messages coming from other people. Your outgoing labels still work, and incoming messages keep what the sender wrote.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Keep reply prefixes out of incoming WhatsApp messages [#138819](https://github.com/openclaw/openclaw/pull/138819). Thanks @sunlit-deng, @vincentkoc, @Jackten.
+
+
+
+
+
+
+##### iMessage conversation names
+
+
+[iMessage](https://docs.openclaw.ai/channels/imessage) conversations can show familiar contact and group names, such as Alice or Family, when that information is available. Names you assigned yourself stay in place, making it easier to find the right chat without sorting through phone numbers or technical IDs.
+
+
+
+###### Sources and complete change list
+
+
+**Documentation**
+
+- Clarify current iMessage support in maturity docs [#141963](https://github.com/openclaw/openclaw/pull/141963). Thanks @RomneyDa.
+- Organize iMessage guides by setup and messaging task [#143038](https://github.com/openclaw/openclaw/pull/143038). Thanks @vincentkoc.
+
+**Bug fixes**
+
+- Show resolved iMessage contact and group names [#142128](https://github.com/openclaw/openclaw/pull/142128). Thanks @omarshahine.
+
+
+
+
+
+
+##### Mattermost connections and progress
+
+
+For Mattermost setups that store login tokens separately from account settings, editing one account no longer unnecessarily reconnects the others; settings shared by all accounts can still restart them together. A replacement progress message also stays visible while the old one is being removed, even when both contain the same plan.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Keep other Mattermost accounts connected during settings reloads [#142193](https://github.com/openclaw/openclaw/pull/142193). Thanks @ceckert, @obviyus.
+- Preserve replacement Mattermost progress previews [#143621](https://github.com/openclaw/openclaw/pull/143621).
+
+
+
+
+
+
+##### Returning to Google Chat conversations
+
+
+Replies from a resumed Google Chat conversation can use its saved destination correctly again. This fixes a case where changing capital letters in the destination caused a permission error, even though your Claw was allowed to send there.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Preserve destination casing for resumed Google Chat replies [#140418](https://github.com/openclaw/openclaw/pull/140418). Thanks @aeoess, @obviyus, @jailbirt.
+
+
+
+
+
+
+##### Nextcloud Talk reaction delays
+
+
+When diagnostic recording is enabled, a successful Nextcloud Talk reaction no longer has to wait for that recording to finish before reporting success. The recording may be incomplete, but it no longer holds up the result.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Avoid diagnostic-capture delays in Nextcloud Talk responses [#141307](https://github.com/openclaw/openclaw/pull/141307). Thanks @hugenshen, @obviyus.
+
+
+
+
+
+
+##### Missing Tlon setup details
+
+
+If a Tlon message cannot send because setup is incomplete, the error now tells you which account needs attention and which settings are missing. You can go straight to the relevant part of [Tlon setup](https://docs.openclaw.ai/channels/tlon) without guessing, and the error does not reveal your login code.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Identify missing Tlon account settings in send errors [#137664](https://github.com/openclaw/openclaw/pull/137664). Thanks @ly85206559, @obviyus.
+
+
+
+
+
+
+##### Repairing older Zalo Personal settings
+
+
+If you use multiple Zalo Personal accounts with an older setup, `openclaw doctor --fix --non-interactive` can now complete a settings repair it previously skipped. Your account profiles and explicit choices about who may message the bot stay intact.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Restore Zalo Personal policy migration [#143860](https://github.com/openclaw/openclaw/pull/143860). Thanks @wangmiao0668000666, @obviyus.
+
+
+
+
+
+
+##### Choosing and managing messaging accounts
+
+
+Account lists and health checks more accurately show which accounts your agents use. [Removing an account](https://docs.openclaw.ai/cli/channels) now reports when nothing was removed, and [message-command errors](https://docs.openclaw.ai/cli/message) explain how to choose an agent when one is needed.
+
+If you use scripts, leave out `--account` and the [directory](https://docs.openclaw.ai/cli/directory) option `--limit` when you want their defaults. Passing an empty value now causes an error; a supplied limit must be a positive whole number. Removal scripts must also handle an error when nothing was removed.
+
+
+
+###### Sources and complete change list
+
+
+**Limits and compatibility**
+
+- Reject blank account options in directory commands [#137334](https://github.com/openclaw/openclaw/pull/137334). Thanks @Alix-007, @obviyus.
+- Reject explicitly empty directory listing limits [#141738](https://github.com/openclaw/openclaw/pull/141738). Thanks @hugenshen, @obviyus.
+- Reject empty account selectors in message and channel commands [#143088](https://github.com/openclaw/openclaw/pull/143088). Thanks @ly85206559, @obviyus.
+
+**Bug fixes**
+
+- Show channel account selectors correctly in agent listings [#141724](https://github.com/openclaw/openclaw/pull/141724).
+- Give message commands a working ownership remedy [#141886](https://github.com/openclaw/openclaw/pull/141886). Thanks @Dreamer-HIT, @obviyus, @schwanncells.
+- Include implicit default accounts in health output and listBoundAccountIds [#143319](https://github.com/openclaw/openclaw/pull/143319). Thanks @qingminglong, @obviyus.
+- Preserve channel subtitles before plugins load [#143416](https://github.com/openclaw/openclaw/pull/143416).
+- Reject blank directory groups before plugin setup [#143440](https://github.com/openclaw/openclaw/pull/143440).
+- Reject unknown channel accounts during removal [#143561](https://github.com/openclaw/openclaw/pull/143561). Thanks @masatohoshino, @obviyus.
+
+**Documentation**
+
+- Split channel configuration documentation into focused pages [#142910](https://github.com/openclaw/openclaw/pull/142910). Thanks @vincentkoc.
+- Correct Matrix token and restart steps, Tlon login guidance, Yuanbao App Key instructions, and plugin publishing and SDK examples [#144018](https://github.com/openclaw/openclaw/pull/144018). Thanks @vincentkoc, @sunnyiren-max.
+
+
+
+
+
+
+##### Keep talking while your Claw delegates work
+
+
+[Talk](https://docs.openclaw.ai/nodes/talk) can keep listening while another agent works on your request, then bring the finished answer back to the same voice conversation as well as chat. This also works when the task needs more than one round of help. Keep that voice conversation open to receive the spoken result; ending it or restarting OpenClaw can leave the answer available only through chat.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Keep voice follow-ups and replies with the active task [#129186](https://github.com/openclaw/openclaw/pull/129186). Thanks @vincentkoc.
+- Return delegated answers to the active Talk session [#129535](https://github.com/openclaw/openclaw/pull/129535). Thanks @vincentkoc.
+- Deliver Talk answers after repeated delegation [#142830](https://github.com/openclaw/openclaw/pull/142830).
+
+**Documentation**
+
+- Organize Talk guidance into focused pages [#143149](https://github.com/openclaw/openclaw/pull/143149). Thanks @vincentkoc.
+
+
+
+
+
+
+##### Phone interruptions and brief audio errors
+
+
+When you interrupt your Claw on a phone call, it now uses the phone service’s playback confirmation to avoid treating an answer you never heard as already spoken. GPT-Live calls through OpenClaw can also continue after an occasional recoverable audio error, though you may hear a brief gap. Repeated failures can still end the call; see the [Voice Call guide](https://docs.openclaw.ai/plugins/voice-call) for setup and troubleshooting.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Restore the default Twilio voice for certain unrecognized names [#137678](https://github.com/openclaw/openclaw/pull/137678). Thanks @teddytennant, @obviyus.
+- Keep unknown call statuses from ending active calls [#137679](https://github.com/openclaw/openclaw/pull/137679). Thanks @teddytennant, @obviyus.
+- Track confirmed phone playback when callers interrupt [#138619](https://github.com/openclaw/openclaw/pull/138619). Thanks @LiuwqGit, @obviyus, @fabiolr, @xueqingli1.
+- Keep GPT-Live calls connected after recoverable audio errors [#140702](https://github.com/openclaw/openclaw/pull/140702). Thanks @zenglingbiao, @obviyus.
+- Return clear errors for unknown voice stream paths [#141315](https://github.com/openclaw/openclaw/pull/141315). Thanks @hugenshen, @obviyus.
+
+**Documentation**
+
+- Organize Voice Call guidance into focused topic pages [#143055](https://github.com/openclaw/openclaw/pull/143055). Thanks @vincentkoc.
+
+
+
+
+
+
+
+#### Memory
+
+Memory fixes help your Claw find remembered details and return to older conversations. There is also clearer guidance when memories cannot be saved, or when deleting a conversation leaves its memories behind.
+
+
+
+
+##### Finding remembered details
+
+
+Asking for a short list of memories no longer drops a better match just because you requested fewer results. Your Claw can also keep looking when an optional search gets stuck, and a local memory-search service gets time to start before OpenClaw gives up on it. These fixes help remembered information reach your conversation without unnecessary repair steps.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Keep top memory matches consistent at small result limits [ff1d91f](https://github.com/openclaw/openclaw/commit/ff1d91f6711b301ad0bb8f8f9485bfb05d770d84). Thanks @linhongyu510.
+- Recover memory searches after manager replacement [#141879](https://github.com/openclaw/openclaw/pull/141879).
+- Preserve Active Memory recall after optional lookup timeouts [#142567](https://github.com/openclaw/openclaw/pull/142567). Thanks @ylcn91, @obviyus, @BsnizND.
+- Allow local embedding startup before timing memory searches [#143590](https://github.com/openclaw/openclaw/pull/143590). Thanks @wangmiao0668000666, @obviyus, @PeterHodl.
+- Skip unnecessary recall for agent deliveries [#143903](https://github.com/openclaw/openclaw/pull/143903). Thanks @LiuwqGit, @obviyus, @kiagentkronos-cell, @syfvb.
+
+
+
+
+
+
+##### Setting up memory search
+
+
+OpenClaw can wait through temporary limits from your memory-search provider and use the right model when it switches to your configured backup. It also stops telling you to rebuild working memory search just because the main provider has recovered. If you change to an incompatible model, you still need to rebuild with `openclaw memory index --force`.
+
+Mac users running OpenClaw with Bun can enable native memory search with `brew install sqlite`. If you previously used a custom SQLite startup script, replace it with the `OPENCLAW_SQLITE_LIBRARY` setting to avoid a startup failure.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Enable native memory search with Homebrew SQLite on macOS Bun; replace custom SQLite preloads with `OPENCLAW_SQLITE_LIBRARY`, and replace the removed `OPENCLAW_CLAUDE_CLI_LOG_OUTPUT` alias with `OPENCLAW_CLI_BACKEND_LOG_OUTPUT` [#141854](https://github.com/openclaw/openclaw/pull/141854).
+
+**Bug fixes**
+
+- Respect provider cooldowns during memory indexing [#134959](https://github.com/openclaw/openclaw/pull/134959). Thanks @shojikumaru, @obviyus, @developercrocodiles.
+- Use the fallback provider's model for memory embeddings [#142364](https://github.com/openclaw/openclaw/pull/142364). Thanks @Yigtwxx, @obviyus.
+- Recognize fallback-built indexes in deep memory status [#142609](https://github.com/openclaw/openclaw/pull/142609). Thanks @Yigtwxx, @obviyus.
+
+
+
+
+
+
+##### Choosing what becomes long-term memory
+
+
+With the default settings, a note no longer becomes long-term memory simply because OpenClaw repeatedly encounters it during background scans. It must also turn up in different memory searches, helping keep incidental notes from being saved just because they keep appearing. After updating, some older notes may take longer to qualify, while memories already saved stay in place.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Require distinct recall queries for automatic memory promotion; configurations with `minUniqueQueries=0` retain their existing allowance [#119624](https://github.com/openclaw/openclaw/pull/119624). Thanks @pcpilot-dev, @RomneyDa, @sunnyandtec-ak, @zachisfine.
+
+
+
+
+
+
+##### Returning to older conversations
+
+
+[Session search](https://docs.openclaw.ai/concepts/session-search) can now open saved messages from before a conversation reset, taking you back to the original discussion instead of an empty page. Fixes also help queued replies continue after OpenClaw shortens a long conversation, so you can pick up where you left off.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Reduce temporary memory during long-conversation checks [#143175](https://github.com/openclaw/openclaw/pull/143175).
+
+**Bug fixes**
+
+- Open retained session search results after a reset [#141437](https://github.com/openclaw/openclaw/pull/141437). Thanks @VACInc.
+- Accept redundant offsets in anchored session-history requests [#141664](https://github.com/openclaw/openclaw/pull/141664). Thanks @FlagshipClaw, @obviyus, @VACInc, @brainatworkharris.
+- Prevent lost replies after compaction and session handoff [#141718](https://github.com/openclaw/openclaw/pull/141718). Thanks @VACInc.
+- Avoid full-history reads for delivery confirmations [#142453](https://github.com/openclaw/openclaw/pull/142453). Thanks @VACInc, @todddickerson.
+- Keep memory maintenance within the conversation context budget [#143193](https://github.com/openclaw/openclaw/pull/143193). Thanks @KirDE, @obviyus.
+
+
+
+
+
+
+##### Knowing what was saved or forgotten
+
+
+Deleting a conversation now tells you when its saved history can still appear in memory search and shows the command for [forgetting those memories](https://docs.openclaw.ai/cli/memory#memory-forget). Forgetting remains a separate step, which you need to run on the computer hosting OpenClaw, even if you deleted the conversation remotely.
+
+When an automatic memory save lacks permission to write, the logs now name the file it could not save. They also explain more reasons why [Active Memory](https://docs.openclaw.ai/concepts/active-memory) skipped a search, making missing memories easier to investigate. These are clearer warnings, so a reported save problem still needs attention.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Warn when memory flushes cannot write their target file [#127031](https://github.com/openclaw/openclaw/pull/127031). Thanks @ayaangazali, @fede-kamel, @vincentkoc.
+- Show selected recall-skip reasons in default logs [#138658](https://github.com/openclaw/openclaw/pull/138658). Thanks @DasX, @obviyus, @Oliverbot26.
+- Explain memory cleanup after deleting a session [#141841](https://github.com/openclaw/openclaw/pull/141841). Thanks @glenn-agent, @obviyus, @dh-js, @he-yufeng.
+- Check memory readiness while agent databases are busy [#142361](https://github.com/openclaw/openclaw/pull/142361).
+- Avoid unnecessary Doctor refusals for shared-memory layouts; preserve edited archives without importing their changes, and defer later event generations in that workspace [#143138](https://github.com/openclaw/openclaw/pull/143138).
+
+**Documentation**
+
+- Explain tool grants for Lossless Claw recall [#142705](https://github.com/openclaw/openclaw/pull/142705). Thanks @MasterSwords1, @obviyus, @guarismo.
+- Split Active Memory guidance into task-specific pages [#143057](https://github.com/openclaw/openclaw/pull/143057). Thanks @vincentkoc.
+
+
+
+
+
+
+##### Keep conversation-history plugins working
+
+
+If you use a [plugin to manage conversation history](https://docs.openclaw.ai/concepts/context-engine), summaries are less likely to fail because a connection closed too soon. OpenClaw also avoids unexpectedly switching to a backup plugin while a turn starts. Cancelling can still stop further changes to the conversation while the plugin finishes closing its connections.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Keep background compaction resources through cleanup [#143426](https://github.com/openclaw/openclaw/pull/143426).
+- Retain context engines through turn cleanup [#143491](https://github.com/openclaw/openclaw/pull/143491).
+- Keep compaction databases open through pending cleanup [#143592](https://github.com/openclaw/openclaw/pull/143592).
+- Keep copied context engines available through cleanup [#143626](https://github.com/openclaw/openclaw/pull/143626).
+- Keep compaction tool services available through outstanding work [#143633](https://github.com/openclaw/openclaw/pull/143633).
+
+
+
+
+
+
+##### Using memories added by other tools
+
+
+If another tool adds memories to your [LanceDB memory extension](https://docs.openclaw.ai/plugins/memory-lancedb), your Claw can find them on its next search without restarting OpenClaw. You can also list or delete those newly added memories without first having to make a change from inside OpenClaw.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Refresh LanceDB reads after external memory writes [#137806](https://github.com/openclaw/openclaw/pull/137806). Thanks @azuretek, @obviyus.
+
+**Documentation**
+
+- Clarify the existing LanceDB requirements for OpenClaw host version `>=2026.5.31` and plugin API `>=2026.9.3`, which must both pass [#142827](https://github.com/openclaw/openclaw/pull/142827). Thanks @obviyus, @ly85206559.
+
+
+
+
+
+
+
+#### Skills
+
+Skills give your Claw reusable instructions for the work you do together. This update makes them easier to find and set up, and lets you watch and guide your Claw as it looks for ways to improve skills using past conversations.
+
+
+
+
+##### Search installed skills and ClawHub together
+
+
+The [Skills page](https://docs.openclaw.ai/tools/skills) now searches your installed skills and ClawHub together, so you can see what you already have and what you can add without checking separate places. Cards show which skills are ready or need setup, and switching agents shows the skills available to that agent. You can also browse popular skills without typing a search, while clearer titles and readable descriptions make it easier to choose.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Search installed skills and ClawHub together [#143758](https://github.com/openclaw/openclaw/pull/143758). Thanks @Patrick-Erichsen.
+
+**Bug fixes**
+
+- Find repository skills in separate execution workspaces [#141966](https://github.com/openclaw/openclaw/pull/141966). Thanks @obviyus.
+- Show and find skills by their actual titles [#142535](https://github.com/openclaw/openclaw/pull/142535).
+- Keep ClawHub details and changelogs readable in dialogs [#142555](https://github.com/openclaw/openclaw/pull/142555). Thanks @vyctorbrzezowski.
+
+
+
+
+
+
+##### Import, install, and read skills
+
+
+When importing a skill, you can now see which files you selected and clear them before continuing. Skill windows fit the screen and keep Close within reach, making longer instructions easier to read on a phone. Installations that need more time to download or set up supporting software can also finish without being cut off as early.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Show and clear selected files during skill import [#142540](https://github.com/openclaw/openclaw/pull/142540). Thanks @vyctorbrzezowski.
+
+**Bug fixes**
+
+- Fit skill dialogs to content with compact Close controls [#142550](https://github.com/openclaw/openclaw/pull/142550). Thanks @vyctorbrzezowski.
+- Allow slower Control UI skill dependency installs to finish [#143000](https://github.com/openclaw/openclaw/pull/143000). Thanks @gozu, @obviyus.
+
+
+
+
+
+
+##### Learn from past conversations in a visible chat
+
+
+Choose “Learn from past conversations” in [Skill Workshop](https://docs.openclaw.ai/tools/skill-workshop) to open a chat where you can follow the work, add direction, or stop it. Auto lets your Claw apply improvements based on what it finds, while Propose leaves suggestions for you to approve. Starting this yourself does not turn on automatic self-learning, and normal model charges and access permissions still apply.
+
+Old unfinished history scans cannot resume in the new flow, so start a new learning chat instead. Your installed skills and existing proposals stay available. Workshop also explains when automatic weekly reviews are paused because scheduling is off and takes you to the setting.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Learn from past conversations in a steerable chat [#142909](https://github.com/openclaw/openclaw/pull/142909). Thanks @obviyus.
+- Explain paused weekly skill reviews [#142840](https://github.com/openclaw/openclaw/pull/142840). Thanks @obviyus.
+
+**Bug fixes**
+
+- Ground Workshop review targets and restore the Team Reports listing [#141575](https://github.com/openclaw/openclaw/pull/141575).
+
+**Documentation**
+
+- Split Skill Workshop documentation into focused guides [#143079](https://github.com/openclaw/openclaw/pull/143079). Thanks @vincentkoc.
+
+
+
+
+
+
+##### Keep current skill instructions available
+
+
+After restarting OpenClaw, you can continue an existing conversation with updated local skill files on its next turn. Skill lists also pick up newly installed or repaired files more reliably. Skills selected from a managed library keep their chosen version until you refresh them.
+
+New Workshop changes preserve the full descriptions that help your Claw recognize when to use a skill, instead of replacing them with short change labels. This protects future edits, but does not restore descriptions already lost or repair older pending proposals.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Refresh session skills after Gateway restarts [#122110](https://github.com/openclaw/openclaw/pull/122110). Thanks @sappkevin, @obviyus, @kashivreddy, @aspalagin.
+- Preserve full skill descriptions through Workshop updates [#140864](https://github.com/openclaw/openclaw/pull/140864). Thanks @LiuwqGit, @obviyus, @XX441, @laisonamarante, @RuiCatalao7, @thomasmoenco.
+- Refresh skill availability after installs and edits [#141979](https://github.com/openclaw/openclaw/pull/141979). Thanks @RomneyDa.
+- Show repaired skills on the first status check [#142123](https://github.com/openclaw/openclaw/pull/142123). Thanks @ericcaiwx-star, @aspalagin, @obviyus.
+- Clarify how agents should make requested repository skill edits outside Workshop [#142844](https://github.com/openclaw/openclaw/pull/142844). Thanks @Finn763, @obviyus, @jmissig.
+- Give sandboxed plugin agents readable skill paths [#143291](https://github.com/openclaw/openclaw/pull/143291). Thanks @sallyom, @sercada, @Artemeey.
+
+
+
+
+
+
+##### Use skills on cloud and remote computers
+
+
+If your Claw works on a cloud or SSH-connected computer, it now spends less time copying skills before starting, especially when you have lots of small skill files. Cloud workers can also use supported links between instruction files within the same local skill, so you do not have to duplicate those files just to get the skill working there.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Batch skill transfers before remote turns [#142440](https://github.com/openclaw/openclaw/pull/142440).
+
+**Bug fixes**
+
+- Deliver contained skill file aliases to cloud workers [#143378](https://github.com/openclaw/openclaw/pull/143378).
+
+
+
+
+
+
+##### Fix Workshop problems after updating
+
+
+Doctor can repair several known Workshop problems that stopped upgrades or prevented OpenClaw from starting. Run `openclaw doctor --fix` when startup asks for it. Proposals and backups that need you to identify their agent remain available for review while other repairs continue. Some older review history may be discarded if its agent cannot be identified, and affected proposals may need reviewing again.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Repair the legacy Workshop review index with Doctor [1e7797ad9836](https://github.com/openclaw/openclaw/commit/1e7797ad983683a3cd691887f1b398164ddc6282). Thanks @jjjhenriksen, @RomneyDa.
+- Continue Doctor repairs while preserving ambiguous Workshop artifacts [#143141](https://github.com/openclaw/openclaw/pull/143141). Thanks @fahrenhe1t, @GitHoubi, @cjn119-ui, @obviyus.
+- Repair recognized unfinished Workshop database upgrades [#143153](https://github.com/openclaw/openclaw/pull/143153). Thanks @syfvb, @pbergeot, @rjamoul, @cjn119-ui.
+- Ignore retired Workshop jobs during Doctor preflight [#143325](https://github.com/openclaw/openclaw/pull/143325). Thanks @cjn119-ui, @jerabinovich, @obviyus.
+
+
+
+
+
+
+##### Replace the retired video-frames helper
+
+
+The bundled `video-frames` skill and its helper script have been removed. If you use them to save still images from videos, switch to `ffmpeg` directly or install a separate frame-extraction skill. OpenClaw's video understanding can analyze a video, but does not produce those image files for you, and existing workflows are not converted automatically.
+
+
+
+###### Sources and complete change list
+
+
+**Limits and compatibility**
+
+- Retire the bundled video-frames skill and helper [#142232](https://github.com/openclaw/openclaw/pull/142232).
+
+
+
+
+
+
+
+#### Native Apps
+
+The Android app helps you keep your place while reading, see what your Claw has done, and reply from notifications. There are also clearer ways to reconnect the mobile apps, fixes for Mac setup, and changes that keep a sleeping Linux desktop from interrupting OpenClaw on another computer.
+
+
+
+
+##### Read Android conversations and follow work
+
+
+The [Android app](https://docs.openclaw.ai/platforms/android) keeps your place while a reply arrives or you resize the window. Read earlier messages without being pulled away, then use Jump to latest to catch up. You can also open tool details to see what your Claw did, while dashboard chats tuck completed steps away and leave the answer visible.
+
+Search and the sidebar show which conversation is busy, and a failed refresh keeps the conversations you already loaded. On folding phones, model settings and background tasks stay clear of the fold.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Translate Android chat-readiness messages [#142267](https://github.com/openclaw/openclaw/pull/142267).
+- Translate Android readiness and empty-state labels [#143203](https://github.com/openclaw/openclaw/pull/143203).
+- Refresh Android chat and activity translations [#143397](https://github.com/openclaw/openclaw/pull/143397).
+
+**Bug fixes**
+
+- Keep Android reading position while replies grow, and reveal expanded messages and code endpoints [#140759](https://github.com/openclaw/openclaw/pull/140759).
+- Show Android session refresh errors without losing loaded pages [#141603](https://github.com/openclaw/openclaw/pull/141603).
+- Keep Android Thinking and Fast controls clear of folds [#141860](https://github.com/openclaw/openclaw/pull/141860). Thanks @vincentkoc.
+- Thread activity labels follow the right conversation [#141883](https://github.com/openclaw/openclaw/pull/141883).
+- Keep Background Tasks inside foldable panes [#141899](https://github.com/openclaw/openclaw/pull/141899). Thanks @vincentkoc.
+- Keep matching Android threads in view [#142046](https://github.com/openclaw/openclaw/pull/142046).
+- Distinguish Android chat readiness from Gateway disconnection [#142182](https://github.com/openclaw/openclaw/pull/142182).
+- Keep Android branch choices inside usable fold panes [#142418](https://github.com/openclaw/openclaw/pull/142418). Thanks @vincentkoc.
+- Restore Android tool activity and fold completed work [#142810](https://github.com/openclaw/openclaw/pull/142810). Thanks @ansxor, @IWhatsskill.
+- Distinguish Android chat readiness from Gateway connection status [#143128](https://github.com/openclaw/openclaw/pull/143128).
+
+
+
+
+
+
+##### Reply from Android notifications
+
+
+Android notification replies reconnect to the saved computer for that conversation when needed. The notification now tells you whether a reply is queued, failed, or has an unknown status. Queued confirms that the app saved your reply for sending; it does not confirm delivery. If the result is unknown, open the conversation before sending again. You may still need to approve a connection-security prompt before the reply can proceed.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Translate Android reply status messages [#143928](https://github.com/openclaw/openclaw/pull/143928).
+
+**Bug fixes**
+
+- Keep notification actions on their saved Gateway, clarify reply status, and leave dismissed approval feedback closed [#143812](https://github.com/openclaw/openclaw/pull/143812).
+
+
+
+
+
+
+##### Send Android attachments with their captions
+
+
+Android waits for your selected files to finish loading before enabling Send, so your message cannot go out with its caption but without the attachment. If you cancel a file or it fails to load, the caption stays in place for you to keep working on.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Wait for Android attachments before sending captions and clarify import warnings [#143162](https://github.com/openclaw/openclaw/pull/143162).
+
+
+
+
+
+
+##### Reconnect the mobile apps
+
+
+When Android or iPhone cannot reach the computer running OpenClaw, the app now explains the problem and offers Retry. iPhone retries the connection you were setting up, and connections that appear to use Tailscale show relevant setup help. Android may need a moment to finish closing the previous connection before trying again.
+
+Android setup also makes the selected security option available to accessibility tools. When your Claw checks a phone or Apple Watch battery, the result now includes a clear percentage, helping avoid confusion between a full charge and one percent.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Refresh native connection and recovery translations [#142807](https://github.com/openclaw/openclaw/pull/142807).
+
+**Bug fixes**
+
+- Add explicit battery percentages to mobile status responses [#141069](https://github.com/openclaw/openclaw/pull/141069). Thanks @NullArbitrage, @obviyus.
+- Expose Android connection-security selection to assistive services [#142131](https://github.com/openclaw/openclaw/pull/142131).
+- Show mobile connection failures with targeted retry actions [#142651](https://github.com/openclaw/openclaw/pull/142651). Thanks @vincentkoc.
+
+
+
+
+
+
+##### Find the official mobile apps
+
+
+You can now reach the official App Store listing straight from the [iPhone setup guide](https://docs.openclaw.ai/platforms/ios). If you install Android outside Google Play, the [Android guide](https://docs.openclaw.ai/platforms/android) helps you find the app download and check that the file is intact. Downloads are attached to selected releases and may appear later than the release itself.
+
+
+
+###### Sources and complete change list
+
+
+**Documentation**
+
+- Find Android release downloads with both APK and checksum [#141762](https://github.com/openclaw/openclaw/pull/141762). Thanks @xiaoguomeiyitian, @obviyus, @tomdailey55.
+- Link the official iPhone app from its setup guide [#142132](https://github.com/openclaw/openclaw/pull/142132). Thanks @mgabor3141, @obviyus.
+
+
+
+
+
+
+##### Understand the iPhone conversation count
+
+
+The iPhone app now makes clear how many conversations are showing and how many there are in total, including in its translated messages. If some have not loaded yet, use Refresh to load the rest.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Clarify displayed and total iOS session counts [#142324](https://github.com/openclaw/openclaw/pull/142324).
+- Clarify localized iOS session counts; carried Wear OS typing and hold hints retain known translation errors [#142381](https://github.com/openclaw/openclaw/pull/142381).
+
+
+
+
+
+
+##### Set up and change Mac connections
+
+
+Choosing Set up later or clearing a connection on Mac now stays saved instead of bringing back the old connection when you reopen the app. If saving fails, the app tells you. Password-protected connections also show where to enter the password and try again. Older OpenClaw installations on the other computer need updating to accept a password in the field labeled Gateway token.
+
+If you prepare Mac setup from the command line, you can now read a password or token from a private file without putting it in the command itself. Setup also respects the profile you chose instead of changing the default profile. The [remote setup guide](https://docs.openclaw.ai/platforms/mac/remote) explains these options and the separate command to use when the app is already running.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Show password recovery during macOS remote onboarding [#141857](https://github.com/openclaw/openclaw/pull/141857).
+- Preserve Gateway clearing and accept file-based macOS setup credentials [#141872](https://github.com/openclaw/openclaw/pull/141872).
+- Honor selected macOS profiles in offline remote setup [#142163](https://github.com/openclaw/openclaw/pull/142163).
+
+**Documentation**
+
+- Refresh translated Gateway password instructions [#141906](https://github.com/openclaw/openclaw/pull/141906).
+- Translate Gateway settings save-failure guidance [#141962](https://github.com/openclaw/openclaw/pull/141962).
+
+
+
+
+
+
+##### Close a Mac side-panel tab with Command-W
+
+
+When you are using a side-panel tab in the Mac app, Command-W now closes that tab and leaves the main window open. You can press it again to close the next tab. When you are working in the main chat instead, the shortcut still closes the window as usual.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Close focused macOS side-panel tabs with Cmd+W [#142634](https://github.com/openclaw/openclaw/pull/142634). Thanks @Patrick-Erichsen.
+
+
+
+
+
+
+##### Troubleshoot Mac startup and repeated restarts
+
+
+If OpenClaw fails to start on Mac, its service log can now include errors that used to disappear before normal logging began. Existing installations need their background service setup refreshed before these errors appear in the log. The [Mac troubleshooting guide](https://docs.openclaw.ai/platforms/mac/bundled-gateway) explains the setup and where to look.
+
+Status and Doctor can also point out background jobs that may be repeatedly restarting OpenClaw. These checks can flag a job incorrectly, so review it before removing anything.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Diagnose stray macOS Gateway restart jobs [#142230](https://github.com/openclaw/openclaw/pull/142230). Thanks @piotx, @rondavis007, @jodok, @jarvismazz.
+- Preserve macOS Gateway startup errors in the service log [#143519](https://github.com/openclaw/openclaw/pull/143519). Thanks @RomneyDa, @Enominera, @igs-rogenlo, @lonexreb.
+
+
+
+
+
+
+##### Keep Linux connections and updates working
+
+
+Putting your Linux desktop to sleep no longer tells OpenClaw on another computer to pause, including when you connect over SSH. Saved SSH connections also use their configured port. If you keep a password or token in a separate file or environment setting, reconnecting preserves that setup so later launches can read the updated secret. Settings overwritten by an older version still need to be restored manually.
+
+The [Linux companion](https://docs.openclaw.ai/platforms/linux) also keeps update notices and tray actions available while you are using the dashboard. An update that is ready to install stays available for another try if a later check or download fails.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Keep desktop update notices and retry actions available [#121938](https://github.com/openclaw/openclaw/pull/121938). Thanks @vincentkoc.
+- Honor SSH alias ports in the Linux companion [#142900](https://github.com/openclaw/openclaw/pull/142900). Thanks @vincentkoc.
+- Keep Linux sleep from suspending remote Gateways [#142913](https://github.com/openclaw/openclaw/pull/142913). Thanks @vincentkoc.
+
+**Security and trust**
+
+- Preserve remote credential references on Linux reconnect [#142907](https://github.com/openclaw/openclaw/pull/142907). Thanks @vincentkoc.
+
+**Documentation**
+
+- Correct the Linux companion maturity description [#141955](https://github.com/openclaw/openclaw/pull/141955). Thanks @RomneyDa.
+
+
+
+
+
+
+##### Hear explanations that include code
+
+
+An explanation with a little code in it can now be read aloud instead of being skipped or replaced with a message to look at the screen. This applies to [spoken replies](https://docs.openclaw.ai/tools/tts) and [Talk](https://docs.openclaw.ai/nodes/talk) when speech is enabled. Answers that are mostly code still follow the existing rules for keeping that content on screen.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Speak ordinary Markdown explanations while retaining code-heavy reply fallback [#142415](https://github.com/openclaw/openclaw/pull/142415).
+
+
+
+
+
+
+
+#### Models and Providers
+
+You have more choices for making images and transcribing voice notes, and choosing the model behind your Claw is easier too. Model menus are searchable, saved choices keep the right settings, and the controls stop offering options a model cannot use. For people working with Codex, Claude, or their own AI server, there are also fixes for missing instructions, interrupted work, and confusing sign-in failures.
+
+
+
+
+##### Model lists from the right Gateway
+
+
+If you connect to more than one Gateway, the [model list](https://docs.openclaw.ai/concepts/models) now follows the Gateway and agent you selected, so you see the choices for the place where your work will run. Browsing the list no longer starts another search for models in the background. Refresh checks for new choices, and a failed refresh shows a warning while keeping compatible saved choices available. Update the Gateway before updating a separate command-line client. Updates to OpenClaw's model-and-price reference still need a Gateway restart before they take effect.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Browse the selected Gateway's model inventory [#142063](https://github.com/openclaw/openclaw/pull/142063). Thanks @obviyus.
+- Reduce first-use Copilot metadata loading [#142134](https://github.com/openclaw/openclaw/pull/142134)
+- Load less session code during model discovery [#143146](https://github.com/openclaw/openclaw/pull/143146). Thanks @vincentkoc.
+- Avoid unused preparation when browsing models [#144095](https://github.com/openclaw/openclaw/pull/144095)
+
+**Bug fixes**
+
+- Refresh model availability after token expiry or cooldown [#141727](https://github.com/openclaw/openclaw/pull/141727). Thanks @obviyus.
+- Show when refreshed model information needs a restart [#141885](https://github.com/openclaw/openclaw/pull/141885). Thanks @obviyus.
+- Warn about incomplete model refreshes [#141951](https://github.com/openclaw/openclaw/pull/141951). Thanks @obviyus.
+- Keep inference model inspection within the agent catalog [#142367](https://github.com/openclaw/openclaw/pull/142367). Thanks @obviyus.
+- Stop model selection from triggering extra provider discovery [#142375](https://github.com/openclaw/openclaw/pull/142375). Thanks @obviyus.
+- Keep internal catalog reads passive and forward explicit refreshes [#142557](https://github.com/openclaw/openclaw/pull/142557). Thanks @obviyus.
+- Restore public SDK model discovery defaults [#142620](https://github.com/openclaw/openclaw/pull/142620). Thanks @obviyus.
+- Clear stale catalog warnings when the source changes [#142622](https://github.com/openclaw/openclaw/pull/142622). Thanks @obviyus.
+- Keep saved models visible after startup [#142766](https://github.com/openclaw/openclaw/pull/142766). Thanks @obviyus.
+- Avoid unrelated provider loading during cold session resets [#143254](https://github.com/openclaw/openclaw/pull/143254)
+- Keep model catalog resources through asynchronous reads [#143492](https://github.com/openclaw/openclaw/pull/143492)
+
+**Documentation**
+
+- Clarify model status and catalog refresh guidance [#141927](https://github.com/openclaw/openclaw/pull/141927). Thanks @obviyus.
+- Translate model-refresh retry guidance [#142000](https://github.com/openclaw/openclaw/pull/142000)
+- Fix the model guide's Gateway catalog link [#142379](https://github.com/openclaw/openclaw/pull/142379). Thanks @vincentkoc.
+
+
+
+
+
+
+##### Keep the model you chose
+
+
+Saved model choices are less likely to change unexpectedly, particularly when custom models have almost identical names. Each keeps its own settings for images, tools, and the amount of text it can handle. Chats started from another chat also show the model they actually inherit, and choosing Default stays in place after a restart. Default follows the configured model and its backups; explicitly choosing a particular model keeps the chat pinned to that choice.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Align child-session model display and routing [#131805](https://github.com/openclaw/openclaw/pull/131805); contextual [#86174](https://github.com/openclaw/openclaw/issues/86174). Thanks @jalehman, @rqlangley, @wpu911.
+- Resolve Anthropic aliases consistently across status and permissions [#137376](https://github.com/openclaw/openclaw/pull/137376). Thanks @Yigtwxx, @obviyus.
+- Respect explicit visibility policies for CLI-backed models in /models [#141642](https://github.com/openclaw/openclaw/pull/141642). Thanks @IWhatsskill, @NovaUnboundAi.
+- Resolve model aliases with the selected provider plugin [#141679](https://github.com/openclaw/openclaw/pull/141679)
+- Honor the selected agent in model catalog commands [#141859](https://github.com/openclaw/openclaw/pull/141859). Thanks @obviyus.
+- Explain unavailable models before terminal selection [#142160](https://github.com/openclaw/openclaw/pull/142160). Thanks @obviyus.
+- Keep distinct model IDs and metadata visible in catalogs [#142285](https://github.com/openclaw/openclaw/pull/142285). Thanks @obviyus.
+- Show inherited models consistently across session views [#142751](https://github.com/openclaw/openclaw/pull/142751)
+- Prefer exact model metadata when aliases coexist [#143686](https://github.com/openclaw/openclaw/pull/143686)
+- Prefer exact model spelling when inferring providers [#143708](https://github.com/openclaw/openclaw/pull/143708)
+- Preserve catalog model identities and capability metadata [#143777](https://github.com/openclaw/openclaw/pull/143777)
+- Preserve distinct model entries and metadata [#143872](https://github.com/openclaw/openclaw/pull/143872)
+- Keep distinct allowed models visible [#143954](https://github.com/openclaw/openclaw/pull/143954)
+- Preserve model identities through catalog refresh [#143967](https://github.com/openclaw/openclaw/pull/143967)
+- Preserve saved model choices when reading sessions [#143975](https://github.com/openclaw/openclaw/pull/143975)
+- Preserve selected models and matching image limits [#143994](https://github.com/openclaw/openclaw/pull/143994). Thanks @elikampf.
+- Resolve configured aliases once [#143999](https://github.com/openclaw/openclaw/pull/143999)
+- Use the selected model context limit [#144009](https://github.com/openclaw/openclaw/pull/144009)
+- Use selected-model tool capabilities [#144010](https://github.com/openclaw/openclaw/pull/144010)
+- Select exact model entries before defaults [#144034](https://github.com/openclaw/openclaw/pull/144034)
+- Honor selected-model image and compaction limits [#144060](https://github.com/openclaw/openclaw/pull/144060)
+- Use selected-provider settings for tools [#144107](https://github.com/openclaw/openclaw/pull/144107)
+
+
+
+
+
+
+##### Find models and edit backup choices
+
+
+Searchable model menus make long lists easier to use without changing your choice until you select a result. Chat menus follow the account saved for that conversation, while New Session lets you preview another account you own. If a list fails to load, you can see the problem and try again.
+
+Editing backup models now preserves an inherited primary model, and removing every backup stays that way after a reload. Unavailable saved choices remain visible so you can remove them. Global defaults labels help distinguish shared settings from an individual agent's choices.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Search long model menus [#141894](https://github.com/openclaw/openclaw/pull/141894). Thanks @obviyus.
+- Match chat model choices to the saved or previewed account [#142165](https://github.com/openclaw/openclaw/pull/142165). Thanks @obviyus.
+- Translate global model settings guidance [#143449](https://github.com/openclaw/openclaw/pull/143449)
+
+**Bug fixes**
+
+- Discard unconfirmed fallback-model searches [#141953](https://github.com/openclaw/openclaw/pull/141953). Thanks @shakkernerd.
+- Preserve model inheritance when editing fallbacks [#141967](https://github.com/openclaw/openclaw/pull/141967). Thanks @shakkernerd, @najef1979-code.
+- Preserve case-sensitive fallback references [#141997](https://github.com/openclaw/openclaw/pull/141997). Thanks @shakkernerd.
+- Keep unavailable saved models visible but unselectable [#142048](https://github.com/openclaw/openclaw/pull/142048). Thanks @obviyus.
+- Load more default-model choices when pickers open [#142105](https://github.com/openclaw/openclaw/pull/142105). Thanks @xiaoguomeiyitian, @obviyus, @dh-js.
+- Restore model discovery in settings pickers [#142346](https://github.com/openclaw/openclaw/pull/142346). Thanks @vyctorbrzezowski.
+- Show failed model-list refreshes in the Control UI [#142372](https://github.com/openclaw/openclaw/pull/142372). Thanks @obviyus.
+- Avoid repeated model discovery when reopening Settings pickers [#142384](https://github.com/openclaw/openclaw/pull/142384). Thanks @vyctorbrzezowski.
+- Reduce model-picker lag with large catalogs [#142465](https://github.com/openclaw/openclaw/pull/142465)
+- Clarify global model defaults and agent settings [#143424](https://github.com/openclaw/openclaw/pull/143424). Thanks @obviyus, @schjonhaug.
+
+
+
+
+
+
+##### Thinking and Fast controls that match the model
+
+
+The Thinking menu now follows the effort levels offered by the selected model, so it no longer invents choices and correctly shows your saved Off setting. When OpenClaw knows that Fast cannot change a request, it disables that choice while still letting you clear an old preference. These controls make it clearer what you can adjust; actual speed, access, and charges still depend on the provider.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Hide thinking choices the selected model does not support [#141696](https://github.com/openclaw/openclaw/pull/141696). Thanks @obviyus.
+- Disable Fast when it cannot affect the selected request [#141852](https://github.com/openclaw/openclaw/pull/141852). Thanks @obviyus.
+- Use published model thinking choices across the UI [#142646](https://github.com/openclaw/openclaw/pull/142646). Thanks @obviyus.
+- Disable Fast choices that cannot change the request [#142682](https://github.com/openclaw/openclaw/pull/142682). Thanks @obviyus.
+- Keep thinking choices aligned with the model [#142790](https://github.com/openclaw/openclaw/pull/142790). Thanks @obviyus.
+- Preserve explicit thinking Off with empty choices [#142822](https://github.com/openclaw/openclaw/pull/142822). Thanks @obviyus.
+
+
+
+
+
+
+##### Keep custom AI connections pointed at the right server
+
+
+People using custom AI servers keep the connection settings they entered when model lists are refreshed, instead of having another model's settings take over. Manually added models also stay in the list. If you use a custom server in place of a provider's usual service, you may need to list the models it supports explicitly. Integrations must use current sign-in details or explicitly configured credentials; old credentials saved only with a downloaded model list no longer authorize requests.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Keep generated model lists out of ordinary setup for Cloudflare AI Gateway, Featherless, Hugging Face, LongCat, Meta, Mistral, NVIDIA, Synthetic, Together, Xiaomi pay-as-you-go, and Z.AI [#142202](https://github.com/openclaw/openclaw/pull/142202). Thanks @obviyus.
+
+**Bug fixes**
+
+- Honor session-affinity settings for managed OpenAI and Azure Responses proxies [#141107](https://github.com/openclaw/openclaw/pull/141107); contextual [#140918](https://github.com/openclaw/openclaw/issues/140918). Thanks @louisfy, @obviyus, @alexph-dev.
+- Preserve manual models during generated catalog refresh [#142302](https://github.com/openclaw/openclaw/pull/142302). Thanks @obviyus.
+- Preserve saved endpoints in configured model lists [#143643](https://github.com/openclaw/openclaw/pull/143643). Thanks @obviyus.
+- Preserve authored SDK routes and require current authentication instead of generated-catalog credentials [#143664](https://github.com/openclaw/openclaw/pull/143664). Thanks @obviyus.
+- Honor exact configured model settings before aliases [#143822](https://github.com/openclaw/openclaw/pull/143822)
+- Honor merged provider runtime settings [#143848](https://github.com/openclaw/openclaw/pull/143848)
+- Quiet intentional provider tuning warnings [#92288](https://github.com/openclaw/openclaw/pull/92288). Thanks @ai-hpc, @obviyus, @kingkong9817.
+
+**Limits and compatibility**
+
+- Require explicit model lists for custom provider endpoints [#142158](https://github.com/openclaw/openclaw/pull/142158). Thanks @obviyus.
+
+
+
+
+
+
+##### Reuse sign-ins and recover from login problems
+
+
+Supported OpenAI sign-in methods can reuse an account or key already saved by Codex, saving you another login or paste. Agents sharing a sign-in also handle renewal more reliably, and a renewal that finished too late for one request can help the next request succeed.
+
+If sign-in still needs attention, OpenClaw better distinguishes saved credentials from a connection that has not picked them up and tells you which computer to check. Older credentials awaiting repair no longer disable unrelated providers; use `openclaw doctor --fix` for the affected accounts.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Reuse supported Codex credentials during provider login [#142933](https://github.com/openclaw/openclaw/pull/142933). Thanks @obviyus.
+
+**Bug fixes**
+
+- Explain saved credentials and failed Gateway refresh separately [#131968](https://github.com/openclaw/openclaw/pull/131968); contextual [#131944](https://github.com/openclaw/openclaw/issues/131944). Thanks @vyctorbrzezowski, @obviyus.
+- Coordinate shared OAuth refresh without reusing consumed tokens [#141477](https://github.com/openclaw/openclaw/pull/141477). Thanks @vincentkoc, @kopl-blip, @100yenadmin.
+- Recognize scoped native Codex login during model discovery [#141759](https://github.com/openclaw/openclaw/pull/141759). Thanks @DonnieFi, @obviyus.
+- Reuse completed Codex sign-in refreshes [#142628](https://github.com/openclaw/openclaw/pull/142628). Thanks @vincentkoc, @kopl-blip, @zhuyankarl, @100yenadmin.
+- Keep OpenAI, xAI, and Copilot device sign-in links clickable in Slack [#142873](https://github.com/openclaw/openclaw/pull/142873). Thanks @obviyus.
+- Keep unrelated providers available during credential migration [#143310](https://github.com/openclaw/openclaw/pull/143310). Thanks @tskerpnext.
+- Keep model setup resources through background work [#143542](https://github.com/openclaw/openclaw/pull/143542)
+- Preserve case in model authentication evidence [#143780](https://github.com/openclaw/openclaw/pull/143780)
+
+
+
+
+
+
+##### Recover failed tool requests and explain what stopped
+
+
+When a model sends broken instructions for a tool, OpenClaw can try again instead of immediately abandoning the task. With Anthropic, it can also repair certain formatting mistakes. Retries are limited to cases where repeating the request is safe and may add cost. If earlier actions already happened, check their results before asking your Claw to continue.
+
+Errors also better distinguish connection problems, rejected sign-ins, and requests a provider cannot accept. Explanations stay in chat history, making it easier to understand why work stopped or a backup model was not tried.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Refresh backup model aliases after plugin reloads [0e1f60ec](https://github.com/openclaw/openclaw/commit/0e1f60ec03b06127ef2a7b81413f817985113ac1); contextual [#133633](https://github.com/openclaw/openclaw/pull/133633)
+- Preserve final ChatGPT events without a closing blank line [#120902](https://github.com/openclaw/openclaw/pull/120902). Thanks @zenglingbiao, @obviyus.
+- Stop retrying wrapped parameter rejections [#140991](https://github.com/openclaw/openclaw/pull/140991); contextual [#140987](https://github.com/openclaw/openclaw/issues/140987). Thanks @ooiuuii, @obviyus.
+- Repair string encoding in completed Anthropic tool arguments [#141323](https://github.com/openclaw/openclaw/pull/141323); contextual [#135111](https://github.com/openclaw/openclaw/issues/135111). Thanks @lraesly, @1Vision365-PeterTijsma, @infocus13, @peterkaynie, @jalehman, @MaxVidkrytaklishnya, @chrislro, @narbs.
+- Refresh the terminal footer when the model falls back [#141436](https://github.com/openclaw/openclaw/pull/141436). Thanks @ooiuuii.
+- Explain why a model fallback attempt stops [#141658](https://github.com/openclaw/openclaw/pull/141658). Thanks @von8794, @obviyus.
+- Show specific provider network errors after redaction [#141665](https://github.com/openclaw/openclaw/pull/141665). Thanks @SunnyShu0925, @obviyus, @DonnieFi.
+- Correct fallback warnings and preserve intentional silent replies [#141725](https://github.com/openclaw/openclaw/pull/141725). Thanks @leilei3167, @obviyus, @markthebest12.
+- Keep unfinished tool-call explanations in chat history [#141870](https://github.com/openclaw/openclaw/pull/141870). Thanks @Takhoffman.
+- Retry replay-safe malformed tool-call failures [#142176](https://github.com/openclaw/openclaw/pull/142176). Thanks @lraesly, @obviyus, @1Vision365-PeterTijsma, @peterkaynie, @infocus13, @MaxVidkrytaklishnya, @chrislro, @narbs.
+- Explain fallback stops after terminal timeouts [#142278](https://github.com/openclaw/openclaw/pull/142278). Thanks @MoerAI, @obviyus, @von8794.
+- Explain provider authentication and model errors in history and status [#143243](https://github.com/openclaw/openclaw/pull/143243)
+
+
+
+
+
+
+##### Reuse more of the prompt between requests
+
+
+Anthropic conversations that use tools can reuse more of the instructions and conversation text already processed, instead of repeatedly saving the same growing history again. Compatible local models also get a more reusable starting prompt when you begin another conversation with the same instructions and tools. This can avoid repeated processing, though any effect on waiting time or charges depends on the provider and workload.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Preserve reusable local-model prompt prefixes [#137371](https://github.com/openclaw/openclaw/pull/137371); contextual [#137257](https://github.com/openclaw/openclaw/issues/137257). Thanks @gwiltschek, @obviyus.
+- Preserve Anthropic cache reuse during tool continuations and omit empty thinking-disabled beta headers [#140621](https://github.com/openclaw/openclaw/pull/140621); contextual [#140607](https://github.com/openclaw/openclaw/issues/140607). Thanks @LightningWareLLC, @he-yufeng, @vincentkoc.
+
+
+
+
+
+
+##### Keep workspace instructions in Codex conversations
+
+
+[Codex conversations managed by OpenClaw](https://docs.openclaw.ai/plugins/codex-harness-runtime) regain workspace personality, preferences, skills, and memory guidance, including later edits. This applies to supported managed connections; other connection types keep their existing handling and may show a warning.
+
+Ordinary Codex chats can also recover a missing final answer after finishing work in a long conversation, without repeating those actions. Follow-ups keep fresh corrections without resending history already covered by a successful final reply.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Restore workspace instructions in managed Codex conversations [#142276](https://github.com/openclaw/openclaw/pull/142276). Thanks @vincentkoc.
+- Accept Codex Responses Lite requests without separate instructions [#142823](https://github.com/openclaw/openclaw/pull/142823). Thanks @jalehman.
+- Honor configured Codex workspace instruction limits [#142932](https://github.com/openclaw/openclaw/pull/142932). Thanks @ashawwal, @obviyus.
+- Recover final answers after tool work in long Codex conversations [#143081](https://github.com/openclaw/openclaw/pull/143081). Thanks @barbarhan, @obviyus.
+- Avoid repeated Codex history after final message delivery [#143506](https://github.com/openclaw/openclaw/pull/143506). Thanks @sunlit-deng, @dbarbatti, @obviyus.
+
+**Documentation**
+
+- Split the Codex harness reference by topic [#142803](https://github.com/openclaw/openclaw/pull/142803). Thanks @vincentkoc.
+- Split Codex runtime guidance into focused pages [#143458](https://github.com/openclaw/openclaw/pull/143458). Thanks @vincentkoc.
+
+
+
+
+
+
+##### Return to Claude and other coding-agent conversations
+
+
+Returning to a Claude conversation keeps its original chat connection and avoids a repeated user message in the affected resume cases. Claude can also stay running between turns when a skill check finds that nothing changed. In Codex chats with a fixed model choice, pasted text now reaches the agent instead of being lost.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Reduce cold setup for Anthropic CLI history [#142801](https://github.com/openclaw/openclaw/pull/142801)
+
+**Bug fixes**
+
+- Preserve Claude session identity when combining duplicate history [#130494](https://github.com/openclaw/openclaw/pull/130494); contextual [#130456](https://github.com/openclaw/openclaw/issues/130456). Thanks @jalehman.
+- Complete valid ACP forms with no fields [#133269](https://github.com/openclaw/openclaw/pull/133269). Thanks @xydt-juyaohui, @obviyus.
+- Keep ACP startup waits consistent through clock changes [#137303](https://github.com/openclaw/openclaw/pull/137303). Thanks @qingminglong, @obviyus.
+- Forward effective Fast settings to CLI plugins and preserve the selected account [#138667](https://github.com/openclaw/openclaw/pull/138667). Thanks @Szqub, @obviyus.
+- Keep Codex operation timeouts stable through clock corrections [#141071](https://github.com/openclaw/openclaw/pull/141071); contextual [#141000](https://github.com/openclaw/openclaw/issues/141000). Thanks @ooiuuii, @obviyus.
+- Restore pasted text in model-locked Codex sessions [#142021](https://github.com/openclaw/openclaw/pull/142021). Thanks @RomneyDa.
+- Avoid duplicate user turns after Claude resume [#143960](https://github.com/openclaw/openclaw/pull/143960). Thanks @Marvinthebored, @Peetiegonzalez, @obviyus.
+
+**Documentation**
+
+- Split ACP guidance by task [#142958](https://github.com/openclaw/openclaw/pull/142958). Thanks @vincentkoc.
+
+
+
+
+
+
+##### Use the right conversation limit for local models
+
+
+If you run models on your own server, OpenClaw now uses the conversation size reported by vLLM, SGLang, and compatible services instead of falling back to a potentially wrong limit. That helps it budget how much text to send to the model, while any limit you entered yourself still takes priority. Opening vLLM model information for the first time also avoids some unnecessary loading work.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Use advertised context limits for self-hosted models [#141113](https://github.com/openclaw/openclaw/pull/141113). Thanks @vincentkoc.
+- Avoid unnecessary loading for first-use vLLM model information [#142125](https://github.com/openclaw/openclaw/pull/142125)
+
+**Documentation**
+
+- Organize Ollama documentation into focused guides [#143004](https://github.com/openclaw/openclaw/pull/143004). Thanks @vincentkoc.
+
+
+
+
+
+
+##### Try Tencent Hy4 preview
+
+
+Tencent users can choose Hy4 preview through TokenHub or TokenPlan, and new setups select it by default when the account has access. Existing model choices stay in place, so an upgrade does not silently switch you to the preview. Its thinking options are Off or High; selecting an intermediate level such as Low uses High, which can affect waiting time and usage.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Add Hy4 preview to Tencent TokenHub and TokenPlan [#131598](https://github.com/openclaw/openclaw/pull/131598). Thanks @chl-0537, @hxy91819.
+
+
+
+
+
+
+##### Grok 4.6 becomes the default for new setups
+
+
+New xAI setups use Grok 4.6, as do xAI web search, X search, and code-execution tools when you have not chosen a model for them. Your explicit choices stay in place, but the new tool default can change cost or availability for your account. If an older subscription setup still uses the retired Auto choice, run `openclaw doctor --fix` or select an available model yourself.
+
+
+
+###### Sources and complete change list
+
+
+**Limits and compatibility**
+
+- Use Grok 4.6 defaults and repair retired subscription auto selections [#142136](https://github.com/openclaw/openclaw/pull/142136). Thanks @obviyus.
+
+
+
+
+
+
+##### Make one-off OpenCode requests
+
+
+OpenCode Go and Zen requests made outside an ongoing conversation no longer fail just because the service needs session information that was missing. OpenClaw supplies it automatically for the supported direct connections, including requests from the command line and supported integrations. Custom server connections keep their existing requirements.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Supply routing identity for sessionless OpenCode Go calls [#143558](https://github.com/openclaw/openclaw/pull/143558). Thanks @RomneyDa.
+- Supply routing identity for standalone OpenCode completions [#143659](https://github.com/openclaw/openclaw/pull/143659). Thanks @HAPPYFAPTAIN, @obviyus, @GDXbsv, @spectrl.
+- Preserve routing with explicit OpenCode sessions [#143890](https://github.com/openclaw/openclaw/pull/143890). Thanks @vincentkoc.
+
+
+
+
+
+
+##### Use your saved OpenRouter account with Arcee
+
+
+If you use Arcee through OpenRouter, OpenClaw now uses your matching saved OpenRouter account instead of asking for a separate Arcee credential. Your model settings stay attached to that choice, and different spellings of the same Arcee model stop looking like an unexpected model switch.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Use the selected Arcee account and preserve model settings [#142898](https://github.com/openclaw/openclaw/pull/142898). Thanks @obviyus.
+
+
+
+
+
+
+##### Tell a Kimi quota limit from a bad key
+
+
+When Kimi explicitly reports that you have used up a weekly allowance, OpenClaw no longer treats your valid key as broken. It can try a configured backup without unnecessarily blocking the provider's other models. Changing the key will not restore the allowance, though; wait for Kimi's quota window or use another provider with available capacity.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Treat explicit Kimi quota failures as rate limits [#142656](https://github.com/openclaw/openclaw/pull/142656). Thanks @RileyJJY, @obviyus, @rico007, @shaozhengkun123.
+
+
+
+
+
+
+##### Generate and edit with GPT Image 2.5
+
+
+You can [generate and edit images](https://docs.openclaw.ai/tools/image-generation) with GPT Image 2.5 Flare or Sunburst through OpenAI or fal, including custom sizes, higher quality settings, and transparent PNG or WebP output. Edits can use up to five reference images through OpenAI or sixteen through fal, and either route can return up to four images.
+
+Direct [OpenAI access](https://docs.openclaw.ai/providers/openai/image-and-video#gpt-image-2.5) needs an API key, selected explicitly if you already use a ChatGPT sign-in; fal needs its own credentials. Your default image model stays unchanged, so choose one of the new variants when you want to use it.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Add GPT Image 2.5 Flare and Sunburst through OpenAI [#143068](https://github.com/openclaw/openclaw/pull/143068). Thanks @vincentkoc.
+- Add GPT Image 2.5 through fal with 16-reference editing [#143069](https://github.com/openclaw/openclaw/pull/143069). Thanks @vincentkoc.
+
+
+
+
+
+
+##### Turn voice notes into text with Deepgram Flux
+
+
+You can now choose [Deepgram Flux](https://docs.openclaw.ai/providers/deepgram) to turn incoming voice notes into text your Claw can use, with English and multilingual options. Install ffmpeg on the computer running OpenClaw before selecting Flux. This is an optional choice in the existing audio settings; Nova remains the default.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Transcribe voice notes with Deepgram Flux [#141836](https://github.com/openclaw/openclaw/pull/141836). Thanks @obviyus, @safzanpirani.
+
+
+
+
+
+
+##### Use Gemini 3.6 Flash for web search
+
+
+Gemini web search now uses Gemini 3.6 Flash unless you chose a specific search model, helping accounts that could no longer use the old default. Your main chat model stays unchanged. Check the billing difference when upgrading, because Gemini 3 charges for each search query rather than once per prompt. There is also clearer help for [setting up Kimi search](https://docs.openclaw.ai/tools/kimi-search) and [using Ollama cloud search while keeping model conversations local](https://docs.openclaw.ai/tools/ollama-search).
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Use Gemini 3.6 Flash for unconfigured web searches [#111964](https://github.com/openclaw/openclaw/pull/111964); contextual [#96974](https://github.com/openclaw/openclaw/issues/96974). Thanks @dillona, @vincentkoc, @anguslogan01.
+
+**Documentation**
+
+- Document search plugin installation and restarts, local Ollama model routing, browser ports, optional jq, /tell, patch syntax, approval inspection, node selection, reactions, and screen availability [#143856](https://github.com/openclaw/openclaw/pull/143856). Thanks @vincentkoc.
+
+
+
+
+
+
+##### Read usage costs with clearer estimates
+
+
+Cost reports now warn when totals may still be incomplete, so a temporary zero is less likely to look like no usage. They also distinguish the tokens used to save reusable prompts from ordinary input and fill gaps in some OpenRouter estimates. These are reporting fixes; the provider's bill remains the amount you actually owe.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Count reported cache writes separately from ordinary input [#141377](https://github.com/openclaw/openclaw/pull/141377); contextual [#141374](https://github.com/openclaw/openclaw/issues/141374). Thanks @ooiuuii, @obviyus.
+- Avoid delayed ClawRouter usage errors during diagnostic capture [#141818](https://github.com/openclaw/openclaw/pull/141818). Thanks @Alix-007, @obviyus.
+- Label incomplete usage-cost totals [#141917](https://github.com/openclaw/openclaw/pull/141917)
+- Fill missing estimates for OpenRouter routing shortcuts [#142138](https://github.com/openclaw/openclaw/pull/142138). Thanks @fabiolr, @obviyus.
+
+
+
+
+
+
+##### Get model results without waiting on diagnostics
+
+
+With diagnostic recording enabled, OpenRouter can return finished music or a usage-check error without waiting for the recording to finish. You get the result sooner even if that optional recording is incomplete. Related fixes let stopped requests finish closing their connections without cutting off cleanup.
+
+If you run `openclaw models status --probe` directly from the terminal, stop the Gateway first and wait for the command to exit before starting it again. The result can appear while the check is still closing its files and connections.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Avoid OpenRouter capture waits after music completion or usage errors [#141754](https://github.com/openclaw/openclaw/pull/141754). Thanks @Alix-007, @obviyus.
+- Retain Anthropic resources through cancellation cleanup [#143377](https://github.com/openclaw/openclaw/pull/143377)
+- Retain model probe resources through cleanup [#143658](https://github.com/openclaw/openclaw/pull/143658)
+- Keep prepared model limits and credentials when skipping discovery [#143695](https://github.com/openclaw/openclaw/pull/143695)
+
+
+
+
+
+
+##### Find the provider instructions you need
+
+
+Setting up an account or checking a provider's options is easier in the reorganized [OpenAI](https://docs.openclaw.ai/providers/openai) and [model-provider guides](https://docs.openclaw.ai/concepts/model-providers). Shorter pages take you straight to the relevant instructions, and old bookmarks still point you toward the material that moved.
+
+
+
+###### Sources and complete change list
+
+
+**Documentation**
+
+- Organize OpenAI guidance into focused task pages [#141224](https://github.com/openclaw/openclaw/pull/141224). Thanks @vincentkoc.
+- Organize model-provider documentation by setup task [#143058](https://github.com/openclaw/openclaw/pull/143058). Thanks @vincentkoc.
+
+
+
+
+
+
+
+#### Automations and Scheduling
+
+Automations are easier to manage, with direct links to edit them and names you can recognize. Scheduled tasks also get fixes for getting stuck, returning results to your chat, and staying quiet when there is nothing to report.
+
+
+
+
+##### Run scheduled tasks with your chosen tools
+
+
+Scheduled commands run by OpenClaw can work without turning off secret protection, and Codex chats can set up automations using the tools already available in the conversation. Tasks also avoid startup failures caused by model settings refreshing or an unrelated plugin being disabled. Your existing permissions still apply, and disabled plugins stay off.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Keep scheduled jobs running through runtime refreshes [84fd689](https://github.com/openclaw/openclaw/commit/84fd689763c410dc32d43302c589f09d2f22d462). Thanks @ekinnee, @84dnnvbdvp-debug.
+- Preserve usable cron models and fallback failure details [855c9de](https://github.com/openclaw/openclaw/commit/855c9de4a2a7c8015d4fa78b28d00f330c0649ba). Thanks @Marvinthebored, @obviyus.
+- Restore scheduled commands with secret egress enabled [#142074](https://github.com/openclaw/openclaw/pull/142074). Thanks @tilor, @obviyus.
+- Accept Codex catalog tool names in automation allowlists [#142382](https://github.com/openclaw/openclaw/pull/142382). Thanks @sercada, @obviyus.
+
+
+
+
+
+
+##### Fixes for stuck scheduled tasks
+
+
+A clash between scheduled tasks could make OpenClaw keep retrying until it stopped responding. That loop is fixed. Tasks that hand work to another agent also avoid a pause they could never resume, leaving OpenClaw to deliver the result through the task's existing settings.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Prevent scheduled agents from entering an unresumable yield [#135318](https://github.com/openclaw/openclaw/pull/135318). Thanks @LiuwqGit, @obviyus, @youens, @postoso, @BottaniCals.
+- Stop stalled scheduled-job reservation loops and clean up resources after failed database opens [#142741](https://github.com/openclaw/openclaw/pull/142741). Thanks @galiniliev.
+
+
+
+
+
+
+##### Background results and quiet checks
+
+
+Background commands can bring their results back to the chat after your Claw's earlier reply has finished. Routine checks with nothing to report can stay quiet instead of sending an unnecessary message.
+
+If an automation result is waiting while your Claw answers you, canceling that result can now unblock actions such as pinning the conversation. Your Claw can finish its reply without adding the canceled result to the chat.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Keep quiet heartbeats silent and report completed sends [#140115](https://github.com/openclaw/openclaw/pull/140115). Thanks @ruel225, @obviyus, @laurencebrown.
+- Release session updates after cancellation [#143832](https://github.com/openclaw/openclaw/pull/143832).
+- Keep background completions and delayed skill experience reviews working after replies, with clearer event origins in history [#143866](https://github.com/openclaw/openclaw/pull/143866).
+
+
+
+
+
+
+##### Find and edit automations
+
+
+You can jump straight to an automation's editor from Settings → Agents → Automations, even when the task is paused. Lists now show the friendly names you saved, and you can group scheduled conversations together so they are easier to find. Large automation lists also spend less time loading where results will be sent.
+
+If you manage automations from the command line, missing jobs and invalid options come with more useful guidance. Warnings also explain what to check when a saved task cannot run because scheduling is turned off.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Edit automations directly from an agent's settings [#139782](https://github.com/openclaw/openclaw/pull/139782). Thanks @jjjhenriksen, @vyctorbrzezowski.
+- Explain time spent loading automation lists when diagnostics are enabled [#141805](https://github.com/openclaw/openclaw/pull/141805).
+
+**Bug fixes**
+
+- Show saved friendly automation names [#142076](https://github.com/openclaw/openclaw/pull/142076).
+- Show direct automation error guidance in JSON mode [#142113](https://github.com/openclaw/openclaw/pull/142113). Thanks @DasX, @obviyus.
+- Explain how to restore automatic scheduling by enabling cron, clearing `OPENCLAW_SKIP_CRON=1` from the Gateway's launch environment, and restarting [#142185](https://github.com/openclaw/openclaw/pull/142185).
+- Reject blank automation job IDs with clear guidance [#142264](https://github.com/openclaw/openclaw/pull/142264).
+- Sort and group scheduled sessions by displayed kind [#142554](https://github.com/openclaw/openclaw/pull/142554).
+- Reduce waits for automation delivery previews [#144014](https://github.com/openclaw/openclaw/pull/144014).
+
+
+
+
+
+
+##### Daily resets and automation guides
+
+
+If you have set conversations to reset each day, they now avoid losing context too early around spring clock changes. The reset still follows the timezone of the computer running OpenClaw.
+
+Guidance is easier to find when you want to [start a task at a set time or when a command finishes](https://docs.openclaw.ai/automation/cron-jobs/schedules#schedule-types), or [set up an automatic response to an event with a hook](https://docs.openclaw.ai/automation/hooks). These guides explain existing features, with clearer instructions for choosing and setting them up.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Prevent premature daily resets near daylight-saving changes [#142482](https://github.com/openclaw/openclaw/pull/142482).
+
+**Documentation**
+
+- Document all automation schedule types and option constraints [#135964](https://github.com/openclaw/openclaw/pull/135964). Thanks @qingminglong, @obviyus.
+- Split hooks guidance into focused reference pages [#143041](https://github.com/openclaw/openclaw/pull/143041). Thanks @vincentkoc.
+- Clarify that there is no native WebSocket schedule source and legacy `cron.failureDestination` settings are not read directly [#144039](https://github.com/openclaw/openclaw/pull/144039). Thanks @vincentkoc.
+
+
+
+
+
+
+
+#### Browser and Computer Use
+
+You can keep using your browser while your Claw works in another tab, and joining it on a remote desktop takes fewer steps. This release fixes interruptions when opening windows, answering website pop-ups, and following along with work on another computer.
+
+
+
+##### Follow browser work without switching tabs
+
+
+The [Browser panel](https://docs.openclaw.ai/tools/browser) can show what your Claw is doing without switching you away from your own tab. You can still choose Open to bring its page forward. If the live view disconnects after it has started, OpenClaw refreshes the picture and tries to reconnect automatically, while keeping any image you are marking up in place. Blank pages also stop appearing as misleading preview cards in chat.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Keep browser focus during automatic panel updates [5c70585](https://github.com/openclaw/openclaw/commit/5c70585f93cf5ab22893266b22cd767e1eb9d056). Thanks @scotthuang.
+- Recover the Browser panel after stream disconnects [#141576](https://github.com/openclaw/openclaw/pull/141576). Thanks @safzanpirani, @obviyus. An open connection that never sends its first frame remains outside this repair.
+- Hide preview cards for blank and internal browser pages [#142213](https://github.com/openclaw/openclaw/pull/142213). Thanks @vyctorbrzezowski.
+
+**Documentation**
+
+- Split browser documentation into focused guides [#142984](https://github.com/openclaw/openclaw/pull/142984). Thanks @vincentkoc.
+
+
+
+
+
+##### Handle website pop-ups and longer tasks
+
+
+When a website pop-up stops a [browser command](https://docs.openclaw.ai/cli/browser), OpenClaw tells you which prompt needs an answer and which steps remain unfinished. Answering one pop-up also no longer prevents the next one from being answered. Longer tasks in an already open browser avoid the premature connection failures covered by these fixes.
+
+Cancelling cannot undo changes already made to a page. If you automate browser commands, check their reported results before continuing, because a blocked task does not always return an error status.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Report blocked and interrupted browser actions [#142480](https://github.com/openclaw/openclaw/pull/142480).
+- Keep sequential browser dialogs available for responses [#142608](https://github.com/openclaw/openclaw/pull/142608).
+- Honor existing-browser timeouts and cancellation [#143365](https://github.com/openclaw/openclaw/pull/143365).
+
+**Limits and compatibility**
+
+- Reject invalid Browser CLI mouse-button values [#140976](https://github.com/openclaw/openclaw/pull/140976). Thanks @WOLIKIMCHENG, @DilapidatedDolphin98, @obviyus. Supplied values must be exactly `left`, `right`, or `middle`.
+
+
+
+
+
+##### Find the window your Claw needs
+
+
+This release fixes [computer-use errors](https://docs.openclaw.ai/nodes/computer-use) that could stop your Claw before it had even found the right window. Supported desktop controls are available from the start, and bringing a window forward no longer looks like a failure when it worked. Your Claw still needs permission to use the computer, and the computer must support the controls it requests.
+
+If [Codex Computer Use](https://docs.openclaw.ai/plugins/codex-computer-use) cannot start because native plugins are disabled, it now explains that promptly and tells you how to enable them and retry installation.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Skip the discovery wait when native Codex plugins are disabled [#137485](https://github.com/openclaw/openclaw/pull/137485). Thanks @shojikumaru, @noelillinger, @obviyus.
+- Make supported paired-desktop actions available on the first call [#141277](https://github.com/openclaw/openclaw/pull/141277). Thanks @oywino, @obviyus. Existing vision and permission restrictions still apply.
+- Fix first-action CUA window discovery [#143736](https://github.com/openclaw/openclaw/pull/143736).
+- Fix activation results and targeted capture guidance [#143953](https://github.com/openclaw/openclaw/pull/143953). Window input uses the `observationId` returned by `get_window_state` with `includeScreenshot`, rather than a whole-desktop frame reference.
+
+
+
+
+
+##### Open a remote desktop and paste text
+
+
+Opening [Desktop from a chat](https://docs.openclaw.ai/gateway/cloud-sessions) now takes you to the computer running that chat, and the view stays connected while you type in another pane alongside it. Desktop support must be enabled, and you start by watching until you choose Take control.
+
+To paste text from your own computer, choose Take control, open Keyboard, and paste there once the connection is ready. Paste shortcuts used directly on the desktop view are sent to the remote computer. If someone else takes control, the notice now shows their signed-in name or user ID when available.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Show who took control of a shared desktop [#143828](https://github.com/openclaw/openclaw/pull/143828).
+
+**Bug fixes**
+
+- Paste local text through Desktop Keyboard [#141986](https://github.com/openclaw/openclaw/pull/141986).
+- Desktop follows the chat machine [#143831](https://github.com/openclaw/openclaw/pull/143831). Desktop support must be enabled; opening still starts view-only under the existing permissions.
+
+
+
+
+
+##### Close a computer session before starting the next
+
+
+Stopping OpenClaw on a connected computer now lets its active computer-use session finish closing before another one starts. If closing fails, the error stays visible so you know why a new session is blocked and what needs attention.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Wait for computer sessions to close before node shutdown [#142787](https://github.com/openclaw/openclaw/pull/142787).
+
+
+
+
+
+##### Open a desktop on an Azure cloud worker
+
+
+You can now enable desktop access for [Azure cloud workers](https://docs.openclaw.ai/gateway/cloud-workers), whether OpenClaw manages them directly or through a coordinator. Turn on the Cloud Worker Desktop lab and enable desktop access in the worker profile. Existing workers created without a desktop need to be stopped and set up again with that setting enabled. This adds Azure to the supported desktop options; GCP desktops remain unsupported.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Remove a redundant cloud-desktop startup request [#142172](https://github.com/openclaw/openclaw/pull/142172).
+
+**Bug fixes**
+
+- Enable desktop access for Azure cloud workers [#141895](https://github.com/openclaw/openclaw/pull/141895).
+
+**Documentation**
+
+- Update translated Azure desktop guidance [#141909](https://github.com/openclaw/openclaw/pull/141909).
+
+
+
+
+
+#### Plugins and Integrations
+
+Finding something new for your Claw is easier, whether you browse plugins or ask for a recommendation in chat. You can review and set up plugins in the browser, while cloud workers gain ways to reuse project setup, keep a computer ready for your next session, and choose Windows or macOS when your provider supports them.
+
+
+
+
+##### Browse plugins and open recommendations from chat
+
+
+You can now search installed and available plugins together, browse by purpose, and keep exploring without clicking through pages. In [chat](https://docs.openclaw.ai/web/control-ui/chat), your Claw can recommend up to three official plugins or skills and give you a card that opens their details. Recommendations need the message tool enabled, and choosing Install opens a review before anything is added. An installed plugin may still need settings or an account connection before you can use it.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Browse and filter ClawHub plugins in the web UI [#137659](https://github.com/openclaw/openclaw/pull/137659) — Thanks @Patrick-Erichsen.
+- Inspect plugin documentation and compatibility in detail pages [#137846](https://github.com/openclaw/openclaw/pull/137846) — Thanks @Patrick-Erichsen.
+- Include local plugins and locally backed details in discovery [#137856](https://github.com/openclaw/openclaw/pull/137856) — Thanks @Patrick-Erichsen.
+- Unify bundled and ClawHub plugin browsing [#138755](https://github.com/openclaw/openclaw/pull/138755) — Thanks @Patrick-Erichsen.
+- Add Gateway-backed ClawHub catalog discovery [#139042](https://github.com/openclaw/openclaw/pull/139042) — Thanks @Patrick-Erichsen.
+- Reuse prepared plugin catalog metadata [#142500](https://github.com/openclaw/openclaw/pull/142500)
+- Use package categories in plugin discovery [#142711](https://github.com/openclaw/openclaw/pull/142711) — Thanks @Patrick-Erichsen.
+- Group installed plugins by purpose [#142712](https://github.com/openclaw/openclaw/pull/142712) — Thanks @Patrick-Erichsen.
+- Unify plugin browsing and add ClawHub chat cards [#142782](https://github.com/openclaw/openclaw/pull/142782) — Thanks @Patrick-Erichsen.
+- Load plugin catalog pages automatically [#143731](https://github.com/openclaw/openclaw/pull/143731) — Thanks @Patrick-Erichsen.
+- Load less unused code for bundled channels [#143846](https://github.com/openclaw/openclaw/pull/143846)
+
+**Limits and compatibility**
+
+- Declare ordered plugin categories [#142710](https://github.com/openclaw/openclaw/pull/142710) — Thanks @Patrick-Erichsen.
+
+**Bug fixes**
+
+- Match installed plugins to the correct ClawHub registry [#143644](https://github.com/openclaw/openclaw/pull/143644)
+- Correct plugin ranking, bundled identities, and skill names [#143730](https://github.com/openclaw/openclaw/pull/143730) — Thanks @Patrick-Erichsen.
+
+
+
+
+
+
+##### Review and set up plugins in the browser
+
+
+You can read what a plugin does, check what it needs, and follow installation through to setup without leaving the browser. [Plugin settings](https://docs.openclaw.ai/plugins/manage-plugins) puts its configuration, permissions, and troubleshooting information together, with clearer messages when setup is unfinished. The install dialog stays with your latest choice and waits through the required restart before confirming completion. Installing or changing plugins still requires the appropriate permissions and your consent.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Browse and search installed plugins in the Plugins workspace [#135839](https://github.com/openclaw/openclaw/pull/135839) — Thanks @Patrick-Erichsen.
+- Manage installed plugins on dedicated settings pages [#135840](https://github.com/openclaw/openclaw/pull/135840) — Thanks @Patrick-Erichsen.
+- Install and configure plugins from their detail pages [#137886](https://github.com/openclaw/openclaw/pull/137886) — Thanks @Patrick-Erichsen.
+- Organize installed-plugin details into tabs [#142713](https://github.com/openclaw/openclaw/pull/142713) — Thanks @Patrick-Erichsen.
+
+**Bug fixes**
+
+- Clarify plugin setup states and package icons [#142624](https://github.com/openclaw/openclaw/pull/142624) — Thanks @Patrick-Erichsen, @jalehman.
+- Correct recovery commands after plugin capability-consent rejection [#143125](https://github.com/openclaw/openclaw/pull/143125) — Thanks @liuwqgit, @obviyus, @yxloveql.
+- Keep plugin selections and installation progress current [#143671](https://github.com/openclaw/openclaw/pull/143671)
+
+
+
+
+
+
+##### Get useful help when plugin commands fail
+
+
+If you manage plugins from the terminal, [error messages](https://docs.openclaw.ai/cli/plugins) now point to recovery commands for your profile or container and explain whether you need to restart OpenClaw. Plugin checks also report cleanup failures instead of claiming success, and slow catalog responses no longer keep commands waiting indefinitely.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Enforce deadlines for ClawHub metadata and error responses [#109092](https://github.com/openclaw/openclaw/pull/109092) — Thanks @Pick-cat, @obviyus.
+- Keep profile and container context in plugin recovery commands [#117631](https://github.com/openclaw/openclaw/pull/117631)
+- Release plugin resources before reporting inspection success [#141780](https://github.com/openclaw/openclaw/pull/141780)
+- Close chat plugin-inspection resources before replying [#141819](https://github.com/openclaw/openclaw/pull/141819)
+- Release Plugin Doctor resources before reporting completion [#141845](https://github.com/openclaw/openclaw/pull/141845)
+- Close Workboard connections after plugin inspections [#141858](https://github.com/openclaw/openclaw/pull/141858)
+- Recover notices for already loaded plugins [#141930](https://github.com/openclaw/openclaw/pull/141930)
+- Clarify restart requirements after installing plugins [#142129](https://github.com/openclaw/openclaw/pull/142129) — Thanks @WOLIKIMCHENG, @obviyus, @dh-js.
+- Identify changed plugin registry records in diagnostics [#142192](https://github.com/openclaw/openclaw/pull/142192)
+- Release plugin CLI resources after cleanup finishes [#142388](https://github.com/openclaw/openclaw/pull/142388)
+- Keep resources alive through plugin registration cleanup [#142636](https://github.com/openclaw/openclaw/pull/142636)
+- Preserve bundled plugin trust for development path installs [#143516](https://github.com/openclaw/openclaw/pull/143516) — Thanks @RomneyDa.
+- Report supported bundle hook layouts accurately [#143687](https://github.com/openclaw/openclaw/pull/143687)
+
+**Documentation**
+
+- Split the plugins CLI reference by task [#142980](https://github.com/openclaw/openclaw/pull/142980) — Thanks @vincentkoc.
+- Clarify default plugin package resolution [#143867](https://github.com/openclaw/openclaw/pull/143867) — Thanks @vincentkoc.
+
+**Improvements**
+
+- Skip unused installation detail work in plugin summary tables [#143105](https://github.com/openclaw/openclaw/pull/143105)
+
+
+
+
+
+
+##### Build and preview your own plugins
+
+
+People building plugins get fixes for type errors and missing supporting files that could stop a build. You can also opt into [live previews in the browser](https://docs.openclaw.ai/web/control-ui/development), seeing changes to your plugin against a real OpenClaw installation. If you wrap the multi-account configuration helper, check its updated types when rebuilding; the [SDK guide](https://docs.openclaw.ai/plugins/sdk-overview) covers development setup.
+
+
+
+###### Sources and complete change list
+
+
+**Documentation**
+
+- Document the private completion helper in the SDK catalog [#111706](https://github.com/openclaw/openclaw/pull/111706) — Thanks @xydt-tanshanshan, @obviyus, @chegherian.
+- Split provider SDK guidance into focused references [#141958](https://github.com/openclaw/openclaw/pull/141958) — Thanks @vincentkoc.
+- Organize plugin hook guidance by task [#142605](https://github.com/openclaw/openclaw/pull/142605) — Thanks @vincentkoc.
+- Split SDK migration guidance into focused pages [#142607](https://github.com/openclaw/openclaw/pull/142607) — Thanks @vincentkoc.
+- Organize the SDK overview into focused references [#142641](https://github.com/openclaw/openclaw/pull/142641) — Thanks @vincentkoc.
+- Split channel SDK guidance into focused references [#142703](https://github.com/openclaw/openclaw/pull/142703) — Thanks @vincentkoc.
+- Split plugin architecture into focused guides [#142730](https://github.com/openclaw/openclaw/pull/142730) — Thanks @vincentkoc.
+- Split the agent-harness SDK reference into focused pages [#142889](https://github.com/openclaw/openclaw/pull/142889) — Thanks @vincentkoc.
+- Split plugin entry-point documentation into focused references [#143151](https://github.com/openclaw/openclaw/pull/143151) — Thanks @vincentkoc.
+- Correct plugin examples and capability guidance [#143857](https://github.com/openclaw/openclaw/pull/143857) — Thanks @vincentkoc.
+- Correct provider catalog and Claude bundle guidance [#143895](https://github.com/openclaw/openclaw/pull/143895) — Thanks @vincentkoc.
+- Clarify plugin migration history and examples [#143982](https://github.com/openclaw/openclaw/pull/143982) — Thanks @vincentkoc.
+
+**Limits and compatibility**
+
+- Expose the actual catchall multi-account schema type [#141796](https://github.com/openclaw/openclaw/pull/141796) — Thanks @RomneyDa.
+
+**Bug fixes**
+
+- Accept interface-typed inbound hook contexts [#141934](https://github.com/openclaw/openclaw/pull/141934) — Thanks @RomneyDa.
+- Use the running Gateway SDK for sibling-checkout plugins [#142508](https://github.com/openclaw/openclaw/pull/142508)
+- Include declared assets in untracked source-plugin builds [#142527](https://github.com/openclaw/openclaw/pull/142527)
+
+**Improvements**
+
+- Develop Control UI plugins against a real Gateway with hot reload [#143052](https://github.com/openclaw/openclaw/pull/143052) — Thanks @shakkernerd.
+
+
+
+
+
+
+##### Keep plugin requests from stopping too early
+
+
+Requests using [model plugins](https://docs.openclaw.ai/plugins/sdk-runtime/models) are less likely to fail because a connection closed while work was still finishing. OpenClaw keeps those connections available through cancellation, plugin reloads, and shutdown. A plugin that cannot finish closing can still delay shutdown.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Stop advertising retired native-hook relay endpoints [#141608](https://github.com/openclaw/openclaw/pull/141608)
+- Keep model state alive through plugin completions [#141938](https://github.com/openclaw/openclaw/pull/141938)
+- Retain plugin model resources through cancellation cleanup [#142197](https://github.com/openclaw/openclaw/pull/142197)
+- Preserve plugin resources through reload cleanup [#142519](https://github.com/openclaw/openclaw/pull/142519)
+- Retain provider resources through host cleanup [#142838](https://github.com/openclaw/openclaw/pull/142838)
+- Preserve provider context while listing tools [#142896](https://github.com/openclaw/openclaw/pull/142896)
+- Release temporary plugin resources after model checks finish [#143109](https://github.com/openclaw/openclaw/pull/143109)
+- Keep local model resources through request cleanup [#143302](https://github.com/openclaw/openclaw/pull/143302)
+- Preserve plugin identity when tools are cancelled [#143305](https://github.com/openclaw/openclaw/pull/143305)
+- Keep isolated model calls alive through cleanup [#143414](https://github.com/openclaw/openclaw/pull/143414)
+- Fix runtime-specific environment listing from the CLI [#143446](https://github.com/openclaw/openclaw/pull/143446) — Thanks @jalehman.
+- Keep plugin resources through late agent cleanup [#143490](https://github.com/openclaw/openclaw/pull/143490)
+- Release model-selected plugin resources after agent work [#143725](https://github.com/openclaw/openclaw/pull/143725)
+
+**Documentation**
+
+- Split tool configuration references into focused pages [#142960](https://github.com/openclaw/openclaw/pull/142960) — Thanks @vincentkoc.
+
+**Improvements**
+
+- Reduce repeated checks when selecting plugin providers [#143091](https://github.com/openclaw/openclaw/pull/143091)
+
+**Limits and compatibility**
+
+- Retain plugin-prepared models until host work finishes [#143270](https://github.com/openclaw/openclaw/pull/143270)
+
+
+
+
+
+
+##### Finish creating and saving images, music, and video
+
+
+Image, music, and video jobs can finish and save their results even when the plugin setup that started them is replaced. Related fixes keep connections available for speech and document analysis and prevent the last part of streamed audio from being lost. Paid generation that has already started may continue after you cancel.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Remove false empty-body explanations from media-download errors [#141674](https://github.com/openclaw/openclaw/pull/141674)
+- Close music plugin resources after generation finishes [#142834](https://github.com/openclaw/openclaw/pull/142834)
+- Retain image plugin resources until generation finishes [#142843](https://github.com/openclaw/openclaw/pull/142843)
+- Retain video plugin resources until generation finishes [#142876](https://github.com/openclaw/openclaw/pull/142876)
+- Keep accepted image jobs alive through provider cleanup [#142991](https://github.com/openclaw/openclaw/pull/142991)
+- Keep music jobs alive through saving and cleanup [#143060](https://github.com/openclaw/openclaw/pull/143060)
+- Keep telephony speech providers alive through synthesis and cleanup [#143065](https://github.com/openclaw/openclaw/pull/143065)
+- Keep video providers available until background jobs finish [#143260](https://github.com/openclaw/openclaw/pull/143260)
+- Keep speech resources through synthesis and cleanup [#143313](https://github.com/openclaw/openclaw/pull/143313)
+- Keep speech providers through stream cleanup [#143369](https://github.com/openclaw/openclaw/pull/143369)
+- Keep image provider resources through cleanup [#143403](https://github.com/openclaw/openclaw/pull/143403)
+- Keep PDF provider resources through cancellation cleanup [#143460](https://github.com/openclaw/openclaw/pull/143460)
+- Keep prepared speech settings usable until host shutdown [#143493](https://github.com/openclaw/openclaw/pull/143493)
+- Keep plugin resources through media task cleanup [#143530](https://github.com/openclaw/openclaw/pull/143530)
+- Retain managed speech-summary resources through cleanup [#143627](https://github.com/openclaw/openclaw/pull/143627)
+- Preserve plugin image handlers for multiple images [#143717](https://github.com/openclaw/openclaw/pull/143717)
+
+**Documentation**
+
+- Organize text-to-speech documentation by task [#142992](https://github.com/openclaw/openclaw/pull/142992) — Thanks @vincentkoc.
+
+
+
+
+
+
+##### Use less extra memory for plugin data
+
+
+Plugins with lots of saved data use less extra memory when listing it, helping reduce the strain of a large collection. The first use after the [storage update](https://docs.openclaw.ai/reference/database-schemas#plugin-state-listing-index) may take extra time and disk space.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Reduce database reads during plugin-state quota checks [#142318](https://github.com/openclaw/openclaw/pull/142318)
+- Reduce temporary memory when listing plugin state [#142568](https://github.com/openclaw/openclaw/pull/142568) — Thanks @arcabotai.
+
+**Bug fixes**
+
+- Release local telemetry resources after cleanup settles [#142423](https://github.com/openclaw/openclaw/pull/142423)
+- Avoid unused private diagnostic copies in Prometheus [#144109](https://github.com/openclaw/openclaw/pull/144109)
+
+
+
+
+
+
+##### Handle large tool replies and disconnects
+
+
+If you connect external tools through [MCP](https://docs.openclaw.ai/cli/mcp), large text replies from connected devices no longer include an unnecessary duplicate copy. Stopping a standalone MCP service gives ongoing tool work time to finish cleaning up, and an accepted disconnect no longer gets stuck waiting on response cleanup. Failed disconnects still report a problem that may need attention.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Finish MCP cleanup without waiting on stalled cancellation [#141289](https://github.com/openclaw/openclaw/pull/141289) — Thanks @hugenshen, @obviyus.
+- Wait for MCP tool cleanup before resource release [#142632](https://github.com/openclaw/openclaw/pull/142632)
+- Keep MCP plugin resources available through shutdown cleanup [#143031](https://github.com/openclaw/openclaw/pull/143031)
+
+**Improvements**
+
+- Remove duplicate text from node-hosted MCP snapshots [#142518](https://github.com/openclaw/openclaw/pull/142518)
+
+**Documentation**
+
+- Split MCP documentation by task [#142995](https://github.com/openclaw/openclaw/pull/142995) — Thanks @vincentkoc.
+
+
+
+
+
+
+##### Use accurate time limits for connected devices
+
+
+Commands on [connected devices](https://docs.openclaw.ai/cli/nodes) no longer time out early or wait longer just because the system clock changed. Time spent waking the device counts toward the same limit as running the command. If you use scripts, omit numeric options when you want their defaults—passing an empty value now gives a clear error before OpenClaw contacts the device.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Keep node command timeouts stable across clock changes [#137147](https://github.com/openclaw/openclaw/pull/137147) — Thanks @qingminglong, @obviyus.
+
+**Limits and compatibility**
+
+- Reject empty numeric node command options [#137311](https://github.com/openclaw/openclaw/pull/137311) — Thanks @Alix-007, @obviyus.
+
+**Documentation**
+
+- Split Nodes documentation by task [#142779](https://github.com/openclaw/openclaw/pull/142779) — Thanks @vincentkoc.
+
+
+
+
+
+
+##### Get answers from a separate agent in Google Meet
+
+
+Google Meet and voice sessions can now ask a [separately configured agent](https://docs.openclaw.ai/plugins/google-meet/tool-and-modes) for help even when the original conversation has a locked model choice. That agent uses its own conversation without copying your earlier chat, and its own model restrictions still apply. Failed Chrome meeting starts also try to stop the audio they opened and close only newly created tabs, leaving your existing tabs alone.
+
+
+
+###### Sources and complete change list
+
+
+**Documentation**
+
+- Organize Google Meet guidance by task [#142729](https://github.com/openclaw/openclaw/pull/142729) — Thanks @vincentkoc.
+
+**Bug fixes**
+
+- Allow separate-agent consultations from model-locked sessions [#142736](https://github.com/openclaw/openclaw/pull/142736) — Thanks @RileyJJY, @jai-assistant, @jalehman.
+- Clean up Google Meet audio after Chrome startup failure [#143408](https://github.com/openclaw/openclaw/pull/143408)
+
+
+
+
+
+
+##### Send A2A work to the agent you chose
+
+
+If you use [A2A to connect agents](https://docs.openclaw.ai/channels/a2a), incoming requests now reach the agent assigned to that connection even when a new conversation begins. You can still choose a different agent for a particular conversation, and separate conversations keep their own history.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Honor A2A peer-to-agent bindings [#142485](https://github.com/openclaw/openclaw/pull/142485) — Thanks @eleqtrizit.
+
+
+
+
+
+
+##### Tell connected apps when an answer was cut short
+
+
+Apps using OpenClaw through [Chat Completions](https://docs.openclaw.ai/gateway/openai-http-api) or the [Responses API](https://docs.openclaw.ai/gateway/openresponses-http-api) can now tell when an answer stopped at its output limit. They keep the partial answer and receive a clear signal that it was cut short, including during streaming, so they can decide what to show or do next. Connected apps also get a more accurate report of which settings changed after a configuration update.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Report output-limited Chat Completions accurately [#141268](https://github.com/openclaw/openclaw/pull/141268) — Thanks @ooiuuii, @obviyus.
+- Report output-limited Responses answers as incomplete [#142778](https://github.com/openclaw/openclaw/pull/142778) — Thanks @zhangguiping-xydt, @obviyus, @ooiuuii.
+
+**Improvements**
+
+- Report effective changed paths from configuration patches [#141757](https://github.com/openclaw/openclaw/pull/141757)
+
+**Documentation**
+
+- Expose Gateway RPC method groups as headings [#143459](https://github.com/openclaw/openclaw/pull/143459) — Thanks @vincentkoc.
+- Correct Gateway reference hierarchy and model-view link [#143472](https://github.com/openclaw/openclaw/pull/143472) — Thanks @vincentkoc.
+- Split Gateway RPC guidance into focused topic pages [#143515](https://github.com/openclaw/openclaw/pull/143515) — Thanks @vincentkoc.
+
+
+
+
+
+
+##### Open Reports and plugin panels with more room
+
+
+[Reports](https://docs.openclaw.ai/plugins/team-reports) opens at the short `/reports` address inside OpenClaw, and embedded plugin pages use more of the window. Plugin panels also load in affected containers where file permissions previously got in the way.
+
+If you use separate Team Reports report or export links, change `/reports/...` to `/plugins/team-reports/...`; old links do not redirect automatically. The guide explains how to keep a custom address if you need one.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Make generated plugin panels readable by container runtime users [#142997](https://github.com/openclaw/openclaw/pull/142997) — Thanks @ylcn91, @obviyus, @Conan-Scott.
+- Let embedded reports fill the content area [#143765](https://github.com/openclaw/openclaw/pull/143765)
+
+**Limits and compatibility**
+
+- Add short plugin-tab URLs and move Team Reports HTTP defaults [#143183](https://github.com/openclaw/openclaw/pull/143183)
+
+**Improvements**
+
+- Use full page width for Team Reports [#143340](https://github.com/openclaw/openclaw/pull/143340)
+
+
+
+
+
+
+##### Reuse project setup in new cloud sessions
+
+
+New cloud sessions can [reuse a project that is already set up](https://docs.openclaw.ai/gateway/cloud-workers/warm-images), saving repeated installation and preparation work while keeping your session’s changes. You can use an eligible local project or start directly from a public GitHub repository. Starting from only a private repository URL still uses a fresh checkout; private projects already checked out locally can use the local-project route. A saved setup still needs a machine to start unless a running spare is available.
+
+Back up OpenClaw’s data before upgrading, following the [backup and rollback instructions](https://docs.openclaw.ai/reference/database-schemas/state-schema-history). Older versions cannot read the updated data format, so rolling back the app alone is not enough. Restoring the earlier backup also discards changes made after it.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Reuse prepared workers for public GitHub repositories [2bcb98a4b280](https://github.com/openclaw/openclaw/commit/2bcb98a4b2807cd0ac014517d4ecdad4f42e557f)
+- Reuse completed project setup across fresh cloud-worker sessions [#143227](https://github.com/openclaw/openclaw/pull/143227)
+
+
+
+
+
+
+##### Keep a cloud computer ready for your next session
+
+
+[Ready workers](https://docs.openclaw.ai/gateway/cloud-workers/warm-images#ready-workers) let your next matching session use an already running computer while OpenClaw prepares a replacement. Eligible Linux projects get one spare per project and profile by default, with a shared limit of four. These computers cost money until deletion is confirmed. Set a profile's Ready workers value to zero to disable its spares, or the shared Prepared pool limit to zero to remove unused spares without stopping active sessions.
+
+If you already use saved worker images, stop OpenClaw and any image captures it started, then follow the [Doctor upgrade step](https://docs.openclaw.ai/gateway/cloud-workers/warm-images) before starting more workers.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Keep prepared cloud workers ready for later sessions [#143372](https://github.com/openclaw/openclaw/pull/143372)
+- Prepare cloud workers on demand [#143838](https://github.com/openclaw/openclaw/pull/143838)
+
+**Bug fixes**
+
+- Preserve worker bundles during provisioning [#143663](https://github.com/openclaw/openclaw/pull/143663)
+
+
+
+
+
+
+##### Choose Linux, Windows, WSL2, or macOS workers
+
+
+You can choose a cloud computer’s operating system for a profile or an individual session when your provider offers it. Native Windows runs Windows commands, while WSL2 gives you a Linux environment on Windows. Mac workers on AWS require a Dedicated Host and On-Demand capacity; desktop access and reusable worker images remain Linux-only. The [operating-system guide](https://docs.openclaw.ai/gateway/cloud-workers/placement-and-machine-selection#choose-an-operating-system-and-machine-class-per-session) covers availability, with separate [setup requirements for native Windows](https://docs.openclaw.ai/gateway/cloud-workers/setup-and-bundle-installation#native-windows-prerequisites).
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Choose provider-defined cloud-session operating systems [#142095](https://github.com/openclaw/openclaw/pull/142095)
+- Enable Windows WSL2 cloud workers with compatible Crabbox [#142679](https://github.com/openclaw/openclaw/pull/142679)
+- Run macOS cloud workers through Crabbox [#143463](https://github.com/openclaw/openclaw/pull/143463)
+- Run cloud workers on native Windows [#143769](https://github.com/openclaw/openclaw/pull/143769)
+
+**Documentation**
+
+- Translate cloud-worker operating-system controls [#142120](https://github.com/openclaw/openclaw/pull/142120)
+
+**Bug fixes**
+
+- Explain unavailable cloud operating systems [#143798](https://github.com/openclaw/openclaw/pull/143798)
+
+
+
+
+
+
+##### Set up cloud workers from Settings
+
+
+Cloud workers settings now lets administrators change advanced options, set spare-computer limits, and choose a default profile for each repository. Save your changes and restart OpenClaw to apply them. You can also hover over a cloud session to see its known operating system, CPU, and memory capacity.
+
+OpenClaw can automatically download a supported Crabbox tool when yours is missing or outdated. If your computer blocks those downloads or installations, [prepare Crabbox 0.55.0 or newer before upgrading](https://docs.openclaw.ai/gateway/config-cloud-workers#crabbox-profile), because you need it even to inspect or stop existing cloud workers.
+
+
+
+###### Sources and complete change list
+
+
+**Documentation**
+
+- Correct Node requirements in cloud-worker setup guidance [#141871](https://github.com/openclaw/openclaw/pull/141871)
+- Split Cloud Workers guidance into focused topic pages [#143158](https://github.com/openclaw/openclaw/pull/143158) — Thanks @vincentkoc.
+
+**Improvements**
+
+- Automatically prepare a supported Crabbox CLI [#143768](https://github.com/openclaw/openclaw/pull/143768)
+- Edit advanced worker settings and repository defaults [#143801](https://github.com/openclaw/openclaw/pull/143801)
+- See cloud session machine specifications [#143864](https://github.com/openclaw/openclaw/pull/143864)
+
+
+
+
+
+
+##### Save and manage prepared cloud projects
+
+
+Administrators can [save a prepared project in Settings](https://docs.openclaw.ai/gateway/cloud-workers/warm-images), watch its progress, cancel it, or pin a useful snapshot to keep it. You can choose a previous snapshot for new workers without changing computers already running. Builds use the project's committed files and setup instructions, and may reuse a suitable existing copy.
+
+Before using Recover after an interrupted capture, stop the affected worker and capture and check the saved images with your provider. Recover only clears OpenClaw's record of the interruption; it does not stop a computer or delete an image for you.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Clear cloud snapshot reservations after confirmed rejection [#142221](https://github.com/openclaw/openclaw/pull/142221)
+- Allow cloud-worker snapshots to finish before enrollment [#143288](https://github.com/openclaw/openclaw/pull/143288)
+- Clean up abandoned uploads and failed checkpoint handoffs [#143675](https://github.com/openclaw/openclaw/pull/143675)
+
+**Improvements**
+
+- Inspect and recover cloud snapshots in the Control UI [#143814](https://github.com/openclaw/openclaw/pull/143814)
+- Pin, delete, and roll back cloud-worker images [#143893](https://github.com/openclaw/openclaw/pull/143893)
+- Build project snapshots from Settings [#143929](https://github.com/openclaw/openclaw/pull/143929)
+
+
+
+
+
+
+##### Keep messages and cloud computers through updates
+
+
+You can send a message while a cloud session is setting up or syncing files and see what it is waiting for. OpenClaw keeps the message and starts it when the intended computer is ready, saving you from copying and resending it.
+
+Supported cloud computers can also keep their files, installed tools, and desktop through an [OpenClaw update](https://docs.openclaw.ai/gateway/cloud-workers/session-lifecycle). A message that has not started can continue once the worker is updated, but work already underway is not automatically repeated. The computer must support the update and reconnect; this cannot recover a machine lost by the provider.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Keep accepted messages queued through worker setup and file sync [#137576](https://github.com/openclaw/openclaw/pull/137576) — Thanks @jalehman.
+- Retain cloud-worker renewals after temporary heartbeat failures [#142194](https://github.com/openclaw/openclaw/pull/142194)
+- Keep configured cloud machines through updates [#143858](https://github.com/openclaw/openclaw/pull/143858)
+- Continue unstarted turns through worker updates [#143910](https://github.com/openclaw/openclaw/pull/143910)
+
+
+
+
+
+
+##### Copy remote workspaces with less waiting
+
+
+Saving a remote workspace with many small files can finish sooner, and its file list needs fewer bytes to transfer. Cancelling preparation stops new scanning and closes the upload connection instead of leaving it hanging, though file operations already underway may need time to finish. Oversized or changing files are also rejected earlier, without leaving a partial workspace result.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Allow long prepared workspace paths at worker launch [#142198](https://github.com/openclaw/openclaw/pull/142198)
+- Stop cancelled cloud workspace uploads from hanging [#142237](https://github.com/openclaw/openclaw/pull/142237)
+- Skip unused workspace files during worker startup [#143721](https://github.com/openclaw/openclaw/pull/143721)
+- Stop workspace scans when worker preparation is canceled [#143746](https://github.com/openclaw/openclaw/pull/143746)
+- Stop excessive reads during worker workspace capture [#143795](https://github.com/openclaw/openclaw/pull/143795)
+
+**Improvements**
+
+- Compress cloud workspace file inventories during transfer [#142242](https://github.com/openclaw/openclaw/pull/142242)
+- Capture many-file remote workspaces faster [#144017](https://github.com/openclaw/openclaw/pull/144017)
+
+
+
+
+
+
+##### See what still needs attention after cloud cleanup
+
+
+When a cloud worker fails, the error now keeps the original problem and the latest cleanup failure visible without piling up repeated messages. Stopping a computer can succeed even if saving an optional image failed, with a warning explaining what remains. Failed image deletion stays visible for retry, and charges may continue until your provider confirms deletion.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Restore Crabbox image cleanup across multiple CLI executables [#142166](https://github.com/openclaw/openclaw/pull/142166)
+- Keep cloud-worker cleanup errors current [#143345](https://github.com/openclaw/openclaw/pull/143345)
+- Separate successful Crabbox cleanup from capture warnings [#143349](https://github.com/openclaw/openclaw/pull/143349)
+
+
+
+
+
+
+##### Find and connect Codex plugins
+
+
+Owners and administrators can [search Codex plugins](https://docs.openclaw.ai/plugins/codex-native-plugins), open their setup links, and see installation, permission, and account-connection information together. Opening a setup link does not finish the step—return and submit the completion response when you are done. After connecting, use `/codex plugins refresh` to update the app list, then `/new` or `/reset` where required; refreshing does not sign in or enable an app for you.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Find, connect and inspect Codex plugins [#132158](https://github.com/openclaw/openclaw/pull/132158) — Thanks @stevenlee-oai.
+
+
+
+
+
+
+
+#### Security and Privacy
+
+Your Claw can make more decisions about routine commands without interrupting you, while still asking for approval when needed. There are also fixes for keeping file access within the permissions you chose, protecting shared conversation history when deleting an agent, and keeping private update records out of backups and support bundles.
+
+
+
+
+##### Decide when commands need your approval
+
+
+[Automatic command review](https://docs.openclaw.ai/tools/exec) can now let suitable routine commands run, refuse a command with an explanation, or ask you to decide. This takes effect in existing automatic and workspace modes. In OpenClaw's built-in agent, the reviewer can use part of your conversation to check whether a command fits your request. High-risk actions still need human approval, and settings that always ask remain in force.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Let automatic command review allow, deny, or ask [#141987](https://github.com/openclaw/openclaw/pull/141987). SDK consumers must handle denial without executing the command or automatically converting it into a human request.
+- Give command auto-review the user's conversation context [#142279](https://github.com/openclaw/openclaw/pull/142279).
+
+**Bug fixes**
+
+- Keep timed-out command review from releasing model resources before cleanup finishes [#143308](https://github.com/openclaw/openclaw/pull/143308).
+
+
+
+
+
+
+##### Keep your tool permissions in place
+
+
+Turning tools off now carries through to supported connected agents, including Copilot, even when you return to a conversation that previously allowed them. If an integration cannot honor that restriction, OpenClaw stops rather than continuing with tools enabled. Update the plugin or choose a supported agent to continue.
+
+Your Claw's instructions also allow it to use existing login details for tasks you authorize, such as signing into a website, while keeping your other permissions in place. When it cannot offer secure setup in chat, it directs you to terminal prompts that hide what you type.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Clarify the existing scope of Read Only permissions in the English interface [#141283](https://github.com/openclaw/openclaw/pull/141283). Thanks @north-echo and @obviyus.
+
+**Bug fixes**
+
+- Show usage for invalid approval decisions and accept unusual IDs with valid decisions [#137877](https://github.com/openclaw/openclaw/pull/137877). Thanks @teddytennant and @obviyus.
+- Remove blanket credential-use refusals and correct setup routing [#143238](https://github.com/openclaw/openclaw/pull/143238). Thanks @ejc3, @Stephane-fci, and @Sedrak-Hovhannisyan. SDK callers should replace the legacy string argument to `buildCredentialSafetyPrompt` with `{ controlToolsAvailable }`; legacy strings remain accepted through November 30, 2026.
+- Keep approval-reply interpretation resources until cleanup ends [#143307](https://github.com/openclaw/openclaw/pull/143307).
+
+**Security and trust**
+
+- Preserve disabled tools across plugin handoffs [#142093](https://github.com/openclaw/openclaw/pull/142093). Thanks @pgondhi987. For [plugin authors](https://docs.openclaw.ai/plugins/sdk-agent-harness), an empty runtime `toolsAllow` list means deny all, while an empty configuration `allow` list remains unrestricted.
+
+**Documentation**
+
+- Clarify full-mode command approval, strict inline-code review, and waiting behavior [#142368](https://github.com/openclaw/openclaw/pull/142368). Thanks @Glucksberg, @obviyus, @JKamgang, and @russellweiss. This documents existing policy; strict inline evaluation remains off by default.
+
+
+
+
+
+
+##### Fix password and device sign-in problems
+
+
+Password login now rejects blank passwords and known example values. If one prevents your Gateway from starting, replace it, restart OpenClaw, and update the apps that connect to it. Short real passwords produce a warning rather than a new startup block.
+
+More model connections can use [protected API keys](https://docs.openclaw.ai/gateway/secrets) without turning protection off. Doctor also gives administrators a working [repair for certain older device sign-in failures](https://docs.openclaw.ai/cli/devices), making it easier to reconnect affected devices.
+
+
+
+###### Sources and complete change list
+
+
+**Security and trust**
+
+- Reject placeholder Gateway passwords and audit password strength [#141720](https://github.com/openclaw/openclaw/pull/141720).
+
+**Bug fixes**
+
+- Skip unused saved credentials for eligible password-only connections [#142290](https://github.com/openclaw/openclaw/pull/142290). This applies to signed clients using read-only local shared state, without an origin-specific credential scope or another credential type.
+- Correct credential recovery notices [#142498](https://github.com/openclaw/openclaw/pull/142498). Thanks @obviyus.
+- Restore WebSocket inference through managed secret egress, and synchronize bundled autoreview authentication handling and machine-readable status output [#143354](https://github.com/openclaw/openclaw/pull/143354). Thanks @fuller-stack-dev. The helper sync also removes the external credential-scanner dependency from autoreview.
+- Recover legacy node tokens with `--no-scopes` [#143599](https://github.com/openclaw/openclaw/pull/143599). Thanks @obviyus and @matthewmoroz. The option cannot be combined with `--scope`; cleanup removes only the matching local legacy node credential.
+
+**Documentation**
+
+- Split secrets guidance into focused runtime, SecretRef, store and egress, integration, and operations guides [#143520](https://github.com/openclaw/openclaw/pull/143520). Thanks @vincentkoc.
+
+
+
+
+
+
+##### Protect incoming messages and network access
+
+
+For Slack connections using HTTP webhooks, OpenClaw now enforces limits on oversized, slow, or excessive incoming requests before processing them. Feishu and Lark webhooks also reject signed requests dated more than an hour before or after the computer's clock. Keep that clock synchronized, and check [Feishu troubleshooting](https://docs.openclaw.ai/channels/feishu/troubleshooting) if delayed deliveries are rejected. Feishu's WebSocket connection mode is unaffected.
+
+If you use [IPv4-mapped network rules](https://docs.openclaw.ai/gateway/trusted-proxy-auth) for a reverse proxy or device pairing, review the addresses you allow. Those rules now cover their full stated range, fixing connections that were wrongly rejected. Broad rules may therefore trust more addresses than before, including the computer itself; keep the allowed range as narrow as your setup needs. Other login and approval checks still apply.
+
+
+
+###### Sources and complete change list
+
+
+**Security and trust**
+
+- Enforce Slack HTTP webhook limits before processing, including a 1 MiB body limit and 30-second read deadline [c11ea063](https://github.com/openclaw/openclaw/commit/c11ea06355b094e29c9fe5fcfe309fdbaae6d17b). Thanks @drobison00. Contextual intent and review reference [#136508](https://github.com/openclaw/openclaw/pull/136508).
+- Preserve IPv6 cloud metadata blocking with proxy compatibility enabled [#137684](https://github.com/openclaw/openclaw/pull/137684). Thanks @eleqtrizit.
+- Reject malformed Tlon citations before authenticated lookups [#142041](https://github.com/openclaw/openclaw/pull/142041). Thanks @pgondhi987.
+- Reject stale signed Feishu and Lark webhook callbacks outside the fixed one-hour clock window [#143484](https://github.com/openclaw/openclaw/pull/143484). Thanks @eleqtrizit.
+
+**Limits and compatibility**
+
+- Honor IPv4-mapped network ranges in proxy and pairing rules [#137668](https://github.com/openclaw/openclaw/pull/137668). Thanks @elbourne12345 and @obviyus. Native IPv6 peers do not match these ranges, and catch-all proxy trust can still prevent correct client attribution.
+
+
+
+
+
+
+##### Keep shared files within their permissions
+
+
+When an agent is limited to its workspace, it can now send files from the current chat's sandbox without being able to attach files from another chat's sandbox. Plugins that send these attachments must identify the correct workspace, so some third-party plugins may need an update.
+
+Changing a shared conversation to draft now also blocks new file requests from readers who can no longer see it, even without separately configured user roles. Download links issued earlier remain valid until they expire, and people sharing one OpenClaw installation still need to trust one another.
+
+
+
+###### Sources and complete change list
+
+
+**Security and trust**
+
+- Prevent attachment reads from sibling sandboxes under workspace-only policy [#143521](https://github.com/openclaw/openclaw/pull/143521). Thanks @eleqtrizit, @yetval, and @yangxiansheng.
+
+**Bug fixes**
+
+- Apply draft visibility to fresh artifact reads and downloads [#143873](https://github.com/openclaw/openclaw/pull/143873). Thanks @vincentkoc.
+
+**Documentation**
+
+- Split sandboxing guidance into focused backend, workspace, image, and setup pages [#143522](https://github.com/openclaw/openclaw/pull/143522). Thanks @vincentkoc.
+- Document file-transfer approval migration and clarify SecretRef fields, the Moonshot model example, and plugin-reference navigation [#144029](https://github.com/openclaw/openclaw/pull/144029). Thanks @vincentkoc.
+
+
+
+
+
+
+##### Keep external tool apps read-only
+
+
+If you have read-only access, opening an MCP App in a separate view no longer gives you permission to run its tools. You can still view the App and use the resources you are allowed to read. For MCP tools running on the same computer, rejecting an oversized upload also stops a tool command queued behind it from running on that connection.
+
+
+
+###### Sources and complete change list
+
+
+**Security and trust**
+
+- Preserve read-only permissions in standalone MCP Apps [#142661](https://github.com/openclaw/openclaw/pull/142661). Thanks @eleqtrizit. Client tool permission is captured when the launch ticket is issued; the ongoing check concerns the live App grant.
+- Block queued MCP tool execution after rejected uploads on the authenticated loopback connection [#143724](https://github.com/openclaw/openclaw/pull/143724).
+
+
+
+
+
+
+##### Protect shared history and private update records
+
+
+[Deleting an agent](https://docs.openclaw.ai/cli/agents) now stops if another agent needs it to read shared history. Moving that history is not yet supported, so keep the agent configured. If deletion fails partway through, fix the reported storage problem and retry. Before deleting a workspace that links to a neighboring folder, check what will be removed. Deletion through the Gateway may move that linked folder to Trash too; the offline command removes only the link.
+
+[Backups and support bundles](https://docs.openclaw.ai/cli/backup) leave out recognized private update records. If you move a protected folder, keep its privacy-marker file with it. Files copied elsewhere without that marker are not protected from export.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Preserve shared history and retryable cleanup during agent deletion [#141731](https://github.com/openclaw/openclaw/pull/141731). Thanks @andrea-kingautomation.
+- Clean up deleted agents on external state volumes, with the Gateway's same-parent workspace-symlink behavior described above [#142130](https://github.com/openclaw/openclaw/pull/142130).
+
+**Security and trust**
+
+- Keep recognized private update captures out of backups and support exports [#143799](https://github.com/openclaw/openclaw/pull/143799). Thanks @fuller-stack-dev.
+- Exclude moved private capture directories when their marker stays intact, and refuse invalid markers [#143899](https://github.com/openclaw/openclaw/pull/143899). Thanks @fuller-stack-dev.
+
+
+
+
+
+
+##### Keep your WhatsApp group access choices
+
+
+Running `openclaw security audit --fix` now keeps the WhatsApp group access list you already chose, instead of adding people just because they had previously paired with your Claw. When changing an open group policy to restricted access, it can still use approved senders if you have not supplied a list. People added by an earlier repair are not removed automatically, so review your list if you were affected.
+
+
+
+###### Sources and complete change list
+
+
+**Security and trust**
+
+- Preserve WhatsApp group allowlists during security repair [#142589](https://github.com/openclaw/openclaw/pull/142589). Thanks @eleqtrizit.
+
+
+
+
+
+
+##### Understand what update checks share
+
+
+The [telemetry guide](https://docs.openclaw.ai/gateway/telemetry) now explains what an update check can reveal about your approximate location, what the local preview can show, and the documented three-month retention period. Turning off optional statistics or setting `DO_NOT_TRACK` does not stop automatic update checks. If you want to stop those requests too, use the separate controls explained in the guide. The location may be that of a VPN, proxy, or remote computer, rather than where you are sitting.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Normalize public-provider names in optional statistics and their preview, while retaining the private-provider filter and existing consent settings [#141134](https://github.com/openclaw/openclaw/pull/141134). Thanks @vincentkoc.
+
+**Documentation**
+
+- Organize Gateway security guidance into focused setup, trust, audit, and incident-response pages [#141162](https://github.com/openclaw/openclaw/pull/141162). Thanks @vincentkoc.
+- Split policy command guidance into authoring, rules, scopes, checks, attestation, and findings guides [#142961](https://github.com/openclaw/openclaw/pull/142961). Thanks @vincentkoc.
+- Explain approximate location in hosted update telemetry, preview limits, retention, and request controls [#143311](https://github.com/openclaw/openclaw/pull/143311). Thanks @vincentkoc.
+- Organize the threat catalog into focused pages while retaining shared risk context [#143517](https://github.com/openclaw/openclaw/pull/143517). Thanks @vincentkoc.
+- Clarify Anthropic setup-token login, secret scope, approvals upgrade guidance, shared rate limits, and proxy validation failures [#144030](https://github.com/openclaw/openclaw/pull/144030). Thanks @vincentkoc.
+
+
+
+
+
+
+
+#### Quality-of-Life Improvements
+
+You can now answer your Claw’s questions and enter secrets from the terminal, with clearer output to read and copy afterward. There are also fixes for starting and restoring coding workspaces, giving delegated tasks enough time, and finding the help you need when something goes wrong.
+
+
+
+
+##### Answer questions and enter secrets in the terminal
+
+
+When your Claw needs an answer, you can now choose an option or type a response directly in the [terminal](https://docs.openclaw.ai/web/tui), including while a task is waiting for your reply. Press Esc to put the question aside and `/question` to bring it back.
+
+[Secret requests](https://docs.openclaw.ai/tools/secrets) get a masked entry box that keeps what you type out of the conversation and input history. Saving a secret requires a Gateway connection, and terminal entry accepts one line at a time. Use the web app if you need to change which sites can use it. Local sessions support ordinary questions, which you should answer before closing the terminal.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Answer agent questions and Gateway secret requests in the terminal [#143273](https://github.com/openclaw/openclaw/pull/143273). Thanks @Sedrak-Hovhannisyan.
+
+
+
+
+
+
+##### Read and copy terminal output
+
+
+Long addresses and other text now wrap in terminal chat without gaining extra spaces, so you can copy them as written. Tables keep related values lined up, and progress indicators stop leaving repeated lines behind in narrow windows. If you use scripts to read command results, approvals JSON and transcript output also keep the unrelated announcements out of the way.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Load less provider runtime code during CLI startup [#142460](https://github.com/openclaw/openclaw/pull/142460).
+- Reduce duplicate work when refreshing shell completions [#143025](https://github.com/openclaw/openclaw/pull/143025).
+
+**Bug fixes**
+
+- Keep progress indicators within narrow terminals [#141401](https://github.com/openclaw/openclaw/pull/141401). Thanks @ooiuuii.
+- Restore native CLI progress indicators [#142071](https://github.com/openclaw/openclaw/pull/142071). Thanks @Xuxyyy, @obviyus.
+- Suppress approvals write announcements in JSON output [#142152](https://github.com/openclaw/openclaw/pull/142152).
+- Preserve blank lines in multiline terminal tables [#142196](https://github.com/openclaw/openclaw/pull/142196).
+- Preserve long words and email addresses in terminal chat [#142210](https://github.com/openclaw/openclaw/pull/142210).
+- Keep wrapped multiline terminal cells aligned [#142305](https://github.com/openclaw/openclaw/pull/142305).
+
+
+
+
+
+
+##### Understand command errors
+
+
+Command errors do a better job of telling you what to do next, such as supplying login details or choosing which agent to use, without making a missing option look like a broken installation. If `openclaw agent` loses its connection or times out after a task was accepted, the error gives you the task’s ID so you can check what happened before trying again. Check its conversation history and Gateway status first, because the work may have continued after the connection was lost.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Show accepted run IDs in connection-loss and timeout hints [#111899](https://github.com/openclaw/openclaw/pull/111899). Thanks @xialonglee, @MrNozz, @obviyus.
+- Distinguish command errors from CLI startup failures [#142109](https://github.com/openclaw/openclaw/pull/142109).
+- Show direct credential guidance for Gateway overrides [#142112](https://github.com/openclaw/openclaw/pull/142112). Thanks @DasX, @obviyus.
+- Show available Gateway details in full status reports [#142174](https://github.com/openclaw/openclaw/pull/142174).
+- Explain when CLI commands require an explicit agent [#143266](https://github.com/openclaw/openclaw/pull/143266).
+
+**Documentation**
+
+- Document system command port and password options [#139071](https://github.com/openclaw/openclaw/pull/139071). Thanks @qingminglong, @obviyus.
+
+
+
+
+
+
+##### Keep more useful Code Mode results
+
+
+[Code Mode](https://docs.openclaw.ai/tools/code-mode) uses less of its result space for formatting, leaving more room for the information your Claw asked for. The terminal also shows that data as written, without treating parts of it as message formatting. Code that calls itself too deeply now returns an error the Claw can work from, making it possible to correct that code and continue.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Fit compact Code Mode results and show literal JSON [#141417](https://github.com/openclaw/openclaw/pull/141417).
+- Keep recursive Code Mode cells recoverable [#141960](https://github.com/openclaw/openclaw/pull/141960). Thanks @vincentkoc.
+
+**Documentation**
+
+- Organize Code Mode guidance by task [#142425](https://github.com/openclaw/openclaw/pull/142425). Thanks @vincentkoc.
+
+
+
+
+
+
+##### Start and restore coding workspaces
+
+
+A [worktree](https://docs.openclaw.ai/concepts/managed-worktrees) gives your Claw a separate working copy of a code project. Setup retries now keep the version you originally selected, and projects with many branches keep the option to start a worktree available. You can type a branch or commit that is missing from the suggestions, with an error if it cannot be found.
+
+Saved worktrees also restore changes that replaced a file with a folder, or a folder with a file, keeping the replacement contents intact.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Validate worktree starting refs and preserve accepted commits [#135917](https://github.com/openclaw/openclaw/pull/135917). Thanks @RomneyDa.
+- Accept surrounding spaces in managed-worktree IDs [#141373](https://github.com/openclaw/openclaw/pull/141373). Thanks @nocodet888-arch, @obviyus.
+- Keep worktree sessions available in repositories with many branches [#143205](https://github.com/openclaw/openclaw/pull/143205).
+- Preserve file and folder replacements in worktree recovery [#143324](https://github.com/openclaw/openclaw/pull/143324).
+
+**Documentation**
+
+- Add worktree commands to the CLI index [#137422](https://github.com/openclaw/openclaw/pull/137422). Thanks @qingminglong, @obviyus.
+
+
+
+
+
+
+##### Keep instructions and side questions on track
+
+
+When a long `AGENTS.md` instruction file has to be shortened, an example keeps the line directly above it that explains what it is, helping keep a quotation from looking like a new instruction. The shortened instructions also recognize more Traditional Chinese rules, although the available space still limits what can be included.
+
+If you track model usage, completed `/btw` side answers can now include their reported usage in your configured diagnostics. Those side questions still sit outside the conversation’s `/usage` cost total.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Reduce repeated work when listing unpinned sessions [#141788](https://github.com/openclaw/openclaw/pull/141788).
+
+**Bug fixes**
+
+- Preserve adjacent example framing in shortened instructions [#137974](https://github.com/openclaw/openclaw/pull/137974). Thanks @SunnyShu0925, @obviyus, @Hawk5150.
+- Report usage from direct /btw answers [#141620](https://github.com/openclaw/openclaw/pull/141620).
+- Guide agents after rejected goal updates [#142808](https://github.com/openclaw/openclaw/pull/142808). Thanks @SunnyShu0925, @obviyus, @aminekhettat.
+- Repair native Git attribution replay before its move to session instructions [#142869](https://github.com/openclaw/openclaw/pull/142869). Thanks @Marvinthebored, @obviyus.
+- Retain Traditional Chinese rules in oversized instructions [#142915](https://github.com/openclaw/openclaw/pull/142915). Thanks @sunlit-deng, @obviyus, @igs-rogenlo.
+- Keep eligible Git co-author guidance in conditional session instructions [#143198](https://github.com/openclaw/openclaw/pull/143198). Thanks @Marvinthebored.
+- Keep side-question resources available through cleanup [#143366](https://github.com/openclaw/openclaw/pull/143366).
+
+**Documentation**
+
+- Organize the session reference by operator task [#143082](https://github.com/openclaw/openclaw/pull/143082). Thanks @vincentkoc.
+
+
+
+
+
+
+##### Time limits for delegated work
+
+
+[Subagents](https://docs.openclaw.ai/tools/subagents) are helpers your Claw can send to work on part of a task. Helpers with visible conversations now get the time selected for their first task, so longer work is not cut short by the ordinary deadline. Later messages use the normal time limit. A separate fix helps finished results return to the right agent after a restart when several agents share one Gateway.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Route restored subagent results to their saved requester [#141480](https://github.com/openclaw/openclaw/pull/141480). Thanks @aeoess, @obviyus, @laurenceputra, @toraiwa.
+- Reject incomplete subagent continuation handoffs [#141901](https://github.com/openclaw/openclaw/pull/141901). Thanks @Takhoffman.
+- Allow independent child runs to register from parent tools [#142652](https://github.com/openclaw/openclaw/pull/142652). Thanks @jalehman.
+- Honor initial visible-subagent time limits [#142812](https://github.com/openclaw/openclaw/pull/142812). Thanks @fanyangCS, @obviyus.
+
+**Documentation**
+
+- Split sub-agent guidance into focused linked pages [#142999](https://github.com/openclaw/openclaw/pull/142999). Thanks @vincentkoc.
+
+
+
+
+
+
+##### Find the help you need
+
+
+The [FAQ](https://docs.openclaw.ai/help/faq) is organized around the question you are trying to answer, and the documentation home gives you direct paths to releases, skills, automations, and building plugins. Setup examples are clearer, and repairs to older bookmarks and help links make the relevant instructions easier to reach. Simplified Chinese navigation also gains translated labels, including separate Releases and Contributing tabs.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Fix the troubleshooting link in automated support replies [#143194](https://github.com/openclaw/openclaw/pull/143194). Thanks @vincentkoc.
+- Keep example headings out of documentation maps [#143299](https://github.com/openclaw/openclaw/pull/143299). Thanks @qingminglong, @obviyus.
+- Repair documentation links in errors and troubleshooting [#143497](https://github.com/openclaw/openclaw/pull/143497). Thanks @vincentkoc.
+
+**Documentation**
+
+- Correct Windows, ChromeOS, and durable-work maturity listings [#142066](https://github.com/openclaw/openclaw/pull/142066). Thanks @RomneyDa.
+- Connect related plugin and provider guides [#143021](https://github.com/openclaw/openclaw/pull/143021). Thanks @vincentkoc.
+- Add related-guide links and Chinese label translations [#143040](https://github.com/openclaw/openclaw/pull/143040). Thanks @vincentkoc.
+- Organize the FAQ into focused topic pages [#143150](https://github.com/openclaw/openclaw/pull/143150). Thanks @vincentkoc.
+- Improve links between guides and command references [#143157](https://github.com/openclaw/openclaw/pull/143157). Thanks @vincentkoc.
+- Restore legacy documentation section links [#143586](https://github.com/openclaw/openclaw/pull/143586). Thanks @vincentkoc.
+- Clarify setup guidance, pruning defaults, and Exa modes [#143770](https://github.com/openclaw/openclaw/pull/143770). Thanks @vincentkoc.
+- Improve navigation between documentation guides [#143773](https://github.com/openclaw/openclaw/pull/143773). Thanks @vincentkoc.
+- Reorganize CLI and tool documentation [#143775](https://github.com/openclaw/openclaw/pull/143775). Thanks @vincentkoc.
+- Correct Gateway and provider setup documentation [#143796](https://github.com/openclaw/openclaw/pull/143796). Thanks @vincentkoc.
+- Add bot-loop, transcripts, Copilot, Baseten, and incident-response guides to the sidebar [#143845](https://github.com/openclaw/openclaw/pull/143845). Thanks @vincentkoc.
+- Improve Chinese documentation labels [#143853](https://github.com/openclaw/openclaw/pull/143853). Thanks @vincentkoc.
+- Improve guide links and section navigation [#143855](https://github.com/openclaw/openclaw/pull/143855). Thanks @vincentkoc.
+- Repair concept and troubleshooting links [#143923](https://github.com/openclaw/openclaw/pull/143923). Thanks @vincentkoc.
+- Improve channel and plugin guide navigation [#143926](https://github.com/openclaw/openclaw/pull/143926). Thanks @vincentkoc.
+- Simplify setup and concept documentation [#143931](https://github.com/openclaw/openclaw/pull/143931). Thanks @vincentkoc.
+- Reorganize setup and operating guides [#143977](https://github.com/openclaw/openclaw/pull/143977). Thanks @vincentkoc.
+- Clarify tool and channel reference prose [#143979](https://github.com/openclaw/openclaw/pull/143979). Thanks @vincentkoc.
+- Improve documentation tabs and headings [#144021](https://github.com/openclaw/openclaw/pull/144021). Thanks @vincentkoc.
+- Align Chinese release and contributor navigation [#144037](https://github.com/openclaw/openclaw/pull/144037). Thanks @RomneyDa, @vincentkoc.
+- Restore Windows maturity section links [#144067](https://github.com/openclaw/openclaw/pull/144067).
+- Clarify agent setup and Gateway concepts [#144086](https://github.com/openclaw/openclaw/pull/144086). Thanks @vincentkoc.
+- Improve documentation home links and wording [#144089](https://github.com/openclaw/openclaw/pull/144089). Thanks @vincentkoc.
+
+
+
+
+
+
+
+#### Other Bug Fixes
+
+OpenClaw now handles more of the interruptions that can leave you without an answer, stop a conversation from loading, or make a successful task look like it failed. Error messages and troubleshooting records also explain more of what happened.
+
+
+
+
+##### Get the answer after the work is done
+
+
+Your Claw can recover a missing final reply in more cases where the work finished but the answer never arrived, including after a lost model connection or an earlier tool error. It asks the model for an explanation without repeating completed actions, giving you another chance to see what was done.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Clarify text-only recovery for missing final answers [#141705](https://github.com/openclaw/openclaw/pull/141705). Thanks @fabiolr, @adinballew, @RomneyDa.
+- Recover final replies after interrupted provider streams [#142168](https://github.com/openclaw/openclaw/pull/142168). Thanks @liuwqgit, @obviyus, @wpu911.
+- Recover final answers after earlier tool errors [#143598](https://github.com/openclaw/openclaw/pull/143598). Thanks @harjothkhara, @obviyus, @CK-XYZ.
+
+
+
+
+
+
+##### Start fresh and reopen conversations
+
+
+Starting over with [`/new` or `/reset`](https://docs.openclaw.ai/tools/slash-commands) avoids unnecessary waits, especially in conversations where your Claw has handed work to other agents, and canceled tasks stay stopped when late results arrive. Your saved history and other conversations remain available.
+
+Old plugin messages outside the current conversation no longer stop its history from loading, and long conversations keep recent messages available when your Claw pauses to wait for other work. If a text-only reply fails partway through, the model also receives a short note about that failure when you continue, so the attempt no longer disappears from its context.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Retain failed partial-answer context for the next model request [989abf6](https://github.com/openclaw/openclaw/commit/989abf68703796dedcdd91d0ab7116684de69b8d), with contextual provenance in [#125977](https://github.com/openclaw/openclaw/pull/125977). Thanks @ayaangazali.
+- Keep inactive custom messages from breaking session history [#125413](https://github.com/openclaw/openclaw/pull/125413).
+- Keep long histories readable during yield cleanup [#137381](https://github.com/openclaw/openclaw/pull/137381), related to [issue #109638](https://github.com/openclaw/openclaw/issues/109638). Thanks @jalehman, @samrrr, @VACInc.
+- Avoid thinking-lookup delays for standalone session resets [#143281](https://github.com/openclaw/openclaw/pull/143281).
+- Keep current history readable after a reset [#143726](https://github.com/openclaw/openclaw/pull/143726).
+- Reduce repeated reset work while keeping child tasks stopped [#143916](https://github.com/openclaw/openclaw/pull/143916). Thanks @obviyus, @aleps001, @zhangguiping-xydt.
+
+
+
+
+
+
+##### Clearer file errors and command results
+
+
+When your Claw cannot save a file in its workspace, it now explains whether access was denied, the disk is full, or the location is read-only. That gives you a useful starting point for fixing the problem. Tool Search also fixes a case where a supplied file path was lost before the file could be read.
+
+On Linux, affected SSH commands can finish instead of being stopped too early. Commands on macOS and Linux also avoid a false cleanup error after successful work. Restart OpenClaw if you updated with `--no-restart` to get that cleanup fix.
+
+
+
+###### Sources and complete change list
+
+
+**Bug fixes**
+
+- Explain filesystem causes of failed workspace writes [#116378](https://github.com/openclaw/openclaw/pull/116378), related to [issue #115920](https://github.com/openclaw/openclaw/issues/115920). Thanks @sloptop-the-terrible, @obviyus, @609NFT, @geekforlife.
+- Clean up adopted Linux processes after command timeouts [#139548](https://github.com/openclaw/openclaw/pull/139548), a partial repair for [issue #97616](https://github.com/openclaw/openclaw/issues/97616). Cleanup is best effort and stops after 30 seconds. Thanks @srikolagani, @obviyus, @avp717, @Grynn, @islandpreneur007, @jinngimk-lang.
+- Let service-managed SSH commands finish normally after closing inherited file handles [#141463](https://github.com/openclaw/openclaw/pull/141463). The demonstrated repair is on Linux. Thanks @jjjhenriksen, @obviyus, @manumadrigal09, @ouioui33, @avcarp, @kaspnov.
+- Avoid false cleanup failures after successful POSIX commands [#143240](https://github.com/openclaw/openclaw/pull/143240).
+- Preserve tool arguments beside empty wrappers [#143729](https://github.com/openclaw/openclaw/pull/143729). Thanks @xydigitLybnnnn, @obviyus, @nkdmike.
+
+
+
+
+
+
+##### Troubleshoot errors and exported conversations
+
+
+OpenClaw can now wait through a brief database lock instead of immediately failing to read its saved settings. When a database problem does cause a failure or shutdown, error messages preserve more of the information needed to investigate it. [Logs](https://docs.openclaw.ai/logging) also give operators a clearer view of which work is waiting or taking time, with extra detail available when diagnostics are enabled.
+
+Exported conversations keep file-read results that were incorrectly removed, including instructions for reading the next part of a file. With the relevant diagnostic recording enabled, records also include actions taken after switching to a backup model and partial responses received before an interruption. Sensitive information is still removed, and recording size limits still apply.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Identify slow and failed SQLite session writes [#143451](https://github.com/openclaw/openclaw/pull/143451).
+- Identify execution threads in SQLite warnings [#143629](https://github.com/openclaw/openclaw/pull/143629).
+- Identify operations holding session queues [#143886](https://github.com/openclaw/openclaw/pull/143886).
+- Explain slow session cleanup preparation [#143942](https://github.com/openclaw/openclaw/pull/143942).
+- Clarify SQLite write and worker-release diagnostics [#144038](https://github.com/openclaw/openclaw/pull/144038). A release event alone does not establish successful cleanup or commit.
+
+**Bug fixes**
+
+- Include fallback tool activity in trajectory exports [#114662](https://github.com/openclaw/openclaw/pull/114662), related to [issue #114602](https://github.com/openclaw/openclaw/issues/114602). Thanks @synthalorian, @obviyus, @jackatagenticforce.
+- Preserve SQLite fatal diagnostics from worker threads [#143039](https://github.com/openclaw/openclaw/pull/143039).
+- Preserve partial debug captures and report shutdown storage failures [#143107](https://github.com/openclaw/openclaw/pull/143107). Thanks @vincentkoc.
+- Preserve the initiating database error during cleanup [#143574](https://github.com/openclaw/openclaw/pull/143574).
+- Wait for brief locks during state reads [#143908](https://github.com/openclaw/openclaw/pull/143908). Persistent locks can still fail. Thanks @pash-openai.
+- Keep paginated file reads in session exports [#143930](https://github.com/openclaw/openclaw/pull/143930). Thanks @linhongyu510, @obviyus, @cp1369.
+
+
+
+
+
+
+
+#### Maintainer and Internal Changes
+
+This release includes 692 maintainer-only units covering code cleanup, testing, release preparation, and contributor tools. Expand the source lists for the full change history.
+
+
+
+
+##### Internal code cleanup
+
+
+Shared code and type definitions replace duplicated logic across OpenClaw. This gives maintainers fewer places to update when changing behavior and removes unused code.
+
+
+
+###### Sources and complete change list
+
+
+The inbound-hook mapper compatibility concern is addressed by the separately documented public repair. Two terminal-writer cleanups remove private reset and closed-state helpers; compatibility with untracked consumers of private imports is not established.
+
+**Improvements**
+
+- Remove the fixed orphan-prompt strategy wrapper [746e53f2](https://github.com/openclaw/openclaw/commit/746e53f21fe9fa671030343545daf65588816dd0)
+- Simplify shared tool-summary formatting [#136181](https://github.com/openclaw/openclaw/pull/136181)
+- Remove the unused internal health-check execution path [#138211](https://github.com/openclaw/openclaw/pull/138211)
+- Remove unused Doctor health-check arguments [#141475](https://github.com/openclaw/openclaw/pull/141475). Thanks @vincentkoc.
+- Return cron activation state from its existing transaction [#141676](https://github.com/openclaw/openclaw/pull/141676). Thanks @RomneyDa.
+- Skip unused distance calculations for trailing wake names [#141683](https://github.com/openclaw/openclaw/pull/141683)
+- Type incoming Reef versions as unverified input [#141687](https://github.com/openclaw/openclaw/pull/141687). Thanks @RomneyDa.
+- Separate cron script-result parsing from execution [#141688](https://github.com/openclaw/openclaw/pull/141688)
+- Separate transcript summary persistence from live capture [#141695](https://github.com/openclaw/openclaw/pull/141695)
+- Separate prepared-runtime snapshot construction [#141711](https://github.com/openclaw/openclaw/pull/141711)
+- Remove redundant CLI binary-name resolution [#141713](https://github.com/openclaw/openclaw/pull/141713)
+- Remove unused restart test overrides [#141714](https://github.com/openclaw/openclaw/pull/141714)
+- Share HTML tag scanning between web-fetch stages [#141726](https://github.com/openclaw/openclaw/pull/141726)
+- Separate prepared-runtime retention and auth invalidation [#141728](https://github.com/openclaw/openclaw/pull/141728)
+- Unify Profile identity-save handling [#141730](https://github.com/openclaw/openclaw/pull/141730)
+- Share Slack reply preparation without changing delivery order [#141733](https://github.com/openclaw/openclaw/pull/141733)
+- Share the CLI local-onboarding decision [#141735](https://github.com/openclaw/openclaw/pull/141735)
+- Centralize native approval adapter type handling [#141737](https://github.com/openclaw/openclaw/pull/141737). Thanks @RomneyDa.
+- Centralize native WebKit bridge message types [#141764](https://github.com/openclaw/openclaw/pull/141764). Thanks @RomneyDa.
+- Share the transcript idempotency-key reader [#141772](https://github.com/openclaw/openclaw/pull/141772). Thanks @vincentkoc.
+- Remove unused UI text-formatting options [#141783](https://github.com/openclaw/openclaw/pull/141783). Thanks @vincentkoc.
+- Reuse Doctor's shared legacy source-identity comparison [#141784](https://github.com/openclaw/openclaw/pull/141784). Thanks @vincentkoc.
+- Separate model-catalog source preparation [#141810](https://github.com/openclaw/openclaw/pull/141810)
+- Share model-catalog presentation across local readers [#141815](https://github.com/openclaw/openclaw/pull/141815). Thanks @obviyus.
+- Move cached turn replay into the dedupe module [#141824](https://github.com/openclaw/openclaw/pull/141824)
+- Reuse Doctor's path-containment helper [#141828](https://github.com/openclaw/openclaw/pull/141828). Thanks @vincentkoc.
+- Simplify built-in memory runtime delegation [#141847](https://github.com/openclaw/openclaw/pull/141847)
+- Centralize memory dreaming types in the host SDK [#141873](https://github.com/openclaw/openclaw/pull/141873). Thanks @RomneyDa.
+- Share ClawHub skill response types through the protocol [#141874](https://github.com/openclaw/openclaw/pull/141874). Thanks @RomneyDa.
+- Derive conversation capability types from their resolver [#141878](https://github.com/openclaw/openclaw/pull/141878). Thanks @RomneyDa.
+- Derive inbound hook context types from their producer [#141880](https://github.com/openclaw/openclaw/pull/141880). Thanks @RomneyDa.
+- Share provider request secret-field definitions [#141882](https://github.com/openclaw/openclaw/pull/141882)
+- Reuse channel setup configuration writers [#141929](https://github.com/openclaw/openclaw/pull/141929)
+- Simplify Markdown span ordering bookkeeping [#141945](https://github.com/openclaw/openclaw/pull/141945). Thanks @vincentkoc.
+- Remove unreachable TUI streaming state [#141999](https://github.com/openclaw/openclaw/pull/141999)
+- Avoid duplicate validation when listing sessions [#142005](https://github.com/openclaw/openclaw/pull/142005)
+- Preserve plugin types during search setup [#142006](https://github.com/openclaw/openclaw/pull/142006)
+- Derive UI session types from Gateway definitions [#142025](https://github.com/openclaw/openclaw/pull/142025). Thanks @RomneyDa.
+- Derive Matrix configuration types from schemas [#142026](https://github.com/openclaw/openclaw/pull/142026). Thanks @RomneyDa.
+- Derive Nextcloud Talk types from schemas [#142027](https://github.com/openclaw/openclaw/pull/142027). Thanks @RomneyDa.
+- Derive Mattermost types from schemas [#142028](https://github.com/openclaw/openclaw/pull/142028). Thanks @RomneyDa.
+- Share activation configuration merging [#142045](https://github.com/openclaw/openclaw/pull/142045)
+- Remove an ineffective source-loader option [#142050](https://github.com/openclaw/openclaw/pull/142050)
+- Consolidate plugin install metadata classification [#142075](https://github.com/openclaw/openclaw/pull/142075)
+- Remove unused plugin-loader cache bookkeeping [#142078](https://github.com/openclaw/openclaw/pull/142078). Thanks @vincentkoc.
+- Remove unused board notice injection inputs [#142101](https://github.com/openclaw/openclaw/pull/142101)
+- Remove unused plugin install option forwarding [#142121](https://github.com/openclaw/openclaw/pull/142121)
+- Remove unused configuration path from lock handles [#142127](https://github.com/openclaw/openclaw/pull/142127). Thanks @vincentkoc.
+- Avoid recounting plugin state after quota eviction [#142148](https://github.com/openclaw/openclaw/pull/142148)
+- Share assignment detection across redaction outputs [#142183](https://github.com/openclaw/openclaw/pull/142183)
+- Remove redundant duplicate tracking from buffered replies [#142205](https://github.com/openclaw/openclaw/pull/142205)
+- Separate plugin inspection authority from resource lifetime [#142214](https://github.com/openclaw/openclaw/pull/142214)
+- Skip unused Markdown scans during reply parsing [#142220](https://github.com/openclaw/openclaw/pull/142220)
+- Reduce temporary collection work in agent rosters [#142229](https://github.com/openclaw/openclaw/pull/142229)
+- Share session-list selection logic [#142239](https://github.com/openclaw/openclaw/pull/142239)
+- Reuse the prepared plugin-tool manifest lookup [#142249](https://github.com/openclaw/openclaw/pull/142249)
+- Avoid repeating rich-reply preparation for command delivery [#142252](https://github.com/openclaw/openclaw/pull/142252)
+- Reduce repeated URL preparation in terminal messages [#142262](https://github.com/openclaw/openclaw/pull/142262)
+- Share sandbox filesystem operation encoding [#142269](https://github.com/openclaw/openclaw/pull/142269)
+- Narrow Memory Core's configuration import [#142270](https://github.com/openclaw/openclaw/pull/142270)
+- Avoid redundant HTTP conversation-history copies [#142309](https://github.com/openclaw/openclaw/pull/142309)
+- Skip unused settings preparation for reduced prompts [#142311](https://github.com/openclaw/openclaw/pull/142311)
+- Avoid duplicate copies of matching read-tool text [#142354](https://github.com/openclaw/openclaw/pull/142354)
+- Share plugin registration provenance types [#142359](https://github.com/openclaw/openclaw/pull/142359)
+- Share Android durable chat send dispatch [#142363](https://github.com/openclaw/openclaw/pull/142363)
+- Reduce temporary allocations when matching plugin commands [#142374](https://github.com/openclaw/openclaw/pull/142374)
+- Stop forwarded-avatar selection when its slots are filled [#142387](https://github.com/openclaw/openclaw/pull/142387)
+- Avoid unused copies during history image pruning [#142391](https://github.com/openclaw/openclaw/pull/142391)
+- Reuse shared configuration scans in plugin planning [#142396](https://github.com/openclaw/openclaw/pull/142396)
+- Consolidate equivalent Nodes dispatch cases [#142402](https://github.com/openclaw/openclaw/pull/142402)
+- Skip unused Telegram draft prefix preparation [#142404](https://github.com/openclaw/openclaw/pull/142404)
+- Derive Google Meet types from resolved settings [#142407](https://github.com/openclaw/openclaw/pull/142407). Thanks @RomneyDa.
+- Derive IRC configuration types from its schema [#142408](https://github.com/openclaw/openclaw/pull/142408). Thanks @RomneyDa.
+- Share plugin manifest and registry types [#142409](https://github.com/openclaw/openclaw/pull/142409). Thanks @RomneyDa.
+- Reuse Gateway types for Workshop storage [#142410](https://github.com/openclaw/openclaw/pull/142410). Thanks @RomneyDa.
+- Share bounded web response-byte reading [#142413](https://github.com/openclaw/openclaw/pull/142413)
+- Avoid redundant chat code-block preparation [#142444](https://github.com/openclaw/openclaw/pull/142444)
+- Reduce temporary Discord formatting allocations [#142447](https://github.com/openclaw/openclaw/pull/142447)
+- Avoid intermediate arrays in model-message preparation [#142450](https://github.com/openclaw/openclaw/pull/142450)
+- Remove unused prompt-based queue deduplication [#142455](https://github.com/openclaw/openclaw/pull/142455)
+- Simplify extra bootstrap file loading [#142469](https://github.com/openclaw/openclaw/pull/142469)
+- Reduce temporary Swarm roster collections [#142488](https://github.com/openclaw/openclaw/pull/142488)
+- Avoid unused display preparation during chat export [#142491](https://github.com/openclaw/openclaw/pull/142491)
+- Remove unused setup callback authentication argument [#142494](https://github.com/openclaw/openclaw/pull/142494). Thanks @vincentkoc.
+- Remove unreachable Matrix forced-reset retry [#142495](https://github.com/openclaw/openclaw/pull/142495)
+- Share diagnostic listener registration [#142499](https://github.com/openclaw/openclaw/pull/142499). Thanks @vincentkoc.
+- Consolidate Gateway restart health finalization [#142513](https://github.com/openclaw/openclaw/pull/142513)
+- Reuse prepared LINE table cells [#142542](https://github.com/openclaw/openclaw/pull/142542)
+- Reuse message preparation during chat renders [#142570](https://github.com/openclaw/openclaw/pull/142570)
+- Share startup plugin membership checks [#142587](https://github.com/openclaw/openclaw/pull/142587). Thanks @vincentkoc.
+- Simplify pending tool-result bookkeeping [#142599](https://github.com/openclaw/openclaw/pull/142599)
+- Centralize Apple Gateway error presentation overrides [#142601](https://github.com/openclaw/openclaw/pull/142601)
+- Share Go and UV skill package validation [#142625](https://github.com/openclaw/openclaw/pull/142625). Thanks @vincentkoc.
+- Extract Codex feature-list protocol types [#142648](https://github.com/openclaw/openclaw/pull/142648). Thanks @RomneyDa.
+- Simplify internal status-report formatting [#142707](https://github.com/openclaw/openclaw/pull/142707)
+- Share route restoration across Control UI pages [#142709](https://github.com/openclaw/openclaw/pull/142709). Thanks @vincentkoc.
+- Isolate model-policy integer parsing [#142804](https://github.com/openclaw/openclaw/pull/142804)
+- Reuse prepared provider ownership metadata [#142818](https://github.com/openclaw/openclaw/pull/142818)
+- Simplify outbound reply mirroring [#142819](https://github.com/openclaw/openclaw/pull/142819)
+- Simplify interactive SDK exports [#142824](https://github.com/openclaw/openclaw/pull/142824)
+- Reduce media-reference formatting overhead [#142836](https://github.com/openclaw/openclaw/pull/142836)
+- Render HTTP history without intermediate entry copies [#142856](https://github.com/openclaw/openclaw/pull/142856)
+- Remove duplicate configuration tag preparation [#142864](https://github.com/openclaw/openclaw/pull/142864). Thanks @vincentkoc.
+- Reuse plugin metadata during contribution discovery [#142975](https://github.com/openclaw/openclaw/pull/142975)
+- Remove unused plugin metadata discovery fallback [#143020](https://github.com/openclaw/openclaw/pull/143020)
+- Reuse prepared paths in Claude plugin manifest loading [#143027](https://github.com/openclaw/openclaw/pull/143027)
+- Avoid redundant JSON-mode invocation parsing [#143097](https://github.com/openclaw/openclaw/pull/143097)
+- Share sandbox filesystem parameter types [#143189](https://github.com/openclaw/openclaw/pull/143189)
+- Share host desktop status formatting [#143223](https://github.com/openclaw/openclaw/pull/143223)
+- Consolidate post-update continuation handling [#143269](https://github.com/openclaw/openclaw/pull/143269)
+- Remove obsolete node CLI timeout overrides [#143330](https://github.com/openclaw/openclaw/pull/143330)
+- Unify Android capability approval state [#143352](https://github.com/openclaw/openclaw/pull/143352)
+- Simplify Synology webhook body handling [#143360](https://github.com/openclaw/openclaw/pull/143360)
+- Reuse shared dreaming statistics types [#143368](https://github.com/openclaw/openclaw/pull/143368)
+- Share Pi and Claude transcript range reading [#143374](https://github.com/openclaw/openclaw/pull/143374)
+- Share paired-node request assembly [#143380](https://github.com/openclaw/openclaw/pull/143380)
+- Remove unused chat-history configuration argument [#143395](https://github.com/openclaw/openclaw/pull/143395). Thanks @vincentkoc.
+- Remove duplicate Automations editor state [#143405](https://github.com/openclaw/openclaw/pull/143405)
+- Unify missing-command ownership resolution [#143411](https://github.com/openclaw/openclaw/pull/143411)
+- Share wizard prompt argument construction [#143430](https://github.com/openclaw/openclaw/pull/143430)
+- Consolidate hook-source selection policy [#143439](https://github.com/openclaw/openclaw/pull/143439)
+- Avoid repeated system-message trimming [#143453](https://github.com/openclaw/openclaw/pull/143453)
+- Reuse normalized channel setup metadata [#143470](https://github.com/openclaw/openclaw/pull/143470)
+- Simplify internal CLI help context [#143477](https://github.com/openclaw/openclaw/pull/143477)
+- Avoid an extra Code Mode diagnostic array copy [#143482](https://github.com/openclaw/openclaw/pull/143482)
+- Share Doctor session migration validation [#143507](https://github.com/openclaw/openclaw/pull/143507)
+- Reuse shared channel configuration writers [#143547](https://github.com/openclaw/openclaw/pull/143547)
+- Derive sandbox settings types from validation schemas [#143551](https://github.com/openclaw/openclaw/pull/143551). Thanks @RomneyDa.
+- Derive installation record types from validation schemas [#143552](https://github.com/openclaw/openclaw/pull/143552). Thanks @RomneyDa.
+- Derive Codex configuration types from existing schemas [#143553](https://github.com/openclaw/openclaw/pull/143553). Thanks @RomneyDa.
+- Share agent configuration schemas and types [#143554](https://github.com/openclaw/openclaw/pull/143554). Thanks @RomneyDa.
+- Share Memory Wiki report and index rendering [#143568](https://github.com/openclaw/openclaw/pull/143568)
+- Centralize Policy document validation [#143600](https://github.com/openclaw/openclaw/pull/143600)
+- Share Comfy workflow polling [#143653](https://github.com/openclaw/openclaw/pull/143653)
+- Consolidate worker validation and workspace reconciliation [#143667](https://github.com/openclaw/openclaw/pull/143667)
+- Reuse shared Markdown rendering for assistant messages [#143706](https://github.com/openclaw/openclaw/pull/143706)
+- Re-export shared provider ID helpers [#143712](https://github.com/openclaw/openclaw/pull/143712)
+- Share model catalog metadata merging [#143715](https://github.com/openclaw/openclaw/pull/143715)
+- Share completion and speech-summary cleanup ownership [#143716](https://github.com/openclaw/openclaw/pull/143716)
+- Remove redundant completion media checks [#143734](https://github.com/openclaw/openclaw/pull/143734)
+- Remove obsolete Discord thread-expiry fallback [#143737](https://github.com/openclaw/openclaw/pull/143737)
+- Consolidate Matrix action parsing and invalid-operation diagnostics [#143759](https://github.com/openclaw/openclaw/pull/143759)
+- Share question validation and terminal state handling [#143766](https://github.com/openclaw/openclaw/pull/143766)
+- Remove Doctor's unused standalone transcript writer [#143772](https://github.com/openclaw/openclaw/pull/143772)
+- Share prepared completion resource cleanup [#143792](https://github.com/openclaw/openclaw/pull/143792)
+- Reuse Gateway session response types in the UI [#143803](https://github.com/openclaw/openclaw/pull/143803)
+- Consolidate fast-mode state construction [#143816](https://github.com/openclaw/openclaw/pull/143816)
+- Share thinking-default policy resolution [#143849](https://github.com/openclaw/openclaw/pull/143849)
+- Share image-request resource ownership [#143871](https://github.com/openclaw/openclaw/pull/143871)
+- Share browser action execution options [#143887](https://github.com/openclaw/openclaw/pull/143887)
+- Simplify migration stop tracking [#143912](https://github.com/openclaw/openclaw/pull/143912)
+- Simplify inference command registration [#143920](https://github.com/openclaw/openclaw/pull/143920)
+- Share desktop rendering inputs [#143922](https://github.com/openclaw/openclaw/pull/143922)
+- Share Mattermost reaction dispatch [#143949](https://github.com/openclaw/openclaw/pull/143949)
+- Remove unused terminal writer reset [#143969](https://github.com/openclaw/openclaw/pull/143969)
+- Consolidate root option forwarding [#143993](https://github.com/openclaw/openclaw/pull/143993)
+- Verify terminal closure through write behavior [#144007](https://github.com/openclaw/openclaw/pull/144007)
+- Reuse model catalog deduplication [#144012](https://github.com/openclaw/openclaw/pull/144012)
+- Simplify provider secret marker restoration [#144036](https://github.com/openclaw/openclaw/pull/144036)
+- Share realtime Talk response types [#144077](https://github.com/openclaw/openclaw/pull/144077)
+- Carry model selection together through recovery [#144088](https://github.com/openclaw/openclaw/pull/144088)
+- Avoid unused task-detail copies in notifications [#144115](https://github.com/openclaw/openclaw/pull/144115)
+- Simplify compaction setup [#144121](https://github.com/openclaw/openclaw/pull/144121)
+
+**Bug fixes**
+
+- Restore desktop lint checks [#143889](https://github.com/openclaw/openclaw/pull/143889)
+
+
+
+
+
+
+##### Test reliability and upkeep
+
+
+Tests are less prone to failures caused by timing, leftover data, or the machine running them. Reusing setup and removing duplicate checks also reduces unnecessary work for contributors.
+
+
+
+###### Sources and complete change list
+
+
+Reported timings cover different local workloads and cannot be added into a release-wide speedup. Test-only changes below do not establish new behavior in the running application.
+
+**Improvements**
+
+- Reuse the deferred-promise helper in Gateway tests [2a4d6a10](https://github.com/openclaw/openclaw/commit/2a4d6a10ae6013ece39ae581762daf13b84ff1c9)
+- Keep interactive preview actions consistent with fixture state [#138350](https://github.com/openclaw/openclaw/pull/138350). Thanks @vyctorbrzezowski.
+- Disable unrelated catalog refreshes in isolated tests [#141266](https://github.com/openclaw/openclaw/pull/141266). Thanks @vincentkoc.
+- Test the existing Parallels log-tail boundary [#141470](https://github.com/openclaw/openclaw/pull/141470)
+- Reuse provider registries in catalog-auth tests [#141682](https://github.com/openclaw/openclaw/pull/141682)
+- Avoid redundant waits in Kova authentication tests [#141693](https://github.com/openclaw/openclaw/pull/141693)
+- Synchronize terminal startup tests with history loading [#141704](https://github.com/openclaw/openclaw/pull/141704)
+- Skip browser asset preparation in config RPC tests [#141741](https://github.com/openclaw/openclaw/pull/141741)
+- Share unreachable Gateway probe test fixtures [#141758](https://github.com/openclaw/openclaw/pull/141758)
+- Clean up security-scan fixture lint violations [#141778](https://github.com/openclaw/openclaw/pull/141778)
+- Share migration-test snapshot inputs [#141782](https://github.com/openclaw/openclaw/pull/141782)
+- Avoid idle-connection waits in webhook handoff tests [#141790](https://github.com/openclaw/openclaw/pull/141790)
+- Make web-search validator fixtures independent of client defaults [#141792](https://github.com/openclaw/openclaw/pull/141792)
+- Simplify Discord recording test branches [#141804](https://github.com/openclaw/openclaw/pull/141804)
+- Keep the image-probe reply matcher private [#141823](https://github.com/openclaw/openclaw/pull/141823)
+- Compact Code Mode source-validation test matrices [#141831](https://github.com/openclaw/openclaw/pull/141831). Thanks @RomneyDa.
+- Compact CLI argument test matrices [#141832](https://github.com/openclaw/openclaw/pull/141832). Thanks @RomneyDa.
+- Compact reasoning-tag test fixtures [#141833](https://github.com/openclaw/openclaw/pull/141833). Thanks @RomneyDa.
+- Compact Control UI routing test fixtures [#141834](https://github.com/openclaw/openclaw/pull/141834). Thanks @RomneyDa.
+- Remove an unused Comfy test fixture option [#141844](https://github.com/openclaw/openclaw/pull/141844)
+- Consolidate model-command policy tests [#141861](https://github.com/openclaw/openclaw/pull/141861). Thanks @RomneyDa.
+- Test the HTML comparison script's actual response limit [#141877](https://github.com/openclaw/openclaw/pull/141877)
+- Simplify Crabbox shell-detection test tables [#141888](https://github.com/openclaw/openclaw/pull/141888). Thanks @RomneyDa.
+- Simplify Doctor plugin repair test tables [#141889](https://github.com/openclaw/openclaw/pull/141889). Thanks @RomneyDa.
+- Simplify Active Memory policy test tables [#141890](https://github.com/openclaw/openclaw/pull/141890). Thanks @RomneyDa.
+- Simplify message account-isolation test tables [#141891](https://github.com/openclaw/openclaw/pull/141891). Thanks @RomneyDa.
+- Consolidate Vitest project-loading checks [#141908](https://github.com/openclaw/openclaw/pull/141908)
+- Share fresh logger fixtures across core tests [#141911](https://github.com/openclaw/openclaw/pull/141911)
+- Remove implementation-specific configuration assertions [#141919](https://github.com/openclaw/openclaw/pull/141919)
+- Simplify Google image test fixtures [#141926](https://github.com/openclaw/openclaw/pull/141926)
+- Verify playback cache limits through writes [#141944](https://github.com/openclaw/openclaw/pull/141944)
+- Use runtime context in plugin compatibility tests [#141989](https://github.com/openclaw/openclaw/pull/141989)
+- Use controlled timing in fatal Git-outcome tests [#142009](https://github.com/openclaw/openclaw/pull/142009)
+- Compact channel account-helper test tables [#142029](https://github.com/openclaw/openclaw/pull/142029). Thanks @RomneyDa.
+- Compact execution-wrapper test fixtures [#142030](https://github.com/openclaw/openclaw/pull/142030). Thanks @RomneyDa.
+- Compact secrets runtime test matrices [#142031](https://github.com/openclaw/openclaw/pull/142031). Thanks @RomneyDa.
+- Simplify npm registry test tables [#142032](https://github.com/openclaw/openclaw/pull/142032). Thanks @RomneyDa.
+- Test scroll reset within the existing preview [#142044](https://github.com/openclaw/openclaw/pull/142044)
+- Reuse text tool-result fixtures in agent tests [#142051](https://github.com/openclaw/openclaw/pull/142051)
+- Add an Android branch-switching test scene [#142057](https://github.com/openclaw/openclaw/pull/142057). Thanks @vincentkoc.
+- Test watcher shutdown with real default intervals [#142079](https://github.com/openclaw/openclaw/pull/142079)
+- Simplify inline-command test tables [#142081](https://github.com/openclaw/openclaw/pull/142081). Thanks @RomneyDa.
+- Compact Gateway network-policy tests [#142082](https://github.com/openclaw/openclaw/pull/142082). Thanks @RomneyDa.
+- Compact CLI configuration-guard tests [#142083](https://github.com/openclaw/openclaw/pull/142083). Thanks @RomneyDa.
+- Compact WhatsApp formatting tests [#142084](https://github.com/openclaw/openclaw/pull/142084). Thanks @RomneyDa.
+- Share timestamped tool-result fixtures [#142094](https://github.com/openclaw/openclaw/pull/142094)
+- Align Mac script tests with system Bash [#142096](https://github.com/openclaw/openclaw/pull/142096)
+- Reuse deferred promises in chat lifecycle tests [#142098](https://github.com/openclaw/openclaw/pull/142098)
+- Simplify memory recall timeout test setup [#142108](https://github.com/openclaw/openclaw/pull/142108)
+- Strengthen Feishu permission-error regressions [#142117](https://github.com/openclaw/openclaw/pull/142117)
+- Reuse xAI video response fixtures [#142118](https://github.com/openclaw/openclaw/pull/142118)
+- Remove unused language-hint test options [#142119](https://github.com/openclaw/openclaw/pull/142119)
+- Share user and assistant message test fixtures [#142133](https://github.com/openclaw/openclaw/pull/142133)
+- Avoid repeated compilation in Doctor process tests [#142140](https://github.com/openclaw/openclaw/pull/142140)
+- Add bounded failure details to Code Mode polling tests [#142157](https://github.com/openclaw/openclaw/pull/142157)
+- Remove duplicate Discord retry tests [#142177](https://github.com/openclaw/openclaw/pull/142177)
+- Share timestamped assistant test inputs [#142184](https://github.com/openclaw/openclaw/pull/142184)
+- Share API-key credential test fixtures [#142245](https://github.com/openclaw/openclaw/pull/142245)
+- Share OAuth credential test fixtures [#142272](https://github.com/openclaw/openclaw/pull/142272)
+- Verify the merge method actually dispatched in tests [#142329](https://github.com/openclaw/openclaw/pull/142329)
+- Reduce the Telegram Markdown chunking test fixture [#142365](https://github.com/openclaw/openclaw/pull/142365)
+- Consolidate duplicate group-policy resolver tests [#142366](https://github.com/openclaw/openclaw/pull/142366)
+- Share cloud-agent fixtures across New Session tests [#142376](https://github.com/openclaw/openclaw/pull/142376)
+- Report successful installation in Docker test logs [#142405](https://github.com/openclaw/openclaw/pull/142405). Thanks @vincentkoc.
+- Remove unused Telegram edit-test branches [#142411](https://github.com/openclaw/openclaw/pull/142411)
+- Share plugin installation test path checks [#142448](https://github.com/openclaw/openclaw/pull/142448). Thanks @vincentkoc.
+- Remove an unreachable process-poll test branch [#142466](https://github.com/openclaw/openclaw/pull/142466)
+- Consolidate memory-flush test coverage [#142478](https://github.com/openclaw/openclaw/pull/142478)
+- Reuse compiled CLI code in message-cleanup tests [#142503](https://github.com/openclaw/openclaw/pull/142503)
+- Remove unused Doctor configuration test mocks [#142507](https://github.com/openclaw/openclaw/pull/142507)
+- Settle composer animations before alignment tests [#142509](https://github.com/openclaw/openclaw/pull/142509). Thanks @RomneyDa.
+- Remove redundant Matrix QA scenario forwarding [#142546](https://github.com/openclaw/openclaw/pull/142546)
+- Remove real timeout waits from Telegram observation tests [#142602](https://github.com/openclaw/openclaw/pull/142602)
+- Remove unused terminal mocks from skills tests [#142604](https://github.com/openclaw/openclaw/pull/142604)
+- Remove duplicate deep-transcript import stress coverage [#142614](https://github.com/openclaw/openclaw/pull/142614)
+- Share changelog fixtures in release-note verifier tests [#142659](https://github.com/openclaw/openclaw/pull/142659)
+- Clarify generated markers in live file-read tests [#142685](https://github.com/openclaw/openclaw/pull/142685). Thanks @RomneyDa.
+- Share Discord action expectations across tests [#142690](https://github.com/openclaw/openclaw/pull/142690)
+- Share Codex lifecycle test fixtures [#142732](https://github.com/openclaw/openclaw/pull/142732)
+- Remove idle delay from cleanup regression testing [#142733](https://github.com/openclaw/openclaw/pull/142733)
+- Simplify native chat test fixtures [#142757](https://github.com/openclaw/openclaw/pull/142757)
+- Reduce plugin loading in storage migration tests [#142777](https://github.com/openclaw/openclaw/pull/142777)
+- Isolate plugin inputs in migration tests [#142785](https://github.com/openclaw/openclaw/pull/142785)
+- Check live meeting-title drafts in regression tests [#142795](https://github.com/openclaw/openclaw/pull/142795)
+- Make Signal test reply policy explicit [#142796](https://github.com/openclaw/openclaw/pull/142796)
+- Reuse model fixtures in native command tests [#142797](https://github.com/openclaw/openclaw/pull/142797)
+- Share Gateway scope expectations in tests [#142806](https://github.com/openclaw/openclaw/pull/142806)
+- Share independent replay test expectations [#142816](https://github.com/openclaw/openclaw/pull/142816)
+- Simplify session tests and expose early rollback setup failures [#142833](https://github.com/openclaw/openclaw/pull/142833)
+- Share reply-dispatch test expectations [#142845](https://github.com/openclaw/openclaw/pull/142845)
+- Simplify worker lifecycle test gates [#142865](https://github.com/openclaw/openclaw/pull/142865)
+- Remove real deadline waits from Swift polling tests [#142882](https://github.com/openclaw/openclaw/pull/142882). Thanks @vincentkoc.
+- Remove real-time waits from Mermaid timeout tests [#142886](https://github.com/openclaw/openclaw/pull/142886). Thanks @vincentkoc.
+- Reuse deferred fixtures in cron lifecycle tests [#142887](https://github.com/openclaw/openclaw/pull/142887)
+- Remove duplicate OpenCode Go metadata testing [#142894](https://github.com/openclaw/openclaw/pull/142894). Thanks @vincentkoc.
+- Consolidate duplicate setup inference tests [#142899](https://github.com/openclaw/openclaw/pull/142899)
+- Advance ngrok startup deadlines in process tests [#142903](https://github.com/openclaw/openclaw/pull/142903)
+- Reuse builds in service-worker update tests [#142904](https://github.com/openclaw/openclaw/pull/142904). Thanks @vincentkoc.
+- Reduce repeated compilation in worker-cache tests [#142911](https://github.com/openclaw/openclaw/pull/142911). Thanks @vincentkoc.
+- Reduce startup work for focused fast tests [#142912](https://github.com/openclaw/openclaw/pull/142912)
+- Reduce upgrade-test configuration launches [#142917](https://github.com/openclaw/openclaw/pull/142917). Thanks @vincentkoc.
+- Reuse shared response-cancellation fixtures [#142919](https://github.com/openclaw/openclaw/pull/142919)
+- Share Google web-search test options [#142928](https://github.com/openclaw/openclaw/pull/142928)
+- Reuse Memory Wiki source-state fixtures [#142934](https://github.com/openclaw/openclaw/pull/142934)
+- Share agent-turn test input fixtures [#142962](https://github.com/openclaw/openclaw/pull/142962)
+- Reuse package fixtures in security-scan tests [#142982](https://github.com/openclaw/openclaw/pull/142982). Thanks @vincentkoc.
+- Share cron context-window test fixtures [#142985](https://github.com/openclaw/openclaw/pull/142985)
+- Remove duplicate model-usage aggregation testing [#142990](https://github.com/openclaw/openclaw/pull/142990). Thanks @vincentkoc.
+- Remove redundant worker-transform test compilation [#143009](https://github.com/openclaw/openclaw/pull/143009)
+- Reuse isolated Git fixtures in release-evidence tests [#143014](https://github.com/openclaw/openclaw/pull/143014). Thanks @vincentkoc.
+- Serialize worker-transform test sequences [#143034](https://github.com/openclaw/openclaw/pull/143034)
+- Share Codex context-engine test setup [#143035](https://github.com/openclaw/openclaw/pull/143035)
+- Build phone recovery test fixture once per suite [#143046](https://github.com/openclaw/openclaw/pull/143046). Thanks @vincentkoc.
+- Reuse Doctor plugin-repair success fixtures [#143047](https://github.com/openclaw/openclaw/pull/143047)
+- Consolidate duplicate QA Lab image-result coverage [#143048](https://github.com/openclaw/openclaw/pull/143048)
+- Remove duplicate warm chat metadata coverage [#143059](https://github.com/openclaw/openclaw/pull/143059)
+- Reuse compiled feature-plugin test fixtures [#143062](https://github.com/openclaw/openclaw/pull/143062). Thanks @vincentkoc.
+- Consolidate xAI credential-reference test fixtures [#143075](https://github.com/openclaw/openclaw/pull/143075)
+- Share Doctor routing-warning fixtures [#143076](https://github.com/openclaw/openclaw/pull/143076)
+- Share Memory Wiki session-search fixtures [#143084](https://github.com/openclaw/openclaw/pull/143084)
+- Remove obsolete WhatsApp session snapshot coverage [#143104](https://github.com/openclaw/openclaw/pull/143104). Thanks @vincentkoc.
+- Reuse remaining xAI secret-reference test fixtures [#143108](https://github.com/openclaw/openclaw/pull/143108)
+- Consolidate proof-policy identity test setup [#143112](https://github.com/openclaw/openclaw/pull/143112)
+- Reuse the diagnostics installation test package [#143116](https://github.com/openclaw/openclaw/pull/143116). Thanks @vincentkoc.
+- Consolidate provider authentication precedence tests [#143117](https://github.com/openclaw/openclaw/pull/143117)
+- Remove duplicate MiniMax M2.7 input coverage [#143122](https://github.com/openclaw/openclaw/pull/143122). Thanks @vincentkoc.
+- Share status-rendering test fixtures [#143124](https://github.com/openclaw/openclaw/pull/143124)
+- Shorten deliberate SQLite timeout test waits [#143130](https://github.com/openclaw/openclaw/pull/143130). Thanks @vincentkoc.
+- Reuse Git seed setup in Testbox tests [#143154](https://github.com/openclaw/openclaw/pull/143154). Thanks @vincentkoc.
+- Share agent-turn execution test defaults [#143166](https://github.com/openclaw/openclaw/pull/143166)
+- Remove redundant Mistral cache-cost arithmetic coverage [#143172](https://github.com/openclaw/openclaw/pull/143172). Thanks @vincentkoc.
+- Share Memory Wiki visibility test callbacks [#143181](https://github.com/openclaw/openclaw/pull/143181)
+- Reduce Telegram policy test startup overhead [#143192](https://github.com/openclaw/openclaw/pull/143192). Thanks @vincentkoc.
+- Share mcporter security-audit test inputs [#143209](https://github.com/openclaw/openclaw/pull/143209)
+- Share Codex migration request fixtures [#143221](https://github.com/openclaw/openclaw/pull/143221)
+- Remove duplicate xAI stream tests [#143222](https://github.com/openclaw/openclaw/pull/143222). Thanks @vincentkoc.
+- Reuse initial certificates in proxy lifecycle tests [#143247](https://github.com/openclaw/openclaw/pull/143247). Thanks @vincentkoc.
+- Reuse prepared CLI artifacts in Telegram QA tests [#143253](https://github.com/openclaw/openclaw/pull/143253). Thanks @vincentkoc.
+- Share ACP metadata-update test setup [#143261](https://github.com/openclaw/openclaw/pull/143261)
+- Reduce repeated manifest searches during test-worker preparation [#143271](https://github.com/openclaw/openclaw/pull/143271)
+- Remove unused Doctor catalog test setup [#143272](https://github.com/openclaw/openclaw/pull/143272). Thanks @vincentkoc.
+- Reuse certificate setup in proxy tests [#143298](https://github.com/openclaw/openclaw/pull/143298). Thanks @vincentkoc.
+- Share Codex conversation test clients [#143300](https://github.com/openclaw/openclaw/pull/143300)
+- Share Docker timeout test fixtures [#143309](https://github.com/openclaw/openclaw/pull/143309)
+- Check authoritative restart state in update tests [#143316](https://github.com/openclaw/openclaw/pull/143316)
+- Remove redundant usage-cost coverage [#143318](https://github.com/openclaw/openclaw/pull/143318). Thanks @vincentkoc.
+- Reduce media QA startup overhead [#143326](https://github.com/openclaw/openclaw/pull/143326). Thanks @vincentkoc.
+- Share Feishu reply account test fixtures [#143336](https://github.com/openclaw/openclaw/pull/143336)
+- Share Docker package-builder fixtures [#143338](https://github.com/openclaw/openclaw/pull/143338)
+- Test archive installation with real workspaces [#143339](https://github.com/openclaw/openclaw/pull/143339)
+- Reuse shared assertions in DeepSeek tests [#143346](https://github.com/openclaw/openclaw/pull/143346)
+- Share Meta and Xiaomi test guards [#143358](https://github.com/openclaw/openclaw/pull/143358)
+- Share Feishu fetched-message fixtures [#143362](https://github.com/openclaw/openclaw/pull/143362)
+- Reuse Slack approval test configuration [#143370](https://github.com/openclaw/openclaw/pull/143370)
+- Remove unused channel catalog fixtures [#143373](https://github.com/openclaw/openclaw/pull/143373). Thanks @vincentkoc.
+- Simplify Chutes test responses [#143382](https://github.com/openclaw/openclaw/pull/143382)
+- Share deferred fixtures in routing tests [#143383](https://github.com/openclaw/openclaw/pull/143383)
+- Avoid cold plugin loading in fallback tests [#143392](https://github.com/openclaw/openclaw/pull/143392)
+- Remove redundant browser annotation tests [#143402](https://github.com/openclaw/openclaw/pull/143402)
+- Exercise real inbound orchestration in Signal tests [#143412](https://github.com/openclaw/openclaw/pull/143412)
+- Reuse compiled SDK fixtures in MCP tests [#143415](https://github.com/openclaw/openclaw/pull/143415)
+- Reuse prepared CLI in JSON-error tests [#143427](https://github.com/openclaw/openclaw/pull/143427)
+- Remove duplicate Discord presence coverage [#143435](https://github.com/openclaw/openclaw/pull/143435). Thanks @vincentkoc.
+- Share image resource test setup [#143443](https://github.com/openclaw/openclaw/pull/143443)
+- Reuse pristine Git seeds in worktree tests [#143469](https://github.com/openclaw/openclaw/pull/143469). Thanks @RomneyDa.
+- Run isolated CLI cleanup tests concurrently [#143481](https://github.com/openclaw/openclaw/pull/143481)
+- Reuse TypeScript transforms in update tests [#143487](https://github.com/openclaw/openclaw/pull/143487)
+- Remove unnecessary diagnostic timeout test waiting [#143514](https://github.com/openclaw/openclaw/pull/143514). Thanks @RomneyDa.
+- Reuse source transforms in proxy exit tests [#143527](https://github.com/openclaw/openclaw/pull/143527)
+- Simplify exec-host approval test fixtures [#143529](https://github.com/openclaw/openclaw/pull/143529)
+- Share Signal quote test inputs [#143532](https://github.com/openclaw/openclaw/pull/143532)
+- Compact shell-completion test tables [#143533](https://github.com/openclaw/openclaw/pull/143533). Thanks @RomneyDa.
+- Compact reply-payload test matrices [#143534](https://github.com/openclaw/openclaw/pull/143534). Thanks @RomneyDa.
+- Compact CI concurrency test cases [#143535](https://github.com/openclaw/openclaw/pull/143535). Thanks @RomneyDa.
+- Compact Labs configuration tests [#143536](https://github.com/openclaw/openclaw/pull/143536). Thanks @RomneyDa.
+- Share Discord REST proxy test spies [#143537](https://github.com/openclaw/openclaw/pull/143537)
+- Share empty plugin metadata fixtures [#143544](https://github.com/openclaw/openclaw/pull/143544)
+- Reuse transforms across cron output tests [#143559](https://github.com/openclaw/openclaw/pull/143559)
+- Exercise Teams timeout handling through Gateway send [#143572](https://github.com/openclaw/openclaw/pull/143572). Thanks @RomneyDa.
+- Share QA mock-provider decisions [#143603](https://github.com/openclaw/openclaw/pull/143603)
+- Strengthen optional plugin-tool environment coverage [#143613](https://github.com/openclaw/openclaw/pull/143613)
+- Reuse transformed code across native Gateway tests [#143628](https://github.com/openclaw/openclaw/pull/143628)
+- Narrow Anthropic cache-check loader types [#143634](https://github.com/openclaw/openclaw/pull/143634)
+- Remove duplicate Teams threading tests [#143636](https://github.com/openclaw/openclaw/pull/143636)
+- Reuse the provider prompt error-stream fixture [#143637](https://github.com/openclaw/openclaw/pull/143637)
+- Consolidate Windows CI checks with stronger assertions [#143642](https://github.com/openclaw/openclaw/pull/143642)
+- Reuse scoped environments in wizard tests [#143652](https://github.com/openclaw/openclaw/pull/143652)
+- Share runtime spy fixtures across channel tests [#143655](https://github.com/openclaw/openclaw/pull/143655)
+- Reuse Gateway acquisition test transforms [#143660](https://github.com/openclaw/openclaw/pull/143660)
+- Remove unused formatter fixture directories [#143662](https://github.com/openclaw/openclaw/pull/143662)
+- Simplify DeepInfra catalog fixtures [#143680](https://github.com/openclaw/openclaw/pull/143680)
+- Reuse Android swarm test controller setup [#143684](https://github.com/openclaw/openclaw/pull/143684)
+- Reuse runtime spies in plugin tests [#143690](https://github.com/openclaw/openclaw/pull/143690)
+- Reuse storage fixtures in sidebar tests [#143697](https://github.com/openclaw/openclaw/pull/143697)
+- Remove obsolete Venice test environment overrides [#143720](https://github.com/openclaw/openclaw/pull/143720)
+- Share SQLite index-drift test setup [#143749](https://github.com/openclaw/openclaw/pull/143749)
+- Speed up SQLite snapshot test byte comparisons [#143751](https://github.com/openclaw/openclaw/pull/143751). Thanks @RomneyDa.
+- Simplify configuration test environment fixtures [#143815](https://github.com/openclaw/openclaw/pull/143815)
+- Remove Responses transport test globals [#143850](https://github.com/openclaw/openclaw/pull/143850)
+- Remove model planner test hooks [#143851](https://github.com/openclaw/openclaw/pull/143851)
+- Simplify image-generation test fixtures [#143862](https://github.com/openclaw/openclaw/pull/143862)
+- Remove duplicate Signal access test [#143870](https://github.com/openclaw/openclaw/pull/143870). Thanks @vincentkoc.
+- Remove models-writer test plumbing [#143874](https://github.com/openclaw/openclaw/pull/143874)
+- Cover update permission loss during discovery [#143877](https://github.com/openclaw/openclaw/pull/143877). Thanks @fuller-stack-dev.
+- Move type contracts to compiler-owned checks [#143888](https://github.com/openclaw/openclaw/pull/143888)
+- Share sidebar drag-data fixtures [#143901](https://github.com/openclaw/openclaw/pull/143901)
+- Remove duplicate Telegram history coverage [#143904](https://github.com/openclaw/openclaw/pull/143904). Thanks @vincentkoc.
+- Simplify configuration environment fixtures [#143925](https://github.com/openclaw/openclaw/pull/143925)
+- Remove duplicate WhatsApp listener tests [#143962](https://github.com/openclaw/openclaw/pull/143962). Thanks @vincentkoc.
+- Share Memory Wiki deferred fixtures [#143978](https://github.com/openclaw/openclaw/pull/143978)
+- Remove duplicate inbound-audio coverage [#143996](https://github.com/openclaw/openclaw/pull/143996). Thanks @vincentkoc.
+- Test usage authentication through owning helpers [#143997](https://github.com/openclaw/openclaw/pull/143997)
+- Reuse auto-reply promise fixtures [#144004](https://github.com/openclaw/openclaw/pull/144004)
+- Exercise shared HTTP behavior in media tests [#144024](https://github.com/openclaw/openclaw/pull/144024)
+- Remove duplicate reply cancellation coverage [#144028](https://github.com/openclaw/openclaw/pull/144028). Thanks @vincentkoc.
+- Simplify Discord directory fixtures [#144033](https://github.com/openclaw/openclaw/pull/144033)
+- Decouple UI behavior tests from class lists [#144050](https://github.com/openclaw/openclaw/pull/144050)
+- Remove duplicate login-shell PATH test [#144051](https://github.com/openclaw/openclaw/pull/144051). Thanks @vincentkoc.
+- Reuse terminal deferred fixtures [#144058](https://github.com/openclaw/openclaw/pull/144058)
+- Remove duplicate metadata scope test [#144072](https://github.com/openclaw/openclaw/pull/144072). Thanks @vincentkoc.
+- Share Slack approval configuration fixtures [#144076](https://github.com/openclaw/openclaw/pull/144076)
+- Simplify source-reply test inputs [#144080](https://github.com/openclaw/openclaw/pull/144080)
+- Reuse ClawHub HTTP test helpers [#144090](https://github.com/openclaw/openclaw/pull/144090)
+- Remove duplicate missing-exporter test [#144091](https://github.com/openclaw/openclaw/pull/144091). Thanks @vincentkoc.
+- Consolidate package-source update tests [#144097](https://github.com/openclaw/openclaw/pull/144097)
+- Remove duplicate realtime authentication test [#144105](https://github.com/openclaw/openclaw/pull/144105). Thanks @vincentkoc.
+- Reuse compiled source in startup tests [#144110](https://github.com/openclaw/openclaw/pull/144110)
+- Reuse terminal upload and queue fixtures [#144116](https://github.com/openclaw/openclaw/pull/144116)
+- Consolidate Brave startup fixtures [#144117](https://github.com/openclaw/openclaw/pull/144117)
+- Simplify Firecrawl credential fixtures [#144122](https://github.com/openclaw/openclaw/pull/144122)
+- Remove duplicate CLI session-cleanup coverage [#144126](https://github.com/openclaw/openclaw/pull/144126). Thanks @vincentkoc.
+- Simplify Quick Chat test inputs [#144135](https://github.com/openclaw/openclaw/pull/144135)
+
+**Bug fixes**
+
+- Load browser cleanup before ACP test deadlines [441f69b2](https://github.com/openclaw/openclaw/commit/441f69b21fd77839345dfe247d82cbba8135984f). Thanks @Baumus.
+- Require completed installation in Claw export fixtures [#120843](https://github.com/openclaw/openclaw/pull/120843). Thanks @vincentkoc.
+- Find Slack QA presentations by exact message timestamp [#127300](https://github.com/openclaw/openclaw/pull/127300). Thanks @RomneyDa.
+- Require completed serving evidence in managed upgrade tests [#141663](https://github.com/openclaw/openclaw/pull/141663)
+- Set explicit permissions for Doctor test state [#141672](https://github.com/openclaw/openclaw/pull/141672)
+- Restore the resize observer after multi-select tests [#141673](https://github.com/openclaw/openclaw/pull/141673)
+- Synchronize containment tests with real process stops [#141681](https://github.com/openclaw/openclaw/pull/141681)
+- Preserve onboarding-test installation failure diagnostics [#141689](https://github.com/openclaw/openclaw/pull/141689). Thanks @vincentkoc and @RomneyDa.
+- Preserve Doctor-written configuration in secret-reference tests [#141768](https://github.com/openclaw/openclaw/pull/141768)
+- Complete manifest fixtures in capability-provider tests [#141855](https://github.com/openclaw/openclaw/pull/141855)
+- Isolate plugin artifact loader test fixtures [#141887](https://github.com/openclaw/openclaw/pull/141887)
+- Preserve inbound references on queued QA replies [#141905](https://github.com/openclaw/openclaw/pull/141905)
+- Align plugin install and removal QA expectations [#141964](https://github.com/openclaw/openclaw/pull/141964). Thanks @RomneyDa.
+- Prepare Docker images for sandbox QA [#141965](https://github.com/openclaw/openclaw/pull/141965). Thanks @RomneyDa.
+- Remove QA credentials through Gateway logout [#141974](https://github.com/openclaw/openclaw/pull/141974). Thanks @RomneyDa.
+- Align Claude QA fixture with session initialization [#141978](https://github.com/openclaw/openclaw/pull/141978). Thanks @RomneyDa.
+- Select compact progress for Slack draft QA [#141980](https://github.com/openclaw/openclaw/pull/141980). Thanks @RomneyDa.
+- Target Teams QA timeouts at message activities [#141985](https://github.com/openclaw/openclaw/pull/141985). Thanks @RomneyDa.
+- Drain heartbeat wakes before plugin test teardown [#142036](https://github.com/openclaw/openclaw/pull/142036)
+- Isolate keyless model tests from host credentials [#142049](https://github.com/openclaw/openclaw/pull/142049)
+- Finish mock-provider continuations after settled work [#142060](https://github.com/openclaw/openclaw/pull/142060). Thanks @RomneyDa.
+- Remove port-reuse races from probe tests [#142088](https://github.com/openclaw/openclaw/pull/142088). Thanks @RomneyDa.
+- Correct core session status in browser fixtures [#142097](https://github.com/openclaw/openclaw/pull/142097)
+- Isolate fresh mock write scenarios from earlier completions [#142137](https://github.com/openclaw/openclaw/pull/142137)
+- Isolate mocked Chromium selection from host settings [#142150](https://github.com/openclaw/openclaw/pull/142150)
+- Use system Bash in installer tests [#142161](https://github.com/openclaw/openclaw/pull/142161)
+- Keep canonical integration fixtures on source plugins [#142171](https://github.com/openclaw/openclaw/pull/142171)
+- Wait for audio transcript completion in Gateway tests [#142178](https://github.com/openclaw/openclaw/pull/142178)
+- Wait for triage test processes before deleting fixtures [#142215](https://github.com/openclaw/openclaw/pull/142215)
+- Prepare provider runtimes before Telegram sticker tests [#142234](https://github.com/openclaw/openclaw/pull/142234)
+- Align auth and Workshop QA with current runtime behavior [#142280](https://github.com/openclaw/openclaw/pull/142280)
+- Avoid unnecessary provider discovery in sticker tests [#142281](https://github.com/openclaw/openclaw/pull/142281)
+- Finish Activity test imports before teardown [#142282](https://github.com/openclaw/openclaw/pull/142282)
+- Wait for Gateway event-log test cleanup [#142314](https://github.com/openclaw/openclaw/pull/142314)
+- Wait for startup completion in first-run recovery tests [#142339](https://github.com/openclaw/openclaw/pull/142339). Thanks @vyctorbrzezowski.
+- Keep upgrade-test registry helpers on the same version [#142353](https://github.com/openclaw/openclaw/pull/142353). Thanks @RomneyDa.
+- Refresh Telegram QA button lookup after menu edits [#142473](https://github.com/openclaw/openclaw/pull/142473)
+- Stabilize Windows Claude CLI test fixtures [#142520](https://github.com/openclaw/openclaw/pull/142520). Thanks @vincentkoc.
+- Recognize unavailable upstream models in live tests [#142561](https://github.com/openclaw/openclaw/pull/142561). Thanks @RomneyDa.
+- Show nested onboarding failures in validation logs [#142645](https://github.com/openclaw/openclaw/pull/142645). Thanks @vincentkoc.
+- Wait for settled attachment test geometry [#142728](https://github.com/openclaw/openclaw/pull/142728)
+- Stabilize Android image-decoding tests on Linux [#142752](https://github.com/openclaw/openclaw/pull/142752). Thanks @vincentkoc.
+- Synchronize cloud-worker settings browser tests [#142763](https://github.com/openclaw/openclaw/pull/142763)
+- Wait for Signal delivery completion in tests [#142775](https://github.com/openclaw/openclaw/pull/142775). Thanks @vincentkoc.
+- Exercise same-version candidates in upgrade tests [#142811](https://github.com/openclaw/openclaw/pull/142811)
+- Run packaged QA commands with the selected candidate [#142925](https://github.com/openclaw/openclaw/pull/142925). Thanks @vincentkoc.
+- Close reloaded database caches in token tests [#142978](https://github.com/openclaw/openclaw/pull/142978)
+- Isolate managed-update tests from host system services [#143013](https://github.com/openclaw/openclaw/pull/143013). Thanks @vincentkoc.
+- Close Gateway test databases across module resets [#143045](https://github.com/openclaw/openclaw/pull/143045)
+- Close skill-upload test databases during cleanup [#143071](https://github.com/openclaw/openclaw/pull/143071)
+- Stabilize Gateway compaction race test synchronization [#143072](https://github.com/openclaw/openclaw/pull/143072)
+- Prepare Gateway test startup and preserve Cron cleanup errors [#143102](https://github.com/openclaw/openclaw/pull/143102). Thanks @vincentkoc.
+- Measure attachment layout within one browser frame [#143103](https://github.com/openclaw/openclaw/pull/143103)
+- Wait for socket closure before stream-test cleanup finishes [#143133](https://github.com/openclaw/openclaw/pull/143133)
+- Allow more startup time for systemd test fixtures [#143134](https://github.com/openclaw/openclaw/pull/143134). Thanks @vincentkoc.
+- Isolate the Gateway prewarm test repository [#143161](https://github.com/openclaw/openclaw/pull/143161)
+- Close paired-device test databases before deleting files [#143168](https://github.com/openclaw/openclaw/pull/143168)
+- Clean up chat preview listeners in UI tests [#143191](https://github.com/openclaw/openclaw/pull/143191)
+- Prevent stale connections in Telegram model callback tests [#143197](https://github.com/openclaw/openclaw/pull/143197)
+- Isolate Windows media file-URL test providers [#143213](https://github.com/openclaw/openclaw/pull/143213)
+- Avoid slow-startup failures in Matrix steering tests [#143249](https://github.com/openclaw/openclaw/pull/143249)
+- Isolate subagent announcement tests [#143251](https://github.com/openclaw/openclaw/pull/143251)
+- Stabilize Doctor source-isolation tests on tmpfs [#143258](https://github.com/openclaw/openclaw/pull/143258)
+- Restore empty-transcript compaction coverage [#143317](https://github.com/openclaw/openclaw/pull/143317)
+- Allow subpixel rounding in attachment layout tests [#143333](https://github.com/openclaw/openclaw/pull/143333). Thanks @vincentkoc.
+- Close Control UI test databases before cleanup [#143398](https://github.com/openclaw/openclaw/pull/143398)
+- Close pairing test databases before cleanup [#143401](https://github.com/openclaw/openclaw/pull/143401)
+- Close token-store test databases before cleanup [#143409](https://github.com/openclaw/openclaw/pull/143409)
+- Close node-pairing test databases before cleanup [#143418](https://github.com/openclaw/openclaw/pull/143418)
+- Complete bundled plugin directory test mock [#143444](https://github.com/openclaw/openclaw/pull/143444). Thanks @RomneyDa.
+- Synchronize model catalog browser tests [#143445](https://github.com/openclaw/openclaw/pull/143445). Thanks @RomneyDa.
+- Allow Chrome tab indexing time in extension tests [#143447](https://github.com/openclaw/openclaw/pull/143447). Thanks @RomneyDa.
+- Recognize expected MCP resolver test diagnostics [#143450](https://github.com/openclaw/openclaw/pull/143450). Thanks @RomneyDa.
+- Isolate announcement test dependencies [#143465](https://github.com/openclaw/openclaw/pull/143465). Thanks @vincentkoc.
+- Recognize Slack card progress in QA checks [#143562](https://github.com/openclaw/openclaw/pull/143562). Thanks @RomneyDa.
+- Correct Telegram QA receipt and preview expectations [#143563](https://github.com/openclaw/openclaw/pull/143563). Thanks @RomneyDa.
+- Run repository CLI health scenarios exclusively [#143564](https://github.com/openclaw/openclaw/pull/143564). Thanks @RomneyDa.
+- Correct package uninstall assertions [#143565](https://github.com/openclaw/openclaw/pull/143565). Thanks @RomneyDa.
+- Accept intentional memory preparation diagnostics in QA [#143570](https://github.com/openclaw/openclaw/pull/143570). Thanks @RomneyDa.
+- Coordinate Matrix QA progress with command completion [#143573](https://github.com/openclaw/openclaw/pull/143573). Thanks @RomneyDa.
+- Isolate CLI announcement checks and await transcript replies [#143576](https://github.com/openclaw/openclaw/pull/143576). Thanks @RomneyDa.
+- Bundle Telegram QA evidence helpers [#143582](https://github.com/openclaw/openclaw/pull/143582). Thanks @RomneyDa.
+- Isolate Codex auth-refresh integration providers [#143585](https://github.com/openclaw/openclaw/pull/143585)
+- Close heartbeat test databases before fixture deletion [#143606](https://github.com/openclaw/openclaw/pull/143606)
+- Repair worker setup browser fixtures [#143666](https://github.com/openclaw/openclaw/pull/143666)
+- Align QA Lab OpenAI defaults with canonical model IDs [#143674](https://github.com/openclaw/openclaw/pull/143674)
+- Correct Discord transcript provider assertions [#143689](https://github.com/openclaw/openclaw/pull/143689). Thanks @RomneyDa.
+- Refresh model catalogs before ClawRouter assertions [#143692](https://github.com/openclaw/openclaw/pull/143692). Thanks @RomneyDa.
+- Align timeout tests with direct Claude CLI execution [#143696](https://github.com/openclaw/openclaw/pull/143696). Thanks @RomneyDa.
+- Correct Telegram model-picker recovery tests [#143704](https://github.com/openclaw/openclaw/pull/143704). Thanks @RomneyDa.
+- Wait for updater process-group cleanup in tests [#143705](https://github.com/openclaw/openclaw/pull/143705)
+- Stabilize concurrent ClawHub catalog assertions [#143710](https://github.com/openclaw/openclaw/pull/143710)
+- Consolidate config environments and isolate Doctor fixtures [#143762](https://github.com/openclaw/openclaw/pull/143762)
+- Close CLI test databases before fixture deletion [#143782](https://github.com/openclaw/openclaw/pull/143782)
+- Close Watch HTTP test databases before fixture deletion [#143793](https://github.com/openclaw/openclaw/pull/143793)
+- Serialize database test worker shutdown [#143813](https://github.com/openclaw/openclaw/pull/143813)
+- Wait for final history placeholder styles in browser tests [#143824](https://github.com/openclaw/openclaw/pull/143824)
+- Isolate legacy handoff fixtures [#143875](https://github.com/openclaw/openclaw/pull/143875)
+- Restore config drainage test collection [#143913](https://github.com/openclaw/openclaw/pull/143913)
+- Isolate Doctor runtime fixtures [#143919](https://github.com/openclaw/openclaw/pull/143919)
+- Keep hardlink fixtures on one filesystem [#143945](https://github.com/openclaw/openclaw/pull/143945)
+- Drain transcript indexing before test cleanup [#143964](https://github.com/openclaw/openclaw/pull/143964)
+- Align dependency-locking navigation tests [#144002](https://github.com/openclaw/openclaw/pull/144002)
+- Stabilize Telegram replacement-session tests [#144049](https://github.com/openclaw/openclaw/pull/144049). Thanks @crash2kx.
+- Coordinate update-ledger test shutdown [#144054](https://github.com/openclaw/openclaw/pull/144054)
+- Restore complete navigation regression guards [#144075](https://github.com/openclaw/openclaw/pull/144075)
+- Drain session fixtures before state removal [#144087](https://github.com/openclaw/openclaw/pull/144087)
+- Isolate npm-only Featured test inputs [#144092](https://github.com/openclaw/openclaw/pull/144092)
+- Keep Pi rename fixtures on one filesystem [#144096](https://github.com/openclaw/openclaw/pull/144096)
+- Isolate reset tests from ambient heartbeats [#144108](https://github.com/openclaw/openclaw/pull/144108)
+
+
+
+
+
+
+##### Automated checks and performance testing
+
+
+Automated checks avoid unrelated work when a change affects only tests. Performance reports also measure CPU use more accurately, helping maintainers distinguish product regressions from measurement errors.
+
+
+
+###### Sources and complete change list
+
+
+The later historical 2026.7.33 evaluator pin restores its 250% status allowance alongside the accounting fixes. Successful live qualification with that pin is not established here. CPU measurements whose uncertainty crosses a limit remain blocked. The CodeQL follow-up repairs the earlier hosted-runner timeout path; these scanning changes are not vulnerability fixes.
+
+**Improvements**
+
+- Add opt-in runtime memory attribution to CLI benchmarks [#127746](https://github.com/openclaw/openclaw/pull/127746). Thanks @vincentkoc.
+- Reuse verified runner archives and handle CI inventory growth [#140680](https://github.com/openclaw/openclaw/pull/140680). Thanks @vincentkoc.
+- Move macOS CodeQL to GitHub-hosted runners [#141761](https://github.com/openclaw/openclaw/pull/141761). Thanks @vincentkoc.
+- Advance the historical evaluator before its calibration correction [#142058](https://github.com/openclaw/openclaw/pull/142058). Thanks @RomneyDa.
+- Skip unrelated upgrade checks for test-only changes [#142154](https://github.com/openclaw/openclaw/pull/142154)
+- Skip unrelated UI E2E jobs for isolated unit-test changes [#142350](https://github.com/openclaw/openclaw/pull/142350)
+- Move TUI test typechecking into the command shard [#142385](https://github.com/openclaw/openclaw/pull/142385)
+- Reuse prerequisite decisions in CI test planning [#142630](https://github.com/openclaw/openclaw/pull/142630)
+- Reuse verified Bun archives in Linux CI [#142849](https://github.com/openclaw/openclaw/pull/142849). Thanks @vincentkoc.
+- Reuse Android build timestamps across CI tests and lint [#143207](https://github.com/openclaw/openclaw/pull/143207)
+
+**Bug fixes**
+
+- Update the evaluator for late-discovered processes [#141675](https://github.com/openclaw/openclaw/pull/141675). Thanks @RomneyDa.
+- Provision ripgrep for filesystem contract tests [#141794](https://github.com/openclaw/openclaw/pull/141794)
+- Let macOS security scans finish within hosted runner limits [#141851](https://github.com/openclaw/openclaw/pull/141851). Thanks @vincentkoc.
+- Preserve heap settings across scorecard builds [#141915](https://github.com/openclaw/openclaw/pull/141915). Thanks @RomneyDa.
+- Scope historical status CPU allowance to July release [#141935](https://github.com/openclaw/openclaw/pull/141935). Thanks @RomneyDa.
+- Update performance evaluator CPU measurement pin [#142053](https://github.com/openclaw/openclaw/pull/142053). Thanks @RomneyDa.
+- Update Gateway startup CPU accounting [#142085](https://github.com/openclaw/openclaw/pull/142085). Thanks @RomneyDa.
+- Update performance evaluator startup discovery [#142104](https://github.com/openclaw/openclaw/pull/142104). Thanks @RomneyDa.
+- Retry failed performance artifact uploads once [#142344](https://github.com/openclaw/openclaw/pull/142344). Thanks @RomneyDa.
+- Correct the historical 2026.7.33 Kova benchmark pin [#142348](https://github.com/openclaw/openclaw/pull/142348). Thanks @RomneyDa.
+- Bound TypeScript preflight resources on constrained CI [#142472](https://github.com/openclaw/openclaw/pull/142472). Thanks @RomneyDa.
+- Use corrected release CPU calibration [#142537](https://github.com/openclaw/openclaw/pull/142537). Thanks @RomneyDa.
+- Retain test timing estimates across inventory changes [#142719](https://github.com/openclaw/openclaw/pull/142719). Thanks @RomneyDa and @vincentkoc.
+- Reject stale or unusable CI timing samples [#143182](https://github.com/openclaw/openclaw/pull/143182). Thanks @vincentkoc.
+- Budget deferred translation catalogs separately in CI [#143219](https://github.com/openclaw/openclaw/pull/143219). Thanks @vincentkoc.
+- Enforce one deferred bundle per language [#143297](https://github.com/openclaw/openclaw/pull/143297). Thanks @vincentkoc.
+- Preserve timing identities for expanded test chunks [#143639](https://github.com/openclaw/openclaw/pull/143639)
+- Correct CPU measurement bounds in release validation [#143808](https://github.com/openclaw/openclaw/pull/143808)
+- Install search test prerequisites [#143835](https://github.com/openclaw/openclaw/pull/143835). Thanks @fuller-stack-dev.
+
+
+
+
+
+
+##### Build and package checks
+
+
+Build and package checks better recognize which dependencies and files belong in each release package. This reduces false failures when maintainers prepare plugins and check their contents.
+
+
+
+###### Sources and complete change list
+
+
+Preparation uses the frozen source manifests where required; installed-package verification retains its own manifest checks. These changes do not by themselves establish that packages were published or are available in an installed release.
+
+**Improvements**
+
+- Use pnpm's override parser in npm lock generation [#141862](https://github.com/openclaw/openclaw/pull/141862). Thanks @RomneyDa.
+- Simplify package import scanning [#142859](https://github.com/openclaw/openclaw/pull/142859). Thanks @vincentkoc.
+- Simplify package dependency path resolution [#143063](https://github.com/openclaw/openclaw/pull/143063)
+
+**Bug fixes**
+
+- Recognize extension-owned package dependencies [#141647](https://github.com/openclaw/openclaw/pull/141647). Thanks @RomneyDa.
+- Preserve version comparisons in npm dependency evidence [#141800](https://github.com/openclaw/openclaw/pull/141800). Thanks @RomneyDa.
+- Verify dependency ownership for built plugin chunks [#141876](https://github.com/openclaw/openclaw/pull/141876). Thanks @RomneyDa.
+- Use source companion manifests in package verification [#142033](https://github.com/openclaw/openclaw/pull/142033). Thanks @RomneyDa.
+- Handle nested optional plugin dependencies [#142126](https://github.com/openclaw/openclaw/pull/142126)
+- Initialize ClawHub bootstrap packaging dependencies [#142191](https://github.com/openclaw/openclaw/pull/142191)
+- Recognize Bun built-ins in package checks [#143436](https://github.com/openclaw/openclaw/pull/143436). Thanks @RomneyDa.
+- Allow shipped Markdown guides in npm checks [#143699](https://github.com/openclaw/openclaw/pull/143699)
+
+
+
+
+
+
+##### Release preparation and recovery
+
+
+Release tools make interrupted publishing easier to investigate and recover from. Checks for older releases match the features those versions contain, while mobile release jobs get fixes for build preparation and troubleshooting. The checks that read older releases directly from Git require Git 2.45 or newer.
+
+
+
+###### Sources and complete change list
+
+
+A recovered dispatch or collected publication status is an observation, not a passed validation or permission to publish. Expired dispatch witnesses can leave recovery unresolved, and separate hosts are not globally deduplicated. Omitted historical scenarios are not passed tests. Bun installation checks retain Bun when its probe succeeds and select Node only for the recognized Bun/node:sqlite rejection; other failures remain errors. Requested diagnostic maturity scorecards may be published before the workflow reports failed or blocked results. Prior-release pages and version metadata below remain historical records.
+
+**Improvements**
+
+- Prepare package artifacts before release publication [#136466](https://github.com/openclaw/openclaw/pull/136466). Thanks @vincentkoc.
+- Add the Node smoke path later replaced by runtime selection [#142034](https://github.com/openclaw/openclaw/pull/142034). Thanks @RomneyDa.
+- Add published 2026.9.3 to the Mac update feed [#142235](https://github.com/openclaw/openclaw/pull/142235)
+- Align main with published 2026.9.3 metadata [#142240](https://github.com/openclaw/openclaw/pull/142240)
+- Match default Telegram package tests to frozen source capabilities [#142378](https://github.com/openclaw/openclaw/pull/142378). Thanks @RomneyDa.
+- Add a manual Android emulator diagnostic [#142780](https://github.com/openclaw/openclaw/pull/142780). Thanks @vincentkoc.
+- Capture emulator boot diagnostics [#142809](https://github.com/openclaw/openclaw/pull/142809). Thanks @vincentkoc.
+- Retain diagnostics after emulator readiness timeout [#142835](https://github.com/openclaw/openclaw/pull/142835). Thanks @vincentkoc.
+- Complete emulator cold-boot diagnostics [#142891](https://github.com/openclaw/openclaw/pull/142891). Thanks @vincentkoc.
+- Recover release-validation dispatches after lost responses [#142927](https://github.com/openclaw/openclaw/pull/142927). Thanks @vincentkoc.
+- Move Android emulator workflows to Ubuntu KVM [#142979](https://github.com/openclaw/openclaw/pull/142979). Thanks @vincentkoc.
+- Show publication observations alongside release validation status [#143171](https://github.com/openclaw/openclaw/pull/143171). Thanks @vincentkoc.
+- Reject releases with beta tags older than stable [#143669](https://github.com/openclaw/openclaw/pull/143669)
+- Validate frozen release targets from committed source [#144023](https://github.com/openclaw/openclaw/pull/144023). Thanks @vincentkoc.
+
+**Bug fixes**
+
+- Use established session tests for historical Node checks [#141640](https://github.com/openclaw/openclaw/pull/141640). Thanks @RomneyDa.
+- Accept opted-in historical same-version updater results [#141652](https://github.com/openclaw/openclaw/pull/141652). Thanks @RomneyDa.
+- Correct release source checks and upgrade-test selection [#141746](https://github.com/openclaw/openclaw/pull/141746)
+- Validate frozen releases with their shipped scenarios [#141774](https://github.com/openclaw/openclaw/pull/141774). Thanks @RomneyDa.
+- Preserve frozen-release Gateway test client imports [#141814](https://github.com/openclaw/openclaw/pull/141814). Thanks @RomneyDa.
+- Place frozen-release test clients beside installed dependencies [#141827](https://github.com/openclaw/openclaw/pull/141827). Thanks @RomneyDa.
+- Install dependencies for the trusted native live-test harness [#141829](https://github.com/openclaw/openclaw/pull/141829). Thanks @RomneyDa.
+- Fetch release-candidate history through its canonical branch [#141840](https://github.com/openclaw/openclaw/pull/141840). Thanks @RomneyDa.
+- Recognize the July filesystem validation contract [#141892](https://github.com/openclaw/openclaw/pull/141892). Thanks @RomneyDa.
+- Keep historical Docker validation scenarios consistent [#141893](https://github.com/openclaw/openclaw/pull/141893). Thanks @RomneyDa.
+- Add maturity-result completeness checks [#141931](https://github.com/openclaw/openclaw/pull/141931). Thanks @RomneyDa.
+- Repair Gateway release-test capacity and scenario selection [#141954](https://github.com/openclaw/openclaw/pull/141954)
+- Keep frozen upgrade tests with matching helpers [#142007](https://github.com/openclaw/openclaw/pull/142007). Thanks @RomneyDa.
+- Record authorized unsupported Docker lanes as no-ops [#142020](https://github.com/openclaw/openclaw/pull/142020). Thanks @RomneyDa.
+- Publish diagnostic scorecards before reporting QA failure [#142040](https://github.com/openclaw/openclaw/pull/142040). Thanks @RomneyDa.
+- Use trusted tooling for preflight plugin plans [#142055](https://github.com/openclaw/openclaw/pull/142055). Thanks @RomneyDa.
+- Omit unsupported historical corrupt-plugin checks [#142061](https://github.com/openclaw/openclaw/pull/142061). Thanks @RomneyDa.
+- Bound ClawHub ancestry verification responses [#142072](https://github.com/openclaw/openclaw/pull/142072). Thanks @vincentkoc.
+- Install trusted tooling dependencies for plugin previews [#142103](https://github.com/openclaw/openclaw/pull/142103)
+- Keep release helpers from dirtying mobile source checks [#142115](https://github.com/openclaw/openclaw/pull/142115). Thanks @vincentkoc.
+- Keep Docker approval waits outside the publication queue [#142250](https://github.com/openclaw/openclaw/pull/142250)
+- Keep changelog credit within verified release history [#142261](https://github.com/openclaw/openclaw/pull/142261). Thanks @vincentkoc.
+- Keep Docker upgrade tests on an older starting version [#142273](https://github.com/openclaw/openclaw/pull/142273)
+- Verify closeout after separate npm and Docker recovery runs [#142291](https://github.com/openclaw/openclaw/pull/142291)
+- Restore Sparkle build-number output from symlinked checkouts [#142315](https://github.com/openclaw/openclaw/pull/142315)
+- Handle large tooling archives during mobile beta authorization [#142360](https://github.com/openclaw/openclaw/pull/142360). Thanks @vincentkoc.
+- Restore Bun execution in installation smoke checks [#142428](https://github.com/openclaw/openclaw/pull/142428). Thanks @RomneyDa.
+- Supply the release Node version to frozen installer tests [#142431](https://github.com/openclaw/openclaw/pull/142431). Thanks @RomneyDa.
+- Keep mobile beta authorization valid as main advances [#142432](https://github.com/openclaw/openclaw/pull/142432). Thanks @vincentkoc.
+- Repair helper loading for historical upgrade checks [#142441](https://github.com/openclaw/openclaw/pull/142441). Thanks @RomneyDa.
+- Align frozen 2026.7.33 Docker validation [#142456](https://github.com/openclaw/openclaw/pull/142456). Thanks @RomneyDa.
+- Match frozen onboarding tests to release helpers [#142467](https://github.com/openclaw/openclaw/pull/142467). Thanks @RomneyDa.
+- Record the reviewed Codex test scan finding [#142474](https://github.com/openclaw/openclaw/pull/142474). Thanks @vincentkoc.
+- Set mobile beta screenshot prerequisites [#142523](https://github.com/openclaw/openclaw/pull/142523). Thanks @vincentkoc.
+- Match ClawHub fixture requests to frozen candidates [#142551](https://github.com/openclaw/openclaw/pull/142551). Thanks @RomneyDa.
+- Forward release Node version to Rocky installer probes [#142562](https://github.com/openclaw/openclaw/pull/142562). Thanks @RomneyDa.
+- Select a supported runtime for Bun install checks [#142563](https://github.com/openclaw/openclaw/pull/142563). Thanks @RomneyDa.
+- Repair frozen-package update validation fixtures [#142573](https://github.com/openclaw/openclaw/pull/142573). Thanks @RomneyDa.
+- Fetch release ancestry branches independently [#142643](https://github.com/openclaw/openclaw/pull/142643). Thanks @RomneyDa.
+- Derive frozen-release expectations from selected source [#142683](https://github.com/openclaw/openclaw/pull/142683). Thanks @RomneyDa.
+- Preserve Git selection in frozen-release tests [#142686](https://github.com/openclaw/openclaw/pull/142686). Thanks @RomneyDa.
+- Match frozen-package Telegram tests to supported scenarios [#142687](https://github.com/openclaw/openclaw/pull/142687). Thanks @RomneyDa.
+- Correct frozen dirty-checkout exit expectations [#142727](https://github.com/openclaw/openclaw/pull/142727). Thanks @RomneyDa.
+- Qualify Telegram progress tests against frozen source [#142731](https://github.com/openclaw/openclaw/pull/142731). Thanks @RomneyDa.
+- Prepare Watch Rust tools for iOS beta builds [#142762](https://github.com/openclaw/openclaw/pull/142762). Thanks @vincentkoc.
+- Isolate iOS release signing keys [#142846](https://github.com/openclaw/openclaw/pull/142846). Thanks @vincentkoc.
+- Identify incompatible release-validation evidence [#142906](https://github.com/openclaw/openclaw/pull/142906). Thanks @vincentkoc.
+- Check image size limits before Vercel copying [#142908](https://github.com/openclaw/openclaw/pull/142908). Thanks @vincentkoc.
+- Match frozen bundle validation clients to source [#142926](https://github.com/openclaw/openclaw/pull/142926). Thanks @vincentkoc.
+- Stop frozen checks on committed-source read errors [#142930](https://github.com/openclaw/openclaw/pull/142930). Thanks @vincentkoc.
+- Isolate frozen-suite compatibility checks [#142935](https://github.com/openclaw/openclaw/pull/142935). Thanks @vincentkoc.
+- Accept native iOS signing keychain filenames [#142968](https://github.com/openclaw/openclaw/pull/142968). Thanks @vincentkoc.
+- Preserve the iOS signing tool environment [#143301](https://github.com/openclaw/openclaw/pull/143301). Thanks @vincentkoc.
+- Match validation runs with omitted empty inputs [#143421](https://github.com/openclaw/openclaw/pull/143421). Thanks @RomneyDa.
+- Include required plugins in candidate preparation [#143452](https://github.com/openclaw/openclaw/pull/143452). Thanks @RomneyDa.
+- Validate Anthropic cache behavior against candidate capabilities [#143508](https://github.com/openclaw/openclaw/pull/143508). Thanks @RomneyDa.
+- Match Telegram release checks to package source [#143510](https://github.com/openclaw/openclaw/pull/143510). Thanks @RomneyDa.
+- Exclude unpublished same-version upgrade baselines [#143567](https://github.com/openclaw/openclaw/pull/143567). Thanks @RomneyDa.
+- Use published plugins for correction-version upgrade baselines [#143681](https://github.com/openclaw/openclaw/pull/143681)
+- Register the 2026.9.4 plugin scan policy [#143807](https://github.com/openclaw/openclaw/pull/143807)
+- Load older candidates in Anthropic cache checks [#143810](https://github.com/openclaw/openclaw/pull/143810). Thanks @RomneyDa.
+- Match Telegram queue validation to candidate capabilities [#143811](https://github.com/openclaw/openclaw/pull/143811). Thanks @RomneyDa.
+- Validate contracts for omitted Docker test aliases [#144129](https://github.com/openclaw/openclaw/pull/144129). Thanks @vincentkoc.
+
+**Documentation**
+
+- Refresh release summaries and contribution records [685ae1b0](https://github.com/openclaw/openclaw/commit/685ae1b0c81ca9dec95e3c10f3d4b4ffffe69d46)
+- Add the 2026.9.4 changelog section [dd178db5](https://github.com/openclaw/openclaw/commit/dd178db54d088b3ee251f5e99e4081bad0f8fc51)
+- Document qualification with final release notes already committed [#141786](https://github.com/openclaw/openclaw/pull/141786)
+- Add the v2026.9.3 release documentation page [#142277](https://github.com/openclaw/openclaw/pull/142277). Thanks @hannesrudolph.
+- Align v2026.9.3 release-page framing with its announcement [#142307](https://github.com/openclaw/openclaw/pull/142307). Thanks @hannesrudolph.
+- Align release validation guidance with notes preparation [#142328](https://github.com/openclaw/openclaw/pull/142328)
+- Temporarily rename the v2026.9.3 statistics label [#142437](https://github.com/openclaw/openclaw/pull/142437). Thanks @hannesrudolph.
+- Correct ClawHub release-verification instructions [#142458](https://github.com/openclaw/openclaw/pull/142458)
+- Correct extended-stable validation instructions [#142538](https://github.com/openclaw/openclaw/pull/142538). Thanks @RomneyDa.
+- Restore the v2026.9.3 statistics label [#142541](https://github.com/openclaw/openclaw/pull/142541). Thanks @hannesrudolph.
+- Organize release validation guidance by task [#142774](https://github.com/openclaw/openclaw/pull/142774). Thanks @vincentkoc.
+- Split release-validation documentation into focused guides [#143163](https://github.com/openclaw/openclaw/pull/143163). Thanks @vincentkoc.
+- Use HTTP liveness for unauthenticated release checks [#143709](https://github.com/openclaw/openclaw/pull/143709). Thanks @vincentkoc.
+- Record landed repairs and contributor credit [#144440](https://github.com/openclaw/openclaw/pull/144440). Thanks @vincentkoc.
+
+
+
+
+
+
+##### Contributor tools and documentation
+
+
+Contributors get less repeated setup during local checks and clearer testing guides. Documentation tools preserve code examples and point errors to the right line. Normal pnpm installs now reject links to another checkout’s dependency folders. Give each source checkout its own dependencies or explicitly configure the dependency location.
+
+
+
+###### Sources and complete change list
+
+
+The dependency-install guard is bypassed when lifecycle scripts are disabled and does not lock against concurrent path replacement. Unix development runners preserve interruption signals; detached workers may still need cleanup, and Windows retains its existing handling. Tool-specific measurements do not establish faster model responses or total publication times. Generated translation records and maturity snapshots do not establish new languages, visible app changes, or blanket readiness.
+
+**Improvements**
+
+- Reuse UTF-8 truncation in SDK change reports [#141660](https://github.com/openclaw/openclaw/pull/141660)
+- Remove unused QA script test accessors [#141751](https://github.com/openclaw/openclaw/pull/141751)
+- Run package contract tests without unrelated runtime builds [#142159](https://github.com/openclaw/openclaw/pull/142159)
+- Preserve human credit in squash merge messages [#142167](https://github.com/openclaw/openclaw/pull/142167)
+- Add tooling for captioned and zoomed PR videos without audio [#142259](https://github.com/openclaw/openclaw/pull/142259)
+- Refresh selected translations with native context and retained aliases [#142260](https://github.com/openclaw/openclaw/pull/142260)
+- Load the compiler only when development checks need it [#142338](https://github.com/openclaw/openclaw/pull/142338)
+- Remove unused update-triage result metadata [#142345](https://github.com/openclaw/openclaw/pull/142345). Thanks @vincentkoc.
+- Reduce documentation sync source downloads [#142400](https://github.com/openclaw/openclaw/pull/142400). Thanks @hannesrudolph.
+- Remove obsolete people-loading translation data [#142420](https://github.com/openclaw/openclaw/pull/142420)
+- Combine duplicate architecture-checker scans [#142451](https://github.com/openclaw/openclaw/pull/142451)
+- Reuse documentation checks and validate after rebase [#142475](https://github.com/openclaw/openclaw/pull/142475). Thanks @hannesrudolph.
+- Reduce repeated lint startup for larger changes [#142691](https://github.com/openclaw/openclaw/pull/142691)
+- Synchronize a screenshot-fixture translation label [#142714](https://github.com/openclaw/openclaw/pull/142714)
+- Consolidate QA Lab YAML validation diagnostics [#143016](https://github.com/openclaw/openclaw/pull/143016). Thanks @vincentkoc.
+- Route session-history HTTP tests without full build prerequisites [#143096](https://github.com/openclaw/openclaw/pull/143096). Thanks @vincentkoc.
+- Remove unused global documentation audit indexes [#143164](https://github.com/openclaw/openclaw/pull/143164)
+- Reuse numeric flag parsing in performance tests [#143237](https://github.com/openclaw/openclaw/pull/143237)
+- Clarify CI watcher progress and timeout output [#143320](https://github.com/openclaw/openclaw/pull/143320)
+- Avoid repeated SDK export traversal [#143393](https://github.com/openclaw/openclaw/pull/143393)
+- Skip unnecessary SDK guard parsing [#143513](https://github.com/openclaw/openclaw/pull/143513). Thanks @RomneyDa.
+- Share task audit summary counting [#143682](https://github.com/openclaw/openclaw/pull/143682). Thanks @vincentkoc.
+- Share dead-code scan orchestration [#143745](https://github.com/openclaw/openclaw/pull/143745). Thanks @vincentkoc.
+- Refresh translation records for Skills screens [#143806](https://github.com/openclaw/openclaw/pull/143806)
+- Refresh snapshot translation records [#143914](https://github.com/openclaw/openclaw/pull/143914)
+- Reuse plugin metadata during docs generation [#144120](https://github.com/openclaw/openclaw/pull/144120)
+
+**Bug fixes**
+
+- Keep local test worker counts consistent across projects [#141716](https://github.com/openclaw/openclaw/pull/141716)
+- Prevent source installs from modifying another checkout's dependencies [#141719](https://github.com/openclaw/openclaw/pull/141719)
+- Label pull requests editing split documentation pages [#142677](https://github.com/openclaw/openclaw/pull/142677). Thanks @vincentkoc.
+- Extend plugin documentation label coverage [#142735](https://github.com/openclaw/openclaw/pull/142735). Thanks @vincentkoc.
+- Track shared native-translation inputs [#142786](https://github.com/openclaw/openclaw/pull/142786). Thanks @vincentkoc.
+- Distinguish declared ClawHub routes from unverified headings in audits [#143002](https://github.com/openclaw/openclaw/pull/143002). Thanks @vincentkoc.
+- Allow the approved historical pnpm pin in isolated checks [#143129](https://github.com/openclaw/openclaw/pull/143129). Thanks @vincentkoc.
+- Audit unused exports after script and root-test changes [#143268](https://github.com/openclaw/openclaw/pull/143268)
+- Preserve fenced examples during documentation formatting [#143394](https://github.com/openclaw/openclaw/pull/143394)
+- Report original source lines in documentation errors [#143404](https://github.com/openclaw/openclaw/pull/143404)
+- Detect overdue documentation during steady edits [#143455](https://github.com/openclaw/openclaw/pull/143455)
+- Distinguish interrupted development runners from completed stops [#143676](https://github.com/openclaw/openclaw/pull/143676). Thanks @shakkernerd.
+- Recover locale imports after source errors [#143776](https://github.com/openclaw/openclaw/pull/143776)
+
+**Documentation**
+
+- Organize testing guidance by task [#141221](https://github.com/openclaw/openclaw/pull/141221). Thanks @vincentkoc.
+- Refresh maturity evidence and coverage reports [#141910](https://github.com/openclaw/openclaw/pull/141910)
+- Split testing guidance into focused pages [#141968](https://github.com/openclaw/openclaw/pull/141968). Thanks @vincentkoc.
+- Validate maturity documentation routes and anchors [#141977](https://github.com/openclaw/openclaw/pull/141977). Thanks @RomneyDa.
+- Refresh maturity scorecard evidence [#142114](https://github.com/openclaw/openclaw/pull/142114)
+- Split QA automation guidance into focused pages [#142426](https://github.com/openclaw/openclaw/pull/142426). Thanks @vincentkoc.
+- Link live-test filtering guidance to its current page [#142560](https://github.com/openclaw/openclaw/pull/142560). Thanks @vincentkoc.
+- Keep SDK alias removal pending review [#142708](https://github.com/openclaw/openclaw/pull/142708)
+- Keep routine repository output inline [#142946](https://github.com/openclaw/openclaw/pull/142946). Thanks @vincentkoc.
+- Organize live-testing documentation by test task [#143042](https://github.com/openclaw/openclaw/pull/143042). Thanks @vincentkoc.
+- Split CI routing guidance into focused pages [#143053](https://github.com/openclaw/openclaw/pull/143053). Thanks @vincentkoc.
+- Refresh CI and plugin validation guidance [#143287](https://github.com/openclaw/openclaw/pull/143287)
+- Document temporary defensive-work model routing [#143698](https://github.com/openclaw/openclaw/pull/143698)
+- Consolidate contributor guidance and subsystem ownership [#143785](https://github.com/openclaw/openclaw/pull/143785). Thanks @obviyus and @vincentkoc.
+
+
+
+
+
+
+##### Reverted changes
+
+
+A change to conversation-marker spacing was undone. Both changes are listed below; the existing compact left rail remains.
+
+
+
+###### Sources and complete change list
+
+
+**Improvements**
+
+- Record the reverted conversation rail spacing adjustment [#142667](https://github.com/openclaw/openclaw/pull/142667). Thanks @Patrick-Erichsen.
+
+**Bug fixes**
+
+- Revert the canceled conversation rail spacing adjustment [#142684](https://github.com/openclaw/openclaw/pull/142684). Thanks @Patrick-Erichsen.
+
+
+
+
+
+
+
diff --git a/scripts/android-release-upload.sh b/scripts/android-release-upload.sh
new file mode 100644
index 0000000000000000000000000000000000000000..970d937d9c7e2add276c5228d669d7e6cb026a63
--- /dev/null
+++ b/scripts/android-release-upload.sh
@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# Bash 5.3+ can deadlock writing heredoc pipes on macOS before the reader starts.
+if [[ ${OSTYPE:-} == darwin* && $BASH != /bin/bash ]] && ((BASH_VERSINFO[0] > 5 || (BASH_VERSINFO[0] == 5 && BASH_VERSINFO[1] >= 3))); then
+  exec /bin/bash "$0" "$@"
+fi
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage:
+  scripts/android-release-upload.sh
+
+Uploads Android Play metadata, builds signed release artifacts, and uploads the
+Play AAB to Google Play internal testing by default. This does not promote the
+build to production.
+EOF
+}
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+source "${ROOT_DIR}/scripts/lib/android-fastlane.sh"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --)
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      usage
+      exit 1
+      ;;
+  esac
+done
+
+(
+  cd "${ROOT_DIR}/apps/android"
+  run_android_fastlane android release_upload
+)
diff --git a/scripts/android-release.sh b/scripts/android-release.sh
new file mode 100644
index 0000000000000000000000000000000000000000..948f7dc18e8fa8b891ca187f3ef5ccefa8adca7a
--- /dev/null
+++ b/scripts/android-release.sh
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+exec bash "${ROOT_DIR}/scripts/android-release-upload.sh" "$@"
diff --git a/scripts/android-sync-versioning.ts b/scripts/android-sync-versioning.ts
new file mode 100644
index 0000000000000000000000000000000000000000..636d71cbb656898315b65cea6cade944d78c3248
--- /dev/null
+++ b/scripts/android-sync-versioning.ts
@@ -0,0 +1,43 @@
+// Android Sync Versioning script supports OpenClaw repository automation.
+import { checkAndroidVersioning } from "./lib/android-version.ts";
+import { parseVersionSyncArgs } from "./lib/version-script-args.ts";
+
+export { parseVersionSyncArgs as parseArgs } from "./lib/version-script-args.ts";
+
+function printUsage(): void {
+  process.stdout.write(
+    "Usage: node --import tsx scripts/android-sync-versioning.ts --check [--require-mobile-release] [--revision n] [--root dir]\n",
+  );
+}
+
+function main(argv = process.argv.slice(2)): number {
+  const requireMobileRelease = argv.includes("--require-mobile-release");
+  const options = parseVersionSyncArgs(
+    argv.filter((arg) => arg !== "--require-mobile-release"),
+    { allowAppStoreRevision: true },
+  );
+  if (options.help) {
+    printUsage();
+    return 0;
+  }
+
+  if (options.mode !== "check") {
+    throw new Error(
+      "Android version sync is retired. Run the shared mobile cutter in scripts/mobile-release-version.ts.",
+    );
+  }
+  checkAndroidVersioning({
+    appStoreRevision: options.appStoreRevision ?? undefined,
+    requireMobileRelease,
+    rootDir: options.rootDir,
+  });
+  process.stdout.write("Android versioning artifacts match committed release metadata.\n");
+  return 0;
+}
+
+try {
+  process.exitCode = main();
+} catch (error) {
+  process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+  process.exitCode = 1;
+}
diff --git a/scripts/android-version.ts b/scripts/android-version.ts
new file mode 100644
index 0000000000000000000000000000000000000000..82ffdb2cee431ee8f72f6d9b52fea357454c6965
--- /dev/null
+++ b/scripts/android-version.ts
@@ -0,0 +1,47 @@
+// Android Version script supports OpenClaw repository automation.
+import { resolveAndroidVersion } from "./lib/android-version.ts";
+import { parseVersionQueryArgs } from "./lib/version-script-args.ts";
+
+function printUsage(): void {
+  process.stdout.write(
+    "Usage: node --import tsx scripts/android-version.ts [--json|--shell] [--field name] [--root dir]\n\n",
+  );
+}
+
+function main(argv = process.argv.slice(2)): number {
+  const options = parseVersionQueryArgs(argv);
+  if (options.help) {
+    printUsage();
+    return 0;
+  }
+
+  const version = resolveAndroidVersion(options.rootDir);
+
+  if (options.field) {
+    const value = version[options.field as keyof typeof version];
+    if (value === undefined) {
+      throw new Error(`Unknown Android version field '${options.field}'.`);
+    }
+    process.stdout.write(`${value}\n`);
+    return 0;
+  }
+
+  if (options.format === "shell") {
+    process.stdout.write(
+      [
+        `OPENCLAW_ANDROID_VERSION_NAME=${version.canonicalVersion}`,
+        `OPENCLAW_ANDROID_VERSION_CODE=${version.versionCode}`,
+      ].join("\n") + "\n",
+    );
+  } else {
+    process.stdout.write(`${JSON.stringify(version, null, 2)}\n`);
+  }
+  return 0;
+}
+
+try {
+  process.exitCode = main();
+} catch (error) {
+  process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+  process.exitCode = 1;
+}
diff --git a/scripts/anthropic-prompt-probe.ts b/scripts/anthropic-prompt-probe.ts
new file mode 100644
index 0000000000000000000000000000000000000000..8f141f732a459d790c3076e777b608070f6d0c2e
--- /dev/null
+++ b/scripts/anthropic-prompt-probe.ts
@@ -0,0 +1,1088 @@
+// Anthropic Prompt Probe script supports OpenClaw repository automation.
+import { spawn } from "node:child_process";
+// Live prompt probe for Anthropic setup-token and Claude CLI prompt-path debugging.
+// Usage:
+// OPENCLAW_PROMPT_TRANSPORT=direct|gateway
+// OPENCLAW_PROMPT_MODE=extra
+// OPENCLAW_PROMPT_TEXT='...'
+// OPENCLAW_PROMPT_CAPTURE=1
+// pnpm probe:anthropic:prompt
+import { randomUUID } from "node:crypto";
+import fs from "node:fs/promises";
+import http from "node:http";
+import os from "node:os";
+import path from "node:path";
+import process from "node:process";
+import { pathToFileURL } from "node:url";
+import { truncateUtf16Safe } from "@openclaw/normalization-core/utf16-slice";
+import type { AuthProfileCredential } from "../src/agents/auth-profiles.js";
+import { fetchWithSsrFGuard, type GuardedFetchResult } from "../src/infra/net/fetch-guard.js";
+import {
+  parseBooleanEnv,
+  parseStrictIntegerOption,
+  redactForDevToolLog,
+} from "./lib/dev-tooling-safety.ts";
+import {
+  hasUnjoinedWork,
+  inspectManagedProcessGroup,
+  runManagedCommand,
+  signalExitCode,
+  terminateManagedChild,
+} from "./lib/managed-child-process.mts";
+
+const TRANSPORT = process.env.OPENCLAW_PROMPT_TRANSPORT?.trim() === "direct" ? "direct" : "gateway";
+const GATEWAY_PROMPT_MODE = "extra";
+const PROMPT_TEXT = process.env.OPENCLAW_PROMPT_TEXT?.trim() ?? "";
+const PROMPT_LIST_JSON = process.env.OPENCLAW_PROMPT_LIST_JSON?.trim() ?? "";
+const USER_PROMPT = process.env.OPENCLAW_USER_PROMPT?.trim() || "is clawd here?";
+const ENABLE_CAPTURE = parseBooleanEnv({
+  fallback: false,
+  name: "OPENCLAW_PROMPT_CAPTURE",
+  raw: process.env.OPENCLAW_PROMPT_CAPTURE,
+});
+const INCLUDE_RAW = parseBooleanEnv({
+  fallback: false,
+  name: "OPENCLAW_PROMPT_INCLUDE_RAW",
+  raw: process.env.OPENCLAW_PROMPT_INCLUDE_RAW,
+});
+const KEEP_TMP = parseBooleanEnv({
+  fallback: false,
+  name: "OPENCLAW_PROMPT_KEEP_TMP",
+  raw: process.env.OPENCLAW_PROMPT_KEEP_TMP,
+});
+const CLAUDE_BIN = process.env.CLAUDE_BIN?.trim() || "claude";
+const NODE_BIN = process.env.OPENCLAW_NODE_BIN?.trim() || process.execPath;
+const TIMEOUT_MS = parseStrictIntegerOption({
+  fallback: 45_000,
+  label: "OPENCLAW_PROMPT_TIMEOUT_MS",
+  min: 1,
+  raw: process.env.OPENCLAW_PROMPT_TIMEOUT_MS,
+});
+const GATEWAY_TIMEOUT_MS = parseStrictIntegerOption({
+  fallback: 120_000,
+  label: "OPENCLAW_PROMPT_GATEWAY_TIMEOUT_MS",
+  min: 1,
+  raw: process.env.OPENCLAW_PROMPT_GATEWAY_TIMEOUT_MS,
+});
+const CAPTURE_PROXY_MAX_BODY_BYTES = parseStrictIntegerOption({
+  fallback: 2 * 1024 * 1024,
+  label: "OPENCLAW_PROMPT_CAPTURE_MAX_BODY_BYTES",
+  min: 1,
+  raw: process.env.OPENCLAW_PROMPT_CAPTURE_MAX_BODY_BYTES,
+});
+const GATEWAY_LOG_TAIL_BYTES = 256 * 1024;
+const SETUP_TOKEN_RAW = process.env.OPENCLAW_LIVE_SETUP_TOKEN?.trim() ?? "";
+const SETUP_TOKEN_VALUE = process.env.OPENCLAW_LIVE_SETUP_TOKEN_VALUE?.trim() ?? "";
+const SETUP_TOKEN_PROFILE = process.env.OPENCLAW_LIVE_SETUP_TOKEN_PROFILE?.trim() ?? "";
+const DIRECT_CLAUDE_ARGS = ["-p", "--append-system-prompt"];
+
+type CaptureSummary = {
+  url?: string;
+  authScheme?: string;
+  xApp?: string;
+  anthropicBeta?: string;
+  systemBlockCount: number;
+  systemBlocks: Array<{ index: number; bytes: number; preview: string }>;
+  containsPromptExact: boolean;
+  bodyContainsPromptExact: boolean;
+  userBytes?: number;
+  userPreview?: string;
+  rawBody?: string;
+};
+
+type PromptResult = {
+  prompt: string;
+  ok: boolean;
+  transport: "direct" | "gateway";
+  promptMode?: "extra";
+  exitCode?: number | null;
+  signal?: NodeJS.Signals | null;
+  status?: string;
+  text?: string;
+  stdout?: string;
+  stderr?: string;
+  error?: string;
+  matchedExtraUsage400: boolean;
+  capture?: CaptureSummary;
+  tmpDir?: string;
+};
+
+type ProxyCapture = {
+  url?: string;
+  authHeader?: string;
+  xApp?: string;
+  anthropicBeta?: string;
+  systemTexts: string[];
+  userText?: string;
+  rawBody?: string;
+};
+
+type TokenSource = {
+  profileId: string;
+  token: string;
+};
+
+type StoppableGatewayChild = {
+  exitCode: number | null;
+  pid?: number;
+  signalCode: NodeJS.Signals | null;
+  kill(signal: NodeJS.Signals): boolean;
+  once(event: "exit", listener: () => void): unknown;
+};
+
+type ClosableLogFile = {
+  appendFile?(data: string | Uint8Array): Promise<void>;
+  close(): Promise<void>;
+};
+
+function toHeaderValue(value: string | string[] | undefined): string | undefined {
+  return Array.isArray(value) ? value.join(", ") : value;
+}
+
+function summarizeText(text: string, max = 120): string {
+  const normalized = text.replace(/\s+/g, " ").trim();
+  if (normalized.length <= max) {
+    return normalized;
+  }
+  return `${truncateUtf16Safe(normalized, max - 1)}…`;
+}
+
+function summarizeCapture(
+  capture: ProxyCapture | undefined,
+  prompt: string,
+): CaptureSummary | undefined {
+  if (!capture) {
+    return undefined;
+  }
+  return {
+    url: capture.url,
+    authScheme: capture.authHeader?.split(/\s+/, 1)[0],
+    xApp: capture.xApp,
+    anthropicBeta: capture.anthropicBeta,
+    systemBlockCount: capture.systemTexts.length,
+    systemBlocks: capture.systemTexts.map((entry, index) => ({
+      index,
+      bytes: Buffer.byteLength(entry, "utf8"),
+      preview: summarizeText(entry),
+    })),
+    containsPromptExact: capture.systemTexts.includes(prompt),
+    bodyContainsPromptExact: capture.rawBody?.includes(prompt) ?? false,
+    userBytes: capture.userText ? Buffer.byteLength(capture.userText, "utf8") : undefined,
+    userPreview: capture.userText ? summarizeText(capture.userText) : undefined,
+    rawBody: INCLUDE_RAW ? capture.rawBody : undefined,
+  };
+}
+
+function resolveAnthropicUpstreamUrl(
+  requestUrl: string | undefined,
+  upstreamBaseUrl: string,
+): string {
+  const raw = requestUrl || "/";
+  if (!raw.startsWith("/") || raw.startsWith("//")) {
+    throw new Error(`refusing non-origin proxy request URL: ${JSON.stringify(raw)}`);
+  }
+  const upstream = new URL(upstreamBaseUrl);
+  if (upstream.protocol !== "https:" || upstream.hostname !== "api.anthropic.com") {
+    throw new Error(`refusing unexpected Anthropic upstream origin: ${upstream.origin}`);
+  }
+  const requestPath = new URL(raw, "http://127.0.0.1");
+  return new URL(`${requestPath.pathname}${requestPath.search}`, upstream).toString();
+}
+
+function matchesExtraUsage400(...parts: Array<string | undefined>): boolean {
+  return parts
+    .filter((value): value is string => typeof value === "string" && value.length > 0)
+    .join(" ")
+    .toLowerCase()
+    .includes("third-party apps now draw from your extra usage");
+}
+
+function promptProbeTmpResult(tmpDir: string, keepTmp = KEEP_TMP): Pick<PromptResult, "tmpDir"> {
+  return keepTmp ? { tmpDir } : {};
+}
+
+async function cleanupPromptProbeTmpDir(tmpDir: string, keepTmp = KEEP_TMP): Promise<void> {
+  if (keepTmp) {
+    return;
+  }
+  await fs.rm(tmpDir, { force: true, recursive: true });
+}
+
+function isSetupToken(value: string): boolean {
+  return value.startsWith("sk-ant-oat01-");
+}
+
+function listSetupTokenProfiles(
+  store: { profiles: Record<string, AuthProfileCredential> },
+  normalizeProviderId: (provider: string) => string,
+): Array<{ id: string; token: string }> {
+  return Object.entries(store.profiles).flatMap(([id, cred]) => {
+    if (
+      cred.type !== "token" ||
+      normalizeProviderId(cred.provider) !== "anthropic" ||
+      !isSetupToken(cred.token ?? "")
+    ) {
+      return [];
+    }
+    return [{ id, token: cred.token ?? "" }];
+  });
+}
+
+function pickSetupTokenProfile(candidates: Array<{ id: string; token: string }>): {
+  id: string;
+  token: string;
+} | null {
+  const preferred = ["anthropic:setup-token-test", "anthropic:setup-token", "anthropic:default"];
+  for (const id of preferred) {
+    const match = candidates.find((entry) => entry.id === id);
+    if (match) {
+      return match;
+    }
+  }
+  return candidates[0] ?? null;
+}
+
+async function resolveSetupTokenSource(): Promise<TokenSource> {
+  const [
+    { resolveDefaultAgentDir },
+    { ensureAuthProfileStore },
+    { normalizeProviderId },
+    tokenApi,
+  ] = await Promise.all([
+    import("../src/agents/agent-scope.js"),
+    import("../src/agents/auth-profiles.js"),
+    import("../src/agents/model-selection.js"),
+    import("../src/commands/auth-token.js"),
+  ]);
+  const validateSetupToken = (value: string): string => {
+    const error = tokenApi.validateAnthropicSetupToken(value);
+    if (error) {
+      throw new Error(`invalid setup-token: ${error}`);
+    }
+    return value;
+  };
+  const explicitToken =
+    (SETUP_TOKEN_RAW && isSetupToken(SETUP_TOKEN_RAW) ? SETUP_TOKEN_RAW : "") || SETUP_TOKEN_VALUE;
+  if (explicitToken) {
+    return {
+      profileId: "anthropic:default",
+      token: validateSetupToken(explicitToken),
+    };
+  }
+
+  const agentDir = resolveDefaultAgentDir({});
+  const store = ensureAuthProfileStore(agentDir, {
+    allowKeychainPrompt: false,
+  });
+  const candidates = listSetupTokenProfiles(store, normalizeProviderId);
+  if (SETUP_TOKEN_PROFILE) {
+    const match = candidates.find((entry) => entry.id === SETUP_TOKEN_PROFILE);
+    if (!match) {
+      throw new Error(`setup-token profile not found: ${SETUP_TOKEN_PROFILE}`);
+    }
+    return { profileId: match.id, token: validateSetupToken(match.token) };
+  }
+  const match = pickSetupTokenProfile(candidates);
+  if (!match) {
+    throw new Error(
+      "no Anthropics setup-token profile found; set OPENCLAW_LIVE_SETUP_TOKEN_VALUE or OPENCLAW_LIVE_SETUP_TOKEN_PROFILE",
+    );
+  }
+  return { profileId: match.id, token: validateSetupToken(match.token) };
+}
+
+async function sleep(ms: number): Promise<void> {
+  return await new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}
+
+async function withTimeout<T>(
+  promise: Promise<T>,
+  timeoutMs: number,
+  fallback: () => T,
+): Promise<T> {
+  return await Promise.race([promise, sleep(timeoutMs).then(() => fallback())]);
+}
+
+async function readRequestBody(
+  req: http.IncomingMessage,
+  maxBytes = CAPTURE_PROXY_MAX_BODY_BYTES,
+): Promise<Buffer> {
+  const chunks: Buffer[] = [];
+  let totalBytes = 0;
+  for await (const chunk of req) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    totalBytes += buffer.length;
+    if (totalBytes > maxBytes) {
+      req.destroy();
+      throw new Error(`Anthropic capture proxy request body exceeded ${maxBytes} bytes`);
+    }
+    chunks.push(buffer);
+  }
+  return Buffer.concat(chunks, totalBytes);
+}
+
+function extractProxyCapture(rawBody: string, req: http.IncomingMessage): ProxyCapture {
+  let parsed: {
+    system?: Array<{ text?: string }>;
+    messages?: Array<{ role?: string; content?: unknown }>;
+  } | null;
+  try {
+    parsed = JSON.parse(rawBody) as typeof parsed;
+  } catch {
+    parsed = null;
+  }
+  const systemTexts = Array.isArray(parsed?.system)
+    ? parsed.system
+        .map((entry) => (typeof entry?.text === "string" ? entry.text : ""))
+        .filter(Boolean)
+    : [];
+  const userText = Array.isArray(parsed?.messages)
+    ? parsed.messages
+        .filter((entry) => entry?.role === "user")
+        .flatMap((entry) => {
+          const content = entry?.content;
+          if (typeof content === "string") {
+            return [content];
+          }
+          if (!Array.isArray(content)) {
+            return [];
+          }
+          return content
+            .map((item) =>
+              item && typeof item === "object" && "text" in item && typeof item.text === "string"
+                ? item.text
+                : "",
+            )
+            .filter(Boolean);
+        })
+        .join("\n")
+    : undefined;
+  return {
+    url: req.url ?? undefined,
+    authHeader: toHeaderValue(req.headers.authorization),
+    xApp: toHeaderValue(req.headers["x-app"]),
+    anthropicBeta: toHeaderValue(req.headers["anthropic-beta"]),
+    systemTexts,
+    userText,
+    rawBody,
+  };
+}
+
+async function startAnthropicProxy(params: {
+  port: number;
+  upstreamBaseUrl: string;
+  timeoutMs: number;
+}) {
+  let lastCapture: ProxyCapture | undefined;
+  const sockets = new Set<import("node:net").Socket>();
+  const server = http.createServer((req, res) => {
+    void (async () => {
+      try {
+        const method = req.method ?? "GET";
+        const requestBody = await readRequestBody(req);
+        const rawBody = requestBody.toString("utf8");
+        lastCapture = extractProxyCapture(rawBody, req);
+
+        const upstreamUrl = resolveAnthropicUpstreamUrl(req.url, params.upstreamBaseUrl);
+        const controller = new AbortController();
+        const timeoutError = new Error(`Anthropic upstream timed out after ${params.timeoutMs}ms`);
+        let timeout: ReturnType<typeof setTimeout> | undefined;
+        const timeoutPromise = new Promise<never>((_resolve, reject) => {
+          timeout = setTimeout(() => {
+            reject(timeoutError);
+            controller.abort(timeoutError);
+          }, params.timeoutMs);
+        });
+        const headers = new Headers();
+        for (const [key, value] of Object.entries(req.headers)) {
+          if (value === undefined) {
+            continue;
+          }
+          const lower = key.toLowerCase();
+          if (lower === "host" || lower === "content-length") {
+            continue;
+          }
+          headers.set(key, Array.isArray(value) ? value.join(", ") : value);
+        }
+        const upstreamInit = {
+          method,
+          headers,
+          body:
+            method === "GET" || method === "HEAD" || requestBody.byteLength === 0
+              ? undefined
+              : Uint8Array.from(requestBody),
+          duplex: "half",
+          signal: controller.signal,
+        } as RequestInit & { duplex: "half" };
+        let guardedFetch: GuardedFetchResult | undefined;
+        try {
+          guardedFetch = await Promise.race([
+            fetchWithSsrFGuard({
+              url: upstreamUrl,
+              init: upstreamInit,
+              signal: controller.signal,
+              timeoutMs: params.timeoutMs,
+              maxRedirects: 0,
+              requireHttps: true,
+              capture: false,
+              auditContext: "anthropic-prompt-probe",
+            }),
+            timeoutPromise,
+          ]);
+          const upstreamRes = guardedFetch.response;
+          const responseHeaders: Record<string, string> = {};
+          for (const [key, value] of upstreamRes.headers.entries()) {
+            const lower = key.toLowerCase();
+            if (
+              lower === "content-length" ||
+              lower === "content-encoding" ||
+              lower === "transfer-encoding" ||
+              lower === "connection" ||
+              lower === "keep-alive"
+            ) {
+              continue;
+            }
+            responseHeaders[key] = value;
+          }
+          res.writeHead(upstreamRes.status, responseHeaders);
+          // Commit the upstream status before reading its body. If that read stalls or
+          // terminates early, destroying the chunked response must remain visible to
+          // downstream clients as a truncated transfer instead of a valid empty body.
+          res.flushHeaders();
+          let responseBodyBytes = 0;
+          if (upstreamRes.body) {
+            await Promise.race([
+              (async () => {
+                for await (const chunk of upstreamRes.body!) {
+                  const bytes = Buffer.from(chunk);
+                  responseBodyBytes += bytes.byteLength;
+                  res.write(bytes);
+                }
+              })(),
+              timeoutPromise,
+            ]);
+          }
+          if (
+            responseBodyBytes === 0 &&
+            method !== "HEAD" &&
+            ![204, 304].includes(upstreamRes.status)
+          ) {
+            throw new Error("Anthropic upstream returned an empty response body");
+          }
+          res.end();
+        } finally {
+          clearTimeout(timeout);
+          await guardedFetch?.release();
+        }
+      } catch (error) {
+        // Once upstream headers are forwarded, a synthetic 502 is invalid.
+        // Close the downstream body so its reader fails instead of hanging.
+        if (res.headersSent) {
+          res.destroy();
+          return;
+        }
+        res.writeHead(502, { "content-type": "text/plain; charset=utf-8" });
+        res.end(redactForDevToolLog(`proxy error: ${String(error)}`));
+      }
+    })();
+  });
+  server.on("connection", (socket) => {
+    sockets.add(socket);
+    socket.on("close", () => sockets.delete(socket));
+  });
+  await new Promise<void>((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(params.port, "127.0.0.1", () => resolve());
+  });
+  const address = server.address();
+  if (!address || typeof address === "string") {
+    throw new Error("Anthropic capture proxy did not bind to a TCP port");
+  }
+  return {
+    port: address.port,
+    getLastCapture() {
+      return lastCapture;
+    },
+    async stop() {
+      for (const socket of sockets) {
+        socket.destroy();
+      }
+      await withTimeout(
+        new Promise<void>((resolve, reject) => {
+          server.close((error) => (error ? reject(error) : resolve()));
+        }),
+        1_000,
+        () => undefined,
+      );
+    },
+  };
+}
+
+async function getFreePort(): Promise<number> {
+  const { getFreePortBlockWithPermissionFallback } = await import("../src/test-utils/ports.js");
+  return await getFreePortBlockWithPermissionFallback({
+    offsets: [0, 1, 2, 4],
+    fallbackBase: 44_000,
+  });
+}
+
+async function runDirectPrompt(
+  prompt: string,
+  options: {
+    claudeBin?: string;
+    shutdownWaitMs?: number;
+    timeoutMs?: number;
+  } = {},
+): Promise<PromptResult> {
+  const timeoutMs = options.timeoutMs ?? TIMEOUT_MS;
+  const cancellation = new AbortController();
+  let cleanupConfirmed = true;
+  const parentSignalController = createPromptProbeParentSignalController((exitCode) => {
+    if (cleanupConfirmed) {
+      process.exit(exitCode);
+    } else {
+      process.exitCode = 1;
+    }
+  });
+  const operation = (async (): Promise<PromptResult> => {
+    const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-direct-prompt-probe-"));
+    let proxy: Awaited<ReturnType<typeof startAnthropicProxy>> | undefined;
+    try {
+      cancellation.signal.throwIfAborted();
+      const proxyPort = ENABLE_CAPTURE ? await getFreePort() : undefined;
+      proxy =
+        ENABLE_CAPTURE && proxyPort
+          ? await startAnthropicProxy({
+              port: proxyPort,
+              upstreamBaseUrl: "https://api.anthropic.com",
+              timeoutMs,
+            })
+          : undefined;
+      const stdout: string[] = [];
+      const stderr: string[] = [];
+      let exit: { code: number | null; signal: NodeJS.Signals | null } = {
+        code: null,
+        signal: null,
+      };
+      try {
+        await runManagedCommand({
+          bin: options.claudeBin ?? CLAUDE_BIN,
+          args: [...DIRECT_CLAUDE_ARGS, prompt, USER_PROMPT],
+          cwd: process.cwd(),
+          env: {
+            ...process.env,
+            ...(proxyPort ? { ANTHROPIC_BASE_URL: `http://127.0.0.1:${proxyPort}` } : {}),
+            ANTHROPIC_API_KEY: "",
+            ANTHROPIC_API_KEY_OLD: "",
+          },
+          shell: false,
+          stdio: ["ignore", "pipe", "pipe"],
+          requireProcessTreeExit: process.platform !== "win32",
+          signal: cancellation.signal,
+          timeoutMs,
+          timeoutKillGraceMs: 0,
+          signalKillGraceMs: 0,
+          abortKillGraceMs: 0,
+          cleanupDrainTimeoutMs: options.shutdownWaitMs ?? 1_500,
+          onReady(child) {
+            child.stdout?.on("data", (chunk) => stdout.push(String(chunk)));
+            child.stderr?.on("data", (chunk) => stderr.push(String(chunk)));
+            child.once("exit", (code, signal) => {
+              exit = { code, signal };
+            });
+          },
+        });
+      } catch (error) {
+        if (!(error instanceof Error) || !("code" in error) || error.code !== "ETIMEDOUT") {
+          throw error;
+        }
+        exit = { code: null, signal: "SIGKILL" };
+      }
+      const joinedStdout = stdout.join("");
+      const joinedStderr = stderr.join("");
+      return {
+        prompt,
+        ok: exit.code === 0 && !matchesExtraUsage400(joinedStdout, joinedStderr),
+        transport: "direct",
+        exitCode: exit.code,
+        signal: exit.signal,
+        stdout: redactForDevToolLog(joinedStdout.trim()) || undefined,
+        stderr: redactForDevToolLog(joinedStderr.trim()) || undefined,
+        matchedExtraUsage400: matchesExtraUsage400(joinedStdout, joinedStderr),
+        capture: summarizeCapture(proxy?.getLastCapture(), prompt),
+        ...promptProbeTmpResult(tmpDir),
+      };
+    } catch (error) {
+      cleanupConfirmed = !hasUnjoinedWork(error);
+      throw error;
+    } finally {
+      await proxy?.stop().catch(() => {});
+      await cleanupPromptProbeTmpDir(tmpDir).catch(() => {});
+    }
+  })();
+  parentSignalController.attach({
+    async stop() {
+      cancellation.abort();
+      await operation;
+    },
+    forceKill() {
+      cancellation.abort();
+    },
+  });
+  try {
+    const result = await operation;
+    cancellation.signal.throwIfAborted();
+    return result;
+  } finally {
+    parentSignalController.dispose();
+  }
+}
+
+async function startGatewayProcess(params: {
+  port: number;
+  gatewayToken: string;
+  configPath: string;
+  stateDir: string;
+  agentDir: string;
+  bundledPluginsDir: string;
+  logPath: string;
+}) {
+  const logFile = await fs.open(params.logPath, "a");
+  const parentSignalController = createPromptProbeParentSignalController();
+  const child = spawn(
+    NODE_BIN,
+    ["openclaw.mjs", "gateway", "--port", String(params.port), "--bind", "loopback", "--force"],
+    {
+      cwd: process.cwd(),
+      env: {
+        ...process.env,
+        OPENCLAW_CONFIG_PATH: params.configPath,
+        OPENCLAW_STATE_DIR: params.stateDir,
+        OPENCLAW_AGENT_DIR: params.agentDir,
+        OPENCLAW_GATEWAY_TOKEN: params.gatewayToken,
+        OPENCLAW_SKIP_CHANNELS: "1",
+        OPENCLAW_SKIP_GMAIL_WATCHER: "1",
+        OPENCLAW_SKIP_CANVAS_HOST: "1",
+        OPENCLAW_SKIP_BROWSER_CONTROL_SERVER: "1",
+        OPENCLAW_DISABLE_BONJOUR: "1",
+        OPENCLAW_SKIP_CRON: "1",
+        OPENCLAW_TEST_MINIMAL_GATEWAY: "1",
+        OPENCLAW_BUNDLED_PLUGINS_DIR: params.bundledPluginsDir,
+        ANTHROPIC_API_KEY: "",
+        ANTHROPIC_API_KEY_OLD: "",
+      },
+      detached: process.platform !== "win32",
+      stdio: ["ignore", "pipe", "pipe"],
+    },
+  );
+  const pendingLogWrites = new Set<Promise<void>>();
+  const logWriteErrors: unknown[] = [];
+  const trackLogWrite = (chunk: Buffer) => {
+    const write = logFile.appendFile(chunk).catch((error: unknown) => {
+      logWriteErrors.push(error);
+      throw error;
+    });
+    pendingLogWrites.add(write);
+    void write
+      .finally(() => {
+        pendingLogWrites.delete(write);
+      })
+      .catch(() => undefined);
+  };
+  child.stdout.on("data", trackLogWrite);
+  child.stderr.on("data", trackLogWrite);
+  let stopPromise: Promise<boolean> | undefined;
+  const stopOnce = async (): Promise<boolean> => {
+    stopPromise ??= stopGatewayPromptChild(
+      child,
+      logFile,
+      1_500,
+      1_500,
+      pendingLogWrites,
+      logWriteErrors,
+    ).finally(() => {
+      parentSignalController.dispose();
+    });
+    return await stopPromise;
+  };
+  parentSignalController.attach({
+    stop: stopOnce,
+    forceKill: () => {
+      terminateManagedChild(child, "SIGKILL", { useWindowsTaskkill: false });
+    },
+  });
+  return {
+    async stop(): Promise<boolean> {
+      return await stopOnce();
+    },
+  };
+}
+
+async function stopGatewayPromptChild(
+  child: StoppableGatewayChild,
+  logFile: ClosableLogFile,
+  sigintTimeoutMs = 1_500,
+  sigkillTimeoutMs = 1_500,
+  pendingLogWrites: Iterable<Promise<void>> = [],
+  logWriteErrors: readonly unknown[] = [],
+): Promise<boolean> {
+  let exited = child.exitCode !== null || child.signalCode !== null;
+  if (!exited) {
+    child.once("exit", () => {
+      exited = true;
+    });
+  }
+  if (!exited) {
+    terminateManagedChild(child, "SIGINT", { useWindowsTaskkill: false });
+  }
+  const exitedAfterSigint = await waitForGatewayPromptChildTreeExit(child, sigintTimeoutMs);
+  if (!exitedAfterSigint) {
+    terminateManagedChild(child, "SIGKILL", { useWindowsTaskkill: false });
+    await waitForGatewayPromptChildTreeExit(child, sigkillTimeoutMs);
+  }
+  const failedLogWrite = (await Promise.allSettled(pendingLogWrites)).find(
+    (result): result is PromiseRejectedResult => result.status === "rejected",
+  );
+  await logFile.close();
+  const logWriteError = failedLogWrite?.reason ?? logWriteErrors[0];
+  if (logWriteError) {
+    throw new Error(`Anthropic prompt gateway log write failed: ${String(logWriteError)}`);
+  }
+  return exited;
+}
+
+// Arm before spawn so a parent signal is retained until child cleanup can attach.
+// The first signal owns the exit code; later signals only escalate cleanup.
+function createPromptProbeParentSignalController(
+  onComplete: (exitCode: number) => void = (exitCode) => process.exit(exitCode),
+) {
+  let attachment: { forceKill(): void; stop(): Promise<unknown> } | undefined;
+  let forceKillPending = false;
+  let receivedSignal: NodeJS.Signals | undefined;
+  let shutdownPromise: Promise<unknown> | undefined;
+  const handlers = new Map<NodeJS.Signals, () => void>();
+  const dispose = () => {
+    for (const [signal, handler] of handlers) {
+      process.off(signal, handler);
+    }
+    handlers.clear();
+  };
+  const forceKill = () => {
+    try {
+      attachment?.forceKill();
+    } catch {}
+  };
+  const startShutdown = () => {
+    if (!attachment || !receivedSignal || shutdownPromise) {
+      return;
+    }
+    const attached = attachment;
+    const exitCode = signalExitCode(receivedSignal);
+    if (forceKillPending) {
+      forceKillPending = false;
+      forceKill();
+    }
+    shutdownPromise = Promise.resolve()
+      .then(() => attached.stop())
+      .catch(() => undefined)
+      .finally(() => {
+        dispose();
+        onComplete(exitCode);
+      });
+  };
+  for (const signal of ["SIGHUP", "SIGINT", "SIGTERM"] satisfies NodeJS.Signals[]) {
+    const handler = () => {
+      if (receivedSignal) {
+        if (attachment) {
+          forceKill();
+        } else {
+          forceKillPending = true;
+        }
+        return;
+      }
+      receivedSignal = signal;
+      startShutdown();
+    };
+    handlers.set(signal, handler);
+    process.on(signal, handler);
+  }
+  return {
+    attach(nextAttachment: NonNullable<typeof attachment>) {
+      attachment ??= nextAttachment;
+      startShutdown();
+    },
+    dispose,
+  };
+}
+
+async function waitForGatewayPromptChildTreeExit(
+  child: StoppableGatewayChild,
+  timeoutMs: number,
+): Promise<boolean> {
+  const deadline = Date.now() + timeoutMs;
+  const groupOptions = {
+    errorPolicy: "alive-on-eperm",
+    inspectLeaderWhenNoGroup: true,
+  } as const;
+  const childTreeExited = () =>
+    (child.exitCode !== null || child.signalCode !== null) &&
+    inspectManagedProcessGroup(child, groupOptions) !== "live";
+  while (Date.now() < deadline) {
+    if (childTreeExited()) {
+      return true;
+    }
+    await sleep(Math.min(25, Math.max(0, deadline - Date.now())));
+  }
+  return childTreeExited();
+}
+
+async function waitForGatewayReady(url: string, token: string): Promise<void> {
+  const { callGateway } = await import("../src/gateway/call.js");
+  const deadline = Date.now() + 45_000;
+  let lastError = "gateway start timeout";
+  while (Date.now() < deadline) {
+    try {
+      await callGateway({ url, token, method: "health", timeoutMs: 5_000 });
+      return;
+    } catch (error) {
+      lastError = String(error);
+      await sleep(500);
+    }
+  }
+  throw new Error(lastError);
+}
+
+async function readLogTail(logPath: string, maxBytes = GATEWAY_LOG_TAIL_BYTES): Promise<string> {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) {
+    throw new Error("maxBytes must be a positive integer");
+  }
+  const logFile = await fs.open(logPath, "r").catch(() => undefined);
+  if (!logFile) {
+    return "";
+  }
+  try {
+    const stat = await logFile.stat();
+    if (stat.size <= 0) {
+      return "";
+    }
+    const length = Math.min(stat.size, maxBytes);
+    const position = Math.max(0, stat.size - length);
+    const buffer = Buffer.allocUnsafe(length);
+    const { bytesRead } = await logFile.read(buffer, 0, length, position);
+    const raw = buffer.subarray(0, bytesRead).toString("utf8");
+    const lineAlignedRaw = position > 0 ? raw.replace(/^[^\n]*(?:\r?\n|$)/u, "") : raw;
+    return redactForDevToolLog(lineAlignedRaw.split(/\r?\n/).slice(-40).join("\n").trim());
+  } finally {
+    await logFile.close();
+  }
+}
+
+async function runGatewayPrompt(prompt: string): Promise<PromptResult> {
+  const tokenSource = await resolveSetupTokenSource();
+  const [{ callGateway }, { extractPayloadText }] = await Promise.all([
+    import("../src/gateway/call.js"),
+    import("../src/gateway/test-helpers.agent-results.js"),
+  ]);
+  const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-gateway-prompt-probe-"));
+  const stateDir = path.join(tmpDir, "state");
+  const agentDir = path.join(stateDir, "agents", "main", "agent");
+  const bundledPluginsDir = path.join(tmpDir, "bundled-plugins-empty");
+  const configPath = path.join(tmpDir, "openclaw.json");
+  const logPath = path.join(tmpDir, "gateway.log");
+  const gatewayToken = `gw-${randomUUID()}`;
+  const port = await getFreePort();
+  const proxyPort = ENABLE_CAPTURE ? await getFreePort() : undefined;
+  const proxy =
+    ENABLE_CAPTURE && proxyPort
+      ? await startAnthropicProxy({
+          port: proxyPort,
+          upstreamBaseUrl: "https://api.anthropic.com",
+          timeoutMs: GATEWAY_TIMEOUT_MS,
+        })
+      : undefined;
+  let gateway: Awaited<ReturnType<typeof startGatewayProcess>> | undefined;
+
+  try {
+    await fs.mkdir(agentDir, { recursive: true });
+    await fs.mkdir(bundledPluginsDir, { recursive: true });
+    await fs.writeFile(
+      configPath,
+      `${JSON.stringify(
+        {
+          gateway: {
+            mode: "local",
+            controlUi: { enabled: false },
+            tailscale: { mode: "off" },
+          },
+          discovery: {
+            mdns: { mode: "off" },
+          },
+          ...(proxyPort
+            ? {
+                models: {
+                  providers: {
+                    anthropic: {
+                      baseUrl: `http://127.0.0.1:${proxyPort}`,
+                      api: "anthropic-messages",
+                      models: [],
+                    },
+                  },
+                },
+              }
+            : {}),
+          auth: {
+            profiles: { [tokenSource.profileId]: { provider: "anthropic", mode: "token" } },
+            order: { anthropic: [tokenSource.profileId] },
+          },
+          agents: {
+            defaults: {
+              model: "anthropic/claude-sonnet-4-6",
+              heartbeat: {
+                includeSystemPromptSection: false,
+              },
+            },
+          },
+        },
+        null,
+        2,
+      )}\n`,
+    );
+    await fs.writeFile(
+      path.join(agentDir, "auth-profiles.json"),
+      `${JSON.stringify(
+        {
+          version: 1,
+          profiles: {
+            [tokenSource.profileId]: {
+              type: "token",
+              provider: "anthropic",
+              token: tokenSource.token,
+            },
+          },
+        },
+        null,
+        2,
+      )}\n`,
+    );
+
+    gateway = await startGatewayProcess({
+      port,
+      gatewayToken,
+      configPath,
+      stateDir,
+      agentDir,
+      bundledPluginsDir,
+      logPath,
+    });
+    const url = `ws://127.0.0.1:${port}`;
+    await waitForGatewayReady(url, gatewayToken);
+    const agentRes = await callGateway({
+      url,
+      token: gatewayToken,
+      method: "agent",
+      params: {
+        sessionKey: `agent:main:prompt-probe-${randomUUID()}`,
+        idempotencyKey: `idem-${randomUUID()}`,
+        message: "Reply with exactly: PROMPT PROBE OK.",
+        ...(GATEWAY_PROMPT_MODE === "extra" ? { extraSystemPrompt: prompt } : {}),
+        deliver: false,
+      },
+      timeoutMs: 15_000,
+      clientName: "cli",
+      mode: "cli",
+    });
+    if (typeof agentRes.runId !== "string" || agentRes.runId.trim().length === 0) {
+      return {
+        prompt,
+        ok: false,
+        transport: "gateway",
+        promptMode: GATEWAY_PROMPT_MODE,
+        error: redactForDevToolLog(`missing runId: ${JSON.stringify(agentRes)}`),
+        matchedExtraUsage400: false,
+        capture: summarizeCapture(proxy?.getLastCapture(), prompt),
+        ...promptProbeTmpResult(tmpDir),
+      };
+    }
+    const waitRes = await callGateway({
+      url,
+      token: gatewayToken,
+      method: "agent.wait",
+      params: { runId: agentRes.runId, timeoutMs: GATEWAY_TIMEOUT_MS },
+      timeoutMs: GATEWAY_TIMEOUT_MS + 10_000,
+      clientName: "cli",
+      mode: "cli",
+    });
+    const text = extractPayloadText(waitRes);
+    const waitStatus = typeof waitRes.status === "string" ? waitRes.status : undefined;
+    const waitError = typeof waitRes.error === "string" ? waitRes.error : undefined;
+    const logTail = await readLogTail(logPath);
+    const matched400 = matchesExtraUsage400(waitError, logTail, JSON.stringify(waitRes));
+    return {
+      prompt,
+      ok: waitStatus === "ok" && !matched400,
+      transport: "gateway",
+      promptMode: GATEWAY_PROMPT_MODE,
+      status: waitStatus,
+      text: text || undefined,
+      error:
+        waitStatus === "ok"
+          ? undefined
+          : redactForDevToolLog(waitError || logTail || "agent.wait failed"),
+      matchedExtraUsage400: matched400,
+      capture: summarizeCapture(proxy?.getLastCapture(), prompt),
+      ...promptProbeTmpResult(tmpDir),
+    };
+  } finally {
+    const gatewayStopped = (await gateway?.stop().catch(() => false)) ?? true;
+    await proxy?.stop().catch(() => {});
+    if (gatewayStopped) {
+      await cleanupPromptProbeTmpDir(tmpDir).catch(() => {});
+    }
+  }
+}
+
+async function main() {
+  if (!PROMPT_TEXT && !PROMPT_LIST_JSON) {
+    throw new Error("missing OPENCLAW_PROMPT_TEXT or OPENCLAW_PROMPT_LIST_JSON");
+  }
+  const prompts = PROMPT_LIST_JSON ? (JSON.parse(PROMPT_LIST_JSON) as string[]) : [PROMPT_TEXT];
+  const results: PromptResult[] = [];
+  for (const prompt of prompts) {
+    results.push(
+      TRANSPORT === "direct" ? await runDirectPrompt(prompt) : await runGatewayPrompt(prompt),
+    );
+  }
+  console.log(
+    JSON.stringify(
+      {
+        transport: TRANSPORT,
+        ...(TRANSPORT === "gateway" ? { promptMode: GATEWAY_PROMPT_MODE } : {}),
+        capture: ENABLE_CAPTURE,
+        results,
+      },
+      null,
+      2,
+    ),
+  );
+}
+
+export const testing = {
+  cleanupPromptProbeTmpDir,
+  createPromptProbeParentSignalController,
+  promptProbeTmpResult,
+  readLogTail,
+  readRequestBody,
+  resolveAnthropicUpstreamUrl,
+  runDirectPrompt,
+  startAnthropicProxy,
+  stopGatewayPromptChild,
+};
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+  await main().catch((error: unknown) => {
+    console.error(redactForDevToolLog(error instanceof Error ? error.message : String(error)));
+    process.exitCode = 1;
+  });
+}
diff --git a/scripts/audit-control-ui-dead-css.mts b/scripts/audit-control-ui-dead-css.mts
new file mode 100644
index 0000000000000000000000000000000000000000..949858199ebc624c7fce409e6bf08dbefae927aa
--- /dev/null
+++ b/scripts/audit-control-ui-dead-css.mts
@@ -0,0 +1,554 @@
+#!/usr/bin/env node
+
+// Advisory audit for Control UI class selectors that have no production source reference.
+import fs from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+import postcss, { type Rule } from "postcss";
+import selectorParser, { type ClassName, type Selector } from "postcss-selector-parser";
+import ts from "typescript";
+
+const SCRIPT_DIR = path.dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = path.resolve(SCRIPT_DIR, "..");
+const UI_ROOT = path.join(REPO_ROOT, "ui");
+const UI_SOURCE_ROOT = path.join(UI_ROOT, "src");
+const CLASS_TOKEN_PATTERN = /[-_A-Za-z][-_A-Za-z0-9]*/gu;
+const CLASS_STEM_PATTERN = /(?:^|[\s"'`=])([-_A-Za-z][-_A-Za-z0-9]*)$/u;
+
+type ExternalClassFamily = {
+  matches: (className: string) => boolean;
+  producer: string;
+};
+
+// These classes are emitted by dependencies rather than written literally in ui/src.
+const EXTERNAL_CLASS_FAMILIES: ExternalClassFamily[] = [
+  // highlight.js emits language token spans during markdown rendering.
+  {
+    matches: (className) => className === "hljs" || className.startsWith("hljs-"),
+    producer: "highlight.js via ui/src/components/markdown-code-blocks.ts",
+  },
+  // CodeMirror owns cm-* editor DOM; its Lezer highlighter owns tok-* spans.
+  {
+    matches: (className) => className.startsWith("cm-") || className.startsWith("tok-"),
+    producer:
+      "CodeMirror and @lezer/highlight via ui/src/pages/chat/components/file-editor-view.ts",
+  },
+  // Web Awesome owns wa-* classes inside its component implementation.
+  {
+    matches: (className) => className.startsWith("wa-"),
+    producer: "Web Awesome custom-element internals",
+  },
+  // ProseMirror owns the editor-root and state classes it adds to its DOM.
+  {
+    matches: (className) => className.startsWith("ProseMirror"),
+    producer: "ProseMirror editor DOM",
+  },
+  // markdown-it-task-lists emits these two classes from parsed markdown.
+  {
+    matches: (className) =>
+      className === "task-list-item" || className === "task-list-item-checkbox",
+    producer:
+      "markdown-it-task-lists via ui/src/components/markdown-parser.ts (the contains-task-list class is removed there)",
+  },
+];
+
+type SourceReferences = {
+  literalClasses: Set<string>;
+  stems: Set<string>;
+};
+
+type SourceReferenceFile = SourceReferences & {
+  file: string;
+};
+
+type DynamicClassBuilder = {
+  defaultValue: string | null;
+  dynamic: boolean;
+  name: string;
+  parameterIndex: number;
+  suffix: string;
+};
+
+type DynamicClassBuilderCall = {
+  arguments: Array<string | null>;
+  name: string;
+};
+
+type DeadClassFinding = {
+  classes: string[];
+  endLine: number;
+  file: string;
+  selector: string;
+  startLine: number;
+  testOnlyFiles: string[];
+};
+
+function groupBy<T, K>(values: Iterable<T>, keyFor: (value: T) => K): Map<K, T[]> {
+  const groups = new Map<K, T[]>();
+  for (const value of values) {
+    const key = keyFor(value);
+    const group = groups.get(key);
+    if (group) {
+      group.push(value);
+    } else {
+      groups.set(key, [value]);
+    }
+  }
+  return groups;
+}
+
+function walkFiles(rootDir: string, accepts: (fileName: string) => boolean): string[] {
+  const files: string[] = [];
+  const pending = [rootDir];
+  while (pending.length > 0) {
+    const current = pending.pop();
+    if (!current) {
+      continue;
+    }
+    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+      const entryPath = path.join(current, entry.name);
+      if (entry.isDirectory()) {
+        pending.push(entryPath);
+      } else if (entry.isFile() && accepts(entry.name)) {
+        files.push(entryPath);
+      }
+    }
+  }
+  return files.toSorted((left, right) => left.localeCompare(right));
+}
+
+function relativeToRepo(filePath: string): string {
+  return path.relative(REPO_ROOT, filePath).replaceAll(path.sep, "/");
+}
+
+function addLiteralClassTokens(value: string, output: Set<string>): void {
+  for (const match of value.matchAll(CLASS_TOKEN_PATTERN)) {
+    output.add(match[0]);
+  }
+}
+
+function addTrailingClassStem(value: string, output: Set<string>): void {
+  const stem = value.match(CLASS_STEM_PATTERN)?.[1];
+  // Dynamic class families in this UI use kebab/BEM separators. Requiring one
+  // avoids treating ordinary string assembly ("item" + index) as CSS evidence.
+  if (stem?.includes("-")) {
+    output.add(stem);
+  }
+}
+
+function inlineConditionalStringValues(node: ts.Expression): string[] {
+  if (
+    !ts.isConditionalExpression(node) ||
+    !ts.isStringLiteral(node.whenTrue) ||
+    !ts.isStringLiteral(node.whenFalse)
+  ) {
+    return [];
+  }
+  return [node.whenTrue.text, node.whenFalse.text];
+}
+
+function classMapPropertyName(node: ts.ObjectLiteralElementLike): string | null {
+  if (!ts.isPropertyAssignment(node) && !ts.isShorthandPropertyAssignment(node)) {
+    return null;
+  }
+  const name = node.name;
+  if (ts.isIdentifier(name) || ts.isStringLiteral(name) || ts.isNumericLiteral(name)) {
+    return name.text;
+  }
+  return null;
+}
+
+/** Collect literal class tokens and dynamic class stems from TypeScript source. */
+export function collectControlUiClassReferences(
+  source: string,
+  fileName = "source.ts",
+): SourceReferences {
+  const literalClasses = new Set<string>();
+  const stems = new Set<string>();
+  const sourceFile = ts.createSourceFile(fileName, source, ts.ScriptTarget.Latest, true);
+
+  function visit(node: ts.Node): void {
+    if (ts.isStringLiteralLike(node)) {
+      addLiteralClassTokens(node.text, literalClasses);
+    } else if (ts.isTemplateExpression(node)) {
+      addLiteralClassTokens(node.head.text, literalClasses);
+      addTrailingClassStem(node.head.text, stems);
+      const firstSpan = node.templateSpans[0];
+      if (node.head.text === "" && firstSpan) {
+        for (const branch of inlineConditionalStringValues(firstSpan.expression)) {
+          addTrailingClassStem(`${branch}${firstSpan.literal.text}`, stems);
+        }
+      }
+      for (const span of node.templateSpans) {
+        addLiteralClassTokens(span.literal.text, literalClasses);
+        if (ts.isTemplateMiddle(span.literal)) {
+          addTrailingClassStem(span.literal.text, stems);
+        }
+      }
+    }
+
+    if (
+      ts.isBinaryExpression(node) &&
+      node.operatorToken.kind === ts.SyntaxKind.PlusToken &&
+      (ts.isStringLiteral(node.left) || ts.isNoSubstitutionTemplateLiteral(node.left))
+    ) {
+      addTrailingClassStem(node.left.text, stems);
+    }
+
+    if (
+      ts.isCallExpression(node) &&
+      ts.isIdentifier(node.expression) &&
+      node.expression.text === "classMap" &&
+      node.arguments[0] &&
+      ts.isObjectLiteralExpression(node.arguments[0])
+    ) {
+      for (const property of node.arguments[0].properties) {
+        const name = classMapPropertyName(property);
+        if (name) {
+          literalClasses.add(name);
+        }
+      }
+    }
+
+    ts.forEachChild(node, visit);
+  }
+
+  visit(sourceFile);
+  return { literalClasses, stems };
+}
+
+function declarationName(node: ts.FunctionLikeDeclaration): string | null {
+  if (node.name && (ts.isIdentifier(node.name) || ts.isStringLiteral(node.name))) {
+    return node.name.text;
+  }
+  if (
+    (ts.isArrowFunction(node) || ts.isFunctionExpression(node)) &&
+    ts.isVariableDeclaration(node.parent) &&
+    ts.isIdentifier(node.parent.name)
+  ) {
+    return node.parent.name.text;
+  }
+  return null;
+}
+
+function isFunctionLikeDeclaration(node: ts.Node): node is ts.FunctionLikeDeclaration {
+  return (
+    ts.isFunctionDeclaration(node) ||
+    ts.isMethodDeclaration(node) ||
+    ts.isGetAccessorDeclaration(node) ||
+    ts.isSetAccessorDeclaration(node) ||
+    ts.isConstructorDeclaration(node) ||
+    ts.isFunctionExpression(node) ||
+    ts.isArrowFunction(node)
+  );
+}
+
+function callName(node: ts.CallExpression): string | null {
+  if (ts.isIdentifier(node.expression)) {
+    return node.expression.text;
+  }
+  if (ts.isPropertyAccessExpression(node.expression)) {
+    return node.expression.name.text;
+  }
+  return null;
+}
+
+function staticStringValue(node: ts.Expression | undefined): string | null {
+  return node && (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node))
+    ? node.text
+    : null;
+}
+
+function classBuilderSuffix(
+  following: ts.TemplateLiteralLikeNode,
+): { dynamic: boolean; suffix: string } | null {
+  if (following.text === "" || /^[\s"'`]/u.test(following.text)) {
+    return { dynamic: false, suffix: "" };
+  }
+  const suffix = following.text.match(/^([-_A-Za-z0-9]+)/u)?.[1];
+  if (!suffix) {
+    return null;
+  }
+  const remainder = following.text.slice(suffix.length);
+  if (remainder !== "" && !/^[\s"'`]/u.test(remainder)) {
+    return null;
+  }
+  return {
+    dynamic: ts.isTemplateMiddle(following) && remainder === "",
+    suffix,
+  };
+}
+
+function collectDynamicClassBuilderData(
+  source: string,
+  fileName: string,
+): {
+  builders: DynamicClassBuilder[];
+  calls: DynamicClassBuilderCall[];
+} {
+  const sourceFile = ts.createSourceFile(fileName, source, ts.ScriptTarget.Latest, true);
+  const builders: DynamicClassBuilder[] = [];
+  const calls: DynamicClassBuilderCall[] = [];
+
+  function visit(node: ts.Node): void {
+    if (ts.isCallExpression(node)) {
+      const name = callName(node);
+      if (name) {
+        calls.push({
+          arguments: node.arguments.map((argument) => staticStringValue(argument)),
+          name,
+        });
+      }
+    }
+
+    if (isFunctionLikeDeclaration(node) && node.body) {
+      const name = declarationName(node);
+      if (name) {
+        const builderName: string = name;
+        const parameters = new Map<string, { defaultValue: string | null; index: number }>();
+        node.parameters.forEach((parameter, index) => {
+          if (ts.isIdentifier(parameter.name)) {
+            parameters.set(parameter.name.text, {
+              defaultValue: staticStringValue(parameter.initializer),
+              index,
+            });
+          }
+        });
+        function visitBody(bodyNode: ts.Node): void {
+          if (ts.isTemplateExpression(bodyNode)) {
+            let precedingText = bodyNode.head.text;
+            for (const span of bodyNode.templateSpans) {
+              if (ts.isIdentifier(span.expression) && /(?:^|[\s"'`=])$/u.test(precedingText)) {
+                const parameter = parameters.get(span.expression.text);
+                const pattern = classBuilderSuffix(span.literal);
+                if (parameter && pattern) {
+                  builders.push({
+                    ...pattern,
+                    defaultValue: parameter.defaultValue,
+                    name: builderName,
+                    parameterIndex: parameter.index,
+                  });
+                }
+              }
+              precedingText = span.literal.text;
+            }
+          }
+          ts.forEachChild(bodyNode, visitBody);
+        }
+        visitBody(node.body);
+      }
+    }
+
+    ts.forEachChild(node, visit);
+  }
+
+  visit(sourceFile);
+  return { builders, calls };
+}
+
+function addDynamicClassBuilderReferences(
+  references: SourceReferences,
+  builders: DynamicClassBuilder[],
+  calls: DynamicClassBuilderCall[],
+): void {
+  const callsByName = groupBy(calls, (call) => call.name);
+  for (const builder of builders) {
+    const values = new Set<string>();
+    if (builder.defaultValue !== null) {
+      values.add(builder.defaultValue);
+    }
+    for (const call of callsByName.get(builder.name) ?? []) {
+      const value = call.arguments[builder.parameterIndex];
+      if (value !== null && value !== undefined) {
+        values.add(value);
+      }
+    }
+    for (const value of values) {
+      const reference = `${value}${builder.suffix}`;
+      (builder.dynamic ? references.stems : references.literalClasses).add(reference);
+    }
+  }
+}
+
+function mergeReferences(references: SourceReferences[]): SourceReferences {
+  return {
+    literalClasses: new Set(references.flatMap((entry) => [...entry.literalClasses])),
+    stems: new Set(references.flatMap((entry) => [...entry.stems])),
+  };
+}
+
+function collectSourceReferenceFiles(): {
+  production: SourceReferences;
+  tests: SourceReferenceFile[];
+} {
+  const sourceFiles = walkFiles(UI_SOURCE_ROOT, (fileName) => fileName.endsWith(".ts"));
+  const productionFiles: SourceReferenceFile[] = [];
+  const testFiles: SourceReferenceFile[] = [];
+  const builders: DynamicClassBuilder[] = [];
+  const calls: DynamicClassBuilderCall[] = [];
+  for (const filePath of sourceFiles) {
+    const source = fs.readFileSync(filePath, "utf8");
+    const entry = {
+      file: relativeToRepo(filePath),
+      ...collectControlUiClassReferences(source, filePath),
+    };
+    const isTestSupport =
+      filePath.endsWith(".test.ts") ||
+      filePath.endsWith(".test-support.ts") ||
+      filePath.split(path.sep).includes("test-helpers");
+    if (isTestSupport) {
+      testFiles.push(entry);
+    } else {
+      productionFiles.push(entry);
+      const builderData = collectDynamicClassBuilderData(source, filePath);
+      builders.push(...builderData.builders);
+      calls.push(...builderData.calls);
+    }
+  }
+
+  const indexHtml = fs.readFileSync(path.join(UI_ROOT, "index.html"), "utf8");
+  const htmlClasses = new Set<string>();
+  addLiteralClassTokens(indexHtml, htmlClasses);
+  productionFiles.push({
+    file: "ui/index.html",
+    literalClasses: htmlClasses,
+    stems: new Set(),
+  });
+
+  const production = mergeReferences(productionFiles);
+  addDynamicClassBuilderReferences(production, builders, calls);
+  return {
+    production,
+    tests: testFiles,
+  };
+}
+
+function isReferenced(className: string, references: SourceReferences): boolean {
+  return (
+    references.literalClasses.has(className) ||
+    [...references.stems].some((stem) => className.startsWith(stem))
+  );
+}
+
+function externalProducer(className: string): string | null {
+  return EXTERNAL_CLASS_FAMILIES.find((family) => family.matches(className))?.producer ?? null;
+}
+
+function selectorClasses(selector: Selector): ClassName[] {
+  const classes: ClassName[] = [];
+  selector.walkClasses((classNode) => {
+    classes.push(classNode);
+  });
+  return classes;
+}
+
+function selectorTargetsPart(selector: Selector): boolean {
+  let targetsPart = false;
+  selector.walkPseudos((pseudo) => {
+    if (pseudo.value === "::part") {
+      targetsPart = true;
+    }
+  });
+  return targetsPart;
+}
+
+function ruleLines(rule: Rule): { startLine: number; endLine: number } {
+  return {
+    startLine: rule.source?.start?.line ?? 1,
+    endLine: rule.source?.end?.line ?? rule.source?.start?.line ?? 1,
+  };
+}
+
+function testOnlyFilesFor(classes: string[], tests: SourceReferenceFile[]): string[] {
+  return tests
+    .filter((test) => classes.some((className) => isReferenced(className, test)))
+    .map((test) => test.file);
+}
+
+function auditStylesheet(
+  filePath: string,
+  references: SourceReferences,
+  tests: SourceReferenceFile[],
+): DeadClassFinding[] {
+  const css = fs.readFileSync(filePath, "utf8");
+  const root = postcss.parse(css, { from: filePath });
+  const findings: DeadClassFinding[] = [];
+  root.walkRules((rule) => {
+    const parsed = selectorParser().astSync(rule.selector);
+    for (const selector of parsed.nodes) {
+      const classes = selectorClasses(selector);
+      // Element selectors (including html/body/:root) never become class
+      // candidates. ::part selectors target component-owned shadow DOM.
+      if (classes.length === 0 || selectorTargetsPart(selector)) {
+        continue;
+      }
+      const classNames = [...new Set(classes.map((classNode) => classNode.value))];
+      const keptAlive = classNames.some(
+        (className) => externalProducer(className) || isReferenced(className, references),
+      );
+      if (keptAlive) {
+        continue;
+      }
+      findings.push({
+        ...ruleLines(rule),
+        classes: classNames,
+        file: relativeToRepo(filePath),
+        selector: selector.toString().trim(),
+        testOnlyFiles: testOnlyFilesFor(classNames, tests),
+      });
+    }
+  });
+  return findings;
+}
+
+function collectDeadClassFindings(): DeadClassFinding[] {
+  const references = collectSourceReferenceFiles();
+  const stylesheets = walkFiles(UI_SOURCE_ROOT, (fileName) => fileName.endsWith(".css"));
+  return stylesheets.flatMap((filePath) =>
+    auditStylesheet(filePath, references.production, references.tests),
+  );
+}
+
+function formatReport(findings: DeadClassFinding[]): string {
+  if (findings.length === 0) {
+    return "Control UI dead-CSS audit: 0 dead class selectors.";
+  }
+  const byFile = groupBy(findings, (finding) => finding.file);
+  const lines = ["Control UI dead-CSS audit (advisory):"];
+  for (const [file, fileFindings] of byFile) {
+    lines.push(`\n${file}`);
+    for (const finding of fileFindings) {
+      const lineRange =
+        finding.startLine === finding.endLine
+          ? `line ${finding.startLine}`
+          : `lines ${finding.startLine}-${finding.endLine}`;
+      lines.push(`  ${finding.classes.map((name) => `.${name}`).join(", ")} (${lineRange})`);
+      lines.push(`    selector: ${finding.selector}`);
+      if (finding.testOnlyFiles.length > 0) {
+        lines.push(`    test-only reference: ${finding.testOnlyFiles.join(", ")}`);
+      }
+    }
+  }
+  const classCount = findings.reduce((count, finding) => count + finding.classes.length, 0);
+  lines.push(
+    `\nSummary: ${classCount} dead class selector${classCount === 1 ? "" : "s"} in ${findings.length} selector${findings.length === 1 ? "" : "s"}.`,
+  );
+  return lines.join("\n");
+}
+
+function main(argv = process.argv.slice(2)): void {
+  if (argv.length > 0) {
+    throw new Error(`Unknown option: ${argv[0]}`);
+  }
+  process.stdout.write(`${formatReport(collectDeadClassFindings())}\n`);
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try {
+    main();
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+  }
+}
diff --git a/scripts/bench-gateway-restart.ts b/scripts/bench-gateway-restart.ts
new file mode 100644
index 0000000000000000000000000000000000000000..49ee0ac7fed3f4203bf2247d9ac3a155b2437aad
--- /dev/null
+++ b/scripts/bench-gateway-restart.ts
@@ -0,0 +1,1312 @@
+// Bench Gateway Restart script supports OpenClaw repository automation.
+import { spawn, spawnSync, type ChildProcessWithoutNullStreams } from "node:child_process";
+import fs, { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { performance } from "node:perf_hooks";
+import { pathToFileURL } from "node:url";
+import { expectDefined } from "../packages/normalization-core/src/expect.js";
+import { writeGatewayRestartIntentSync } from "../src/infra/restart-intent.js";
+import { delay, stopChild, type StopChildResult } from "./lib/gateway-bench-child.ts";
+import {
+  getFreePort,
+  readProcessRssMb,
+  readProcessTreeCpuMs,
+  requestProbeStatus,
+} from "./lib/gateway-bench-probes.ts";
+import {
+  BASE_GATEWAY_BENCH_CONFIG,
+  buildGatewayBenchChildArgs,
+  classifyGatewayReadyLog,
+  CliArgumentError,
+  collectOutputLines,
+  collectTraceLine,
+  createGatewayBenchEnv,
+  flushOutputLineBuffers,
+  formatMb,
+  formatMs,
+  formatStats,
+  hasFlag,
+  hasHelpFlag,
+  parseFlagValue,
+  parseNonNegativeInt,
+  parsePositiveInt,
+  parseRepeatableFlag,
+  resolveCases as resolveGatewayBenchCases,
+  resolveEntry as resolveGatewayBenchEntry,
+  resolveOutputPath,
+  summarizeNumbers,
+  summarizeTraceStats,
+  type SummaryStats,
+  validateCliArgs as validateGatewayBenchCliArgs,
+  waitForInitialProbe,
+  writeGatewayBenchConfig,
+  writePluginFixtures,
+} from "./lib/gateway-bench-runtime.ts";
+
+type GatewayBenchCase = {
+  config: Record<string, unknown>;
+  env?: Record<string, string>;
+  id: string;
+  name: string;
+  pluginActivationOnStartup?: boolean;
+  pluginCount?: number;
+};
+
+type ProbeTransition = {
+  errorKind?: string;
+  ms: number;
+  status: number | null;
+};
+
+type ProbeResult = {
+  downtimeMs: number | null;
+  firstErrorKind: string | null;
+  firstRecoveryMs: number | null;
+  ms: number | null;
+  status: number | null;
+  transitions: ProbeTransition[];
+  unavailableMs: number | null;
+};
+
+type ResourceSnapshot = {
+  activeHandlesCount: number | null;
+  activeRequestsCount: number | null;
+  activeTimersCount: number | null;
+  fdCount: number | null;
+  ms: number;
+  phase: string;
+  rssMb: number | null;
+};
+
+type BenchmarkEvent = {
+  errorKind?: string;
+  iteration?: number;
+  line?: string;
+  ms: number;
+  phase?: string;
+  status?: number | null;
+  type: string;
+};
+
+type GatewayRestartFailureCode =
+  | "initial_healthz_timeout"
+  | "initial_ready_log_timeout"
+  | "initial_readyz_timeout"
+  | "restart_deadline_timeout"
+  | "restart_signal_failed"
+  | "restart_child_exited"
+  | "next_healthz_timeout"
+  | "next_readyz_timeout"
+  | "ready_log_timeout"
+  | "trace_missing"
+  | "child_nonzero_exit"
+  | "cleanup_failed";
+
+type RestartIteration = {
+  cpuCoreRatio: number | null;
+  cpuMs: number | null;
+  failureCode: GatewayRestartFailureCode | null;
+  gatewayReadyLogLine: string | null;
+  gatewayReadyLogMs: number | null;
+  healthz: ProbeResult;
+  httpListenLogLine: string | null;
+  httpListenLogMs: number | null;
+  index: number;
+  readyz: ProbeResult;
+  resourceSnapshots: ResourceSnapshot[];
+  restartTrace: Record<string, number>;
+  signalSentMs: number | null;
+  startupTrace: Record<string, number>;
+};
+
+type ResourceSlope = {
+  activeHandlesCountPerRestart: number | null;
+  activeRequestsCountPerRestart: number | null;
+  activeTimersCountPerRestart: number | null;
+  fdCountPerRestart: number | null;
+  heapUsedMbPerRestart: number | null;
+  rssMbPerRestart: number | null;
+};
+
+type GatewayRestartSample = {
+  childExitCode: number | null;
+  childSignal: string | null;
+  events: BenchmarkEvent[];
+  exitedBeforeTeardown: boolean;
+  failureCode: GatewayRestartFailureCode | null;
+  firstOutputMs: number | null;
+  initialGatewayReadyLogLine: string | null;
+  initialGatewayReadyLogMs: number | null;
+  initialHealthz: ProbeResult;
+  initialHttpListenLogLine: string | null;
+  initialHttpListenLogMs: number | null;
+  initialReadyz: ProbeResult;
+  initialStartupTrace: Record<string, number>;
+  iterations: RestartIteration[];
+  maxRssMb: number | null;
+  outputTail: string;
+  resourceSlope: ResourceSlope;
+};
+
+type CaseResult = {
+  id: string;
+  name: string;
+  samples: GatewayRestartSample[];
+  summary: {
+    downtimeMs: SummaryStats | null;
+    failureRate: number;
+    firstFailureCode: GatewayRestartFailureCode | null;
+    healthzRecoveryMs: SummaryStats | null;
+    readyzRecoveryMs: SummaryStats | null;
+    resourceSlope: Record<keyof ResourceSlope, SummaryStats | null>;
+    restartReadyMs: SummaryStats | null;
+    restartReadyTotalMs: SummaryStats | null;
+    restartTrace: Record<string, SummaryStats>;
+  };
+};
+
+type BenchmarkEvidenceFailure = {
+  id: string;
+  reason: string;
+  sampleIndex: number | null;
+};
+
+type CliOptions = {
+  allowFailures: boolean;
+  cases: GatewayBenchCase[];
+  entry: string;
+  json: boolean;
+  output?: string;
+  postReadyDelayMs: number;
+  restarts: number;
+  runs: number;
+  timeoutMs: number;
+  warmup: number;
+};
+
+const DEFAULT_RUNS = 1;
+const DEFAULT_WARMUP = 0;
+const DEFAULT_RESTARTS = 5;
+const DEFAULT_TIMEOUT_MS = 30_000;
+const DEFAULT_POST_READY_DELAY_MS = 250;
+const DEFAULT_ENTRY = "dist/entry.js";
+const BOOLEAN_FLAGS = new Set(["--allow-failures", "--help", "-h", "--json"]);
+const VALUE_FLAGS = new Set([
+  "--case",
+  "--entry",
+  "--output",
+  "--post-ready-delay-ms",
+  "--restarts",
+  "--runs",
+  "--timeout-ms",
+  "--warmup",
+]);
+
+const BASE_CONFIG = BASE_GATEWAY_BENCH_CONFIG;
+
+const GATEWAY_CASES: readonly GatewayBenchCase[] = [
+  {
+    id: "skipChannels",
+    name: "gateway restart, skip channels",
+    env: { OPENCLAW_SKIP_CHANNELS: "1" },
+    config: BASE_CONFIG,
+  },
+  {
+    id: "skipChannelsAcpxProbe",
+    name: "gateway restart, skip channels, ACPX startup probe on",
+    env: { OPENCLAW_ACPX_RUNTIME_STARTUP_PROBE: "1", OPENCLAW_SKIP_CHANNELS: "1" },
+    config: BASE_CONFIG,
+  },
+  {
+    id: "skipChannelsNoAcpxProbe",
+    name: "gateway restart, skip channels, ACPX startup probe off",
+    env: { OPENCLAW_ACPX_RUNTIME_STARTUP_PROBE: "0", OPENCLAW_SKIP_CHANNELS: "1" },
+    config: BASE_CONFIG,
+  },
+  {
+    id: "default",
+    name: "gateway restart, default",
+    config: BASE_CONFIG,
+  },
+  {
+    id: "fiftyPlugins",
+    name: "gateway restart, 50 manifest plugins",
+    env: { OPENCLAW_SKIP_CHANNELS: "1" },
+    pluginActivationOnStartup: true,
+    pluginCount: 50,
+    config: BASE_CONFIG,
+  },
+] as const;
+
+function validateCliArgs(argv: string[]): void {
+  validateGatewayBenchCliArgs(argv, {
+    booleanFlags: BOOLEAN_FLAGS,
+    repeatableValueFlags: new Set(["--case"]),
+    valueFlags: VALUE_FLAGS,
+  });
+}
+
+function ensureSupportedRestartPlatform(platform: NodeJS.Platform = process.platform): void {
+  if (platform === "win32") {
+    throw new Error(
+      "Gateway restart benchmark is not supported on Windows because it requires SIGUSR1 in-process restarts; run it on macOS or Linux.",
+    );
+  }
+}
+
+function resolveEntry(raw: string | undefined): string {
+  return resolveGatewayBenchEntry(raw, DEFAULT_ENTRY);
+}
+
+function resolveCases(caseIds: string[]): GatewayBenchCase[] {
+  return resolveGatewayBenchCases(caseIds, GATEWAY_CASES, { allByDefault: false });
+}
+
+function parseOptions(argv: string[] = process.argv.slice(2)): CliOptions {
+  validateCliArgs(argv);
+  return {
+    allowFailures: hasFlag(argv, "--allow-failures"),
+    cases: resolveCases(parseRepeatableFlag(argv, "--case")),
+    entry: resolveEntry(parseFlagValue(argv, "--entry")),
+    json: hasFlag(argv, "--json"),
+    output: resolveOutputPath(parseFlagValue(argv, "--output")),
+    postReadyDelayMs: parseNonNegativeInt(
+      parseFlagValue(argv, "--post-ready-delay-ms"),
+      DEFAULT_POST_READY_DELAY_MS,
+      "--post-ready-delay-ms",
+    ),
+    restarts: parsePositiveInt(parseFlagValue(argv, "--restarts"), DEFAULT_RESTARTS, "--restarts"),
+    runs: parsePositiveInt(parseFlagValue(argv, "--runs"), DEFAULT_RUNS, "--runs"),
+    timeoutMs: parsePositiveInt(
+      parseFlagValue(argv, "--timeout-ms"),
+      DEFAULT_TIMEOUT_MS,
+      "--timeout-ms",
+    ),
+    warmup: parseNonNegativeInt(parseFlagValue(argv, "--warmup"), DEFAULT_WARMUP, "--warmup"),
+  };
+}
+
+function printUsage(): void {
+  console.log(`OpenClaw Gateway restart benchmark
+
+Usage:
+  pnpm test:restart:gateway -- [options]
+  node --import tsx scripts/bench-gateway-restart.ts [options]
+
+Options:
+  --case <id>              Specific case id to run; repeatable (default: skipChannels)
+  --entry <path>           Gateway CLI entry file (default: ${DEFAULT_ENTRY})
+  --runs <n>               Measured process samples per case (default: ${DEFAULT_RUNS})
+  --warmup <n>             Warmup process samples per case (default: ${DEFAULT_WARMUP})
+  --restarts <n>           In-process restarts per process sample (default: ${DEFAULT_RESTARTS})
+  --timeout-ms <ms>        Timeout for initial startup and each restart (default: ${DEFAULT_TIMEOUT_MS})
+  --post-ready-delay-ms <ms> Resource snapshot delay after next ready (default: ${DEFAULT_POST_READY_DELAY_MS})
+  --output <path>          Write machine-readable JSON to a file
+  --json                   Emit machine-readable JSON
+  --allow-failures         Exit 0 even when restart failures are measured
+  --help, -h               Show this text
+
+Case ids:
+  ${GATEWAY_CASES.map((benchCase) => `${benchCase.id} (${benchCase.name})`).join("\n  ")}
+`);
+}
+
+function formatRate(rate: number): string {
+  return `${(rate * 100).toFixed(1)}%`;
+}
+
+function isTraceMetricSummaryKey(name: string): boolean {
+  if (name.endsWith(".total")) {
+    return true;
+  }
+  const lastSegment = name.split(".").at(-1);
+  return (
+    lastSegment === "eventLoopMax" ||
+    lastSegment === "rssMb" ||
+    lastSegment === "heapTotalMb" ||
+    lastSegment === "heapUsedMb" ||
+    lastSegment === "externalMb" ||
+    lastSegment === "arrayBuffersMb" ||
+    lastSegment === "activeHandlesCount" ||
+    lastSegment === "activeRequestsCount" ||
+    lastSegment === "activeTimersCount" ||
+    lastSegment === "processSigintListenersCount" ||
+    lastSegment === "processSigtermListenersCount" ||
+    lastSegment === "processSigusr1ListenersCount" ||
+    lastSegment === "restartExpectedMs" ||
+    lastSegment?.endsWith("Count") === true ||
+    lastSegment?.endsWith("Ms") === true
+  );
+}
+
+function traceValue(iteration: RestartIteration, ...keys: string[]): number | null {
+  for (const key of keys) {
+    const value = iteration.restartTrace[key];
+    if (typeof value === "number") {
+      return value;
+    }
+  }
+  return null;
+}
+
+function lastSnapshotValue(
+  iteration: RestartIteration,
+  key: keyof Omit<ResourceSnapshot, "ms" | "phase">,
+): number | null {
+  for (let index = iteration.resourceSnapshots.length - 1; index >= 0; index -= 1) {
+    const value = iteration.resourceSnapshots[index]?.[key];
+    if (typeof value === "number") {
+      return value;
+    }
+  }
+  return null;
+}
+
+function slope(values: Array<number | null>): number | null {
+  const points = values
+    .map((value, index) => ({ index, value }))
+    .filter((point): point is { index: number; value: number } => typeof point.value === "number");
+  if (points.length < 2) {
+    return null;
+  }
+  const first = expectDefined(points[0], "first gateway restart slope point");
+  const last = expectDefined(points[points.length - 1], "last gateway restart slope point");
+  const denominator = Math.max(1, last.index - first.index);
+  return (last.value - first.value) / denominator;
+}
+
+function summarizeResourceSlope(
+  samples: GatewayRestartSample[],
+): Record<keyof ResourceSlope, SummaryStats | null> {
+  const keys: Array<keyof ResourceSlope> = [
+    "rssMbPerRestart",
+    "heapUsedMbPerRestart",
+    "fdCountPerRestart",
+    "activeHandlesCountPerRestart",
+    "activeRequestsCountPerRestart",
+    "activeTimersCountPerRestart",
+  ];
+  return Object.fromEntries(
+    keys.map((key) => [
+      key,
+      summarizeNumbers(
+        samples
+          .map((sample) => sample.resourceSlope[key])
+          .filter((value): value is number => typeof value === "number"),
+      ),
+    ]),
+  ) as Record<keyof ResourceSlope, SummaryStats | null>;
+}
+
+function summarizeCase(benchCase: GatewayBenchCase, samples: GatewayRestartSample[]): CaseResult {
+  const iterations = samples.flatMap((sample) => sample.iterations);
+  const restartTrace = summarizeTraceStats(iterations, (iteration) => iteration.restartTrace);
+  const failedIterations = iterations.filter((iteration) => iteration.failureCode !== null);
+  const sampleOnlyFailures = samples.filter(
+    (sample) =>
+      sample.failureCode !== null &&
+      !sample.iterations.some((iteration) => iteration.failureCode !== null),
+  );
+  const failureUnits = iterations.length + sampleOnlyFailures.length;
+  const firstFailureCode =
+    samples.find((sample) => sample.failureCode)?.failureCode ??
+    failedIterations[0]?.failureCode ??
+    null;
+  return {
+    id: benchCase.id,
+    name: benchCase.name,
+    samples,
+    summary: {
+      downtimeMs: summarizeNumbers(
+        iterations
+          .map((iteration) => iteration.readyz.downtimeMs ?? iteration.healthz.downtimeMs)
+          .filter((value): value is number => typeof value === "number"),
+      ),
+      failureRate:
+        failureUnits === 0
+          ? 0
+          : (failedIterations.length + sampleOnlyFailures.length) / failureUnits,
+      firstFailureCode,
+      healthzRecoveryMs: summarizeNumbers(
+        iterations
+          .map((iteration) => iteration.healthz.ms)
+          .filter((value): value is number => typeof value === "number"),
+      ),
+      readyzRecoveryMs: summarizeNumbers(
+        iterations
+          .map((iteration) => iteration.readyz.ms)
+          .filter((value): value is number => typeof value === "number"),
+      ),
+      resourceSlope: summarizeResourceSlope(samples),
+      restartReadyMs: summarizeNumbers(
+        iterations
+          .map((iteration) => traceValue(iteration, "restart.ready"))
+          .filter((value): value is number => typeof value === "number"),
+      ),
+      restartReadyTotalMs: summarizeNumbers(
+        iterations
+          .map((iteration) => traceValue(iteration, "restart.ready.total"))
+          .filter((value): value is number => typeof value === "number"),
+      ),
+      restartTrace,
+    },
+  };
+}
+
+async function waitForProbeReady(params: {
+  deadlineAt: number;
+  isDone?: () => boolean;
+  path: string;
+  port: number;
+  sampleStartAt: number;
+}): Promise<ProbeResult> {
+  const result = await waitForInitialProbe({
+    deadlineAt: params.deadlineAt,
+    isDone: params.isDone,
+    path: params.path,
+    port: params.port,
+    startAt: params.sampleStartAt,
+  });
+  return {
+    downtimeMs: null,
+    ...result,
+    unavailableMs: null,
+  };
+}
+
+async function waitForRestartProbe(params: {
+  deadlineAt: number;
+  events: BenchmarkEvent[];
+  isDone?: () => boolean;
+  isProcessDone?: () => boolean;
+  iteration: number;
+  path: string;
+  port: number;
+  sampleStartAt: number;
+  signalSentAt: number;
+}): Promise<ProbeResult> {
+  let firstErrorKind: string | null = null;
+  let firstRecoveryMs: number | null = null;
+  let lastStatus: number | null = null;
+  let lastStateKey: string | null = null;
+  let lastSuccessMs: number | null = null;
+  let unavailableMs: number | null = null;
+  const transitions: ProbeTransition[] = [];
+  while (performance.now() < params.deadlineAt) {
+    if (params.isProcessDone?.()) {
+      break;
+    }
+    if (params.isDone?.() && unavailableMs == null && lastSuccessMs != null) {
+      return {
+        downtimeMs: null,
+        firstErrorKind,
+        firstRecoveryMs,
+        ms: lastSuccessMs,
+        status: 200,
+        transitions,
+        unavailableMs: null,
+      };
+    }
+    const attempt = await requestProbeStatus(params.port, params.path);
+    const now = performance.now();
+    const elapsedMs = now - params.signalSentAt;
+    lastStatus = attempt.status;
+    const stateKey = `${attempt.status ?? "none"}:${attempt.errorKind ?? "ok"}`;
+    if (stateKey !== lastStateKey) {
+      transitions.push({
+        ms: elapsedMs,
+        status: attempt.status,
+        ...(attempt.errorKind ? { errorKind: attempt.errorKind } : {}),
+      });
+      params.events.push({
+        iteration: params.iteration,
+        ms: now - params.sampleStartAt,
+        status: attempt.status,
+        type: `${params.path}:transition`,
+        ...(attempt.errorKind ? { errorKind: attempt.errorKind } : {}),
+      });
+      lastStateKey = stateKey;
+    }
+    if (attempt.errorKind && firstErrorKind == null) {
+      firstErrorKind = attempt.errorKind;
+    }
+    if (attempt.status !== 200 && unavailableMs == null) {
+      unavailableMs = elapsedMs;
+    }
+    if (attempt.status === 200) {
+      lastSuccessMs = elapsedMs;
+    }
+    if (attempt.status === 200 && unavailableMs != null) {
+      firstRecoveryMs = elapsedMs;
+      return {
+        downtimeMs: elapsedMs - unavailableMs,
+        firstErrorKind,
+        firstRecoveryMs,
+        ms: elapsedMs,
+        status: attempt.status,
+        transitions,
+        unavailableMs,
+      };
+    }
+    await delay(25);
+  }
+  return {
+    downtimeMs: null,
+    firstErrorKind,
+    firstRecoveryMs,
+    ms: unavailableMs == null ? lastSuccessMs : null,
+    status: lastStatus,
+    transitions,
+    unavailableMs,
+  };
+}
+
+function writeConfig(root: string, benchCase: GatewayBenchCase): string {
+  const pluginFixtures = benchCase.pluginCount
+    ? writePluginFixtures(root, {
+        activationOnStartup: benchCase.pluginActivationOnStartup,
+        count: benchCase.pluginCount,
+      })
+    : null;
+  return writeGatewayBenchConfig(root, benchCase.config, { pluginFixtures });
+}
+
+function sanitizedEnv(
+  root: string,
+  configPath: string,
+  benchCase: GatewayBenchCase,
+): NodeJS.ProcessEnv {
+  return createGatewayBenchEnv(root, configPath, {
+    caseEnv: benchCase.env,
+    restartTrace: true,
+  });
+}
+
+function writeRestartIntent(env: NodeJS.ProcessEnv, targetPid: number, reason: string): boolean {
+  return writeGatewayRestartIntentSync({ env, reason, targetPid });
+}
+
+function readProcessFdCount(pid: number | undefined): number | null {
+  if (!pid || process.platform === "win32") {
+    return null;
+  }
+  const procFd = `/proc/${pid}/fd`;
+  try {
+    return fs.readdirSync(procFd).length;
+  } catch {
+    // macOS does not expose /proc; use lsof when available.
+  }
+  const result = spawnSync("lsof", ["-p", String(pid)], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: 1000,
+  });
+  if (result.status !== 0) {
+    return null;
+  }
+  return countLsofFileDescriptors(result.stdout);
+}
+
+function countLsofFileDescriptors(raw: string): number | null {
+  const lines = raw.trim().split(/\r?\n/u).filter(Boolean);
+  if (lines.length <= 1) {
+    return null;
+  }
+  let count = 0;
+  for (const line of lines.slice(1)) {
+    const columns = line.trim().split(/\s+/u);
+    if (/^\d+/u.test(columns[3] ?? "")) {
+      count += 1;
+    }
+  }
+  return count;
+}
+
+function snapshotResources(
+  child: ChildProcessWithoutNullStreams,
+  sampleStartAt: number,
+  phase: string,
+): ResourceSnapshot {
+  return {
+    activeHandlesCount: null,
+    activeRequestsCount: null,
+    activeTimersCount: null,
+    fdCount: readProcessFdCount(child.pid),
+    ms: performance.now() - sampleStartAt,
+    phase,
+    rssMb: readProcessRssMb(child.pid),
+  };
+}
+
+function createEmptyProbeResult(): ProbeResult {
+  return {
+    downtimeMs: null,
+    firstErrorKind: null,
+    firstRecoveryMs: null,
+    ms: null,
+    status: null,
+    transitions: [],
+    unavailableMs: null,
+  };
+}
+
+function createRestartIteration(index: number): RestartIteration {
+  return {
+    cpuCoreRatio: null,
+    cpuMs: null,
+    failureCode: null,
+    gatewayReadyLogLine: null,
+    gatewayReadyLogMs: null,
+    healthz: createEmptyProbeResult(),
+    httpListenLogLine: null,
+    httpListenLogMs: null,
+    index,
+    readyz: createEmptyProbeResult(),
+    resourceSnapshots: [],
+    restartTrace: {},
+    signalSentMs: null,
+    startupTrace: {},
+  };
+}
+
+function resolveIterationFailure(iteration: RestartIteration): GatewayRestartFailureCode | null {
+  if (iteration.healthz.ms === null) {
+    return "next_healthz_timeout";
+  }
+  if (iteration.readyz.ms === null) {
+    return "next_readyz_timeout";
+  }
+  if (iteration.gatewayReadyLogMs === null) {
+    return "ready_log_timeout";
+  }
+  if (typeof iteration.restartTrace["restart.ready.total"] !== "number") {
+    return "trace_missing";
+  }
+  return null;
+}
+
+function finalizeRestartIteration(
+  iteration: RestartIteration,
+  childExited: boolean,
+  flushOutputBuffers: () => void,
+): GatewayRestartFailureCode | null {
+  flushOutputBuffers();
+  return childExited ? "restart_child_exited" : resolveIterationFailure(iteration);
+}
+
+function hasRestartReadySignal(iteration: RestartIteration): boolean {
+  return (
+    typeof iteration.restartTrace["restart.ready.total"] === "number" &&
+    iteration.gatewayReadyLogMs !== null
+  );
+}
+
+function hasInitialReadyLogs(params: {
+  initialGatewayReadyLogMs: number | null;
+  initialHttpListenLogMs: number | null;
+}): boolean {
+  return params.initialGatewayReadyLogMs !== null && params.initialHttpListenLogMs !== null;
+}
+
+function resolveRestartDeadlineFailure(childExited: boolean): GatewayRestartFailureCode {
+  return childExited ? "restart_child_exited" : "restart_deadline_timeout";
+}
+
+function resolveSampleExitFailure(exit: StopChildResult): GatewayRestartFailureCode | null {
+  if (!exit.exitedBeforeTeardown) {
+    return null;
+  }
+  return exit.exitCode !== null && exit.exitCode !== 0
+    ? "child_nonzero_exit"
+    : "restart_child_exited";
+}
+
+function computeResourceSlope(iterations: RestartIteration[]): ResourceSlope {
+  return {
+    activeHandlesCountPerRestart: slope(
+      iterations.map((iteration) =>
+        traceValue(
+          iteration,
+          "restart.ready.activeHandlesCount",
+          "restart.ready.memory.ready.activeHandlesCount",
+        ),
+      ),
+    ),
+    activeRequestsCountPerRestart: slope(
+      iterations.map((iteration) =>
+        traceValue(
+          iteration,
+          "restart.ready.activeRequestsCount",
+          "restart.ready.memory.ready.activeRequestsCount",
+        ),
+      ),
+    ),
+    activeTimersCountPerRestart: slope(
+      iterations.map((iteration) =>
+        traceValue(
+          iteration,
+          "restart.ready.activeTimersCount",
+          "restart.ready.memory.ready.activeTimersCount",
+        ),
+      ),
+    ),
+    fdCountPerRestart: slope(
+      iterations.map((iteration) => lastSnapshotValue(iteration, "fdCount")),
+    ),
+    heapUsedMbPerRestart: slope(
+      iterations.map((iteration) =>
+        traceValue(iteration, "restart.ready.heapUsedMb", "restart.ready.memory.ready.heapUsedMb"),
+      ),
+    ),
+    rssMbPerRestart: slope(
+      iterations.map(
+        (iteration) =>
+          traceValue(iteration, "restart.ready.rssMb", "restart.ready.memory.ready.rssMb") ??
+          lastSnapshotValue(iteration, "rssMb"),
+      ),
+    ),
+  };
+}
+
+async function waitForIterationCondition(
+  predicate: () => boolean,
+  deadlineAt: number,
+): Promise<boolean> {
+  while (performance.now() < deadlineAt) {
+    if (predicate()) {
+      return true;
+    }
+    await delay(25);
+  }
+  return predicate();
+}
+
+function resolvePhaseDeadlineAt(startedAt: number, timeoutMs: number): number {
+  return startedAt + timeoutMs;
+}
+
+async function runGatewaySample(options: {
+  benchCase: GatewayBenchCase;
+  entry: string;
+  restarts: number;
+  postReadyDelayMs: number;
+  timeoutMs: number;
+}): Promise<GatewayRestartSample> {
+  ensureSupportedRestartPlatform();
+  const root = mkdtempSync(path.join(tmpdir(), "openclaw-gateway-restart-bench-"));
+  const port = await getFreePort();
+  const configPath = writeConfig(root, options.benchCase);
+  const env = sanitizedEnv(root, configPath, options.benchCase);
+  const sampleStartAt = performance.now();
+  const initialDeadlineAt = resolvePhaseDeadlineAt(sampleStartAt, options.timeoutMs);
+  const initialStartupTrace: Record<string, number> = {};
+  const events: BenchmarkEvent[] = [{ ms: 0, type: "process.spawn.start" }];
+  const output: string[] = [];
+  const outputBuffers: Record<"stderr" | "stdout", string> = { stderr: "", stdout: "" };
+  let currentIteration: RestartIteration | null = null;
+  let firstOutputMs: number | null = null;
+  let initialGatewayReadyLogLine: string | null = null;
+  let initialGatewayReadyLogMs: number | null = null;
+  let initialHttpListenLogLine: string | null = null;
+  let initialHttpListenLogMs: number | null = null;
+  let maxRssMb: number | null = null;
+  let childExited = false;
+
+  const child = spawn(process.execPath, buildGatewayBenchChildArgs(options.entry, port), {
+    cwd: process.cwd(),
+    detached: process.platform !== "win32",
+    env,
+  });
+  events.push({ ms: performance.now() - sampleStartAt, type: "process.spawned" });
+  const sampleRss = () => {
+    const rssMb = readProcessRssMb(child.pid);
+    if (rssMb != null) {
+      maxRssMb = maxRssMb == null ? rssMb : Math.max(maxRssMb, rssMb);
+    }
+  };
+  sampleRss();
+  const rssTimer = setInterval(sampleRss, 100);
+  rssTimer.unref?.();
+  const childExitPromise = new Promise<{ exitCode: number | null; signal: string | null }>(
+    (resolve) => {
+      child.once("exit", (exitCode, signal) => {
+        childExited = true;
+        events.push({ ms: performance.now() - sampleStartAt, type: "process.exit" });
+        resolve({ exitCode, signal });
+      });
+    },
+  );
+
+  const onLine = (line: string, nowMs: number) => {
+    if (!line) {
+      return;
+    }
+    const readyLogKind = classifyGatewayReadyLog(line);
+    if (readyLogKind === "http-listen") {
+      if (currentIteration) {
+        currentIteration.httpListenLogMs ??= nowMs - (currentIteration.signalSentMs ?? nowMs);
+        currentIteration.httpListenLogLine ??= line;
+      } else if (initialHttpListenLogMs == null) {
+        initialHttpListenLogMs = nowMs;
+        initialHttpListenLogLine = line;
+      }
+    }
+    if (readyLogKind === "gateway-ready") {
+      if (currentIteration) {
+        currentIteration.gatewayReadyLogMs ??= nowMs - (currentIteration.signalSentMs ?? nowMs);
+        currentIteration.gatewayReadyLogLine ??= line;
+      } else if (initialGatewayReadyLogMs == null) {
+        initialGatewayReadyLogMs = nowMs;
+        initialGatewayReadyLogLine = line;
+      }
+    }
+    const traceTarget = currentIteration?.startupTrace ?? initialStartupTrace;
+    if (collectTraceLine(line, "startup trace", traceTarget)) {
+      events.push({
+        iteration: currentIteration?.index,
+        line,
+        ms: nowMs,
+        type: "startup-trace",
+      });
+    }
+    if (
+      currentIteration &&
+      collectTraceLine(line, "restart trace", currentIteration.restartTrace)
+    ) {
+      events.push({ iteration: currentIteration.index, line, ms: nowMs, type: "restart-trace" });
+    }
+  };
+
+  const onChunk = (stream: "stderr" | "stdout", chunk: Buffer) => {
+    const nowMs = performance.now() - sampleStartAt;
+    if (firstOutputMs == null) {
+      firstOutputMs = nowMs;
+      events.push({ ms: nowMs, type: "process.first-output" });
+    }
+    const text = chunk.toString("utf8");
+    output.push(text);
+    if (output.length > 30) {
+      output.splice(0, output.length - 30);
+    }
+    const parsed = collectOutputLines(outputBuffers[stream], text);
+    outputBuffers[stream] = parsed.carry;
+    for (const line of parsed.lines) {
+      onLine(line, nowMs);
+    }
+  };
+  child.stdout.on("data", (chunk: Buffer) => onChunk("stdout", chunk));
+  child.stderr.on("data", (chunk: Buffer) => onChunk("stderr", chunk));
+
+  let failureCode: GatewayRestartFailureCode | null = null;
+  const initialHealthz = await waitForProbeReady({
+    deadlineAt: initialDeadlineAt,
+    isDone: () => childExited,
+    path: "/healthz",
+    port,
+    sampleStartAt,
+  });
+  if (initialHealthz.ms === null) {
+    failureCode = "initial_healthz_timeout";
+  }
+  const initialReadyz =
+    failureCode === null
+      ? await waitForProbeReady({
+          deadlineAt: initialDeadlineAt,
+          isDone: () => childExited,
+          path: "/readyz",
+          port,
+          sampleStartAt,
+        })
+      : createEmptyProbeResult();
+  if (failureCode === null && initialReadyz.ms === null) {
+    failureCode = "initial_readyz_timeout";
+  }
+
+  if (failureCode === null) {
+    flushOutputLineBuffers(outputBuffers, onLine, performance.now() - sampleStartAt);
+    await waitForIterationCondition(
+      () => hasInitialReadyLogs({ initialGatewayReadyLogMs, initialHttpListenLogMs }),
+      initialDeadlineAt,
+    );
+    flushOutputLineBuffers(outputBuffers, onLine, performance.now() - sampleStartAt);
+    if (!hasInitialReadyLogs({ initialGatewayReadyLogMs, initialHttpListenLogMs })) {
+      failureCode = "initial_ready_log_timeout";
+    }
+  }
+
+  const iterations: RestartIteration[] = [];
+  if (failureCode === null) {
+    for (let index = 1; index <= options.restarts; index += 1) {
+      if (childExited) {
+        failureCode = resolveRestartDeadlineFailure(childExited);
+        break;
+      }
+      const iteration = createRestartIteration(index);
+      currentIteration = iteration;
+      const cpuStartMs = readProcessTreeCpuMs(child.pid);
+      iteration.resourceSnapshots.push(snapshotResources(child, sampleStartAt, "before-signal"));
+      const targetPid = child.pid;
+      if (!targetPid || !writeRestartIntent(env, targetPid, "gateway-restart-bench")) {
+        iteration.failureCode = "restart_signal_failed";
+        failureCode = iteration.failureCode;
+        iterations.push(iteration);
+        break;
+      }
+      events.push({
+        iteration: index,
+        ms: performance.now() - sampleStartAt,
+        type: "restart-intent-written",
+      });
+      try {
+        process.kill(targetPid, "SIGUSR1");
+      } catch {
+        iteration.failureCode = "restart_signal_failed";
+        failureCode = iteration.failureCode;
+        iterations.push(iteration);
+        break;
+      }
+      const signalSentAt = performance.now();
+      iteration.signalSentMs = signalSentAt - sampleStartAt;
+      const iterationDeadlineAt = resolvePhaseDeadlineAt(signalSentAt, options.timeoutMs);
+      events.push({ iteration: index, ms: iteration.signalSentMs, type: "restart-signal-sent" });
+
+      const healthzPromise = waitForRestartProbe({
+        deadlineAt: iterationDeadlineAt,
+        events,
+        isDone: () => hasRestartReadySignal(iteration),
+        isProcessDone: () => childExited,
+        iteration: index,
+        path: "/healthz",
+        port,
+        sampleStartAt,
+        signalSentAt,
+      });
+      const readyzPromise = waitForRestartProbe({
+        deadlineAt: iterationDeadlineAt,
+        events,
+        isDone: () => hasRestartReadySignal(iteration),
+        isProcessDone: () => childExited,
+        iteration: index,
+        path: "/readyz",
+        port,
+        sampleStartAt,
+        signalSentAt,
+      });
+      const [healthz, readyz] = await Promise.all([healthzPromise, readyzPromise]);
+      iteration.healthz = healthz;
+      iteration.readyz = readyz;
+      iteration.resourceSnapshots.push(snapshotResources(child, sampleStartAt, "after-next-ready"));
+      await waitForIterationCondition(() => hasRestartReadySignal(iteration), iterationDeadlineAt);
+      if (options.postReadyDelayMs > 0 && performance.now() < iterationDeadlineAt) {
+        await delay(
+          Math.min(options.postReadyDelayMs, Math.max(0, iterationDeadlineAt - performance.now())),
+        );
+      }
+      iteration.resourceSnapshots.push(
+        snapshotResources(child, sampleStartAt, "after-post-ready-delay"),
+      );
+      const cpuEndMs = readProcessTreeCpuMs(child.pid);
+      iteration.cpuMs =
+        cpuStartMs == null || cpuEndMs == null ? null : Math.max(0, cpuEndMs - cpuStartMs);
+      iteration.cpuCoreRatio =
+        iteration.cpuMs == null
+          ? null
+          : iteration.cpuMs / Math.max(1, performance.now() - signalSentAt);
+      iteration.failureCode = finalizeRestartIteration(iteration, childExited, () =>
+        flushOutputLineBuffers(outputBuffers, onLine, performance.now() - sampleStartAt),
+      );
+      iterations.push(iteration);
+      console.error(
+        `[gateway-restart-bench] ${options.benchCase.id} restart ${index}/${options.restarts}: readyz=${formatMs(iteration.readyz.ms)} downtime=${formatMs(iteration.readyz.downtimeMs ?? iteration.healthz.downtimeMs)} restartReady=${formatMs(traceValue(iteration, "restart.ready.total"))} cpu=${formatMs(iteration.cpuMs)} rss=${formatMb(traceValue(iteration, "restart.ready.rssMb", "restart.ready.memory.ready.rssMb") ?? lastSnapshotValue(iteration, "rssMb"))} failure=${iteration.failureCode ?? "none"}`,
+      );
+      if (iteration.failureCode) {
+        failureCode = iteration.failureCode;
+        break;
+      }
+    }
+  }
+
+  currentIteration = null;
+  flushOutputLineBuffers(outputBuffers, onLine, performance.now() - sampleStartAt);
+  const exit = await stopChild(child);
+  clearInterval(rssTimer);
+  sampleRss();
+  // stopChild is the bounded teardown wait; the raw exit promise may never settle.
+  void childExitPromise.catch(() => null);
+  flushOutputLineBuffers(outputBuffers, onLine, performance.now() - sampleStartAt, {
+    flushPartial: true,
+  });
+  failureCode ??= resolveSampleExitFailure(exit);
+  try {
+    rmSync(root, { force: true, maxRetries: 3, recursive: true, retryDelay: 100 });
+  } catch {
+    failureCode ??= "cleanup_failed";
+  }
+
+  return {
+    childExitCode: exit.exitCode,
+    childSignal: exit.signal,
+    events,
+    exitedBeforeTeardown: exit.exitedBeforeTeardown,
+    failureCode,
+    firstOutputMs,
+    initialGatewayReadyLogLine,
+    initialGatewayReadyLogMs,
+    initialHealthz,
+    initialHttpListenLogLine,
+    initialHttpListenLogMs,
+    initialReadyz,
+    initialStartupTrace,
+    iterations,
+    maxRssMb,
+    outputTail: output.join("").split(/\r?\n/u).slice(-30).join("\n"),
+    resourceSlope: computeResourceSlope(iterations),
+  };
+}
+
+async function runCase(options: {
+  benchCase: GatewayBenchCase;
+  entry: string;
+  postReadyDelayMs: number;
+  restarts: number;
+  runs: number;
+  timeoutMs: number;
+  warmup: number;
+}): Promise<CaseResult> {
+  const samples: GatewayRestartSample[] = [];
+  const total = options.runs + options.warmup;
+  for (let index = 0; index < total; index += 1) {
+    const sample = await runGatewaySample({
+      benchCase: options.benchCase,
+      entry: options.entry,
+      postReadyDelayMs: options.postReadyDelayMs,
+      restarts: options.restarts,
+      timeoutMs: options.timeoutMs,
+    });
+    if (index >= options.warmup) {
+      samples.push(sample);
+      console.error(
+        `[gateway-restart-bench] ${options.benchCase.id} sample ${samples.length}/${options.runs}: iterations=${sample.iterations.length} failure=${sample.failureCode ?? "none"} rssSlope=${formatMb(sample.resourceSlope.rssMbPerRestart)} heapSlope=${formatMb(sample.resourceSlope.heapUsedMbPerRestart)} fdSlope=${sample.resourceSlope.fdCountPerRestart ?? "n/a"}`,
+      );
+    } else {
+      console.error(
+        `[gateway-restart-bench] ${options.benchCase.id} warmup ${index + 1}/${options.warmup}: failure=${sample.failureCode ?? "none"}`,
+      );
+    }
+  }
+  return summarizeCase(options.benchCase, samples);
+}
+
+function printResult(result: CaseResult): void {
+  console.log(`\n${result.name} (${result.id})`);
+  console.log(`  failure rate: ${formatRate(result.summary.failureRate)}`);
+  console.log(`  first failure: ${result.summary.firstFailureCode ?? "none"}`);
+  console.log(`  downtime:      ${formatStats(result.summary.downtimeMs)}`);
+  console.log(`  /healthz next: ${formatStats(result.summary.healthzRecoveryMs)}`);
+  console.log(`  /readyz next:  ${formatStats(result.summary.readyzRecoveryMs)}`);
+  console.log(`  restart.ready: ${formatStats(result.summary.restartReadyTotalMs)}`);
+  console.log(
+    `  resource slope: rss=${formatMb(result.summary.resourceSlope.rssMbPerRestart?.avg ?? null)}/restart heap=${formatMb(result.summary.resourceSlope.heapUsedMbPerRestart?.avg ?? null)}/restart fd=${result.summary.resourceSlope.fdCountPerRestart?.avg?.toFixed(2) ?? "n/a"}/restart`,
+  );
+  const trace = Object.entries(result.summary.restartTrace)
+    .filter(([name]) => !isTraceMetricSummaryKey(name))
+    .toSorted((a, b) => (b[1].avg ?? 0) - (a[1].avg ?? 0))
+    .slice(0, 10);
+  if (trace.length > 0) {
+    console.log("  trace top:");
+    for (const [name, stats] of trace) {
+      console.log(`    ${name}: ${formatStats(stats)}`);
+    }
+  }
+}
+
+function hasBenchmarkFailures(results: CaseResult[]): boolean {
+  return results.some(
+    (result) => result.summary.failureRate > 0 || result.summary.firstFailureCode !== null,
+  );
+}
+
+function hasPositiveNumber(value: number | null): boolean {
+  return typeof value === "number" && Number.isFinite(value) && value > 0;
+}
+
+function hasFiniteNumber(value: number | null): boolean {
+  return typeof value === "number" && Number.isFinite(value);
+}
+
+function hasIterationRssEvidence(iteration: RestartIteration): boolean {
+  return hasPositiveNumber(
+    traceValue(iteration, "restart.ready.rssMb", "restart.ready.memory.ready.rssMb") ??
+      lastSnapshotValue(iteration, "rssMb"),
+  );
+}
+
+function isFailureFreeSample(sample: GatewayRestartSample): boolean {
+  return (
+    sample.failureCode === null &&
+    sample.iterations.every((iteration) => iteration.failureCode === null)
+  );
+}
+
+function collectBenchmarkEvidenceFailures(results: CaseResult[]): BenchmarkEvidenceFailure[] {
+  const failures: BenchmarkEvidenceFailure[] = [];
+  for (const result of results) {
+    if (result.samples.length === 0) {
+      failures.push({
+        id: result.id,
+        reason: "missing measured samples",
+        sampleIndex: null,
+      });
+      continue;
+    }
+
+    for (const [index, sample] of result.samples.entries()) {
+      if (!isFailureFreeSample(sample)) {
+        continue;
+      }
+      const sampleIndex = index + 1;
+      if (sample.iterations.length === 0) {
+        failures.push({
+          id: result.id,
+          reason: "missing restart iterations",
+          sampleIndex,
+        });
+        continue;
+      }
+      if (!hasPositiveNumber(sample.maxRssMb)) {
+        failures.push({
+          id: result.id,
+          reason: "missing positive RSS sample",
+          sampleIndex,
+        });
+      }
+      if (sample.iterations.some((iteration) => !hasIterationRssEvidence(iteration))) {
+        failures.push({
+          id: result.id,
+          reason: "missing per-restart RSS evidence",
+          sampleIndex,
+        });
+      }
+      if (sample.iterations.length >= 2 && !hasFiniteNumber(sample.resourceSlope.rssMbPerRestart)) {
+        failures.push({
+          id: result.id,
+          reason: "missing RSS slope",
+          sampleIndex,
+        });
+      }
+    }
+  }
+  return failures;
+}
+
+function hasInvalidBenchmarkEvidence(results: CaseResult[]): boolean {
+  return collectBenchmarkEvidenceFailures(results).length > 0;
+}
+
+function shouldFailBenchmark(results: CaseResult[], options: { allowFailures: boolean }): boolean {
+  return (
+    hasInvalidBenchmarkEvidence(results) ||
+    (!options.allowFailures && hasBenchmarkFailures(results))
+  );
+}
+
+function printBenchmarkEvidenceFailures(failures: BenchmarkEvidenceFailure[]): void {
+  for (const failure of failures) {
+    const sample = failure.sampleIndex === null ? "" : ` sample ${failure.sampleIndex}`;
+    console.error(
+      `[gateway-restart-bench] ${failure.id}${sample}: ${failure.reason}; benchmark evidence is incomplete`,
+    );
+  }
+}
+
+async function main() {
+  const argv = process.argv.slice(2);
+  if (hasHelpFlag(argv)) {
+    printUsage();
+    return;
+  }
+
+  const options = parseOptions(argv);
+  ensureSupportedRestartPlatform();
+  const results: CaseResult[] = [];
+  for (const benchCase of options.cases) {
+    results.push(
+      await runCase({
+        benchCase,
+        entry: options.entry,
+        postReadyDelayMs: options.postReadyDelayMs,
+        restarts: options.restarts,
+        runs: options.runs,
+        timeoutMs: options.timeoutMs,
+        warmup: options.warmup,
+      }),
+    );
+  }
+
+  const payload = {
+    entry: options.entry,
+    generatedAt: new Date().toISOString(),
+    node: process.version,
+    platform: {
+      arch: process.arch,
+      platform: process.platform,
+    },
+    results,
+  };
+  if (options.output) {
+    mkdirSync(path.dirname(options.output), { recursive: true });
+    writeFileSync(options.output, `${JSON.stringify(payload, null, 2)}\n`);
+  }
+  const evidenceFailures = collectBenchmarkEvidenceFailures(results);
+  if (evidenceFailures.length > 0) {
+    printBenchmarkEvidenceFailures(evidenceFailures);
+  }
+  if (options.json) {
+    console.log(JSON.stringify(payload, null, 2));
+    if (shouldFailBenchmark(results, options)) {
+      process.exitCode = 1;
+    }
+    return;
+  }
+  for (const result of results) {
+    printResult(result);
+  }
+  if (shouldFailBenchmark(results, options)) {
+    process.exitCode = 1;
+  }
+}
+
+export const testing = {
+  countLsofFileDescriptors,
+  createRestartIteration,
+  ensureSupportedRestartPlatform,
+  finalizeRestartIteration,
+  collectBenchmarkEvidenceFailures,
+  hasInitialReadyLogs,
+  hasBenchmarkFailures,
+  hasInvalidBenchmarkEvidence,
+  parseOptions,
+  resolveRestartDeadlineFailure,
+  resolveEntry,
+  resolvePhaseDeadlineAt,
+  resolveSampleExitFailure,
+  sanitizedEnv,
+  shouldFailBenchmark,
+  summarizeCase,
+  waitForRestartProbe,
+  writeConfig,
+  writeRestartIntent,
+};
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+  main().catch((err: unknown) => {
+    if (err instanceof CliArgumentError) {
+      console.error(err.message);
+      process.exitCode = 1;
+      return;
+    }
+    console.error(err instanceof Error ? err.stack : String(err));
+    process.exitCode = 1;
+  });
+}
diff --git a/scripts/bench-model.ts b/scripts/bench-model.ts
new file mode 100644
index 0000000000000000000000000000000000000000..c6a1d043e2813b124898be56ed9a0a4b5336b723
--- /dev/null
+++ b/scripts/bench-model.ts
@@ -0,0 +1,249 @@
+// Bench Model script supports OpenClaw repository automation.
+import { pathToFileURL } from "node:url";
+import type { Model } from "openclaw/plugin-sdk/llm";
+import { expectDefined } from "../packages/normalization-core/src/expect.js";
+import { parseStrictIntegerOption } from "./lib/strict-integer-option.ts";
+
+type Usage = {
+  input?: number;
+  output?: number;
+  cacheRead?: number;
+  cacheWrite?: number;
+  totalTokens?: number;
+};
+
+type RunResult = {
+  durationMs: number;
+  usage?: Usage;
+};
+
+type CliOptions = {
+  help: boolean;
+  prompt: string;
+  runs: number;
+};
+
+const DEFAULT_PROMPT = "Reply with a single word: ok. No punctuation or extra text.";
+const DEFAULT_RUNS = 10;
+const BOOLEAN_FLAGS = new Set(["--help", "-h"]);
+const VALUE_FLAGS = new Set(["--prompt", "--runs"]);
+
+class CliArgumentError extends Error {
+  override name = "CliArgumentError";
+}
+
+function readValue(argv: string[], index: number, flag: string): string {
+  const value = argv[index + 1]?.trim() ?? "";
+  if (!value || value.startsWith("-")) {
+    throw new CliArgumentError(`${flag} requires a value`);
+  }
+  return value;
+}
+
+function validateCliArgs(argv: string[]): void {
+  const seenValueFlags = new Set<string>();
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index] ?? "";
+    if (BOOLEAN_FLAGS.has(arg)) {
+      continue;
+    }
+    if (VALUE_FLAGS.has(arg)) {
+      if (seenValueFlags.has(arg)) {
+        throw new CliArgumentError(`${arg} was provided more than once`);
+      }
+      seenValueFlags.add(arg);
+      readValue(argv, index, arg);
+      index += 1;
+      continue;
+    }
+    throw new CliArgumentError(`Unknown argument: ${arg}`);
+  }
+}
+
+function parseArg(argv: string[], flag: string): string | undefined {
+  const index = argv.indexOf(flag);
+  if (index === -1) {
+    return undefined;
+  }
+  return readValue(argv, index, flag);
+}
+
+function parseRuns(raw: string | undefined): number {
+  return parseStrictIntegerOption({
+    fallback: DEFAULT_RUNS,
+    label: "--runs",
+    min: 1,
+    raw,
+  });
+}
+
+function parseArgs(argv = process.argv.slice(2)): CliOptions {
+  validateCliArgs(argv);
+  return {
+    help: argv.includes("--help") || argv.includes("-h"),
+    prompt: parseArg(argv, "--prompt") ?? DEFAULT_PROMPT,
+    runs: parseRuns(parseArg(argv, "--runs")),
+  };
+}
+
+function printUsage(): void {
+  console.log(`OpenClaw model latency benchmark
+
+Usage:
+  node --import tsx scripts/bench-model.ts [options]
+
+Options:
+  --runs <n>      Runs per model (default: ${DEFAULT_RUNS})
+  --prompt <text> Prompt to send to each model
+  --help, -h      Show this text
+
+Environment:
+  ANTHROPIC_API_KEY
+  MINIMAX_API_KEY
+  MINIMAX_BASE_URL
+  MINIMAX_MODEL
+`);
+}
+
+function median(values: number[]): number {
+  if (values.length === 0) {
+    return 0;
+  }
+  const sorted = [...values].toSorted((a, b) => a - b);
+  const mid = Math.floor(sorted.length / 2);
+  if (sorted.length % 2 === 0) {
+    return Math.round(
+      (expectDefined(sorted[mid - 1], "lower middle model benchmark sample") +
+        expectDefined(sorted[mid], "upper middle model benchmark sample")) /
+        2,
+    );
+  }
+  return expectDefined(sorted[mid], "middle model benchmark sample");
+}
+
+async function runModel(opts: {
+  label: string;
+  model: Model;
+  apiKey: string;
+  runs: number;
+  prompt: string;
+}): Promise<RunResult[]> {
+  // Keep SDK initialization outside the measured model-call samples.
+  const { completeSimple } = await import("openclaw/plugin-sdk/llm");
+  const results: RunResult[] = [];
+  for (let i = 0; i < opts.runs; i += 1) {
+    const started = Date.now();
+    const res = await completeSimple(
+      opts.model,
+      {
+        messages: [
+          {
+            role: "user",
+            content: opts.prompt,
+            timestamp: Date.now(),
+          },
+        ],
+      },
+      { apiKey: opts.apiKey, maxTokens: 64 },
+    );
+    const durationMs = Date.now() - started;
+    results.push({ durationMs, usage: res.usage });
+    console.log(`${opts.label} run ${i + 1}/${opts.runs}: ${durationMs}ms`);
+  }
+  return results;
+}
+
+async function main(argv = process.argv.slice(2)): Promise<void> {
+  const options = parseArgs(argv);
+  if (options.help) {
+    printUsage();
+    return;
+  }
+
+  const anthropicKey = process.env.ANTHROPIC_API_KEY?.trim();
+  const minimaxKey = process.env.MINIMAX_API_KEY?.trim();
+  if (!anthropicKey) {
+    throw new Error("Missing ANTHROPIC_API_KEY in environment.");
+  }
+  if (!minimaxKey) {
+    throw new Error("Missing MINIMAX_API_KEY in environment.");
+  }
+
+  const minimaxBaseUrl = process.env.MINIMAX_BASE_URL?.trim() || "https://api.minimax.io/v1";
+  const minimaxModelId = process.env.MINIMAX_MODEL?.trim() || "MiniMax-M2.1";
+
+  const minimaxModel: Model<"openai-completions"> = {
+    id: minimaxModelId,
+    name: `MiniMax ${minimaxModelId}`,
+    api: "openai-completions",
+    provider: "minimax",
+    baseUrl: minimaxBaseUrl,
+    reasoning: false,
+    input: ["text"],
+    cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+    contextWindow: 200000,
+    maxTokens: 8192,
+  };
+  const opusModel: Model<"anthropic-messages"> = {
+    id: "claude-opus-4-6",
+    name: "Claude Opus 4.6",
+    api: "anthropic-messages",
+    provider: "anthropic",
+    baseUrl: "https://api.anthropic.com",
+    reasoning: true,
+    input: ["text", "image"],
+    cost: { input: 15, output: 75, cacheRead: 1.5, cacheWrite: 18.75 },
+    contextWindow: 200000,
+    maxTokens: 32000,
+  };
+
+  console.log(`Prompt: ${options.prompt}`);
+  console.log(`Runs: ${options.runs}`);
+  console.log("");
+
+  const minimaxResults = await runModel({
+    label: "minimax",
+    model: minimaxModel,
+    apiKey: minimaxKey,
+    runs: options.runs,
+    prompt: options.prompt,
+  });
+  const opusResults = await runModel({
+    label: "opus",
+    model: opusModel,
+    apiKey: anthropicKey,
+    runs: options.runs,
+    prompt: options.prompt,
+  });
+
+  const summarize = (label: string, results: RunResult[]) => {
+    const durations = results.map((r) => r.durationMs);
+    const med = median(durations);
+    const min = Math.min(...durations);
+    const max = Math.max(...durations);
+    return { label, med, min, max };
+  };
+
+  const summary = [summarize("minimax", minimaxResults), summarize("opus", opusResults)];
+  console.log("");
+  console.log("Summary (ms):");
+  for (const row of summary) {
+    console.log(`${row.label.padEnd(7)} median=${row.med} min=${row.min} max=${row.max}`);
+  }
+}
+
+export const testing = {
+  parseArgs,
+};
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+  main().catch((err: unknown) => {
+    if (err instanceof CliArgumentError) {
+      console.error(err.message);
+      process.exitCode = 1;
+      return;
+    }
+    console.error(err instanceof Error ? err.stack : String(err));
+    process.exitCode = 1;
+  });
+}
diff --git a/scripts/bench-sqlite-reliability.ts b/scripts/bench-sqlite-reliability.ts
new file mode 100644
index 0000000000000000000000000000000000000000..06e9953de9165a7528630e8d2cb0146b12ff6345
--- /dev/null
+++ b/scripts/bench-sqlite-reliability.ts
@@ -0,0 +1,105 @@
+// SQLite reliability stress proof exercises snapshots during concurrent writes.
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { CliUsageError, parseSqliteReliabilityCli } from "./lib/sqlite-reliability-cli.js";
+import type { ReliabilityReport } from "./lib/sqlite-reliability-contract.js";
+
+function printUsage(): void {
+  console.log(`OpenClaw SQLite reliability stress proof
+
+Usage:
+  node --import tsx scripts/bench-sqlite-reliability.ts [options]
+
+Options:
+  --profile <smoke|default|large>  Stress profile (default: default)
+  --agent <id>                     Stress one per-agent database (default: global)
+  --state-dir <path>               Reuse a state directory and retain proof artifacts
+  --repository <path>              Snapshot repository path
+  --output <path>                  Write machine-readable JSON report
+  --help                           Show this text
+`);
+}
+
+function printProofLines(report: ReliabilityReport): void {
+  console.log(`SQLITE_RELIABILITY_PROFILE=${report.profile}`);
+  console.log(`SQLITE_RELIABILITY_TARGET=${report.target}`);
+  console.log(`SQLITE_RELIABILITY_PLATFORM=${report.platform}`);
+  console.log(`SQLITE_RELIABILITY_ARCH=${report.arch}`);
+  console.log(`SQLITE_RELIABILITY_ITERATIONS=${report.iterations}`);
+  console.log(`SQLITE_RELIABILITY_RETAINED_BATCHES=${report.retainedBatches}`);
+  console.log(
+    `SQLITE_RELIABILITY_CONCURRENT_RESTORES_VERIFIED=${report.concurrentRestoresVerified}`,
+  );
+  console.log(`SQLITE_RELIABILITY_RESTORES_VERIFIED=${report.restoresVerified}`);
+  console.log(`SQLITE_RELIABILITY_WRITER_ROWS=${report.writer.rowsCommitted}`);
+  console.log(
+    `SQLITE_RELIABILITY_CRASH_RECOVERY=${report.crashRecoveryProof.sourceRecovered && report.crashRecoveryProof.committedStatePreserved && report.crashRecoveryProof.writerRestarted ? "verified" : "missing"}`,
+  );
+  console.log(
+    `SQLITE_RELIABILITY_CRASH_EXIT_SIGNAL=${report.crashRecoveryProof.exit.signal ?? "none"}`,
+  );
+  console.log(
+    `SQLITE_RELIABILITY_PUBLICATION_INTERRUPTION=${report.publicationInterruptionProof.beforePublish.recoveryVerified && report.publicationInterruptionProof.afterPublish.targetVerifiedAfterCrash && report.publicationInterruptionProof.afterPublish.recoveryVerified ? "verified" : "missing"}`,
+  );
+  console.log(
+    `SQLITE_RELIABILITY_RESTORE_INTERRUPTION=${report.maintenanceProof.restoreInterruption.beforePublish.recoveryVerified && report.maintenanceProof.restoreInterruption.beforePublish.retryRestored && report.maintenanceProof.restoreInterruption.afterPublish.targetVerifiedAfterCrash && report.maintenanceProof.restoreInterruption.afterPublish.existingTargetPreserved ? "verified" : "missing"}`,
+  );
+  console.log(
+    `SQLITE_RELIABILITY_REPOSITORY_INTERRUPTION=${report.maintenanceProof.repositoryInterruption.beforePending.repositoryVerified && report.maintenanceProof.repositoryInterruption.beforePending.retryCreated && report.maintenanceProof.repositoryInterruption.pending.crashSnapshotVerifiedAfterCrash && report.maintenanceProof.repositoryInterruption.pending.crashSnapshotVisibleAfterCrash && report.maintenanceProof.repositoryInterruption.pending.incompleteEntries === 0 && report.maintenanceProof.repositoryInterruption.pending.retryCreated && report.maintenanceProof.repositoryInterruption.afterCommit.crashSnapshotVerifiedAfterCrash && report.maintenanceProof.repositoryInterruption.afterCommit.retryCreated ? "verified" : "missing"}`,
+  );
+  console.log(
+    `SQLITE_RELIABILITY_INDEX_REPAIR_INTERRUPTION=${report.indexRepairInterruptionProof.rollbackJournal.recoveryVerified && report.indexRepairInterruptionProof.wal.recoveryVerified ? "verified" : "missing"}`,
+  );
+  console.log(
+    `SQLITE_RELIABILITY_WAL_SENTINEL=${report.transactionProof.committedWalSentinel ? "verified" : "missing"}`,
+  );
+  console.log(`SQLITE_RELIABILITY_HELD_BATCH=${report.transactionProof.heldBatch}`);
+  console.log(`SQLITE_RELIABILITY_SNAPSHOT_P95_MS=${report.timingsMs.snapshotP95.toFixed(3)}`);
+  console.log(`SQLITE_RELIABILITY_RESTORE_P95_MS=${report.timingsMs.restoreP95.toFixed(3)}`);
+  console.log(`SQLITE_RELIABILITY_SNAPSHOT_BYTES_MAX=${report.snapshotBytes.max}`);
+  console.log(
+    `SQLITE_RELIABILITY_COMPACT_RECLAIMED_BYTES=${report.maintenanceProof.compaction.reclaimedBytes}`,
+  );
+  console.log(
+    `SQLITE_RELIABILITY_VACUUM_INTERRUPTION=${report.maintenanceProof.vacuumInterruption.recoveryVerified ? "verified" : "missing"}`,
+  );
+  console.log(
+    `SQLITE_RELIABILITY_POST_COMPACT_RESTORE=${report.maintenanceProof.postCompact.restoreVerified ? "verified" : "missing"}`,
+  );
+  console.log(`SQLITE_RELIABILITY_FINAL_ROWS=${report.maintenanceProof.postCompact.state.rows}`);
+  console.log(
+    `SQLITE_RELIABILITY_FINAL_STATE_SHA256=${report.maintenanceProof.postCompact.state.sha256}`,
+  );
+  console.log(`SQLITE_RELIABILITY_WAL_PEAK_BYTES=${report.walBytes.peak}`);
+  console.log(`SQLITE_RELIABILITY_WAL_LIMIT_BYTES=${report.walBytes.limit}`);
+}
+
+async function main(argv: string[]): Promise<void> {
+  try {
+    const cli = parseSqliteReliabilityCli(argv);
+    if (cli.help) {
+      printUsage();
+      return;
+    }
+    const { options } = cli;
+    const { runReliabilityStress } = await import("./lib/sqlite-reliability-runner.js");
+    const report = await runReliabilityStress(options);
+    if (options.output) {
+      fs.mkdirSync(path.dirname(options.output), { recursive: true });
+      fs.writeFileSync(options.output, `${JSON.stringify(report, null, 2)}\n`, "utf8");
+    }
+    printProofLines(report);
+  } catch (error) {
+    if (error instanceof CliUsageError) {
+      console.error(`error: ${error.message}`);
+      process.exitCode = 2;
+      return;
+    }
+    throw error;
+  }
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+  await main(process.argv.slice(2));
+}
diff --git a/scripts/build-all.mts b/scripts/build-all.mts
new file mode 100644
index 0000000000000000000000000000000000000000..f786fd457b91607a056de7845ff984ea0825a135
--- /dev/null
+++ b/scripts/build-all.mts
@@ -0,0 +1,641 @@
+#!/usr/bin/env node
+// Builds OpenClaw packages and plugin SDK artifacts with cache-aware orchestration.
+
+import type { SpawnSyncOptions } from "node:child_process";
+import { performance } from "node:perf_hooks";
+import prettyMilliseconds from "pretty-ms";
+import { resolveNodeRuntimeExecutable } from "../src/infra/node-runtime-executable.ts";
+import {
+  finalizeBuildStepCache,
+  resolveBuildStepCacheState,
+  restoreBuildStepCacheOutputs,
+  type BuildCacheStep,
+} from "./lib/build-artifact-cache.mts";
+import { readCurrentGitCommit, resolveBuildIdentityEnvironment } from "./lib/build-identity.mts";
+import { isDirectRunUrl } from "./lib/direct-run.mjs";
+import {
+  distArtifactEntryArgs,
+  withDistArtifactOwnership,
+} from "./lib/dist-artifact-ownership.mts";
+import { runManagedCommand } from "./lib/managed-child-process.mts";
+import {
+  TSDOWN_PACKAGE_CONFIG_GROUP,
+  TSDOWN_UNIFIED_CONFIG_GROUP,
+} from "./lib/tsdown-config-groups.mts";
+import {
+  TSDOWN_PACKAGE_OUTPUT_ROOTS,
+  tsdownPackageOutputRoot,
+} from "./lib/tsdown-output-roots.mts";
+import { resolvePnpmRunner } from "./pnpm-runner.mts";
+import {
+  TSDOWN_MAX_OLD_SPACE_MB_ENV,
+  TSDOWN_DECLARATION_EXTENSIONS,
+  TSDOWN_DECLARATION_TOOL_INPUTS,
+  TSDOWN_PACKAGES_CACHE_INPUT,
+  resolveTsdownBuildPlan,
+  type MemoryLimitParams,
+} from "./tsdown-build.mts";
+
+const nodeBin = resolveNodeRuntimeExecutable() ?? process.execPath;
+
+export type BuildAllStep = BuildCacheStep &
+  (
+    | { kind: "pnpm"; args?: never; pnpmArgs: string[]; windowsNodeOptions?: string }
+    | { kind?: "node"; args: string[]; pnpmArgs?: never; windowsNodeOptions?: string }
+  );
+
+type BuildAllTiming = { label: string; durationMs: number; status: string };
+type BuildAllStepParams = {
+  platform?: NodeJS.Platform;
+  env?: NodeJS.ProcessEnv;
+  nodeExecPath?: string;
+  npmExecPath?: string;
+  comSpec?: string;
+};
+const RUN_NODE_SKIP_DTS_BUILD_ENV = "OPENCLAW_RUN_NODE_SKIP_DTS_BUILD";
+const TSDOWN_AI_OUTPUT_ROOT = tsdownPackageOutputRoot("ai");
+const TSDOWN_MAIN_PACKAGE_OUTPUT_ROOTS = TSDOWN_PACKAGE_OUTPUT_ROOTS.filter(
+  (root) => root !== TSDOWN_AI_OUTPUT_ROOT,
+);
+const declarationCacheOutputs = (roots: string[]) =>
+  roots.map((root) => ({ path: root, extensions: TSDOWN_DECLARATION_EXTENSIONS }));
+const tsxScript = (script: string, ...args: string[]) => ["--import", "tsx", script, ...args];
+const nodeStep = (label: string, args: string[]): Extract<BuildAllStep, { kind?: "node" }> => ({
+  label,
+  kind: "node",
+  args,
+});
+const tsxStep = (label: string, script: string, ...args: string[]) =>
+  nodeStep(label, tsxScript(script, ...args));
+const PNPM_STEP_NODE_FALLBACKS = new Map([
+  ["plugins:assets:build", tsxScript("scripts/bundled-plugin-assets.mts", "--phase", "build")],
+  ["plugins:assets:copy", tsxScript("scripts/bundled-plugin-assets.mts", "--phase", "copy")],
+  ["ui:build", ["scripts/ui.js", "build"]],
+]);
+export const BUILD_ALL_STEPS: BuildAllStep[] = [
+  nodeStep("clean:dist", [
+    "-e",
+    'require("node:fs").rmSync("dist", { recursive: true, force: true })',
+  ]),
+  { label: "plugins:assets:build", kind: "pnpm", pnpmArgs: ["plugins:assets:build"] },
+  tsxStep("tsdown", "scripts/tsdown-build.mts"),
+  {
+    ...tsxStep("tsdown-ai", "scripts/tsdown-build.mts", "--config", "tsdown.ai.config.ts"),
+    cache: {
+      inputs: [
+        ...TSDOWN_DECLARATION_TOOL_INPUTS,
+        "tsdown.ai.config.ts",
+        TSDOWN_PACKAGES_CACHE_INPUT,
+      ],
+      outputs: declarationCacheOutputs([TSDOWN_AI_OUTPUT_ROOT]),
+      restore: "always",
+      runOnHit: {
+        env: { OPENCLAW_RUN_NODE_SKIP_DTS_BUILD: "1" },
+      },
+    },
+  },
+  {
+    ...tsxStep(
+      "tsdown-packages",
+      "scripts/tsdown-build.mts",
+      "--config",
+      "tsdown.config.ts",
+      "--filter",
+      TSDOWN_PACKAGE_CONFIG_GROUP,
+    ),
+    cache: {
+      inputs: [...TSDOWN_DECLARATION_TOOL_INPUTS, "tsdown.config.ts", TSDOWN_PACKAGES_CACHE_INPUT],
+      outputs: declarationCacheOutputs(TSDOWN_MAIN_PACKAGE_OUTPUT_ROOTS),
+      restore: "always",
+      runOnHit: {
+        env: { OPENCLAW_RUN_NODE_SKIP_DTS_BUILD: "1" },
+      },
+    },
+  },
+  {
+    ...tsxStep(
+      "tsdown-unified",
+      "scripts/tsdown-build.mts",
+      "--config",
+      "tsdown.config.ts",
+      "--filter",
+      TSDOWN_UNIFIED_CONFIG_GROUP,
+    ),
+    env: { OPENCLAW_RUN_NODE_SKIP_DTS_BUILD: "1" },
+  },
+  {
+    ...tsxStep("write-unified-entry-dts", "scripts/write-unified-entry-dts.ts"),
+    env: { OPENCLAW_RUN_NODE_SKIP_DTS_BUILD: "0" },
+  },
+  tsxStep("external-plugins:local-dist", "scripts/build-external-plugin-local-dist.mts"),
+  tsxStep("check-cli-bootstrap-imports", "scripts/check-cli-bootstrap-imports.mts"),
+  {
+    label: "plugins:assets:copy",
+    kind: "pnpm",
+    pnpmArgs: ["plugins:assets:copy"],
+  },
+  tsxStep("runtime-postbuild", "scripts/runtime-postbuild.mts"),
+  tsxStep("build-stamp", "scripts/build-stamp.mts"),
+  tsxStep("runtime-postbuild-stamp", "scripts/runtime-postbuild-stamp.mts"),
+  {
+    ...tsxStep("write-plugin-sdk-entry-dts", "scripts/write-plugin-sdk-entry-dts.ts"),
+    env: { OPENCLAW_RUN_NODE_SKIP_DTS_BUILD: "0" },
+  },
+  tsxStep("check-plugin-sdk-exports", "scripts/check-plugin-sdk-exports.mts"),
+  {
+    label: "ui:build",
+    kind: "pnpm",
+    pnpmArgs: ["ui:build"],
+    // No build-all cache: ui/vite.config.ts derives the Control UI build ID
+    // from package.json, git HEAD, and OPENCLAW_CONTROL_UI_BUILD_ID env, so a
+    // file-input signature cannot exactly invalidate generated assets and a
+    // warm hit could restore stale service-worker/app cache metadata.
+    cache: undefined,
+  },
+  tsxStep("write-build-info", "scripts/write-build-info.ts"),
+  {
+    ...tsxStep("write-cli-startup-metadata", "scripts/write-cli-startup-metadata.ts"),
+    cache: {
+      inputs: [
+        "scripts/write-cli-startup-metadata.ts",
+        "scripts/lib/cli-startup-root-help-bundle.ts",
+      ],
+      outputs: ["dist/cli-startup-metadata.json"],
+      restore: "always",
+      runOnHit: { finalize: "refresh" },
+    },
+  },
+];
+
+const RUNTIME_SETUP_STEP_LABELS = [
+  "external-plugins:local-dist",
+  "check-cli-bootstrap-imports",
+] as const;
+const RUNTIME_FINALIZE_STEP_LABELS = [
+  "runtime-postbuild",
+  "build-stamp",
+  "runtime-postbuild-stamp",
+] as const;
+const RUNTIME_STEP_LABELS = [...RUNTIME_SETUP_STEP_LABELS, ...RUNTIME_FINALIZE_STEP_LABELS];
+const ASSET_RUNTIME_STEP_LABELS = [
+  "plugins:assets:build",
+  "tsdown",
+  ...RUNTIME_SETUP_STEP_LABELS,
+  // Copy after compiler cleanup, before postbuild records the generated asset inventory.
+  "plugins:assets:copy",
+  ...RUNTIME_FINALIZE_STEP_LABELS,
+];
+const BUILD_METADATA_STEP_LABELS = ["write-build-info", "write-cli-startup-metadata"] as const;
+const SDK_DECLARATION_STEP_LABELS = [
+  "write-plugin-sdk-entry-dts",
+  "check-plugin-sdk-exports",
+] as const;
+const FINAL_BUILD_ARTIFACTS_STEP_LABELS = [
+  ...SDK_DECLARATION_STEP_LABELS,
+  "ui:build",
+  ...BUILD_METADATA_STEP_LABELS,
+] as const;
+const CI_ARTIFACT_STEP_LABELS = [
+  ...ASSET_RUNTIME_STEP_LABELS,
+  ...FINAL_BUILD_ARTIFACTS_STEP_LABELS,
+];
+const FULL_COMPILER_STEP_LABELS = [
+  "tsdown-ai",
+  "tsdown-packages",
+  "tsdown-unified",
+  "write-unified-entry-dts",
+] as const;
+// Typed builds cache declaration groups separately from the runtime graph.
+const FULL_RUNTIME_STEP_LABELS = ASSET_RUNTIME_STEP_LABELS.flatMap((step) =>
+  step === "tsdown" ? FULL_COMPILER_STEP_LABELS : [step],
+);
+const FULL_BUILD_STEP_LABELS = [...FULL_RUNTIME_STEP_LABELS, ...FINAL_BUILD_ARTIFACTS_STEP_LABELS];
+
+export const BUILD_ALL_PROFILES: Record<string, string[]> = {
+  full: [...FULL_BUILD_STEP_LABELS],
+  package: ["clean:dist", ...FULL_BUILD_STEP_LABELS],
+  ciArtifacts: [...CI_ARTIFACT_STEP_LABELS],
+  // Smoke builds retain typed compilation and publication checks without the UI/metadata tail.
+  strictSmoke: [...FULL_RUNTIME_STEP_LABELS, ...SDK_DECLARATION_STEP_LABELS],
+  pluginSdkStrictSmoke: [
+    ...FULL_COMPILER_STEP_LABELS,
+    ...RUNTIME_STEP_LABELS,
+    ...SDK_DECLARATION_STEP_LABELS,
+  ],
+  gatewayWatch: ["tsdown", ...RUNTIME_STEP_LABELS],
+  qaRuntime: [...ASSET_RUNTIME_STEP_LABELS],
+  sourcePerformance: [...ASSET_RUNTIME_STEP_LABELS, "write-build-info"],
+  cliStartup: ["tsdown", ...RUNTIME_STEP_LABELS, "write-cli-startup-metadata"],
+};
+
+const FULL_RUNTIME_ONLY_STEPS = [
+  ...ASSET_RUNTIME_STEP_LABELS,
+  "ui:build",
+  ...BUILD_METADATA_STEP_LABELS,
+];
+
+export const BUILD_ALL_PROFILE_STEP_ENV: Record<string, Record<string, NodeJS.ProcessEnv>> = {
+  full: {
+    tsdown: {
+      OPENCLAW_PRESERVE_CLI_STARTUP_METADATA: "1",
+    },
+    "tsdown-unified": {
+      OPENCLAW_PRESERVE_CLI_STARTUP_METADATA: "1",
+    },
+  },
+  package: {
+    tsdown: {
+      OPENCLAW_PRESERVE_CLI_STARTUP_METADATA: "1",
+    },
+    "tsdown-unified": {
+      OPENCLAW_PRESERVE_CLI_STARTUP_METADATA: "1",
+    },
+  },
+  ciArtifacts: {
+    tsdown: {
+      // Global declaration emission is ~95% of the tsdown wall clock and PR
+      // CI's dist consumers are runtime JS only; the plugin-sdk gate below
+      // stages the two canonical SDK declaration groups instead. Release/package builds
+      // (full profile, docker packaging) keep canonical dts.
+      OPENCLAW_RUN_NODE_SKIP_DTS_BUILD: "1",
+      OPENCLAW_PRESERVE_CLI_STARTUP_METADATA: "1",
+    },
+  },
+  gatewayWatch: {
+    tsdown: {
+      OPENCLAW_RUN_NODE_SKIP_DTS_BUILD: "1",
+    },
+    "runtime-postbuild": {
+      OPENCLAW_RUNTIME_POSTBUILD_STATIC_ASSETS: "0",
+    },
+  },
+  qaRuntime: {
+    tsdown: {
+      OPENCLAW_RUN_NODE_SKIP_DTS_BUILD: "1",
+    },
+  },
+  sourcePerformance: {
+    tsdown: {
+      OPENCLAW_RUN_NODE_SKIP_DTS_BUILD: "1",
+    },
+  },
+  cliStartup: {
+    tsdown: {
+      OPENCLAW_RUN_NODE_SKIP_DTS_BUILD: "1",
+      OPENCLAW_PRESERVE_CLI_STARTUP_METADATA: "1",
+    },
+    "runtime-postbuild": {
+      OPENCLAW_RUNTIME_POSTBUILD_STATIC_ASSETS: "0",
+    },
+  },
+};
+
+function buildAllUsage() {
+  return [
+    "Usage: node --import tsx scripts/build-all.mts [profile]",
+    "",
+    "Builds OpenClaw artifacts for the selected profile.",
+    "",
+    "Profiles:",
+    ...Object.keys(BUILD_ALL_PROFILES).map((profile) => `  ${profile}`),
+    "",
+    "Options:",
+    "  -h, --help  Show this help.",
+  ].join("\n");
+}
+
+export function parseBuildAllArgs(argv: string[]) {
+  const args = {
+    help: false,
+    profile: "full",
+  };
+  let sawProfile = false;
+  for (const arg of argv) {
+    if (arg === "--help" || arg === "-h") {
+      args.help = true;
+    } else if (arg.startsWith("-")) {
+      throw new Error(`unknown argument: ${arg}\n\n${buildAllUsage()}`);
+    } else if (sawProfile) {
+      throw new Error(`unexpected argument: ${arg}\n\n${buildAllUsage()}`);
+    } else {
+      args.profile = arg;
+      sawProfile = true;
+    }
+  }
+  if (!args.help && !BUILD_ALL_PROFILES[args.profile]) {
+    throw new Error(`Unknown build profile: ${args.profile}\n\n${buildAllUsage()}`);
+  }
+  return args;
+}
+
+export function resolveBuildAllSteps(
+  profile = "full",
+  buildEnv: NodeJS.ProcessEnv = process.env,
+): BuildAllStep[] {
+  const profileLabels = BUILD_ALL_PROFILES[profile];
+  if (!profileLabels) {
+    throw new Error(`Unknown build profile: ${profile}`);
+  }
+  // A cold runtime-only build has no declarations for the canonical SDK gates.
+  // Its uncached graph cannot seed the declaration-only caches used by full builds.
+  const runtimeOnly = buildEnv[RUN_NODE_SKIP_DTS_BUILD_ENV] === "1";
+  const labels =
+    profile === "full" && runtimeOnly
+      ? FULL_RUNTIME_ONLY_STEPS
+      : profile === "package" && runtimeOnly
+        ? ["clean:dist", ...FULL_RUNTIME_ONLY_STEPS]
+        : profileLabels;
+  const selected = labels.map((label) => BUILD_ALL_STEPS.find((step) => step.label === label));
+  if (selected.some((step) => !step)) {
+    const missing = labels.filter((label) => !BUILD_ALL_STEPS.some((step) => step.label === label));
+    throw new Error(`Build profile ${profile} references unknown steps: ${missing.join(", ")}`);
+  }
+  const envOverrides = BUILD_ALL_PROFILE_STEP_ENV[profile] ?? {};
+  return selected
+    .filter((step): step is NonNullable<typeof step> => step !== undefined)
+    .map((step) => {
+      const env = envOverrides[step.label];
+      if (!env) {
+        return step;
+      }
+      const mergedEnv = Object.assign({}, "env" in step ? step.env : undefined, env);
+      // Source-run rebuilds share qaRuntime but retain the caller's explicit
+      // declaration choice. The other partial profiles remain runtime-only.
+      if (profile === "qaRuntime" && step.label === "tsdown") {
+        mergedEnv[RUN_NODE_SKIP_DTS_BUILD_ENV] =
+          buildEnv[RUN_NODE_SKIP_DTS_BUILD_ENV] ?? mergedEnv[RUN_NODE_SKIP_DTS_BUILD_ENV];
+      }
+      const merged: BuildAllStep = Object.assign({}, step, { env: mergedEnv });
+      return merged;
+    });
+}
+
+/** Pin one source identity for every child process that contributes to this build. */
+export function resolveBuildAllEnvironment(
+  env: NodeJS.ProcessEnv = process.env,
+  now: () => Date = () => new Date(),
+  readGitCommit: () => string | null = readCurrentGitCommit,
+) {
+  const buildEnv = resolveBuildIdentityEnvironment({
+    commitLabel: "build commit",
+    env,
+    now,
+    readGitCommit,
+  });
+  // Older installed updaters already send this marker to candidate builds.
+  // Updates need runtime artifacts; explicit declaration/package builds still win.
+  if (buildEnv.OPENCLAW_UPDATE_IN_PROGRESS === "1") {
+    buildEnv[RUN_NODE_SKIP_DTS_BUILD_ENV] ??= "1";
+    // Published updaters can still pass the serving checkout's source root.
+    // Rebind before plugin asset hooks resolve SDK aliases in this candidate.
+    buildEnv.OPENCLAW_DEV_SOURCE_ROOT = process.cwd();
+  }
+  return buildEnv;
+}
+
+export function resolveBuildAllTsdownPlan(
+  profile: string,
+  env: NodeJS.ProcessEnv,
+  params: Omit<MemoryLimitParams, "env"> = {},
+): {
+  env: NodeJS.ProcessEnv;
+  heapShortfall: ReturnType<typeof resolveTsdownBuildPlan>["heapShortfall"];
+} {
+  if (
+    !["full", "package", "ciArtifacts", "strictSmoke", "pluginSdkStrictSmoke"].includes(profile)
+  ) {
+    return { env, heapShortfall: null };
+  }
+  const plan = resolveTsdownBuildPlan({ ...params, env });
+  return {
+    // Direct Node steps need NODE_OPTIONS; tsdown descendants also need the frozen budget.
+    env: { ...plan.env, [TSDOWN_MAX_OLD_SPACE_MB_ENV]: String(plan.maxOldSpaceMb) },
+    heapShortfall: plan.heapShortfall,
+  };
+}
+
+function resolveStepEnv(step: BuildAllStep, env: NodeJS.ProcessEnv, platform: NodeJS.Platform) {
+  const stepEnv = step.env ? Object.assign({}, env, step.env) : env;
+  if (platform !== "win32" || !step.windowsNodeOptions) {
+    return stepEnv;
+  }
+  const currentNodeOptions = stepEnv.NODE_OPTIONS?.trim() ?? "";
+  if (currentNodeOptions.includes(step.windowsNodeOptions)) {
+    return stepEnv;
+  }
+  return {
+    ...stepEnv,
+    NODE_OPTIONS: currentNodeOptions
+      ? `${currentNodeOptions} ${step.windowsNodeOptions}`
+      : step.windowsNodeOptions,
+  };
+}
+
+export function resolveBuildAllStep(step: BuildAllStep, params: BuildAllStepParams = {}) {
+  const platform = params.platform ?? process.platform;
+  const env = resolveStepEnv(step, params.env ?? process.env, platform);
+  const nodeArgs =
+    step.kind !== "pnpm"
+      ? step.args
+      : env.OPENCLAW_BUILD_ALL_NO_PNPM === "1"
+        ? PNPM_STEP_NODE_FALLBACKS.get(step.label)
+        : undefined;
+  if (nodeArgs) {
+    return {
+      command: params.nodeExecPath ?? nodeBin,
+      args: nodeArgs,
+      options: {
+        stdio: "inherit",
+        env,
+        // Managed commands default to a Windows shell; Node needs literal argv,
+        // including percent-encoded file URLs passed to --import.
+        shell: false,
+      } satisfies SpawnSyncOptions,
+    };
+  }
+  const runner = resolvePnpmRunner({
+    env,
+    pnpmArgs: step.pnpmArgs,
+    nodeExecPath: params.nodeExecPath ?? nodeBin,
+    npmExecPath: params.npmExecPath ?? env.npm_execpath,
+    comSpec: params.comSpec,
+    platform,
+  });
+  return {
+    command: runner.command,
+    args: runner.args,
+    options: {
+      stdio: "inherit",
+      env,
+      shell: runner.shell,
+      windowsVerbatimArguments: runner.windowsVerbatimArguments,
+    } satisfies SpawnSyncOptions,
+  };
+}
+
+export function resolveBuildAllStepOnCacheHit(step: BuildAllStep) {
+  if (!step.cache?.runOnHit) {
+    return null;
+  }
+  return {
+    ...step,
+    env: Object.assign({}, step.env, step.cache.runOnHit.env),
+  };
+}
+
+export function formatBuildAllDuration(durationMs: number) {
+  const clampedMs = Math.max(0, durationMs);
+  const roundedMs =
+    clampedMs < 1000
+      ? Math.round(clampedMs)
+      : clampedMs < 10_000
+        ? Math.round(clampedMs / 10) * 10
+        : Math.round(clampedMs / 100) * 100;
+  return prettyMilliseconds(roundedMs, {
+    secondsDecimalDigits: clampedMs < 10_000 ? 2 : 1,
+  });
+}
+
+export function formatBuildAllTimingSummary(timings: BuildAllTiming[]) {
+  if (timings.length === 0) {
+    return "[build-all] phase timings: no phases ran";
+  }
+  const totalMs = timings.reduce((sum, timing) => sum + timing.durationMs, 0);
+  const phases = timings
+    .toSorted((left, right) => right.durationMs - left.durationMs)
+    .map((timing) => {
+      const status = timing.status === "ran" ? "" : ` (${timing.status})`;
+      return `${timing.label}${status} ${formatBuildAllDuration(timing.durationMs)}`;
+    })
+    .join("; ");
+  return `[build-all] phase timings: total ${formatBuildAllDuration(totalMs)}; slowest ${phases}`;
+}
+
+export async function runBuildAllSteps(
+  profile: string,
+  params: {
+    cacheEnabled?: boolean;
+    env?: NodeJS.ProcessEnv;
+    finalizeCache?: typeof finalizeBuildStepCache;
+    logger?: Pick<Console, "error" | "warn">;
+    memoryLimit?: Omit<MemoryLimitParams, "env">;
+    now?: () => number;
+    resolveCacheState?: typeof resolveBuildStepCacheState;
+    restoreCache?: typeof restoreBuildStepCacheOutputs;
+    runStep?: (
+      invocation: ReturnType<typeof resolveBuildAllStep>,
+    ) => { status: number | null } | Promise<{ status: number | null }>;
+    steps?: BuildAllStep[];
+  } = {},
+) {
+  const { env: buildEnv, heapShortfall } = resolveBuildAllTsdownPlan(
+    profile,
+    resolveBuildAllEnvironment(params.env),
+    params.memoryLimit,
+  );
+  const steps = params.steps ?? resolveBuildAllSteps(profile, buildEnv);
+  const cacheEnabled = params.cacheEnabled ?? buildEnv.OPENCLAW_BUILD_CACHE !== "0";
+  const logger = params.logger ?? console;
+  const now = params.now ?? performance.now.bind(performance);
+  const resolveCacheState = params.resolveCacheState ?? resolveBuildStepCacheState;
+  const restoreCache = params.restoreCache ?? restoreBuildStepCacheOutputs;
+  const finalizeCache = params.finalizeCache ?? finalizeBuildStepCache;
+  const runStep =
+    params.runStep ??
+    (async (invocation: ReturnType<typeof resolveBuildAllStep>) => {
+      const script = invocation.args[2];
+      return {
+        status: await runManagedCommand({
+          bin: invocation.command,
+          args:
+            script === "scripts/tsdown-build.mts" ||
+            script === "scripts/write-unified-entry-dts.ts" ||
+            script === "scripts/write-plugin-sdk-entry-dts.ts" ||
+            script === "scripts/runtime-postbuild.mts"
+              ? distArtifactEntryArgs(script, invocation.args.slice(3))
+              : invocation.args,
+          ...invocation.options,
+          requireProcessTreeExit: process.platform !== "win32",
+        }),
+      };
+    });
+  const timings: BuildAllTiming[] = [];
+  let exitCode = 0;
+  if (heapShortfall) {
+    if (heapShortfall.fatal) {
+      logger.error(heapShortfall.message);
+      return { exitCode: 1, timings };
+    }
+    logger.warn(heapShortfall.message);
+  }
+  for (const step of steps) {
+    const cacheStartedAt = now();
+    const cacheState = resolveCacheState(step, { env: buildEnv });
+    const cacheDurationMs = now() - cacheStartedAt;
+    const startedAt = now();
+    let stepToRun = step;
+    let reusedCache = false;
+    if (cacheEnabled && cacheState.fresh) {
+      if (cacheState.restorable && !restoreCache(cacheState)) {
+        throw new Error(`Build cache changed before restoration: ${step.label}; rerun the build`);
+      }
+      const cacheHitStep = resolveBuildAllStepOnCacheHit(step);
+      if (!cacheHitStep) {
+        const durationMs = cacheDurationMs + now() - startedAt;
+        timings.push({ label: step.label, status: "cached", durationMs });
+        logger.error(`[build-all] ${step.label} (cached) ${formatBuildAllDuration(durationMs)}`);
+        continue;
+      }
+      reusedCache = true;
+      stepToRun = cacheHitStep;
+    }
+    logger.error(`[build-all] ${step.label}${reusedCache ? " (cache restored)" : ""}`);
+    const invocation = resolveBuildAllStep(stepToRun, { env: buildEnv });
+    const result = await runStep(invocation);
+    const durationMs = cacheDurationMs + now() - startedAt;
+    if (typeof result.status === "number") {
+      if (result.status !== 0) {
+        timings.push({ label: step.label, status: "failed", durationMs });
+        logger.error(
+          `[build-all] ${step.label} failed after ${formatBuildAllDuration(durationMs)}`,
+        );
+        exitCode = result.status;
+        break;
+      }
+      // Runtime-only tsdown cleans its output roots. Cache hits restore
+      // declarations again after that pass so the full build stays complete.
+      if (!finalizeCache(step, cacheState, { env: buildEnv, reusedCache })) {
+        throw new Error(`Build cache changed during ${step.label}; rerun the build`);
+      }
+      timings.push({ label: step.label, status: reusedCache ? "reused" : "ran", durationMs });
+      logger.error(`[build-all] ${step.label} done in ${formatBuildAllDuration(durationMs)}`);
+      continue;
+    }
+    timings.push({ label: step.label, status: "failed", durationMs });
+    logger.error(`[build-all] ${step.label} failed after ${formatBuildAllDuration(durationMs)}`);
+    exitCode = 1;
+    break;
+  }
+  logger.error(formatBuildAllTimingSummary(timings));
+  return { exitCode, timings };
+}
+
+if (isDirectRunUrl(process.argv[1], import.meta.url)) {
+  let args;
+  try {
+    args = parseBuildAllArgs(process.argv.slice(2));
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(2);
+  }
+  if (args?.help) {
+    console.log(buildAllUsage());
+  } else {
+    const result = await withDistArtifactOwnership(process.cwd(), () =>
+      runBuildAllSteps(args.profile),
+    );
+    if (result.exitCode !== 0) {
+      process.exit(result.exitCode);
+    }
+  }
+}
diff --git a/scripts/build-discord-activity-sdk.mts b/scripts/build-discord-activity-sdk.mts
new file mode 100644
index 0000000000000000000000000000000000000000..00fee02e0da0d7ebe413d807b3a82c374f02da94
--- /dev/null
+++ b/scripts/build-discord-activity-sdk.mts
@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { build } from "esbuild";
+import { writeGeneratedTextAsset } from "./lib/generated-text-asset.mts";
+
+type DiscordActivitySdkBuildParams = {
+  build?: (
+    options: Parameters<typeof build>[0],
+  ) => Promise<{ outputFiles?: Array<{ text: string }> }>;
+  outputPath?: string;
+};
+
+const modulePath = fileURLToPath(import.meta.url);
+const repoRoot = path.resolve(path.dirname(modulePath), "..");
+const discordDir = path.join(repoRoot, "extensions/discord");
+const outputPath = path.join(repoRoot, "extensions/discord/assets/embedded-app-sdk.mjs");
+
+/** Builds the browser SDK bundle without rewriting an identical generated asset. */
+export async function buildDiscordActivitySdk(params: DiscordActivitySdkBuildParams = {}) {
+  const buildImpl = params.build ?? build;
+  const targetPath = params.outputPath ?? outputPath;
+  const result = await buildImpl({
+    entryPoints: ["@discord/embedded-app-sdk"],
+    absWorkingDir: discordDir,
+    bundle: true,
+    platform: "browser",
+    target: "es2020",
+    format: "esm",
+    minify: true,
+    legalComments: "none",
+    outfile: targetPath,
+    write: false,
+  });
+
+  const outputFile = result.outputFiles?.[0];
+  if (!outputFile) {
+    throw new Error("esbuild did not produce the Discord Embedded App SDK bundle");
+  }
+
+  return writeGeneratedTextAsset(targetPath, outputFile.text);
+}
+
+if (process.argv[1] === modulePath) {
+  await buildDiscordActivitySdk();
+}
diff --git a/scripts/capture-model-picker-proof.mts b/scripts/capture-model-picker-proof.mts
new file mode 100644
index 0000000000000000000000000000000000000000..6577033595f33f7787862fbec4f0dcd8c3d83dc4
--- /dev/null
+++ b/scripts/capture-model-picker-proof.mts
@@ -0,0 +1,146 @@
+#!/usr/bin/env node
+import path from "node:path";
+import { chromium } from "playwright";
+// Captures chat model-picker proof shots: the open picker inheriting the agent
+// default, the same picker with a session override, and the picker after a
+// failed catalog refresh. Also reports the x offset between the provider
+// heading label and the model row name (the row-alignment change).
+import { createControlUiE2eArtifactDir } from "../ui/src/test-helpers/control-ui-e2e-artifacts.ts";
+import {
+  canRunPlaywrightChromium,
+  installMockGateway,
+  resolvePlaywrightChromiumExecutablePath,
+  startControlUiE2eServer,
+} from "../ui/src/test-helpers/control-ui-e2e.ts";
+import { readControlUiProofOption } from "./lib/control-ui-proof-args.mts";
+
+const outputDir = createControlUiE2eArtifactDir(
+  "model-picker-proof",
+  readControlUiProofOption(process.argv, "output-dir") ??
+    ".artifacts/control-ui-e2e/model-picker-proof",
+);
+const label = readControlUiProofOption(process.argv, "label") ?? "after";
+const executablePath = resolvePlaywrightChromiumExecutablePath(chromium.executablePath());
+if (!canRunPlaywrightChromium(executablePath)) {
+  throw new Error(`Playwright Chromium is unavailable at ${executablePath}`);
+}
+
+const models = [
+  { id: "gpt-5.5", name: "GPT-5.5", provider: "openai", contextWindow: 400_000 },
+  { id: "gpt-5.6-luna", name: "GPT-5.6 Luna", provider: "openai", contextWindow: 1_000_000 },
+  { id: "gpt-5.6-sol", name: "GPT-5.6 Sol", provider: "openai", contextWindow: 1_000_000 },
+  { id: "gpt-5.6-terra", name: "GPT-5.6 Terra", provider: "openai", contextWindow: 1_000_000 },
+  {
+    id: "claude-sonnet-4-6",
+    name: "Claude Sonnet 4.6",
+    provider: "anthropic",
+    contextWindow: 200_000,
+  },
+  { id: "claude-opus-4-6", name: "Claude Opus 4.6", provider: "anthropic", contextWindow: 200_000 },
+];
+
+const server = await startControlUiE2eServer(undefined, { source: true });
+const browser = await chromium.launch({ executablePath });
+const context = await browser.newContext({
+  colorScheme: "dark",
+  viewport: { width: 1280, height: 900 },
+});
+const page = await context.newPage();
+page.setDefaultTimeout(30_000);
+
+try {
+  const gateway = await installMockGateway(page, { agentModel: "openai/gpt-5.5", models });
+  await page.goto(`${server.baseUrl}chat`);
+  await gateway.waitForRequest("chat.startup");
+
+  const composer = page.locator(".agent-chat__input");
+  await composer.waitFor({ state: "visible" });
+  const trigger = composer.locator('[data-chat-model-select="true"]');
+  const menu = composer.locator(".chat-controls__model-menu");
+
+  const openPicker = async () => {
+    await trigger.click();
+    await menu.waitFor({ state: "visible" });
+    await page.waitForTimeout(500);
+  };
+  const closePicker = async () => {
+    await page.keyboard.press("Escape");
+    await page.waitForTimeout(250);
+  };
+  const shoot = async (name: string) => {
+    const box = await menu.boundingBox();
+    if (!box) {
+      throw new Error(`model menu has no layout box for ${name}`);
+    }
+    await page.screenshot({
+      path: path.join(outputDir, `${label}-${name}.png`),
+      clip: {
+        x: Math.max(0, box.x - 8),
+        y: Math.max(0, box.y - 8),
+        width: box.width + 16,
+        height: box.height + 16,
+      },
+    });
+  };
+
+  await openPicker();
+  await shoot("default");
+
+  const headingLabel = menu.locator(".chat-controls__provider-heading span").last();
+  const rowName = menu.locator(".chat-controls__model-option-name").first();
+  const headingBox = await headingLabel.boundingBox();
+  const rowBox = await rowName.boundingBox();
+
+  const search = menu.locator("[data-chat-model-search]");
+  await search.fill("default");
+  await page.waitForTimeout(400);
+  await shoot("search-default");
+  const searchMatches = await menu
+    .locator("[data-chat-model-option]:not([hidden])")
+    .evaluateAll((rows) => rows.map((row) => row.textContent?.replace(/\s+/gu, " ").trim() ?? ""));
+  await search.fill("");
+  await page.waitForTimeout(250);
+
+  const override = menu.locator('[data-chat-model-option="openai/gpt-5.6-terra"]');
+  await override.click();
+  await page.waitForTimeout(600);
+  await openPicker();
+  await shoot("override");
+  await closePicker();
+
+  // A fresh page drops the per-client catalog cache, so the picker's own load
+  // reaches the mock gateway and fails there.
+  await gateway.setMethodResponse("models.list", {
+    __mockError: { code: "UNAVAILABLE", message: "mock catalog refresh failed" },
+  });
+  await page.reload();
+  await composer.waitFor({ state: "visible" });
+  await page.waitForTimeout(1000);
+  await openPicker();
+  await page.waitForTimeout(1500);
+  await shoot("refresh-failure");
+  const catalogStateText = await menu.locator("[data-chat-model-catalog-state]").allTextContents();
+  const rowsAfterFailure = await menu.locator("[data-chat-model-option]").count();
+  await closePicker();
+
+  console.log(
+    JSON.stringify(
+      {
+        label,
+        outputDir,
+        providerHeadingLabelX: headingBox?.x ?? null,
+        modelRowNameX: rowBox?.x ?? null,
+        alignmentDeltaPx: headingBox && rowBox ? rowBox.x - headingBox.x : null,
+        searchDefaultMatches: searchMatches,
+        catalogStateAfterRefreshFailure: catalogStateText,
+        modelRowsAfterRefreshFailure: rowsAfterFailure,
+      },
+      null,
+      2,
+    ),
+  );
+} finally {
+  await context.close();
+  await browser.close();
+  await server.close();
+}
diff --git a/scripts/capture-session-toolbar-proof.mts b/scripts/capture-session-toolbar-proof.mts
new file mode 100644
index 0000000000000000000000000000000000000000..b6c06d509da945921968fd929d0878d6a3a66cad
--- /dev/null
+++ b/scripts/capture-session-toolbar-proof.mts
@@ -0,0 +1,300 @@
+#!/usr/bin/env node
+import path from "node:path";
+import { chromium, type Page } from "playwright";
+import { createControlUiE2eArtifactDir } from "../ui/src/test-helpers/control-ui-e2e-artifacts.ts";
+import {
+  canRunPlaywrightChromium,
+  installMockGateway,
+  resolvePlaywrightChromiumExecutablePath,
+  startControlUiE2eServer,
+} from "../ui/src/test-helpers/control-ui-e2e.ts";
+import { readControlUiProofOption } from "./lib/control-ui-proof-args.mts";
+type CaptureMode = "after" | "before";
+
+function readMode(): CaptureMode {
+  const value = readControlUiProofOption(process.argv, "mode") ?? "after";
+  if (value !== "after" && value !== "before") {
+    throw new Error(`Expected --mode after|before, received ${value}`);
+  }
+  return value;
+}
+
+function sessionRow(
+  key: string,
+  label: string,
+  updatedAt: number,
+  extra: Record<string, unknown> = {},
+) {
+  return {
+    contextTokens: 200_000,
+    displayName: label,
+    hasActiveRun: false,
+    key,
+    kind: "direct",
+    label,
+    model: "gpt-5.6-luna",
+    modelProvider: "openai",
+    status: "done",
+    totalTokens: 0,
+    updatedAt,
+    ...extra,
+  };
+}
+
+function sessionsListResponse(sessions: unknown[]) {
+  return {
+    count: sessions.length,
+    defaults: {
+      contextTokens: 200_000,
+      model: "gpt-5.6-luna",
+      modelProvider: "openai",
+    },
+    hasMore: false,
+    limitApplied: 50,
+    nextOffset: null,
+    offset: 0,
+    path: "",
+    sessions,
+    totalCount: sessions.length,
+    ts: Date.parse("2026-08-17T20:00:00.000Z"),
+  };
+}
+
+const baseTime = Date.parse("2026-08-17T20:00:00.000Z");
+const groupedSessions = [
+  sessionRow("agent:main:main", "Main", baseTime),
+  sessionRow("agent:main:jesse-roadmap", "Roadmap review", baseTime - 60_000, {
+    category: "Jesse",
+  }),
+  sessionRow("agent:main:jesse-launch", "Launch checklist", baseTime - 120_000, {
+    category: "Jesse",
+  }),
+  sessionRow("agent:main:josh-design", "Design handoff", baseTime - 180_000, {
+    category: "Josh",
+  }),
+  sessionRow("agent:main:josh-feedback", "Customer feedback", baseTime - 240_000, {
+    category: "Josh",
+  }),
+  sessionRow("agent:main:weekly-planning", "Weekly planning", baseTime - 300_000),
+  sessionRow("agent:main:travel-notes", "Travel notes", baseTime - 360_000),
+  sessionRow("agent:main:reading-list", "Reading list", baseTime - 420_000),
+  sessionRow("agent:main:toolbar-cleanup", "Toolbar cleanup", baseTime - 480_000, {
+    worktree: {
+      branch: "feat/session-toolbar",
+      id: "wt-session-toolbar",
+      repoRoot: "/Users/demo/Projects/openclaw",
+    },
+  }),
+  sessionRow("agent:main:filter-followup", "Filter menu follow-up", baseTime - 540_000, {
+    worktree: {
+      branch: "fix/filter-menu",
+      id: "wt-filter-menu",
+      repoRoot: "/Users/demo/Projects/openclaw",
+    },
+  }),
+];
+
+const ungroupedSessions = [
+  sessionRow("agent:main:main", "Main", baseTime),
+  sessionRow("agent:main:weekly-planning", "Weekly planning", baseTime - 60_000),
+  sessionRow("agent:main:travel-notes", "Travel notes", baseTime - 120_000),
+  sessionRow("agent:main:reading-list", "Reading list", baseTime - 180_000),
+];
+
+const mode = readMode();
+const outputDir = createControlUiE2eArtifactDir(
+  "session-toolbar-proof",
+  readControlUiProofOption(process.argv, "output-dir") ??
+    ".artifacts/control-ui-e2e/session-toolbar-proof",
+);
+const executablePath = resolvePlaywrightChromiumExecutablePath(chromium.executablePath());
+if (!canRunPlaywrightChromium(executablePath)) {
+  throw new Error(`Playwright Chromium is unavailable at ${executablePath}`);
+}
+
+const server = await startControlUiE2eServer(undefined, { source: true });
+const browser = await chromium.launch({ executablePath });
+const captured: string[] = [];
+
+async function settle(page: Page): Promise<void> {
+  await page.evaluate(async () => {
+    await document.fonts.ready;
+    await new Promise<void>((resolve) => {
+      requestAnimationFrame(() => requestAnimationFrame(() => resolve()));
+    });
+  });
+}
+
+async function capture(page: Page, name: string): Promise<void> {
+  await settle(page);
+  const target = path.join(outputDir, name);
+  await page.screenshot({
+    animations: "disabled",
+    clip: { x: 0, y: 0, width: 560, height: 900 },
+    path: target,
+  });
+  captured.push(target);
+}
+
+async function openScenario(sessions: unknown[], groups: string[] = []) {
+  const context = await browser.newContext({
+    colorScheme: "dark",
+    locale: "en-US",
+    reducedMotion: "reduce",
+    serviceWorkers: "block",
+    viewport: { width: 1280, height: 900 },
+  });
+  const page = await context.newPage();
+  page.setDefaultTimeout(30_000);
+  await installMockGateway(page, {
+    methodResponses: {
+      "sessions.list": sessionsListResponse(sessions),
+    },
+    sessionArchiveFiltering: true,
+    sessionGroups: groups,
+    sessionKey: "agent:main:main",
+  });
+  await page.goto(`${server.baseUrl}chat`);
+  await page.locator("openclaw-app-sidebar").waitFor({ state: "visible" });
+  await page.waitForFunction(() => document.documentElement.dataset.theme === "dark");
+  return { context, page };
+}
+
+async function expandCoding(page: Page): Promise<void> {
+  const coding = page.locator('[data-session-section="work"]');
+  await coding.waitFor({ state: "visible" });
+  const toggle = coding.getByRole("button", { name: "Coding", exact: true });
+  if ((await toggle.getAttribute("aria-expanded")) !== "true") {
+    await toggle.click();
+  }
+  await page.waitForFunction(
+    () =>
+      document.querySelectorAll('[data-session-section="work"] .sidebar-recent-session').length ===
+      2,
+  );
+}
+
+try {
+  if (mode === "after") {
+    const grouped = await openScenario(groupedSessions, ["Jesse", "Josh"]);
+    try {
+      await grouped.page.waitForFunction(() => {
+        const counts = ["Jesse", "Josh"].map(
+          (name) =>
+            document.querySelectorAll(
+              `[data-session-section="category:${name}"] .sidebar-recent-session`,
+            ).length,
+        );
+        return counts.every((count) => count === 2);
+      });
+      await grouped.page.waitForFunction(
+        () =>
+          document.querySelectorAll('[data-session-section="ungrouped"] .sidebar-recent-session')
+            .length === 3,
+      );
+      await expandCoding(grouped.page);
+
+      const toolbar = grouped.page.locator(".sidebar-session-toolbar");
+      await toolbar.getByText("Sessions", { exact: true }).waitFor();
+      const filter = toolbar.getByRole("button", { name: "Filter & sort" });
+      const add = toolbar.getByRole("link", { name: "New session" });
+      await grouped.page.mouse.move(1_000, 850);
+      const toolbarOpacity = await Promise.all([
+        filter.evaluate((element) => Number.parseFloat(getComputedStyle(element).opacity)),
+        add.evaluate((element) => Number.parseFloat(getComputedStyle(element).opacity)),
+      ]);
+      if (toolbarOpacity.some((opacity) => opacity <= 0)) {
+        throw new Error(
+          `Toolbar controls are not visible without hover: ${toolbarOpacity.join(", ")}`,
+        );
+      }
+      await grouped.page.getByText("Other", { exact: true }).waitFor();
+      await capture(grouped.page, "after-grouped.png");
+
+      await filter.click();
+      await grouped.page.locator(".sidebar-session-sort-menu").waitFor({ state: "visible" });
+      await capture(grouped.page, "after-toolbar-menu.png");
+
+      await grouped.page.getByRole("menuitemradio", { name: "All", exact: true }).click();
+      await grouped.page.waitForFunction(
+        () =>
+          document
+            .querySelector(".sidebar-session-toolbar .sidebar-session-sort")
+            ?.classList.contains("sidebar-session-sort--filtered") === true,
+      );
+      await grouped.page.mouse.move(1_000, 850);
+      await capture(grouped.page, "after-filter-active.png");
+    } finally {
+      await grouped.context.close();
+    }
+
+    const ungrouped = await openScenario(ungroupedSessions);
+    try {
+      await ungrouped.page.waitForFunction(
+        () =>
+          document.querySelectorAll('[data-session-section="ungrouped"] .sidebar-recent-session')
+            .length === 3,
+      );
+      if (
+        (await ungrouped.page
+          .locator('[data-session-section="ungrouped"] > .sidebar-recent-sessions__head')
+          .count()) !== 0
+      ) {
+        throw new Error("Ungrouped-only state unexpectedly rendered a section header");
+      }
+      await ungrouped.page.getByText("Sessions", { exact: true }).waitFor();
+      await capture(ungrouped.page, "after-ungrouped-only.png");
+    } finally {
+      await ungrouped.context.close();
+    }
+  } else {
+    const grouped = await openScenario(groupedSessions, ["Jesse", "Josh"]);
+    try {
+      await grouped.page.waitForFunction(
+        () =>
+          document.querySelectorAll('[data-session-section="ungrouped"] .sidebar-recent-session')
+            .length === 3,
+      );
+      await expandCoding(grouped.page);
+      const header = grouped.page.locator(
+        '[data-session-section="ungrouped"] > .sidebar-recent-sessions__head',
+      );
+      const filter = header.getByRole("button", { name: "Sort sessions" });
+      const add = header.getByRole("button", { name: "New session" });
+
+      await grouped.page.mouse.move(1_000, 850);
+      await settle(grouped.page);
+      const idleOpacity = await Promise.all([
+        filter.evaluate((element) => Number.parseFloat(getComputedStyle(element).opacity)),
+        add.evaluate((element) => Number.parseFloat(getComputedStyle(element).opacity)),
+      ]);
+      if (idleOpacity.some((opacity) => opacity !== 0)) {
+        throw new Error(`Legacy controls are not hover-hidden: ${idleOpacity.join(", ")}`);
+      }
+      await capture(grouped.page, "before-grouped.png");
+
+      await header.hover();
+      await grouped.page.waitForFunction(() => {
+        const controls = [
+          ...document.querySelectorAll(
+            '[data-session-section="ungrouped"] > .sidebar-recent-sessions__head .sidebar-session-group-actions',
+          ),
+        ];
+        return (
+          controls.length === 2 &&
+          controls.every((element) => getComputedStyle(element).opacity === "1")
+        );
+      });
+      await capture(grouped.page, "before-grouped-hover.png");
+    } finally {
+      await grouped.context.close();
+    }
+  }
+} finally {
+  await browser.close();
+  await server.close();
+}
+
+console.log(
+  JSON.stringify({ captured, fixture: "custom installMockGateway scenario", mode }, null, 2),
+);
diff --git a/scripts/changelog-to-html.sh b/scripts/changelog-to-html.sh
new file mode 100644
index 0000000000000000000000000000000000000000..b7f9e0ee71baacdd301f6fe77ec0ba06b337b8ee
--- /dev/null
+++ b/scripts/changelog-to-html.sh
@@ -0,0 +1,109 @@
+#!/usr/bin/env bash
+# Bash 5.3+ can deadlock writing heredoc pipes on macOS before the reader starts.
+if [[ ${OSTYPE:-} == darwin* && $BASH != /bin/bash ]] && ((BASH_VERSINFO[0] > 5 || (BASH_VERSINFO[0] == 5 && BASH_VERSINFO[1] >= 3))); then
+  exec /bin/bash "$0" "$@"
+fi
+set -euo pipefail
+
+VERSION=${1:-}
+CHANGELOG_FILE=${2:-}
+
+if [[ -z "$VERSION" ]]; then
+  echo "Usage: $0 <version> [changelog_file]" >&2
+  exit 1
+fi
+
+SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+if [[ -z "$CHANGELOG_FILE" ]]; then
+  if [[ -f "$SCRIPT_DIR/../CHANGELOG.md" ]]; then
+    CHANGELOG_FILE="$SCRIPT_DIR/../CHANGELOG.md"
+  elif [[ -f "CHANGELOG.md" ]]; then
+    CHANGELOG_FILE="CHANGELOG.md"
+  elif [[ -f "../CHANGELOG.md" ]]; then
+    CHANGELOG_FILE="../CHANGELOG.md"
+  else
+    echo "Error: Could not find CHANGELOG.md" >&2
+    exit 1
+  fi
+fi
+
+if [[ ! -f "$CHANGELOG_FILE" ]]; then
+  echo "Error: Changelog file '$CHANGELOG_FILE' not found" >&2
+  exit 1
+fi
+
+extract_version_section() {
+  local version=$1
+  local file=$2
+  node --input-type=module - "$SCRIPT_DIR" "$version" "$file" <<'NODE'
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+const [scriptDir, version, file] = process.argv.slice(2);
+const { findChangelogSection, findReleaseChangelog } = await import(
+  pathToFileURL(path.join(scriptDir, "lib/release-changelog.mjs")).href
+);
+try {
+  const markdown = path.basename(file) === "CHANGELOG.md"
+    ? findReleaseChangelog({ rootDir: path.dirname(path.resolve(file)), version })?.section
+    : readFileSync(file, "utf8");
+  const section = markdown && findChangelogSection(markdown, version);
+  if (section) process.stdout.write(section.replace(/^[^\n]*(?:\n|$)/u, ""));
+} catch (error) {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+}
+NODE
+}
+
+markdown_to_html() {
+  # Keep substitution order and literal HTML unchanged, but process the whole
+  # section once instead of spawning nine sed processes for every changelog line.
+  sed \
+    -e 's/^##### \(.*\)$/<h5>\1<\/h5>/' \
+    -e 's/^#### \(.*\)$/<h4>\1<\/h4>/' \
+    -e 's/^### \(.*\)$/<h3>\1<\/h3>/' \
+    -e 's/^## \(.*\)$/<h2>\1<\/h2>/' \
+    -e 's/^- \*\*\([^*]*\)\*\*\(.*\)$/<li><strong>\1<\/strong>\2<\/li>/' \
+    -e 's/^- \([^*].*\)$/<li>\1<\/li>/' \
+    -e 's/\*\*\([^*]*\)\*\*/<strong>\1<\/strong>/g' \
+    -e 's/`\([^`]*\)`/<code>\1<\/code>/g' \
+    -e 's/\[\([^]]*\)\](\([^)]*\))/<a href="\2">\1<\/a>/g'
+}
+
+version_content=$(extract_version_section "$VERSION" "$CHANGELOG_FILE")
+if [[ -z "$version_content" ]]; then
+  echo "<h2>OpenClaw $VERSION</h2>"
+  echo "<p>Latest OpenClaw update.</p>"
+  echo "<p><a href=\"https://github.com/openclaw/openclaw/blob/main/CHANGELOG.md\">View full changelog</a></p>"
+  exit 0
+fi
+
+echo "<h2>OpenClaw $VERSION</h2>"
+
+{
+  in_list=false
+  while IFS= read -r line; do
+    if [[ "$line" =~ ^- ]]; then
+      if [[ "$in_list" == false ]]; then
+        echo "<ul>"
+        in_list=true
+      fi
+      printf '%s\n' "$line"
+    else
+      if [[ "$in_list" == true ]]; then
+        echo "</ul>"
+        in_list=false
+      fi
+      if [[ -n "$line" ]]; then
+        printf '%s\n' "$line"
+      fi
+    fi
+  done <<< "$version_content"
+
+  if [[ "$in_list" == true ]]; then
+    echo "</ul>"
+  fi
+} | markdown_to_html
+
+echo "<p><a href=\"https://github.com/openclaw/openclaw/blob/main/CHANGELOG.md\">View full changelog</a></p>"
diff --git a/scripts/check-assertion-safety-ratchet.mts b/scripts/check-assertion-safety-ratchet.mts
new file mode 100644
index 0000000000000000000000000000000000000000..1c1468819f960d15cb881b2962b6d791edebd66f
--- /dev/null
+++ b/scripts/check-assertion-safety-ratchet.mts
@@ -0,0 +1,371 @@
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import ts from "typescript";
+import {
+  compareRatchetCounts,
+  listRatchetRenames,
+  loadRatchetReference,
+  loadRatchetSnapshot,
+  loadRatchetSources,
+  parseRatchetArgs,
+  parseRatchetCounts,
+  reportRatchetFailures,
+  reportRatchetSuccess,
+  resolveRatchetBase,
+  type RatchetCountDelta,
+} from "./lib/shrink-ratchet.mts";
+import {
+  TYPE_ASSERTION_PRODUCTION_ROOTS,
+  isSkippedTypeAssertionTestPath,
+  pathMatchesTypeAssertionRoot,
+} from "./lib/type-assertion-guard-scope.mjs";
+
+const BASELINE_PATH = "config/assertion-safety-baseline.txt";
+const GIT_MAX_BUFFER = 256 * 1024 * 1024;
+const SOURCE_EXTENSIONS = new Set([".ts", ".tsx", ".mts", ".cts"]);
+const BASELINE_HEADER = [
+  "# Per-file counts of production type assertions without a // SAFETY: invariant.",
+  "# Ratchet: counts may only shrink. New non-const assertions need a SAFETY comment.",
+  "# Format: repo-relative path, tab, positive count. Zero-count files are omitted.",
+  "",
+].join("\n");
+
+type AssertionNode = ts.AsExpression | ts.TypeAssertion;
+
+const compareStrings = (left: string, right: string) => (left < right ? -1 : left > right ? 1 : 0);
+
+function isDeclarationFile(filePath: string) {
+  return [".d.ts", ".d.mts", ".d.cts"].some((suffix) => filePath.endsWith(suffix));
+}
+
+export function isGovernedAssertionSourcePath(filePath: string) {
+  const normalized = filePath.replaceAll("\\", "/");
+  return (
+    TYPE_ASSERTION_PRODUCTION_ROOTS.some((root) =>
+      pathMatchesTypeAssertionRoot(normalized, root),
+    ) &&
+    SOURCE_EXTENSIONS.has(path.posix.extname(normalized)) &&
+    !isDeclarationFile(normalized) &&
+    !isSkippedTypeAssertionTestPath(normalized)
+  );
+}
+
+function scriptKindForPath(filePath: string) {
+  return filePath.endsWith(".tsx") ? ts.ScriptKind.TSX : ts.ScriptKind.TS;
+}
+
+function collectSafetyCommentLines(sourceFile: ts.SourceFile, source: string) {
+  // Line text, not token scanning: a raw scanner desyncs on the `}` that ends a
+  // template substitution and then misses every later comment in the file.
+  const sameLine = new Set<number>();
+  const standalone = new Set<number>();
+  sourceFile.getLineStarts().forEach((lineStart, line) => {
+    const lineEnd = source.indexOf("\n", lineStart);
+    const text = source.slice(lineStart, lineEnd === -1 ? source.length : lineEnd);
+    const commentStart = text.indexOf("//");
+    if (commentStart === -1 || !/^\/\/\s*SAFETY:\s*\S/u.test(text.slice(commentStart).trim())) {
+      return;
+    }
+    sameLine.add(line);
+    if (text.slice(0, commentStart).trim() === "") {
+      standalone.add(line);
+    }
+  });
+  return { sameLine, standalone };
+}
+
+function assertionOperatorPosition(sourceFile: ts.SourceFile, node: AssertionNode) {
+  const operatorKind = ts.isAsExpression(node)
+    ? ts.SyntaxKind.AsKeyword
+    : ts.SyntaxKind.LessThanToken;
+  return (
+    node
+      .getChildren(sourceFile)
+      .find((child) => child.kind === operatorKind)
+      ?.getStart(sourceFile) ?? node.getStart(sourceFile)
+  );
+}
+
+function isUnknownAssertion(node: AssertionNode) {
+  // Casting exactly to unknown strengthens evidence; oxlint still rejects chained assertions such as `x as unknown as T`.
+  return node.type.kind === ts.SyntaxKind.UnknownKeyword;
+}
+
+export function countUnsafeAssertions(source: string, filePath = "src/source.ts") {
+  const repoPath = filePath.replaceAll("\\", "/");
+  if (isDeclarationFile(repoPath)) {
+    return 0;
+  }
+  const sourceFile = ts.createSourceFile(
+    filePath,
+    source,
+    ts.ScriptTarget.Latest,
+    true,
+    scriptKindForPath(filePath),
+  );
+  const parseDiagnostics = (
+    sourceFile as ts.SourceFile & { parseDiagnostics: readonly ts.Diagnostic[] }
+  ).parseDiagnostics;
+  const diagnostic = parseDiagnostics[0];
+  if (diagnostic) {
+    const position = diagnostic.start ?? 0;
+    const line = sourceFile.getLineAndCharacterOfPosition(position).line + 1;
+    throw new Error(
+      `${filePath}:${line}: ${ts.flattenDiagnosticMessageText(diagnostic.messageText, "\n")}`,
+    );
+  }
+
+  const safetyCommentLines = collectSafetyCommentLines(sourceFile, source);
+  let count = 0;
+  const visit = (node: ts.Node): void => {
+    if (ts.isAsExpression(node) || ts.isTypeAssertionExpression(node)) {
+      if (!ts.isConstTypeReference(node.type) && !isUnknownAssertion(node)) {
+        const operatorLine = sourceFile.getLineAndCharacterOfPosition(
+          assertionOperatorPosition(sourceFile, node),
+        ).line;
+        if (
+          !safetyCommentLines.sameLine.has(operatorLine) &&
+          !safetyCommentLines.standalone.has(operatorLine - 1)
+        ) {
+          count += 1;
+        }
+      }
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(sourceFile);
+  return count;
+}
+
+function parseAssertionBaseline(source: string) {
+  return parseRatchetCounts(source, BASELINE_PATH);
+}
+
+function formatBaseline(counts: ReadonlyMap<string, number>) {
+  const entries = [...counts]
+    .filter(([, count]) => count > 0)
+    .toSorted(([left], [right]) => compareStrings(left, right))
+    .map(([filePath, count]) => `${filePath}\t${count}`);
+  return BASELINE_HEADER + entries.join("\n") + (entries.length > 0 ? "\n" : "");
+}
+
+function baselineWithVerifiedRenames(
+  root: string,
+  baseRef: string,
+  staged: boolean,
+  baseline: ReadonlyMap<string, number>,
+  baseBaseline: ReadonlyMap<string, number>,
+) {
+  const allowed = new Map(baseBaseline);
+  for (const { from, to } of listRatchetRenames(
+    root,
+    baseRef,
+    staged,
+    TYPE_ASSERTION_PRODUCTION_ROOTS,
+  )) {
+    const oldCount = baseBaseline.get(from);
+    const newCount = baseline.get(to);
+    if (
+      oldCount !== undefined &&
+      newCount !== undefined &&
+      newCount <= oldCount &&
+      !baseline.has(from)
+    ) {
+      allowed.delete(from);
+      allowed.set(to, oldCount);
+    }
+  }
+  return allowed;
+}
+
+export function collectCurrentAssertionSafetyCounts(
+  root = process.cwd(),
+  options: { staged?: boolean } = {},
+) {
+  const staged = options.staged === true;
+  const filePaths = execFileSync(
+    "git",
+    [
+      "ls-files",
+      "-z",
+      ...(staged ? ["--cached"] : ["--cached", "--others", "--exclude-standard"]),
+      "--",
+      ...TYPE_ASSERTION_PRODUCTION_ROOTS,
+    ],
+    { cwd: root, maxBuffer: GIT_MAX_BUFFER },
+  )
+    .toString("utf8")
+    .split("\0")
+    .filter(Boolean)
+    .filter(isGovernedAssertionSourcePath)
+    .filter((filePath) => staged || fs.existsSync(path.join(root, filePath)))
+    .toSorted(compareStrings);
+  const sources = staged
+    ? [...loadRatchetSources(root, filePaths)]
+    : filePaths.map((filePath): [string, string] => [
+        filePath,
+        fs.readFileSync(path.join(root, filePath), "utf8"),
+      ]);
+  const counts = new Map<string, number>();
+  for (const [filePath, source] of sources) {
+    const count = countUnsafeAssertions(source, filePath);
+    if (count > 0) {
+      counts.set(filePath, count);
+    }
+  }
+  return counts;
+}
+
+function allowanceWithExistingBaseCounts(
+  root: string,
+  baseRef: string,
+  proposed: ReadonlyMap<string, number>,
+  allowed: ReadonlyMap<string, number>,
+) {
+  const effective = new Map(allowed);
+  for (const [filePath, count] of proposed) {
+    if (count <= (effective.get(filePath) ?? 0)) {
+      continue;
+    }
+    try {
+      const source = execFileSync("git", ["show", `${baseRef}:${filePath}`], {
+        cwd: root,
+        encoding: "utf8",
+        maxBuffer: GIT_MAX_BUFFER,
+        stdio: ["ignore", "pipe", "ignore"],
+      });
+      const baseCount = countUnsafeAssertions(source, filePath);
+      if (baseCount > (effective.get(filePath) ?? 0)) {
+        effective.set(filePath, baseCount);
+      }
+    } catch {
+      // Missing base paths are branch additions and receive no allowance.
+    }
+  }
+  return effective;
+}
+
+function writeBaseline(root: string, counts: ReadonlyMap<string, number>) {
+  fs.writeFileSync(path.join(root, BASELINE_PATH), formatBaseline(counts));
+}
+
+function formatDeltas(entries: RatchetCountDelta[], comparison: ">" | "<") {
+  return entries.map((entry) => `${entry.entry}: ${entry.current} ${comparison} ${entry.allowed}`);
+}
+
+function totalCount(counts: ReadonlyMap<string, number>) {
+  return [...counts.values()].reduce((total, count) => total + count, 0);
+}
+
+export function main(root = process.cwd(), argv: string[] = process.argv.slice(2)) {
+  try {
+    const args = parseRatchetArgs(argv);
+    if (args.staged && args.prune) {
+      throw new Error("--prune cannot be combined with --staged");
+    }
+
+    const baseRef = resolveRatchetBase(root, { base: args.base, staged: args.staged });
+    const baseBaseline = baseRef
+      ? loadRatchetReference(root, baseRef, BASELINE_PATH, parseAssertionBaseline)
+      : null;
+    const current = collectCurrentAssertionSafetyCounts(root, { staged: args.staged });
+
+    let baselineSource;
+    try {
+      baselineSource = loadRatchetSnapshot(
+        root,
+        BASELINE_PATH,
+        args.staged,
+        parseAssertionBaseline,
+      );
+    } catch {
+      if (args.prune && !args.staged && baseBaseline === null) {
+        writeBaseline(root, current);
+        reportRatchetSuccess(
+          `Initialized ${BASELINE_PATH}: ${current.size} files, ${totalCount(current)} assertions.`,
+        );
+        return 0;
+      }
+      throw new Error("Missing " + BASELINE_PATH + (args.staged ? " in the index" : ""));
+    }
+
+    const baseline = baselineSource;
+    if (args.prune && !args.staged && baseBaseline === null) {
+      writeBaseline(root, current);
+      reportRatchetSuccess(
+        `Refreshed initial ${BASELINE_PATH}: ${current.size} files, ${totalCount(current)} assertions.`,
+      );
+      return 0;
+    }
+    const allowedBaseline =
+      baseRef && baseBaseline
+        ? baselineWithVerifiedRenames(root, baseRef, args.staged, baseline, baseBaseline)
+        : baseBaseline;
+    const currentAllowance =
+      baseRef && baseBaseline
+        ? allowanceWithExistingBaseCounts(root, baseRef, current, baseline)
+        : baseline;
+    const expansionAllowance =
+      baseRef && allowedBaseline
+        ? allowanceWithExistingBaseCounts(root, baseRef, baseline, allowedBaseline)
+        : allowedBaseline;
+    const increases = compareRatchetCounts(current, currentAllowance).increased;
+    const expanded = expansionAllowance
+      ? compareRatchetCounts(baseline, expansionAllowance).increased
+      : [];
+
+    if (
+      reportRatchetFailures(
+        [
+          {
+            entries: formatDeltas(increases, ">"),
+            title: "Uncommented type assertions exceed the grandfathered per-file baseline:",
+          },
+          {
+            entries: formatDeltas(expanded, ">"),
+            title: "The assertion SAFETY baseline may only shrink:",
+          },
+        ],
+        "Every new non-const type assertion needs // SAFETY: <invariant> above it or on the same line.",
+      )
+    ) {
+      return 1;
+    }
+
+    if (args.prune) {
+      const oldFiles = baseline.size;
+      const oldAssertions = totalCount(baseline);
+      writeBaseline(root, current);
+      reportRatchetSuccess(
+        `Pruned ${BASELINE_PATH}: ${oldFiles} -> ${current.size} files; ${oldAssertions} -> ${totalCount(current)} assertions.`,
+      );
+      return 0;
+    }
+
+    const stale = compareRatchetCounts(current, baseline).decreased;
+    if (
+      reportRatchetFailures([
+        {
+          entries: formatDeltas(stale, "<"),
+          title: `Shrink ${BASELINE_PATH} entries (or run with --prune):`,
+        },
+      ])
+    ) {
+      return 1;
+    }
+
+    reportRatchetSuccess(
+      `assertion SAFETY ratchet OK: ${current.size} files, ${totalCount(current)} grandfathered assertions.`,
+    );
+    return 0;
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    return 1;
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  process.exitCode = main();
+}
diff --git a/scripts/check-changelog-attributions.mts b/scripts/check-changelog-attributions.mts
new file mode 100644
index 0000000000000000000000000000000000000000..56ef5574847bbff72f0cb1de5e1899fa8e7d3f88
--- /dev/null
+++ b/scripts/check-changelog-attributions.mts
@@ -0,0 +1,181 @@
+#!/usr/bin/env node
+
+// Rejects changelog thanks entries that credit bots or internal handles.
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { changelogFormat, isReleaseChangelogPath } from "./lib/release-changelog.mjs";
+
+/**
+ * Exact handles that changelog thanks entries must not credit.
+ */
+const FORBIDDEN_CHANGELOG_THANKS_HANDLES = new Set([
+  "codex",
+  "openclaw",
+  "steipete",
+  "clawsweeper",
+  "openclaw-clawsweeper",
+  "clawsweeper[bot]",
+  "openclaw-clawsweeper[bot]",
+]);
+/**
+ * Handle prefixes that identify forbidden changelog thanks credits.
+ */
+const FORBIDDEN_CHANGELOG_THANKS_HANDLE_PREFIXES = ["app/"];
+/**
+ * Handle suffixes that identify forbidden changelog thanks credits.
+ */
+const FORBIDDEN_CHANGELOG_THANKS_HANDLE_SUFFIXES = ["[bot]"];
+/**
+ * Handles that require an explicit human credit instead.
+ */
+const CHANGELOG_THANKS_REQUIRE_HUMAN_CREDIT_HANDLES = new Set([
+  "clawsweeper",
+  "openclaw-clawsweeper",
+  "clawsweeper[bot]",
+  "openclaw-clawsweeper[bot]",
+]);
+/**
+ * Handle prefixes that require explicit human credit instead.
+ */
+const CHANGELOG_THANKS_REQUIRE_HUMAN_CREDIT_HANDLE_PREFIXES = ["app/"];
+/**
+ * Handle suffixes that require explicit human credit instead.
+ */
+const CHANGELOG_THANKS_REQUIRE_HUMAN_CREDIT_HANDLE_SUFFIXES = ["[bot]"];
+
+const THANKS_PATTERN = /\bThanks\b/iu;
+const THANKED_HANDLE_PATTERN = /@([-_/A-Za-z0-9]+(?:\[bot\])?)/giu;
+type ThanksOptions = { strictBotHandle?: boolean; docsMirror?: boolean };
+
+/**
+ * Reports whether a handle is forbidden in changelog thanks text.
+ */
+export function isForbiddenChangelogThanksHandle(handle: string, options: ThanksOptions = {}) {
+  const { strictBotHandle = false } = options;
+  const normalized = handle.toLowerCase();
+  // Approved docs mirrors retain every verified human, including the maintainer.
+  // Initial notes, frozen accounting, and PR-author queries keep their existing policy.
+  if (options.docsMirror && normalized === "steipete") {
+    return false;
+  }
+  if (normalized === "" || normalized === "null") {
+    // Empty/null input is not a GitHub handle, but the shell query path may pass it through.
+    return true;
+  }
+  if (
+    FORBIDDEN_CHANGELOG_THANKS_HANDLES.has(normalized) ||
+    FORBIDDEN_CHANGELOG_THANKS_HANDLE_PREFIXES.some((prefix) => normalized.startsWith(prefix)) ||
+    FORBIDDEN_CHANGELOG_THANKS_HANDLE_SUFFIXES.some((suffix) => normalized.endsWith(suffix))
+  ) {
+    return true;
+  }
+  if (strictBotHandle) {
+    // PR-author checks should not reject a real human whose login merely contains a bot keyword.
+    return false;
+  }
+  return false;
+}
+
+/**
+ * Reports whether a handle needs a separate human credit.
+ */
+export function requiresExplicitHumanChangelogThanks(handle: string) {
+  const normalized = handle.toLowerCase();
+  if (normalized === "" || normalized === "null") {
+    return false;
+  }
+  return (
+    CHANGELOG_THANKS_REQUIRE_HUMAN_CREDIT_HANDLES.has(normalized) ||
+    CHANGELOG_THANKS_REQUIRE_HUMAN_CREDIT_HANDLE_PREFIXES.some((prefix) =>
+      normalized.startsWith(prefix),
+    ) ||
+    CHANGELOG_THANKS_REQUIRE_HUMAN_CREDIT_HANDLE_SUFFIXES.some((suffix) =>
+      normalized.endsWith(suffix),
+    )
+  );
+}
+
+/**
+ * Finds changelog lines that thank forbidden handles.
+ */
+export function findForbiddenChangelogThanks(content: string, options: ThanksOptions = {}) {
+  return content
+    .split(/\r?\n/u)
+    .map((text, index) => {
+      if (!THANKS_PATTERN.test(text)) {
+        return null;
+      }
+      // A single changelog line may thank multiple handles; scan all of them.
+      for (const match of text.matchAll(THANKED_HANDLE_PATTERN)) {
+        const handle = match[1];
+        if (handle && isForbiddenChangelogThanksHandle(handle, options)) {
+          return { line: index + 1, handle: handle.toLowerCase(), text };
+        }
+      }
+      return null;
+    })
+    .filter((violation) => violation !== null);
+}
+
+/**
+ * Runs the changelog attribution check.
+ */
+export async function main(argv = process.argv.slice(2)) {
+  if (argv[0] === "--is-forbidden-handle") {
+    process.exitCode = isForbiddenChangelogThanksHandle(argv[1] ?? "", {
+      strictBotHandle: true,
+    })
+      ? 0
+      : 1;
+    return;
+  }
+
+  if (argv[0] === "--requires-explicit-human-thanks") {
+    process.exitCode = requiresExplicitHumanChangelogThanks(argv[1] ?? "") ? 0 : 1;
+    return;
+  }
+
+  const changelogPath = argv[0] ?? "CHANGELOG.md";
+  const absolutePath = path.resolve(process.cwd(), changelogPath);
+  const paths = [absolutePath];
+  const root = path.dirname(absolutePath);
+  const artifacts = path.join(root, "CHANGELOG");
+  if (path.basename(absolutePath) === "CHANGELOG.md" && fs.existsSync(artifacts)) {
+    for (const entry of fs.readdirSync(artifacts, { recursive: true, encoding: "utf8" })) {
+      const relative = `CHANGELOG/${entry}`;
+      if (isReleaseChangelogPath(relative)) {
+        paths.push(path.join(root, relative));
+      }
+    }
+  }
+  let failed = false;
+  for (const file of paths) {
+    const content = fs.readFileSync(file, "utf8");
+    const relativePath = path.relative(process.cwd(), file);
+    const docsMirror =
+      /^CHANGELOG\/[^/]+\.md$/u.test(relativePath) &&
+      isReleaseChangelogPath(relativePath) &&
+      changelogFormat(content) === "docs-mirror";
+    for (const violation of findForbiddenChangelogThanks(content, { docsMirror })) {
+      if (!failed) {
+        console.error("Forbidden changelog thanks attribution:");
+      }
+      failed = true;
+      console.error(`- ${relativePath}:${violation.line} uses Thanks @${violation.handle}`);
+    }
+  }
+  if (failed) {
+    console.error(
+      "Use verified human GitHub credits; retain the initial-note policy in frozen records.",
+    );
+    process.exitCode = 1;
+  }
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  main().catch((error: unknown) => {
+    console.error(error);
+    process.exit(1);
+  });
+}
diff --git a/scripts/check-coercion-helper-declarations.mts b/scripts/check-coercion-helper-declarations.mts
new file mode 100644
index 0000000000000000000000000000000000000000..f5c2bff2d6c1b2ce4995bc7ec2795a90a4cb4e06
--- /dev/null
+++ b/scripts/check-coercion-helper-declarations.mts
@@ -0,0 +1,789 @@
+#!/usr/bin/env node
+
+// Prevents local primitive-coercion helpers from regrowing after consolidation.
+import fs from "node:fs";
+import path from "node:path";
+import ts from "typescript";
+import { isCodeFile, listRepoFilesSync } from "./check-file-utils.js";
+import { isDirectRunUrl } from "./lib/direct-run.mjs";
+import { runWithFailedTrailer } from "./lib/failed-trailer.mts";
+import { escapeRegExp } from "./lib/regexp.mjs";
+import { resolveRepoRoot } from "./lib/repo-root.mjs";
+import { getPropertyNameText, toLine, unwrapExpression } from "./lib/ts-guard-utils.mts";
+
+const ABSOLUTE_LEGACY_COERCION_HELPER_NAMES = [
+  "asObject",
+  "asString",
+  "normalizeString",
+  "optionalString",
+  "readBoolean",
+  "readNumber",
+  "readOptionalString",
+  "readString",
+  "timestampMs",
+] as const;
+
+export type CoercionHelperDeclarationKind =
+  | "field"
+  | "function"
+  | "method"
+  | "property"
+  | "variable";
+
+export const CANONICAL_COERCION_HELPER_OWNERS = [
+  {
+    file: "packages/normalization-core/src/agent-id.ts",
+    kind: "function",
+    names: ["isValidAgentId", "normalizeAgentId", "normalizeAgentIdStrict"],
+  },
+  {
+    file: "packages/normalization-core/src/string-coerce.ts",
+    kind: "function",
+    names: [
+      "hasNonEmptyString",
+      "lowercasePreservingWhitespace",
+      "localeLowercasePreservingWhitespace",
+      "normalizeBoundedOptionalString",
+      "normalizeFastMode",
+      "normalizeLowercaseStringOrEmpty",
+      "normalizeNullableString",
+      "normalizeOptionalLowercaseString",
+      "normalizeOptionalString",
+      "normalizeOptionalStringifiedId",
+      "normalizeOptionalThreadValue",
+      "normalizeStringifiedOptionalString",
+      "normalizeStringifiedEntries",
+      "readNonBlankString",
+      "readNonEmptyStringPreservingWhitespace",
+      "readStringValue",
+      "resolvePrimaryStringValue",
+    ],
+  },
+  {
+    file: "packages/normalization-core/src/string-normalization.ts",
+    kind: "function",
+    names: [
+      "containsAsciiControlCharacter",
+      "filterStringEntries",
+      "normalizeArrayBackedTrimmedStringList",
+      "normalizeAtHashSlug",
+      "normalizeCsvOrLooseStringList",
+      "normalizeHyphenSlug",
+      "normalizeOptionalTrimmedStringList",
+      "normalizeSingleOrTrimmedStringList",
+      "normalizeSortedUniqueStringEntries",
+      "normalizeSortedUniqueTrimmedStringList",
+      "normalizeStringEntries",
+      "normalizeStringEntriesLower",
+      "normalizeTrimmedStringList",
+      "normalizeUniqueSingleOrTrimmedStringList",
+      "normalizeUniqueStringEntries",
+      "normalizeUniqueStringEntriesLower",
+      "normalizeUniqueTrimmedStringList",
+      "sortUniqueStrings",
+      "uniqueStrings",
+      "uniqueValues",
+    ],
+  },
+  {
+    file: "packages/normalization-core/src/number-coercion.ts",
+    kind: "function",
+    names: [
+      "addTimerTimeoutGraceMs",
+      "asDateTimestampMs",
+      "asFiniteNumber",
+      "asFiniteNumberInRange",
+      "asNonNegativeFiniteNumber",
+      "asPositiveFiniteNumber",
+      "asPositiveSafeInteger",
+      "asSafeIntegerInRange",
+      "clampTimerTimeoutMs",
+      "clampPositiveTimerTimeoutMs",
+      "finiteSecondsToTimerSafeMilliseconds",
+      "isFutureDateTimestampMs",
+      "nonNegativeSecondsToSafeMilliseconds",
+      "parseDateFirstTimestampMs",
+      "parseDateStringTimestampMs",
+      "parseFiniteNumber",
+      "parseStrictFiniteNumber",
+      "parseStrictInteger",
+      "parseStrictNonNegativeInteger",
+      "parseStrictPositiveInteger",
+      "positiveSecondsToSafeMilliseconds",
+      "resolveDateTimestampMs",
+      "resolveExpiresAtMsFromDurationMs",
+      "resolveExpiresAtMsFromDurationOrEpoch",
+      "resolveExpiresAtMsFromDurationSeconds",
+      "resolveExpiresAtMsFromEpochSeconds",
+      "resolveIntegerOption",
+      "resolveNonNegativeIntegerOption",
+      "resolveOptionalIntegerOption",
+      "resolvePositiveTimerTimeoutMs",
+      "resolveTimerTimeoutMs",
+      "resolveTimestampMsToIsoString",
+      "timestampMsToIsoFileStamp",
+      "timestampMsToIsoString",
+    ],
+  },
+  {
+    file: "packages/normalization-core/src/boolean-coercion.ts",
+    kind: "function",
+    names: ["parseBoolean"],
+  },
+  {
+    file: "packages/normalization-core/src/record-coerce.ts",
+    kind: "function",
+    names: [
+      "asNonArrayRecord",
+      "asNullableObjectRecord",
+      "asNullableRecord",
+      "asOptionalObjectRecord",
+      "asOptionalRecord",
+      "asRecord",
+      "filterStringRecord",
+      "isRecord",
+      "isStringRecord",
+      "readStringField",
+    ],
+  },
+  {
+    file: "packages/normalization-core/src/json-coercion.ts",
+    kind: "function",
+    names: ["safeParseJson", "safeParseJsonRecord"],
+  },
+  {
+    file: "packages/normalization-core/src/error-coercion.ts",
+    kind: "function",
+    names: [
+      "coerceErrorMessage",
+      "collectErrorGraphCandidates",
+      "collectNestedErrorCandidates",
+      "extractErrorCodeOrErrno",
+      "stringifyNonErrorCause",
+      "toErrorObject",
+      "toStringifiedError",
+      "toStructuredErrorObject",
+    ],
+  },
+  {
+    file: "scripts/lib/error-format.mts",
+    kind: "function",
+    names: ["coerceErrorMessage", "toErrorObject", "toStringifiedError"],
+  },
+  {
+    file: "scripts/lib/arg-utils.runtime.mjs",
+    kind: "function",
+    names: [
+      "classifyBoundedUnsignedDecimal",
+      "parsePermissiveBooleanToken",
+      "parseStrictBooleanArg",
+    ],
+  },
+  {
+    file: "src/utils/boolean.ts",
+    kind: "function",
+    names: ["asBoolean", "parseBooleanValue"],
+  },
+] as const satisfies readonly {
+  file: string;
+  kind: CoercionHelperDeclarationKind;
+  names: readonly string[];
+}[];
+
+export const CANONICAL_COERCION_MODULES = [
+  "packages/normalization-core/src/agent-id.ts",
+  "packages/normalization-core/src/string-coerce.ts",
+  "packages/normalization-core/src/string-normalization.ts",
+  "packages/normalization-core/src/number-coercion.ts",
+  "packages/normalization-core/src/record-coerce.ts",
+  "packages/normalization-core/src/json-coercion.ts",
+  "packages/normalization-core/src/error-coercion.ts",
+  "packages/normalization-core/src/boolean-coercion.ts",
+  "scripts/lib/error-format.mts",
+  "src/utils/boolean.ts",
+] as const;
+
+const MIXED_CANONICAL_COERCION_MODULES = ["scripts/lib/arg-utils.runtime.mjs"] as const;
+
+export const DEFERRED_CANONICAL_COERCION_EXPORTS = [
+  {
+    file: "packages/normalization-core/src/error-coercion.ts",
+    name: "extractErrorCode",
+    reason: "Provider adapters share this name for nested response-code extraction.",
+  },
+  {
+    file: "packages/normalization-core/src/error-coercion.ts",
+    name: "readErrorName",
+    reason: "Diagnostic adapters share this name for filtered or non-blank error names.",
+  },
+  {
+    file: "packages/normalization-core/src/error-coercion.ts",
+    name: "formatErrorMessage",
+    reason: "Structural formatter shares its public name with redacting owner adapters.",
+  },
+  {
+    file: "scripts/lib/error-format.mts",
+    name: "formatErrorMessage",
+    reason: "Dependency-light scripts retain a deliberately smaller formatting policy.",
+  },
+] as const satisfies readonly { file: string; name: string; reason: string }[];
+
+const EXCEPTIONAL_COERCION_HELPER_CARVE_OUTS = [
+  {
+    file: "scripts/lib/ci-test-timings-schema.mts",
+    name: "isRecord",
+    kind: "function",
+    reason: "Dependency-free CI preflight runs before install and cannot use workspace resolution.",
+  },
+  {
+    file: "ui/src/test-helpers/control-ui-e2e.ts",
+    name: "isRecord",
+    kind: "function",
+    reason: "Serialized mock Gateway closure cannot capture module imports.",
+  },
+  {
+    file: "src/gateway/mcp-app-standalone-host.ts",
+    name: "asStandaloneRecord",
+    kind: "variable",
+    reason: "Serialized standalone app closure cannot capture module imports.",
+  },
+  {
+    file: "extensions/diffs/src/viewer-payload.ts",
+    name: "isViewerRecord",
+    kind: "function",
+    reason: "Standalone browser asset build cannot resolve workspace package imports.",
+  },
+  {
+    file: "scripts/lib/kova-report-gate.mts",
+    name: "isRecord",
+    kind: "function",
+    reason: "Copied standalone report gate cannot rely on workspace package resolution.",
+  },
+  {
+    file: "scripts/lib/record-shared.mjs",
+    name: "isRecord",
+    kind: "function",
+    reason: "Plain-Node shared helper serves MJS and E2E callers without package resolution.",
+  },
+  {
+    file: "scripts/pr-lib/process-group-runner.mjs",
+    name: "toError",
+    kind: "function",
+    reason:
+      "Bootstrap process supervisor preserves fallback errors without workspace dependencies.",
+  },
+  {
+    file: "scripts/lib/bounded-response.mjs",
+    name: "toLintErrorObject",
+    kind: "function",
+    reason: "Standalone copied response reader cannot resolve workspace packages.",
+  },
+] as const satisfies readonly {
+  file: string;
+  kind: CoercionHelperDeclarationKind;
+  name: string;
+  reason: string;
+}[];
+
+type CanonicalCoercionHelperName =
+  (typeof CANONICAL_COERCION_HELPER_OWNERS)[number]["names"][number];
+type AbsoluteLegacyCoercionHelperName = (typeof ABSOLUTE_LEGACY_COERCION_HELPER_NAMES)[number];
+type ExceptionalCoercionHelperName =
+  (typeof EXCEPTIONAL_COERCION_HELPER_CARVE_OUTS)[number]["name"];
+export type BannedCoercionHelperName =
+  | AbsoluteLegacyCoercionHelperName
+  | CanonicalCoercionHelperName
+  | ExceptionalCoercionHelperName;
+
+export const BANNED_COERCION_HELPER_NAMES: readonly BannedCoercionHelperName[] = [
+  ...new Set<BannedCoercionHelperName>([
+    ...ABSOLUTE_LEGACY_COERCION_HELPER_NAMES,
+    ...CANONICAL_COERCION_HELPER_OWNERS.flatMap(({ names }) => names),
+    ...EXCEPTIONAL_COERCION_HELPER_CARVE_OUTS.map(({ name }) => name),
+  ]),
+];
+const BANNED_HELPER_NAMES: ReadonlySet<string> = new Set(BANNED_COERCION_HELPER_NAMES);
+const BANNED_HELPER_NAME_PATTERN = new RegExp(
+  [...BANNED_HELPER_NAMES].map(escapeRegExp).join("|"),
+  "u",
+);
+// One tracked-tree scan covers root configs plus config, Actions, skills, apps, plugins, and packages.
+const SCAN_ROOTS = ["."];
+const GENERATED_OR_FIXTURE_PATH_RE =
+  /(?:^|\/)(?:\.generated|__generated__|build|coverage|dist|generated|fixtures|node_modules|test-fixtures|vendor)(?:\/|$)|\.generated\.[^/]+$|\.(?:bundle|min)\.[cm]?[jt]sx?$/u;
+
+export type CoercionHelperDeclaration = {
+  file: string;
+  kind: CoercionHelperDeclarationKind;
+  line: number;
+  name: BannedCoercionHelperName;
+};
+
+export type CanonicalCoercionExportClassification = {
+  file: string;
+  name: string;
+  reason?: string;
+  status: "deferred" | "enforced";
+};
+
+export type CanonicalCoercionExportAudit = {
+  invalidClassifications: string[];
+  staleClassifications: CanonicalCoercionExportClassification[];
+  unclassifiedExports: Array<{ file: string; name: string }>;
+};
+
+export type CoercionHelperCarveOut = {
+  file: string;
+  kind: CoercionHelperDeclarationKind;
+  name: BannedCoercionHelperName;
+  reason: string;
+};
+
+function canonicalOwnerCarveOuts(
+  owner: (typeof CANONICAL_COERCION_HELPER_OWNERS)[number],
+): CoercionHelperCarveOut[] {
+  return owner.names.map((name) => ({
+    file: owner.file,
+    kind: owner.kind,
+    name,
+    reason: "Canonical coercion helper owned by this module.",
+  }));
+}
+
+export const COERCION_HELPER_CARVE_OUTS: readonly CoercionHelperCarveOut[] = [
+  ...CANONICAL_COERCION_HELPER_OWNERS.flatMap(canonicalOwnerCarveOuts),
+  ...EXCEPTIONAL_COERCION_HELPER_CARVE_OUTS,
+];
+
+type CoercionHelperAudit = {
+  excessDeclarations: CoercionHelperDeclaration[];
+  invalidCarveOuts: string[];
+  staleCarveOuts: CoercionHelperCarveOut[];
+};
+
+type ScriptIo = {
+  stderr: { write(value: string): unknown };
+  stdout: { write(value: string): unknown };
+};
+
+const COERCION_HELPER_DECLARATION_KINDS = new Set<CoercionHelperDeclarationKind>([
+  "field",
+  "function",
+  "method",
+  "property",
+  "variable",
+]);
+
+function carveOutKey(entry: Pick<CoercionHelperCarveOut, "file" | "kind" | "name">) {
+  return `${entry.file}\0${entry.name}\0${entry.kind}`;
+}
+
+function unwrapCallableInitializer(expression: ts.Expression) {
+  let current = unwrapExpression(expression);
+  while (ts.isSatisfiesExpression(current)) {
+    current = unwrapExpression(current.expression);
+  }
+  return current;
+}
+
+/** Returns true for tracked source files governed by the declaration guard. */
+export function isGovernedCoercionHelperPath(filePath: string) {
+  return (
+    isCodeFile(filePath) &&
+    !/\.d\.[cm]?ts$/u.test(filePath) &&
+    !GENERATED_OR_FIXTURE_PATH_RE.test(filePath)
+  );
+}
+
+function isCallableInitializer(expression: ts.Expression): boolean {
+  const initializer = unwrapCallableInitializer(expression);
+  return ts.isArrowFunction(initializer) || ts.isFunctionExpression(initializer);
+}
+
+function unwrapDirectAliasInitializer(expression: ts.Expression): ts.Expression | undefined {
+  let current = expression;
+  while (true) {
+    if (ts.isParenthesizedExpression(current) || ts.isNonNullExpression(current)) {
+      current = current.expression;
+      continue;
+    }
+    if (ts.isSatisfiesExpression(current)) {
+      current = current.expression;
+      continue;
+    }
+    if (ts.isAsExpression(current) || ts.isTypeAssertionExpression(current)) {
+      return undefined;
+    }
+    return current;
+  }
+}
+
+/** Finds banned callable declarations in one source file. */
+export function findBannedCoercionHelperDeclarations(
+  source: string,
+  file = "source.ts",
+): CoercionHelperDeclaration[] {
+  if (!BANNED_HELPER_NAME_PATTERN.test(source)) {
+    return [];
+  }
+  const scriptKind = file.endsWith("x") ? ts.ScriptKind.TSX : ts.ScriptKind.TS;
+  const sourceFile = ts.createSourceFile(file, source, ts.ScriptTarget.Latest, true, scriptKind);
+  const declarations: CoercionHelperDeclaration[] = [];
+  const visit = (node: ts.Node): void => {
+    if (ts.isFunctionDeclaration(node) && node.name && BANNED_HELPER_NAMES.has(node.name.text)) {
+      declarations.push({
+        file,
+        kind: "function",
+        line: toLine(sourceFile, node.name),
+        name: node.name.text as BannedCoercionHelperName,
+      });
+    } else if (
+      ts.isVariableDeclaration(node) &&
+      ts.isIdentifier(node.name) &&
+      BANNED_HELPER_NAMES.has(node.name.text) &&
+      node.initializer
+    ) {
+      const aliasInitializer = unwrapDirectAliasInitializer(node.initializer);
+      if (
+        isCallableInitializer(node.initializer) ||
+        (aliasInitializer !== undefined &&
+          (ts.isIdentifier(aliasInitializer) || ts.isPropertyAccessExpression(aliasInitializer)))
+      ) {
+        declarations.push({
+          file,
+          kind: "variable",
+          line: toLine(sourceFile, node.name),
+          name: node.name.text as BannedCoercionHelperName,
+        });
+      }
+    } else if (ts.isMethodDeclaration(node)) {
+      const name = getPropertyNameText(node.name);
+      if (name && BANNED_HELPER_NAMES.has(name)) {
+        declarations.push({
+          file,
+          kind: "method",
+          line: toLine(sourceFile, node.name),
+          name: name as BannedCoercionHelperName,
+        });
+      }
+    } else if (ts.isPropertyDeclaration(node) && node.initializer) {
+      const name = getPropertyNameText(node.name);
+      if (name && BANNED_HELPER_NAMES.has(name) && isCallableInitializer(node.initializer)) {
+        declarations.push({
+          file,
+          kind: "field",
+          line: toLine(sourceFile, node.name),
+          name: name as BannedCoercionHelperName,
+        });
+      }
+    } else if (ts.isPropertyAssignment(node)) {
+      const name = getPropertyNameText(node.name);
+      if (name && BANNED_HELPER_NAMES.has(name) && isCallableInitializer(node.initializer)) {
+        declarations.push({
+          file,
+          kind: "property",
+          line: toLine(sourceFile, node.name),
+          name: name as BannedCoercionHelperName,
+        });
+      }
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(sourceFile);
+  return declarations;
+}
+
+function hasExportModifier(node: ts.Node) {
+  return (ts.canHaveModifiers(node) ? (ts.getModifiers(node) ?? []) : []).some(
+    (modifier) => modifier.kind === ts.SyntaxKind.ExportKeyword,
+  );
+}
+
+/** Finds directly declared callable exports in one selected canonical module. */
+export function findExportedCallableNames(source: string, file = "source.ts") {
+  const scriptKind = file.endsWith("x") ? ts.ScriptKind.TSX : ts.ScriptKind.TS;
+  const sourceFile = ts.createSourceFile(file, source, ts.ScriptTarget.Latest, true, scriptKind);
+  const callableLocals = new Set<string>();
+  const exportedNames = new Set<string>();
+
+  for (const statement of sourceFile.statements) {
+    if (ts.isFunctionDeclaration(statement) && statement.name) {
+      callableLocals.add(statement.name.text);
+      if (hasExportModifier(statement)) {
+        exportedNames.add(statement.name.text);
+      }
+      continue;
+    }
+    if (!ts.isVariableStatement(statement)) {
+      continue;
+    }
+    for (const declaration of statement.declarationList.declarations) {
+      if (!ts.isIdentifier(declaration.name) || !declaration.initializer) {
+        continue;
+      }
+      const alias = unwrapDirectAliasInitializer(declaration.initializer);
+      if (
+        !isCallableInitializer(declaration.initializer) &&
+        (!alias || (!ts.isIdentifier(alias) && !ts.isPropertyAccessExpression(alias)))
+      ) {
+        continue;
+      }
+      callableLocals.add(declaration.name.text);
+      if (hasExportModifier(statement)) {
+        exportedNames.add(declaration.name.text);
+      }
+    }
+  }
+
+  for (const statement of sourceFile.statements) {
+    if (
+      !ts.isExportDeclaration(statement) ||
+      statement.moduleSpecifier ||
+      !statement.exportClause ||
+      !ts.isNamedExports(statement.exportClause)
+    ) {
+      continue;
+    }
+    for (const element of statement.exportClause.elements) {
+      const localName = element.propertyName?.text ?? element.name.text;
+      if (!element.isTypeOnly && callableLocals.has(localName)) {
+        exportedNames.add(element.name.text);
+      }
+    }
+  }
+  return [...exportedNames].toSorted();
+}
+
+/** Requires every selected callable export to be enforced or explicitly deferred. */
+export function auditCanonicalCoercionExports(
+  exportsByFile: ReadonlyMap<string, readonly string[]>,
+  classifications: readonly CanonicalCoercionExportClassification[],
+): CanonicalCoercionExportAudit {
+  const invalidClassifications: string[] = [];
+  const byKey = new Map<string, CanonicalCoercionExportClassification>();
+  for (const classification of classifications) {
+    const key = `${classification.file}\0${classification.name}`;
+    if (byKey.has(key)) {
+      invalidClassifications.push(
+        `${classification.file} [${classification.name}] is classified more than once`,
+      );
+      continue;
+    }
+    if (classification.status === "deferred" && !classification.reason?.trim()) {
+      invalidClassifications.push(
+        `${classification.file} [${classification.name}] needs a non-empty deferred reason`,
+      );
+    }
+    byKey.set(key, classification);
+  }
+  const unclassifiedExports = [...exportsByFile].flatMap(([file, names]) =>
+    names.flatMap((name) => (byKey.has(`${file}\0${name}`) ? [] : [{ file, name }])),
+  );
+  const staleClassifications = classifications.filter(
+    ({ file, name }) => !(exportsByFile.get(file) ?? []).includes(name),
+  );
+  return { invalidClassifications, staleClassifications, unclassifiedExports };
+}
+
+/** Checks exact file/name/kind carve-outs and rejects stale or excess entries. */
+export function auditCoercionHelperDeclarations(
+  declarations: readonly CoercionHelperDeclaration[],
+  carveOuts: readonly CoercionHelperCarveOut[],
+): CoercionHelperAudit {
+  const invalidCarveOuts: string[] = [];
+  const carveOutByKey = new Map<string, CoercionHelperCarveOut>();
+  for (const carveOut of carveOuts) {
+    const key = carveOutKey(carveOut);
+    if (carveOutByKey.has(key)) {
+      invalidCarveOuts.push(`${carveOut.file} [${carveOut.name}] is listed more than once`);
+      continue;
+    }
+    if (!BANNED_HELPER_NAMES.has(carveOut.name)) {
+      invalidCarveOuts.push(`${carveOut.file} [${carveOut.name}] is not a banned helper name`);
+    }
+    if (!COERCION_HELPER_DECLARATION_KINDS.has(carveOut.kind)) {
+      invalidCarveOuts.push(
+        `${carveOut.file} [${carveOut.name}] has invalid kind ${carveOut.kind}`,
+      );
+    }
+    if (!carveOut.reason.trim()) {
+      invalidCarveOuts.push(`${carveOut.file} [${carveOut.name}] needs a non-empty reason`);
+    }
+    carveOutByKey.set(key, carveOut);
+  }
+
+  const declarationsByKey = new Map<string, CoercionHelperDeclaration[]>();
+  for (const declaration of declarations) {
+    const key = carveOutKey(declaration);
+    const current = declarationsByKey.get(key) ?? [];
+    current.push(declaration);
+    declarationsByKey.set(key, current);
+  }
+
+  const excessDeclarations: CoercionHelperDeclaration[] = [];
+  for (const [key, actual] of declarationsByKey) {
+    if (carveOutByKey.has(key)) {
+      excessDeclarations.push(...actual.slice(1));
+    } else {
+      excessDeclarations.push(...actual);
+    }
+  }
+  const staleCarveOuts = carveOuts.filter(
+    (carveOut) => !declarationsByKey.has(carveOutKey(carveOut)),
+  );
+
+  return {
+    excessDeclarations: excessDeclarations.toSorted(
+      (left, right) =>
+        left.file.localeCompare(right.file) ||
+        left.line - right.line ||
+        left.name.localeCompare(right.name),
+    ),
+    invalidCarveOuts,
+    staleCarveOuts,
+  };
+}
+
+function writeLine(stream: ScriptIo["stdout"] | ScriptIo["stderr"], value: string) {
+  stream.write(`${value}\n`);
+}
+
+function auditDefaultCanonicalExports(repoRoot: string): CanonicalCoercionExportAudit {
+  const canonicalModules = new Set<string>(CANONICAL_COERCION_MODULES);
+  const mixedModules = new Set<string>(MIXED_CANONICAL_COERCION_MODULES);
+  const auditedModules = [...CANONICAL_COERCION_MODULES, ...MIXED_CANONICAL_COERCION_MODULES];
+  const exportsByFile = new Map(
+    auditedModules.map((file) => {
+      const source = fs.readFileSync(path.join(repoRoot, file), "utf8");
+      const exportedNames = findExportedCallableNames(source, file);
+      if (!mixedModules.has(file)) {
+        return [file, exportedNames] as const;
+      }
+      const registeredNames = new Set<string>(
+        CANONICAL_COERCION_HELPER_OWNERS.filter((owner) => owner.file === file).flatMap(
+          (owner) => owner.names,
+        ),
+      );
+      return [file, exportedNames.filter((name) => registeredNames.has(name))] as const;
+    }),
+  );
+  const classifications: CanonicalCoercionExportClassification[] = [
+    ...CANONICAL_COERCION_HELPER_OWNERS.filter(
+      ({ file }) => canonicalModules.has(file) || mixedModules.has(file),
+    ).flatMap(({ file, names }) =>
+      names.map((name) => ({ file, name, status: "enforced" as const })),
+    ),
+    ...DEFERRED_CANONICAL_COERCION_EXPORTS.map(({ file, name, reason }) => ({
+      file,
+      name,
+      reason,
+      status: "deferred" as const,
+    })),
+  ];
+  return auditCanonicalCoercionExports(exportsByFile, classifications);
+}
+
+/** Runs the full tracked-source declaration guard. */
+export function runCoercionHelperDeclarationGuard(
+  options: {
+    carveOuts?: readonly CoercionHelperCarveOut[];
+    io?: ScriptIo;
+    repoRoot?: string;
+  } = {},
+) {
+  const repoRoot = options.repoRoot ?? resolveRepoRoot(import.meta.url);
+  const io = options.io ?? { stderr: process.stderr, stdout: process.stdout };
+  const carveOuts = options.carveOuts ?? COERCION_HELPER_CARVE_OUTS;
+  const relativeFiles = listRepoFilesSync(repoRoot, {
+    roots: SCAN_ROOTS,
+    includeFile: isGovernedCoercionHelperPath,
+  });
+  const declarations = relativeFiles.flatMap((file) => {
+    const absolutePath = path.join(repoRoot, file);
+    if (!fs.existsSync(absolutePath)) {
+      return [];
+    }
+    return findBannedCoercionHelperDeclarations(fs.readFileSync(absolutePath, "utf8"), file);
+  });
+  const audit = auditCoercionHelperDeclarations(declarations, carveOuts);
+  const exportAudit =
+    options.carveOuts === undefined
+      ? auditDefaultCanonicalExports(repoRoot)
+      : { invalidClassifications: [], staleClassifications: [], unclassifiedExports: [] };
+  const failed =
+    audit.excessDeclarations.length > 0 ||
+    audit.invalidCarveOuts.length > 0 ||
+    audit.staleCarveOuts.length > 0 ||
+    exportAudit.invalidClassifications.length > 0 ||
+    exportAudit.staleClassifications.length > 0 ||
+    exportAudit.unclassifiedExports.length > 0;
+  if (!failed) {
+    writeLine(
+      io.stdout,
+      `Coercion helper declaration guard passed (${declarations.length} allowlisted declarations).`,
+    );
+    return 0;
+  }
+
+  if (audit.invalidCarveOuts.length > 0) {
+    writeLine(io.stderr, "Invalid coercion-helper carve-outs:");
+    for (const message of audit.invalidCarveOuts) {
+      writeLine(io.stderr, `- ${message}`);
+    }
+  }
+  if (audit.excessDeclarations.length > 0) {
+    writeLine(io.stderr, "Banned local coercion-helper declarations:");
+    for (const declaration of audit.excessDeclarations) {
+      writeLine(
+        io.stderr,
+        `- ${declaration.file}:${declaration.line} ${declaration.name} (${declaration.kind} declaration)`,
+      );
+    }
+  }
+  if (audit.staleCarveOuts.length > 0) {
+    writeLine(io.stderr, "Stale coercion-helper carve-outs:");
+    for (const carveOut of audit.staleCarveOuts) {
+      writeLine(
+        io.stderr,
+        `- ${carveOut.file} [${carveOut.name}] has no ${carveOut.kind} declaration; remove the carve-out`,
+      );
+    }
+  }
+  if (exportAudit.invalidClassifications.length > 0) {
+    writeLine(io.stderr, "Invalid canonical-export classifications:");
+    for (const message of exportAudit.invalidClassifications) {
+      writeLine(io.stderr, `- ${message}`);
+    }
+  }
+  if (exportAudit.unclassifiedExports.length > 0) {
+    writeLine(io.stderr, "Unclassified canonical callable exports:");
+    for (const entry of exportAudit.unclassifiedExports) {
+      writeLine(io.stderr, `- ${entry.file} [${entry.name}]`);
+    }
+  }
+  if (exportAudit.staleClassifications.length > 0) {
+    writeLine(io.stderr, "Stale canonical-export classifications:");
+    for (const entry of exportAudit.staleClassifications) {
+      writeLine(io.stderr, `- ${entry.file} [${entry.name}] (${entry.status})`);
+    }
+  }
+  writeLine(
+    io.stderr,
+    "Core/package/UI/workspace-script code: use the matching @openclaw/normalization-core export or module.",
+  );
+  writeLine(
+    io.stderr,
+    "Bundled plugin production code: use the matching openclaw/plugin-sdk runtime; number-runtime is bundled/private-local, not a third-party typed contract.",
+  );
+  writeLine(
+    io.stderr,
+    "Dependency-free, copied, generated, or serialized code: use an existing dependency-light seam or a precise semantic name with an exact reasoned carve-out.",
+  );
+  return 1;
+}
+
+if (isDirectRunUrl(process.argv[1], import.meta.url)) {
+  await runWithFailedTrailer("check:coercion-helpers", () => {
+    process.exitCode = runCoercionHelperDeclarationGuard();
+  });
+}
diff --git a/scripts/check-control-ui-precompressed-assets.mts b/scripts/check-control-ui-precompressed-assets.mts
new file mode 100644
index 0000000000000000000000000000000000000000..c02366ec32e4f8f5c3dd2d4d9fdd81ccf69444e2
--- /dev/null
+++ b/scripts/check-control-ui-precompressed-assets.mts
@@ -0,0 +1,42 @@
+#!/usr/bin/env node
+// Verifies each generated Control UI sidecar encodes the final emitted asset bytes.
+import fs from "node:fs";
+import path from "node:path";
+import { brotliDecompressSync, gunzipSync } from "node:zlib";
+import { resolveRepoRoot } from "./lib/repo-root.mjs";
+const repoRoot: string = resolveRepoRoot(import.meta.url);
+const assetsDir = path.join(repoRoot, "dist", "control-ui", "assets");
+const errors = [];
+let checked = 0;
+
+for (const entry of fs.readdirSync(assetsDir, { withFileTypes: true })) {
+  if (!entry.isFile()) {
+    continue;
+  }
+  const suffix = entry.name.endsWith(".br") ? ".br" : entry.name.endsWith(".gz") ? ".gz" : null;
+  if (!suffix) {
+    continue;
+  }
+  const sidecarPath = path.join(assetsDir, entry.name);
+  const sourcePath = sidecarPath.slice(0, -suffix.length);
+  try {
+    const encoded = fs.readFileSync(sidecarPath);
+    const decoded = suffix === ".br" ? brotliDecompressSync(encoded) : gunzipSync(encoded);
+    const source = fs.readFileSync(sourcePath);
+    if (!decoded.equals(source)) {
+      errors.push(`${entry.name}: decoded bytes differ from ${path.basename(sourcePath)}`);
+    }
+  } catch (error) {
+    errors.push(`${entry.name}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  checked += 1;
+}
+
+if (checked === 0) {
+  errors.push("no precompressed Control UI assets found");
+}
+if (errors.length > 0) {
+  throw new Error(`Control UI precompressed asset verification failed:\n${errors.join("\n")}`);
+}
+
+process.stdout.write(`verified ${checked} finalized Control UI sidecars\n`);
diff --git a/scripts/check-deadcode-exports.mts b/scripts/check-deadcode-exports.mts
new file mode 100644
index 0000000000000000000000000000000000000000..447c09e7b6938663663bac1fb1cd6ff0aa7acc9b
--- /dev/null
+++ b/scripts/check-deadcode-exports.mts
@@ -0,0 +1,171 @@
+#!/usr/bin/env node
+// Enforces a hard-zero policy for Knip's unused exports.
+import { fileURLToPath } from "node:url";
+import {
+  isLikelyRepoFilePath,
+  runKnipScans,
+  type KnipRunResult,
+  uniqueSorted,
+} from "./deadcode-knip-runner.mts";
+
+const KNIP_ISSUES = "exports,nsExports,types,nsTypes,enumMembers,namespaceMembers";
+
+const KNIP_SCANS = [
+  {
+    name: "production unused-export scan",
+    args: ["--config", "config/knip.config.ts", "--production"],
+  },
+  {
+    name: "full-tree unused-export scan",
+    args: ["--config", "config/knip.all-exports.config.ts"],
+  },
+  {
+    name: "script unused-export scan",
+    args: ["--config", "config/knip.scripts-exports.config.ts", "--include-entry-exports"],
+  },
+];
+
+const KNIP_COMMON_ARGS = [
+  "--no-progress",
+  "--reporter",
+  "compact",
+  "--include",
+  KNIP_ISSUES,
+  "--no-config-hints",
+];
+
+/** Parses compact Knip export sections into one path-and-symbol entry per finding. */
+export function parseKnipCompactUnusedExportsResult(output: string) {
+  const entries: string[] = [];
+  let inExportSection = false;
+  let sawExportSection = false;
+
+  for (const line of output.split(/\r?\n/u)) {
+    const sectionMatch =
+      /^(Unused exports|Exports in used namespace|Unused exported types|Exported types in used namespace|Unused exported enum members|Unused exported namespace members) \(\d+\)$/u.exec(
+        line,
+      );
+    if (sectionMatch) {
+      inExportSection = true;
+      sawExportSection = true;
+      continue;
+    }
+    if (/^Unused .+ \(\d+\)$/u.test(line)) {
+      inExportSection = false;
+      continue;
+    }
+    if (!inExportSection) {
+      continue;
+    }
+
+    const separatorIndex = line.indexOf(": ");
+    if (separatorIndex === -1) {
+      continue;
+    }
+    const file = line.slice(0, separatorIndex).trim();
+    if (!isLikelyRepoFilePath(file)) {
+      continue;
+    }
+    const symbols = line.slice(separatorIndex + 2).split(", ");
+    for (const symbol of symbols) {
+      const trimmedSymbol = symbol.trim();
+      if (trimmedSymbol) {
+        entries.push(`${file}: ${trimmedSymbol}`);
+      }
+    }
+  }
+
+  return { entries: uniqueSorted(entries), sawExportSection };
+}
+
+/** Parses compact Knip export sections into one path-and-symbol entry per finding. */
+export function parseKnipCompactUnusedExports(output: string) {
+  return parseKnipCompactUnusedExportsResult(output).entries;
+}
+
+/** Rejects every unused export reported by Knip. */
+export function checkUnusedExports(output: string) {
+  const entries = parseKnipCompactUnusedExports(output);
+  return {
+    ok: entries.length === 0,
+    entries,
+    message:
+      entries.length === 0
+        ? ""
+        : [
+            "Unused exports are not allowed:",
+            ...entries.map((entry) => `  ${entry}`),
+            "Delete the exports or model their real production consumers in Knip.",
+          ].join("\n"),
+  };
+}
+
+/** Classifies Knip export output, rejecting findings after resolution failures. */
+export function checkExportScan(scanName: string, output: string) {
+  const resolutionErrors = output
+    .split(/\r?\n/u)
+    .filter((line) => line.startsWith("ERROR: Error loading "));
+  if (resolutionErrors.length > 0) {
+    return {
+      ok: false,
+      entries: [],
+      message: [
+        `deadcode ${scanName} could not resolve workspace modules; export findings would be unreliable and are discarded.`,
+        ...resolutionErrors,
+        "Install workspace dependencies in-tree (pnpm install) — on delegated boxes the crabbox wrapper links the hydrated modules dir into the workdir — and rerun.",
+      ].join("\n"),
+    };
+  }
+
+  const check = checkUnusedExports(output);
+  return {
+    ...check,
+    message: check.ok ? "" : `${scanName}:\n${check.message}`,
+  };
+}
+
+function reportUnusedExportScan(scan: (typeof KNIP_SCANS)[number], result: KnipRunResult) {
+  if (result.errorCode || result.status === null) {
+    console.error(
+      `deadcode ${scan.name} failed: ${result.errorCode ?? result.signal ?? "unknown"}${
+        result.errorMessage ? `: ${result.errorMessage}` : ""
+      }`,
+    );
+    if (result.output) {
+      console.error(result.output);
+    }
+    return false;
+  }
+
+  const check = checkExportScan(scan.name, result.output);
+  if (!check.ok) {
+    console.error(check.message);
+    return false;
+  }
+
+  const parsed = parseKnipCompactUnusedExportsResult(result.output);
+  // Knip's compact reporter omits empty sections, so a clean scan (exit 0)
+  // legitimately prints no export sections; sectionless output is only a
+  // failure signal when Knip also exited nonzero (crash/config error).
+  if (!parsed.sawExportSection && result.status !== 0) {
+    console.error(`deadcode ${scan.name} produced no export sections.`);
+    if (result.output) {
+      console.error(result.output);
+    }
+    return false;
+  }
+
+  if (result.status !== 0) {
+    console.error(`deadcode ${scan.name} exited with status ${result.status}.`);
+    if (result.output) {
+      console.error(result.output);
+    }
+    return false;
+  }
+  console.log(`[deadcode] Knip ${scan.name} passed with 0 entries.`);
+  return true;
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+  await runKnipScans(KNIP_SCANS, KNIP_COMMON_ARGS, reportUnusedExportScan);
+}
diff --git a/scripts/check-docs-config-examples.mts b/scripts/check-docs-config-examples.mts
new file mode 100644
index 0000000000000000000000000000000000000000..247e8e0f641b093dc2d10d523f5c78c561f88e0b
--- /dev/null
+++ b/scripts/check-docs-config-examples.mts
@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { auditDocsConfigExamples } from "../src/config/docs-config-examples.js";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const result = auditDocsConfigExamples({ repoRoot });
+
+console.log(`docs_config_files_scanned=${result.stats.filesScanned}`);
+console.log(`docs_config_fences_seen=${result.stats.fencesSeen}`);
+console.log(`docs_config_fences_validated=${result.stats.candidatesValidated}`);
+console.log(`docs_config_fences_skipped=${result.stats.fencesSkipped}`);
+console.log(`docs_config_skipped_unsupported_language=${result.stats.skippedUnsupportedLanguage}`);
+console.log(`docs_config_skipped_opt_out=${result.stats.skippedOptOut}`);
+console.log(`docs_config_skipped_parse_failure=${result.stats.skippedParseFailure}`);
+console.log(`docs_config_skipped_non_object=${result.stats.skippedNonObject}`);
+console.log(`docs_config_skipped_fragment=${result.stats.skippedFragment}`);
+
+for (const finding of result.findings) {
+  console.log(
+    `${finding.filePath}:${finding.fenceStartLine} :: ${finding.issuePath} :: ${finding.message}`,
+  );
+}
+
+if (result.findings.length > 0) {
+  console.log(
+    "Update each example to the current schema, or annotate a deliberately partial or illustrative fence with validate=false.",
+  );
+  process.exit(1);
+}
diff --git a/scripts/check-duplicates.mjs b/scripts/check-duplicates.mjs
new file mode 100644
index 0000000000000000000000000000000000000000..385adfd9cf290439c3cb221442e8d208a4049ebd
--- /dev/null
+++ b/scripts/check-duplicates.mjs
@@ -0,0 +1,6 @@
+import { runTsxCliShim } from "./lib/tsx-cli-shim.mjs";
+
+await runTsxCliShim(import.meta.url, {
+  implementation: "./check-duplicates.mts",
+  failureTool: "dup:check",
+});
diff --git a/scripts/check-dynamic-import-warts.mts b/scripts/check-dynamic-import-warts.mts
new file mode 100644
index 0000000000000000000000000000000000000000..92de02d06fcf638d899f1a636309d4d05c1dd890
--- /dev/null
+++ b/scripts/check-dynamic-import-warts.mts
@@ -0,0 +1,205 @@
+#!/usr/bin/env node
+
+// Advises on ineffective or suspicious dynamic import patterns.
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import ts from "typescript";
+import { resolveRepoRoot } from "./lib/repo-root.mjs";
+import { collectTypeScriptFilesFromRoots, runAsScript, toLine } from "./lib/ts-guard-utils.mts";
+
+const repoRoot = resolveRepoRoot(import.meta.url);
+const defaultRoots = [path.join(repoRoot, "src"), path.join(repoRoot, "extensions")];
+
+type DynamicImportAdvisory = { line: number; reason: string };
+type ImportLines = Map<string, [number, ...number[]]>;
+
+function isTypeOnlyImportDeclaration(node: ts.ImportDeclaration) {
+  const clause = node.importClause;
+  return Boolean(
+    clause &&
+    (ts.isTypeOnlyImportDeclaration(clause) ||
+      (!clause.name &&
+        clause.namedBindings &&
+        ts.isNamedImports(clause.namedBindings) &&
+        clause.namedBindings.elements.length > 0 &&
+        clause.namedBindings.elements.every(ts.isTypeOnlyImportOrExportDeclaration))),
+  );
+}
+
+function isTypeOnlyExportDeclaration(node: ts.ExportDeclaration) {
+  const clause = node.exportClause;
+  return (
+    node.isTypeOnly ||
+    Boolean(
+      clause &&
+      ts.isNamedExports(clause) &&
+      clause.elements.length > 0 &&
+      clause.elements.every(ts.isTypeOnlyImportOrExportDeclaration),
+    )
+  );
+}
+
+function isExecuteDeclaration(node: ts.Node) {
+  if (
+    !ts.isFunctionDeclaration(node) &&
+    !ts.isMethodDeclaration(node) &&
+    !ts.isVariableDeclaration(node) &&
+    !ts.isPropertyAssignment(node)
+  ) {
+    return false;
+  }
+  const name = ts.getNameOfDeclaration(node);
+  return Boolean(
+    name && (ts.isIdentifier(name) || ts.isStringLiteral(name)) && name.text === "execute",
+  );
+}
+
+function isIgnoredTestHelperContent(content: string) {
+  return /\bfrom\s+["']vitest["']/.test(content) || /\bfrom\s+["']@vitest\//.test(content);
+}
+
+function isIgnoredTestHelperPath(filePath: string) {
+  const normalized = filePath.split(path.sep).join("/");
+  const base = path.basename(filePath);
+  return (
+    normalized.includes("/test/") ||
+    /(?:^|[./-])test(?:[./-]|$)/.test(base) ||
+    base.includes("test-support") ||
+    base.includes("test-harness") ||
+    base.includes("test-helper") ||
+    base.includes("test-mocks")
+  );
+}
+
+/**
+ * Finds dynamic import advisories in a single source file.
+ */
+export function findDynamicImportAdvisories(content: string, fileName = "source.ts") {
+  const sourceFile = ts.createSourceFile(fileName, content, ts.ScriptTarget.Latest, true);
+  const staticRuntimeImports: ImportLines = new Map();
+  const dynamicImports: ImportLines = new Map();
+  const directExecuteImports: DynamicImportAdvisory[] = [];
+
+  const addLine = (map: ImportLines, specifier: string, line: number) => {
+    const lines = map.get(specifier);
+    if (lines) {
+      lines.push(line);
+    } else {
+      map.set(specifier, [line]);
+    }
+  };
+
+  const visit = (node: ts.Node) => {
+    if (
+      ts.isImportDeclaration(node) &&
+      ts.isStringLiteral(node.moduleSpecifier) &&
+      !isTypeOnlyImportDeclaration(node)
+    ) {
+      addLine(staticRuntimeImports, node.moduleSpecifier.text, toLine(sourceFile, node));
+    }
+
+    if (
+      ts.isExportDeclaration(node) &&
+      node.moduleSpecifier &&
+      ts.isStringLiteral(node.moduleSpecifier) &&
+      !isTypeOnlyExportDeclaration(node)
+    ) {
+      addLine(staticRuntimeImports, node.moduleSpecifier.text, toLine(sourceFile, node));
+    }
+
+    if (
+      ts.isCallExpression(node) &&
+      node.expression.kind === ts.SyntaxKind.ImportKeyword &&
+      node.arguments.length > 0
+    ) {
+      const argument = node.arguments[0];
+      const specifier = argument && ts.isStringLiteralLike(argument) ? argument.text : null;
+      if (specifier) {
+        const line = toLine(sourceFile, node);
+        addLine(dynamicImports, specifier, line);
+        if (ts.findAncestor(node, isExecuteDeclaration)) {
+          directExecuteImports.push({
+            line,
+            reason: `direct dynamic import of "${specifier}" inside execute path; move it behind a cached loader`,
+          });
+        }
+      }
+    }
+
+    ts.forEachChild(node, visit);
+  };
+
+  visit(sourceFile);
+
+  const advisories = [...directExecuteImports];
+  for (const [specifier, dynamicLines] of dynamicImports) {
+    const staticLines = staticRuntimeImports.get(specifier);
+    if (staticLines?.length) {
+      advisories.push({
+        line: dynamicLines[0],
+        reason: `runtime static + dynamic import of "${specifier}" (static line ${staticLines[0]})`,
+      });
+    }
+    if (dynamicLines.length > 1) {
+      advisories.push({
+        line: dynamicLines[0],
+        reason: `repeated direct dynamic import of "${specifier}" (${dynamicLines.length} callsites: ${dynamicLines.join(", ")})`,
+      });
+    }
+  }
+  return advisories;
+}
+
+/**
+ * Collects dynamic import advisories across configured source roots.
+ */
+async function collectDynamicImportAdvisories(options: { roots?: string[] } = {}) {
+  const roots = options.roots ?? defaultRoots;
+  const files = await collectTypeScriptFilesFromRoots(roots, {
+    extraTestSuffixes: [".suite.ts"],
+  });
+  const advisories: Array<DynamicImportAdvisory & { path: string }> = [];
+  for (const filePath of files) {
+    if (isIgnoredTestHelperPath(filePath)) {
+      continue;
+    }
+    const content = await fs.readFile(filePath, "utf8");
+    if (isIgnoredTestHelperContent(content)) {
+      continue;
+    }
+    for (const advisory of findDynamicImportAdvisories(content, filePath)) {
+      advisories.push({
+        path: path.relative(repoRoot, filePath),
+        ...advisory,
+      });
+    }
+  }
+  return advisories;
+}
+
+/**
+ * Runs the dynamic import advisory check.
+ */
+export async function main(argv = process.argv.slice(2)) {
+  const fail = argv.includes("--fail");
+  const json = argv.includes("--json");
+  const advisories = await collectDynamicImportAdvisories();
+
+  if (json) {
+    console.log(JSON.stringify({ advisories }, null, 2));
+  } else if (advisories.length === 0) {
+    console.log("No dynamic import advisories found.");
+  } else {
+    console.log(`Dynamic import advisories (${advisories.length}):`);
+    for (const advisory of advisories) {
+      console.log(`- ${advisory.path}:${advisory.line} ${advisory.reason}`);
+    }
+    console.log("Advisory only. Use --fail when ratcheting this into a hard check.");
+  }
+
+  if (fail && advisories.length > 0) {
+    process.exit(1);
+  }
+}
+
+runAsScript(import.meta.url, main);
diff --git a/scripts/check-gateway-cpu-scenarios.mts b/scripts/check-gateway-cpu-scenarios.mts
new file mode 100644
index 0000000000000000000000000000000000000000..7ea6e8613d795618715f8c028b95fac532c5cd32
--- /dev/null
+++ b/scripts/check-gateway-cpu-scenarios.mts
@@ -0,0 +1,661 @@
+#!/usr/bin/env node
+
+// Runs gateway startup and QA scenarios while checking hot CPU observations.
+import {
+  spawnSync as defaultSpawnSync,
+  type SpawnSyncOptions,
+  type SpawnSyncReturns,
+} from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { pathToFileURL } from "node:url";
+import { isRecord } from "@openclaw/normalization-core/record-coerce";
+import { stripLeadingPackageManagerSeparator } from "./lib/arg-utils.mts";
+import {
+  parseNonNegativeInt,
+  parsePositiveInt,
+  parsePositiveNumber,
+} from "./lib/numeric-options.mjs";
+import {
+  collectGatewayCpuObservations,
+  readQaSuiteSummary,
+} from "./lib/plugin-gateway-gauntlet.mts";
+import { createPnpmRunnerSpawnSpec } from "./pnpm-runner.mts";
+
+const DEFAULT_STARTUP_CASES = ["default", "oneInternalHook", "allInternalHooks"];
+const DEFAULT_QA_SCENARIOS = [
+  "channel-chat-baseline",
+  "memory-failure-fallback",
+  "gateway-restart-inflight-run",
+];
+const SINGLE_VALUE_FLAGS = new Set([
+  "--cpu-core-warn",
+  "--hot-wall-warn-ms",
+  "--output-dir",
+  "--runs",
+  "--warmup",
+]);
+const DEFAULT_CPU_CORE_WARN = 0.9;
+const DEFAULT_HOT_WALL_WARN_MS = 30_000;
+const DEFAULT_GATEWAY_CONCURRENCY = 8;
+// Local N=8 mock-stream p99s were 1.3-1.5s on the shared maintainer host;
+// 3s leaves roughly 2x headroom while still flagging a material regression.
+const CONCURRENCY_EVENT_LOOP_DELAY_P99_WARN_MS = 3_000;
+const CONCURRENCY_RPC_P99_WARN_MS = 3_000;
+const CONCURRENCY_CONTROL_UI_P99_WARN_MS = 3_000;
+const PRIVATE_QA_REQUIRED_DIST_ENTRIES = [
+  "dist/plugin-sdk/qa-lab.js",
+  "dist/plugin-sdk/qa-runtime.js",
+];
+
+type SpawnSyncResultLike = Partial<Pick<SpawnSyncReturns<Buffer>, "error" | "signal" | "status">>;
+type SpawnSyncFn = (
+  command: string,
+  args: string[],
+  options: SpawnSyncOptions,
+) => SpawnSyncResultLike;
+type GatewayCpuRunParams = {
+  argv?: string[];
+  cwd?: string;
+  env?: NodeJS.ProcessEnv;
+  fs?: Pick<typeof fs, "statSync">;
+  silent?: boolean;
+  spawnSync?: SpawnSyncFn;
+};
+type ConcurrencyReport = {
+  summary: {
+    eventLoopDelayP99Ms?: { max?: number };
+    sessionsListLatencyMs?: { p99?: number };
+    controlUiLatencyMs?: { p99?: number };
+  };
+};
+
+function parseArgs(argv: string[]) {
+  const args = stripLeadingPackageManagerSeparator(argv);
+  const options = {
+    outputDir: path.join(
+      process.cwd(),
+      ".artifacts",
+      "gateway-cpu-scenarios",
+      new Date().toISOString().replace(/[:.]/g, "-"),
+    ),
+    startupCases: Array<string>(),
+    qaScenarios: Array<string>(),
+    runs: 1,
+    warmup: 0,
+    skipStartup: false,
+    skipQa: false,
+    cpuCoreWarn: DEFAULT_CPU_CORE_WARN,
+    hotWallWarnMs: DEFAULT_HOT_WALL_WARN_MS,
+  };
+  const seenSingleValueFlags = new Set<string>();
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index]!;
+    if (SINGLE_VALUE_FLAGS.has(arg)) {
+      if (seenSingleValueFlags.has(arg)) {
+        throw new Error(`${arg} was provided more than once`);
+      }
+      seenSingleValueFlags.add(arg);
+    }
+    const readValue = () => {
+      const value = args[index + 1];
+      if (!value || value.startsWith("-")) {
+        throw new Error(`Missing value for ${arg}`);
+      }
+      index += 1;
+      return value;
+    };
+    switch (arg) {
+      case "--output-dir":
+        options.outputDir = path.resolve(readValue());
+        break;
+      case "--startup-case":
+        options.startupCases.push(readValue());
+        break;
+      case "--qa-scenario":
+        options.qaScenarios.push(readValue());
+        break;
+      case "--runs":
+        options.runs = parsePositiveInt(readValue(), "--runs");
+        break;
+      case "--warmup":
+        options.warmup = parseNonNegativeInt(readValue(), "--warmup");
+        break;
+      case "--cpu-core-warn":
+        options.cpuCoreWarn = parsePositiveNumber(readValue(), "--cpu-core-warn");
+        break;
+      case "--hot-wall-warn-ms":
+        options.hotWallWarnMs = parsePositiveInt(readValue(), "--hot-wall-warn-ms");
+        break;
+      case "--skip-startup":
+        options.skipStartup = true;
+        break;
+      case "--skip-qa":
+        options.skipQa = true;
+        break;
+      case "--help":
+        printHelp();
+        process.exit(0);
+        break;
+      default:
+        throw new Error(`Unknown argument: ${arg}`);
+    }
+  }
+  if (options.startupCases.length === 0) {
+    options.startupCases = [...DEFAULT_STARTUP_CASES];
+  }
+  if (options.qaScenarios.length === 0) {
+    options.qaScenarios = [...DEFAULT_QA_SCENARIOS];
+  }
+  if (options.skipStartup && options.skipQa) {
+    throw new Error("--skip-startup and --skip-qa cannot be used together");
+  }
+  return options;
+}
+
+function printHelp() {
+  console.log(`Usage: pnpm test:gateway:cpu-scenarios [options]
+
+Runs a small gateway CPU scenario suite against built dist artifacts.
+
+Options:
+  --output-dir <path>        Artifact directory
+  --startup-case <id>        Startup bench case, repeatable
+  --qa-scenario <id>         QA Lab scenario, repeatable
+  --runs <count>             Startup bench runs per case (default: 1)
+  --warmup <count>           Startup bench warmup runs per case (default: 0)
+  --cpu-core-warn <ratio>    Hot CPU observation threshold (default: 0.9)
+  --hot-wall-warn-ms <ms>    Minimum wall time for hot CPU observations (default: 30000)
+  --skip-startup             Skip startup bench
+  --skip-qa                  Skip QA Lab scenario smoke
+`);
+}
+
+function readJsonIfExists(filePath: string): unknown {
+  if (!fs.existsSync(filePath)) {
+    return null;
+  }
+  return JSON.parse(fs.readFileSync(filePath, "utf8"));
+}
+
+function validateStartupReport(report: unknown): string | null {
+  if (!isRecord(report)) {
+    return "startup report must be a JSON object";
+  }
+  if (!Array.isArray(report.results)) {
+    return "startup report missing results array";
+  }
+  if (report.results.length === 0) {
+    return "startup report has no measured results";
+  }
+  return null;
+}
+
+function readStartupReport(startupOutput: string) {
+  if (!fs.existsSync(startupOutput)) {
+    return {
+      diagnosticFailure: "startup-report-missing",
+      diagnosticDetail: `expected startup bench report at ${startupOutput}`,
+      report: null,
+    };
+  }
+  try {
+    const report = readJsonIfExists(startupOutput);
+    const invalidReason = validateStartupReport(report);
+    if (invalidReason) {
+      return {
+        diagnosticFailure: "startup-report-invalid",
+        diagnosticDetail: invalidReason,
+        report: null,
+      };
+    }
+    return {
+      diagnosticFailure: null,
+      diagnosticDetail: null,
+      report,
+    };
+  } catch (error) {
+    return {
+      diagnosticFailure: "startup-report-invalid",
+      diagnosticDetail: error instanceof Error ? error.message : String(error),
+      report: null,
+    };
+  }
+}
+
+function validateConcurrencyReport(report: unknown): string | null {
+  if (!isRecord(report)) {
+    return "concurrency report must be a JSON object";
+  }
+  if (report.mode !== "mock-streaming-agent") {
+    return "concurrency report has an unexpected mode";
+  }
+  if (!Array.isArray(report.runs) || report.runs.length === 0) {
+    return "concurrency report has no measured runs";
+  }
+  if (!isRecord(report.summary)) {
+    return "concurrency report missing summary";
+  }
+  return null;
+}
+
+function readConcurrencyReport(concurrencyOutput: string) {
+  if (!fs.existsSync(concurrencyOutput)) {
+    return {
+      diagnosticFailure: "concurrency-report-missing",
+      diagnosticDetail: `expected concurrency bench report at ${concurrencyOutput}`,
+      report: null,
+    };
+  }
+  try {
+    const report = readJsonIfExists(concurrencyOutput);
+    const invalidReason = validateConcurrencyReport(report);
+    return invalidReason
+      ? {
+          diagnosticFailure: "concurrency-report-invalid",
+          diagnosticDetail: invalidReason,
+          report: null,
+        }
+      : {
+          diagnosticFailure: null,
+          diagnosticDetail: null,
+          report: report as ConcurrencyReport,
+        };
+  } catch (error) {
+    return {
+      diagnosticFailure: "concurrency-report-invalid",
+      diagnosticDetail: error instanceof Error ? error.message : String(error),
+      report: null,
+    };
+  }
+}
+
+function collectConcurrencyWarnings(report: ConcurrencyReport | null) {
+  if (!report?.summary) {
+    return [];
+  }
+  const candidates = [
+    {
+      kind: "event-loop-delay-p99",
+      value: report.summary.eventLoopDelayP99Ms?.max,
+      threshold: CONCURRENCY_EVENT_LOOP_DELAY_P99_WARN_MS,
+    },
+    {
+      kind: "sessions-list-p99",
+      value: report.summary.sessionsListLatencyMs?.p99,
+      threshold: CONCURRENCY_RPC_P99_WARN_MS,
+    },
+    {
+      kind: "control-ui-p99",
+      value: report.summary.controlUiLatencyMs?.p99,
+      threshold: CONCURRENCY_CONTROL_UI_P99_WARN_MS,
+    },
+  ];
+  return candidates.flatMap((candidate) =>
+    typeof candidate.value === "number" && candidate.value > candidate.threshold ? [candidate] : [],
+  );
+}
+
+function runStep(
+  name: string,
+  command: string,
+  args: string[],
+  options: SpawnSyncOptions = {},
+  params: GatewayCpuRunParams = {},
+) {
+  console.error(`[gateway-cpu] start ${name}`);
+  const spawn = params.spawnSync ?? defaultSpawnSync;
+  const result = spawn(command, args, {
+    cwd: params.cwd ?? process.cwd(),
+    env: params.env ?? process.env,
+    stdio: "inherit",
+    ...options,
+  });
+  const error = result.error instanceof Error ? result.error.message : null;
+  const status = result.error ? 1 : (result.status ?? (result.signal ? 1 : 0));
+  console.error(
+    `[gateway-cpu] ${status === 0 ? "pass" : "fail"} ${name}${error ? `: ${error}` : ""}`,
+  );
+  return {
+    name,
+    status,
+    signal: result.signal ?? null,
+    ...(error ? { error } : {}),
+  };
+}
+
+function pnpmCommand(args: string[], params: Pick<GatewayCpuRunParams, "cwd" | "env"> = {}) {
+  return createPnpmRunnerSpawnSpec({
+    cwd: params.cwd ?? process.cwd(),
+    env: params.env ?? process.env,
+    pnpmArgs: args,
+    stdio: "inherit",
+  });
+}
+
+function toRepoRelativePath(repoRoot: string, absolutePath: string): string {
+  const relativePath = path.relative(repoRoot, absolutePath);
+  if (!relativePath || relativePath.startsWith("..") || path.isAbsolute(relativePath)) {
+    throw new Error(`Output path must stay inside the repo root: ${absolutePath}`);
+  }
+  return relativePath;
+}
+
+function hasPrivateQaDist(repoRoot: string, fsImpl: Pick<typeof fs, "statSync"> = fs): boolean {
+  return PRIVATE_QA_REQUIRED_DIST_ENTRIES.every((relativePath) => {
+    try {
+      return fsImpl.statSync(path.join(repoRoot, relativePath)).isFile();
+    } catch {
+      return false;
+    }
+  });
+}
+
+function buildPrivateQaEnv(
+  env: NodeJS.ProcessEnv,
+  qaState: ReturnType<typeof createQaState> | null,
+): NodeJS.ProcessEnv {
+  return {
+    ...env,
+    ...(qaState
+      ? {
+          HOME: qaState.home,
+          USERPROFILE: qaState.home,
+          OPENCLAW_HOME: qaState.home,
+          OPENCLAW_STATE_DIR: qaState.stateDir,
+          OPENCLAW_CONFIG_PATH: qaState.configPath,
+        }
+      : {}),
+    OPENCLAW_BUILD_PRIVATE_QA: "1",
+    OPENCLAW_ENABLE_PRIVATE_QA_CLI: "1",
+    OPENCLAW_RUN_NODE_SKIP_DTS_BUILD: env.OPENCLAW_RUN_NODE_SKIP_DTS_BUILD ?? "1",
+    OPENCLAW_TEST_DISABLE_UPDATE_CHECK: env.OPENCLAW_TEST_DISABLE_UPDATE_CHECK ?? "1",
+    PNPM_CONFIG_VERIFY_DEPS_BEFORE_RUN: "false",
+  };
+}
+
+function createQaState(outputDir: string) {
+  const root = path.join(outputDir, "qa-state-root");
+  const home = path.join(root, "home");
+  const stateDir = path.join(root, "state");
+  return {
+    configPath: path.join(stateDir, "openclaw.json"),
+    home,
+    root,
+    stateDir,
+  };
+}
+
+async function runGatewayCpuScenarios(
+  options: ReturnType<typeof parseArgs>,
+  params: GatewayCpuRunParams = {},
+) {
+  const repoRoot = params.cwd ?? process.cwd();
+  const inputEnv = params.env ?? process.env;
+  const baseEnv = {
+    ...inputEnv,
+    PNPM_CONFIG_VERIFY_DEPS_BEFORE_RUN: "false",
+  };
+  fs.mkdirSync(options.outputDir, { recursive: true });
+
+  const startupOutput = path.join(options.outputDir, "gateway-startup-bench.json");
+  const concurrencyOutput = path.join(options.outputDir, "gateway-concurrency-bench.json");
+  const qaOutputDir = path.join(options.outputDir, "qa-suite");
+  const qaSummaryPath = path.join(qaOutputDir, "qa-suite-summary.json");
+  const qaState = options.skipQa ? null : createQaState(options.outputDir);
+  if (qaState) {
+    fs.mkdirSync(qaState.home, { recursive: true });
+    fs.mkdirSync(qaState.stateDir, { recursive: true });
+  }
+  const qaBuildEnv = buildPrivateQaEnv(baseEnv, qaState);
+  const qaOutputArg = toRepoRelativePath(repoRoot, qaOutputDir);
+  const steps: Array<ReturnType<typeof runStep>> = [];
+
+  if (!options.skipStartup) {
+    const startupBuild = runStep(
+      "startup build",
+      process.execPath,
+      ["--import", "tsx", "scripts/ensure-cli-startup-build.mts"],
+      { env: baseEnv },
+      params,
+    );
+    steps.push(startupBuild);
+    steps.push(
+      startupBuild.status === 0
+        ? runStep(
+            "startup bench",
+            process.execPath,
+            [
+              "--import",
+              "tsx",
+              "scripts/bench-gateway-startup.ts",
+              "--runs",
+              String(options.runs),
+              "--warmup",
+              String(options.warmup),
+              "--output",
+              startupOutput,
+              ...options.startupCases.flatMap((id) => ["--case", id]),
+            ],
+            { env: baseEnv },
+            params,
+          )
+        : { name: "startup bench", signal: null, status: 1 },
+    );
+    steps.push(
+      startupBuild.status === 0
+        ? runStep(
+            "concurrency bench",
+            process.execPath,
+            [
+              "--import",
+              "tsx",
+              "scripts/bench-gateway-concurrency.ts",
+              "--concurrency",
+              String(DEFAULT_GATEWAY_CONCURRENCY),
+              "--workspace-fanout",
+              // Post-fix readyz/sessions.list p100 is 1.3-2.6s across environments;
+              // 4s still catches the pre-fix 8s+ stalls and handshake timeouts.
+              "--max-control-ms",
+              "4000",
+              "--max-handshake-ms",
+              "2000",
+              "--runs",
+              String(options.runs),
+              "--warmup",
+              String(options.warmup),
+              "--output",
+              concurrencyOutput,
+            ],
+            { env: baseEnv },
+            params,
+          )
+        : { name: "concurrency bench", signal: null, status: 1 },
+    );
+  }
+
+  let privateQaBuildFailed = false;
+  if (!options.skipQa && !hasPrivateQaDist(repoRoot, params.fs ?? fs)) {
+    const privateQaBuild = runStep(
+      "private QA build",
+      process.execPath,
+      ["--import", "tsx", "scripts/build-all.mts", "qaRuntime"],
+      { env: qaBuildEnv },
+      params,
+    );
+    steps.push(privateQaBuild);
+    privateQaBuildFailed = privateQaBuild.status !== 0;
+  }
+
+  if (!options.skipQa) {
+    steps.push(
+      privateQaBuildFailed
+        ? { name: "node worker finalization gate", signal: null, status: 1 }
+        : runStep(
+            "node worker finalization gate",
+            process.execPath,
+            [
+              "scripts/run-vitest.mjs",
+              "test/e2e/qa-lab/runtime/node-worker-launch-wire.e2e.test.ts",
+            ],
+            { env: qaBuildEnv },
+            params,
+          ),
+    );
+  }
+
+  let qaStep = null;
+  if (!options.skipQa) {
+    const qaCommand = pnpmCommand(
+      [
+        "openclaw",
+        "qa",
+        "suite",
+        "--provider-mode",
+        "mock-openai",
+        "--concurrency",
+        "1",
+        "--output-dir",
+        qaOutputArg,
+        ...options.qaScenarios.flatMap((id) => ["--scenario", id]),
+      ],
+      { cwd: repoRoot, env: qaBuildEnv },
+    );
+    qaStep = privateQaBuildFailed
+      ? { name: "qa suite", signal: null, status: 1 }
+      : runStep("qa suite", qaCommand.command, qaCommand.args, qaCommand.options, params);
+    steps.push(qaStep);
+  }
+
+  const startupReportResult = options.skipStartup ? null : readStartupReport(startupOutput);
+  const startupReportFailure =
+    steps.find((step) => step.name === "startup bench")?.status === 0
+      ? (startupReportResult?.diagnosticFailure ?? null)
+      : null;
+  const startup = startupReportResult?.report ?? null;
+  const concurrencyReportResult = options.skipStartup
+    ? null
+    : readConcurrencyReport(concurrencyOutput);
+  const concurrencyReportFailure =
+    steps.find((step) => step.name === "concurrency bench")?.status === 0
+      ? (concurrencyReportResult?.diagnosticFailure ?? null)
+      : null;
+  const concurrency = concurrencyReportResult?.report ?? null;
+  const concurrencyWarnings = collectConcurrencyWarnings(concurrency);
+  const qaSummaryResult = options.skipQa ? null : readQaSuiteSummary(qaSummaryPath);
+  const qaSummaryFailure =
+    qaStep?.status === 0 ? (qaSummaryResult?.diagnosticFailure ?? null) : null;
+  const qa = qaSummaryResult?.summary ?? null;
+  const qaObservationSummary = qa && isRecord(qa.metrics) ? { metrics: qa.metrics } : undefined;
+  const observations = collectGatewayCpuObservations({
+    startup,
+    qa: qaObservationSummary,
+    cpuCoreWarn: options.cpuCoreWarn,
+    hotWallWarnMs: options.hotWallWarnMs,
+  });
+  const summary = {
+    generatedAt: new Date().toISOString(),
+    outputDir: options.outputDir,
+    startupOutput: fs.existsSync(startupOutput) ? startupOutput : null,
+    concurrencyOutput: fs.existsSync(concurrencyOutput) ? concurrencyOutput : null,
+    qaSummary: fs.existsSync(qaSummaryPath) ? qaSummaryPath : null,
+    ...(startupReportFailure
+      ? {
+          startupReportFailure,
+          startupReportFailureDetail: startupReportResult?.diagnosticDetail ?? null,
+        }
+      : {}),
+    ...(qaSummaryFailure
+      ? {
+          qaSummaryFailure,
+          qaSummaryFailureDetail: qaSummaryResult?.diagnosticDetail ?? null,
+        }
+      : {}),
+    ...(concurrencyReportFailure
+      ? {
+          concurrencyReportFailure,
+          concurrencyReportFailureDetail: concurrencyReportResult?.diagnosticDetail ?? null,
+        }
+      : {}),
+    options: {
+      startupCases: options.startupCases,
+      qaScenarios: options.qaScenarios,
+      runs: options.runs,
+      warmup: options.warmup,
+      cpuCoreWarn: options.cpuCoreWarn,
+      hotWallWarnMs: options.hotWallWarnMs,
+      concurrency: DEFAULT_GATEWAY_CONCURRENCY,
+      concurrencyWarnThresholds: {
+        eventLoopDelayP99Ms: CONCURRENCY_EVENT_LOOP_DELAY_P99_WARN_MS,
+        sessionsListP99Ms: CONCURRENCY_RPC_P99_WARN_MS,
+        controlUiP99Ms: CONCURRENCY_CONTROL_UI_P99_WARN_MS,
+      },
+      qaStateDir: qaState?.stateDir ?? null,
+    },
+    steps,
+    observations,
+    concurrencyWarnings,
+  };
+  const summaryPath = path.join(options.outputDir, "summary.json");
+  fs.writeFileSync(summaryPath, `${JSON.stringify(summary, null, 2)}\n`);
+  if (!params.silent) {
+    console.log(JSON.stringify(summary, null, 2));
+  }
+  if (observations.length > 0) {
+    console.error(
+      `[gateway-cpu] fail hot CPU observations: ${observations
+        .map((observation) => `${observation.kind}:${observation.id}`)
+        .join(", ")}`,
+    );
+  }
+  if (qaSummaryFailure) {
+    console.error(`[gateway-cpu] fail QA summary: ${qaSummaryResult?.diagnosticDetail}`);
+  }
+  if (startupReportFailure) {
+    console.error(`[gateway-cpu] fail startup report: ${startupReportResult?.diagnosticDetail}`);
+  }
+  for (const warning of concurrencyWarnings) {
+    console.error(
+      `[gateway-cpu] warn ${warning.kind}: ${warning.value}ms > ${warning.threshold}ms`,
+    );
+  }
+  if (concurrencyReportFailure) {
+    console.error(
+      `[gateway-cpu] fail concurrency report: ${concurrencyReportResult?.diagnosticDetail}`,
+    );
+  }
+
+  const exitCode =
+    steps.some((step) => step.status !== 0) ||
+    observations.length > 0 ||
+    qaSummaryFailure ||
+    startupReportFailure ||
+    concurrencyReportFailure
+      ? 1
+      : 0;
+  return { exitCode, summary };
+}
+
+async function main(params: GatewayCpuRunParams = {}) {
+  const options = parseArgs(params.argv ?? process.argv.slice(2));
+  const result = await runGatewayCpuScenarios(options, params);
+  if (result.exitCode !== 0) {
+    process.exitCode = 1;
+  }
+}
+
+/**
+ * Test-only access to the gateway CPU scenario parser and runner helpers.
+ */
+export const testing = {
+  parseArgs,
+  runGatewayCpuScenarios,
+};
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  main().catch((error: unknown) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+  });
+}
diff --git a/scripts/check-gateway-watch-regression.mts b/scripts/check-gateway-watch-regression.mts
new file mode 100644
index 0000000000000000000000000000000000000000..a1be4a5390a098655e9a5e18fe41a1f29b55c111
--- /dev/null
+++ b/scripts/check-gateway-watch-regression.mts
@@ -0,0 +1,1246 @@
+#!/usr/bin/env node
+// Measures gateway watch idle CPU and dist/runtime artifact churn.
+
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import net from "node:net";
+import os from "node:os";
+import path from "node:path";
+import process from "node:process";
+import { setTimeout as delay } from "node:timers/promises";
+import { pathToFileURL } from "node:url";
+import { stripLeadingPackageManagerSeparator } from "./lib/arg-utils.mts";
+import { readProcessTreeCpuMs } from "./lib/gateway-bench-probes.ts";
+import {
+  BUILD_STAMP_FILE,
+  refreshLocalBuildStampTimes,
+  writeBuildStamp,
+  writeRuntimePostBuildStamp,
+} from "./lib/local-build-metadata.mts";
+import { hasUnjoinedWork, runManagedCommand } from "./lib/managed-child-process.mts";
+import { parseStrictNonNegativeDecimal as readNonNegativeInteger } from "./lib/numeric-options.mjs";
+import { resolveBuildRequirement } from "./run-node.mts";
+
+const DEFAULTS = {
+  outputDir: path.join(process.cwd(), ".local", "gateway-watch-regression"),
+  windowMs: 10_000,
+  readyTimeoutMs: 20_000,
+  readySettleMs: 500,
+  sigkillGraceMs: 10_000,
+  sigkillExitGraceMs: 2_000,
+  cpuWarnMs: 1_000,
+  cpuFailMs: 8_000,
+  distRuntimeFileGrowthMax: 200,
+  distRuntimeByteGrowthMax: 2 * 1024 * 1024,
+  keepLogs: true,
+  skipBuild: false,
+};
+
+const WATCH_GATEWAY_SKIP_ENV = {
+  OPENCLAW_DISABLE_BONJOUR: "1",
+  OPENCLAW_SKIP_ACPX_RUNTIME: "1",
+  OPENCLAW_SKIP_ACPX_RUNTIME_PROBE: "1",
+  OPENCLAW_SKIP_BROWSER_CONTROL_SERVER: "1",
+  OPENCLAW_SKIP_CANVAS_HOST: "1",
+  OPENCLAW_SKIP_CHANNELS: "1",
+  OPENCLAW_SKIP_CRON: "1",
+  OPENCLAW_SKIP_GMAIL_WATCHER: "1",
+  OPENCLAW_RUNTIME_POSTBUILD_STATIC_ASSETS: "0",
+  OPENCLAW_TEST_MINIMAL_GATEWAY: "1",
+  NODE_ENV: "test",
+};
+
+/**
+ * Maximum retained stdout/stderr text for gateway watch diagnostics.
+ */
+export const WATCH_LOG_CAPTURE_MAX_CHARS = 2 * 1024 * 1024;
+export const WATCH_LOG_FAILURE_TAIL_CHARS = 12_000;
+const WATCH_BUILD_DETECTION_MAX_CHARS = 4096;
+const ANSI_ESCAPE_PATTERN = new RegExp(`${String.fromCharCode(27)}\\[[0-?]*[ -/]*[@-~]`, "g");
+
+type WatchOptions = typeof DEFAULTS;
+type WatchExit = {
+  code: number | null;
+  signal: string | null;
+  error?: string;
+};
+type WatchBuildDetectionState = {
+  buffer?: string;
+  triggered?: boolean;
+  reason?: string | null;
+};
+type TreeSnapshot = {
+  exists: boolean;
+  files: number;
+  directories: number;
+  symlinks: number;
+  entries: number;
+  apparentBytes: number;
+};
+type Timing = { userSeconds: number; sysSeconds: number; elapsedSeconds: number };
+type TimedWatchOptions = Pick<
+  WatchOptions,
+  "readySettleMs" | "readyTimeoutMs" | "sigkillGraceMs" | "windowMs"
+> &
+  Partial<Pick<WatchOptions, "sigkillExitGraceMs">>;
+type TimedWatchResult = {
+  exit: WatchExit | null;
+  spawnError: string | null;
+  timingFileMissing: boolean;
+  timing: Timing;
+  readyBeforeWindow: boolean;
+  exitedBeforeReady: boolean;
+  exitedBeforeStop: boolean;
+  idleCpuMs: number | null;
+  stdoutPath: string;
+  stderrPath: string;
+  timeFilePath: string;
+  watchTriggeredBuild: boolean;
+  watchBuildReason: string | null;
+};
+type TimedWatchDeps = {
+  allocateLoopbackPort?: () => Promise<number>;
+  parseTimingFile?: (filePath: string) => Timing;
+  readProcessTreeCpuMs?: (pid: number) => number | null;
+  // Wait overrides must settle when the phase signal aborts.
+  sleep?: (ms: number, signal: AbortSignal) => Promise<void>;
+  waitForGatewayReady?: (
+    readText: () => string,
+    timeoutMs: number,
+    signal: AbortSignal,
+  ) => Promise<boolean>;
+};
+type BuildRequirementSummary = { shouldBuild?: boolean; reason?: string };
+type WatchFindingResult = {
+  exit?: WatchExit | null;
+  exitedBeforeReady?: boolean;
+  exitedBeforeStop?: boolean;
+  idleCpuMs: number | null;
+  readyBeforeWindow: boolean;
+  spawnError: string | null;
+  timingFileMissing: boolean;
+};
+
+function shellQuote(value: unknown): string {
+  return `'${String(value).replaceAll("'", "'\\''")}'`;
+}
+
+/**
+ * Appends watch output while preserving only the diagnostic tail.
+ */
+export function appendBoundedWatchLog(
+  current: string,
+  chunk: string | Uint8Array,
+  maxChars = WATCH_LOG_CAPTURE_MAX_CHARS,
+) {
+  const next = current + chunk.toString();
+  if (next.length <= maxChars) {
+    return { text: next, truncated: false };
+  }
+  return { text: next.slice(-maxChars), truncated: true };
+}
+
+function formatCapturedWatchLog(text: string, truncated: boolean): string {
+  return truncated
+    ? `[openclaw] log truncated to last ${WATCH_LOG_CAPTURE_MAX_CHARS} chars\n${text}`
+    : text;
+}
+
+function formatWatchExit(exit: WatchExit | null | undefined): string {
+  if (!exit) {
+    return "unknown exit";
+  }
+  const parts: string[] = [];
+  if (exit.code !== undefined) {
+    parts.push(`code ${exit.code === null ? "null" : exit.code}`);
+  }
+  if (exit.signal !== undefined) {
+    parts.push(`signal ${exit.signal === null ? "null" : exit.signal}`);
+  }
+  if (exit.error) {
+    parts.push(`error ${exit.error}`);
+  }
+  return parts.length > 0 ? parts.join(", ") : "unknown exit";
+}
+
+function readTextTail(filePath: string, maxChars = WATCH_LOG_FAILURE_TAIL_CHARS): string {
+  const text = fs.readFileSync(filePath, "utf8");
+  return text.length <= maxChars ? text : text.slice(-maxChars);
+}
+
+/**
+ * Updates bounded watch-build detection state from new output.
+ */
+export function updateWatchBuildDetection(
+  state: WatchBuildDetectionState,
+  chunk: unknown,
+): { buffer: string; triggered: boolean; reason: string | null } {
+  const combined = `${state.buffer ?? ""}${String(chunk)}`;
+  const next = appendBoundedWatchLog("", combined, WATCH_BUILD_DETECTION_MAX_CHARS);
+  const reason = detectWatchBuildReason(combined, "");
+  const triggered = state.triggered || combined.includes("Building TypeScript (dist is stale");
+  return {
+    buffer: next.text,
+    triggered,
+    reason: state.reason ?? reason,
+  };
+}
+
+/**
+ * Parses gateway watch regression CLI arguments.
+ */
+export function parseArgs(argv: string[]): WatchOptions {
+  const args = stripLeadingPackageManagerSeparator(argv);
+  const options = { ...DEFAULTS };
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i]!;
+    const next = args[i + 1];
+    const readValue = () => {
+      if (!next) {
+        throw new Error(`Missing value for ${arg}`);
+      }
+      i += 1;
+      return next;
+    };
+    switch (arg) {
+      case "--output-dir":
+        options.outputDir = path.resolve(readValue());
+        break;
+      case "--window-ms":
+        options.windowMs = readNonNegativeInteger(readValue(), "--window-ms");
+        break;
+      case "--ready-timeout-ms":
+        options.readyTimeoutMs = readNonNegativeInteger(readValue(), "--ready-timeout-ms");
+        break;
+      case "--ready-settle-ms":
+        options.readySettleMs = readNonNegativeInteger(readValue(), "--ready-settle-ms");
+        break;
+      case "--sigkill-grace-ms":
+        options.sigkillGraceMs = readNonNegativeInteger(readValue(), "--sigkill-grace-ms");
+        break;
+      case "--sigkill-exit-grace-ms":
+        options.sigkillExitGraceMs = readNonNegativeInteger(readValue(), "--sigkill-exit-grace-ms");
+        break;
+      case "--cpu-warn-ms":
+        options.cpuWarnMs = readNonNegativeInteger(readValue(), "--cpu-warn-ms");
+        break;
+      case "--cpu-fail-ms":
+        options.cpuFailMs = readNonNegativeInteger(readValue(), "--cpu-fail-ms");
+        break;
+      case "--dist-runtime-file-growth-max":
+        options.distRuntimeFileGrowthMax = readNonNegativeInteger(
+          readValue(),
+          "--dist-runtime-file-growth-max",
+        );
+        break;
+      case "--dist-runtime-byte-growth-max":
+        options.distRuntimeByteGrowthMax = readNonNegativeInteger(
+          readValue(),
+          "--dist-runtime-byte-growth-max",
+        );
+        break;
+      case "--skip-build":
+        options.skipBuild = true;
+        break;
+      default:
+        throw new Error(`Unknown argument: ${arg}`);
+    }
+  }
+  return options;
+}
+
+function ensureDir(dirPath: string) {
+  fs.mkdirSync(dirPath, { recursive: true });
+}
+
+function removePathIfExists(targetPath: string) {
+  fs.rmSync(targetPath, { recursive: true, force: true });
+}
+
+function lstatIfExists(targetPath: string): {
+  isDirectory(): boolean;
+  isFile(): boolean;
+  isSymbolicLink(): boolean;
+  size: number;
+} | null {
+  try {
+    return fs.lstatSync(targetPath);
+  } catch (error) {
+    if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
+      return null;
+    }
+    throw error;
+  }
+}
+
+function normalizePath(filePath: string): string {
+  return filePath.replaceAll("\\", "/");
+}
+
+function listTreeEntries(rootName: string): string[] {
+  const rootPath = path.join(process.cwd(), rootName);
+  if (!fs.existsSync(rootPath)) {
+    return [`${rootName} (missing)`];
+  }
+
+  const entries = [rootName];
+  const queue = [rootPath];
+  while (queue.length > 0) {
+    const current = queue.pop();
+    if (!current) {
+      continue;
+    }
+    let dirents;
+    try {
+      dirents = fs.readdirSync(current, { withFileTypes: true });
+    } catch (error) {
+      if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
+        continue;
+      }
+      throw error;
+    }
+    for (const dirent of dirents) {
+      const fullPath = path.join(current, dirent.name);
+      const relativePath = normalizePath(path.relative(process.cwd(), fullPath));
+      entries.push(relativePath);
+      if (dirent.isDirectory()) {
+        queue.push(fullPath);
+      }
+    }
+  }
+  return entries.toSorted((a, b) => a.localeCompare(b));
+}
+
+function humanBytes(bytes: number): string {
+  if (bytes < 1024) {
+    return `${bytes}B`;
+  }
+  if (bytes < 1024 * 1024) {
+    return `${(bytes / 1024).toFixed(1)}K`;
+  }
+  if (bytes < 1024 * 1024 * 1024) {
+    return `${(bytes / (1024 * 1024)).toFixed(1)}M`;
+  }
+  return `${(bytes / (1024 * 1024 * 1024)).toFixed(1)}G`;
+}
+
+function snapshotTree(rootName: string): TreeSnapshot {
+  const rootPath = path.join(process.cwd(), rootName);
+  const stats = {
+    exists: fs.existsSync(rootPath),
+    files: 0,
+    directories: 0,
+    symlinks: 0,
+    entries: 0,
+    apparentBytes: 0,
+  };
+
+  if (!stats.exists) {
+    return stats;
+  }
+
+  const queue = [rootPath];
+  while (queue.length > 0) {
+    const current = queue.pop();
+    if (!current) {
+      continue;
+    }
+    const currentStats = lstatIfExists(current);
+    if (!currentStats) {
+      continue;
+    }
+    stats.entries += 1;
+    if (currentStats.isDirectory()) {
+      stats.directories += 1;
+      for (const dirent of fs.readdirSync(current, { withFileTypes: true })) {
+        queue.push(path.join(current, dirent.name));
+      }
+      continue;
+    }
+    if (currentStats.isSymbolicLink()) {
+      stats.symlinks += 1;
+      continue;
+    }
+    if (currentStats.isFile()) {
+      stats.files += 1;
+      stats.apparentBytes += currentStats.size;
+    }
+  }
+
+  return stats;
+}
+
+function writeSnapshot(snapshotDir: string): {
+  generatedAt: string;
+  dist: TreeSnapshot;
+  distRuntime: TreeSnapshot;
+} {
+  ensureDir(snapshotDir);
+  const pathEntries = [...listTreeEntries("dist"), ...listTreeEntries("dist-runtime")];
+  fs.writeFileSync(path.join(snapshotDir, "paths.txt"), `${pathEntries.join("\n")}\n`, "utf8");
+
+  const dist = snapshotTree("dist");
+  const distRuntime = snapshotTree("dist-runtime");
+  const snapshot = {
+    generatedAt: new Date().toISOString(),
+    dist,
+    distRuntime,
+  };
+  fs.writeFileSync(
+    path.join(snapshotDir, "snapshot.json"),
+    `${JSON.stringify(snapshot, null, 2)}\n`,
+  );
+  fs.writeFileSync(
+    path.join(snapshotDir, "stats.txt"),
+    [
+      `generated_at: ${snapshot.generatedAt}`,
+      "",
+      "[dist]",
+      `files: ${dist.files}`,
+      `directories: ${dist.directories}`,
+      `symlinks: ${dist.symlinks}`,
+      `entries: ${dist.entries}`,
+      `apparent_bytes: ${dist.apparentBytes}`,
+      `apparent_human: ${humanBytes(dist.apparentBytes)}`,
+      "",
+      "[dist-runtime]",
+      `files: ${distRuntime.files}`,
+      `directories: ${distRuntime.directories}`,
+      `symlinks: ${distRuntime.symlinks}`,
+      `entries: ${distRuntime.entries}`,
+      `apparent_bytes: ${distRuntime.apparentBytes}`,
+      `apparent_human: ${humanBytes(distRuntime.apparentBytes)}`,
+      "",
+    ].join("\n"),
+    "utf8",
+  );
+  return snapshot;
+}
+
+function runCheckedCommand(command: string, args: string[]) {
+  const result = spawnSync(command, args, {
+    cwd: process.cwd(),
+    stdio: "inherit",
+    env: process.env,
+  });
+  if (typeof result.status === "number" && result.status === 0) {
+    return;
+  }
+  throw new Error(`${command} ${args.join(" ")} failed with status ${result.status ?? "unknown"}`);
+}
+
+/**
+ * Reports whether gateway watch output contains a ready marker.
+ */
+export function hasGatewayReadyLog(text: string): boolean {
+  const normalized = text.replaceAll(ANSI_ESCAPE_PATTERN, "");
+  return /\[gateway\] (?:http server listening|ready(?:\b|\s*\())/.test(normalized);
+}
+
+async function waitForGatewayReady(
+  readText: () => string,
+  timeoutMs: number,
+  signal: AbortSignal,
+): Promise<boolean> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    signal.throwIfAborted();
+    if (hasGatewayReadyLog(readText())) {
+      return true;
+    }
+    await delay(100, undefined, { signal });
+  }
+  return false;
+}
+
+async function allocateLoopbackPort(): Promise<number> {
+  return await new Promise<number>((resolve, reject) => {
+    const server = net.createServer();
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      if (!address || typeof address === "string") {
+        server.close(() => reject(new Error("Failed to allocate watch regression port")));
+        return;
+      }
+      const { port } = address;
+      server.close((closeErr) => {
+        if (closeErr) {
+          reject(closeErr instanceof Error ? closeErr : new Error(String(closeErr)));
+          return;
+        }
+        resolve(port);
+      });
+    });
+  });
+}
+
+export function resolveTimedWatchShell(
+  deps: { existsSync?: (filePath: string) => boolean } = {},
+): string {
+  const existsSync = deps.existsSync ?? fs.existsSync;
+  for (const shellPath of ["/bin/bash", "/usr/bin/bash", "/bin/sh"]) {
+    if (existsSync(shellPath)) {
+      return shellPath;
+    }
+  }
+  return "/bin/sh";
+}
+
+export function buildTimedWatchCommand(
+  pidFilePath: string,
+  timeFilePath: string,
+  isolatedHomeDir: string,
+  port: number,
+  deps: {
+    existsSync?: (filePath: string) => boolean;
+    shellPath?: string;
+    nodeExecPath?: string;
+  } = {},
+) {
+  const isolatedStateDir = path.join(isolatedHomeDir, ".openclaw");
+  const isolatedConfigPath = path.join(isolatedStateDir, "openclaw.json");
+  const configJson = JSON.stringify({
+    gateway: { controlUi: { enabled: false } },
+    logging: { file: path.join(isolatedStateDir, "gateway.log") },
+    plugins: { enabled: false },
+  });
+  // CI env hooks can contain bash-only `declare` lines; running the watch shell
+  // under sh delays gateway readiness behind stderr noise before the idle window.
+  const shellPath = deps.shellPath ?? resolveTimedWatchShell(deps);
+  const nodeExecPath = deps.nodeExecPath ?? process.execPath;
+  const shellSource = [
+    'echo "$$" > "$OPENCLAW_WATCH_PID_FILE"',
+    'mkdir -p "$OPENCLAW_STATE_DIR"',
+    `printf '%s\n' ${shellQuote(configJson)} > "$OPENCLAW_CONFIG_PATH"`,
+    `exec ${shellQuote(nodeExecPath)} scripts/watch-node.mjs gateway --force --allow-unconfigured --port ${String(port)} --token watch-regression-token`,
+  ].join("\n");
+  const nodeBinDir = path.dirname(nodeExecPath);
+  const env = {
+    OPENCLAW_WATCH_PID_FILE: pidFilePath,
+    HOME: isolatedHomeDir,
+    OPENCLAW_HOME: isolatedHomeDir,
+    OPENCLAW_CONFIG_PATH: isolatedConfigPath,
+    OPENCLAW_STATE_DIR: isolatedStateDir,
+    PATH: `${nodeBinDir}${path.delimiter}${process.env.PATH ?? ""}`,
+    XDG_CONFIG_HOME: path.join(isolatedHomeDir, ".config"),
+    ...WATCH_GATEWAY_SKIP_ENV,
+  };
+
+  if (process.platform === "darwin") {
+    return {
+      command: "/usr/bin/time",
+      args: ["-lp", "-o", timeFilePath, shellPath, "-lc", shellSource],
+      env,
+    };
+  }
+
+  if (!fs.existsSync("/usr/bin/time")) {
+    return {
+      command: shellPath,
+      args: ["-lc", shellSource],
+      env,
+    };
+  }
+
+  return {
+    command: "/usr/bin/time",
+    args: [
+      "-f",
+      "__TIMING__ user=%U sys=%S elapsed=%e",
+      "-o",
+      timeFilePath,
+      shellPath,
+      "-lc",
+      shellSource,
+    ],
+    env,
+  };
+}
+
+function parseTimingFile(timeFilePath: string): Timing {
+  const text = fs.readFileSync(timeFilePath, "utf8");
+  if (process.platform === "darwin") {
+    const user = Number(text.match(/^user\s+([0-9.]+)/m)?.[1] ?? "NaN");
+    const sys = Number(text.match(/^sys\s+([0-9.]+)/m)?.[1] ?? "NaN");
+    const elapsed = Number(text.match(/^real\s+([0-9.]+)/m)?.[1] ?? "NaN");
+    return {
+      userSeconds: user,
+      sysSeconds: sys,
+      elapsedSeconds: elapsed,
+    };
+  }
+
+  const match = text.match(/__TIMING__ user=([0-9.]+) sys=([0-9.]+) elapsed=([0-9.]+)/);
+  return {
+    userSeconds: Number(match?.[1] ?? "NaN"),
+    sysSeconds: Number(match?.[2] ?? "NaN"),
+    elapsedSeconds: Number(match?.[3] ?? "NaN"),
+  };
+}
+
+/**
+ * Runs a bounded gateway watch process and captures timing/log artifacts.
+ */
+export async function runTimedWatch(
+  options: TimedWatchOptions,
+  outputDir: string,
+  deps: TimedWatchDeps = {},
+): Promise<TimedWatchResult> {
+  const allocatePort = deps.allocateLoopbackPort ?? allocateLoopbackPort;
+  const parseTiming = deps.parseTimingFile ?? parseTimingFile;
+  const readCpuMs = deps.readProcessTreeCpuMs ?? readProcessTreeCpuMs;
+  const sleepMs =
+    deps.sleep ?? ((ms: number, signal: AbortSignal) => delay(ms, undefined, { signal }));
+  const waitReady = deps.waitForGatewayReady ?? waitForGatewayReady;
+  const pidFilePath = path.join(outputDir, "watch.pid");
+  const timeFilePath = path.join(outputDir, "watch.time.log");
+  const isolatedHomeDir = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-gateway-watch-"));
+  fs.writeFileSync(path.join(outputDir, "watch.home.txt"), `${isolatedHomeDir}\n`, "utf8");
+  let retainIsolatedHome = false;
+  try {
+    const stdoutPath = path.join(outputDir, "watch.stdout.log");
+    const stderrPath = path.join(outputDir, "watch.stderr.log");
+    for (const stalePath of [pidFilePath, timeFilePath, stdoutPath, stderrPath]) {
+      removePathIfExists(stalePath);
+    }
+    const port = await allocatePort();
+    fs.writeFileSync(path.join(outputDir, "watch.port.txt"), `${String(port)}\n`, "utf8");
+    const { command, args, env } = buildTimedWatchCommand(
+      pidFilePath,
+      timeFilePath,
+      isolatedHomeDir,
+      port,
+    );
+
+    let stdout = "";
+    let stderr = "";
+    let stdoutTruncated = false;
+    let stderrTruncated = false;
+    let buildDetection: Required<WatchBuildDetectionState> = {
+      buffer: "",
+      triggered: false,
+      reason: null,
+    };
+    let childAcquiredPid = false;
+    let spawnError: Error | undefined;
+    let observedExit: WatchExit | null = null;
+    let interruptedBy: NodeJS.Signals | undefined;
+    let managedSettled = false;
+    const cancellation = new AbortController();
+    let resolveSpawnError!: (value: WatchExit) => void;
+    const spawnErrorExit = new Promise<WatchExit>((resolve) => {
+      resolveSpawnError = resolve;
+    });
+    let resolveChildExit!: (value: WatchExit) => void;
+    const childExit = new Promise<WatchExit>((resolve) => {
+      resolveChildExit = resolve;
+    });
+    const managedOutcome = runManagedCommand({
+      bin: command,
+      args,
+      cwd: process.cwd(),
+      env: { ...process.env, ...env },
+      shell: false,
+      stdio: ["ignore", "pipe", "pipe"],
+      requireProcessTreeExit: process.platform !== "win32",
+      signal: cancellation.signal,
+      // The watch protocol gets its graceful window before managed fallback starts.
+      abortKillGraceMs: 0,
+      cleanupDrainTimeoutMs: options.sigkillExitGraceMs ?? DEFAULTS.sigkillExitGraceMs,
+      onSignal: (signal) => {
+        interruptedBy = signal;
+      },
+      onReady: (owned) => {
+        childAcquiredPid = owned.pid !== undefined;
+        owned.stdout?.on("data", (chunk: Uint8Array | string) => {
+          const next = appendBoundedWatchLog(stdout, chunk);
+          stdout = next.text;
+          stdoutTruncated ||= next.truncated;
+          buildDetection = updateWatchBuildDetection(buildDetection, chunk);
+        });
+        owned.stderr?.on("data", (chunk: Uint8Array | string) => {
+          const next = appendBoundedWatchLog(stderr, chunk);
+          stderr = next.text;
+          stderrTruncated ||= next.truncated;
+          buildDetection = updateWatchBuildDetection(buildDetection, chunk);
+        });
+        owned.once("error", (error) => {
+          spawnError = error;
+          resolveSpawnError({ code: null, signal: null, error: error.message });
+          if (owned.pid && !managedSettled) {
+            cancellation.abort();
+          }
+        });
+        owned.once("exit", (code, signal) => {
+          observedExit = { code, signal };
+          resolveChildExit(observedExit);
+        });
+      },
+    }).then(
+      () => {
+        managedSettled = true;
+        return { type: "completed" as const };
+      },
+      (error: unknown) => {
+        managedSettled = true;
+        if (!childAcquiredPid) {
+          resolveSpawnError({ code: null, signal: null, error: String(error) });
+        }
+        return { type: "failed" as const, error };
+      },
+    );
+    const errors: unknown[] = [];
+    const raceChildLifecycle = async <Value,>(
+      operation: (signal: AbortSignal) => Value | PromiseLike<Value>,
+    ) => {
+      const measurementCancellation = new AbortController();
+      const pending = Promise.resolve()
+        .then(() => operation(measurementCancellation.signal))
+        .then(
+          (value) => ({ type: "value" as const, value }),
+          (error: unknown) => ({ type: "operation-error" as const, error }),
+        );
+      const outcome = await Promise.race([
+        pending,
+        spawnErrorExit.then((value) => ({ type: "spawn-error" as const, value })),
+        childExit.then((value) => ({ type: "child-exit" as const, value })),
+        managedOutcome.then((result) => {
+          if (result.type === "failed") {
+            return { type: "managed-error" as const, error: result.error };
+          }
+          return observedExit
+            ? { type: "child-exit" as const, value: observedExit }
+            : {
+                type: "managed-error" as const,
+                error: new Error("Managed watch command completed without an observed exit"),
+              };
+        }),
+      ]);
+      // Measurement waits have no process authority; retire their timers before proceeding.
+      measurementCancellation.abort();
+      const settled = await pending;
+      const expectedCancellation =
+        settled.type === "operation-error" &&
+        (settled.error === measurementCancellation.signal.reason ||
+          (settled.error instanceof Error &&
+            settled.error.name === "AbortError" &&
+            settled.error.cause === measurementCancellation.signal.reason));
+      if (outcome.type === "managed-error") {
+        if (
+          settled.type === "operation-error" &&
+          !expectedCancellation &&
+          settled.error !== outcome.error
+        ) {
+          errors.push(settled.error);
+        }
+        throw outcome.error;
+      }
+      if (settled.type === "operation-error" && !expectedCancellation) {
+        throw settled.error;
+      }
+      if (outcome.type === "operation-error") {
+        throw outcome.error;
+      }
+      return outcome;
+    };
+
+    let watchPid: number | null = null;
+    let exit: WatchExit | null = null;
+    let exitedBeforeReady = false;
+    let exitedBeforeStop = false;
+    let readyBeforeWindow = false;
+    let idleCpuStartMs: number | null = null;
+    let idleCpuEndMs: number | null = null;
+    try {
+      for (let attempt = 0; attempt < 50; attempt += 1) {
+        if (fs.existsSync(pidFilePath)) {
+          watchPid = Number(fs.readFileSync(pidFilePath, "utf8").trim());
+          break;
+        }
+        const waitResult = await raceChildLifecycle((signal) => sleepMs(100, signal));
+        if (waitResult.type === "spawn-error") {
+          exit = waitResult.value;
+          break;
+        }
+        if (waitResult.type === "child-exit") {
+          exit = waitResult.value;
+          exitedBeforeReady = true;
+          exitedBeforeStop = true;
+          break;
+        }
+      }
+
+      if (!exit) {
+        const readyResult = await raceChildLifecycle((signal) =>
+          waitReady(() => `${stdout}\n${stderr}`, options.readyTimeoutMs, signal),
+        );
+        if (readyResult.type === "spawn-error") {
+          exit = readyResult.value;
+        } else if (readyResult.type === "child-exit") {
+          exit = readyResult.value;
+          exitedBeforeReady = true;
+          exitedBeforeStop = true;
+        } else {
+          readyBeforeWindow = readyResult.value;
+        }
+      }
+      if (!exit && readyBeforeWindow && options.readySettleMs > 0) {
+        const settleResult = await raceChildLifecycle((signal) =>
+          sleepMs(options.readySettleMs, signal),
+        );
+        if (settleResult.type === "spawn-error") {
+          exit = settleResult.value;
+        } else if (settleResult.type === "child-exit") {
+          exit = settleResult.value;
+          exitedBeforeStop = true;
+        }
+      }
+      if (!exit && readyBeforeWindow) {
+        idleCpuStartMs = watchPid ? readCpuMs(watchPid) : null;
+        const windowResult = await raceChildLifecycle((signal) =>
+          sleepMs(options.windowMs, signal),
+        );
+        if (windowResult.type === "spawn-error") {
+          exit = windowResult.value;
+        } else if (windowResult.type === "child-exit") {
+          exit = windowResult.value;
+          exitedBeforeStop = true;
+        } else {
+          idleCpuEndMs = watchPid ? readCpuMs(watchPid) : null;
+        }
+      }
+    } catch (error) {
+      errors.push(error);
+    }
+
+    try {
+      if (!managedSettled && !observedExit) {
+        if (watchPid && !cancellation.signal.aborted) {
+          // Leave /usr/bin/time alive to collect the watcher's normal exit and timing.
+          try {
+            process.kill(watchPid, "SIGTERM");
+          } catch {
+            // Managed fallback still owns a child whose protocol stop could not be sent.
+          }
+          let graceTimer: ReturnType<typeof setTimeout> | undefined;
+          try {
+            const joined = await Promise.race([
+              managedOutcome.then(() => true),
+              new Promise<boolean>((resolve) => {
+                graceTimer = setTimeout(() => resolve(false), options.sigkillGraceMs);
+              }),
+            ]);
+            if (!joined && !observedExit) {
+              cancellation.abort();
+            }
+          } finally {
+            clearTimeout(graceTimer);
+          }
+        } else {
+          cancellation.abort();
+        }
+      }
+      const outcome = await managedOutcome;
+      if (outcome.type === "failed") {
+        const expectedAbort =
+          cancellation.signal.aborted &&
+          outcome.error instanceof Error &&
+          "code" in outcome.error &&
+          outcome.error.code === "ABORT_ERR";
+        if (!expectedAbort && (outcome.error !== spawnError || childAcquiredPid)) {
+          throw outcome.error;
+        }
+      }
+      exit ??= observedExit;
+      if (interruptedBy) {
+        throw new Error(`gateway:watch interrupted by ${interruptedBy}`);
+      }
+    } catch (error) {
+      if (!errors.includes(error)) {
+        errors.push(error);
+      }
+    }
+    retainIsolatedHome = errors.some(hasUnjoinedWork);
+
+    try {
+      fs.writeFileSync(stdoutPath, formatCapturedWatchLog(stdout, stdoutTruncated), "utf8");
+      fs.writeFileSync(stderrPath, formatCapturedWatchLog(stderr, stderrTruncated), "utf8");
+    } catch (error) {
+      errors.push(error);
+    }
+    if (errors.length === 1) {
+      throw errors[0];
+    }
+    if (errors.length > 1) {
+      throw new AggregateError(errors, "Gateway watch measurement or cleanup failed", {
+        cause: errors.find(hasUnjoinedWork) ?? errors.at(-1),
+      });
+    }
+    const timingFileMissing = !fs.existsSync(timeFilePath);
+    const timing = timingFileMissing
+      ? { userSeconds: Number.NaN, sysSeconds: Number.NaN, elapsedSeconds: Number.NaN }
+      : parseTiming(timeFilePath);
+
+    return {
+      exit,
+      spawnError: spawnError?.message ?? null,
+      timingFileMissing,
+      timing,
+      readyBeforeWindow,
+      exitedBeforeReady,
+      exitedBeforeStop,
+      idleCpuMs:
+        idleCpuStartMs == null || idleCpuEndMs == null
+          ? null
+          : Math.max(0, idleCpuEndMs - idleCpuStartMs),
+      stdoutPath,
+      stderrPath,
+      timeFilePath,
+      watchTriggeredBuild: buildDetection.triggered,
+      watchBuildReason: buildDetection.reason,
+    };
+  } finally {
+    if (!retainIsolatedHome) {
+      fs.rmSync(isolatedHomeDir, { force: true, recursive: true });
+    }
+  }
+}
+
+function parsePathFile(filePath: string): string[] {
+  return fs
+    .readFileSync(filePath, "utf8")
+    .split("\n")
+    .map((line) => line.trimEnd())
+    .filter(Boolean);
+}
+
+function writeDiffArtifacts(outputDir: string, preDir: string, postDir: string) {
+  const diffDir = path.join(outputDir, "diff");
+  ensureDir(diffDir);
+  const prePaths = parsePathFile(path.join(preDir, "paths.txt"));
+  const postPaths = parsePathFile(path.join(postDir, "paths.txt"));
+  const preSet = new Set(prePaths);
+  const postSet = new Set(postPaths);
+  const added = postPaths.filter((entry) => !preSet.has(entry));
+  const removed = prePaths.filter((entry) => !postSet.has(entry));
+
+  fs.writeFileSync(path.join(diffDir, "added-paths.txt"), `${added.join("\n")}\n`, "utf8");
+  fs.writeFileSync(path.join(diffDir, "removed-paths.txt"), `${removed.join("\n")}\n`, "utf8");
+  return { added, removed };
+}
+
+function fail(message: string) {
+  console.error(`FAIL: ${message}`);
+}
+
+function warn(message: string) {
+  console.error(`WARN: ${message}`);
+}
+
+function detectWatchBuildReason(stdout: string, stderr: string): string | null {
+  const combined = `${stdout}\n${stderr}`;
+  const match = combined.match(/Building TypeScript \(dist is stale: ([a-z_]+)/);
+  return match?.[1] ?? null;
+}
+
+function buildRunNodeDeps(env: NodeJS.ProcessEnv) {
+  const cwd = process.cwd();
+  return {
+    cwd,
+    env,
+    fs,
+    spawnSync,
+    distRoot: path.join(cwd, "dist"),
+    distEntry: path.join(cwd, "dist", "/entry.js"),
+    buildStampPath: path.join(cwd, "dist", BUILD_STAMP_FILE),
+    sourceRoots: ["src", "extensions"].map((sourceRoot) => ({
+      name: sourceRoot,
+      path: path.join(cwd, sourceRoot),
+    })),
+    configFiles: ["tsconfig.json", "package.json", "tsdown.config.ts"].map((filePath) =>
+      path.join(cwd, filePath),
+    ),
+  };
+}
+
+/**
+ * Reports whether restored CI artifacts need fresh build stamps.
+ */
+export function shouldRefreshBuildStampForRestoredArtifacts(params: {
+  skipBuild?: boolean;
+  buildRequirement?: BuildRequirementSummary;
+}): boolean {
+  return (
+    params.skipBuild === true &&
+    params.buildRequirement?.shouldBuild === true &&
+    params.buildRequirement.reason === "config_newer"
+  );
+}
+
+/**
+ * Writes build and runtime-postbuild stamps for the current artifact set.
+ */
+export function writeBuildAndRuntimePostBuildStamps(params: { cwd?: string } = {}) {
+  const cwd = params.cwd ?? process.cwd();
+  writeBuildStamp({ cwd });
+  writeRuntimePostBuildStamp({ cwd });
+}
+
+export function calculateDistRuntimeByteGrowth(beforeBytes: number, afterBytes: number): number {
+  return afterBytes - beforeBytes;
+}
+/**
+ * Collects pass/fail findings for the bounded gateway watch regression run.
+ */
+export function collectGatewayWatchFindings(params: {
+  distRuntimeByteGrowth: number;
+  distRuntimeFileGrowth: number;
+  removedPaths: number;
+  options: Pick<
+    WatchOptions,
+    "cpuFailMs" | "cpuWarnMs" | "distRuntimeByteGrowthMax" | "distRuntimeFileGrowthMax" | "windowMs"
+  >;
+  watchBuildReason: string | null;
+  watchResult: WatchFindingResult;
+  watchTriggeredBuild: boolean;
+}): { failures: string[]; warnings: string[] } {
+  const {
+    distRuntimeByteGrowth,
+    distRuntimeFileGrowth,
+    removedPaths,
+    options,
+    watchBuildReason,
+    watchResult,
+    watchTriggeredBuild,
+  } = params;
+  const failures: string[] = [];
+  const warnings: string[] = [];
+  if (watchResult.spawnError) {
+    failures.push(`gateway:watch failed to start: ${watchResult.spawnError}`);
+  }
+  if (!watchResult.readyBeforeWindow && watchResult.exitedBeforeReady) {
+    failures.push(`gateway:watch exited before ready (${formatWatchExit(watchResult.exit)})`);
+  } else if (!watchResult.readyBeforeWindow) {
+    failures.push("gateway:watch did not report ready before the idle CPU window");
+  }
+  if (watchResult.readyBeforeWindow && watchResult.exitedBeforeStop) {
+    failures.push(
+      `gateway:watch exited before the idle CPU window completed (${formatWatchExit(watchResult.exit)})`,
+    );
+  }
+  if (watchResult.timingFileMissing && !Number.isFinite(watchResult.idleCpuMs)) {
+    failures.push(
+      "failed to collect CPU timing from the bounded gateway:watch run; timing artifact is missing",
+    );
+  } else if (watchResult.timingFileMissing) {
+    warnings.push(
+      "bounded gateway:watch timing artifact is missing; using process-tree idle CPU sample",
+    );
+  }
+  if (watchTriggeredBuild && watchBuildReason === "dirty_watched_tree") {
+    failures.push(
+      "gateway:watch invalid local run: dirty watched source tree forced a rebuild during the watch window",
+    );
+  } else if (watchTriggeredBuild) {
+    failures.push(
+      `gateway:watch unexpectedly rebuilt prebuilt artifacts (${watchBuildReason ?? "unknown reason"})`,
+    );
+  }
+  if (removedPaths > 0) {
+    failures.push(`gateway:watch removed ${removedPaths} prebuilt artifact paths`);
+  }
+  if (distRuntimeFileGrowth > options.distRuntimeFileGrowthMax) {
+    failures.push(
+      `dist-runtime file growth ${distRuntimeFileGrowth} exceeded max ${options.distRuntimeFileGrowthMax}`,
+    );
+  }
+  if (distRuntimeByteGrowth > options.distRuntimeByteGrowthMax) {
+    failures.push(
+      `dist-runtime apparent byte growth ${distRuntimeByteGrowth} exceeded max ${options.distRuntimeByteGrowthMax}`,
+    );
+  }
+  if (watchResult.readyBeforeWindow) {
+    const cpuMs = watchResult.idleCpuMs;
+    if (cpuMs === null || !Number.isFinite(cpuMs)) {
+      if (!watchResult.exitedBeforeStop && !watchResult.spawnError) {
+        failures.push("failed to collect idle CPU timing from the ready gateway:watch window");
+      }
+    } else if (cpuMs > options.cpuFailMs) {
+      failures.push(
+        `LOUD ALARM: gateway:watch used ${cpuMs}ms CPU in ${options.windowMs}ms window, above loud-alarm threshold ${options.cpuFailMs}ms`,
+      );
+    } else if (cpuMs > options.cpuWarnMs) {
+      warnings.push(
+        `gateway:watch used ${cpuMs}ms CPU in ${options.windowMs}ms window, above target ${options.cpuWarnMs}ms`,
+      );
+    }
+  }
+  return { failures, warnings };
+}
+
+export function shouldReportDuplicateDistRuntimeRegression(failures: string[]): boolean {
+  return failures.some((message) => message.startsWith("dist-runtime "));
+}
+
+function printWatchLogDiagnostics(watchResult: TimedWatchResult) {
+  const artifacts: Array<[string, string]> = [
+    ["stderr", watchResult.stderrPath],
+    ["stdout", watchResult.stdoutPath],
+  ];
+  for (const [label, filePath] of artifacts) {
+    if (!filePath || !fs.existsSync(filePath)) {
+      continue;
+    }
+    const tail = readTextTail(filePath).trimEnd();
+    if (!tail) {
+      warn(`gateway:watch ${label} artifact is empty (${filePath})`);
+      continue;
+    }
+    console.error(
+      `--- gateway:watch ${label} tail (${filePath}, last ${WATCH_LOG_FAILURE_TAIL_CHARS} chars) ---`,
+    );
+    console.error(tail);
+    console.error(`--- end gateway:watch ${label} tail ---`);
+  }
+}
+
+async function main() {
+  const options = parseArgs(process.argv.slice(2));
+  ensureDir(options.outputDir);
+  if (!options.skipBuild) {
+    runCheckedCommand("node", ["--import", "tsx", "scripts/build-all.mts", "gatewayWatch"]);
+    // The watch harness must start from a completed dist/runtime baseline.
+    // Refresh both stamps after the gateway build finishes so run-node does not
+    // leave stale local artifact metadata after the bounded watch window.
+    writeBuildAndRuntimePostBuildStamps();
+  } else {
+    // Restored CI artifacts can be older than the fresh checkout mtimes.
+    // Preserve the artifact producer's provenance; recipient cleanliness is not build proof.
+    refreshLocalBuildStampTimes();
+  }
+
+  let preflightBuildRequirement = resolveBuildRequirement(buildRunNodeDeps(process.env));
+  if (
+    shouldRefreshBuildStampForRestoredArtifacts({
+      skipBuild: options.skipBuild,
+      buildRequirement: preflightBuildRequirement,
+    })
+  ) {
+    // CI's skip-build path restores a built dist artifact after checkout.
+    // Refresh the stamps so checkout mtimes for package/config files do not
+    // force a duplicate build during the bounded gateway:watch window.
+    refreshLocalBuildStampTimes();
+    preflightBuildRequirement = resolveBuildRequirement(buildRunNodeDeps(process.env));
+  }
+  if (preflightBuildRequirement.shouldBuild) {
+    const summary = {
+      windowMs: options.windowMs,
+      invalidated: true,
+      invalidationReason: preflightBuildRequirement.reason,
+      invalidationMessage:
+        "gateway-watch-regression requires a complete, current prebuilt artifact set; run-node would rebuild during the watch window.",
+    };
+    fs.writeFileSync(
+      path.join(options.outputDir, "summary.json"),
+      `${JSON.stringify(summary, null, 2)}\n`,
+    );
+    console.log(JSON.stringify(summary, null, 2));
+    fail(
+      `gateway-watch-regression invalid local run: ${preflightBuildRequirement.reason} would force a rebuild inside the watch window`,
+    );
+    process.exit(1);
+  }
+
+  const preDir = path.join(options.outputDir, "pre");
+  const pre = writeSnapshot(preDir);
+
+  const watchDir = path.join(options.outputDir, "watch");
+  ensureDir(watchDir);
+  const watchResult = await runTimedWatch(options, watchDir);
+
+  const postDir = path.join(options.outputDir, "post");
+  const post = writeSnapshot(postDir);
+  const diff = writeDiffArtifacts(options.outputDir, preDir, postDir);
+
+  const distRuntimeAddedPaths = diff.added.filter((entry) =>
+    entry.startsWith("dist-runtime/"),
+  ).length;
+  const distRuntimeFileGrowth = distRuntimeAddedPaths;
+  const distRuntimeByteGrowth = calculateDistRuntimeByteGrowth(
+    pre.distRuntime.apparentBytes,
+    post.distRuntime.apparentBytes,
+  );
+  const totalCpuMs = Math.round(
+    (watchResult.timing.userSeconds + watchResult.timing.sysSeconds) * 1000,
+  );
+  const watchTriggeredBuild = watchResult.watchTriggeredBuild;
+  const watchBuildReason = watchResult.watchBuildReason;
+
+  const summary = {
+    windowMs: options.windowMs,
+    watchTriggeredBuild,
+    watchBuildReason,
+    cpuMs: watchResult.idleCpuMs,
+    totalCpuMs,
+    readyBeforeWindow: watchResult.readyBeforeWindow,
+    exitedBeforeReady: watchResult.exitedBeforeReady,
+    exitedBeforeStop: watchResult.exitedBeforeStop,
+    cpuWarnMs: options.cpuWarnMs,
+    cpuFailMs: options.cpuFailMs,
+    distRuntimeFileGrowth,
+    distRuntimeFileGrowthMax: options.distRuntimeFileGrowthMax,
+    distRuntimeByteGrowth,
+    distRuntimeByteGrowthMax: options.distRuntimeByteGrowthMax,
+    distRuntimeAddedPaths,
+    addedPaths: diff.added.length,
+    // A previously absent tree becoming present removes only the snapshot's
+    // diagnostic sentinel, not an artifact (for example during metadata sync).
+    removedPaths: diff.removed.filter((entry) => !entry.endsWith(" (missing)")).length,
+    watchExit: watchResult.exit,
+    spawnError: watchResult.spawnError,
+    stdoutPath: watchResult.stdoutPath,
+    stderrPath: watchResult.stderrPath,
+    timingFileMissing: watchResult.timingFileMissing,
+    timing: watchResult.timing,
+  };
+  fs.writeFileSync(
+    path.join(options.outputDir, "summary.json"),
+    `${JSON.stringify(summary, null, 2)}\n`,
+  );
+
+  console.log(JSON.stringify(summary, null, 2));
+
+  const { failures, warnings } = collectGatewayWatchFindings({
+    distRuntimeByteGrowth,
+    distRuntimeFileGrowth,
+    removedPaths: summary.removedPaths,
+    options,
+    watchBuildReason,
+    watchResult,
+    watchTriggeredBuild,
+  });
+
+  for (const message of warnings) {
+    warn(message);
+  }
+
+  if (failures.length > 0) {
+    for (const message of failures) {
+      fail(message);
+    }
+    printWatchLogDiagnostics(watchResult);
+    if (shouldReportDuplicateDistRuntimeRegression(failures)) {
+      fail(
+        "Possible duplicate dist-runtime graph regression: this can reintroduce split runtime personalities where plugins and core observe different global state, including Telegram missing /voice, /phone, or /pair.",
+      );
+    }
+    process.exit(1);
+  }
+
+  process.exit(0);
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+  await main();
+}
diff --git a/scripts/check-install-dependency-ownership.mjs b/scripts/check-install-dependency-ownership.mjs
new file mode 100644
index 0000000000000000000000000000000000000000..e35f898e88970301cbf72884d855e5b3f8149abd
--- /dev/null
+++ b/scripts/check-install-dependency-ownership.mjs
@@ -0,0 +1,36 @@
+import { lstatSync, realpathSync } from "node:fs";
+import path from "node:path";
+
+const root = realpathSync(process.cwd());
+const configured =
+  (process.env.PNPM_CONFIG_MODULES_DIR ?? process.env.pnpm_config_modules_dir) ||
+  process.env.npm_config_modules_dir ||
+  undefined;
+const modules = path.resolve(root, configured || "node_modules");
+const workspaceModules = path.join(root, "node_modules");
+
+function inspectDirectory(directory, explicitTarget) {
+  const entry = lstatSync(directory, { throwIfNoEntry: false });
+  if (!entry) {
+    return;
+  }
+  if (entry.isSymbolicLink() && explicitTarget && realpathSync(directory) === explicitTarget) {
+    return;
+  }
+  if (!entry.isDirectory()) {
+    throw new Error(
+      `Refusing to reconcile dependencies through ${directory}: it is not a physical directory. Preserve the borrowed install and use an independently owned checkout.`,
+    );
+  }
+}
+
+// pnpm can still reconcile workspace modules when its metadata directory is explicit.
+inspectDirectory(modules);
+const explicitTarget =
+  configured && modules !== workspaceModules && lstatSync(modules, { throwIfNoEntry: false })
+    ? realpathSync(modules)
+    : undefined;
+inspectDirectory(workspaceModules, explicitTarget);
+for (const directory of new Set([modules, workspaceModules])) {
+  inspectDirectory(path.join(directory, ".pnpm"));
+}
diff --git a/scripts/check-madge-import-cycles.ts b/scripts/check-madge-import-cycles.ts
new file mode 100644
index 0000000000000000000000000000000000000000..5225ff12c37f5d87b16d022f752cd2d1bbc33155
--- /dev/null
+++ b/scripts/check-madge-import-cycles.ts
@@ -0,0 +1,133 @@
+#!/usr/bin/env node
+// Check Madge Import Cycles script supports OpenClaw repository automation.
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import ts from "typescript";
+import {
+  collectSourceFiles,
+  collectStronglyConnectedComponents,
+} from "./lib/import-cycle-graph.ts";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const scanRoots = ["src", "extensions", "ui"] as const;
+const sourceExtensions = [".ts"] as const;
+const ignoredPathPartPattern =
+  /(^|\/)(node_modules|dist|build|coverage|\.artifacts|\.git|assets)(\/|$)/;
+
+function shouldSkipRepoPath(repoPath: string): boolean {
+  return ignoredPathPartPattern.test(repoPath);
+}
+
+function loadCompilerOptions(): ts.CompilerOptions {
+  const configPath = path.join(repoRoot, "tsconfig.json");
+  const config = ts.readConfigFile(configPath, (filePath) => ts.sys.readFile(filePath));
+  if (config.error) {
+    throw new Error(ts.flattenDiagnosticMessageText(config.error.messageText, "\n"));
+  }
+  return ts.parseJsonConfigFileContent(config.config, ts.sys, repoRoot).options;
+}
+
+function collectStaticModuleSpecifiers(sourceFile: ts.SourceFile): string[] {
+  const specifiers: string[] = [];
+  const visit = (node: ts.Node) => {
+    if (ts.isImportDeclaration(node) && ts.isStringLiteral(node.moduleSpecifier)) {
+      specifiers.push(node.moduleSpecifier.text);
+    } else if (
+      ts.isExportDeclaration(node) &&
+      node.moduleSpecifier &&
+      ts.isStringLiteral(node.moduleSpecifier)
+    ) {
+      specifiers.push(node.moduleSpecifier.text);
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(sourceFile);
+  return specifiers;
+}
+
+function createImportGraph(files: readonly string[]): Map<string, string[]> {
+  const compilerOptions = loadCompilerOptions();
+  const compilerHost = ts.createCompilerHost(compilerOptions, false);
+  const directoryExists = compilerHost.directoryExists?.bind(compilerHost);
+  if (directoryExists) {
+    const directories = new Map<string, boolean>();
+    compilerHost.directoryExists = (directory) => {
+      const cached = directories.get(directory);
+      if (cached !== undefined) {
+        return cached;
+      }
+      const exists = directoryExists(directory);
+      directories.set(directory, exists);
+      return exists;
+    };
+  }
+  const resolutionCache = ts.createModuleResolutionCache(
+    repoRoot,
+    (value) => value,
+    compilerOptions,
+  );
+  const absoluteToRepoPath = new Map(
+    files.map((file): [string, string] => [path.resolve(repoRoot, file), file]),
+  );
+  const graph = new Map<string, string[]>();
+
+  for (const file of files) {
+    const absoluteFile = path.join(repoRoot, file);
+    const sourceFile = ts.createSourceFile(
+      file,
+      readFileSync(absoluteFile, "utf8"),
+      ts.ScriptTarget.Latest,
+      false,
+    );
+    const imports = collectStaticModuleSpecifiers(sourceFile).flatMap((specifier) => {
+      const resolved = ts.resolveModuleName(
+        specifier,
+        absoluteFile,
+        compilerOptions,
+        compilerHost,
+        resolutionCache,
+      ).resolvedModule?.resolvedFileName;
+      if (!resolved) {
+        return [];
+      }
+      const repoPath = absoluteToRepoPath.get(path.resolve(resolved));
+      return repoPath ? [repoPath] : [];
+    });
+    graph.set(
+      file,
+      imports.toSorted((left, right) => left.localeCompare(right)),
+    );
+  }
+
+  return graph;
+}
+
+function main(): number {
+  const files = scanRoots.flatMap((root) =>
+    collectSourceFiles(path.join(repoRoot, root), {
+      repoRoot,
+      sourceExtensions,
+      shouldSkipRepoPath,
+    }),
+  );
+  const graph = createImportGraph(files);
+  const cycles = collectStronglyConnectedComponents(graph);
+
+  console.log(`Madge import cycle check: ${cycles.length} cycle(s).`);
+  if (cycles.length === 0) {
+    return 0;
+  }
+
+  console.error("\nMadge circular dependencies:");
+  for (const [index, cycle] of cycles.entries()) {
+    console.error(`\n# cycle ${index + 1}`);
+    console.error(`  ${cycle.join("\n  -> ")}`);
+  }
+  console.error(
+    "\nBreak the cycle or extract a leaf contract instead of routing through a barrel.",
+  );
+  return 1;
+}
+
+process.exitCode = main();
diff --git a/scripts/check-max-lines-ratchet.mts b/scripts/check-max-lines-ratchet.mts
new file mode 100644
index 0000000000000000000000000000000000000000..30011e94b0108443f05e7c4a18a54a2d06e79b1e
--- /dev/null
+++ b/scripts/check-max-lines-ratchet.mts
@@ -0,0 +1,288 @@
+import { execFileSync, spawnSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import ts from "typescript";
+import {
+  addEnvVarNames,
+  isCountedSourcePath,
+  main as checkEnvVarCount,
+} from "./check-env-var-count.mts";
+import {
+  compareRatchetSets,
+  listRatchetRenames,
+  loadRatchetReference,
+  loadRatchetSnapshot,
+  loadRatchetSources,
+  parseRatchetArgs,
+  parseRatchetPaths,
+  reportRatchetFailures,
+  reportRatchetSuccess,
+  resolveRatchetBase,
+} from "./lib/shrink-ratchet.mts";
+import { collectTypeScriptCommentRanges } from "./lib/ts-guard-utils.mts";
+
+const BASELINE_PATH = "config/max-lines-baseline.txt";
+const GIT_MAX_BUFFER = 256 * 1024 * 1024;
+const SOURCE_ROOTS = ["src", "ui/src", "packages", "extensions"];
+const SOURCE_EXTENSIONS = new Set([".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".mts", ".cts"]);
+const BASELINE_HEADER = [
+  "# Files currently allowed to exceed the oxlint max-lines budget.",
+  "# Ratchet: this list may only shrink. Split files; never add entries.",
+  "# Existing suppressions carry a TODO at the file site.",
+  "",
+].join("\n");
+const compareStrings = (left: string, right: string) => left.localeCompare(right);
+
+export function isGovernedSourcePath(filePath: string) {
+  const normalized = filePath.replaceAll("\\", "/");
+  if (!SOURCE_ROOTS.some((root) => normalized === root || normalized.startsWith(root + "/"))) {
+    return false;
+  }
+  if (!SOURCE_EXTENSIONS.has(path.posix.extname(normalized))) {
+    return false;
+  }
+  return !(
+    normalized.startsWith("ui/src/i18n/locales/") ||
+    normalized.startsWith("src/wizard/i18n/locales/") ||
+    /(?:^|\/)(?:__generated__|generated|protocol-gen|dist)(?:\/|$)/u.test(normalized) ||
+    /\.generated\.[^/]+$/u.test(normalized)
+  );
+}
+
+export function collectLintDisableDirectives(source: string, filePath = "source.ts") {
+  if (!source.includes("oxlint-disable") && !source.includes("eslint-disable")) {
+    return [];
+  }
+  const directive = /^(?:eslint|oxlint)-disable(?:-next-line|-line)?(?=$|\s)([\s\S]*)$/u;
+  const scriptKind = /\.[cm]?[jt]sx$/u.test(filePath) ? ts.ScriptKind.TSX : ts.ScriptKind.TS;
+  const sourceFile = ts.createSourceFile(
+    filePath,
+    source,
+    ts.ScriptTarget.Latest,
+    false,
+    scriptKind,
+  );
+  const directives: string[][] = [];
+  for (const range of collectTypeScriptCommentRanges(ts, sourceFile)) {
+    const text = source.slice(range.pos, range.end);
+    const comment = text.slice(2, text.startsWith("/*") ? -2 : undefined);
+    const match = directive.exec(comment.trim());
+    if (!match) {
+      continue;
+    }
+    const directiveBody = match[1] ?? "";
+    const reason = /--|(?<=\s)-(?=\s)/u.exec(directiveBody);
+    const rules = (reason ? directiveBody.slice(0, reason.index) : directiveBody).trim();
+    directives.push(rules === "" ? [] : rules.split(/[\s,]+/u));
+  }
+  return directives;
+}
+
+export function isMaxLinesRule(rule: string) {
+  return rule === "max-lines" || rule.endsWith("/max-lines");
+}
+
+function baselineWithVerifiedRenames(
+  root: string,
+  baseRef: string,
+  staged: boolean,
+  baseline: ReadonlySet<string>,
+  baseBaseline: ReadonlySet<string>,
+) {
+  const allowed = new Set(baseBaseline);
+  for (const { from, to } of listRatchetRenames(root, baseRef, staged, SOURCE_ROOTS)) {
+    if (baseBaseline.has(from) && !baseline.has(from) && baseline.has(to)) {
+      allowed.delete(from);
+      allowed.add(to);
+    }
+  }
+  return allowed;
+}
+
+function listStagedSuppressionCandidates(root: string) {
+  // The staged policy covers the whole index. Narrow candidates once so a one-file
+  // check does not spawn a Git process for every governed source.
+  const result = spawnSync(
+    "git",
+    [
+      "grep",
+      "--cached",
+      "-z",
+      "-l",
+      "-e",
+      "oxlint-disable",
+      "-e",
+      "eslint-disable",
+      "--",
+      ...SOURCE_ROOTS,
+    ],
+    { cwd: root, maxBuffer: GIT_MAX_BUFFER },
+  );
+  if (result.status === 1) {
+    return [];
+  }
+  if (result.status !== 0) {
+    throw new Error(result.stderr.toString("utf8").trim() || "git grep failed");
+  }
+  return result.stdout.toString("utf8").split("\0").filter(Boolean);
+}
+
+export function collectCurrentSuppressionState(
+  root = process.cwd(),
+  options: { staged?: boolean; envVarNames?: Map<string, ReadonlySet<string>> } = {},
+) {
+  const staged = options.staged === true;
+  const filePaths = staged
+    ? listStagedSuppressionCandidates(root)
+    : execFileSync(
+        "git",
+        ["ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...SOURCE_ROOTS],
+        { cwd: root, maxBuffer: GIT_MAX_BUFFER },
+      )
+        .toString("utf8")
+        .split("\0");
+  const governedPaths = filePaths
+    .filter(Boolean)
+    .filter(isGovernedSourcePath)
+    .filter((filePath) => staged || fs.existsSync(path.join(root, filePath)));
+  const stagedSources = staged ? loadRatchetSources(root, governedPaths) : undefined;
+  const allRules: string[] = [];
+  const explicit: string[] = [];
+  for (const filePath of governedPaths) {
+    const source = stagedSources
+      ? stagedSources.get(filePath)!
+      : fs.readFileSync(path.join(root, filePath), "utf8");
+    if (!staged && options.envVarNames && isCountedSourcePath(filePath)) {
+      const names = new Set<string>();
+      addEnvVarNames(source, names);
+      options.envVarNames.set(filePath, names);
+    }
+    const directives = collectLintDisableDirectives(source, filePath);
+    if (directives.some((rules) => rules.length === 0)) {
+      allRules.push(filePath);
+    }
+    if (directives.some((rules) => rules.some(isMaxLinesRule))) {
+      explicit.push(filePath);
+    }
+  }
+  return {
+    allRules: allRules.toSorted(compareStrings),
+    explicit: explicit.toSorted(compareStrings),
+  };
+}
+
+function writeBaseline(root: string, entries: string[]) {
+  fs.writeFileSync(path.join(root, BASELINE_PATH), BASELINE_HEADER + entries.join("\n") + "\n");
+}
+
+function envVarCountArgs(argv: string[]) {
+  const args = parseRatchetArgs(argv);
+  return [...(args.staged ? ["--staged"] : []), ...(args.base ? ["--base", args.base] : [])];
+}
+
+export function main(
+  root = process.cwd(),
+  argv: string[] = process.argv.slice(2),
+  envVarNames?: Map<string, ReadonlySet<string>>,
+) {
+  try {
+    const args = parseRatchetArgs(argv);
+    if (args.staged && args.prune) {
+      throw new Error("--prune cannot be combined with --staged");
+    }
+
+    let baselineSource;
+    try {
+      baselineSource = loadRatchetSnapshot(root, BASELINE_PATH, args.staged, parseRatchetPaths);
+    } catch {
+      throw new Error("Missing " + BASELINE_PATH + (args.staged ? " in the index" : ""));
+    }
+    const baseline = baselineSource;
+    const { allRules, explicit: current } = collectCurrentSuppressionState(root, {
+      staged: args.staged,
+      envVarNames,
+    });
+    const { added, removed: stale } = compareRatchetSets(current, baseline, compareStrings);
+    const baseRef = resolveRatchetBase(root, { base: args.base, staged: args.staged });
+    const baseBaseline = baseRef
+      ? loadRatchetReference(root, baseRef, BASELINE_PATH, parseRatchetPaths)
+      : null;
+    const allowedBaseline =
+      baseRef && baseBaseline
+        ? baselineWithVerifiedRenames(root, baseRef, args.staged, baseline, baseBaseline)
+        : baseBaseline;
+    const expanded = allowedBaseline
+      ? compareRatchetSets(baseline, allowedBaseline, compareStrings).added
+      : [];
+
+    if (
+      reportRatchetFailures([
+        { entries: added, title: "New max-lines suppressions are forbidden; split these files:" },
+        {
+          entries: expanded,
+          title: "The max-lines baseline may only shrink; remove these entries:",
+        },
+        {
+          entries: allRules,
+          title: "All-rule lint disables are forbidden; name only the required rules:",
+        },
+      ])
+    ) {
+      return 1;
+    }
+
+    if (args.prune) {
+      const kept = [...baseline]
+        .filter((entry) => current.includes(entry))
+        .toSorted(compareStrings);
+      writeBaseline(root, kept);
+      reportRatchetSuccess(
+        "Pruned " + BASELINE_PATH + ": " + baseline.size + " -> " + kept.length + ".",
+      );
+      return 0;
+    }
+    if (
+      reportRatchetFailures([
+        {
+          entries: stale,
+          title: "Remove stale max-lines baseline entries (or run with --prune):",
+        },
+      ])
+    ) {
+      return 1;
+    }
+
+    reportRatchetSuccess(
+      "max-lines ratchet OK: " + current.length + " grandfathered suppressions.",
+    );
+    return 0;
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    return 1;
+  }
+}
+
+function runBaselineRatchets(root = process.cwd(), argv: string[] = process.argv.slice(2)) {
+  // Keep name sets local to this invocation, including files with no matches.
+  const envVarNames = argv.includes("--staged")
+    ? undefined
+    : new Map<string, ReadonlySet<string>>();
+  const maxLinesStatus = main(root, argv, envVarNames);
+  if (maxLinesStatus !== 0) {
+    return maxLinesStatus;
+  }
+  try {
+    // CI invokes this entry with its frozen fork-point ref. Carry the same snapshot
+    // into the env budget so every baseline ratchet judges one tested tree.
+    checkEnvVarCount(envVarCountArgs(argv), root, envVarNames);
+    return 0;
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    return 1;
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  process.exitCode = runBaselineRatchets();
+}
diff --git a/scripts/check-memory-fd-repro.mts b/scripts/check-memory-fd-repro.mts
new file mode 100644
index 0000000000000000000000000000000000000000..3a1cfc98c50d8dfae692702be8a25ab9a076bc60
--- /dev/null
+++ b/scripts/check-memory-fd-repro.mts
@@ -0,0 +1,975 @@
+#!/usr/bin/env node
+
+// Reproduces memory-search file descriptor retention with a synthetic workspace.
+import { spawnSync, type ChildProcess } from "node:child_process";
+import fs from "node:fs";
+import net from "node:net";
+import os from "node:os";
+import path from "node:path";
+import process from "node:process";
+import { setTimeout as sleep } from "node:timers/promises";
+import { pathToFileURL } from "node:url";
+import { safeParseJson } from "../packages/normalization-core/src/json-coercion.ts";
+import { resolveTimerTimeoutMs } from "../packages/normalization-core/src/number-coercion.ts";
+import { asNullableRecord as asRecord } from "../packages/normalization-core/src/record-coerce.ts";
+import { readNonBlankString } from "../packages/normalization-core/src/string-coerce.ts";
+import { stripLeadingPackageManagerSeparator } from "./lib/arg-utils.mts";
+import { readBoundedResponseText } from "./lib/bounded-response.mjs";
+import { formatErrorMessage } from "./lib/error-format.mts";
+import { hasUnjoinedWork, runManagedCommand } from "./lib/managed-child-process.mts";
+import { parseStrictNonNegativeDecimal as parseNonNegativeInteger } from "./lib/numeric-options.mjs";
+
+const ISSUE_FILE_COUNTS = [
+  ["memory/transcripts", 9394],
+  ["memory/transcripts.archived", 1695],
+  ["memory/structured-md/lessons", 268],
+  ["memory/structured-md/decisions", 215],
+  ["memory/structured-md/lessons.archived", 214],
+  ["memory/structured-md/procedures", 213],
+  ["memory/structured-md/decisions.archived", 151],
+  ["memory/structured-md/procedures.archived", 126],
+  ["memory/structured-md/projects", 81],
+  ["memory/structured-md/projects.archived", 34],
+] satisfies Array<[string, number]>;
+
+type ChildExitState = { exitCode: number | null; signalCode: string | null };
+type GatewayReadyChild = ChildExitState & { pid?: number };
+type GatewayReadyOutputState = { tail?: string; readySeen?: boolean };
+type ConfigOptions = { homeDir: string; workspaceDir: string; port: number; token: string };
+type FdSampleOptions = { label: string; pid: number; workspaceRealPath: string };
+type GatewayReadyOptions = {
+  child: GatewayReadyChild;
+  port: number;
+  logPath: string;
+  timeoutMs: number;
+  outputState?: GatewayReadyOutputState;
+};
+type InvokeOptions = { port: number; token: string; timeoutMs: number; signal?: AbortSignal };
+type InvokeResponseOptions = { httpOk: boolean; status: number; bodyText: string };
+
+const ISSUE_MEMORY_FILE_COUNT = ISSUE_FILE_COUNTS.reduce((sum, [, count]) => sum + count, 0);
+const DEFAULT_FILE_COUNT = 512;
+const DEFAULT_MAX_WORKSPACE_REG_FDS = process.platform === "darwin" ? 8 : 64;
+/**
+ * Maximum gateway-ready output tail retained while waiting for startup.
+ */
+const GATEWAY_READY_OUTPUT_MAX_CHARS = 128 * 1024;
+/**
+ * Maximum bytes read from the memory_search HTTP response.
+ */
+const MEMORY_SEARCH_RESPONSE_MAX_BYTES = 256 * 1024;
+/**
+ * Probe query expected to hit the synthetic top-level memory file.
+ */
+const MEMORY_SEARCH_PROBE_QUERY = "Top-level memory file";
+
+const SKIP_GATEWAY_ENV = {
+  NODE_ENV: "test",
+  OPENCLAW_DISABLE_BONJOUR: "1",
+  OPENCLAW_NO_RESPAWN: "1",
+  OPENCLAW_SKIP_ACPX_RUNTIME: "1",
+  OPENCLAW_SKIP_ACPX_RUNTIME_PROBE: "1",
+  OPENCLAW_SKIP_BROWSER_CONTROL_SERVER: "1",
+  OPENCLAW_SKIP_CANVAS_HOST: "1",
+  OPENCLAW_SKIP_CHANNELS: "1",
+  OPENCLAW_SKIP_CRON: "1",
+  OPENCLAW_SKIP_GMAIL_WATCHER: "1",
+  OPENCLAW_SKIP_PROVIDERS: "1",
+};
+
+function usage() {
+  return `
+Usage: node --import tsx scripts/check-memory-fd-repro.mts [options]
+
+Options:
+  --full                         Use the issue-sized 12,391-file memory tree.
+  --files <count>                Number of memory/**/*.md files to generate. Default: ${DEFAULT_FILE_COUNT}.
+  --mode <fixed|leak|report>     fixed fails on FD fan-out; leak expects it; report skips threshold checks. Default: fixed.
+  --max-workspace-reg-fds <n>    Fixed-mode maximum retained workspace Markdown REG FDs. Default: ${DEFAULT_MAX_WORKSPACE_REG_FDS}.
+  --min-leaked-fds <n>           Leak-mode minimum retained workspace Markdown REG FDs. Default: min(files, 64).
+  --invoke-timeout-ms <n>        Abort the memory_search HTTP call after this long. Default: 30000.
+  --sample-delay-ms <n>          First post-invoke FD sample delay. Default: 1000.
+  --settle-delay-ms <n>          Final FD sample delay after invoke settles. Default: 5000.
+  --output-dir <path>            Artifact directory. Default: .artifacts/memory-fd-repro/<timestamp>.
+  --keep                         Keep the synthetic OPENCLAW_HOME and workspace after the run.
+  --allow-non-darwin             Run on non-macOS platforms. lsof REG counts are most meaningful on macOS.
+  --help                         Show this help.
+`.trim();
+}
+
+const ARGUMENT_FLAGS = new Set([
+  "--allow-non-darwin",
+  "--expect-leak",
+  "--files",
+  "--full",
+  "--help",
+  "--invoke-timeout-ms",
+  "--keep",
+  "--max-workspace-reg-fds",
+  "--min-leaked-fds",
+  "--mode",
+  "--output-dir",
+  "--report-only",
+  "--sample-delay-ms",
+  "--settle-delay-ms",
+]);
+
+function stripPackageManagerSeparatorForKnownFlags(argv: string[]) {
+  return argv[0] === "--" && argv[1] !== undefined && ARGUMENT_FLAGS.has(argv[1])
+    ? stripLeadingPackageManagerSeparator(argv)
+    : argv;
+}
+
+/**
+ * Parses a safe positive integer option.
+ */
+function readPositiveNumber(value: unknown, label: string) {
+  const parsed = parseNonNegativeInteger(value, label);
+  if (parsed <= 0) {
+    throw new Error(`${label} must be greater than 0`);
+  }
+  return parsed;
+}
+
+function readNumberEnv(name: string, fallback: number) {
+  const raw = process.env[name];
+  return raw == null || raw.trim() === "" ? fallback : parseNonNegativeInteger(raw, name);
+}
+
+function readPositiveNumberEnv(name: string, fallback: number) {
+  const raw = process.env[name];
+  return raw == null || raw.trim() === "" ? fallback : readPositiveNumber(raw, name);
+}
+
+function readTimerTimeoutNumber(value: unknown, label: string, minMs = 1) {
+  const parsed =
+    minMs > 0 ? readPositiveNumber(value, label) : parseNonNegativeInteger(value, label);
+  return resolveTimerTimeoutMs(parsed, minMs, minMs);
+}
+
+function readTimerTimeoutNumberEnv(name: string, fallback: number, minMs = 1) {
+  const raw = process.env[name];
+  return raw == null || raw.trim() === ""
+    ? resolveTimerTimeoutMs(fallback, minMs, minMs)
+    : readTimerTimeoutNumber(raw, name, minMs);
+}
+
+/**
+ * Parses memory FD repro CLI arguments and environment fallbacks.
+ */
+export function parseArgs(argv: string[]) {
+  const args = stripPackageManagerSeparatorForKnownFlags(argv);
+  const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+  let fileCount: number | undefined;
+  let maxWorkspaceRegFds: number | undefined;
+  let minLeakedFds: number | undefined;
+  let invokeTimeoutMs: number | undefined;
+  let sampleDelayMs: number | undefined;
+  let settleDelayMs: number | undefined;
+  let mode = process.env.OPENCLAW_MEMORY_FD_REPRO_MODE || "fixed";
+  let outputDir = path.resolve(".artifacts", "memory-fd-repro", stamp);
+  let keep = process.env.OPENCLAW_MEMORY_FD_REPRO_KEEP === "1";
+  let allowNonDarwin = process.env.OPENCLAW_MEMORY_FD_REPRO_ALLOW_NON_DARWIN === "1";
+
+  parseArgv: for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg === undefined) {
+      break;
+    }
+    const next = args[i + 1];
+    const readValue = () => {
+      if (!next || next.startsWith("-")) {
+        throw new Error(`Missing value for ${arg}`);
+      }
+      i += 1;
+      return next;
+    };
+
+    switch (arg) {
+      case "--":
+        break parseArgv;
+      case "--help":
+        console.log(usage());
+        process.exit(0);
+      case "--full":
+        fileCount = ISSUE_MEMORY_FILE_COUNT;
+        break;
+      case "--files":
+        fileCount = readPositiveNumber(readValue(), "--files");
+        break;
+      case "--mode":
+        mode = readValue();
+        break;
+      case "--expect-leak":
+        mode = "leak";
+        break;
+      case "--report-only":
+        mode = "report";
+        break;
+      case "--max-workspace-reg-fds":
+        maxWorkspaceRegFds = parseNonNegativeInteger(readValue(), "--max-workspace-reg-fds");
+        break;
+      case "--min-leaked-fds":
+        minLeakedFds = readPositiveNumber(readValue(), "--min-leaked-fds");
+        break;
+      case "--invoke-timeout-ms":
+        invokeTimeoutMs = readTimerTimeoutNumber(readValue(), "--invoke-timeout-ms");
+        break;
+      case "--sample-delay-ms":
+        sampleDelayMs = readTimerTimeoutNumber(readValue(), "--sample-delay-ms", 0);
+        break;
+      case "--settle-delay-ms":
+        settleDelayMs = readTimerTimeoutNumber(readValue(), "--settle-delay-ms", 0);
+        break;
+      case "--output-dir":
+        outputDir = path.resolve(readValue());
+        break;
+      case "--keep":
+        keep = true;
+        break;
+      case "--allow-non-darwin":
+        allowNonDarwin = true;
+        break;
+      default:
+        throw new Error(`Unknown argument: ${arg}`);
+    }
+  }
+
+  if (mode !== "fixed" && mode !== "leak" && mode !== "report") {
+    throw new Error('--mode must be "fixed", "leak", or "report"');
+  }
+  fileCount ??= readPositiveNumberEnv("OPENCLAW_MEMORY_FD_REPRO_FILES", DEFAULT_FILE_COUNT);
+  maxWorkspaceRegFds ??= readNumberEnv(
+    "OPENCLAW_MEMORY_FD_REPRO_MAX_WORKSPACE_REG_FDS",
+    DEFAULT_MAX_WORKSPACE_REG_FDS,
+  );
+  invokeTimeoutMs ??= readTimerTimeoutNumberEnv("OPENCLAW_MEMORY_FD_REPRO_TIMEOUT_MS", 30_000);
+  sampleDelayMs ??= readTimerTimeoutNumberEnv("OPENCLAW_MEMORY_FD_REPRO_SAMPLE_DELAY_MS", 1_000, 0);
+  settleDelayMs ??= readTimerTimeoutNumberEnv("OPENCLAW_MEMORY_FD_REPRO_SETTLE_DELAY_MS", 5_000, 0);
+  if (!Number.isFinite(fileCount) || fileCount <= 0) {
+    throw new Error("file count must be greater than 0");
+  }
+  if (!Number.isFinite(maxWorkspaceRegFds) || maxWorkspaceRegFds < 0) {
+    throw new Error("max workspace REG FD threshold must be non-negative");
+  }
+  return {
+    fileCount,
+    mode,
+    maxWorkspaceRegFds,
+    minLeakedFds: minLeakedFds ?? Math.min(fileCount, 64),
+    invokeTimeoutMs,
+    sampleDelayMs,
+    settleDelayMs,
+    outputDir,
+    keep,
+    allowNonDarwin,
+  };
+}
+
+function logStep(message: string) {
+  console.log(`[memory-fd-repro] ${message}`);
+}
+
+async function getFreePort() {
+  return await new Promise<number>((resolve, reject) => {
+    const server = net.createServer();
+    server.unref();
+    server.on("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      const port = typeof address === "object" && address ? address.port : 0;
+      server.close(() => (port > 0 ? resolve(port) : reject(new Error("no free port"))));
+    });
+  });
+}
+
+function distributeFileCounts(total: number) {
+  const exact = ISSUE_FILE_COUNTS.map(([dir, count]) => ({
+    dir,
+    count: Math.floor((count / ISSUE_MEMORY_FILE_COUNT) * total),
+    remainder: (count / ISSUE_MEMORY_FILE_COUNT) * total,
+  }));
+  let assigned = exact.reduce((sum, entry) => sum + entry.count, 0);
+  for (const entry of exact.toSorted((a, b) => b.remainder - a.remainder)) {
+    if (assigned >= total) {
+      break;
+    }
+    entry.count += 1;
+    assigned += 1;
+  }
+  return exact
+    .filter((entry) => entry.count > 0)
+    .map(({ dir, count }) => [dir, count] satisfies [string, number]);
+}
+
+function writeSyntheticWorkspace(workspaceDir: string, fileCount: number) {
+  fs.mkdirSync(workspaceDir, { recursive: true });
+  fs.writeFileSync(
+    path.join(workspaceDir, "MEMORY.md"),
+    "# Memory\n\nTop-level memory file for FD repro.\n",
+  );
+
+  for (const [relativeDir, count] of distributeFileCounts(fileCount)) {
+    const dir = path.join(workspaceDir, relativeDir);
+    fs.mkdirSync(dir, { recursive: true });
+    for (let index = 1; index <= count; index += 1) {
+      const name = `${String(index).padStart(5, "0")}.md`;
+      fs.writeFileSync(
+        path.join(dir, name),
+        `# ${relativeDir} ${index}\n\nSynthetic memory note ${index}.\n`,
+      );
+    }
+  }
+}
+
+/**
+ * Writes isolated OpenClaw config for the synthetic memory workspace.
+ */
+export function writeConfig({ homeDir, workspaceDir, port, token }: ConfigOptions) {
+  const configDir = path.join(homeDir, ".openclaw");
+  fs.mkdirSync(configDir, { recursive: true });
+  const configPath = path.join(configDir, "openclaw.json");
+  const config = {
+    agents: {
+      defaults: {
+        workspace: workspaceDir,
+      },
+      entries: {
+        main: {
+          default: true,
+          tools: { allow: ["memory_search"] },
+        },
+      },
+    },
+    memory: {
+      search: {
+        provider: "none",
+        model: "",
+        store: {
+          vector: { enabled: false },
+        },
+      },
+    },
+    plugins: { allow: ["memory-core"] },
+    gateway: {
+      mode: "local",
+      bind: "loopback",
+      port,
+      auth: { mode: "token", token },
+    },
+  };
+  fs.writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`);
+  return configPath;
+}
+
+function formatTail(text: string, maxChars = 4096) {
+  return text.length > maxChars ? text.slice(-maxChars) : text;
+}
+
+function preindexSyntheticMemory(env: NodeJS.ProcessEnv) {
+  logStep("preindex start");
+  const result = spawnSync(
+    process.execPath,
+    ["scripts/run-node.mjs", "memory", "index", "--force", "--agent", "main"],
+    {
+      cwd: process.cwd(),
+      encoding: "utf8",
+      env,
+      maxBuffer: 10 * 1024 * 1024,
+      stdio: ["ignore", "pipe", "pipe"],
+    },
+  );
+  if (result.status !== 0) {
+    throw new Error(
+      [
+        `memory preindex failed with exit ${result.status ?? result.signal}`,
+        formatTail(result.stdout || ""),
+        formatTail(result.stderr || ""),
+      ]
+        .filter(Boolean)
+        .join("\n"),
+    );
+  }
+  logStep("preindex complete");
+}
+
+/**
+ * Updates bounded gateway-ready output state from a stdout/stderr chunk.
+ */
+export function updateGatewayReadyOutputState(
+  state: GatewayReadyOutputState,
+  chunk: string,
+  maxChars = GATEWAY_READY_OUTPUT_MAX_CHARS,
+) {
+  const combined = `${state.tail ?? ""}${chunk}`;
+  return {
+    tail: combined.length > maxChars ? combined.slice(-maxChars) : combined,
+    readySeen: state.readySeen || combined.includes("[gateway] ready"),
+  };
+}
+
+function runLsofForPid(pid: number) {
+  const result = spawnSync("lsof", ["-nP", "-p", String(pid)], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  if (result.error) {
+    throw result.error;
+  }
+  if (result.status !== 0) {
+    throw new Error(`lsof failed: ${result.stderr || result.stdout}`);
+  }
+  return result.stdout;
+}
+
+function findGatewayPid(port: number) {
+  const result = spawnSync("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN", "-t"], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  if (result.error) {
+    throw result.error;
+  }
+  if (result.status !== 0) {
+    if (result.status === 1 && result.stdout.trim() === "" && result.stderr.trim() === "") {
+      return null;
+    }
+    throw new Error(`lsof listener query failed: ${result.stderr || result.stdout}`);
+  }
+  const pid = Number(result.stdout.trim().split(/\s+/)[0]);
+  return Number.isFinite(pid) && pid > 0 ? pid : null;
+}
+
+function sampleFds({ label, pid, workspaceRealPath }: FdSampleOptions) {
+  const output = runLsofForPid(pid);
+  const workspacePrefix = `${workspaceRealPath}${path.sep}`;
+  const workspaceMarkdownPaths: string[] = [];
+  let total = 0;
+  let reg = 0;
+
+  for (const line of output.split("\n").slice(1)) {
+    if (!line.trim()) {
+      continue;
+    }
+    total += 1;
+    const columns = line.trim().split(/\s+/);
+    const type = columns[4];
+    const filePath = columns[columns.length - 1];
+    if (type === "REG") {
+      reg += 1;
+    }
+    if (
+      type === "REG" &&
+      filePath?.startsWith(workspacePrefix) &&
+      (filePath === path.join(workspaceRealPath, "MEMORY.md") ||
+        (filePath.startsWith(path.join(workspaceRealPath, "memory") + path.sep) &&
+          filePath.endsWith(".md")))
+    ) {
+      workspaceMarkdownPaths.push(filePath);
+    }
+  }
+
+  const sample = {
+    label,
+    totalFds: total,
+    regFds: reg,
+    workspaceMarkdownRegFds: workspaceMarkdownPaths.length,
+    uniqueWorkspaceMarkdownRegFds: new Set(workspaceMarkdownPaths).size,
+    sampledAt: new Date().toISOString(),
+  };
+  logStep(
+    `${label}: total=${sample.totalFds} reg=${sample.regFds} workspace_md_reg=${sample.workspaceMarkdownRegFds} unique_workspace_md_reg=${sample.uniqueWorkspaceMarkdownRegFds}`,
+  );
+  return sample;
+}
+
+/**
+ * Reports whether a spawned child has already exited.
+ */
+function hasChildExited(child: ChildExitState) {
+  return child.exitCode !== null || child.signalCode !== null;
+}
+
+function assertGatewayRunning(child: GatewayReadyChild, tail = "") {
+  if (hasChildExited(child)) {
+    throw new Error(
+      `gateway exited before ready or measurement completed (${child.signalCode ?? child.exitCode})\n${formatTail(tail)}`,
+    );
+  }
+  if (!child.pid) {
+    throw new Error("gateway did not acquire a process ID");
+  }
+  return child.pid;
+}
+
+/**
+ * Readiness corroborates the launched PID; a port never selects a process owner.
+ */
+export async function waitForGatewayReady({
+  child,
+  port,
+  logPath,
+  timeoutMs,
+  outputState = {},
+}: GatewayReadyOptions) {
+  const startedAt = Date.now();
+  while (Date.now() - startedAt < timeoutMs) {
+    const pid = assertGatewayRunning(child, outputState.tail);
+    if (outputState.readySeen) {
+      const listener = findGatewayPid(port);
+      if (listener === pid) {
+        return pid;
+      }
+      if (listener !== null) {
+        throw new Error("gateway listener does not belong to the launched process");
+      }
+    }
+    await sleep(100);
+  }
+  throw new Error(`gateway did not become ready within ${timeoutMs}ms; see ${logPath}`);
+}
+
+function parseToolTextContent(result: Record<string, unknown> | null) {
+  const content = Array.isArray(result?.content) ? result.content : [];
+  for (const entry of content) {
+    const record = asRecord(entry);
+    const text = record?.type === "text" && typeof record.text === "string" ? record.text : null;
+    if (!text) {
+      continue;
+    }
+    const parsed = asRecord(safeParseJson(text));
+    if (parsed) {
+      return parsed;
+    }
+  }
+  return null;
+}
+
+/**
+ * Classifies the memory_search HTTP response into success/error details.
+ */
+export function classifyMemorySearchInvokeResponse({
+  httpOk,
+  status,
+  bodyText,
+}: InvokeResponseOptions) {
+  const parsedBody = safeParseJson(bodyText);
+  const body = asRecord(parsedBody);
+  if (!httpOk) {
+    const errorRecord = asRecord(body?.error);
+    return {
+      ok: false,
+      httpOk,
+      status,
+      gatewayOk: body?.ok === true ? true : body?.ok === false ? false : undefined,
+      error:
+        readNonBlankString(errorRecord?.message) ??
+        readNonBlankString(body?.error) ??
+        `memory_search HTTP request failed with status ${status}`,
+    };
+  }
+  if (!body) {
+    return {
+      ok: false,
+      httpOk,
+      status,
+      error: "memory_search response was not JSON",
+    };
+  }
+
+  const gatewayOk = body.ok === true ? true : body.ok === false ? false : undefined;
+  if (gatewayOk === false) {
+    const errorRecord = asRecord(body.error);
+    return {
+      ok: false,
+      httpOk,
+      status,
+      gatewayOk,
+      error:
+        readNonBlankString(errorRecord?.message) ??
+        readNonBlankString(body.error) ??
+        "memory_search gateway invocation failed",
+    };
+  }
+
+  const result = asRecord(body.result);
+  const details = asRecord(result?.details);
+  const directResult = Array.isArray(result?.results) ? result : null;
+  const directBody =
+    Array.isArray(body.results) || body.disabled === true || body.unavailable === true
+      ? body
+      : null;
+  const payload = details ?? parseToolTextContent(result) ?? directResult ?? directBody;
+  if (!payload) {
+    return {
+      ok: false,
+      httpOk,
+      status,
+      gatewayOk,
+      error: "memory_search result payload missing or invalid",
+    };
+  }
+  const resultCount = Array.isArray(payload.results) ? payload.results.length : undefined;
+  const toolDisabled = payload.disabled === true;
+  const toolUnavailable = payload.unavailable === true;
+  const toolError = readNonBlankString(payload.error);
+  const ok = gatewayOk === true && !toolDisabled && !toolUnavailable && !toolError;
+
+  return {
+    ok,
+    httpOk,
+    status,
+    gatewayOk,
+    resultCount,
+    toolDisabled,
+    toolUnavailable,
+    ...(toolError ? { toolError } : {}),
+    ...(ok
+      ? {}
+      : {
+          error:
+            toolError ??
+            (toolDisabled || toolUnavailable
+              ? "memory_search returned disabled/unavailable"
+              : "memory_search result payload missing or invalid"),
+        }),
+  };
+}
+
+export async function invokeMemorySearch({ port, token, timeoutMs, signal }: InvokeOptions) {
+  const resolvedTimeoutMs = resolveTimerTimeoutMs(timeoutMs, 1);
+  const controller = new AbortController();
+  const abort = () => controller.abort();
+  signal?.addEventListener("abort", abort, { once: true });
+  if (signal?.aborted) {
+    abort();
+  }
+  const timer = setTimeout(() => controller.abort(), resolvedTimeoutMs);
+  const startedAt = Date.now();
+  try {
+    const res = await fetch(`http://127.0.0.1:${port}/tools/invoke`, {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${token}`,
+        "content-type": "application/json",
+      },
+      body: JSON.stringify({
+        tool: "memory_search",
+        args: {
+          query: MEMORY_SEARCH_PROBE_QUERY,
+          maxResults: 1,
+          corpus: "memory",
+        },
+        sessionKey: "main",
+      }),
+      signal: controller.signal,
+    });
+    const text = await readBoundedResponseText(
+      res,
+      "memory_search",
+      MEMORY_SEARCH_RESPONSE_MAX_BYTES,
+      { signal: controller.signal },
+    );
+    const result = classifyMemorySearchInvokeResponse({
+      httpOk: res.ok,
+      status: res.status,
+      bodyText: text,
+    });
+    return {
+      ...result,
+      durationMs: Date.now() - startedAt,
+      bodyPreview: text.slice(0, 500),
+    };
+  } catch (error) {
+    return {
+      ok: false,
+      aborted: error instanceof Error && error.name === "AbortError",
+      durationMs: Date.now() - startedAt,
+      error: error instanceof Error ? error.message : String(error),
+    };
+  } finally {
+    clearTimeout(timer);
+    signal?.removeEventListener("abort", abort);
+  }
+}
+
+type FailureOptions = {
+  invokePassed: boolean;
+  options: ReturnType<typeof parseArgs>;
+  peak: number;
+};
+
+function formatFailure({ invokePassed, options, peak }: FailureOptions) {
+  if (options.mode === "fixed" && !invokePassed) {
+    return `memory_search did not complete successfully; see summary invoke details`;
+  }
+  if (options.mode === "fixed") {
+    return `workspace Markdown REG FDs peaked at ${peak}, above max ${options.maxWorkspaceRegFds}`;
+  }
+  if (options.mode === "leak") {
+    return `workspace Markdown REG FDs peaked at ${peak}, below leak threshold ${options.minLeakedFds}`;
+  }
+  return "";
+}
+
+function formatErrors(errors: unknown[]) {
+  return [
+    ...new Set(
+      errors
+        .flatMap((error) =>
+          error instanceof AggregateError ? [error].concat(error.errors) : [error],
+        )
+        .map((error) => formatErrorMessage(error).slice(0, 8192)),
+    ),
+  ].join("\n");
+}
+
+async function main() {
+  const options = parseArgs(process.argv.slice(2));
+  if (process.platform !== "darwin" && !options.allowNonDarwin) {
+    console.log(
+      `[memory-fd-repro] skipped: lsof REG watcher counts are macOS-focused; pass --allow-non-darwin to run on ${process.platform}`,
+    );
+    return;
+  }
+
+  const lsofAvailable = spawnSync("lsof", ["-v"], { stdio: "ignore" }).status === 0;
+  if (!lsofAvailable) {
+    throw new Error("lsof is required for memory FD repro instrumentation");
+  }
+
+  const rootDir = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-memory-fd-repro-"));
+  const homeDir = path.join(rootDir, "home");
+  const workspaceDir = path.join(rootDir, "workspace");
+  const logPath = path.join(options.outputDir, "gateway.log");
+  const generatedAt = new Date().toISOString();
+  const stop = new AbortController();
+  const invokeStop = new AbortController();
+  const measurementSignal = AbortSignal.any([stop.signal, invokeStop.signal]);
+  const outputState: GatewayReadyOutputState = {};
+  const errors: unknown[] = [];
+  const outputErrors: unknown[] = [];
+  let child: ChildProcess | undefined;
+  let completion: Promise<{ code: number } | { error: unknown }> | undefined;
+  let pendingInvoke: ReturnType<typeof invokeMemorySearch> | undefined;
+  let measurement:
+    | {
+        pid: number;
+        samples: ReturnType<typeof sampleFds>[];
+        invoke: Awaited<ReturnType<typeof invokeMemorySearch>>;
+      }
+    | undefined;
+  try {
+    fs.mkdirSync(options.outputDir, { recursive: true });
+    const port = await getFreePort();
+    const token = `memory-fd-repro-${process.pid}`;
+    writeSyntheticWorkspace(workspaceDir, options.fileCount);
+    const configPath = writeConfig({ homeDir, workspaceDir, port, token });
+    const workspaceRealPath = fs.realpathSync.native(workspaceDir);
+    const env: NodeJS.ProcessEnv = {
+      ...process.env,
+      ...SKIP_GATEWAY_ENV,
+      HOME: homeDir,
+      OPENCLAW_STATE_DIR: path.join(homeDir, ".openclaw"),
+      OPENCLAW_CONFIG_PATH: configPath,
+      OPENCLAW_GATEWAY_TOKEN: token,
+      // The measured PID must not respawn for compile-cache activation.
+      NODE_DISABLE_COMPILE_CACHE: "1",
+    };
+    env.OPENCLAW_DEV_SOURCE_ROOT ??= process.cwd();
+    preindexSyntheticMemory(env);
+    completion = runManagedCommand({
+      bin: process.execPath,
+      args: [
+        path.resolve("openclaw.mjs"),
+        "gateway",
+        "run",
+        "--port",
+        String(port),
+        "--auth",
+        "token",
+        "--token",
+        token,
+        "--bind",
+        "loopback",
+        "--allow-unconfigured",
+      ],
+      cwd: process.cwd(),
+      env,
+      shell: false,
+      stdio: ["ignore", "pipe", "pipe"],
+      signal: stop.signal,
+      // Cancel measurement without replacing the managed owner's signal outcome.
+      onSignal: () => invokeStop.abort(),
+      // The shared owner adds its separate 5s output/group drainage allowance.
+      abortKillGraceMs: 5_000,
+      requireProcessTreeExit: process.platform !== "win32",
+      onReady(launched) {
+        child = launched;
+        launched.once("exit", () => invokeStop.abort());
+        const captureOutputError = (error: unknown) => {
+          if (outputErrors.length === 0) {
+            outputErrors.push(error);
+          }
+          stop.abort();
+        };
+        const append = (chunk: Uint8Array | string) => {
+          const text = chunk.toString();
+          Object.assign(outputState, updateGatewayReadyOutputState(outputState, text));
+          try {
+            fs.appendFileSync(logPath, text);
+          } catch (error) {
+            captureOutputError(error);
+          }
+        };
+        // Observe both error channels before data listeners start flowing;
+        // read failures must retire the owner through the same cleanup path.
+        launched.stdout!.on("error", captureOutputError);
+        launched.stderr!.on("error", captureOutputError);
+        launched.stdout!.on("data", append);
+        launched.stderr!.on("data", append);
+      },
+    }).then(
+      (code) => ({ code }),
+      (error: unknown) => ({ error }),
+    );
+    // onReady is synchronous. Observe completion immediately, then measure
+    // outside that callback so setup, measurement and teardown share one owner.
+    if (!child) {
+      const result = await completion;
+      throw "error" in result ? result.error : new Error("gateway failed to launch");
+    }
+    const ownedChild = child;
+    logStep(`workspace=${workspaceDir}`);
+    logStep(`files=${options.fileCount} mode=${options.mode} port=${port}`);
+    const pid = await waitForGatewayReady({
+      child: ownedChild,
+      port,
+      logPath,
+      timeoutMs: 60_000,
+      outputState,
+    });
+    const sample = (label: string) => {
+      assertGatewayRunning(ownedChild, outputState.tail);
+      if (findGatewayPid(port) !== pid) {
+        throw new Error("gateway listener no longer belongs to the launched process");
+      }
+      return sampleFds({ label, pid, workspaceRealPath });
+    };
+    const samples = [sample("baseline")];
+    pendingInvoke = invokeMemorySearch({
+      port,
+      token,
+      timeoutMs: options.invokeTimeoutMs,
+      signal: measurementSignal,
+    });
+    await sleep(options.sampleDelayMs, undefined, { signal: measurementSignal });
+    samples.push(sample("during"));
+    const invoke = await pendingInvoke;
+    logStep(`invoke=${JSON.stringify(invoke)}`);
+    await sleep(options.settleDelayMs, undefined, { signal: measurementSignal });
+    samples.push(sample("settled"));
+    measurement = { pid, samples, invoke };
+  } catch (error) {
+    errors.push(error);
+  } finally {
+    // A sampling failure must also retire the request it started, before
+    // releasing either the Gateway's inputs or the measurement owner.
+    invokeStop.abort();
+    await pendingInvoke;
+    if (completion) {
+      if (child && !hasChildExited(child)) {
+        stop.abort();
+      }
+      const result = await completion;
+      if ("error" in result) {
+        // Only this owner's abort, after the helper verified cleanup, is expected.
+        if (
+          !stop.signal.aborted ||
+          !(result.error instanceof Error) ||
+          !("code" in result.error) ||
+          result.error.code !== "ABORT_ERR"
+        ) {
+          errors.push(result.error);
+        }
+      } else if (result.code !== 0) {
+        errors.push(
+          new Error(
+            `gateway exited with code ${result.code}\n${formatTail(outputState.tail ?? "")}`,
+          ),
+        );
+      }
+    }
+    errors.push(...outputErrors);
+    if (!options.keep && !errors.some(hasUnjoinedWork)) {
+      try {
+        fs.rmSync(rootDir, { recursive: true, force: true, maxRetries: 10, retryDelay: 50 });
+      } catch (error) {
+        errors.push(error);
+      }
+    } else {
+      logStep(`kept synthetic root=${rootDir}`);
+    }
+  }
+  if (measurement) {
+    const { pid, samples, invoke } = measurement;
+    const peak = Math.max(...samples.map((sample) => sample.uniqueWorkspaceMarkdownRegFds));
+    const invokePassed = invoke.ok;
+    const measurementPassed =
+      options.mode === "report" ||
+      (options.mode === "fixed" && invokePassed && peak <= options.maxWorkspaceRegFds) ||
+      (options.mode === "leak" && peak >= options.minLeakedFds);
+    if (!measurementPassed) {
+      errors.unshift(new Error(formatFailure({ invokePassed, options, peak })));
+    }
+    // Retain completed measurements after settlement, even when cleanup failed.
+    // Report-only exempts thresholds, never ownership or cleanup.
+    const summary = {
+      generatedAt,
+      platform: process.platform,
+      mode: options.mode,
+      fileCount: options.fileCount,
+      expectedMarkdownFiles: options.fileCount + 1,
+      thresholds: {
+        maxWorkspaceRegFds: options.maxWorkspaceRegFds,
+        minLeakedFds: options.minLeakedFds,
+      },
+      rootDir,
+      outputDir: options.outputDir,
+      samples,
+      invoke,
+      gatewayPid: pid,
+      peakUniqueWorkspaceMarkdownRegFds: peak,
+      passed: errors.length === 0,
+      failure: errors.length > 0 ? formatErrors(errors) : undefined,
+    };
+    try {
+      fs.writeFileSync(
+        path.join(options.outputDir, "summary.json"),
+        `${JSON.stringify(summary, null, 2)}\n`,
+      );
+      logStep(`summary=${path.join(options.outputDir, "summary.json")}`);
+    } catch (error) {
+      errors.push(error);
+    }
+  } else if (errors.length === 0) {
+    errors.push(new Error("gateway measurement did not complete"));
+  }
+  if (errors.length > 0) {
+    throw new AggregateError(errors, formatErrors(errors));
+  }
+}
+
+function isMainModule() {
+  const entrypoint = process.argv[1];
+  return Boolean(entrypoint && import.meta.url === pathToFileURL(path.resolve(entrypoint)).href);
+}
+
+if (isMainModule()) {
+  main().catch((error: unknown) => {
+    console.error(
+      `[memory-fd-repro] failed: ${error instanceof Error ? error.message : String(error)}`,
+    );
+    process.exit(1);
+  });
+}
diff --git a/scripts/check-no-extension-src-imports.ts b/scripts/check-no-extension-src-imports.ts
new file mode 100644
index 0000000000000000000000000000000000000000..dc9bb109892a5548ab7e57b530c9a13668a4a8a2
--- /dev/null
+++ b/scripts/check-no-extension-src-imports.ts
@@ -0,0 +1,44 @@
+// Check No Extension Src Imports script supports OpenClaw repository automation.
+import fs from "node:fs";
+import path from "node:path";
+import { collectFilesSync, isCodeFile, relativeToCwd } from "./check-file-utils.js";
+import { classifyBundledExtensionSourcePath } from "./lib/extension-source-classifier.mts";
+
+const FORBIDDEN_REPO_SRC_IMPORT = /["'](?:\.\.\/)+(?:src\/)[^"']+["']/;
+
+function collectExtensionSourceFiles(rootDir: string): string[] {
+  return collectFilesSync(rootDir, {
+    includeFile: (filePath) =>
+      isCodeFile(filePath) && classifyBundledExtensionSourcePath(filePath).isProductionSource,
+  });
+}
+
+function main() {
+  const extensionsDir = path.join(process.cwd(), "extensions");
+  const files = collectExtensionSourceFiles(extensionsDir);
+  const offenders: string[] = [];
+
+  for (const file of files) {
+    const content = fs.readFileSync(file, "utf8");
+    if (FORBIDDEN_REPO_SRC_IMPORT.test(content)) {
+      offenders.push(file);
+    }
+  }
+
+  if (offenders.length > 0) {
+    console.error("Production extension files must not import the repo src/ tree directly.");
+    for (const offender of offenders.toSorted()) {
+      console.error(`- ${relativeToCwd(offender)}`);
+    }
+    console.error(
+      "Publish a focused openclaw/plugin-sdk/<subpath> surface or use the extension's own public barrel instead.",
+    );
+    process.exit(1);
+  }
+
+  console.log(
+    `OK: production extension files avoid direct repo src/ imports (${files.length} checked).`,
+  );
+}
+
+main();
diff --git a/scripts/check-no-extension-test-core-imports.ts b/scripts/check-no-extension-test-core-imports.ts
new file mode 100644
index 0000000000000000000000000000000000000000..34ff0372619c17b73906579b61831c9a5e73cc2b
--- /dev/null
+++ b/scripts/check-no-extension-test-core-imports.ts
@@ -0,0 +1,356 @@
+// Check No Extension Test Core Imports script supports OpenClaw repository automation.
+import fs from "node:fs";
+import path from "node:path";
+import { collectFilesSync, isCodeFile, relativeToCwd } from "./check-file-utils.js";
+
+type Offender = { file: string; hint: string; line?: number; specifier?: string };
+
+const FORBIDDEN_PATTERNS: Array<{ pattern: RegExp; hint: string }> = [
+  {
+    pattern: /["']openclaw\/plugin-sdk["']/,
+    hint: "Use openclaw/plugin-sdk/<subpath> instead of the monolithic root entry.",
+  },
+  {
+    pattern: /["']openclaw\/plugin-sdk\/test-utils["']/,
+    hint: "Use a focused plugin-sdk test subpath for the public extension test surface.",
+  },
+  {
+    pattern: /["']openclaw\/plugin-sdk\/compat["']/,
+    hint: "Use a focused public plugin-sdk subpath instead of compat.",
+  },
+  {
+    pattern: /["'](?:\.\.\/)+(?:test-utils\/)[^"']+["']/,
+    hint: "Use a documented openclaw/plugin-sdk test subpath for bundled extension test helpers.",
+  },
+  {
+    pattern: /["'](?:\.\.\/)+(?:test\/helpers\/plugins\/)[^"']+["']/,
+    hint: "Use a documented openclaw/plugin-sdk test subpath instead of repo-only plugin helper bridges.",
+  },
+  {
+    pattern: /["'](?:\.\.\/)+(?:test\/helpers\/channels\/)[^"']+["']/,
+    hint: "Use openclaw/plugin-sdk/channel-test-helpers or another focused SDK test subpath instead of repo-only channel helper bridges.",
+  },
+  {
+    pattern: /["'](?:\.\.\/)+(?:test\/helpers\/media-generation\/)[^"']+["']/,
+    hint: "Use openclaw/plugin-sdk/test-media-generation, provider-test-contracts, or provider-http-test-mocks instead of repo-only media provider helper bridges.",
+  },
+  {
+    pattern:
+      /["'](?:\.\.\/)+(?:test\/helpers\/(?:bundled-channel-entry|envelope-timestamp|pairing-reply)\.(?:js|ts))["']/,
+    hint: "Use openclaw/plugin-sdk/channel-test-helpers instead of repo-only channel test helper bridges.",
+  },
+  {
+    pattern:
+      /["'](?:\.\.\/)+(?:test\/helpers\/(?:http-test-server|mock-incoming-request|temp-home)\.(?:js|ts))["']/,
+    hint: "Use openclaw/plugin-sdk/test-env instead of repo-only environment/network test helper bridges.",
+  },
+  {
+    pattern:
+      /["'](?:\.\.\/)+(?:test\/helpers\/(?:bundled-plugin-paths|import-fresh|node-builtin-mocks)\.(?:js|ts))["']/,
+    hint: "Use openclaw/plugin-sdk/test-fixtures instead of repo-only generic test helper bridges.",
+  },
+  {
+    pattern:
+      /["'](?:\.\.\/)+(?:test\/helpers\/(?:provider-replay-policy|stt-live-audio)\.(?:js|ts))["']/,
+    hint: "Use openclaw/plugin-sdk/provider-test-contracts instead of repo-only provider test helper bridges.",
+  },
+  {
+    pattern: /["'](?:\.\.\/)+(?:test\/helpers\/)[^"']+["']/,
+    hint: "Use a documented openclaw/plugin-sdk test subpath instead of repo-only test helper bridges.",
+  },
+  {
+    pattern: /["'](?:\.\.\/)+(?:src\/channels\/plugins\/contracts\/test-helpers\/)[^"']+["']/,
+    hint: "Use openclaw/plugin-sdk/channel-test-helpers or another focused SDK test subpath instead of core-only channel contract helpers.",
+  },
+  {
+    pattern: /["'](?:\.\.\/)+(?:src\/test-utils\/)[^"']+["']/,
+    hint: "Use a documented openclaw/plugin-sdk test subpath for public surfaces.",
+  },
+  {
+    pattern: /["'](?:\.\.\/)+(?:src\/plugins\/types\.js)["']/,
+    hint: "Use public plugin-sdk/core types or documented plugin-sdk test helpers instead.",
+  },
+  {
+    pattern: /["'](?:\.\.\/)+(?:src\/channels\/plugins\/contracts\/test-helpers\.js)["']/,
+    hint: "Use openclaw/plugin-sdk/channel-contract-testing for channel contract test helpers.",
+  },
+];
+
+const STATIC_RELATIVE_MODULE_PATTERN = /\b(?:import|export)\b[\s\S]*?\bfrom\s*["']([^"']+)["']/g;
+const DYNAMIC_RELATIVE_MODULE_PATTERN = /\bimport\s*\(\s*["']([^"']+)["']\s*\)/g;
+const MOCK_RELATIVE_MODULE_PATTERN =
+  /\bvi\.(?:mock|doMock|unmock|doUnmock)\s*\(\s*["']([^"']+)["']/g;
+
+const RELATIVE_CORE_HINT =
+  "Use a focused plugin-sdk test/runtime subpath instead of core internals.";
+const ROOT_TEST_SUPPORT_LOCAL_SRC_HINT =
+  "Move this helper under the extension's src/test-support tree or expose a narrow test-api/runtime-api surface instead of reaching into private src from package-root test-support.";
+
+// Tombstones for retired repo-only plugin helper bridge files. Keep this list so
+// deleted bridges fail loudly if they are recreated instead of using SDK subpaths.
+const RETIRED_EXTENSION_TEST_HELPER_BRIDGE_FILES = [
+  "test/helpers/plugins/env.ts",
+  "test/helpers/plugins/fetch-mock.ts",
+  "test/helpers/plugins/frozen-time.ts",
+  "test/helpers/plugins/media-understanding.ts",
+  "test/helpers/plugins/mock-http-response.ts",
+  "test/helpers/plugins/contracts-testkit.ts",
+  "test/helpers/plugins/direct-smoke.ts",
+  "test/helpers/plugins/directory.ts",
+  "test/helpers/plugins/onboard-config.ts",
+  "test/helpers/plugins/outbound-delivery.ts",
+  "test/helpers/plugins/package-manifest-contract.ts",
+  "test/helpers/plugins/plugin-api.ts",
+  "test/helpers/plugins/plugin-registration-contract-cases.ts",
+  "test/helpers/plugins/plugin-registration-contract.ts",
+  "test/helpers/plugins/plugin-registration.ts",
+  "test/helpers/plugins/plugin-runtime-mock.ts",
+  "test/helpers/plugins/plugin-registry.ts",
+  "test/helpers/plugins/provider-auth-contract.ts",
+  "test/helpers/plugins/provider-catalog.ts",
+  "test/helpers/plugins/provider-contract-suites.ts",
+  "test/helpers/plugins/provider-contract.ts",
+  "test/helpers/plugins/provider-discovery-contract.ts",
+  "test/helpers/plugins/provider-onboard.ts",
+  "test/helpers/plugins/provider-registration.ts",
+  "test/helpers/plugins/provider-runtime-contract.ts",
+  "test/helpers/plugins/provider-usage-fetch.ts",
+  "test/helpers/plugins/provider-wizard-contract-suites.ts",
+  "test/helpers/plugins/public-artifacts.ts",
+  "test/helpers/plugins/public-surface-loader.ts",
+  "test/helpers/plugins/runtime-taskflow.ts",
+  "test/helpers/plugins/runtime-env.ts",
+  "test/helpers/plugins/send-config.ts",
+  "test/helpers/plugins/setup-wizard.ts",
+  "test/helpers/plugins/start-account-context.ts",
+  "test/helpers/plugins/start-account-lifecycle.ts",
+  "test/helpers/plugins/status-issues.ts",
+  "test/helpers/plugins/stream-hooks.ts",
+  "test/helpers/plugins/subagent-hooks.ts",
+  "test/helpers/plugins/temp-dir.ts",
+  "test/helpers/plugins/temp-home.ts",
+  "test/helpers/plugins/tts-contract-suites.ts",
+  "test/helpers/plugins/typed-cases.ts",
+  "test/helpers/plugins/web-fetch-provider-contract.ts",
+  "test/helpers/plugins/web-search-provider-contract.ts",
+  "test/helpers/media-generation/dashscope-video-provider.ts",
+  "test/helpers/media-generation/provider-capability-assertions.ts",
+  "test/helpers/media-generation/provider-http-mocks.ts",
+  "test/helpers/bundled-channel-entry.ts",
+  "test/helpers/bundled-plugin-paths.ts",
+  "test/helpers/envelope-timestamp.ts",
+  "test/helpers/http-test-server.ts",
+  "test/helpers/import-fresh.ts",
+  "test/helpers/mock-incoming-request.ts",
+  "test/helpers/node-builtin-mocks.ts",
+  "test/helpers/pairing-reply.ts",
+  "test/helpers/provider-replay-policy.ts",
+  "test/helpers/stt-live-audio.ts",
+  "test/helpers/temp-home.ts",
+  "test/helpers/agents/auth-profile-runtime-contract.ts",
+  "test/helpers/agents/delivery-no-reply-runtime-contract.ts",
+  "test/helpers/agents/openclaw-owned-tool-runtime-contract.ts",
+  "test/helpers/agents/outcome-fallback-runtime-contract.ts",
+  "test/helpers/agents/prompt-overlay-runtime-contract.ts",
+  "test/helpers/agents/schema-normalization-runtime-contract.ts",
+  "test/helpers/agents/transcript-repair-runtime-contract.ts",
+  "test/helpers/sandbox-fixtures.ts",
+];
+
+function isExtensionTestFile(filePath: string): boolean {
+  return /\.test\.[cm]?[jt]sx?$/u.test(filePath) || /\.e2e\.test\.[cm]?[jt]sx?$/u.test(filePath);
+}
+
+function isExtensionTestSupportFile(filePath: string): boolean {
+  return (
+    (/(?:^|[/\\])test-support(?:[/\\]|$)/u.test(filePath) ||
+      /(?:\.|-|_)test-support\.[cm]?[jt]sx?$/u.test(filePath)) &&
+    /\.[cm]?[jt]sx?$/u.test(filePath)
+  );
+}
+
+function collectExtensionTestFiles(rootDir: string): string[] {
+  return collectFilesSync(rootDir, {
+    includeFile: (filePath) =>
+      isExtensionTestFile(filePath) || isExtensionTestSupportFile(filePath),
+  });
+}
+
+function collectPluginHelperFiles(rootDir: string): string[] {
+  return collectFilesSync(rootDir, {
+    includeFile: isCodeFile,
+  });
+}
+
+function lineNumberForOffset(content: string, offset: number): number {
+  let line = 1;
+  for (let index = 0; index < offset; index += 1) {
+    if (content.charCodeAt(index) === 10) {
+      line += 1;
+    }
+  }
+  return line;
+}
+
+function resolvesToRepoSrc(filePath: string, specifier: string): boolean {
+  if (!specifier.startsWith(".")) {
+    return false;
+  }
+  const resolved = path.resolve(path.dirname(filePath), specifier);
+  const repoRelative = path.relative(process.cwd(), resolved).replaceAll(path.sep, "/");
+  return repoRelative === "src" || repoRelative.startsWith("src/");
+}
+
+function getExtensionRootForFile(filePath: string): string | undefined {
+  const relativePath = path.relative(process.cwd(), filePath).replaceAll(path.sep, "/");
+  const match = /^extensions\/[^/]+(?:\/|$)/u.exec(relativePath);
+  return match ? path.resolve(process.cwd(), match[0]) : undefined;
+}
+
+function isRootExtensionTestSupportFile(filePath: string): boolean {
+  const relativePath = path.relative(process.cwd(), filePath).replaceAll(path.sep, "/");
+  return /^extensions\/[^/]+\/test-support(?:\.[cm]?[jt]sx?|\/)/u.test(relativePath);
+}
+
+function resolvesToExtensionLocalSrc(filePath: string, specifier: string): boolean {
+  if (!specifier.startsWith(".")) {
+    return false;
+  }
+  const extensionRoot = getExtensionRootForFile(filePath);
+  if (!extensionRoot) {
+    return false;
+  }
+  const resolved = path.resolve(path.dirname(filePath), specifier);
+  const localSrc = path.join(extensionRoot, "src");
+  return resolved === localSrc || resolved.startsWith(`${localSrc}${path.sep}`);
+}
+
+function collectRelativeCoreImportOffenders(
+  filePath: string,
+  content: string,
+  opts: { includeDynamic: boolean },
+): Offender[] {
+  const offenders: Offender[] = [];
+  const matches = [
+    ...content.matchAll(STATIC_RELATIVE_MODULE_PATTERN),
+    ...(opts.includeDynamic ? [...content.matchAll(DYNAMIC_RELATIVE_MODULE_PATTERN)] : []),
+    ...content.matchAll(MOCK_RELATIVE_MODULE_PATTERN),
+  ];
+  for (const match of matches) {
+    const specifier = match[1];
+    if (!specifier || !resolvesToRepoSrc(filePath, specifier)) {
+      continue;
+    }
+    offenders.push({
+      file: filePath,
+      hint: RELATIVE_CORE_HINT,
+      line: lineNumberForOffset(content, match.index ?? 0),
+      specifier,
+    });
+  }
+  return offenders;
+}
+
+function collectRootTestSupportLocalSrcImportOffenders(
+  filePath: string,
+  content: string,
+): Offender[] {
+  if (!isRootExtensionTestSupportFile(filePath)) {
+    return [];
+  }
+  const offenders: Offender[] = [];
+  const matches = [
+    ...content.matchAll(STATIC_RELATIVE_MODULE_PATTERN),
+    ...content.matchAll(DYNAMIC_RELATIVE_MODULE_PATTERN),
+    ...content.matchAll(MOCK_RELATIVE_MODULE_PATTERN),
+  ];
+  for (const match of matches) {
+    const specifier = match[1];
+    if (!specifier || !resolvesToExtensionLocalSrc(filePath, specifier)) {
+      continue;
+    }
+    offenders.push({
+      file: filePath,
+      hint: ROOT_TEST_SUPPORT_LOCAL_SRC_HINT,
+      line: lineNumberForOffset(content, match.index ?? 0),
+      specifier,
+    });
+  }
+  return offenders;
+}
+
+function main() {
+  const extensionsDir = path.join(process.cwd(), "extensions");
+  const pluginHelpersDir = path.join(process.cwd(), "test/helpers/plugins");
+  const retiredChannelHelpersDir = path.join(process.cwd(), "test/helpers/channels");
+  const files = collectExtensionTestFiles(extensionsDir);
+  const pluginHelperFiles = collectPluginHelperFiles(pluginHelpersDir);
+  const retiredChannelHelperFiles = fs.existsSync(retiredChannelHelpersDir)
+    ? collectFilesSync(retiredChannelHelpersDir, { includeFile: isCodeFile })
+    : [];
+  const offenders: Offender[] = [];
+
+  for (const file of retiredChannelHelperFiles) {
+    offenders.push({
+      file,
+      hint: "Keep core channel contract helpers under src/channels/plugins/contracts/test-helpers and public plugin helpers under focused openclaw/plugin-sdk test subpaths.",
+    });
+  }
+
+  for (const file of RETIRED_EXTENSION_TEST_HELPER_BRIDGE_FILES) {
+    const filePath = path.join(process.cwd(), file);
+    if (!fs.existsSync(filePath)) {
+      continue;
+    }
+    offenders.push({
+      file: filePath,
+      hint: "Import the helper directly from a documented openclaw/plugin-sdk testing subpath instead of recreating this bridge.",
+    });
+  }
+
+  for (const file of files) {
+    const content = fs.readFileSync(file, "utf8");
+    for (const rule of FORBIDDEN_PATTERNS) {
+      if (!rule.pattern.test(content)) {
+        continue;
+      }
+      offenders.push({ file, hint: rule.hint });
+      break;
+    }
+    offenders.push(
+      ...collectRelativeCoreImportOffenders(file, content, {
+        includeDynamic: true,
+      }),
+    );
+    offenders.push(...collectRootTestSupportLocalSrcImportOffenders(file, content));
+  }
+
+  for (const file of pluginHelperFiles) {
+    const content = fs.readFileSync(file, "utf8");
+    offenders.push(
+      ...collectRelativeCoreImportOffenders(file, content, {
+        includeDynamic: true,
+      }),
+    );
+  }
+
+  if (offenders.length > 0) {
+    console.error(
+      "Extension test files and plugin test helpers must stay on public plugin-sdk surfaces.",
+    );
+    for (const offender of offenders.toSorted((a, b) => a.file.localeCompare(b.file))) {
+      const location = offender.line
+        ? `${relativeToCwd(offender.file)}:${offender.line}`
+        : relativeToCwd(offender.file);
+      const specifier = offender.specifier ? ` (${offender.specifier})` : "";
+      console.error(`- ${location}${specifier}: ${offender.hint}`);
+    }
+    process.exit(1);
+  }
+
+  console.log(
+    `OK: extension test files, support helpers, and plugin test helpers avoid direct core test/internal imports (${files.length} extension files, ${pluginHelperFiles.length} plugin helpers checked).`,
+  );
+}
+
+main();
diff --git a/scripts/check-no-random-messaging-tmp.mts b/scripts/check-no-random-messaging-tmp.mts
new file mode 100644
index 0000000000000000000000000000000000000000..f23adfd55aade090bc57e45390d3d413ba4405bc
--- /dev/null
+++ b/scripts/check-no-random-messaging-tmp.mts
@@ -0,0 +1,95 @@
+#!/usr/bin/env node
+
+// Blocks host-random tmpdir usage in messaging/channel runtime sources.
+import ts from "typescript";
+import { runCallsiteGuard } from "./lib/callsite-guard.mts";
+import { classifyBundledExtensionSourcePath } from "./lib/extension-source-classifier.mts";
+import {
+  collectCallExpressionLines,
+  runAsScript,
+  unwrapExpression,
+} from "./lib/ts-guard-utils.mts";
+
+/**
+ * Source roots scanned for unsafe messaging tmpdir usage.
+ */
+export const messagingTmpdirGuardSourceRoots = [
+  "src/channels",
+  "src/infra/outbound",
+  "src/line",
+  "src/media",
+  "src/media-understanding",
+  "extensions",
+];
+function collectOsTmpdirImports(sourceFile: ts.SourceFile) {
+  const osModuleSpecifiers = new Set(["node:os", "os"]);
+  const osNamespaceOrDefault = new Set<string>();
+  const namedTmpdir = new Set<string>();
+  for (const statement of sourceFile.statements) {
+    if (!ts.isImportDeclaration(statement)) {
+      continue;
+    }
+    if (!statement.importClause || !ts.isStringLiteral(statement.moduleSpecifier)) {
+      continue;
+    }
+    if (!osModuleSpecifiers.has(statement.moduleSpecifier.text)) {
+      continue;
+    }
+    const clause = statement.importClause;
+    if (clause.name) {
+      osNamespaceOrDefault.add(clause.name.text);
+    }
+    if (!clause.namedBindings) {
+      continue;
+    }
+    if (ts.isNamespaceImport(clause.namedBindings)) {
+      osNamespaceOrDefault.add(clause.namedBindings.name.text);
+      continue;
+    }
+    for (const element of clause.namedBindings.elements) {
+      if ((element.propertyName?.text ?? element.name.text) === "tmpdir") {
+        namedTmpdir.add(element.name.text);
+      }
+    }
+  }
+  return { osNamespaceOrDefault, namedTmpdir };
+}
+
+/**
+ * Finds `os.tmpdir()` or imported `tmpdir()` call lines in source.
+ */
+export function findMessagingTmpdirCallLines(content: string, fileName = "source.ts"): number[] {
+  const sourceFile = ts.createSourceFile(fileName, content, ts.ScriptTarget.Latest, true);
+  const { osNamespaceOrDefault, namedTmpdir } = collectOsTmpdirImports(sourceFile);
+  return collectCallExpressionLines(ts, sourceFile, (node) => {
+    const callee = unwrapExpression(node.expression);
+    if (
+      ts.isPropertyAccessExpression(callee) &&
+      callee.name.text === "tmpdir" &&
+      ts.isIdentifier(callee.expression) &&
+      osNamespaceOrDefault.has(callee.expression.text)
+    ) {
+      return callee;
+    }
+    return ts.isIdentifier(callee) && namedTmpdir.has(callee.text) ? callee : null;
+  });
+}
+
+/**
+ * Runs the messaging tmpdir guard.
+ */
+export async function main() {
+  await runCallsiteGuard({
+    importMetaUrl: import.meta.url,
+    sourceRoots: messagingTmpdirGuardSourceRoots,
+    skipRelativePath: (relPath) =>
+      relPath.startsWith("extensions/") && classifyBundledExtensionSourcePath(relPath).isTestLike,
+    findCallLines: findMessagingTmpdirCallLines,
+    header: "Found os.tmpdir()/tmpdir() usage in messaging/channel runtime sources:",
+    footer:
+      "Use resolvePreferredOpenClawTmpDir() or plugin-sdk temp helpers instead of host tmp defaults.",
+    sortViolations: false,
+  });
+}
+
+runAsScript(import.meta.url, main);
diff --git a/scripts/check-no-raw-channel-fetch.mts b/scripts/check-no-raw-channel-fetch.mts
new file mode 100644
index 0000000000000000000000000000000000000000..98303c9e45f73b944734f0dfede80e5eb42131ce
--- /dev/null
+++ b/scripts/check-no-raw-channel-fetch.mts
@@ -0,0 +1,105 @@
+#!/usr/bin/env node
+
+// Blocks new raw fetch callsites in channel and plugin runtime sources.
+import ts from "typescript";
+import { bundledPluginCallsite } from "./lib/bundled-plugin-paths.mjs";
+import { runCallsiteGuard } from "./lib/callsite-guard.mts";
+import {
+  collectCallExpressionLines,
+  runAsScript,
+  unwrapExpression,
+} from "./lib/ts-guard-utils.mts";
+
+const sourceRoots = ["src/channels", "src/routing", "src/line", "extensions"];
+
+// Temporary allowlist for legacy callsites. New raw fetch callsites in channel/plugin runtime
+// code should be rejected and migrated to fetchWithSsrFGuard/shared channel helpers.
+const allowedRawFetchCallsites = new Set([
+  bundledPluginCallsite("browser", "src/browser/cdp.helpers.ts", 268),
+  bundledPluginCallsite("browser", "src/browser/client-fetch.ts", 192),
+  bundledPluginCallsite("chutes", "models.ts", 536),
+  bundledPluginCallsite("chutes", "models.ts", 543),
+  bundledPluginCallsite("discord", "src/monitor/gateway-plugin.ts", 417),
+  bundledPluginCallsite("discord", "src/monitor/gateway-plugin.ts", 483),
+  bundledPluginCallsite("discord", "src/voice-message.ts", 298),
+  bundledPluginCallsite("discord", "src/voice-message.ts", 333),
+  bundledPluginCallsite("elevenlabs", "speech-provider.ts", 295),
+  bundledPluginCallsite("elevenlabs", "tts.ts", 74),
+  bundledPluginCallsite("feishu", "src/monitor.webhook.test-helpers.ts", 25),
+  bundledPluginCallsite("github-copilot", "login.ts", 80),
+  bundledPluginCallsite("github-copilot", "login.ts", 112),
+  bundledPluginCallsite("googlechat", "src/auth.ts", 83),
+  bundledPluginCallsite("huggingface", "models.ts", 143),
+  bundledPluginCallsite("kilocode", "provider-models.ts", 130),
+  bundledPluginCallsite("matrix", "src/matrix/sdk/transport.ts", 112),
+  bundledPluginCallsite("microsoft-foundry", "onboard.ts", 479),
+  bundledPluginCallsite("microsoft", "speech-provider.ts", 140),
+  bundledPluginCallsite("minimax", "oauth.ts", 82),
+  bundledPluginCallsite("minimax", "oauth.ts", 123),
+  bundledPluginCallsite("minimax", "tts.ts", 52),
+  bundledPluginCallsite("msteams", "src/graph.ts", 47),
+  bundledPluginCallsite("msteams", "src/sdk.ts", 400),
+  bundledPluginCallsite("msteams", "src/sdk.ts", 441),
+  bundledPluginCallsite("ollama", "src/stream.ts", 649),
+  bundledPluginCallsite("openai", "tts.ts", 149),
+  bundledPluginCallsite("qa-channel", "src/bus-client.ts", 41),
+  bundledPluginCallsite("qa-channel", "src/bus-client.ts", 221),
+  bundledPluginCallsite("qa-lab", "src/docker-up.runtime.ts", 274),
+  bundledPluginCallsite("qa-lab", "src/gateway-child.ts", 489),
+  bundledPluginCallsite("qa-lab", "src/suite.ts", 330),
+  bundledPluginCallsite("qa-lab", "src/suite.ts", 341),
+  // The QA dashboard calls its same-origin local API from the browser, where server SSRF helpers do not run.
+  bundledPluginCallsite("qa-lab", "web/src/http.ts", 24),
+  bundledPluginCallsite("qa-lab", "web/src/http.ts", 32),
+  bundledPluginCallsite("qa-lab", "web/src/http.ts", 43),
+  bundledPluginCallsite("signal", "src/install-signal-cli.ts", 224),
+  bundledPluginCallsite("slack", "src/monitor/media.ts", 106),
+  bundledPluginCallsite("slack", "src/monitor/media.ts", 125),
+  bundledPluginCallsite("slack", "src/monitor/media.ts", 130),
+  bundledPluginCallsite("venice", "models.ts", 552),
+  bundledPluginCallsite("vercel-ai-gateway", "models.ts", 181),
+  bundledPluginCallsite("voice-call", "src/providers/twilio/api.ts", 23),
+]);
+
+function isRawFetchCall(expression: ts.Expression) {
+  const callee = unwrapExpression(expression);
+  if (ts.isIdentifier(callee)) {
+    return callee.text === "fetch";
+  }
+  if (ts.isPropertyAccessExpression(callee)) {
+    return (
+      ts.isIdentifier(callee.expression) &&
+      callee.expression.text === "globalThis" &&
+      callee.name.text === "fetch"
+    );
+  }
+  return false;
+}
+
+/**
+ * Finds raw `fetch(...)` and `globalThis.fetch(...)` call lines.
+ */
+function findRawFetchCallLines(content: string, fileName = "source.ts") {
+  const sourceFile = ts.createSourceFile(fileName, content, ts.ScriptTarget.Latest, true);
+  return collectCallExpressionLines(ts, sourceFile, (node) =>
+    isRawFetchCall(node.expression) ? node.expression : null,
+  );
+}
+
+/**
+ * Runs the raw channel/plugin fetch guard.
+ */
+async function main() {
+  await runCallsiteGuard({
+    importMetaUrl: import.meta.url,
+    sourceRoots,
+    extraTestSuffixes: [".browser.test.ts", ".node.test.ts"],
+    findCallLines: findRawFetchCallLines,
+    skipRelativePath: (relPath) => relPath.includes("/test-support/"),
+    allowCallsite: (callsite) => allowedRawFetchCallsites.has(callsite),
+    header: "Found raw fetch() usage in channel/plugin runtime sources outside allowlist:",
+    footer: "Use fetchWithSsrFGuard() or existing channel/plugin SDK wrappers for network calls.",
+  });
+}
+
+runAsScript(import.meta.url, main);
diff --git a/scripts/check-no-raw-http2-imports.mts b/scripts/check-no-raw-http2-imports.mts
new file mode 100644
index 0000000000000000000000000000000000000000..de83d87e207584d5f748569f49408ff9dd827ed4
--- /dev/null
+++ b/scripts/check-no-raw-http2-imports.mts
@@ -0,0 +1,76 @@
+// Rejects raw Node http2 imports in source and extension code.
+import fs from "node:fs";
+import path from "node:path";
+import { collectFilesSync, isCodeFile, toPosixPath } from "./check-file-utils.ts";
+
+const SOURCE_ROOTS = ["src", "extensions"];
+
+const FORBIDDEN_HTTP2_MODULES = new Set(["node:http2", "http2"]);
+const ALLOWED_PRODUCTION_FILES = new Set(["src/infra/push-apns-http2.ts"]);
+
+function isTestFile(relativePath: string) {
+  return (
+    /(?:^|\/)(?:test|test-fixtures)\//u.test(relativePath) ||
+    /\.test\.[cm]?[jt]sx?$/u.test(relativePath)
+  );
+}
+
+function lineNumberForOffset(content: string, offset: number) {
+  return content.slice(0, offset).split(/\r?\n/u).length;
+}
+
+function collectHttp2ImportOffenders(filePath: string) {
+  const relativePath = toPosixPath(path.relative(process.cwd(), filePath));
+  if (ALLOWED_PRODUCTION_FILES.has(relativePath) || isTestFile(relativePath)) {
+    return [];
+  }
+
+  const content = fs.readFileSync(filePath, "utf8");
+  const offenders: Array<{ file: string; line: number; specifier: string }> = [];
+  const patterns = [
+    /\bimport\s+(?:type\s+)?[\s\S]*?\bfrom\s*["']([^"']+)["']/gu,
+    /\bexport\s+(?:type\s+)?[\s\S]*?\bfrom\s*["']([^"']+)["']/gu,
+    /\bimport\s*\(\s*["']([^"']+)["']\s*\)/gu,
+    /\brequire\s*\(\s*["']([^"']+)["']\s*\)/gu,
+  ];
+
+  for (const pattern of patterns) {
+    for (const match of content.matchAll(pattern)) {
+      const specifier = match[1];
+      if (specifier && FORBIDDEN_HTTP2_MODULES.has(specifier)) {
+        offenders.push({
+          file: relativePath,
+          line: lineNumberForOffset(content, match.index ?? 0),
+          specifier,
+        });
+      }
+    }
+  }
+
+  return offenders;
+}
+
+function collectSourceFiles() {
+  return SOURCE_ROOTS.flatMap((root) =>
+    collectFilesSync(path.join(process.cwd(), root), { includeFile: isCodeFile }),
+  );
+}
+
+function main() {
+  const offenders = collectSourceFiles().flatMap(collectHttp2ImportOffenders);
+  if (offenders.length === 0) {
+    console.log("OK: raw node:http2 imports stay behind the APNs proxy wrapper.");
+    return;
+  }
+
+  console.error("Raw node:http2 imports are only allowed in src/infra/push-apns-http2.ts.");
+  for (const offender of offenders.toSorted(
+    (a, b) => a.file.localeCompare(b.file) || a.line - b.line,
+  )) {
+    console.error(`- ${offender.file}:${offender.line} imports ${offender.specifier}`);
+  }
+  console.error("Use connectApnsHttp2Session() so APNs HTTP/2 honors managed proxy policy.");
+  process.exit(1);
+}
+
+main();
diff --git a/scripts/check-no-runtime-action-load-config.mts b/scripts/check-no-runtime-action-load-config.mts
new file mode 100644
index 0000000000000000000000000000000000000000..34de56cd09c2537e7c681908e3dba98fcbbc0f16
--- /dev/null
+++ b/scripts/check-no-runtime-action-load-config.mts
@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+// Prevents runtime action paths from loading global config directly.
+import { collectRuntimeActionLoadConfigViolations } from "./lib/config-boundary-guard.mts";
+
+function main() {
+  const violations = collectRuntimeActionLoadConfigViolations();
+  if (violations.length === 0) {
+    return 0;
+  }
+  console.error(
+    [
+      "Runtime channel send/action/client/pairing helpers must not call loadConfig().",
+      "Load and resolve config at the command/gateway/monitor boundary, then pass cfg through.",
+      "",
+      ...violations,
+    ].join("\n"),
+  );
+  return 1;
+}
+
+process.exitCode = main();
diff --git a/scripts/check-openclaw-package-tarball.mjs b/scripts/check-openclaw-package-tarball.mjs
new file mode 100644
index 0000000000000000000000000000000000000000..9834328b923db9fee05b610180949e983e339e25
--- /dev/null
+++ b/scripts/check-openclaw-package-tarball.mjs
@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runTsxCliShim } from "./lib/tsx-cli-shim.mjs";
+
+await runTsxCliShim(import.meta.url, { implementation: "./check-openclaw-package-tarball.mts" });
diff --git a/scripts/check-package-dist-imports.mjs b/scripts/check-package-dist-imports.mjs
new file mode 100644
index 0000000000000000000000000000000000000000..3d8f0ed22c8d0667b22d07355e59b764818a0f31
--- /dev/null
+++ b/scripts/check-package-dist-imports.mjs
@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+// Checks built package dist files for imports outside package boundaries.
+import fs from "node:fs";
+import path from "node:path";
+import { collectPackageDistImportErrors } from "./lib/package-dist-imports.mjs";
+
+function usage() {
+  return "Usage: node scripts/check-package-dist-imports.mjs [package-root]";
+}
+
+function fail(message) {
+  console.error(message);
+  process.exit(1);
+}
+
+function parseArgs(argv) {
+  const args = argv[0] === "--" ? argv.slice(1) : argv;
+  const packageRootArg = args[0]?.trim() ?? "";
+  if (packageRootArg === "--help" || packageRootArg === "-h") {
+    return { help: true, packageRoot: "" };
+  }
+  if (packageRootArg.startsWith("-")) {
+    throw new Error(`Unknown package dist import check option: ${packageRootArg}`);
+  }
+  const extraArg = args[1]?.trim();
+  if (args.length > 1) {
+    throw new Error(`Unexpected package dist import check argument: ${extraArg}`);
+  }
+  return {
+    help: false,
+    packageRoot: path.resolve(packageRootArg || process.cwd()),
+  };
+}
+
+let cliArgs;
+try {
+  cliArgs = parseArgs(process.argv.slice(2));
+} catch (error) {
+  fail(error instanceof Error ? error.message : String(error));
+}
+if (cliArgs.help) {
+  console.log(usage());
+  process.exit(0);
+}
+
+const { packageRoot } = cliArgs;
+const distRoot = path.join(packageRoot, "dist");
+if (!fs.existsSync(distRoot)) {
+  fail(`missing dist directory: ${distRoot}`);
+}
+
+function collectFiles(rootDir) {
+  const pending = [rootDir];
+  const files = [];
+  while (pending.length > 0) {
+    const dir = pending.pop();
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+      const entryPath = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        pending.push(entryPath);
+        continue;
+      }
+      if (entry.isFile()) {
+        files.push(path.relative(packageRoot, entryPath).replace(/\\/gu, "/"));
+      }
+    }
+  }
+  return files;
+}
+
+const errors = collectPackageDistImportErrors({
+  files: collectFiles(distRoot),
+  readText(relativePath) {
+    return fs.readFileSync(path.join(packageRoot, relativePath), "utf8");
+  },
+});
+
+if (errors.length > 0) {
+  fail(`OpenClaw package dist import closure failed:\n${errors.join("\n")}`);
+}
+
+console.log("OpenClaw package dist import closure passed.");
diff --git a/scripts/check-plugin-extension-import-boundary.mts b/scripts/check-plugin-extension-import-boundary.mts
new file mode 100644
index 0000000000000000000000000000000000000000..8329b2c0ac12b8a34268d813e8270454a6a0d2fa
--- /dev/null
+++ b/scripts/check-plugin-extension-import-boundary.mts
@@ -0,0 +1,137 @@
+#!/usr/bin/env node
+
+// Inventories core plugin imports that cross into bundled extension files.
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { createExtensionImportBoundaryChecker } from "./lib/extension-import-boundary-checker.mts";
+import {
+  formatGroupedInventoryHuman,
+  resolveRepoSpecifier,
+  writeLine,
+} from "./lib/guard-inventory-utils.mjs";
+import { resolveRepoRoot } from "./lib/repo-root.mjs";
+import { runAsScript } from "./lib/ts-guard-utils.mts";
+
+const repoRoot = resolveRepoRoot(import.meta.url);
+const AUTHORED_MODULE_EXTENSIONS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
+const RETIRED_WEB_SEARCH_CORE_MODULES = [
+  "src/agents/tools/web-search-plugin-factory",
+  "src/plugins/bundled-web-search-registry",
+  "src/plugins/web-search-providers",
+] as const;
+
+type PluginExtensionInventoryEntry = {
+  file: string;
+  line: number;
+  kind: string;
+  specifier: string;
+  resolvedPath: string | null;
+  reason: string;
+};
+function compareEntries(left: PluginExtensionInventoryEntry, right: PluginExtensionInventoryEntry) {
+  return (
+    left.file.localeCompare(right.file) ||
+    left.line - right.line ||
+    left.kind.localeCompare(right.kind) ||
+    left.specifier.localeCompare(right.specifier) ||
+    left.reason.localeCompare(right.reason)
+  );
+}
+
+function classifyResolvedExtensionReason(kind: string, resolvedPath: string | null) {
+  const verb =
+    kind === "export"
+      ? "re-exports"
+      : kind === "dynamic-import"
+        ? "dynamically imports"
+        : "imports";
+  if (/^extensions\/[^/]+\/src\//.test(resolvedPath ?? "")) {
+    return `${verb} extension implementation from src/plugins`;
+  }
+  if (/^extensions\/[^/]+\/index\.[^/]+$/.test(resolvedPath ?? "")) {
+    return `${verb} extension entrypoint from src/plugins`;
+  }
+  return `${verb} extension-owned file from src/plugins`;
+}
+
+const boundaryChecker = createExtensionImportBoundaryChecker({
+  roots: ["src/plugins"],
+  shouldSkipFile(relativeFile) {
+    return (
+      relativeFile.startsWith("src/plugins/contracts/") ||
+      /^src\/plugins\/runtime\/runtime-[^/]+-contract\.[cm]?[jt]s$/u.test(relativeFile)
+    );
+  },
+  collectEntries({ filePath, relativeFile, references }) {
+    return references.map(({ kind, line, specifier }) => {
+      const resolvedPath = resolveRepoSpecifier(repoRoot, specifier, filePath);
+      return {
+        file: relativeFile,
+        line,
+        kind,
+        specifier,
+        resolvedPath,
+        reason: classifyResolvedExtensionReason(kind, resolvedPath),
+      };
+    });
+  },
+  compareEntries,
+});
+
+/** Rejects retired core registries whose ownership now comes from plugin manifests. */
+export function collectRetiredWebSearchCorePathEntries(
+  rootDir = repoRoot,
+): PluginExtensionInventoryEntry[] {
+  return RETIRED_WEB_SEARCH_CORE_MODULES.flatMap((modulePath) =>
+    AUTHORED_MODULE_EXTENSIONS.map((extension) => `${modulePath}${extension}`),
+  )
+    .filter((relativeFile) => existsSync(path.join(rootDir, relativeFile)))
+    .map((relativeFile) => ({
+      file: relativeFile,
+      line: 1,
+      kind: "retired-path",
+      specifier: relativeFile,
+      resolvedPath: relativeFile,
+      reason: "restores retired core web-search registry or factory ownership",
+    }));
+}
+
+/** Inventory of src/plugins extension imports and retired core web-search ownership paths. */
+async function collectPluginExtensionImportBoundaryInventory() {
+  return [
+    ...(await boundaryChecker.collectInventory()),
+    ...collectRetiredWebSearchCorePathEntries(),
+  ].toSorted(compareEntries);
+}
+
+const ruleText =
+  "Rule: src/plugins/** must not import bundled plugin files or restore retired web-search registries";
+const formatInventoryHuman = (inventory: PluginExtensionInventoryEntry[]) =>
+  formatGroupedInventoryHuman(
+    {
+      rule: ruleText,
+      cleanMessage: "No plugin import boundary violations found.",
+      inventoryTitle: "Plugin extension import boundary inventory:",
+    },
+    inventory,
+  );
+
+/**
+ * Runs the plugin-extension import boundary check.
+ */
+async function runPluginExtensionImportBoundaryCheck(): Promise<0 | 1> {
+  const actual = await collectPluginExtensionImportBoundaryInventory();
+
+  writeLine(process.stdout, formatInventoryHuman(actual));
+  if (actual.length === 0) {
+    return 0;
+  }
+  writeLine(process.stderr, `${ruleText} violations found (${actual.length}).`);
+  return 1;
+}
+
+async function main(): Promise<void> {
+  process.exitCode = await runPluginExtensionImportBoundaryCheck();
+}
+
+runAsScript(import.meta.url, main);
diff --git a/scripts/check-plugin-npm-runtime-builds.mts b/scripts/check-plugin-npm-runtime-builds.mts
new file mode 100644
index 0000000000000000000000000000000000000000..0f07d23c62c79ccf9c1c3b113348634cf8f8b3f2
--- /dev/null
+++ b/scripts/check-plugin-npm-runtime-builds.mts
@@ -0,0 +1,115 @@
+#!/usr/bin/env node
+
+// Verifies publishable plugin packages can build their npm runtime outputs.
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import {
+  buildPluginNpmRuntime,
+  listPluginNpmRuntimeBuildOutputs,
+  listPublishablePluginPackageDirs,
+  resolvePluginNpmRuntimeBuildPlan,
+} from "./lib/plugin-npm-runtime-build.mts";
+
+type CheckPluginNpmRuntimeBuildParams = {
+  repoRoot?: string;
+  packageDirs?: string[];
+  logLevel?: "silent" | "warn";
+};
+
+function readPackageArgValue(argv: string[], index: number) {
+  const value = argv[index + 1];
+  if (value === undefined || value === "" || value.startsWith("-")) {
+    throw new Error("missing value for --package");
+  }
+  return value;
+}
+
+function usage() {
+  return "usage: node --import tsx scripts/check-plugin-npm-runtime-builds.mts [--package extensions/<id> ...]";
+}
+
+export function parseArgs(argv: string[]) {
+  const args = argv[0] === "--" ? argv.slice(1) : argv;
+  if (args[0] === "--help" || args[0] === "-h") {
+    return { help: true, packageDirs: [] };
+  }
+  const packageDirs: string[] = [];
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === "--package") {
+      packageDirs.push(readPackageArgValue(args, index));
+      index += 1;
+      continue;
+    }
+    throw new Error(usage());
+  }
+  return { packageDirs };
+}
+
+/**
+ * Builds publishable plugin npm runtimes and verifies declared outputs exist.
+ */
+export async function checkPluginNpmRuntimeBuilds(params: CheckPluginNpmRuntimeBuildParams = {}) {
+  const repoRoot = path.resolve(params.repoRoot ?? ".");
+  const selectedPackageDirs = params.packageDirs;
+  const packageDirs =
+    selectedPackageDirs && selectedPackageDirs.length > 0
+      ? selectedPackageDirs
+      : listPublishablePluginPackageDirs({ repoRoot });
+  const rows = [];
+  for (const packageDir of packageDirs) {
+    const plan = resolvePluginNpmRuntimeBuildPlan({ repoRoot, packageDir });
+    if (!plan) {
+      throw new Error(`${packageDir} did not produce a package-local runtime build plan`);
+    }
+    const result = await buildPluginNpmRuntime({
+      repoRoot,
+      packageDir,
+      logLevel: params.logLevel ?? "warn",
+    });
+    if (!result) {
+      throw new Error(`${packageDir} did not produce runtime build outputs`);
+    }
+    const missing = listPluginNpmRuntimeBuildOutputs(result).filter(
+      (runtimePath) =>
+        !fs.existsSync(path.join(result.packageDir, runtimePath.replace(/^\.\//u, ""))),
+    );
+    if (missing.length > 0) {
+      throw new Error(`${packageDir} missing built runtime outputs: ${missing.join(", ")}`);
+    }
+    rows.push({
+      pluginDir: result.pluginDir,
+      status: "built",
+      entryCount: Object.keys(result.entry).length,
+      copiedStaticAssets: result.copiedStaticAssets,
+    });
+  }
+  return rows;
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+  try {
+    const args = parseArgs(process.argv.slice(2));
+    if (args.help) {
+      console.log(usage());
+      process.exit(0);
+    }
+    const rows = await checkPluginNpmRuntimeBuilds(args);
+    const builtCount = rows.filter((row) => row.status === "built").length;
+    console.log(`checked ${rows.length} publishable plugins; built ${builtCount} npm runtimes`);
+    for (const row of rows) {
+      console.log(
+        [
+          row.pluginDir,
+          row.status,
+          row.entryCount,
+          row.copiedStaticAssets.length > 0 ? row.copiedStaticAssets.join(",") : "-",
+        ].join("\t"),
+      );
+    }
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+  }
+}
diff --git a/scripts/check-plugin-sdk-exports.mts b/scripts/check-plugin-sdk-exports.mts
new file mode 100644
index 0000000000000000000000000000000000000000..e864c430372a921e583232545ff55b316554ea7e
--- /dev/null
+++ b/scripts/check-plugin-sdk-exports.mts
@@ -0,0 +1,416 @@
+#!/usr/bin/env -S node --import tsx
+
+/**
+ * Verifies that public plugin-sdk subpaths are present in the compiled dist output.
+ *
+ * Run after the package build to catch missing exports or leaked repo-only type aliases
+ * before release.
+ */
+
+import { spawnSync } from "node:child_process";
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  statSync,
+  symlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, relative, resolve, sep } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { resolveRepoToolBinPath } from "./lib/local-check-runtime.mts";
+import {
+  MAX_PRIVATE_QA_PUBLIC_PLUGIN_SDK_DECLARATION_BYTES,
+  MAX_PUBLIC_PLUGIN_SDK_DECLARATION_BYTES,
+  PLUGIN_SDK_DECLARATION_OUTPUT_VARIANCE_BYTES,
+  evaluatePluginSdkDeclarationBudget,
+  isPrivateQaPluginSdkBuild,
+} from "./lib/plugin-sdk-declaration-budget.mts";
+import { publicPluginSdkEntrypoints, publicPluginSdkSubpaths } from "./lib/plugin-sdk-entries.mts";
+import { findUndeclaredBundlerHelperDtsExports } from "./lib/sanitize-bundler-helper-dts-exports.mts";
+
+const scriptDir = dirname(fileURLToPath(import.meta.url));
+const repoRoot = resolve(scriptDir, "..");
+const tsgoPath = resolveRepoToolBinPath("tsgo", { cwd: repoRoot });
+const forbiddenPublicDeclarationSpecifiers = ["@openclaw/llm-core"];
+const FORBIDDEN_PUBLIC_PROTOCOL_REGISTRY_RE = /\bdeclare\s+const\s+ProtocolSchemas(?:\$\d+)?\b/u;
+const RELATIVE_DECLARATION_SPECIFIER_RE = /\b(?:from|import)\s*(?:\(\s*)?["']([^"']+)["']/gu;
+const requiredSubpathExports: Record<string, string[]> = {
+  "diagnostic-flags": ["isDiagnosticFlagEnabled"],
+  "diagnostic-runtime": ["areDiagnosticsEnabledForProcess", "createSubsystemLogger"],
+  "secret-input-runtime": [
+    "assertPluginCapabilitySecretAvailable",
+    "coerceSecretRef",
+    "hasConfiguredSecretInput",
+    "isSecretRef",
+    "normalizeResolvedSecretInputString",
+    "normalizeSecretInputString",
+    "resolveSecretInputString",
+  ],
+};
+
+// These private runtime facades have declarations only in the private-QA profile.
+// Do not require their types from ordinary public-package builds.
+const privateRuntimeConsumers = isPrivateQaPluginSdkBuild(process.env)
+  ? `import { SessionManager, type SessionEntry } from "openclaw/plugin-sdk/agent-sessions";
+import type { drainPendingDeliveries } from "openclaw/plugin-sdk/delivery-queue-runtime";
+
+type RecoveryDeliver = NonNullable<Parameters<typeof drainPendingDeliveries>[0]["deliver"]>;
+type RecoveryParams = Parameters<RecoveryDeliver>[0];
+type RecoveryContextIsPrivate = RequireNever<Extract<keyof RecoveryParams, PrivateQueueContextKeys>>;
+
+// Private facade declarations must preserve callable access to persist.
+declare const sessionManager: SessionManager;
+declare const sessionEntry: SessionEntry;
+sessionManager.persist(sessionEntry);
+sessionManager.persist(sessionEntry, {});
+// @ts-expect-error Persist still requires a complete session entry.
+sessionManager.persist({});`
+  : "";
+
+let missing = 0;
+
+{
+  const tempRoot = mkdtempSync(join(tmpdir(), "openclaw-plugin-sdk-consumer-"));
+  const consumerRoot = join(tempRoot, "consumer");
+  try {
+    mkdirSync(consumerRoot, { recursive: true });
+    writeFileSync(
+      join(consumerRoot, "index.ts"),
+      `import { buildChannelConfigSchema, DmPolicySchema } from "openclaw/plugin-sdk/channel-config-schema";
+import { defineChannelPluginEntry } from "openclaw/plugin-sdk/core";
+import type { sendDurableMessageBatch } from "openclaw/plugin-sdk/channel-outbound";
+import type {
+  EmbeddingBatchChunk,
+  EmbeddingBatchOptions,
+  EmbeddingProviderBatchRuntime,
+} from "openclaw/plugin-sdk/embedding-provider-runtime-contract";
+import { defineToolPlugin } from "openclaw/plugin-sdk/tool-plugin";
+import { identityEntryAuthenticationClassifier, meetsIdentifierAuthentication } from "openclaw/plugin-sdk/channel-ingress-runtime";
+import type {
+  ChannelIngressIdentitySubjectInput,
+  IdentifierAuthentication,
+} from "openclaw/plugin-sdk/channel-ingress-runtime";
+// @ts-expect-error Host admission evidence is intentionally private to core.
+import type { ChannelAdmissionEvidence } from "openclaw/plugin-sdk/channel-ingress-runtime";
+// @ts-expect-error Plugins cannot mint host admission evidence.
+import { prepareHostChannelContextAdmissionEvidence } from "openclaw/plugin-sdk/channel-ingress-runtime";
+// @ts-expect-error Plugins cannot register host evidence owners.
+import { registerChannelAdmissionEvidenceOwner } from "openclaw/plugin-sdk/channel-ingress-runtime";
+import { createPluginRuntimeStore, type PluginRuntime } from "openclaw/plugin-sdk/runtime-store";
+import type { buildModelsProviderData, buildPreparedModelsProviderData, ModelsProviderData } from "openclaw/plugin-sdk/models-provider-runtime";
+import type { buildModelsProviderData as buildCommandAuthModelsProviderData } from "openclaw/plugin-sdk/command-auth";
+import { z } from "zod";
+${privateRuntimeConsumers}
+
+type RequireNever<T extends never> = T;
+type RequireTrue<T extends true> = T;
+type Equal<A, B> = (<T>() => T extends A ? 1 : 2) extends
+  (<T>() => T extends B ? 1 : 2) ? true : false;
+type PrivateQueueContextKeys =
+  | "conversationDeliveryTarget"
+  | "deliveryQueueStateContext"
+  | "databaseAgentId"
+  | "supervisorMode"
+  | "env";
+type SendParams = Parameters<typeof sendDurableMessageBatch>[0];
+type KeysOfUnion<T> = T extends unknown ? keyof T : never;
+// Database context stays private even when public aliases derive from core types.
+type SendContextIsPrivate = RequireNever<Extract<keyof SendParams, PrivateQueueContextKeys>>;
+type CompletionContextIsPrivate = RequireNever<
+  Extract<KeysOfUnion<NonNullable<SendParams["deliveryCompletion"]>>, PrivateQueueContextKeys>
+>;
+type QueueOwner = NonNullable<SendParams["deliveryQueueOwner"]>;
+type FailureRecorder = Parameters<QueueOwner["fail"]>[0];
+type FailureRecorderArgsUnchanged = RequireTrue<Equal<Parameters<FailureRecorder>, [
+  id: string,
+  error: string,
+  stateDir?: string,
+  expectedPlatformSendAttemptId?: string | null,
+]>>;
+type AckOptionsUnchanged = RequireTrue<Equal<NonNullable<Parameters<QueueOwner["ack"]>[0]>, {
+  retainSpoolArtifacts?: boolean;
+  suppressCompletionReceipt?: boolean;
+  expectedPlatformSendAttemptId?: string | null;
+}>>;
+
+// Stable v2026.7.1-2 consumers construct these results and supply typed adapters.
+const legacyModelsData = {
+  byProvider: new Map<string, Set<string>>(),
+  providers: [],
+  resolvedDefault: { provider: "fixture-provider", model: "fixture-model" },
+  modelNames: new Map<string, string>(),
+};
+const modelsData: ModelsProviderData = legacyModelsData;
+const modelsAdapter: typeof buildModelsProviderData = async () => legacyModelsData;
+const commandAuthModelsAdapter: typeof buildCommandAuthModelsProviderData = modelsAdapter;
+void modelsData;
+void commandAuthModelsAdapter;
+declare const preparedModelsData: Awaited<ReturnType<typeof buildPreparedModelsProviderData>>;
+const preparedCatalog: { id: string; provider: string; contextWindow?: number }[] = preparedModelsData.modelCatalog;
+void preparedCatalog;
+// @ts-expect-error Prepared selections require their typed catalog metadata.
+const incompletePrepared: typeof preparedModelsData = legacyModelsData;
+void incompletePrepared;
+void defineToolPlugin;
+
+const identifierAuthentication: IdentifierAuthentication = "verified";
+const meetsMinimum: boolean = meetsIdentifierAuthentication(identifierAuthentication, "asserted");
+void meetsMinimum;
+const subject: ChannelIngressIdentitySubjectInput = {
+  stableId: "provider-user-id",
+  authentication: { "provider-user-id": identifierAuthentication },
+};
+void subject;
+const classifyEntryAuthentication = identityEntryAuthenticationClassifier({
+  primary: { authentication: identifierAuthentication },
+});
+const entryAuthentication: IdentifierAuthentication | undefined = classifyEntryAuthentication("provider-user-id");
+void entryAuthentication;
+
+const batchEmbed: EmbeddingProviderBatchRuntime["batchEmbed"] = async (options: EmbeddingBatchOptions) => {
+  const chunks: EmbeddingBatchChunk[] = options.chunks;
+  return chunks.map(() => [1]);
+};
+const batchRuntimes: EmbeddingProviderBatchRuntime[] = [
+  { batchEmbed },
+  { batchEmbed, sourceWideBatchEmbed: true },
+  { batchEmbed, sourceWideBatchEmbed: false },
+];
+const batchRuntimeWithInternalPolicy = {
+  batchEmbed,
+  // @ts-expect-error Cache identity is not part of the public batch contract.
+  cacheKeyData: {},
+} satisfies EmbeddingProviderBatchRuntime;
+void batchRuntimes;
+void batchRuntimeWithInternalPolicy;
+
+const runtimeStore = createPluginRuntimeStore<PluginRuntime>({
+  pluginId: "package-consumer",
+  errorMessage: "package consumer runtime not initialized",
+});
+export const configSchema = buildChannelConfigSchema(
+  z.object({ dmPolicy: DmPolicySchema.optional() }),
+);
+
+declare const plugin: Parameters<typeof defineChannelPluginEntry>[0]["plugin"];
+export default defineChannelPluginEntry({
+  id: "package-consumer",
+  name: "Package Consumer",
+  description: "Published Plugin SDK declaration compatibility fixture",
+  plugin,
+  setRuntime: runtimeStore.setRuntime,
+});
+`,
+    );
+    writeFileSync(join(consumerRoot, "package.json"), '{"private":true,"type":"module"}\n');
+    // Keep skipLibCheck on for this in-tree consumer: workspace @openclaw/ai
+    // declaration caches can omit .d.mts while still shipping .mjs, which makes
+    // skipLibCheck:false fail with TS7016 before the helper scan below. Packed
+    // release-check still uses skipLibCheck:false against a complete tarball.
+    writeFileSync(
+      join(consumerRoot, "tsconfig.json"),
+      `{
+  "compilerOptions": {
+    "lib": ["DOM", "DOM.Iterable", "ES2023"],
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "noEmit": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "types": []
+  },
+  "include": ["index.ts"]
+}
+`,
+    );
+    const openclawPackagePath = join(consumerRoot, "node_modules", "openclaw");
+    mkdirSync(dirname(openclawPackagePath), { recursive: true });
+    symlinkSync(repoRoot, openclawPackagePath, process.platform === "win32" ? "junction" : "dir");
+    symlinkSync(
+      join(repoRoot, "node_modules", "zod"),
+      join(consumerRoot, "node_modules", "zod"),
+      process.platform === "win32" ? "junction" : "dir",
+    );
+
+    const result = spawnSync(
+      tsgoPath,
+      ["-p", join(consumerRoot, "tsconfig.json"), "--pretty", "false"],
+      { cwd: consumerRoot, encoding: "utf8" },
+    );
+    if (result.error) {
+      console.error("BROKEN PLUGIN SDK CONSUMER: failed to start tsgo");
+      console.error(result.error.message);
+      missing += 1;
+    } else if (result.status !== 0) {
+      console.error("BROKEN PLUGIN SDK CONSUMER: mixed public subpaths are not assignable");
+      process.stderr.write(result.stdout || "");
+      process.stderr.write(result.stderr || "");
+      missing += 1;
+    }
+  } finally {
+    rmSync(tempRoot, { force: true, recursive: true });
+  }
+}
+
+for (const entry of publicPluginSdkSubpaths) {
+  const jsPath = resolve(scriptDir, "..", "dist", "plugin-sdk", `${entry}.js`);
+  const dtsPath = resolve(scriptDir, "..", "dist", "plugin-sdk", `${entry}.d.ts`);
+  if (!existsSync(jsPath)) {
+    console.error(`MISSING SUBPATH JS: dist/plugin-sdk/${entry}.js`);
+    missing += 1;
+  }
+  if (!existsSync(dtsPath)) {
+    console.error(`MISSING SUBPATH DTS: dist/plugin-sdk/${entry}.d.ts`);
+    missing += 1;
+  }
+}
+
+for (const [entry, names] of Object.entries(requiredSubpathExports)) {
+  const jsPath = resolve(scriptDir, "..", "dist", "plugin-sdk", `${entry}.js`);
+  if (!existsSync(jsPath)) {
+    continue;
+  }
+  let runtime: Record<string, unknown>;
+  try {
+    runtime = (await import(pathToFileURL(jsPath).href)) as Record<string, unknown>;
+  } catch (err) {
+    console.error(`BROKEN SUBPATH JS: dist/plugin-sdk/${entry}.js`);
+    console.error(err instanceof Error ? err.message : String(err));
+    missing += 1;
+    continue;
+  }
+  for (const name of names) {
+    if (typeof runtime[name] !== "function") {
+      console.error(`MISSING SUBPATH EXPORT: dist/plugin-sdk/${entry}.js#${name}`);
+      missing += 1;
+    }
+  }
+}
+
+const distDir = resolve(scriptDir, "..", "dist");
+const declarationPaths = new Set<string>();
+// Publication checks always start at public roots. Private QA entries are local-only,
+// but their unified-build chunk topology can still change declarations reachable here.
+const declarationQueue = publicPluginSdkEntrypoints.map((entry: string) =>
+  resolve(distDir, "plugin-sdk", `${entry}.d.ts`),
+);
+while (declarationQueue.length > 0) {
+  const dtsPath = declarationQueue.pop();
+  if (!dtsPath || declarationPaths.has(dtsPath)) {
+    continue;
+  }
+  if (!existsSync(dtsPath)) {
+    console.error(`MISSING PUBLIC DTS DEPENDENCY: ${relative(resolve(scriptDir, ".."), dtsPath)}`);
+    missing += 1;
+    continue;
+  }
+  declarationPaths.add(dtsPath);
+  const dtsContent = readFileSync(dtsPath, "utf8");
+  if (FORBIDDEN_PUBLIC_PROTOCOL_REGISTRY_RE.test(dtsContent)) {
+    console.error(
+      `FORBIDDEN PUBLIC DTS REGISTRY: ${relative(resolve(scriptDir, ".."), dtsPath)} retains ProtocolSchemas`,
+    );
+    missing += 1;
+  }
+  for (const match of dtsContent.matchAll(RELATIVE_DECLARATION_SPECIFIER_RE)) {
+    const specifier = match[1];
+    if (!specifier?.startsWith(".")) {
+      continue;
+    }
+    const declarationSpecifier = specifier.endsWith(".js")
+      ? `${specifier.slice(0, -3)}.d.ts`
+      : `${specifier}.d.ts`;
+    const importedPath = resolve(dirname(dtsPath), declarationSpecifier);
+    if (importedPath.startsWith(`${distDir}${sep}`)) {
+      declarationQueue.push(importedPath);
+    }
+  }
+  for (const specifier of forbiddenPublicDeclarationSpecifiers) {
+    if (dtsContent.includes(`"${specifier}`) || dtsContent.includes(`'${specifier}`)) {
+      console.error(
+        `FORBIDDEN PUBLIC DTS SPECIFIER: ${relative(resolve(scriptDir, ".."), dtsPath)} imports ${specifier}`,
+      );
+      missing += 1;
+    }
+  }
+}
+
+const declarationBytes = Array.from(declarationPaths).reduce<number>(
+  (total, dtsPath) => total + statSync(dtsPath).size,
+  0,
+);
+const declarationBudget = evaluatePluginSdkDeclarationBudget({
+  buildPrivateQa: isPrivateQaPluginSdkBuild(process.env),
+  declarationBytes,
+});
+if (declarationBudget.shouldFail) {
+  const budgetLabel =
+    declarationBudget.budgetKind === "private-qa-public-entry"
+      ? "PRIVATE QA PUBLIC-ENTRY PLUGIN SDK"
+      : "PLUGIN SDK";
+  console.error(
+    `${budgetLabel} DTS TOO LARGE: ${declarationBytes} bytes exceeds ${declarationBudget.budgetBytes} bytes.`,
+  );
+  console.error(
+    `Budget: ${declarationBudget.ratchetBytes}-byte ratchet + ${declarationBudget.varianceBytes}-byte Rolldown output variance.`,
+  );
+  console.error("Keep plugin SDK declarations in the canonical unified tsdown graph.");
+  missing += 1;
+} else if (declarationBudget.budgetKind === "private-qa-public-entry") {
+  console.log(
+    `Private QA build public-entry declaration graph: ${declarationBytes}/${declarationBudget.budgetBytes} bytes (${MAX_PRIVATE_QA_PUBLIC_PLUGIN_SDK_DECLARATION_BYTES}-byte ratchet + ${PLUGIN_SDK_DECLARATION_OUTPUT_VARIANCE_BYTES}-byte output variance); publication ratchet ${MAX_PUBLIC_PLUGIN_SDK_DECLARATION_BYTES} bytes is not applied.`,
+  );
+} else {
+  console.log(
+    `Public plugin SDK declaration graph: ${declarationBytes}/${declarationBudget.budgetBytes} bytes (${MAX_PUBLIC_PLUGIN_SDK_DECLARATION_BYTES}-byte ratchet + ${PLUGIN_SDK_DECLARATION_OUTPUT_VARIANCE_BYTES}-byte output variance).`,
+  );
+}
+
+{
+  const rootDist = resolve(scriptDir, "..", "dist");
+  if (!existsSync(rootDist)) {
+    console.error("UNDECLARED BUNDLER HELPER DTS EXPORT: missing dist/ for helper export scan");
+    missing += 1;
+  } else {
+    const queue = [rootDist];
+    const visitedDirs = new Set<string>();
+    while (queue.length > 0) {
+      const dir = queue.pop()!;
+      if (visitedDirs.has(dir)) {
+        continue;
+      }
+      visitedDirs.add(dir);
+      for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        const fullPath = join(dir, entry.name);
+        if (entry.isDirectory()) {
+          queue.push(fullPath);
+          continue;
+        }
+        if (!entry.isFile() || !/\.d\.(?:ts|mts|cts)$/u.test(entry.name)) {
+          continue;
+        }
+        const sourceText = readFileSync(fullPath, "utf8");
+        for (const finding of findUndeclaredBundlerHelperDtsExports(sourceText, fullPath)) {
+          console.error(
+            `UNDECLARED BUNDLER HELPER DTS EXPORT: ${relative(resolve(scriptDir, ".."), fullPath)}:${finding.line} exports ${finding.name} without a local declaration`,
+          );
+          missing += 1;
+        }
+      }
+    }
+  }
+}
+
+if (missing > 0) {
+  console.error(`\nERROR: ${missing} plugin-sdk artifact check(s) failed.`);
+  console.error("This will break published plugin-sdk artifacts.");
+  console.error("Check generated d.ts rewrites, subpath entries, type compatibility, and rebuild.");
+  process.exit(1);
+}
+
+console.log(`OK: All ${publicPluginSdkSubpaths.length} public plugin-sdk subpaths verified.`);
diff --git a/scripts/check-plugin-sdk-subpath-exports.mts b/scripts/check-plugin-sdk-subpath-exports.mts
new file mode 100644
index 0000000000000000000000000000000000000000..c94643a32c34721144062ff3971bcf3ad8511376
--- /dev/null
+++ b/scripts/check-plugin-sdk-subpath-exports.mts
@@ -0,0 +1,205 @@
+#!/usr/bin/env node
+
+// Verifies plugin SDK subpath exports and generated entrypoint metadata.
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import ts from "typescript";
+import { normalizeRepoPath, visitModuleSpecifiers } from "./lib/guard-inventory-utils.mjs";
+import { resolveRepoRoot } from "./lib/repo-root.mjs";
+import {
+  collectTypeScriptFilesFromRoots,
+  isTestLikeTypeScriptFile,
+  resolveSourceRoots,
+  toLine,
+} from "./lib/ts-guard-utils.mts";
+const repoRoot = resolveRepoRoot(import.meta.url);
+const scanRoots = resolveSourceRoots(repoRoot, [
+  "src",
+  "packages",
+  "extensions",
+  "scripts",
+  "test",
+]);
+const extraTestSuffixes = [".test-support.ts", ".test-loader.ts", ".test-fixtures.ts"];
+
+type PluginSdkViolation = {
+  file: string;
+  kind: string;
+  line: number;
+  reason: string;
+  specifier: string;
+  subpath: string;
+};
+type ModuleSpecifierVisit = {
+  kind: string;
+  node: ts.Node;
+  specifier: string;
+  specifierNode: ts.Node;
+};
+
+function readPackageExports(): Set<string> {
+  const packageJson = JSON.parse(readFileSync(path.join(repoRoot, "package.json"), "utf8")) as {
+    exports?: Record<string, unknown>;
+  };
+  return new Set(
+    Object.keys(packageJson.exports ?? {})
+      .filter((key) => key.startsWith("./plugin-sdk/"))
+      .map((key) => key.slice("./plugin-sdk/".length)),
+  );
+}
+
+function readEntrypoints(): Set<string> {
+  const entrypoints = JSON.parse(
+    readFileSync(path.join(repoRoot, "scripts/lib/plugin-sdk-entrypoints.json"), "utf8"),
+  ) as unknown[];
+  return new Set(
+    entrypoints.filter((entry): entry is string => typeof entry === "string" && entry !== "index"),
+  );
+}
+
+function readPrivateLocalOnlySubpaths(): Set<string> {
+  const subpaths = JSON.parse(
+    readFileSync(
+      path.join(repoRoot, "scripts/lib/plugin-sdk-private-local-only-subpaths.json"),
+      "utf8",
+    ),
+  ) as unknown[];
+  return new Set(
+    subpaths.filter((entry): entry is string => typeof entry === "string" && !entry.includes("/")),
+  );
+}
+
+function parsePluginSdkSubpath(specifier: string): string | null {
+  return specifier.match(/^@?openclaw\/plugin-sdk\/(.+)$/u)?.[1] ?? null;
+}
+
+function isGeneratedBuildArtifact(filePath: string): boolean {
+  return normalizeRepoPath(repoRoot, filePath).split("/").includes("dist");
+}
+
+function isRuntimeModuleReference(node: ts.Node): boolean {
+  // With verbatimModuleSyntax, inline `type` specifiers emit an empty import/export and still
+  // resolve the module. Only declaration-level `import type` and `export type` are erased.
+  if (ts.isImportDeclaration(node)) {
+    return !node.importClause?.isTypeOnly;
+  }
+  if (ts.isExportDeclaration(node)) {
+    return !node.isTypeOnly;
+  }
+  if (ts.isImportTypeNode(node)) {
+    return false;
+  }
+  if (ts.isImportEqualsDeclaration(node)) {
+    return !node.isTypeOnly;
+  }
+  return true;
+}
+
+function compareEntries(left: PluginSdkViolation, right: PluginSdkViolation): number {
+  return (
+    left.file.localeCompare(right.file) ||
+    left.line - right.line ||
+    left.kind.localeCompare(right.kind) ||
+    left.specifier.localeCompare(right.specifier) ||
+    left.subpath.localeCompare(right.subpath)
+  );
+}
+
+async function collectViolations(): Promise<PluginSdkViolation[]> {
+  const entrypoints = readEntrypoints();
+  const exports = readPackageExports();
+  const privateLocalOnlySubpaths = readPrivateLocalOnlySubpaths();
+  const files = (await collectTypeScriptFilesFromRoots(scanRoots, { includeTests: true }))
+    .filter((filePath) => !isGeneratedBuildArtifact(filePath))
+    .toSorted((left, right) =>
+      normalizeRepoPath(repoRoot, left).localeCompare(normalizeRepoPath(repoRoot, right)),
+    );
+  const violations: PluginSdkViolation[] = [];
+
+  for (const filePath of files) {
+    const sourceText = readFileSync(filePath, "utf8");
+    // Escaped module names need parsing even when the literal SDK prefix is absent.
+    if (!sourceText.includes("plugin-sdk") && !sourceText.includes("\\")) {
+      continue;
+    }
+    const repoPath = normalizeRepoPath(repoRoot, filePath);
+    // Workspace packages resolve private facades through TS paths; core runtime stays relative.
+    const isCoreRuntimeFile =
+      repoPath.startsWith("src/") && !isTestLikeTypeScriptFile(filePath, extraTestSuffixes);
+    const sourceFile = ts.createSourceFile(filePath, sourceText, ts.ScriptTarget.Latest, true);
+
+    function push(kind: string, node: ts.Node, specifierNode: ts.Node, specifier: string): void {
+      const subpath = parsePluginSdkSubpath(specifier);
+      if (!subpath) {
+        return;
+      }
+      if (privateLocalOnlySubpaths.has(subpath)) {
+        if (isCoreRuntimeFile && isRuntimeModuleReference(node)) {
+          violations.push({
+            file: repoPath,
+            line: toLine(sourceFile, specifierNode),
+            kind,
+            specifier,
+            subpath,
+            reason: "private runtime helper used by core must use a relative import",
+          });
+        }
+        return;
+      }
+
+      const missingFrom: string[] = [];
+      if (!entrypoints.has(subpath)) {
+        missingFrom.push("scripts/lib/plugin-sdk-entrypoints.json");
+      }
+      if (!exports.has(subpath)) {
+        missingFrom.push("package.json exports");
+      }
+      if (missingFrom.length === 0) {
+        return;
+      }
+
+      violations.push({
+        file: repoPath,
+        line: toLine(sourceFile, specifierNode),
+        kind,
+        specifier,
+        subpath,
+        reason: `missing from ${missingFrom.join(" and ")}`,
+      });
+    }
+
+    visitModuleSpecifiers(
+      ts,
+      sourceFile,
+      ({ kind, node, specifier, specifierNode }: ModuleSpecifierVisit) => {
+        push(kind, node, specifierNode, specifier);
+      },
+      { includeCommonJs: true, includeImportTypes: true },
+    );
+  }
+
+  return violations.toSorted(compareEntries);
+}
+
+async function main(): Promise<void> {
+  const violations = await collectViolations();
+  if (violations.length === 0) {
+    console.log("OK: all referenced openclaw/plugin-sdk/<subpath> imports are exported.");
+    return;
+  }
+
+  console.error(
+    "Rule: every referenced openclaw/plugin-sdk/<subpath> must be public or use its required private boundary.",
+  );
+  for (const violation of violations) {
+    console.error(
+      `- ${violation.file}:${violation.line} [${violation.kind}] ${violation.specifier}: ${violation.reason}`,
+    );
+  }
+  process.exit(1);
+}
+
+main().catch((error: unknown) => {
+  console.error(error);
+  process.exit(1);
+});
diff --git a/scripts/check-protocol-since.mts b/scripts/check-protocol-since.mts
new file mode 100644
index 0000000000000000000000000000000000000000..235b246c63d3a3461cff542ffa0c04b4f9d2901a
--- /dev/null
+++ b/scripts/check-protocol-since.mts
@@ -0,0 +1,231 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+// Enforces release-train metadata on core gateway methods.
+import fs from "node:fs";
+import path from "node:path";
+import { isRecord } from "@openclaw/normalization-core/record-coerce";
+import ts from "typescript";
+import { resolveRepoRoot } from "./lib/repo-root.mjs";
+
+const repoRoot = resolveRepoRoot(import.meta.url);
+const descriptorPath = "src/gateway/methods/core-descriptors.ts";
+
+type MethodSpec = {
+  line: number;
+  name: string;
+  since: string | undefined;
+  compatibilityRestored: boolean;
+};
+
+function runGit(args: string[]): string {
+  const result = spawnSync("git", args, { cwd: repoRoot, encoding: "utf8" });
+  if (result.status !== 0) {
+    const detail = result.stderr.trim() || result.stdout.trim() || `git exited ${result.status}`;
+    throw new Error(
+      `${detail}\nRun git fetch origin main so origin/main and its merge-base are available.`,
+    );
+  }
+  return result.stdout.trim();
+}
+
+function tryRunGit(args: string[]): string | undefined {
+  const result = spawnSync("git", args, { cwd: repoRoot, encoding: "utf8" });
+  return result.status === 0 ? result.stdout.trim() : undefined;
+}
+
+function resolveBaseCommit(): string {
+  const explicitBase = process.env.PROTOCOL_SINCE_BASE_SHA?.trim();
+  if (explicitBase) {
+    if (!/^[0-9a-f]{40}$/u.test(explicitBase)) {
+      throw new Error("PROTOCOL_SINCE_BASE_SHA must be a full commit SHA.");
+    }
+    if (tryRunGit(["cat-file", "-e", `${explicitBase}:${descriptorPath}`]) === undefined) {
+      throw new Error(`PROTOCOL_SINCE_BASE_SHA ${explicitBase} is unavailable in this checkout.`);
+    }
+    return explicitBase;
+  }
+  const mainMergeBase = tryRunGit(["merge-base", "HEAD", "origin/main"]);
+  if (mainMergeBase) {
+    return mainMergeBase;
+  }
+  // Pull-request CI checks out a synthetic merge commit without creating origin/main.
+  // Its first parent is the exact base used to build the merge result.
+  const parents = (tryRunGit(["show", "-s", "--format=%P", "HEAD"]) ?? "").split(/\s+/u);
+  if (parents.length === 2 && parents[0]) {
+    return parents[0];
+  }
+  throw new Error(
+    "Could not resolve PROTOCOL_SINCE_BASE_SHA, origin/main, or a two-parent pull-request merge checkout.",
+  );
+}
+
+function unwrapExpression(expression: ts.Expression): ts.Expression {
+  let current = expression;
+  while (
+    ts.isAsExpression(current) ||
+    ts.isSatisfiesExpression(current) ||
+    ts.isParenthesizedExpression(current)
+  ) {
+    current = current.expression;
+  }
+  return current;
+}
+
+function stringProperty(object: ts.ObjectLiteralExpression, key: string): string | undefined {
+  for (const property of object.properties) {
+    if (!ts.isPropertyAssignment(property)) {
+      continue;
+    }
+    const propertyName = property.name;
+    const name =
+      ts.isIdentifier(propertyName) || ts.isStringLiteral(propertyName)
+        ? propertyName.text
+        : undefined;
+    if (name === key && ts.isStringLiteralLike(property.initializer)) {
+      return property.initializer.text;
+    }
+  }
+  return undefined;
+}
+
+function trueProperty(object: ts.ObjectLiteralExpression, key: string): boolean {
+  return object.properties.some((property) => {
+    if (!ts.isPropertyAssignment(property)) {
+      return false;
+    }
+    const propertyName = property.name;
+    const name =
+      ts.isIdentifier(propertyName) || ts.isStringLiteral(propertyName)
+        ? propertyName.text
+        : undefined;
+    return name === key && property.initializer.kind === ts.SyntaxKind.TrueKeyword;
+  });
+}
+
+function collectMethodSpec(
+  element: ts.Expression,
+  sourceFile: ts.SourceFile,
+  fileName: string,
+): MethodSpec {
+  const line = sourceFile.getLineAndCharacterOfPosition(element.getStart(sourceFile)).line + 1;
+  if (ts.isObjectLiteralExpression(element)) {
+    const name = stringProperty(element, "name");
+    if (!name) {
+      throw new Error(
+        `${fileName}:${line} core method spec names must be string literals so additions can be compared with origin/main.`,
+      );
+    }
+    return {
+      name,
+      since: stringProperty(element, "since"),
+      compatibilityRestored: trueProperty(element, "compatibilityRestored"),
+      line,
+    };
+  }
+  if (ts.isArrayLiteralExpression(element)) {
+    const name = element.elements[0];
+    const since = element.elements[3];
+    if (!name || !since || !ts.isStringLiteralLike(name) || !ts.isStringLiteralLike(since)) {
+      throw new Error(
+        `${fileName}:${line} core method spec rows must use string literal names and vintage metadata.`,
+      );
+    }
+    const policy = element.elements[4];
+    const compatibilityRestored =
+      policy !== undefined && ts.isObjectLiteralExpression(policy)
+        ? trueProperty(policy, "compatibilityRestored")
+        : false;
+    return { name: name.text, since: since.text, compatibilityRestored, line };
+  }
+  throw new Error(
+    `${fileName}:${line} core method specs must be inline object literals or labeled rows so vintage metadata can be enforced.`,
+  );
+}
+
+function collectMethodSpecs(sourceText: string, fileName: string): MethodSpec[] {
+  const sourceFile = ts.createSourceFile(fileName, sourceText, ts.ScriptTarget.Latest, true);
+  let specs: MethodSpec[] | undefined;
+
+  function visit(node: ts.Node): void {
+    if (
+      ts.isVariableDeclaration(node) &&
+      ts.isIdentifier(node.name) &&
+      node.name.text === "CORE_GATEWAY_METHOD_SPECS" &&
+      node.initializer
+    ) {
+      const initializer = unwrapExpression(node.initializer);
+      if (ts.isArrayLiteralExpression(initializer)) {
+        specs = initializer.elements.map((element) =>
+          collectMethodSpec(element, sourceFile, fileName),
+        );
+      }
+    }
+    ts.forEachChild(node, visit);
+  }
+
+  visit(sourceFile);
+  if (!specs) {
+    throw new Error(`Could not find CORE_GATEWAY_METHOD_SPECS in ${fileName}.`);
+  }
+  return specs;
+}
+
+function currentTrain(): string {
+  const packageJson: unknown = JSON.parse(
+    fs.readFileSync(path.join(repoRoot, "package.json"), "utf8"),
+  );
+  if (!isRecord(packageJson)) {
+    throw new Error("Root package.json must contain an object.");
+  }
+  const version = typeof packageJson.version === "string" ? packageJson.version : "";
+  const match = /^(\d{4})\.(\d{1,2})(?:\.|$)/.exec(version);
+  if (!match) {
+    throw new Error(`Root package version ${JSON.stringify(packageJson.version)} is not calver.`);
+  }
+  return `${match[1]!}.${match[2]!}`;
+}
+
+try {
+  const train = currentTrain();
+  const mergeBase = resolveBaseCommit();
+  const currentSource = fs.readFileSync(path.join(repoRoot, descriptorPath), "utf8");
+  const currentSpecs = collectMethodSpecs(currentSource, descriptorPath);
+  const baseSource = runGit(["show", `${mergeBase}:${descriptorPath}`]);
+  const baseNames = new Set(
+    collectMethodSpecs(baseSource, `${descriptorPath}@${mergeBase}`).map((s) => s.name),
+  );
+  const added = currentSpecs.filter((spec) => !baseNames.has(spec.name));
+  const restored = added.filter((spec) => spec.compatibilityRestored);
+  const newMethods = added.filter((spec) => !spec.compatibilityRestored);
+  // Restored shipped methods retain their historical vintage so discovery and
+  // generated clients see the original availability contract, not a new API.
+  const violations = added.filter((spec) =>
+    spec.compatibilityRestored ? !spec.since?.startsWith("<=") : spec.since !== train,
+  );
+
+  if (violations.length > 0) {
+    console.error(`Protocol since guard failed for current train ${train}:`);
+    for (const spec of violations) {
+      const problem = spec.compatibilityRestored
+        ? `is marked compatibilityRestored but has non-historical since ${JSON.stringify(spec.since)}`
+        : spec.since
+          ? `has since ${JSON.stringify(spec.since)}`
+          : "is missing since metadata";
+      console.error(
+        spec.compatibilityRestored
+          ? `- ${descriptorPath}:${spec.line} ${spec.name} ${problem}; restored compatibility methods must retain <= vintage metadata.`
+          : `- ${descriptorPath}:${spec.line} ${spec.name} ${problem}; add since: ${JSON.stringify(train)}.`,
+      );
+    }
+    process.exitCode = 1;
+  } else {
+    console.log(
+      `protocol since guard passed: ${newMethods.length} new core method${newMethods.length === 1 ? "" : "s"} use train ${train}; ${restored.length} restored compatibility method${restored.length === 1 ? "" : "s"} retain historical vintage`,
+    );
+  }
+} catch (error) {
+  console.error(
+    `Protocol since guard failed: ${error instanceof Error ? error.message : String(error)}`,
+  );
+  process.exitCode = 1;
+}
diff --git a/scripts/check-session-accessor-boundary.mts b/scripts/check-session-accessor-boundary.mts
new file mode 100644
index 0000000000000000000000000000000000000000..779b78237620f5d1e21ac7c69f03f9729dbce308
--- /dev/null
+++ b/scripts/check-session-accessor-boundary.mts
@@ -0,0 +1,1005 @@
+#!/usr/bin/env node
+
+import fs from "node:fs/promises";
+import path from "node:path";
+import ts from "typescript";
+import { z } from "zod";
+import { resolveRepoRoot } from "./lib/repo-root.mjs";
+import {
+  collectFileViolations,
+  getPropertyNameText,
+  resolveSourceRoots,
+  runAsScript,
+  toLine,
+  unwrapExpression,
+} from "./lib/ts-guard-utils.mts";
+
+const legacyReaderNames = new Set([
+  "loadSessionStore",
+  "readSessionEntries",
+  "readSessionEntry",
+  "readSessionStoreReadOnly",
+  "readSessionStoreSnapshot",
+  "resolveSessionStoreEntry",
+  "resolveSessionStoreEntryCore",
+]);
+const legacyWholeStoreAccessNames = new Set([
+  ...legacyReaderNames,
+  "saveSessionStore",
+  "updateSessionStore",
+]);
+const legacyWriterNames = new Set([
+  "applySessionStoreEntryPatch",
+  "recordSessionMetaFromInbound",
+  "saveSessionStore",
+  "updateLastRoute",
+  "updateSessionStore",
+  "updateSessionStoreEntry",
+]);
+const legacyTranscriptWriterNames = new Set([
+  "appendSessionTranscriptMessage",
+  "emitSessionTranscriptUpdate",
+]);
+const sessionCreateLifecycleWriterNames = new Set([
+  "applySessionStoreEntryPatch",
+  "saveSessionStore",
+  "updateSessionStore",
+  "updateSessionStoreEntry",
+  "ensureSessionTranscriptFile",
+]);
+const legacyManualCompactTrimNames = new Set([
+  "archiveFileOnDisk",
+  "readRecentSessionTranscriptLines",
+]);
+const legacyLifecycleCleanupNames = new Set([
+  "archiveRemovedSessionTranscripts",
+  "cleanupArchivedSessionTranscripts",
+]);
+const sessionStoreRuntimeFileBackedCompatNames = new Set([
+  "loadSessionStore",
+  "readSessionEntries",
+  "readSessionEntry",
+  "readLatestAssistantTextFromSessionTranscript",
+  "readSessionStoreReadOnly",
+  "resolveAndPersistSessionFile",
+  "resolveSessionFilePath",
+  "resolveSessionStoreEntry",
+  "saveSessionStore",
+  "updateSessionStore",
+]);
+const embeddedAgentSessionFileRuntimeNames = new Set(["resolveSessionFilePath"]);
+const materializingSessionEntryAccessorNames = new Set([
+  "listSessionEntriesCore",
+  "loadSessionEntry",
+]);
+
+// Shipped beta.5 official plugins import these deprecated helpers during
+// doctor migrations. Remove this ratchet with the compatibility bridge once
+// beta.5 is outside the supported upgrade window; do not add runtime callers.
+export const allowedSessionStoreRuntimeFileBackedCompatExports = new Set([
+  "loadSessionStore",
+  "resolveSessionFilePath",
+  "resolveSessionStoreEntry",
+  "updateSessionStore",
+]);
+
+const gatewaySessionServerMethodFiles = [
+  "src/gateway/server-methods/sessions-abort.ts",
+  "src/gateway/server-methods/sessions-compact.ts",
+  "src/gateway/server-methods/sessions-compaction-checkpoints.ts",
+  "src/gateway/server-methods/sessions-compaction-queries.ts",
+  "src/gateway/server-methods/sessions-compaction-runner.ts",
+  "src/gateway/server-methods/sessions-create.ts",
+  "src/gateway/server-methods/sessions-delete.ts",
+  "src/gateway/server-methods/sessions-dispatch.ts",
+  "src/gateway/server-methods/sessions-groups.ts",
+  "src/gateway/server-methods/sessions-messaging.ts",
+  "src/gateway/server-methods/sessions-mutations.ts",
+  "src/gateway/server-methods/sessions-read.ts",
+  "src/gateway/server-methods/sessions-shared.ts",
+  "src/gateway/server-methods/sessions-subscriptions.ts",
+];
+
+export const migratedSessionAccessorFiles = new Set([
+  "packages/memory-host-sdk/src/host/session-files.ts",
+  "src/acp/control-plane/manager.background-task.ts",
+  "src/acp/control-plane/manager.core.ts",
+  "src/acp/runtime/session-meta.ts",
+  "src/agents/subagents/spawn/acp-spawn.ts",
+  "src/agents/auth-profiles/session-override.ts",
+  "src/agents/embedded-agent-runner/compaction-successor-transcript.ts",
+  "src/agents/embedded-agent-runner/run/attempt.ts",
+  "src/agents/embedded-agent-runner/tool-result-truncation.ts",
+  "src/agents/embedded-agent-runner/transcript-rewrite.ts",
+  "src/agents/embedded-agent-runner/transcript-runtime-state.ts",
+  "src/agents/live-model-switch.ts",
+  "src/agents/subagents/registry/subagent-control.ts",
+  "src/agents/subagents/registry/subagent-registry-helpers.ts",
+  "src/auto-reply/reply/abort.ts",
+  "src/auto-reply/reply/agent-runner-helpers.ts",
+  "src/auto-reply/reply/agent-runner.ts",
+  "src/auto-reply/reply/commands-subagents/action-info.ts",
+  "src/auto-reply/reply/followup-runner.ts",
+  "src/auto-reply/reply/queue/drain.ts",
+  "src/commands/export-trajectory.ts",
+  "src/commands/health.ts",
+  "src/commands/sandbox-explain.ts",
+  "src/commands/sessions-tail.ts",
+  "src/commands/sessions.ts",
+  "src/commands/status.agent-local.ts",
+  "src/status/summary.ts",
+  "src/commands/tasks.ts",
+  "src/config/sessions/combined-store-gateway.ts",
+  "src/config/sessions/delivery-info.ts",
+  "src/config/sessions/goals.ts",
+  "src/cron/isolated-agent/delivery-target.ts",
+  "src/cron/service/timer.ts",
+  "src/gateway/session-compaction-checkpoints.ts",
+  "src/gateway/session-history-state.ts",
+  "src/gateway/sessions-history-http.ts",
+  "src/gateway/session-utils.ts",
+  "src/gateway/managed-image-attachments.ts",
+  "src/gateway/boot.ts",
+  "src/gateway/server-methods/artifacts.ts",
+  "src/gateway/server-methods/chat.ts",
+  "src/gateway/sessions-resolve.ts",
+  "src/gateway/server-methods/sessions-files.ts",
+  ...gatewaySessionServerMethodFiles,
+  "src/gateway/server-session-events.ts",
+  "src/gateway/session-reset-service.ts",
+  "src/infra/outbound/message-action-tts.ts",
+  "src/agents/tools/embedded-gateway-stub.ts",
+  "src/agents/tools/session-status-tool.ts",
+  "src/agents/tools/sessions-list-tool.ts",
+  "src/plugins/host-hook-state.ts",
+  "src/status/status-message.ts",
+  "src/tui/embedded-backend.ts",
+]);
+
+export const migratedBundledPluginSessionAccessorFiles = new Set([
+  "extensions/codex/src/conversation-binding.ts",
+  "extensions/discord/src/monitor/native-command-model-picker-ui.ts",
+  "extensions/discord/src/monitor/native-command-model-picker-apply.ts",
+  "extensions/discord/src/monitor/thread-session-close.ts",
+  "extensions/feishu/src/reasoning-preview.ts",
+  "extensions/memory-core/src/dreaming-phases.ts",
+  "extensions/memory-core/src/dreaming-narrative.ts",
+  "extensions/mattermost/src/mattermost/model-picker.ts",
+  "extensions/matrix/src/matrix/monitor/handler.ts",
+  "extensions/matrix/src/session-route.ts",
+  "extensions/slack/src/monitor/slash.ts",
+  "extensions/telegram/src/bot-core.ts",
+  "extensions/telegram/src/bot-handlers.runtime.ts",
+  "extensions/telegram/src/bot.ts",
+  "extensions/telegram/src/bot-message-dispatch.ts",
+  "extensions/telegram/src/bot-native-commands.ts",
+  "extensions/voice-call/src/response-generator.ts",
+  "extensions/whatsapp/src/auto-reply/monitor/group-activation.ts",
+]);
+
+export const migratedEmbeddedAgentSessionTargetFiles = new Set([
+  "extensions/voice-call/src/response-generator.ts",
+]);
+
+export const migratedSessionAccessorWriteFiles = new Set([
+  "src/acp/runtime/session-meta.ts",
+  "src/agents/auth-profiles/session-override.ts",
+  "src/agents/command/attempt-execution.shared.ts",
+  "src/agents/command/session-store.ts",
+  "src/agents/embedded-agent-runner/run.ts",
+  "src/agents/embedded-agent-subscribe.handlers.compaction.runtime.ts",
+  "src/agents/embedded-agent-runner/run/attempt.ts",
+  "src/agents/live-model-switch.ts",
+  "src/agents/main-session-recovery/main-session-restart-recovery-checkpoint.ts",
+  "src/agents/main-session-recovery/main-session-restart-recovery-marking.ts",
+  "src/agents/main-session-recovery/main-session-restart-recovery-store.ts",
+  "src/agents/session-suspension.ts",
+  "src/auto-reply/reply/abort.ts",
+  "src/agents/subagents/registry/subagent-control.ts",
+  "src/agents/subagents/registry/subagent-registry-helpers.ts",
+  "src/agents/tools/session-status-tool.ts",
+  "src/auto-reply/reply/abort-cutoff.runtime.ts",
+  "src/auto-reply/reply/agent-runner-cli-dispatch.ts",
+  "src/auto-reply/reply/agent-runner-execution.ts",
+  "src/auto-reply/reply/agent-runner-memory.ts",
+  "src/auto-reply/reply/agent-runner-session-reset.ts",
+  "src/auto-reply/reply/agent-runner.ts",
+  "src/auto-reply/reply/body.ts",
+  "src/auto-reply/reply/commands-acp/lifecycle.ts",
+  "src/auto-reply/reply/commands-reset.ts",
+  "src/auto-reply/reply/commands-session-store.ts",
+  "src/auto-reply/reply/directive-handling.impl.ts",
+  "src/auto-reply/reply/directive-handling.persist.ts",
+  "src/auto-reply/reply/dispatch-from-config.runtime.ts",
+  "src/auto-reply/reply/followup-runner.ts",
+  "src/auto-reply/reply/get-reply.ts",
+  "src/auto-reply/reply/model-selection.ts",
+  "src/auto-reply/reply/session.ts",
+  "src/auto-reply/reply/session-reset-model.ts",
+  "src/auto-reply/reply/session-updates.ts",
+  "src/auto-reply/reply/session-usage.ts",
+  "src/commands/tasks.ts",
+  "src/config/sessions/cleanup-service.ts",
+  "src/config/sessions/goals.ts",
+  "src/gateway/boot.ts",
+  "src/gateway/server-methods/chat.ts",
+  ...gatewaySessionServerMethodFiles,
+  "src/gateway/server-node-events.ts",
+  "src/gateway/session-compaction-checkpoints.ts",
+  "src/infra/outbound/outbound-session.ts",
+  "src/plugins/host-hook-cleanup.ts",
+  "src/plugins/host-hook-state.ts",
+  "src/plugins/runtime/runtime-channel.ts",
+  "src/tui/embedded-backend.ts",
+]);
+
+export const migratedTranscriptWriterFiles = new Set([
+  "src/agents/command/attempt-execution.ts",
+  "src/agents/embedded-agent-runner/context-engine-maintenance.ts",
+  "src/auto-reply/reply/session-fork.runtime.ts",
+  "src/config/sessions/transcript.ts",
+  "src/gateway/server-methods/chat.ts",
+  "src/gateway/server-methods/chat-transcript-inject.ts",
+  "src/sessions/user-turn-transcript.ts",
+]);
+
+export const migratedSessionCompactManualTrimFiles = new Set([
+  "src/gateway/server-methods/sessions-compact.ts",
+]);
+
+export const migratedSessionLifecycleCleanupFiles = new Set([
+  "src/config/sessions/cleanup-service.ts",
+  "src/cron/session-reaper.ts",
+  "src/infra/heartbeat-runner.ts",
+]);
+
+export const readOnlyGatewaySessionAccessorFiles = new Set([
+  "src/gateway/approval-session-audience.ts",
+  "src/gateway/control-ui-session-prs.ts",
+  "src/gateway/managed-image-attachments.ts",
+  "src/gateway/mcp-app-reconstruction.ts",
+  "src/gateway/server-chat.ts",
+  "src/gateway/server-methods/artifacts.ts",
+  "src/gateway/server-methods/chat-history-handler.ts",
+  "src/gateway/server-methods/chat-message-get-handler.ts",
+  "src/gateway/server-methods/sessions-diff.ts",
+  "src/gateway/server-methods/sessions-files.ts",
+  "src/gateway/server-methods/sessions-read.ts",
+  "src/gateway/server-methods/sessions-subscriptions.ts",
+  "src/gateway/server-methods/task-suggestions.ts",
+  "src/gateway/server-methods/tools-effective.ts",
+  "src/gateway/server-methods/usage-session-selection.ts",
+  "src/gateway/server-session-events.ts",
+]);
+
+export const migratedMemoryHostSessionCorpusFiles = new Set([
+  "packages/memory-host-sdk/src/host/session-files.ts",
+  "packages/memory-host-sdk/src/host/session-transcript-corpus.ts",
+]);
+
+const memoryHostSessionCorpusFunctionNames = new Set([
+  "listSessionTranscriptCorpusEntriesForAgentSync",
+  "listSessionTranscriptCorpusEntriesForAgent",
+  "loadDreamingNarrativeTranscriptPathSetForAgent",
+  "loadSessionTranscriptClassificationForAgent",
+  "listSessionFilesForAgent",
+]);
+
+const legacyMemoryHostSessionCorpusNames = new Set([
+  "loadSessionTranscriptClassificationForSessionsDir",
+  "readSessionTranscriptClassificationStore",
+]);
+
+type BoundaryViolation = { line: number; reason: string };
+const sessionAccessorDebtCountsSchema = z.record(z.string(), z.record(z.string(), z.number()));
+type SessionAccessorDebtCounts = z.infer<typeof sessionAccessorDebtCountsSchema>;
+
+function normalizeRelativePath(filePath: string) {
+  return filePath.replaceAll(path.sep, "/");
+}
+
+function legacyNamesForFile(fileName: string) {
+  const normalized = normalizeRelativePath(fileName);
+  if (
+    fileName === "source.ts" ||
+    [...migratedBundledPluginSessionAccessorFiles].some((filePath) => normalized.endsWith(filePath))
+  ) {
+    return legacyWholeStoreAccessNames;
+  }
+  return legacyReaderNames;
+}
+
+function propertyAccessName(expression: ts.Expression) {
+  const unwrapped = unwrapExpression(expression);
+  if (ts.isIdentifier(unwrapped)) {
+    return unwrapped.text;
+  }
+  if (ts.isPropertyAccessExpression(unwrapped)) {
+    return unwrapped.name.text;
+  }
+  if (ts.isElementAccessExpression(unwrapped) && ts.isStringLiteral(unwrapped.argumentExpression)) {
+    return unwrapped.argumentExpression.text;
+  }
+  return null;
+}
+
+function bindingName(node: ts.BindingElement) {
+  if (node.propertyName && ts.isIdentifier(node.propertyName)) {
+    return node.propertyName.text;
+  }
+  if (ts.isIdentifier(node.name)) {
+    return node.name.text;
+  }
+  return null;
+}
+
+function findNamedBoundaryViolations(
+  content: string,
+  fileName: string,
+  legacyNames: ReadonlySet<string>,
+  subject: string,
+) {
+  const sourceFile = ts.createSourceFile(fileName, content, ts.ScriptTarget.Latest, true);
+  const violations: BoundaryViolation[] = [];
+  const addViolation = (node: ts.Node, action: string, name: string) => {
+    violations.push({
+      line: toLine(sourceFile, node),
+      reason: `${action} ${subject} "${name}"`,
+    });
+  };
+
+  const visit = (node: ts.Node) => {
+    if (ts.isImportDeclaration(node)) {
+      const namedBindings = node.importClause?.namedBindings;
+      if (namedBindings && ts.isNamedImports(namedBindings)) {
+        for (const specifier of namedBindings.elements) {
+          const importedName = specifier.propertyName?.text ?? specifier.name.text;
+          if (legacyNames.has(importedName)) {
+            addViolation(specifier, "imports", importedName);
+          }
+        }
+      }
+    }
+
+    if (ts.isBindingElement(node)) {
+      const name = bindingName(node);
+      if (name && legacyNames.has(name)) {
+        addViolation(node, "aliases", name);
+      }
+    }
+
+    if (ts.isPropertyAccessExpression(node) && legacyNames.has(node.name.text)) {
+      addViolation(node.name, "references", node.name.text);
+    }
+
+    if (
+      ts.isElementAccessExpression(node) &&
+      ts.isStringLiteral(node.argumentExpression) &&
+      legacyNames.has(node.argumentExpression.text)
+    ) {
+      addViolation(node.argumentExpression, "references", node.argumentExpression.text);
+    }
+
+    if (ts.isCallExpression(node)) {
+      const calleeName = propertyAccessName(node.expression);
+      if (
+        calleeName &&
+        legacyNames.has(calleeName) &&
+        ts.isIdentifier(unwrapExpression(node.expression))
+      ) {
+        addViolation(node.expression, "calls", calleeName);
+      }
+    }
+
+    ts.forEachChild(node, visit);
+  };
+
+  visit(sourceFile);
+  return violations;
+}
+
+function findNamedSessionStoreViolations(
+  content: string,
+  fileName: string,
+  legacyNames: ReadonlySet<string>,
+  legacyKind: string,
+) {
+  return findNamedBoundaryViolations(
+    content,
+    fileName,
+    legacyNames,
+    `legacy session store ${legacyKind}`,
+  );
+}
+
+export function collectSessionStoreRuntimeFileBackedCompatExports(
+  content: string,
+  fileName = "source.ts",
+) {
+  const sourceFile = ts.createSourceFile(fileName, content, ts.ScriptTarget.Latest, true);
+  const exports = new Map<string, { line: number; sourceName: string }>();
+
+  const rememberExport = (node: ts.Node, exportedName: string, sourceName = exportedName) => {
+    if (!sessionStoreRuntimeFileBackedCompatNames.has(sourceName)) {
+      return;
+    }
+    exports.set(exportedName, {
+      line: toLine(sourceFile, node),
+      sourceName,
+    });
+  };
+
+  for (const statement of sourceFile.statements) {
+    const isExported =
+      ts.canHaveModifiers(statement) &&
+      ts.getModifiers(statement)?.some((modifier) => modifier.kind === ts.SyntaxKind.ExportKeyword);
+    if (isExported && ts.isVariableStatement(statement)) {
+      for (const declaration of statement.declarationList.declarations) {
+        if (ts.isIdentifier(declaration.name)) {
+          rememberExport(declaration.name, declaration.name.text);
+        }
+      }
+      continue;
+    }
+    if (isExported && ts.isFunctionDeclaration(statement) && statement.name) {
+      rememberExport(statement.name, statement.name.text);
+      continue;
+    }
+    if (
+      ts.isExportDeclaration(statement) &&
+      statement.exportClause &&
+      ts.isNamedExports(statement.exportClause)
+    ) {
+      for (const specifier of statement.exportClause.elements) {
+        rememberExport(
+          specifier,
+          specifier.name.text,
+          specifier.propertyName?.text ?? specifier.name.text,
+        );
+      }
+    }
+  }
+
+  return exports;
+}
+
+export function findSessionStoreRuntimeFileBackedCompatExportViolations(
+  content: string,
+  fileName = "source.ts",
+) {
+  const exports = collectSessionStoreRuntimeFileBackedCompatExports(content, fileName);
+  const violations: BoundaryViolation[] = [];
+  for (const [exportedName, exported] of exports) {
+    if (
+      exportedName !== exported.sourceName ||
+      !allowedSessionStoreRuntimeFileBackedCompatExports.has(exportedName)
+    ) {
+      violations.push({
+        line: exported.line,
+        reason: `exports unratcheted file-backed SDK session helper "${exported.sourceName}"`,
+      });
+    }
+  }
+  return violations;
+}
+
+export function findSessionAccessorBoundaryViolations(content: string, fileName = "source.ts") {
+  const legacyNames = legacyNamesForFile(fileName);
+  const legacyKind = legacyNames === legacyWholeStoreAccessNames ? "access" : "reader";
+  return findNamedSessionStoreViolations(content, fileName, legacyNames, legacyKind);
+}
+
+export function findReadOnlySessionAccessorViolations(content: string, fileName = "source.ts") {
+  return findNamedBoundaryViolations(
+    content,
+    fileName,
+    materializingSessionEntryAccessorNames,
+    "materializing session entry accessor",
+  );
+}
+
+export function findEmbeddedAgentSessionTargetViolations(content: string, fileName = "source.ts") {
+  const sourceFile = ts.createSourceFile(fileName, content, ts.ScriptTarget.Latest, true);
+  const violations = findNamedBoundaryViolations(
+    content,
+    fileName,
+    embeddedAgentSessionFileRuntimeNames,
+    "legacy embedded-agent session file resolver",
+  );
+
+  const recordDeprecatedSessionFile = (name: ts.Node) => {
+    violations.push({
+      line: toLine(sourceFile, name),
+      reason:
+        'passes deprecated embedded-agent runtime identity field "sessionFile"; use sessionTarget',
+    });
+  };
+
+  const visitRunOptions = (options: ts.ObjectLiteralExpression) => {
+    for (const property of options.properties) {
+      if (
+        ts.isPropertyAssignment(property) &&
+        getPropertyNameText(property.name) === "sessionFile"
+      ) {
+        recordDeprecatedSessionFile(property.name);
+      } else if (
+        ts.isShorthandPropertyAssignment(property) &&
+        property.name.text === "sessionFile"
+      ) {
+        recordDeprecatedSessionFile(property.name);
+      }
+    }
+  };
+
+  const visit = (node: ts.Node) => {
+    if (ts.isCallExpression(node) && propertyAccessName(node.expression) === "runEmbeddedAgent") {
+      const firstArgument = node.arguments[0];
+      const options = firstArgument ? unwrapExpression(firstArgument) : undefined;
+      if (options && ts.isObjectLiteralExpression(options)) {
+        visitRunOptions(options);
+      }
+      return;
+    }
+    ts.forEachChild(node, visit);
+  };
+
+  visit(sourceFile);
+  return violations;
+}
+
+export function findSessionAccessorWriteBoundaryViolations(
+  content: string,
+  fileName = "source.ts",
+) {
+  return findNamedSessionStoreViolations(content, fileName, legacyWriterNames, "writer");
+}
+
+export function findTranscriptWriterBoundaryViolations(content: string, fileName = "source.ts") {
+  return findNamedBoundaryViolations(
+    content,
+    fileName,
+    legacyTranscriptWriterNames,
+    "legacy transcript writer",
+  );
+}
+
+export function findGatewaySessionCreateLifecycleViolations(
+  content: string,
+  fileName = "source.ts",
+) {
+  const sourceFile = ts.createSourceFile(fileName, content, ts.ScriptTarget.Latest, true);
+  const violations: BoundaryViolation[] = [];
+
+  const visitCreateHandler = (node: ts.Node) => {
+    if (ts.isCallExpression(node)) {
+      const calleeName = propertyAccessName(node.expression);
+      if (calleeName && sessionCreateLifecycleWriterNames.has(calleeName)) {
+        violations.push({
+          line: toLine(sourceFile, node.expression),
+          reason: `calls legacy sessions.create lifecycle writer "${calleeName}"`,
+        });
+      }
+    }
+    ts.forEachChild(node, visitCreateHandler);
+  };
+
+  const visit = (node: ts.Node) => {
+    if (
+      ts.isPropertyAssignment(node) &&
+      ts.isStringLiteralLike(node.name) &&
+      node.name.text === "sessions.create"
+    ) {
+      visitCreateHandler(node.initializer);
+      return;
+    }
+    ts.forEachChild(node, visit);
+  };
+
+  visit(sourceFile);
+  return violations;
+}
+
+export function findSessionCompactManualTrimBoundaryViolations(
+  content: string,
+  fileName = "source.ts",
+) {
+  return findNamedSessionStoreViolations(
+    content,
+    fileName,
+    legacyManualCompactTrimNames,
+    "manual compact trim",
+  );
+}
+
+export function findSessionLifecycleCleanupBoundaryViolations(
+  content: string,
+  fileName = "source.ts",
+) {
+  return findNamedSessionStoreViolations(
+    content,
+    fileName,
+    legacyLifecycleCleanupNames,
+    "lifecycle cleanup",
+  );
+}
+
+// Source roots shared by the enforced boundary checks in main() and the debt
+// ratchet below; keeping one list prevents the two scans from drifting apart.
+const readSourceRootPaths = [
+  "packages/memory-host-sdk/src/host",
+  "extensions/discord/src/monitor",
+  "extensions/memory-core/src",
+  "extensions/telegram/src",
+  "extensions/voice-call/src",
+  "src/acp",
+  "src/agents",
+  "src/auto-reply",
+  "src/commands",
+  "src/config/sessions",
+  "src/cron",
+  "src/gateway",
+  "src/infra",
+  "src/plugins",
+  "src/tui",
+];
+const writeSourceRootPaths = [
+  "src/acp",
+  "src/agents",
+  "src/auto-reply",
+  "src/commands",
+  "src/config/sessions",
+  "src/gateway",
+  "src/infra",
+  "src/plugins",
+  "src/tui",
+];
+const transcriptWriterSourceRootPaths = [
+  "src/agents/command",
+  "src/agents/embedded-agent-runner",
+  "src/auto-reply/reply",
+  "src/config/sessions",
+  "src/gateway/server-methods",
+  "src/sessions",
+];
+
+function collectTopLevelFunctionBodies(sourceFile: ts.SourceFile) {
+  const bodies = new Map<string, ts.ConciseBody>();
+  for (const statement of sourceFile.statements) {
+    if (ts.isFunctionDeclaration(statement)) {
+      if (statement.name && statement.body) {
+        bodies.set(statement.name.text, statement.body);
+      }
+      continue;
+    }
+    if (!ts.isVariableStatement(statement)) {
+      continue;
+    }
+    const declaration = statement.declarationList.declarations[0];
+    const initializer = declaration?.initializer;
+    if (
+      declaration &&
+      ts.isIdentifier(declaration.name) &&
+      initializer &&
+      (ts.isArrowFunction(initializer) || ts.isFunctionExpression(initializer))
+    ) {
+      bodies.set(declaration.name.text, initializer.body);
+    }
+  }
+  return bodies;
+}
+
+export function findMemoryHostSessionCorpusBoundaryViolations(
+  content: string,
+  fileName = "source.ts",
+) {
+  const sourceFile = ts.createSourceFile(fileName, content, ts.ScriptTarget.Latest, true);
+  const functionBodies = collectTopLevelFunctionBodies(sourceFile);
+  const visitedFunctions = new Set<string>();
+  const violationKeys = new Set<string>();
+  const violations: BoundaryViolation[] = [];
+
+  const visitCorpusBody = (node: ts.Node) => {
+    if (ts.isCallExpression(node)) {
+      const calleeName = propertyAccessName(node.expression);
+      if (calleeName && legacyMemoryHostSessionCorpusNames.has(calleeName)) {
+        const line = toLine(sourceFile, node.expression);
+        const reason = `calls legacy memory-host session corpus helper "${calleeName}"`;
+        const key = `${line}:${reason}`;
+        if (!violationKeys.has(key)) {
+          violationKeys.add(key);
+          violations.push({ line, reason });
+        }
+      }
+      if (calleeName && ts.isIdentifier(unwrapExpression(node.expression))) {
+        const localBody = functionBodies.get(calleeName);
+        if (localBody && !visitedFunctions.has(calleeName)) {
+          visitedFunctions.add(calleeName);
+          visitCorpusBody(localBody);
+        }
+      }
+    }
+    ts.forEachChild(node, visitCorpusBody);
+  };
+
+  for (const name of memoryHostSessionCorpusFunctionNames) {
+    const body = functionBodies.get(name);
+    if (!body || visitedFunctions.has(name)) {
+      continue;
+    }
+    visitedFunctions.add(name);
+    visitCorpusBody(body);
+  }
+
+  return violations;
+}
+
+// Debt ratchet: the boundary checks above only scan files already on the
+// migrated lists, so unmigrated files could quietly gain new legacy call
+// sites. The checked-in baseline locks each unmigrated file's current legacy
+// call-site count per concern; any drift from the baseline fails the guard.
+const sessionAccessorDebtBaselineRelativePath = "scripts/lib/session-accessor-debt-baseline.json";
+const debtBaselineRegenCommand = "pnpm lint:tmp:session-accessor-boundary:gen";
+
+// Keys sorted alphabetically so the generated baseline JSON stays deterministic.
+const sessionAccessorDebtConcerns = {
+  embeddedAgentSessionTarget: {
+    sourceRootPaths: ["extensions/voice-call/src"],
+    migratedFiles: migratedEmbeddedAgentSessionTargetFiles,
+    findViolations: findEmbeddedAgentSessionTargetViolations,
+  },
+  memoryHostSessionCorpus: {
+    sourceRootPaths: ["packages/memory-host-sdk/src/host"],
+    migratedFiles: migratedMemoryHostSessionCorpusFiles,
+    findViolations: findMemoryHostSessionCorpusBoundaryViolations,
+  },
+  sessionAccessorRead: {
+    sourceRootPaths: readSourceRootPaths,
+    migratedFiles: new Set([
+      ...migratedSessionAccessorFiles,
+      ...migratedBundledPluginSessionAccessorFiles,
+    ]),
+    findViolations: findSessionAccessorBoundaryViolations,
+  },
+  sessionAccessorWrite: {
+    sourceRootPaths: writeSourceRootPaths,
+    migratedFiles: migratedSessionAccessorWriteFiles,
+    findViolations: findSessionAccessorWriteBoundaryViolations,
+  },
+  sessionCompactManualTrim: {
+    sourceRootPaths: ["src/gateway/server-methods"],
+    migratedFiles: migratedSessionCompactManualTrimFiles,
+    findViolations: findSessionCompactManualTrimBoundaryViolations,
+  },
+  sessionLifecycleCleanup: {
+    sourceRootPaths: readSourceRootPaths,
+    migratedFiles: migratedSessionLifecycleCleanupFiles,
+    findViolations: findSessionLifecycleCleanupBoundaryViolations,
+  },
+  transcriptWriter: {
+    sourceRootPaths: transcriptWriterSourceRootPaths,
+    migratedFiles: migratedTranscriptWriterFiles,
+    findViolations: findTranscriptWriterBoundaryViolations,
+  },
+};
+
+function sortRecordByKey<Value>(record: Record<string, Value>) {
+  return Object.fromEntries(
+    Object.entries(record).toSorted(([left], [right]) =>
+      left < right ? -1 : left > right ? 1 : 0,
+    ),
+  );
+}
+
+/** Counts legacy call sites per unmigrated file for every debt concern. */
+async function collectSessionAccessorDebtCounts(repoRoot: string) {
+  const counts: SessionAccessorDebtCounts = {};
+  for (const [key, concern] of Object.entries(sessionAccessorDebtConcerns)) {
+    const violations = await collectFileViolations({
+      repoRoot,
+      sourceRoots: resolveSourceRoots(repoRoot, concern.sourceRootPaths),
+      // Inverse of the enforcement skip: migrated files are held at zero by the
+      // boundary checks, so the ratchet tracks only the unmigrated rest.
+      skipFile: (filePath) =>
+        concern.migratedFiles.has(normalizeRelativePath(path.relative(repoRoot, filePath))),
+      findViolations: concern.findViolations,
+    });
+    const fileCounts: Record<string, number> = {};
+    for (const violation of violations) {
+      const relativePath = normalizeRelativePath(violation.path);
+      fileCounts[relativePath] = (fileCounts[relativePath] ?? 0) + 1;
+    }
+    counts[key] = sortRecordByKey(fileCounts);
+  }
+  return sortRecordByKey(counts);
+}
+
+/** Ratchet compare: counts above baseline are regressions, below are improvements. */
+export function compareSessionAccessorDebt(
+  currentCounts: SessionAccessorDebtCounts,
+  baselineCounts: SessionAccessorDebtCounts,
+) {
+  const regressions = [];
+  const improvements = [];
+  const concerns = [
+    ...new Set([...Object.keys(baselineCounts), ...Object.keys(currentCounts)]),
+  ].toSorted();
+  for (const concern of concerns) {
+    const current = currentCounts[concern] ?? {};
+    const baseline = baselineCounts[concern] ?? {};
+    const filePaths = [...new Set([...Object.keys(baseline), ...Object.keys(current)])].toSorted();
+    for (const filePath of filePaths) {
+      const currentCount = current[filePath] ?? 0;
+      const baselineCount = baseline[filePath] ?? 0;
+      if (currentCount === baselineCount) {
+        continue;
+      }
+      const entry = { concern, path: filePath, currentCount, baselineCount };
+      if (currentCount > baselineCount) {
+        regressions.push(entry);
+      } else {
+        improvements.push(entry);
+      }
+    }
+  }
+  return { regressions, improvements };
+}
+type DebtComparison = ReturnType<typeof compareSessionAccessorDebt>;
+
+// Improvements fail the guard too: passing silently would leave the baseline
+// stale, letting a later change reintroduce legacy call sites up to the old
+// count without tripping the ratchet.
+export function formatSessionAccessorDebtImprovements(
+  improvements: DebtComparison["improvements"],
+) {
+  return [
+    `Legacy session accessor debt dropped below ${sessionAccessorDebtBaselineRelativePath}:`,
+    ...improvements.map(
+      (improvement) =>
+        `- ${improvement.path} [${improvement.concern}]: ${improvement.currentCount} legacy call site(s), stale baseline allows ${improvement.baselineCount}`,
+    ),
+    `Run \`${debtBaselineRegenCommand}\` to ratchet the baseline down and commit it.`,
+  ];
+}
+
+function resolveDebtBaselinePath(repoRoot: string) {
+  return path.join(repoRoot, ...sessionAccessorDebtBaselineRelativePath.split("/"));
+}
+
+async function readSessionAccessorDebtBaseline(repoRoot: string) {
+  try {
+    return sessionAccessorDebtCountsSchema.parse(
+      JSON.parse(await fs.readFile(resolveDebtBaselinePath(repoRoot), "utf8")),
+    );
+  } catch (error) {
+    if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
+      return null;
+    }
+    throw error;
+  }
+}
+
+async function writeSessionAccessorDebtBaseline(repoRoot: string) {
+  const counts = await collectSessionAccessorDebtCounts(repoRoot);
+  await fs.writeFile(resolveDebtBaselinePath(repoRoot), `${JSON.stringify(counts, null, 2)}\n`);
+}
+
+function compareMigratedFilePaths(left: string, right: string, sourceRootPaths: string[]) {
+  const rootIndex = (filePath: string) =>
+    sourceRootPaths.findIndex((sourceRoot) => filePath.startsWith(`${sourceRoot}/`));
+  const leftRoot = rootIndex(left);
+  const rightRoot = rootIndex(right);
+  const rootOrder =
+    (leftRoot < 0 ? sourceRootPaths.length : leftRoot) -
+    (rightRoot < 0 ? sourceRootPaths.length : rightRoot);
+  if (rootOrder !== 0) {
+    return rootOrder;
+  }
+  // Recursive directory walks visit nested files before same-prefix sibling files.
+  const leftTraversalPath = left.replaceAll("/", "\0");
+  const rightTraversalPath = right.replaceAll("/", "\0");
+  return leftTraversalPath < rightTraversalPath
+    ? -1
+    : leftTraversalPath > rightTraversalPath
+      ? 1
+      : 0;
+}
+
+export async function main() {
+  const repoRoot = resolveRepoRoot(import.meta.url);
+  if (process.argv.includes("--update-debt-baseline")) {
+    await writeSessionAccessorDebtBaseline(repoRoot);
+    console.log(`Wrote ${sessionAccessorDebtBaselineRelativePath}`);
+    return;
+  }
+  const enforcementConcerns = [
+    sessionAccessorDebtConcerns.sessionAccessorRead,
+    sessionAccessorDebtConcerns.sessionAccessorWrite,
+    sessionAccessorDebtConcerns.transcriptWriter,
+    {
+      sourceRootPaths: ["src/gateway/server-methods"],
+      migratedFiles: new Set(["src/gateway/server-methods/sessions-create.ts"]),
+      findViolations: findGatewaySessionCreateLifecycleViolations,
+    },
+    sessionAccessorDebtConcerns.sessionCompactManualTrim,
+    sessionAccessorDebtConcerns.sessionLifecycleCleanup,
+    sessionAccessorDebtConcerns.memoryHostSessionCorpus,
+    sessionAccessorDebtConcerns.embeddedAgentSessionTarget,
+    {
+      sourceRootPaths: ["src/gateway"],
+      migratedFiles: readOnlyGatewaySessionAccessorFiles,
+      findViolations: findReadOnlySessionAccessorViolations,
+    },
+  ];
+  const violations: Array<BoundaryViolation & { path: string }> = [];
+  for (const concern of enforcementConcerns) {
+    violations.push(
+      ...(await collectFileViolations({
+        repoRoot,
+        sourceRoots: resolveSourceRoots(
+          repoRoot,
+          [...concern.migratedFiles].toSorted((left, right) =>
+            compareMigratedFilePaths(left, right, concern.sourceRootPaths),
+          ),
+        ),
+        findViolations: concern.findViolations,
+      })),
+    );
+  }
+  const sessionStoreRuntimePath = path.join(repoRoot, "src/plugin-sdk/session-store-runtime.ts");
+  violations.push(
+    ...findSessionStoreRuntimeFileBackedCompatExportViolations(
+      await fs.readFile(sessionStoreRuntimePath, "utf8"),
+      sessionStoreRuntimePath,
+    ).map((violation) =>
+      Object.assign({ path: "src/plugin-sdk/session-store-runtime.ts" }, violation),
+    ),
+  );
+
+  const baselineCounts = await readSessionAccessorDebtBaseline(repoRoot);
+  if (!baselineCounts) {
+    console.error(
+      `Missing ${sessionAccessorDebtBaselineRelativePath}; run \`${debtBaselineRegenCommand}\` and commit it.`,
+    );
+    process.exit(1);
+  }
+  const debt = compareSessionAccessorDebt(
+    await collectSessionAccessorDebtCounts(repoRoot),
+    baselineCounts,
+  );
+
+  if (violations.length === 0 && debt.regressions.length === 0 && debt.improvements.length === 0) {
+    console.log("session accessor boundary guard passed.");
+    return;
+  }
+
+  if (violations.length > 0) {
+    console.error("Found legacy session store usage in session-accessor migrated files:");
+    for (const violation of violations) {
+      console.error(`- ${violation.path}:${violation.line}: ${violation.reason}`);
+    }
+    console.error(
+      "Use src/config/sessions/session-accessor.ts helpers for migrated read/write and transcript-writer paths. Expand file-backed SDK compatibility only as an explicit pre-SQLite migration decision.",
+    );
+  }
+  if (debt.regressions.length > 0) {
+    console.error(
+      `Found new legacy session call sites in unmigrated files (counts exceed ${sessionAccessorDebtBaselineRelativePath}):`,
+    );
+    for (const regression of debt.regressions) {
+      console.error(
+        `- ${regression.path} [${regression.concern}]: ${regression.currentCount} legacy call site(s), baseline allows ${regression.baselineCount}`,
+      );
+    }
+    console.error(
+      `Use src/config/sessions/session-accessor.ts helpers instead of adding legacy call sites. If the increase is an intentional seam-owner change, run \`${debtBaselineRegenCommand}\` and commit the updated baseline.`,
+    );
+  }
+  if (debt.improvements.length > 0) {
+    for (const line of formatSessionAccessorDebtImprovements(debt.improvements)) {
+      console.error(line);
+    }
+  }
+  process.exit(1);
+}
+
+runAsScript(import.meta.url, main);
diff --git a/scripts/check-sqlite-transaction-boundary.mts b/scripts/check-sqlite-transaction-boundary.mts
new file mode 100644
index 0000000000000000000000000000000000000000..e3f8aed780d45a66bcc8c643777f3f4b12cdec4a
--- /dev/null
+++ b/scripts/check-sqlite-transaction-boundary.mts
@@ -0,0 +1,176 @@
+#!/usr/bin/env node
+
+import ts from "typescript";
+import { resolveRepoRoot } from "./lib/repo-root.mjs";
+import {
+  collectFileViolations,
+  resolveSourceRoots,
+  runAsScript,
+  toLine,
+  unwrapExpression,
+} from "./lib/ts-guard-utils.mts";
+
+const removedAsyncTransactionNames = new Set([
+  "runOpenClawAgentWriteTransactionAsync",
+  "runSqliteImmediateTransactionAsync",
+]);
+const synchronousTransactionCallbackIndexes = new Map([
+  ["runOpenClawAgentWriteTransaction", 0],
+  ["runOpenClawStateWriteTransaction", 0],
+  ["runSqliteImmediateTransactionSync", 1],
+]);
+
+function expressionName(expression: ts.Expression) {
+  const unwrapped = unwrapExpression(expression);
+  if (ts.isIdentifier(unwrapped)) {
+    return unwrapped.text;
+  }
+  if (ts.isPropertyAccessExpression(unwrapped)) {
+    return unwrapped.name.text;
+  }
+  if (ts.isElementAccessExpression(unwrapped) && ts.isStringLiteral(unwrapped.argumentExpression)) {
+    return unwrapped.argumentExpression.text;
+  }
+  return undefined;
+}
+
+function hasAsyncModifier(node: ts.FunctionLikeDeclaration) {
+  return node.modifiers?.some((modifier) => modifier.kind === ts.SyntaxKind.AsyncKeyword) === true;
+}
+
+function collectLocalAsyncFunctionNames(sourceFile: ts.SourceFile) {
+  const names = new Set<string>();
+  const visit = (node: ts.Node) => {
+    if (ts.isFunctionDeclaration(node) && node.name && hasAsyncModifier(node)) {
+      names.add(node.name.text);
+    }
+    if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && node.initializer) {
+      const initializer = unwrapExpression(node.initializer);
+      if (
+        (ts.isArrowFunction(initializer) || ts.isFunctionExpression(initializer)) &&
+        hasAsyncModifier(initializer)
+      ) {
+        names.add(node.name.text);
+      }
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(sourceFile);
+  return names;
+}
+
+function collectSynchronousTransactionAliases(sourceFile: ts.SourceFile) {
+  const aliases = new Map<string, string>();
+  for (const statement of sourceFile.statements) {
+    if (!ts.isImportDeclaration(statement)) {
+      continue;
+    }
+    const bindings = statement.importClause?.namedBindings;
+    if (!bindings || !ts.isNamedImports(bindings)) {
+      continue;
+    }
+    for (const specifier of bindings.elements) {
+      const importedName = specifier.propertyName?.text ?? specifier.name.text;
+      if (synchronousTransactionCallbackIndexes.has(importedName)) {
+        aliases.set(specifier.name.text, importedName);
+      }
+    }
+  }
+  return aliases;
+}
+
+function isAsyncCallback(expression: ts.Expression, localAsyncFunctionNames: Set<string>) {
+  const unwrapped = unwrapExpression(expression);
+  if (ts.isArrowFunction(unwrapped) || ts.isFunctionExpression(unwrapped)) {
+    return hasAsyncModifier(unwrapped);
+  }
+  return ts.isIdentifier(unwrapped) && localAsyncFunctionNames.has(unwrapped.text);
+}
+
+export function findSqliteTransactionBoundaryViolations(content: string, fileName = "source.ts") {
+  const sourceFile = ts.createSourceFile(fileName, content, ts.ScriptTarget.Latest, true);
+  const localAsyncFunctionNames = collectLocalAsyncFunctionNames(sourceFile);
+  const transactionAliases = collectSynchronousTransactionAliases(sourceFile);
+  const violations: Array<{ line: number; reason: string }> = [];
+
+  const visit = (node: ts.Node) => {
+    if (ts.isImportDeclaration(node)) {
+      const bindings = node.importClause?.namedBindings;
+      if (bindings && ts.isNamedImports(bindings)) {
+        for (const specifier of bindings.elements) {
+          const importedName = specifier.propertyName?.text ?? specifier.name.text;
+          if (removedAsyncTransactionNames.has(importedName)) {
+            violations.push({
+              line: toLine(sourceFile, specifier),
+              reason: `imports removed async SQLite transaction primitive "${importedName}"`,
+            });
+          }
+        }
+      }
+    }
+
+    const declaredName =
+      ts.isFunctionDeclaration(node) && node.name
+        ? node.name
+        : ts.isVariableDeclaration(node) && ts.isIdentifier(node.name)
+          ? node.name
+          : undefined;
+    if (declaredName && removedAsyncTransactionNames.has(declaredName.text)) {
+      violations.push({
+        line: toLine(sourceFile, declaredName),
+        reason: `declares removed async SQLite transaction primitive "${declaredName.text}"`,
+      });
+    }
+
+    if (ts.isCallExpression(node)) {
+      const calledName = expressionName(node.expression);
+      if (calledName && removedAsyncTransactionNames.has(calledName)) {
+        violations.push({
+          line: toLine(sourceFile, node.expression),
+          reason: `calls removed async SQLite transaction primitive "${calledName}"`,
+        });
+      }
+      const canonicalName = calledName
+        ? (transactionAliases.get(calledName) ?? calledName)
+        : undefined;
+      const callbackIndex = canonicalName
+        ? synchronousTransactionCallbackIndexes.get(canonicalName)
+        : undefined;
+      const callback = callbackIndex === undefined ? undefined : node.arguments[callbackIndex];
+      if (canonicalName && callback && isAsyncCallback(callback, localAsyncFunctionNames)) {
+        violations.push({
+          line: toLine(sourceFile, callback),
+          reason: `passes an async callback to synchronous SQLite transaction helper "${canonicalName}"`,
+        });
+      }
+    }
+
+    ts.forEachChild(node, visit);
+  };
+  visit(sourceFile);
+  return violations;
+}
+
+async function main() {
+  const repoRoot = resolveRepoRoot(import.meta.url);
+  const violations = await collectFileViolations({
+    repoRoot,
+    sourceRoots: resolveSourceRoots(repoRoot, ["src", "extensions", "packages"]),
+    skipFile: (filePath) => /(^|[\\/])dist([\\/]|$)/.test(filePath),
+    findViolations: findSqliteTransactionBoundaryViolations,
+  });
+  if (violations.length === 0) {
+    console.log("SQLite transaction boundary guard passed.");
+    return;
+  }
+  console.error("Found asynchronous SQLite transaction work:");
+  for (const violation of violations) {
+    console.error(`- ${violation.path}:${violation.line}: ${violation.reason}`);
+  }
+  console.error(
+    "Complete asynchronous preparation before the transaction, then validate and apply inside a synchronous transaction callback.",
+  );
+  process.exit(1);
+}
+
+runAsScript(import.meta.url, main);
diff --git a/scripts/check-temp-path-guardrails.ts b/scripts/check-temp-path-guardrails.ts
new file mode 100644
index 0000000000000000000000000000000000000000..0f17ffa83f1431225f8b780fbe09d45a4911d153
--- /dev/null
+++ b/scripts/check-temp-path-guardrails.ts
@@ -0,0 +1,287 @@
+// Check Temp Path Guardrails script supports OpenClaw repository automation.
+import fs from "node:fs/promises";
+import path from "node:path";
+import pMap, { pMapSkip } from "p-map";
+import { listRepoFilesSync } from "./check-file-utils.js";
+
+type QuoteChar = "'" | '"' | "`";
+
+type QuoteScanState = {
+  quote: QuoteChar | null;
+  escaped: boolean;
+};
+
+type RuntimeSourceGuardrailFile = {
+  relativePath: string;
+  source: string;
+};
+
+const WEAK_RANDOM_SAME_LINE_PATTERN =
+  /(?:Date\.now[^\r\n]*Math\.random|Math\.random[^\r\n]*Date\.now)/u;
+const PATH_JOIN_CALL_PATTERN = /path\s*\.\s*join\s*\(/u;
+const OS_TMPDIR_CALL_PATTERN = /os\s*\.\s*tmpdir\s*\(/u;
+const FILE_READ_CONCURRENCY = 24;
+const DEFAULT_GUARDRAIL_SKIP_PATTERNS = [
+  /\.test\.tsx?$/,
+  /\.test-helpers\.tsx?$/,
+  /\.test-utils\.tsx?$/,
+  /\.test-harness\.tsx?$/,
+  /\.test-support\.tsx?$/,
+  /\.suite\.tsx?$/,
+  /\.e2e\.tsx?$/,
+  /\.d\.ts$/,
+  /[\\/](?:__tests__|tests|test-helpers|test-utils|test-support)[\\/]/,
+  /[\\/][^\\/]*test-helpers(?:\.[^\\/]+)?\.ts$/,
+  /[\\/][^\\/]*test-utils(?:\.[^\\/]+)?\.ts$/,
+  /[\\/][^\\/]*test-harness(?:\.[^\\/]+)?\.ts$/,
+  /[\\/][^\\/]*test-support(?:\.[^\\/]+)?\.ts$/,
+];
+
+function shouldSkipGuardrailRuntimeSource(relativePath: string): boolean {
+  return DEFAULT_GUARDRAIL_SKIP_PATTERNS.some((pattern) => pattern.test(relativePath));
+}
+
+function stripCommentsForScan(input: string): string {
+  return input.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/.*$/gm, "$1");
+}
+
+function beginQuotedSection(state: QuoteScanState, ch: string): boolean {
+  if (ch !== "'" && ch !== '"' && ch !== "`") {
+    return false;
+  }
+  state.quote = ch;
+  return true;
+}
+
+function consumeQuotedChar(state: QuoteScanState, ch: string): boolean {
+  if (!state.quote) {
+    return false;
+  }
+  if (state.escaped) {
+    state.escaped = false;
+    return true;
+  }
+  if (ch === "\\") {
+    state.escaped = true;
+    return true;
+  }
+  if (ch === state.quote) {
+    state.quote = null;
+  }
+  return true;
+}
+
+function findMatchingParen(source: string, openIndex: number): number {
+  let depth = 1;
+  const quoteState: QuoteScanState = { quote: null, escaped: false };
+  for (let i = openIndex + 1; i < source.length; i += 1) {
+    const ch = source.charAt(i);
+    if (consumeQuotedChar(quoteState, ch)) {
+      continue;
+    }
+    if (beginQuotedSection(quoteState, ch)) {
+      continue;
+    }
+    if (ch === "(") {
+      depth += 1;
+      continue;
+    }
+    if (ch === ")") {
+      depth -= 1;
+      if (depth === 0) {
+        return i;
+      }
+    }
+  }
+  return -1;
+}
+
+function splitTopLevelArguments(source: string): string[] {
+  const out: string[] = [];
+  let current = "";
+  let parenDepth = 0;
+  let bracketDepth = 0;
+  let braceDepth = 0;
+  const quoteState: QuoteScanState = { quote: null, escaped: false };
+  for (const ch of source) {
+    if (quoteState.quote) {
+      current += ch;
+      consumeQuotedChar(quoteState, ch);
+      continue;
+    }
+    if (beginQuotedSection(quoteState, ch)) {
+      current += ch;
+      continue;
+    }
+    if (ch === "(") {
+      parenDepth += 1;
+      current += ch;
+      continue;
+    }
+    if (ch === ")") {
+      if (parenDepth > 0) {
+        parenDepth -= 1;
+      }
+      current += ch;
+      continue;
+    }
+    if (ch === "[") {
+      bracketDepth += 1;
+      current += ch;
+      continue;
+    }
+    if (ch === "]") {
+      if (bracketDepth > 0) {
+        bracketDepth -= 1;
+      }
+      current += ch;
+      continue;
+    }
+    if (ch === "{") {
+      braceDepth += 1;
+      current += ch;
+      continue;
+    }
+    if (ch === "}") {
+      if (braceDepth > 0) {
+        braceDepth -= 1;
+      }
+      current += ch;
+      continue;
+    }
+    if (ch === "," && parenDepth === 0 && bracketDepth === 0 && braceDepth === 0) {
+      out.push(current.trim());
+      current = "";
+      continue;
+    }
+    current += ch;
+  }
+  if (current.trim()) {
+    out.push(current.trim());
+  }
+  return out;
+}
+
+function isOsTmpdirExpression(argument: string): boolean {
+  return /^os\s*\.\s*tmpdir\s*\(\s*\)$/u.test(argument.trim());
+}
+
+function mightContainDynamicTmpdirJoin(source: string): boolean {
+  if (!source.includes("path") || !source.includes("join") || !source.includes("tmpdir")) {
+    return false;
+  }
+  return (
+    (source.includes("path.join") || PATH_JOIN_CALL_PATTERN.test(source)) &&
+    (source.includes("os.tmpdir") || OS_TMPDIR_CALL_PATTERN.test(source)) &&
+    source.includes("`") &&
+    source.includes("${")
+  );
+}
+
+function hasDynamicTmpdirJoin(source: string): boolean {
+  if (!mightContainDynamicTmpdirJoin(source)) {
+    return false;
+  }
+
+  const scanSource = stripCommentsForScan(source);
+  const joinPattern = /path\s*\.\s*join\s*\(/gu;
+  let match: RegExpExecArray | null = joinPattern.exec(scanSource);
+  while (match) {
+    const openParenIndex = scanSource.indexOf("(", match.index);
+    if (openParenIndex !== -1) {
+      const closeParenIndex = findMatchingParen(scanSource, openParenIndex);
+      if (closeParenIndex !== -1) {
+        const argsSource = scanSource.slice(openParenIndex + 1, closeParenIndex);
+        const args = splitTopLevelArguments(argsSource);
+        const firstArg = args[0];
+        if (firstArg && isOsTmpdirExpression(firstArg)) {
+          for (const arg of args.slice(1)) {
+            const trimmed = arg.trim();
+            if (trimmed.startsWith("`") && trimmed.includes("${")) {
+              return true;
+            }
+          }
+        }
+      }
+    }
+    match = joinPattern.exec(scanSource);
+  }
+  return false;
+}
+
+function listTrackedRuntimeSourceFiles(repoRoot: string): string[] {
+  return listRepoFilesSync(repoRoot, {
+    roots: ["src", "extensions"],
+    includeFile: (relativePath) =>
+      (relativePath.endsWith(".ts") || relativePath.endsWith(".tsx")) &&
+      !shouldSkipGuardrailRuntimeSource(relativePath),
+  }).map((relativePath) => path.join(repoRoot, relativePath));
+}
+
+async function readRuntimeSourceFiles(
+  repoRoot: string,
+  absolutePaths: string[],
+): Promise<RuntimeSourceGuardrailFile[]> {
+  return await pMap(
+    absolutePaths,
+    async (absolutePath) => {
+      try {
+        return {
+          relativePath: path.relative(repoRoot, absolutePath),
+          source: await fs.readFile(absolutePath, "utf8"),
+        };
+      } catch {
+        // File tracked by git but deleted on disk (e.g. pending deletion).
+        return pMapSkip;
+      }
+    },
+    { concurrency: FILE_READ_CONCURRENCY, stopOnError: false },
+  );
+}
+
+async function main() {
+  const repoRoot = process.cwd();
+  const files = await readRuntimeSourceFiles(repoRoot, listTrackedRuntimeSourceFiles(repoRoot));
+  const offenders: string[] = [];
+  const weakRandomMatches: string[] = [];
+
+  for (const file of files) {
+    const source = file.source;
+    const mightContainTmpdirJoin =
+      source.includes("tmpdir") &&
+      source.includes("path") &&
+      source.includes("join") &&
+      source.includes("`");
+    const mightContainWeakRandom = source.includes("Date.now") && source.includes("Math.random");
+
+    if (!mightContainTmpdirJoin && !mightContainWeakRandom) {
+      continue;
+    }
+    if (mightContainTmpdirJoin && hasDynamicTmpdirJoin(source)) {
+      offenders.push(file.relativePath);
+    }
+    if (mightContainWeakRandom && WEAK_RANDOM_SAME_LINE_PATTERN.test(source)) {
+      weakRandomMatches.push(file.relativePath);
+    }
+  }
+
+  if (offenders.length === 0 && weakRandomMatches.length === 0) {
+    return;
+  }
+
+  if (offenders.length > 0) {
+    console.error("Dynamic os.tmpdir()/path.join() template paths found:");
+    for (const offender of offenders) {
+      console.error(`- ${offender}`);
+    }
+  }
+  if (weakRandomMatches.length > 0) {
+    console.error("Weak Date.now()+Math.random() same-line IDs found:");
+    for (const offender of weakRandomMatches) {
+      console.error(`- ${offender}`);
+    }
+  }
+  process.exitCode = 1;
+}
+
+await main();
diff --git a/scripts/check.mts b/scripts/check.mts
new file mode 100644
index 0000000000000000000000000000000000000000..c34a5f5d11e14632689f578fb4e1168f58b20b6e
--- /dev/null
+++ b/scripts/check.mts
@@ -0,0 +1,221 @@
+// Runs the repository check lanes selected by CLI arguments.
+import { performance } from "node:perf_hooks";
+import { booleanFlag, parseFlagArgs } from "./lib/arg-utils.mts";
+import { printTimingSummary } from "./lib/check-timing-summary.mts";
+import { runManagedCommand } from "./lib/managed-child-process.mts";
+
+type CheckCommand = { name: string; args: string[] };
+type RunManagedCheck = (options: { args: string[]; bin: string }) => Promise<number>;
+
+export const PREFLIGHT_CHECKS: CheckCommand[] = [
+  { name: "conflict markers", args: ["check:no-conflict-markers"] },
+  { name: "script TypeScript erasability", args: ["check:script-erasability"] },
+  { name: "max-lines suppression ratchet", args: ["check:max-lines-ratchet"] },
+  { name: "assertion SAFETY comment ratchet", args: ["check:assertion-safety"] },
+  { name: "changelog attributions", args: ["check:changelog-attributions"] },
+  { name: "database-first legacy-store guard", args: ["check:database-first-legacy-stores"] },
+  { name: "doctor deprecation registry", args: ["check:doctor-deprecation-registry"] },
+  {
+    name: "guarded extension wildcard re-exports",
+    args: ["lint:extensions:no-guarded-wildcard-reexports"],
+  },
+  {
+    name: "plugin-sdk wildcard re-exports",
+    args: ["lint:extensions:no-plugin-sdk-wildcard-reexports"],
+  },
+  {
+    name: "deprecated channel access seams",
+    args: ["lint:extensions:no-deprecated-channel-access"],
+  },
+  { name: "media download helper guard", args: ["check:media-download-helpers"] },
+  { name: "runtime sidecar loader guard", args: ["check:runtime-sidecar-loaders"] },
+  { name: "tool display", args: ["tool-display:check"] },
+  { name: "host env policy", args: ["check:host-env-policy:swift"] },
+  { name: "browser inspect script", args: ["check:browser-inspect-script:swift"] },
+  { name: "native conversation privacy defaults", args: ["native-catalogs:check"] },
+  { name: "opengrep rule metadata", args: ["check:opengrep-rule-metadata"] },
+  { name: "duplicate scan target coverage", args: ["dup:check:coverage"] },
+  { name: "npm package-lock guard", args: ["deps:npm-lock:check"] },
+  { name: "package patch guard", args: ["deps:patches:check"] },
+];
+
+/**
+ * Returns command usage text for the aggregate check runner.
+ */
+export function usage() {
+  return [
+    "Usage: node --import tsx scripts/check.mts [--timed] [--include-architecture] [--include-test-types]",
+    "",
+    "Runs the local check graph: guard preflights, typecheck, lint, and policy guards.",
+    "",
+    "Options:",
+    "  --timed                 Print timing summary even when checks pass.",
+    "  --include-architecture  Run architecture import-cycle checks instead of runtime cycles.",
+    "  --include-test-types    Typecheck production and test sources.",
+    "  -h, --help              Show this help.",
+  ].join("\n");
+}
+
+/**
+ * Parses aggregate check runner arguments.
+ */
+function parseCheckArgs(argv: string[]) {
+  return parseFlagArgs(
+    argv,
+    { help: false, includeArchitecture: false, includeTestTypes: false, timed: false },
+    [
+      booleanFlag("--timed", "timed", true, { repeatable: true }),
+      booleanFlag("--include-architecture", "includeArchitecture", true, { repeatable: true }),
+      booleanFlag("--include-test-types", "includeTestTypes", true, { repeatable: true }),
+      booleanFlag("--help", "help", true, { repeatable: true }),
+      booleanFlag("-h", "help", true, { repeatable: true }),
+    ],
+    {
+      ignoreDoubleDash: false,
+      onUnhandledArg(arg: string) {
+        throw new Error(`unknown argument: ${arg}\n\n${usage()}`);
+      },
+    },
+  );
+}
+
+/**
+ * Runs selected repository check lanes.
+ */
+export async function main(argv = process.argv.slice(2)) {
+  let args;
+  try {
+    args = parseCheckArgs(argv);
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 2;
+    return;
+  }
+  if (args.help) {
+    console.log(usage());
+    process.exitCode = 0;
+    return;
+  }
+
+  const tailChecks = [
+    { name: "webhook body guard", args: ["lint:webhook:no-low-level-body-read"] },
+    { name: "runtime action config guard", args: ["check:no-runtime-action-load-config"] },
+    !args.includeArchitecture
+      ? {
+          name: "deprecated API usage guard",
+          args: ["check:deprecated-api-usage"],
+        }
+      : null,
+    !args.includeArchitecture
+      ? {
+          name: "wrapper shadowing guard",
+          args: ["check:wrapper-shadowing"],
+        }
+      : null,
+    { name: "temp path guard", args: ["check:temp-path-guardrails"] },
+    { name: "pairing store guard", args: ["lint:auth:no-pairing-store-group"] },
+    { name: "pairing account guard", args: ["lint:auth:pairing-account-scope"] },
+    args.includeArchitecture
+      ? { name: "architecture import cycles", args: ["check:architecture"] }
+      : { name: "runtime import cycles", args: ["check:import-cycles"] },
+  ].filter((command) => command !== null);
+
+  const stages = [
+    {
+      name: "preflight guards",
+      parallel: true,
+      commands: PREFLIGHT_CHECKS,
+    },
+    {
+      name: "typecheck",
+      parallel: false,
+      commands: args.includeTestTypes
+        ? [{ name: "typecheck all", args: ["tsgo:all"] }]
+        : [
+            { name: "typecheck prod", args: ["tsgo:prod"] },
+            { name: "typecheck scripts", args: ["tsgo:scripts"] },
+            { name: "typecheck test root", args: ["tsgo:test:root"] },
+          ],
+    },
+    {
+      name: "lint",
+      parallel: false,
+      commands: [
+        { name: "lint", args: ["lint"] },
+        { name: "format", args: ["format:check"] },
+      ],
+    },
+    {
+      name: "policy guards",
+      parallel: true,
+      commands: tailChecks,
+    },
+  ];
+
+  const timings = [];
+  let exitCode = 0;
+
+  for (const stage of stages) {
+    console.error(`\n[check] ${stage.name}`);
+    const results = stage.parallel
+      ? await Promise.all(stage.commands.map((command) => runCommand(command)))
+      : await runSerial(stage.commands);
+
+    timings.push(...results);
+    const failed = results.find((result) => result.status !== 0);
+    if (failed) {
+      exitCode = failed.status;
+      break;
+    }
+  }
+
+  if (args.timed || exitCode !== 0) {
+    printSummary(timings);
+  }
+
+  process.exitCode = exitCode;
+}
+
+async function runSerial(commands: CheckCommand[]) {
+  const results: Array<Awaited<ReturnType<typeof runCommand>>> = [];
+  for (const command of commands) {
+    const result = await runCommand(command);
+    results.push(result);
+    if (result.status !== 0) {
+      break;
+    }
+  }
+  return results;
+}
+
+/**
+ * Runs one managed check command and returns timing/status details.
+ */
+export async function runCommand(
+  command: CheckCommand,
+  runManagedCommandImpl: RunManagedCheck = runManagedCommand,
+) {
+  const startedAt = performance.now();
+  let status = 1;
+  try {
+    status = await runManagedCommandImpl({
+      args: command.args,
+      bin: "pnpm",
+    });
+  } catch (error) {
+    console.error(error);
+  }
+  return {
+    name: command.name,
+    durationMs: performance.now() - startedAt,
+    status,
+  };
+}
+
+function printSummary(timings: Array<Awaited<ReturnType<typeof runCommand>>>) {
+  printTimingSummary("check", timings);
+}
+
+if (import.meta.main) {
+  await main();
+}
diff --git a/scripts/ci-changed-scope.mjs b/scripts/ci-changed-scope.mjs
new file mode 100644
index 0000000000000000000000000000000000000000..f18a03a0882f9ed0564a5011125e2b7ef8ae32cd
--- /dev/null
+++ b/scripts/ci-changed-scope.mjs
@@ -0,0 +1,828 @@
+// Determines CI scope from changed paths.
+import { execFileSync } from "node:child_process";
+import { appendFileSync, readFileSync, readdirSync } from "node:fs";
+import { requireOptionArgument } from "./lib/arg-utils.runtime.mjs";
+import { getChangedPathFacts } from "./lib/changed-path-facts.mjs";
+import { isDirectRunUrl } from "./lib/direct-run.mjs";
+import { resolveMergeHeadDiffBase } from "./lib/merge-head-diff-base.mjs";
+
+/** @typedef {{ runNode: boolean; runMacos: boolean; runMacosNode: boolean; runIosBuild: boolean; runAndroid: boolean; runWindows: boolean; runSkillsPython: boolean; runChangedSmoke: boolean; runControlUiI18n: boolean; runUiTests: boolean }} ChangedScope */
+/** @typedef {{ runFastOnly: boolean; runPluginContracts: boolean; runCiRouting: boolean }} NodeFastScope */
+/** @typedef {{ runFastInstallSmoke: boolean; runFullInstallSmoke: boolean }} InstallSmokeScope */
+
+const CHANGED_PATHS_OUTPUT_MAX_BYTES = 64 * 1024;
+
+/** @type {ChangedScope} */
+const FULL_SCOPE = {
+  runNode: true,
+  runMacos: true,
+  runMacosNode: true,
+  runIosBuild: true,
+  runAndroid: true,
+  runWindows: true,
+  runSkillsPython: true,
+  runChangedSmoke: true,
+  runControlUiI18n: true,
+  runUiTests: true,
+};
+
+/** @type {ChangedScope} */
+const EMPTY_SCOPE = {
+  runNode: false,
+  runMacos: false,
+  runMacosNode: false,
+  runIosBuild: false,
+  runAndroid: false,
+  runWindows: false,
+  runSkillsPython: false,
+  runChangedSmoke: false,
+  runControlUiI18n: false,
+  runUiTests: false,
+};
+
+const SKILLS_PYTHON_SCOPE_RE = /^(skills\/|skills\/pyproject\.toml$)/;
+const INSTALL_SMOKE_WORKFLOW_SCOPE_RE = /^\.github\/workflows\/install-smoke\.yml$/;
+const NATIVE_PROTOCOL_GEN_RE = /^apps\/shared\/OpenClawKit\/Sources\/OpenClawProtocol\//;
+const APPLE_SWIFT_CONFIG_RE = /^config\/(?:swiftformat|swiftlint\.yml)$/;
+const APPLE_SHARED_CONTRACT_FIXTURE_RE =
+  /^test\/fixtures\/(?:device-identity-coordinator|talk-config)-contract\.json$/;
+const MACOS_NATIVE_RE =
+  /^(apps\/macos\/|apps\/macos-mlx-tts\/|apps\/shared\/|apps\/swabble\/|Swabble\/)/;
+const GIT_OWNER_SCOPE_RE =
+  /^(?:\.github\/(?:actions\/(?:git-owner|ensure-base-commit|publish-generated-pr|mantis-validate-trusted-ref)\/|workflows\/(?:workflow-sanity|qa-profile-evidence|maturity-scorecard|docs-agent|docs-sync-publish|openclaw-performance|linux-app-release|macos-release|npm-placeholder-bootstrap|plugin-clawhub-release|plugin-npm-release|mantis-(?:discord-(?:smoke|status-reactions|thread-attachment)|slack-desktop-smoke|web-ui-chat-proof))\.yml$)|scripts\/generate-ci-git-owner\.mts$|test\/scripts\/(?:ci-(?:checkout|git-owner|linux-git|platform-checkout|windows-process-census)\.test(?:-support)?\.ts|generated-publisher\.test-support\.ts|openclaw-performance-(?:workflow\.test(?:-support)?|git-lifecycle\.test)\.ts|plugin-release-git-lifecycle\.test\.ts|release-workflow-git-lifecycle\.test\.ts|fixtures\/(?:ci-platform-checkout\.mjs|ci-windows-process-census\.(?:mjs|py)))$)/;
+const MACOS_SCRIPT_SCOPE_RE =
+  /^(?:scripts\/(?:build-and-run-mac|check-swift-tools|codesign-mac-app|create-dmg|format-swift|install-swift-tools|install-xcodegen|lint-swift|mac-elevation-host|notarize-mac-artifact|package-mac-app|package-mac-dist|prepush-ci|restart-mac|stage-cua-driver-macos|stage-mac-node-worker)\.sh|scripts\/test-macos-native\.mts|scripts\/(?:verify-mac-node-worker(?:-fs)?|lib\/(?:mac-node-worker-proof-state|mac-worker-portability))\.mjs|scripts\/(?:materialize-mac-node-worker|swift-build-cache-metadata|lib\/(?:mac-native-inventory|mac-bundle-mutation))\.py|scripts\/lib\/(?:mac-app-bundle|plistbuddy|swift-toolchain)\.sh|test\/helpers\/mac-(?:native|signing)\.ts|test\/scripts\/(?:codesign-mac-app|create-dmg|mac-elevation-artifact|mac-elevation-host|mac-node-worker|macos-native-test-launch|notarize-mac-artifact|package-mac-app|package-mac-dist|restart-mac|swift-build-cache-metadata|verify-mac-node-worker-fs)\.test\.ts|test\/scripts\/(?:mac-elevation-artifact|mac-native-fixtures|mac-node-worker-materialization)\.test-support\.ts)$/;
+const WORKER_DEPLOY_ARTIFACT_SCOPE_RE =
+  /^src\/(?:agents\/github-exec-(?:launcher|credential)\.ts|shared\/worker-bundle-hash\.ts|worker\/workspace-rsync-receiver\.ts|gateway\/worker-environments\/workspace-(?:accepted-(?:remote-script|sync)|mutation-remote-script|rsync-path\.test|sync(?:-helpers)?)\.ts)$/;
+const IOS_BUILD_RE =
+  /^(apps\/ios\/|apps\/shared\/|apps\/swabble\/|Swabble\/|scripts\/(?:check-swift-tools|format-swift|install-swift-tools|install-xcodegen|lint-swift)\.sh$|scripts\/(?:ios-(?:configure-signing|screenshots|team-id|write-version-xcconfig)\.sh|ios-screenshot-evidence\.(?:mjs|d\.mts)|ios-write-swift-filelist\.m[jt]s|ios-version\.ts)$|scripts\/lib\/(?:ios-fastlane\.sh|ios-version\.ts|release-version\.mjs|version-script-args\.ts)$)/;
+// Tests and WatchTests Swift sources belong only to retained native unit-test targets.
+// UITests, resources, and project changes still prove the screenshot target graph.
+const IOS_SCREENSHOT_APP_SCOPE_RE =
+  /^(?:apps\/ios\/(?!(?:Tests|WatchTests)\/.*\.swift$)|apps\/shared\/OpenClawKit\/|apps\/swabble\/|Swabble\/)/;
+const IOS_SCREENSHOT_SCRIPT_SCOPE_RE =
+  /^scripts\/(?:check-swift-tools|format-swift|install-swift-tools|install-xcodegen|lint-swift)\.sh$|^scripts\/(?:ios-(?:configure-signing|screenshots|team-id|write-version-xcconfig)\.sh|ios-screenshot-evidence\.(?:mjs|d\.mts)|ios-write-swift-filelist\.m[jt]s|ios-version\.ts)$|^scripts\/lib\/(?:ios-fastlane\.sh|ios-version\.ts|release-version\.mjs|version-script-args\.ts)$/;
+const ANDROID_NATIVE_RE =
+  /^(apps\/android\/|apps\/shared\/|\.github\/actions\/setup-android-toolchain\/)/;
+// Native bundling reads the root aliases and this shared coercion dependency.
+const MERMAID_ASSET_INPUT_RE =
+  /^(?:packages\/(?:mermaid-renderer\/|normalization-core\/(?:package\.json|src\/record-coerce\.ts)$)|tsconfig\.json$)/;
+const NODE_SCOPE_RE =
+  /^(src\/|test\/|extensions\/|packages\/|scripts\/|ui\/|\.github\/|openclaw\.mjs$|package\.json$|pnpm-lock\.yaml$|pnpm-workspace\.yaml$|tsconfig.*\.json$|vitest.*\.ts$|tsdown\.config\.ts$|\.oxlintrc\.json$|\.oxfmtrc\.jsonc$)/;
+const WINDOWS_SQLITE_SCOPE_RE = /^src\/(?:state\/|.*sqlite.*\.ts$)/;
+// Windows process-start identity: the owner, the Windows probe it falls back to,
+// and every consumer that admits or recovers work from that identity. The
+// real-host proof for this contract only runs on the Windows lane, so a change
+// to any of them that skipped the lane would merge a Windows regression unseen.
+// Not gated on isTestOnly: the proof itself is a test file and must route here.
+const WINDOWS_PROCESS_IDENTITY_SCOPE_RE =
+  /^src\/(?:shared\/pid-alive(?:\.[a-z-]+)?(?:\.test)?\.ts|infra\/(?:windows-process-start|gateway-lock)(?:\.test)?\.ts|node-host\/node-worker-process-identity(?:\.test)?\.ts|cron\/store\/run-receipt-store(?:\.test)?\.ts)$/;
+const WINDOWS_FILE_URL_SCOPE_RE =
+  /^(?:src\/agents\/tools\/(?:media-tool-file-url\.windows\.test|media-tool-shared(?:\.test)?|pdf-tool(?:\.test)?)|src\/auto-reply\/(?:reply\/stage-sandbox-media|reply\.triggers\.trigger-handling\.stages-inbound-media-into-sandbox-workspace\.test)|src\/media\/(?:local-media-path(?:\.windows\.test)?|local-roots(?:\.test)?|web-media(?:\.file-url\.windows\.test)?)|src\/channels\/inbound-event\/media(?:\.test)?|src\/gateway\/managed-image-attachments(?:\.test)?|extensions\/msteams\/src\/(?:media-helpers|messenger)(?:\.test)?)\.ts$/;
+const WINDOWS_SCOPE_RE =
+  /^(src\/cli\/completion-runtime\.ts$|extensions\/canvas\/scripts\/pnpm-runner\.(?:mjs|test\.ts)$|extensions\/mxc\/|src\/agents\/(?:bash-tools\.exec-script-(?:preflight|target)|bash-tools\.exec\.script-preflight\.test)\.ts$|src\/config\/sessions\/(?:session-accessor\.sqlite-archive(?:\.worker(?:\.test)?)?|store\.session-lifecycle-mutation\.test)\.ts$|src\/process\/|src\/infra\/(?:(?:exec-allowlist-pattern|fs-safe-remove)(?:\.windows)?(?:\.test)?|ports(?:-inspect|\.test)|ssh-client(?:\.windows\.test)?|update-managed-service-handoff(?:-(?:command|lifecycle)\.test)?|windows-install-roots)\.ts$|src\/shared\/(?:import-specifier|runtime-import)(?:\.test)?\.ts$|src\/test-utils\/openclaw-test-state(?:\.test)?\.ts$|scripts\/(?:android-(?:app-i18n|pin-version)\.ts|ci-run-timings\.mjs|e2e\/lib\/package-compat\.mjs|generate-bundled-channel-config-metadata\.ts|install\.ps1|openclaw-cross-os-release-checks\.ts|plan-release-workflow-matrix\.mjs|run-additional-boundary-checks\.mts|verify-docker-attestations\.mjs|github\/run-openclaw-cross-os-release-checks\.sh|tsx\.mjs|(?:npm-runner|pnpm-runner|ui|vitest-process-group)\.(?:mjs|mts|js)|lib\/(?:direct-run\.(?:mjs|mts)|format-generated-module\.mts|tsx-cli-shim\.mjs|cross-os-release-checks\/[^/]+\.ts))$|test\/scripts\/(?:direct-run-entrypoints|format-generated-module|install-ps1|npm-runner|openclaw-cross-os-release-workflow|pnpm-runner|ui|vitest-process-group)\.test\.ts$|package\.json$|pnpm-lock\.yaml$|pnpm-workspace\.yaml$|\.github\/workflows\/(?:ci|openclaw-cross-os-release-checks-reusable|windows-testbox-probe)\.yml$|\.github\/actions\/setup-node-env\/action\.yml$|\.github\/actions\/setup-pnpm-store-cache\/action\.yml$)/;
+const WINDOWS_LAN_ADVERTISEMENT_SCOPE_RE =
+  /^src\/infra\/advertised-lan-host(?:\.windows)?(?:\.test)?\.ts$/;
+const WINDOWS_SECRETREF_SCOPE_RE =
+  /^(?:src\/commands\/doctor-gateway-auth-token(?:\.windows\.test)?\.ts|src\/flows\/(?:doctor-core-checks|doctor-health-contributions)\.ts|src\/gateway\/(?:auth-token-resolution|resolve-configured-secret-input-string)\.ts|src\/infra\/(?:fs-safe|fs-safe-defaults|permissions)\.ts|src\/secrets\/(?:resolve|resolve-errors)\.ts|src\/security\/audit-fs\.ts)$/;
+const WINDOWS_DAEMON_SCOPE_RE =
+  /^src\/daemon\/(?:schtasks(?:[-.][^/]+)?|runtime-hints\.windows-paths(?:\.test)?|test-helpers\/schtasks-(?:base-mocks|fixtures))\.ts$/;
+const WINDOWS_USAGE_TEMPLATE_SCOPE_RE =
+  /^src\/auto-reply\/usage-bar\/template(?:\.windows\.test)?\.ts$/;
+const WINDOWS_MEDIA_UNDERSTANDING_FILE_URL_SCOPE_RE =
+  /^src\/media-understanding\/attachments\.(?:cache(?:\.test)?|file-url\.windows\.test|normalize(?:\.test)?)\.ts$/;
+const WINDOWS_HOME_DISPLAY_SCOPE_RE =
+  /^(?:src\/(?:utils(?:\.test)?|infra\/(?:home-display|path-guards)|commands\/agents\.commands\.list(?:\.test)?|cli\/daemon-cli\/status\.print(?:\.test)?|agents\/(?:sandbox\/fs-paths|sessions\/tools\/render-utils)(?:\.test)?)|packages\/terminal-core\/src\/display-string(?:\.test)?)\.ts$/;
+const WINDOWS_CHILD_ENV_SCOPE_RE =
+  /^src\/(?:agents\/provider-local-service(?:\.env-case\.test)?|cli\/mcp-cli(?:\.path-case\.windows)?\.test|cli\/mcp-cli|infra\/process-env(?:\.test)?)\.ts$/;
+const WINDOWS_SOURCE_CLI_SCOPE_RE =
+  /^src\/infra\/openclaw-cli-(?:invocation(?:\.test(?:-support)?)?|shim(?:\.(?:windows\.)?test)?)\.ts$/;
+// The helper is test-only, but its command and receipt owners need native process proof.
+const WINDOWS_TEST_INSTANCE_SCOPE_RE =
+  /^(?:test\/helpers\/openclaw-test-instance(?:\.test)?\.ts|test\/helpers\/openclaw-test-instance\.cli\.test-support\.mjs|scripts\/lib\/(?:managed-child-process|vitest-resource-ownership)\.mts)$/;
+const WINDOWS_NODE_HOST_EXECUTABLE_SCOPE_RE =
+  /^(?:src\/plugin-sdk\/node-host(?:\.test)?|src\/tui\/(?:tui|tui\.resolve-codex-bin\.test))\.ts$/;
+const WINDOWS_AGENT_HOME_PATH_SCOPE_RE =
+  /^src\/(?:infra\/home-dir(?:\.test)?|agents\/(?:agent-tools\.read(?:\.host-operations|\.windows)?\.test|agent-tools\.read|sessions\/tools\/path-utils(?:\.test)?))\.ts$/;
+const WINDOWS_MEMORY_EXTRA_FILE_SCOPE_RE =
+  /^(?:packages\/memory-host-sdk\/src\/host\/(?:(?:internal|read-file)(?:\.test)?|explicit-extra-markdown)|extensions\/memory-core\/src\/(?:cli-runtime-common|memory-extra-file-path\.windows\.test))\.ts$/;
+const WINDOWS_WORKSPACE_QUIESCENCE_SCOPE_RE =
+  /^src\/gateway\/worker-environments\/workspace-quiescence(?:-scripts|(?:\.windows)?\.test)?\.ts$/;
+const WINDOWS_WORKER_BUNDLE_SCOPE_RE =
+  /^src\/(?:shared\/worker-bundle-(?:archive|hash)(?:\.test)?|gateway\/worker-environments\/bundle(?:-staging)?(?:\.test)?|node-host\/node-worker-bundle-installer(?:\.test)?)\.ts$/;
+const WINDOWS_WORKER_WORKSPACE_SCOPE_RE =
+  /^src\/(?:infra\/git-exec(?:\.test)?|agents\/worktrees\/(?:git|base-ref)(?:\.test)?|node-host\/node-worker-transfer-client(?:\.test)?|gateway\/worker-environments\/(?:node-worker-tunnel(?:\.test)?|workspace-result-(?:git(?:\.test)?|staging|ref-mutation\.test)|session-repository-checkpoints(?:\.test)?|workspace-sync-(?:scripts|manifest\.test)))\.ts$/;
+const CONTROL_UI_I18N_SCOPE_RE =
+  /^(ui\/src\/i18n\/|ui\/config\/control-ui-locales\.ts$|scripts\/(?:control-ui-i18n(?:-verify)?\.ts|lib\/control-ui-i18n-(?:(?:catalog(?:-values)?|config|raw-copy|sync-plan)\.ts|config\.json))$|\.github\/workflows\/control-ui-locale-refresh\.yml$)/;
+const CONTROL_UI_I18N_PRODUCTION_SOURCE_RE =
+  /^(?:ui\/src\/(?:app|components|lib|pages)\/.*\.tsx?|src\/config\/(?:schema[^/]*|zod-schema[^/]*|media-audio-field-metadata|talk-defaults|channel-config-keys)\.ts)$/;
+const CONTROL_UI_HARD_GENERATED_I18N_RE =
+  /^ui\/src\/i18n\/\.i18n\/(?:catalog-fallbacks\.json|[^/]+\.(?:meta\.json|tm\.jsonl))$/;
+const RELEASE_BRANCH_RE = /^release\/\d{4}\.\d+\.\d+$/;
+
+class ControlUiGeneratedArtifactsMixedError extends Error {}
+class NativeGeneratedArtifactsMixedError extends Error {}
+// Browser setup and sharding inputs must select the same proof as the config;
+// matching the harness family also covers per-project bundle setup owners.
+// QA Lab real-Gateway suites share the same Chromium owner.
+const CHROMIUM_UI_TEST_SCOPE_RE =
+  /^(ui\/|extensions\/[^/]+\/browser(?:\/|$)|extensions\/browser\/chrome-extension\/|extensions\/qa-lab\/src\/[^/]+\.real-gateway\.e2e\.test\.ts$|test\/vitest\/vitest\.(?:shared\.config\.ts|ui-(?:e2e|browser)(?:-[^/.]+)?\.[^/]+\.ts|(?:pattern-file|performance-config|timeouts|weighted-sharding)\.ts|ui-(?:isolated-)?paths\.mjs)$|test\/helpers\/temp-dir\.ts$|scripts\/(?:ensure-playwright-chromium\.mts|test-desktop-resize-real\.mts|check-control-ui-(?:performance(?:-base)?|precompressed-assets)\.mts|ui\.(?:mts|js)|control-ui-mock-[^/]+\.ts|lib\/(?:ci-test-timings(?:-schema)?|desktop-resize-proof|vitest-local-scheduling)\.mts)$|config\/(?:ci-test-timings|control-ui-startup-budget-baseline)\.json$|package\.json$|\.github\/workflows\/ci\.yml$)/;
+const NATIVE_I18N_SCOPE_RE =
+  /^(?:apps\/\.i18n\/|apps\/android\/(?:app\/src\/(?:main|play|thirdParty)\/|wear\/src\/main\/)|apps\/ios\/|apps\/macos\/Sources\/|apps\/shared\/OpenClawKit\/Sources\/|scripts\/(?:android-app-i18n|apple-app-i18n|native-(?:app-i18n|i18n-locales))\.ts$|test\/scripts\/(?:android-app-i18n|apple-app-i18n|native-app-i18n)\.test\.ts$|\.github\/workflows\/(?:ci|native-app-locale-refresh)\.yml$)/;
+// Android base resources are co-owned: source PRs edit their English content,
+// while the generator rewrites managed sections. Treat them as generated only
+// alongside a hard-generated artifact so neither ownership path blocks the other.
+const NATIVE_COOWNED_GENERATED_I18N_RE =
+  /^apps\/android\/app\/src\/main\/res\/values\/(?:assistant|strings)\.xml$/;
+const NATIVE_HARD_GENERATED_I18N_RE =
+  /^(?:apps\/\.i18n\/native\/[^/]+\.json|apps\/android\/app\/src\/main\/java\/ai\/openclaw\/app\/i18n\/NativeStringResources\.kt|apps\/android\/app\/src\/main\/res\/values-[^/]+\/(?:assistant|strings)\.xml|apps\/android\/app\/src\/thirdParty\/res\/values-[^/]+\/accessibility_strings\.xml|apps\/android\/wear\/src\/main\/res\/values-[^/]+\/strings\.xml|apps\/ios\/Resources\/Localizable\.xcstrings|apps\/macos\/Sources\/OpenClaw\/Resources\/Localizable\.xcstrings|apps\/ios\/(?:Sources|WatchApp|ShareExtension|ActivityWidget)\/[^/]+\.lproj\/InfoPlist\.strings)$/;
+const NATIVE_CANONICAL_V2_MIGRATION_GENERATED_RE =
+  /^(?:apps\/\.i18n\/native\/[^/]+\.json|apps\/android\/app\/src\/main\/res\/values-[^/]+\/strings\.xml|apps\/android\/wear\/src\/main\/res\/values-[^/]+\/strings\.xml|apps\/ios\/Resources\/Localizable\.xcstrings|apps\/macos\/Sources\/OpenClaw\/Resources\/Localizable\.xcstrings)$/;
+const FAST_INSTALL_SMOKE_SCOPE_RE =
+  /^(Dockerfile$|\.npmrc$|package\.json$|pnpm-lock\.yaml$|pnpm-workspace\.yaml$|scripts\/ci-changed-scope\.mjs$|scripts\/postinstall-bundled-plugins\.mjs$|scripts\/e2e\/(?:Dockerfile(?:\.qr-import)?|agents-delete-shared-workspace-docker\.sh|gateway-network-docker\.sh)$|extensions\/[^/]+\/(?:package\.json|openclaw\.plugin\.json)$|\.github\/workflows\/install-smoke\.yml$|\.github\/actions\/setup-node-env\/action\.yml$)/;
+const FULL_INSTALL_SMOKE_SCOPE_RE =
+  /^(Dockerfile$|\.npmrc$|package\.json$|pnpm-lock\.yaml$|pnpm-workspace\.yaml$|scripts\/ci-changed-scope\.mjs$|scripts\/install(?:-cli)?\.sh$|scripts\/install\.ps1$|scripts\/test-install-sh-docker\.sh$|scripts\/docker\/|scripts\/e2e\/(?:Dockerfile(?:\.qr-import)?|qr-import-docker\.sh|bun-global-install-smoke\.sh)$|\.github\/workflows\/(?:install-smoke|website-installer-sync)\.yml$|\.github\/actions\/setup-node-env\/action\.yml$)/;
+const FAST_INSTALL_SMOKE_RUNTIME_SCOPE_RE =
+  /^(?:src\/(?:channels|gateway|plugin-sdk|plugins)\/|packages\/gateway-(?:client|protocol)\/src\/)/;
+const NODE_FAST_PLUGIN_CONTRACT_SCOPE_RE =
+  /^src\/plugins\/contracts\/(?:inventory\/bundled-capability-metadata|registry|tts-contract-suites)\.ts$/;
+const NODE_FAST_CI_ROUTING_SCOPE_RE =
+  /^(scripts\/ci-changed-scope\.mjs$|scripts\/(?:check-changed|run-vitest)\.(?:mjs|mts)$|scripts\/test-projects(?:\.test-support)?\.mts$|scripts\/lib\/changed-path-facts\.mjs$|scripts\/lib\/(?:ci-changed-node-test-plan|ci-docker-seed-plan)\.mts$|src\/commands\/status\.scan-result\.test\.ts$|src\/scripts\/ci-changed-scope(?:\.[^/]+)?\.test\.ts$|test\/scripts\/(?:changed-lanes|changed-path-facts|ci-changed-node-test-plan|ci-docker-seed-plan|run-vitest|test-projects)\.test\.ts$)/;
+const NODE_FAST_SCOPE_RE = new RegExp(
+  `${NODE_FAST_PLUGIN_CONTRACT_SCOPE_RE.source}|${NODE_FAST_CI_ROUTING_SCOPE_RE.source}`,
+);
+
+/** @param {string} path Canonical repository-relative script or test path. */
+export function isMacosToolingPath(path) {
+  return MACOS_SCRIPT_SCOPE_RE.test(path);
+}
+
+/** @param {string} path Canonical repository-relative build input. */
+function isAppleSharedBuildInput(path) {
+  return (
+    APPLE_SWIFT_CONFIG_RE.test(path) ||
+    MERMAID_ASSET_INPUT_RE.test(path) ||
+    path === "scripts/prepare-apple-mermaid.mjs"
+  );
+}
+
+/**
+ * Detects high-level CI scope from changed file paths.
+ * @param {string[]} changedPaths
+ * @returns {ChangedScope}
+ */
+export function detectChangedScope(changedPaths) {
+  if (!Array.isArray(changedPaths) || changedPaths.length === 0) {
+    return { ...FULL_SCOPE };
+  }
+
+  // The package scripts own the native test inventory; a second whitelist drifts.
+  const scripts = JSON.parse(
+    readFileSync(new URL("../package.json", import.meta.url), "utf8"),
+  ).scripts;
+  const windowsCiTests = new Set(
+    [1, 2].flatMap((part) => {
+      const targets = scripts[`test:windows:ci:${part}`].match(/[^\s"']+\.test\.ts/g);
+      if (!targets) {
+        throw new Error(`Windows CI part ${part} must declare explicit test paths`);
+      }
+      return targets;
+    }),
+  );
+
+  let runNode = false;
+  let runMacos = false;
+  let hasGitOwnerChanges = false;
+  let hasMacosNodeTestSupportChanges = false;
+  let runIosBuild = false;
+  let runAndroid = false;
+  let runWindows = false;
+  let runSkillsPython = false;
+  let runChangedSmoke = false;
+  let runControlUiI18n = false;
+  let runUiTests = false;
+  let hasNonDocs = false;
+  let hasNonNativeNonDocs = false;
+
+  for (const rawPath of changedPaths) {
+    const facts = getChangedPathFacts(rawPath);
+    const { path } = facts;
+    if (!path) {
+      continue;
+    }
+
+    const isAppleBuildInput = isAppleSharedBuildInput(path);
+
+    if (facts.surface === "docs") {
+      continue;
+    }
+
+    hasNonDocs = true;
+    hasGitOwnerChanges ||= GIT_OWNER_SCOPE_RE.test(path);
+    // Native shell fixture support needs Darwin proof, not Swift or Windows builds.
+    hasMacosNodeTestSupportChanges ||= path === "test/scripts/mac-script-fixture.test-support.ts";
+
+    if (SKILLS_PYTHON_SCOPE_RE.test(path)) {
+      runSkillsPython = true;
+    }
+
+    if (INSTALL_SMOKE_WORKFLOW_SCOPE_RE.test(path)) {
+      runChangedSmoke = true;
+    }
+
+    if (
+      !NATIVE_PROTOCOL_GEN_RE.test(path) &&
+      (MACOS_NATIVE_RE.test(path) ||
+        isMacosToolingPath(path) ||
+        WORKER_DEPLOY_ARTIFACT_SCOPE_RE.test(path) ||
+        APPLE_SHARED_CONTRACT_FIXTURE_RE.test(path) ||
+        isAppleBuildInput)
+    ) {
+      runMacos = true;
+    }
+
+    if (IOS_BUILD_RE.test(path) || isAppleBuildInput) {
+      runIosBuild = true;
+    }
+
+    if (
+      !NATIVE_PROTOCOL_GEN_RE.test(path) &&
+      (ANDROID_NATIVE_RE.test(path) || MERMAID_ASSET_INPUT_RE.test(path))
+    ) {
+      runAndroid = true;
+    }
+
+    if (NODE_SCOPE_RE.test(path)) {
+      runNode = true;
+    }
+
+    if (
+      windowsCiTests.has(path) ||
+      WINDOWS_LAN_ADVERTISEMENT_SCOPE_RE.test(path) ||
+      WINDOWS_FILE_URL_SCOPE_RE.test(path) ||
+      WINDOWS_DAEMON_SCOPE_RE.test(path) ||
+      WINDOWS_USAGE_TEMPLATE_SCOPE_RE.test(path) ||
+      WINDOWS_MEDIA_UNDERSTANDING_FILE_URL_SCOPE_RE.test(path) ||
+      WINDOWS_HOME_DISPLAY_SCOPE_RE.test(path) ||
+      WINDOWS_AGENT_HOME_PATH_SCOPE_RE.test(path) ||
+      WINDOWS_CHILD_ENV_SCOPE_RE.test(path) ||
+      WINDOWS_SOURCE_CLI_SCOPE_RE.test(path) ||
+      WINDOWS_TEST_INSTANCE_SCOPE_RE.test(path) ||
+      WINDOWS_NODE_HOST_EXECUTABLE_SCOPE_RE.test(path) ||
+      WINDOWS_MEMORY_EXTRA_FILE_SCOPE_RE.test(path) ||
+      WINDOWS_WORKSPACE_QUIESCENCE_SCOPE_RE.test(path) ||
+      WINDOWS_WORKER_BUNDLE_SCOPE_RE.test(path) ||
+      WINDOWS_WORKER_WORKSPACE_SCOPE_RE.test(path) ||
+      WINDOWS_PROCESS_IDENTITY_SCOPE_RE.test(path) ||
+      (!facts.isTestOnly &&
+        (WINDOWS_SCOPE_RE.test(path) ||
+          WINDOWS_SQLITE_SCOPE_RE.test(path) ||
+          WINDOWS_SECRETREF_SCOPE_RE.test(path)))
+    ) {
+      runWindows = true;
+    }
+
+    if (detectInstallSmokeScopeForPath(path).runFastInstallSmoke) {
+      runChangedSmoke = true;
+    }
+
+    if (
+      CONTROL_UI_I18N_SCOPE_RE.test(path) ||
+      (CONTROL_UI_I18N_PRODUCTION_SOURCE_RE.test(path) && !facts.isTestOnly)
+    ) {
+      runControlUiI18n = true;
+    }
+
+    if (CHROMIUM_UI_TEST_SCOPE_RE.test(path) || MERMAID_ASSET_INPUT_RE.test(path)) {
+      runUiTests = true;
+    }
+
+    if (!facts.isNativeOnly) {
+      hasNonNativeNonDocs = true;
+    }
+  }
+
+  if (!runNode && hasNonDocs && hasNonNativeNonDocs) {
+    runNode = true;
+  }
+
+  return {
+    runNode,
+    runMacos,
+    runMacosNode: runMacos || hasGitOwnerChanges || hasMacosNodeTestSupportChanges,
+    runIosBuild,
+    runAndroid,
+    runWindows: runWindows || hasGitOwnerChanges,
+    runSkillsPython,
+    runChangedSmoke,
+    runControlUiI18n,
+    runUiTests,
+  };
+}
+
+/**
+ * Release screenshot capture is a conservative pipeline-integrity gate. App,
+ * linked Swift, and capture-tool changes must prove the real release lane.
+ * @param {string[] | null} changedPaths
+ * @returns {boolean}
+ */
+export function shouldRunIosScreenshots(changedPaths) {
+  if (!Array.isArray(changedPaths)) {
+    return true;
+  }
+  return changedPaths.some((rawPath) => {
+    const { path } = getChangedPathFacts(rawPath);
+    return (
+      IOS_SCREENSHOT_APP_SCOPE_RE.test(path) ||
+      IOS_SCREENSHOT_SCRIPT_SCOPE_RE.test(path) ||
+      isAppleSharedBuildInput(path)
+    );
+  });
+}
+
+/**
+ * Generated Control UI locale snapshots belong in their isolated automation PR.
+ * Mixing them into a source PR recreates deterministic rebase conflicts.
+ * @param {string[]} changedPaths
+ * @param {string} [branchName]
+ * @returns {void}
+ */
+export function assertControlUiGeneratedArtifactsIsolated(changedPaths, branchName = "") {
+  if (branchName === "main" || RELEASE_BRANCH_RE.test(branchName)) {
+    return;
+  }
+  const generatedPaths = changedPaths.filter((filePath) =>
+    CONTROL_UI_HARD_GENERATED_I18N_RE.test(filePath),
+  );
+  if (generatedPaths.length === 0) {
+    return;
+  }
+  const sourcePaths = changedPaths.filter(
+    (filePath) => !CONTROL_UI_HARD_GENERATED_I18N_RE.test(filePath),
+  );
+  if (sourcePaths.length === 0) {
+    return;
+  }
+  if (isControlUiCanonicalMemoryMigration(changedPaths, generatedPaths)) {
+    return;
+  }
+  throw new ControlUiGeneratedArtifactsMixedError(
+    [
+      "Control UI generated locale artifacts must be isolated from source changes.",
+      "Commit English/source changes only; the locale refresh workflow owns generated translation memory and metadata.",
+      ...generatedPaths.map((filePath) => `- generated: ${filePath}`),
+      ...sourcePaths.map((filePath) => `- source: ${filePath}`),
+    ].join("\n"),
+  );
+}
+
+/**
+ * @param {string[]} changedPaths
+ * @param {string[]} generatedPaths
+ * @returns {boolean}
+ */
+function isControlUiCanonicalMemoryMigration(changedPaths, generatedPaths) {
+  const requiredOwners = [
+    ".gitattributes",
+    "scripts/ci-changed-scope.mjs",
+    "scripts/control-ui-i18n.ts",
+    "scripts/control-ui-i18n-verify.ts",
+    "scripts/lib/control-ui-i18n-catalog.ts",
+    "scripts/lib/control-ui-i18n-catalog-values.ts",
+    "scripts/lib/control-ui-i18n-sync-plan.ts",
+    "ui/AGENTS.md",
+    "ui/config/control-ui-locales.ts",
+    "ui/vite.config.ts",
+  ];
+  if (!requiredOwners.every((owner) => changedPaths.includes(owner))) {
+    return false;
+  }
+
+  const assetsDir = new URL("../ui/src/i18n/.i18n/", import.meta.url);
+  const locales = readdirSync(assetsDir)
+    .filter((fileName) => fileName.endsWith(".tm.jsonl"))
+    .map((fileName) => fileName.slice(0, -".tm.jsonl".length));
+  const requiredGeneratedPaths = [
+    "ui/src/i18n/.i18n/catalog-fallbacks.json",
+    ...locales.flatMap((locale) => [
+      `ui/src/i18n/.i18n/${locale}.tm.jsonl`,
+      `ui/src/i18n/.i18n/${locale}.meta.json`,
+    ]),
+  ];
+  if (
+    generatedPaths.length !== requiredGeneratedPaths.length ||
+    !requiredGeneratedPaths.every((filePath) => generatedPaths.includes(filePath))
+  ) {
+    return false;
+  }
+
+  return locales.every((locale) => {
+    const adapterPath = `ui/src/i18n/locales/${locale}.ts`;
+    if (!changedPaths.includes(adapterPath)) {
+      return false;
+    }
+    let source;
+    try {
+      source = readFileSync(new URL(`../${adapterPath}`, import.meta.url), "utf8").trim();
+    } catch {
+      return false;
+    }
+    const exportName = locale.replaceAll("-", "_");
+    return (
+      source ===
+      `export { default as ${exportName} } from "virtual:openclaw-control-ui-locale/${locale}";`
+    );
+  });
+}
+
+/**
+ * @param {string[] | null} changedPaths
+ * @returns {boolean}
+ */
+export function shouldStrictControlUiI18n(changedPaths) {
+  return (
+    changedPaths === null ||
+    changedPaths.some((filePath) => CONTROL_UI_HARD_GENERATED_I18N_RE.test(filePath))
+  );
+}
+
+/**
+ * Native translations and platform resources are committed by one serialized
+ * automation PR. Source PRs own only source plus the stable-ID inventory.
+ * @param {string[]} changedPaths
+ * @param {string} [branchName]
+ * @returns {void}
+ */
+export function assertNativeGeneratedArtifactsIsolated(changedPaths, branchName = "") {
+  if (branchName === "main" || RELEASE_BRANCH_RE.test(branchName)) {
+    return;
+  }
+  const generatedPaths = changedPaths.filter((filePath) =>
+    NATIVE_HARD_GENERATED_I18N_RE.test(filePath),
+  );
+  if (generatedPaths.length === 0) {
+    return;
+  }
+  const generatedCompanionPaths = changedPaths.filter((filePath) =>
+    NATIVE_COOWNED_GENERATED_I18N_RE.test(filePath),
+  );
+  const sourcePaths = changedPaths.filter(
+    (filePath) =>
+      !NATIVE_HARD_GENERATED_I18N_RE.test(filePath) &&
+      !NATIVE_COOWNED_GENERATED_I18N_RE.test(filePath),
+  );
+  if (sourcePaths.length === 0) {
+    return;
+  }
+  if (isNativeCanonicalV2Migration(changedPaths, generatedPaths)) {
+    return;
+  }
+  throw new NativeGeneratedArtifactsMixedError(
+    [
+      "Native generated locale artifacts must be isolated from source changes.",
+      "Commit native source changes and apps/.i18n/native-source.json only; the native locale refresh workflow owns translated and platform-generated artifacts.",
+      ...generatedPaths.map((filePath) => `- generated: ${filePath}`),
+      ...generatedCompanionPaths.map((filePath) => `- generated companion: ${filePath}`),
+      ...sourcePaths.map((filePath) => `- source: ${filePath}`),
+    ].join("\n"),
+  );
+}
+
+/**
+ * One-time v2 native artifact migration escape; remove after the migration PR lands.
+ * @param {string[]} changedPaths
+ * @param {string[]} generatedPaths
+ * @returns {boolean}
+ */
+function isNativeCanonicalV2Migration(changedPaths, generatedPaths) {
+  const requiredOwners = [
+    ".gitattributes",
+    "scripts/ci-changed-scope.mjs",
+    "scripts/native-app-i18n.ts",
+    "scripts/android-app-i18n.ts",
+    "scripts/apple-app-i18n.ts",
+    "test/scripts/native-app-i18n.test.ts",
+    "test/scripts/apple-app-i18n.test.ts",
+    "src/scripts/ci-changed-scope.native-i18n.test.ts",
+  ];
+  return (
+    requiredOwners.every((owner) => changedPaths.includes(owner)) &&
+    generatedPaths.every((filePath) => NATIVE_CANONICAL_V2_MIGRATION_GENERATED_RE.test(filePath))
+  );
+}
+
+/**
+ * @param {string[] | null} changedPaths
+ * @returns {boolean}
+ */
+export function shouldStrictNativeI18n(changedPaths) {
+  return (
+    changedPaths === null ||
+    changedPaths.some((filePath) => NATIVE_HARD_GENERATED_I18N_RE.test(filePath))
+  );
+}
+
+/** @returns {string} */
+function resolveChangedBranchName() {
+  const githubBranch = process.env.GITHUB_HEAD_REF || process.env.GITHUB_REF_NAME;
+  if (githubBranch) {
+    return githubBranch;
+  }
+  try {
+    return execFileSync("git", ["branch", "--show-current"], { encoding: "utf8" }).trim();
+  } catch {
+    return "";
+  }
+}
+
+/**
+ * @param {Readonly<Record<string, string | undefined>>} [env]
+ * @param {string} [branchName]
+ * @returns {string}
+ */
+export function resolveAllowedGeneratedMixBranch(
+  env = process.env,
+  branchName = resolveChangedBranchName(),
+) {
+  if (env.GITHUB_ACTIONS === "true" && env.OPENCLAW_ALLOW_RELEASE_GENERATED_MIX !== "true") {
+    return "";
+  }
+  if (RELEASE_BRANCH_RE.test(branchName)) {
+    return branchName;
+  }
+  if (
+    env.GITHUB_ACTIONS === "true" &&
+    env.GITHUB_EVENT_NAME === "push" &&
+    env.GITHUB_REF === "refs/heads/main" &&
+    branchName === "main"
+  ) {
+    return branchName;
+  }
+  return "";
+}
+
+/**
+ * @param {string[] | null | undefined} changedPaths
+ * @returns {boolean}
+ */
+export function shouldRunNativeI18n(changedPaths) {
+  return (
+    !Array.isArray(changedPaths) ||
+    changedPaths.length === 0 ||
+    changedPaths.some((path) => NATIVE_I18N_SCOPE_RE.test(path))
+  );
+}
+
+/**
+ * Detects whether node-fast CI can cover the changed paths.
+ * @param {string[]} changedPaths
+ * @returns {NodeFastScope}
+ */
+export function detectNodeFastScope(changedPaths) {
+  if (!Array.isArray(changedPaths) || changedPaths.length === 0) {
+    return { runFastOnly: false, runPluginContracts: false, runCiRouting: false };
+  }
+
+  let hasNonDocs = false;
+  let runPluginContracts = false;
+  let runCiRouting = false;
+
+  for (const rawPath of changedPaths) {
+    const facts = getChangedPathFacts(rawPath);
+    const { path } = facts;
+    if (!path || facts.surface === "docs") {
+      continue;
+    }
+
+    hasNonDocs = true;
+    runPluginContracts ||= NODE_FAST_PLUGIN_CONTRACT_SCOPE_RE.test(path);
+    runCiRouting ||= NODE_FAST_CI_ROUTING_SCOPE_RE.test(path);
+
+    if (!NODE_FAST_SCOPE_RE.test(path)) {
+      return { runFastOnly: false, runPluginContracts: false, runCiRouting: false };
+    }
+  }
+
+  const runFastOnly = hasNonDocs && (runPluginContracts || runCiRouting);
+  return {
+    runFastOnly,
+    runPluginContracts: runFastOnly && runPluginContracts,
+    runCiRouting: runFastOnly && runCiRouting,
+  };
+}
+
+/**
+ * @param {string} path
+ * @returns {InstallSmokeScope}
+ */
+function detectInstallSmokeScopeForPath(path) {
+  const facts = getChangedPathFacts(path);
+  const runFullInstallSmoke = FULL_INSTALL_SMOKE_SCOPE_RE.test(path);
+  const runFastInstallSmoke =
+    runFullInstallSmoke ||
+    FAST_INSTALL_SMOKE_SCOPE_RE.test(path) ||
+    (FAST_INSTALL_SMOKE_RUNTIME_SCOPE_RE.test(path) && !facts.isTestOnly);
+  return { runFastInstallSmoke, runFullInstallSmoke };
+}
+
+/**
+ * Detects whether install-smoke CI should run for changed paths.
+ * @param {string[]} changedPaths
+ * @returns {InstallSmokeScope}
+ */
+export function detectInstallSmokeScope(changedPaths) {
+  if (!Array.isArray(changedPaths) || changedPaths.length === 0) {
+    return { runFastInstallSmoke: true, runFullInstallSmoke: true };
+  }
+
+  let runFastInstallSmoke = false;
+  let runFullInstallSmoke = false;
+  for (const rawPath of changedPaths) {
+    const facts = getChangedPathFacts(rawPath);
+    const { path } = facts;
+    if (!path || facts.surface === "docs") {
+      continue;
+    }
+    const pathScope = detectInstallSmokeScopeForPath(path);
+    runFastInstallSmoke ||= pathScope.runFastInstallSmoke;
+    runFullInstallSmoke ||= pathScope.runFullInstallSmoke;
+  }
+  return { runFastInstallSmoke, runFullInstallSmoke };
+}
+
+/**
+ * Lists changed paths for CI base/head inputs.
+ * @param {string} base
+ * @param {string} [head]
+ * @param {string} [cwd]
+ * @param {boolean} [preferMergeHeadFirstParent]
+ * @returns {string[]}
+ */
+export function listChangedPaths(
+  base,
+  head = "HEAD",
+  cwd = process.cwd(),
+  preferMergeHeadFirstParent = false,
+) {
+  if (!base) {
+    return [];
+  }
+  const diffBase = resolveMergeHeadDiffBase({
+    base,
+    head,
+    cwd,
+    preferFirstParent: preferMergeHeadFirstParent,
+  });
+  const output = execFileSync(
+    "git",
+    ["diff", "--no-renames", "--name-only", "-z", diffBase, head],
+    {
+      cwd,
+      stdio: ["ignore", "pipe", "pipe"],
+      encoding: "utf8",
+    },
+  );
+  return output.split("\0").filter(Boolean);
+}
+
+/**
+ * Writes CI scope decisions to GitHub Actions output.
+ * @param {ChangedScope} scope
+ * @param {string} [outputPath]
+ * @param {InstallSmokeScope} [installSmokeScope]
+ * @param {NodeFastScope} [nodeFastScope]
+ * @param {boolean} [runNativeI18n]
+ * @param {string[] | null} [changedPaths]
+ * @returns {void}
+ */
+export function writeGitHubOutput(
+  scope,
+  outputPath = process.env.GITHUB_OUTPUT,
+  installSmokeScope = {
+    runFastInstallSmoke: scope.runChangedSmoke,
+    runFullInstallSmoke: scope.runChangedSmoke,
+  },
+  nodeFastScope = { runFastOnly: false, runPluginContracts: false, runCiRouting: false },
+  runNativeI18n = true,
+  changedPaths = null,
+) {
+  if (!outputPath) {
+    throw new Error("GITHUB_OUTPUT is required");
+  }
+  appendFileSync(outputPath, `run_node=${scope.runNode}\n`, "utf8");
+  appendFileSync(outputPath, `run_macos=${scope.runMacos}\n`, "utf8");
+  appendFileSync(outputPath, `run_macos_node=${scope.runMacosNode}\n`, "utf8");
+  appendFileSync(outputPath, `run_ios_build=${scope.runIosBuild}\n`, "utf8");
+  appendFileSync(
+    outputPath,
+    `run_ios_screenshots=${shouldRunIosScreenshots(changedPaths)}\n`,
+    "utf8",
+  );
+  appendFileSync(outputPath, `run_android=${scope.runAndroid}\n`, "utf8");
+  appendFileSync(outputPath, `run_windows=${scope.runWindows}\n`, "utf8");
+  appendFileSync(outputPath, `run_skills_python=${scope.runSkillsPython}\n`, "utf8");
+  appendFileSync(outputPath, `run_changed_smoke=${scope.runChangedSmoke}\n`, "utf8");
+  appendFileSync(outputPath, `run_node_fast_only=${nodeFastScope.runFastOnly}\n`, "utf8");
+  appendFileSync(
+    outputPath,
+    `run_node_fast_plugin_contracts=${nodeFastScope.runPluginContracts}\n`,
+    "utf8",
+  );
+  appendFileSync(outputPath, `run_node_fast_ci_routing=${nodeFastScope.runCiRouting}\n`, "utf8");
+  appendFileSync(
+    outputPath,
+    `run_fast_install_smoke=${installSmokeScope.runFastInstallSmoke}\n`,
+    "utf8",
+  );
+  appendFileSync(
+    outputPath,
+    `run_full_install_smoke=${installSmokeScope.runFullInstallSmoke}\n`,
+    "utf8",
+  );
+  appendFileSync(outputPath, `run_control_ui_i18n=${scope.runControlUiI18n}\n`, "utf8");
+  appendFileSync(
+    outputPath,
+    `strict_control_ui_i18n=${shouldStrictControlUiI18n(changedPaths)}\n`,
+    "utf8",
+  );
+  appendFileSync(outputPath, `run_ui_tests=${scope.runUiTests}\n`, "utf8");
+  appendFileSync(outputPath, `run_native_i18n=${runNativeI18n}\n`, "utf8");
+  appendFileSync(
+    outputPath,
+    `strict_native_i18n=${shouldStrictNativeI18n(changedPaths)}\n`,
+    "utf8",
+  );
+  const changedPathsJson = JSON.stringify(changedPaths);
+  appendFileSync(
+    outputPath,
+    `changed_paths_json=${Buffer.byteLength(changedPathsJson, "utf8") <= CHANGED_PATHS_OUTPUT_MAX_BYTES ? changedPathsJson : "null"}\n`,
+    "utf8",
+  );
+}
+
+/** @returns {boolean} */
+function isDirectRun() {
+  return isDirectRunUrl(process.argv[1], import.meta.url);
+}
+
+/**
+ * @param {string[]} argv
+ * @returns {{ base: string; head: string; mergeHeadFirstParent: boolean }}
+ */
+export function parseArgs(argv) {
+  const args = { base: "", head: "HEAD", mergeHeadFirstParent: false };
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--base" || arg === "--head") {
+      args[arg === "--base" ? "base" : "head"] = requireOptionArgument(argv, i, arg);
+      i += 1;
+      continue;
+    }
+    if (arg === "--merge-head-first-parent") {
+      args.mergeHeadFirstParent = true;
+      continue;
+    }
+    throw new Error(`Unknown argument: ${arg}`);
+  }
+  if (!args.base) {
+    throw new Error("--base is required");
+  }
+  return args;
+}
+
+if (isDirectRun()) {
+  try {
+    const args = parseArgs(process.argv.slice(2));
+    const changedPaths = listChangedPaths(
+      args.base,
+      args.head,
+      process.cwd(),
+      args.mergeHeadFirstParent,
+    );
+    if (changedPaths.length === 0) {
+      writeGitHubOutput(EMPTY_SCOPE, process.env.GITHUB_OUTPUT, undefined, undefined, false, []);
+      process.exit(0);
+    }
+    const allowedGeneratedMixBranch = resolveAllowedGeneratedMixBranch();
+    assertControlUiGeneratedArtifactsIsolated(changedPaths, allowedGeneratedMixBranch);
+    assertNativeGeneratedArtifactsIsolated(changedPaths, allowedGeneratedMixBranch);
+    writeGitHubOutput(
+      detectChangedScope(changedPaths),
+      process.env.GITHUB_OUTPUT,
+      detectInstallSmokeScope(changedPaths),
+      detectNodeFastScope(changedPaths),
+      shouldRunNativeI18n(changedPaths),
+      changedPaths,
+    );
+  } catch (error) {
+    if (
+      error instanceof ControlUiGeneratedArtifactsMixedError ||
+      error instanceof NativeGeneratedArtifactsMixedError
+    ) {
+      console.error(error.message);
+      process.exitCode = 1;
+    } else {
+      writeGitHubOutput(FULL_SCOPE, process.env.GITHUB_OUTPUT, undefined, undefined, true, null);
+    }
+  }
+}
diff --git a/scripts/ci-docker-pull-retry.sh b/scripts/ci-docker-pull-retry.sh
new file mode 100644
index 0000000000000000000000000000000000000000..5038a1798556fee5c19d967849568323d5578da2
--- /dev/null
+++ b/scripts/ci-docker-pull-retry.sh
@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="${BASH_SOURCE[0]%/*}"
+# shellcheck source=scripts/lib/host-timeout.sh
+source "$SCRIPT_DIR/lib/host-timeout.sh"
+
+if [[ "$#" -ne 1 || -z "${1// }" ]]; then
+  echo "usage: $0 <image>" >&2
+  exit 2
+fi
+
+image="$1"
+attempts="${OPENCLAW_DOCKER_PULL_ATTEMPTS:-3}"
+timeout_seconds="${OPENCLAW_DOCKER_PULL_TIMEOUT_SECONDS:-180}"
+retry_delay_seconds="${OPENCLAW_DOCKER_PULL_RETRY_DELAY_SECONDS:-5}"
+
+if ! [[ "$attempts" =~ ^[1-9][0-9]*$ ]]; then
+  echo "OPENCLAW_DOCKER_PULL_ATTEMPTS must be a positive integer, got: $attempts" >&2
+  exit 2
+fi
+
+if ! [[ "$timeout_seconds" =~ ^[1-9][0-9]*$ ]]; then
+  echo "OPENCLAW_DOCKER_PULL_TIMEOUT_SECONDS must be a positive integer, got: $timeout_seconds" >&2
+  exit 2
+fi
+
+if ! [[ "$retry_delay_seconds" =~ ^[0-9]+$ ]]; then
+  echo "OPENCLAW_DOCKER_PULL_RETRY_DELAY_SECONDS must be a non-negative integer, got: $retry_delay_seconds" >&2
+  exit 2
+fi
+
+last_status=1
+run_docker_pull() {
+  local timeout_bin
+  if ! timeout_bin="$(openclaw_host_timeout_bin)"; then
+    echo "timeout or gtimeout command not found; cannot bound Docker pull after ${timeout_seconds}s" >&2
+    return 127
+  fi
+  if "$timeout_bin" --kill-after=1s 1s true >/dev/null 2>&1; then
+    "$timeout_bin" --kill-after=30s "${timeout_seconds}s" docker pull "$image"
+  else
+    "$timeout_bin" "${timeout_seconds}s" docker pull "$image"
+  fi
+}
+
+for ((attempt = 1; attempt <= attempts; attempt++)); do
+  echo "==> Pull Docker image attempt ${attempt}/${attempts}: ${image}"
+  if run_docker_pull; then
+    exit 0
+  else
+    last_status="$?"
+  fi
+  echo "Docker pull failed or timed out after ${timeout_seconds}s: status=${last_status}" >&2
+  if [[ "$attempt" -lt "$attempts" && "$retry_delay_seconds" -gt 0 ]]; then
+    sleep "$retry_delay_seconds"
+  fi
+done
+
+exit "$last_status"
diff --git a/scripts/ci-hydrate-live-auth.sh b/scripts/ci-hydrate-live-auth.sh
new file mode 100644
index 0000000000000000000000000000000000000000..d80ad159305f51c82436ce20821d3b0cbeeea7f1
--- /dev/null
+++ b/scripts/ci-hydrate-live-auth.sh
@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+# Bash 5.3+ can deadlock writing heredoc pipes on macOS before the reader starts.
+if [[ ${OSTYPE:-} == darwin* && $BASH != /bin/bash ]] && ((BASH_VERSINFO[0] > 5 || (BASH_VERSINFO[0] == 5 && BASH_VERSINFO[1] >= 3))); then
+  exec /bin/bash "$0" "$@"
+fi
+set -euo pipefail
+
+profile_path="${1:-${RUNNER_TEMP:-/tmp}/openclaw-live.profile}"
+
+mkdir -p "$(dirname "$profile_path")"
+: >"$profile_path"
+chmod 600 "$profile_path"
+
+append_profile_env() {
+  local key="$1"
+  local value="${!key:-}"
+  if [[ -z "$value" || "$value" == "undefined" || "$value" == "null" ]]; then
+    return
+  fi
+  printf 'export %s=%q\n' "$key" "$value" >>"$profile_path"
+}
+
+write_secret_file() {
+  local destination="$1"
+  local source_env="$2"
+  local value="${!source_env:-}"
+  if [[ -z "$value" ]]; then
+    return
+  fi
+  mkdir -p "$(dirname "$destination")"
+  printf '%s' "$value" >"$destination"
+  chmod 600 "$destination"
+}
+
+activate_claude_oauth_access_token() {
+  local credentials="${OPENCLAW_CLAUDE_CREDENTIALS_JSON:-}"
+  if [[ -z "$credentials" ]]; then
+    return
+  fi
+
+  local access_token expires_at now_ms
+  local min_remaining_ms="$(( 90 * 60 * 1000 ))"
+  access_token="$(jq -r '.claudeAiOauth.accessToken // empty' <<<"$credentials" 2>/dev/null || true)"
+  expires_at="$(jq -r '.claudeAiOauth.expiresAt // 0' <<<"$credentials" 2>/dev/null || true)"
+  now_ms="$(( $(date +%s) * 1000 ))"
+
+  if [[ "$access_token" != sk-ant-oat* ]]; then
+    echo "::warning::Claude credentials JSON has no usable OAuth access token; keeping the configured Anthropic fallback." >&2
+    return
+  fi
+  # Stable live shards can run for an hour, so never shadow the fallback with
+  # a token that could expire before setup, retries, and cleanup complete.
+  if ! [[ "$expires_at" =~ ^[0-9]+$ ]] || (( expires_at <= now_ms + min_remaining_ms )); then
+    echo "::warning::Claude credentials JSON OAuth access token lacks 90 minutes of remaining life; keeping the configured Anthropic fallback." >&2
+    return
+  fi
+
+  echo "::add-mask::$access_token"
+  export ANTHROPIC_OAUTH_TOKEN="$access_token"
+  if [[ -n "${GITHUB_ENV:-}" ]]; then
+    printf 'ANTHROPIC_OAUTH_TOKEN=%s\n' "$access_token" >>"$GITHUB_ENV"
+  fi
+}
+
+activate_claude_oauth_access_token
+
+for env_key in \
+  OPENAI_API_KEY \
+  OPENAI_BASE_URL \
+  ANTHROPIC_OAUTH_TOKEN \
+  ANTHROPIC_API_KEY \
+  ANTHROPIC_API_KEY_OLD \
+  ANTHROPIC_API_TOKEN \
+  BYTEPLUS_API_KEY \
+  CEREBRAS_API_KEY \
+  DEEPINFRA_API_KEY \
+  DEEPSEEK_API_KEY \
+  DASHSCOPE_API_KEY \
+  GROQ_API_KEY \
+  KIMI_API_KEY \
+  MODELSTUDIO_API_KEY \
+  MOONSHOT_API_KEY \
+  MISTRAL_API_KEY \
+  MINIMAX_API_KEY \
+  OPENCODE_API_KEY \
+  OPENCODE_ZEN_API_KEY \
+  OPENCLAW_LIVE_BROWSER_CDP_URL \
+  OPENCLAW_LIVE_SETUP_TOKEN \
+  OPENCLAW_LIVE_SETUP_TOKEN_MODEL \
+  OPENCLAW_LIVE_SETUP_TOKEN_PROFILE \
+  OPENCLAW_LIVE_SETUP_TOKEN_VALUE \
+  FACTORY_API_KEY \
+  GEMINI_API_KEY \
+  GOOGLE_API_KEY \
+  OPENROUTER_API_KEY \
+  QWEN_API_KEY \
+  FAL_KEY \
+  RUNWAY_API_KEY \
+  DEEPGRAM_API_KEY \
+  TOGETHER_API_KEY \
+  VYDRA_API_KEY \
+  XAI_API_KEY \
+  ZAI_API_KEY \
+  Z_AI_API_KEY \
+  BYTEPLUS_ACCESS_KEY_ID \
+  BYTEPLUS_SECRET_ACCESS_KEY \
+  CLAUDE_CODE_OAUTH_TOKEN \
+  FIREWORKS_API_KEY
+do
+  append_profile_env "$env_key"
+done
+
+write_secret_file "$HOME/.codex/auth.json" OPENCLAW_CODEX_AUTH_JSON
+write_secret_file "$HOME/.codex/config.toml" OPENCLAW_CODEX_CONFIG_TOML
+write_secret_file "$HOME/.claude.json" OPENCLAW_CLAUDE_JSON
+write_secret_file "$HOME/.claude/.credentials.json" OPENCLAW_CLAUDE_CREDENTIALS_JSON
+write_secret_file "$HOME/.claude/settings.json" OPENCLAW_CLAUDE_SETTINGS_JSON
+write_secret_file "$HOME/.claude/settings.local.json" OPENCLAW_CLAUDE_SETTINGS_LOCAL_JSON
+write_secret_file "$HOME/.gemini/settings.json" OPENCLAW_GEMINI_SETTINGS_JSON
+
+if [[ -n "${GITHUB_ENV:-}" ]]; then
+  {
+    echo "OPENCLAW_PROFILE_FILE=$profile_path"
+  } >>"$GITHUB_ENV"
+fi
diff --git a/scripts/ci-hydrate-testbox-env.sh b/scripts/ci-hydrate-testbox-env.sh
new file mode 100644
index 0000000000000000000000000000000000000000..458081ae73c4450cebefe406c6880d654f5b9513
--- /dev/null
+++ b/scripts/ci-hydrate-testbox-env.sh
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Bash 5.3+ can deadlock writing heredoc pipes on macOS before the reader starts.
+if [[ ${OSTYPE:-} == darwin* && $BASH != /bin/bash ]] && ((BASH_VERSINFO[0] > 5 || (BASH_VERSINFO[0] == 5 && BASH_VERSINFO[1] >= 3))); then
+  exec /bin/bash "$0" "$@"
+fi
+set -euo pipefail
+
+profile_path="${1:-$HOME/.openclaw-testbox-live.profile}"
+helper_path="${2:-$HOME/.local/bin/openclaw-testbox-env}"
+quoted_profile_path="$(printf "%q" "$profile_path")"
+
+mkdir -p "$(dirname "$helper_path")"
+
+bash scripts/ci-hydrate-live-auth.sh "$profile_path"
+
+cat >"$helper_path" <<SH
+#!/usr/bin/env bash
+set -euo pipefail
+
+default_profile_path=$quoted_profile_path
+profile_path="\${OPENCLAW_TESTBOX_PROFILE_FILE:-\$default_profile_path}"
+if [[ ! -f "\$profile_path" ]]; then
+  echo "Missing Testbox provider env profile: \$profile_path" >&2
+  exit 1
+fi
+
+set -a
+# shellcheck disable=SC1090
+source "\$profile_path"
+set +a
+
+if [[ "\$#" -eq 0 ]]; then
+  exec "\${SHELL:-/bin/bash}"
+fi
+
+exec "\$@"
+SH
+chmod 700 "$helper_path"
diff --git a/scripts/ci-live-command-retry.sh b/scripts/ci-live-command-retry.sh
new file mode 100644
index 0000000000000000000000000000000000000000..2c4edb039de0ce0bd026b8320feb723771bffaac
--- /dev/null
+++ b/scripts/ci-live-command-retry.sh
@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+command="${OPENCLAW_LIVE_COMMAND:-}"
+if [[ -z "$command" && "$#" -gt 0 ]]; then
+  command="$*"
+fi
+
+if [[ -z "$command" ]]; then
+  echo "Usage: OPENCLAW_LIVE_COMMAND='<command>' $0" >&2
+  exit 64
+fi
+
+attempts="${OPENCLAW_LIVE_COMMAND_ATTEMPTS:-2}"
+delay_seconds="${OPENCLAW_LIVE_COMMAND_RETRY_DELAY_SECONDS:-10}"
+rate_limit_delay_seconds="${OPENCLAW_LIVE_COMMAND_RATE_LIMIT_RETRY_DELAY_SECONDS:-60}"
+# Live provider 5xx responses and one-off test timeouts get one retry; deterministic
+# hangs still fail the second attempt. Keep auth and input failures fail-fast.
+retry_pattern="${OPENCLAW_LIVE_COMMAND_RETRY_PATTERN:-ECONNRESET|ETIMEDOUT|ENOTFOUND|EAI_AGAIN|fetch failed|TLS connection|socket hang up|UND_ERR|gateway request timeout|HTTP 5[0-9][0-9]|Test timed out in [0-9]+ms|terminal timeout after [0-9]+ms|MiniMax image generation API error \\(1000\\)|model idle timeout|did not produce a response before the model idle timeout|\\b429\\b|\\b529\\b}"
+rate_limit_pattern="${OPENCLAW_LIVE_COMMAND_RATE_LIMIT_PATTERN:-Rate limit reached|rate.?limit|tokens per min|requests per min|\\bTPM\\b|\\bRPM\\b}"
+
+if ! [[ "$attempts" =~ ^[1-9][0-9]*$ ]]; then
+  echo "OPENCLAW_LIVE_COMMAND_ATTEMPTS must be a positive integer, got: $attempts" >&2
+  exit 64
+fi
+
+if ! [[ "$delay_seconds" =~ ^[0-9]+$ ]]; then
+  echo "OPENCLAW_LIVE_COMMAND_RETRY_DELAY_SECONDS must be a non-negative integer, got: $delay_seconds" >&2
+  exit 64
+fi
+
+if ! [[ "$rate_limit_delay_seconds" =~ ^[0-9]+$ ]]; then
+  echo "OPENCLAW_LIVE_COMMAND_RATE_LIMIT_RETRY_DELAY_SECONDS must be a non-negative integer, got: $rate_limit_delay_seconds" >&2
+  exit 64
+fi
+
+log_file="$(mktemp)"
+cleanup() {
+  rm -f "$log_file"
+}
+trap cleanup EXIT
+
+for attempt in $(seq 1 "$attempts"); do
+  : >"$log_file"
+  set +e
+  bash -o pipefail -c "$command" 2>&1 | tee "$log_file"
+  status="${PIPESTATUS[0]}"
+  set -e
+
+  if [[ "$status" -eq 0 ]]; then
+    exit 0
+  fi
+
+  if [[ "$attempt" -ge "$attempts" ]]; then
+    exit "$status"
+  fi
+
+  # Keep raw tee output; classify without ANSI formatting or complete successful Vitest rows.
+  classification="$(
+    LC_ALL=C sed -E \
+      -e $'s/\033\\[[0-?]*[ -/]*[@-~]//g' \
+      -e $'/^[[:space:]]+\342\234\223[[:space:]]+.+[[:space:]]+([0-9]+ms([[:space:]]+\\((retry|repeat) x[0-9]+\\))*([[:space:]]+[0-9]+ MB heap used)?|\\([0-9]+\\))[[:space:]]*$/d' \
+      "$log_file"
+  )"
+  is_rate_limited=0
+  if printf '%s\n' "$classification" | grep -Ei "$rate_limit_pattern" >/dev/null; then
+    is_rate_limited=1
+  elif ! printf '%s\n' "$classification" | grep -Ei "$retry_pattern" >/dev/null; then
+    exit "$status"
+  fi
+
+  echo "Live command failed with a retryable provider/network error; retrying ($attempt/$attempts)..." >&2
+  next_delay_seconds="$delay_seconds"
+  if [[ "$is_rate_limited" -eq 1 ]]; then
+    next_delay_seconds="$rate_limit_delay_seconds"
+    echo "Provider rate limit detected; waiting ${next_delay_seconds}s before retry." >&2
+  fi
+  if [[ "$next_delay_seconds" -gt 0 ]]; then
+    sleep "$next_delay_seconds"
+  fi
+done
diff --git a/scripts/ci-run-node-test-shard.mts b/scripts/ci-run-node-test-shard.mts
new file mode 100644
index 0000000000000000000000000000000000000000..adcfbcbb2534f2feecbf0dd5e7723ef4f7ea6d8f
--- /dev/null
+++ b/scripts/ci-run-node-test-shard.mts
@@ -0,0 +1,588 @@
+// Runs one CI node test shard job: either explicit changed-test targets or a
+// list of packed group plans. Extracted from .github/workflows/ci.yml so the
+// execution policy is unit-testable and plans can run concurrently.
+import { spawn, type ChildProcess } from "node:child_process";
+import {
+  constants,
+  cpSync,
+  existsSync,
+  mkdtempSync,
+  readdirSync,
+  rmSync,
+  statSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
+import os, { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { Readable } from "node:stream";
+import { StringDecoder } from "node:string_decoder";
+import { fileURLToPath } from "node:url";
+import { isRecord } from "@openclaw/normalization-core/record-coerce";
+import { decodeNodeTestGroups } from "./lib/ci-node-test-groups-codec.mts";
+import { isDirectRunUrl } from "./lib/direct-run.mjs";
+import { isConstrainedCiCheckHost } from "./lib/local-check-runtime.mts";
+import { parsePositiveInt, readPositiveEnvInt } from "./lib/numeric-options.mjs";
+import type { VitestWorkerRun } from "./lib/vitest-worker-run.mts";
+
+// CI admits at most two plans only when the actual host has room. Each plan
+// keeps inner test-projects parallelism 1; runner labels cannot establish capacity.
+const PLAN_CONCURRENCY = 2;
+const FS_MODULE_CACHE_PATH_ENV_KEY = "OPENCLAW_VITEST_FS_MODULE_CACHE_PATH";
+const FS_MODULE_CACHE_WRITER_ENV_KEY = "OPENCLAW_VITEST_FS_MODULE_CACHE_WRITER";
+const NODE_COMPILE_CACHE_PATH_ENV_KEY = "NODE_COMPILE_CACHE";
+const NODE_COMPILE_CACHE_WRITER_ENV_KEY = "OPENCLAW_NODE_COMPILE_CACHE_WRITER";
+const VITEST_EXTRA_ARGS_ENV_KEY = "OPENCLAW_NODE_TEST_VITEST_ARGS_JSON";
+const FS_MODULE_CACHE_MAX_BYTES = 2 * 1024 * 1024 * 1024;
+const NODE_COMPILE_CACHE_MAX_BYTES = 1024 * 1024 * 1024;
+const FS_MODULE_CACHE_PRUNE_TARGET_RATIO = 0.75;
+const FS_MODULE_CACHE_METADATA_FILE = "_metadata.json";
+const FS_MODULE_CACHE_GENERATION_FILE = ".openclaw-transform-generation";
+
+export type ShardTargetPlan = { kind: "target"; name: string; target: string };
+type ShardGroupConfig = {
+  configs: string[];
+  env?: Record<string, unknown> | null;
+  includePatterns?: string[] | null;
+  shard_name?: string;
+  timing_key?: string;
+};
+export type ShardGroupPlan = {
+  kind: "group";
+  name: string;
+  plan: ShardGroupConfig;
+  timingKey?: string;
+};
+export type ShardPlan = ShardTargetPlan | ShardGroupPlan;
+type RunShardOptions = {
+  concurrency?: number;
+  continueOnFailure?: boolean;
+  env?: NodeJS.ProcessEnv;
+  fsModuleCacheMaxBytes?: number;
+  nodeCompileCacheMaxBytes?: number;
+  runChild?: typeof runChild;
+  scratchDir?: string;
+};
+
+function isStringArray(value: unknown): value is string[] {
+  return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+}
+
+function isShardGroupConfig(value: unknown): value is ShardGroupConfig {
+  return isRecord(value) && isStringArray(value.configs);
+}
+
+function parseJsonEnv(
+  env: Record<string, unknown>,
+  name: string,
+  fallback: unknown = null,
+): unknown {
+  try {
+    const value = env[name];
+    return typeof value === "string" ? (JSON.parse(value) ?? fallback) : fallback;
+  } catch {
+    return fallback;
+  }
+}
+
+export function resolveShardPlans(env: NodeJS.ProcessEnv = process.env): ShardPlan[] {
+  const targets = parseJsonEnv(env, "OPENCLAW_NODE_TEST_TARGETS_JSON");
+  if (isStringArray(targets) && targets.length > 0) {
+    // One target per child process preserves the isolation boundaries encoded
+    // by full-suite include-pattern shards while keeping one runner job.
+    return targets.map((target) => ({ kind: "target", name: target, target }));
+  }
+
+  // The CI manifest packs matrix groups so preflight's job outputs stay under
+  // GitHub's 1 MiB UTF-16 cap. Plain JSON remains for the Vitest cache warmer,
+  // which writes its small group list straight into GITHUB_ENV.
+  const packedGroups = env.OPENCLAW_NODE_TEST_GROUPS_GZIP_BASE64?.trim();
+  const groups = packedGroups
+    ? decodeNodeTestGroups(packedGroups)
+    : parseJsonEnv(env, "OPENCLAW_NODE_TEST_GROUPS_JSON");
+  const groupPlans = Array.isArray(groups) ? groups.filter(isShardGroupConfig) : [];
+  const configs = parseJsonEnv(env, "OPENCLAW_NODE_TEST_CONFIGS_JSON", []);
+  const groupEnv = parseJsonEnv(env, "OPENCLAW_NODE_TEST_ENV_JSON");
+  const includePatterns = parseJsonEnv(env, "OPENCLAW_NODE_TEST_INCLUDE_PATTERNS_JSON");
+  const plans: ShardGroupConfig[] =
+    groupPlans.length > 0
+      ? groupPlans
+      : [
+          {
+            configs: isStringArray(configs) ? configs : [],
+            env: isRecord(groupEnv) ? groupEnv : null,
+            includePatterns: isStringArray(includePatterns) ? includePatterns : null,
+            shard_name: env.OPENCLAW_VITEST_SHARD_NAME,
+          },
+        ];
+  return plans.map((plan) => {
+    const name = plan.shard_name ?? plan.configs?.[0] ?? "group";
+    return { kind: "group", name, plan, timingKey: plan.timing_key ?? name };
+  });
+}
+
+function prepareChildEnv(entry: ShardPlan, baseEnv: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
+  const childEnv: NodeJS.ProcessEnv = { ...baseEnv, OPENCLAW_TEST_PROJECTS_PARALLEL: "1" };
+  if (entry.kind === "group") {
+    if (entry.plan.shard_name) {
+      childEnv.OPENCLAW_VITEST_SHARD_NAME = entry.plan.shard_name;
+    }
+    for (const [key, value] of Object.entries(entry.plan.env ?? {})) {
+      if (typeof value === "string") {
+        const inherited = baseEnv[key]?.trim();
+        // Pins may lower the admitted job budget, never raise it. Compiler
+        // preparation and test children must inherit the same intersection.
+        childEnv[key] =
+          key === "OPENCLAW_VITEST_MAX_WORKERS" && inherited
+            ? String(
+                Math.min(
+                  parsePositiveInt(inherited, key),
+                  parsePositiveInt(value.trim() || inherited, key),
+                ),
+              )
+            : value;
+      }
+    }
+  }
+  return childEnv;
+}
+
+export function buildChildEnv(
+  entry: ShardPlan,
+  baseEnv: NodeJS.ProcessEnv,
+  scratchDir: string,
+  index: number,
+  options: { serial?: boolean; cacheSlot?: number } = {},
+) {
+  const persistentCacheRoot = baseEnv[FS_MODULE_CACHE_PATH_ENV_KEY]?.trim();
+  const cacheDirectory = persistentCacheRoot
+    ? `vitest-cache-${options.cacheSlot ?? index}`
+    : options.serial
+      ? "vitest-cache-shared"
+      : `vitest-cache-${index}`;
+  // Persistent worker slots let serial plans reuse transforms without concurrent
+  // writers. Scratch caches stay per-plan; group overrides still apply last.
+  const childEnv = prepareChildEnv(entry, {
+    ...baseEnv,
+    [FS_MODULE_CACHE_PATH_ENV_KEY]: join(persistentCacheRoot || scratchDir, cacheDirectory),
+  });
+  if (entry.kind === "group") {
+    const plan = entry.plan;
+    if (Array.isArray(plan.includePatterns) && plan.includePatterns.length > 0) {
+      const includeFile = join(scratchDir, `node-test-include-${index}.json`);
+      writeFileSync(includeFile, JSON.stringify(plan.includePatterns), "utf8");
+      childEnv.OPENCLAW_VITEST_INCLUDE_FILE = includeFile;
+    } else {
+      delete childEnv.OPENCLAW_VITEST_INCLUDE_FILE;
+    }
+  }
+  return childEnv;
+}
+
+export function pruneFsModuleCache(root: string, maxBytes = FS_MODULE_CACHE_MAX_BYTES) {
+  if (!root || !existsSync(root) || !Number.isFinite(maxBytes) || maxBytes < 0) {
+    return { beforeBytes: 0, afterBytes: 0, removedFiles: 0 };
+  }
+
+  const files: Array<{ filePath: string; mtimeMs: number; size: number }> = [];
+  let totalBytes = 0;
+  const visit = (directory: string) => {
+    for (const entry of readdirSync(directory, { withFileTypes: true })) {
+      const filePath = join(directory, entry.name);
+      if (entry.isDirectory()) {
+        visit(filePath);
+        continue;
+      }
+      if (!entry.isFile()) {
+        continue;
+      }
+      const fileStat = statSync(filePath);
+      totalBytes += fileStat.size;
+      if (
+        entry.name !== FS_MODULE_CACHE_METADATA_FILE &&
+        entry.name !== FS_MODULE_CACHE_GENERATION_FILE
+      ) {
+        files.push({ filePath, mtimeMs: fileStat.mtimeMs, size: fileStat.size });
+      }
+    }
+  };
+  visit(root);
+
+  const beforeBytes = totalBytes;
+  if (totalBytes <= maxBytes) {
+    return { beforeBytes, afterBytes: totalBytes, removedFiles: 0 };
+  }
+
+  const targetBytes = Math.floor(maxBytes * FS_MODULE_CACHE_PRUNE_TARGET_RATIO);
+  files.sort((left, right) => left.mtimeMs - right.mtimeMs);
+  let removedFiles = 0;
+  for (const file of files) {
+    if (totalBytes <= targetBytes) {
+      break;
+    }
+    unlinkSync(file.filePath);
+    totalBytes -= file.size;
+    removedFiles += 1;
+  }
+  return { beforeBytes, afterBytes: totalBytes, removedFiles };
+}
+
+export function clonePersistentCacheSlots(root: string | undefined, concurrency: number) {
+  if (!root || concurrency <= 1) {
+    return 0;
+  }
+  const seed = join(root, "vitest-cache-0");
+  if (!existsSync(seed)) {
+    return 0;
+  }
+
+  let clonedSlots = 0;
+  for (let cacheSlot = 1; cacheSlot < concurrency; cacheSlot += 1) {
+    const destination = join(root, `vitest-cache-${cacheSlot}`);
+    rmSync(destination, { force: true, recursive: true });
+    // Clone before workers start. Reflinks make the common Linux path cheap;
+    // unsupported filesystems transparently fall back to a regular copy.
+    cpSync(seed, destination, {
+      mode: constants.COPYFILE_FICLONE,
+      recursive: true,
+    });
+    clonedSlots += 1;
+  }
+  return clonedSlots;
+}
+
+const MAX_PENDING_LINE_CHARS = 1_000_000;
+
+function relayChildStream(stream: Readable, label: string) {
+  const decoder = new StringDecoder("utf8");
+  let pending = "";
+  const writeLine = (line: string) => {
+    if (!process.stdout.write(`[shard:${label}] ${line}\n`)) {
+      stream.pause();
+      process.stdout.once("drain", () => stream.resume());
+    }
+  };
+  stream.on("data", (chunk: Buffer | string) => {
+    pending += decoder.write(chunk);
+    const lines = pending.split("\n");
+    pending = lines.pop() ?? "";
+    for (const line of lines) {
+      writeLine(line);
+    }
+    if (pending.length > MAX_PENDING_LINE_CHARS) {
+      writeLine(pending);
+      pending = "";
+    }
+  });
+  return () => {
+    pending += decoder.end();
+    if (pending !== "") {
+      writeLine(pending);
+      pending = "";
+    }
+  };
+}
+
+const TEST_PROJECTS_ENTRYPOINTS = ["scripts/test-projects.mts", "scripts/test-projects.mjs"];
+
+export function resolveTestProjectsEntrypoint(
+  fileExists: (path: string) => boolean = existsSync,
+): string {
+  const entrypoint = TEST_PROJECTS_ENTRYPOINTS.find((candidate) => fileExists(candidate));
+  if (!entrypoint) {
+    throw new Error("CI target does not provide scripts/test-projects.mts or .mjs");
+  }
+  return entrypoint;
+}
+
+export function resolveShardChildCommand(
+  args: string[],
+  nodeExecPath = process.execPath,
+  testProjectsEntrypoint = resolveTestProjectsEntrypoint(),
+  workerRun?: VitestWorkerRun,
+) {
+  const loaderArgs = testProjectsEntrypoint.endsWith(".mts") ? ["--import", "tsx"] : [];
+  return {
+    command: nodeExecPath,
+    args: [
+      ...loaderArgs,
+      ...(workerRun
+        ? [
+            fileURLToPath(new URL("./lib/vitest-worker-bootstrap.mts", import.meta.url)),
+            workerRun.descriptor.directory,
+          ]
+        : []),
+      testProjectsEntrypoint,
+      ...args,
+    ],
+  };
+}
+
+async function createWorkerContext(env: NodeJS.ProcessEnv, plans: ShardPlan[]) {
+  const ownedRunner = join(process.cwd(), "scripts/ci-run-node-test-shard.mts");
+  // ci.yml's five-file frozen-release adapter must execute the old target,
+  // never load a modern compiler from its workflow-owned .ci-workflow checkout.
+  if (
+    fileURLToPath(import.meta.url) ===
+      join(process.cwd(), ".ci-workflow/scripts/ci-run-node-test-shard.mts") &&
+    !existsSync(ownedRunner)
+  ) {
+    return undefined;
+  }
+  if (fileURLToPath(import.meta.url) !== ownedRunner) {
+    throw new Error("Compiled CI worker ownership requires the target's own shard runner");
+  }
+  const groupOwner = await import("./vitest-process-group.mts");
+  // Windows' portable entry keeps per-group owners: a close-only receipt cannot
+  // authorize deleting a generation shared with another group's descendants.
+  if (!groupOwner.shouldUseDetachedVitestProcessGroup()) {
+    return undefined;
+  }
+  const { resolveSharedVitestCompilerEnv } = await import("./lib/vitest-process-env.mts");
+  const compilerEnv = resolveSharedVitestCompilerEnv(
+    plans.length > 0 ? plans.map((plan) => prepareChildEnv(plan, env)) : [env],
+  );
+  const [worker, processOwner] = await Promise.all([
+    import("./lib/vitest-worker-run.mts"),
+    import("./lib/vitest-process.mts"),
+  ]);
+  return {
+    workerRun: worker.createVitestWorkerRun(compilerEnv),
+    spawn: processOwner.spawnOwnedVitestProcess,
+    exitBySignal: processOwner.exitVitestBySignal,
+    installCleanup: groupOwner.installVitestProcessGroupCleanup,
+  };
+}
+
+async function runChild(
+  args: string[],
+  childEnv: NodeJS.ProcessEnv,
+  label: string,
+  timingKey: string,
+  context?: Awaited<ReturnType<typeof createWorkerContext>>,
+) {
+  // Use Node directly. `pnpm exec node` may reconcile the workspace before
+  // tests, which destroys the sticky dependency fast path.
+  const childCommand = resolveShardChildCommand(
+    args,
+    process.execPath,
+    undefined,
+    context?.workerRun,
+  );
+  let child: ChildProcess;
+  let completion: Promise<number>;
+  let teardown: (() => void) | undefined;
+  if (context) {
+    const owned = context.spawn({
+      command: childCommand.command,
+      args: childCommand.args,
+      options: {
+        env: childEnv,
+        stdio: ["ignore", "pipe", "pipe", "ipc"],
+      },
+      homeMode: "tooling",
+    });
+    child = owned.child;
+    teardown = context.installCleanup({
+      child,
+      forceSignal: "SIGKILL",
+      forceSignalDelayMs: 100,
+    }).teardown;
+    // The containing TMP owner preserves nested claims if a group parent dies.
+    completion = context.workerRun.borrow(
+      child,
+      owned.completion.then((result) => {
+        if (!result.groupJoined) {
+          throw new Error("CI group descendant completion is unverified");
+        }
+        return result.code ?? 1;
+      }),
+    );
+  } else {
+    child = spawn(childCommand.command, childCommand.args, {
+      env: childEnv,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    completion = new Promise<number>((resolve) => {
+      child.once("close", (code) => resolve(code ?? 1));
+      child.once("error", (error) => {
+        process.stdout.write(`[shard:${label}] failed to spawn: ${error}\n`);
+        resolve(1);
+      });
+    });
+  }
+  // Stream with a per-line label instead of buffering: children can run
+  // whole suites for hours and verbose output must not accumulate on the
+  // wrapper heap. Backpressure pauses the child stream while stdout drains,
+  // and an oversized newline-free tail is force-flushed so the pending
+  // partial line stays bounded too.
+  const flushers = [child.stdout!, child.stderr!].map((stream) => relayChildStream(stream, label));
+  process.stdout.write(`[shard:${timingKey}] begin\n`);
+  let code: number;
+  try {
+    code = await completion;
+  } finally {
+    for (const flush of flushers) {
+      flush();
+    }
+    teardown?.();
+  }
+  process.stdout.write(`[shard:${timingKey}] end (exit ${code})\n`);
+  return code;
+}
+
+export async function runShardPlans(plans: ShardPlan[], options: RunShardOptions = {}) {
+  const baseEnv = options.env ?? process.env;
+  // Respect serial timing-sensitive bins and never clone cache slots that
+  // cannot receive a plan.
+  const requestedConcurrency =
+    options.concurrency === undefined
+      ? readPositiveEnvInt("OPENCLAW_NODE_TEST_PLAN_CONCURRENCY", baseEnv, PLAN_CONCURRENCY)
+      : parsePositiveInt(options.concurrency, "Shard plan concurrency");
+  const ci = baseEnv.CI === "true" || baseEnv.GITHUB_ACTIONS === "true";
+  const hostResources = ci
+    ? { logicalCpuCount: os.availableParallelism(), totalMemoryBytes: os.totalmem() }
+    : null;
+  const concurrency = Math.min(
+    plans.length,
+    requestedConcurrency,
+    hostResources
+      ? isConstrainedCiCheckHost(hostResources)
+        ? 1
+        : PLAN_CONCURRENCY
+      : requestedConcurrency,
+  );
+  if (hostResources) {
+    console.log(
+      `[shard:resources] logicalCpuCount=${hostResources.logicalCpuCount} totalMemoryBytes=${hostResources.totalMemoryBytes} requested plans=${requestedConcurrency} admitted plans=${concurrency}`,
+    );
+  }
+  const scratchDir = options.scratchDir ?? mkdtempSync(join(tmpdir(), "openclaw-node-shard-"));
+  const persistentCacheRoot = baseEnv[FS_MODULE_CACHE_PATH_ENV_KEY]?.trim();
+  const nodeCompileCacheRoot = baseEnv[NODE_COMPILE_CACHE_PATH_ENV_KEY]?.trim();
+  const clonedCacheSlots = clonePersistentCacheSlots(persistentCacheRoot, concurrency);
+  if (clonedCacheSlots > 0) {
+    process.stdout.write(
+      `[shard:cache] cloned restored Vitest seed into ${clonedCacheSlots} isolated lane(s)\n`,
+    );
+  }
+
+  const context = await createWorkerContext(baseEnv, plans);
+  let interrupted: NodeJS.Signals | undefined;
+  const onSignal = (signal: NodeJS.Signals) => {
+    interrupted ??= signal;
+  };
+  if (context) {
+    process.on("SIGINT", onSignal);
+    process.on("SIGTERM", onSignal);
+  }
+  try {
+    const runner: typeof runChild =
+      options.runChild ??
+      ((args, childEnv, label, timingKey) => runChild(args, childEnv, label, timingKey, context));
+    let nextIndex = 0;
+    let exitCode = 0;
+    const workers = Array.from({ length: concurrency }, async (_, cacheSlot) => {
+      try {
+        while (nextIndex < plans.length && (exitCode === 0 || options.continueOnFailure)) {
+          if (interrupted) {
+            return;
+          }
+          const index = nextIndex;
+          nextIndex += 1;
+          const entry = plans[index];
+          if (!entry) {
+            return;
+          }
+          const targetArgs = entry.kind === "target" ? [entry.target] : entry.plan.configs;
+          if (!Array.isArray(targetArgs) || targetArgs.length === 0) {
+            console.error(`Missing node test shard configs for ${entry.name}`);
+            exitCode = exitCode || 1;
+            if (!options.continueOnFailure) {
+              return;
+            }
+            continue;
+          }
+          const vitestExtraArgs = [
+            baseEnv,
+            entry.kind === "group" ? entry.plan.env : undefined,
+          ].flatMap((env) => {
+            const value = parseJsonEnv(env ?? {}, VITEST_EXTRA_ARGS_ENV_KEY, []);
+            return isStringArray(value) ? value : [];
+          });
+          const args =
+            vitestExtraArgs.length > 0 ? [...targetArgs, "--", ...vitestExtraArgs] : targetArgs;
+          const childEnv = buildChildEnv(entry, baseEnv, scratchDir, index, {
+            serial: concurrency === 1,
+            cacheSlot,
+          });
+          const code = await runner(
+            args,
+            childEnv,
+            entry.name,
+            entry.kind === "group" ? (entry.timingKey ?? entry.name) : entry.name,
+          );
+          if (code !== 0) {
+            // Ordinary CI stops scheduling after failure; cache warmers explicitly
+            // continue so later groups still seed their independent transforms.
+            exitCode = exitCode || code;
+          }
+        }
+      } catch (error) {
+        // Setup failures stop admission immediately; live children still own
+        // their cache slots until every admitted worker has joined.
+        nextIndex = plans.length;
+        throw error;
+      }
+    });
+    const outcomes = await Promise.allSettled(workers);
+    const rejected = outcomes.find((outcome) => outcome.status === "rejected");
+    if (rejected) {
+      throw rejected.reason;
+    }
+    if (persistentCacheRoot && baseEnv[FS_MODULE_CACHE_WRITER_ENV_KEY] === "1") {
+      try {
+        const pruned = pruneFsModuleCache(
+          persistentCacheRoot,
+          options.fsModuleCacheMaxBytes ?? FS_MODULE_CACHE_MAX_BYTES,
+        );
+        process.stdout.write(
+          `[shard:cache] vitest ${pruned.beforeBytes} -> ${pruned.afterBytes} bytes; removed ${pruned.removedFiles} files\n`,
+        );
+      } catch (error) {
+        console.warn(`[shard:cache] failed to prune Vitest cache: ${String(error)}`);
+      }
+    }
+    if (nodeCompileCacheRoot && baseEnv[NODE_COMPILE_CACHE_WRITER_ENV_KEY] === "1") {
+      try {
+        const pruned = pruneFsModuleCache(
+          nodeCompileCacheRoot,
+          options.nodeCompileCacheMaxBytes ?? NODE_COMPILE_CACHE_MAX_BYTES,
+        );
+        process.stdout.write(
+          `[shard:cache] node-compile ${pruned.beforeBytes} -> ${pruned.afterBytes} bytes; removed ${pruned.removedFiles} files\n`,
+        );
+      } catch (error) {
+        console.warn(`[shard:cache] failed to prune Node compile cache: ${String(error)}`);
+      }
+    }
+    return exitCode;
+  } finally {
+    try {
+      await context?.workerRun.dispose();
+    } finally {
+      process.off("SIGINT", onSignal);
+      process.off("SIGTERM", onSignal);
+      if (interrupted && context) {
+        await context.exitBySignal(interrupted);
+      }
+    }
+  }
+}
+
+if (isDirectRunUrl(process.argv[1], import.meta.url)) {
+  const plans = resolveShardPlans();
+  process.exitCode = await runShardPlans(plans, {
+    continueOnFailure: process.env.OPENCLAW_NODE_TEST_PLAN_CONTINUE_ON_FAILURE === "1",
+  });
+}
diff --git a/scripts/clawhub-postpublish.mjs b/scripts/clawhub-postpublish.mjs
new file mode 100644
index 0000000000000000000000000000000000000000..f81c995d4bbeb35fbf219507808927cfeedfcf9f
--- /dev/null
+++ b/scripts/clawhub-postpublish.mjs
@@ -0,0 +1,470 @@
+#!/usr/bin/env node
+
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+import {
+  downloadClawHubTransactions,
+  readPackedClawHubTransaction,
+  validateClawHubParentAuthorization,
+  validateClawHubIdentity,
+  validateClawHubWorkflowRun,
+} from "./clawhub-parent-authorization.mjs";
+import {
+  downloadExactActionsArtifactArchive,
+  inspectActionsArtifactZip,
+  readBoundedRegularFile,
+  validateActionsArtifactBinding,
+} from "./lib/actions-artifact-archive.mjs";
+import { readBoundedResponseText } from "./lib/bounded-response.mjs";
+import { verifyReleaseToolingIdentity } from "./release-tooling-identity.mjs";
+import { verifyPublishedClawHubPackage } from "./verify-clawhub-published-artifact.mjs";
+
+const REPOSITORY = "openclaw/openclaw";
+const PARENT_WORKFLOW = ".github/workflows/openclaw-release-publish.yml";
+const CHILD_WORKFLOW = ".github/workflows/plugin-clawhub-release.yml";
+const MAX_RECEIPT_BYTES = 64 * 1024;
+
+function positiveId(value, label) {
+  if (!/^[1-9][0-9]*$/u.test(String(value)) || !Number.isSafeInteger(Number(value))) {
+    throw new Error(`${label} must be a positive safe integer.`);
+  }
+  return Number(value);
+}
+
+function requireSuccessfulRun(run, expected) {
+  const actual = {
+    repository: run?.repository?.full_name,
+    headRepository: run?.head_repository?.full_name,
+    workflow: run?.path?.split("@")[0],
+    runId: run?.id,
+    runAttempt: run?.run_attempt,
+    headSha: run?.head_sha,
+    ref: run?.head_branch,
+    event: run?.event,
+    status: run?.status,
+    conclusion: run?.conclusion,
+  };
+  for (const [key, value] of Object.entries({
+    repository: REPOSITORY,
+    headRepository: REPOSITORY,
+    event: "workflow_dispatch",
+    status: "completed",
+    conclusion: "success",
+    ...expected,
+  })) {
+    if (actual[key] !== value) {
+      throw new Error(`ClawHub postpublish workflow ${key} mismatch.`);
+    }
+  }
+}
+
+async function githubJson(path, { token, fetchImpl }) {
+  const signal = AbortSignal.timeout(60_000);
+  const response = await fetchImpl(`https://api.github.com/repos/${REPOSITORY}/${path}`, {
+    headers: {
+      accept: "application/vnd.github+json",
+      authorization: `Bearer ${token}`,
+      "x-github-api-version": "2026-03-10",
+    },
+    redirect: "error",
+    signal,
+  });
+  if (!response.ok) {
+    throw new Error(`GitHub postpublish read returned HTTP ${response.status}.`);
+  }
+  return JSON.parse(
+    await readBoundedResponseText(response, "GitHub postpublish", 2 * 1024 * 1024, { signal }),
+  );
+}
+
+async function listRunArtifacts(runId, context) {
+  const artifacts = [];
+  // A full plugin release produces several artifacts per package. Bound the
+  // inventory without trusting an artifact's self-declared download location.
+  for (let page = 1; page <= 20; page += 1) {
+    const result = await githubJson(
+      `actions/runs/${runId}/artifacts?per_page=100&page=${page}`,
+      context,
+    );
+    if (
+      !Array.isArray(result.artifacts) ||
+      !Number.isSafeInteger(result.total_count) ||
+      result.total_count > 2000
+    ) {
+      throw new Error("ClawHub postpublish artifact listing is invalid or exceeds its limit.");
+    }
+    artifacts.push(...result.artifacts);
+    if (artifacts.length === result.total_count) {
+      return artifacts;
+    }
+    if (result.artifacts.length === 0 || artifacts.length > result.total_count) {
+      break;
+    }
+  }
+  throw new Error("ClawHub postpublish artifact listing is incomplete.");
+}
+
+async function downloadArtifact(artifact, run, context, maxArchiveBytes) {
+  validateActionsArtifactBinding({
+    artifactMetadata: artifact,
+    workflowRun: { ...run, path: run.path.split("@")[0] },
+    expected: {
+      artifactId: artifact.id,
+      artifactName: artifact.name,
+      artifactDigest: artifact.digest,
+      artifactSizeBytes: artifact.size_in_bytes,
+      repository: REPOSITORY,
+      runId: run.id,
+      runAttempt: run.run_attempt,
+      workflowSha: run.head_sha,
+      workflowHeadBranch: run.head_branch,
+      workflowEvent: "workflow_dispatch",
+      runStatePolicy: "completed-success",
+      workflowPath: run.path.split("@")[0],
+    },
+  });
+  await mkdir(context.archiveDir, { recursive: true });
+  return await downloadExactActionsArtifactArchive({
+    ...context,
+    archivePath: join(context.archiveDir, `${artifact.id}.zip`),
+    maxArchiveBytes,
+    expected: {
+      repository: REPOSITORY,
+      artifactId: artifact.id,
+      artifactName: artifact.name,
+      artifactDigest: artifact.digest,
+      artifactSizeBytes: artifact.size_in_bytes,
+      artifactExpiresAt: artifact.expires_at,
+      runId: run.id,
+      workflowSha: run.head_sha,
+    },
+  });
+}
+
+function identityFromReceipt(receipt) {
+  return validateClawHubIdentity({
+    version: 2,
+    repository: REPOSITORY,
+    workflow: CHILD_WORKFLOW,
+    runId: String(positiveId(receipt.childRunId, "child run")),
+    runAttempt: String(positiveId(receipt.childRunAttempt, "child attempt")),
+    ref: receipt.childRef,
+    fullRef: receipt.childFullRef,
+    sha: receipt.childHeadSha,
+    candidateRepository: REPOSITORY,
+    candidateSha: receipt.candidateSha,
+    toolingRef: receipt.toolingRef,
+    toolingFullRef: receipt.toolingFullRef,
+    toolingSha: receipt.toolingSha,
+    parentRepository: REPOSITORY,
+    parentWorkflow: PARENT_WORKFLOW,
+    parentRunId: receipt.runId,
+    parentRunAttempt: receipt.runAttempt,
+  });
+}
+
+export async function verifyClawHubPostpublish({
+  event,
+  verifierSha,
+  token,
+  outputDir,
+  fetchImpl = fetch,
+  runGh,
+}) {
+  const trigger = event?.workflow_run;
+  const runId = positiveId(trigger?.id, "parent run");
+  const runAttempt = positiveId(trigger?.run_attempt, "parent attempt");
+  const expectedParent = {
+    workflow: PARENT_WORKFLOW,
+    runId,
+    runAttempt,
+    headSha: trigger?.head_sha,
+    ref: trigger?.head_branch,
+  };
+  requireSuccessfulRun(trigger, expectedParent);
+  const context = { token, fetchImpl, archiveDir: join(outputDir, "archives") };
+  const parent = await githubJson(`actions/runs/${runId}/attempts/${runAttempt}`, context);
+  requireSuccessfulRun(parent, expectedParent);
+  const artifacts = await listRunArtifacts(runId, context);
+  const dispatchName = `openclaw-release-children-${runId}-${runAttempt}`;
+  const dispatchArtifacts = artifacts.filter((artifact) => artifact.name === dispatchName);
+  if (dispatchArtifacts.length !== 1) {
+    throw new Error("Missing exact parent release dispatch record.");
+  }
+  const { archiveBytes: dispatchZip } = await downloadArtifact(
+    dispatchArtifacts[0],
+    parent,
+    context,
+    MAX_RECEIPT_BYTES + 4096,
+  );
+  const dispatchFiles = inspectActionsArtifactZip(dispatchZip, ["dispatch.json"], {
+    maxEntryBytes: MAX_RECEIPT_BYTES,
+    maxExpandedBytes: MAX_RECEIPT_BYTES,
+  });
+  const dispatch = JSON.parse(
+    new TextDecoder("utf-8", { fatal: true }).decode(dispatchFiles.get("dispatch.json")),
+  );
+  const dispatchFields = [
+    "schemaVersion",
+    "repository",
+    "parentRunId",
+    "parentRunAttempt",
+    "parentWorkflow",
+    "toolingRef",
+    "toolingFullRef",
+    "toolingSha",
+    "candidateSha",
+    "normalClawHubRunId",
+    "normalClawHubRunAttempt",
+  ];
+  if (
+    !dispatch ||
+    Object.keys(dispatch).length !== dispatchFields.length ||
+    dispatchFields.some((key) => !Object.hasOwn(dispatch, key)) ||
+    dispatch.schemaVersion !== 1 ||
+    dispatch.repository !== REPOSITORY ||
+    String(dispatch.parentRunId) !== String(runId) ||
+    String(dispatch.parentRunAttempt) !== String(runAttempt) ||
+    dispatch.parentWorkflow !== PARENT_WORKFLOW ||
+    dispatch.toolingRef !== parent.head_branch ||
+    dispatch.toolingSha !== parent.head_sha ||
+    !/^[a-f0-9]{40}$/u.test(dispatch.candidateSha)
+  ) {
+    throw new Error("Parent dispatch record identity mismatch.");
+  }
+  verifyReleaseToolingIdentity({
+    repository: REPOSITORY,
+    workflowRef: dispatch.toolingRef,
+    workflowFullRef: dispatch.toolingFullRef,
+    workflowSha: parent.head_sha,
+    runGh,
+  });
+  if (!/^[a-f0-9]{40}$/u.test(verifierSha)) {
+    throw new Error("Invalid trusted verifier SHA.");
+  }
+  // GitHub includes file patches only on page 1; status describes the full comparison.
+  const ancestry = await githubJson(
+    `compare/${parent.head_sha}...${verifierSha}?per_page=1&page=2`,
+    context,
+  );
+  if (ancestry.status !== "ahead" && ancestry.status !== "identical") {
+    throw new Error("Parent tooling is not an ancestor of trusted verification tooling.");
+  }
+  const parentQualifiedRef = parent.path.split("@")[1];
+  if (parentQualifiedRef !== undefined && parentQualifiedRef !== dispatch.toolingFullRef) {
+    throw new Error("Parent workflow full ref mismatch.");
+  }
+  await mkdir(outputDir, { recursive: true });
+  if (dispatch.normalClawHubRunId === null && dispatch.normalClawHubRunAttempt === null) {
+    const evidence = {
+      schemaVersion: 1,
+      repository: REPOSITORY,
+      parentRunId: runId,
+      parentRunAttempt: runAttempt,
+      complete: true,
+      outcome: "no-normal-clawhub-publication",
+      dispatchArtifactId: dispatchArtifacts[0].id,
+      dispatchArtifactDigest: dispatchArtifacts[0].digest,
+      packages: [],
+    };
+    await writeFile(join(outputDir, "evidence.json"), `${JSON.stringify(evidence, null, 2)}\n`);
+    return evidence;
+  }
+  positiveId(dispatch.normalClawHubRunId, "dispatched child run");
+  positiveId(dispatch.normalClawHubRunAttempt, "dispatched child attempt");
+  const prefix = `openclaw-clawhub-parent-authorization-v2-${runId}-${runAttempt}-`;
+  const receipts = artifacts.filter((artifact) => artifact.name?.startsWith(prefix));
+  if (receipts.length !== 1) {
+    throw new Error("Expected exactly one ClawHub parent authorization artifact for this attempt.");
+  }
+  const receiptArtifact = receipts[0];
+  const { archiveBytes } = await downloadArtifact(
+    receiptArtifact,
+    parent,
+    context,
+    MAX_RECEIPT_BYTES + 4096,
+  );
+  const files = inspectActionsArtifactZip(archiveBytes, ["authorization.json"], {
+    maxEntryBytes: MAX_RECEIPT_BYTES,
+    maxExpandedBytes: MAX_RECEIPT_BYTES,
+  });
+  const receipt = JSON.parse(
+    new TextDecoder("utf-8", { fatal: true }).decode(files.get("authorization.json")),
+  );
+  const identity = identityFromReceipt(receipt);
+  if (
+    identity.runId !== String(dispatch.normalClawHubRunId) ||
+    identity.runAttempt !== String(dispatch.normalClawHubRunAttempt) ||
+    identity.candidateSha !== dispatch.candidateSha ||
+    identity.toolingFullRef !== dispatch.toolingFullRef
+  ) {
+    throw new Error("Parent receipt does not bind its dispatched child.");
+  }
+  if (
+    receiptArtifact.name !== `${prefix}${identity.runId}-${identity.runAttempt}` ||
+    receipt.runId !== String(runId) ||
+    receipt.runAttempt !== String(runAttempt) ||
+    receipt.headSha !== parent.head_sha ||
+    receipt.ref !== parent.head_branch
+  ) {
+    throw new Error("ClawHub parent receipt does not bind the triggering run attempt.");
+  }
+  let child;
+  const childDeadline = Date.now() + 30 * 60 * 1000;
+  for (;;) {
+    child = await githubJson(
+      `actions/runs/${identity.runId}/attempts/${identity.runAttempt}`,
+      context,
+    );
+    validateClawHubWorkflowRun(child, identity);
+    if (child.status === "completed") {
+      break;
+    }
+    if (Date.now() >= childDeadline) {
+      throw new Error("ClawHub child did not complete within the postpublish deadline.");
+    }
+    await new Promise((resolve) => {
+      setTimeout(resolve, 10_000);
+    });
+  }
+  validateClawHubWorkflowRun(child, identity, { terminal: true });
+  const childQualifiedRef = child.path.split("@")[1];
+  if (childQualifiedRef !== undefined && childQualifiedRef !== identity.fullRef) {
+    throw new Error("Child workflow full ref mismatch.");
+  }
+  const downloaded = await downloadClawHubTransactions({
+    identity,
+    ...context,
+    archivePath: join(
+      context.archiveDir,
+      `transactions-${identity.runId}-${identity.runAttempt}.zip`,
+    ),
+    runGhJson: runGh
+      ? (path) => JSON.parse(runGh(["api", `repos/${REPOSITORY}/${path}`, "--method", "GET"]))
+      : undefined,
+  });
+  const transactions = downloaded.transactions;
+  validateClawHubParentAuthorization(receipt, transactions);
+  const childArtifacts = await listRunArtifacts(child.id, context);
+  const evidence = {
+    schemaVersion: 1,
+    repository: REPOSITORY,
+    parentRunId: runId,
+    parentRunAttempt: runAttempt,
+    childRunId: child.id,
+    childRunAttempt: child.run_attempt,
+    toolingSha: parent.head_sha,
+    candidateSha: identity.candidateSha,
+    dispatchArtifactId: dispatchArtifacts[0].id,
+    dispatchArtifactDigest: dispatchArtifacts[0].digest,
+    receiptArtifactId: receiptArtifact.id,
+    receiptArtifactDigest: receiptArtifact.digest,
+    packages: [],
+    complete: false,
+  };
+  await mkdir(outputDir, { recursive: true });
+  const save = () =>
+    writeFile(join(outputDir, "evidence.json"), `${JSON.stringify(evidence, null, 2)}\n`);
+  await save();
+  // Registry reads carry no GitHub credentials. Each package is checked against
+  // the exact bytes and inventory authorized by the successful parent.
+  for (let index = 0; index < transactions.packages.length; index += 8) {
+    const results = await Promise.allSettled(
+      transactions.packages.slice(index, index + 8).map(async (entry) => {
+        const matches = childArtifacts.filter((artifact) => artifact.name === entry.artifactName);
+        if (matches.length !== 1) {
+          throw new Error(`Expected one package artifact for ${entry.name}.`);
+        }
+        const { archiveBytes: packageZip } = await downloadArtifact(
+          matches[0],
+          child,
+          context,
+          130 * 1024 * 1024,
+        );
+        const packageFiles = inspectActionsArtifactZip(packageZip, 1, {
+          maxEntryBytes: 120 * 1024 * 1024,
+        });
+        const [[fileName, bytes]] = packageFiles;
+        if (!/^[A-Za-z0-9][A-Za-z0-9._-]*\.tgz$/u.test(fileName)) {
+          throw new Error("ClawHub package artifact must contain one root tarball.");
+        }
+        const artifactDir = join(outputDir, String(matches[0].id));
+        await mkdir(artifactDir, { recursive: true });
+        const tarballPath = join(artifactDir, fileName);
+        try {
+          await writeFile(tarballPath, bytes, { flag: "wx", mode: 0o600 });
+        } catch (error) {
+          if (error?.code !== "EEXIST") {
+            throw error;
+          }
+          // Retained output is reusable content, never publication authority.
+          // Refuse modified or symlinked files instead of overwriting evidence.
+          const retained = readBoundedRegularFile(tarballPath, {
+            label: "Retained ClawHub package",
+            maxBytes: 120 * 1024 * 1024,
+          });
+          if (!retained.equals(bytes)) {
+            throw new Error(`Retained ClawHub package bytes mismatch: ${entry.name}.`, {
+              cause: error,
+            });
+          }
+        }
+        const packed = readPackedClawHubTransaction({
+          artifactDir,
+          packageName: entry.name,
+          version: entry.version,
+          artifactName: entry.artifactName,
+        });
+        if (Object.keys(packed).some((key) => packed[key] !== entry[key])) {
+          throw new Error(`ClawHub package transaction changed: ${entry.name}.`);
+        }
+        const publishTag = entry.version.includes("-alpha.")
+          ? "alpha"
+          : entry.version.includes("-beta.")
+            ? "beta"
+            : "latest";
+        const verified = await verifyPublishedClawHubPackage({
+          expectedArtifactDir: artifactDir,
+          packageName: entry.name,
+          packageVersion: entry.version,
+          publishTag,
+          retryOptions: { fetchImpl },
+        });
+        return Object.assign(verified, {
+          artifactId: matches[0].id,
+          artifactDigest: matches[0].digest,
+          inventoryDigest: entry.inventoryDigest,
+        });
+      }),
+    );
+    for (const result of results) {
+      if (result.status === "fulfilled") {
+        evidence.packages.push(result.value);
+      }
+    }
+    await save();
+    const failure = results.find((result) => result.status === "rejected");
+    if (failure) {
+      throw failure.reason;
+    }
+  }
+  evidence.complete = true;
+  await save();
+  return evidence;
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+  try {
+    await verifyClawHubPostpublish({
+      event: JSON.parse(await readFile(process.env.GITHUB_EVENT_PATH, "utf8")),
+      verifierSha: process.env.VERIFIER_SHA,
+      token: process.env.GH_TOKEN,
+      outputDir: join(process.env.RUNNER_TEMP, "clawhub-postpublish"),
+    });
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    console.error("[clawhub-postpublish] FAILED (exit 1)");
+    process.exitCode = 1;
+  }
+}
diff --git a/scripts/code-mode-model-matrix.ts b/scripts/code-mode-model-matrix.ts
new file mode 100644
index 0000000000000000000000000000000000000000..44f7e6b8666078e992bfedd4518970e5608098b7
--- /dev/null
+++ b/scripts/code-mode-model-matrix.ts
@@ -0,0 +1,1705 @@
+#!/usr/bin/env node
+
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import process from "node:process";
+import { pathToFileURL } from "node:url";
+import { promisify } from "node:util";
+import {
+  buildScriptEvidenceSummary,
+  captureQaEvidenceRuntimeIdentity,
+  captureQaEvidenceSourceIdentity as readSourceIdentity,
+  createQaEvidenceInvocation,
+  QA_EVIDENCE_FILENAME,
+  validateQaEvidenceSummaryJson,
+  type QaEvidenceIdentity,
+  type QaEvidenceStatus,
+  type QaEvidenceSummaryJson,
+} from "../extensions/qa-lab/test-api.js";
+import type { AgentExecEnvelope } from "../src/commands/agent-exec-result.ts";
+import { requireOptionArgument } from "./lib/arg-utils.mts";
+import { summarizeGatewayMatrixOutcomes } from "./lib/code-mode-matrix-comparison.ts";
+import {
+  GATEWAY_MATRIX_TASKS,
+  type GatewayMatrixTask,
+} from "./lib/code-mode-matrix-gateway-fixtures.ts";
+import type {
+  GatewayMatrixEvidence,
+  GatewayMatrixWorkload,
+} from "./lib/code-mode-matrix-gateway.ts";
+import { previewForDevToolLog, redactJsonValueForDevToolLog } from "./lib/dev-tooling-safety.ts";
+
+export { validateQaEvidenceSummaryJson };
+
+const execFileAsync = promisify(execFile);
+const SOURCE_PATH = "scripts/code-mode-model-matrix.ts";
+const MATRIX_SCHEMA_VERSION = 1;
+const DEFAULT_REPETITIONS = 3;
+const DEFAULT_TIMEOUT_SECONDS = 180;
+const MAX_REPETITIONS = 10;
+const MAX_DIAGNOSTIC_CHARS = 8_000;
+
+export type CodeModeMatrixMode = "direct" | "auto" | "code";
+const MATRIX_TASKS = [
+  "read",
+  "dependent-read-write",
+  "large-result-reduction",
+  "parallel-independent-reads",
+  "dependent-chain",
+  ...GATEWAY_MATRIX_TASKS,
+] as const;
+export type CodeModeMatrixTask = (typeof MATRIX_TASKS)[number];
+
+export type CodeModeMatrixOptions = {
+  allowFailures: boolean;
+  dryRun: boolean;
+  keepState: boolean;
+  models: string[];
+  modes: CodeModeMatrixMode[];
+  outputDir?: string;
+  repetitions: number;
+  repoRoot: string;
+  runtimeDir?: string;
+  baselineResults?: string;
+  tasks: CodeModeMatrixTask[];
+  thinking: string;
+  timeoutSeconds: number;
+};
+
+export type MatrixCell = {
+  id: string;
+  mode: CodeModeMatrixMode;
+  model: string;
+  repetition: number;
+  task: CodeModeMatrixTask;
+};
+
+type MatrixTaskFixture = {
+  expected: string;
+  prompt: string;
+  resultPath?: string;
+};
+
+export type MatrixRuntimeEntrypoint = {
+  args: string[];
+  cwd: string;
+};
+
+type CellFailureCategory =
+  | "activation"
+  | "agent_error"
+  | "answer_mismatch"
+  | "effect_mismatch"
+  | "harness_error"
+  | "interview_mismatch"
+  | "model_mismatch"
+  | "provider_auth"
+  | "provider_billing"
+  | "provider_transport"
+  | "timeout"
+  | "tool_execution";
+
+export type CodeModeMatrixCellResult = {
+  assistantTurns?: number;
+  bridgeCalls?: AgentExecEnvelope["bridgeCalls"];
+  buildSha256: string;
+  codeModeEngaged: boolean | null;
+  costUsd?: number;
+  diagnostics?: string;
+  elapsedMs: number;
+  evidenceOccurrenceId?: string;
+  error?: AgentExecEnvelope["error"];
+  expected: string;
+  failureCategory: CellFailureCategory | null;
+  final: string;
+  gitSha: string;
+  id: string;
+  mode: CodeModeMatrixMode;
+  model: string;
+  observedModel: string | null;
+  observedProvider: string | null;
+  oracle: {
+    answer: boolean;
+    effect: boolean;
+    engagement: boolean;
+    identity: boolean;
+    toolExecution: boolean;
+  };
+  passed: boolean;
+  repetition: number;
+  sourceDirty: boolean;
+  sourcePatchSha256: string | null;
+  status: AgentExecEnvelope["status"];
+  task: CodeModeMatrixTask;
+  timestamp: string;
+  toolSummary?: AgentExecEnvelope["toolSummary"];
+  usage?: AgentExecEnvelope["usage"];
+  gateway?: GatewayMatrixEvidence;
+  workload?: GatewayMatrixWorkload;
+};
+
+export type RunCellParams = {
+  abortSignal?: AbortSignal;
+  buildSha256: string;
+  cell: MatrixCell;
+  gitSha: string;
+  keepState: boolean;
+  outputDir: string;
+  repoRoot: string;
+  runtime?: MatrixRuntimeEntrypoint;
+  sourceDirty: boolean;
+  sourcePatchSha256: string | null;
+  thinking: string;
+  timeoutSeconds: number;
+};
+
+type MatrixRunDependencies = {
+  buildCliArtifacts?: (repoRoot: string) => Promise<void>;
+  now?: () => Date;
+  readBuildSha256?: (repoRoot: string) => Promise<string>;
+  readGitSha?: (repoRoot: string) => Promise<string>;
+  readSourceIdentity?: (repoRoot: string) => Promise<SourceIdentity>;
+  runCell?: (params: RunCellParams) => Promise<CodeModeMatrixCellResult>;
+};
+
+type SourceIdentity = {
+  gitSha: string;
+  sourceDirty: boolean;
+  sourcePatchSha256: string | null;
+};
+
+function usage() {
+  return `Usage: pnpm qa:code-mode-models -- --model <provider/model> [options]
+
+Runs repeated Code Mode acceptance cells through the normal embedded agent path.
+
+Options:
+  --model <provider/model>  Model reference; repeat for multiple models
+  --mode <mode>             direct | auto | code; repeat to select modes
+  --task <task>             ${MATRIX_TASKS.join(" | ")}; repeat to select tasks
+                            (default: read, dependent-read-write)
+  --repetitions <n>         Runs per model/mode/task cell (default: ${DEFAULT_REPETITIONS}, max: ${MAX_REPETITIONS})
+  --timeout <seconds>       Per-run agent deadline (default: ${DEFAULT_TIMEOUT_SECONDS})
+  --thinking <level>        Agent thinking level (default: off)
+  --output-dir <path>       Repo-relative artifact directory
+  --runtime-dir <path>      Use a clean, already-built checkout without rebuilding it
+  --baseline-results <path> Compare matching cells from an earlier results.jsonl
+  --keep-state              Retain per-cell state and workspace directories
+  --allow-failures          Exit zero after writing evidence even when cells fail
+  --dry-run                 Write the manifest without calling models
+  -h, --help                Show this help
+
+Provider credentials are read from the environment and are never written to artifacts.
+`;
+}
+
+function parseIntegerOption(raw: string, flag: string, max?: number): number {
+  if (!/^\d+$/u.test(raw)) {
+    throw new Error(`${flag} must be a positive integer`);
+  }
+  const value = Number(raw);
+  if (!Number.isSafeInteger(value) || value < 1 || (max !== undefined && value > max)) {
+    const suffix = max === undefined ? "" : ` from 1 to ${max}`;
+    throw new Error(`${flag} must be an integer${suffix}`);
+  }
+  return value;
+}
+
+function collectUnique<T extends string>(values: T[], value: T, flag: string): void {
+  if (values.includes(value)) {
+    throw new Error(`Duplicate ${flag} value: ${value}`);
+  }
+  values.push(value);
+}
+
+function parseMode(raw: string): CodeModeMatrixMode {
+  if (raw === "direct" || raw === "auto" || raw === "code") {
+    return raw;
+  }
+  throw new Error(`--mode must be one of direct, auto, code; got ${JSON.stringify(raw)}`);
+}
+
+function parseTask(raw: string): CodeModeMatrixTask {
+  const task = MATRIX_TASKS.find((candidate) => candidate === raw);
+  if (task) {
+    return task;
+  }
+  throw new Error(`--task must be one of ${MATRIX_TASKS.join(", ")}; got ${JSON.stringify(raw)}`);
+}
+
+function isGatewayTask(task: CodeModeMatrixTask): task is GatewayMatrixTask {
+  return GATEWAY_MATRIX_TASKS.some((candidate) => candidate === task);
+}
+
+export function parseCodeModeMatrixOptions(
+  argv: readonly string[],
+  cwd = process.cwd(),
+): CodeModeMatrixOptions {
+  const models: string[] = [];
+  const modes: CodeModeMatrixMode[] = [];
+  const tasks: CodeModeMatrixTask[] = [];
+  let allowFailures = false;
+  let dryRun = false;
+  let keepState = false;
+  let outputDir: string | undefined;
+  let runtimeDir: string | undefined;
+  let baselineResults: string | undefined;
+  let repetitions = DEFAULT_REPETITIONS;
+  let thinking = "off";
+  let timeoutSeconds = DEFAULT_TIMEOUT_SECONDS;
+  const seen = new Set<string>();
+  const recordOnce = (flag: string) => {
+    if (seen.has(flag)) {
+      throw new Error(`${flag} was provided more than once`);
+    }
+    seen.add(flag);
+  };
+
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === "--model") {
+      const value = requireOptionArgument(argv, index, arg).trim();
+      if (!value.includes("/")) {
+        throw new Error(
+          `--model must use a provider/model reference; got ${JSON.stringify(value)}`,
+        );
+      }
+      collectUnique(models, value, arg);
+      index += 1;
+      continue;
+    }
+    if (arg === "--mode") {
+      collectUnique(modes, parseMode(requireOptionArgument(argv, index, arg)), arg);
+      index += 1;
+      continue;
+    }
+    if (arg === "--task") {
+      collectUnique(tasks, parseTask(requireOptionArgument(argv, index, arg)), arg);
+      index += 1;
+      continue;
+    }
+    if (arg === "--repetitions") {
+      recordOnce(arg);
+      repetitions = parseIntegerOption(
+        requireOptionArgument(argv, index, arg),
+        arg,
+        MAX_REPETITIONS,
+      );
+      index += 1;
+      continue;
+    }
+    if (arg === "--timeout") {
+      recordOnce(arg);
+      timeoutSeconds = parseIntegerOption(requireOptionArgument(argv, index, arg), arg);
+      index += 1;
+      continue;
+    }
+    if (arg === "--thinking") {
+      recordOnce(arg);
+      thinking = requireOptionArgument(argv, index, arg).trim();
+      index += 1;
+      continue;
+    }
+    if (arg === "--output-dir") {
+      recordOnce(arg);
+      outputDir = requireOptionArgument(argv, index, arg);
+      index += 1;
+      continue;
+    }
+    if (arg === "--runtime-dir" || arg === "--baseline-results") {
+      recordOnce(arg);
+      const value = path.resolve(cwd, requireOptionArgument(argv, index, arg));
+      if (arg === "--runtime-dir") {
+        runtimeDir = value;
+      } else {
+        baselineResults = value;
+      }
+      index += 1;
+      continue;
+    }
+    if (arg === "--allow-failures") {
+      recordOnce(arg);
+      allowFailures = true;
+      continue;
+    }
+    if (arg === "--keep-state") {
+      recordOnce(arg);
+      keepState = true;
+      continue;
+    }
+    if (arg === "--dry-run") {
+      recordOnce(arg);
+      dryRun = true;
+      continue;
+    }
+    if (arg === "--help" || arg === "-h") {
+      throw Object.assign(new Error(usage()), { code: "HELP" });
+    }
+    throw new Error(`Unknown argument: ${arg}`);
+  }
+
+  if (models.length === 0) {
+    throw new Error("At least one --model <provider/model> is required");
+  }
+  if (tasks.some(isGatewayTask)) {
+    if (modes.length !== 1 || modes[0] !== "code") {
+      throw new Error("Gateway interview tasks require --mode code.");
+    }
+    if (models.some((model) => !model.startsWith("openai/"))) {
+      throw new Error("Gateway interview tasks currently require explicit OpenAI models.");
+    }
+  }
+  if (baselineResults && (tasks.length === 0 || tasks.some((task) => !isGatewayTask(task)))) {
+    throw new Error(
+      "--baseline-results requires Gateway interview tasks with fixed workload fingerprints.",
+    );
+  }
+  return {
+    allowFailures,
+    dryRun,
+    keepState,
+    models,
+    modes: modes.length > 0 ? modes : ["direct", "auto", "code"],
+    outputDir,
+    repetitions,
+    repoRoot: path.resolve(cwd),
+    ...(runtimeDir ? { runtimeDir } : {}),
+    ...(baselineResults ? { baselineResults } : {}),
+    tasks: tasks.length > 0 ? tasks : ["read", "dependent-read-write"],
+    thinking,
+    timeoutSeconds,
+  };
+}
+
+function slug(value: string): string {
+  return value
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/gu, "-")
+    .replace(/^-+|-+$/gu, "")
+    .slice(0, 80);
+}
+
+function defaultOutputDir(now: Date): string {
+  return path.join(
+    ".artifacts",
+    "qa-e2e",
+    "code-mode-model-matrix",
+    now.toISOString().replaceAll(":", "-"),
+  );
+}
+
+export function resolveCodeModeMatrixOutputDir(
+  repoRoot: string,
+  configured: string | undefined,
+  now = new Date(),
+): string {
+  const raw = configured?.trim() || defaultOutputDir(now);
+  if (path.isAbsolute(raw)) {
+    throw new Error("--output-dir must be repo-relative");
+  }
+  const resolvedRoot = path.resolve(repoRoot);
+  const resolved = path.resolve(resolvedRoot, raw);
+  if (resolved === resolvedRoot || !resolved.startsWith(`${resolvedRoot}${path.sep}`)) {
+    throw new Error("--output-dir must stay within the repository");
+  }
+  return resolved;
+}
+
+function pathsOverlap(left: string, right: string, caseInsensitive: boolean): boolean {
+  const normalize = (value: string) => {
+    const resolved = path.resolve(value);
+    return caseInsensitive ? resolved.toLowerCase() : resolved;
+  };
+  const resolvedLeft = normalize(left);
+  const resolvedRight = normalize(right);
+  return (
+    resolvedLeft === resolvedRight ||
+    resolvedLeft.startsWith(`${resolvedRight}${path.sep}`) ||
+    resolvedRight.startsWith(`${resolvedLeft}${path.sep}`)
+  );
+}
+
+async function filesystemUsesCaseInsensitivePaths(repoRoot: string): Promise<boolean> {
+  const canonicalRoot = await fs.realpath(repoRoot);
+  const rootName = path.basename(canonicalRoot);
+  const letterIndex = rootName.search(/[a-z]/iu);
+  if (letterIndex < 0) {
+    return process.platform === "win32";
+  }
+  const letter = rootName[letterIndex] ?? "";
+  const alternateLetter =
+    letter === letter.toLowerCase() ? letter.toUpperCase() : letter.toLowerCase();
+  const alternateRoot = path.join(
+    path.dirname(canonicalRoot),
+    `${rootName.slice(0, letterIndex)}${alternateLetter}${rootName.slice(letterIndex + 1)}`,
+  );
+  return await fs.realpath(alternateRoot).then(
+    (resolved) => resolved === canonicalRoot,
+    () => false,
+  );
+}
+
+async function canonicalizeExistingPathPrefix(value: string): Promise<string> {
+  let current = path.resolve(value);
+  const missingSegments: string[] = [];
+  for (;;) {
+    try {
+      return path.join(await fs.realpath(current), ...missingSegments.toReversed());
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT") {
+        throw error;
+      }
+      const parent = path.dirname(current);
+      if (parent === current) {
+        throw error;
+      }
+      missingSegments.push(path.basename(current));
+      current = parent;
+    }
+  }
+}
+
+async function runtimeArtifactDirectories(repoRoot: string, outputDir: string): Promise<string[]> {
+  const packagesRoot = path.join(repoRoot, "packages");
+  const packageEntries = await fs
+    .readdir(packagesRoot, { withFileTypes: true })
+    .catch((error: unknown) => {
+      if ((error as NodeJS.ErrnoException).code === "ENOENT") {
+        return [];
+      }
+      throw error;
+    });
+  const artifacts = [
+    path.join(repoRoot, "dist"),
+    ...packageEntries
+      .filter((entry) => entry.isDirectory())
+      .map((entry) => path.join(packagesRoot, entry.name, "dist")),
+  ];
+  const outputSegments = path
+    .relative(path.resolve(repoRoot), path.resolve(outputDir))
+    .split(path.sep);
+  const outputPackage = outputSegments[0]?.toLowerCase() === "packages" && outputSegments[1];
+  if (outputPackage) {
+    artifacts.push(path.join(packagesRoot, outputPackage, "dist"));
+  }
+  return artifacts;
+}
+
+async function assertOutputOutsideRuntimeArtifacts(
+  repoRoot: string,
+  outputDir: string,
+): Promise<void> {
+  const caseInsensitive = await filesystemUsesCaseInsensitivePaths(repoRoot);
+  const canonicalOutput = await canonicalizeExistingPathPrefix(outputDir);
+  for (const artifactDir of await runtimeArtifactDirectories(repoRoot, outputDir)) {
+    const canonicalArtifact = await canonicalizeExistingPathPrefix(artifactDir);
+    if (pathsOverlap(canonicalOutput, canonicalArtifact, caseInsensitive)) {
+      throw new Error(
+        `--output-dir must not overlap runtime artifacts: ${path.relative(repoRoot, artifactDir)}`,
+      );
+    }
+  }
+}
+
+async function assertOutputOutsideGitMetadata(repoRoot: string, outputDir: string): Promise<void> {
+  const gitDirectories = [path.join(repoRoot, ".git")];
+  const discovered = await execFileAsync(
+    "git",
+    ["rev-parse", "--path-format=absolute", "--git-dir", "--git-common-dir"],
+    {
+      cwd: repoRoot,
+      encoding: "utf8",
+    },
+  ).catch(() => null);
+  if (discovered) {
+    gitDirectories.push(
+      ...discovered.stdout
+        .split(/\r?\n/u)
+        .map((value) => value.trim())
+        .filter(Boolean),
+    );
+  }
+
+  const caseInsensitive = await filesystemUsesCaseInsensitivePaths(repoRoot);
+  const canonicalOutput = await canonicalizeExistingPathPrefix(outputDir);
+  for (const gitDirectory of new Set(gitDirectories)) {
+    const canonicalGitDirectory = await canonicalizeExistingPathPrefix(gitDirectory);
+    if (pathsOverlap(canonicalOutput, canonicalGitDirectory, caseInsensitive)) {
+      throw new Error("--output-dir must not overlap Git metadata");
+    }
+  }
+}
+
+export async function reserveCodeModeMatrixOutputDir(
+  repoRoot: string,
+  outputDir: string,
+): Promise<void> {
+  const resolvedRoot = path.resolve(repoRoot);
+  const resolvedOutput = path.resolve(outputDir);
+  const relative = path.relative(resolvedRoot, resolvedOutput);
+  if (
+    !relative ||
+    relative === ".." ||
+    relative.startsWith(`..${path.sep}`) ||
+    path.isAbsolute(relative)
+  ) {
+    throw new Error("--output-dir must stay within the repository");
+  }
+  let current = resolvedRoot;
+  for (const segment of relative.split(path.sep)) {
+    current = path.join(current, segment);
+    for (;;) {
+      try {
+        const stats = await fs.lstat(current);
+        if (stats.isSymbolicLink()) {
+          throw new Error(`--output-dir must not traverse symlinks: ${relative}`);
+        }
+        if (current === resolvedOutput) {
+          throw new Error(`--output-dir must not already exist: ${relative}`);
+        }
+        if (!stats.isDirectory()) {
+          throw new Error(
+            `--output-dir parent must be a directory: ${path.relative(repoRoot, current)}`,
+          );
+        }
+        break;
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code !== "ENOENT") {
+          throw error;
+        }
+        try {
+          await fs.mkdir(current);
+          break;
+        } catch (mkdirError) {
+          if ((mkdirError as NodeJS.ErrnoException).code !== "EEXIST") {
+            throw mkdirError;
+          }
+          // A concurrent creator won the race. Inspect its path before proceeding.
+        }
+      }
+    }
+  }
+}
+
+function buildCells(options: CodeModeMatrixOptions): MatrixCell[] {
+  return options.models.flatMap((model) =>
+    options.modes.flatMap((mode) =>
+      options.tasks.flatMap((task) =>
+        Array.from({ length: options.repetitions }, (_, index) => {
+          const repetition = index + 1;
+          return {
+            id: `${modelCellPrefix(model)}-${mode}-${task}-${repetition}`,
+            mode,
+            model,
+            repetition,
+            task,
+          };
+        }),
+      ),
+    ),
+  );
+}
+
+export function modelCellPrefix(model: string): string {
+  const modelHash = createHash("sha256").update(model).digest("hex").slice(0, 10);
+  return `${slug(model)}-${modelHash}`;
+}
+
+function verificationCode(cell: MatrixCell): string {
+  return `CM-${createHash("sha256").update(cell.id).digest("hex").slice(0, 12).toUpperCase()}`;
+}
+
+function taskFixture(cell: MatrixCell): MatrixTaskFixture & { files: Record<string, string> } {
+  const expected = verificationCode(cell);
+  const facts = { "facts.txt": `project=openclaw\nverification_code=${expected}\n` };
+  if (cell.task === "read") {
+    return {
+      expected,
+      files: facts,
+      prompt:
+        "Read facts.txt using tools. Reply with only the verification_code value, with no prose or formatting.",
+    };
+  }
+  if (cell.task === "dependent-read-write") {
+    return {
+      expected,
+      files: facts,
+      prompt:
+        "Read facts.txt using tools. Write only its verification_code value to result.txt, then read result.txt and reply with only that value. Do not guess or skip verification.",
+      resultPath: "result.txt",
+    };
+  }
+  // Extended tasks use identical inputs across models/modes for each repetition.
+  const code = verificationCode({ ...cell, id: `${cell.task}-${cell.repetition}` });
+  const finish =
+    " Write only the answer to result.txt, read it back, and reply with only that answer, with no prose or formatting. Use file tools, not shell commands.";
+  if (cell.task === "large-result-reduction") {
+    const rows = Array.from({ length: 512 }, (_, index) => ({
+      id: index + 1,
+      region: index % 3 === 0 ? "west" : "east",
+      units: (index % 7) + 1,
+      unitPriceCents: 100 + (index % 23),
+      note: "irrelevant-detail-".repeat(4),
+    }));
+    const selected = rows.filter((row) => row.region === "east" && row.units >= 4);
+    return {
+      expected: `${code}:${selected.length}:${selected.reduce((total, row) => total + row.units * row.unitPriceCents, 0)}`,
+      files: {
+        "rules.json": JSON.stringify({ region: "east", minUnits: 4, verificationCode: code }),
+        "orders.jsonl": rows.map((row) => JSON.stringify(row)).join("\n") + "\n",
+      },
+      prompt:
+        "Read rules.json and all of orders.jsonl using tools, following read continuations when truncated. Select orders matching rules.region with units >= rules.minUnits. Compute their count and sum of units * unitPriceCents. The answer is verificationCode:count:sum, using rules.verificationCode and integer decimal numbers. Do not emit the raw orders." +
+        finish,
+      resultPath: "result.txt",
+    };
+  }
+  if (cell.task === "parallel-independent-reads") {
+    const names = ["north", "south", "west"];
+    const values = names.map((name, index) => `${code}-${index + 1}-${name}`);
+    return {
+      expected: values.join("|"),
+      files: Object.fromEntries(
+        names.map((name, index) => [`${name}.json`, JSON.stringify({ value: values[index] })]),
+      ),
+      prompt:
+        "Read north.json, south.json, and west.json using independent tool calls. Run the reads in parallel when the tool surface supports it; in Code Mode use Promise.all. Join their value fields in north, south, west order with | (not completion order)." +
+        finish,
+      resultPath: "result.txt",
+    };
+  }
+  const route = `route-${code.slice(3, 9)}.json`;
+  const payload = `payload-${code.slice(9)}.json`;
+  return {
+    expected: code,
+    files: {
+      "start.json": JSON.stringify({ next: route }),
+      [route]: JSON.stringify({ next: payload }),
+      [payload]: JSON.stringify({ value: code }),
+    },
+    prompt:
+      "Read start.json using tools. Its next field names the next file; read that file and follow its next field to the payload file. The answer is the payload's value. Await each read before choosing the next path; do not list the directory or guess paths." +
+      finish,
+    resultPath: "result.txt",
+  };
+}
+
+async function prepareTaskFixture(workspace: string, cell: MatrixCell): Promise<MatrixTaskFixture> {
+  const { files, ...fixture } = taskFixture(cell);
+  await fs.mkdir(workspace, { recursive: true });
+  for (const [name, content] of Object.entries(files)) {
+    await fs.writeFile(path.join(workspace, name), content, "utf8");
+  }
+  if (fixture.resultPath) {
+    fixture.resultPath = path.join(workspace, fixture.resultPath);
+    await fs.rm(fixture.resultPath, { force: true });
+  }
+  return fixture;
+}
+
+async function hashDirectory(root: string): Promise<string> {
+  const hash = createHash("sha256");
+  const visit = async (directory: string): Promise<void> => {
+    const entries = (await fs.readdir(directory, { withFileTypes: true })).toSorted((a, b) =>
+      a.name < b.name ? -1 : a.name > b.name ? 1 : 0,
+    );
+    for (const entry of entries) {
+      const filePath = path.join(directory, entry.name);
+      const relativePath = path.relative(root, filePath);
+      hash.update(`\0${relativePath}\0`);
+      if (entry.isDirectory()) {
+        await visit(filePath);
+      } else if (entry.isSymbolicLink()) {
+        hash.update(await fs.readlink(filePath));
+      } else if (entry.isFile()) {
+        hash.update(await fs.readFile(filePath));
+      }
+    }
+  };
+  await visit(root);
+  return hash.digest("hex");
+}
+
+async function hashRuntimeArtifacts(repoRoot: string): Promise<string> {
+  const artifacts = [{ label: "dist", root: path.join(repoRoot, "dist") }];
+  const packagesRoot = path.join(repoRoot, "packages");
+  const packageEntries = await fs.readdir(packagesRoot, { withFileTypes: true });
+  for (const entry of packageEntries.toSorted((a, b) =>
+    a.name < b.name ? -1 : a.name > b.name ? 1 : 0,
+  )) {
+    if (!entry.isDirectory()) {
+      continue;
+    }
+    const packageDist = path.join(packagesRoot, entry.name, "dist");
+    const stat = await fs.stat(packageDist).catch(() => null);
+    if (stat?.isDirectory()) {
+      artifacts.push({ label: `packages/${entry.name}/dist`, root: packageDist });
+    }
+  }
+
+  const hash = createHash("sha256");
+  for (const artifact of artifacts) {
+    hash.update(`\0${artifact.label}\0${await hashDirectory(artifact.root)}`);
+  }
+  return hash.digest("hex");
+}
+
+async function buildMatrixCliArtifacts(repoRoot: string): Promise<void> {
+  for (const args of [
+    ["--import", "tsx", "scripts/bundled-plugin-assets.mts", "--phase", "build"],
+    ["--import", "tsx", "scripts/tsdown-build.mts", "--no-clean"],
+    ["scripts/runtime-postbuild.mjs"],
+  ]) {
+    const { stderr, stdout } = await execFileAsync(process.execPath, args, {
+      cwd: repoRoot,
+      encoding: "utf8",
+      env: {
+        ...process.env,
+        OPENCLAW_BUILD_ALL_NO_PNPM: "1",
+        OPENCLAW_RUN_NODE_SKIP_DTS_BUILD: "1",
+      },
+      maxBuffer: 8 * 1024 * 1024,
+      timeout: 10 * 60 * 1_000,
+    });
+    const output = `${stdout}\n${stderr}`.trim();
+    if (output) {
+      console.log(output);
+    }
+  }
+}
+
+function expectedEngagement(mode: CodeModeMatrixMode, engaged: boolean | undefined): boolean {
+  if (mode === "auto") {
+    return typeof engaged === "boolean";
+  }
+  return engaged === (mode === "code");
+}
+
+function classifyProviderFailure(text: string): CellFailureCategory | null {
+  if (
+    /\b402\b|billing|credits? (?:depleted|exhausted|insufficient)|payment required/iu.test(text)
+  ) {
+    return "provider_billing";
+  }
+  if (/\b401\b|\b403\b|unauthorized|forbidden|invalid (?:api )?key|authentication/iu.test(text)) {
+    return "provider_auth";
+  }
+  if (
+    /connection refused|connect timeout|fetch failed|network|socket|stream.*(?:closed|ended)|http 5\d\d/iu.test(
+      text,
+    )
+  ) {
+    return "provider_transport";
+  }
+  return null;
+}
+
+export function classifyCodeModeMatrixCell(params: {
+  diagnostics: string;
+  effectPassed: boolean;
+  envelope: Readonly<AgentExecEnvelope>;
+  expected: string;
+  mode: CodeModeMatrixMode;
+  model: string;
+  stdoutContractValid?: boolean;
+  task: CodeModeMatrixTask;
+}): {
+  failureCategory: CellFailureCategory | null;
+  oracle: CodeModeMatrixCellResult["oracle"];
+  passed: boolean;
+} {
+  const engagement = expectedEngagement(params.mode, params.envelope.codeModeEngaged);
+  const answer = params.envelope.final.trim() === params.expected;
+  const effect = params.effectPassed;
+  const separator = params.model.indexOf("/");
+  const requestedProvider = params.model.slice(0, separator);
+  const requestedModel = params.model.slice(separator + 1);
+  const identity =
+    params.envelope.provider === requestedProvider && params.envelope.model === requestedModel;
+  const outerToolExecution = (params.envelope.toolSummary?.calls ?? 0) > 0;
+  // Direct and auto evaluate the model-visible outer tool surface. Forced Code
+  // Mode additionally proves that the exec cell reached a nested catalog tool.
+  const toolExecution =
+    outerToolExecution && (params.mode !== "code" || (params.envelope.bridgeCalls?.call ?? 0) > 0);
+  const oracle = { answer, effect, engagement, identity, toolExecution };
+  if (params.stdoutContractValid === false) {
+    return { failureCategory: "harness_error", oracle, passed: false };
+  }
+  if (params.envelope.status === "timeout") {
+    return { failureCategory: "timeout", oracle, passed: false };
+  }
+  if (!params.envelope.ok) {
+    const providerFailure = classifyProviderFailure(
+      `${params.envelope.error?.message ?? ""}\n${params.diagnostics}`,
+    );
+    if (providerFailure) {
+      return { failureCategory: providerFailure, oracle, passed: false };
+    }
+    return { failureCategory: "agent_error", oracle, passed: false };
+  }
+  if (!identity) {
+    return { failureCategory: "model_mismatch", oracle, passed: false };
+  }
+  if (!engagement) {
+    return { failureCategory: "activation", oracle, passed: false };
+  }
+  if (!toolExecution) {
+    return { failureCategory: "tool_execution", oracle, passed: false };
+  }
+  if (!effect) {
+    return { failureCategory: "effect_mismatch", oracle, passed: false };
+  }
+  if (!answer) {
+    return { failureCategory: "answer_mismatch", oracle, passed: false };
+  }
+  return { failureCategory: null, oracle, passed: true };
+}
+
+function parseAgentExecOutput(stdout: string): {
+  envelope: AgentExecEnvelope;
+  trailing: string;
+} {
+  const value = stdout.trimStart();
+  if (!value) {
+    throw new Error("agent exec produced no JSON envelope");
+  }
+  if (value[0] !== "{") {
+    throw new Error("agent exec stdout did not begin with a JSON envelope");
+  }
+  let depth = 0;
+  let escaped = false;
+  let inString = false;
+  for (let index = 0; index < value.length; index += 1) {
+    const character = value[index];
+    if (inString) {
+      if (escaped) {
+        escaped = false;
+      } else if (character === "\\") {
+        escaped = true;
+      } else if (character === '"') {
+        inString = false;
+      }
+      continue;
+    }
+    if (character === '"') {
+      inString = true;
+    } else if (character === "{") {
+      depth += 1;
+    } else if (character === "}") {
+      depth -= 1;
+      if (depth === 0) {
+        const envelope = JSON.parse(value.slice(0, index + 1)) as AgentExecEnvelope;
+        return { envelope, trailing: value.slice(index + 1).trim() };
+      }
+    }
+  }
+  throw new Error("agent exec produced an incomplete JSON envelope");
+}
+
+async function pathIsDirectory(value: string): Promise<boolean> {
+  return await fs
+    .stat(value)
+    .then((stats) => stats.isDirectory())
+    .catch(() => false);
+}
+
+async function cloneTreeWithHardlinks(source: string, destination: string): Promise<void> {
+  await fs.mkdir(destination, { recursive: true });
+  for (const entry of await fs.readdir(source, { withFileTypes: true })) {
+    const sourcePath = path.join(source, entry.name);
+    const destinationPath = path.join(destination, entry.name);
+    if (entry.isDirectory()) {
+      await cloneTreeWithHardlinks(sourcePath, destinationPath);
+    } else if (entry.isSymbolicLink()) {
+      await fs.symlink(await fs.readlink(sourcePath), destinationPath);
+    } else {
+      try {
+        await fs.link(sourcePath, destinationPath);
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code !== "EXDEV") {
+          throw error;
+        }
+        await fs.copyFile(sourcePath, destinationPath);
+      }
+    }
+  }
+}
+
+async function prepareRuntimeEntrypoint(
+  repoRoot: string,
+  runtimeRoot: string,
+): Promise<MatrixRuntimeEntrypoint> {
+  const entrypoint = path.join(repoRoot, "dist", "entry.js");
+  try {
+    await fs.access(entrypoint);
+  } catch (error) {
+    throw new Error("dist/entry.js is missing; run pnpm build before the matrix", { cause: error });
+  }
+
+  const nodeModules = path.join(repoRoot, "node_modules");
+  const physicalNodeModules = await fs.realpath(nodeModules);
+  if (physicalNodeModules === path.resolve(nodeModules)) {
+    return { args: [entrypoint], cwd: repoRoot };
+  }
+
+  const overlayDist = path.join(runtimeRoot, "dist");
+  const overlayNodeModules = path.join(runtimeRoot, "node_modules");
+  await cloneTreeWithHardlinks(path.join(repoRoot, "dist"), overlayDist);
+  await fs.mkdir(overlayNodeModules);
+  await fs.copyFile(path.join(repoRoot, "package.json"), path.join(runtimeRoot, "package.json"));
+
+  const entries = await fs.readdir(physicalNodeModules, { withFileTypes: true });
+  for (const entry of entries) {
+    if (entry.name.startsWith(".") || entry.name === "@openclaw") {
+      continue;
+    }
+    await fs.symlink(
+      path.join(physicalNodeModules, entry.name),
+      path.join(overlayNodeModules, entry.name),
+      process.platform === "win32" ? "junction" : "dir",
+    );
+  }
+
+  const overlayOpenClaw = path.join(overlayNodeModules, "@openclaw");
+  const physicalOpenClaw = path.join(physicalNodeModules, "@openclaw");
+  await fs.mkdir(overlayOpenClaw);
+  for (const entry of await fs.readdir(physicalOpenClaw, { withFileTypes: true })) {
+    const worktreePackage = path.join(repoRoot, "packages", entry.name);
+    const target = (await pathIsDirectory(path.join(worktreePackage, "dist")))
+      ? worktreePackage
+      : path.join(physicalOpenClaw, entry.name);
+    await fs.symlink(
+      target,
+      path.join(overlayOpenClaw, entry.name),
+      process.platform === "win32" ? "junction" : "dir",
+    );
+  }
+
+  return {
+    args: [path.join(runtimeRoot, "dist", "entry.js")],
+    cwd: runtimeRoot,
+  };
+}
+
+export function buildCodeModeMatrixAgentEnv(
+  model: string,
+  runtimeCwd: string,
+  baseEnv: NodeJS.ProcessEnv = process.env,
+): NodeJS.ProcessEnv {
+  const env: NodeJS.ProcessEnv = {
+    ...baseEnv,
+    NODE_DISABLE_COMPILE_CACHE: "1",
+    OPENCLAW_BUNDLED_PLUGINS_DIR: path.join(runtimeCwd, "dist", "extensions"),
+  };
+  // The local Ollama provider uses a non-secret opt-in marker. Keep cloud and
+  // custom credentials caller-owned, but make the local acceptance path work.
+  if (model.startsWith("ollama/") && !env.OLLAMA_API_KEY) {
+    env.OLLAMA_API_KEY = "ollama-local";
+  }
+  delete env.NODE_COMPILE_CACHE;
+  return env;
+}
+
+async function executeAgentExec(params: {
+  fixture: MatrixTaskFixture;
+  matrix: RunCellParams;
+  stateDir: string;
+  workspace: string;
+}): Promise<{
+  diagnostics: string;
+  envelope: AgentExecEnvelope;
+  stdoutContractValid: boolean;
+}> {
+  const runtime = params.matrix.runtime;
+  if (!runtime) {
+    throw new Error("matrix runtime entrypoint was not prepared");
+  }
+  const args = [
+    ...runtime.args,
+    "agent",
+    "exec",
+    params.fixture.prompt,
+    "--cwd",
+    params.workspace,
+    "--state-dir",
+    params.stateDir,
+    "--model",
+    params.matrix.cell.model,
+    "--code-mode",
+    params.matrix.cell.mode,
+    "--local-model-lean",
+    "--thinking",
+    params.matrix.thinking,
+    "--timeout",
+    String(params.matrix.timeoutSeconds),
+    "--json",
+  ];
+  try {
+    const env = buildCodeModeMatrixAgentEnv(params.matrix.cell.model, runtime.cwd);
+    const { stdout, stderr } = await execFileAsync(process.execPath, args, {
+      cwd: runtime.cwd,
+      encoding: "utf8",
+      env,
+      maxBuffer: 4 * 1024 * 1024,
+      timeout: (params.matrix.timeoutSeconds + 30) * 1_000,
+      signal: params.matrix.abortSignal,
+    });
+    const parsed = parseAgentExecOutput(stdout);
+    return {
+      diagnostics:
+        `${stderr}\n${parsed.trailing ? `unexpected stdout after JSON: ${parsed.trailing}` : ""}`
+          .trim()
+          .slice(-MAX_DIAGNOSTIC_CHARS),
+      envelope: parsed.envelope,
+      stdoutContractValid: parsed.trailing.length === 0,
+    };
+  } catch (error) {
+    const commandError = error as Error & {
+      code?: string;
+      killed?: boolean;
+      stderr?: string;
+      stdout?: string;
+    };
+    if (commandError.killed || commandError.code === "ETIMEDOUT") {
+      return {
+        diagnostics: previewForDevToolLog(commandError.stderr ?? commandError.message, 2_000),
+        envelope: {
+          ok: false,
+          status: "timeout",
+          final: "",
+          payloads: [],
+          model: null,
+          provider: null,
+          sessionId: "",
+          error: { kind: "timeout", message: "agent exec process deadline elapsed" },
+        },
+        stdoutContractValid: true,
+      };
+    }
+    if (commandError.stdout?.trim()) {
+      const parsed = parseAgentExecOutput(commandError.stdout);
+      return {
+        diagnostics:
+          `${commandError.stderr ?? ""}\n${parsed.trailing ? `unexpected stdout after JSON: ${parsed.trailing}` : ""}`
+            .trim()
+            .slice(-MAX_DIAGNOSTIC_CHARS),
+        envelope: parsed.envelope,
+        stdoutContractValid: parsed.trailing.length === 0,
+      };
+    }
+    throw error;
+  }
+}
+
+async function runMatrixCell(params: RunCellParams): Promise<CodeModeMatrixCellResult> {
+  if (isGatewayTask(params.cell.task)) {
+    const { runGatewayMatrixCell } = await import("./lib/code-mode-matrix-gateway.ts");
+    return await runGatewayMatrixCell({
+      ...params,
+      cell: { ...params.cell, task: params.cell.task },
+    });
+  }
+  const retainedRoot = path.join(params.outputDir, "state", params.cell.id);
+  if (params.keepState) {
+    await fs.rm(retainedRoot, { force: true, recursive: true });
+  }
+  const root = params.keepState
+    ? retainedRoot
+    : await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-code-mode-matrix-"));
+  const stateDir = path.join(root, "state");
+  const workspace = path.join(root, "workspace");
+  await fs.mkdir(stateDir, { recursive: true });
+  const fixture = await prepareTaskFixture(workspace, params.cell);
+  const startedAt = Date.now();
+  try {
+    const command = await executeAgentExec({
+      fixture,
+      matrix: params,
+      stateDir,
+      workspace,
+    });
+    const effectPassed = fixture.resultPath
+      ? (await fs.readFile(fixture.resultPath, "utf8").catch(() => "")).trim() === fixture.expected
+      : true;
+    const diagnosticText = command.diagnostics;
+    const classification = classifyCodeModeMatrixCell({
+      diagnostics: diagnosticText,
+      effectPassed,
+      envelope: command.envelope,
+      expected: fixture.expected,
+      mode: params.cell.mode,
+      model: params.cell.model,
+      stdoutContractValid: command.stdoutContractValid,
+      task: params.cell.task,
+    });
+    return {
+      ...(command.envelope.assistantTurns !== undefined
+        ? { assistantTurns: command.envelope.assistantTurns }
+        : {}),
+      ...(command.envelope.bridgeCalls ? { bridgeCalls: command.envelope.bridgeCalls } : {}),
+      buildSha256: params.buildSha256,
+      codeModeEngaged: command.envelope.codeModeEngaged ?? null,
+      ...(command.envelope.costUsd !== undefined ? { costUsd: command.envelope.costUsd } : {}),
+      ...(diagnosticText ? { diagnostics: diagnosticText } : {}),
+      elapsedMs: Date.now() - startedAt,
+      ...(command.envelope.error ? { error: command.envelope.error } : {}),
+      expected: fixture.expected,
+      failureCategory: classification.failureCategory,
+      final: command.envelope.final,
+      gitSha: params.gitSha,
+      id: params.cell.id,
+      mode: params.cell.mode,
+      model: params.cell.model,
+      observedModel: command.envelope.model,
+      observedProvider: command.envelope.provider,
+      oracle: classification.oracle,
+      passed: classification.passed,
+      repetition: params.cell.repetition,
+      sourceDirty: params.sourceDirty,
+      sourcePatchSha256: params.sourcePatchSha256,
+      status: command.envelope.status,
+      task: params.cell.task,
+      timestamp: new Date().toISOString(),
+      ...(command.envelope.toolSummary ? { toolSummary: command.envelope.toolSummary } : {}),
+      ...(command.envelope.usage ? { usage: command.envelope.usage } : {}),
+    };
+  } finally {
+    if (!params.keepState) {
+      await fs.rm(root, { force: true, recursive: true });
+    }
+  }
+}
+
+function harnessFailureResult(
+  cell: MatrixCell,
+  provenance: Pick<RunCellParams, "buildSha256" | "gitSha" | "sourceDirty" | "sourcePatchSha256">,
+  elapsedMs: number,
+  error: unknown,
+): CodeModeMatrixCellResult {
+  const message = previewForDevToolLog(
+    error instanceof Error ? error.message : String(error),
+    2_000,
+  );
+  return {
+    buildSha256: provenance.buildSha256,
+    codeModeEngaged: null,
+    diagnostics: message,
+    elapsedMs,
+    error: { kind: "harness_error", message },
+    expected: isGatewayTask(cell.task) ? "Gateway task result" : taskFixture(cell).expected,
+    failureCategory: "harness_error",
+    final: "",
+    gitSha: provenance.gitSha,
+    id: cell.id,
+    mode: cell.mode,
+    model: cell.model,
+    observedModel: null,
+    observedProvider: null,
+    oracle: {
+      answer: false,
+      effect: false,
+      engagement: false,
+      identity: false,
+      toolExecution: false,
+    },
+    passed: false,
+    repetition: cell.repetition,
+    sourceDirty: provenance.sourceDirty,
+    sourcePatchSha256: provenance.sourcePatchSha256,
+    status: "error",
+    task: cell.task,
+    timestamp: new Date().toISOString(),
+  };
+}
+
+function summarizeMetric(values: (number | undefined)[]) {
+  const samples = values
+    .filter((value): value is number => value !== undefined)
+    .toSorted((a, b) => a - b);
+  return {
+    samples: samples.length,
+    total: samples.length > 0 ? samples.reduce((total, value) => total + value, 0) : null,
+    p50: samples[Math.floor(samples.length / 2)] ?? null,
+  };
+}
+
+function summarizeResults(results: CodeModeMatrixCellResult[]) {
+  const groups = new Map<
+    string,
+    {
+      codeModeEngaged: number;
+      failed: number;
+      failures: Record<string, number>;
+      firstPassPassed: boolean;
+      passed: number;
+      total: number;
+      wallMs: number[];
+      results: CodeModeMatrixCellResult[];
+    }
+  >();
+  for (const result of results) {
+    const key = `${result.model}\0${result.mode}\0${result.task}`;
+    const group = groups.get(key) ?? {
+      codeModeEngaged: 0,
+      failed: 0,
+      failures: {},
+      firstPassPassed: false,
+      passed: 0,
+      total: 0,
+      wallMs: [],
+      results: [],
+    };
+    group.results.push(result);
+    group.total += 1;
+    group.wallMs.push(result.elapsedMs);
+    if (result.passed) {
+      group.passed += 1;
+      if (result.repetition === 1) {
+        group.firstPassPassed = true;
+      }
+    } else {
+      group.failed += 1;
+      const category = result.failureCategory ?? "unknown";
+      group.failures[category] = (group.failures[category] ?? 0) + 1;
+    }
+    if (result.codeModeEngaged === true) {
+      group.codeModeEngaged += 1;
+    }
+    groups.set(key, group);
+  }
+  return [...groups.entries()].map(([key, group]) => {
+    const [model, mode, task] = key.split("\0");
+    const sortedWallMs = group.wallMs.toSorted((a, b) => a - b);
+    const summary = {
+      codeModeEngaged: group.codeModeEngaged,
+      failed: group.failed,
+      failures: group.failures,
+      firstPassPassed: group.firstPassPassed,
+      mode,
+      model,
+      eventualPassed: group.passed > 0,
+      p50WallMs: sortedWallMs[Math.floor(sortedWallMs.length / 2)] ?? 0,
+      metrics: {
+        assistantTurns: summarizeMetric(group.results.map((result) => result.assistantTurns)),
+        outerToolCalls: summarizeMetric(
+          group.results.map((result) => result.toolSummary?.calls ?? result.gateway?.outerCalls),
+        ),
+        bridgeSearchCalls: summarizeMetric(
+          group.results.map((result) => result.bridgeCalls?.search),
+        ),
+        bridgeDescribeCalls: summarizeMetric(
+          group.results.map((result) => result.bridgeCalls?.describe),
+        ),
+        bridgeToolCalls: summarizeMetric(group.results.map((result) => result.bridgeCalls?.call)),
+        costUsd: summarizeMetric(group.results.map((result) => result.costUsd)),
+        gatewayUpstreamCalls: summarizeMetric(
+          group.results.map((result) => result.gateway?.upstreamCalls),
+        ),
+        gatewayTaskElapsedMs: summarizeMetric(
+          group.results.map((result) => result.gateway?.taskElapsedMs),
+        ),
+        inputTokens: summarizeMetric(group.results.map((result) => result.usage?.input)),
+        outputTokens: summarizeMetric(group.results.map((result) => result.usage?.output)),
+      },
+      passRate: group.total === 0 ? 0 : group.passed / group.total,
+      passed: group.passed,
+      task,
+      total: group.total,
+    };
+    return group.results.some((result) => result.workload)
+      ? Object.assign(summary, { gatewayOutcomes: summarizeGatewayMatrixOutcomes(group.results) })
+      : summary;
+  });
+}
+
+async function writeJson(filePath: string, value: unknown): Promise<void> {
+  await fs.mkdir(path.dirname(filePath), { recursive: true });
+  await fs.writeFile(
+    filePath,
+    `${JSON.stringify(redactJsonValueForDevToolLog(value), null, 2)}\n`,
+    "utf8",
+  );
+}
+
+function evidenceStatus(result: CodeModeMatrixCellResult): QaEvidenceStatus {
+  if (result.passed) {
+    return "pass";
+  }
+  if (result.failureCategory === "provider_auth" || result.failureCategory === "provider_billing") {
+    return "blocked";
+  }
+  return "fail";
+}
+
+function observedModelRef(result: CodeModeMatrixCellResult): string {
+  if (result.observedProvider && result.observedModel) {
+    return `${result.observedProvider}/${result.observedModel}`;
+  }
+  return result.model;
+}
+
+function buildCodeModeMatrixEvidence(params: {
+  generatedAt: string;
+  repoRoot: string;
+  results: readonly CodeModeMatrixCellResult[];
+}): QaEvidenceSummaryJson {
+  const artifactPaths = [
+    { kind: "manifest", path: "manifest.json" },
+    { kind: "summary", path: "summary.json" },
+    { kind: "results", path: "results.jsonl" },
+  ];
+  const entries = params.results.flatMap((result) => {
+    const summary = buildScriptEvidenceSummary({
+      artifactPaths,
+      evidenceMode: "full",
+      generatedAt: result.timestamp,
+      packageSource: { kind: "source-checkout", sha: result.gitSha },
+      primaryModel: observedModelRef(result),
+      providerMode: "live-frontier",
+      repoRoot: params.repoRoot,
+      runner: "code-mode-model-matrix",
+      targets: [
+        {
+          id: result.id,
+          title: `${result.model} ${result.mode} ${result.task} repetition ${result.repetition}`,
+          sourcePath: SOURCE_PATH,
+        },
+      ],
+      results: [
+        {
+          id: result.id,
+          status: evidenceStatus(result),
+          durationMs: Math.max(1, result.elapsedMs),
+          failureMessage: result.failureCategory ?? undefined,
+        },
+      ],
+    });
+    const entry = summary.entries[0];
+    if (!entry) {
+      return [];
+    }
+    if (entry.result.failure && result.failureCategory) {
+      entry.result.failure.class = result.failureCategory;
+    }
+    return [entry];
+  });
+  const base = buildScriptEvidenceSummary({
+    artifactPaths,
+    evidenceMode: "full",
+    generatedAt: params.generatedAt,
+    packageSource: { kind: "source-checkout" },
+    primaryModel: "unknown/unknown",
+    providerMode: "live-frontier",
+    repoRoot: params.repoRoot,
+    runner: "code-mode-model-matrix",
+    targets: [],
+    results: [],
+  });
+  return validateQaEvidenceSummaryJson({
+    ...base,
+    entries,
+  });
+}
+
+export async function runCodeModeModelMatrix(
+  options: CodeModeMatrixOptions,
+  deps: MatrixRunDependencies = {},
+): Promise<{ exitCode: number; outputDir: string; summary: unknown }> {
+  const now = deps.now?.() ?? new Date();
+  const outputDir = resolveCodeModeMatrixOutputDir(options.repoRoot, options.outputDir, now);
+  const runtimeRepoRoot = options.runtimeDir ?? options.repoRoot;
+  const sourceIdentity = deps.readSourceIdentity
+    ? await deps.readSourceIdentity(runtimeRepoRoot)
+    : deps.readGitSha
+      ? {
+          gitSha: await deps.readGitSha(runtimeRepoRoot),
+          sourceDirty: false,
+          sourcePatchSha256: null,
+        }
+      : await readSourceIdentity(runtimeRepoRoot);
+  if (options.runtimeDir && sourceIdentity.sourceDirty) {
+    throw new Error("--runtime-dir must identify a clean committed checkout.");
+  }
+  const cells = buildCells(options);
+  await assertOutputOutsideGitMetadata(options.repoRoot, outputDir);
+  if (!options.dryRun && !options.runtimeDir) {
+    await (deps.buildCliArtifacts ?? buildMatrixCliArtifacts)(options.repoRoot);
+  }
+  if (!options.dryRun && options.runtimeDir) {
+    // Current source can be clean after reverting edits that produced the retained artifacts.
+    for (const stamp of [".buildstamp", ".runtime-postbuildstamp"]) {
+      const value: unknown = JSON.parse(
+        await fs.readFile(path.join(runtimeRepoRoot, "dist", stamp), "utf8"),
+      );
+      if (
+        !value ||
+        typeof value !== "object" ||
+        !("head" in value) ||
+        value.head !== sourceIdentity.gitSha ||
+        !("inputsClean" in value) ||
+        value.inputsClean !== true
+      ) {
+        throw new Error(
+          `Frozen runtime ${stamp} must match its clean committed source and record clean build inputs. Choose a revision with provenance-capable stamp writers and run pnpm build; rebuilding older source without those writers cannot satisfy this check.`,
+        );
+      }
+    }
+  }
+  // Build first so its output set is complete, then reserve evidence storage
+  // before hashing. Dry runs also write evidence, so every run needs isolation.
+  await assertOutputOutsideRuntimeArtifacts(options.repoRoot, outputDir);
+  if (options.runtimeDir) {
+    await assertOutputOutsideRuntimeArtifacts(runtimeRepoRoot, outputDir);
+  }
+  await reserveCodeModeMatrixOutputDir(options.repoRoot, outputDir);
+  const buildSha256 = options.dryRun
+    ? null
+    : await (deps.readBuildSha256 ?? hashRuntimeArtifacts)(runtimeRepoRoot);
+  const launch: QaEvidenceIdentity = {
+    source: {
+      ref: sourceIdentity.gitSha,
+      integrity: `git:${sourceIdentity.gitSha}${sourceIdentity.sourcePatchSha256 ? `+sha256:${sourceIdentity.sourcePatchSha256}` : ""}`,
+    },
+    runtime: captureQaEvidenceRuntimeIdentity(),
+    package: null,
+    protocol: null,
+    accountRef: null,
+    proofClass: null,
+  };
+  const invocation = createQaEvidenceInvocation({
+    scenarios: cells.map((cell) => ({ id: cell.id, execution: { kind: "script" } })),
+    channel: null,
+    launch,
+  });
+  const writeEvidence = async (generatedAt: string) =>
+    await writeJson(
+      path.join(outputDir, QA_EVIDENCE_FILENAME),
+      invocation.snapshot({ generatedAt, evidenceMode: "full" }),
+    );
+  const manifest = {
+    schemaVersion: MATRIX_SCHEMA_VERSION,
+    generatedAt: now.toISOString(),
+    source: SOURCE_PATH,
+    ...(options.runtimeDir ? { harness: await readSourceIdentity(options.repoRoot) } : {}),
+    ...(options.runtimeDir ? { runtimeDir: runtimeRepoRoot } : {}),
+    ...sourceIdentity,
+    buildSha256,
+    models: options.models,
+    modes: options.modes,
+    tasks: options.tasks,
+    repetitions: options.repetitions,
+    timeoutSeconds: options.timeoutSeconds,
+    thinking: options.thinking,
+    keepState: options.keepState,
+    cells: cells.map((cell) => cell.id),
+  };
+  await writeJson(path.join(outputDir, "manifest.json"), manifest);
+  // Persist the complete schedule before any cell starts. An interrupted or dry
+  // run retains null selections instead of inventing successful observations.
+  await writeEvidence(now.toISOString());
+  if (options.dryRun) {
+    const summary = { status: "dry-run", total: cells.length };
+    await writeJson(path.join(outputDir, "summary.json"), summary);
+    return { exitCode: 0, outputDir, summary };
+  }
+
+  const runtimeRoot = deps.runCell
+    ? undefined
+    : await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-code-mode-runtime-"));
+  const abortController = new AbortController();
+  const interrupt = () => abortController.abort(new Error("Code Mode matrix interrupted"));
+  process.once("SIGINT", interrupt);
+  process.once("SIGTERM", interrupt);
+  try {
+    const runtime = runtimeRoot
+      ? await prepareRuntimeEntrypoint(runtimeRepoRoot, runtimeRoot)
+      : undefined;
+    const results: CodeModeMatrixCellResult[] = [];
+    const resultsPath = path.join(outputDir, "results.jsonl");
+    await fs.writeFile(resultsPath, "", "utf8");
+    const executeCell = deps.runCell ?? runMatrixCell;
+    for (const [index, cell] of cells.entries()) {
+      abortController.signal.throwIfAborted();
+      const workload = isGatewayTask(cell.task)
+        ? (await import("./lib/code-mode-matrix-gateway.ts")).createGatewayMatrixWorkload(
+            cell.task,
+            cell.repetition,
+            options.thinking,
+            options.timeoutSeconds,
+          )
+        : undefined;
+      // Repetitions are independent scheduled cells, not retries whose eventual
+      // success could hide an earlier failure.
+      const occurrenceId = invocation.begin(index, null);
+      let result: CodeModeMatrixCellResult;
+      const cellStartedAt = Date.now();
+      try {
+        result = await executeCell({
+          abortSignal: abortController.signal,
+          buildSha256: buildSha256 ?? "dry-run",
+          cell,
+          gitSha: sourceIdentity.gitSha,
+          keepState: options.keepState,
+          outputDir,
+          repoRoot: runtimeRepoRoot,
+          runtime,
+          sourceDirty: sourceIdentity.sourceDirty,
+          sourcePatchSha256: sourceIdentity.sourcePatchSha256,
+          thinking: options.thinking,
+          timeoutSeconds: options.timeoutSeconds,
+        });
+      } catch (error) {
+        result = harnessFailureResult(
+          cell,
+          {
+            buildSha256: buildSha256 ?? "dry-run",
+            ...sourceIdentity,
+          },
+          Date.now() - cellStartedAt,
+          error,
+        );
+      }
+      if (workload) {
+        result.workload = workload;
+      }
+      result.evidenceOccurrenceId = occurrenceId;
+      const artifactPath = path.posix.join("observations", `${occurrenceId}.json`);
+      const artifactBytes = `${JSON.stringify(redactJsonValueForDevToolLog({ result, launch, buildSha256 }), null, 2)}\n`;
+      await fs.mkdir(path.join(outputDir, "observations"), { recursive: true });
+      await fs.writeFile(path.join(outputDir, artifactPath), artifactBytes, {
+        flag: "wx",
+        mode: 0o600,
+      });
+      const artifact = {
+        kind: "matrix-observation",
+        path: artifactPath,
+        source: "code-mode-model-matrix",
+        sha256: createHash("sha256").update(artifactBytes).digest("hex"),
+      };
+      // The envelope observes provider/model responses, not a target runtime's
+      // package, protocol, account, or proof class. Keep this receipt prepared-only.
+      invocation.complete(occurrenceId, {
+        status: evidenceStatus(result),
+        entries: buildCodeModeMatrixEvidence({
+          generatedAt: result.timestamp,
+          repoRoot: options.repoRoot,
+          results: [result],
+        }).entries.map((entry) =>
+          Object.assign({}, entry, {
+            execution: entry.execution
+              ? {
+                  ...entry.execution,
+                  artifacts: [
+                    ...entry.execution.artifacts,
+                    {
+                      kind: artifact.kind,
+                      path: artifact.path,
+                      source: artifact.source,
+                    },
+                  ],
+                }
+              : undefined,
+          }),
+        ),
+        receipts: [
+          { id: `${occurrenceId}:prepared`, phase: "prepared", identity: launch, artifact },
+        ],
+      });
+      invocation.select(index, occurrenceId);
+      results.push(result);
+      await fs.appendFile(
+        resultsPath,
+        `${JSON.stringify(redactJsonValueForDevToolLog(result))}\n`,
+        "utf8",
+      );
+      await writeEvidence(result.timestamp);
+      const label = result.passed ? "PASS" : `FAIL ${result.failureCategory ?? "unknown"}`;
+      console.log(`[code-mode-matrix] ${label} ${result.id} ${result.elapsedMs}ms`);
+    }
+    abortController.signal.throwIfAborted();
+    if (options.runtimeDir && !deps.runCell) {
+      const finalIdentity = await readSourceIdentity(runtimeRepoRoot);
+      if (finalIdentity.sourceDirty || finalIdentity.gitSha !== sourceIdentity.gitSha) {
+        throw new Error(
+          "Frozen runtime changed during the benchmark; per-cell evidence is retained but cannot establish a fixed-source comparison.",
+        );
+      }
+    }
+
+    const groups = summarizeResults(results);
+    const failed = results.filter((result) => !result.passed).length;
+    const firstPassPassed = groups.filter((group) => group.firstPassPassed).length;
+    const eventualPassed = groups.filter((group) => group.eventualPassed).length;
+    const summary = {
+      schemaVersion: MATRIX_SCHEMA_VERSION,
+      finishedAt: new Date().toISOString(),
+      ...sourceIdentity,
+      buildSha256,
+      counts: {
+        total: results.length,
+        passed: results.length - failed,
+        failed,
+      },
+      groupCounts: {
+        total: groups.length,
+        firstPassPassed,
+        eventualPassed,
+      },
+      ...(results.some((result) => result.workload)
+        ? { gatewayOutcomes: summarizeGatewayMatrixOutcomes(results) }
+        : {}),
+      groups,
+    };
+    await writeJson(path.join(outputDir, "summary.json"), summary);
+    if (options.baselineResults) {
+      const { compareCodeModeMatrixResultsFile } =
+        await import("./lib/code-mode-matrix-comparison.ts");
+      await writeJson(
+        path.join(outputDir, "comparison.json"),
+        await compareCodeModeMatrixResultsFile(options.baselineResults, results),
+      );
+    }
+    await writeEvidence(summary.finishedAt);
+    return {
+      exitCode: failed > 0 && !options.allowFailures ? 1 : 0,
+      outputDir,
+      summary,
+    };
+  } finally {
+    process.off("SIGINT", interrupt);
+    process.off("SIGTERM", interrupt);
+    if (runtimeRoot) {
+      await fs.rm(runtimeRoot, { force: true, recursive: true });
+    }
+  }
+}
+
+async function main(): Promise<void> {
+  try {
+    const options = parseCodeModeMatrixOptions(process.argv.slice(2));
+    const result = await runCodeModeModelMatrix(options);
+    console.log(
+      `[code-mode-matrix] artifacts ${path.relative(options.repoRoot, result.outputDir)}`,
+    );
+    process.exitCode = result.exitCode;
+  } catch (error) {
+    if ((error as { code?: unknown }).code === "HELP") {
+      console.log(error instanceof Error ? error.message : String(error));
+      return;
+    }
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+  }
+}
+
+function isCliEntrypoint(): boolean {
+  const entrypoint = process.argv[1];
+  return Boolean(entrypoint && import.meta.url === pathToFileURL(path.resolve(entrypoint)).href);
+}
+
+if (isCliEntrypoint()) {
+  await main();
+}
diff --git a/scripts/codesign-mac-app.sh b/scripts/codesign-mac-app.sh
new file mode 100644
index 0000000000000000000000000000000000000000..ab9438e5abc1f660e3f4c162ab98f7be530e01bf
--- /dev/null
+++ b/scripts/codesign-mac-app.sh
@@ -0,0 +1,518 @@
+#!/bin/bash
+set -euo pipefail
+
+APP_BUNDLE="dist/OpenClaw.app"
+IDENTITY="${SIGN_IDENTITY:-}"
+SIGNING_VARIANT="${OPENCLAW_MAC_SIGNING_VARIANT:-standard}"
+ELEVATION_IDENTITY="Developer ID Application: OpenClaw Foundation (FWJYW4S8P8)"
+ELEVATION_TEAM_ID="FWJYW4S8P8"
+TIMESTAMP_MODE="${CODESIGN_TIMESTAMP:-auto}"
+CODESIGN_TIMESTAMP_RETRY_ATTEMPTS="${CODESIGN_TIMESTAMP_RETRY_ATTEMPTS:-8}"
+CODESIGN_TIMESTAMP_RETRY_DELAY_SECONDS="${CODESIGN_TIMESTAMP_RETRY_DELAY_SECONDS:-5}"
+DISABLE_LIBRARY_VALIDATION="${DISABLE_LIBRARY_VALIDATION:-0}"
+SKIP_TEAM_ID_CHECK="${SKIP_TEAM_ID_CHECK:-0}"
+ENT_TMP_DIR=""
+
+cleanup() {
+  if [[ -n "$ENT_TMP_DIR" ]]; then
+    rm -rf "$ENT_TMP_DIR"
+  fi
+}
+
+if [[ "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
+  cat <<'HELP'
+Usage: scripts/codesign-mac-app.sh [app-bundle]
+
+Env:
+  SIGN_IDENTITY="Apple Development: Your Name (TEAMID)"
+  OPENCLAW_MAC_SIGNING_VARIANT=standard|elevation-host
+  ALLOW_ADHOC_SIGNING=1
+  CODESIGN_TIMESTAMP=auto|on|off
+  CODESIGN_TIMESTAMP_RETRY_ATTEMPTS=8
+  CODESIGN_TIMESTAMP_RETRY_DELAY_SECONDS=5
+  DISABLE_LIBRARY_VALIDATION=1      # dev-only Sparkle Team ID workaround
+  SKIP_TEAM_ID_CHECK=1              # bypass Team ID audit
+HELP
+  exit 0
+fi
+
+case "$SIGNING_VARIANT" in
+  standard|elevation-host) ;;
+  *)
+    echo "ERROR: Unknown OPENCLAW_MAC_SIGNING_VARIANT value: $SIGNING_VARIANT (use standard|elevation-host)" >&2
+    exit 1
+    ;;
+esac
+
+if [[ "$SIGNING_VARIANT" == "elevation-host" && -z "$IDENTITY" ]]; then
+  IDENTITY="$ELEVATION_IDENTITY"
+fi
+if [[ "$SIGNING_VARIANT" == "elevation-host" && "$DISABLE_LIBRARY_VALIDATION" == "1" ]]; then
+  echo "ERROR: Elevation host signing forbids DISABLE_LIBRARY_VALIDATION=1." >&2
+  exit 1
+fi
+if [[ "$SIGNING_VARIANT" == "elevation-host" && "$SKIP_TEAM_ID_CHECK" == "1" ]]; then
+  echo "ERROR: Elevation host signing forbids SKIP_TEAM_ID_CHECK=1." >&2
+  exit 1
+fi
+
+if [[ "${1:-}" == "--" ]]; then
+  shift
+fi
+if [[ "$#" -gt 0 ]]; then
+  case "$1" in
+    -*) echo "ERROR: Unknown codesign option: $1" >&2; exit 1 ;;
+    *) APP_BUNDLE="$1"; shift ;;
+  esac
+fi
+if [[ "$#" -gt 0 ]]; then
+  echo "ERROR: Unexpected codesign argument: $1" >&2
+  exit 1
+fi
+
+# Match scanner paths and expose symlink roots before any validation or signing.
+while [[ "$APP_BUNDLE" == */ && "$APP_BUNDLE" != "/" ]]; do
+  APP_BUNDLE="${APP_BUNDLE%/}"
+done
+if [ ! -d "$APP_BUNDLE" ]; then
+  echo "App bundle not found: $APP_BUNDLE" >&2
+  exit 1
+fi
+
+# A non-following inventory cannot audit a symlink used as the bundle root.
+if [[ -L "$APP_BUNDLE" ]]; then
+  echo "ERROR: App bundle must not be a symlink: $APP_BUNDLE" >&2
+  exit 1
+fi
+# Freeze the physical policy root now; resolving it after a swap could authorize the replacement.
+APP_MUTATION_ROOT="$(cd -P -- "$APP_BUNDLE" && pwd -P)"
+
+select_identity() {
+  local preferred available first
+
+  # Prefer a Developer ID Application cert.
+  preferred="$(security find-identity -p codesigning -v 2>/dev/null \
+    | awk -F'\"' '/Developer ID Application/ { print $2; exit }')"
+
+  if [ -n "$preferred" ]; then
+    echo "$preferred"
+    return
+  fi
+
+  # Next, try Apple Distribution.
+  preferred="$(security find-identity -p codesigning -v 2>/dev/null \
+    | awk -F'\"' '/Apple Distribution/ { print $2; exit }')"
+  if [ -n "$preferred" ]; then
+    echo "$preferred"
+    return
+  fi
+
+  # Then, try Apple Development.
+  preferred="$(security find-identity -p codesigning -v 2>/dev/null \
+    | awk -F'\"' '/Apple Development/ { print $2; exit }')"
+  if [ -n "$preferred" ]; then
+    echo "$preferred"
+    return
+  fi
+
+  # Fallback to the first valid signing identity.
+  available="$(security find-identity -p codesigning -v 2>/dev/null \
+    | sed -n 's/.*\"\\(.*\\)\"/\\1/p')"
+
+  if [ -n "$available" ]; then
+    first="$(printf '%s\n' "$available" | head -n1)"
+    echo "$first"
+    return
+  fi
+
+  return 1
+}
+
+if [ -z "$IDENTITY" ]; then
+  if ! IDENTITY="$(select_identity)"; then
+    if [[ "${ALLOW_ADHOC_SIGNING:-}" == "1" ]]; then
+      echo "WARN: No signing identity found. Falling back to ad-hoc signing (-)." >&2
+      echo "      !!! WARNING: Ad-hoc signed apps do NOT persist TCC permissions (Accessibility, etc) !!!" >&2
+      echo "      !!! You will need to re-grant permissions every time you restart the app.         !!!" >&2
+      IDENTITY="-"
+    else
+      echo "ERROR: No signing identity found. Set SIGN_IDENTITY to a valid codesigning certificate." >&2
+      echo "       Alternatively, set ALLOW_ADHOC_SIGNING=1 to fallback to ad-hoc signing (limitations apply)." >&2
+      exit 1
+    fi
+  fi
+fi
+
+echo "Using signing identity: $IDENTITY"
+if [[ "$IDENTITY" == "-" ]]; then
+  cat <<'WARN' >&2
+
+================================================================================
+!!! AD-HOC SIGNING IN USE - PERMISSIONS WILL NOT STICK (macOS RESTRICTION) !!!
+
+macOS ties permissions to the code signature, bundle ID, and app path.
+Ad-hoc signing generates a new signature every build, so macOS treats the app
+as a different binary and will forget permissions (prompts may vanish).
+
+For correct permission behavior you MUST sign with a real Apple Development or
+Developer ID certificate.
+
+If prompts disappear: remove the app entry in System Settings -> Privacy & Security,
+relaunch the app, and re-grant. Some permissions only reappear after a full
+macOS restart.
+================================================================================
+
+WARN
+fi
+
+timestamp_arg="--timestamp=none"
+case "$TIMESTAMP_MODE" in
+  1|on|yes|true)
+    timestamp_arg="--timestamp"
+    ;;
+  0|off|no|false)
+    timestamp_arg="--timestamp=none"
+    ;;
+  auto)
+    identity_name="$IDENTITY"
+    if [[ "$IDENTITY" =~ ^[[:xdigit:]]{40}$ ]]; then
+      # A hash selector conceals the certificate class required for notarization timestamps.
+      identity_name="$(security find-identity -p codesigning -v 2>/dev/null \
+        | awk -v hash="$IDENTITY" 'toupper($2) == toupper(hash) { print }')"
+    fi
+    if [[ "$identity_name" == *"Developer ID Application"* ]]; then
+      timestamp_arg="--timestamp"
+    fi
+    ;;
+  *)
+    echo "ERROR: Unknown CODESIGN_TIMESTAMP value: $TIMESTAMP_MODE (use auto|on|off)" >&2
+    exit 1
+    ;;
+esac
+if [[ "$IDENTITY" == "-" ]]; then
+  timestamp_arg="--timestamp=none"
+fi
+
+if [[ ! "$CODESIGN_TIMESTAMP_RETRY_ATTEMPTS" =~ ^[1-9][0-9]*$ ]]; then
+  echo "ERROR: CODESIGN_TIMESTAMP_RETRY_ATTEMPTS must be a positive integer" >&2
+  exit 1
+fi
+if [[ ! "$CODESIGN_TIMESTAMP_RETRY_DELAY_SECONDS" =~ ^[0-9]+$ ]]; then
+  echo "ERROR: CODESIGN_TIMESTAMP_RETRY_DELAY_SECONDS must be a nonnegative integer" >&2
+  exit 1
+fi
+
+ENT_TMP_DIR=$(mktemp -d -t openclaw-entitlements.XXXXXX)
+trap cleanup EXIT
+ENT_TMP_DIR="$(cd -P -- "$ENT_TMP_DIR" && pwd -P)"
+ENT_TMP_APP="$ENT_TMP_DIR/app.plist"
+ENT_TMP_NODE="$ENT_TMP_DIR/node.plist"
+CODESIGN_OUTPUT="$ENT_TMP_DIR/codesign-output"
+NATIVE_INVENTORY="$ENT_TMP_DIR/native-inventory"
+INVENTORY_SCRIPT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/mac-native-inventory.py"
+MUTATION_SCRIPT="${INVENTORY_SCRIPT%/*}/mac-bundle-mutation.py"
+
+options_args=()
+if [[ "$IDENTITY" != "-" ]]; then
+  options_args=("--options" "runtime")
+fi
+timestamp_args=("$timestamp_arg")
+
+if [[ "$SIGNING_VARIANT" == "elevation-host" ]]; then
+  cat > "$ENT_TMP_APP" <<'PLIST'
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict/>
+</plist>
+PLIST
+else
+  cat > "$ENT_TMP_APP" <<'PLIST'
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.automation.apple-events</key>
+    <true/>
+    <key>com.apple.security.device.audio-input</key>
+    <true/>
+    <key>com.apple.security.device.camera</key>
+    <true/>
+    <key>com.apple.security.personal-information.location</key>
+    <true/>
+</dict>
+</plist>
+PLIST
+fi
+
+if [[ "$DISABLE_LIBRARY_VALIDATION" == "1" ]]; then
+  /usr/libexec/PlistBuddy -c "Add :com.apple.security.cs.disable-library-validation bool true" "$ENT_TMP_APP" >/dev/null 2>&1 || \
+    /usr/libexec/PlistBuddy -c "Set :com.apple.security.cs.disable-library-validation true" "$ENT_TMP_APP"
+  echo "Note: disable-library-validation entitlement enabled (DISABLE_LIBRARY_VALIDATION=1)."
+fi
+
+APP_ENTITLEMENTS="$ENT_TMP_APP"
+
+# V8 and bundled standalone JS executables need JIT memory under hardened
+# runtime. All native libraries are re-signed below; library validation stays on.
+cat > "$ENT_TMP_NODE" <<'PLIST'
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+  <key>com.apple.security.cs.allow-jit</key><true/>
+  <key>com.apple.security.cs.allow-unsigned-executable-memory</key><true/>
+</dict></plist>
+PLIST
+
+run_bundle_mutation() {
+  /usr/bin/python3 "$MUTATION_SCRIPT" "$APP_MUTATION_ROOT" "$ENT_TMP_DIR" "$@"
+}
+
+codesign_with_timestamp_retry() {
+  local attempt=1
+  local command_rc
+  local delay
+
+  while true; do
+    : >"$CODESIGN_OUTPUT"
+    command_rc=0
+    run_bundle_mutation codesign "$@" >"$CODESIGN_OUTPUT" 2>&1 || command_rc=$?
+    cat "$CODESIGN_OUTPUT" >&2
+    if [[ "$command_rc" -eq 0 ]]; then
+      return 0
+    fi
+    if [[ "$timestamp_arg" != "--timestamp" ]] ||
+      ! grep -Eiq 'A timestamp was expected but was not found|timestamp service is not available' "$CODESIGN_OUTPUT"
+    then
+      return "$command_rc"
+    fi
+    if [[ "$attempt" -ge "$CODESIGN_TIMESTAMP_RETRY_ATTEMPTS" ]]; then
+      echo "codesign timestamp retry limit reached after $attempt attempts" >&2
+      return "$command_rc"
+    fi
+
+    delay=$((CODESIGN_TIMESTAMP_RETRY_DELAY_SECONDS * attempt))
+    ((delay <= 30)) || delay=30
+    echo "Transient Apple timestamp failure; retrying codesign in ${delay}s (attempt $((attempt + 1))/$CODESIGN_TIMESTAMP_RETRY_ATTEMPTS)" >&2
+    sleep "$delay"
+    attempt=$((attempt + 1))
+  done
+}
+
+sign_item() {
+  local target="$1"
+  local entitlements="$2"
+  codesign_with_timestamp_retry --force ${options_args+"${options_args[@]}"} "${timestamp_args[@]}" --entitlements "$entitlements" --sign "$IDENTITY" "$target"
+}
+
+sign_plain_item() {
+  local target="$1"
+  codesign_with_timestamp_retry --force ${options_args+"${options_args[@]}"} "${timestamp_args[@]}" --sign "$IDENTITY" "$target"
+}
+
+codesign_metadata_value() {
+  local target="$1" key="$2" metadata
+  metadata="$(codesign -dv --verbose=4 "$target" 2>&1)" || {
+    local rc=$?
+    echo "ERROR: Could not read codesign metadata: $target" >&2
+    return "$rc"
+  }
+  # Executable/Identifier can contain filename newlines. The real CodeDirectory
+  # follows Format and resets any injected fields; Authority starts with the leaf.
+  awk -F= -v key="$key" '
+    /^CodeDirectory / { format = previous; value = ""; found = 0 }
+    $1 == key && (!found || key != "Authority") {
+      value = substr($0, length(key) + 2); found = 1
+    }
+    { previous = $0 }
+    END {
+      if (format !~ /^Format=.*Mach-O /) exit 1
+      print value
+    }
+  ' <<<"$metadata" || {
+    echo "ERROR: Native Mach-O signature missing: $target. Rebuild the payload as codesign-compatible native code (thin/fat32); generic signatures are not accepted." >&2
+    return 1
+  }
+}
+
+team_id_for() {
+  codesign_metadata_value "$1" TeamIdentifier
+}
+
+verify_native_signatures() {
+  local expected
+  expected="$(team_id_for "$APP_BUNDLE")"
+  # A Team ID opt-out never permits generic signatures on native candidates.
+  if [[ "$SKIP_TEAM_ID_CHECK" == "1" ]]; then
+    echo "Note: skipping Team ID comparison (SKIP_TEAM_ID_CHECK=1); native format checks remain enabled."
+  elif [[ -z "$expected" ]]; then
+    echo "ERROR: TeamIdentifier missing on app bundle." >&2
+    return 1
+  fi
+
+  local mismatches=() kind f team
+  while IFS= read -r -d '' kind && IFS= read -r -d '' f; do
+    [[ "$kind" == "executable" || "$kind" == "library" ]] || continue
+    team="$(team_id_for "$f")"
+    if [[ "$SKIP_TEAM_ID_CHECK" != "1" && ( -z "$team" || "$team" != "$expected" ) ]]; then
+      mismatches+=("$f (TeamIdentifier=${team:-missing})")
+    fi
+  done < "$NATIVE_INVENTORY"
+
+  if [[ "${#mismatches[@]}" -gt 0 ]]; then
+    echo "ERROR: Team ID mismatch detected (expected: $expected)"
+    for entry in "${mismatches[@]}"; do
+      echo " - $entry"
+    done
+    echo "Hint: re-sign embedded frameworks or set DISABLE_LIBRARY_VALIDATION=1 for dev builds."
+    exit 1
+  fi
+}
+
+assert_no_elevation_cua_driver() {
+  [[ "$SIGNING_VARIANT" == "elevation-host" ]] || return 0
+  local cua_driver="$APP_BUNDLE/Contents/Resources/cua-driver"
+  if [[ -e "$cua_driver" || -L "$cua_driver" ]]; then
+    echo "ERROR: Elevation host must not contain bundled CUA driver: $cua_driver" >&2
+    exit 1
+  fi
+}
+
+# Sign-time twin of verify_elevation_app in mac-elevation-host.sh, which asserts the same identity
+# invariants but requires an already notarized and stapled bundle. Dropping this check defers every
+# elevation identity failure until after an Apple notarization submission has been spent.
+verify_elevation_signature() {
+  [[ "$SIGNING_VARIANT" == "elevation-host" ]] || return 0
+  assert_no_elevation_cua_driver
+
+  local actual_team
+  actual_team="$(team_id_for "$APP_BUNDLE")"
+  if [[ "$actual_team" != "$ELEVATION_TEAM_ID" ]]; then
+    echo "ERROR: Elevation host requires TeamIdentifier=$ELEVATION_TEAM_ID, got '${actual_team:-not set}'." >&2
+    exit 1
+  fi
+
+  local authority
+  authority="$(codesign_metadata_value "$APP_BUNDLE" Authority)"
+  if [[ "$authority" != "$ELEVATION_IDENTITY" ]]; then
+    echo "ERROR: Elevation host requires '$ELEVATION_IDENTITY', got '${authority:-not set}'." >&2
+    exit 1
+  fi
+
+  assert_no_apple_events_entitlement() {
+    local signed_path="$1"
+    local entitlements
+    entitlements="$(codesign -d --entitlements :- "$signed_path")"
+    if /usr/bin/grep -q "com.apple.security.automation.apple-events" <<<"$entitlements"; then
+      echo "ERROR: Elevation host code retains Apple Events entitlement: $signed_path" >&2
+      exit 1
+    fi
+  }
+
+  assert_no_apple_events_entitlement "$APP_BUNDLE"
+  local kind signed_path
+  while IFS= read -r -d '' kind && IFS= read -r -d '' signed_path; do
+    [[ "$kind" == "executable" || "$kind" == "library" ]] || continue
+    assert_no_apple_events_entitlement "$signed_path"
+  done < "$NATIVE_INVENTORY"
+}
+
+# Complete the scan before any signing; process substitution hides scanner failures.
+assert_no_elevation_cua_driver
+/usr/bin/python3 "$INVENTORY_SCRIPT" "$APP_BUNDLE" > "$NATIVE_INVENTORY"
+# Shared inodes escape path confinement; special files can block recursive xattr.
+find "$APP_BUNDLE" \( -type f -links +1 -o ! -type f ! -type d ! -type l \) -print0 > "$ENT_TMP_DIR/unsafe-inputs"
+if [[ -s "$ENT_TMP_DIR/unsafe-inputs" ]]; then
+  echo "ERROR: Signing requires a private app copy without hardlinked or special files; copy or rebuild the bundle first." >&2
+  exit 1
+fi
+
+# Clear attributes only after input validation, inside the same write boundary as signing.
+run_bundle_mutation xattr -cr "$APP_BUNDLE" 2>/dev/null || true
+
+# Sign bundled helper binaries before signing the app bundle.
+MAC_CONTROL_CLI="$APP_BUNDLE/Contents/MacOS/openclaw-mac"
+if [ -f "$MAC_CONTROL_CLI" ]; then
+  echo "Signing macOS control CLI"; sign_plain_item "$MAC_CONTROL_CLI"
+fi
+
+MLX_TTS_HELPER="$APP_BUNDLE/Contents/MacOS/openclaw-mlx-tts"
+if [ -f "$MLX_TTS_HELPER" ]; then
+  echo "Signing MLX TTS helper"; sign_plain_item "$MLX_TTS_HELPER"
+fi
+
+CUA_DRIVER="$APP_BUNDLE/Contents/Resources/cua-driver"
+if [ -f "$CUA_DRIVER" ]; then
+  echo "Signing embedded CUA driver"; sign_plain_item "$CUA_DRIVER"
+fi
+
+while IFS= read -r -d '' helper_kind && IFS= read -r -d '' helper_file; do
+  [[ "$helper_kind" == "executable" ]] || continue
+  [[ "$helper_file" == "$APP_BUNDLE/Contents/Resources/cloudflared/"* ]] || continue
+  sign_plain_item "$helper_file"
+  codesign --verify --strict "$helper_file"
+done < "$NATIVE_INVENTORY"
+
+# Seal all native payloads before the enclosing app; npm packages can carry
+# standalone executables and addons below arbitrarily nested dependency roots.
+WORKER_ROOT="$APP_BUNDLE/Contents/Resources/node-worker"
+while IFS= read -r -d '' worker_kind && IFS= read -r -d '' worker_file; do
+  [[ "$worker_kind" == "executable" || "$worker_kind" == "library" ]] || continue
+  [[ "$worker_file" == "$WORKER_ROOT/"* ]] || continue
+  worker_relative="${worker_file#"$WORKER_ROOT"/}"
+  # Node and the SDK's standalone Bun CLI own JS execution. Other native
+  # helpers must not inherit JIT permissions merely because they execute.
+  if [[ "$worker_kind" == "executable" && (
+    "$worker_relative" == arm64/bin/node || "$worker_relative" == x86_64/bin/node ||
+    "$worker_relative" == */node_modules/@anthropic-ai/claude-agent-sdk-darwin-arm64/claude ||
+    "$worker_relative" == */node_modules/@anthropic-ai/claude-agent-sdk-darwin-x64/claude
+  ) ]]; then
+    sign_item "$worker_file" "$ENT_TMP_NODE"
+  else
+    sign_plain_item "$worker_file"
+  fi
+  codesign --verify --strict "$worker_file"
+done < "$NATIVE_INVENTORY"
+
+# Sign Sparkle deeply if present
+SPARKLE="$APP_BUNDLE/Contents/Frameworks/Sparkle.framework"
+if [ -d "$SPARKLE" ]; then
+  echo "Signing Sparkle framework and helpers"
+  while IFS= read -r -d '' kind && IFS= read -r -d '' f; do
+    [[ "$kind" == "executable" || "$kind" == "library" ]] || continue
+    [[ "$f" == "$SPARKLE/"* ]] || continue
+    # Known Sparkle entry points are signed explicitly below. codesign treats
+    # bundle main-executable paths as the whole bundle, so don't seal them early.
+    case "${f#"$SPARKLE/Versions/B/"}" in
+      Sparkle|Autoupdate|Updater.app/Contents/MacOS/Updater|\
+      XPCServices/Downloader.xpc/Contents/MacOS/Downloader|\
+      XPCServices/Installer.xpc/Contents/MacOS/Installer) continue ;;
+    esac
+    sign_plain_item "$f"
+  done < "$NATIVE_INVENTORY"
+  sign_plain_item "$SPARKLE/Versions/B/Autoupdate"
+  sign_plain_item "$SPARKLE/Versions/B/Updater.app"
+  sign_plain_item "$SPARKLE/Versions/B/XPCServices/Downloader.xpc"
+  sign_plain_item "$SPARKLE/Versions/B/XPCServices/Installer.xpc"
+  sign_plain_item "$SPARKLE"
+fi
+
+# Sign any other embedded frameworks/dylibs
+if [ -d "$APP_BUNDLE/Contents/Frameworks" ]; then
+  find "$APP_BUNDLE/Contents/Frameworks" -depth \( -name "*.framework" -o -name "*.dylib" \) ! -path "*Sparkle.framework*" -print0 > "$ENT_TMP_DIR/frameworks"
+  while IFS= read -r -d '' f; do
+    echo "Signing framework: $f"; sign_plain_item "$f"
+  done < "$ENT_TMP_DIR/frameworks"
+fi
+
+# The bundle seal also signs its main executable. Signing that path separately
+# would seal every resource twice, with the first seal preceding nested code.
+sign_item "$APP_BUNDLE" "$APP_ENTITLEMENTS"
+
+# Signing can create files. Rebuild after the final seal; the two read-only
+# audits share only this completed post-sign inventory, never the pre-sign scan.
+/usr/bin/python3 "$INVENTORY_SCRIPT" "$APP_BUNDLE" > "$NATIVE_INVENTORY"
+verify_native_signatures
+verify_elevation_signature
+
+echo "Codesign complete for $APP_BUNDLE"
diff --git a/scripts/control-ui-mock-skill-library.ts b/scripts/control-ui-mock-skill-library.ts
new file mode 100644
index 0000000000000000000000000000000000000000..6a8e4914a7f7c3ee15bd25c0030a01ce9e608941
--- /dev/null
+++ b/scripts/control-ui-mock-skill-library.ts
@@ -0,0 +1,350 @@
+import type {
+  SkillsLibraryListResult,
+  SkillsLibraryReadResult,
+} from "../packages/gateway-protocol/src/index.ts";
+import type { ModelCatalogEntry } from "../ui/src/api/types.ts";
+import type {
+  ControlUiMockGateway,
+  ControlUiMockRequestHandler,
+} from "../ui/src/test-helpers/control-ui-e2e.ts";
+import { buildSkillLibraryMock } from "../ui/src/test-helpers/skill-library-fixtures.ts";
+
+/** Runs inside the isolated mock browser, after the generic Gateway fixture. */
+function installSkillLibraryMock(
+  seed: ReturnType<typeof buildSkillLibraryMock>,
+  models: ModelCatalogEntry[],
+): void {
+  const gateway = (window as Window & { openclawControlUiE2eGateway?: ControlUiMockGateway })
+    .openclawControlUiE2eGateway;
+  if (!gateway) {
+    return;
+  }
+  const mode = new URL(window.location.href).searchParams.get("skillLibrary") ?? "shared";
+  const solo = mode === "solo";
+  const viewer = mode === "collaborator" ? "profile-bob" : "profile-alice";
+  const entries = new Map(seed.map((read) => [read.entry.skillId, read]));
+  const histories = new Map(
+    seed.map((read) => [
+      read.entry.skillId,
+      new Map([[read.entry.revision, structuredClone(read)]]),
+    ]),
+  );
+  const sessions = new Map<string, SkillsLibraryReadResult[]>();
+  const uploads = new Map<string, { slug: string; offset: number }>();
+  const pins = (sessionKey: string) => {
+    let selected = sessions.get(sessionKey);
+    if (!selected) {
+      selected = mode === "collaborator" ? [structuredClone(seed[0])] : [];
+      sessions.set(sessionKey, selected);
+    }
+    return selected;
+  };
+  const visible = () =>
+    solo
+      ? []
+      : Array.from(entries.values())
+          .map((read) => read.entry)
+          .filter(
+            (entry) =>
+              !entry.removed &&
+              (mode === "admin" ||
+                entry.ownerProfileId === viewer ||
+                entry.shared ||
+                entry.ownerProfileId === null),
+          );
+  const selection = (read: SkillsLibraryReadResult) => ({
+    skillId: read.entry.skillId,
+    revision: read.entry.revision,
+    name: read.entry.name,
+    ownerProfileId: read.entry.ownerProfileId,
+    slug: read.entry.slug,
+    description: read.entry.description,
+    ownerLabel: read.entry.ownerLabel,
+  });
+  const list = (sessionKey?: string): SkillsLibraryListResult => {
+    const selected = sessionKey ? pins(sessionKey) : [];
+    return {
+      entries: visible(),
+      profileId: solo ? null : viewer,
+      multipleProfiles: !solo,
+      defaultTarget: solo ? "workspace" : "personal",
+      canManageWorkspace: solo || mode === "admin",
+      defaultSelectionLimit: 64,
+      ...(sessionKey
+        ? {
+            session: {
+              sessionKey,
+              selections: selected.map(selection),
+              attachable: visible().filter(
+                (entry) => !selected.some((read) => read.entry.skillId === entry.skillId),
+              ),
+            },
+          }
+        : {}),
+    };
+  };
+  for (const read of entries.values()) {
+    read.entry.canEdit =
+      mode !== "readonly" && (mode === "admin" || read.entry.ownerProfileId === viewer);
+  }
+  const handleRequest = (
+    method: string,
+    { params: input, respond }: Parameters<ControlUiMockRequestHandler>[0],
+  ) => {
+    const params = (input ?? {}) as {
+      sessionKey?: string;
+      skillId?: string;
+      expectedRevision?: string | null;
+      slug?: string;
+      content?: string;
+      files?: SkillsLibraryReadResult["files"];
+      action?: string;
+      revision?: string;
+      source?: { slug: string };
+      uploadId?: string;
+      offset?: number;
+      data?: string;
+      sizeBytes?: number;
+      sha256?: string;
+    };
+    if (method === "commands.list" || method === "chat.metadata") {
+      const selected = params.sessionKey ? pins(params.sessionKey) : [];
+      respond({
+        commands: selected.map(({ entry }) => ({
+          name: entry.name,
+          skillDisplayName: `${entry.slug} · ${entry.ownerLabel}`,
+          description: entry.description,
+          source: "skill",
+          scope: "both",
+          acceptsArgs: true,
+          skillModelVisible: true,
+          textAliases: [`/${entry.name}`],
+        })),
+        ...(method === "chat.metadata" ? { models } : {}),
+      });
+      return;
+    }
+    const reject = (message: string, code = "SKILL_LIBRARY_FORBIDDEN") => {
+      respond({ __mockError: { code: "INVALID_REQUEST", message, details: { code } } });
+    };
+    if (method === "skills.library.list") {
+      respond(list(params.sessionKey));
+      return;
+    }
+    if (method === "skills.library.read") {
+      const selected = params.sessionKey
+        ? pins(params.sessionKey).find(
+            (read) =>
+              read.entry.skillId === params.skillId && read.entry.revision === params.revision,
+          )
+        : undefined;
+      const read = params.sessionKey
+        ? selected
+        : params.skillId && visible().some((entry) => entry.skillId === params.skillId)
+          ? params.revision
+            ? histories.get(params.skillId)?.get(params.revision)
+            : entries.get(params.skillId)
+          : undefined;
+      if (!read) {
+        return reject("Read requires visible library access or an exact selected session pin.");
+      }
+      respond(
+        params.sessionKey
+          ? {
+              ...read,
+              entry: { ...read.entry, canEdit: false },
+              revisions: [{ revision: read.entry.revision, createdAt: read.entry.updatedAt }],
+            }
+          : {
+              ...read,
+              entry: {
+                ...read.entry,
+                canEdit: entries.get(read.entry.skillId)?.entry.canEdit === true,
+              },
+            },
+      );
+      return;
+    }
+    if (method === "skills.library.activate") {
+      if (!params.sessionKey) {
+        return reject("Activation requires a session key.");
+      }
+      const selected = pins(params.sessionKey);
+      const targets =
+        params.action === "refresh" && !params.skillId
+          ? selected.map((read) => read.entry.skillId)
+          : [params.skillId];
+      if (
+        params.action !== "detach" &&
+        targets.some((id) => !visible().some((entry) => entry.skillId === id))
+      ) {
+        return reject(
+          "Refresh requires current library access. The existing session pin remains unchanged.",
+        );
+      }
+      let next = selected.filter((read) => read.entry.skillId !== params.skillId);
+      if (params.action === "refresh" && !params.skillId) {
+        next = [];
+      }
+      if (params.action !== "detach") {
+        for (const id of targets) {
+          const read = id
+            ? params.revision
+              ? histories.get(id)?.get(params.revision)
+              : entries.get(id)
+            : undefined;
+          if (!read) {
+            return reject("Skill revision is unavailable.");
+          }
+          next.push(structuredClone(read));
+        }
+      }
+      sessions.set(params.sessionKey, next);
+      respond({
+        sessionKey: params.sessionKey,
+        selections: next.map((read) => ({
+          skillId: read.entry.skillId,
+          revision: read.entry.revision,
+          name: read.entry.name,
+          ownerProfileId: read.entry.ownerProfileId,
+        })),
+        sessionActivation: "next-turn",
+      });
+      return;
+    }
+    if (method === "skills.library.upload") {
+      if (params.action === "begin" && params.slug && params.sizeBytes && params.sha256) {
+        const uploadId = `mock-upload-${params.slug}`;
+        uploads.set(uploadId, { slug: params.slug, offset: 0 });
+        respond({ uploadId, offset: 0, maxChunkBytes: 256 * 1024 });
+        return;
+      }
+      const upload = params.uploadId ? uploads.get(params.uploadId) : undefined;
+      if (!upload) {
+        return reject("The mock upload is no longer available.", "SKILL_LIBRARY_UPLOAD_MISSING");
+      }
+      if (params.action === "chunk" && typeof params.data === "string") {
+        const received = atob(params.data).length;
+        upload.offset = (params.offset ?? upload.offset) + received;
+        respond({ uploadId: params.uploadId, offset: upload.offset, maxChunkBytes: 256 * 1024 });
+        return;
+      }
+      if (params.action === "commit") {
+        uploads.delete(params.uploadId ?? "");
+        params.slug = upload.slug;
+        params.content = `---\nname: ${upload.slug}\ndescription: Imported archive fixture\n---\n\nReview the source material before drafting.\n`;
+        params.files = [];
+      }
+    }
+
+    const current = params.skillId ? entries.get(params.skillId) : undefined;
+    if (
+      params.skillId &&
+      (!current ||
+        !current.entry.canEdit ||
+        current.entry.revision !== params.expectedRevision ||
+        mode === "conflict")
+    ) {
+      return reject(
+        "The skill changed. Reopen it to review the latest revision.",
+        "SKILL_LIBRARY_CONFLICT",
+      );
+    }
+    const skillId = current?.entry.skillId ?? crypto.randomUUID();
+    const slug = params.slug ?? current?.entry.slug ?? "imported-skill";
+    const revision =
+      method === "skills.library.mutate"
+        ? ((params.action === "rollback" ? params.revision : current?.entry.revision) ??
+          "1".repeat(64))
+        : String((current?.revisions.length ?? 0) + 1).padStart(64, "0");
+    const previous =
+      params.action === "rollback" && params.revision
+        ? histories.get(skillId)?.get(params.revision)
+        : undefined;
+    const read: SkillsLibraryReadResult = current ?? {
+      entry: {
+        skillId,
+        slug,
+        name: `s_${slug.replaceAll("-", "_").slice(0, 9)}_${skillId.replaceAll("-", "").slice(0, 20)}`,
+        description: "Custom skill",
+        ownerProfileId: viewer,
+        ownerLabel: viewer === "profile-alice" ? "Alice" : "Bob",
+        authorProfileId: viewer,
+        shared: false,
+        enabled: true,
+        removed: false,
+        revision,
+        createdAt: Date.now(),
+        updatedAt: Date.now(),
+        canEdit: true,
+      },
+      content: "",
+      files: [],
+      revisions: [],
+    };
+    read.entry = { ...read.entry, slug, revision, updatedAt: Date.now() };
+    if (
+      method === "skills.library.save" ||
+      (method === "skills.library.upload" && params.action === "commit")
+    ) {
+      read.content = params.content ?? "";
+      read.files = params.files ?? [];
+    }
+    if (method === "skills.library.import") {
+      read.content = `---\nname: ${slug}\ndescription: Imported from ClawHub\n---\n\nImported ${params.source?.slug ?? slug}.\n`;
+    }
+    if (params.action === "remove") {
+      read.entry.removed = true;
+    }
+    if (params.action === "share" || params.action === "unshare") {
+      read.entry.shared = params.action === "share";
+    }
+    if (params.action === "enable" || params.action === "disable") {
+      read.entry.enabled = params.action === "enable";
+    }
+    if (params.action === "transfer") {
+      read.entry.ownerProfileId = null;
+      read.entry.ownerLabel = "Team";
+      read.entry.shared = true;
+    }
+    if (previous) {
+      read.content = previous.content;
+      read.files = structuredClone(previous.files);
+    }
+    if (!read.revisions.some((item) => item.revision === revision)) {
+      read.revisions = [{ revision, createdAt: Date.now() }, ...read.revisions];
+    }
+    entries.set(skillId, read);
+    const history = histories.get(skillId) ?? new Map();
+    history.set(revision, structuredClone(read));
+    histories.set(skillId, history);
+    respond({
+      state: read.entry.removed ? "removed" : "published",
+      target: read.entry.ownerProfileId === null ? "team" : "personal",
+      entry: read.entry,
+      sessionActivation: "new-sessions",
+      nextAction: read.entry.removed
+        ? "Existing sessions retain their pinned revision. Create a new skill to add it to future sessions."
+        : !read.entry.enabled
+          ? "Disabled for new-session defaults. Existing sessions retain their selected revision; explicit attachment remains available."
+          : `Enabled for ${read.entry.shared || read.entry.ownerProfileId === null ? "new team sessions" : "your new sessions"}, subject to agent policy and prerequisites. Existing session pins remain. Use skills.library.activate to attach or refresh it.`,
+    });
+  };
+  for (const method of [
+    "commands.list",
+    "chat.metadata",
+    "skills.library.list",
+    "skills.library.read",
+    "skills.library.activate",
+    "skills.library.save",
+    "skills.library.mutate",
+    "skills.library.import",
+    "skills.library.upload",
+  ]) {
+    gateway.setRequestHandler(method, (request) => handleRequest(method, request));
+  }
+}
+
+export function skillLibraryMockInitScript(models: ModelCatalogEntry[] = []): string {
+  return `(() => { const __name = (target) => target; (${installSkillLibraryMock.toString()})(${JSON.stringify(buildSkillLibraryMock())}, ${JSON.stringify(models)}); })();`;
+}
diff --git a/scripts/copy-bundled-plugin-metadata.mjs b/scripts/copy-bundled-plugin-metadata.mjs
new file mode 100644
index 0000000000000000000000000000000000000000..d1a8045e1c0e96057329503fc1bae0b2434ac801
--- /dev/null
+++ b/scripts/copy-bundled-plugin-metadata.mjs
@@ -0,0 +1,5 @@
+import { runTsxCliShim } from "./lib/tsx-cli-shim.mjs";
+
+await runTsxCliShim(import.meta.url, {
+  implementation: "./copy-bundled-plugin-metadata.mts",
+});
diff --git a/scripts/copy-hook-metadata.ts b/scripts/copy-hook-metadata.ts
new file mode 100644
index 0000000000000000000000000000000000000000..02c8e653747c3241608d9fdc149cc30b44aef0b8
--- /dev/null
+++ b/scripts/copy-hook-metadata.ts
@@ -0,0 +1,60 @@
+#!/usr/bin/env tsx
+/**
+ * Copy HOOK.md files from src/hooks/bundled to dist/bundled
+ */
+
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { logVerboseCopy, resolveBuildCopyContext } from "./lib/copy-assets.ts";
+
+const context = resolveBuildCopyContext(import.meta.url);
+
+type CopyHookMetadataParams = {
+  rootDir?: string;
+  fs?: typeof fs;
+  verbose?: boolean;
+};
+
+function listHookMetadataFiles(rootDir: string, fsImpl: typeof fs) {
+  const sourceRoot = path.join(rootDir, "src", "hooks", "bundled");
+  if (!fsImpl.existsSync(sourceRoot)) {
+    return [];
+  }
+  return fsImpl
+    .readdirSync(sourceRoot, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory())
+    .map((entry) => ({
+      source: path.join(sourceRoot, entry.name, "HOOK.md"),
+      target: path.join(rootDir, "dist", "bundled", entry.name, "HOOK.md"),
+    }))
+    .filter(({ source }) => fsImpl.existsSync(source));
+}
+
+export function listHookMetadataOutputs(params: CopyHookMetadataParams = {}): string[] {
+  const rootDir = params.rootDir ?? context.projectRoot;
+  const fsImpl = params.fs ?? fs;
+  return listHookMetadataFiles(rootDir, fsImpl).map(({ target }) =>
+    path.relative(rootDir, target).replaceAll(path.sep, "/"),
+  );
+}
+
+export function copyHookMetadata(params: CopyHookMetadataParams = {}): number {
+  const rootDir = params.rootDir ?? context.projectRoot;
+  const fsImpl = params.fs ?? fs;
+  let copiedCount = 0;
+  for (const { source, target } of listHookMetadataFiles(rootDir, fsImpl)) {
+    fsImpl.mkdirSync(path.dirname(target), { recursive: true });
+    fsImpl.copyFileSync(source, target);
+    copiedCount += 1;
+    if (params.verbose) {
+      logVerboseCopy(context, `Copied ${path.basename(path.dirname(target))}/HOOK.md`);
+    }
+  }
+  return copiedCount;
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+  const copiedCount = copyHookMetadata({ verbose: true });
+  console.log(`${context.prefix} Copied ${copiedCount} hook metadata files.`);
+}
diff --git a/scripts/crabbox-routing-policy.mts b/scripts/crabbox-routing-policy.mts
new file mode 100644
index 0000000000000000000000000000000000000000..9f06365517fa25bef7db45cc10e8d70a9809334c
--- /dev/null
+++ b/scripts/crabbox-routing-policy.mts
@@ -0,0 +1,82 @@
+const workloadAliasEntries = [
+  ["check", "ci-fast"],
+  ["ci", "ci-fast"],
+  ["ci-fast", "ci-fast"],
+  ["ci-proof", "ci-proof"],
+  ["desktop", "desktop"],
+  ["interactive", "interactive"],
+  ["release", "release-proof"],
+  ["release-proof", "release-proof"],
+  ["untrusted", "untrusted"],
+  ["windows", "windows"],
+] as const;
+
+type CrabboxWorkload = (typeof workloadAliasEntries)[number][1];
+
+const workloadAliases = new Map<string, CrabboxWorkload>(workloadAliasEntries);
+
+export function normalizeCrabboxWorkload(value: unknown) {
+  const normalized = typeof value === "string" ? value.trim().toLowerCase() : "";
+  if (!normalized) {
+    return "";
+  }
+  return workloadAliases.get(normalized) ?? null;
+}
+
+export function crabboxProviderChain({
+  workload,
+  configuredProvider,
+  target,
+  advertisedProviders,
+}: {
+  workload: CrabboxWorkload | "";
+  configuredProvider: string;
+  target: string;
+  advertisedProviders: readonly string[];
+}) {
+  const providers = new Set(advertisedProviders);
+  const normalizedConfigured = configuredProvider.trim();
+  const normalizedTarget = target.trim().toLowerCase();
+
+  if (normalizedTarget === "macos") {
+    return available(["aws"], providers);
+  }
+  if (normalizedTarget === "windows" || workload === "windows") {
+    return available(["azure", "aws"], providers);
+  }
+
+  const cloudFallback = ["azure", "aws"];
+  switch (workload) {
+    case "ci-fast":
+      return available(["blacksmith-testbox", "daytona", ...cloudFallback], providers);
+    case "ci-proof":
+    case "release-proof":
+      return available(["blacksmith-testbox", "daytona", ...cloudFallback], providers);
+    case "interactive":
+      return available(["daytona", ...cloudFallback], providers);
+    case "desktop":
+      return available(cloudFallback, providers);
+    case "untrusted":
+      // Daytona remains excluded until its brokered isolation profile has live proof.
+      return available(cloudFallback, providers);
+    default:
+      return available([normalizedConfigured], providers);
+  }
+}
+
+export function selectReadyCrabboxProvider<T extends { ready: boolean }>(
+  chain: readonly string[],
+  readiness: ReadonlyMap<string, T>,
+) {
+  for (const provider of chain) {
+    const status = readiness.get(provider);
+    if (status?.ready) {
+      return { provider, readiness: status };
+    }
+  }
+  return null;
+}
+
+function available(candidates: readonly string[], advertisedProviders: ReadonlySet<string>) {
+  return candidates.filter((provider) => provider && advertisedProviders.has(provider));
+}
diff --git a/scripts/crabbox-source-capsule.mts b/scripts/crabbox-source-capsule.mts
new file mode 100644
index 0000000000000000000000000000000000000000..749b76e596e044193ca58ac73a7c200f4a8cdb61
--- /dev/null
+++ b/scripts/crabbox-source-capsule.mts
@@ -0,0 +1,654 @@
+import { isUtf8 } from "node:buffer";
+import { execFileSync, spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import {
+  chmodSync,
+  closeSync,
+  constants,
+  fstatSync,
+  lstatSync,
+  mkdirSync,
+  mkdtempSync,
+  openSync,
+  readFileSync,
+  readlinkSync,
+  readSync,
+  realpathSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { z } from "zod";
+
+const bundleFile = ".openclaw-crabbox-changed-gate.bundle";
+const capsuleRef = "refs/openclaw/source-capsule";
+const syncPlanSchema = z.object({
+  candidate: z.object({ files: z.number().int().nonnegative() }),
+  topFiles: z.array(z.object({ path: z.string().min(1) })),
+});
+
+export type CrabboxSourceCapsule = {
+  sourceSha: string;
+  baseSha: string;
+  tree: string;
+  carrier: string;
+  digest: string;
+  bundlePath: string;
+  directory: string;
+  cleanup: () => void;
+  configPath?: string;
+};
+
+function sourceGitEnvironment() {
+  const env: NodeJS.ProcessEnv = {
+    ...process.env,
+    GIT_OPTIONAL_LOCKS: "0",
+  };
+  // Repository routing belongs to the selected checkout. Keep Git configuration
+  // here: the invoking user's global excludes are part of source selection.
+  for (const key of [
+    "GIT_DIR",
+    "GIT_WORK_TREE",
+    "GIT_INDEX_FILE",
+    "GIT_OBJECT_DIRECTORY",
+    "GIT_ALTERNATE_OBJECT_DIRECTORIES",
+    "GIT_COMMON_DIR",
+    "GIT_SHALLOW_FILE",
+  ]) {
+    delete env[key];
+  }
+  return env;
+}
+
+function capsulePath(path: string) {
+  const parts = path.split("/");
+  if (
+    parts.some((part) => !part || part === "." || part === ".." || part.toLowerCase() === ".git")
+  ) {
+    throw new Error("source capsule contains an invalid repository path");
+  }
+  if (path.includes("\0") || path.includes("\\") || path === bundleFile) {
+    throw new Error("source capsule path conflicts with its transport metadata");
+  }
+  return path;
+}
+
+function capsuleObjectId(value: string) {
+  const id = value.trim();
+  if (!/^[a-f0-9]{40}$/u.test(id)) {
+    throw new Error("source capsule requires a complete SHA-1 Git object identity");
+  }
+  return id;
+}
+
+function sourceStat(root: string, path: string) {
+  const parts = path.split("/");
+  let current = root;
+  for (const part of parts.slice(0, -1)) {
+    current = join(current, part);
+    const info = lstatSync(current, { throwIfNoEntry: false });
+    if (!info) {
+      return { kind: "missing" } as const;
+    }
+    if (!info.isDirectory() || info.isSymbolicLink()) {
+      // An indexed directory can be replaced by a file or symlink. Its old
+      // descendants are deleted source, never paths into the new link's target.
+      return { kind: "replaced" } as const;
+    }
+  }
+  const stat = lstatSync(join(root, path), { throwIfNoEntry: false });
+  return stat ? { kind: "present" as const, stat } : { kind: "missing" as const };
+}
+
+export function prepareCrabboxSourceCapsule(options: {
+  repoRoot: string;
+  syncRoot: string;
+  base: string;
+  syncPlan: { command: string; args: string[]; windowsVerbatimArguments?: boolean };
+}): CrabboxSourceCapsule {
+  const repoRoot = realpathSync(options.repoRoot);
+  const sourceEnv = sourceGitEnvironment();
+  function git(cwd: string, args: string[], env = sourceEnv, input?: string) {
+    let output: Buffer;
+    try {
+      output = execFileSync("git", ["-C", cwd, ...args], {
+        env,
+        input,
+        maxBuffer: 64 * 1024 * 1024,
+        stdio: ["pipe", "pipe", "pipe"],
+      });
+    } catch {
+      throw new Error(`source capsule: git ${args[0]} failed; source was not uploaded`);
+    }
+    if (!isUtf8(output)) {
+      throw new Error("source capsule requires UTF-8 Git paths and metadata");
+    }
+    return output.toString("utf8");
+  }
+  const sourceSha = capsuleObjectId(git(repoRoot, ["rev-parse", "--verify", "HEAD^{commit}"]));
+  const baseSha = capsuleObjectId(
+    git(repoRoot, ["rev-parse", "--verify", `${options.base}^{commit}`]),
+  );
+  const trackedRecords = git(repoRoot, ["ls-files", "-v", "--stage", "-z"]);
+  const tracked = new Map<string, { mode: string; hash: string; sparse: boolean }>();
+  for (const record of trackedRecords.split("\0").filter(Boolean)) {
+    const match = /^([A-Za-z]) (100644|100755|120000) ([a-f0-9]{40}) 0\t([\s\S]+)$/u.exec(record);
+    if (!match || !match[1] || !match[2] || !match[3] || !match[4]) {
+      throw new Error("source capsule requires resolved regular-file or symlink index entries");
+    }
+    tracked.set(capsulePath(match[4]), {
+      mode: match[2],
+      hash: match[3],
+      sparse: match[1].toUpperCase() === "S",
+    });
+  }
+  const owned = new Set(tracked.keys());
+  for (const revision of new Set([baseSha, sourceSha])) {
+    for (const path of git(repoRoot, ["ls-tree", "-r", "--name-only", "-z", revision])
+      .split("\0")
+      .filter(Boolean)) {
+      owned.add(capsulePath(path));
+    }
+  }
+  // Freeze invoking Git's eligibility before moving to a different Git/config
+  // context. This includes staged ignored additions and excludes untracked secrets.
+  const eligible = new Set(
+    git(repoRoot, ["ls-files", "--cached", "--others", "--exclude-standard", "-z"])
+      .split("\0")
+      .filter(Boolean)
+      .map(capsulePath),
+  );
+  mkdirSync(options.syncRoot, { recursive: true });
+  const temporary = mkdtempSync(resolve(options.syncRoot, "openclaw-crabbox-sync-"));
+  const directory = join(temporary, "source");
+  const cleanup = () => rmSync(temporary, { recursive: true, force: true });
+  try {
+    mkdirSync(directory);
+    const privateEnv: NodeJS.ProcessEnv = {
+      ...sourceEnv,
+      GIT_CONFIG_GLOBAL: "/dev/null",
+      GIT_CONFIG_NOSYSTEM: "1",
+      GIT_CONFIG_COUNT: "0",
+      GIT_AUTHOR_NAME: "OpenClaw",
+      GIT_AUTHOR_EMAIL: "ci@openclaw.local",
+      GIT_COMMITTER_NAME: "OpenClaw",
+      GIT_COMMITTER_EMAIL: "ci@openclaw.local",
+    };
+    delete privateEnv.GIT_CONFIG_PARAMETERS;
+    git(directory, ["init", "--quiet", "--template="], privateEnv);
+    const objectDir = git(repoRoot, [
+      "rev-parse",
+      "--path-format=absolute",
+      "--git-path",
+      "objects",
+    ]).trim();
+    writeFileSync(join(directory, ".git", "objects", "info", "alternates"), `${objectDir}\n`);
+    git(directory, ["update-ref", "--no-deref", "HEAD", sourceSha], privateEnv);
+    // Git expands ~/ paths; relative excludesFile paths are relative to the source
+    // checkout. Keep this policy reference local, including an explicit empty override.
+    const excludesFile = spawnSync(
+      "git",
+      ["-C", repoRoot, "config", "--path", "--null", "--get", "core.excludesFile"],
+      {
+        env: sourceEnv,
+      },
+    );
+    if (excludesFile.status === 0 && isUtf8(excludesFile.stdout)) {
+      const path = excludesFile.stdout.toString("utf8").slice(0, -1);
+      git(
+        directory,
+        ["config", "core.excludesFile", path ? resolve(repoRoot, path) : ""],
+        privateEnv,
+      );
+    } else if (excludesFile.status !== 1) {
+      throw new Error("source capsule could not resolve Git exclusion policy");
+    }
+    git(
+      directory,
+      ["remote", "add", "origin", git(repoRoot, ["remote", "get-url", "origin"]).trim()],
+      privateEnv,
+    );
+    // Original tracking, not the eventual raw candidate index, controls Crabbox's
+    // tracked-source exceptions. Untracked candidates must remain untracked here.
+    git(
+      directory,
+      ["update-index", "-z", "--index-info"],
+      privateEnv,
+      [...tracked].map(([path, entry]) => `${entry.mode} ${entry.hash}\t${path}\0`).join(""),
+    );
+    const exclude = git(repoRoot, [
+      "rev-parse",
+      "--path-format=absolute",
+      "--git-path",
+      "info/exclude",
+    ]).trim();
+    const excludeInfo = lstatSync(exclude, { throwIfNoEntry: false });
+    if (excludeInfo) {
+      const policy = realpathSync(exclude);
+      if (!lstatSync(policy).isFile()) {
+        throw new Error("source capsule requires a regular Git info/exclude policy file");
+      }
+      mkdirSync(join(directory, ".git", "info"), { recursive: true });
+      const fd = openSync(policy, constants.O_RDONLY | constants.O_NOFOLLOW);
+      try {
+        writeFileSync(join(directory, ".git", "info", "exclude"), readFileSync(fd));
+      } finally {
+        closeSync(fd);
+      }
+    }
+    const frozen = new Map<string, { mode: string; blobPath: string }>();
+    const linkBlobs = join(temporary, "links");
+    mkdirSync(linkBlobs);
+    function writeFrozen(path: string, bytes: Buffer, mode: string) {
+      const destination = join(directory, path);
+      let blobPath = destination;
+      let operation = "mkdir";
+      try {
+        mkdirSync(dirname(destination), { recursive: true });
+        if (mode === "120000") {
+          operation = "symlink";
+          symlinkSync(bytes, destination);
+          blobPath = join(linkBlobs, String(frozen.size));
+          operation = "write symlink blob";
+          writeFileSync(blobPath, bytes);
+        } else {
+          operation = "write file";
+          writeFileSync(destination, bytes);
+          operation = "chmod";
+          chmodSync(destination, mode === "100755" ? 0o755 : 0o644);
+        }
+      } catch (error) {
+        const failure = error as NodeJS.ErrnoException;
+        const details = [
+          failure?.code === undefined ? undefined : `code=${JSON.stringify(failure.code)}`,
+          failure?.errno === undefined ? undefined : `errno=${JSON.stringify(failure.errno)}`,
+        ]
+          .filter(Boolean)
+          .join(", ");
+        throw new Error(
+          `source capsule: ${operation} failed for ${JSON.stringify(path)}${details ? ` (${details})` : ""}; source was not uploaded`,
+          { cause: error },
+        );
+      }
+      frozen.set(path, { mode, blobPath });
+    }
+    function copySource(path: string) {
+      const entry = sourceStat(repoRoot, path);
+      if (entry.kind !== "present" || entry.stat.isDirectory()) {
+        return entry.kind;
+      }
+      const info = entry.stat;
+      const source = join(repoRoot, path);
+      if (info.isSymbolicLink()) {
+        const bytes = readlinkSync(source, { encoding: "buffer" });
+        const after = sourceStat(repoRoot, path);
+        if (
+          after.kind !== "present" ||
+          !after.stat.isSymbolicLink() ||
+          after.stat.ino !== info.ino ||
+          !readlinkSync(source, { encoding: "buffer" }).equals(bytes)
+        ) {
+          throw new Error(
+            `symlink changed while freezing ${JSON.stringify(path)}; retry after edits finish`,
+          );
+        }
+        writeFrozen(path, bytes, "120000");
+        return "present";
+      }
+      if (!info.isFile()) {
+        throw new Error(`source capsule has an unsupported file kind at ${JSON.stringify(path)}`);
+      }
+      const fd = openSync(source, constants.O_RDONLY | constants.O_NOFOLLOW);
+      try {
+        const opened = fstatSync(fd);
+        const bytes = readFileSync(fd);
+        const after = sourceStat(repoRoot, path);
+        if (
+          !opened.isFile() ||
+          after.kind !== "present" ||
+          opened.ino !== info.ino ||
+          opened.ino !== after.stat.ino ||
+          opened.mode !== info.mode ||
+          opened.mode !== after.stat.mode ||
+          opened.size !== after.stat.size ||
+          opened.mtimeMs !== after.stat.mtimeMs
+        ) {
+          throw new Error(
+            `source changed while freezing ${JSON.stringify(path)}; retry after edits finish`,
+          );
+        }
+        writeFrozen(path, bytes, (opened.mode & 0o100) !== 0 ? "100755" : "100644");
+      } finally {
+        closeSync(fd);
+      }
+      return "present";
+    }
+    const sparse: Array<{ path: string; mode: string; hash: string }> = [];
+    for (const path of [...eligible].toSorted()) {
+      const kind = copySource(path);
+      const entry = tracked.get(path);
+      if (kind === "missing" && entry?.sparse) {
+        sparse.push({ path, mode: entry.mode, hash: entry.hash });
+      }
+    }
+    if (sparse.length) {
+      // Batch directly to a private file: a sparse checkout can omit most of the
+      // repository. Neither per-blob subprocesses nor one huge stdout buffer scales.
+      const stream = join(temporary, "sparse-blobs");
+      const output = openSync(stream, "wx", 0o600);
+      try {
+        execFileSync("git", ["-C", repoRoot, "cat-file", "--batch"], {
+          env: sourceEnv,
+          input: sparse.map((entry) => entry.hash).join("\n") + "\n",
+          stdio: ["pipe", output, "pipe"],
+        });
+      } catch {
+        throw new Error("source capsule could not materialize missing sparse index blobs");
+      } finally {
+        closeSync(output);
+      }
+      const input = openSync(stream, "r");
+      let offset = 0;
+      try {
+        for (const entry of sparse) {
+          const headerBytes = Buffer.alloc(128);
+          const headerSize = readSync(input, headerBytes, 0, headerBytes.length, offset);
+          const newline = headerBytes.indexOf(10, 0);
+          const header = headerBytes.subarray(0, newline).toString("ascii");
+          const match = /^([a-f0-9]{40}) blob (\d+)$/u.exec(header);
+          if (
+            newline < 0 ||
+            newline >= headerSize ||
+            !match ||
+            match[1] !== entry.hash ||
+            !match[2]
+          ) {
+            throw new Error("source capsule received invalid sparse blob framing");
+          }
+          const size = Number(match[2]);
+          if (!Number.isSafeInteger(size)) {
+            throw new Error("source capsule sparse blob size is invalid");
+          }
+          offset += newline + 1;
+          const bytes = Buffer.alloc(size);
+          for (let read = 0; read < size;) {
+            const count = readSync(input, bytes, read, size - read, offset + read);
+            if (!count) {
+              throw new Error("source capsule sparse blob was truncated");
+            }
+            read += count;
+          }
+          offset += size;
+          const separator = Buffer.alloc(1);
+          if (readSync(input, separator, 0, 1, offset) !== 1 || separator[0] !== 10) {
+            throw new Error("source capsule sparse blob separator is missing");
+          }
+          offset += 1;
+          writeFrozen(entry.path, bytes, entry.mode);
+        }
+        if (offset !== fstatSync(input).size) {
+          throw new Error("source capsule sparse blob stream has unexpected data");
+        }
+      } finally {
+        closeSync(input);
+      }
+    }
+    const selectionEnv = { ...sourceEnv };
+    const runtimePolicies: string[] = [];
+    let configPath: string | undefined;
+    const explicitConfig = sourceEnv.CRABBOX_CONFIG;
+    if (explicitConfig) {
+      const original = resolve(repoRoot, explicitConfig);
+      function repositoryPolicyPath(absolute: string) {
+        const path = relative(repoRoot, absolute);
+        return path !== ".." && !path.startsWith(`..${sep}`) && !isAbsolute(path)
+          ? capsulePath(path)
+          : undefined;
+      }
+      let policyPath = repositoryPolicyPath(original);
+      if (!policyPath) {
+        // Crabbox also treats an external alias resolving into this repository
+        // as repository configuration. Relocation must not elevate its trust.
+        try {
+          policyPath = repositoryPolicyPath(realpathSync(original));
+        } catch {
+          // Missing explicit configuration is permitted by Crabbox.
+        }
+      }
+      if (policyPath) {
+        runtimePolicies.push(policyPath);
+        configPath = join(directory, policyPath);
+      } else {
+        configPath = original;
+      }
+      selectionEnv.CRABBOX_CONFIG = configPath;
+    } else {
+      runtimePolicies.push("crabbox.yaml", ".crabbox.yaml");
+    }
+    // Policy files may be Git-ignored. They affect selection but never become
+    // transport candidates merely because selection needs to read them.
+    for (const path of [...runtimePolicies, ".crabboxignore"]) {
+      const kind = frozen.has(path) ? "present" : copySource(path);
+      // A replaced policy must not become an absent file and lose its exclusions.
+      if (kind !== "missing" && !["100644", "100755"].includes(frozen.get(path)?.mode ?? "")) {
+        throw new Error(
+          `source capsule cannot relocate non-regular repository policy ${JSON.stringify(path)}; use a regular policy file before uploading`,
+        );
+      }
+    }
+    const snapshotEligible = new Set(
+      git(directory, ["ls-files", "--cached", "--others", "--exclude-standard", "-z"])
+        .split("\0")
+        .filter(Boolean),
+    );
+    for (const path of frozen.keys()) {
+      if (eligible.has(path) && !snapshotEligible.has(path)) {
+        throw new Error("source capsule Git exclusion context changed in the frozen checkout");
+      }
+    }
+    function selectSource() {
+      let planValue: unknown;
+      try {
+        const result = spawnSync(options.syncPlan.command, options.syncPlan.args, {
+          cwd: directory,
+          env: selectionEnv,
+          windowsVerbatimArguments: options.syncPlan.windowsVerbatimArguments,
+          encoding: "utf8",
+          maxBuffer: 64 * 1024 * 1024,
+          stdio: ["ignore", "pipe", "pipe"],
+        });
+        if (result.error || result.status !== 0) {
+          throw new Error("Crabbox sync-plan failed");
+        }
+        planValue = JSON.parse(result.stdout);
+      } catch {
+        throw new Error(
+          "source capsule requires a successful Crabbox sync-plan; inspect source exclusions before retrying",
+        );
+      }
+      const parsed = syncPlanSchema.safeParse(planValue);
+      if (!parsed.success) {
+        throw new Error("source capsule received an invalid Crabbox sync-plan");
+      }
+      const selected = new Set(parsed.data.topFiles.map((entry) => capsulePath(entry.path)));
+      if (
+        selected.size !== parsed.data.candidate.files ||
+        selected.size !== parsed.data.topFiles.length
+      ) {
+        throw new Error("source capsule requires the complete, unique Crabbox sync-plan selection");
+      }
+      return selected;
+    }
+    const directories = new Set<string>();
+    for (const path of frozen.keys()) {
+      for (let parent = dirname(path); parent !== "."; parent = dirname(parent)) {
+        directories.add(parent);
+      }
+    }
+    // Ask the same policy owner about absent source using empty tracked placeholders.
+    // These never enter the source tree. Separate overlapping historical file paths
+    // (a -> a/b) so no probe follows a source symlink or shadows another deletion.
+    const groups: Set<string>[] = [new Set()];
+    for (const path of [...owned].toSorted()) {
+      if (frozen.has(path) || directories.has(path)) {
+        continue;
+      }
+      const parents: string[] = [];
+      for (let parent = dirname(path); parent !== "."; parent = dirname(parent)) {
+        parents.push(parent);
+      }
+      if (parents.some((parent) => frozen.has(parent))) {
+        continue; // The selected ancestor replaces this namespace without following it.
+      }
+      let group = groups.find((entries) => parents.every((parent) => !entries.has(parent)));
+      if (!group) {
+        group = new Set();
+        groups.push(group);
+      }
+      group.add(path);
+    }
+    const emptyBlob = git(directory, ["hash-object", "-w", "--stdin"], privateEnv, "").trim();
+    const unstageDeletions = (paths: Iterable<string>) =>
+      git(
+        directory,
+        ["update-index", "-z", "--index-info"],
+        privateEnv,
+        [...paths].map((path) => `0 ${"0".repeat(40)}\t${path}\0`).join(""),
+      );
+    unstageDeletions(groups.flatMap((group) => [...group]));
+    const deleted: string[] = [];
+    let selected: Set<string> | undefined;
+    for (const group of groups) {
+      for (const path of group) {
+        mkdirSync(dirname(join(directory, path)), { recursive: true });
+        writeFileSync(join(directory, path), "", { flag: "wx" });
+      }
+      git(
+        directory,
+        ["update-index", "-z", "--index-info"],
+        privateEnv,
+        [...group].map((path) => `100644 ${emptyBlob}\t${path}\0`).join(""),
+      );
+      const current = selectSource();
+      for (const path of group) {
+        if (current.delete(path)) {
+          deleted.push(path);
+        }
+        rmSync(join(directory, path));
+      }
+      unstageDeletions(group);
+      if (
+        selected &&
+        (selected.size !== current.size || [...selected].some((path) => !current.has(path)))
+      ) {
+        throw new Error("source capsule policy changed while selecting deletions");
+      }
+      selected = current;
+    }
+    if (!selected) {
+      throw new Error("source capsule selection is missing");
+    }
+    for (const path of tracked.keys()) {
+      if (frozen.has(path) && !selected.has(path)) {
+        throw new Error(
+          `source capsule privacy selection excludes required tracked source ${JSON.stringify(path)}; resolve the conflict before uploading`,
+        );
+      }
+    }
+    for (const path of selected) {
+      if (frozen.has(path)) {
+        continue;
+      }
+      const parts = path.split("/");
+      const replacedTrackedPath =
+        tracked.has(path) &&
+        parts.some((_, index) => index > 0 && frozen.has(parts.slice(0, index).join("/")));
+      if (!replacedTrackedPath) {
+        throw new Error("source capsule selection contains an absent source entry");
+      }
+    }
+    const paths = [...selected].filter((path) => eligible.has(path) && frozen.has(path)).toSorted();
+    const finalPaths = new Set(paths);
+    for (const path of runtimePolicies) {
+      if (frozen.has(path) && !finalPaths.has(path)) {
+        throw new Error(
+          `source capsule cannot retain excluded repository runtime configuration ${JSON.stringify(path)} for staged delegation`,
+        );
+      }
+    }
+    for (const path of frozen.keys()) {
+      if (!finalPaths.has(path)) {
+        rmSync(join(directory, path));
+      }
+    }
+    // Hash frozen bytes without attributes or filters. Link blob inputs contain
+    // readlink bytes, never the referent's contents; only selected blobs enter Git.
+    const hashes = git(
+      directory,
+      ["hash-object", "-w", "--no-filters", "--stdin-paths"],
+      privateEnv,
+      paths.map((path) => JSON.stringify(frozen.get(path)!.blobPath)).join("\n") +
+        (paths.length ? "\n" : ""),
+    )
+      .trim()
+      .split("\n")
+      .filter(Boolean);
+    if (hashes.length !== paths.length || hashes.some((hash) => !/^[a-f0-9]{40}$/u.test(hash))) {
+      throw new Error("source capsule could not freeze every raw blob");
+    }
+    git(directory, ["read-tree", "--empty"], privateEnv);
+    git(
+      directory,
+      ["update-index", "-z", "--index-info"],
+      privateEnv,
+      paths.map((path, index) => `${frozen.get(path)!.mode} ${hashes[index]}\t${path}\0`).join(""),
+    );
+    const tree = capsuleObjectId(git(directory, ["write-tree"], privateEnv));
+    const carrier = capsuleObjectId(
+      git(
+        directory,
+        ["commit-tree", tree, "-p", baseSha],
+        privateEnv,
+        JSON.stringify({ deleted }) + "\n",
+      ),
+    );
+    git(directory, ["update-ref", capsuleRef, carrier], privateEnv);
+    const shallow = join(temporary, "shallow");
+    writeFileSync(shallow, `${baseSha}\n`);
+    const bundlePath = join(directory, bundleFile);
+    git(directory, ["bundle", "create", bundlePath, `${baseSha}..${capsuleRef}`], {
+      ...privateEnv,
+      GIT_SHALLOW_FILE: shallow,
+    });
+    const digest = createHash("sha256").update(readFileSync(bundlePath)).digest("hex");
+    const bundleHash = capsuleObjectId(
+      git(directory, ["hash-object", "-w", "--no-filters", bundlePath], privateEnv),
+    );
+    git(
+      directory,
+      ["update-index", "--add", "--cacheinfo", `100644,${bundleHash},${bundleFile}`],
+      privateEnv,
+    );
+    if (
+      git(repoRoot, ["rev-parse", "HEAD"]).trim() !== sourceSha ||
+      git(repoRoot, ["ls-files", "-v", "--stage", "-z"]) !== trackedRecords
+    ) {
+      throw new Error("source revision or index changed while freezing; retry after edits finish");
+    }
+    return {
+      sourceSha,
+      baseSha,
+      tree,
+      carrier,
+      digest,
+      bundlePath,
+      directory,
+      cleanup,
+      configPath,
+    };
+  } catch (error) {
+    cleanup();
+    throw error;
+  }
+}
diff --git a/scripts/create-dmg.sh b/scripts/create-dmg.sh
new file mode 100644
index 0000000000000000000000000000000000000000..326105e54bc881cfd16d179cf795d7f707ce6b1e
--- /dev/null
+++ b/scripts/create-dmg.sh
@@ -0,0 +1,250 @@
+#!/bin/bash
+set -euo pipefail
+
+# Create a styled DMG containing the app bundle + /Applications symlink.
+#
+# Usage:
+#   scripts/create-dmg.sh <app_path> [output_dmg]
+#
+# Env:
+#   DMG_VOLUME_NAME        default: CFBundleName
+#   DMG_BACKGROUND_PATH    default: apps/macos/Packaging/dmg-background.png
+#   DMG_BACKGROUND_SMALL   default: apps/macos/Packaging/dmg-background-small.png (recommended)
+#   DMG_WINDOW_BOUNDS      default: "400 100 1080 530" (680x430)
+#   DMG_ICON_SIZE          default: 144
+#   DMG_APP_POS            default: "170 305"
+#   DMG_APPS_POS           default: "510 305"
+#   SKIP_DMG_STYLE=1       skip Finder styling
+#   DMG_EXTRA_SECTORS      extra sectors to keep when shrinking RW image (default: 2048)
+
+APP_PATH="${1:-}"
+OUT_PATH="${2:-}"
+
+if [[ -z "$APP_PATH" ]]; then
+  echo "Usage: $0 <app_path> [output_dmg]" >&2
+  exit 1
+fi
+if [[ ! -d "$APP_PATH" ]]; then
+  echo "Error: App not found: $APP_PATH" >&2
+  exit 1
+fi
+
+ROOT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+source "$ROOT_DIR/scripts/lib/plistbuddy.sh"
+
+BUILD_DIR="$ROOT_DIR/dist"
+mkdir -p "$BUILD_DIR"
+
+APP_NAME="$(plist_print_required "$APP_PATH/Contents/Info.plist" CFBundleName)"
+VERSION="$(plist_print_required "$APP_PATH/Contents/Info.plist" CFBundleShortVersionString)"
+
+DMG_NAME="${APP_NAME}-${VERSION}.dmg"
+DMG_VOLUME_NAME="${DMG_VOLUME_NAME:-$APP_NAME}"
+DMG_BACKGROUND_SMALL="${DMG_BACKGROUND_SMALL:-$ROOT_DIR/apps/macos/Packaging/dmg-background-small.png}"
+DMG_BACKGROUND_PATH="${DMG_BACKGROUND_PATH:-$ROOT_DIR/apps/macos/Packaging/dmg-background.png}"
+
+DMG_WINDOW_BOUNDS="${DMG_WINDOW_BOUNDS:-400 100 1080 530}"
+DMG_ICON_SIZE="${DMG_ICON_SIZE:-144}"
+DMG_APP_POS="${DMG_APP_POS:-170 305}"
+DMG_APPS_POS="${DMG_APPS_POS:-510 305}"
+DMG_EXTRA_SECTORS="${DMG_EXTRA_SECTORS:-2048}"
+
+require_integer_list() {
+  local name="$1"
+  local raw="$2"
+  local expected_count="$3"
+  local values=()
+  local value
+
+  if [[ "$raw" == *$'\n'* || "$raw" == *$'\r'* ]]; then
+    echo "Error: $name must be a single line of integer values: '$raw'" >&2
+    exit 1
+  fi
+
+  read -r -a values <<< "$raw"
+  if [[ "${#values[@]}" -ne "$expected_count" ]]; then
+    echo "Error: $name must contain $expected_count integer value(s): '$raw'" >&2
+    exit 1
+  fi
+
+  for value in "${values[@]}"; do
+    if [[ ! "$value" =~ ^-?[0-9]+$ ]]; then
+      echo "Error: $name must contain only integer values: '$raw'" >&2
+      exit 1
+    fi
+  done
+}
+
+require_positive_integer() {
+  local name="$1"
+  local raw="$2"
+  if [[ ! "$raw" =~ ^[1-9][0-9]*$ ]]; then
+    echo "Error: $name must be a positive integer: '$raw'" >&2
+    exit 1
+  fi
+}
+
+require_nonnegative_integer() {
+  local name="$1"
+  local raw="$2"
+  if [[ ! "$raw" =~ ^(0|[1-9][0-9]*)$ || "${#raw}" -gt 9 ]]; then
+    echo "Error: $name must be a finite non-negative integer: '$raw'" >&2
+    exit 1
+  fi
+}
+
+require_integer_list DMG_WINDOW_BOUNDS "$DMG_WINDOW_BOUNDS" 4
+require_integer_list DMG_APP_POS "$DMG_APP_POS" 2
+require_integer_list DMG_APPS_POS "$DMG_APPS_POS" 2
+require_positive_integer DMG_ICON_SIZE "$DMG_ICON_SIZE"
+require_nonnegative_integer DMG_EXTRA_SECTORS "$DMG_EXTRA_SECTORS"
+
+to_applescript_list4() {
+  local raw="$1"
+  echo "$raw" | awk '{ printf "%s, %s, %s, %s", $1, $2, $3, $4 }'
+}
+
+to_applescript_pair() {
+  local raw="$1"
+  echo "$raw" | awk '{ printf "%s, %s", $1, $2 }'
+}
+
+if [[ -z "$OUT_PATH" ]]; then
+  OUT_PATH="$BUILD_DIR/$DMG_NAME"
+fi
+OUT_DIR="$(dirname "$OUT_PATH")"
+mkdir -p "$OUT_DIR"
+
+echo "Creating DMG: $OUT_PATH"
+
+DMG_TEMP="$(mktemp -d "${TMPDIR:-/tmp}/openclaw-dmg.XXXXXX")"
+DMG_SOURCE="$DMG_TEMP/source"
+MOUNT_POINT="$DMG_TEMP/mount"
+DMG_RW_PATH="$DMG_TEMP/image-rw.dmg"
+DMG_OUTPUT_TEMP=""
+DMG_FINAL_PATH=""
+MOUNTED=0
+
+cleanup_dmg() {
+  if [[ "$MOUNTED" == "1" ]]; then
+    if hdiutil detach "$MOUNT_POINT" -force 2>/dev/null; then
+      MOUNTED=0
+    else
+      echo "WARN: Preserving DMG temp root because mount is still attached: $DMG_TEMP" >&2
+      return
+    fi
+  fi
+  if [[ -n "$DMG_OUTPUT_TEMP" ]]; then
+    rm -rf "$DMG_OUTPUT_TEMP" 2>/dev/null || true
+  fi
+  rm -rf "$DMG_TEMP" 2>/dev/null || true
+}
+trap cleanup_dmg EXIT
+
+detach_dmg() {
+  local attempt
+  for attempt in {1..15}; do
+    if hdiutil detach "$MOUNT_POINT" -quiet 2>/dev/null; then
+      MOUNTED=0
+      return
+    fi
+    if (( attempt >= 3 )) && hdiutil detach "$MOUNT_POINT" -force 2>/dev/null; then
+      MOUNTED=0
+      return
+    fi
+    # Finder can retain the just-closed volume briefly on macOS runners.
+    sleep 2
+  done
+  return 1
+}
+
+mkdir -p "$DMG_SOURCE" "$MOUNT_POINT"
+cp -R "$APP_PATH" "$DMG_SOURCE/"
+ln -s /Applications "$DMG_SOURCE/Applications"
+
+# Let -srcfolder account for filesystem overhead; du plus fixed slack can
+# underallocate bundles containing many small runtime files.
+hdiutil create \
+  -volname "$DMG_VOLUME_NAME" \
+  -srcfolder "$DMG_SOURCE" \
+  -ov \
+  -format UDRW \
+  "$DMG_RW_PATH"
+
+hdiutil attach "$DMG_RW_PATH" -mountpoint "$MOUNT_POINT" -nobrowse
+MOUNTED=1
+
+if [[ "${SKIP_DMG_STYLE:-0}" != "1" ]]; then
+  mkdir -p "$MOUNT_POINT/.background"
+  if [[ -f "$DMG_BACKGROUND_SMALL" ]]; then
+    cp "$DMG_BACKGROUND_SMALL" "$MOUNT_POINT/.background/background.png"
+  elif [[ -f "$DMG_BACKGROUND_PATH" ]]; then
+    cp "$DMG_BACKGROUND_PATH" "$MOUNT_POINT/.background/background.png"
+  else
+    echo "WARN: DMG background missing: $DMG_BACKGROUND_SMALL / $DMG_BACKGROUND_PATH" >&2
+  fi
+
+  # Volume icon: reuse the app icon if available.
+  ICON_SRC="$ROOT_DIR/apps/macos/Sources/OpenClaw/Resources/OpenClaw.icns"
+  if [[ -f "$ICON_SRC" ]]; then
+    cp "$ICON_SRC" "$MOUNT_POINT/.VolumeIcon.icns"
+    if command -v SetFile >/dev/null 2>&1; then
+      SetFile -a C "$MOUNT_POINT" 2>/dev/null || true
+    fi
+  fi
+
+  osascript <<EOF
+tell application "Finder"
+  set dmgRoot to POSIX file "$MOUNT_POINT" as alias
+  set dmgDisk to disk of dmgRoot
+  tell dmgDisk
+    open
+    set current view of container window to icon view
+    set toolbar visible of container window to false
+    set statusbar visible of container window to false
+    set the bounds of container window to {$(to_applescript_list4 "$DMG_WINDOW_BOUNDS")}
+    set viewOptions to the icon view options of container window
+    set arrangement of viewOptions to not arranged
+    set icon size of viewOptions to ${DMG_ICON_SIZE}
+    if exists file ".background:background.png" then
+      set background picture of viewOptions to file ".background:background.png"
+    end if
+    set text size of viewOptions to 12
+    set label position of viewOptions to bottom
+    set shows item info of viewOptions to false
+    set shows icon preview of viewOptions to true
+    set position of item "${APP_NAME}.app" of container window to {$(to_applescript_pair "$DMG_APP_POS")}
+    set position of item "Applications" of container window to {$(to_applescript_pair "$DMG_APPS_POS")}
+    update without registering applications
+    delay 2
+    close
+    open
+    delay 1
+    close container window
+  end tell
+end tell
+EOF
+fi
+
+if ! detach_dmg; then
+  echo "Error: Failed to detach DMG mount: $MOUNT_POINT" >&2
+  exit 1
+fi
+
+DMG_LIMITS_PATH="$DMG_TEMP/resize-limits.txt"
+hdiutil resize -limits "$DMG_RW_PATH" >"$DMG_LIMITS_PATH" 2>/dev/null || true
+MIN_SECTORS="$(tail -n 1 "$DMG_LIMITS_PATH" 2>/dev/null | awk '{print $1}')"
+if [[ "$MIN_SECTORS" =~ ^[0-9]+$ ]] && [[ "$DMG_EXTRA_SECTORS" =~ ^[0-9]+$ ]]; then
+  TARGET_SECTORS=$((MIN_SECTORS + DMG_EXTRA_SECTORS))
+  echo "Shrinking RW image: min sectors=$MIN_SECTORS (+$DMG_EXTRA_SECTORS) -> $TARGET_SECTORS"
+  hdiutil resize -sectors "$TARGET_SECTORS" "$DMG_RW_PATH" >/dev/null 2>&1 || true
+fi
+
+DMG_OUTPUT_TEMP="$(mktemp -d "$(dirname "$OUT_PATH")/.openclaw-dmg.XXXXXX")"
+DMG_FINAL_PATH="$DMG_OUTPUT_TEMP/final.dmg"
+
+hdiutil convert "$DMG_RW_PATH" -format ULMO -o "$DMG_FINAL_PATH" -ov
+
+hdiutil verify "$DMG_FINAL_PATH" >/dev/null
+mv -f "$DMG_FINAL_PATH" "$OUT_PATH"
+echo "✅ DMG ready: $OUT_PATH"
diff --git a/scripts/deadcode-knip-runner.mts b/scripts/deadcode-knip-runner.mts
new file mode 100644
index 0000000000000000000000000000000000000000..387aede02a347bf08ac77f3a69af8c43e55b3976
--- /dev/null
+++ b/scripts/deadcode-knip-runner.mts
@@ -0,0 +1,316 @@
+import { spawn, type SpawnOptions } from "node:child_process";
+import { createPnpmRunnerSpawnSpec } from "./pnpm-runner.mts";
+
+const KNIP_VERSION = "6.32.2";
+const KNIP_TIMEOUT_MS = 10 * 60 * 1000;
+const KNIP_KILL_GRACE_MS = 5_000;
+const KNIP_PROCESS_TREE_EXIT_POLL_MS = 25;
+const KNIP_POST_FORCE_KILL_WAIT_MS = 1_000;
+const KNIP_HEARTBEAT_MS = 60_000;
+
+/** Maximum buffered Knip output retained for diagnostics. */
+export const KNIP_MAX_BUFFER_BYTES = 16 * 1024 * 1024;
+
+type KnipSignal = "SIGHUP" | "SIGINT" | "SIGKILL" | "SIGTERM";
+
+export type KnipRunResult = {
+  errorCode?: string;
+  errorMessage?: string;
+  output: string;
+  signal: string | null;
+  status: number | null;
+};
+
+type KnipOutputStream = {
+  destroy?: () => void;
+  off?: (event: "data", listener: (chunk: string | Uint8Array) => void) => unknown;
+  on: (event: "data", listener: (chunk: string | Uint8Array) => void) => unknown;
+};
+
+type KnipChildProcess = {
+  exitCode?: number | null;
+  on(event: "error", listener: (error: Error) => void): unknown;
+  on(
+    event: "exit" | "close",
+    listener: (status: number | null, signal: string | null) => void,
+  ): unknown;
+  pid?: number;
+  signalCode?: string | null;
+  stderr?: KnipOutputStream | null;
+  stdout?: KnipOutputStream | null;
+};
+
+type KnipSpawnCommand = (
+  command: string,
+  args: string[],
+  options: SpawnOptions,
+) => KnipChildProcess;
+
+type KnipRunParams = {
+  spawnCommand?: KnipSpawnCommand;
+  timeoutMs?: number;
+  heartbeatMs?: number;
+  maxBufferBytes?: number;
+  killGraceMs?: number;
+  scanName?: string;
+  writeStatus?: (message: string) => void;
+  env?: NodeJS.ProcessEnv;
+  nodeExecPath?: string;
+  npmExecPath?: string;
+  platform?: NodeJS.Platform;
+};
+
+function normalizeRepoPath(value: string) {
+  return value.replaceAll("\\", "/").replace(/^\.\//u, "");
+}
+
+export function uniqueSorted(values: string[]) {
+  return [...new Set(values.map(normalizeRepoPath))].toSorted((left, right) =>
+    left.localeCompare(right),
+  );
+}
+
+export function isLikelyRepoFilePath(value: string) {
+  const normalized = normalizeRepoPath(value);
+  return (
+    !normalized.startsWith("/") &&
+    !/^[A-Za-z]:/u.test(normalized) &&
+    !normalized.startsWith("../") &&
+    !normalized.includes("/../") &&
+    /\.(?:[cm]?[jt]sx?)$/u.test(normalized)
+  );
+}
+
+function spawnErrorCode(error: unknown) {
+  return error && typeof error === "object" && "code" in error ? String(error.code) : undefined;
+}
+
+function signalProcessTree(child: KnipChildProcess, signal: KnipSignal) {
+  if (!child.pid) {
+    return;
+  }
+  try {
+    if (process.platform === "win32") {
+      process.kill(child.pid, signal);
+    } else {
+      process.kill(-child.pid, signal);
+    }
+  } catch {
+    // The child may have exited between the timeout and signal delivery.
+  }
+}
+
+function processTreeAlive(child: KnipChildProcess) {
+  if (!child.pid) {
+    return false;
+  }
+  if (process.platform === "win32") {
+    return child.exitCode === null && child.signalCode === null;
+  }
+  try {
+    process.kill(-child.pid, 0);
+    return true;
+  } catch (error) {
+    return error instanceof Error && "code" in error && error.code === "EPERM";
+  }
+}
+
+async function waitForProcessTreeExit(child: KnipChildProcess, timeoutMs: number) {
+  const deadlineAt = Date.now() + timeoutMs;
+  while (Date.now() < deadlineAt) {
+    if (!processTreeAlive(child)) {
+      return true;
+    }
+    await new Promise((resolvePoll) => {
+      setTimeout(resolvePoll, KNIP_PROCESS_TREE_EXIT_POLL_MS);
+    });
+  }
+  return !processTreeAlive(child);
+}
+
+/** Runs pinned Knip with the supplied CLI arguments. */
+export async function runKnip(knipArgs: string[], params: KnipRunParams = {}) {
+  const run: KnipSpawnCommand = params.spawnCommand ?? spawn;
+  const timeoutMs = params.timeoutMs ?? KNIP_TIMEOUT_MS;
+  const heartbeatMs = params.heartbeatMs ?? KNIP_HEARTBEAT_MS;
+  const maxBufferBytes = params.maxBufferBytes ?? KNIP_MAX_BUFFER_BYTES;
+  const killGraceMs = params.killGraceMs ?? KNIP_KILL_GRACE_MS;
+  const scanName = params.scanName ?? "scan";
+  const writeStatus = params.writeStatus ?? ((message) => process.stderr.write(`${message}\n`));
+  const args = ["dlx", "--package", `knip@${KNIP_VERSION}`, "knip", ...knipArgs];
+
+  return await new Promise<KnipRunResult>((resolve) => {
+    const startedAt = Date.now();
+    let settled = false;
+    let timedOut = false;
+    let bufferExceeded = false;
+    let outputBytes = 0;
+    const output: string[] = [];
+    let killTimer: ReturnType<typeof setTimeout> | undefined;
+    let exitStatus: number | null = null;
+    let exitSignal: string | null = null;
+
+    const pnpm = createPnpmRunnerSpawnSpec({
+      detached: process.platform !== "win32",
+      env: params.env,
+      nodeExecPath: params.nodeExecPath,
+      npmExecPath: params.npmExecPath,
+      platform: params.platform,
+      pnpmArgs: args,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    const child = run(pnpm.command, pnpm.args, {
+      ...pnpm.options,
+      detached: process.platform !== "win32",
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    const parentSignalHandlers: Array<{ signal: KnipSignal; handler: () => void }> = [];
+    const cleanupParentSignalHandlers = () => {
+      for (const { signal, handler } of parentSignalHandlers) {
+        process.off(signal, handler);
+      }
+      parentSignalHandlers.length = 0;
+    };
+    const relayParentSignal = (signal: KnipSignal) => {
+      const handler = () => {
+        signalProcessTree(child, signal);
+        signalProcessTree(child, "SIGKILL");
+        cleanupParentSignalHandlers();
+        process.kill(process.pid, signal);
+      };
+      parentSignalHandlers.push({ signal, handler });
+      process.once(signal, handler);
+    };
+    if (process.platform !== "win32") {
+      relayParentSignal("SIGINT");
+      relayParentSignal("SIGTERM");
+      relayParentSignal("SIGHUP");
+    }
+
+    const heartbeatTimer = setInterval(() => {
+      writeStatus(
+        `[deadcode] Knip ${scanName} still running after ${Math.round((Date.now() - startedAt) / 1000)}s.`,
+      );
+    }, heartbeatMs);
+
+    const timeoutTimer = setTimeout(() => {
+      timedOut = true;
+      clearInterval(heartbeatTimer);
+      writeStatus(
+        `[deadcode] Knip ${scanName} timed out after ${Math.round(timeoutMs / 1000)}s; terminating.`,
+      );
+      signalProcessTree(child, "SIGTERM");
+      killTimer = setTimeout(() => signalProcessTree(child, "SIGKILL"), killGraceMs);
+    }, timeoutMs);
+
+    const finish = (result: Omit<KnipRunResult, "output">) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      clearTimeout(timeoutTimer);
+      clearInterval(heartbeatTimer);
+      clearTimeout(killTimer);
+      cleanupParentSignalHandlers();
+      resolve({ ...result, output: output.join("") });
+    };
+    const finishAfterProcessTreeCleanup = async (result: Omit<KnipRunResult, "output">) => {
+      if (processTreeAlive(child)) {
+        await waitForProcessTreeExit(child, killGraceMs);
+      }
+      if (processTreeAlive(child)) {
+        signalProcessTree(child, "SIGKILL");
+        await waitForProcessTreeExit(child, KNIP_POST_FORCE_KILL_WAIT_MS);
+      }
+      finish(result);
+    };
+
+    const appendOutput = (chunk: string | Uint8Array) => {
+      if (settled || bufferExceeded) {
+        return;
+      }
+      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      const remainingBytes = maxBufferBytes - outputBytes;
+      if (buffer.length <= remainingBytes) {
+        output.push(buffer.toString("utf8"));
+        outputBytes += buffer.length;
+        return;
+      }
+      if (remainingBytes > 0) {
+        output.push(buffer.subarray(0, remainingBytes).toString("utf8"));
+        outputBytes = maxBufferBytes;
+      }
+      bufferExceeded = true;
+      writeStatus(
+        `[deadcode] Knip ${scanName} exceeded ${maxBufferBytes} output bytes; terminating.`,
+      );
+      child.stdout?.off?.("data", appendOutput);
+      child.stderr?.off?.("data", appendOutput);
+      child.stdout?.destroy?.();
+      child.stderr?.destroy?.();
+      clearInterval(heartbeatTimer);
+      signalProcessTree(child, "SIGTERM");
+      killTimer = setTimeout(() => signalProcessTree(child, "SIGKILL"), killGraceMs);
+    };
+
+    child.stdout?.on("data", appendOutput);
+    child.stderr?.on("data", appendOutput);
+    child.on("error", (error) =>
+      finish({
+        errorCode: spawnErrorCode(error),
+        errorMessage: error.message,
+        signal: null,
+        status: null,
+      }),
+    );
+    child.on("exit", (status, signal) => {
+      exitStatus = status;
+      exitSignal = signal;
+    });
+    child.on("close", (status, signal) => {
+      exitStatus = exitStatus ?? status;
+      exitSignal = exitSignal ?? signal;
+      const elapsedSeconds = Math.round((Date.now() - startedAt) / 1000);
+      if (timedOut) {
+        void finishAfterProcessTreeCleanup({
+          errorCode: "ETIMEDOUT",
+          errorMessage: `Knip ${scanName} timed out after ${elapsedSeconds}s`,
+          signal: exitSignal,
+          status: exitStatus,
+        });
+        return;
+      }
+      if (bufferExceeded) {
+        void finishAfterProcessTreeCleanup({
+          errorCode: "ENOBUFS",
+          errorMessage: `Knip ${scanName} exceeded ${maxBufferBytes} output bytes`,
+          signal: exitSignal,
+          status: exitStatus,
+        });
+        return;
+      }
+      finish({
+        errorCode: undefined,
+        errorMessage: undefined,
+        signal: exitSignal,
+        status: exitStatus,
+      });
+    });
+  });
+}
+
+export async function runKnipScans<T extends { name: string; args: readonly string[] }>(
+  scans: readonly T[],
+  commonArgs: readonly string[],
+  report: (scan: T, result: KnipRunResult) => boolean,
+): Promise<void> {
+  const results = await Promise.all(
+    scans.map(async (scan) => {
+      const result = await runKnip([...scan.args, ...commonArgs], { scanName: scan.name });
+      return report(scan, result);
+    }),
+  );
+  if (results.includes(false)) {
+    process.exitCode = 1;
+  }
+}
diff --git a/scripts/detect-private-keys.mts b/scripts/detect-private-keys.mts
new file mode 100644
index 0000000000000000000000000000000000000000..c820fa063a3f20121c2132ddbd783f486167f75f
--- /dev/null
+++ b/scripts/detect-private-keys.mts
@@ -0,0 +1,132 @@
+#!/usr/bin/env node
+// Flags committed private-key material from tracked files only. Dependency-free
+// by design: the CI security-fast job runs it before any install and after
+// checkout credentials are dropped, so it needs no network and executes no
+// third-party hook code. Marker set mirrors pre-commit-hooks v6.0.0
+// detect_private_key.py (byte substrings, not regexes) so local prek runs and
+// CI agree on what counts as a key. Self-contained by contract: pull-request
+// CI extracts the base-ref copy with `git show` and runs it from outside the
+// candidate tree, so a relative import here would break that trusted path.
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const TOOL_NAME = "detect-private-keys";
+
+// Assembled at load time so this file never contains a literal marker: any
+// byte-substring scanner (this one, or the upstream hook that scans PRs) would
+// otherwise flag its own table, and a path carve-out for the scanner would
+// then be needed in every scanner config.
+const KEY = "PRIVATE KEY";
+export const PRIVATE_KEY_MARKERS: readonly string[] = [
+  `BEGIN RSA ${KEY}`,
+  `BEGIN DSA ${KEY}`,
+  `BEGIN EC ${KEY}`,
+  `BEGIN OPENSSH ${KEY}`,
+  `BEGIN ${KEY}`,
+  ["PuTTY-User-Key-File-", "2"].join(""),
+  `BEGIN SSH2 ENCRYPTED ${KEY}`,
+  `BEGIN PGP ${KEY} BLOCK`,
+  `BEGIN ENCRYPTED ${KEY}`,
+  ["BEGIN OpenVPN Static key V", "1"].join(""),
+];
+
+// Colocated test fixtures and the iOS Fastfile's marker-bearing string. The
+// list lives here, not in a config the scanner reads, so CI can run a
+// base-ref copy of this file and get the base-ref policy with it.
+export const PRIVATE_KEY_SCAN_EXCLUDE = /(^|\/)(apps\/ios\/fastlane\/Fastfile$|.*\.test\.ts$)/;
+
+const REGULAR_FILE_MODES = new Set(["100644", "100755"]);
+
+export function findPrivateKeyMarker(content: Buffer): string | undefined {
+  return PRIVATE_KEY_MARKERS.find((marker) => content.includes(marker));
+}
+
+// Regular tracked files only: symlinks would double-scan or dangle, gitlinks
+// are directories. Matches pre-commit's `types: [text]` scope closely enough
+// that the current tree passes without a binary sniffer.
+export function listTrackedRegularFiles(cwd: string): string[] {
+  const result = spawnSync("git", ["ls-files", "-z", "--stage"], {
+    cwd,
+    encoding: "utf8",
+    maxBuffer: 256 * 1024 * 1024,
+  });
+  if (result.error) {
+    throw result.error;
+  }
+  if (result.status !== 0) {
+    throw new Error(`git ls-files exited ${result.status}: ${result.stderr.trim()}`);
+  }
+  const files: string[] = [];
+  for (const entry of result.stdout.split("\0")) {
+    if (!entry) {
+      continue;
+    }
+    const tabIndex = entry.indexOf("\t");
+    const mode = entry.slice(0, entry.indexOf(" "));
+    if (REGULAR_FILE_MODES.has(mode)) {
+      files.push(entry.slice(tabIndex + 1));
+    }
+  }
+  return files;
+}
+
+export type PrivateKeyFinding = { file: string; marker: string };
+
+export function scanFilesForPrivateKeys(
+  files: readonly string[],
+  cwd: string,
+): PrivateKeyFinding[] {
+  const findings: PrivateKeyFinding[] = [];
+  for (const file of files) {
+    if (PRIVATE_KEY_SCAN_EXCLUDE.test(file)) {
+      continue;
+    }
+    const marker = findPrivateKeyMarker(fs.readFileSync(path.resolve(cwd, file)));
+    if (marker) {
+      findings.push({ file, marker });
+    }
+  }
+  return findings;
+}
+
+function main(argv: readonly string[]): number {
+  const cwd = process.cwd();
+  // Explicit paths come from pre-commit's staged-file batches; no args scans
+  // every tracked regular file (CI and `--all-files`).
+  const files = argv.length > 0 ? argv : listTrackedRegularFiles(cwd);
+  const findings = scanFilesForPrivateKeys(files, cwd);
+  if (findings.length === 0) {
+    console.log(`[${TOOL_NAME}] scanned ${files.length} files; no private keys found.`);
+    return 0;
+  }
+  for (const finding of findings) {
+    console.error(`Private key found: ${finding.file} (${finding.marker})`);
+  }
+  console.error("Remove or rotate the key material; test fixtures belong in *.test.ts files.");
+  return 1;
+}
+
+function isDirectRun(): boolean {
+  if (!process.argv[1]) {
+    return false;
+  }
+  const normalize = (value: string) =>
+    process.platform === "win32" ? path.resolve(value).toLowerCase() : path.resolve(value);
+  return normalize(process.argv[1]) === normalize(fileURLToPath(import.meta.url));
+}
+
+if (isDirectRun()) {
+  let exitCode: number;
+  try {
+    exitCode = main(process.argv.slice(2));
+  } catch (error) {
+    console.error(error);
+    exitCode = 1;
+  }
+  if (exitCode !== 0) {
+    console.error(`[${TOOL_NAME}] FAILED (exit ${exitCode})`);
+  }
+  process.exitCode = exitCode;
+}
diff --git a/scripts/docker-e2e-rerun.mts b/scripts/docker-e2e-rerun.mts
new file mode 100644
index 0000000000000000000000000000000000000000..978af8cffd3a17e8acce01706fd52764c9d6abf4
--- /dev/null
+++ b/scripts/docker-e2e-rerun.mts
@@ -0,0 +1,590 @@
+#!/usr/bin/env node
+// Builds cheap rerun commands from a Docker E2E GitHub run or local summary.
+// For GitHub runs, the script downloads Docker E2E artifacts, reads
+// summary/failures JSON, and prints targeted workflow commands for failed
+// lanes, repacking the exact artifact target and reusing GHCR-backed prepared
+// image refs when artifacts expose them.
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { isRecord } from "@openclaw/normalization-core/record-coerce";
+import { readDockerE2eJsonArtifact } from "./lib/docker-e2e-json-artifacts.mts";
+
+const DEFAULT_WORKFLOW = "openclaw-live-and-e2e-checks-reusable.yml";
+
+const REUSE_INPUT_KEYS = [
+  "bareImage",
+  "functionalImage",
+  "publishedUpgradeSurvivorBaseline",
+  "publishedUpgradeSurvivorBaselines",
+  "publishedUpgradeSurvivorScenarios",
+  "allowUnreleasedChangelog",
+] as const;
+
+type ReuseInputKey = (typeof REUSE_INPUT_KEYS)[number];
+type ReuseInputs = Partial<Record<ReuseInputKey, string>>;
+
+function usage() {
+  return [
+    "Usage:",
+    "  node --import tsx scripts/docker-e2e-rerun.mts <run-id|summary.json|failures.json> [--repo owner/repo] [--dir output-dir] [--workflow workflow.yml] [--ref ref]",
+  ].join("\n");
+}
+
+function parseArgs(argv: string[]) {
+  const options = {
+    dir: "",
+    help: false,
+    input: "",
+    ref: "",
+    repo: "",
+    workflow: DEFAULT_WORKFLOW,
+  };
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index]!;
+    if (arg === "--help" || arg === "-h") {
+      options.help = true;
+    } else if (arg === "--repo") {
+      options.repo = argv[(index += 1)] ?? "";
+    } else if (arg?.startsWith("--repo=")) {
+      options.repo = arg.slice("--repo=".length);
+    } else if (arg === "--dir") {
+      options.dir = argv[(index += 1)] ?? "";
+    } else if (arg?.startsWith("--dir=")) {
+      options.dir = arg.slice("--dir=".length);
+    } else if (arg === "--workflow") {
+      options.workflow = argv[(index += 1)] ?? "";
+    } else if (arg?.startsWith("--workflow=")) {
+      options.workflow = arg.slice("--workflow=".length);
+    } else if (arg === "--ref") {
+      options.ref = argv[(index += 1)] ?? "";
+    } else if (arg?.startsWith("--ref=")) {
+      options.ref = arg.slice("--ref=".length);
+    } else if (!options.input) {
+      options.input = arg;
+    } else {
+      throw new Error(`unknown argument: ${arg}\n${usage()}`);
+    }
+  }
+  if (options.help) {
+    return options;
+  }
+  if (!options.input || !options.workflow) {
+    throw new Error(usage());
+  }
+  return options;
+}
+
+function run(
+  command: string,
+  args: string[],
+  options: { stdio?: "inherit" | ["ignore", "pipe", "pipe"] } = {},
+): string {
+  const result = spawnSync(command, args, {
+    encoding: "utf8",
+    stdio: options.stdio ?? ["ignore", "pipe", "pipe"],
+  });
+  if (result.status !== 0) {
+    throw new Error(
+      `${command} ${args.join(" ")} failed with ${result.status ?? result.signal}\n${result.stderr}`,
+    );
+  }
+  return result.stdout;
+}
+
+function readJson(file: string) {
+  const value = readDockerE2eJsonArtifact(file);
+  return isRecord(value) ? value : {};
+}
+
+function shellQuote(value: string): string {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+
+function laneNeedsReleasePath(lane: string): boolean {
+  return /^bundled-channel(?:-|$)/u.test(lane);
+}
+
+function maybeGhcrImage(value: unknown): string {
+  return typeof value === "string" && value.startsWith("ghcr.io/") ? value : "";
+}
+
+const TRUSTED_WORKFLOW_INPUTS = new Map<string, ReuseInputKey>([
+  ["docker_e2e_bare_image", "bareImage"],
+  ["docker_e2e_functional_image", "functionalImage"],
+  ["published_upgrade_survivor_baseline", "publishedUpgradeSurvivorBaseline"],
+  ["published_upgrade_survivor_baselines", "publishedUpgradeSurvivorBaselines"],
+  ["published_upgrade_survivor_scenarios", "publishedUpgradeSurvivorScenarios"],
+  ["allow_unreleased_changelog", "allowUnreleasedChangelog"],
+]);
+
+const WORKFLOW_INPUT_RE = /(?:^|\s)-f\s+([a-z0-9_]+)=('([^']*)'|[^\s]+)/gu;
+
+function trustedReuseInputsFromCommand(command: unknown): ReuseInputs {
+  const text = typeof command === "string" ? command : "";
+  if (!/^\s*gh\s+workflow\s+run\s/u.test(text)) {
+    return {};
+  }
+  const inputs: ReuseInputs = {};
+  for (const match of text.matchAll(WORKFLOW_INPUT_RE)) {
+    const input = match[1];
+    const target = input ? TRUSTED_WORKFLOW_INPUTS.get(input) : undefined;
+    const value = (match[3] ?? match[2] ?? "").replace(/^'/u, "").replace(/'$/u, "");
+    if (!target || !value) {
+      continue;
+    }
+    let normalized = value;
+    if (target === "bareImage" || target === "functionalImage") {
+      normalized = maybeGhcrImage(value);
+    } else if (target === "allowUnreleasedChangelog" && value !== "true") {
+      normalized = "";
+    }
+    if (normalized) {
+      inputs[target] = normalized;
+    }
+  }
+  return inputs;
+}
+
+function reuseInputsFromJson(parsed: Record<string, unknown>): ReuseInputs {
+  const images = isRecord(parsed.images) ? parsed.images : {};
+  const bareImage = maybeGhcrImage(images.bare);
+  const functionalImage = maybeGhcrImage(images.functional);
+  const allowUnreleasedChangelog = parsed.allowUnreleasedChangelog === true ? "true" : undefined;
+  return {
+    ...(allowUnreleasedChangelog ? { allowUnreleasedChangelog } : {}),
+    ...(bareImage ? { bareImage } : {}),
+    ...(functionalImage ? { functionalImage } : {}),
+  };
+}
+
+function artifactTargetRef(
+  parsed: Record<string, unknown>,
+  file: string,
+  required: boolean,
+): string {
+  const github = isRecord(parsed.github) ? parsed.github : {};
+  const values = [parsed.ref, github.selectedSha].filter(
+    (value) => value !== undefined && value !== null && value !== "",
+  );
+  if (
+    !values.every(
+      (value): value is string => typeof value === "string" && /^[a-f0-9]{40}$/u.test(value),
+    )
+  ) {
+    if (required) {
+      throw new Error(`${file} has an invalid artifact target ref; expected a full commit SHA`);
+    }
+    return "";
+  }
+  const refs = [...new Set(values)];
+  if (refs.length > 1) {
+    if (required) {
+      throw new Error(`${file} has conflicting artifact target refs: ${refs.join(", ")}`);
+    }
+    return "";
+  }
+  return refs[0] || "";
+}
+
+function discardMismatchedPreparedImages(entry: FailedEntry, explicitRef: string): FailedEntry {
+  if (!explicitRef || entry.artifactRef === explicitRef) {
+    return entry;
+  }
+  const reuseInputs = Object.fromEntries(
+    Object.entries(entry.reuseInputs ?? {}).filter(
+      ([key]) => key !== "bareImage" && key !== "functionalImage",
+    ),
+  );
+  return { ...entry, reuseInputs };
+}
+
+function sameReuseInputs(left: ReuseInputs | undefined, right: ReuseInputs | undefined): boolean {
+  return REUSE_INPUT_KEYS.every((key) => (left?.[key] || "") === (right?.[key] || ""));
+}
+
+function reuseInputsKey(inputs: ReuseInputs | undefined): string {
+  return JSON.stringify(REUSE_INPUT_KEYS.map((key) => inputs?.[key] || ""));
+}
+
+function commonReuseInputs(entries: FailedEntry[]): ReuseInputs {
+  const first = entries[0]?.reuseInputs;
+  return first && entries.every((entry) => sameReuseInputs(first, entry.reuseInputs)) ? first : {};
+}
+
+function groupByReuseInputs(entries: FailedEntry[]): FailedEntry[][] {
+  const groups = new Map<string, FailedEntry[]>();
+  for (const entry of entries) {
+    const key = reuseInputsKey(entry.reuseInputs);
+    const group = groups.get(key);
+    if (group) {
+      group.push(entry);
+    } else {
+      groups.set(key, [entry]);
+    }
+  }
+  return [...groups.values()];
+}
+
+function ghWorkflowCommand(
+  lanes: string[],
+  ref: string,
+  workflow: string,
+  reuseInputs: ReuseInputs = {},
+): string {
+  const workflowRef = process.env.OPENCLAW_DOCKER_E2E_WORKFLOW_REF;
+  const releasePath = lanes.some(laneNeedsReleasePath);
+  const fields = [
+    "gh workflow run",
+    shellQuote(workflow),
+    ...(workflowRef ? ["--ref", shellQuote(workflowRef)] : []),
+    "-f",
+    `ref=${shellQuote(ref)}`,
+    "-f",
+    "include_repo_e2e=false",
+    "-f",
+    `include_release_path_suites=${releasePath ? "true" : "false"}`,
+    "-f",
+    "include_openwebui=false",
+    "-f",
+    `docker_lanes=${shellQuote(lanes.join(" "))}`,
+    "-f",
+    "include_live_suites=false",
+    "-f",
+    "live_models_only=false",
+  ];
+  if (reuseInputs.bareImage) {
+    fields.push("-f", `docker_e2e_bare_image=${shellQuote(reuseInputs.bareImage)}`);
+  }
+  if (reuseInputs.functionalImage) {
+    fields.push("-f", `docker_e2e_functional_image=${shellQuote(reuseInputs.functionalImage)}`);
+  }
+  if (reuseInputs.bareImage || reuseInputs.functionalImage) {
+    fields.push("-f", "shared_image_policy=existing-only");
+  }
+  if (reuseInputs.allowUnreleasedChangelog === "true") {
+    fields.push("-f", "allow_unreleased_changelog=true");
+  }
+  if (reuseInputs.publishedUpgradeSurvivorBaseline) {
+    fields.push(
+      "-f",
+      `published_upgrade_survivor_baseline=${shellQuote(
+        reuseInputs.publishedUpgradeSurvivorBaseline,
+      )}`,
+    );
+  }
+  if (reuseInputs.publishedUpgradeSurvivorBaselines) {
+    fields.push(
+      "-f",
+      `published_upgrade_survivor_baselines=${shellQuote(
+        reuseInputs.publishedUpgradeSurvivorBaselines,
+      )}`,
+    );
+  }
+  if (reuseInputs.publishedUpgradeSurvivorScenarios) {
+    fields.push(
+      "-f",
+      `published_upgrade_survivor_scenarios=${shellQuote(
+        reuseInputs.publishedUpgradeSurvivorScenarios,
+      )}`,
+    );
+  }
+  return fields.join(" ");
+}
+
+function failureName(failure: Record<string, unknown>): string {
+  if (typeof failure.name === "string" && failure.name) {
+    return failure.name;
+  }
+  return typeof failure.lane === "string" ? failure.lane : "";
+}
+
+function failedEntryFromRecord(
+  failure: Record<string, unknown>,
+  artifactRef: string,
+  reuseInputs: ReuseInputs,
+) {
+  const lane = failureName(failure);
+  const targetable = failure.targetable !== false;
+  const workflowInputs = {
+    ...trustedReuseInputsFromCommand(failure.ghWorkflowCommand),
+    ...reuseInputs,
+  };
+  return {
+    artifactRef,
+    lane,
+    localRerunCommand: typeof failure.rerunCommand === "string" ? failure.rerunCommand : "",
+    reuseInputs: workflowInputs,
+    targetable,
+  };
+}
+
+type FailedEntry = ReturnType<typeof failedEntryFromRecord>;
+
+function mergeReuseInputs(left: ReuseInputs = {}, right: ReuseInputs = {}): ReuseInputs {
+  const merged: ReuseInputs = { ...left };
+  for (const key of REUSE_INPUT_KEYS) {
+    const value = right[key];
+    if (value) {
+      merged[key] = value;
+    }
+  }
+  return merged;
+}
+
+function detectRepo(): string {
+  return run("gh", ["repo", "view", "--json", "nameWithOwner", "--jq", ".nameWithOwner"]).trim();
+}
+
+function findFiles(rootDir: string, basenames: Set<string>, out: string[] = []): string[] {
+  for (const entry of fs.readdirSync(rootDir, { withFileTypes: true })) {
+    const file = path.join(rootDir, entry.name);
+    if (entry.isDirectory()) {
+      findFiles(file, basenames, out);
+    } else if (basenames.has(entry.name)) {
+      out.push(file);
+    }
+  }
+  return out;
+}
+
+function failedLaneEntriesFromJson(file: string, explicitRef = ""): FailedEntry[] {
+  const parsed = readJson(file);
+  const reuseInputs = reuseInputsFromJson(parsed);
+  const source = path.basename(file);
+  let failures;
+  const lanes = Array.isArray(parsed.lanes) ? parsed.lanes.filter(isRecord) : [];
+  if (source === "failures.json") {
+    failures = lanes.filter((lane) => failureName(lane));
+  } else {
+    const recordedFailures = Array.isArray(parsed.failures) ? parsed.failures.filter(isRecord) : [];
+    failures =
+      recordedFailures.length > 0 ? recordedFailures : lanes.filter((lane) => lane.status !== 0);
+    failures = failures.filter((lane) => failureName(lane));
+  }
+  const needsTargetRef = !explicitRef && failures.some((failure) => failure.targetable !== false);
+  const artifactRef = artifactTargetRef(parsed, file, needsTargetRef);
+  return failures.map((failure) =>
+    discardMismatchedPreparedImages(
+      failedEntryFromRecord(failure, artifactRef, reuseInputs),
+      explicitRef,
+    ),
+  );
+}
+
+function mergeArtifactRefs(left: string, right: string, lane: string): string {
+  if (left && right && left !== right) {
+    throw new Error(`lane ${lane} has mixed artifact target refs: ${left}, ${right}`);
+  }
+  return left || right || "";
+}
+
+function mergeByLane(entries: FailedEntry[], explicitRef = ""): FailedEntry[] {
+  const byLane = new Map<string, FailedEntry>();
+  for (const entry of entries) {
+    const existing = byLane.get(entry.lane);
+    if (existing) {
+      byLane.set(entry.lane, {
+        ...existing,
+        ...entry,
+        artifactRef:
+          explicitRef || mergeArtifactRefs(existing.artifactRef, entry.artifactRef, entry.lane),
+        localRerunCommand: existing.localRerunCommand || entry.localRerunCommand,
+        reuseInputs: mergeReuseInputs(existing.reuseInputs, entry.reuseInputs),
+        targetable: existing.targetable && entry.targetable,
+      });
+    } else {
+      byLane.set(entry.lane, { ...entry, artifactRef: explicitRef || entry.artifactRef });
+    }
+  }
+  return [...byLane.values()].toSorted((left, right) => left.lane.localeCompare(right.lane));
+}
+
+function resolveTargetRef(entries: FailedEntry[], explicitRef: string): string {
+  const targetable = entries.filter((entry) => entry.targetable);
+  if (targetable.length === 0) {
+    return "";
+  }
+  if (explicitRef) {
+    if (!/^[a-f0-9]{40}$/u.test(explicitRef)) {
+      throw new Error("--ref must be the exact lowercase 40-character target SHA");
+    }
+    return explicitRef;
+  }
+  const missing = targetable.filter((entry) => !entry.artifactRef);
+  if (missing.length > 0) {
+    throw new Error(
+      `Docker E2E artifacts are missing an exact target ref for: ${missing.map((entry) => entry.lane).join(", ")}; pass --ref explicitly`,
+    );
+  }
+  const refs = [...new Set(targetable.map((entry) => entry.artifactRef).filter(Boolean))];
+  if (refs.length > 1) {
+    throw new Error(`Docker E2E artifacts contain mixed target refs: ${refs.join(", ")}`);
+  }
+  return refs[0] || "";
+}
+
+function downloadDockerArtifacts(runId: string, repo: string, outputDir: string): string[] {
+  fs.mkdirSync(outputDir, { recursive: true });
+  const payload: unknown = JSON.parse(
+    run("gh", [
+      "api",
+      `repos/${repo}/actions/runs/${runId}/artifacts?per_page=100`,
+      "--jq",
+      ".artifacts",
+    ]),
+  );
+  const artifacts = Array.isArray(payload) ? payload.filter(isRecord) : [];
+  const names = artifacts.flatMap((artifact) =>
+    artifact.expired !== true &&
+    typeof artifact.name === "string" &&
+    artifact.name.startsWith("docker-e2e-")
+      ? [artifact.name]
+      : [],
+  );
+  if (names.length === 0) {
+    throw new Error(`No docker-e2e-* artifacts found for run ${runId}`);
+  }
+  for (const [index, name] of names.entries()) {
+    const artifactDir = path.join(
+      outputDir,
+      `${String(index).padStart(3, "0")}-${safePathSegment(name)}`,
+    );
+    run("gh", ["run", "download", runId, "--repo", repo, "--name", name, "--dir", artifactDir], {
+      stdio: "inherit",
+    });
+  }
+  return names;
+}
+
+function runInfo(runId: string, repo: string) {
+  const value: unknown = JSON.parse(
+    run("gh", [
+      "run",
+      "view",
+      runId,
+      "--repo",
+      repo,
+      "--json",
+      "databaseId,headSha,headBranch,status,conclusion,url,workflowName",
+    ]),
+  );
+  return {
+    url: isRecord(value) && typeof value.url === "string" ? value.url : undefined,
+    workflowName:
+      isRecord(value) && typeof value.workflowName === "string" ? value.workflowName : undefined,
+  };
+}
+
+function safePathSegment(value: string): string {
+  return (
+    value
+      .replace(/[^a-zA-Z0-9_.-]+/gu, "-")
+      .replace(/^-+|-+$/gu, "")
+      .slice(0, 80) || "run"
+  );
+}
+
+function defaultOutputDir(input: string): string {
+  return fs.mkdtempSync(
+    path.join(os.tmpdir(), `openclaw-docker-e2e-rerun-${safePathSegment(input)}-`),
+  );
+}
+
+function printEntries(
+  entries: FailedEntry[],
+  ref: string,
+  workflow: string,
+  runValue?: ReturnType<typeof runInfo>,
+): void {
+  if (runValue) {
+    console.log(`Run: ${runValue.url}`);
+    console.log(`Workflow: ${runValue.workflowName}`);
+  }
+  console.log(`Ref: ${ref}`);
+  console.log(
+    "Targeted GitHub reruns repack the exact artifact target and reuse GHCR-backed prepared image refs when the downloaded artifacts expose them.",
+  );
+  if (entries.length === 0) {
+    console.log("No failed Docker E2E lanes found.");
+    return;
+  }
+  const workflowEntries = entries.filter((entry) => entry.targetable);
+  console.log(`Failed Docker E2E entries: ${entries.map((entry) => entry.lane).join(", ")}`);
+  if (workflowEntries.length > 0) {
+    console.log("");
+    const workflowGroups = groupByReuseInputs(workflowEntries);
+    if (workflowGroups.length === 1) {
+      console.log("Combined GitHub rerun:");
+      console.log(
+        ghWorkflowCommand(
+          workflowEntries.map((entry) => entry.lane),
+          ref,
+          workflow,
+          commonReuseInputs(workflowEntries),
+        ),
+      );
+    } else {
+      console.log("Combined GitHub reruns:");
+      for (const group of workflowGroups) {
+        const lanes = group.map((entry) => entry.lane);
+        console.log(
+          `- ${lanes.join(", ")}: ${ghWorkflowCommand(lanes, ref, workflow, group[0]?.reuseInputs)}`,
+        );
+      }
+    }
+    console.log("");
+    console.log("Per-lane GitHub reruns:");
+    for (const entry of workflowEntries) {
+      console.log(
+        `- ${entry.lane}: ${ghWorkflowCommand([entry.lane], ref, workflow, entry.reuseInputs)}`,
+      );
+    }
+  } else {
+    console.log("");
+    console.log("No targetable failed Docker E2E lanes found.");
+  }
+  console.log("");
+  console.log("Local rerun starting points:");
+  for (const entry of entries) {
+    if (entry.localRerunCommand) {
+      console.log(`- ${entry.lane}: ${entry.localRerunCommand}`);
+    }
+  }
+}
+
+function main(): void {
+  const options = parseArgs(process.argv.slice(2));
+  if (options.help) {
+    console.log(usage());
+    return;
+  }
+  const isLocalJson = fs.existsSync(options.input) && fs.statSync(options.input).isFile();
+  if (isLocalJson) {
+    const entries = mergeByLane(failedLaneEntriesFromJson(options.input, options.ref), options.ref);
+    const ref = resolveTargetRef(entries, options.ref);
+    printEntries(entries, ref, options.workflow);
+  } else {
+    const repo = options.repo || detectRepo();
+    const runLocal = runInfo(options.input, repo);
+    const outputDir = options.dir || defaultOutputDir(options.input);
+    const artifactNames = downloadDockerArtifacts(options.input, repo, outputDir);
+    const files = findFiles(outputDir, new Set(["failures.json", "summary.json"]));
+    const entries = mergeByLane(
+      files.flatMap((file) => failedLaneEntriesFromJson(file, options.ref)),
+      options.ref,
+    );
+    const ref = resolveTargetRef(entries, options.ref);
+    console.log(`Artifacts: ${artifactNames.join(", ")}`);
+    console.log(`Downloaded: ${outputDir}`);
+    printEntries(entries, ref, options.workflow, runLocal);
+  }
+}
+
+try {
+  main();
+} catch (error) {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(1);
+}
diff --git a/scripts/docker-e2e.mjs b/scripts/docker-e2e.mjs
new file mode 100644
index 0000000000000000000000000000000000000000..cfc2828687638366a66bf69e1e8c463e3057abfb
--- /dev/null
+++ b/scripts/docker-e2e.mjs
@@ -0,0 +1,5 @@
+import { runTsxCliShim } from "./lib/tsx-cli-shim.mjs";
+
+await runTsxCliShim(import.meta.url, {
+  implementation: "./docker-e2e.mts",
+});
diff --git a/scripts/docs-link-audit.mjs b/scripts/docs-link-audit.mjs
new file mode 100644
index 0000000000000000000000000000000000000000..d355ef798b1b27125d86631c9cd9d5635e644cc2
--- /dev/null
+++ b/scripts/docs-link-audit.mjs
@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { runTsxCliShim } from "./lib/tsx-cli-shim.mjs";
+
+await runTsxCliShim(import.meta.url, { implementation: "./docs-link-audit.mts" });
diff --git a/scripts/embedded-run-liveness-leak.ts b/scripts/embedded-run-liveness-leak.ts
new file mode 100644
index 0000000000000000000000000000000000000000..53a76ad1cc8091f328bf69ffe3bdcdaf4d124ab9
--- /dev/null
+++ b/scripts/embedded-run-liveness-leak.ts
@@ -0,0 +1,96 @@
+/**
+ * Checks that a completed liveness join releases its caller while delivery is
+ * still pending. Run with:
+ * pnpm leak:embedded-run:liveness
+ */
+import { mkdirSync } from "node:fs";
+import { setImmediate as nextTurn } from "node:timers/promises";
+import { writeHeapSnapshot } from "node:v8";
+import { joinWithRunLivenessDeadline } from "../src/agents/embedded-agent-runner/run/abortable.js";
+
+class AttemptContext {
+  payload = Array.from({ length: 10_000 }, (_, index) => index);
+  timedOut = false;
+}
+
+const snapshotDirectory = ".tmp/embedded-run-liveness-leak";
+const attemptsPerMode = 100;
+
+async function countRetained(tracked: WeakRef<AttemptContext>[]): Promise<number> {
+  for (let index = 0; index < 10; index++) {
+    await nextTurn();
+    global.gc?.();
+  }
+  return tracked.filter((reference) => reference.deref()).length;
+}
+
+function joinPendingDelivery(
+  mode: "timeout" | "abort",
+  tracked: WeakRef<AttemptContext>[],
+  releases: (() => void)[],
+): Promise<void> {
+  const attempt = new AttemptContext();
+  const controller = new AbortController();
+  const delivery = new Promise<void>((resolve) => {
+    releases.push(resolve);
+  });
+  tracked.push(new WeakRef(attempt));
+  // The two callbacks share a lexical scope, as they do in stream settlement.
+  return joinWithRunLivenessDeadline({
+    joinWork: () => {
+      if (mode === "abort") {
+        queueMicrotask(() => controller.abort());
+      }
+      return delivery;
+    },
+    runAbortSignal: controller.signal,
+    timeoutMs: mode === "timeout" ? 1 : undefined,
+    onTimeout: () => {
+      attempt.timedOut = true;
+    },
+  });
+}
+
+if (!global.gc) {
+  throw new Error("Run this harness with node --expose-gc.");
+}
+mkdirSync(snapshotDirectory, { recursive: true });
+let failed = false;
+// The production liveness timers are unref'd; keep their deadlines observable.
+const keepAlive = setInterval(() => {}, 1_000);
+try {
+  for (const mode of ["timeout", "abort"] as const) {
+    const tracked: WeakRef<AttemptContext>[] = [];
+    const releases: (() => void)[] = [];
+    const startedAt = performance.now();
+    const rssBefore = process.memoryUsage().rss;
+    await Promise.all(
+      Array.from({ length: attemptsPerMode }, () => joinPendingDelivery(mode, tracked, releases)),
+    );
+    const retainedAfterJoin = await countRetained(tracked);
+    await nextTurn();
+    writeHeapSnapshot(`${snapshotDirectory}/${mode}-${process.pid}.heapsnapshot`);
+    for (const release of releases) {
+      release();
+    }
+    releases.length = 0;
+    const retainedAfterDelivery = await countRetained(tracked);
+    const passed = retainedAfterJoin === 0 && retainedAfterDelivery === 0;
+    failed ||= !passed;
+    console.log(
+      JSON.stringify({
+        mode,
+        attempts: attemptsPerMode,
+        retainedAfterJoin,
+        retainedAfterDelivery,
+        durationMs: performance.now() - startedAt,
+        rssBefore,
+        rssAfter: process.memoryUsage().rss,
+        passed,
+      }),
+    );
+  }
+} finally {
+  clearInterval(keepAlive);
+}
+process.exitCode = failed ? 1 : 0;
diff --git a/scripts/format-swift.sh b/scripts/format-swift.sh
new file mode 100644
index 0000000000000000000000000000000000000000..2700569d621d74427ffad359ed7d70338df2862c
--- /dev/null
+++ b/scripts/format-swift.sh
@@ -0,0 +1,39 @@
+#!/bin/bash
+
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$repo_root"
+
+scope="${1:-all}"
+if [[ "$scope" != "all" && "$scope" != "ios" && "$scope" != "macos" ]]; then
+  echo "usage: $0 [ios|macos]" >&2
+  exit 2
+fi
+
+./scripts/check-swift-tools.sh swiftformat
+
+if [[ "$scope" != "ios" ]]; then
+  swiftformat --lint apps/macos/Sources \
+    --config config/swiftformat \
+    --exclude '**/OpenClawProtocol,**/HostEnvSecurityPolicy.generated.swift,**/BrowserInspectScript.generated.swift,**/BrowserFaviconScript.generated.swift'
+  swiftformat --lint \
+    apps/macos-mlx-tts/Sources \
+    apps/shared/OpenClawKit/Sources/OpenClawNativeState \
+    apps/shared/OpenClawMLXTTSProtocol/Sources \
+    apps/swabble/Sources \
+    --config config/swiftformat
+fi
+
+if [[ "$scope" == "macos" ]]; then
+  exit 0
+fi
+
+node scripts/ios-write-swift-filelist.mjs
+(
+  cd apps/ios
+  swiftformat --lint \
+    --config ../../config/swiftformat \
+    --unexclude "$PWD/Sources,$PWD/ShareExtension,$PWD/ActivityWidget,$PWD/WatchApp,$PWD/../shared/OpenClawKit/Sources/OpenClawChatUI,$PWD/../shared/OpenClawKit/Sources/OpenClawKit,$PWD/../shared/OpenClawKit/Sources/OpenClawNativeState,$PWD/../shared/OpenClawKit/Sources/OpenClawProtocol,$PWD/../swabble/Sources/SwabbleKit" \
+    --filelist SwiftSources.input.xcfilelist
+)
diff --git a/scripts/frv-publication-status.mts b/scripts/frv-publication-status.mts
new file mode 100644
index 0000000000000000000000000000000000000000..b7df0f2351f6c1a55be7cc5b29bc4e790044eb6c
--- /dev/null
+++ b/scripts/frv-publication-status.mts
@@ -0,0 +1,871 @@
+import { isDeepStrictEqual } from "node:util";
+import { z } from "zod";
+
+// Observation limits are independent of the continuation controller's wait budget.
+export const PUBLICATION_LIMITS = Object.freeze({
+  deadlineMs: 180_000,
+  requestMs: 20_000,
+  requests: 256,
+  runs: 32,
+  attempts: 8,
+  pages: 10,
+  pageSize: 100,
+  jsonBytes: 2 * 1024 * 1024,
+  archiveBytes: 2 * 1024 * 1024,
+  expandedBytes: 1024 * 1024,
+  diagnosticBytes: 128 * 1024,
+  totalBytes: 32 * 1024 * 1024,
+  outputBytes: 256 * 1024,
+});
+export const FRV_WORKFLOW = ".github/workflows/full-release-validation.yml";
+export const PUBLICATION_WORKFLOW = ".github/workflows/openclaw-release-publish.yml";
+export const PUBLICATION_DIAGNOSTIC = "release-postpublish-diagnostics.json";
+
+const failureCodes = [
+  "usage",
+  "identity-mismatch",
+  "malformed-evidence",
+  "incomplete",
+  "transport",
+  "deadline",
+  "limits",
+  "attempt-changed",
+] as const;
+type FailureCode = (typeof failureCodes)[number];
+
+export class PublicationStatusError extends Error {
+  readonly code: FailureCode;
+  readonly runId?: string;
+  constructor(code: FailureCode, runId?: string) {
+    super(`publication observation: ${code}`);
+    this.code = code;
+    this.runId = runId;
+  }
+}
+
+export function requirePublication(
+  condition: unknown,
+  code: FailureCode = "identity-mismatch",
+): asserts condition {
+  if (!condition) {
+    throw new PublicationStatusError(code);
+  }
+}
+
+export function publicationFailure(error: unknown): FailureCode {
+  return error instanceof PublicationStatusError ? error.code : "malformed-evidence";
+}
+
+const id = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
+// Passive diagnostic identifiers stay strings; dereferenced IDs are bounded at the reader.
+const decimal = z
+  .string()
+  .max(20)
+  .regex(/^[1-9][0-9]*$/u);
+const sha = z.string().regex(/^[a-f0-9]{40}$/u);
+const ref = z
+  .string()
+  .min(1)
+  .max(200)
+  .regex(/^[A-Za-z0-9][A-Za-z0-9._/-]*$/u);
+const repository = z
+  .string()
+  .max(200)
+  .regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u);
+const runState = z.enum(["queued", "in_progress", "completed", "waiting", "pending", "requested"]);
+const conclusion = z.enum([
+  "success",
+  "failure",
+  "cancelled",
+  "skipped",
+  "timed_out",
+  "action_required",
+  "neutral",
+  "stale",
+  "startup_failure",
+]);
+const diagnosticState = z.enum([
+  "unattempted",
+  "skipped",
+  "started",
+  "success",
+  "failure",
+  "unknown",
+]);
+const diagnosticConclusion = z.enum([...conclusion.options, "unknown"]);
+const actor = z.object({
+  login: z
+    .string()
+    .max(100)
+    .regex(/^[A-Za-z0-9_.[\]-]+$/u),
+});
+const runSchema = z.object({
+  id,
+  run_attempt: id,
+  workflow_id: id,
+  repository: z.object({ full_name: repository }),
+  head_repository: z.object({ full_name: repository }).optional(),
+  head_sha: sha,
+  head_branch: ref,
+  path: z.string().max(500),
+  display_title: z.string().max(500).optional(),
+  event: z.literal("workflow_dispatch"),
+  status: runState,
+  conclusion: conclusion.nullable(),
+  actor: actor.optional(),
+  triggering_actor: actor.optional(),
+});
+export type PublicationRun = z.infer<typeof runSchema>;
+
+export function parsePublicationRun(value: unknown, repo: string, runId: string): PublicationRun {
+  const parsed = runSchema.safeParse(value);
+  requirePublication(parsed.success);
+  const run = parsed.data;
+  requirePublication(
+    String(run.id) === runId &&
+      run.repository.full_name === repo &&
+      (!run.head_repository || run.head_repository.full_name === repo),
+  );
+  requirePublication(
+    /^\.github\/workflows\/[A-Za-z0-9._-]+\.ya?ml(?:@[A-Za-z0-9._/-]+)?$/u.test(run.path),
+  );
+  const [path, suffix] = run.path.split("@");
+  requirePublication(
+    path &&
+      (!suffix ||
+        [run.head_branch, `refs/heads/${run.head_branch}`, `refs/tags/${run.head_branch}`].includes(
+          suffix,
+        )),
+  );
+  return run;
+}
+
+export function bindPublicationWorkflow(
+  run: PublicationRun,
+  workflow: unknown,
+  expectedPath: string,
+) {
+  const parsed = z.object({ id, path: z.string() }).safeParse(workflow);
+  requirePublication(
+    parsed.success &&
+      parsed.data.id === run.workflow_id &&
+      parsed.data.path === expectedPath &&
+      run.path.split("@")[0] === expectedPath,
+  );
+}
+
+export function assertPublicationRunUnchanged(before: PublicationRun, after: PublicationRun) {
+  requirePublication(before.run_attempt === after.run_attempt, "attempt-changed");
+  const identity = (run: PublicationRun) => [
+    run.id,
+    run.workflow_id,
+    run.repository.full_name,
+    run.head_repository?.full_name ?? null,
+    run.head_sha,
+    run.head_branch,
+    run.path.split("@")[0],
+    run.event,
+  ];
+  // Lifecycle, display and actor-login observations can change without a new identity.
+  requirePublication(isDeepStrictEqual(identity(before), identity(after)));
+}
+
+const jobSchema = z.object({
+  id,
+  run_id: id,
+  run_attempt: id,
+  name: z.string().min(1).max(500),
+  status: runState,
+  conclusion: conclusion.nullable(),
+  started_at: z.string().max(100).nullable().optional(),
+  completed_at: z.string().max(100).nullable().optional(),
+  html_url: z.string().max(1000).optional(),
+  steps: z
+    .array(
+      z.object({
+        number: id,
+        name: z.string().max(500),
+        status: runState,
+        conclusion: conclusion.nullable(),
+      }),
+    )
+    .max(100)
+    .optional(),
+});
+export type PublicationJob = z.infer<typeof jobSchema>;
+export function parsePublicationJobs(values: unknown[], runId: string, attempt: number) {
+  return values.map((value) => {
+    const parsed = jobSchema.safeParse(value);
+    requirePublication(parsed.success, "malformed-evidence");
+    requirePublication(String(parsed.data.run_id) === runId && parsed.data.run_attempt === attempt);
+    return parsed.data;
+  });
+}
+
+const errorSchema = z.object({
+  class: z.enum([
+    "registry-not-visible",
+    "selector-mismatch",
+    "identity-mismatch",
+    "transport",
+    "malformed-response",
+    "command-failure",
+    "evidence-write-failure",
+  ]),
+  status: z.number().int().min(0).max(255).nullable(),
+});
+const packageSchema = z.object({
+  name: z
+    .string()
+    .max(128)
+    .regex(/^@openclaw\/[a-z0-9][a-z0-9._-]*$/u),
+  state: diagnosticState,
+  publication: z.enum(["unknown", "observed"]),
+  error: errorSchema.nullable(),
+});
+const stageSchema = z.object({
+  state: diagnosticState,
+  publication: z.enum(["unknown", "observed"]),
+  error: errorSchema.nullable(),
+  packages: z.array(packageSchema).max(256),
+  packagesTruncated: z.boolean(),
+});
+const stageNames = [
+  "checkout",
+  "githubRelease",
+  "coreNpm",
+  "postpublish",
+  "pluginNpm",
+  "clawHub",
+  "fullReleaseValidation",
+  "pluginNpmRun",
+  "pluginClawHubRun",
+  "pluginClawHubBootstrap",
+  "openclawNpm",
+  "npmTelegram",
+  "evidence",
+  "binding",
+  "assets",
+] as const;
+export const PUBLICATION_CHILDREN = {
+  openclawNpm: { workflow: ".github/workflows/openclaw-npm-release.yml", surface: "coreNpm" },
+  pluginNpm: { workflow: ".github/workflows/plugin-npm-release.yml", surface: "pluginNpm" },
+  pluginClawHub: { workflow: ".github/workflows/plugin-clawhub-release.yml", surface: "clawHub" },
+  pluginClawHubBootstrap: {
+    workflow: ".github/workflows/plugin-clawhub-new.yml",
+    surface: "clawHub",
+  },
+  npmTelegram: { workflow: ".github/workflows/npm-telegram-beta-e2e.yml", surface: "npmTelegram" },
+} as const;
+const childNames = ["fullReleaseValidation", ...Object.keys(PUBLICATION_CHILDREN)] as [
+  string,
+  ...string[],
+];
+const diagnosticSchema = z.object({
+  schemaVersion: z.literal(1),
+  kind: z.literal("release-postpublish-diagnostics"),
+  invocationId: z.string().uuid(),
+  context: z.object({
+    repository: repository.nullable(),
+    releaseVersion: z
+      .string()
+      .max(80)
+      .regex(/^[0-9]+(?:\.[0-9]+){2}(?:-[a-z0-9.-]+)?$/u)
+      .nullable(),
+    releaseTag: z
+      .string()
+      .max(81)
+      .regex(/^v[0-9]+(?:\.[0-9]+){2}(?:-[a-z0-9.-]+)?$/u)
+      .nullable(),
+    npmDistTag: z.enum(["latest", "beta", "alpha", "extended-stable"]).nullable(),
+    requestedSourceSha: sha.nullable(),
+    toolingSha: sha.nullable(),
+    suppliedToolingSha: sha.nullable(),
+    suppliedToolingRef: ref.nullable(),
+    parentRunId: decimal.nullable(),
+    parentRunAttempt: decimal.nullable(),
+    validationEvidence: z.object({
+      mode: z.enum(["full-release-validation", "authorized-beta-focused-v1"]).nullable(),
+      runId: decimal.nullable(),
+      runAttempt: decimal.nullable(),
+    }),
+  }),
+  selection: z.object({
+    plugins: z.array(packageSchema.shape.name).max(256),
+    pluginsTruncated: z.boolean(),
+    workflowRef: ref.nullable(),
+    clawHubWorkflowRef: ref.nullable(),
+  }),
+  verification: diagnosticState,
+  currentStage: z.enum(stageNames).nullable(),
+  stages: z.record(z.enum(stageNames), stageSchema),
+  children: z.record(
+    z.enum(childNames),
+    z.object({
+      suppliedRunId: decimal.nullable(),
+      runAttempt: decimal.nullable(),
+      producerRunAttempt: decimal.nullable(),
+      status: z.enum([...runState.options, "unknown"]),
+      conclusion: diagnosticConclusion,
+      failedJobCount: z.number().int().min(0).max(10000).nullable(),
+      readbackArtifactId: decimal.nullable(),
+      packageArtifactId: decimal.nullable(),
+    }),
+  ),
+  jobOutcomeBeforeArtifactUploads: diagnosticConclusion,
+  stepOutcomes: z.object({ coreStart: diagnosticConclusion, completion: diagnosticConclusion }),
+});
+export type PublicationDiagnostic = z.infer<typeof diagnosticSchema>;
+
+export function parsePublicationDiagnostic(
+  value: unknown,
+  run: PublicationRun,
+): PublicationDiagnostic | null {
+  const envelope = z.object({ kind: z.string(), schemaVersion: z.number() }).safeParse(value);
+  requirePublication(envelope.success, "malformed-evidence");
+  if (
+    envelope.data.kind !== "release-postpublish-diagnostics" ||
+    envelope.data.schemaVersion !== 1
+  ) {
+    return null;
+  }
+  const parsed = diagnosticSchema.safeParse(value);
+  requirePublication(parsed.success, "malformed-evidence");
+  const diagnostic = parsed.data;
+  const context = diagnostic.context;
+  if (
+    [
+      context.repository,
+      context.parentRunId,
+      context.parentRunAttempt,
+      context.toolingSha,
+      context.suppliedToolingSha,
+      context.suppliedToolingRef,
+    ].includes(null)
+  ) {
+    return null;
+  }
+  // The record supplies linkage, not its own producer authority.
+  requirePublication(
+    context.repository === run.repository.full_name &&
+      context.parentRunId === String(run.id) &&
+      context.parentRunAttempt === String(run.run_attempt) &&
+      context.toolingSha === run.head_sha &&
+      context.suppliedToolingSha === run.head_sha,
+  );
+  requirePublication(
+    context.suppliedToolingRef === `refs/heads/${run.head_branch}` ||
+      context.suppliedToolingRef === `refs/tags/${run.head_branch}`,
+  );
+  const suffix = run.path.split("@")[1];
+  requirePublication(
+    !suffix || suffix === run.head_branch || suffix === context.suppliedToolingRef,
+  );
+  const protectedRef = /^release-publish\/([a-f0-9]{12})-[1-9][0-9]*$/u.exec(run.head_branch);
+  requirePublication(!protectedRef || protectedRef[1] === run.head_sha.slice(0, 12));
+  return diagnostic;
+}
+
+type EvidenceRef = {
+  kind: "owner-diagnostic" | "job-conclusion" | "dispatch-record" | "terminal-marker";
+  runId: string;
+  runAttempt: number;
+  artifactId?: number;
+  jobId?: number;
+};
+type Phase = { state: string; evidence: EvidenceRef[] };
+type Surface = {
+  selection: "unknown" | "selected" | "not-selected";
+  verificationSelection: "unknown" | "selected" | "not-selected";
+  operation: Phase;
+  verification: Phase;
+  registryObservation: Phase;
+  terminalMarker: Phase;
+  verificationError: z.infer<typeof errorSchema> | null;
+  packages: z.infer<typeof packageSchema>[];
+  packagesOmitted?: number;
+  advisory: boolean;
+  jobsOmitted?: number;
+  jobs: {
+    jobId: number;
+    runId: string;
+    runAttempt: number;
+    status: string;
+    conclusion: string | null;
+    steps: {
+      phase: "copy" | "smoke" | "aliases";
+      number: number;
+      status: string;
+      conclusion: string | null;
+    }[];
+  }[];
+  children: {
+    runId: string;
+    workflowSha: string;
+    workflowRef: string;
+    recordedAttempt: number | null;
+    observedAttempt: number;
+    status: string;
+    conclusion: string | null;
+    relation: "supplied" | "dispatch-record";
+  }[];
+};
+const surfaces = [
+  "coreNpm",
+  "pluginNpm",
+  "clawHub",
+  "docker",
+  "activation",
+  "vcr",
+  "nativeWindows",
+  "nativeAndroid",
+  "nativeMac",
+  "npmTelegram",
+] as const;
+type SurfaceName = (typeof surfaces)[number];
+export type PublicationObservation = {
+  version: 1;
+  requested: { repository: string; validationRunId: string; publicationRunId: string };
+  publisher: {
+    runId: string;
+    runAttempt: number;
+    workflowSha: string;
+    status: string;
+    conclusion: string | null;
+  } | null;
+  relationship: {
+    status: "unverified" | "verified" | "invalid";
+    reason: string;
+    originalPlanAttempt: number | null;
+    validationAttempt: number | null;
+    candidateSha: string | null;
+    validationToolingSha: string | null;
+  };
+  collection: {
+    complete: boolean;
+    error: FailureCode | null;
+    outputTruncated?: true;
+    validationStatusOmitted?: boolean;
+  };
+  diagnostics: {
+    state: "missing" | "expired" | "unsupported" | "available" | "legacy-only";
+    artifactId: number | null;
+    truncated: boolean;
+  };
+  verification: Phase;
+  binding: Phase;
+  assets: Phase;
+  dispatches: {
+    scope: "normal-clawhub" | "windows";
+    state: "acknowledged" | "not-dispatched" | "unknown";
+    runId: string;
+    runAttempt: number;
+    artifactId: number;
+  }[];
+  surfaces: Record<SurfaceName, Surface>;
+};
+
+export function newPublicationObservation(
+  repo: string,
+  validationRunId: string,
+  publicationRunId: string,
+): PublicationObservation {
+  const phase = (): Phase => ({ state: "unknown", evidence: [] });
+  return {
+    version: 1,
+    requested: { repository: repo, validationRunId, publicationRunId },
+    publisher: null,
+    relationship: {
+      status: "unverified",
+      reason: "no-supported-link",
+      originalPlanAttempt: null,
+      validationAttempt: null,
+      candidateSha: null,
+      validationToolingSha: null,
+    },
+    collection: { complete: false, error: null },
+    diagnostics: { state: "missing", artifactId: null, truncated: false },
+    verification: phase(),
+    binding: phase(),
+    assets: phase(),
+    dispatches: [],
+    surfaces: Object.fromEntries(
+      surfaces.map((name): [SurfaceName, Surface] => [
+        name,
+        {
+          selection: "unknown",
+          verificationSelection: "unknown",
+          operation: phase(),
+          verification: phase(),
+          registryObservation: phase(),
+          terminalMarker: phase(),
+          advisory: ["vcr", "nativeWindows", "nativeAndroid", "nativeMac", "npmTelegram"].includes(
+            name,
+          ),
+          jobs: [],
+          children: [],
+          verificationError: null,
+          packages: [],
+        },
+      ]),
+    ) as Record<SurfaceName, Surface>,
+  };
+}
+
+export function compactPublicationObservation(
+  observation: PublicationObservation,
+  validationStatusOmitted: boolean,
+): PublicationObservation {
+  const retainedItems = 4;
+  return {
+    ...observation,
+    collection: {
+      ...observation.collection,
+      complete: false,
+      error: observation.collection.error ?? "limits",
+      outputTruncated: true,
+      validationStatusOmitted,
+    },
+    surfaces: Object.fromEntries(
+      surfaces.map((name): [SurfaceName, Surface] => {
+        const surface = observation.surfaces[name];
+        const jobs = surface.jobs.slice(0, retainedItems);
+        const packages = surface.packages.slice(0, retainedItems);
+        const jobsOmitted = (surface.jobsOmitted ?? 0) + surface.jobs.length - jobs.length;
+        const packagesOmitted =
+          (surface.packagesOmitted ?? 0) + surface.packages.length - packages.length;
+        return [
+          name,
+          {
+            ...surface,
+            jobs,
+            packages,
+            ...(jobsOmitted ? { jobsOmitted } : {}),
+            ...(packagesOmitted ? { packagesOmitted } : {}),
+          },
+        ];
+      }),
+    ) as Record<SurfaceName, Surface>,
+  };
+}
+
+export function observePublicationJobs(
+  observation: PublicationObservation,
+  run: PublicationRun,
+  jobs: PublicationJob[],
+) {
+  const mapping: [SurfaceName, string, boolean][] = [
+    ["coreNpm", "Publish plugins, then OpenClaw", false],
+    ["pluginNpm", "Publish plugins, then OpenClaw", false],
+    ["clawHub", "Publish plugins, then OpenClaw", false],
+    ["coreNpm", "Verify already-published core npm package", false],
+    ["docker", "Publish Docker images / ", true],
+    ["vcr", "Mirror Docker images to Vercel Container Registry / ", true],
+    ["activation", "Finalize GitHub release", false],
+    ["nativeWindows", "Dispatch Windows assets after publication", false],
+    ["nativeAndroid", "Approve and dispatch qualified Android", false],
+  ];
+  for (const [surface, name, prefix] of mapping) {
+    for (const job of jobs.filter((entry) =>
+      prefix ? entry.name.startsWith(name) : entry.name === name,
+    )) {
+      observation.surfaces[surface].jobs.push({
+        jobId: job.id,
+        runId: String(run.id),
+        runAttempt: run.run_attempt,
+        status: job.status,
+        conclusion: job.conclusion,
+        steps:
+          surface === "vcr"
+            ? (job.steps ?? []).flatMap((step) => {
+                const phase = {
+                  "Copy and verify immutable release images": "copy",
+                  "Run custom-image Sandbox smoke": "smoke",
+                  "Promote and verify channel aliases": "aliases",
+                }[step.name] as "copy" | "smoke" | "aliases" | undefined;
+                return phase
+                  ? [
+                      {
+                        phase,
+                        number: step.number,
+                        status: step.status,
+                        conclusion: step.conclusion,
+                      },
+                    ]
+                  : [];
+              })
+            : [],
+      });
+    }
+  }
+  // Job conclusions are observations of jobs, not receipts for their privileged operations.
+}
+
+export function observePublicationDiagnostic(
+  observation: PublicationObservation,
+  diagnostic: PublicationDiagnostic,
+  artifactId: number,
+) {
+  requirePublication(observation.publisher);
+  const evidence: EvidenceRef[] = [
+    {
+      kind: "owner-diagnostic",
+      artifactId,
+      runId: observation.publisher.runId,
+      runAttempt: observation.publisher.runAttempt,
+    },
+  ];
+  observation.diagnostics = {
+    state: "available",
+    artifactId,
+    truncated:
+      diagnostic.selection.pluginsTruncated ||
+      Object.values(diagnostic.stages).some((stage) => stage.packagesTruncated),
+  };
+  observation.verification = { state: diagnostic.verification, evidence };
+  observation.binding = { state: diagnostic.stages.binding.state, evidence };
+  observation.assets = { state: diagnostic.stages.assets.state, evidence };
+  for (const name of ["coreNpm", "pluginNpm", "clawHub", "npmTelegram"] as const) {
+    const stage = diagnostic.stages[name];
+    const surface = observation.surfaces[name];
+    surface.verification = { state: stage.state, evidence };
+    surface.registryObservation = { state: stage.publication, evidence };
+    surface.verificationError = stage.error;
+    surface.packages = stage.packages;
+    surface.verificationSelection =
+      stage.state === "skipped"
+        ? "not-selected"
+        : stage.state === "unattempted"
+          ? "unknown"
+          : "selected";
+  }
+}
+
+export function joinPublicationValidation(
+  observation: PublicationObservation,
+  diagnostic: PublicationDiagnostic,
+  plan: Record<string, unknown>,
+  manifest: Record<string, unknown>,
+  rawManifest: Record<string, unknown>,
+) {
+  const context = diagnostic.context;
+  requirePublication(
+    context.validationEvidence.runId === observation.requested.validationRunId &&
+      context.requestedSourceSha === plan.targetSha &&
+      manifest.targetSha === plan.targetSha &&
+      manifest.workflowSha === plan.workflowSha &&
+      manifest.workflowRef === plan.workflowRef &&
+      manifest.releaseProfile === plan.releaseProfile &&
+      manifest.rerunGroup === plan.rerunGroup &&
+      rawManifest.executionPlanSha256 === plan.sha256 &&
+      Number(rawManifest.sourceParentRunAttempt) === plan.parentRunAttempt &&
+      isDeepStrictEqual(manifest.candidateBinding, plan.candidate) &&
+      Number(context.validationEvidence.runAttempt) === manifest.runAttempt &&
+      plan.parentRunAttempt <= manifest.runAttempt,
+  );
+  observation.relationship = {
+    status: "verified",
+    reason: "attempt-bound-diagnostic",
+    originalPlanAttempt: plan.parentRunAttempt,
+    validationAttempt: manifest.runAttempt,
+    candidateSha: String(plan.targetSha),
+    validationToolingSha: String(plan.workflowSha),
+  };
+}
+
+export function boundPublicationManifest(value: unknown) {
+  const parsed = z
+    .object({
+      childEvidence: z
+        .record(
+          z.string(),
+          z.object({
+            plannedRunAttempt: id,
+            effectiveRunAttempt: id,
+            observedRunAttempts: z.array(id).max(PUBLICATION_LIMITS.attempts),
+            jobs: z.array(z.unknown()).max(PUBLICATION_LIMITS.pages * PUBLICATION_LIMITS.pageSize),
+          }),
+        )
+        .optional(),
+    })
+    .safeParse(value);
+  requirePublication(parsed.success, "limits");
+  const children = Object.values(parsed.data.childEvidence ?? {});
+  requirePublication(children.length <= PUBLICATION_LIMITS.runs, "limits");
+  for (const child of children) {
+    requirePublication(
+      child.effectiveRunAttempt >= child.plannedRunAttempt &&
+        child.effectiveRunAttempt - child.plannedRunAttempt < PUBLICATION_LIMITS.attempts,
+      "limits",
+    );
+  }
+}
+
+export function parseClawHubDispatch(value: unknown, run: PublicationRun, candidateSha: string) {
+  const parsed = z
+    .object({
+      schemaVersion: z.literal(1),
+      repository,
+      parentRunId: decimal,
+      parentRunAttempt: decimal,
+      parentWorkflow: z.literal(PUBLICATION_WORKFLOW),
+      toolingRef: ref,
+      toolingFullRef: ref,
+      toolingSha: sha,
+      candidateSha: sha,
+      normalClawHubRunId: decimal.nullable(),
+      normalClawHubRunAttempt: decimal.nullable(),
+    })
+    .safeParse(value);
+  requirePublication(parsed.success, "malformed-evidence");
+  const record = parsed.data;
+  requirePublication(
+    record.repository === run.repository.full_name &&
+      record.parentRunId === String(run.id) &&
+      record.parentRunAttempt === String(run.run_attempt) &&
+      record.toolingSha === run.head_sha &&
+      record.toolingRef === run.head_branch &&
+      record.candidateSha === candidateSha &&
+      [record.toolingRef, record.toolingFullRef].includes(
+        run.path.split("@")[1] ?? record.toolingRef,
+      ) &&
+      (record.toolingFullRef === `refs/heads/${run.head_branch}` ||
+        record.toolingFullRef === `refs/tags/${run.head_branch}`) &&
+      (record.normalClawHubRunId === null) === (record.normalClawHubRunAttempt === null),
+  );
+  return record;
+}
+
+export function observePublicationChild(
+  observation: PublicationObservation,
+  surface: SurfaceName,
+  run: PublicationRun,
+  recordedAttempt: number | null,
+  relation: "supplied" | "dispatch-record" = "supplied",
+) {
+  observation.surfaces[surface].children.push({
+    runId: String(run.id),
+    workflowSha: run.head_sha,
+    workflowRef: run.head_branch,
+    recordedAttempt,
+    observedAttempt: run.run_attempt,
+    status: run.status,
+    conclusion: run.conclusion,
+    relation,
+  });
+}
+
+export function parseWindowsDispatch(value: unknown) {
+  const parsed = z
+    .object({
+      tag: z
+        .string()
+        .max(81)
+        .regex(/^v[0-9]+(?:\.[0-9]+){2}(?:-[a-z0-9.-]+)?$/u),
+      sourceTag: ref,
+      installerDigests: z.string().max(4096),
+      state: z.enum(["dispatched", "dispatch-failed"]),
+      childRunId: decimal.optional(),
+    })
+    .safeParse(value);
+  requirePublication(parsed.success, "malformed-evidence");
+  requirePublication(parsed.data.state !== "dispatched" || parsed.data.childRunId);
+  return parsed.data;
+}
+
+export function observeWindowsMarker(
+  observation: PublicationObservation,
+  value: unknown,
+  dispatch: ReturnType<typeof parseWindowsDispatch>,
+  run: PublicationRun,
+  artifactId: number,
+  job: PublicationJob,
+) {
+  const parsed = z
+    .object({
+      schemaVersion: z.literal(1),
+      tag: z.string(),
+      sourceTag: z.string(),
+      installerDigests: z.string(),
+      outcome: diagnosticConclusion,
+      runUrl: z.string(),
+    })
+    .safeParse(value);
+  requirePublication(parsed.success, "malformed-evidence");
+  requirePublication(
+    parsed.data.tag === dispatch.tag &&
+      parsed.data.sourceTag === dispatch.sourceTag &&
+      parsed.data.installerDigests === dispatch.installerDigests &&
+      parsed.data.runUrl ===
+        `https://github.com/${run.repository.full_name}/actions/runs/${run.id}`,
+  );
+  observation.surfaces.nativeWindows.terminalMarker = {
+    state: parsed.data.outcome,
+    evidence: [
+      { kind: "terminal-marker", runId: String(run.id), runAttempt: run.run_attempt, artifactId },
+    ],
+  };
+  observation.surfaces.nativeWindows.jobs.push({
+    jobId: job.id,
+    runId: String(run.id),
+    runAttempt: run.run_attempt,
+    status: job.status,
+    conclusion: job.conclusion,
+    steps: [],
+  });
+}
+
+export function formatPublicationObservation(value: PublicationObservation) {
+  const lines = [
+    "Publication observation (not release authorization)",
+    `relationship: ${value.relationship.status} (${value.relationship.reason})`,
+    `collection: ${value.collection.complete ? "complete" : `incomplete (${value.collection.error ?? "unknown"})`}`,
+    `publisher: ${value.publisher?.runId ?? "unknown"} attempt=${value.publisher?.runAttempt ?? "unknown"} ${value.publisher?.status ?? "unknown"}/${value.publisher?.conclusion ?? "unknown"}`,
+    `validation binding: original-plan-attempt=${value.relationship.originalPlanAttempt ?? "unknown"} selected-attempt=${value.relationship.validationAttempt ?? "unknown"}`,
+    `diagnostics: ${value.diagnostics.state}; verification=${value.verification.state}; binding=${value.binding.state}; assets=${value.assets.state}`,
+  ];
+  if (value.collection.validationStatusOmitted) {
+    lines.push("validation detail omitted: output limit");
+  }
+  for (const name of surfaces) {
+    const surface = value.surfaces[name];
+    lines.push(
+      `${name}: selection=${surface.selection} operation=${surface.operation.state} verification=${surface.verification.state} registry-observation=${surface.registryObservation.state} terminal-marker=${surface.terminalMarker.state}${surface.advisory ? " advisory" : ""}`,
+    );
+    for (const job of surface.jobs) {
+      lines.push(
+        `  job=${job.jobId} run=${job.runId} attempt=${job.runAttempt} ${job.status}/${job.conclusion ?? "unknown"} (job conclusion only)`,
+      );
+      for (const step of job.steps) {
+        lines.push(
+          `    ${step.phase}: ${step.status}/${step.conclusion ?? "unknown"} (API step conclusion only)`,
+        );
+      }
+    }
+    if (surface.jobsOmitted) {
+      lines.push(`  jobs omitted: ${surface.jobsOmitted} (output limit)`);
+    }
+    for (const item of surface.packages) {
+      lines.push(
+        `  ${item.name}: verification=${item.state} registry-observation=${item.publication} error=${item.error?.class ?? "none"}`,
+      );
+    }
+    if (surface.packagesOmitted) {
+      lines.push(`  packages omitted: ${surface.packagesOmitted} (output limit)`);
+    }
+    for (const child of surface.children) {
+      lines.push(
+        `  child=${child.runId} recorded-attempt=${child.recordedAttempt ?? "unknown"} observed-attempt=${child.observedAttempt} ${child.status}/${child.conclusion ?? "unknown"} (${child.relation}) workflow-ref=${child.workflowRef} workflow-sha=${child.workflowSha}`,
+      );
+    }
+  }
+  for (const dispatch of value.dispatches) {
+    lines.push(
+      `${dispatch.scope} dispatch: ${dispatch.state} parent=${dispatch.runId} attempt=${dispatch.runAttempt} artifact=${dispatch.artifactId}`,
+    );
+  }
+  lines.push(
+    "Missing observations remain unknown; consult the existing owner evidence. No recovery action was performed.",
+  );
+  return lines.join("\n");
+}
diff --git a/scripts/frv.d.mts b/scripts/frv.d.mts
new file mode 100644
index 0000000000000000000000000000000000000000..32eaf0ceae788fe91694f14f9184fb770b63e0c1
--- /dev/null
+++ b/scripts/frv.d.mts
@@ -0,0 +1,82 @@
+import type { PublicationObservation } from "./frv-publication-status.mts";
+
+export type FrvPublicationStatus = Partial<FrvContinuationStatus> & {
+  publication: PublicationObservation;
+};
+
+export interface FrvChildStatus extends Record<string, unknown> {
+  effectiveRunAttempt: number | null;
+  key: string;
+  plannedRunAttempt: number | null;
+  runId: string;
+  status: "active" | "failed" | "missing" | "passed";
+}
+
+export interface FrvContinuationStatus {
+  active: FrvChildStatus[];
+  children: FrvChildStatus[];
+  failed: FrvChildStatus[];
+  missing: FrvChildStatus[];
+  passed: FrvChildStatus[];
+}
+
+export interface FrvClient {
+  repository?: string;
+  getReleaseEvidenceClient: () => ReturnType<
+    typeof import("./release-ci-summary.mjs").createReleaseEvidenceClient
+  >;
+  getAttemptJobs: (runId: string, runAttempt: number) => Promise<Record<string, unknown>[]>;
+  getJobLog: (jobId: number) => Promise<string>;
+  getParentJobs: (runId: string) => Promise<Record<string, unknown>[]>;
+  getRun: (runId: string) => Promise<Record<string, unknown>>;
+  getRunAttempt: (runId: string, runAttempt: number) => Promise<Record<string, unknown>>;
+  rerunFailed?: (runId: string) => Promise<unknown>;
+  rerunParent?: (runId: string) => Promise<unknown>;
+  verify?: (
+    runId: string,
+    plan: Record<string, unknown>,
+    operationDeadline?: number,
+    expectedRunAttempts?: Record<string, number>,
+  ) => Promise<unknown>;
+  verifySeal?: (
+    runId: string,
+    plan: Record<string, unknown>,
+    operationDeadline: number,
+    expectedRunAttempts: Record<string, number>,
+  ) => Promise<boolean>;
+}
+
+export type FrvConcreteClient = FrvClient &
+  Required<Pick<FrvClient, "rerunFailed" | "rerunParent" | "verify" | "verifySeal">>;
+
+export function inspectContinuation(
+  plan: Record<string, unknown>,
+  client: Pick<FrvClient, "getAttemptJobs" | "getRun" | "repository">,
+): Promise<FrvContinuationStatus>;
+export function createClient(
+  repository: string,
+  dependencies?: Record<string, unknown>,
+): FrvConcreteClient;
+export function preflightContinuation(
+  plan: Record<string, unknown>,
+  rootRunId: string,
+  client: Pick<
+    FrvClient,
+    "getJobLog" | "getParentJobs" | "getRunAttempt" | "getReleaseEvidenceClient"
+  >,
+  repository?: string,
+): Promise<Record<string, unknown>>;
+export function loadPlan(
+  options: Record<string, unknown>,
+  loadExecutionPlan?: (...args: unknown[]) => Promise<unknown>,
+): Promise<Record<string, unknown>>;
+export function continueFailed(
+  plan: Record<string, unknown>,
+  rootRunId: string,
+  client: FrvClient,
+  options?: Record<string, unknown>,
+): Promise<{
+  action: string;
+  finalRunId?: string;
+  status: FrvContinuationStatus;
+}>;
diff --git a/scripts/frv.mjs b/scripts/frv.mjs
new file mode 100644
index 0000000000000000000000000000000000000000..006cea92723709f4e33712c1bbeffde8e306ed9e
--- /dev/null
+++ b/scripts/frv.mjs
@@ -0,0 +1,1563 @@
+#!/usr/bin/env node
+import { execFile } from "node:child_process";
+import { mkdtempSync, readFileSync, rmSync, statSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import process from "node:process";
+import { pathToFileURL } from "node:url";
+import { promisify } from "node:util";
+import {
+  publicationAdmissionContract,
+  publicationSourceContract,
+  validatePublicationAdmissionBinding,
+  validatePublicationSourceBinding,
+} from "./full-release-publication-contract.mjs";
+import {
+  classifyReleaseGhTransportError,
+  composeReleaseChildAttemptEvidence,
+  isReleaseGhArtifactMissingError,
+  MAX_RELEASE_ARTIFACT_BYTES,
+  releaseChildSpec,
+  terminalPolicyPass,
+  validateReleaseChildDispatchBinding,
+  validateReleaseChildRunProvenance,
+  validateReleaseExecutionPlanArtifact,
+} from "./full-release-validation-policy.mjs";
+import {
+  inspectActionsArtifactZipWithPolicy,
+  sha256Digest,
+} from "./lib/actions-artifact-archive.mjs";
+import { execPlainGh, plainGhAuthenticatedEnv, resolvePlainGhBin } from "./lib/plain-gh.mjs";
+import {
+  createReleaseEvidenceClient,
+  restoreOriginalPublicationAdmission,
+} from "./release-ci-summary.mjs";
+
+const execFileAsync = promisify(execFile);
+const DEFAULT_REPOSITORY = "openclaw/openclaw";
+const DEFAULT_POLL_MS = 30_000;
+const DEFAULT_TIMEOUT_MS = 12 * 60 * 60_000;
+const DEFAULT_RECONCILE_TIMEOUT_MS = 60_000;
+const PLAN_FILENAME = "full-release-execution-plan.json";
+
+function requiredValue(value, label) {
+  const normalized = String(value ?? "").trim();
+  if (!normalized) {
+    throw new Error(`${label} is required`);
+  }
+  return normalized;
+}
+
+function positiveInteger(value, label) {
+  const normalized = Number(value);
+  if (!Number.isSafeInteger(normalized) || normalized < 1) {
+    throw new Error(`${label} must be a positive integer`);
+  }
+  return normalized;
+}
+
+function configuredTimeout(name, fallback) {
+  return positiveInteger(process.env[name] || fallback, name);
+}
+
+function createOperationDeadline() {
+  const deadline = Date.now() + configuredTimeout("OPENCLAW_FRV_TIMEOUT_MS", DEFAULT_TIMEOUT_MS);
+  if (!Number.isSafeInteger(deadline)) {
+    throw new Error("FRV operation deadline is invalid");
+  }
+  return deadline;
+}
+
+function validateOperationDeadline(deadline) {
+  if (!Number.isSafeInteger(deadline) || deadline < 1) {
+    throw new Error("FRV operation deadline must be a positive integer");
+  }
+  return deadline;
+}
+
+function remainingOperationTime(deadline, label = "FRV operation") {
+  const remaining = validateOperationDeadline(deadline) - Date.now();
+  if (remaining < 1) {
+    throw new Error(`${label} timed out`);
+  }
+  return remaining;
+}
+
+function parseArgs(argv) {
+  const command = argv[0];
+  const options = {
+    command,
+    dryRun: false,
+    failedOnly: false,
+    json: false,
+    repository: DEFAULT_REPOSITORY,
+    runId: "",
+  };
+  const publicationRequested = argv.includes("--publication-run");
+  const seen = new Set();
+  for (let index = 1; index < argv.length; index += 1) {
+    const argument = argv[index];
+    if (publicationRequested && seen.has(argument)) {
+      throw new Error("duplicate publication status argument");
+    }
+    seen.add(argument);
+    if (argument === "--run") {
+      options.runId = requiredValue(argv[++index], "--run");
+    } else if (argument === "--publication-run") {
+      options.publicationRunId = requiredValue(argv[++index], "--publication-run");
+    } else if (argument === "--repo") {
+      options.repository = requiredValue(argv[++index], "--repo");
+    } else if (argument === "--failed") {
+      options.failedOnly = true;
+    } else if (argument === "--json") {
+      options.json = true;
+    } else if (argument === "--dry-run") {
+      options.dryRun = true;
+    } else {
+      throw new Error(`unknown argument: ${argument}`);
+    }
+  }
+  if (!["continue", "status", "verify"].includes(command)) {
+    throw new Error("usage: pnpm frv <status|continue|verify> --run <id> [--failed]");
+  }
+  if (!/^[1-9][0-9]*$/u.test(options.runId)) {
+    throw new Error("--run must be a positive decimal");
+  }
+  if (command === "continue" && !options.failedOnly) {
+    throw new Error("continue requires --failed");
+  }
+  if (command !== "continue" && (options.failedOnly || options.dryRun)) {
+    throw new Error("--failed and --dry-run are valid only with continue");
+  }
+  if (publicationRequested) {
+    if (
+      !(
+        command === "status" &&
+        /^[1-9][0-9]*$/u.test(options.publicationRunId) &&
+        Number.isSafeInteger(Number(options.publicationRunId)) &&
+        Number.isSafeInteger(Number(options.runId)) &&
+        /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u.test(options.repository) &&
+        options.repository.split("/").every((part) => part !== "." && part !== "..") &&
+        options.repository.length <= 200
+      )
+    ) {
+      throw new Error("invalid publication status arguments");
+    }
+  }
+  return options;
+}
+
+async function execCommand(command, args, options = {}) {
+  const result = await execFileAsync(command, args, {
+    encoding: "utf8",
+    env: options.env ?? process.env,
+    killSignal: "SIGKILL",
+    maxBuffer: 64 * 1024 * 1024,
+    timeout: options.timeoutMs ?? 60_000,
+  });
+  return result.stdout.trim();
+}
+
+function execGh(args, options = {}) {
+  return execCommand(resolvePlainGhBin(), args, {
+    ...options,
+    env: plainGhAuthenticatedEnv(),
+  });
+}
+
+function verifierEvidenceNeedsRefresh(error) {
+  if (!error || typeof error !== "object" || typeof error.stdout !== "string") {
+    return false;
+  }
+  try {
+    const failure = JSON.parse(error.stdout);
+    return failure?.valid === false && failure.refreshable === true;
+  } catch {
+    return false;
+  }
+}
+
+function isUnknownAllowEscapeSequencesFlag(error) {
+  return (
+    typeof error?.stderr === "string" &&
+    error.stderr
+      .replace(/\r\n?/gu, "\n")
+      .split("\n")
+      .includes("unknown flag: --allow-escape-sequences")
+  );
+}
+
+async function sleep(milliseconds) {
+  await new Promise((resolvePromise) => {
+    setTimeout(resolvePromise, milliseconds);
+  });
+}
+
+async function execGhRead(args, options = {}) {
+  const attempts = options.attempts ?? 4;
+  let lastError;
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    try {
+      return await execGh(args, options);
+    } catch (error) {
+      lastError = error;
+      if (attempt === attempts || classifyReleaseGhTransportError(error) !== "transient") {
+        throw error;
+      }
+      await sleep(Math.min(attempt * 1000, 5000));
+    }
+  }
+  throw lastError;
+}
+
+function readFreshGhApi(repository, path, args = []) {
+  // Rerun decisions require current attempts and jobs, not a relay's earlier snapshot.
+  return execGhRead([
+    "api",
+    `repos/${repository}/${path}`,
+    "-H",
+    "Cache-Control: max-age=0",
+    ...args,
+  ]);
+}
+
+async function ghJson(repository, path) {
+  return JSON.parse(await readFreshGhApi(repository, path));
+}
+
+async function ghAttemptJobs(repository, runId, runAttempt) {
+  const output = await readFreshGhApi(
+    repository,
+    `actions/runs/${runId}/attempts/${runAttempt}/jobs?per_page=100`,
+    ["--paginate", "--jq", ".jobs[] | @json"],
+  );
+  return output
+    ? output
+        .split("\n")
+        .filter(Boolean)
+        .map((line) => JSON.parse(line))
+    : [];
+}
+
+async function downloadExecutionPlan(repository, runId) {
+  const directory = mkdtempSync(join(tmpdir(), "openclaw-frv-plan-"));
+  try {
+    try {
+      await execGhRead([
+        "run",
+        "download",
+        runId,
+        "--repo",
+        repository,
+        "--name",
+        `full-release-execution-plan-${runId}`,
+        "--dir",
+        directory,
+      ]);
+    } catch (error) {
+      if (isReleaseGhArtifactMissingError(error)) {
+        return undefined;
+      }
+      throw error;
+    }
+    const path = join(directory, PLAN_FILENAME);
+    const size = statSync(path, { throwIfNoEntry: false })?.size ?? 0;
+    if (size < 1 || size > MAX_RELEASE_ARTIFACT_BYTES) {
+      throw new Error("immutable execution plan artifact is missing or oversized");
+    }
+    return JSON.parse(readFileSync(path, "utf8"));
+  } finally {
+    rmSync(directory, { force: true, recursive: true });
+  }
+}
+
+function selectedChildren(plan) {
+  return plan.children.filter((child) => child.selected);
+}
+
+function hasExactChildRunIdentity(child) {
+  return (
+    typeof child.runId === "string" &&
+    /^[1-9][0-9]*$/u.test(child.runId) &&
+    Number.isSafeInteger(child.runAttempt) &&
+    child.runAttempt > 0
+  );
+}
+
+function assertChildRunIdentity(child, run, repository = DEFAULT_REPOSITORY) {
+  return validateReleaseChildRunProvenance(run, {
+    ...child,
+    plannedRunAttempt: child.runAttempt,
+    repository,
+  });
+}
+
+function exactParentJob(parentJobs, child, sourceParentAttempt) {
+  const spec = releaseChildSpec(child.key);
+  const matches = parentJobs.filter(
+    (job) =>
+      job.name === spec.parentJobName && Number(job.run_attempt) === Number(sourceParentAttempt),
+  );
+  if (
+    matches.length !== 1 ||
+    matches[0].status !== "completed" ||
+    !["success", "failure"].includes(String(matches[0].conclusion))
+  ) {
+    throw new Error(`source parent dispatch job is missing or ambiguous: ${child.key}`);
+  }
+  return matches[0];
+}
+
+export async function preflightContinuation(
+  plan,
+  rootRunId,
+  client,
+  repository = DEFAULT_REPOSITORY,
+) {
+  if (plan.candidate?.producer.runId === String(rootRunId)) {
+    throw new Error(
+      "parent-owned sealed candidate artifacts do not survive parent reruns; start a fresh all-group FRV",
+    );
+  }
+  if (plan.rerunGroup !== "all") {
+    throw new Error("FRV continuation requires an all-group root");
+  }
+  const source = {
+    sourceDisplayTitle: "Full Release Validation",
+    sourceEvent: "workflow_dispatch",
+    sourceRepository: repository,
+    sourceRunAttempt: plan.parentRunAttempt,
+    sourceRunId: String(rootRunId),
+    sourceWorkflowPath: ".github/workflows/full-release-validation.yml",
+    sourceWorkflowRef: plan.workflowRef,
+    sourceWorkflowSha: plan.workflowSha,
+  };
+  const sourceRun = await client.getRunAttempt(source.sourceRunId, source.sourceRunAttempt);
+  if (
+    String(sourceRun.id) !== source.sourceRunId ||
+    Number(sourceRun.run_attempt) !== source.sourceRunAttempt ||
+    sourceRun.display_title !== source.sourceDisplayTitle ||
+    sourceRun.event !== source.sourceEvent ||
+    String(sourceRun.path ?? "").split("@", 1)[0] !== source.sourceWorkflowPath ||
+    sourceRun.head_branch !== source.sourceWorkflowRef ||
+    sourceRun.head_sha !== source.sourceWorkflowSha ||
+    sourceRun.repository?.full_name !== source.sourceRepository
+  ) {
+    throw new Error("source full release parent identity changed");
+  }
+  const parentJobs = await client.getParentJobs(source.sourceRunId);
+  if (
+    parentJobs.some(
+      (job) =>
+        Number(job.run_attempt) === source.sourceRunAttempt &&
+        job.conclusion !== "skipped" &&
+        /^(?:Prepare release npm artifacts|Prepare release Docker artifacts) \/ /u.test(
+          job.name ?? "",
+        ),
+    )
+  ) {
+    throw new Error(
+      "parent-owned publication artifacts do not survive parent reruns; start a fresh all-group FRV",
+    );
+  }
+  const missingChildren = selectedChildren(plan)
+    .filter((child) => !hasExactChildRunIdentity(child))
+    .map((child) => child.key)
+    .toSorted();
+  if (missingChildren.length > 0) {
+    throw new Error(
+      `selected FRV children did not record exact run IDs and attempts: ${missingChildren.join(", ")}; start a fresh all-group FRV`,
+    );
+  }
+  const resolveJobs = parentJobs.filter(
+    (job) =>
+      job.name === "Resolve target ref" &&
+      Number(job.run_attempt) === Number(source.sourceRunAttempt),
+  );
+  if (resolveJobs.length !== 1 || resolveJobs[0].status !== "completed") {
+    throw new Error("source full release input job is missing or ambiguous");
+  }
+  const resolveLog = await client.getJobLog(resolveJobs[0].id);
+  if (
+    !String(resolveLog).includes("RERUN_GROUP: all") ||
+    !String(resolveLog).includes("FAIL_FAST: false") ||
+    !String(resolveLog).includes(`TARGET_SHA: ${plan.targetSha}`)
+  ) {
+    throw new Error("source full release root is not an exact fail-fast-disabled all-group target");
+  }
+  const evidenceClient = client.getReleaseEvidenceClient();
+  const workflow = evidenceClient.getWorkflowSource(plan.workflowSha);
+  const sourceContract = publicationSourceContract(workflow);
+  const registryContract = publicationAdmissionContract(workflow);
+  if (
+    plan.sourceAdmissionContract !== sourceContract ||
+    plan.publicationAdmissionContract !== registryContract
+  ) {
+    throw new Error("continuation admission differs from its immutable source workflow contract");
+  }
+  const sourceAdmission = validatePublicationSourceBinding(plan, {
+    sourceAdmissionContract: sourceContract,
+    parentRunId: String(rootRunId),
+    repository,
+    targetSha: plan.targetSha,
+  });
+  validatePublicationAdmissionBinding(plan, { publicationAdmissionContract: registryContract });
+  if (registryContract && sourceAdmission.validationPurpose === "publish") {
+    const original = await restoreOriginalPublicationAdmission({
+      request: sourceAdmission,
+      client: {
+        ...evidenceClient,
+        getWorkflowSource: (sha) =>
+          sha === plan.workflowSha ? workflow : evidenceClient.getWorkflowSource(sha),
+      },
+    });
+    const validated = validateReleaseExecutionPlanArtifact(plan, {
+      parentRunId: String(rootRunId),
+      sourceAdmissionContract: sourceContract,
+      publicationAdmissionContract: registryContract,
+    });
+    if (validated.sha256 !== original.plan.sha256) {
+      throw new Error("continuation differs from the authenticated original publication plan");
+    }
+  }
+  const childObservations = await Promise.all(
+    selectedChildren(plan).map(async (child) => {
+      const sourceParentAttempt = child.sourceParentAttempt ?? source.sourceRunAttempt;
+      const parentJob = exactParentJob(parentJobs, child, sourceParentAttempt);
+      const [childRun, parentLog] = await Promise.all([
+        client.getRunAttempt(child.runId, child.runAttempt),
+        client.getJobLog(parentJob.id),
+      ]);
+      return { child, childRun, parentLog };
+    }),
+  );
+  for (const { child, parentLog } of childObservations) {
+    validateReleaseChildDispatchBinding({
+      child,
+      log: parentLog,
+      coveragePolicy: plan.coveragePolicy,
+      plannedRunAttempt: child.runAttempt,
+      repository,
+      targetSha: plan.targetSha,
+    });
+  }
+  for (const { child, childRun } of childObservations) {
+    assertChildRunIdentity(child, childRun, repository);
+  }
+  return sourceRun;
+}
+
+export async function inspectContinuation(plan, client) {
+  const children = await Promise.all(
+    selectedChildren(plan).map(async (child) => {
+      if (!hasExactChildRunIdentity(child)) {
+        return {
+          compositeJobsSha256: "",
+          conclusion: "",
+          effectiveRunAttempt: null,
+          key: child.key,
+          passed: false,
+          plannedRunAttempt: child.runAttempt ?? null,
+          runId: String(child.runId ?? ""),
+          status: "missing",
+          url: String(child.url ?? ""),
+        };
+      }
+      const run = await client.getRun(child.runId);
+      assertChildRunIdentity(child, run, client.repository ?? DEFAULT_REPOSITORY);
+      const effectiveRunAttempt = positiveInteger(run.run_attempt, `${child.key} run attempt`);
+      const attempts = await Promise.all(
+        Array.from({ length: effectiveRunAttempt - child.runAttempt + 1 }, async (_, index) => {
+          const runAttempt = child.runAttempt + index;
+          return {
+            jobs: await client.getAttemptJobs(child.runId, runAttempt),
+            runAttempt,
+          };
+        }),
+      );
+      if (run.status !== "completed" && attempts.at(-1)?.jobs.length === 0) {
+        if (attempts.slice(0, -1).some((attempt) => attempt.jobs.length === 0)) {
+          throw new Error(`child attempt evidence is gapped: ${child.key}`);
+        }
+        return {
+          compositeJobsSha256: "",
+          conclusion: String(run.conclusion ?? ""),
+          effectiveRunAttempt,
+          key: child.key,
+          passed: false,
+          plannedRunAttempt: child.runAttempt,
+          runId: child.runId,
+          status: "active",
+          url: String(run.html_url ?? child.url ?? ""),
+        };
+      }
+      const evidence = composeReleaseChildAttemptEvidence({
+        attempts,
+        expected: {
+          ...child,
+          plannedRunAttempt: child.runAttempt,
+          repository: client.repository ?? DEFAULT_REPOSITORY,
+        },
+        run,
+      });
+      const active = run.status !== "completed";
+      const passed =
+        !active &&
+        terminalPolicyPass(
+          {
+            conclusion: run.conclusion,
+            jobs: evidence.jobs,
+            key: child.key,
+            status: run.status,
+          },
+          plan.releaseProfile,
+          child.workflowRef,
+        );
+      return {
+        compositeJobsSha256: evidence.compositeJobsSha256,
+        conclusion: String(run.conclusion ?? ""),
+        dispatchActor: evidence.dispatchActor,
+        effectiveRunAttempt,
+        key: child.key,
+        passed,
+        plannedRunAttempt: child.runAttempt,
+        repository: evidence.repository,
+        runId: child.runId,
+        status: active ? "active" : passed ? "passed" : "failed",
+        triggeringActor: evidence.triggeringActor,
+        url: String(run.html_url ?? child.url ?? ""),
+      };
+    }),
+  );
+  return {
+    children,
+    failed: children.filter((child) => child.status === "failed"),
+    active: children.filter((child) => child.status === "active"),
+    missing: children.filter((child) => child.status === "missing"),
+    passed: children.filter((child) => child.status === "passed"),
+  };
+}
+
+export function createClient(repository, dependencies = {}) {
+  let releaseEvidenceClient;
+  const apiJson = dependencies.apiJson ?? ((path) => ghJson(repository, path));
+  const apiText =
+    dependencies.apiText ??
+    ((path, jq, extraArgs = []) =>
+      readFreshGhApi(repository, path, [...(jq ? ["--paginate", "--jq", jq] : []), ...extraArgs]));
+  const mutate = dependencies.mutate ?? ((args) => execGh(args));
+  const rerun = (runId, action) =>
+    mutate(["api", "-X", "POST", `repos/${repository}/actions/runs/${runId}/${action}`]);
+  const execute = dependencies.execCommand ?? execCommand;
+  const attemptJobs =
+    dependencies.getAttemptJobs ??
+    ((runId, runAttempt) => ghAttemptJobs(repository, runId, runAttempt));
+  const verify = async (runId, plan, operationDeadline, expectedRunAttempts) => {
+    const sourceSha = plan.trustedWorkflow?.sha;
+    return execute(
+      process.execPath,
+      [
+        "scripts/release-ci-summary.mjs",
+        "--validate-run",
+        runId,
+        "--repo",
+        repository,
+        "--trusted-workflow-ref",
+        plan.trustedWorkflow?.ref ?? "main",
+        "--trusted-workflow-full-ref",
+        plan.trustedWorkflow?.fullRef ?? "refs/heads/main",
+        "--trusted-workflow-sha",
+        sourceSha,
+        "--verifier-source-sha",
+        sourceSha,
+        "--verifier-source-file",
+        "scripts/release-ci-summary.mjs",
+        ...(expectedRunAttempts === undefined
+          ? []
+          : ["--expected-run-attempts-json", JSON.stringify(expectedRunAttempts)]),
+        "--json",
+      ],
+      {
+        timeoutMs: remainingOperationTime(
+          operationDeadline ?? createOperationDeadline(),
+          "FRV verification",
+        ),
+      },
+    );
+  };
+  return {
+    repository,
+    getReleaseEvidenceClient() {
+      releaseEvidenceClient ??= createReleaseEvidenceClient(repository);
+      return releaseEvidenceClient;
+    },
+    getAttemptJobs(runId, runAttempt) {
+      return attemptJobs(runId, runAttempt);
+    },
+    getRun(runId) {
+      return apiJson(`actions/runs/${runId}`);
+    },
+    getRunAttempt(runId, runAttempt) {
+      return apiJson(`actions/runs/${runId}/attempts/${runAttempt}`);
+    },
+    async getParentJobs(runId) {
+      const output = await apiText(
+        `actions/runs/${runId}/jobs?filter=all&per_page=100`,
+        ".jobs[] | @json",
+      );
+      return output
+        ? output
+            .split("\n")
+            .filter(Boolean)
+            .map((line) => JSON.parse(line))
+        : [];
+    },
+    async getJobLog(jobId) {
+      // Octopool's gh shim refuses log bodies with terminal escape sequences even off a TTY;
+      // real gh ignores the flag off-TTY, so the controller works with either binary.
+      const path = `actions/jobs/${jobId}/logs`;
+      try {
+        return await apiText(path, undefined, ["--allow-escape-sequences"]);
+      } catch (error) {
+        // gh before 2.97 rejects this flag before issuing the protected request.
+        if (!isUnknownAllowEscapeSequencesFlag(error)) {
+          throw error;
+        }
+        return apiText(path);
+      }
+    },
+    rerunFailed: (runId) => rerun(runId, "rerun-failed-jobs"),
+    rerunParent: (runId) => rerun(runId, "rerun"),
+    verify,
+    async verifySeal(runId, plan, operationDeadline, expectedRunAttempts) {
+      try {
+        await verify(runId, plan, operationDeadline, expectedRunAttempts);
+        return true;
+      } catch (error) {
+        if (verifierEvidenceNeedsRefresh(error)) {
+          return false;
+        }
+        throw error;
+      }
+    },
+  };
+}
+
+function controllerRunAttempt(run, sourceAttempt, expectedAttempt) {
+  const runId = String(run.id);
+  const observedAttempt = positiveInteger(run.run_attempt, `${runId} run attempt`);
+  switch (true) {
+    case observedAttempt < sourceAttempt:
+      throw new Error(`rerun source ${runId} attempt regressed`);
+    case observedAttempt > expectedAttempt:
+      throw new Error(`controller-owned run ${runId} advanced past attempt ${expectedAttempt}`);
+    default:
+      return observedAttempt;
+  }
+}
+
+async function waitForTerminal(runIds, client, operationDeadline, expectedAttempts = new Map()) {
+  const pollMs = configuredTimeout("OPENCLAW_FRV_POLL_MS", DEFAULT_POLL_MS);
+  while (Date.now() < operationDeadline) {
+    const runs = await Promise.all(runIds.map((runId) => client.getRun(runId)));
+    const ready = runs.every((run) => {
+      const runId = String(run.id);
+      const expectedAttempt = expectedAttempts.get(runId);
+      if (expectedAttempt === undefined) {
+        return run.status === "completed";
+      }
+      const observedAttempt = controllerRunAttempt(run, expectedAttempt - 1, expectedAttempt);
+      return run.status === "completed" && observedAttempt === expectedAttempt;
+    });
+    if (ready) {
+      return runs;
+    }
+    await sleep(Math.min(pollMs, remainingOperationTime(operationDeadline)));
+  }
+  throw new Error(`timed out waiting for runs: ${runIds.join(", ")}`);
+}
+
+async function reconcileAttemptStarts(
+  minimumAttempts,
+  priorRuns,
+  client,
+  mutationResults,
+  operationDeadline,
+) {
+  const reconcileDeadline = Math.min(
+    operationDeadline,
+    Date.now() +
+      configuredTimeout("OPENCLAW_FRV_RECONCILE_TIMEOUT_MS", DEFAULT_RECONCILE_TIMEOUT_MS),
+  );
+  const hardFailures = mutationResults.filter(
+    (result) =>
+      result.status === "rejected" && classifyReleaseGhTransportError(result.reason) === "hard",
+  );
+  const pending = new Set(
+    [...minimumAttempts.keys()].filter(
+      (_, index) => !hardFailures.includes(mutationResults[index]),
+    ),
+  );
+  while (pending.size > 0 && Date.now() < reconcileDeadline) {
+    const runs = await Promise.all([...pending].map((runId) => client.getRun(runId)));
+    for (const run of runs) {
+      const runId = String(run.id);
+      const priorRun = priorRuns.get(runId);
+      if (JSON.stringify(runIdentity(run)) !== JSON.stringify(runIdentity(priorRun))) {
+        throw new Error(`rerun source ${runId} changed during mutation reconciliation`);
+      }
+      const sourceAttempt = positiveInteger(priorRun.run_attempt, `${runId} source run attempt`);
+      const expectedAttempt = minimumAttempts.get(runId);
+      const observedAttempt = controllerRunAttempt(run, sourceAttempt, expectedAttempt);
+      if (observedAttempt === expectedAttempt) {
+        pending.delete(runId);
+      }
+    }
+    if (pending.size > 0) {
+      const remainingReconcileTime = reconcileDeadline - Date.now();
+      if (remainingReconcileTime < 1) {
+        break;
+      }
+      await sleep(
+        Math.min(
+          configuredTimeout("OPENCLAW_FRV_POLL_MS", DEFAULT_POLL_MS),
+          remainingReconcileTime,
+        ),
+      );
+    }
+  }
+  if (pending.size > 0) {
+    const runIds = [...minimumAttempts.keys()];
+    const failures = [...pending].flatMap((runId) => {
+      const result = mutationResults[runIds.indexOf(runId)];
+      if (result?.status !== "rejected") {
+        return [];
+      }
+      const reason = result.reason instanceof Error ? result.reason.message : String(result.reason);
+      return [`${runId}: ${reason}`];
+    });
+    throw new Error(
+      `rerun mutation did not produce an observable newer attempt for ${[...pending].join(
+        ", ",
+      )}${failures.length > 0 ? ` (${failures.join("; ")})` : ""}`,
+    );
+  }
+  if (hardFailures[0]) {
+    throw hardFailures[0].reason;
+  }
+  remainingOperationTime(operationDeadline);
+}
+
+function runIdentity(run) {
+  return {
+    actor: String(run.actor?.login ?? ""),
+    displayTitle: String(run.display_title ?? ""),
+    event: String(run.event ?? ""),
+    headBranch: String(run.head_branch ?? ""),
+    headSha: String(run.head_sha ?? ""),
+    id: String(run.id),
+    path: String(run.path ?? ""),
+    repository: String(run.repository?.full_name ?? run.repository ?? ""),
+  };
+}
+
+function exactTerminalRunState(run, runId) {
+  const state = {
+    ...runIdentity(run),
+    conclusion: run.conclusion ?? null,
+    runAttempt: positiveInteger(run.run_attempt, `${runId} run attempt`),
+  };
+  if (state.id !== runId || String(run.status ?? "") !== "completed") {
+    throw new Error(`rerun source ${runId} is no longer the exact terminal run`);
+  }
+  return state;
+}
+
+async function freezeVerificationAttempts(plan, rootRunId, status, client) {
+  const expectedRunAttempts = new Map(
+    status.children.map((child) => [child.runId, child.effectiveRunAttempt]),
+  );
+  // Reuse verification rereads its root and selected parent manifests too.
+  const parentRunIds = new Set([
+    rootRunId,
+    ...(plan.evidenceReuse?.requested
+      ? [plan.evidenceReuse.rootRunId, plan.evidenceReuse.selectedRunId]
+      : []),
+  ]);
+  for (const parentRunId of parentRunIds) {
+    const run = await client.getRun(parentRunId);
+    if (String(run.id) !== parentRunId) {
+      throw new Error(`verification parent run identity changed: ${parentRunId}`);
+    }
+    const terminal = parentRunId === rootRunId ? exactTerminalRunState(run, rootRunId) : undefined;
+    if (terminal && terminal.conclusion !== "success") {
+      throw new Error(`final parent rerun failed: ${rootRunId}`);
+    }
+    expectedRunAttempts.set(
+      parentRunId,
+      terminal?.runAttempt ?? positiveInteger(run.run_attempt, `${parentRunId} run attempt`),
+    );
+  }
+  return Object.fromEntries(expectedRunAttempts.entries());
+}
+
+export async function continueFailed(plan, rootRunId, client, options = {}) {
+  const operationDeadline =
+    options.operationDeadline === undefined
+      ? createOperationDeadline()
+      : validateOperationDeadline(options.operationDeadline);
+  const ownedAttempts = new Map();
+  await preflightContinuation(plan, rootRunId, client, client.repository ?? DEFAULT_REPOSITORY);
+  let status = await inspectContinuation(plan, client);
+  if (status.active.length > 0) {
+    await waitForTerminal(
+      status.active.map((child) => child.runId),
+      client,
+      operationDeadline,
+    );
+    status = await inspectContinuation(plan, client);
+  }
+  if (status.failed.length > 0) {
+    if (options.dryRun) {
+      return { action: "would-rerun", status };
+    }
+    const priorRuns = new Map(
+      await Promise.all(
+        status.failed.map(async (child) => {
+          const run = await client.getRun(child.runId);
+          const terminal = exactTerminalRunState(run, child.runId);
+          if (
+            terminal.runAttempt !== child.effectiveRunAttempt ||
+            terminal.conclusion !== child.conclusion
+          ) {
+            throw new Error(`failed child ${child.runId} changed before rerun dispatch`);
+          }
+          return [child.runId, run];
+        }),
+      ),
+    );
+    const minimumAttempts = new Map(
+      status.failed.map((child) => [child.runId, child.effectiveRunAttempt + 1]),
+    );
+    remainingOperationTime(operationDeadline);
+    const mutationResults = await Promise.allSettled(
+      status.failed.map((child) => client.rerunFailed(child.runId)),
+    );
+    await reconcileAttemptStarts(
+      minimumAttempts,
+      priorRuns,
+      client,
+      mutationResults,
+      operationDeadline,
+    );
+    minimumAttempts.forEach((attempt, runId) => ownedAttempts.set(runId, attempt));
+    await waitForTerminal(
+      status.failed.map((child) => child.runId),
+      client,
+      operationDeadline,
+      minimumAttempts,
+    );
+    status = await inspectContinuation(plan, client);
+    for (const child of status.children) {
+      const expectedAttempt = ownedAttempts.get(child.runId);
+      if (expectedAttempt !== undefined) {
+        controllerRunAttempt(
+          { id: child.runId, run_attempt: child.effectiveRunAttempt },
+          expectedAttempt,
+          expectedAttempt,
+        );
+      }
+    }
+  }
+  if (status.active.length > 0 || status.failed.length > 0) {
+    throw new Error("failed child reruns did not produce a complete green composite");
+  }
+  if (options.dryRun) {
+    return { action: "would-rerun-parent", status };
+  }
+  const childEvidenceAdvanced = status.children.some(
+    (child) => child.effectiveRunAttempt !== child.plannedRunAttempt,
+  );
+  const parent = await client.getRun(rootRunId);
+  if (parent.status !== "completed") {
+    await waitForTerminal([rootRunId], client, operationDeadline);
+  }
+  let completedParent = await client.getRun(rootRunId);
+  let verificationAttempts;
+  let parentSealed = false;
+  if (
+    completedParent.conclusion === "success" &&
+    childEvidenceAdvanced &&
+    client.verifySeal !== undefined
+  ) {
+    verificationAttempts = await freezeVerificationAttempts(plan, rootRunId, status, client);
+    parentSealed = await client.verifySeal(
+      rootRunId,
+      plan,
+      operationDeadline,
+      verificationAttempts,
+    );
+    if (!parentSealed) {
+      const verifiedParent = exactTerminalRunState(completedParent, rootRunId);
+      completedParent = await client.getRun(rootRunId);
+      const currentParent = exactTerminalRunState(completedParent, rootRunId);
+      if (JSON.stringify(currentParent) !== JSON.stringify(verifiedParent)) {
+        throw new Error(`verification parent run changed before rerun dispatch: ${rootRunId}`);
+      }
+    }
+  }
+  if (!parentSealed && (completedParent.conclusion !== "success" || childEvidenceAdvanced)) {
+    const terminalParent = exactTerminalRunState(completedParent, rootRunId);
+    const minimumAttempts = new Map([[rootRunId, terminalParent.runAttempt + 1]]);
+    remainingOperationTime(operationDeadline);
+    const mutationResults = await Promise.allSettled([client.rerunParent(rootRunId)]);
+    await reconcileAttemptStarts(
+      minimumAttempts,
+      new Map([[rootRunId, completedParent]]),
+      client,
+      mutationResults,
+      operationDeadline,
+    );
+    ownedAttempts.set(rootRunId, minimumAttempts.get(rootRunId));
+    await waitForTerminal([rootRunId], client, operationDeadline, minimumAttempts);
+  }
+  if (!parentSealed) {
+    await waitForTerminal([...ownedAttempts.keys()], client, operationDeadline, ownedAttempts);
+    verificationAttempts = await freezeVerificationAttempts(plan, rootRunId, status, client);
+    await client.verify(rootRunId, plan, operationDeadline, verificationAttempts);
+  }
+  return {
+    action: ownedAttempts.has(rootRunId) ? "reran-parent" : "verified-parent",
+    finalRunId: rootRunId,
+    status,
+  };
+}
+
+export async function loadPlan(options, loadExecutionPlan = downloadExecutionPlan) {
+  const payload = await loadExecutionPlan(options.repository, options.runId);
+  if (!payload) {
+    throw new Error("run has no authenticated immutable FRV plan");
+  }
+  const plan = validateReleaseExecutionPlanArtifact(payload, { parentRunId: options.runId });
+  if (plan.attemptEvidenceVersion === undefined) {
+    throw new Error("run predates attempt-aware immutable plans; run a fresh all-group FRV");
+  }
+  if (plan.rerunGroup !== "all") {
+    throw new Error("FRV continuation requires an all-group root");
+  }
+  return plan;
+}
+
+async function createPublicationReader(repository) {
+  const {
+    PUBLICATION_LIMITS: limits,
+    requirePublication,
+    PublicationStatusError,
+    parsePublicationRun,
+    bindPublicationWorkflow,
+    parsePublicationJobs,
+    assertPublicationRunUnchanged,
+    publicationFailure,
+  } = await import("./frv-publication-status.mts");
+  const deadline = Date.now() + limits.deadlineMs;
+  let requests = 0;
+  let totalBytes = 0;
+  const runs = new Map();
+  const workflows = new Map();
+  const artifactLists = new Map();
+  const remaining = () => {
+    const value = deadline - Date.now();
+    requirePublication(value > 0, "deadline");
+    return value;
+  };
+  function bytes(path, maxBytes = limits.jsonBytes) {
+    const timeout = Math.min(limits.requestMs, remaining());
+    requirePublication(++requests <= limits.requests, "limits");
+    let result;
+    try {
+      result = execPlainGh(
+        [
+          "api",
+          "--hostname",
+          "github.com",
+          "--method",
+          "GET",
+          `repos/${repository}/${path}`,
+          "-H",
+          "Cache-Control: max-age=0",
+          "-H",
+          "X-GitHub-Api-Version: 2026-03-10",
+        ],
+        {
+          encoding: "buffer",
+          stdio: ["ignore", "pipe", "pipe"],
+          timeout,
+          killSignal: "SIGKILL",
+          maxBuffer: maxBytes,
+        },
+      );
+    } catch (error) {
+      throw new PublicationStatusError(
+        error?.code === "ENOBUFS"
+          ? "limits"
+          : error?.code === "ETIMEDOUT"
+            ? "deadline"
+            : "transport",
+      );
+    }
+    requirePublication(
+      Buffer.isBuffer(result) && result.length > 0 && result.length <= maxBytes,
+      "limits",
+    );
+    totalBytes += result.length;
+    requirePublication(totalBytes <= limits.totalBytes, "limits");
+    remaining();
+    return result;
+  }
+  function json(path) {
+    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes(path)));
+  }
+  function collection(path, key) {
+    const entries = [];
+    const ids = new Set();
+    let total;
+    for (let page = 1; page <= limits.pages; page += 1) {
+      const value = json(`${path}?per_page=${limits.pageSize}&page=${page}`);
+      requirePublication(
+        Number.isSafeInteger(value?.total_count) &&
+          value.total_count >= 0 &&
+          value.total_count <= limits.pages * limits.pageSize,
+        "limits",
+      );
+      total ??= value.total_count;
+      requirePublication(
+        total === value.total_count &&
+          Array.isArray(value[key]) &&
+          value[key].length <= limits.pageSize,
+        "incomplete",
+      );
+      for (const entry of value[key]) {
+        requirePublication(
+          Number.isSafeInteger(entry?.id) && entry.id > 0 && !ids.has(entry.id),
+          "incomplete",
+        );
+        ids.add(entry.id);
+        entries.push(entry);
+      }
+      requirePublication(entries.length <= total, "incomplete");
+      if (entries.length === total) {
+        return entries;
+      }
+      requirePublication(value[key].length === limits.pageSize, "incomplete");
+    }
+    throw new PublicationStatusError("limits");
+  }
+  async function getRun(runId) {
+    const key = String(runId);
+    requirePublication(/^[1-9][0-9]*$/u.test(key) && Number.isSafeInteger(Number(key)), "limits");
+    if (!runs.has(key)) {
+      requirePublication(runs.size < limits.runs, "limits");
+      runs.set(key, parsePublicationRun(json(`actions/runs/${key}`), repository, key));
+    }
+    return runs.get(key);
+  }
+  async function authenticate(run, path) {
+    if (!workflows.has(run.workflow_id)) {
+      workflows.set(run.workflow_id, json(`actions/workflows/${run.workflow_id}`));
+    }
+    bindPublicationWorkflow(run, workflows.get(run.workflow_id), path);
+  }
+  async function getRunAttempt(runId, attempt) {
+    const current = await getRun(runId);
+    requirePublication(
+      Number.isSafeInteger(attempt) && attempt > 0 && attempt <= current.run_attempt,
+    );
+    const observed = parsePublicationRun(
+      json(`actions/runs/${runId}/attempts/${attempt}`),
+      repository,
+      String(runId),
+    );
+    requirePublication(
+      observed.run_attempt === attempt &&
+        observed.workflow_id === current.workflow_id &&
+        observed.path === current.path &&
+        observed.head_sha === current.head_sha &&
+        observed.head_branch === current.head_branch,
+    );
+    return observed;
+  }
+  async function listArtifacts(runId) {
+    if (!artifactLists.has(runId)) {
+      artifactLists.set(runId, collection(`actions/runs/${runId}/artifacts`, "artifacts"));
+    }
+    return artifactLists.get(runId);
+  }
+  function artifactTuple(metadata, run, name) {
+    requirePublication(
+      metadata &&
+        Number.isSafeInteger(metadata.id) &&
+        metadata.id > 0 &&
+        metadata.name === name &&
+        metadata.workflow_run?.id === run.id &&
+        metadata.workflow_run?.head_sha === run.head_sha &&
+        typeof metadata.digest === "string" &&
+        /^sha256:[a-f0-9]{64}$/u.test(metadata.digest) &&
+        Number.isSafeInteger(metadata.size_in_bytes) &&
+        metadata.size_in_bytes > 0 &&
+        metadata.size_in_bytes <= limits.archiveBytes &&
+        typeof metadata.expired === "boolean" &&
+        typeof metadata.expires_at === "string" &&
+        Number.isFinite(Date.parse(metadata.expires_at)),
+    );
+    return JSON.stringify([
+      metadata.id,
+      metadata.name,
+      metadata.digest,
+      metadata.size_in_bytes,
+      metadata.expired,
+      metadata.expires_at,
+      metadata.workflow_run.id,
+      metadata.workflow_run.head_sha,
+    ]);
+  }
+  async function readArtifact(run, name, filename, maxBytes = limits.expandedBytes) {
+    const all = await listArtifacts(String(run.id));
+    const matches = all.filter((item) => item.name === name);
+    requirePublication(matches.length <= 1);
+    if (!matches.length) {
+      return { state: "missing" };
+    }
+    const selected = matches[0];
+    const tuple = artifactTuple(selected, run, name);
+    if (selected.expired || Date.parse(selected.expires_at) <= Date.now()) {
+      return { state: "expired" };
+    }
+    const fresh = json(`actions/artifacts/${selected.id}`);
+    requirePublication(artifactTuple(fresh, run, name) === tuple);
+    const archive = bytes(`actions/artifacts/${selected.id}/zip`, limits.archiveBytes);
+    requirePublication(
+      archive.length === selected.size_in_bytes && sha256Digest(archive) === selected.digest,
+    );
+    const files = inspectActionsArtifactZipWithPolicy(archive, {
+      expectedEntries: [filename],
+      maxArchiveBytes: limits.archiveBytes,
+      maxExpandedBytes: maxBytes,
+      maxEntryBytes: () => maxBytes,
+    });
+    const entry = files.get(filename);
+    requirePublication(entry, "malformed-evidence");
+    const after = json(`actions/artifacts/${selected.id}`);
+    requirePublication(
+      artifactTuple(after, run, name) === tuple && Date.parse(after.expires_at) > Date.now(),
+    );
+    return {
+      state: "available",
+      artifactId: selected.id,
+      value: JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(entry)),
+    };
+  }
+  return {
+    repository,
+    getRun,
+    getRunAttempt,
+    authenticate,
+    readArtifact,
+    listArtifacts,
+    async getAttemptJobs(runId, attempt) {
+      return parsePublicationJobs(
+        collection(`actions/runs/${runId}/attempts/${attempt}/jobs`, "jobs"),
+        String(runId),
+        attempt,
+      );
+    },
+    finish() {
+      for (const [runId, run] of runs) {
+        try {
+          assertPublicationRunUnchanged(
+            run,
+            parsePublicationRun(json(`actions/runs/${runId}`), repository, runId),
+          );
+        } catch (error) {
+          throw new PublicationStatusError(publicationFailure(error), runId);
+        }
+      }
+      remaining();
+    },
+  };
+}
+
+async function inspectPublicationStatus(options) {
+  const policy = await import("./frv-publication-status.mts");
+  const {
+    FRV_WORKFLOW,
+    PUBLICATION_WORKFLOW,
+    PUBLICATION_LIMITS,
+    PUBLICATION_DIAGNOSTIC,
+    PUBLICATION_CHILDREN,
+    requirePublication,
+    newPublicationObservation,
+    compactPublicationObservation,
+    publicationFailure,
+    observePublicationJobs,
+    observePublicationDiagnostic,
+    parsePublicationDiagnostic,
+    boundPublicationManifest,
+    joinPublicationValidation,
+    observePublicationChild,
+    parseWindowsDispatch,
+    observeWindowsMarker,
+    parseClawHubDispatch,
+  } = policy;
+  const { validateParentManifest } = await import("./release-ci-summary.mjs");
+  const publication = newPublicationObservation(
+    options.repository,
+    options.runId,
+    options.publicationRunId,
+  );
+  let status;
+  let reader;
+  let authenticatingRelationship = true;
+  function recordFailure(error) {
+    const code = publicationFailure(error);
+    const joinedRun = [options.runId, options.publicationRunId].includes(error?.runId);
+    publication.collection = { complete: false, error: code };
+    if (
+      (code === "identity-mismatch" || code === "attempt-changed") &&
+      (authenticatingRelationship || joinedRun)
+    ) {
+      publication.relationship.status = "invalid";
+      publication.relationship.reason = code;
+    } else if (joinedRun && publication.relationship.status === "verified") {
+      publication.relationship.status = "unverified";
+      publication.relationship.reason = code;
+    }
+    process.exitCode = 1;
+  }
+  try {
+    reader = await createPublicationReader(options.repository);
+    const root = await reader.getRun(options.runId);
+    await reader.authenticate(root, FRV_WORKFLOW);
+    const publisher = await reader.getRun(options.publicationRunId);
+    await reader.authenticate(publisher, PUBLICATION_WORKFLOW);
+    publication.publisher = {
+      runId: String(publisher.id),
+      runAttempt: publisher.run_attempt,
+      workflowSha: publisher.head_sha,
+      status: publisher.status,
+      conclusion: publisher.conclusion,
+    };
+    const plan = await loadPlan(options, async () => {
+      const artifact = await reader.readArtifact(
+        root,
+        `full-release-execution-plan-${root.id}`,
+        PLAN_FILENAME,
+      );
+      requirePublication(artifact.state === "available", "incomplete");
+      return validateReleaseExecutionPlanArtifact(artifact.value, {
+        parentRunId: options.runId,
+        repository: options.repository,
+        workflowRef: root.head_branch,
+        workflowSha: root.head_sha,
+        maxParentRunAttempt: root.run_attempt,
+      });
+    });
+    // Authenticate the publication link before unrelated child observations can fail.
+    const jobs = await reader.getAttemptJobs(String(publisher.id), publisher.run_attempt);
+    observePublicationJobs(publication, publisher, jobs);
+    const evidence = await reader.readArtifact(
+      publisher,
+      `openclaw-release-postpublish-diagnostics-${publisher.id}-${publisher.run_attempt}`,
+      PUBLICATION_DIAGNOSTIC,
+      PUBLICATION_LIMITS.diagnosticBytes,
+    );
+    publication.diagnostics.state = evidence.state;
+    let diagnostic;
+    if (evidence.state === "available") {
+      // Failed publishers can upload diagnostics. Their job need not pass; its exact upload must.
+      const owner = jobs.filter((job) => job.name === "Publish plugins, then OpenClaw");
+      requirePublication(
+        owner.length === 1 &&
+          owner[0].steps?.filter(
+            (step) =>
+              step.name === "Upload postpublish diagnostics" &&
+              step.status === "completed" &&
+              step.conclusion === "success",
+          ).length === 1,
+      );
+      diagnostic = parsePublicationDiagnostic(evidence.value, publisher);
+      if (!diagnostic) {
+        publication.diagnostics.state = "unsupported";
+      } else {
+        observePublicationDiagnostic(publication, diagnostic, evidence.artifactId);
+        const validation = diagnostic.context.validationEvidence;
+        if (
+          validation.mode === "full-release-validation" &&
+          validation.runId &&
+          validation.runAttempt
+        ) {
+          requirePublication(validation.runId === options.runId);
+          const attempt = Number(validation.runAttempt);
+          const selected = await reader.getRunAttempt(options.runId, attempt);
+          const manifestArtifact = await reader.readArtifact(
+            selected,
+            `full-release-validation-${selected.id}-${attempt}`,
+            "full-release-validation-manifest.json",
+          );
+          if (manifestArtifact.state === "available") {
+            boundPublicationManifest(manifestArtifact.value);
+            const manifest = validateParentManifest(manifestArtifact.value, {
+              runId: options.runId,
+              runAttempt: attempt,
+              repository: options.repository,
+              workflowRef: root.head_branch,
+              workflowSha: root.head_sha,
+              candidateBinding: plan.candidate,
+            });
+            joinPublicationValidation(
+              publication,
+              diagnostic,
+              plan,
+              manifest,
+              manifestArtifact.value,
+            );
+          } else {
+            publication.relationship.reason = `validation-manifest-${manifestArtifact.state}`;
+          }
+        } else {
+          publication.relationship.reason = "unsupported-or-incomplete-validation-link";
+        }
+        authenticatingRelationship = false;
+        for (const [name, spec] of Object.entries(PUBLICATION_CHILDREN)) {
+          const child = diagnostic.children[name];
+          if (child.suppliedRunId) {
+            const run = await reader.getRun(child.suppliedRunId);
+            await reader.authenticate(run, spec.workflow);
+            const attempt = child.runAttempt === null ? null : Number(child.runAttempt);
+            requirePublication(attempt === null || attempt <= run.run_attempt);
+            observePublicationChild(publication, spec.surface, run, attempt);
+          }
+        }
+      }
+    } else if (evidence.state === "missing") {
+      const artifacts = await reader.listArtifacts(String(publisher.id));
+      if (
+        artifacts.some((item) => item.name?.startsWith("openclaw-release-postpublish-evidence-"))
+      ) {
+        publication.diagnostics.state = "legacy-only";
+      }
+    }
+    authenticatingRelationship = false;
+    const clawHub = await reader.readArtifact(
+      publisher,
+      `openclaw-release-children-${publisher.id}-${publisher.run_attempt}`,
+      "dispatch.json",
+      PUBLICATION_LIMITS.diagnosticBytes,
+    );
+    if (clawHub.state === "available") {
+      const dispatch = parseClawHubDispatch(clawHub.value, publisher, plan.targetSha);
+      const supplied = diagnostic?.children.pluginClawHub.suppliedRunId;
+      requirePublication(!supplied || supplied === dispatch.normalClawHubRunId);
+      publication.dispatches.push({
+        scope: "normal-clawhub",
+        state: dispatch.normalClawHubRunId ? "acknowledged" : "not-dispatched",
+        runId: String(publisher.id),
+        runAttempt: publisher.run_attempt,
+        artifactId: clawHub.artifactId,
+      });
+      if (dispatch.normalClawHubRunId) {
+        const run = await reader.getRun(dispatch.normalClawHubRunId);
+        await reader.authenticate(run, PUBLICATION_CHILDREN.pluginClawHub.workflow);
+        const recordedRef = diagnostic?.selection.clawHubWorkflowRef?.replace(
+          /^refs\/(?:heads|tags)\//u,
+          "",
+        );
+        requirePublication(
+          run.head_sha === publisher.head_sha &&
+            (!recordedRef || run.head_branch === recordedRef) &&
+            run.run_attempt >= Number(dispatch.normalClawHubRunAttempt),
+        );
+        observePublicationChild(
+          publication,
+          "clawHub",
+          run,
+          Number(dispatch.normalClawHubRunAttempt),
+          "dispatch-record",
+        );
+      }
+    }
+    const windows = await reader.readArtifact(
+      publisher,
+      `windows-release-dispatch-${publisher.id}-${publisher.run_attempt}`,
+      "windows-dispatch.json",
+      PUBLICATION_LIMITS.diagnosticBytes,
+    );
+    if (windows.state === "available") {
+      const owner = jobs.filter((job) => job.name === "Dispatch Windows assets after publication");
+      requirePublication(
+        owner.length === 1 &&
+          owner[0].steps?.filter(
+            (step) =>
+              step.name === "Upload Windows dispatch evidence" &&
+              step.status === "completed" &&
+              step.conclusion === "success",
+          ).length === 1,
+      );
+      const dispatch = parseWindowsDispatch(windows.value);
+      requirePublication(
+        !diagnostic?.context.releaseTag || dispatch.tag === diagnostic.context.releaseTag,
+      );
+      publication.surfaces.nativeWindows.selection = "selected";
+      publication.dispatches.push({
+        scope: "windows",
+        state: dispatch.state === "dispatched" ? "acknowledged" : "unknown",
+        runId: String(publisher.id),
+        runAttempt: publisher.run_attempt,
+        artifactId: windows.artifactId,
+      });
+      if (dispatch.state === "dispatched") {
+        const run = await reader.getRun(dispatch.childRunId);
+        await reader.authenticate(run, ".github/workflows/windows-node-release.yml");
+        requirePublication(
+          run.head_branch === publisher.head_branch && run.head_sha === publisher.head_sha,
+        );
+        observePublicationChild(publication, "nativeWindows", run, null, "dispatch-record");
+        const terminal = await reader.readArtifact(
+          run,
+          `windows-release-promotion-${run.id}-${run.run_attempt}`,
+          "windows-promotion.json",
+          PUBLICATION_LIMITS.diagnosticBytes,
+        );
+        if (terminal.state === "available") {
+          const nativeJobs = await reader.getAttemptJobs(String(run.id), run.run_attempt);
+          const nativeOwner = nativeJobs.filter(
+            (job) => job.name === "Promote signed Windows installers",
+          );
+          requirePublication(
+            nativeOwner.length === 1 &&
+              nativeOwner[0].steps?.filter(
+                (step) =>
+                  step.name === "Upload Windows promotion evidence" &&
+                  step.status === "completed" &&
+                  step.conclusion === "success",
+              ).length === 1,
+          );
+          observeWindowsMarker(
+            publication,
+            terminal.value,
+            dispatch,
+            run,
+            terminal.artifactId,
+            nativeOwner[0],
+          );
+        }
+      }
+    }
+    const children = selectedChildren(plan);
+    requirePublication(children.length <= PUBLICATION_LIMITS.runs - 2, "limits");
+    // Bound attempt fanout before inspectContinuation allocates its attempt array.
+    for (const child of children) {
+      if (!hasExactChildRunIdentity(child)) {
+        continue;
+      }
+      const run = await reader.getRun(child.runId);
+      await reader.authenticate(run, `.github/workflows/${child.workflow}`);
+      requirePublication(
+        run.run_attempt >= child.runAttempt &&
+          run.run_attempt - child.runAttempt < PUBLICATION_LIMITS.attempts,
+        "limits",
+      );
+    }
+    status = await inspectContinuation(plan, reader);
+    for (const child of status.children) {
+      child.url = child.runId
+        ? `https://github.com/${options.repository}/actions/runs/${child.runId}`
+        : "";
+    }
+    requirePublication(!publication.diagnostics.truncated, "incomplete");
+    publication.collection.complete = true;
+  } catch (error) {
+    recordFailure(error);
+  }
+  // Partial collection still requires final identity checks within the original budget.
+  try {
+    reader?.finish();
+  } catch (error) {
+    recordFailure(error);
+  }
+  const value = { ...status, publication };
+  if (Buffer.byteLength(JSON.stringify(value, null, 2)) + 1 > PUBLICATION_LIMITS.outputBytes) {
+    process.exitCode = 1;
+    const compact = {
+      publication: compactPublicationObservation(publication, status !== undefined),
+    };
+    requirePublication(
+      Buffer.byteLength(JSON.stringify(compact, null, 2)) + 1 <= PUBLICATION_LIMITS.outputBytes,
+      "limits",
+    );
+    return compact;
+  }
+  return value;
+}
+
+function print(value, json) {
+  if (json) {
+    console.log(JSON.stringify(value, null, 2));
+    return;
+  }
+  for (const child of value.status?.children ?? value.children ?? []) {
+    console.log(
+      `${child.key}: ${child.status} attempt=${child.effectiveRunAttempt} planned=${child.plannedRunAttempt} run=${child.runId}`,
+    );
+  }
+  if (value.action) {
+    console.log(`action: ${value.action}`);
+  }
+  if (value.finalRunId) {
+    console.log(`final run: https://github.com/openclaw/openclaw/actions/runs/${value.finalRunId}`);
+  }
+}
+
+async function main() {
+  const options = parseArgs(process.argv.slice(2));
+  if (options.publicationRunId) {
+    const value = await inspectPublicationStatus(options);
+    print(value, options.json);
+    if (!options.json) {
+      const { formatPublicationObservation } = await import("./frv-publication-status.mts");
+      console.log(formatPublicationObservation(value.publication));
+    }
+    return;
+  }
+  const client = createClient(options.repository);
+  if (options.command === "verify") {
+    const plan = await loadPlan(options);
+    const evidence = await client.verify(options.runId, plan, createOperationDeadline());
+    console.log(evidence);
+    return;
+  }
+  const plan = await loadPlan(options);
+  if (options.command === "status") {
+    print(await inspectContinuation(plan, client), options.json);
+    return;
+  }
+  print(
+    await continueFailed(plan, options.runId, client, {
+      dryRun: options.dryRun,
+    }),
+    options.json,
+  );
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  try {
+    await main();
+  } catch (error) {
+    console.error(
+      process.argv.includes("--publication-run")
+        ? "[frv] publication observation: usage"
+        : `[frv] ${error instanceof Error ? error.message : String(error)}`,
+    );
+    console.error("[frv] FAILED (exit 1)");
+    process.exitCode = 1;
+  }
+}
diff --git a/scripts/full-release-candidate-contract.d.mts b/scripts/full-release-candidate-contract.d.mts
new file mode 100644
index 0000000000000000000000000000000000000000..556b06d79b7ded6bf190552f872d91181f0ab3ed
--- /dev/null
+++ b/scripts/full-release-candidate-contract.d.mts
@@ -0,0 +1,102 @@
+export interface FullReleaseCandidateRecord {
+  [key: string]: unknown;
+}
+
+export interface FullReleaseCandidateRequest {
+  allowFrozenTargetScenarioOmissions: boolean;
+  allowUnreleasedChangelog: boolean;
+  contractVersions: {
+    package: 1;
+    prepublishPluginRegistry: 1;
+    sharedImage: 1;
+  };
+  packagePublished: boolean;
+  releaseProfile: string;
+  releaseSoak: boolean;
+  repository: string;
+  schema: "openclaw.full-release-candidate-request/v2";
+  sharedImagePolicy: string;
+  targetSha: string;
+  toolingSha: string;
+  upgradeSurvivorBaselines: string[];
+  upgradeSurvivorScenarios: string[];
+}
+
+export interface FullReleaseCandidateArtifactIdentity {
+  digest: string;
+  expiresAt: string;
+  id: string;
+  name: string;
+  runAttempt: string;
+  runId: string;
+}
+
+export interface FullReleaseCandidateJobIdentity {
+  jobId: string;
+  jobName: string;
+  repository: string;
+  runAttempt: string;
+  runId: string;
+  workflowPath: string;
+  workflowSha: string;
+}
+
+export type FullReleaseCandidateProducer = FullReleaseCandidateJobIdentity;
+
+export type FullReleaseCandidatePublisher = FullReleaseCandidateJobIdentity;
+
+export interface FullReleaseCandidatePreparation {
+  planSha256: string;
+  requiredPrepublishPluginPackages: string[];
+}
+
+export interface FullReleaseCandidatePackage {
+  artifact: FullReleaseCandidateArtifactIdentity;
+  fileName: string;
+  packageSha256: string;
+  sourceSha: string;
+  version: string;
+}
+
+export interface FullReleaseCandidatePluginRegistry {
+  artifact: FullReleaseCandidateArtifactIdentity;
+  manifestSha256: string;
+  sourceSha: string;
+}
+
+export interface FullReleaseCandidateSharedImage {
+  archiveSha256: string;
+  artifact: FullReleaseCandidateArtifactIdentity;
+  packageSha256: string;
+}
+
+export interface FullReleaseCandidateManifest {
+  package: FullReleaseCandidatePackage;
+  preparation: FullReleaseCandidatePreparation;
+  prepublishPluginRegistry: FullReleaseCandidatePluginRegistry;
+  producer: FullReleaseCandidateProducer;
+  publisher: FullReleaseCandidatePublisher;
+  request: FullReleaseCandidateRequest;
+  requestSha256: string;
+  schema: "openclaw.full-release-candidate/v2";
+  sharedImage: FullReleaseCandidateSharedImage;
+}
+
+export interface FullReleaseCandidateBinding extends Omit<FullReleaseCandidateManifest, "schema"> {
+  evidenceArtifact: FullReleaseCandidateArtifactIdentity;
+  manifestSha256: string;
+  schema: "openclaw.full-release-candidate-binding/v2";
+}
+
+export function buildFullReleaseCandidateRequest(
+  input: FullReleaseCandidateRecord,
+): FullReleaseCandidateRequest;
+export function buildFullReleaseCandidateBinding(input: {
+  artifact: FullReleaseCandidateRecord;
+  manifest: FullReleaseCandidateRecord;
+}): FullReleaseCandidateBinding;
+export function canonicalFullReleaseCandidateRequestJson(value: unknown): string;
+export function candidateRequestSha256(value: unknown): string;
+export function fullReleaseCandidateArtifactName(requestSha256: string): string;
+export function validateFullReleaseCandidateRequest(value: unknown): FullReleaseCandidateRequest;
+export function validateFullReleaseCandidateBinding(value: unknown): FullReleaseCandidateBinding;
diff --git a/scripts/full-release-publication-admission.mts b/scripts/full-release-publication-admission.mts
new file mode 100644
index 0000000000000000000000000000000000000000..3ac764bd1ea087a8df4c95c35b524d8cfa21f21b
--- /dev/null
+++ b/scripts/full-release-publication-admission.mts
@@ -0,0 +1,528 @@
+import { execFileSync, spawn } from "node:child_process";
+import {
+  lstatSync,
+  mkdtempSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { delimiter, dirname, join, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import {
+  createPublicationSourceFact,
+  normalizePublicationIntent,
+  publicationSourceJson,
+} from "./full-release-publication-contract.mjs";
+import {
+  assertPluginReleaseVersionFloors,
+  parsePluginReleaseSelection,
+  parsePluginReleaseSelectionMode,
+  resolveSelectedPublishablePluginPackages,
+} from "./lib/plugin-npm-release.ts";
+import { collectExtensionPackageJsonCandidates } from "./lib/plugin-publication-candidates.ts";
+import { collectPublishablePluginPackagesFromCandidates } from "./lib/plugin-publication-collector.ts";
+import {
+  classifyReleaseTrain,
+  parsePinnedReleaseVersion,
+  parseReleaseVersion,
+} from "./lib/release-version.mjs";
+import { produceVerifiedReleaseInventory } from "./release-plan-producer.mts";
+
+const executionRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const metadataPath =
+  /^(?:package\.json|apps\/android\/version\.json|extensions\/[^/]+\/(?:package\.json|README\.md)|packages\/[^/]+\/package\.json)$/u;
+const platformHelperPath = "scripts/lib/release-publish-children.sh";
+// Acquisition includes the producer's committed runtime and policy inputs. The producer
+// remains responsible for verifying its executing bootstrap, fixed imports and YAML bytes.
+const toolingPaths = new Set([
+  "package.json",
+  "pnpm-lock.yaml",
+  "packages/normalization-core/src/record-coerce.ts",
+  "packages/normalization-core/src/string-coerce.ts",
+  "packages/plugin-package-contract/src/categories.ts",
+  "packages/plugin-package-contract/src/index.ts",
+  "scripts/lib/bounded-response.mjs",
+  "scripts/lib/canonical-json.mjs",
+  "scripts/lib/npm-publish-plan.mjs",
+  "scripts/lib/npm-core-release-packages.json",
+  "scripts/lib/plugin-publication-candidates.ts",
+  "scripts/lib/plugin-publication-collector.ts",
+  "scripts/lib/plugin-publication-target.mjs",
+  "scripts/lib/pnpm-lockfile-documents.mjs",
+  "scripts/lib/record-shared.mjs",
+  "scripts/lib/release-version.mjs",
+  "scripts/release-plan-producer.mts",
+  "scripts/release-plan-producer-core.mts",
+  "scripts/release-plan-contract.mjs",
+  "scripts/release-tooling-identity.mjs",
+  "scripts/release-validation-intent.mjs",
+  "scripts/full-release-publication-admission.mts",
+  "scripts/full-release-publication-contract.mjs",
+  "scripts/lib/plugin-npm-release.ts",
+  "scripts/lib/npm-json-output.mts",
+  "packages/normalization-core/src/expect.ts",
+  "src/utils/run-with-concurrency.ts",
+  "scripts/full-release-publication-observations.mts",
+  "scripts/lib/plugin-clawhub-release.ts",
+  "scripts/clawhub-prepared-artifact.mjs",
+  "scripts/clawhub-parent-authorization.mjs",
+  "scripts/plugin-publication-artifact.mjs",
+  "scripts/lib/actions-artifact-archive.mjs",
+  "scripts/lib/arg-utils.runtime.mjs",
+  "scripts/tsx.mjs",
+  "scripts/lib/tsx-cli-shim.mjs",
+  "scripts/lib/local-check-runtime.mts",
+  "packages/normalization-core/src/number-coercion.ts",
+  "packages/normalization-core/src/utf16-slice.ts",
+  "packages/ai/src/internal/retry-after.ts",
+  "packages/retry/src/index.ts",
+  "src/infra/clawhub-retry.ts",
+  "src/infra/map-size.ts",
+  "src/infra/retry-after.ts",
+  "src/infra/retry-attempt-errors.ts",
+  "src/infra/retry.ts",
+  "src/infra/secure-random.ts",
+  "src/logging/secret-redaction-registry.ts",
+  "src/shared/global-singleton.ts",
+  "src/shared/regexp.ts",
+]);
+type Request = ReturnType<
+  typeof import("./full-release-publication-contract.mjs").publicationSourceRequest
+>;
+type SourceEntry = { oid: string; mode: string; path: string; type: string };
+
+function localGit(root: string, args: string[], input?: Buffer | string) {
+  return execFileSync("git", ["--no-lazy-fetch", "--no-replace-objects", "-C", root, ...args], {
+    env: {
+      PATH: process.env.PATH,
+      GIT_CONFIG_NOSYSTEM: "1",
+      GIT_CONFIG_GLOBAL: "/dev/null",
+      GIT_NO_LAZY_FETCH: "1",
+      GIT_NO_REPLACE_OBJECTS: "1",
+      GIT_OPTIONAL_LOCKS: "0",
+    },
+    input,
+    timeout: 120_000,
+    maxBuffer: 64 * 1024 * 1024,
+    stdio: ["pipe", "pipe", "pipe"],
+  });
+}
+
+function sourceEntries(root: string, sha: string): SourceEntry[] {
+  if (!/^[a-f0-9]{40}$/u.test(sha)) {
+    throw new Error("publication source requires an exact commit");
+  }
+  const resolved = localGit(root, ["rev-parse", "--verify", `${sha}^{commit}`])
+    .toString()
+    .trim();
+  if (resolved !== sha) {
+    throw new Error("publication source commit identity mismatch");
+  }
+  return localGit(root, ["ls-tree", "-r", "-t", "-z", "--full-tree", sha])
+    .toString("latin1")
+    .split("\0")
+    .filter(Boolean)
+    .map((entry) => {
+      const tab = entry.indexOf("\t");
+      const [mode, type, oid] = entry.slice(0, tab).split(" ");
+      if (tab < 0 || !/^[a-f0-9]{40}$/u.test(oid ?? "") || !mode || !type) {
+        throw new Error("invalid publication source object inventory");
+      }
+      return { mode, type, oid: oid!, path: entry.slice(tab + 1) };
+    });
+}
+
+function retainSource(root: string, sha: string, store: string, tooling: boolean) {
+  const entries = sourceEntries(root, sha);
+  const selected = entries.filter(
+    (entry) =>
+      entry.type === "tree" ||
+      (tooling
+        ? toolingPaths.has(entry.path) ||
+          (entry.path === platformHelperPath && entry.type === "blob") ||
+          /^\.github\/workflows\/[^/]+\.yml$/u.test(entry.path)
+        : metadataPath.test(entry.path)),
+  );
+  const objects = new Set([
+    sha,
+    localGit(root, ["rev-parse", `${sha}^{tree}`])
+      .toString()
+      .trim(),
+  ]);
+  let total = 0;
+  const decoder = new TextDecoder("utf-8", { fatal: true });
+  for (const entry of selected) {
+    if (entry.type !== "tree") {
+      decoder.decode(Buffer.from(entry.path, "latin1"));
+      // The optional helper stays raw Git data. Core alone requires and validates
+      // its regular mode when a parsed publication step actually links it.
+      if (
+        !(tooling && entry.path === platformHelperPath) &&
+        !["100644", "100755"].includes(entry.mode)
+      ) {
+        throw new Error("publication source metadata must contain only regular Git blobs");
+      }
+    }
+    objects.add(entry.oid);
+  }
+  if (objects.size > 8192) {
+    throw new Error("publication source object count exceeds limit");
+  }
+  const objectIds = [...objects];
+  const objectInput = objectIds.join("\n") + "\n";
+  const sizes = localGit(
+    root,
+    ["cat-file", "--batch-check=%(objectname) %(objectsize)"],
+    objectInput,
+  )
+    .toString()
+    .split("\n");
+  // A batch can exit successfully with missing objects. Bind every response before packing.
+  for (const [index, oid] of objectIds.entries()) {
+    const match = /^([a-f0-9]{40}) (0|[1-9][0-9]*)$/u.exec(sizes[index] ?? "");
+    if (!match || match[1] !== oid) {
+      throw new Error("invalid publication source object-size response");
+    }
+    const size = Number(match[2]);
+    if (
+      !Number.isSafeInteger(size) ||
+      size > 16 * 1024 * 1024 ||
+      (total += size) > 64 * 1024 * 1024
+    ) {
+      throw new Error("publication source metadata exceeds byte limit");
+    }
+  }
+  if (sizes.length !== objectIds.length + 1 || sizes.at(-1) !== "") {
+    throw new Error("invalid publication source object-size response");
+  }
+  const pack = localGit(
+    root,
+    ["pack-objects", "--stdout", "--no-reuse-delta", "--no-reuse-object"],
+    objectInput,
+  );
+  localGit(store, ["index-pack", "--stdin"], pack);
+  return selected.filter((entry) => entry.type === "blob");
+}
+
+function projectSource(
+  request: Request,
+  snapshot: string,
+  plan: ReturnType<typeof produceVerifiedReleaseInventory>,
+) {
+  const { publicationSelection: selection } = normalizePublicationIntent(
+    request.validationPurpose,
+    publicationSourceJson(request.publicationSelection),
+  );
+  if (!selection) {
+    throw new Error("publication source selection required");
+  }
+  const parsed = parseReleaseVersion(plan.version);
+  if (!parsed) {
+    throw new Error("invalid publication source version");
+  }
+  const train = classifyReleaseTrain(parsed);
+  if (train === "unsupported-extended-stable-correction") {
+    throw new Error("unsupported extended-stable correction");
+  }
+  const extended = selection.route === "extended-stable";
+  const allowedTags =
+    train === "stable"
+      ? ["beta", "latest"]
+      : train === "extended-stable"
+        ? ["extended-stable"]
+        : [parsed.channel];
+  if (
+    !allowedTags.includes(selection.npmDistTag) ||
+    (train === "extended-stable") !== extended ||
+    (parsed.channel === "alpha") !== (selection.route === "alpha")
+  ) {
+    throw new Error("publication selection does not match the committed release version");
+  }
+  if (selection.route === "prepared" && !["beta", "stable"].includes(train)) {
+    throw new Error("prepared publication requires a regular beta/stable candidate");
+  }
+  if (selection.windowsNodeTag && train !== "stable") {
+    throw new Error("Windows assets require a stable publication");
+  }
+  const mode = parsePluginReleaseSelectionMode(selection.pluginPublishScope);
+  const names = parsePluginReleaseSelection(selection.plugins.join(","));
+  if ((mode === "selected") !== names.length > 0) {
+    throw new Error("inconsistent plugin selection");
+  }
+  const candidates = collectExtensionPackageJsonCandidates(snapshot);
+  const npm = collectPublishablePluginPackagesFromCandidates(
+    candidates,
+    "npm",
+    extended ? { npmDistTag: "extended-stable", rootVersion: plan.version } : {},
+  );
+  const clawhub = extended
+    ? []
+    : collectPublishablePluginPackagesFromCandidates(candidates, "clawhub");
+  const all = [
+    ...new Map([...npm, ...clawhub].map((plugin) => [plugin.packageName, plugin])).values(),
+  ];
+  const selected = resolveSelectedPublishablePluginPackages({ plugins: all, selection: names });
+  assertPluginReleaseVersionFloors(selected, "FRV source admission");
+  const selectedNames = new Set(selected.map((plugin) => plugin.packageName));
+  const allPluginNames = new Set(all.map((plugin) => plugin.packageName));
+  const packages = plan.inventory.packages.flatMap((entry) => {
+    const targets = entry.targets.filter((target) => !extended || target === "npm");
+    if (!targets.length) {
+      return [];
+    }
+    const include = allPluginNames.has(entry.name)
+      ? selectedNames.has(entry.name)
+      : selection.publishOpenclawNpm;
+    return include ? [{ ...entry, targets }] : [];
+  });
+  const platforms = plan.inventory.platforms.filter((platform) => {
+    if (platform.id === "linux") {
+      return selection.publishOpenclawNpm && train === "stable" && !extended;
+    }
+    if (platform.id === "windows") {
+      return Boolean(selection.windowsNodeTag);
+    }
+    if (platform.id === "android") {
+      if (!selection.publishOpenclawNpm || train !== "stable") {
+        return false;
+      }
+      const pin = JSON.parse(
+        readFileSync(join(snapshot, "apps/android/version.json"), "utf8"),
+      )?.version;
+      // Match the publisher's exact pin syntax before comparing the parsed base.
+      if (typeof pin !== "string" || !/^[0-9]{4}\.([1-9]|1[0-2])\.[0-9]{1,3}$/u.test(pin)) {
+        throw new Error("apps/android/version.json must pin an exact YYYY.M.PATCH Android version");
+      }
+      return parsePinnedReleaseVersion(pin) === parsed.baseVersion;
+    }
+    if (extended) {
+      return platform.id === "docker";
+    }
+    return selection.publishOpenclawNpm && selection.route !== "alpha";
+  });
+  return { version: plan.version, packages, platforms };
+}
+
+async function collectVerifiedObservations(
+  scratch: string,
+  snapshot: string,
+  source: ReturnType<typeof createPublicationSourceFact>,
+) {
+  const home = join(scratch, "worker-home");
+  const temporary = join(scratch, "worker-tmp");
+  const cache = join(scratch, "worker-cache");
+  for (const directory of [home, temporary, cache]) {
+    mkdirSync(directory);
+  }
+  const request = join(scratch, "registry-request.json");
+  writeFileSync(
+    request,
+    publicationSourceJson({
+      snapshot,
+      source,
+      prerequisitesCompletedAt: new Date().toISOString(),
+    }),
+    { mode: 0o600 },
+  );
+  return await new Promise<string>((resolveResult, reject) => {
+    const child = spawn(
+      process.execPath,
+      [
+        "--import",
+        pathToFileURL(join(executionRoot, "scripts/tsx.mjs")).href,
+        join(executionRoot, "scripts/full-release-publication-observations.mts"),
+        request,
+      ],
+      {
+        cwd: executionRoot,
+        env: {
+          PATH: [dirname(process.execPath), "/usr/bin", "/bin"].join(delimiter),
+          HOME: home,
+          TMPDIR: temporary,
+          TMP: temporary,
+          TEMP: temporary,
+          XDG_CACHE_HOME: cache,
+          LANG: "C.UTF-8",
+          LC_ALL: "C.UTF-8",
+        },
+        stdio: ["ignore", "pipe", "pipe"],
+      },
+    );
+    const stdout: Buffer[] = [];
+    let stderr = Buffer.alloc(0);
+    let outputBytes = 0;
+    let failure: Error | undefined;
+    let forceKill: NodeJS.Timeout | undefined;
+    const stop = (error: Error, signal: NodeJS.Signals = "SIGTERM") => {
+      failure ??= error;
+      child.kill(signal);
+      forceKill ??= setTimeout(() => child.kill("SIGKILL"), 5_000);
+    };
+    const interrupt = () =>
+      stop(new Error("Publication observation worker interrupted by SIGINT."), "SIGINT");
+    const terminate = () =>
+      stop(new Error("Publication observation worker interrupted by SIGTERM."));
+    process.on("SIGINT", interrupt);
+    process.on("SIGTERM", terminate);
+    const deadline = setTimeout(
+      () => stop(new Error("Publication observation worker exceeded its collection deadline.")),
+      300_000,
+    );
+    child.stdout.on("data", (bytes: Buffer) => {
+      outputBytes += bytes.length;
+      if (outputBytes > 1024 * 1024) {
+        stop(new Error("Publication observation worker output exceeded byte limit."));
+      } else {
+        stdout.push(bytes);
+      }
+    });
+    child.stderr.on("data", (bytes: Buffer) => {
+      // Planners also log their retained advisory warnings. Drain them without
+      // converting warning volume into an admission failure; keep a bounded tail.
+      stderr = Buffer.concat([stderr, bytes]).subarray(-16 * 1024);
+    });
+    child.once("error", (error) => {
+      failure ??= new Error("Could not start publication observation worker.", { cause: error });
+    });
+    child.once("close", (code) => {
+      clearTimeout(deadline);
+      clearTimeout(forceKill);
+      process.off("SIGINT", interrupt);
+      process.off("SIGTERM", terminate);
+      if (failure || code !== 0) {
+        let message = "Publication observation worker failed before a bounded diagnostic.";
+        try {
+          const diagnostic = JSON.parse(stderr.toString("utf8").trim().split("\n").at(-1) ?? "");
+          if (
+            diagnostic?.stage === "publication-observations" &&
+            typeof diagnostic.error === "string" &&
+            diagnostic.error.length <= 1024
+          ) {
+            message = diagnostic.error;
+          }
+        } catch {
+          // Import/startup failures are not safe public registry diagnostics.
+        }
+        reject(failure ?? new Error(message));
+      } else {
+        resolveResult(Buffer.concat(stdout).toString("utf8"));
+      }
+    });
+  });
+}
+
+async function admitPublicationSource(
+  request: Request,
+  roots: { selected: string; tooling: string },
+  observationsOut?: string,
+) {
+  const intent = normalizePublicationIntent(
+    request.validationPurpose,
+    request.publicationSelection === null
+      ? ""
+      : publicationSourceJson(request.publicationSelection),
+  );
+  if (intent.validationPurpose !== "publish") {
+    return createPublicationSourceFact(request, null, null);
+  }
+  if (resolve(roots.tooling) !== executionRoot) {
+    throw new Error("source admission requires its executing tooling checkout");
+  }
+  // Bind the trusted checkout's adapter/helper bytes as well as the producer's
+  // independently retained imports. This does not attest a malicious bootstrap.
+  for (const path of toolingPaths) {
+    const file = join(executionRoot, path);
+    if (
+      !lstatSync(file).isFile() ||
+      !readFileSync(file).equals(
+        localGit(executionRoot, ["show", `${request.tooling.sha}:${path}`]),
+      )
+    ) {
+      throw new Error(`source admission tooling bytes differ from the declared SHA: ${path}`);
+    }
+  }
+  const scratch = mkdtempSync(join(tmpdir(), "openclaw-publication-source-"));
+  const store = join(scratch, "objects");
+  const snapshot = join(scratch, "metadata");
+  mkdirSync(store);
+  mkdirSync(snapshot);
+  try {
+    localGit(store, ["-c", "init.templateDir=", "init", "--bare", "-q"]);
+    // A real empty-tree object is needed by the unchanged producer's pathspec diff.
+    localGit(store, ["hash-object", "-w", "-t", "tree", "--stdin"], "");
+    const entries = retainSource(roots.selected, request.candidateSha, store, false);
+    retainSource(roots.tooling, request.tooling.sha, store, true);
+    const plan = produceVerifiedReleaseInventory({
+      repoRoot: store,
+      candidateSha: request.candidateSha,
+      toolingSha: request.tooling.sha,
+      toolingFullRef: request.tooling.ref,
+    });
+    // Only regular committed metadata is materialized, after complete inventory verification.
+    for (const entry of entries) {
+      const path = new TextDecoder("utf-8", { fatal: true }).decode(
+        Buffer.from(entry.path, "latin1"),
+      );
+      const destination = join(snapshot, path);
+      mkdirSync(dirname(destination), { recursive: true });
+      writeFileSync(destination, localGit(store, ["cat-file", "blob", entry.oid]));
+    }
+    mkdirSync(join(snapshot, "extensions"), { recursive: true });
+    const source = createPublicationSourceFact(
+      request,
+      plan.inventory,
+      projectSource(request, snapshot, plan),
+    );
+    if (observationsOut) {
+      const observations = await collectVerifiedObservations(scratch, snapshot, source);
+      writeFileSync(observationsOut, observations, { mode: 0o600 });
+    }
+    return source;
+  } finally {
+    rmSync(scratch, { recursive: true, force: true });
+  }
+}
+
+let invokedAsMain = false;
+if (process.argv[1]) {
+  try {
+    invokedAsMain = import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href;
+  } catch {
+    // Inline and stdin importers need not have a filesystem entrypoint.
+  }
+}
+if (invokedAsMain) {
+  try {
+    const path = process.argv[2];
+    const observationsOut = process.argv[3] === "--observations-out" ? process.argv[4] : undefined;
+    if (
+      !path ||
+      !process.env.PUBLICATION_TARGET_ROOT ||
+      (process.argv.length !== 3 && (process.argv.length !== 5 || !observationsOut))
+    ) {
+      throw new Error("publication source request and selected root required");
+    }
+    const bytes = readFileSync(path);
+    if (bytes.length > 128 * 1024) {
+      throw new Error("publication source request exceeds byte limit");
+    }
+    process.stdout.write(
+      publicationSourceJson(
+        await admitPublicationSource(
+          JSON.parse(bytes.toString("utf8")),
+          {
+            selected: process.env.PUBLICATION_TARGET_ROOT,
+            tooling: executionRoot,
+          },
+          observationsOut,
+        ),
+      ) + "\n",
+    );
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+  }
+}
diff --git a/scripts/full-release-publication-contract.d.mts b/scripts/full-release-publication-contract.d.mts
new file mode 100644
index 0000000000000000000000000000000000000000..082a0db461bbed8b19f94d930a9b1e456edfc880
--- /dev/null
+++ b/scripts/full-release-publication-contract.d.mts
@@ -0,0 +1,190 @@
+export const FULL_RELEASE_SOURCE_ADMISSION_CONTRACT: "1";
+export const FULL_RELEASE_PUBLICATION_ADMISSION_CONTRACT: "1";
+export type ValidationPurpose =
+  | "publish"
+  | "diagnostic"
+  | "main-qualification"
+  | "postpublish-confidence";
+export interface PublicationSelection {
+  route: "normal" | "prepared" | "extended-stable" | "alpha";
+  npmDistTag: "alpha" | "beta" | "latest" | "extended-stable";
+  publishOpenclawNpm: boolean;
+  pluginPublishScope: "selected" | "all-publishable";
+  plugins: string[];
+  windowsNodeTag?: string;
+  windowsNodeInstallerDigests?: Record<string, string>;
+}
+export interface PublicationIntent {
+  validationPurpose: ValidationPurpose;
+  publicationSelection: PublicationSelection | null;
+}
+export interface PublicationDispatchEnvelope extends PublicationIntent {
+  trustedWorkflow: { ref: string; fullRef: string; sha: string } | null;
+}
+export interface PublicationSourceRequest extends PublicationIntent {
+  repository: string;
+  candidateSha: string;
+  targetContextRef: string;
+  tooling: { ref: string; sha: string };
+  workflow: { ref: string; sha: string };
+  runId: string;
+  runAttempt: number;
+  coverage: Record<string, string>;
+}
+export interface PublicationSourceFact extends PublicationSourceRequest {
+  kind: "openclaw.full-release-source-admission/v1";
+  contract: "1";
+  status: "source-admitted" | "not-applicable";
+  inventoryDigest: string | null;
+  projection: { version: string; packages: unknown[]; platforms: unknown[] } | null;
+  digest: string;
+}
+export function publicationSourceContract(source: string): "1" | undefined;
+export function publicationSourceJson(value: unknown): string;
+export function normalizePublicationIntent(
+  purpose: unknown,
+  selectionJson?: unknown,
+): PublicationIntent;
+export function publicationIntentInputs(intent: PublicationIntent): {
+  validationPurpose: ValidationPurpose;
+  publicationSelectionJson: string;
+};
+export function decodePublicationDispatchEnvelope(raw: unknown): PublicationDispatchEnvelope;
+export function publicationDispatchEnvelope(
+  trustedWorkflow: PublicationDispatchEnvelope["trustedWorkflow"],
+  intent: PublicationIntent,
+): string;
+export function publicationSourceRequest(
+  env: Record<string, string | undefined>,
+): PublicationSourceRequest;
+export function createPublicationSourceFact(
+  request: PublicationSourceRequest,
+  inventory: unknown,
+  projection: PublicationSourceFact["projection"],
+): PublicationSourceFact;
+export function validatePublicationSourceBinding(
+  record: Record<string, unknown>,
+  expected?: Record<string, unknown>,
+): PublicationSourceFact | undefined;
+export function publicationSourceReuseIdentity(
+  fact: PublicationSourceFact | undefined,
+):
+  | Pick<
+      PublicationSourceFact,
+      "validationPurpose" | "publicationSelection" | "inventoryDigest" | "projection"
+    >
+  | undefined;
+
+export type PublicationNpmObservation = {
+  name: string;
+  version: string | null;
+  required: boolean;
+  observedAt: string;
+} & (
+  | {
+      outcome: "observed";
+      state: {
+        packageExists: boolean;
+        hasVersionHistory: boolean;
+        selectedVersionExists: boolean;
+        latestVersion: string | null;
+      };
+    }
+  | { outcome: "unavailable"; error: string }
+);
+export interface PublicationClawHubObservation {
+  name: string;
+  version: string;
+  observedAt: string;
+  state: {
+    packageExists: boolean;
+    alreadyPublished: boolean;
+    hasTrustedPublisher: boolean;
+    trustedPublisher: {
+      provider: string | null;
+      repository: string | null;
+      workflowFilename: string | null;
+      environment: string | null;
+    } | null;
+  };
+}
+export interface PublicationPlanningSummary {
+  all: Array<{ name: string; version: string; alreadyPublished: boolean }>;
+  candidates: string[];
+  skippedPublished: string[];
+  warnings: string[];
+}
+export interface PublicationObservationCollection {
+  sourceDigest: string;
+  prerequisitesCompletedAt: string;
+  collectionStartedAt: string;
+  collectionCompletedAt: string;
+  npm: PublicationNpmObservation[];
+  clawhub: PublicationClawHubObservation[];
+  pendingAuthority: Array<{
+    registry: "npm" | "clawhub";
+    name: string;
+    action: string;
+    status: "unresolved";
+  }>;
+  plans: {
+    npm: PublicationPlanningSummary;
+    clawhub: PublicationPlanningSummary & {
+      bootstrapCandidates: string[];
+      missingTrustedPublisher: string[];
+    };
+  };
+}
+export interface PublicationObservations extends PublicationObservationCollection {
+  kind: "openclaw.full-release-publication-observations/v1";
+  contract: "1";
+}
+export interface PublicationObservationArtifact {
+  id: string;
+  name: string;
+  digest: string;
+  sizeInBytes: number;
+}
+export interface PublicationAdmission {
+  observations: PublicationObservations;
+  binding: {
+    kind: "openclaw.full-release-publication-admission/v1";
+    contract: "1";
+    repository: string;
+    parentRunId: string;
+    parentRunAttempt: number;
+    workflow: { path: string; event: string; ref: string; sha: string };
+    sourceDigest: string;
+    observationsDigest: string;
+    artifact: PublicationObservationArtifact;
+    admittedAt: string;
+    status: "admitted-for-validation";
+  };
+}
+export function publicationAdmissionContract(source: string): "1" | undefined;
+export function publicationObservationJson(value: unknown): string;
+export function publicationPendingAuthority(
+  source: PublicationSourceFact,
+  registry: "npm" | "clawhub",
+  row: {
+    name: string;
+    version: string | null;
+    state:
+      | Extract<PublicationNpmObservation, { outcome: "observed" }>["state"]
+      | PublicationClawHubObservation["state"];
+  },
+): PublicationObservationCollection["pendingAuthority"][number] | null;
+export function createPublicationObservations(
+  source: PublicationSourceFact,
+  observations: PublicationObservationCollection,
+): PublicationObservations;
+export function createPublicationAdmission(
+  source: PublicationSourceFact,
+  observations: PublicationObservations,
+  artifact: PublicationObservationArtifact,
+  admittedAt: string,
+): PublicationAdmission;
+export function validatePublicationAdmissionBinding(
+  record: Record<string, unknown>,
+  expected?: Record<string, unknown>,
+): PublicationAdmission | null | undefined;
diff --git a/scripts/full-release-publication-contract.mjs b/scripts/full-release-publication-contract.mjs
new file mode 100644
index 0000000000000000000000000000000000000000..9a43da0e8b5e2545ca776e9157d9f8e646e82cdd
--- /dev/null
+++ b/scripts/full-release-publication-contract.mjs
@@ -0,0 +1,1121 @@
+import { createHash } from "node:crypto";
+import { appendFileSync, readFileSync, realpathSync } from "node:fs";
+import { pathToFileURL } from "node:url";
+import { isPreparedClawHubTrustedPublisher } from "./clawhub-prepared-artifact.mjs";
+import { canonicalizeJsonValue, compareAscii } from "./lib/canonical-json.mjs";
+import corePackages from "./lib/npm-core-release-packages.json" with { type: "json" };
+import { resolveNpmPublishPlan } from "./lib/npm-publish-plan.mjs";
+import { classifyReleaseTrain, parseReleaseVersion } from "./lib/release-version.mjs";
+
+export const FULL_RELEASE_SOURCE_ADMISSION_CONTRACT = "1";
+export const FULL_RELEASE_PUBLICATION_ADMISSION_CONTRACT = "1";
+const purposes = ["publish", "diagnostic", "main-qualification", "postpublish-confidence"];
+const maximumBytes = 128 * 1024;
+const sha = /^[a-f0-9]{40}$/u;
+const digest = /^[a-f0-9]{64}$/u;
+const packageName = /^@openclaw\/[a-z0-9][a-z0-9._-]*$/u;
+const coverageInputs = {
+  provider: "provider",
+  mode: "mode",
+  live_suite_filter: "liveSuiteFilter",
+  cross_os_suite_filter: "crossOsSuiteFilter",
+  release_package_spec: "releasePackageSpec",
+  package_acceptance_package_spec: "packageAcceptancePackageSpec",
+  codex_plugin_spec: "codexPluginSpec",
+  npm_telegram_package_spec: "npmTelegramPackageSpec",
+  npm_telegram_provider_mode: "npmTelegramProviderMode",
+  npm_telegram_scenario: "npmTelegramScenario",
+  plugin_prerelease_node_exclude_patterns_json: "pluginPrereleaseNodeExcludePatternsJson",
+  skip_package_telegram_e2e: "skipPackageTelegramE2e",
+  telegram_waiver: "telegramWaiver",
+  allow_unreleased_changelog: "allowUnreleasedChangelog",
+};
+
+// This marker belongs to the top-level workflow env, not artifact-controlled data.
+export function publicationSourceContract(workflowSource) {
+  if (typeof workflowSource !== "string" || Buffer.byteLength(workflowSource) > 1024 * 1024) {
+    throw new Error("missing or oversized source-admission workflow contract");
+  }
+  const matches = [
+    ...workflowSource.matchAll(/^ {2}FULL_RELEASE_SOURCE_ADMISSION_CONTRACT: *([^\r\n]+)$/gmu),
+  ];
+  if (!matches.length) {
+    if (workflowSource.includes("FULL_RELEASE_SOURCE_ADMISSION_CONTRACT")) {
+      throw new Error("unrecognized source-admission workflow contract encoding");
+    }
+    return undefined;
+  }
+  if (matches.length !== 1 || !/^(?:"1"|'1'|1)$/u.test(matches[0][1])) {
+    throw new Error("unsupported source-admission workflow contract");
+  }
+  return FULL_RELEASE_SOURCE_ADMISSION_CONTRACT;
+}
+
+function object(value, keys, label) {
+  if (
+    !value ||
+    typeof value !== "object" ||
+    Array.isArray(value) ||
+    Object.keys(value).some((key) => !keys.includes(key))
+  ) {
+    throw new Error(`invalid ${label}`);
+  }
+  return value;
+}
+
+function text(value, label, limit = 4096) {
+  if (typeof value !== "string" || value.length > limit) {
+    throw new Error(`invalid ${label}`);
+  }
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code < 32 || code === 127) {
+      throw new Error(`invalid ${label}`);
+    }
+  }
+  return value;
+}
+
+export function publicationSourceJson(value) {
+  const json = JSON.stringify(canonicalizeJsonValue(value));
+  if (Buffer.byteLength(json) > maximumBytes) {
+    throw new Error("source admission exceeds byte limit");
+  }
+  return json;
+}
+
+function publicationSourceDigest(value) {
+  return createHash("sha256").update(publicationSourceJson(value)).digest("hex");
+}
+
+export function normalizePublicationIntent(purpose, selectionJson = "") {
+  if (!purposes.includes(purpose)) {
+    throw new Error(`validation_purpose must be explicit: ${purposes.join(", ")}`);
+  }
+  if (purpose !== "publish") {
+    if (selectionJson !== "") {
+      throw new Error("nonpublish purpose must omit publication selection");
+    }
+    return { validationPurpose: purpose, publicationSelection: null };
+  }
+  if (
+    typeof selectionJson !== "string" ||
+    !selectionJson ||
+    Buffer.byteLength(selectionJson) > 16 * 1024
+  ) {
+    throw new Error("publish purpose requires bounded publication_selection_json");
+  }
+  let selected;
+  try {
+    selected = JSON.parse(selectionJson);
+  } catch {
+    throw new Error("invalid publication selection JSON");
+  }
+  object(
+    selected,
+    [
+      "route",
+      "npmDistTag",
+      "publishOpenclawNpm",
+      "pluginPublishScope",
+      "plugins",
+      "windowsNodeTag",
+      "windowsNodeInstallerDigests",
+    ],
+    "publication selection",
+  );
+  if (
+    !["normal", "prepared", "extended-stable", "alpha"].includes(selected.route) ||
+    !["alpha", "beta", "latest", "extended-stable"].includes(selected.npmDistTag) ||
+    typeof selected.publishOpenclawNpm !== "boolean" ||
+    !["selected", "all-publishable"].includes(selected.pluginPublishScope) ||
+    !Array.isArray(selected.plugins) ||
+    selected.plugins.length > 256 ||
+    selected.plugins.some((name) => typeof name !== "string" || !packageName.test(name))
+  ) {
+    throw new Error("invalid publication selection operands");
+  }
+  const plugins = [...new Set(selected.plugins)].toSorted(compareAscii);
+  if ((selected.pluginPublishScope === "selected") !== plugins.length > 0) {
+    throw new Error("selected publication requires names; all-publishable must omit names");
+  }
+  if (selected.publishOpenclawNpm && selected.pluginPublishScope !== "all-publishable") {
+    throw new Error("core publication requires all-publishable plugins");
+  }
+  if (
+    (selected.route === "extended-stable") !== (selected.npmDistTag === "extended-stable") ||
+    (selected.route === "alpha") !== (selected.npmDistTag === "alpha")
+  ) {
+    throw new Error("publication route and npm dist-tag disagree");
+  }
+  if (
+    ["prepared", "extended-stable"].includes(selected.route) &&
+    (selected.pluginPublishScope !== "all-publishable" || !selected.publishOpenclawNpm)
+  ) {
+    throw new Error("prepared and extended-stable require the complete core/plugin publication");
+  }
+  const windows = {};
+  if (selected.windowsNodeTag !== undefined || selected.windowsNodeInstallerDigests !== undefined) {
+    if (selected.route === "extended-stable") {
+      throw new Error("extended-stable does not select Windows assets");
+    }
+    if (!["beta", "latest"].includes(selected.npmDistTag)) {
+      throw new Error("Windows assets require a stable publication");
+    }
+    windows.windowsNodeTag = text(selected.windowsNodeTag, "Windows source tag", 256);
+    if (
+      !/^v[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z]+([.-][0-9A-Za-z]+)*)?$/u.test(
+        windows.windowsNodeTag,
+      )
+    ) {
+      throw new Error("invalid Windows source tag");
+    }
+    const digests = selected.windowsNodeInstallerDigests;
+    if (
+      !digests ||
+      typeof digests !== "object" ||
+      Array.isArray(digests) ||
+      !Object.keys(digests).length ||
+      Object.keys(digests).length > 16 ||
+      Object.entries(digests).some(
+        ([name, value]) =>
+          !/^[A-Za-z0-9._-]+$/u.test(name) ||
+          typeof value !== "string" ||
+          !/^sha256:[a-f0-9]{64}$/u.test(value),
+      )
+    ) {
+      throw new Error("invalid Windows installer digest map");
+    }
+    windows.windowsNodeInstallerDigests = digests;
+  }
+  return {
+    validationPurpose: purpose,
+    publicationSelection: {
+      route: selected.route,
+      npmDistTag: selected.npmDistTag,
+      publishOpenclawNpm: selected.publishOpenclawNpm,
+      pluginPublishScope: selected.pluginPublishScope,
+      plugins,
+      ...windows,
+    },
+  };
+}
+
+export function publicationIntentInputs(intent) {
+  const normalized = normalizePublicationIntent(
+    intent.validationPurpose,
+    intent.publicationSelection === null ? "" : publicationSourceJson(intent.publicationSelection),
+  );
+  return {
+    validationPurpose: normalized.validationPurpose,
+    publicationSelectionJson:
+      normalized.publicationSelection === null
+        ? ""
+        : publicationSourceJson(normalized.publicationSelection),
+  };
+}
+
+export function decodePublicationDispatchEnvelope(raw) {
+  if (typeof raw !== "string" || !raw || Buffer.byteLength(raw) > maximumBytes) {
+    throw new Error("trusted_workflow_json requires a bounded source-admission envelope");
+  }
+  const value = object(
+    JSON.parse(raw),
+    ["trustedWorkflow", "validationPurpose", "publicationSelection"],
+    "source-admission envelope",
+  );
+  if (Object.keys(value).length !== 3) {
+    throw new Error("source-admission envelope requires identity, purpose and selection");
+  }
+  const trustedWorkflow = value.trustedWorkflow;
+  if (trustedWorkflow !== null) {
+    object(trustedWorkflow, ["ref", "fullRef", "sha"], "source-admission tooling identity");
+    if (
+      Object.keys(trustedWorkflow).length !== 3 ||
+      typeof trustedWorkflow.ref !== "string" ||
+      !/^[A-Za-z0-9._/-]+$/u.test(trustedWorkflow.ref) ||
+      !["refs/heads/", "refs/tags/"].some(
+        (prefix) => trustedWorkflow.fullRef === prefix + trustedWorkflow.ref,
+      ) ||
+      typeof trustedWorkflow.sha !== "string" ||
+      !sha.test(trustedWorkflow.sha)
+    ) {
+      throw new Error("invalid source-admission tooling identity");
+    }
+  }
+  return {
+    trustedWorkflow,
+    ...normalizePublicationIntent(
+      value.validationPurpose,
+      value.publicationSelection === null ? "" : publicationSourceJson(value.publicationSelection),
+    ),
+  };
+}
+
+export function publicationDispatchEnvelope(trustedWorkflow, intent) {
+  return publicationSourceJson(
+    decodePublicationDispatchEnvelope(publicationSourceJson({ trustedWorkflow, ...intent })),
+  );
+}
+
+function dispatchEnvelopeFromInputs(inputs) {
+  if (
+    Object.hasOwn(inputs, "validation_purpose") ||
+    Object.hasOwn(inputs, "publication_selection_json")
+  ) {
+    throw new Error("source intent must use only the trusted_workflow_json envelope");
+  }
+  return decodePublicationDispatchEnvelope(inputs.trusted_workflow_json);
+}
+
+export function publicationSourceRequest(env) {
+  const inputs = JSON.parse(env.PUBLICATION_INPUTS_JSON);
+  const { trustedWorkflow, ...intent } = dispatchEnvelopeFromInputs(inputs);
+  const tooling = JSON.parse(env.PUBLICATION_TOOLING_JSON);
+  if (
+    trustedWorkflow &&
+    ["ref", "fullRef", "sha"].some((key) => trustedWorkflow[key] !== tooling[key])
+  ) {
+    throw new Error("source-admission tooling differs from resolved identity");
+  }
+  const coverage = {};
+  for (const key of [
+    ...Object.keys(coverageInputs),
+    "release_profile",
+    "rerun_group",
+    "evidence_package_spec",
+    "fail_fast",
+    "dispatch_release_evidence",
+  ]) {
+    coverage[key] = text(String(inputs[key] ?? ""), key);
+  }
+  coverage.live_suite_filter = env.PUBLICATION_LIVE_FILTER ?? coverage.live_suite_filter;
+  coverage.cross_os_suite_filter =
+    env.PUBLICATION_CROSS_OS_FILTER ?? coverage.cross_os_suite_filter;
+  coverage.skip_package_telegram_e2e =
+    env.PUBLICATION_SKIP_TELEGRAM ?? coverage.skip_package_telegram_e2e;
+  coverage.allow_unreleased_changelog = String(
+    inputs.allow_unreleased_changelog === true ||
+      inputs.allow_unreleased_changelog === "true" ||
+      (!inputs.target_context_ref && ["main", "refs/heads/main"].includes(inputs.ref)),
+  );
+  coverage.run_release_soak = String(
+    inputs.run_release_soak === true ||
+      inputs.run_release_soak === "true" ||
+      ["stable", "full"].includes(inputs.release_profile),
+  );
+  coverage.coverage_policy = text(env.PUBLICATION_COVERAGE_POLICY ?? "", "coverage policy");
+  return {
+    repository: env.GITHUB_REPOSITORY,
+    candidateSha: env.PUBLICATION_TARGET_SHA,
+    targetContextRef: text(env.PUBLICATION_TARGET_CONTEXT || inputs.ref, "target context"),
+    tooling: { ref: tooling.fullRef, sha: tooling.sha },
+    workflow: { ref: env.GITHUB_REF, sha: env.GITHUB_SHA },
+    runId: env.GITHUB_RUN_ID,
+    runAttempt: Number(env.GITHUB_RUN_ATTEMPT),
+    ...intent,
+    coverage,
+  };
+}
+
+export function createPublicationSourceFact(request, inventory, projection) {
+  const fact = {
+    kind: "openclaw.full-release-source-admission/v1",
+    contract: FULL_RELEASE_SOURCE_ADMISSION_CONTRACT,
+    ...request,
+    status: request.validationPurpose === "publish" ? "source-admitted" : "not-applicable",
+    inventoryDigest: inventory === null ? null : publicationSourceDigest(inventory),
+    projection,
+  };
+  const result = { ...fact, digest: publicationSourceDigest(fact) };
+  return validatePublicationSourceFact(result);
+}
+
+function validatePublicationSourceFact(value, expected = {}) {
+  object(
+    value,
+    [
+      "kind",
+      "contract",
+      "repository",
+      "candidateSha",
+      "targetContextRef",
+      "tooling",
+      "workflow",
+      "runId",
+      "runAttempt",
+      "validationPurpose",
+      "publicationSelection",
+      "coverage",
+      "status",
+      "inventoryDigest",
+      "projection",
+      "digest",
+    ],
+    "source admission fact",
+  );
+  if (
+    value.kind !== "openclaw.full-release-source-admission/v1" ||
+    value.contract !== FULL_RELEASE_SOURCE_ADMISSION_CONTRACT ||
+    value.repository !== "openclaw/openclaw" ||
+    !sha.test(value.candidateSha) ||
+    !/^[1-9][0-9]*$/u.test(value.runId) ||
+    !Number.isSafeInteger(value.runAttempt) ||
+    value.runAttempt < 1
+  ) {
+    throw new Error("invalid source admission identity");
+  }
+  text(value.targetContextRef, "source target context");
+  for (const identity of [value.tooling, value.workflow]) {
+    object(identity, ["ref", "sha"], "source tooling/workflow identity");
+    if (
+      !sha.test(identity.sha) ||
+      !/^refs\/(?:heads|tags)\/[A-Za-z0-9._/-]+$/u.test(identity.ref)
+    ) {
+      throw new Error("invalid source tooling/workflow identity");
+    }
+  }
+  if (value.tooling.sha !== value.workflow.sha) {
+    throw new Error("source tooling differs from executed workflow");
+  }
+  const intent = publicationIntentInputs(value);
+  const coverageKeys = [
+    ...Object.keys(coverageInputs),
+    "release_profile",
+    "rerun_group",
+    "evidence_package_spec",
+    "fail_fast",
+    "dispatch_release_evidence",
+    "run_release_soak",
+    "coverage_policy",
+  ];
+  object(value.coverage, coverageKeys, "source admission coverage");
+  if (coverageKeys.some((key) => !Object.hasOwn(value.coverage, key))) {
+    throw new Error("source admission coverage is incomplete");
+  }
+  for (const entry of Object.values(value.coverage)) {
+    text(entry, "source admission coverage");
+  }
+  if (value.validationPurpose === "publish") {
+    if (value.status !== "source-admitted" || !digest.test(value.inventoryDigest)) {
+      throw new Error("publish source admission requires verified complete inventory");
+    }
+    object(value.projection, ["version", "packages", "platforms"], "publication source projection");
+    text(value.projection.version, "projection version", 128);
+    const version = parseReleaseVersion(value.projection.version);
+    if (!version) {
+      throw new Error("invalid projection version");
+    }
+    if (!Array.isArray(value.projection.packages) || !Array.isArray(value.projection.platforms)) {
+      throw new Error("invalid publication source projection");
+    }
+    if (
+      (value.publicationSelection.windowsNodeTag ||
+        value.projection.platforms.some((entry) => entry?.id === "windows")) &&
+      classifyReleaseTrain(version) !== "stable"
+    ) {
+      throw new Error("Windows assets require a stable publication");
+    }
+    for (const [entries, name] of [
+      [value.projection.packages, "name"],
+      [value.projection.platforms, "id"],
+    ]) {
+      if (
+        entries.length > 512 ||
+        new Set(entries.map((entry) => entry?.[name])).size !== entries.length
+      ) {
+        throw new Error("duplicate or oversized publication source projection");
+      }
+      for (const entry of entries) {
+        if (
+          !entry ||
+          typeof entry !== "object" ||
+          Array.isArray(entry) ||
+          !text(entry[name], "projection identity", 256)
+        ) {
+          throw new Error("invalid publication source projection entry");
+        }
+        if (name === "name") {
+          object(entry, ["name", "version", "targets"], "publication package projection");
+          if (
+            !/^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/u.test(entry.name) ||
+            typeof entry.version !== "string" ||
+            !parseReleaseVersion(entry.version) ||
+            !Array.isArray(entry.targets) ||
+            entry.targets.length === 0 ||
+            entry.targets.some((target) => !["npm", "clawhub"].includes(target)) ||
+            JSON.stringify(entry.targets) !==
+              JSON.stringify([...new Set(entry.targets)].toSorted(compareAscii))
+          ) {
+            throw new Error("invalid publication package version or targets");
+          }
+        } else {
+          object(entry, ["id", "source"], "publication platform projection");
+          if (
+            !/^[a-z][a-z0-9-]*$/u.test(entry.id) ||
+            typeof entry.source !== "string" ||
+            !/^\.github\/workflows\/[a-z0-9][a-z0-9-]*\.yml$/u.test(entry.source)
+          ) {
+            throw new Error("invalid publication platform source");
+          }
+        }
+      }
+      if (entries.some((entry, index) => index > 0 && entries[index - 1][name] >= entry[name])) {
+        throw new Error("publication projection must retain canonical ordering");
+      }
+    }
+  } else if (
+    value.status !== "not-applicable" ||
+    value.inventoryDigest !== null ||
+    value.projection !== null
+  ) {
+    throw new Error("nonpublish source admission must be not-applicable");
+  }
+  const { digest: actualDigest, ...content } = value;
+  if (!digest.test(actualDigest) || actualDigest !== publicationSourceDigest(content)) {
+    throw new Error("source admission digest mismatch");
+  }
+  const bindings = {
+    repository: value.repository,
+    targetSha: value.candidateSha,
+    targetContextRef: value.targetContextRef,
+    trustedWorkflowFullRef: value.tooling.ref,
+    trustedWorkflowSha: value.tooling.sha,
+    parentRunId: value.runId,
+    sourceParentRunAttempt: value.runAttempt,
+    workflowSha: value.workflow.sha,
+    workflowRef: value.workflow.ref.replace(/^refs\/(?:heads|tags)\//u, ""),
+    releaseProfile: value.coverage.release_profile,
+    rerunGroup: value.coverage.rerun_group,
+    runReleaseSoak: value.coverage.run_release_soak,
+    ...intent,
+  };
+  for (const [key, wanted] of Object.entries(expected)) {
+    if (
+      wanted !== undefined &&
+      Object.hasOwn(bindings, key) &&
+      String(bindings[key]) !== String(wanted)
+    ) {
+      throw new Error(`source admission ${key} mismatch`);
+    }
+  }
+  return value;
+}
+
+export function validatePublicationSourceBinding(record, expected = {}) {
+  const contract = record.sourceAdmissionContract;
+  if (
+    expected.sourceAdmissionContract !== undefined &&
+    contract !== expected.sourceAdmissionContract
+  ) {
+    throw new Error("source admission contract missing or mismatched");
+  }
+  if (contract === undefined) {
+    if (
+      record.sourceAdmission !== undefined ||
+      record.validationInputs?.validationPurpose !== undefined ||
+      record.validationInputs?.publicationSelectionJson !== undefined
+    ) {
+      throw new Error("source admission omitted its workflow contract");
+    }
+    return undefined;
+  }
+  if (contract !== FULL_RELEASE_SOURCE_ADMISSION_CONTRACT) {
+    throw new Error("unsupported source admission contract");
+  }
+  if (record.runId !== undefined && (!record.validationInputs || !record.trustedWorkflow)) {
+    throw new Error("source admission manifest omitted its inputs or canonical tooling identity");
+  }
+  const fact = validatePublicationSourceFact(record.sourceAdmission, {
+    targetSha: record.targetSha,
+    parentRunId: record.runId ?? record.parentRunId,
+    workflowSha: record.workflowSha,
+    workflowRef: record.workflowRef,
+    sourceParentRunAttempt: record.sourceParentRunAttempt ?? record.parentRunAttempt,
+    releaseProfile: record.releaseProfile,
+    rerunGroup: record.rerunGroup,
+    runReleaseSoak: record.runReleaseSoak,
+    ...(record.trustedWorkflow
+      ? {
+          trustedWorkflowFullRef: record.trustedWorkflow.fullRef,
+          trustedWorkflowSha: record.trustedWorkflow.sha,
+        }
+      : {}),
+    ...expected,
+  });
+  if (record.validationInputs) {
+    const context = record.validationInputs.targetContextRef || record.targetRef;
+    if (context !== fact.targetContextRef) {
+      throw new Error("source admission target context differs from manifest");
+    }
+    const intent = publicationIntentInputs(fact);
+    for (const [key, value] of Object.entries(intent)) {
+      if (record.validationInputs[key] !== value) {
+        throw new Error(`source admission ${key} differs from manifest`);
+      }
+    }
+    for (const [input, key] of Object.entries(coverageInputs)) {
+      if (String(record.validationInputs[key] ?? "") !== fact.coverage[input]) {
+        throw new Error(`source admission coverage ${key} differs from manifest`);
+      }
+    }
+    if ((record.validationInputs.coveragePolicy ?? "") !== fact.coverage.coverage_policy) {
+      throw new Error("source admission coverage policy differs from manifest");
+    }
+  }
+  return fact;
+}
+
+export function publicationSourceReuseIdentity(fact) {
+  if (fact === undefined) {
+    return undefined;
+  }
+  validatePublicationSourceFact(fact);
+  return {
+    validationPurpose: fact.validationPurpose,
+    publicationSelection: fact.publicationSelection,
+    inventoryDigest: fact.inventoryDigest,
+    projection: fact.projection,
+  };
+}
+
+export function publicationAdmissionContract(workflowSource) {
+  if (typeof workflowSource !== "string" || Buffer.byteLength(workflowSource) > 1024 * 1024) {
+    throw new Error("missing or oversized publication-admission workflow contract");
+  }
+  const matches = [
+    ...workflowSource.matchAll(/^ {2}FULL_RELEASE_PUBLICATION_ADMISSION_CONTRACT: *([^\r\n]+)$/gmu),
+  ];
+  if (!matches.length && !workflowSource.includes("FULL_RELEASE_PUBLICATION_ADMISSION_CONTRACT")) {
+    return undefined;
+  }
+  if (matches.length !== 1 || !/^(?:"1"|'1'|1)$/u.test(matches[0][1])) {
+    throw new Error("unsupported publication-admission workflow contract");
+  }
+  return FULL_RELEASE_PUBLICATION_ADMISSION_CONTRACT;
+}
+
+function closedObject(value, keys, label) {
+  object(value, keys, label);
+  if (keys.some((key) => !Object.hasOwn(value, key))) {
+    throw new Error(`incomplete ${label}`);
+  }
+  return value;
+}
+
+function observationTime(value) {
+  const time = typeof value === "string" ? Date.parse(value) : Number.NaN;
+  if (!Number.isFinite(time) || new Date(time).toISOString() !== value) {
+    throw new Error("invalid publication observation time");
+  }
+  return time;
+}
+
+// These exact canonical bytes are uploaded once; their digest is not the ZIP digest.
+export function publicationObservationJson(value) {
+  return `${JSON.stringify(canonicalizeJsonValue(value))}\n`;
+}
+
+function observationDigest(observations) {
+  return `sha256:${createHash("sha256").update(publicationObservationJson(observations)).digest("hex")}`;
+}
+
+function observationNames(rows, label, maximum = 1024) {
+  if (
+    !Array.isArray(rows) ||
+    rows.length > maximum ||
+    rows.some(
+      (row, index) =>
+        !row ||
+        typeof row.name !== "string" ||
+        !/^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/u.test(row.name) ||
+        row.name.length > 256 ||
+        (index > 0 && compareAscii(rows[index - 1].name, row.name) >= 0),
+    )
+  ) {
+    throw new Error(`invalid publication ${label} roster`);
+  }
+}
+
+function validateObservationPlan(plan, registry, required, observations) {
+  const groups =
+    registry === "npm"
+      ? ["candidates", "skippedPublished"]
+      : ["candidates", "skippedPublished", "bootstrapCandidates", "missingTrustedPublisher"];
+  closedObject(plan, ["all", ...groups, "warnings"], "publication planning summary");
+  observationNames(plan.all, "planning", 512);
+  for (const entry of plan.all) {
+    closedObject(entry, ["name", "version", "alreadyPublished"], "publication planning entry");
+    if (
+      !required.some((row) => row.name === entry.name && row.version === entry.version) ||
+      typeof entry.alreadyPublished !== "boolean"
+    ) {
+      throw new Error("publication planning entry differs from selected registry roster");
+    }
+  }
+  if (registry === "clawhub" && plan.all.length !== required.length) {
+    throw new Error("publication ClawHub planning roster is incomplete");
+  }
+  for (const group of groups) {
+    if (
+      !Array.isArray(plan[group]) ||
+      new Set(plan[group]).size !== plan[group].length ||
+      plan[group].some((name) => !plan.all.some((entry) => entry.name === name))
+    ) {
+      throw new Error("invalid publication planning group");
+    }
+  }
+  for (const entry of plan.all) {
+    const observed = observations.find((row) => row.name === entry.name)?.state;
+    const published =
+      registry === "npm" ? observed?.selectedVersionExists : observed?.alreadyPublished;
+    const candidate =
+      !published &&
+      (registry === "npm" || (observed?.packageExists && observed?.hasTrustedPublisher));
+    if (
+      entry.alreadyPublished !== published ||
+      plan.skippedPublished.includes(entry.name) !== entry.alreadyPublished ||
+      plan.candidates.includes(entry.name) !== candidate ||
+      (registry === "clawhub" &&
+        (plan.bootstrapCandidates.includes(entry.name) !== !observed.packageExists ||
+          plan.missingTrustedPublisher.includes(entry.name) !==
+            (observed.packageExists && !observed.hasTrustedPublisher)))
+    ) {
+      throw new Error("publication planning outcome mismatch");
+    }
+  }
+  if (!Array.isArray(plan.warnings) || plan.warnings.length > 4096) {
+    throw new Error("invalid publication advisory warnings");
+  }
+  for (const warning of plan.warnings) {
+    text(warning, "publication advisory warning");
+  }
+}
+
+// The worker and retained-receipt reader use the same state-to-authority decision.
+// Package membership/version is the authenticated A projection, not caller input.
+export function publicationPendingAuthority(source, registry, row) {
+  const selected = source.projection?.packages.find(
+    (entry) =>
+      entry.name === row.name && entry.version === row.version && entry.targets.includes(registry),
+  );
+  if (!selected || !source.publicationSelection) {
+    throw new Error("publication authority requires a selected source package");
+  }
+  const selection = source.publicationSelection;
+  let action;
+  if (registry === "npm") {
+    if (row.state.packageExists) {
+      if (!row.state.hasVersionHistory) {
+        throw new Error(`${row.name}: npm HTTP 200 has empty version history.`);
+      }
+      return null;
+    }
+    const parsed = parseReleaseVersion(selected.version);
+    const plugin =
+      packageName.test(selected.name) && !corePackages.some((entry) => entry.name === selected.name)
+        ? resolveNpmPublishPlan(
+            selected.version,
+            undefined,
+            selection.route === "extended-stable" ? "extended-stable" : undefined,
+          )
+        : null;
+    const supported =
+      (plugin?.channel === "beta" && plugin.publishTag === "beta") ||
+      (plugin?.channel === "stable" &&
+        plugin.publishTag === "latest" &&
+        selection.npmDistTag === "latest" &&
+        parsed &&
+        classifyReleaseTrain(parsed) === "stable");
+    if (!["normal", "prepared"].includes(selection.route) || !supported) {
+      throw new Error(`${row.name}: npm bootstrap is unsupported for this publication route.`);
+    }
+    action = "owner-preparation-and-access";
+  } else if (registry === "clawhub") {
+    if (
+      selection.route === "prepared" &&
+      (!row.state.packageExists ||
+        !row.state.hasTrustedPublisher ||
+        !isPreparedClawHubTrustedPublisher(row.state.trustedPublisher))
+    ) {
+      throw new Error("publication ClawHub prepared-trust-required");
+    }
+    if (row.state.packageExists && row.state.hasTrustedPublisher) {
+      return null;
+    }
+    action = !row.state.packageExists
+      ? "bootstrap-and-owner-access"
+      : row.state.alreadyPublished
+        ? "configure-only"
+        : "publisher-repair";
+  } else {
+    throw new Error("invalid publication authority registry");
+  }
+  return { registry, name: row.name, action, status: "unresolved" };
+}
+
+function validatePublicationObservations(source, value) {
+  validatePublicationSourceFact(source);
+  if (source.validationPurpose !== "publish") {
+    throw new Error("publication observations require a publish source");
+  }
+  closedObject(
+    value,
+    [
+      "kind",
+      "contract",
+      "sourceDigest",
+      "prerequisitesCompletedAt",
+      "collectionStartedAt",
+      "collectionCompletedAt",
+      "npm",
+      "clawhub",
+      "pendingAuthority",
+      "plans",
+    ],
+    "publication observations",
+  );
+  if (
+    value.kind !== "openclaw.full-release-publication-observations/v1" ||
+    value.contract !== FULL_RELEASE_PUBLICATION_ADMISSION_CONTRACT ||
+    value.sourceDigest !== source.digest
+  ) {
+    throw new Error("publication observations source binding mismatch");
+  }
+  const prerequisites = observationTime(value.prerequisitesCompletedAt);
+  const start = observationTime(value.collectionStartedAt);
+  const end = observationTime(value.collectionCompletedAt);
+  if (prerequisites > start || start > end || end - prerequisites > 300_000) {
+    throw new Error("publication observation time ordering is invalid");
+  }
+  const required = (registry) =>
+    source.projection.packages.filter((entry) => entry.targets.includes(registry));
+  for (const registry of ["npm", "clawhub"]) {
+    observationNames(value[registry], registry);
+    const selected = required(registry);
+    const actual = registry === "npm" ? value.npm.filter((entry) => entry.required) : value.clawhub;
+    if (
+      actual.length !== selected.length ||
+      actual.some(
+        (row) =>
+          !selected.some((entry) => row.name === entry.name && row.version === entry.version),
+      )
+    ) {
+      throw new Error("publication required observation roster differs from selected source");
+    }
+    for (const row of value[registry]) {
+      const observed = observationTime(row.observedAt);
+      if (observed < start || observed > end) {
+        throw new Error("publication observation time is outside collection");
+      }
+      if (registry === "npm") {
+        const observedOutcome = row.outcome === "observed";
+        closedObject(
+          row,
+          [
+            "name",
+            "version",
+            "required",
+            "observedAt",
+            "outcome",
+            observedOutcome ? "state" : "error",
+          ],
+          "publication npm observation",
+        );
+        if (
+          typeof row.required !== "boolean" ||
+          (row.required ? typeof row.version !== "string" : row.version !== null) ||
+          (!row.required && selected.some((entry) => entry.name === row.name))
+        ) {
+          throw new Error("invalid publication npm observation role");
+        }
+        if (!observedOutcome) {
+          if (
+            row.required ||
+            row.outcome !== "unavailable" ||
+            !/^(?:http-[1-5][0-9]{2}|response-too-large|invalid-response|cancelled-or-timeout|read-failed)$/u.test(
+              row.error,
+            )
+          ) {
+            throw new Error("required publication npm observation is unavailable");
+          }
+          continue;
+        }
+        closedObject(
+          row.state,
+          ["packageExists", "hasVersionHistory", "selectedVersionExists", "latestVersion"],
+          "publication npm state",
+        );
+        if (
+          ["packageExists", "hasVersionHistory", "selectedVersionExists"].some(
+            (key) => typeof row.state[key] !== "boolean",
+          ) ||
+          (!row.state.packageExists &&
+            (row.state.hasVersionHistory ||
+              row.state.selectedVersionExists ||
+              row.state.latestVersion !== null)) ||
+          (row.required && row.state.packageExists && !row.state.hasVersionHistory) ||
+          (row.state.latestVersion !== null &&
+            !text(row.state.latestVersion, "publication latest version", 128))
+        ) {
+          throw new Error("invalid publication npm history");
+        }
+      } else {
+        closedObject(
+          row,
+          ["name", "version", "observedAt", "state"],
+          "publication ClawHub observation",
+        );
+        closedObject(
+          row.state,
+          ["packageExists", "alreadyPublished", "hasTrustedPublisher", "trustedPublisher"],
+          "publication ClawHub state",
+        );
+        if (
+          ["packageExists", "alreadyPublished", "hasTrustedPublisher"].some(
+            (key) => typeof row.state[key] !== "boolean",
+          ) ||
+          (!row.state.packageExists &&
+            (row.state.alreadyPublished ||
+              row.state.hasTrustedPublisher ||
+              row.state.trustedPublisher !== null))
+        ) {
+          throw new Error("invalid publication ClawHub state");
+        }
+        if (row.state.trustedPublisher !== null) {
+          closedObject(
+            row.state.trustedPublisher,
+            ["provider", "repository", "workflowFilename", "environment"],
+            "publication trusted publisher",
+          );
+          for (const field of Object.values(row.state.trustedPublisher)) {
+            if (field !== null) {
+              text(field, "publication trusted publisher field", 256);
+            }
+          }
+        }
+      }
+    }
+  }
+  if (!Array.isArray(value.pendingAuthority) || value.pendingAuthority.length > 1024) {
+    throw new Error("invalid publication pending authority");
+  }
+  const pendingKeys = new Set();
+  for (const pending of value.pendingAuthority) {
+    closedObject(
+      pending,
+      ["registry", "name", "action", "status"],
+      "publication pending authority",
+    );
+    const key = `${pending.registry}/${pending.name}`;
+    if (
+      pendingKeys.has(key) ||
+      pending.status !== "unresolved" ||
+      !["npm", "clawhub"].includes(pending.registry) ||
+      !required(pending.registry).some((entry) => entry.name === pending.name) ||
+      !(
+        pending.registry === "npm"
+          ? ["owner-preparation-and-access"]
+          : ["bootstrap-and-owner-access", "configure-only", "publisher-repair"]
+      ).includes(pending.action)
+    ) {
+      throw new Error("invalid publication pending authority classification");
+    }
+    pendingKeys.add(key);
+  }
+  const requiredPending = [
+    ...value.npm
+      .filter((entry) => entry.required)
+      .map((row) => publicationPendingAuthority(source, "npm", row)),
+    ...value.clawhub.map((row) => publicationPendingAuthority(source, "clawhub", row)),
+  ]
+    .filter(Boolean)
+    .toSorted((a, b) => compareAscii(`${a.registry}/${a.name}`, `${b.registry}/${b.name}`));
+  if (
+    publicationObservationJson(value.pendingAuthority) !==
+    publicationObservationJson(requiredPending)
+  ) {
+    throw new Error("publication pending authority differs from required observation states");
+  }
+  closedObject(value.plans, ["npm", "clawhub"], "publication plans");
+  for (const registry of ["npm", "clawhub"]) {
+    validateObservationPlan(value.plans[registry], registry, required(registry), value[registry]);
+  }
+  return value;
+}
+
+export function createPublicationObservations(source, observations) {
+  return validatePublicationObservations(source, {
+    kind: "openclaw.full-release-publication-observations/v1",
+    contract: FULL_RELEASE_PUBLICATION_ADMISSION_CONTRACT,
+    ...observations,
+  });
+}
+
+export function createPublicationAdmission(source, observations, artifact, admittedAt) {
+  const admission = {
+    observations,
+    binding: {
+      kind: "openclaw.full-release-publication-admission/v1",
+      contract: FULL_RELEASE_PUBLICATION_ADMISSION_CONTRACT,
+      repository: source.repository,
+      parentRunId: source.runId,
+      parentRunAttempt: source.runAttempt,
+      workflow: {
+        path: ".github/workflows/full-release-validation.yml",
+        event: "workflow_dispatch",
+        ...source.workflow,
+      },
+      sourceDigest: source.digest,
+      observationsDigest: observationDigest(observations),
+      artifact,
+      admittedAt,
+      status: "admitted-for-validation",
+    },
+  };
+  return validatePublicationAdmissionBinding({
+    sourceAdmissionContract: FULL_RELEASE_SOURCE_ADMISSION_CONTRACT,
+    sourceAdmission: source,
+    publicationAdmissionContract: FULL_RELEASE_PUBLICATION_ADMISSION_CONTRACT,
+    publicationAdmission: admission,
+  });
+}
+
+export function validatePublicationAdmissionBinding(record, expected = {}) {
+  const contract = record.publicationAdmissionContract;
+  if (
+    expected.publicationAdmissionContract !== undefined &&
+    contract !== expected.publicationAdmissionContract
+  ) {
+    throw new Error("publication admission contract missing or mismatched");
+  }
+  if (contract === undefined) {
+    if (record.publicationAdmission !== undefined) {
+      throw new Error("publication admission omitted its workflow contract");
+    }
+    return undefined;
+  }
+  if (contract !== FULL_RELEASE_PUBLICATION_ADMISSION_CONTRACT) {
+    throw new Error("unsupported publication admission contract");
+  }
+  const source = validatePublicationSourceBinding(record, {
+    ...expected,
+    sourceAdmissionContract: FULL_RELEASE_SOURCE_ADMISSION_CONTRACT,
+  });
+  if (source.validationPurpose !== "publish") {
+    if (record.publicationAdmission !== null) {
+      throw new Error("nonpublish purpose cannot retain publication admission");
+    }
+    return null;
+  }
+  const admission = closedObject(
+    record.publicationAdmission,
+    ["observations", "binding"],
+    "publication admission",
+  );
+  const observations = validatePublicationObservations(source, admission.observations);
+  const binding = closedObject(
+    admission.binding,
+    [
+      "kind",
+      "contract",
+      "repository",
+      "parentRunId",
+      "parentRunAttempt",
+      "workflow",
+      "sourceDigest",
+      "observationsDigest",
+      "artifact",
+      "admittedAt",
+      "status",
+    ],
+    "publication admission binding",
+  );
+  closedObject(binding.workflow, ["path", "event", "ref", "sha"], "publication workflow");
+  if (
+    binding.kind !== "openclaw.full-release-publication-admission/v1" ||
+    binding.contract !== contract ||
+    binding.status !== "admitted-for-validation" ||
+    binding.repository !== source.repository ||
+    binding.parentRunId !== source.runId ||
+    binding.parentRunAttempt !== source.runAttempt ||
+    binding.workflow.path !== ".github/workflows/full-release-validation.yml" ||
+    binding.workflow.event !== "workflow_dispatch" ||
+    binding.workflow.ref !== source.workflow.ref ||
+    binding.workflow.sha !== source.workflow.sha ||
+    binding.sourceDigest !== source.digest ||
+    binding.observationsDigest !== observationDigest(observations)
+  ) {
+    throw new Error("publication admission identity or observation digest mismatch");
+  }
+  const artifact = closedObject(
+    binding.artifact,
+    ["id", "name", "digest", "sizeInBytes"],
+    "publication observation artifact",
+  );
+  if (
+    typeof artifact.id !== "string" ||
+    !/^[1-9][0-9]{0,19}$/u.test(artifact.id) ||
+    artifact.name !==
+      `full-release-publication-observations-${source.runId}-${source.runAttempt}` ||
+    !/^sha256:[a-f0-9]{64}$/u.test(artifact.digest) ||
+    !Number.isSafeInteger(artifact.sizeInBytes) ||
+    artifact.sizeInBytes < 1 ||
+    artifact.sizeInBytes > 1024 * 1024 + 8 * 1024
+  ) {
+    throw new Error("invalid publication observation artifact descriptor");
+  }
+  const admitted = observationTime(binding.admittedAt);
+  if (
+    admitted < observationTime(observations.collectionCompletedAt) ||
+    admitted - observationTime(observations.prerequisitesCompletedAt) > 300_000 ||
+    [...observations.npm.filter((row) => row.required), ...observations.clawhub].some(
+      (row) => admitted - observationTime(row.observedAt) > 300_000,
+    )
+  ) {
+    throw new Error("publication admission freshness window exceeded");
+  }
+  return admission;
+}
+
+let invokedAsMain = false;
+if (process.argv[1]) {
+  try {
+    invokedAsMain = import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href;
+  } catch {
+    // Inline and stdin importers need not have a filesystem entrypoint.
+  }
+}
+if (invokedAsMain) {
+  try {
+    if (process.argv[2] === "--dispatch") {
+      const envelope = dispatchEnvelopeFromInputs(JSON.parse(process.env.PUBLICATION_INPUTS_JSON));
+      const identity =
+        envelope.trustedWorkflow === null ? "" : publicationSourceJson(envelope.trustedWorkflow);
+      appendFileSync(process.env.GITHUB_OUTPUT, `trusted_workflow_json=${identity}\n`);
+    } else if (process.argv[2] === "--request") {
+      const request = publicationSourceRequest(process.env);
+      const normalized = publicationIntentInputs(request);
+      if (process.env.GITHUB_OUTPUT) {
+        appendFileSync(
+          process.env.GITHUB_OUTPUT,
+          `required=${request.validationPurpose === "publish"}\nvalidation_purpose=${normalized.validationPurpose}\npublication_selection_json=${normalized.publicationSelectionJson}\n`,
+        );
+      }
+      process.stdout.write(publicationSourceJson(request) + "\n");
+    } else if (process.argv[2] === "--not-applicable") {
+      const retained = JSON.parse(readFileSync(process.argv[3], "utf8"));
+      if (retained.validationPurpose === "publish") {
+        throw new Error("publish requires source inventory");
+      }
+      process.stdout.write(
+        publicationSourceJson(createPublicationSourceFact(retained, null, null)) + "\n",
+      );
+    } else {
+      throw new Error("unsupported source admission operation");
+    }
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+  }
+}
diff --git a/scripts/full-release-validation-at-sha.mts b/scripts/full-release-validation-at-sha.mts
new file mode 100644
index 0000000000000000000000000000000000000000..29aedc456bdebf6551d1d142ef170a6b5fccc778
--- /dev/null
+++ b/scripts/full-release-validation-at-sha.mts
@@ -0,0 +1,2087 @@
+#!/usr/bin/env node
+// Dispatches full release validation against a temporary SHA-pinned branch.
+import {
+  execFileSync,
+  spawnSync,
+  type ExecFileSyncOptionsWithBufferEncoding,
+  type ExecFileSyncOptionsWithStringEncoding,
+} from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import {
+  closeSync,
+  existsSync,
+  fsyncSync,
+  linkSync,
+  lstatSync,
+  mkdirSync,
+  mkdtempSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  statSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { isDeepStrictEqual } from "node:util";
+import { parse as parseYaml } from "yaml";
+import { isRecord as isJsonRecord } from "../packages/normalization-core/src/record-coerce.ts";
+import {
+  decodePublicationDispatchEnvelope,
+  normalizePublicationIntent,
+  publicationDispatchEnvelope,
+  publicationIntentInputs,
+} from "./full-release-publication-contract.mjs";
+import {
+  classifyReleaseGhTransportError,
+  formatReleaseStateOutcome,
+  isReleaseGhArtifactMissingError,
+  MAX_RELEASE_ARTIFACT_BYTES,
+  validateReleaseStateArtifact,
+} from "./full-release-validation-policy.mjs";
+import {
+  inspectActionsArtifactZipWithPolicy,
+  readBoundedRegularFile,
+} from "./lib/actions-artifact-archive.mjs";
+import { requireOptionArgument } from "./lib/arg-utils.mts";
+import { execPlainGh } from "./lib/plain-gh.mjs";
+import { parseReleaseContextRef, resolveReleaseContextIdentity } from "./lib/release-context.mjs";
+import { validatePackageSourceRef } from "./package-source-preflight.mjs";
+
+const REPOSITORY = "openclaw/openclaw";
+const WORKFLOW = "full-release-validation.yml";
+const TRUSTED_WORKFLOW_PATH = `.github/workflows/${WORKFLOW}`;
+const RELEASE_ISOLATION_TOOLING_CONTRACT = "2";
+const RELEASE_ISOLATION_TOOLING_CONTRACT_ENV = "RELEASE_ISOLATION_TOOLING_CONTRACT";
+const RELEASE_EVIDENCE_VERIFIER_PATHS = [
+  "scripts/release-ci-summary.mjs",
+  ".agents/skills/release-openclaw-ci/scripts/release-ci-summary.mjs",
+];
+const GH_READ_TIMEOUT_MS = 60_000;
+export const FULL_RELEASE_WAIT_TIMEOUT_MINUTES = 720;
+export const FULL_RELEASE_GITHUB_POLL_INTERVAL_MS = 2 * 60_000;
+const FULL_RELEASE_PROGRESS_INTERVAL_MS = 15 * 60_000;
+const FULL_RELEASE_RUN_DISCOVERY_DELAYS_MS = [30_000, 60_000, 120_000];
+const RELEASE_DECISION_FILE = "full-release-decision.json";
+const GH_NO_CACHE_HEADER = "Cache-Control: max-age=0";
+const REQUEST_KIND = "openclaw.full-release-dispatch/v1";
+const WITNESS_KIND = "openclaw.full-release-dispatch-inputs/v1";
+const WITNESS_FILE = "dispatch-inputs.json";
+const MAX_REQUEST_BYTES = 128 * 1024;
+const MAX_WITNESS_ARCHIVE_BYTES = 256 * 1024;
+const RUN_PAGE_SIZE = 20;
+const MAX_RUN_PAGES = 5;
+const GH_READ_OPTIONS = {
+  encoding: "utf8",
+  killSignal: "SIGKILL",
+  stdio: ["ignore", "pipe", "inherit"],
+  timeout: GH_READ_TIMEOUT_MS,
+} satisfies ExecFileSyncOptionsWithStringEncoding;
+const TRUSTED_WORKFLOW_TAG_PATTERN = /^release-publish\/([a-f0-9]{12})-[1-9][0-9]*$/u;
+const SHA_PATTERN = /^[a-f0-9]{40}$/u;
+const RERUN_GROUPS = new Set([
+  "all",
+  "ci",
+  "plugin-prerelease",
+  "install-smoke",
+  "cross-os",
+  "live-e2e",
+  "package",
+  "qa-parity",
+  "qa-live",
+  "npm-telegram",
+  "performance",
+]);
+const DEFAULT_INPUTS = {
+  provider: "openai",
+  mode: "both",
+  rerun_group: "all",
+  reuse_evidence: "true",
+  fail_fast: "false",
+};
+
+type ReleaseInputs = Record<string, string> &
+  typeof DEFAULT_INPUTS &
+  Partial<Record<"release_profile" | "allow_unreleased_changelog", string>>;
+type CommandOptions = {
+  dryRun?: boolean;
+  stdio?: "inherit" | ["ignore", "pipe" | "ignore", "pipe" | "inherit" | "ignore"];
+  timeoutMs?: number;
+};
+type CommandStatus = {
+  error?: Error;
+  signal?: unknown;
+  status: number | null;
+  stderr: unknown;
+  stdout: unknown;
+};
+type TemporaryRefParams = {
+  keepBranch: boolean;
+  dryRun: boolean;
+  parentConclusion: string;
+  evidenceVerified: boolean;
+};
+type TrustedWorkflowHarness = {
+  contract: "1" | "2";
+  verifierPath: string;
+};
+type DispatchInputs = Record<string, string | boolean | number>;
+type DispatchRun = { id: number; attempt: number };
+type DispatchRequest = {
+  id: string;
+  host: "github.com";
+  repository: typeof REPOSITORY;
+  workflowId: number;
+  workflowPath: typeof TRUSTED_WORKFLOW_PATH;
+  event: "workflow_dispatch";
+  workflowSha: string;
+  trustedWorkflowRef: string;
+  targetSha: string;
+  targetVersion: string;
+  targetContextRef: string;
+  workflowRef: string;
+  targetRef: string;
+  wireInputs: Record<string, string>;
+  inputs: DispatchInputs;
+  effectiveSoak: boolean;
+};
+type DispatchRecord = {
+  kind: typeof REQUEST_KIND;
+  request: DispatchRequest;
+  phase: "prepared" | "attempted" | "observed" | "rejected";
+  refs: {
+    target: "intended" | "uncertain" | "created";
+    workflow: "intended" | "uncertain" | "created";
+  };
+  error: "none" | "transport" | "unclassified" | "http-rejection";
+  run: DispatchRun | null;
+};
+
+function stringValue(value: unknown, fallback = ""): string {
+  return typeof value === "string" ? value : fallback;
+}
+
+function displayValue(value: unknown): string {
+  if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+    return String(value);
+  }
+  return value === null ? "null" : (JSON.stringify(value) ?? "<undefined>");
+}
+
+function requiredPositiveInteger(value: unknown, label: string): number {
+  const normalized = Number(value);
+  if (!Number.isSafeInteger(normalized) || normalized < 1) {
+    throw new Error(`${label} must be a positive integer`);
+  }
+  return normalized;
+}
+
+function usage() {
+  console.error(`Usage: node scripts/full-release-validation-at-sha.mjs [--sha <target-sha>] [--target-ref <canonical-release-branch-or-tag>] [--workflow-sha <trusted-tooling-sha>] [--trusted-workflow-ref <main-or-release-publish-tag>] [--request-file <path>] [--keep-branch] [--dry-run] [-- -f key=value ...]
+       node scripts/full-release-validation-at-sha.mjs --reconcile-request <path>
+
+Retains a private request artifact before remote mutations. An existing --request-file
+always performs read-only reconciliation. --reconcile-request refuses a missing file.
+Retain the artifact until operator cleanup; its loss never proves non-execution.
+Frozen tooling must declare FULL_RELEASE_DISPATCH_WITNESS_CONTRACT=1 before a new request.
+
+Creates temporary remote branches pinned to the exact Tooling SHA and Validation SHA,
+dispatches Full Release Validation with the full Validation SHA as its ref input
+and expected_sha as its immutable identity,
+watches the parent run, verifies all child workflow head SHAs match the trusted
+workflow lineage through the release evidence manifest, then deletes both
+temporary branches by default. --keep-branch retains both branches. Exact-target and changelog-only Release SHA
+evidence reuse stay enabled; pass -f reuse_evidence=false to force a fresh
+run. Child workflows collect independent failures by default; pass
+-f fail_fast=true to cancel only an exact still-active child after Release
+Decision identifies a blocking failure for that child. The release
+branch accepts its final package version or a matching beta prerelease.
+A numeric correction branch also accepts the base package only when its
+published base tag resolves to the exact Validation SHA.
+Exact alpha tags remain supported for Tideclaw. The release profile defaults to
+beta for beta candidates and exact alpha tags, and stable otherwise; pass
+-f release_profile=full for the broad advisory sweep. Focused retries must use
+one controller rerun_group; the removed release-checks aggregate and the direct
+child's manual qa aggregate are not accepted.`);
+}
+
+function run(command: string, args: string[], options: CommandOptions = {}) {
+  if (options.dryRun) {
+    console.log(["+", command, ...args].join(" "));
+    return "";
+  }
+  const output = execFileSync(command, args, {
+    encoding: "utf8",
+    stdio: options.stdio ?? ["ignore", "pipe", "inherit"],
+  });
+  return typeof output === "string" ? output.trim() : "";
+}
+
+function runStatus(command: string, args: string[], options: CommandOptions = {}) {
+  if (options.dryRun) {
+    console.log(["+", command, ...args].join(" "));
+    return { status: 0, stderr: "", stdout: "" };
+  }
+  return spawnSync(command, args, {
+    encoding: "utf8",
+    killSignal: "SIGKILL",
+    stdio: options.stdio ?? ["ignore", "pipe", "inherit"],
+    timeout: options.timeoutMs ?? GH_READ_TIMEOUT_MS,
+  });
+}
+
+function runGh(inputArgs: string[], options: CommandOptions = {}) {
+  const args =
+    inputArgs[0] === "api" && !inputArgs.includes("--hostname")
+      ? [...inputArgs, "--hostname", "github.com"]
+      : inputArgs;
+  if (options.dryRun) {
+    console.log(["+", "gh", ...args].join(" "));
+    return "";
+  }
+  const output = execPlainGh(args, {
+    encoding: "utf8",
+    stdio: options.stdio ?? ["ignore", "pipe", "inherit"],
+    ...(options.timeoutMs === undefined ? {} : { timeout: options.timeoutMs }),
+  });
+  return typeof output === "string" ? (args.includes("--include") ? output : output.trim()) : "";
+}
+
+function runGhStatus(args: string[], options: CommandOptions = {}): CommandStatus {
+  try {
+    return {
+      signal: null,
+      status: 0,
+      stderr: "",
+      stdout: execPlainGh(args, {
+        encoding: "utf8",
+        killSignal: "SIGKILL",
+        stdio: options.stdio ?? ["ignore", "pipe", "inherit"],
+        timeout: options.timeoutMs ?? GH_READ_TIMEOUT_MS,
+      }),
+    };
+  } catch (error) {
+    const failure = error instanceof Error ? error : new Error(String(error));
+    const details = failure as Error & {
+      signal?: unknown;
+      status?: number | null;
+      stderr?: unknown;
+      stdout?: unknown;
+    };
+    return {
+      error: failure,
+      signal: details.signal,
+      status: details.status ?? 1,
+      stderr: details.stderr ?? "",
+      stdout: details.stdout ?? "",
+    };
+  }
+}
+
+function readGhApi(
+  endpoint: string,
+  fields: string[] = [],
+  options: ExecFileSyncOptionsWithStringEncoding = GH_READ_OPTIONS,
+) {
+  return execPlainGh(
+    [
+      "api",
+      "--method",
+      "GET",
+      endpoint,
+      ...fields,
+      "--hostname",
+      "github.com",
+      "-H",
+      GH_NO_CACHE_HEADER,
+    ],
+    options,
+  );
+}
+
+function commandFailureMessage(error: unknown): string {
+  if (error === undefined || error === null) {
+    return "";
+  }
+  if (!(error instanceof Error)) {
+    return displayValue(error);
+  }
+  const details = error as Error & {
+    cause?: unknown;
+    stderr?: unknown;
+    stdout?: unknown;
+  };
+  const outputText = (value: unknown) => {
+    if (typeof value === "string") {
+      return value.trim();
+    }
+    return Buffer.isBuffer(value) ? value.toString("utf8").trim() : "";
+  };
+  return [
+    outputText(details.stderr),
+    outputText(details.stdout),
+    error.message,
+    details.cause === error ? "" : commandFailureMessage(details.cause),
+  ]
+    .filter(Boolean)
+    .join("\n");
+}
+
+function isUnsupportedAllowEscapeSequencesFlag(error: unknown): boolean {
+  if (!(error instanceof Error)) {
+    return false;
+  }
+  const stderr = (error as Error & { stderr?: unknown }).stderr;
+  const text =
+    typeof stderr === "string" ? stderr : Buffer.isBuffer(stderr) ? stderr.toString("utf8") : "";
+  return text
+    .replaceAll("\r\n", "\n")
+    .split("\n")
+    .some((line) => line.trim() === "unknown flag: --allow-escape-sequences");
+}
+
+function createTemporaryRef(ref: string, sha: string, dryRun: boolean) {
+  try {
+    runGh(
+      [
+        "api",
+        "--method",
+        "POST",
+        `repos/${REPOSITORY}/git/refs`,
+        "-f",
+        `ref=${ref}`,
+        "-f",
+        `sha=${sha}`,
+      ],
+      { dryRun, stdio: ["ignore", "pipe", "pipe"] },
+    );
+  } catch (error) {
+    const message = commandFailureMessage(error);
+    if (!message.includes("Object does not exist")) {
+      throw new Error(message, { cause: error });
+    }
+    // The refs API cannot transfer a commit that exists only in the local
+    // object database. Preserve the shipped local-candidate contract.
+    run("git", ["push", "origin", `${sha}:${ref}`], {
+      dryRun,
+      stdio: "inherit",
+    });
+  }
+}
+
+function deleteTemporaryRefs(refs: string[], dryRun: boolean) {
+  const failures: string[] = [];
+  for (const ref of refs) {
+    try {
+      runGh(
+        ["api", "--method", "DELETE", `repos/${REPOSITORY}/git/refs/${ref.slice("refs/".length)}`],
+        {
+          dryRun,
+        },
+      );
+    } catch (error) {
+      failures.push(`${ref}: ${commandFailureMessage(error)}`);
+    }
+  }
+  if (failures.length > 0) {
+    throw new Error(`Failed to delete temporary refs: ${failures.join("; ")}`);
+  }
+}
+
+export function parseArgs(argv: string[]) {
+  const inputs: ReleaseInputs = { ...DEFAULT_INPUTS };
+  const args = {
+    sha: "",
+    targetRef: "",
+    trustedWorkflowRef: "main",
+    workflowSha: "",
+    requestFile: "",
+    reconcileRequest: "",
+    specifiedInputs: [] as string[],
+    keepBranch: false,
+    dryRun: false,
+    inputs,
+  };
+
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i]!;
+    if (arg === "--help" || arg === "-h") {
+      usage();
+      process.exit(0);
+    }
+    if (arg === "--sha") {
+      args.sha = requireOptionArgument(argv, i, arg);
+      i += 1;
+      continue;
+    }
+    if (arg === "--request-file" || arg === "--reconcile-request") {
+      args[arg === "--request-file" ? "requestFile" : "reconcileRequest"] = requireOptionArgument(
+        argv,
+        i,
+        arg,
+      );
+      i += 1;
+      continue;
+    }
+    if (arg === "--workflow-sha") {
+      args.workflowSha = requireOptionArgument(argv, i, arg);
+      i += 1;
+      continue;
+    }
+    if (arg === "--trusted-workflow-ref") {
+      args.trustedWorkflowRef = requireOptionArgument(argv, i, arg);
+      i += 1;
+      continue;
+    }
+    if (arg === "--target-ref") {
+      args.targetRef = requireOptionArgument(argv, i, arg);
+      i += 1;
+      continue;
+    }
+    if (arg === "--keep-branch") {
+      args.keepBranch = true;
+      continue;
+    }
+    if (arg === "--dry-run") {
+      args.dryRun = true;
+      continue;
+    }
+    if (arg === "--") {
+      const extras = argv.slice(i + 1);
+      for (let extraIndex = 0; extraIndex < extras.length; extraIndex += 1) {
+        const extra = extras[extraIndex]!;
+        let assignment;
+        if (extra === "-f") {
+          assignment = requireOptionArgument(extras, extraIndex, extra);
+          extraIndex += 1;
+        } else {
+          assignment = extra.startsWith("-f") ? extra.slice(2).trim() : extra;
+        }
+        const [key, ...valueParts] = assignment.split("=");
+        if (!key || valueParts.length === 0) {
+          throw new Error(`Unsupported extra argument after --: ${extra}`);
+        }
+        args.inputs[key] = valueParts.join("=");
+        args.specifiedInputs.push(key);
+      }
+      break;
+    }
+    if (arg === "-f") {
+      const assignment = requireOptionArgument(argv, i, arg);
+      i += 1;
+      const [key, ...valueParts] = assignment.split("=");
+      if (!key || valueParts.length === 0) {
+        throw new Error(`Invalid -f assignment: ${assignment}`);
+      }
+      args.inputs[key] = valueParts.join("=");
+      args.specifiedInputs.push(key);
+      continue;
+    }
+    if (arg.startsWith("-f") && arg.includes("=")) {
+      const assignment = arg.slice(2).trim();
+      const [key, ...valueParts] = assignment.split("=");
+      if (!key || valueParts.length === 0) {
+        throw new Error(`Invalid -f assignment: ${arg}`);
+      }
+      args.inputs[key] = valueParts.join("=");
+      args.specifiedInputs.push(key);
+      continue;
+    }
+    throw new Error(`Unknown argument: ${arg}`);
+  }
+
+  if (args.reconcileRequest) {
+    if (argv.length !== 2 || argv[0] !== "--reconcile-request") {
+      throw new Error("--reconcile-request accepts only the retained request path");
+    }
+    return args;
+  }
+  if (!["true", "false"].includes(args.inputs.reuse_evidence)) {
+    throw new Error("reuse_evidence must be true or false");
+  }
+  if (!["true", "false"].includes(args.inputs.fail_fast)) {
+    throw new Error("fail_fast must be true or false");
+  }
+  if (
+    Object.hasOwn(args.inputs, "allow_unreleased_changelog") &&
+    !["true", "false"].includes(args.inputs.allow_unreleased_changelog ?? "")
+  ) {
+    throw new Error("allow_unreleased_changelog must be true or false");
+  }
+  if (
+    args.inputs.release_profile &&
+    !["beta", "stable", "full"].includes(args.inputs.release_profile)
+  ) {
+    throw new Error("release_profile must be beta, stable, or full");
+  }
+  if (!RERUN_GROUPS.has(args.inputs.rerun_group)) {
+    throw new Error(`rerun_group must be one of: ${[...RERUN_GROUPS].join(", ")}`);
+  }
+  if (Object.hasOwn(args.inputs, "ref")) {
+    throw new Error("SHA-pinned release validation reserves the ref input for --sha");
+  }
+  if (Object.hasOwn(args.inputs, "expected_sha")) {
+    throw new Error("SHA-pinned release validation reserves expected_sha for the resolved --sha");
+  }
+  if (Object.hasOwn(args.inputs, "trusted_workflow_json")) {
+    throw new Error("SHA-pinned release validation reserves trusted_workflow_json");
+  }
+  const targetContext = parseReleaseContextRef(args.targetRef);
+  if (args.targetRef && !targetContext) {
+    throw new Error("--target-ref must be a canonical OpenClaw release branch or tag");
+  }
+  args.targetRef = targetContext?.ref ?? args.targetRef;
+  if (
+    args.trustedWorkflowRef !== "main" &&
+    !TRUSTED_WORKFLOW_TAG_PATTERN.test(args.trustedWorkflowRef)
+  ) {
+    throw new Error(
+      "--trusted-workflow-ref must be main or a protected release-publish/<12hex>-<decimal> tag",
+    );
+  }
+  if (args.trustedWorkflowRef !== "main" && !SHA_PATTERN.test(args.workflowSha.toLowerCase())) {
+    throw new Error(
+      "protected release-publish workflow refs require --workflow-sha with an explicit full Tooling SHA",
+    );
+  }
+  if (
+    targetContext &&
+    targetContext.kind !== "release tag" &&
+    !SHA_PATTERN.test(args.workflowSha.toLowerCase())
+  ) {
+    throw new Error(
+      "release-branch validation requires --workflow-sha with an explicit full Tooling SHA",
+    );
+  }
+  return args;
+}
+
+export function resolveRemoteTargetRefSha(
+  targetRef: string,
+  executeGit: (args: string[]) => string = (args) => run("git", args),
+) {
+  const context = parseReleaseContextRef(targetRef);
+  if (!context) {
+    throw new Error("Target ref must be a canonical OpenClaw release branch or tag");
+  }
+  if (context.kind !== "release tag") {
+    return (
+      executeGit(["ls-remote", "--heads", "origin", `refs/heads/${context.ref}`]).split(
+        /\s+/u,
+      )[0] ?? ""
+    );
+  }
+
+  const tagRef = `refs/tags/${context.ref}`;
+  const peeledSha = executeGit(["ls-remote", "--tags", "origin", `${tagRef}^{}`]).split(/\s+/u)[0];
+  if (peeledSha) {
+    return peeledSha;
+  }
+  return executeGit(["ls-remote", "--tags", "origin", tagRef]).split(/\s+/u)[0] ?? "";
+}
+
+export function verifyTargetRef(
+  targetRef: string,
+  targetSha: string,
+  targetVersion: string,
+  resolveRemoteSha: (ref: string) => string = resolveRemoteTargetRefSha,
+  isAncestor: (ancestor: string, descendant: string) => boolean = (ancestor, descendant) =>
+    runStatus("git", ["merge-base", "--is-ancestor", ancestor, descendant], {
+      stdio: ["ignore", "ignore", "ignore"],
+    }).status === 0,
+) {
+  if (!targetRef) {
+    return targetSha;
+  }
+  const identity = resolveReleaseContextIdentity(targetRef, targetVersion);
+  if (!identity) {
+    throw new Error("Target ref must be a canonical OpenClaw release branch or tag");
+  }
+  const remoteSha = resolveRemoteSha(targetRef);
+  if (!remoteSha) {
+    throw new Error(`Target ref ${targetRef} does not resolve to a commit`);
+  }
+  if (identity.kind !== "release tag") {
+    if (!isAncestor(targetSha, remoteSha)) {
+      throw new Error(
+        `Target SHA ${targetSha} is not reachable from release branch ${targetRef} at ${remoteSha}`,
+      );
+    }
+  } else if (remoteSha.toLowerCase() !== targetSha.toLowerCase()) {
+    throw new Error(`Target ref ${targetRef} does not resolve to ${targetSha}`);
+  }
+  if (identity.baseTag) {
+    const baseSha = resolveRemoteSha(identity.baseTag);
+    if (baseSha.toLowerCase() !== targetSha.toLowerCase()) {
+      throw new Error(
+        `Fallback correction ${identity.releaseTag} must use the same source commit as ${identity.baseTag}; expected ${targetSha}, found ${baseSha || "missing"}.`,
+      );
+    }
+  }
+  return targetRef;
+}
+
+function resolveSha(requestedSha: string) {
+  const rev = requestedSha || "HEAD";
+  return run("git", ["rev-parse", "--verify", `${rev}^{commit}`], { dryRun: false });
+}
+
+function fetchTargetRef(targetRef: string) {
+  if (!targetRef) {
+    return;
+  }
+  const context = parseReleaseContextRef(targetRef);
+  if (!context) {
+    throw new Error("Target ref must be a canonical OpenClaw release branch or tag");
+  }
+  const sourceRef = `refs/${context.kind === "release tag" ? "tags" : "heads"}/${context.ref}`;
+  run("git", ["fetch", "--no-tags", "origin", sourceRef], {
+    stdio: "inherit",
+  });
+}
+
+function resolveTargetSha(requestedSha: string, targetRef: string) {
+  fetchTargetRef(targetRef);
+  const revision = requestedSha || "HEAD";
+  const resolved = runStatus("git", ["rev-parse", "--verify", `${revision}^{commit}`], {
+    stdio: ["ignore", "pipe", "ignore"],
+  });
+  const resolvedSha = typeof resolved.stdout === "string" ? resolved.stdout.trim() : "";
+  if (resolved.status !== 0 || !resolvedSha) {
+    throw new Error(
+      targetRef
+        ? `Target SHA ${revision} is not available locally after fetching ${targetRef}`
+        : `Target SHA ${revision} is not available locally; pass --target-ref so it can be fetched by name`,
+    );
+  }
+  return resolvedSha;
+}
+
+function targetVersionForTarget(
+  targetSha: string,
+  readPackageJson: (sha: string) => string = (sha) => run("git", ["show", `${sha}:package.json`]),
+): string {
+  let version: unknown;
+  try {
+    version = JSON.parse(readPackageJson(targetSha)).version;
+  } catch {
+    throw new Error(`Could not read package.json from target SHA ${targetSha}`);
+  }
+  if (typeof version !== "string" || !/^[0-9]{4}\.[0-9]+\.[0-9]+(?:-.+)?$/u.test(version)) {
+    throw new Error(`Target SHA ${targetSha} has an invalid package version`);
+  }
+  return version;
+}
+
+function releaseProfileForVersion(version: string): "beta" | "stable" {
+  return /-(?:alpha|beta)\.[1-9][0-9]*$/u.test(version) ? "beta" : "stable";
+}
+
+export function releaseProfileForTarget(
+  targetSha: string,
+  readPackageJson: (sha: string) => string = (sha) => run("git", ["show", `${sha}:package.json`]),
+): "beta" | "stable" {
+  return releaseProfileForVersion(targetVersionForTarget(targetSha, readPackageJson));
+}
+
+export function verifyTrustedWorkflowRef(
+  workflowSha: string,
+  trustedWorkflowRef: string,
+  resolveRemoteTagSha: (tag: string) => string = (tag) =>
+    run("git", ["ls-remote", "--tags", "origin", `refs/tags/${tag}`]).split(/\s+/u)[0] ?? "",
+  isMainAncestor: (sha: string) => boolean = (sha) =>
+    runStatus("git", ["merge-base", "--is-ancestor", sha, "refs/remotes/origin/main"]).status === 0,
+) {
+  if (trustedWorkflowRef === "main") {
+    if (!isMainAncestor(workflowSha)) {
+      throw new Error(
+        `Workflow SHA ${workflowSha} is not reachable from current origin/main; refusing an untrusted release harness.`,
+      );
+    }
+    return;
+  }
+
+  const tagMatch = trustedWorkflowRef.match(TRUSTED_WORKFLOW_TAG_PATTERN);
+  if (!tagMatch) {
+    throw new Error(
+      "trusted workflow ref must be main or a protected release-publish/<12hex>-<decimal> tag",
+    );
+  }
+  if (workflowSha.slice(0, 12) !== tagMatch[1]) {
+    throw new Error(
+      `Trusted workflow tag ${trustedWorkflowRef} does not match Tooling SHA ${workflowSha}`,
+    );
+  }
+  const remoteTagSha = resolveRemoteTagSha(trustedWorkflowRef);
+  if (!remoteTagSha) {
+    throw new Error(`Trusted workflow tag ${trustedWorkflowRef} does not exist on origin`);
+  }
+  if (remoteTagSha.toLowerCase() !== workflowSha.toLowerCase()) {
+    throw new Error(
+      `Trusted workflow tag ${trustedWorkflowRef} resolves to ${remoteTagSha}, expected ${workflowSha}`,
+    );
+  }
+}
+
+function resolveTrustedWorkflowSha(requestedSha: string, trustedWorkflowRef: string) {
+  if (trustedWorkflowRef === "main") {
+    run("git", ["fetch", "--no-tags", "origin", "refs/heads/main:refs/remotes/origin/main"], {
+      stdio: "inherit",
+    });
+  }
+  const workflowSha = resolveSha(requestedSha || "origin/main");
+  verifyTrustedWorkflowRef(workflowSha, trustedWorkflowRef);
+  return workflowSha;
+}
+
+function requireDispatch(condition: unknown, message: string): asserts condition {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+function exactKeys(value: unknown, keys: string[]): value is Record<string, unknown> {
+  return isJsonRecord(value) && isDeepStrictEqual(Object.keys(value).toSorted(), keys.toSorted());
+}
+
+export function dispatchInputsDigest(inputs: DispatchInputs): string {
+  const wireInputs = Object.fromEntries(
+    Object.keys(inputs)
+      .filter((key) => String(inputs[key]) !== "")
+      .toSorted()
+      .map((key) => [key, String(inputs[key])]),
+  );
+  return `sha256:${createHash("sha256").update(JSON.stringify(wireInputs)).digest("hex")}`;
+}
+
+function validateDispatchRecord(value: unknown): asserts value is DispatchRecord {
+  requireDispatch(
+    exactKeys(value, ["kind", "request", "phase", "refs", "error", "run"]) &&
+      value.kind === REQUEST_KIND &&
+      ["prepared", "attempted", "observed", "rejected"].includes(stringValue(value.phase)) &&
+      ["none", "transport", "unclassified", "http-rejection"].includes(stringValue(value.error)),
+    "Invalid retained dispatch record",
+  );
+  const request = value.request;
+  requireDispatch(
+    exactKeys(request, [
+      "id",
+      "host",
+      "repository",
+      "workflowId",
+      "workflowPath",
+      "event",
+      "workflowSha",
+      "trustedWorkflowRef",
+      "targetSha",
+      "targetVersion",
+      "targetContextRef",
+      "workflowRef",
+      "targetRef",
+      "wireInputs",
+      "inputs",
+      "effectiveSoak",
+    ]) &&
+      typeof request.id === "string" &&
+      /^[a-f0-9-]{36}$/u.test(request.id) &&
+      request.host === "github.com" &&
+      request.repository === REPOSITORY &&
+      request.workflowPath === TRUSTED_WORKFLOW_PATH &&
+      request.event === "workflow_dispatch" &&
+      Number.isSafeInteger(request.workflowId) &&
+      Number(request.workflowId) > 0 &&
+      typeof request.workflowSha === "string" &&
+      SHA_PATTERN.test(request.workflowSha) &&
+      typeof request.targetSha === "string" &&
+      SHA_PATTERN.test(request.targetSha) &&
+      typeof request.targetVersion === "string" &&
+      /^[0-9]{4}\.[0-9]+\.[0-9]+(?:-.+)?$/u.test(request.targetVersion) &&
+      typeof request.targetContextRef === "string" &&
+      typeof request.trustedWorkflowRef === "string" &&
+      (request.trustedWorkflowRef === "main" ||
+        TRUSTED_WORKFLOW_TAG_PATTERN.test(request.trustedWorkflowRef)) &&
+      typeof request.workflowRef === "string" &&
+      new RegExp(`^release-ci/${request.workflowSha.slice(0, 12)}-[0-9]+$`, "u").test(
+        request.workflowRef,
+      ) &&
+      typeof request.targetRef === "string" &&
+      new RegExp(`^validation/target-${request.targetSha.slice(0, 12)}-[0-9]+$`, "u").test(
+        request.targetRef,
+      ) &&
+      isJsonRecord(request.wireInputs) &&
+      isJsonRecord(request.inputs) &&
+      isDeepStrictEqual(
+        Object.keys(request.wireInputs).toSorted(),
+        Object.keys(request.inputs).toSorted(),
+      ),
+    "Invalid retained dispatch request identity",
+  );
+  for (const [key, input] of Object.entries(request.inputs)) {
+    requireDispatch(
+      /^[a-z][a-z0-9_]*$/u.test(key) &&
+        (typeof input === "string" ||
+          typeof input === "boolean" ||
+          (typeof input === "number" && Number.isFinite(input))) &&
+        request.wireInputs[key] === String(input),
+      "Invalid retained dispatch inputs",
+    );
+  }
+  requireDispatch(
+    request.inputs.ref === request.targetSha &&
+      request.inputs.expected_sha === request.targetSha &&
+      (request.targetContextRef === request.targetSha
+        ? !request.inputs.target_context_ref
+        : request.inputs.target_context_ref === request.targetContextRef) &&
+      request.effectiveSoak ===
+        (request.inputs.run_release_soak === true ||
+          request.inputs.release_profile === "stable" ||
+          request.inputs.release_profile === "full"),
+    "Retained dispatch selection does not match its identity",
+  );
+  if (request.inputs.trusted_workflow_json) {
+    requireDispatch(
+      typeof request.inputs.trusted_workflow_json === "string",
+      "Invalid retained tooling input",
+    );
+    const supplied = JSON.parse(request.inputs.trusted_workflow_json);
+    const enveloped = isJsonRecord(supplied) && Object.hasOwn(supplied, "trustedWorkflow");
+    const identity = enveloped
+      ? decodePublicationDispatchEnvelope(request.inputs.trusted_workflow_json).trustedWorkflow
+      : supplied;
+    requireDispatch(
+      !enveloped ||
+        (!Object.hasOwn(request.inputs, "validation_purpose") &&
+          !Object.hasOwn(request.inputs, "publication_selection_json")),
+      "Retained dispatch contains conflicting source intent representations",
+    );
+    requireDispatch(
+      typeof request.inputs.trusted_workflow_json === "string" &&
+        isDeepStrictEqual(identity, {
+          fullRef:
+            request.trustedWorkflowRef === "main"
+              ? "refs/heads/main"
+              : `refs/tags/${request.trustedWorkflowRef}`,
+          ref: request.trustedWorkflowRef,
+          sha: request.workflowSha,
+        }),
+      "Retained trusted workflow identity changed",
+    );
+  }
+  requireDispatch(
+    exactKeys(value.refs, ["target", "workflow"]) &&
+      Object.values(value.refs).every((state) =>
+        ["intended", "uncertain", "created"].includes(stringValue(state)),
+      ) &&
+      (value.run === null ||
+        (exactKeys(value.run, ["id", "attempt"]) &&
+          Number.isSafeInteger(value.run.id) &&
+          Number(value.run.id) > 0 &&
+          Number.isSafeInteger(value.run.attempt) &&
+          Number(value.run.attempt) > 0)) &&
+      (value.phase === "observed" ? value.run !== null : value.run === null) &&
+      (value.phase !== "rejected" || value.error === "http-rejection"),
+    "Invalid retained dispatch outcome",
+  );
+}
+
+function assertRequestPath(path: string) {
+  let current = resolve(path);
+  while (true) {
+    try {
+      const info = lstatSync(current);
+      requireDispatch(!info.isSymbolicLink(), "Request path must not contain symlinks");
+      if (current === resolve(path)) {
+        requireDispatch(
+          info.isFile() && (info.mode & 0o077) === 0,
+          "Request must be a private regular file",
+        );
+      } else {
+        requireDispatch(info.isDirectory(), "Request parent must be a directory");
+      }
+    } catch (error) {
+      if (!isJsonRecord(error) || error.code !== "ENOENT") {
+        throw error;
+      }
+    }
+    const parent = dirname(current);
+    if (parent === current) {
+      break;
+    }
+    current = parent;
+  }
+}
+
+function readDispatchRecord(path: string): DispatchRecord {
+  assertRequestPath(path);
+  const bytes = readBoundedRegularFile(path, {
+    maxBytes: MAX_REQUEST_BYTES,
+    label: "Retained dispatch request",
+  });
+  const value: unknown = JSON.parse(bytes.toString("utf8"));
+  requireDispatch(
+    bytes.equals(Buffer.from(`${JSON.stringify(value)}\n`)),
+    "Retained request is not complete canonical JSON",
+  );
+  validateDispatchRecord(value);
+  return value;
+}
+
+function retainDispatchRecord(path: string, record: DispatchRecord, previous?: DispatchRecord) {
+  validateDispatchRecord(record);
+  const bytes = `${JSON.stringify(record)}\n`;
+  requireDispatch(
+    Buffer.byteLength(bytes) <= MAX_REQUEST_BYTES,
+    "Dispatch request exceeds its byte limit",
+  );
+  assertRequestPath(path);
+  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+  assertRequestPath(path);
+  const temporary = `${path}.${randomUUID()}.tmp`;
+  const descriptor = openSync(temporary, "wx", 0o600);
+  try {
+    try {
+      writeFileSync(descriptor, bytes);
+      fsyncSync(descriptor);
+    } finally {
+      closeSync(descriptor);
+    }
+    if (previous) {
+      requireDispatch(
+        isDeepStrictEqual(readDispatchRecord(path), previous),
+        "Retained request changed during dispatch",
+      );
+      renameSync(temporary, path);
+    } else {
+      // A fully written exclusive claim prevents a second caller from issuing the POST.
+      linkSync(temporary, path);
+      unlinkSync(temporary);
+    }
+    const directory = openSync(dirname(path), "r");
+    try {
+      fsyncSync(directory);
+    } finally {
+      closeSync(directory);
+    }
+  } finally {
+    rmSync(temporary, { force: true });
+  }
+}
+
+function resolveDispatchSelection(workflowSha: string, overrides: Record<string, string>) {
+  const workflow: unknown = parseYaml(
+    run("git", ["show", `${workflowSha}:${TRUSTED_WORKFLOW_PATH}`]),
+  );
+  requireDispatch(
+    isJsonRecord(workflow) &&
+      isJsonRecord(workflow.env) &&
+      workflow.env.FULL_RELEASE_DISPATCH_WITNESS_CONTRACT === "1",
+    `Tooling SHA ${workflowSha} does not support FULL_RELEASE_DISPATCH_WITNESS_CONTRACT=1; no remote refs or run were created. Keep the frozen Tooling SHA. Existing runs use frv status; a new request needs separately approved witness-capable tooling.`,
+  );
+  requireDispatch(
+    workflow.env.FULL_RELEASE_SOURCE_ADMISSION_CONTRACT === "1",
+    `Tooling SHA ${workflowSha} does not support source admission; no remote refs or run were created. Keep the frozen tooling SHA. Reopen existing requests read-only; new tooling requires separate approval.`,
+  );
+  requireDispatch(
+    isJsonRecord(workflow.on) &&
+      isJsonRecord(workflow.on.workflow_dispatch) &&
+      isJsonRecord(workflow.on.workflow_dispatch.inputs),
+    "Pinned workflow input schema is invalid",
+  );
+  const definitions = workflow.on.workflow_dispatch.inputs;
+  requireDispatch(
+    Object.keys(definitions).length <= 25,
+    "Pinned workflow exceeds 25 dispatch inputs",
+  );
+  const { validation_purpose, publication_selection_json, ...wireOverrides } = overrides;
+  const intent = normalizePublicationIntent(validation_purpose, publication_selection_json);
+  requireDispatch(
+    intent.validationPurpose !== "publish" ||
+      workflow.env.FULL_RELEASE_PUBLICATION_ADMISSION_CONTRACT === "1",
+    `Tooling SHA ${workflowSha} does not support registry admission for fresh publish requests; no remote refs or run were created. Keep the frozen tooling SHA. Reopen existing requests read-only; new tooling requires separate approval.`,
+  );
+  wireOverrides.trusted_workflow_json = publicationDispatchEnvelope(
+    JSON.parse(overrides.trusted_workflow_json || "null"),
+    intent,
+  );
+  requireDispatch(
+    Object.keys(wireOverrides).every((key) => Object.hasOwn(definitions, key)),
+    "Undeclared workflow input",
+  );
+  const inputs: DispatchInputs = {};
+  const wireInputs: Record<string, string> = {};
+  for (const [key, definition] of Object.entries(definitions)) {
+    requireDispatch(
+      /^[a-z][a-z0-9_]*$/u.test(key) && isJsonRecord(definition),
+      "Invalid workflow input definition",
+    );
+    const raw: unknown =
+      wireOverrides[key] ?? definition.default ?? (definition.type === "boolean" ? false : "");
+    const text = String(raw);
+    let value: string | number | boolean = text;
+    if (definition.type === "boolean") {
+      requireDispatch(["true", "false"].includes(text), `Input ${key} must be true or false`);
+      value = text === "true";
+    } else if (definition.type === "number") {
+      requireDispatch(
+        text.trim() !== "" && Number.isFinite(Number(text)),
+        `Input ${key} must be a number`,
+      );
+      value = Number(text);
+    } else {
+      requireDispatch(
+        ["string", "choice", "environment"].includes(stringValue(definition.type)),
+        `Unsupported input type for ${key}`,
+      );
+      if (definition.type === "choice") {
+        requireDispatch(
+          Array.isArray(definition.options) && definition.options.includes(text),
+          `Invalid choice for ${key}`,
+        );
+      }
+    }
+    inputs[key] = value;
+    wireInputs[key] = String(value);
+  }
+  decodePublicationDispatchEnvelope(inputs.trusted_workflow_json);
+  return {
+    inputs,
+    wireInputs,
+    effectiveSoak:
+      inputs.run_release_soak === true ||
+      inputs.release_profile === "stable" ||
+      inputs.release_profile === "full",
+  };
+}
+
+function parseGhHttpResponse(output: string) {
+  const match = /^HTTP\/[\d.]+ (\d{3})[^\r\n]*\r?\n([\s\S]*?)\r?\n\r?\n([\s\S]*)$/u.exec(output);
+  requireDispatch(match, "GitHub response did not include complete HTTP headers");
+  const headers = new Headers();
+  for (const line of match[2]!.split(/\r?\n/u)) {
+    if (!line) {
+      continue;
+    }
+    const separator = line.indexOf(":");
+    requireDispatch(separator > 0, "GitHub response contains malformed headers");
+    headers.append(line.slice(0, separator), line.slice(separator + 1).trim());
+  }
+  return { status: Number(match[1]), headers, body: match[3]! };
+}
+
+function readDispatchRuns(request: DispatchRequest) {
+  const runs: Record<string, unknown>[] = [];
+  let total: number | undefined;
+  for (let page = 1; page <= MAX_RUN_PAGES; page += 1) {
+    const response = parseGhHttpResponse(
+      readGhApi(`repos/${REPOSITORY}/actions/workflows/${request.workflowId}/runs`, [
+        "--include",
+        "-f",
+        `branch=${request.workflowRef}`,
+        "-f",
+        "event=workflow_dispatch",
+        "-f",
+        `per_page=${RUN_PAGE_SIZE}`,
+        "-f",
+        `page=${page}`,
+      ]),
+    );
+    requireDispatch(
+      response.status === 200,
+      "Dispatch run inventory returned a non-success response",
+    );
+    const value: unknown = JSON.parse(response.body);
+    requireDispatch(
+      isJsonRecord(value) &&
+        Array.isArray(value.workflow_runs) &&
+        Number.isSafeInteger(value.total_count) &&
+        Number(value.total_count) >= 0 &&
+        Number(value.total_count) <= RUN_PAGE_SIZE * MAX_RUN_PAGES,
+      "Dispatch run inventory is incomplete or exceeds its bound",
+    );
+    total ??= Number(value.total_count);
+    requireDispatch(
+      value.total_count === total &&
+        value.workflow_runs.length === Math.min(RUN_PAGE_SIZE, total - runs.length),
+      "Dispatch run pagination changed or is incomplete",
+    );
+    for (const item of value.workflow_runs) {
+      requireDispatch(
+        isJsonRecord(item) &&
+          Number.isSafeInteger(item.id) &&
+          Number(item.id) > 0 &&
+          !runs.some((other) => other.id === item.id),
+        "Dispatch run inventory contains invalid or repeated IDs",
+      );
+      runs.push(item);
+    }
+    const next = response.headers.get("link")?.match(/<([^>]+)>;\s*rel="next"/u)?.[1];
+    if (runs.length === total) {
+      requireDispatch(!next, "Dispatch run pagination is uncertain");
+      return runs;
+    }
+    requireDispatch(next, "Dispatch run inventory omitted its next page");
+    const url = new URL(next);
+    requireDispatch(
+      url.origin === "https://api.github.com" &&
+        url.pathname === `/repos/${REPOSITORY}/actions/workflows/${request.workflowId}/runs` &&
+        url.searchParams.get("page") === String(page + 1) &&
+        url.searchParams.get("branch") === request.workflowRef &&
+        url.searchParams.get("event") === "workflow_dispatch" &&
+        url.searchParams.get("per_page") === String(RUN_PAGE_SIZE),
+      "Dispatch run pagination changed scope",
+    );
+  }
+  throw new Error("Dispatch run inventory exceeded its page bound");
+}
+
+function assertDispatchRun(workflowRun: unknown, request: DispatchRequest, expected: DispatchRun) {
+  requireDispatch(
+    isJsonRecord(workflowRun) &&
+      workflowRun.id === expected.id &&
+      workflowRun.run_attempt === expected.attempt &&
+      workflowRun.workflow_id === request.workflowId &&
+      workflowRun.head_sha === request.workflowSha &&
+      workflowRun.head_branch === request.workflowRef &&
+      workflowRun.event === request.event &&
+      [
+        request.workflowPath,
+        `${request.workflowPath}@${request.workflowRef}`,
+        `${request.workflowPath}@refs/heads/${request.workflowRef}`,
+      ].includes(stringValue(workflowRun.path)) &&
+      isJsonRecord(workflowRun.repository) &&
+      workflowRun.repository.full_name === request.repository &&
+      isJsonRecord(workflowRun.head_repository) &&
+      workflowRun.head_repository.full_name === request.repository &&
+      workflowRun.display_title === "Full Release Validation" &&
+      workflowRun.html_url === `https://github.com/${REPOSITORY}/actions/runs/${expected.id}`,
+    "Dispatch run does not match the exact retained workflow/ref/event/attempt identity",
+  );
+}
+
+async function readDispatchWitness(request: DispatchRequest, observed: DispatchRun) {
+  const name = `full-release-dispatch-inputs-${observed.id}-${observed.attempt}`;
+  const inventory: unknown = JSON.parse(
+    readGhApi(
+      `repos/${REPOSITORY}/actions/runs/${observed.id}/artifacts`,
+      ["-f", `name=${name}`, "-f", "per_page=100"],
+      { ...GH_READ_OPTIONS, maxBuffer: MAX_REQUEST_BYTES },
+    ),
+  );
+  requireDispatch(
+    isJsonRecord(inventory) &&
+      Array.isArray(inventory.artifacts) &&
+      Number.isSafeInteger(inventory.total_count) &&
+      inventory.total_count === inventory.artifacts.length &&
+      inventory.total_count <= 100,
+    "Dispatch witness inventory is incomplete",
+  );
+  if (inventory.artifacts.length === 0) {
+    return false;
+  }
+  requireDispatch(inventory.artifacts.length === 1, "Dispatch witness is ambiguous");
+  const metadata: unknown = inventory.artifacts[0];
+  requireDispatch(
+    isJsonRecord(metadata) &&
+      typeof metadata.id === "number" &&
+      Number.isSafeInteger(metadata.id) &&
+      metadata.id > 0 &&
+      metadata.name === name &&
+      typeof metadata.size_in_bytes === "number" &&
+      Number.isSafeInteger(metadata.size_in_bytes) &&
+      metadata.size_in_bytes > 0 &&
+      metadata.size_in_bytes <= MAX_WITNESS_ARCHIVE_BYTES &&
+      typeof metadata.digest === "string" &&
+      /^sha256:[a-f0-9]{64}$/u.test(metadata.digest) &&
+      metadata.expired === false &&
+      typeof metadata.expires_at === "string" &&
+      Date.parse(metadata.expires_at) > Date.now() &&
+      isJsonRecord(metadata.workflow_run) &&
+      metadata.workflow_run.id === observed.id &&
+      metadata.workflow_run.head_sha === request.workflowSha,
+    "Dispatch witness metadata does not match its exact run",
+  );
+  const artifactEndpoint = `repos/${REPOSITORY}/actions/artifacts/${metadata.id}`;
+  const exactMetadata: unknown = JSON.parse(
+    readGhApi(artifactEndpoint, [], { ...GH_READ_OPTIONS, maxBuffer: MAX_REQUEST_BYTES }),
+  );
+  requireDispatch(
+    isJsonRecord(exactMetadata) &&
+      exactMetadata.id === metadata.id &&
+      exactMetadata.name === name &&
+      exactMetadata.size_in_bytes === metadata.size_in_bytes &&
+      exactMetadata.digest === metadata.digest &&
+      exactMetadata.expired === false &&
+      exactMetadata.expires_at === metadata.expires_at &&
+      Date.parse(metadata.expires_at) > Date.now() &&
+      isJsonRecord(exactMetadata.workflow_run) &&
+      exactMetadata.workflow_run.id === observed.id &&
+      exactMetadata.workflow_run.head_sha === request.workflowSha,
+    "Dispatch witness metadata changed from its exact artifact tuple",
+  );
+  // Keep credentials and redirects owned by the selected CLI; ZIP bytes must not be decoded.
+  const archiveArgs = [
+    "api",
+    "--method",
+    "GET",
+    `${artifactEndpoint}/zip`,
+    "--hostname",
+    "github.com",
+    "-H",
+    GH_NO_CACHE_HEADER,
+  ];
+  const archiveOptions = {
+    ...GH_READ_OPTIONS,
+    encoding: null,
+    maxBuffer: MAX_WITNESS_ARCHIVE_BYTES,
+    stdio: ["ignore", "pipe", "pipe"],
+  } satisfies ExecFileSyncOptionsWithBufferEncoding;
+  let archiveBytes: Uint8Array<ArrayBuffer>;
+  try {
+    archiveBytes = execPlainGh([...archiveArgs, "--allow-escape-sequences"], archiveOptions);
+  } catch (error) {
+    if (!isUnsupportedAllowEscapeSequencesFlag(error)) {
+      throw error;
+    }
+    archiveBytes = execPlainGh(archiveArgs, archiveOptions);
+  }
+  requireDispatch(
+    archiveBytes.byteLength === metadata.size_in_bytes &&
+      `sha256:${createHash("sha256").update(archiveBytes).digest("hex")}` === metadata.digest,
+    "Dispatch witness archive does not match its exact size and digest",
+  );
+  const files = inspectActionsArtifactZipWithPolicy(archiveBytes, {
+    expectedEntries: [WITNESS_FILE],
+    maxArchiveBytes: MAX_WITNESS_ARCHIVE_BYTES,
+    maxCompressedEntryBytes: () => MAX_WITNESS_ARCHIVE_BYTES,
+    maxEntryBytes: () => MAX_REQUEST_BYTES,
+    maxExpandedBytes: MAX_REQUEST_BYTES,
+  });
+  const witness: unknown = JSON.parse(files.get(WITNESS_FILE).toString("utf8"));
+  requireDispatch(
+    isDeepStrictEqual(witness, {
+      kind: WITNESS_KIND,
+      serverUrl: "https://github.com",
+      repository: REPOSITORY,
+      workflowRef: `${REPOSITORY}/${request.workflowPath}@refs/heads/${request.workflowRef}`,
+      event: request.event,
+      ref: `refs/heads/${request.workflowRef}`,
+      sha: request.workflowSha,
+      runId: String(observed.id),
+      runAttempt: String(observed.attempt),
+      inputsDigest: dispatchInputsDigest(request.wireInputs),
+    }),
+    "Dispatch input witness does not match the complete retained request",
+  );
+  return true;
+}
+
+async function reconcileDispatch(record: DispatchRecord): Promise<DispatchRun> {
+  requireDispatch(
+    record.phase !== "prepared",
+    "No attempted workflow POST was retained; dispatch remains unknown",
+  );
+  requireDispatch(
+    record.phase !== "rejected",
+    "dispatch=rejected: GitHub rejected the retained request",
+  );
+  const request = record.request;
+  for (let attempt = 0; attempt <= FULL_RELEASE_RUN_DISCOVERY_DELAYS_MS.length; attempt += 1) {
+    const runs = readDispatchRuns(request);
+    if (runs.length > 0) {
+      requireDispatch(
+        runs.length === 1,
+        "Multiple dispatch runs exist for the retained transport; adoption is ambiguous",
+      );
+      const observed = record.run ?? { id: Number(runs[0]!.id), attempt: 1 };
+      assertDispatchRun(runs[0], request, observed);
+      assertDispatchRun(
+        JSON.parse(readGhApi(`repos/${REPOSITORY}/actions/runs/${observed.id}`)),
+        request,
+        observed,
+      );
+      if (await readDispatchWitness(request, observed)) {
+        // Recheck both identity and inventory after the archive read, which can span a rerun.
+        assertDispatchRun(
+          JSON.parse(readGhApi(`repos/${REPOSITORY}/actions/runs/${observed.id}`)),
+          request,
+          observed,
+        );
+        const after = readDispatchRuns(request);
+        requireDispatch(after.length === 1, "Dispatch run inventory changed during reconciliation");
+        assertDispatchRun(after[0], request, observed);
+        return observed;
+      }
+    }
+    if (attempt < FULL_RELEASE_RUN_DISCOVERY_DELAYS_MS.length) {
+      Atomics.wait(
+        new Int32Array(new SharedArrayBuffer(4)),
+        0,
+        0,
+        FULL_RELEASE_RUN_DISCOVERY_DELAYS_MS[attempt],
+      );
+    }
+  }
+  throw new Error("Could not determine Full Release Validation run id: discovery exhausted");
+}
+
+async function reopenDispatch(path: string, args: ReturnType<typeof parseArgs>, argv: string[]) {
+  const record = readDispatchRecord(path);
+  const request = record.request;
+  let retainedInputs = request.wireInputs;
+  let retainedIntent: ReturnType<typeof publicationIntentInputs> | undefined;
+  const rawIdentity = request.wireInputs.trusted_workflow_json;
+  if (rawIdentity && Object.hasOwn(JSON.parse(rawIdentity), "trustedWorkflow")) {
+    retainedIntent = publicationIntentInputs(decodePublicationDispatchEnvelope(rawIdentity));
+    retainedInputs = {
+      ...retainedInputs,
+      validation_purpose: retainedIntent.validationPurpose,
+      publication_selection_json: retainedIntent.publicationSelectionJson,
+    };
+  }
+  requireDispatch(
+    (!args.sha || args.sha === request.targetSha) &&
+      (!args.workflowSha || args.workflowSha === request.workflowSha) &&
+      (!args.targetRef || args.targetRef === request.targetContextRef) &&
+      (!argv.includes("--trusted-workflow-ref") ||
+        args.trustedWorkflowRef === request.trustedWorkflowRef) &&
+      args.specifiedInputs.every((key) =>
+        key === "publication_selection_json" && retainedIntent
+          ? publicationIntentInputs(
+              normalizePublicationIntent(retainedIntent.validationPurpose, args.inputs[key]),
+            ).publicationSelectionJson === retainedIntent.publicationSelectionJson
+          : args.inputs[key] === retainedInputs[key],
+      ),
+    "Reopen arguments conflict with the retained request",
+  );
+  try {
+    const observed = await reconcileDispatch(record);
+    console.log(
+      `dispatch=observed: https://github.com/${REPOSITORY}/actions/runs/${observed.id} attempt=${observed.attempt}`,
+    );
+  } catch (error) {
+    console.error(
+      `dispatch=${record.phase === "rejected" ? "rejected" : "unknown"} error=${record.error}`,
+    );
+    console.error(
+      `Retained refs: refs/heads/${request.workflowRef} and refs/heads/${request.targetRef}`,
+    );
+    throw error;
+  }
+}
+
+function readWorkflowRun(parentRunId: string, workflowSha: string) {
+  if (!/^[1-9][0-9]*$/u.test(parentRunId)) {
+    throw new Error("parent run ID must be a positive decimal");
+  }
+  const workflowRun: unknown = JSON.parse(
+    readGhApi(`repos/${REPOSITORY}/actions/runs/${parentRunId}`, [], GH_READ_OPTIONS),
+  );
+  if (!isJsonRecord(workflowRun)) {
+    throw new Error(`Full Release Validation run ${parentRunId} returned an invalid response`);
+  }
+  if (workflowRun.head_sha !== workflowSha) {
+    throw new Error(
+      `Full Release Validation run ${parentRunId} head ${displayValue(workflowRun.head_sha)} does not match trusted workflow SHA ${workflowSha}`,
+    );
+  }
+  return workflowRun;
+}
+
+function readActiveParentJobs(parentRunId: string) {
+  const response: unknown = JSON.parse(
+    readGhApi(
+      `repos/${REPOSITORY}/actions/runs/${parentRunId}/jobs`,
+      ["-f", "per_page=100"],
+      GH_READ_OPTIONS,
+    ),
+  );
+  if (!isJsonRecord(response) || !Array.isArray(response.jobs)) {
+    throw new Error(`Full Release Validation run ${parentRunId} returned invalid jobs`);
+  }
+  return response.jobs
+    .filter((job) => isJsonRecord(job) && job.status !== "completed")
+    .map((job) => ({
+      name: isJsonRecord(job) ? stringValue(job.name, "<unnamed>") : "<unnamed>",
+      status: isJsonRecord(job) ? stringValue(job.status, "pending") : "pending",
+      url: isJsonRecord(job) ? stringValue(job.html_url) : "",
+    }));
+}
+
+export function validateReleaseDecisionPayload(
+  payload: unknown,
+  expected: {
+    parentRunAttempt: number;
+    parentRunId: string;
+    workflowSha: string;
+  },
+) {
+  return validateReleaseStateArtifact(
+    payload,
+    {
+      parentRunAttempt: expected.parentRunAttempt,
+      parentRunId: expected.parentRunId,
+      workflowSha: expected.workflowSha,
+    },
+    "decision",
+  );
+}
+
+export function releaseDecisionStopsForeground(state: unknown) {
+  return [
+    "blocked_diagnostics_running",
+    "blocked_complete",
+    "orchestration_error",
+    "cancelled_with_children",
+  ].includes(stringValue(state));
+}
+
+export function tryReadReleaseDecision(
+  parentRunId: string,
+  parentRunAttempt: number,
+  workflowSha: string,
+  runStatusImpl: (command: string, args: string[], options?: CommandOptions) => CommandStatus = (
+    _command,
+    args,
+    options,
+  ) => runGhStatus(args, options),
+) {
+  const artifactName = `full-release-decision-${parentRunId}-${parentRunAttempt}`;
+  const downloadDir = mkdtempSync(join(tmpdir(), "openclaw-release-decision-"));
+  try {
+    const result = runStatusImpl(
+      "gh",
+      [
+        "run",
+        "download",
+        parentRunId,
+        "--repo",
+        REPOSITORY,
+        "--name",
+        artifactName,
+        "--dir",
+        downloadDir,
+      ],
+      { stdio: ["ignore", "ignore", "pipe"], timeoutMs: GH_READ_TIMEOUT_MS },
+    );
+    if (result.status !== 0) {
+      const stderr = stringValue(result.stderr);
+      if (isReleaseGhArtifactMissingError({ cause: result.error, stderr })) {
+        return undefined;
+      }
+      const downloadError = Object.assign(
+        result.error instanceof Error
+          ? result.error
+          : new Error(
+              `Release Decision artifact download failed${
+                stderr.trim() ? `: ${stderr.trim().slice(0, 500)}` : ""
+              }`,
+            ),
+        {
+          signal: result.signal,
+          status: result.status,
+          stderr,
+        },
+      );
+      if (classifyReleaseGhTransportError(downloadError) === "transient") {
+        console.warn(
+          `Release Decision artifact unavailable this poll; retrying: ${downloadError.message}`,
+        );
+        return undefined;
+      }
+      throw new Error(
+        `Release Decision artifact download failed${
+          stderr.trim() ? `: ${stderr.trim().slice(0, 500)}` : ""
+        }`,
+        { cause: downloadError },
+      );
+    }
+    const decisionPath = join(downloadDir, RELEASE_DECISION_FILE);
+    if (!existsSync(decisionPath)) {
+      throw new Error(
+        `Release Decision artifact ${artifactName} omitted ${RELEASE_DECISION_FILE}.`,
+      );
+    }
+    if (statSync(decisionPath).size > MAX_RELEASE_ARTIFACT_BYTES) {
+      throw new Error(`Release Decision artifact ${artifactName} exceeds the size limit.`);
+    }
+    return validateReleaseDecisionPayload(JSON.parse(readFileSync(decisionPath, "utf8")), {
+      parentRunAttempt,
+      parentRunId,
+      workflowSha,
+    });
+  } finally {
+    rmSync(downloadDir, { force: true, recursive: true });
+  }
+}
+
+function releaseDecisionAvailable(parentRunId: string, parentRunAttempt: number) {
+  const artifactName = `full-release-decision-${parentRunId}-${parentRunAttempt}`;
+  try {
+    const response: unknown = JSON.parse(
+      readGhApi(
+        `repos/${REPOSITORY}/actions/runs/${parentRunId}/artifacts`,
+        ["-f", "per_page=100", "-f", `name=${artifactName}`],
+        { ...GH_READ_OPTIONS, stdio: ["ignore", "pipe", "pipe"] },
+      ),
+    );
+    if (!isJsonRecord(response) || !Array.isArray(response.artifacts)) {
+      throw new Error(`Full Release Validation run ${parentRunId} returned invalid artifacts`);
+    }
+    return response.artifacts.some(
+      (artifact) =>
+        isJsonRecord(artifact) && artifact.name === artifactName && artifact.expired === false,
+    );
+  } catch (error) {
+    if (classifyReleaseGhTransportError(error) !== "transient") {
+      throw error;
+    }
+    console.warn(`Release Decision metadata unavailable this poll; retrying: ${String(error)}`);
+    return false;
+  }
+}
+
+function waitForWorkflowRun(parentRunId: string, workflowSha: string, record?: DispatchRecord) {
+  let lastSummary = "";
+  let consecutiveErrors = 0;
+  const startedAt = Date.now();
+  const deadline = startedAt + FULL_RELEASE_WAIT_TIMEOUT_MINUTES * 60_000;
+  let nextProgressAt = startedAt + FULL_RELEASE_PROGRESS_INTERVAL_MS;
+  let decision: { attempt: number; state: "unavailable" | "ready" | "passed" } | undefined;
+  while (Date.now() < deadline) {
+    let suite: Record<string, unknown> | undefined;
+    try {
+      suite = readWorkflowRun(parentRunId, workflowSha);
+      consecutiveErrors = 0;
+    } catch (error) {
+      consecutiveErrors += 1;
+      if (consecutiveErrors >= 3) {
+        throw error;
+      }
+      const message = error instanceof Error ? error.message : String(error);
+      console.warn(`Parent run status query failed; retrying: ${message}`);
+    }
+
+    const status = stringValue(suite?.status, "pending").toLowerCase();
+    const conclusion = stringValue(suite?.conclusion, "pending").toLowerCase();
+    const summary = `${status}/${conclusion}`;
+    if (summary !== lastSummary) {
+      console.log(`Parent run status: ${summary}`);
+      lastSummary = summary;
+    }
+    if (suite) {
+      if (record?.run) {
+        assertDispatchRun(suite, record.request, record.run);
+      }
+      const attempt = requiredPositiveInteger(suite.run_attempt, "parent run attempt");
+      if (decision?.attempt !== attempt) {
+        decision = { attempt, state: "unavailable" };
+      }
+      // Metadata is only a readiness hint. Once advertised, keep trying the
+      // authoritative download across status regressions until this attempt validates.
+      if (
+        decision.state === "unavailable" &&
+        (suite.status === "completed" || releaseDecisionAvailable(parentRunId, attempt))
+      ) {
+        decision.state = "ready";
+      }
+      if (decision.state === "ready") {
+        const releaseDecision = tryReadReleaseDecision(parentRunId, attempt, workflowSha);
+        if (releaseDecision && releaseDecisionStopsForeground(releaseDecision.state)) {
+          throw new Error(
+            `${formatReleaseStateOutcome(releaseDecision)}\nhttps://github.com/openclaw/openclaw/actions/runs/${parentRunId}`,
+          );
+        }
+        // The workflow uploads one immutable decision per attempt; final success
+        // still requires the parent's terminal conclusion and strict evidence verifier.
+        if (releaseDecision?.state === "passed") {
+          decision.state = "passed";
+        }
+      }
+    }
+    if (suite?.status === "completed" && stringValue(suite.conclusion)) {
+      if (suite.conclusion === "success") {
+        return suite;
+      }
+      throw new Error(
+        `Full Release Validation concluded ${stringValue(suite.conclusion, "unknown").toLowerCase()}: https://github.com/openclaw/openclaw/actions/runs/${parentRunId}`,
+      );
+    }
+    const now = Date.now();
+    if (now >= nextProgressAt) {
+      const elapsedMinutes = Math.floor((now - startedAt) / 60_000);
+      try {
+        const activeJobs = readActiveParentJobs(parentRunId);
+        console.log(
+          `Parent run progress after ${elapsedMinutes}m: ${activeJobs.length} active job(s)`,
+        );
+        for (const job of activeJobs) {
+          console.log(`- ${job.name}: ${job.status}${job.url ? ` ${job.url}` : ""}`);
+        }
+      } catch (error) {
+        console.warn(
+          `Parent run progress query failed: ${error instanceof Error ? error.message : String(error)}`,
+        );
+      }
+      nextProgressAt = now + FULL_RELEASE_PROGRESS_INTERVAL_MS;
+    }
+    const remainingMs = deadline - Date.now();
+    if (remainingMs <= 0) {
+      break;
+    }
+    Atomics.wait(
+      new Int32Array(new SharedArrayBuffer(4)),
+      0,
+      0,
+      Math.min(FULL_RELEASE_GITHUB_POLL_INTERVAL_MS, remainingMs),
+    );
+  }
+  throw new Error(
+    `Timed out after ${FULL_RELEASE_WAIT_TIMEOUT_MINUTES} minutes waiting for Full Release Validation: https://github.com/openclaw/openclaw/actions/runs/${parentRunId}`,
+  );
+}
+
+export function releaseEvidenceVerificationArgs(
+  parentRunId: unknown,
+  verifierSourceSha: string,
+  verifierSourceFile: string,
+  trustedWorkflowRef = "main",
+) {
+  if (!/^[1-9][0-9]*$/u.test(String(parentRunId))) {
+    throw new Error("parent run ID must be a positive decimal");
+  }
+  const trustedWorkflowFullRef =
+    trustedWorkflowRef === "main"
+      ? "refs/heads/main"
+      : TRUSTED_WORKFLOW_TAG_PATTERN.test(trustedWorkflowRef)
+        ? `refs/tags/${trustedWorkflowRef}`
+        : "";
+  if (!trustedWorkflowFullRef) {
+    throw new Error("trusted workflow ref must be main or a protected release-publish tag");
+  }
+  return [
+    "--validate-run",
+    String(parentRunId),
+    "--trusted-workflow-ref",
+    trustedWorkflowRef,
+    "--trusted-workflow-full-ref",
+    trustedWorkflowFullRef,
+    "--trusted-workflow-sha",
+    verifierSourceSha,
+    "--json",
+    "--verifier-source-sha",
+    verifierSourceSha,
+    "--verifier-source-file",
+    verifierSourceFile,
+  ];
+}
+
+export function shouldDeleteTemporaryWorkflowRef(params: TemporaryRefParams) {
+  return (
+    !params.keepBranch &&
+    (params.dryRun || (params.parentConclusion === "success" && params.evidenceVerified))
+  );
+}
+
+export function assertTrustedWorkflowHarness(
+  workflowSha: string,
+  pathExists: (relativePath: string) => boolean = (relativePath) =>
+    runStatus("git", ["cat-file", "-e", `${workflowSha}:${relativePath}`], {
+      stdio: ["ignore", "ignore", "ignore"],
+    }).status === 0,
+  readPath: (relativePath: string) => string = (relativePath) =>
+    run("git", ["show", `${workflowSha}:${relativePath}`]),
+): TrustedWorkflowHarness {
+  if (!pathExists(TRUSTED_WORKFLOW_PATH)) {
+    throw new Error(
+      `trusted workflow SHA ${workflowSha} does not contain ${TRUSTED_WORKFLOW_PATH}`,
+    );
+  }
+  let workflow: unknown;
+  try {
+    workflow = parseYaml(readPath(TRUSTED_WORKFLOW_PATH));
+  } catch (error) {
+    throw new Error(
+      `Tooling SHA ${workflowSha} contains invalid ${TRUSTED_WORKFLOW_PATH}: ${error instanceof Error ? error.message : String(error)}`,
+      { cause: error },
+    );
+  }
+  const contract =
+    isJsonRecord(workflow) && isJsonRecord(workflow.env)
+      ? workflow.env[RELEASE_ISOLATION_TOOLING_CONTRACT_ENV]
+      : undefined;
+  if (contract !== "1" && contract !== RELEASE_ISOLATION_TOOLING_CONTRACT) {
+    throw new Error(
+      `Tooling SHA ${workflowSha} does not declare a supported ${RELEASE_ISOLATION_TOOLING_CONTRACT_ENV} in ${TRUSTED_WORKFLOW_PATH}`,
+    );
+  }
+  const workflowInputs =
+    isJsonRecord(workflow) &&
+    isJsonRecord(workflow.on) &&
+    isJsonRecord(workflow.on.workflow_dispatch) &&
+    isJsonRecord(workflow.on.workflow_dispatch.inputs)
+      ? workflow.on.workflow_dispatch.inputs
+      : undefined;
+  if (!workflowInputs || !Object.hasOwn(workflowInputs, "expected_sha")) {
+    throw new Error(
+      `Tooling SHA ${workflowSha} is missing workflow_dispatch input expected_sha in ${TRUSTED_WORKFLOW_PATH}`,
+    );
+  }
+  if (
+    contract === RELEASE_ISOLATION_TOOLING_CONTRACT &&
+    !Object.hasOwn(workflowInputs, "trusted_workflow_json")
+  ) {
+    throw new Error(
+      `Tooling SHA ${workflowSha} declares ${RELEASE_ISOLATION_TOOLING_CONTRACT_ENV}=2 but is missing workflow_dispatch input trusted_workflow_json in ${TRUSTED_WORKFLOW_PATH}`,
+    );
+  }
+  const verifierPath = RELEASE_EVIDENCE_VERIFIER_PATHS.find((relativePath) =>
+    pathExists(relativePath),
+  );
+  if (!verifierPath) {
+    throw new Error(
+      `trusted workflow SHA ${workflowSha} does not contain a supported release evidence verifier`,
+    );
+  }
+  return { contract, verifierPath };
+}
+
+export function releaseEvidenceVerifierPath(worktreeRoot: string) {
+  const candidates = RELEASE_EVIDENCE_VERIFIER_PATHS.map((relativePath) =>
+    join(worktreeRoot, relativePath),
+  );
+  const verifier = candidates.find((candidate) => existsSync(candidate));
+  if (!verifier) {
+    throw new Error("trusted workflow checkout does not contain a release evidence verifier");
+  }
+  return verifier;
+}
+
+function verifyReleaseEvidence(
+  parentRunId: string,
+  workflowSha: string,
+  trustedWorkflowRef: string,
+) {
+  const verifierWorktree = mkdtempSync(join(tmpdir(), "openclaw-release-verifier-"));
+  try {
+    run("git", ["worktree", "add", "--detach", verifierWorktree, workflowSha], {
+      stdio: ["ignore", "ignore", "inherit"],
+    });
+    const verifier = releaseEvidenceVerifierPath(verifierWorktree);
+    const evidence: unknown = JSON.parse(
+      run(process.execPath, [
+        verifier,
+        ...releaseEvidenceVerificationArgs(parentRunId, workflowSha, verifier, trustedWorkflowRef),
+      ]),
+    );
+    if (
+      !isJsonRecord(evidence) ||
+      evidence.valid !== true ||
+      !isJsonRecord(evidence.current) ||
+      !isJsonRecord(evidence.root)
+    ) {
+      throw new Error(`Full Release Validation evidence is invalid for run ${parentRunId}.`);
+    }
+    console.log(
+      `ok release evidence current=${displayValue(evidence.current.runId)} root=${displayValue(evidence.root.runId)} reused=${Boolean(evidence.evidenceReuse)}`,
+    );
+  } finally {
+    runStatus("git", ["worktree", "remove", "--force", verifierWorktree], {
+      stdio: ["ignore", "ignore", "ignore"],
+    });
+    rmSync(verifierWorktree, { force: true, recursive: true });
+  }
+}
+
+async function main() {
+  const argv = process.argv.slice(2);
+  const args = parseArgs(argv);
+  const reopenPath = args.reconcileRequest || args.requestFile;
+  if (reopenPath) {
+    assertRequestPath(reopenPath);
+    if (args.reconcileRequest || existsSync(reopenPath)) {
+      await reopenDispatch(reopenPath, args, argv);
+      return;
+    }
+  }
+  const targetSha = resolveTargetSha(args.sha, args.targetRef);
+  const targetVersion = targetVersionForTarget(targetSha);
+  args.inputs.release_profile ??= releaseProfileForVersion(targetVersion);
+  args.inputs.allow_unreleased_changelog ??= args.targetRef ? "false" : "true";
+  const targetContextRef = verifyTargetRef(args.targetRef, targetSha, targetVersion);
+  const workflowSha = resolveTrustedWorkflowSha(args.workflowSha, args.trustedWorkflowRef);
+  const trustedWorkflowHarness = assertTrustedWorkflowHarness(workflowSha);
+  // Read target blobs with trusted tooling before creating remote transport refs.
+  validatePackageSourceRef(targetSha, {
+    allowUnreleasedChangelog: args.inputs.allow_unreleased_changelog === "true",
+  });
+  if (trustedWorkflowHarness.contract === "1") {
+    args.inputs.reuse_evidence = "false";
+  }
+  const shortSha = workflowSha.slice(0, 12);
+  const branch = `release-ci/${shortSha}-${Date.now()}`;
+  const remoteBranchRef = `refs/heads/${branch}`;
+  const targetBranch = `validation/target-${targetSha.slice(0, 12)}-${Date.now()}`;
+  const remoteTargetBranchRef = `refs/heads/${targetBranch}`;
+  const dispatchInputs = {
+    ref: targetSha,
+    expected_sha: targetSha,
+    ...(trustedWorkflowHarness.contract === RELEASE_ISOLATION_TOOLING_CONTRACT
+      ? {
+          trusted_workflow_json: JSON.stringify({
+            fullRef:
+              args.trustedWorkflowRef === "main"
+                ? "refs/heads/main"
+                : `refs/tags/${args.trustedWorkflowRef}`,
+            ref: args.trustedWorkflowRef,
+            sha: workflowSha,
+          }),
+        }
+      : {}),
+    ...(targetContextRef !== targetSha ? { target_context_ref: targetContextRef } : {}),
+    ...args.inputs,
+  };
+  const selection = resolveDispatchSelection(workflowSha, dispatchInputs);
+  const requestId = randomUUID();
+  const requestPath = resolve(
+    args.requestFile || join(".artifacts", "full-release-validation", `${requestId}.json`),
+  );
+  let record: DispatchRecord | undefined;
+  if (!args.dryRun) {
+    const workflow: unknown = JSON.parse(
+      readGhApi(`repos/${REPOSITORY}/actions/workflows/${WORKFLOW}`),
+    );
+    requireDispatch(
+      isJsonRecord(workflow) &&
+        workflow.path === TRUSTED_WORKFLOW_PATH &&
+        Number.isSafeInteger(workflow.id) &&
+        Number(workflow.id) > 0,
+      "Workflow metadata does not match the pinned workflow path",
+    );
+    record = {
+      kind: REQUEST_KIND,
+      request: {
+        id: requestId,
+        host: "github.com",
+        repository: REPOSITORY,
+        workflowId: Number(workflow.id),
+        workflowPath: TRUSTED_WORKFLOW_PATH,
+        event: "workflow_dispatch",
+        workflowSha,
+        trustedWorkflowRef: args.trustedWorkflowRef,
+        targetSha,
+        targetVersion,
+        targetContextRef,
+        workflowRef: branch,
+        targetRef: targetBranch,
+        ...selection,
+      },
+      phase: "prepared",
+      refs: { target: "intended", workflow: "intended" },
+      error: "none",
+      run: null,
+    };
+    retainDispatchRecord(requestPath, record);
+  }
+
+  console.log(`Request artifact: ${requestPath}${args.dryRun ? " (dry run; not written)" : ""}`);
+  console.log(`Validation SHA: ${targetSha}`);
+  console.log(`Tooling SHA: ${workflowSha}`);
+  console.log(`Trusted workflow ref: ${args.trustedWorkflowRef}`);
+  console.log(
+    `Frozen validation tuple: candidate=${targetSha} tooling=${workflowSha} rerun_group=${args.inputs.rerun_group}`,
+  );
+  console.log(`Temporary target ref: ${targetBranch}`);
+  console.log(`Temporary workflow ref: ${branch}`);
+
+  let parentRunId: string | undefined;
+  let parentConclusion = "";
+  let evidenceVerified = false;
+  let targetRefCreated = false;
+  let workflowRefCreated = false;
+  let dispatchAttempted = false;
+  let operationError: Error | undefined;
+  const retain = (next: DispatchRecord) => {
+    retainDispatchRecord(requestPath, next, record);
+    record = next;
+  };
+  try {
+    let payloadDirectory: string | undefined;
+    let dispatchOutput = "";
+    let dispatchError: unknown;
+    try {
+      let payloadPath = "";
+      if (!args.dryRun) {
+        const payload = JSON.stringify({ ref: branch, inputs: selection.wireInputs });
+        requireDispatch(
+          Buffer.byteLength(payload) <= MAX_REQUEST_BYTES,
+          "Dispatch payload exceeds its byte limit",
+        );
+        payloadDirectory = mkdtempSync(join(tmpdir(), "openclaw-release-dispatch-payload-"));
+        payloadPath = join(payloadDirectory, "dispatch.json");
+        writeFileSync(payloadPath, payload, { flag: "wx", mode: 0o600 });
+      }
+      if (record) {
+        retain({ ...record, refs: { ...record.refs, target: "uncertain" } });
+      }
+      createTemporaryRef(remoteTargetBranchRef, targetSha, args.dryRun);
+      targetRefCreated = true;
+      if (record) {
+        retain({ ...record, refs: { ...record.refs, target: "created", workflow: "uncertain" } });
+      }
+      createTemporaryRef(remoteBranchRef, workflowSha, args.dryRun);
+      workflowRefCreated = true;
+      if (record) {
+        retain({ ...record, phase: "attempted", refs: { target: "created", workflow: "created" } });
+      }
+      const dispatchArgs = [
+        "api",
+        "--include",
+        "--method",
+        "POST",
+        `repos/${REPOSITORY}/actions/workflows/${WORKFLOW}/dispatches`,
+        "--hostname",
+        "github.com",
+        "--input",
+        payloadPath,
+      ];
+
+      // Once dispatch starts, the refs may be needed for GitHub reruns even when
+      // the client loses the response. Cleanup resumes only after verified success.
+      dispatchAttempted = true;
+      try {
+        if (args.dryRun) {
+          console.log(
+            `+ gh api --method POST repos/${REPOSITORY}/actions/workflows/${WORKFLOW}/dispatches (input values omitted)`,
+          );
+        } else {
+          dispatchOutput = runGh(dispatchArgs, { stdio: ["ignore", "pipe", "pipe"] });
+        }
+      } catch (error) {
+        dispatchError = error;
+        dispatchOutput =
+          error instanceof Error && "stdout" in error ? stringValue(error.stdout) : "";
+      }
+    } finally {
+      if (payloadDirectory) {
+        try {
+          rmSync(payloadDirectory, { recursive: true, force: true });
+        } catch {
+          // A local cleanup failure must not change the observed POST outcome.
+          console.warn(
+            `Could not remove dispatch payload directory: ${JSON.stringify(payloadDirectory)}`,
+          );
+        }
+      }
+    }
+    if (record) {
+      let responseStatus = 0;
+      try {
+        responseStatus = parseGhHttpResponse(dispatchOutput).status;
+      } catch {
+        // A missing or partial response is not evidence that GitHub rejected the POST.
+      }
+      if ([400, 401, 403, 404, 422].includes(responseStatus)) {
+        retain({ ...record, phase: "rejected", error: "http-rejection" });
+        throw new Error(`dispatch=rejected: GitHub returned HTTP ${responseStatus}`);
+      }
+      if (dispatchError || responseStatus !== 204) {
+        retain({
+          ...record,
+          error:
+            classifyReleaseGhTransportError(dispatchError) === "transient"
+              ? "transport"
+              : "unclassified",
+        });
+      }
+      const observed = await reconcileDispatch(record);
+      retain({ ...record, phase: "observed", run: observed });
+      parentRunId = String(observed.id);
+      console.log(`dispatch=observed: attempt=${observed.attempt}`);
+    }
+    if (parentRunId) {
+      console.log(`Parent run: https://github.com/openclaw/openclaw/actions/runs/${parentRunId}`);
+      const completedRun = waitForWorkflowRun(parentRunId, workflowSha, record);
+      parentConclusion = stringValue(completedRun.conclusion);
+      if (parentConclusion !== "success") {
+        throw new Error(
+          `Full Release Validation concluded ${parentConclusion.toLowerCase() || "without a conclusion"}: https://github.com/openclaw/openclaw/actions/runs/${parentRunId}`,
+        );
+      }
+      verifyReleaseEvidence(parentRunId, workflowSha, args.trustedWorkflowRef);
+      evidenceVerified = true;
+    }
+  } catch (error) {
+    operationError = error instanceof Error ? error : new Error(String(error));
+    if (record) {
+      console.error(
+        `dispatch=${record.phase === "rejected" ? "rejected" : record.phase === "observed" ? "observed" : "unknown"} error=${record.error}`,
+      );
+      console.error(`Retained refs: ${remoteBranchRef} and ${remoteTargetBranchRef}`);
+      console.error(
+        `node scripts/full-release-validation-at-sha.mjs --reconcile-request ${JSON.stringify(requestPath)}`,
+      );
+    }
+  }
+
+  const createdRefs = [
+    ...(workflowRefCreated ? [remoteBranchRef] : []),
+    ...(targetRefCreated ? [remoteTargetBranchRef] : []),
+  ];
+  const cleanupBeforeDispatch =
+    !dispatchAttempted &&
+    createdRefs.length > 0 &&
+    !Object.values(record?.refs ?? {}).includes("uncertain");
+  const cleanupAfterSuccess = shouldDeleteTemporaryWorkflowRef({
+    keepBranch: args.keepBranch,
+    dryRun: args.dryRun,
+    parentConclusion,
+    evidenceVerified,
+  });
+  let cleanupError: Error | undefined;
+  if (cleanupBeforeDispatch || cleanupAfterSuccess) {
+    try {
+      deleteTemporaryRefs(createdRefs, args.dryRun);
+    } catch (error) {
+      cleanupError = error instanceof Error ? error : new Error(String(error));
+    }
+  } else if (createdRefs.length > 0) {
+    const keptRefs = createdRefs.join(" and ");
+    console.warn(
+      args.keepBranch
+        ? `Kept ${keptRefs}`
+        : `Kept ${keptRefs}: ${
+            parentConclusion === "success"
+              ? "release evidence was not verified"
+              : `parent concluded ${parentConclusion || "without a conclusion"}`
+          }. Keep it through GitHub reruns or evidence diagnosis; delete it after verified success.`,
+    );
+  }
+
+  if (operationError && cleanupError) {
+    throw new Error(
+      `${commandFailureMessage(operationError)}; temporary ref cleanup also failed: ${commandFailureMessage(cleanupError)}`,
+      { cause: new AggregateError([operationError, cleanupError]) },
+    );
+  }
+  if (operationError) {
+    throw operationError;
+  }
+  if (cleanupError) {
+    throw cleanupError;
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  try {
+    await main();
+  } catch (error) {
+    console.error(
+      `[full-release-validation] FAILED: ${error instanceof Error ? error.message : String(error)}`,
+    );
+    console.error("[full-release-validation] FAILED (exit 1)");
+    process.exitCode = 1;
+  }
+}
diff --git a/scripts/generate-base-config-schema.ts b/scripts/generate-base-config-schema.ts
new file mode 100644
index 0000000000000000000000000000000000000000..c4a81dba93103c892f5e75b2f6a107551077156b
--- /dev/null
+++ b/scripts/generate-base-config-schema.ts
@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+// Generate Base Config Schema script supports OpenClaw repository automation.
+import { pathToFileURL } from "node:url";
+import { computeBaseConfigSchemaResponse } from "../src/config/schema-base.js";
+
+function checkBaseConfigSchema(): void {
+  computeBaseConfigSchemaResponse({
+    generatedAt: "2026-05-05T00:00:00.000Z",
+  });
+}
+
+const args = new Set(process.argv.slice(2));
+if (args.has("--check") && args.has("--write")) {
+  throw new Error("Use either --check or --write, not both.");
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+  checkBaseConfigSchema();
+  if (args.has("--write")) {
+    console.log("[base-config-schema] runtime-computed; no generated file to write");
+  } else {
+    console.log("[base-config-schema] ok");
+  }
+}
diff --git a/scripts/generate-ci-git-owner.mts b/scripts/generate-ci-git-owner.mts
new file mode 100644
index 0000000000000000000000000000000000000000..5f986a5fce775fec98bd060805fb31f8b4685fd6
--- /dev/null
+++ b/scripts/generate-ci-git-owner.mts
@@ -0,0 +1,42 @@
+#!/usr/bin/env node
+// This dependency-free closure also runs before workspace dependencies exist.
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { writeGeneratedOutput } from "./lib/generated-output-utils.mts";
+
+try {
+  const args = process.argv.slice(2);
+  if (args.some((arg) => arg !== "--check")) {
+    throw new Error("Usage: node scripts/generate-ci-git-owner.mts [--check]");
+  }
+  const repoRoot = fileURLToPath(new URL("../", import.meta.url));
+  const workflowPath = ".github/workflows/ci.yml";
+  const workflow = readFileSync(new URL(`../${workflowPath}`, import.meta.url), "utf8");
+  const source = readFileSync(
+    new URL("../.github/actions/git-owner/owner.py", import.meta.url),
+    "utf8",
+  );
+  const marker =
+    "          # Generated from .github/actions/git-owner/owner.py; do not edit here.\n";
+  const endMarker = "          # End generated CI Git owner.\n";
+  const start = workflow.indexOf(marker) + marker.length;
+  const end = workflow.indexOf(endMarker, start);
+  if (workflow.split(marker).length !== 2 || end < start) {
+    throw new Error("Expected exactly one CI Git owner projection");
+  }
+  // Bash can block before starting the reader of a large heredoc on Darwin.
+  // A literal argument preserves the source without pre-filling an unread pipe.
+  const projection = `run_owner '${source.replaceAll("'", "'\\''")}'\n`;
+  const next =
+    workflow.slice(0, start) + projection.replace(/^(?=.)/gmu, "          ") + workflow.slice(end);
+  const check = args.includes("--check");
+  const result = writeGeneratedOutput({ check, next, outputPath: workflowPath, repoRoot });
+  if (check && result.changed) {
+    throw new Error("Stale CI Git owner projection; run pnpm ci:git-owner:gen");
+  }
+  console.log(`[ci-git-owner] ${check ? "checked" : "generated"} ${workflowPath}`);
+} catch (error) {
+  console.error(error instanceof Error ? error.message : String(error));
+  console.error("[ci-git-owner] FAILED (exit 1)");
+  process.exitCode = 1;
+}
diff --git a/scripts/generate-dependency-release-evidence.mts b/scripts/generate-dependency-release-evidence.mts
new file mode 100644
index 0000000000000000000000000000000000000000..73151dd13c1ca2fac67b55b1c1c92e49f38482ae
--- /dev/null
+++ b/scripts/generate-dependency-release-evidence.mts
@@ -0,0 +1,627 @@
+#!/usr/bin/env node
+
+// Generates release dependency evidence artifacts and summaries.
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { appendFile, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import process from "node:process";
+import type { runDependencyVulnerabilityGate } from "./dependency-vulnerability-gate.mts";
+import { parseFlagArgs, stringFlag } from "./lib/arg-utils.mts";
+import {
+  RELEASE_DEPENDENCY_RISK_LOCKFILES,
+  resolveReleaseDependencyRiskAcceptance,
+} from "./lib/release-dependency-risk-acceptance.mts";
+import { REPORT_CLI_PARSE_OPTIONS } from "./lib/report-cli-helpers.mts";
+import type { generateNpmPackageLocksReport } from "./npm-package-locks-report.mts";
+
+/**
+ * Dependency evidence reports generated for release artifacts.
+ */
+export const DEPENDENCY_EVIDENCE_REPORTS = [
+  {
+    name: "Dependency advisory vulnerability gate",
+    command: "pnpm deps:vuln:gate",
+    policy: "hard-blocking",
+    json: "dependency-vulnerability-gate.json",
+    markdown: "dependency-vulnerability-gate.md",
+  },
+  {
+    name: "Transitive manifest risk report",
+    command: "pnpm deps:transitive-risk:report",
+    policy: "report-only",
+    json: "transitive-manifest-risk-report.json",
+    markdown: "transitive-manifest-risk-report.md",
+  },
+  {
+    name: "Dependency ownership and install surface report",
+    command: "pnpm deps:ownership-surface:report",
+    policy: "report-only",
+    json: "dependency-ownership-surface-report.json",
+    markdown: "dependency-ownership-surface-report.md",
+  },
+  {
+    name: "Dependency change report",
+    command: "pnpm deps:changes:report",
+    policy: "report-only",
+    json: "dependency-changes-report.json",
+    markdown: "dependency-changes-report.md",
+  },
+  {
+    name: "npm package-lock mirrors",
+    command: "pnpm deps:npm-lock:report",
+    policy: "report-only",
+    json: "npm-package-locks.json",
+    markdown: "npm-package-locks.md",
+  },
+];
+
+const RELEASE_TAG_PATTERN = "v[0-9]*.[0-9]*.[0-9]*";
+
+type ExecFileSyncLike = (command: string, args?: string[], options?: object) => unknown;
+type ManifestParams = {
+  dependencyChangeBaseRef?: string;
+  generatedAt?: string;
+  npmDistTag?: string;
+  packageVersion?: string;
+  releaseRef?: string;
+  releaseSha?: string;
+  releaseTag?: string;
+  workflowRunAttempt?: string;
+  workflowRunId?: string;
+};
+type GenerateEvidenceParams = Partial<EvidenceCliOptions> & {
+  execFileSyncImpl?: ExecFileSyncLike;
+  now?: Date;
+  workflowRunAttempt?: string;
+  workflowRunId?: string;
+};
+type EvidenceCliOptions = {
+  baseRef: string | null;
+  githubOutput: string | undefined;
+  githubStepSummary: string | undefined;
+  help?: true;
+  npmDistTag: string | null;
+  outputDir: string | null;
+  releaseRef: string | null;
+  rootDir: string;
+};
+
+function commandOutput(
+  command: string,
+  args: string[],
+  rootDir: string,
+  execFileSyncImpl: ExecFileSyncLike = execFileSync,
+  allowFailure = false,
+): string | null {
+  try {
+    return String(
+      execFileSyncImpl(command, args, {
+        cwd: rootDir,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+      }),
+    ).trim();
+  } catch (error) {
+    if (allowFailure) {
+      return null;
+    }
+    throw error;
+  }
+}
+
+function runCommand(
+  command: string,
+  args: string[],
+  rootDir: string,
+  execFileSyncImpl: ExecFileSyncLike = execFileSync,
+) {
+  execFileSyncImpl(command, args, {
+    cwd: rootDir,
+    stdio: "inherit",
+  });
+}
+
+/**
+ * Resolves the release tag when the release ref is a SHA or tag.
+ */
+export function resolveReleaseTag({
+  releaseRef,
+  packageVersion,
+}: Required<Pick<ManifestParams, "packageVersion" | "releaseRef">>) {
+  if (/^[0-9a-fA-F]{40}$/u.test(releaseRef)) {
+    return `v${packageVersion}`;
+  }
+  return releaseRef;
+}
+
+/**
+ * Resolves the previous reachable release tag for dependency diffs.
+ */
+export function resolvePreviousReleaseTag({
+  rootDir = process.cwd(),
+  execFileSyncImpl = execFileSync,
+  fetchOnMiss = true,
+}: { rootDir?: string; execFileSyncImpl?: ExecFileSyncLike; fetchOnMiss?: boolean } = {}) {
+  const describeArgs = [
+    "describe",
+    "--tags",
+    "--match",
+    RELEASE_TAG_PATTERN,
+    "--abbrev=0",
+    "HEAD^",
+  ];
+  const localTag = commandOutput("git", describeArgs, rootDir, execFileSyncImpl, true);
+  if (localTag) {
+    return localTag;
+  }
+  if (fetchOnMiss) {
+    const releaseSha = commandOutput("git", ["rev-parse", "HEAD"], rootDir, execFileSyncImpl);
+    if (!releaseSha) {
+      throw new Error("Could not resolve the release commit SHA.");
+    }
+    const shallow = commandOutput(
+      "git",
+      ["rev-parse", "--is-shallow-repository"],
+      rootDir,
+      execFileSyncImpl,
+    );
+    // Describe needs complete target ancestry; unrelated branches and tooling tags do not.
+    runCommand(
+      "git",
+      [
+        "fetch",
+        "--filter=blob:none",
+        "--no-tags",
+        "--force",
+        ...(shallow === "true" ? ["--unshallow"] : []),
+        "origin",
+        releaseSha,
+        "+refs/tags/v*:refs/tags/v*",
+      ],
+      rootDir,
+      execFileSyncImpl,
+    );
+  }
+  const fetchedTag = commandOutput("git", describeArgs, rootDir, execFileSyncImpl, true);
+  if (fetchedTag) {
+    return fetchedTag;
+  }
+  throw new Error(
+    "Could not resolve a previous reachable release tag for dependency change evidence.",
+  );
+}
+
+/**
+ * Creates the dependency evidence manifest payload.
+ */
+export function createDependencyEvidenceManifest({
+  generatedAt = new Date().toISOString(),
+  releaseTag,
+  releaseRef,
+  releaseSha,
+  npmDistTag,
+  packageVersion,
+  workflowRunId = "",
+  workflowRunAttempt = "",
+  dependencyChangeBaseRef,
+}: ManifestParams = {}) {
+  return {
+    schemaVersion: 1,
+    generatedAt,
+    releaseTag,
+    releaseRef,
+    releaseSha,
+    npmDistTag,
+    packageName: "openclaw",
+    packageVersion,
+    workflowRunId,
+    workflowRunAttempt,
+    dependencyChangeBaseRef,
+    reports: DEPENDENCY_EVIDENCE_REPORTS,
+  };
+}
+
+function reportPath(evidenceDir: string, fileName: string) {
+  return path.join(evidenceDir, fileName);
+}
+
+async function readJson<T>(filePath: string): Promise<T> {
+  return JSON.parse(await readFile(filePath, "utf8")) as T;
+}
+
+/**
+ * Reads generated reports and collects summary counts.
+ */
+export async function collectDependencyEvidenceSummaryCounts(evidenceDir: string) {
+  const [vulnerability, transitiveRisk, ownershipSurface, dependencyChanges, npmLocks] =
+    await Promise.all([
+      readJson<Awaited<ReturnType<typeof runDependencyVulnerabilityGate>>>(
+        reportPath(evidenceDir, "dependency-vulnerability-gate.json"),
+      ),
+      readJson<{
+        findingCount: number;
+        metadataFailures: unknown[];
+        workspaceExcludedFindingCount: number;
+      }>(reportPath(evidenceDir, "transitive-manifest-risk-report.json")),
+      readJson<{ summary: { buildRiskPackageCount: number; lockfilePackageCount: number } }>(
+        reportPath(evidenceDir, "dependency-ownership-surface-report.json"),
+      ),
+      readJson<{
+        summary: {
+          addedPackages: number;
+          changedPackages: number;
+          dependencyFileChanges: number;
+          removedPackages: number;
+        };
+      }>(reportPath(evidenceDir, "dependency-changes-report.json")),
+      readJson<Awaited<ReturnType<typeof generateNpmPackageLocksReport>>>(
+        reportPath(evidenceDir, "npm-package-locks.json"),
+      ),
+    ]);
+  return {
+    vulnerabilityBlockers: vulnerability.blockers.length,
+    vulnerabilityFindings: vulnerability.findings.length,
+    vulnerabilityCoverage: vulnerability.coverage,
+    upstreamOnlyVulnerabilityFindings: vulnerability.findings.filter(
+      (finding) => finding.source === "github-repository",
+    ).length,
+    transitiveRiskSignals: transitiveRisk.findingCount,
+    workspaceExcludedTransitiveSignals: transitiveRisk.workspaceExcludedFindingCount,
+    transitiveMetadataFailures: transitiveRisk.metadataFailures.length,
+    ownershipLockfilePackages: ownershipSurface.summary.lockfilePackageCount,
+    ownershipBuildRiskPackages: ownershipSurface.summary.buildRiskPackageCount,
+    dependencyFileChanges: dependencyChanges.summary.dependencyFileChanges,
+    dependencyAddedPackages: dependencyChanges.summary.addedPackages,
+    dependencyRemovedPackages: dependencyChanges.summary.removedPackages,
+    dependencyChangedPackages: dependencyChanges.summary.changedPackages,
+    npmLockPackages: npmLocks.packages.length,
+    npmLocklessPackages: npmLocks.packages.filter((entry) => !entry.bundleRuntimeDependencies)
+      .length,
+    npmPartialLockPackages: npmLocks.packagesWithOmittedWorkspaceDependencies,
+  };
+}
+
+type EvidenceSummaryCounts = Awaited<ReturnType<typeof collectDependencyEvidenceSummaryCounts>>;
+type EvidenceSummaryParams = { baseRef: string; counts: EvidenceSummaryCounts };
+
+function renderVulnerabilityEvidenceSummary(counts: EvidenceSummaryCounts) {
+  const { npm, upstream } = counts.vulnerabilityCoverage;
+  return [
+    `- npm advisory coverage: ${npm}`,
+    `- Upstream public repository advisory coverage: ${upstream.status}`,
+    `- Upstream source: \`${upstream.source}\``,
+    `- Upstream package versions mapped: ${upstream.mappedPackageVersions}/${upstream.packageVersions}`,
+    `- Upstream repositories checked: ${upstream.checkedRepositories}/${upstream.repositories}`,
+    `- Advisory vulnerability hard blockers: ${counts.vulnerabilityBlockers}`,
+    `- Advisory vulnerability total findings: ${counts.vulnerabilityFindings}`,
+    `- Upstream-only vulnerability findings: ${counts.upstreamOnlyVulnerabilityFindings}`,
+    `- Upstream coverage issues: ${upstream.issues.length}`,
+    ...upstream.issues.slice(0, 25).map(({ subject, reason }) => `  - ${subject}: ${reason}`),
+    ...(upstream.issues.length > 25
+      ? [
+          `  - ${upstream.issues.length - 25} more coverage issues; see dependency-vulnerability-gate.json.`,
+        ]
+      : []),
+    "",
+    "Coverage is limited to these advisory sources; zero findings do not prove that dependencies are unaffected.",
+    "",
+  ];
+}
+
+/**
+ * Renders the dependency evidence Markdown summary.
+ */
+export function renderDependencyEvidenceSummary({
+  releaseTag,
+  releaseSha,
+  baseRef,
+  counts,
+}: EvidenceSummaryParams & Required<Pick<ManifestParams, "releaseSha" | "releaseTag">>) {
+  return `${[
+    "# Dependency release evidence",
+    "",
+    `Generated for \`${releaseTag}\` at \`${releaseSha}\`.`,
+    "",
+    "## Summary",
+    "",
+    ...renderVulnerabilityEvidenceSummary(counts),
+    `- Transitive manifest reported risk signals: ${counts.transitiveRiskSignals}`,
+    `- Workspace-policy excluded transitive signals: ${counts.workspaceExcludedTransitiveSignals}`,
+    `- Transitive manifest metadata failures: ${counts.transitiveMetadataFailures}`,
+    `- Lockfile packages inspected for ownership/install surface: ${counts.ownershipLockfilePackages}`,
+    `- Packages with install-time or platform-specific behavior: ${counts.ownershipBuildRiskPackages}`,
+    `- Dependency change baseline: \`${baseRef}\``,
+    `- Dependency file changes: ${counts.dependencyFileChanges}`,
+    `- Resolved package changes: +${counts.dependencyAddedPackages} -${counts.dependencyRemovedPackages} changed ${counts.dependencyChangedPackages}`,
+    `- npm package-lock mirrors: ${counts.npmLockPackages}`,
+    `- Lockless packages (bundleRuntimeDependencies=false): ${counts.npmLocklessPackages}`,
+    `- Partial npm package-lock mirrors (workspace omissions): ${counts.npmPartialLockPackages}`,
+    "",
+    "## Reports",
+    "",
+    "- `dependency-vulnerability-gate.md`",
+    "- `transitive-manifest-risk-report.md`",
+    "- `dependency-ownership-surface-report.md`",
+    "- `dependency-changes-report.md`",
+    "- `npm-package-locks.md`",
+  ].join("\n")}\n`;
+}
+
+/**
+ * Renders the GitHub Actions step summary for dependency evidence.
+ */
+export function renderDependencyEvidenceStepSummary({
+  evidenceArtifactName,
+  baseRef,
+  counts,
+}: EvidenceSummaryParams & { evidenceArtifactName: string }) {
+  return `${[
+    "### Dependency release evidence",
+    "",
+    `- Evidence artifact: \`${evidenceArtifactName}\``,
+    `- Dependency change baseline: \`${baseRef}\``,
+    ...renderVulnerabilityEvidenceSummary(counts),
+    `- Transitive manifest reported risk signals: \`${counts.transitiveRiskSignals}\``,
+    `- Workspace-policy excluded transitive signals: \`${counts.workspaceExcludedTransitiveSignals}\``,
+    `- Ownership/install surface lockfile packages: \`${counts.ownershipLockfilePackages}\``,
+    `- Dependency file changes: \`${counts.dependencyFileChanges}\``,
+    `- Resolved package changes: \`+${counts.dependencyAddedPackages} -${counts.dependencyRemovedPackages} changed ${counts.dependencyChangedPackages}\``,
+    `- npm package-lock mirrors: ${counts.npmLockPackages}`,
+    `- Lockless packages (bundleRuntimeDependencies=false): ${counts.npmLocklessPackages}`,
+    `- Partial npm package-lock mirrors (workspace omissions): ${counts.npmPartialLockPackages}`,
+  ].join("\n")}\n`;
+}
+
+async function runEvidenceReports(
+  rootDir: string,
+  outputDir: string,
+  baseRef: string,
+  execFileSyncImpl: ExecFileSyncLike,
+  packageVersion: string,
+) {
+  let riskAcceptance: ReturnType<typeof resolveReleaseDependencyRiskAcceptance> = null;
+  const toolingRoot = path.resolve(import.meta.dirname, "..");
+  // Report implementations belong to this tooling checkout; --root selects only the source data.
+  // Release branches can keep frozen product bytes while trusted release tooling is repaired.
+  for (const report of DEPENDENCY_EVIDENCE_REPORTS) {
+    try {
+      runCommand(
+        "pnpm",
+        [
+          report.command.slice("pnpm ".length),
+          "--",
+          "--root",
+          rootDir,
+          ...(report.json === "dependency-changes-report.json" ? ["--base-ref", baseRef] : []),
+          "--json",
+          reportPath(outputDir, report.json),
+          "--markdown",
+          reportPath(outputDir, report.markdown),
+        ],
+        toolingRoot,
+        execFileSyncImpl,
+      );
+    } catch (error) {
+      if (
+        report.json !== "dependency-vulnerability-gate.json" ||
+        !(error instanceof Error) ||
+        !("status" in error) ||
+        error.status !== 1 ||
+        packageVersion !== "2026.9.1"
+      ) {
+        throw error;
+      }
+      const vulnerability = await readJson<
+        Awaited<ReturnType<typeof runDependencyVulnerabilityGate>>
+      >(reportPath(outputDir, report.json));
+      const lockfileSha256 = Object.fromEntries(
+        await Promise.all(
+          Object.keys(RELEASE_DEPENDENCY_RISK_LOCKFILES).map(async (file) => [
+            file,
+            createHash("sha256")
+              .update(await readFile(path.join(rootDir, file)))
+              .digest("hex"),
+          ]),
+        ),
+      );
+      riskAcceptance = resolveReleaseDependencyRiskAcceptance({
+        packageVersion,
+        lockfileSha256,
+        blockers: vulnerability.blockers,
+      });
+      if (!riskAcceptance) {
+        throw error;
+      }
+      console.warn(
+        "WARNING: 2026.9.1 dependency risks accepted by maintainer; scan findings remain unresolved.",
+      );
+    }
+  }
+  return riskAcceptance;
+}
+
+/**
+ * Generates dependency evidence reports, manifest, and summaries for a release.
+ */
+export async function generateDependencyReleaseEvidence({
+  rootDir: sourceRoot = process.cwd(),
+  outputDir: requestedOutputDir,
+  releaseRef,
+  npmDistTag,
+  baseRef = null,
+  githubOutput = process.env.GITHUB_OUTPUT,
+  githubStepSummary = process.env.GITHUB_STEP_SUMMARY,
+  workflowRunId = process.env.GITHUB_RUN_ID ?? "",
+  workflowRunAttempt = process.env.GITHUB_RUN_ATTEMPT ?? "",
+  execFileSyncImpl = execFileSync,
+  now = new Date(),
+}: GenerateEvidenceParams = {}) {
+  if (!requestedOutputDir) {
+    throw new Error("Expected --output-dir <path>.");
+  }
+  if (!releaseRef) {
+    throw new Error("Expected --release-ref <tag-or-sha>.");
+  }
+  if (!npmDistTag) {
+    throw new Error("Expected --npm-dist-tag <tag>.");
+  }
+
+  const rootDir = path.resolve(sourceRoot);
+  const outputDir = path.resolve(requestedOutputDir);
+  await rm(outputDir, { recursive: true, force: true });
+  await mkdir(outputDir, { recursive: true });
+  // Publish the artifact location before a blocking report exits so CI can retain its evidence.
+  if (githubOutput) {
+    await appendFile(githubOutput, `dir=${outputDir}\n`, "utf8");
+  }
+
+  const releaseSha = commandOutput("git", ["rev-parse", "HEAD"], rootDir, execFileSyncImpl);
+  if (!releaseSha) {
+    throw new Error("Could not resolve the release commit SHA.");
+  }
+  const packageJson = await readJson<{ version: string }>(path.join(rootDir, "package.json"));
+  const packageVersion = packageJson.version;
+  const releaseTag = resolveReleaseTag({ releaseRef, packageVersion });
+  const dependencyChangeBaseRef =
+    baseRef ?? resolvePreviousReleaseTag({ rootDir, execFileSyncImpl });
+
+  const riskAcceptance = await runEvidenceReports(
+    rootDir,
+    outputDir,
+    dependencyChangeBaseRef,
+    execFileSyncImpl,
+    packageVersion,
+  );
+
+  const manifest = {
+    ...createDependencyEvidenceManifest({
+      generatedAt: now.toISOString(),
+      releaseTag,
+      releaseRef,
+      releaseSha,
+      npmDistTag,
+      packageVersion,
+      workflowRunId,
+      workflowRunAttempt,
+      dependencyChangeBaseRef,
+    }),
+    ...(riskAcceptance ? { riskAcceptance } : {}),
+  };
+  await writeFile(
+    reportPath(outputDir, "dependency-evidence-manifest.json"),
+    `${JSON.stringify(manifest, null, 2)}\n`,
+    "utf8",
+  );
+
+  const counts = await collectDependencyEvidenceSummaryCounts(outputDir);
+  await writeFile(
+    reportPath(outputDir, "dependency-evidence-summary.md"),
+    renderDependencyEvidenceSummary({
+      releaseTag,
+      releaseSha,
+      baseRef: dependencyChangeBaseRef,
+      counts,
+    }) +
+      (riskAcceptance
+        ? "\n## Operator-accepted dependency risk\n\nThe maintainer accepted the five recorded advisory blockers for 2026.9.1 with unchanged dependencies. They remain unresolved, not a clean security scan. Exact graph hashes and findings are retained in dependency-evidence-manifest.json.\n"
+        : ""),
+    "utf8",
+  );
+
+  if (githubStepSummary) {
+    await appendFile(
+      githubStepSummary,
+      renderDependencyEvidenceStepSummary({
+        evidenceArtifactName: `openclaw-release-dependency-evidence-${releaseRef}`,
+        baseRef: dependencyChangeBaseRef,
+        counts,
+      }) +
+        (riskAcceptance
+          ? "\nWARNING: Five dependency advisory blockers remain unresolved and were explicitly accepted for 2026.9.1. See the dependency evidence manifest.\n"
+          : ""),
+      "utf8",
+    );
+  }
+  return { manifest, counts, outputDir };
+}
+
+function usage() {
+  return `Usage: node --import tsx scripts/generate-dependency-release-evidence.mts --output-dir <dir> --release-ref <ref> --npm-dist-tag <tag> [options]
+
+Generates release dependency evidence reports and summary artifacts.
+
+Options:
+  --root <dir>                  Repository root
+  --output-dir <dir>            Evidence artifact directory
+  --release-ref <ref>           Release tag or SHA under validation
+  --npm-dist-tag <tag>          npm dist-tag being validated
+  --base-ref <ref>              Dependency change comparison base
+  --github-output <path>        GitHub Actions output file
+  --github-step-summary <path>  GitHub Actions step summary file
+  -h, --help                    Show this help
+`;
+}
+
+export function parseArgs(argv: string[]): EvidenceCliOptions {
+  const options: EvidenceCliOptions = {
+    rootDir: process.cwd(),
+    outputDir: null,
+    releaseRef: null,
+    npmDistTag: null,
+    baseRef: null,
+    githubOutput: process.env.GITHUB_OUTPUT,
+    githubStepSummary: process.env.GITHUB_STEP_SUMMARY,
+  };
+  const helpIndex = argv.findIndex((arg) => arg === "-h" || arg === "--help");
+  const specs = [
+    ["--root", "rootDir", false],
+    ["--output-dir", "outputDir", false],
+    ["--release-ref", "releaseRef", false],
+    ["--npm-dist-tag", "npmDistTag", false],
+    ["--base-ref", "baseRef", false],
+    ["--github-output", "githubOutput", true],
+    ["--github-step-summary", "githubStepSummary", true],
+  ] satisfies Array<readonly [string, keyof EvidenceCliOptions, boolean]>;
+  const parsed = parseFlagArgs(
+    helpIndex === -1 ? argv : argv.slice(0, helpIndex),
+    options,
+    specs.map(([flag, key, allowEmpty]) =>
+      stringFlag(flag, key, {
+        allowEmpty,
+        allowInline: false,
+        missingValueMessage: `Expected ${flag} <value>.`,
+        rejectShortOptions: true,
+      }),
+    ),
+    REPORT_CLI_PARSE_OPTIONS,
+  );
+  return helpIndex === -1 ? parsed : { ...parsed, help: true };
+}
+
+/**
+ * Runs the dependency release evidence generator CLI.
+ */
+async function main(argv = process.argv.slice(2)) {
+  const options = parseArgs(argv);
+  if (options.help) {
+    process.stdout.write(usage());
+    return 0;
+  }
+  await generateDependencyReleaseEvidence(options);
+  return 0;
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === path.resolve(import.meta.filename)) {
+  main().then(
+    (exitCode) => {
+      process.exitCode = exitCode;
+    },
+    (error: unknown) => {
+      process.stderr.write(
+        `${error instanceof Error ? error.message : String(error)}\n[dependency-release-evidence] FAILED (exit 1)\n`,
+      );
+      process.exitCode = 1;
+    },
+  );
+}
diff --git a/scripts/generate-kysely-types.mts b/scripts/generate-kysely-types.mts
new file mode 100644
index 0000000000000000000000000000000000000000..b128122a3b8f622504dab2ba04f303402c05a688
--- /dev/null
+++ b/scripts/generate-kysely-types.mts
@@ -0,0 +1,139 @@
+#!/usr/bin/env node
+
+// Generates Kysely database types from the SQLite schema.
+import fs from "node:fs";
+import process from "node:process";
+import { DatabaseSync } from "node:sqlite";
+
+const SCHEMAS = [
+  {
+    name: "openclaw-state",
+    schema: "src/state/openclaw-state-schema.sql",
+    outFile: "src/state/openclaw-state-db.generated.d.ts",
+  },
+  {
+    name: "openclaw-agent",
+    schema: "src/state/openclaw-agent-schema.sql",
+    outFile: "src/state/openclaw-agent-db.generated.d.ts",
+  },
+];
+
+const verify = process.argv.includes("--verify") || process.argv.includes("--check");
+
+type SchemaTarget = (typeof SCHEMAS)[number];
+
+function toInterfaceName(tableName: string): string {
+  return tableName
+    .split("_")
+    .map((part) => `${part.slice(0, 1).toUpperCase()}${part.slice(1)}`)
+    .join("");
+}
+
+function columnBaseType(columnTypeLocal: string): string {
+  const normalized = columnTypeLocal.toUpperCase();
+  if (normalized.includes("BLOB")) {
+    return "Uint8Array";
+  }
+  if (
+    normalized.includes("INT") ||
+    normalized.includes("REAL") ||
+    normalized.includes("FLOA") ||
+    normalized.includes("DOUB") ||
+    normalized.includes("NUM") ||
+    normalized.includes("DEC")
+  ) {
+    return "number";
+  }
+  return "string";
+}
+
+function columnType(column: Record<string, unknown>, primaryKeyColumnCount: number): string {
+  const sqliteType = typeof column.type === "string" ? column.type : "";
+  const baseType = columnBaseType(sqliteType);
+  const generatedPrimaryKey =
+    primaryKeyColumnCount === 1 &&
+    Number(column.pk) > 0 &&
+    sqliteType.toUpperCase().includes("INT");
+  const generated = column.dflt_value != null || generatedPrimaryKey;
+  const nullable = Number(column.notnull) !== 1 && !generatedPrimaryKey;
+  const valueType = nullable ? `${baseType} | null` : baseType;
+  return generated ? `Generated<${valueType}>` : valueType;
+}
+
+function quoteSqliteIdentifier(identifier: string): string {
+  return `"${identifier.replaceAll('"', '""')}"`;
+}
+
+function generateTypes(db: DatabaseSync): string {
+  const tables = db
+    .prepare(
+      "SELECT name FROM sqlite_schema WHERE type = 'table' AND name NOT LIKE 'sqlite_%' ORDER BY name;",
+    )
+    .all()
+    .map((row) => String(row.name));
+  const lines = [
+    "/**",
+    " * This file was generated by kysely-codegen.",
+    " * Please do not edit it manually.",
+    " */",
+    "",
+    'import type { ColumnType } from "kysely";',
+    "",
+    "export type Generated<T> =",
+    "  T extends ColumnType<infer S, infer I, infer U>",
+    "    ? ColumnType<S, I | undefined, U>",
+    "    : ColumnType<T, T | undefined, T>;",
+    "",
+  ];
+
+  const interfaces: Array<{ interfaceName: string; table: string }> = [];
+  for (const table of tables) {
+    const interfaceName = toInterfaceName(table);
+    interfaces.push({ interfaceName, table });
+    lines.push(`export interface ${interfaceName} {`);
+    const columns = db
+      .prepare(`PRAGMA table_xinfo(${quoteSqliteIdentifier(table)});`)
+      .all()
+      .filter((column) => Number(column.hidden) === 0)
+      .toSorted((left, right) => String(left.name).localeCompare(String(right.name)));
+    const primaryKeyColumnCount = columns.filter((column) => Number(column.pk) > 0).length;
+    for (const column of columns) {
+      lines.push(`  ${String(column.name)}: ${columnType(column, primaryKeyColumnCount)};`);
+    }
+    lines.push("}", "");
+  }
+
+  lines.push("export interface DB {");
+  for (const { interfaceName, table } of interfaces) {
+    lines.push(`  ${table}: ${interfaceName};`);
+  }
+  lines.push("}", "");
+  return lines.join("\n");
+}
+
+function readUtf8(file: string): string {
+  return fs.readFileSync(file, "utf8");
+}
+
+function generate(schema: SchemaTarget): void {
+  const db = new DatabaseSync(":memory:");
+  try {
+    db.exec(readUtf8(schema.schema));
+    const typesSource = generateTypes(db);
+
+    if (verify) {
+      if (typesSource !== readUtf8(schema.outFile)) {
+        console.error(`${schema.outFile} is out of date. Run pnpm db:kysely:gen.`);
+        process.exitCode = 1;
+      }
+    } else {
+      fs.writeFileSync(schema.outFile, typesSource);
+    }
+  } finally {
+    db.close();
+  }
+}
+
+for (const schema of SCHEMAS) {
+  generate(schema);
+}
diff --git a/scripts/generate-runtime-sidecar-paths-baseline.ts b/scripts/generate-runtime-sidecar-paths-baseline.ts
new file mode 100644
index 0000000000000000000000000000000000000000..24a6a388996a8133e0cfa9acf7b5d57cf00bce26
--- /dev/null
+++ b/scripts/generate-runtime-sidecar-paths-baseline.ts
@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+// Generate Runtime Sidecar Paths Baseline script supports OpenClaw repository automation.
+import path from "node:path";
+import { writeBundledRuntimeSidecarPathBaseline } from "../src/plugins/runtime-sidecar-paths-baseline.js";
+
+const args = new Set(process.argv.slice(2));
+const checkOnly = args.has("--check");
+const writeMode = args.has("--write");
+
+if (checkOnly === writeMode) {
+  console.error("Use exactly one of --check or --write.");
+  process.exit(1);
+}
+
+const repoRoot = process.cwd();
+const result = await writeBundledRuntimeSidecarPathBaseline({
+  repoRoot,
+  check: checkOnly,
+});
+
+if (checkOnly) {
+  if (result.changed) {
+    console.error(
+      [
+        "Bundled runtime sidecar path baseline drift detected.",
+        `Expected current: ${path.relative(repoRoot, result.jsonPath)}`,
+        "If this bundled plugin runtime-sidecar change is intentional, run `pnpm runtime-sidecars:gen` and commit the updated baseline file.",
+        "If not intentional, fix the bundled plugin metadata/public surface drift first.",
+      ].join("\n"),
+    );
+    process.exit(1);
+  }
+  console.log(`OK ${path.relative(repoRoot, result.jsonPath)}`);
+} else {
+  console.log(`Wrote ${path.relative(repoRoot, result.jsonPath)}`);
+}
diff --git a/scripts/generate-sqlite-session-schema-baseline.ts b/scripts/generate-sqlite-session-schema-baseline.ts
new file mode 100644
index 0000000000000000000000000000000000000000..d2820fa668ee9978d0b3e765aab7754e0a33b869
--- /dev/null
+++ b/scripts/generate-sqlite-session-schema-baseline.ts
@@ -0,0 +1,42 @@
+#!/usr/bin/env node
+// Generate SQLite Session Schema Baseline script supports OpenClaw repository automation.
+import path from "node:path";
+import { writeSqliteSessionSchemaBaselineArtifacts } from "./lib/sqlite-session-schema-baseline.ts";
+
+const args = new Set(process.argv.slice(2));
+const checkOnly = args.has("--check");
+const writeMode = args.has("--write");
+
+if (checkOnly === writeMode) {
+  console.error("Use exactly one of --check or --write.");
+  process.exit(1);
+}
+
+const repoRoot = process.cwd();
+const result = await writeSqliteSessionSchemaBaselineArtifacts({
+  repoRoot,
+  check: checkOnly,
+});
+
+if (checkOnly) {
+  if (result.changed) {
+    console.error(
+      [
+        "SQLite sessions/transcripts schema baseline drift detected.",
+        `Hash mismatch: ${path.relative(repoRoot, result.hashPath)}`,
+        "This means the sessions, conversations, or transcripts SQLite DDL changed.",
+        "If this schema change is intentional, run `pnpm sqlite:sessions-schema:gen` and commit the updated hash file.",
+        "If not intentional, keep the schema stable or move unrelated state to a separate table/store.",
+      ].join("\n"),
+    );
+    process.exit(1);
+  }
+  console.log(`OK ${path.relative(repoRoot, result.hashPath)}`);
+} else {
+  console.log(
+    [
+      `Wrote ${path.relative(repoRoot, result.hashPath)}`,
+      `Wrote ${path.relative(repoRoot, result.sqlPath)} (gitignored, local only)`,
+    ].join("\n"),
+  );
+}
diff --git a/scripts/install-swift-tools.sh b/scripts/install-swift-tools.sh
new file mode 100644
index 0000000000000000000000000000000000000000..9b86e602af073623c62836c1cb8609e934c3af9b
--- /dev/null
+++ b/scripts/install-swift-tools.sh
@@ -0,0 +1,49 @@
+#!/bin/bash
+
+set -euo pipefail
+
+if [[ "$#" -ne 1 ]]; then
+  echo "usage: $0 <install-directory>" >&2
+  exit 2
+fi
+
+install_dir="$1"
+temp_dir="$(mktemp -d)"
+trap 'rm -rf "$temp_dir"' EXIT
+
+install_archive() {
+  local name="$1"
+  local url="$2"
+  local checksum="$3"
+  local archive="$temp_dir/$name.zip"
+  local extract_dir="$temp_dir/$name"
+
+  # Bound individual transfers and the retry window. curl resets --max-time for
+  # each retry, while a started retry can outlive --retry-max-time.
+  curl --fail --location --silent --show-error \
+    --connect-timeout 10 --max-time 120 \
+    --retry 3 --retry-max-time 120 \
+    --output "$archive" "$url"
+  if [[ "$(shasum -a 256 "$archive" | awk '{print $1}')" != "$checksum" ]]; then
+    echo "$name archive checksum mismatch" >&2
+    exit 1
+  fi
+
+  mkdir -p "$extract_dir"
+  unzip -q "$archive" -d "$extract_dir"
+  install -m 0755 "$extract_dir/$name" "$install_dir/$name"
+}
+
+mkdir -p "$install_dir"
+
+install_archive \
+  swiftformat \
+  "https://github.com/nicklockwood/SwiftFormat/releases/download/0.63.0/swiftformat.zip" \
+  "28c7802e11fa5ae113d903066439c6bb1be20a8ac1ad9709c42616a7e273fb0f"
+install_archive \
+  swiftlint \
+  "https://github.com/realm/SwiftLint/releases/download/0.65.1/portable_swiftlint.zip" \
+  "c1e429b0599cf1b516f369a2d9ec04eaf0e436f3c12b637df8851fa52ff694d0"
+
+[[ "$($install_dir/swiftformat --version)" == "0.63.0" ]]
+[[ "$($install_dir/swiftlint version)" == "0.65.1" ]]
diff --git a/scripts/install-xcodegen.sh b/scripts/install-xcodegen.sh
new file mode 100644
index 0000000000000000000000000000000000000000..b3972b0ff0d3778841526c87cf0207a5d0dd1748
--- /dev/null
+++ b/scripts/install-xcodegen.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+if [[ "$#" -ne 1 ]]; then
+  echo "usage: $0 <install-directory>" >&2
+  exit 2
+fi
+
+readonly xcodegen_version="2.46.0"
+readonly xcodegen_checksum="4d9e34b62172d645eed6457cac13fc222569974098ef4ee9c3368bedf0196806"
+
+install_dir="$1"
+temp_dir="$(mktemp -d)"
+trap 'rm -rf "$temp_dir"' EXIT
+
+archive="$temp_dir/xcodegen.zip"
+extract_dir="$temp_dir/extract"
+
+# Bound individual transfers and the retry window. curl resets --max-time for
+# each retry, while a started retry can outlive --retry-max-time.
+curl --fail --location --silent --show-error \
+  --connect-timeout 10 --max-time 120 \
+  --retry 3 --retry-max-time 120 \
+  --output "$archive" \
+  "https://github.com/yonaskolb/XcodeGen/releases/download/$xcodegen_version/xcodegen.zip"
+if [[ "$(shasum -a 256 "$archive" | awk '{print $1}')" != "$xcodegen_checksum" ]]; then
+  echo "xcodegen archive checksum mismatch" >&2
+  exit 1
+fi
+
+mkdir -p "$install_dir" "$extract_dir"
+unzip -q "$archive" -d "$extract_dir"
+
+prefix_dir="$(cd "$(dirname "$install_dir")" && pwd)"
+share_dir="$prefix_dir/share/xcodegen"
+rm -rf "$share_dir"
+mkdir -p "$(dirname "$share_dir")"
+cp -R "$extract_dir/xcodegen/share/xcodegen" "$share_dir"
+install -m 0755 "$extract_dir/xcodegen/bin/xcodegen" "$install_dir/xcodegen"
+
+# XcodeGen resolves SettingPresets relative to its executable, so keep the
+# release archive's bin/../share layout intact or project generation will fail.
+[[ "$("$install_dir/xcodegen" --version)" == "Version: $xcodegen_version" ]]
diff --git a/scripts/ios-app-store-connect-keychain-setup.sh b/scripts/ios-app-store-connect-keychain-setup.sh
new file mode 100644
index 0000000000000000000000000000000000000000..1da0abcf762dcda7d0783997a9f2258594a4604d
--- /dev/null
+++ b/scripts/ios-app-store-connect-keychain-setup.sh
@@ -0,0 +1,187 @@
+#!/bin/bash
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage:
+  scripts/ios-app-store-connect-keychain-setup.sh --key-path /path/to/AuthKey_XXXXXX.p8 --issuer-id <issuer-uuid> [options]
+
+Required:
+  --key-path <path>      Path to App Store Connect API key (.p8)
+  --issuer-id <uuid>     App Store Connect issuer ID
+
+Optional:
+  --key-id <id>          API key ID (auto-detected from AuthKey_<id>.p8 if omitted)
+  --service <name>       Keychain service name (default: openclaw-app-store-connect-key)
+  --account <name>       Keychain account name (default: $USER or $LOGNAME)
+  --write-env            Upsert non-secret env vars into apps/ios/fastlane/.env
+  --env-file <path>      Override env file path used with --write-env
+  -h, --help             Show this help
+
+Example:
+  scripts/ios-app-store-connect-keychain-setup.sh \
+    --key-path "$HOME/keys/AuthKey_ABC1234567.p8" \
+    --issuer-id "00000000-1111-2222-3333-444444444444" \
+    --write-env
+EOF
+}
+
+upsert_env_line() {
+  local file="$1"
+  local key="$2"
+  local value="$3"
+  local tmp
+  tmp="$(mktemp)"
+
+  if [[ -f "$file" ]]; then
+    awk -v key="$key" -v value="$value" '
+      BEGIN { updated = 0 }
+      $0 ~ ("^" key "=") { print key "=" value; updated = 1; next }
+      { print }
+      END { if (!updated) print key "=" value }
+    ' "$file" >"$tmp"
+  else
+    printf "%s=%s\n" "$key" "$value" >"$tmp"
+  fi
+
+  mv "$tmp" "$file"
+}
+
+delete_env_line() {
+  local file="$1"
+  local key="$2"
+  local tmp
+  tmp="$(mktemp)"
+
+  if [[ ! -f "$file" ]]; then
+    rm -f "$tmp"
+    return
+  fi
+
+  awk -v key="$key" '
+    $0 ~ ("^" key "=") { next }
+    { print }
+  ' "$file" >"$tmp"
+
+  mv "$tmp" "$file"
+}
+
+KEY_PATH=""
+KEY_ID=""
+ISSUER_ID=""
+SERVICE="openclaw-app-store-connect-key"
+ACCOUNT="${USER:-${LOGNAME:-}}"
+WRITE_ENV=0
+ENV_FILE=""
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+DEFAULT_ENV_FILE="$REPO_ROOT/apps/ios/fastlane/.env"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --key-path)
+      KEY_PATH="${2:-}"
+      shift 2
+      ;;
+    --key-id)
+      KEY_ID="${2:-}"
+      shift 2
+      ;;
+    --issuer-id)
+      ISSUER_ID="${2:-}"
+      shift 2
+      ;;
+    --service)
+      SERVICE="${2:-}"
+      shift 2
+      ;;
+    --account)
+      ACCOUNT="${2:-}"
+      shift 2
+      ;;
+    --write-env)
+      WRITE_ENV=1
+      shift
+      ;;
+    --env-file)
+      ENV_FILE="${2:-}"
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      usage
+      exit 1
+      ;;
+  esac
+done
+
+if [[ -z "$KEY_PATH" || -z "$ISSUER_ID" ]]; then
+  echo "Missing required arguments." >&2
+  usage
+  exit 1
+fi
+
+if [[ ! -f "$KEY_PATH" ]]; then
+  echo "Key file not found: $KEY_PATH" >&2
+  exit 1
+fi
+
+if [[ -z "$KEY_ID" ]]; then
+  key_filename="$(basename "$KEY_PATH")"
+  if [[ "$key_filename" =~ ^AuthKey_([A-Za-z0-9]+)\.p8$ ]]; then
+    KEY_ID="${BASH_REMATCH[1]}"
+  else
+    echo "Could not infer --key-id from filename '$key_filename'. Pass --key-id explicitly." >&2
+    exit 1
+  fi
+fi
+
+if [[ -z "$ACCOUNT" ]]; then
+  echo "Could not determine Keychain account. Pass --account explicitly." >&2
+  exit 1
+fi
+
+KEY_CONTENT="$(cat "$KEY_PATH")"
+if [[ -z "$KEY_CONTENT" ]]; then
+  echo "Key file is empty: $KEY_PATH" >&2
+  exit 1
+fi
+
+security add-generic-password \
+  -a "$ACCOUNT" \
+  -s "$SERVICE" \
+  -w "$KEY_CONTENT" \
+  -U >/dev/null
+
+echo "Stored App Store Connect API private key in macOS Keychain (service='$SERVICE', account='$ACCOUNT')."
+echo
+echo "Export these vars for Fastlane:"
+echo "APP_STORE_CONNECT_KEY_ID=$KEY_ID"
+echo "APP_STORE_CONNECT_ISSUER_ID=$ISSUER_ID"
+echo "APP_STORE_CONNECT_KEYCHAIN_SERVICE=$SERVICE"
+echo "APP_STORE_CONNECT_KEYCHAIN_ACCOUNT=$ACCOUNT"
+
+if [[ "$WRITE_ENV" -eq 1 ]]; then
+  if [[ -z "$ENV_FILE" ]]; then
+    ENV_FILE="$DEFAULT_ENV_FILE"
+  fi
+
+  mkdir -p "$(dirname "$ENV_FILE")"
+  touch "$ENV_FILE"
+
+  upsert_env_line "$ENV_FILE" "APP_STORE_CONNECT_KEY_ID" "$KEY_ID"
+  upsert_env_line "$ENV_FILE" "APP_STORE_CONNECT_ISSUER_ID" "$ISSUER_ID"
+  upsert_env_line "$ENV_FILE" "APP_STORE_CONNECT_KEYCHAIN_SERVICE" "$SERVICE"
+  upsert_env_line "$ENV_FILE" "APP_STORE_CONNECT_KEYCHAIN_ACCOUNT" "$ACCOUNT"
+  # Remove file/path based keys so Keychain is used by default.
+  delete_env_line "$ENV_FILE" "APP_STORE_CONNECT_KEY_PATH"
+  delete_env_line "$ENV_FILE" "APP_STORE_CONNECT_KEY_CONTENT"
+  delete_env_line "$ENV_FILE" "APP_STORE_CONNECT_API_KEY_PATH"
+
+  echo
+  echo "Updated env file: $ENV_FILE"
+fi
diff --git a/scripts/ios-release-archive.sh b/scripts/ios-release-archive.sh
new file mode 100644
index 0000000000000000000000000000000000000000..b865e2d71b9556b0fc2785b8244fc4b10882b3d1
--- /dev/null
+++ b/scripts/ios-release-archive.sh
@@ -0,0 +1,41 @@
+#!/bin/bash
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage:
+  scripts/ios-release-archive.sh --version 2026.7.2 --revision 1 [--build-number 3]
+
+Archives and exports an App Store distribution IPA locally without uploading.
+EOF
+}
+
+BUILD_NUMBER=""
+APP_STORE_REVISION=""
+RELEASE_VERSION=""
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+source "${ROOT_DIR}/scripts/lib/ios-fastlane.sh"
+
+parse_ios_release_args archive "$@"
+
+if [[ -z "${RELEASE_VERSION}" ]]; then
+  echo "Missing required --version." >&2
+  usage >&2
+  exit 1
+fi
+
+if [[ -z "${APP_STORE_REVISION}" ]]; then
+  echo "Missing required --revision." >&2
+  usage >&2
+  exit 1
+fi
+
+FASTLANE_ARGS=(ios app_store_archive "release_version:${RELEASE_VERSION}" "app_store_revision:${APP_STORE_REVISION}")
+if [[ -n "${BUILD_NUMBER}" ]]; then
+  FASTLANE_ARGS+=("build_number:${BUILD_NUMBER}")
+fi
+
+(
+  cd "${ROOT_DIR}/apps/ios"
+  run_ios_fastlane "${FASTLANE_ARGS[@]}"
+)
diff --git a/scripts/ios-release-plan.ts b/scripts/ios-release-plan.ts
new file mode 100644
index 0000000000000000000000000000000000000000..a0223409263399cfebdfc9d42522e69c292865df
--- /dev/null
+++ b/scripts/ios-release-plan.ts
@@ -0,0 +1,18 @@
+// iOS release plan CLI resolves pure App Store state supplied by the Fastlane adapter.
+import { readFileSync } from "node:fs";
+import { resolveIosReleasePlan, type IosReleasePlanInput } from "./lib/ios-release-plan.ts";
+
+const inputIndex = process.argv.indexOf("--input");
+const inputPath = inputIndex >= 0 ? process.argv[inputIndex + 1] : undefined;
+if (!inputPath) {
+  console.error("Usage: node --import tsx scripts/ios-release-plan.ts --input <json-file>");
+  process.exit(1);
+}
+
+try {
+  const input = JSON.parse(readFileSync(inputPath, "utf8")) as IosReleasePlanInput;
+  process.stdout.write(`${JSON.stringify(resolveIosReleasePlan(input), null, 2)}\n`);
+} catch (error) {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(1);
+}
diff --git a/scripts/ios-release-prepare.sh b/scripts/ios-release-prepare.sh
new file mode 100644
index 0000000000000000000000000000000000000000..911a729800a2e7203d328df39c5e86017653ff0e
--- /dev/null
+++ b/scripts/ios-release-prepare.sh
@@ -0,0 +1,153 @@
+#!/bin/bash
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage:
+  scripts/ios-release-prepare.sh --version 2026.7.2 --revision 1 --build-number 3 [--team-id TEAMID]
+
+Prepares local App Store release inputs without touching local signing overrides:
+- writes apps/ios/build/Version.xcconfig for the explicit gateway and App Store revision
+- writes apps/ios/build/AppStoreRelease.xcconfig with canonical bundle IDs
+- configures the release build for relay-backed APNs registration
+- configures manual App Store distribution signing with pinned provisioning profiles
+- regenerates apps/ios/OpenClaw.xcodeproj via xcodegen
+EOF
+}
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+source "${ROOT_DIR}/scripts/lib/ios-fastlane.sh"
+IOS_DIR="${ROOT_DIR}/apps/ios"
+BUILD_DIR="${IOS_DIR}/build"
+RELEASE_XCCONFIG="${IOS_DIR}/build/AppStoreRelease.xcconfig"
+TEAM_HELPER="${ROOT_DIR}/scripts/ios-team-id.sh"
+VERSION_HELPER="${ROOT_DIR}/scripts/ios-write-version-xcconfig.sh"
+IOS_VERSION_HELPER="${ROOT_DIR}/scripts/ios-version.ts"
+VERSION_SYNC_HELPER="${ROOT_DIR}/scripts/ios-sync-versioning.ts"
+RELEASE_SIGNING_HELPER="${ROOT_DIR}/scripts/ios-release-signing.mjs"
+RELEASE_SOURCE_HELPER="${ROOT_DIR}/scripts/apple-release-source-check.sh"
+CANONICAL_TEAM_ID="FWJYW4S8P8"
+
+BUILD_NUMBER=""
+APP_STORE_REVISION=""
+RELEASE_VERSION=""
+TEAM_ID="${IOS_DEVELOPMENT_TEAM:-}"
+IOS_VERSION=""
+RELEASE_SIGNING_XCCONFIG=""
+RELEASE_GIT_COMMIT=""
+
+prepare_build_dir() {
+  if [[ -L "${BUILD_DIR}" ]]; then
+    echo "Refusing to use symlinked build directory: ${BUILD_DIR}" >&2
+    exit 1
+  fi
+
+  mkdir -p "${BUILD_DIR}"
+}
+
+write_generated_file() {
+  local output_path="$1"
+  local tmp_file=""
+
+  if [[ -e "${output_path}" && -L "${output_path}" ]]; then
+    echo "Refusing to overwrite symlinked file: ${output_path}" >&2
+    exit 1
+  fi
+
+  tmp_file="$(mktemp "${output_path}.XXXXXX")"
+  cat >"${tmp_file}"
+  mv -f "${tmp_file}" "${output_path}"
+}
+
+parse_ios_release_args prepare "$@"
+
+if [[ -z "${BUILD_NUMBER}" ]]; then
+  echo "Missing required --build-number." >&2
+  usage >&2
+  exit 1
+fi
+
+if [[ -z "${RELEASE_VERSION}" ]]; then
+  echo "Missing required --version." >&2
+  usage >&2
+  exit 1
+fi
+
+if [[ -z "${APP_STORE_REVISION}" ]]; then
+  echo "Missing required --revision." >&2
+  usage >&2
+  exit 1
+fi
+
+if [[ -z "${TEAM_ID}" ]]; then
+  TEAM_ID="$(IOS_ALLOW_KEYCHAIN_TEAM_FALLBACK=1 /bin/bash "${TEAM_HELPER}" --require-canonical)"
+fi
+
+if [[ -z "${TEAM_ID}" ]]; then
+  echo "Could not resolve Apple Team ID. Set IOS_DEVELOPMENT_TEAM or sign into Xcode." >&2
+  exit 1
+fi
+
+if [[ "${TEAM_ID}" != "${CANONICAL_TEAM_ID}" ]]; then
+  echo "iOS App Store release must use canonical OpenClaw Team ID ${CANONICAL_TEAM_ID}; got ${TEAM_ID}." >&2
+  exit 1
+fi
+
+if [[ -n "${OPENCLAW_PUSH_RELAY_BASE_URL:-}" || -n "${IOS_PUSH_RELAY_BASE_URL:-}" ]]; then
+  echo "iOS App Store release uses the canonical hosted push relay; custom relay URL overrides are not allowed." >&2
+  exit 1
+fi
+
+source "${ROOT_DIR}/scripts/lib/build-metadata.sh"
+RELEASE_GIT_COMMIT="$(OPENCLAW_REQUIRE_BUILD_METADATA=1 openclaw_resolve_git_commit "${ROOT_DIR}")"
+/bin/bash "${RELEASE_SOURCE_HELPER}" --root "${ROOT_DIR}" --expected-commit "${RELEASE_GIT_COMMIT}"
+export GIT_COMMIT="${RELEASE_GIT_COMMIT}"
+
+prepare_build_dir
+
+(
+  cd "${ROOT_DIR}" && node --import tsx "${VERSION_SYNC_HELPER}" --check --version "${RELEASE_VERSION}" --revision "${APP_STORE_REVISION}"
+)
+
+IOS_VERSION="$(cd "${ROOT_DIR}" && node --import tsx "${IOS_VERSION_HELPER}" --version "${RELEASE_VERSION}" --revision "${APP_STORE_REVISION}" --field marketingVersion)"
+if [[ -z "${IOS_VERSION}" ]]; then
+  echo "Unable to resolve App Store version for gateway '${RELEASE_VERSION}' revision '${APP_STORE_REVISION}'." >&2
+  exit 1
+fi
+
+RELEASE_SIGNING_XCCONFIG="$(cd "${ROOT_DIR}" && node "${RELEASE_SIGNING_HELPER}" --mode xcconfig)"
+if [[ -z "${RELEASE_SIGNING_XCCONFIG}" ]]; then
+  echo "Unable to resolve App Store release signing profile settings." >&2
+  exit 1
+fi
+
+(
+  OPENCLAW_REQUIRE_BUILD_METADATA=1 \
+    /bin/bash "${VERSION_HELPER}" --version "${RELEASE_VERSION}" --revision "${APP_STORE_REVISION}" --build-number "${BUILD_NUMBER}"
+)
+node "${ROOT_DIR}/scripts/ios-write-swift-filelist.mjs"
+
+write_generated_file "${RELEASE_XCCONFIG}" <<EOF
+// Auto-generated by scripts/ios-release-prepare.sh.
+// Local App Store release override; do not commit.
+${RELEASE_SIGNING_XCCONFIG}
+OPENCLAW_DEVELOPMENT_TEAM = ${TEAM_ID}
+OPENCLAW_IOS_SELECTED_TEAM = ${TEAM_ID}
+OPENCLAW_APP_BUNDLE_ID = ai.openclawfoundation.app
+OPENCLAW_SHARE_BUNDLE_ID = ai.openclawfoundation.app.share
+OPENCLAW_ACTIVITY_WIDGET_BUNDLE_ID = ai.openclawfoundation.app.activitywidget
+OPENCLAW_WATCH_APP_BUNDLE_ID = ai.openclawfoundation.app.watchkitapp
+OPENCLAW_CODE_SIGN_ENTITLEMENTS = Sources/OpenClawAppAttest.entitlements
+OPENCLAW_APNS_ENTITLEMENT_ENVIRONMENT = production
+OPENCLAW_APP_ATTEST_ENVIRONMENT = production
+OPENCLAW_PUSH_MODE = appStore
+OPENCLAW_PUSH_RELAY_BASE_URL =
+EOF
+
+(
+  cd "${IOS_DIR}"
+  xcodegen generate
+)
+
+echo "Prepared iOS App Store release: version=${IOS_VERSION} build=${BUILD_NUMBER} team=${TEAM_ID}"
+echo "XCODE_XCCONFIG_FILE=${RELEASE_XCCONFIG}"
diff --git a/scripts/ios-release-signing.mts b/scripts/ios-release-signing.mts
new file mode 100644
index 0000000000000000000000000000000000000000..ff0c2f80fa4d4b9dadfeb34690cd96679e58796e
--- /dev/null
+++ b/scripts/ios-release-signing.mts
@@ -0,0 +1,214 @@
+#!/usr/bin/env -S node --import tsx
+import fs from "node:fs";
+import path from "node:path";
+import process from "node:process";
+import { isRecord } from "@openclaw/normalization-core/record-coerce";
+import { parseFlagArgs, stringFlag } from "./lib/arg-utils.mts";
+import { resolveRepoRoot } from "./lib/repo-root.mjs";
+const rootDir = resolveRepoRoot(import.meta.url);
+const defaultManifestPath = path.join(rootDir, "apps", "ios", "Config", "AppStoreSigning.json");
+
+function validateAppGroupId(value: unknown, context: string): asserts value is string {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new Error(`${context} must be a non-empty string.`);
+  }
+  if (!/^group\.[A-Za-z0-9.-]+$/.test(value)) {
+    throw new Error(`${context} must be an Apple app group identifier beginning with group.`);
+  }
+}
+
+function usage() {
+  process.stdout.write(`Usage:
+  node scripts/ios-release-signing.mjs --mode plan
+  node scripts/ios-release-signing.mjs --mode xcconfig
+  node scripts/ios-release-signing.mjs --mode check
+
+Options:
+  --manifest PATH   Signing manifest path. Defaults to apps/ios/Config/AppStoreSigning.json.
+
+Fastlane owns App Store signing setup and encrypted sync. This helper only
+validates the checked-in manifest and renders local release xcconfig settings.
+`);
+}
+
+function parseArgs(argv: string[]) {
+  const options = { manifestPath: defaultManifestPath, mode: "" };
+  const helpIndex = argv.findIndex((arg) => arg === "-h" || arg === "--help");
+  parseFlagArgs(
+    helpIndex === -1 ? argv : argv.slice(0, helpIndex),
+    options,
+    [
+      stringFlag("--mode", "mode", {
+        allowInline: false,
+        missingValueMessage: "Missing value for --mode.",
+        rejectShortOptions: true,
+        repeatable: true,
+      }),
+      stringFlag("--manifest", "manifestPath", {
+        allowInline: false,
+        missingValueMessage: "Missing value for --manifest.",
+        rejectShortOptions: true,
+        repeatable: true,
+        transform: path.resolve,
+      }),
+    ],
+    {
+      ignoreDoubleDash: false,
+      onUnhandledArg(arg) {
+        throw new Error(`Unknown argument: ${arg}`);
+      },
+    },
+  );
+  if (helpIndex !== -1) {
+    usage();
+    process.exit(0);
+  }
+  if (!options.mode) {
+    throw new Error("Missing required --mode.");
+  }
+  return options;
+}
+
+function requireString(value: unknown, message: string) {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new Error(message);
+  }
+  return value;
+}
+
+function readTarget(targetValue: unknown, manifestAppGroupId: string | undefined) {
+  if (!isRecord(targetValue)) {
+    throw new Error("Signing target must be an object.");
+  }
+  const target = {
+    target: requireString(targetValue.target, "Signing target is missing target."),
+    displayName: requireString(targetValue.displayName, "Signing target is missing displayName."),
+    bundleId: requireString(targetValue.bundleId, "Signing target is missing bundleId."),
+    platform: requireString(targetValue.platform, "Signing target is missing platform."),
+    profileKey: requireString(targetValue.profileKey, "Signing target is missing profileKey."),
+    profileName: requireString(targetValue.profileName, "Signing target is missing profileName."),
+  };
+  const capabilities = targetValue.capabilities;
+  if (!Array.isArray(capabilities)) {
+    throw new Error(`Signing target ${target.target} must include capabilities array.`);
+  }
+  if (
+    !capabilities.every(
+      (capability): capability is string =>
+        typeof capability === "string" && capability.trim() !== "",
+    )
+  ) {
+    throw new Error(`Signing target ${target.target} capabilities must be non-empty strings.`);
+  }
+  const rawAppGroups = targetValue.appGroups ?? [];
+  if (!Array.isArray(rawAppGroups)) {
+    throw new Error(`Signing target ${target.target} appGroups must be an array when present.`);
+  }
+  const appGroups = rawAppGroups.map((appGroup) => {
+    validateAppGroupId(appGroup, `Signing target ${target.target} appGroups entry`);
+    return appGroup;
+  });
+
+  const hasAppGroupsCapability = capabilities.includes("APP_GROUPS");
+  if (hasAppGroupsCapability && appGroups.length === 0) {
+    throw new Error(
+      `Signing target ${target.target} must list appGroups when APP_GROUPS is enabled.`,
+    );
+  }
+  if (!hasAppGroupsCapability && appGroups.length > 0) {
+    throw new Error(
+      `Signing target ${target.target} lists appGroups without APP_GROUPS capability.`,
+    );
+  }
+  if (
+    manifestAppGroupId !== undefined &&
+    appGroups.length > 0 &&
+    !appGroups.includes(manifestAppGroupId)
+  ) {
+    throw new Error(`Signing target ${target.target} appGroups must include manifest appGroupId.`);
+  }
+  return { ...target, capabilities, appGroups };
+}
+
+function readManifest(manifestPath: string) {
+  const parsed: unknown = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+  if (!isRecord(parsed)) {
+    throw new Error("Signing manifest must be an object.");
+  }
+  const manifest = {
+    teamId: requireString(parsed.teamId, "Signing manifest missing teamId."),
+    signingRepo: requireString(parsed.signingRepo, "Signing manifest missing signingRepo."),
+    signingBranch: requireString(parsed.signingBranch, "Signing manifest missing signingBranch."),
+    profileType: requireString(parsed.profileType, "Signing manifest missing profileType."),
+  };
+  if (!Array.isArray(parsed.targets) || parsed.targets.length === 0) {
+    throw new Error("Signing manifest must include targets.");
+  }
+  const appGroupId = parsed.appGroupId;
+  if (appGroupId !== undefined) {
+    validateAppGroupId(appGroupId, "Signing manifest appGroupId");
+  }
+  return {
+    ...manifest,
+    appGroupId,
+    targets: parsed.targets.map((target) => readTarget(target, appGroupId)),
+  };
+}
+
+type SigningManifest = ReturnType<typeof readManifest>;
+
+function writeXcconfig(manifest: SigningManifest) {
+  const lines = [
+    "OPENCLAW_CODE_SIGN_STYLE = Manual",
+    "OPENCLAW_CODE_SIGN_IDENTITY = Apple Distribution",
+  ];
+  if (typeof manifest.appGroupId === "string") {
+    lines.push(`OPENCLAW_APP_GROUP_ID = ${manifest.appGroupId}`);
+  }
+
+  for (const target of manifest.targets) {
+    lines.push(`${target.profileKey} = ${target.profileName}`);
+  }
+
+  process.stdout.write(`${lines.join("\n")}\n`);
+}
+
+function writePlan(manifest: SigningManifest) {
+  process.stdout.write(`iOS App Store signing plan
+Team ID: ${manifest.teamId}
+Profile type: ${manifest.profileType}
+Signing repo: ${manifest.signingRepo}
+Signing branch: ${manifest.signingBranch}
+Signing setup and sync: Fastlane match
+
+Targets:
+`);
+  for (const target of manifest.targets) {
+    const capabilities = target.capabilities.length > 0 ? target.capabilities.join(", ") : "none";
+    const appGroups =
+      target.appGroups.length > 0 ? `, app groups: ${target.appGroups.join(", ")}` : "";
+    process.stdout.write(
+      `- ${target.target}: ${target.bundleId}, profile "${target.profileName}", capabilities: ${capabilities}${appGroups}\n`,
+    );
+  }
+}
+
+try {
+  const { mode, manifestPath } = parseArgs(process.argv.slice(2));
+  const manifest = readManifest(manifestPath);
+
+  if (mode === "plan") {
+    writePlan(manifest);
+  } else if (mode === "xcconfig") {
+    writeXcconfig(manifest);
+  } else if (mode === "check") {
+    process.stdout.write(
+      "iOS App Store signing manifest is valid. Fastlane match owns remote signing asset checks.\n",
+    );
+  } else {
+    throw new Error(`Unknown mode: ${mode}`);
+  }
+} catch (error) {
+  process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+  process.exit(1);
+}
diff --git a/scripts/ios-run.sh b/scripts/ios-run.sh
new file mode 100644
index 0000000000000000000000000000000000000000..2739b17de520fa818d53c4e32937289817743d44
--- /dev/null
+++ b/scripts/ios-run.sh
@@ -0,0 +1,163 @@
+#!/bin/bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+IOS_DIR="${ROOT_DIR}/apps/ios"
+
+APP_NAME="${IOS_APP_NAME:-OpenClaw}"
+CONFIGURATION="${IOS_CONFIGURATION:-Debug}"
+DERIVED_DATA_DIR="${IOS_DERIVED_DATA_DIR:-${IOS_DIR}/build/DerivedData}"
+IOS_DESTINATION="${IOS_DEST:-platform=iOS Simulator,name=iPhone 17}"
+SIMULATOR_TARGET="${IOS_SIM:-iPhone 17}"
+
+XCODEBUILD_BIN="${IOS_RUN_XCODEBUILD_BIN:-xcodebuild}"
+XCODEGEN_BIN="${IOS_RUN_XCODEGEN_BIN:-xcodegen}"
+SIMCTL_BIN="${IOS_RUN_SIMCTL_BIN:-xcrun simctl}"
+PLIST_BUDDY_BIN="${IOS_RUN_PLIST_BUDDY_BIN:-/usr/libexec/PlistBuddy}"
+
+usage() {
+  cat <<'EOF'
+Usage: scripts/ios-run.sh [options]
+
+Options:
+  --push-sandbox-simulator
+      Build with the hosted sandbox push relay and launch the simulator with an
+      internal simulator proof secret.
+  --push-relay-base-url <url>
+      Override the sandbox relay URL used with --push-sandbox-simulator.
+      Defaults to https://ios-push-relay-sandbox.openclaw.ai.
+  --simulator-proof-secret-env <name>
+      Environment variable that contains the simulator proof secret.
+      Defaults to OPENCLAW_SIMULATOR_PUSH_PROOF_SECRET.
+  -h, --help
+      Show this help.
+EOF
+}
+
+run_simctl() {
+  # shellcheck disable=SC2086
+  ${SIMCTL_BIN} "$@"
+}
+
+push_sandbox_simulator=0
+push_relay_base_url="${OPENCLAW_PUSH_SANDBOX_RELAY_BASE_URL:-https://ios-push-relay-sandbox.openclaw.ai}"
+simulator_proof_secret_env="${OPENCLAW_SIMULATOR_PUSH_PROOF_SECRET_ENV:-OPENCLAW_SIMULATOR_PUSH_PROOF_SECRET}"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --push-sandbox-simulator)
+      push_sandbox_simulator=1
+      ;;
+    --push-relay-base-url)
+      if [[ $# -lt 2 || -z "$2" ]]; then
+        echo "ERROR: --push-relay-base-url requires a URL" >&2
+        exit 1
+      fi
+      push_relay_base_url="$2"
+      shift
+      ;;
+    --simulator-proof-secret-env)
+      if [[ $# -lt 2 || -z "$2" ]]; then
+        echo "ERROR: --simulator-proof-secret-env requires an environment variable name" >&2
+        exit 1
+      fi
+      simulator_proof_secret_env="$2"
+      shift
+      ;;
+    -h | --help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "ERROR: Unknown argument: $1" >&2
+      usage >&2
+      exit 1
+      ;;
+  esac
+  shift
+done
+
+xcodebuild_overrides=()
+simulator_proof_secret=""
+
+if [[ ! "${simulator_proof_secret_env}" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]]; then
+  echo "ERROR: Invalid simulator proof secret environment variable name" >&2
+  exit 1
+fi
+
+if [[ "${push_sandbox_simulator}" == "1" ]]; then
+  simulator_proof_secret="${!simulator_proof_secret_env:-}"
+  if [[ -z "${simulator_proof_secret}" ]]; then
+    echo "ERROR: ${simulator_proof_secret_env} must be set for --push-sandbox-simulator" >&2
+    exit 1
+  fi
+  if [[ "${#simulator_proof_secret}" -lt 32 ]]; then
+    echo "ERROR: ${simulator_proof_secret_env} must contain at least 32 characters" >&2
+    exit 1
+  fi
+
+  xcodebuild_overrides+=(
+    "OPENCLAW_PUSH_MODE=simulatorSandbox"
+    "OPENCLAW_PUSH_RELAY_BASE_URL=${push_relay_base_url}"
+    "OPENCLAW_APNS_ENTITLEMENT_ENVIRONMENT=development"
+  )
+fi
+
+unset "${simulator_proof_secret_env}"
+if [[ "${simulator_proof_secret_env}" != "OPENCLAW_SIMULATOR_PUSH_PROOF_SECRET" ]]; then
+  unset OPENCLAW_SIMULATOR_PUSH_PROOF_SECRET
+fi
+
+"${ROOT_DIR}/scripts/ios-configure-signing.sh"
+"${ROOT_DIR}/scripts/ios-write-version-xcconfig.sh"
+node "${ROOT_DIR}/scripts/ios-write-swift-filelist.mjs"
+
+cd "${IOS_DIR}"
+"${XCODEGEN_BIN}" generate
+if [[ "${push_sandbox_simulator}" == "1" ]]; then
+  "${XCODEBUILD_BIN}" \
+    -project OpenClaw.xcodeproj \
+    -scheme OpenClaw \
+    -destination "${IOS_DESTINATION}" \
+    -configuration "${CONFIGURATION}" \
+    -derivedDataPath "${DERIVED_DATA_DIR}" \
+    build \
+    "${xcodebuild_overrides[@]}"
+else
+  "${XCODEBUILD_BIN}" \
+    -project OpenClaw.xcodeproj \
+    -scheme OpenClaw \
+    -destination "${IOS_DESTINATION}" \
+    -configuration "${CONFIGURATION}" \
+    -derivedDataPath "${DERIVED_DATA_DIR}" \
+    build
+fi
+
+app_path="${DERIVED_DATA_DIR}/Build/Products/${CONFIGURATION}-iphonesimulator/${APP_NAME}.app"
+if [[ ! -d "${app_path}" ]]; then
+  echo "ERROR: Built app not found at ${app_path}" >&2
+  exit 1
+fi
+
+bundle_id="$("${PLIST_BUDDY_BIN}" -c 'Print :CFBundleIdentifier' "${app_path}/Info.plist" 2>/dev/null || true)"
+if [[ -z "${bundle_id}" ]]; then
+  echo "ERROR: Built app is missing CFBundleIdentifier: ${app_path}/Info.plist" >&2
+  exit 1
+fi
+
+boot_output=""
+if ! boot_output="$(run_simctl boot "${SIMULATOR_TARGET}" 2>&1)"; then
+  if [[ "${boot_output}" != *"Unable to boot device in current state: Booted"* ]]; then
+    printf '%s\n' "${boot_output}" >&2
+    exit 1
+  fi
+fi
+
+run_simctl install "${SIMULATOR_TARGET}" "${app_path}"
+if [[ "${push_sandbox_simulator}" == "1" ]]; then
+  # shellcheck disable=SC2086
+  SIMCTL_CHILD_OPENCLAW_SIMULATOR_PUSH_PROOF_SECRET="${simulator_proof_secret}" \
+    ${SIMCTL_BIN} launch "${SIMULATOR_TARGET}" "${bundle_id}"
+else
+  run_simctl launch "${SIMULATOR_TARGET}" "${bundle_id}"
+fi
diff --git a/scripts/live-docker-normalize-config.ts b/scripts/live-docker-normalize-config.ts
new file mode 100644
index 0000000000000000000000000000000000000000..84e142c9e9eb032d14264c10d7b837073955c8b1
--- /dev/null
+++ b/scripts/live-docker-normalize-config.ts
@@ -0,0 +1,16 @@
+// Live Docker Normalize Config script supports OpenClaw repository automation.
+import { loadAndMaybeMigrateDoctorConfig } from "../src/commands/doctor-config-flow.js";
+import { replaceConfigFile } from "../src/config/config.js";
+
+const result = await loadAndMaybeMigrateDoctorConfig({
+  options: {
+    nonInteractive: true,
+    repair: true,
+    yes: true,
+  },
+  confirm: async () => false,
+});
+
+if (result.shouldWriteConfig) {
+  await replaceConfigFile({ nextConfig: result.cfg });
+}
diff --git a/scripts/live-docker-stage-private-sdk-exports.mjs b/scripts/live-docker-stage-private-sdk-exports.mjs
new file mode 100644
index 0000000000000000000000000000000000000000..38e36debb8a480d55a3c8ad4d760650457e07b9a
--- /dev/null
+++ b/scripts/live-docker-stage-private-sdk-exports.mjs
@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const PRIVATE_SUBPATH_PATTERN = /^[a-z0-9][a-z0-9-]*$/u;
+
+export function addStagedPrivatePluginSdkExports(repoRoot) {
+  const packagePath = path.join(repoRoot, "package.json");
+  const privateSubpathsPath = path.join(
+    repoRoot,
+    "scripts",
+    "lib",
+    "plugin-sdk-private-local-only-subpaths.json",
+  );
+  const packageJson = JSON.parse(fs.readFileSync(packagePath, "utf8"));
+  const privateSubpaths = JSON.parse(fs.readFileSync(privateSubpathsPath, "utf8"));
+
+  if (!packageJson.exports || typeof packageJson.exports !== "object") {
+    throw new Error("staged package.json must define object exports");
+  }
+  if (!Array.isArray(privateSubpaths)) {
+    throw new Error("private plugin SDK subpaths must be an array");
+  }
+
+  for (const subpath of privateSubpaths) {
+    if (typeof subpath !== "string" || !PRIVATE_SUBPATH_PATTERN.test(subpath)) {
+      throw new Error(`invalid private plugin SDK subpath: ${String(subpath)}`);
+    }
+    const sourcePath = `./src/plugin-sdk/${subpath}.ts`;
+    if (!fs.existsSync(path.join(repoRoot, sourcePath))) {
+      throw new Error(`missing private plugin SDK source: ${sourcePath}`);
+    }
+    packageJson.exports[`./plugin-sdk/${subpath}`] ??= {
+      types: sourcePath,
+      default: sourcePath,
+    };
+  }
+
+  fs.writeFileSync(packagePath, `${JSON.stringify(packageJson, null, 2)}\n`, "utf8");
+}
+
+const invokedPath = process.argv[1] ? path.resolve(process.argv[1]) : undefined;
+if (invokedPath === fileURLToPath(import.meta.url)) {
+  addStagedPrivatePluginSdkExports(path.resolve(process.argv[2] ?? "."));
+}
diff --git a/scripts/load-channel-config-surface.ts b/scripts/load-channel-config-surface.ts
new file mode 100644
index 0000000000000000000000000000000000000000..b9238bcdcdd1c6f672b4b21cfd5f555e55999594
--- /dev/null
+++ b/scripts/load-channel-config-surface.ts
@@ -0,0 +1,81 @@
+// Load Channel Config Surface script supports OpenClaw repository automation.
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { createJiti } from "jiti";
+import { buildChannelConfigSchema } from "../src/channels/plugins/config-schema.js";
+import {
+  buildPluginLoaderAliasMap,
+  buildPluginLoaderJitiOptions,
+} from "../src/plugins/sdk-alias.js";
+
+function isBuiltChannelConfigSchema(
+  value: unknown,
+): value is { schema: Record<string, unknown>; uiHints?: Record<string, unknown> } {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  const candidate = value as { schema?: unknown };
+  return Boolean(candidate.schema && typeof candidate.schema === "object");
+}
+
+function resolveConfigSchemaExport(
+  imported: Record<string, unknown>,
+): { schema: Record<string, unknown>; uiHints?: Record<string, unknown> } | null {
+  for (const [name, value] of Object.entries(imported)) {
+    if (name.endsWith("ChannelConfigSchema") && isBuiltChannelConfigSchema(value)) {
+      return value;
+    }
+  }
+
+  for (const [name, value] of Object.entries(imported)) {
+    if (!name.endsWith("ConfigSchema") || name.endsWith("AccountConfigSchema")) {
+      continue;
+    }
+    if (isBuiltChannelConfigSchema(value)) {
+      return value;
+    }
+    if (value && typeof value === "object") {
+      return buildChannelConfigSchema(value as never);
+    }
+  }
+
+  for (const value of Object.values(imported)) {
+    if (isBuiltChannelConfigSchema(value)) {
+      return value;
+    }
+  }
+
+  return null;
+}
+
+export async function loadChannelConfigSurfaceModule(
+  modulePath: string,
+): Promise<{ schema: Record<string, unknown>; uiHints?: Record<string, unknown> } | null> {
+  const resolvedPath = path.resolve(modulePath);
+  const aliasMap = buildPluginLoaderAliasMap(resolvedPath, "", undefined, "src");
+  // Jiti 2.7 passes Windows drive paths raw to import(); use its source loader there.
+  // Disabled caches keep generation source-current.
+  const jiti = createJiti(import.meta.url, {
+    ...buildPluginLoaderJitiOptions(aliasMap),
+    tryNative: process.platform !== "win32",
+    moduleCache: false,
+    fsCache: false,
+  });
+  const imported = await jiti.import<Record<string, unknown>>(resolvedPath);
+  return resolveConfigSchemaExport(imported);
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+  const modulePath = process.argv[2]?.trim();
+  if (!modulePath) {
+    process.exit(2);
+  }
+
+  const resolved = await loadChannelConfigSurfaceModule(modulePath);
+  if (!resolved) {
+    process.exit(3);
+  }
+
+  process.stdout.write(JSON.stringify(resolved));
+  process.exit(0);
+}
diff --git a/scripts/mcp-code-mode-gateway-e2e.ts b/scripts/mcp-code-mode-gateway-e2e.ts
new file mode 100644
index 0000000000000000000000000000000000000000..0b3349d78aa3c5707c02118b6eed86cd1e501bfe
--- /dev/null
+++ b/scripts/mcp-code-mode-gateway-e2e.ts
@@ -0,0 +1,290 @@
+// Mcp Code Mode Gateway E2E script supports OpenClaw repository automation.
+import fs from "node:fs/promises";
+import net from "node:net";
+import os from "node:os";
+import path from "node:path";
+import process from "node:process";
+import { setTimeout as setNodeTimeout, clearTimeout as clearNodeTimeout } from "node:timers";
+import { pathToFileURL } from "node:url";
+import { startQaMockOpenAiServer } from "../extensions/qa-lab/src/providers/mock-openai/server.js";
+import {
+  qaMockRequestCursorUrl,
+  qaMockRequestsAfterUrl,
+  readQaMockRequestCursor,
+} from "../extensions/qa-lab/src/providers/shared/debug-request-cursor.js";
+import { stageQaMockAuthProfiles } from "../extensions/qa-lab/src/providers/shared/mock-auth.js";
+import { buildQaGatewayConfig } from "../extensions/qa-lab/src/qa-gateway-config.js";
+import { resetConfigRuntimeState } from "../src/config/config.js";
+import { startGatewayServer } from "../src/gateway/server.js";
+import { deleteTestEnvValue, setTestEnvValue } from "../src/test-utils/env.js";
+import { writeProbeMcpServer } from "./e2e/lib/mcp-code-mode-probe-server.ts";
+import {
+  type McpCodeModeMentions,
+  validateMcpCodeModeResult,
+} from "./e2e/lib/mcp-code-mode-validation.ts";
+import { countSessionLogMentions } from "./e2e/lib/session-log-mentions.ts";
+import { readBoundedResponseText } from "./lib/bounded-response.mjs";
+
+async function freePort(): Promise<number> {
+  return await new Promise((resolve, reject) => {
+    const server = net.createServer();
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      const port = typeof address === "object" && address ? address.port : 0;
+      server.close((error) => (error ? reject(error) : resolve(port)));
+    });
+  });
+}
+
+async function fetchJson(url: string, init: RequestInit = {}): Promise<unknown> {
+  const timeoutMs = 180_000;
+  const controller = new AbortController();
+  let timeout: ReturnType<typeof setNodeTimeout> | undefined;
+  const timeoutPromise = new Promise<never>((_, reject) => {
+    timeout = setNodeTimeout(() => {
+      const error = Object.assign(new Error(`HTTP request to ${url} timed out`), {
+        code: "ETIMEDOUT",
+      });
+      controller.abort(error);
+      reject(error);
+    }, timeoutMs);
+  });
+  try {
+    const response = await Promise.race([
+      fetch(url, { ...init, signal: controller.signal }),
+      timeoutPromise,
+    ]);
+    const text = await readBoundedResponseText(response, url, 1024 * 1024, {
+      createTooLargeError(message: string) {
+        return Object.assign(new Error(message), { code: "ETOOBIG" });
+      },
+      formatTooLargeMessage(targetUrl: string, byteLimit: number) {
+        return `HTTP response from ${targetUrl} exceeded ${byteLimit} bytes`;
+      },
+      timeoutPromise,
+      signal: controller.signal,
+    });
+    if (!response.ok) {
+      throw new Error(`HTTP ${response.status} from ${url}: ${text}`);
+    }
+    return text ? JSON.parse(text) : {};
+  } finally {
+    if (timeout) {
+      clearNodeTimeout(timeout);
+    }
+  }
+}
+
+async function readSessionLogMentions(stateDir: string): Promise<Record<string, number>> {
+  const sessionsDir = path.join(stateDir, "agents", "qa", "sessions");
+  return await countSessionLogMentions({
+    sessionsDir,
+    needles: {
+      apiCall: "MCP.$api",
+      apiFileList: "API.list",
+      apiFileRead: "API.read",
+      mcpNamespace: "MCP.fixture",
+      mcpTool: "MCP.fixture.lookupNote",
+      toolSearchPollution: 'catalog.search("lookup note"',
+    },
+  });
+}
+
+function restoreEnvValue(key: string, value: string | undefined): void {
+  if (value === undefined) {
+    deleteTestEnvValue(key);
+  } else {
+    setTestEnvValue(key, value);
+  }
+}
+
+async function writeConfig(params: {
+  configPath: string;
+  stateDir: string;
+  workspaceDir: string;
+  gatewayPort: number;
+  providerBaseUrl: string;
+  serverPath: string;
+}) {
+  let cfg = buildQaGatewayConfig({
+    bind: "loopback",
+    gatewayPort: params.gatewayPort,
+    gatewayToken: "mcp-code-mode-e2e",
+    providerBaseUrl: `${params.providerBaseUrl}/v1`,
+    workspaceDir: params.workspaceDir,
+    controlUiEnabled: false,
+    providerMode: "mock-openai",
+  });
+  cfg = {
+    ...cfg,
+    plugins: {
+      ...cfg.plugins,
+      slots: {
+        ...cfg.plugins?.slots,
+        memory: "none",
+      },
+    },
+    memory: {
+      ...cfg.memory,
+      search: {
+        ...cfg.memory?.search,
+        enabled: false,
+      },
+    },
+    tools: {
+      ...cfg.tools,
+      alsoAllow: [...new Set([...(cfg.tools?.alsoAllow ?? []), "bundle-mcp"])],
+      codeMode: {
+        enabled: true,
+        timeoutMs: 20_000,
+        maxPendingToolCalls: 16,
+      },
+    },
+    mcp: {
+      servers: {
+        fixture: {
+          command: "node",
+          args: [params.serverPath],
+          cwd: path.dirname(params.serverPath),
+          connectionTimeoutMs: 30_000,
+        },
+      },
+    },
+    gateway: {
+      ...cfg.gateway,
+      http: {
+        endpoints: {
+          responses: {
+            enabled: true,
+          },
+        },
+      },
+    },
+  };
+  cfg = await stageQaMockAuthProfiles({
+    cfg,
+    stateDir: params.stateDir,
+    agentIds: ["qa"],
+    providers: ["mock-openai", "openai", "anthropic"],
+  });
+  await fs.mkdir(path.dirname(params.configPath), { recursive: true });
+  await fs.writeFile(params.configPath, `${JSON.stringify(cfg, null, 2)}\n`, "utf8");
+}
+
+async function main() {
+  const rootDir = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-mcp-code-mode-"));
+  const keep = process.env.OPENCLAW_MCP_CODE_MODE_GATEWAY_E2E_KEEP === "1";
+  const previousEnv = {
+    configPath: process.env.OPENCLAW_CONFIG_PATH,
+    stateDir: process.env.OPENCLAW_STATE_DIR,
+    testFast: process.env.OPENCLAW_TEST_FAST,
+  };
+  let provider: Awaited<ReturnType<typeof startQaMockOpenAiServer>> | undefined;
+  let server: Awaited<ReturnType<typeof startGatewayServer>> | undefined;
+  try {
+    provider = await startQaMockOpenAiServer();
+    const stateDir = path.join(rootDir, "state");
+    const workspaceDir = path.join(rootDir, "workspace");
+    const serverPath = path.join(rootDir, "mcp", "fixture-server.mjs");
+    const configPath = path.join(stateDir, "openclaw.json");
+    const gatewayPort = await freePort();
+    await fs.mkdir(workspaceDir, { recursive: true });
+    await writeProbeMcpServer(serverPath);
+    await writeConfig({
+      configPath,
+      stateDir,
+      workspaceDir,
+      gatewayPort,
+      providerBaseUrl: provider.baseUrl,
+      serverPath,
+    });
+
+    setTestEnvValue("OPENCLAW_STATE_DIR", stateDir);
+    setTestEnvValue("OPENCLAW_CONFIG_PATH", configPath);
+    setTestEnvValue("OPENCLAW_TEST_FAST", "1");
+    resetConfigRuntimeState();
+
+    server = await startGatewayServer(gatewayPort, {
+      host: "127.0.0.1",
+      auth: { mode: "none" },
+      controlUiEnabled: false,
+      openResponsesEnabled: true,
+    });
+
+    const requestCursorBefore = readQaMockRequestCursor(
+      await fetchJson(qaMockRequestCursorUrl(provider.baseUrl)),
+    );
+    const response = await fetchJson(`http://127.0.0.1:${gatewayPort}/v1/responses`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "x-openclaw-scopes": "operator.write",
+        "x-openclaw-agent": "qa",
+      },
+      body: JSON.stringify({
+        model: "openclaw/qa",
+        input: [
+          {
+            type: "message",
+            role: "user",
+            content: [
+              {
+                type: "input_text",
+                text: "mcp code mode api file qa check: inspect the MCP TypeScript declaration files through API.read, call the fixture lookup_note tool for alpha, and return the note text plus what was unclear.",
+              },
+            ],
+          },
+        ],
+        max_output_tokens: 256,
+        stream: false,
+      }),
+    });
+    const laneRequests = (await fetchJson(
+      qaMockRequestsAfterUrl(provider.baseUrl, requestCursorBefore),
+    )) as Array<{
+      raw?: string;
+      body?: { tools?: unknown[] };
+      plannedToolName?: string;
+    }>;
+    const firstRequest = laneRequests[0] ?? {};
+    const mentions = await readSessionLogMentions(stateDir);
+    const plannedTools = laneRequests
+      .map((request) => request.plannedToolName)
+      .filter((name): name is string => typeof name === "string");
+    const finalText = validateMcpCodeModeResult(response, mentions as McpCodeModeMentions, {
+      plannedTools,
+      requireExec: true,
+    });
+
+    const summary = {
+      ok: true,
+      rootDir,
+      stateDir,
+      gatewayUrl: `http://127.0.0.1:${gatewayPort}`,
+      finalText,
+      providerRequestCount: laneRequests.length,
+      providerDeclaredToolCount: Array.isArray(firstRequest.body?.tools)
+        ? firstRequest.body.tools.length
+        : 0,
+      providerRawBytes: typeof firstRequest.raw === "string" ? firstRequest.raw.length : 0,
+      plannedTools,
+      sessionLogMentions: mentions,
+    };
+    process.stdout.write(`${JSON.stringify(summary, null, 2)}\n`);
+  } finally {
+    await server?.close({ reason: "mcp code-mode gateway e2e complete" });
+    await provider?.stop();
+    resetConfigRuntimeState();
+    restoreEnvValue("OPENCLAW_STATE_DIR", previousEnv.stateDir);
+    restoreEnvValue("OPENCLAW_CONFIG_PATH", previousEnv.configPath);
+    restoreEnvValue("OPENCLAW_TEST_FAST", previousEnv.testFast);
+    if (!keep) {
+      await fs.rm(rootDir, { recursive: true, force: true });
+    }
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  await main();
+}
diff --git a/scripts/npm-package-locks-report.mts b/scripts/npm-package-locks-report.mts
new file mode 100644
index 0000000000000000000000000000000000000000..8dec5375f81dfd0501cfec5c2634bb42b6fd20e1
--- /dev/null
+++ b/scripts/npm-package-locks-report.mts
@@ -0,0 +1,211 @@
+#!/usr/bin/env node
+
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import {
+  generateNpmPackageLocks,
+  listManagedNpmLockPackageDirs,
+  resolveNpmLockJobs,
+} from "./generate-npm-package-lock.mts";
+import { parseFlagArgs, stringFlag } from "./lib/arg-utils.mts";
+import { isRecord } from "./lib/record-shared.mjs";
+import { REPORT_CLI_PARSE_OPTIONS, writeReportArtifact } from "./lib/report-cli-helpers.mts";
+
+function sha256(bytes: string | Buffer) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+
+async function readPackage(rootDir: string, packageDir: string) {
+  const manifest: unknown = JSON.parse(
+    await readFile(path.join(rootDir, packageDir, "package.json"), "utf8"),
+  );
+  if (
+    !isRecord(manifest) ||
+    typeof manifest.name !== "string" ||
+    !manifest.name ||
+    typeof manifest.version !== "string" ||
+    !manifest.version
+  ) {
+    throw new Error(`${packageDir}: expected package name and version`);
+  }
+  const release = isRecord(manifest.openclaw) ? manifest.openclaw.release : undefined;
+  const dependencies = isRecord(manifest.dependencies) ? manifest.dependencies : {};
+  const optionalDependencies = isRecord(manifest.optionalDependencies)
+    ? manifest.optionalDependencies
+    : {};
+  const omittedWorkspaceDependencies = [
+    ...new Set(
+      [...Object.entries(dependencies), ...Object.entries(optionalDependencies)]
+        .filter(([, spec]) => typeof spec === "string" && spec.startsWith("workspace:"))
+        .map(([name]) => name),
+    ),
+  ].toSorted((left, right) => left.localeCompare(right));
+  return {
+    packageDir,
+    name: manifest.name,
+    version: manifest.version,
+    bundleRuntimeDependencies:
+      packageDir !== "." && !(isRecord(release) && release.bundleRuntimeDependencies === false),
+    dependencyCount: Object.keys(dependencies).length,
+    optionalDependencyCount: Object.keys(optionalDependencies).length,
+    omittedWorkspaceDependencies,
+  };
+}
+
+function validateLock(text: string, entry: Awaited<ReturnType<typeof readPackage>>) {
+  const lock: unknown = JSON.parse(text);
+  if (
+    !isRecord(lock) ||
+    lock.lockfileVersion !== 3 ||
+    lock.name !== entry.name ||
+    lock.version !== entry.version ||
+    !isRecord(lock.packages)
+  ) {
+    throw new Error(
+      `${entry.packageDir}: expected a version 3 npm lock for ${entry.name}@${entry.version}`,
+    );
+  }
+  const root = lock.packages[""];
+  if (!isRecord(root) || root.name !== entry.name || root.version !== entry.version) {
+    throw new Error(`${entry.packageDir}: npm lock root identity mismatch`);
+  }
+  for (const name of entry.omittedWorkspaceDependencies) {
+    if (Object.hasOwn(lock.packages, `node_modules/${name}`)) {
+      throw new Error(
+        `${entry.packageDir}: npm lock contains omitted workspace dependency ${name}`,
+      );
+    }
+  }
+  for (const [lockPath, metadata] of Object.entries(lock.packages)) {
+    if (
+      !isRecord(metadata) ||
+      metadata.dev === true ||
+      metadata.link === true ||
+      (typeof metadata.resolved === "string" &&
+        /^(?:file:|workspace:|git\+|git:|ssh:|https:\/\/github\.com\/)/iu.test(
+          metadata.resolved,
+        )) ||
+      (lockPath !== "" &&
+        (typeof metadata.resolved !== "string" ||
+          !metadata.resolved ||
+          typeof metadata.integrity !== "string" ||
+          !metadata.integrity))
+    ) {
+      throw new Error(`${entry.packageDir}: unsupported npm lock entry ${lockPath || "<root>"}`);
+    }
+  }
+  return lock;
+}
+
+export async function generateNpmPackageLocksReport({
+  rootDir: sourceRoot = process.cwd(),
+  jobs = resolveNpmLockJobs(undefined),
+}: { rootDir?: string; jobs?: number } = {}) {
+  const rootDir = path.resolve(sourceRoot);
+  const sourceSha = execFileSync("git", ["rev-parse", "HEAD"], {
+    cwd: rootDir,
+    encoding: "utf8",
+  }).trim();
+  if (!/^[a-f0-9]{40}$/u.test(sourceSha)) {
+    throw new Error("Expected the source root's full Git commit SHA");
+  }
+  const pnpmLockSha256 = sha256(await readFile(path.join(rootDir, "pnpm-lock.yaml")));
+  const manifests = await Promise.all(
+    [".", ...listManagedNpmLockPackageDirs(rootDir)].map((dir) => readPackage(rootDir, dir)),
+  );
+  const entries = manifests.filter(
+    (entry) =>
+      entry.packageDir === "." || entry.dependencyCount + entry.optionalDependencyCount > 0,
+  );
+  const locks = await generateNpmPackageLocks({
+    rootDir,
+    jobs: resolveNpmLockJobs(jobs),
+    packageDirs: entries.map((entry) => path.join(rootDir, entry.packageDir)),
+  });
+  return {
+    schemaVersion: 1,
+    generatedAt: new Date().toISOString(),
+    generator: "scripts/npm-package-locks-report.mts",
+    sourceSha,
+    packageVersion: manifests[0]!.version,
+    pnpmLockSha256,
+    lockfileVersion: 3,
+    packagesWithOmittedWorkspaceDependencies: entries.filter(
+      (entry) => entry.omittedWorkspaceDependencies.length > 0,
+    ).length,
+    packages: entries.map((entry, index) => {
+      const lock = validateLock(locks[index]!, entry);
+      return Object.assign(entry, {
+        lockSha256: sha256(`${JSON.stringify(lock, null, 2)}\n`),
+        lock,
+      });
+    }),
+  };
+}
+
+type NpmPackageLocksReport = Awaited<ReturnType<typeof generateNpmPackageLocksReport>>;
+
+function renderMarkdown(report: NpmPackageLocksReport) {
+  return `${[
+    "# npm package-lock mirrors",
+    "",
+    `Source: \`${report.sourceSha}\` (OpenClaw ${report.packageVersion}).`,
+    `pnpm lock SHA-256: \`${report.pnpmLockSha256}\`.`,
+    "",
+    `Total packages: ${report.packages.length}`,
+    `Lockless packages (bundleRuntimeDependencies=false): ${report.packages.filter((entry) => !entry.bundleRuntimeDependencies).length}`,
+    `Partial locks (omitted workspace dependencies): ${report.packagesWithOmittedWorkspaceDependencies}`,
+    "",
+    "Entries with non-empty omittedWorkspaceDependencies are partial locks: sibling workspace packages publish in the same release and are omitted by the generator. Consumers must reject these entries instead of installing them.",
+    "Select the exact name and version in npm-package-locks.json, require an empty omittedWorkspaceDependencies array, and write entry.lock as package-lock.json.",
+    "Verify dependency-evidence-manifest.json releaseSha equals sourceSha and the OpenClaw commit you pin.",
+    "These generated locks are release evidence only and are never included in npm tarballs.",
+    "",
+    "| Package directory | Name | Version | Bundles runtime dependencies | Dependencies | Optional dependencies | Omitted workspace dependencies |",
+    "| --- | --- | --- | --- | --- | --- | --- |",
+    ...report.packages.map(
+      (entry) =>
+        `| ${entry.packageDir} | ${entry.name} | ${entry.version} | ${entry.bundleRuntimeDependencies} | ${entry.dependencyCount} | ${entry.optionalDependencyCount} | ${entry.omittedWorkspaceDependencies.length > 0 ? `Partial: ${entry.omittedWorkspaceDependencies.join(", ")}` : "None"} |`,
+    ),
+  ].join("\n")}\n`;
+}
+
+async function main(argv = process.argv.slice(2)) {
+  const options: {
+    rootDir: string;
+    jsonPath: string | null;
+    markdownPath: string | null;
+    jobs: string | null;
+  } = { rootDir: process.cwd(), jsonPath: null, markdownPath: null, jobs: null };
+  const flags = [
+    ["--root", "rootDir"],
+    ["--json", "jsonPath"],
+    ["--markdown", "markdownPath"],
+    ["--jobs", "jobs"],
+  ] satisfies Array<[string, keyof typeof options]>;
+  const parsed = parseFlagArgs(
+    argv,
+    options,
+    flags.map(([flag, key]) =>
+      stringFlag(flag, key, { allowInline: false, rejectShortOptions: true }),
+    ),
+    REPORT_CLI_PARSE_OPTIONS,
+  );
+  const report = await generateNpmPackageLocksReport({
+    rootDir: parsed.rootDir,
+    jobs: resolveNpmLockJobs(parsed.jobs),
+  });
+  const markdown = renderMarkdown(report);
+  await writeReportArtifact(parsed.jsonPath, `${JSON.stringify(report, null, 2)}\n`);
+  await writeReportArtifact(parsed.markdownPath, markdown);
+  process.stdout.write(markdown);
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === path.resolve(import.meta.filename)) {
+  main().catch((error: unknown) => {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+  });
+}
diff --git a/scripts/openclaw-prepack.ts b/scripts/openclaw-prepack.ts
new file mode 100644
index 0000000000000000000000000000000000000000..96a588f6eebe88eb9cb07de6c9c251e3c9eec4bd
--- /dev/null
+++ b/scripts/openclaw-prepack.ts
@@ -0,0 +1,316 @@
+#!/usr/bin/env -S node --import tsx
+// Openclaw Prepack script supports OpenClaw repository automation.
+
+import { spawnSync, type SpawnSyncOptions } from "node:child_process";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { basename, delimiter, join } from "node:path";
+import { pathToFileURL } from "node:url";
+import { formatErrorMessage } from "../src/infra/errors.ts";
+import { readCurrentGitCommit, resolveBuildIdentityEnvironment } from "./lib/build-identity.mts";
+import { readPositiveEnvInt } from "./lib/numeric-options.mjs";
+import { writePackageDistInventoryForPublish } from "./lib/package-dist-inventory.ts";
+import { restorePrepackArtifacts } from "./openclaw-postpack.mjs";
+import { preparePackageChangelog } from "./package-changelog.mjs";
+import { preparePackageDocsMap } from "./package-docs-map.mjs";
+import { preparePackageManifest } from "./package-manifest.mjs";
+import { createPnpmRunnerSpawnSpec } from "./pnpm-runner.mts";
+const requiredPreparedPathGroups = [
+  ["dist/index.js", "dist/index.mjs"],
+  ["dist/control-ui/index.html"],
+];
+const requiredControlUiAssetPrefix = "dist/control-ui/assets/";
+const requiredControlUiCompressionSuffixes = [".br", ".gz"] as const;
+const DEFAULT_PREPACK_COMMAND_TIMEOUT_MS = 30 * 60 * 1000;
+const ALLOW_UNRELEASED_CHANGELOG_ENV = "OPENCLAW_PREPACK_ALLOW_UNRELEASED_CHANGELOG";
+const PREPARED_RELEASE_ENV = "OPENCLAW_PREPACK_PREPARED";
+const OCM_INTERNAL_NPM_BIN_ENV = "OCM_INTERNAL_NPM_BIN";
+const OCM_WORKSPACE_DIRS_ENV = "OPENCLAW_OCM_WORKSPACE_DEPENDENCY_DIRS";
+const OCM_ADAPTER_BASENAME = "ocm-npm-workspace-deps.mts";
+const NPM_COMMAND_ENV = "npm_command";
+const SELF_CONTAINED_SOURCE_PACK_COMMAND =
+  "node scripts/package-openclaw-for-docker.mjs --allow-unreleased-changelog";
+
+type PreparedFileReader = {
+  existsSync: typeof existsSync;
+  readdirSync: typeof readdirSync;
+};
+
+type PackageManifest = {
+  dependencies?: Record<string, unknown>;
+  name?: unknown;
+};
+
+function ocmExternalizesWorkspacePackage(packageName: string, env: NodeJS.ProcessEnv): boolean {
+  if (env[NPM_COMMAND_ENV] !== "pack") {
+    return false;
+  }
+  const adapterPath = env[OCM_INTERNAL_NPM_BIN_ENV]?.trim();
+  if (!adapterPath || basename(adapterPath) !== OCM_ADAPTER_BASENAME) {
+    return false;
+  }
+  const workspaceDirs = (env[OCM_WORKSPACE_DIRS_ENV] ?? "")
+    .split(delimiter)
+    .map((entry) => entry.trim())
+    .filter(Boolean);
+  // OCM uses these same manifests to pack and install dependencies beside the root archive.
+  // Require the exact package here so unrelated ambient paths cannot bypass the plain-pack guard.
+  return workspaceDirs.some((workspaceDir) => {
+    try {
+      const manifest = JSON.parse(
+        readFileSync(join(workspaceDir, "package.json"), "utf8"),
+      ) as PackageManifest;
+      return manifest.name === packageName;
+    } catch {
+      return false;
+    }
+  });
+}
+
+function normalizeFiles(files: Iterable<string>): Set<string> {
+  return new Set(Array.from(files, (file) => file.replace(/\\/g, "/")));
+}
+
+export function collectSourcePackWorkspaceDependencyErrors(
+  packageJson: PackageManifest,
+  env: NodeJS.ProcessEnv = process.env,
+): string[] {
+  if (env[PREPARED_RELEASE_ENV]?.trim() === "1") {
+    return [];
+  }
+  const aiDependency = packageJson.dependencies?.["@openclaw/ai"];
+  if (typeof aiDependency !== "string" || !aiDependency.trim().startsWith("workspace:")) {
+    return [];
+  }
+  if (ocmExternalizesWorkspacePackage("@openclaw/ai", env)) {
+    return [];
+  }
+  return [
+    `plain root packing cannot safely resolve @openclaw/ai from ${aiDependency}: pnpm rewrites the workspace dependency to an exact version without bundling the package`,
+    `use \`${SELF_CONTAINED_SOURCE_PACK_COMMAND}\` for a self-contained source package; official npm release automation prepares and publishes @openclaw/ai separately`,
+  ];
+}
+
+function ensureSupportedSourcePack(env: NodeJS.ProcessEnv = process.env): void {
+  const packageJson = JSON.parse(readFileSync("package.json", "utf8")) as PackageManifest;
+  const errors = collectSourcePackWorkspaceDependencyErrors(packageJson, env);
+  if (errors.length === 0) {
+    return;
+  }
+  for (const error of errors) {
+    console.error(`prepack: ${error}`);
+  }
+  process.exit(1);
+}
+
+export function collectPreparedPrepackErrors(
+  files: Iterable<string>,
+  assetPaths: Iterable<string>,
+): string[] {
+  const normalizedFiles = normalizeFiles(files);
+  const normalizedAssets = normalizeFiles(assetPaths);
+  const errors: string[] = [];
+
+  for (const group of requiredPreparedPathGroups) {
+    if (group.some((path) => normalizedFiles.has(path))) {
+      continue;
+    }
+    errors.push(`missing required prepared artifact: ${group.join(" or ")}`);
+  }
+
+  if (!normalizedAssets.values().next().done) {
+    for (const suffix of requiredControlUiCompressionSuffixes) {
+      if (!Array.from(normalizedAssets).some((assetPath) => assetPath.endsWith(suffix))) {
+        errors.push(
+          `missing prepared Control UI ${suffix} asset under ${requiredControlUiAssetPrefix}`,
+        );
+      }
+    }
+    return errors;
+  }
+
+  errors.push(`missing prepared Control UI asset payload under ${requiredControlUiAssetPrefix}`);
+  return errors;
+}
+
+function collectPreparedFilePaths(reader: PreparedFileReader = { existsSync, readdirSync }): {
+  files: Set<string>;
+  assets: string[];
+} {
+  const assets = reader
+    .readdirSync("dist/control-ui/assets", { withFileTypes: true })
+    .flatMap((entry) =>
+      entry.isDirectory() ? [] : [`${requiredControlUiAssetPrefix}${entry.name}`],
+    );
+
+  const files = new Set<string>();
+  for (const group of requiredPreparedPathGroups) {
+    for (const path of group) {
+      if (reader.existsSync(path)) {
+        files.add(path);
+      }
+    }
+  }
+
+  return {
+    files,
+    assets,
+  };
+}
+
+function ensurePreparedArtifacts(): void {
+  try {
+    const preparedFiles = collectPreparedFilePaths();
+    const errors = collectPreparedPrepackErrors(preparedFiles.files, preparedFiles.assets);
+    if (errors.length === 0) {
+      console.error("prepack: using existing prepared artifacts.");
+      return;
+    }
+    for (const error of errors) {
+      console.error(`prepack: ${error}`);
+    }
+  } catch (error) {
+    const message = formatErrorMessage(error);
+    console.error(`prepack: failed to verify prepared artifacts: ${message}`);
+  }
+
+  console.error(
+    "prepack: requires an existing build and Control UI bundle. Run `pnpm build && pnpm ui:build` before packing or publishing.",
+  );
+  process.exit(1);
+}
+
+export function resolvePrepackCommandTimeoutMs(env: NodeJS.ProcessEnv = process.env): number {
+  return readPositiveEnvInt(
+    "OPENCLAW_PREPACK_COMMAND_TIMEOUT_MS",
+    env,
+    DEFAULT_PREPACK_COMMAND_TIMEOUT_MS,
+  );
+}
+
+export function resolvePrepackAllowUnreleasedChangelog(
+  env: NodeJS.ProcessEnv = process.env,
+): boolean {
+  const raw = env[ALLOW_UNRELEASED_CHANGELOG_ENV]?.trim();
+  if (raw === undefined || raw === "" || raw === "0" || raw === "false") {
+    return false;
+  }
+  if (raw === "1" || raw === "true") {
+    return true;
+  }
+  throw new Error(`invalid ${ALLOW_UNRELEASED_CHANGELOG_ENV}: ${raw}`);
+}
+
+export function resolvePrepackCommandStdio(
+  options: SpawnSyncOptions,
+  env: NodeJS.ProcessEnv = process.env,
+): SpawnSyncOptions["stdio"] {
+  const requestedStdio = options.stdio ?? "inherit";
+  const npmJsonOutput = env.npm_config_json === "true" || env.npm_config_json === "1";
+  if (npmJsonOutput && requestedStdio === "inherit") {
+    return ["inherit", 2, "inherit"];
+  }
+  return requestedStdio;
+}
+
+export function runPrepackCommand(
+  command: string,
+  args: string[],
+  options: SpawnSyncOptions = {},
+): ReturnType<typeof spawnSync> {
+  const env = options.env ?? process.env;
+  return spawnSync(command, args, {
+    ...options,
+    env,
+    killSignal: options.killSignal ?? "SIGKILL",
+    stdio: resolvePrepackCommandStdio(options, env),
+    timeout: options.timeout ?? resolvePrepackCommandTimeoutMs(env),
+  });
+}
+
+function run(command: string, args: string[], options: SpawnSyncOptions = {}): void {
+  const result = runPrepackCommand(command, args, options);
+  if (result.status === 0) {
+    return;
+  }
+  if (result.error) {
+    console.error(`prepack: ${command} failed: ${formatErrorMessage(result.error)}`);
+  }
+  process.exit(result.status ?? 1);
+}
+
+export function resolvePrepackBuildEnvironment(
+  env: NodeJS.ProcessEnv = process.env,
+  now: () => Date = () => new Date(),
+  readGitCommit: () => string | null = readCurrentGitCommit,
+): NodeJS.ProcessEnv {
+  return resolveBuildIdentityEnvironment({
+    commitLabel: "build commit",
+    env,
+    now,
+    readGitCommit,
+  });
+}
+
+function runPnpm(args: string[], env: NodeJS.ProcessEnv): void {
+  const command = createPnpmRunnerSpawnSpec({
+    env,
+    pnpmArgs: args,
+    stdio: "inherit",
+  });
+  run(command.command, command.args, { ...command.options, env });
+}
+
+function runBuildSmoke(): void {
+  run(process.execPath, ["--import", "tsx", "scripts/test-built-bundled-channel-entry-smoke.mts"]);
+}
+
+async function writeDistInventory(): Promise<void> {
+  await writePackageDistInventoryForPublish(process.cwd());
+}
+
+export async function preparePrepackArtifacts(env: NodeJS.ProcessEnv = process.env): Promise<void> {
+  ensurePreparedArtifacts();
+  runBuildSmoke();
+  // The docs-map receipt serializes source-mutating pack lifecycles before the
+  // changelog is touched, so concurrent packs cannot restore each other's files.
+  await preparePackageDocsMap(process.cwd());
+  try {
+    await writeDistInventory();
+    await preparePackageManifest(process.cwd());
+    await preparePackageChangelog(process.cwd(), {
+      allowUnreleased: resolvePrepackAllowUnreleasedChangelog(env),
+    });
+  } catch (error) {
+    try {
+      await restorePrepackArtifacts(process.cwd());
+    } catch (restoreError) {
+      throw prepackPreparationRestoreError(error, restoreError);
+    }
+    throw error;
+  }
+}
+
+function prepackPreparationRestoreError(error: unknown, restoreError: unknown): AggregateError {
+  return new AggregateError(
+    [error, restoreError],
+    "Prepack preparation failed and source artifacts could not be restored.",
+    { cause: error },
+  );
+}
+
+async function main(): Promise<void> {
+  ensureSupportedSourcePack();
+  const buildEnv = resolvePrepackBuildEnvironment();
+  // Release preflight already built or restored clean outputs for its exact SHA.
+  // Preserve those artifacts while still running the complete packaging lifecycle.
+  if (buildEnv[PREPARED_RELEASE_ENV]?.trim() !== "1") {
+    runPnpm(["build:package"], buildEnv);
+  } else {
+    runPnpm(["update:compat:check"], buildEnv);
+  }
+  await preparePrepackArtifacts(buildEnv);
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+  await main();
+}
diff --git a/scripts/openclaw-release-clawhub-plan.ts b/scripts/openclaw-release-clawhub-plan.ts
new file mode 100644
index 0000000000000000000000000000000000000000..be57fcb1041fd90f5b69e3b11c145b7137ad29b5
--- /dev/null
+++ b/scripts/openclaw-release-clawhub-plan.ts
@@ -0,0 +1,14 @@
+#!/usr/bin/env -S node --import tsx
+// OpenClaw release ClawHub plan CLI emits release workflow routing as JSON.
+
+import { pathToFileURL } from "node:url";
+import {
+  buildOpenClawReleaseClawHubPlan,
+  parseOpenClawReleaseClawHubPlanArgs,
+} from "./lib/openclaw-release-clawhub-plan.ts";
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+  const args = parseOpenClawReleaseClawHubPlanArgs(process.argv.slice(2));
+  const plan = await buildOpenClawReleaseClawHubPlan(args);
+  console.log(JSON.stringify(plan, null, 2));
+}
diff --git a/scripts/openclaw-release-clawhub-runtime-state.ts b/scripts/openclaw-release-clawhub-runtime-state.ts
new file mode 100644
index 0000000000000000000000000000000000000000..b364d4fcc14a0ab9928b167648ade0e15a555994
--- /dev/null
+++ b/scripts/openclaw-release-clawhub-runtime-state.ts
@@ -0,0 +1,88 @@
+#!/usr/bin/env -S node --import tsx
+import { parseStrictBooleanArg } from "./lib/arg-utils.mts";
+import { buildOpenClawReleaseClawHubRuntimeState } from "./lib/openclaw-release-clawhub-plan.ts";
+
+function parseArgs(argv: string[]) {
+  const values = [...argv];
+  if (values[0] === "--") {
+    values.shift();
+  }
+
+  let repository: string | undefined;
+  let waitForClawHub: boolean | undefined;
+  let forceSkipClawHub: boolean | undefined;
+  let normalRunId: string | undefined;
+  let normalPublicationStaged = false;
+  let bootstrapRunId: string | undefined;
+  let bootstrapCompleted: boolean | undefined;
+
+  for (let index = 0; index < values.length; index += 1) {
+    const arg = values[index];
+    const next = () => {
+      const value = values[index + 1];
+      if (value === undefined || value.startsWith("-")) {
+        throw new Error(`${arg} requires a value.`);
+      }
+      index += 1;
+      return value;
+    };
+
+    switch (arg) {
+      case "--repository":
+        repository = next();
+        break;
+      case "--wait-for-clawhub":
+        waitForClawHub = parseStrictBooleanArg(next(), "--wait-for-clawhub");
+        break;
+      case "--force-skip-clawhub":
+        forceSkipClawHub = parseStrictBooleanArg(next(), "--force-skip-clawhub");
+        break;
+      case "--normal-run-id":
+        normalRunId = next();
+        break;
+      case "--normal-publication-staged":
+        normalPublicationStaged = parseStrictBooleanArg(next(), "--normal-publication-staged");
+        break;
+      case "--bootstrap-run-id":
+        bootstrapRunId = next();
+        break;
+      case "--bootstrap-completed":
+        bootstrapCompleted = parseStrictBooleanArg(next(), "--bootstrap-completed");
+        break;
+      default:
+        throw new Error(`Unknown argument: ${arg}`);
+    }
+  }
+
+  if (!repository?.trim()) {
+    throw new Error("--repository is required.");
+  }
+  if (waitForClawHub === undefined) {
+    throw new Error("--wait-for-clawhub is required.");
+  }
+  if (forceSkipClawHub === undefined) {
+    throw new Error("--force-skip-clawhub is required.");
+  }
+  if (bootstrapCompleted === undefined) {
+    throw new Error("--bootstrap-completed is required.");
+  }
+
+  return {
+    repository,
+    waitForClawHub,
+    forceSkipClawHub,
+    normalRunId,
+    normalPublicationStaged,
+    bootstrapRunId,
+    bootstrapCompleted,
+  };
+}
+
+try {
+  const state = buildOpenClawReleaseClawHubRuntimeState(parseArgs(process.argv.slice(2)));
+  process.stdout.write(`${JSON.stringify(state, null, 2)}\n`);
+} catch (error) {
+  const message = error instanceof Error ? error.message : String(error);
+  console.error(message);
+  process.exit(1);
+}
diff --git a/scripts/package-docs-map.mjs b/scripts/package-docs-map.mjs
new file mode 100644
index 0000000000000000000000000000000000000000..01c4226350b9cc8f0a4ed7dd578ce1abe01f7f58
--- /dev/null
+++ b/scripts/package-docs-map.mjs
@@ -0,0 +1,125 @@
+#!/usr/bin/env node
+
+// Materializes the generated docs map only while npm assembles a package tarball.
+import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { renderDocsHeadingMap } from "./docs-list.js";
+
+const DOCS_MAP_PATH = path.join("docs", "docs_map.md");
+const RECEIPT_PATH = path.join(".artifacts", "package-docs-map", "receipt.json");
+
+function activePreparationError() {
+  return Object.assign(
+    new Error(
+      `Another package preparation owns ${DOCS_MAP_PATH}; wait for it to finish or run \`node scripts/openclaw-postpack.mjs\` after an interrupted pack.`,
+    ),
+    { code: "PACKAGE_DOCS_MAP_ACTIVE" },
+  );
+}
+
+function preparationRestoreError(error, restoreError) {
+  return new AggregateError(
+    [error, restoreError],
+    `Writing ${DOCS_MAP_PATH} failed and its source state could not be restored.`,
+    { cause: error },
+  );
+}
+
+function sha256(content) {
+  return createHash("sha256").update(content).digest("hex");
+}
+
+/** Restore the source map stub after prepack replaced it with generated content. */
+export async function restorePackageDocsMap(cwd = process.cwd()) {
+  const receiptPath = path.join(cwd, RECEIPT_PATH);
+  if (!existsSync(receiptPath)) {
+    return false;
+  }
+  const receipt = JSON.parse(await readFile(receiptPath, "utf8"));
+  if (
+    !receipt ||
+    typeof receipt.generatedSha256 !== "string" ||
+    !/^[0-9a-f]{64}$/u.test(receipt.generatedSha256) ||
+    (receipt.original !== null && typeof receipt.original !== "string")
+  ) {
+    throw new Error(`Invalid package docs-map receipt at ${RECEIPT_PATH}.`);
+  }
+
+  const mapPath = path.join(cwd, DOCS_MAP_PATH);
+  const current = existsSync(mapPath) ? await readFile(mapPath, "utf8") : null;
+  if (current === receipt.original) {
+    await rm(receiptPath, { force: true });
+    return true;
+  }
+  if (current === null || sha256(current) !== receipt.generatedSha256) {
+    throw new Error(
+      `Refusing to restore ${DOCS_MAP_PATH} because it changed after prepack generated it.`,
+    );
+  }
+  if (receipt.original === null) {
+    await rm(mapPath);
+  } else {
+    await writeFile(mapPath, receipt.original, "utf8");
+  }
+  await rm(receiptPath, { force: true });
+  return true;
+}
+
+/** Generate the shipped docs map for npm while recording the source state for cleanup. */
+export async function preparePackageDocsMap(cwd = process.cwd()) {
+  const receiptPath = path.join(cwd, RECEIPT_PATH);
+  if (existsSync(receiptPath)) {
+    throw activePreparationError();
+  }
+  const mapPath = path.join(cwd, DOCS_MAP_PATH);
+  const content = renderDocsHeadingMap(path.join(cwd, "docs"));
+  const original = existsSync(mapPath) ? await readFile(mapPath, "utf8") : null;
+  // The receipt owns every source-mutating pack step, even when the map is
+  // already generated; skipping it lets another pack restore our prepared files.
+  await mkdir(path.dirname(receiptPath), { recursive: true });
+  try {
+    await writeFile(
+      receiptPath,
+      `${JSON.stringify({ generatedSha256: sha256(content), original })}\n`,
+      { encoding: "utf8", flag: "wx" },
+    );
+  } catch (error) {
+    if (error?.code === "EEXIST") {
+      throw activePreparationError();
+    }
+    throw error;
+  }
+  try {
+    await writeFile(mapPath, content, "utf8");
+  } catch (error) {
+    try {
+      await restorePackageDocsMap(cwd);
+    } catch (restoreError) {
+      throw preparationRestoreError(error, restoreError);
+    }
+    throw error;
+  }
+  return true;
+}
+
+async function main(argv = process.argv.slice(2)) {
+  if (argv.length !== 1 || (argv[0] !== "prepare" && argv[0] !== "restore")) {
+    console.error("Usage: node scripts/package-docs-map.mjs <prepare|restore>");
+    process.exitCode = 1;
+    return;
+  }
+  const changed =
+    argv[0] === "prepare" ? await preparePackageDocsMap() : await restorePackageDocsMap();
+  console.error(
+    changed
+      ? `package-docs-map: ${argv[0] === "prepare" ? "generated" : "removed"} transient docs map.`
+      : `package-docs-map: no ${argv[0] === "prepare" ? "generation" : "cleanup"} needed.`,
+  );
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  await main();
+}
diff --git a/scripts/plugin-boundary-report.ts b/scripts/plugin-boundary-report.ts
new file mode 100644
index 0000000000000000000000000000000000000000..104b185a48e77eebb1b6ed2d40b409504b8dc1f2
--- /dev/null
+++ b/scripts/plugin-boundary-report.ts
@@ -0,0 +1,693 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import { existsSync, lstatSync, readdirSync, readFileSync } from "node:fs";
+import { join, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { listPluginCompatRecords } from "../src/plugins/compat/registry.ts";
+import type { PluginCompatRecord } from "../src/plugins/compat/types.ts";
+import {
+  pluginSdkEntrypoints,
+  publicPluginOwnedSdkEntrypoints,
+  supportedBundledFacadeSdkEntrypoints,
+} from "./lib/plugin-sdk-entries.mts";
+
+const REPO_ROOT = process.cwd();
+const SOURCE_ROOTS = ["src", "extensions", "packages", "scripts", "test", "docs"] as const;
+const SKIPPED_DIRS = new Set([
+  ".artifacts",
+  ".git",
+  "coverage",
+  "dist",
+  "dist-runtime",
+  "node_modules",
+]);
+const TEXT_FILE_PATTERN = /\.(?:[cm]?[jt]sx?|json|mdx?|ya?ml)$/u;
+const MEMORY_HOST_SOURCE_BRIDGE_TOKEN = "src/memory-host-sdk/";
+const MEMORY_HOST_CORE_REFERENCE_TOKEN = "../../../src/";
+type CliOptions = {
+  json: boolean;
+  summary: boolean;
+  owner?: string;
+  failOnEligibleCompat: boolean;
+  help: boolean;
+};
+
+type CompatDebtRecord = {
+  code: string;
+  owner: string;
+  status: PluginCompatRecord["status"];
+  removeAfter?: string;
+  removalGate?: PluginCompatRecord["removalGate"];
+  replacement: string;
+  docsPath: string;
+  surfaces: readonly string[];
+  tokens: string[];
+  codeReferenceFiles: string[];
+  docReferenceFiles: string[];
+  eligibleForRemoval: boolean;
+};
+
+type RemovalPendingDebtRecord = {
+  code: string;
+  owner: string;
+  status: "removal-pending";
+  removeAfter?: string;
+  removalGate?: PluginCompatRecord["removalGate"];
+  blocker: string;
+  readerFiles: string[];
+  dueForReview: boolean;
+};
+
+type RemovalPendingDebtSummary = Omit<RemovalPendingDebtRecord, "readerFiles"> & {
+  readerCount: number;
+  readerSample: string[];
+};
+
+type WorkspaceTextFile = {
+  file: string;
+  relativeFile: string;
+  source: string;
+};
+
+type BoundaryReport = {
+  generatedAt: string;
+  compat: {
+    deprecatedCount: number;
+    eligibleForRemovalCount: number;
+    records: CompatDebtRecord[];
+    removalPendingCount: number;
+    removalPendingDueCount: number;
+    removalPending: RemovalPendingDebtRecord[];
+  };
+  pluginSdk: {
+    entrypointCount: number;
+    supportedBundledFacadeCount: number;
+    publicPluginOwnedCount: number;
+  };
+  memoryHostSdk: {
+    privatePackage: boolean;
+    exportedSubpaths: string[];
+    sourceBridgeFiles: string[];
+    packageCoreReferenceFiles: string[];
+  };
+};
+
+type BoundaryReportSummary = {
+  generatedAt: string;
+  owner?: string;
+  compat: {
+    deprecatedCount: number;
+    eligibleForRemovalCount: number;
+    deprecatedByOwner: Record<string, number>;
+    eligibleForRemoval: Array<Pick<CompatDebtRecord, "code" | "owner" | "removeAfter">>;
+    removalPendingCount: number;
+    removalPendingDueCount: number;
+    removalPending: RemovalPendingDebtSummary[];
+  };
+  pluginSdk: {
+    entrypointCount: number;
+    supportedBundledFacadeCount: number;
+    publicPluginOwnedCount: number;
+  };
+  memoryHostSdk: {
+    privatePackage: boolean;
+    exportedSubpathCount: number;
+    sourceBridgeFileCount: number;
+    packageCoreReferenceFileCount: number;
+    implementation:
+      | "private-core-bridge"
+      | "private-package-core-integrated"
+      | "package-owned"
+      | "mixed";
+  };
+};
+
+export type PluginBoundaryReportResult = {
+  stdout: string;
+  stderr: string;
+  exitCode: number;
+};
+
+function collectTextFiles(dir: string): string[] {
+  const files: string[] = [];
+  if (!existsSync(dir)) {
+    return files;
+  }
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    if (SKIPPED_DIRS.has(entry.name)) {
+      continue;
+    }
+    const nextPath = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...collectTextFiles(nextPath));
+      continue;
+    }
+    if (entry.isFile() && TEXT_FILE_PATTERN.test(entry.name)) {
+      files.push(nextPath);
+    }
+  }
+  return files;
+}
+
+function isExistingTextFile(file: string): boolean {
+  try {
+    return lstatSync(file).isFile();
+  } catch {
+    return false;
+  }
+}
+
+function collectWorkspaceTextFiles(): string[] {
+  const gitFiles = collectWorkspaceTextFilesFromGit();
+  return (
+    gitFiles ?? SOURCE_ROOTS.flatMap((root) => collectTextFiles(resolve(REPO_ROOT, root)))
+  ).toSorted((left, right) => relative(REPO_ROOT, left).localeCompare(relative(REPO_ROOT, right)));
+}
+
+function collectWorkspaceTextFilesFromGit(): string[] | null {
+  const result = spawnSync(
+    "git",
+    ["ls-files", "--cached", "--others", "--exclude-standard", "--", ...SOURCE_ROOTS],
+    {
+      cwd: REPO_ROOT,
+      encoding: "utf8",
+      maxBuffer: 32 * 1024 * 1024,
+      stdio: ["ignore", "pipe", "ignore"],
+    },
+  );
+  if (result.status !== 0) {
+    return null;
+  }
+  return result.stdout
+    .split("\n")
+    .map((line) => line.trim())
+    .filter((line) => line.length > 0 && TEXT_FILE_PATTERN.test(line))
+    .filter((line) => !line.split("/").some((part) => SKIPPED_DIRS.has(part)))
+    .map((line) => resolve(REPO_ROOT, line))
+    .filter(isExistingTextFile);
+}
+
+function collectWorkspaceTextFilesMatchingGit(patternArgs: readonly string[]): string[] | null {
+  const result = spawnSync(
+    "git",
+    ["grep", "--untracked", "-l", ...patternArgs, "--", ...SOURCE_ROOTS],
+    {
+      cwd: REPO_ROOT,
+      encoding: "utf8",
+      maxBuffer: 32 * 1024 * 1024,
+      stdio: ["ignore", "pipe", "ignore"],
+    },
+  );
+  if (result.status === 1) {
+    return [];
+  }
+  if (result.status !== 0) {
+    return null;
+  }
+  return result.stdout
+    .split("\n")
+    .map((line) => line.trim())
+    .filter((line) => line.length > 0 && TEXT_FILE_PATTERN.test(line))
+    .filter((line) => !line.split("/").some((part) => SKIPPED_DIRS.has(part)))
+    .map((line) => resolve(REPO_ROOT, line))
+    .filter(isExistingTextFile);
+}
+
+function repoRelative(file: string): string {
+  return relative(REPO_ROOT, file).replaceAll("\\", "/");
+}
+
+function collectWorkspaceTextFileSources(
+  records?: readonly PluginCompatRecord[],
+): WorkspaceTextFile[] {
+  const tokens = records?.flatMap((record) =>
+    record.status === "deprecated"
+      ? extractCompatTokens(record)
+      : record.status === "removal-pending"
+        ? extractCompatSurfaceTokens(record)
+        : [],
+  );
+  // Keep every file either collector can use; Git failure retains the exhaustive scan.
+  const matches = tokens
+    ? collectWorkspaceTextFilesMatchingGit([
+        "-F",
+        ...[...tokens, MEMORY_HOST_SOURCE_BRIDGE_TOKEN, MEMORY_HOST_CORE_REFERENCE_TOKEN].flatMap(
+          (token) => ["-e", token],
+        ),
+      ])
+    : null;
+  return (matches ?? collectWorkspaceTextFiles()).map((file) => ({
+    file,
+    relativeFile: repoRelative(file),
+    source: readFileSync(file, "utf8"),
+  }));
+}
+
+function collectSummaryWorkspaceTextFileSources(): WorkspaceTextFile[] {
+  const pluginSdkFiles = collectWorkspaceTextFilesMatchingGit([
+    "-E",
+    String.raw`openclaw/plugin-sdk/[a-z0-9][a-z0-9-]*`,
+  ]);
+  if (!pluginSdkFiles) {
+    return collectWorkspaceTextFileSources();
+  }
+  const files = new Set(pluginSdkFiles);
+  for (const file of collectTextFiles(resolve(REPO_ROOT, "packages/memory-host-sdk/src"))) {
+    files.add(file);
+  }
+  return [...files]
+    .toSorted((left, right) => repoRelative(left).localeCompare(repoRelative(right)))
+    .map((file) => ({
+      file,
+      relativeFile: repoRelative(file),
+      source: readFileSync(file, "utf8"),
+    }));
+}
+
+function isDocsFile(file: string): boolean {
+  return file.startsWith("docs/") || file === "README.md";
+}
+
+function parseArgs(args: readonly string[]): CliOptions {
+  const options: CliOptions = {
+    json: false,
+    summary: false,
+    failOnEligibleCompat: false,
+    help: false,
+  };
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === "--json") {
+      options.json = true;
+    } else if (arg === "--summary") {
+      options.summary = true;
+    } else if (arg === "--owner") {
+      const owner = args[index + 1];
+      if (!owner || owner.startsWith("--")) {
+        throw new Error("--owner requires a plugin or compatibility owner id");
+      }
+      options.owner = owner;
+      index += 1;
+    } else if (arg === "--fail-on-eligible-compat") {
+      options.failOnEligibleCompat = true;
+    } else if (arg === "--help" || arg === "-h") {
+      options.help = true;
+    } else {
+      throw new Error(`Unknown argument: ${arg}`);
+    }
+  }
+  return options;
+}
+
+function renderHelp(): string {
+  return [
+    "Usage: pnpm plugins:boundary-report [--summary] [--json] [--owner <id>] [fail flags]",
+    "",
+    "Options:",
+    "  --summary                              Print compact counts only.",
+    "  --json                                 Emit JSON instead of text.",
+    "  --owner <id>                           Filter compatibility records by owner id.",
+    "  --fail-on-eligible-compat              Exit non-zero when deprecated compat is due for removal.",
+  ].join("\n");
+}
+
+function extractCompatTokensFromValues(values: readonly (string | undefined)[]): string[] {
+  const tokens = new Set<string>();
+  for (const value of values) {
+    if (value === undefined) {
+      continue;
+    }
+    for (const match of value.matchAll(/`([^`]+)`/g)) {
+      const token = match[1]?.trim();
+      if (token && !token.includes(" ")) {
+        tokens.add(token);
+      }
+    }
+    for (const match of value.matchAll(/\bopenclaw\/[a-z0-9/-]+\b/g)) {
+      tokens.add(match[0]);
+    }
+    for (const match of value.matchAll(/\bOPENCLAW_[A-Z0-9_]+\b/g)) {
+      tokens.add(match[0]);
+    }
+    for (const match of value.matchAll(/\b[a-z][a-zA-Z0-9_]*(?:\.[a-zA-Z0-9_]+)+\b/g)) {
+      tokens.add(match[0]);
+    }
+    for (const match of value.matchAll(/\b[a-z][a-zA-Z0-9_]*_[a-zA-Z0-9_]+\b/g)) {
+      tokens.add(match[0]);
+    }
+  }
+  return [...tokens].toSorted();
+}
+
+function extractCompatTokens(record: PluginCompatRecord): string[] {
+  return extractCompatTokensFromValues([
+    record.code,
+    record.replacement,
+    ...record.surfaces,
+    ...record.diagnostics,
+  ]);
+}
+
+function extractCompatSurfaceTokens(record: PluginCompatRecord): string[] {
+  return extractCompatTokensFromValues(record.surfaces);
+}
+
+function collectReferenceFiles(files: readonly WorkspaceTextFile[], tokens: readonly string[]) {
+  const codeReferenceFiles = new Set<string>();
+  const docReferenceFiles = new Set<string>();
+  for (const { relativeFile, source } of files) {
+    if (relativeFile === "src/plugins/compat/registry.ts") {
+      continue;
+    }
+    if (!tokens.some((token) => source.includes(token))) {
+      continue;
+    }
+    if (isDocsFile(relativeFile)) {
+      docReferenceFiles.add(relativeFile);
+    } else {
+      codeReferenceFiles.add(relativeFile);
+    }
+  }
+  return {
+    codeReferenceFiles: [...codeReferenceFiles].toSorted(),
+    docReferenceFiles: [...docReferenceFiles].toSorted(),
+  };
+}
+
+export function isPluginCompatEligibleForRemoval(
+  removeAfter: string | undefined,
+  today = new Date(),
+): boolean {
+  if (!removeAfter) {
+    return false;
+  }
+  const firstRemovalInstant = new Date(`${removeAfter}T00:00:00Z`);
+  firstRemovalInstant.setUTCDate(firstRemovalInstant.getUTCDate() + 1);
+  return firstRemovalInstant <= today;
+}
+
+function collectCompatDebt(
+  records: readonly PluginCompatRecord[],
+  files: readonly WorkspaceTextFile[],
+  today = new Date(),
+  options: { includeReferenceFiles?: boolean } = {},
+): CompatDebtRecord[] {
+  return records
+    .filter((record) => record.status === "deprecated")
+    .map((record) => {
+      const tokens = extractCompatTokens(record);
+      const references =
+        options.includeReferenceFiles === false
+          ? { codeReferenceFiles: [], docReferenceFiles: [] }
+          : collectReferenceFiles(files, tokens);
+      const eligibleForRemoval = isPluginCompatEligibleForRemoval(record.removeAfter, today);
+      return {
+        code: record.code,
+        owner: record.owner,
+        status: record.status,
+        removeAfter: record.removeAfter,
+        removalGate: record.removalGate,
+        replacement: record.replacement as string,
+        docsPath: record.docsPath,
+        surfaces: record.surfaces,
+        tokens,
+        codeReferenceFiles: references.codeReferenceFiles,
+        docReferenceFiles: references.docReferenceFiles,
+        eligibleForRemoval,
+      };
+    })
+    .toSorted(
+      (left, right) =>
+        formatRemovalGate(left).localeCompare(formatRemovalGate(right)) ||
+        left.owner.localeCompare(right.owner) ||
+        left.code.localeCompare(right.code),
+    );
+}
+
+function collectRemovalPendingDebt(
+  records: readonly PluginCompatRecord[],
+  files: readonly WorkspaceTextFile[],
+  today = new Date(),
+): RemovalPendingDebtRecord[] {
+  return records
+    .filter((record) => record.status === "removal-pending")
+    .map((record) => {
+      const references = collectReferenceFiles(files, extractCompatSurfaceTokens(record));
+      return {
+        code: record.code,
+        owner: record.owner,
+        status: "removal-pending" as const,
+        removeAfter: record.removeAfter,
+        removalGate: record.removalGate,
+        blocker: record.replacement ?? "no removal blocker documented",
+        readerFiles: references.codeReferenceFiles,
+        dueForReview: record.removeAfter
+          ? new Date(`${record.removeAfter}T00:00:00Z`) <= today
+          : false,
+      };
+    })
+    .toSorted(
+      (left, right) =>
+        formatRemovalGate(left).localeCompare(formatRemovalGate(right)) ||
+        left.owner.localeCompare(right.owner) ||
+        left.code.localeCompare(right.code),
+    );
+}
+
+function collectMemoryHostBoundary(
+  files: readonly WorkspaceTextFile[],
+): BoundaryReport["memoryHostSdk"] {
+  const packageJson = JSON.parse(
+    readFileSync(resolve(REPO_ROOT, "packages/memory-host-sdk/package.json"), "utf8"),
+  ) as { private?: boolean; exports?: Record<string, string> };
+  const sourceBridgeFiles: string[] = [];
+  const packageCoreReferenceFiles = new Set<string>();
+  for (const { relativeFile, source } of files) {
+    if (!relativeFile.startsWith("packages/memory-host-sdk/src/")) {
+      continue;
+    }
+    if (source.includes(MEMORY_HOST_SOURCE_BRIDGE_TOKEN)) {
+      sourceBridgeFiles.push(relativeFile);
+    }
+    if (source.includes(MEMORY_HOST_CORE_REFERENCE_TOKEN)) {
+      packageCoreReferenceFiles.add(relativeFile);
+    }
+  }
+  return {
+    privatePackage: packageJson.private === true,
+    exportedSubpaths: Object.keys(packageJson.exports ?? {}).toSorted(),
+    sourceBridgeFiles: sourceBridgeFiles.toSorted(),
+    packageCoreReferenceFiles: [...packageCoreReferenceFiles].toSorted(),
+  };
+}
+
+function countByOwner(records: readonly CompatDebtRecord[]): Record<string, number> {
+  const counts: Record<string, number> = {};
+  for (const record of records) {
+    counts[record.owner] = (counts[record.owner] ?? 0) + 1;
+  }
+  return Object.fromEntries(
+    Object.entries(counts).toSorted(([left], [right]) => left.localeCompare(right)),
+  );
+}
+
+function formatRemovalGate(
+  record: Pick<PluginCompatRecord, "removeAfter" | "removalGate">,
+): string {
+  return record.removeAfter ?? record.removalGate ?? "no-date";
+}
+
+function resolveMemoryHostImplementation(
+  memoryHostSdk: BoundaryReport["memoryHostSdk"],
+): BoundaryReportSummary["memoryHostSdk"]["implementation"] {
+  if (memoryHostSdk.privatePackage && memoryHostSdk.sourceBridgeFiles.length > 0) {
+    return "private-core-bridge";
+  }
+  if (memoryHostSdk.privatePackage && memoryHostSdk.packageCoreReferenceFiles.length > 0) {
+    return "private-package-core-integrated";
+  }
+  if (memoryHostSdk.packageCoreReferenceFiles.length === 0) {
+    return "package-owned";
+  }
+  return "mixed";
+}
+
+function buildSummary(report: BoundaryReport, owner?: string): BoundaryReportSummary {
+  const eligibleForRemoval = report.compat.records
+    .filter((record) => record.eligibleForRemoval)
+    .map((record) => ({
+      code: record.code,
+      owner: record.owner,
+      removeAfter: record.removeAfter,
+    }));
+  return {
+    generatedAt: report.generatedAt,
+    owner,
+    compat: {
+      deprecatedCount: report.compat.deprecatedCount,
+      eligibleForRemovalCount: report.compat.eligibleForRemovalCount,
+      deprecatedByOwner: countByOwner(report.compat.records),
+      eligibleForRemoval,
+      removalPendingCount: report.compat.removalPendingCount,
+      removalPendingDueCount: report.compat.removalPendingDueCount,
+      removalPending: report.compat.removalPending.map(({ readerFiles, ...record }) => ({
+        ...record,
+        readerCount: readerFiles.length,
+        readerSample: readerFiles.slice(0, 5),
+      })),
+    },
+    pluginSdk: {
+      entrypointCount: report.pluginSdk.entrypointCount,
+      supportedBundledFacadeCount: report.pluginSdk.supportedBundledFacadeCount,
+      publicPluginOwnedCount: report.pluginSdk.publicPluginOwnedCount,
+    },
+    memoryHostSdk: {
+      privatePackage: report.memoryHostSdk.privatePackage,
+      exportedSubpathCount: report.memoryHostSdk.exportedSubpaths.length,
+      sourceBridgeFileCount: report.memoryHostSdk.sourceBridgeFiles.length,
+      packageCoreReferenceFileCount: report.memoryHostSdk.packageCoreReferenceFiles.length,
+      implementation: resolveMemoryHostImplementation(report.memoryHostSdk),
+    },
+  };
+}
+
+function buildReport(options: Partial<Pick<CliOptions, "owner" | "summary">> = {}): BoundaryReport {
+  const records = listPluginCompatRecords().filter(
+    (record) => options.owner === undefined || record.owner === options.owner,
+  );
+  const files = options.summary
+    ? collectSummaryWorkspaceTextFileSources()
+    : collectWorkspaceTextFileSources(records);
+  const compatRecords = collectCompatDebt(records, files, new Date(), {
+    includeReferenceFiles: !options.summary,
+  });
+  const removalPending = collectRemovalPendingDebt(records, files);
+  return {
+    generatedAt: new Date().toISOString(),
+    compat: {
+      deprecatedCount: compatRecords.length,
+      eligibleForRemovalCount: compatRecords.filter((record) => record.eligibleForRemoval).length,
+      records: compatRecords,
+      removalPendingCount: removalPending.length,
+      removalPendingDueCount: removalPending.filter((record) => record.dueForReview).length,
+      removalPending,
+    },
+    pluginSdk: {
+      entrypointCount: pluginSdkEntrypoints.length,
+      supportedBundledFacadeCount: supportedBundledFacadeSdkEntrypoints.length,
+      publicPluginOwnedCount: publicPluginOwnedSdkEntrypoints.length,
+    },
+    memoryHostSdk: collectMemoryHostBoundary(files),
+  };
+}
+
+function renderSummaryText(summary: BoundaryReportSummary): string {
+  const lines: string[] = [];
+  lines.push(`Plugin Boundary Report${summary.owner ? ` (${summary.owner})` : ""}`);
+  lines.push("");
+  lines.push(
+    `compat deprecated=${summary.compat.deprecatedCount} eligibleForRemoval=${summary.compat.eligibleForRemovalCount} removalPending=${summary.compat.removalPendingCount} removalPendingDue=${summary.compat.removalPendingDueCount}`,
+  );
+  for (const record of summary.compat.removalPending) {
+    lines.push(
+      `  removal-pending ${formatRemovalGate(record)} ${record.code} due=${record.dueForReview} blocker=${record.blocker} readerRefs=${record.readerCount} readers=${record.readerSample.join(",") || "none"}`,
+    );
+  }
+  lines.push(
+    `plugin-sdk entrypoints=${summary.pluginSdk.entrypointCount} supportedBundledFacade=${summary.pluginSdk.supportedBundledFacadeCount} publicPluginOwned=${summary.pluginSdk.publicPluginOwnedCount}`,
+  );
+  lines.push(
+    `memory-host-sdk implementation=${summary.memoryHostSdk.implementation} private=${summary.memoryHostSdk.privatePackage} exports=${summary.memoryHostSdk.exportedSubpathCount} sourceBridgeFiles=${summary.memoryHostSdk.sourceBridgeFileCount} coreReferenceFiles=${summary.memoryHostSdk.packageCoreReferenceFileCount}`,
+  );
+  return lines.join("\n");
+}
+
+function renderText(report: BoundaryReport, owner?: string): string {
+  const lines: string[] = [];
+  lines.push(`Plugin Boundary Report${owner ? ` (${owner})` : ""}`);
+  lines.push("");
+  lines.push(
+    `compat deprecated=${report.compat.deprecatedCount} eligibleForRemoval=${report.compat.eligibleForRemovalCount} removalPending=${report.compat.removalPendingCount} removalPendingDue=${report.compat.removalPendingDueCount}`,
+  );
+  for (const record of report.compat.records) {
+    lines.push(
+      `  ${formatRemovalGate(record)} ${record.code} owner=${record.owner} codeRefs=${record.codeReferenceFiles.length} docRefs=${record.docReferenceFiles.length}`,
+    );
+  }
+  for (const record of report.compat.removalPending) {
+    lines.push(
+      `  removal-pending ${formatRemovalGate(record)} ${record.code} due=${record.dueForReview} blocker=${record.blocker} readerRefs=${record.readerFiles.length}`,
+    );
+    for (const reader of record.readerFiles) {
+      lines.push(`    reader ${reader}`);
+    }
+  }
+  lines.push("");
+  lines.push(
+    `plugin-sdk entrypoints=${report.pluginSdk.entrypointCount} supportedBundledFacade=${report.pluginSdk.supportedBundledFacadeCount} publicPluginOwned=${report.pluginSdk.publicPluginOwnedCount}`,
+  );
+  lines.push("");
+  lines.push(
+    `memory-host-sdk implementation=${resolveMemoryHostImplementation(report.memoryHostSdk)} private=${report.memoryHostSdk.privatePackage} exports=${report.memoryHostSdk.exportedSubpaths.length} sourceBridgeFiles=${report.memoryHostSdk.sourceBridgeFiles.length} coreReferenceFiles=${report.memoryHostSdk.packageCoreReferenceFiles.length}`,
+  );
+  return lines.join("\n");
+}
+
+function collectFailures(report: BoundaryReport, options: CliOptions): string[] {
+  const failures: string[] = [];
+  if (options.failOnEligibleCompat && report.compat.eligibleForRemovalCount > 0) {
+    failures.push(
+      `${report.compat.eligibleForRemovalCount} compatibility record(s) are due for removal`,
+    );
+  }
+  return failures;
+}
+
+export function createPluginBoundaryReport(args: readonly string[]): PluginBoundaryReportResult {
+  const options = parseArgs(args);
+  if (options.help) {
+    return {
+      stdout: `${renderHelp()}\n`,
+      stderr: "",
+      exitCode: 0,
+    };
+  }
+
+  const report = buildReport(options);
+  const summary = buildSummary(report, options.owner);
+  const body = options.json
+    ? JSON.stringify(options.summary ? summary : report, null, 2)
+    : options.summary
+      ? renderSummaryText(summary)
+      : renderText(report, options.owner);
+  const failures = collectFailures(report, options);
+  return {
+    stdout: `${body}\n`,
+    stderr:
+      failures.length > 0
+        ? `${failures.map((failure) => `plugin-boundary-report: ${failure}`).join("\n")}\n`
+        : "",
+    exitCode: failures.length > 0 ? 1 : 0,
+  };
+}
+
+function runPluginBoundaryReportCli(args: readonly string[]): void {
+  let result: PluginBoundaryReportResult;
+  try {
+    result = createPluginBoundaryReport(args);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    process.stderr.write(`${message}\n\n${renderHelp()}\n`);
+    process.exitCode = 2;
+    return;
+  }
+  process.stdout.write(result.stdout);
+  if (result.stderr) {
+    process.stderr.write(result.stderr);
+  }
+  process.exitCode = result.exitCode;
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  runPluginBoundaryReportCli(process.argv.slice(2));
+}
diff --git a/scripts/plugin-npm-bootstrap-approval.mjs b/scripts/plugin-npm-bootstrap-approval.mjs
new file mode 100644
index 0000000000000000000000000000000000000000..b6f42bca373899cdfae3560b0f8b90e1e1deaba2
--- /dev/null
+++ b/scripts/plugin-npm-bootstrap-approval.mjs
@@ -0,0 +1,91 @@
+import { parseReleaseVersion } from "./lib/release-version.mjs";
+
+const SHA = /^[a-f0-9]{40}$/u;
+const PACKAGE = /^@openclaw\/[a-z0-9][a-z0-9._-]*$/u;
+
+export function createStablePluginNpmBootstrapApproval(input) {
+  const version = typeof input.releaseTag === "string" ? input.releaseTag.slice(1) : "";
+  const parsed = parseReleaseVersion(version);
+  if (
+    input.releaseTag !== `v${version}` ||
+    parsed?.channel !== "stable" ||
+    parsed.patch >= 33 ||
+    input.publishTag !== "latest" ||
+    !["stable", "full"].includes(input.releaseProfile)
+  ) {
+    throw new Error(
+      "Stable npm bootstrap requires a regular stable tag, latest, and stable/full validation.",
+    );
+  }
+  if (
+    input.repository !== "openclaw/openclaw" ||
+    !SHA.test(input.targetSha ?? "") ||
+    !SHA.test(input.parentWorkflowSha ?? "") ||
+    !new RegExp(`^release-publish/${input.parentWorkflowSha.slice(0, 12)}-[1-9][0-9]*$`, "u").test(
+      input.workflowBranch,
+    ) ||
+    input.workflowFullRef !== `refs/tags/${input.workflowBranch}` ||
+    !/^[1-9][0-9]*$/u.test(input.parentRunId ?? "") ||
+    !Number.isSafeInteger(input.parentRunAttempt) ||
+    input.parentRunAttempt < 1 ||
+    !/^[1-9][0-9]*$/u.test(input.validationRunId ?? "") ||
+    !Number.isSafeInteger(input.validationRunAttempt) ||
+    input.validationRunAttempt < 1
+  ) {
+    throw new Error(
+      "Stable npm bootstrap requires an exact protected parent and validation tuple.",
+    );
+  }
+  if (
+    !Array.isArray(input.packages) ||
+    input.packages.length === 0 ||
+    input.packages.some((name) => typeof name !== "string" || !PACKAGE.test(name)) ||
+    new Set(input.packages).size !== input.packages.length
+  ) {
+    throw new Error("Stable npm bootstrap requires a unique publishable @openclaw package set.");
+  }
+  return {
+    version: 1,
+    kind: "npm-stable-bootstrap",
+    repository: input.repository,
+    parentRunId: input.parentRunId,
+    parentRunAttempt: input.parentRunAttempt,
+    workflowBranch: input.workflowBranch,
+    workflowFullRef: input.workflowFullRef,
+    parentWorkflowSha: input.parentWorkflowSha,
+    releaseTag: input.releaseTag,
+    targetSha: input.targetSha,
+    publishTag: input.publishTag,
+    releaseProfile: input.releaseProfile,
+    validationRunId: input.validationRunId,
+    validationRunAttempt: input.validationRunAttempt,
+    packages: input.packages.toSorted(),
+  };
+}
+
+export function validateStablePluginNpmBootstrapApproval(approval, expected) {
+  const canonical = createStablePluginNpmBootstrapApproval(approval);
+  if (JSON.stringify(approval) !== JSON.stringify(canonical)) {
+    throw new Error("Stable npm bootstrap approval is not canonical.");
+  }
+  for (const key of [
+    "repository",
+    "parentRunId",
+    "parentRunAttempt",
+    "workflowBranch",
+    "workflowFullRef",
+    "parentWorkflowSha",
+    "targetSha",
+    "publishTag",
+  ]) {
+    if (approval[key] !== expected[key]) {
+      throw new Error(`Stable npm bootstrap approval ${key} does not match this publication.`);
+    }
+  }
+  if (
+    approval.releaseTag !== `v${expected.packageVersion}` ||
+    !approval.packages.includes(expected.packageName)
+  ) {
+    throw new Error("Stable npm bootstrap approval does not cover this package and version.");
+  }
+}
diff --git a/scripts/plugin-npm-prepared-release.mjs b/scripts/plugin-npm-prepared-release.mjs
new file mode 100644
index 0000000000000000000000000000000000000000..5eef77523e2fb5e647315e5a4ab12d5c0473cd09
--- /dev/null
+++ b/scripts/plugin-npm-prepared-release.mjs
@@ -0,0 +1,606 @@
+#!/usr/bin/env node
+
+import { createHash } from "node:crypto";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+import { pathToFileURL } from "node:url";
+import {
+  downloadActionsArtifactArchive,
+  inspectActionsArtifactZipWithPolicy,
+  readBoundedRegularFile,
+  validateActionsArtifactBinding,
+  validateActionsArtifactProducerJob,
+} from "./lib/actions-artifact-archive.mjs";
+import {
+  fetchNpmRegistryPackumentWithRetry,
+  fetchNpmRegistryTarballWithRetry,
+  resolveNpmPublishPlan,
+} from "./lib/npm-publish-plan.mjs";
+import { collectExtensionPackageJsonCandidates } from "./lib/plugin-publication-candidates.ts";
+import { isPluginPublicationEnabled } from "./lib/plugin-publication-target.mjs";
+import { parseReleaseVersion } from "./lib/release-version.mjs";
+import { verifyPluginPublicationArtifact } from "./plugin-publication-artifact.mjs";
+
+export const PREPARED_NPM_MANIFEST = "plugin-npm-prepared.json";
+const SCHEMA = "openclaw.plugin-npm-prepared/v1";
+const WORKFLOW_PATH = ".github/workflows/plugin-npm-release.yml";
+const MAX_MANIFEST_BYTES = 1024 * 1024;
+const MAX_PACKAGE_BYTES = 256 * 1024 * 1024;
+const SHA = /^[a-f0-9]{40}$/u;
+const DIGEST = /^sha256:[a-f0-9]{64}$/u;
+const PACKAGE = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/u;
+const ROUTES = new Set(["npm-oidc", "npm-token-bootstrap", "npm-readback"]);
+
+function requireValue(condition, message) {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+function sha256(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+
+function readJson(file, maxBytes = MAX_MANIFEST_BYTES) {
+  return JSON.parse(readBoundedRegularFile(file, { label: file, maxBytes }).toString("utf8"));
+}
+
+function normalizeProducer(value) {
+  requireValue(
+    value?.workflowPath === WORKFLOW_PATH &&
+      value.workflowEvent === "workflow_dispatch" &&
+      /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u.test(value.repository ?? "") &&
+      SHA.test(value.workflowSha ?? "") &&
+      Number.isSafeInteger(value.runId) &&
+      value.runId > 0 &&
+      Number.isSafeInteger(value.runAttempt) &&
+      value.runAttempt > 0 &&
+      typeof value.workflowHeadBranch === "string" &&
+      /^(?:main|release\/[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*|extended-stable\/[0-9]{4}\.[1-9][0-9]*\.33|release-publish\/[a-f0-9]{12}-[1-9][0-9]*)$/u.test(
+        value.workflowHeadBranch,
+      ),
+    "Prepared npm producer must bind an exact trusted workflow run and attempt.",
+  );
+  return {
+    repository: value.repository,
+    runId: value.runId,
+    runAttempt: value.runAttempt,
+    workflowPath: value.workflowPath,
+    workflowEvent: value.workflowEvent,
+    workflowHeadBranch: value.workflowHeadBranch,
+    workflowSha: value.workflowSha,
+  };
+}
+
+function normalizePackage(value, npmDistTag) {
+  requireValue(
+    /^[a-z0-9][a-z0-9._-]*$/u.test(value?.extensionId ?? "") &&
+      value.packageDir === `extensions/${value.extensionId}` &&
+      PACKAGE.test(value.packageName ?? "") &&
+      typeof value.installNpmSpec === "string" &&
+      value.installNpmSpec.length > 0 &&
+      !/[\s\p{Cc}]/u.test(value.installNpmSpec),
+    "Prepared npm package identity is invalid.",
+  );
+  const plan = resolveNpmPublishPlan(
+    value.version,
+    undefined,
+    npmDistTag === "default" ? undefined : npmDistTag,
+  );
+  requireValue(
+    value.channel === plan.channel && value.publishTag === plan.publishTag,
+    "Prepared npm package channel differs from its version.",
+  );
+  return {
+    extensionId: value.extensionId,
+    packageDir: value.packageDir,
+    packageName: value.packageName,
+    version: value.version,
+    channel: value.channel,
+    publishTag: value.publishTag,
+    installNpmSpec: value.installNpmSpec,
+  };
+}
+
+function artifactTuple(metadata, producer) {
+  requireValue(
+    Number.isSafeInteger(metadata.id) &&
+      metadata.id > 0 &&
+      typeof metadata.name === "string" &&
+      /^[A-Za-z0-9][A-Za-z0-9_.-]*$/u.test(metadata.name) &&
+      DIGEST.test(metadata.digest ?? "") &&
+      Number.isSafeInteger(metadata.size_in_bytes) &&
+      metadata.size_in_bytes > 0 &&
+      metadata.size_in_bytes <= MAX_PACKAGE_BYTES,
+    "Prepared npm artifact identity is invalid.",
+  );
+  return {
+    ...producer,
+    artifactId: metadata.id,
+    artifactName: metadata.name,
+    artifactDigest: metadata.digest,
+    artifactSizeBytes: metadata.size_in_bytes,
+  };
+}
+
+function packageArtifactName(entry, route, producer) {
+  return `plugin-npm-package-${entry.extensionId}-${entry.version}-${route}-${producer.runId}-${producer.runAttempt}`;
+}
+
+export function preparedNpmArtifactName(sourceSha, producer) {
+  requireValue(SHA.test(sourceSha), "Prepared npm source must be a full lowercase SHA.");
+  const identity = normalizeProducer(producer);
+  return `plugin-npm-prepared-${sourceSha}-${identity.runId}-${identity.runAttempt}`;
+}
+
+function sourcePackageRoster(sourceRoot, npmDistTag, selectedNames) {
+  return collectExtensionPackageJsonCandidates(sourceRoot)
+    .filter(({ packageJson }) => isPluginPublicationEnabled(packageJson, "npm"))
+    .filter(
+      ({ packageJson }) =>
+        selectedNames.length === 0 || selectedNames.includes(packageJson.name?.trim()),
+    )
+    .map(({ extensionId, packageDir, packageJson }) => {
+      const plan = resolveNpmPublishPlan(
+        packageJson.version,
+        undefined,
+        npmDistTag === "default" ? undefined : npmDistTag,
+      );
+      return normalizePackage(
+        {
+          extensionId,
+          packageDir,
+          packageName: packageJson.name?.trim(),
+          version: packageJson.version?.trim(),
+          channel: plan.channel,
+          publishTag: plan.publishTag,
+          installNpmSpec: packageJson.openclaw?.install?.npmSpec?.trim(),
+        },
+        npmDistTag,
+      );
+    })
+    .toSorted((a, b) =>
+      a.packageName < b.packageName ? -1 : a.packageName > b.packageName ? 1 : 0,
+    );
+}
+
+export function validatePreparedNpmRelease(manifest, expected) {
+  const producer = normalizeProducer(manifest?.producer);
+  requireValue(
+    manifest.schema === SCHEMA &&
+      manifest.runtimeQualification === "packed-runtime-v1" &&
+      SHA.test(manifest.sourceSha ?? "") &&
+      manifest.sourceSha === expected.sourceSha &&
+      manifest.npmDistTag === expected.npmDistTag &&
+      ["default", "extended-stable"].includes(manifest.npmDistTag) &&
+      manifest.selectionMode === expected.selectionMode &&
+      ["selected", "all-publishable"].includes(manifest.selectionMode) &&
+      manifest.publisherPolicySha256 === expected.publisherPolicySha256 &&
+      /^[a-f0-9]{64}$/u.test(manifest.publisherPolicySha256 ?? "") &&
+      producer.repository === expected.repository &&
+      producer.workflowSha === expected.workflowSha,
+    "Prepared npm release differs from the approved source, tooling, selection, or channel.",
+  );
+  requireValue(
+    Array.isArray(manifest.packages) &&
+      manifest.packages.length > 0 &&
+      manifest.packages.length <= 256,
+    "Prepared npm release must contain the complete non-empty package roster.",
+  );
+  const names = new Set();
+  const artifacts = new Set();
+  const packages = manifest.packages.map((value) => {
+    const entry = normalizePackage(value, manifest.npmDistTag);
+    const tuple = value.artifact;
+    requireValue(
+      ROUTES.has(value.route),
+      "Prepared npm route requires separately authorized repair tooling.",
+    );
+    if (value.route === "npm-token-bootstrap") {
+      const parsed = parseReleaseVersion(entry.version);
+      requireValue(
+        entry.channel === "beta" ||
+          (parsed?.channel === "stable" &&
+            parsed.patch < 33 &&
+            manifest.npmDistTag === "default" &&
+            entry.publishTag === "latest"),
+        "Prepared npm token bootstrap requires beta or regular stable/latest qualification.",
+      );
+    }
+    requireValue(
+      JSON.stringify(normalizeProducer(tuple)) === JSON.stringify(producer),
+      "Prepared npm package producer differs from the sealed release.",
+    );
+    const normalizedTuple = artifactTuple(
+      {
+        id: tuple.artifactId,
+        name: tuple.artifactName,
+        digest: tuple.artifactDigest,
+        size_in_bytes: tuple.artifactSizeBytes,
+      },
+      producer,
+    );
+    requireValue(
+      normalizedTuple.artifactName === packageArtifactName(entry, value.route, producer),
+      "Prepared npm package artifact does not bind its exact producer attempt.",
+    );
+    requireValue(
+      !names.has(entry.packageName) && !artifacts.has(tuple.artifactId),
+      "Prepared npm release contains duplicate packages or artifacts.",
+    );
+    names.add(entry.packageName);
+    artifacts.add(tuple.artifactId);
+    return { ...entry, route: value.route, artifact: normalizedTuple };
+  });
+  const selected = (expected.plugins ?? "")
+    .split(",")
+    .map((name) => name.trim())
+    .filter(Boolean)
+    .toSorted();
+  if (manifest.selectionMode === "all-publishable") {
+    requireValue(
+      selected.length === 0,
+      "All-publishable prepared npm release must not narrow the roster.",
+    );
+  } else {
+    requireValue(
+      JSON.stringify(selected) ===
+        JSON.stringify([...names].toSorted((a, b) => (a < b ? -1 : a > b ? 1 : 0))),
+      "Prepared npm package roster differs from the requested selection.",
+    );
+  }
+  if (expected.sourceRoot !== undefined) {
+    const sourcePackages = sourcePackageRoster(expected.sourceRoot, manifest.npmDistTag, selected);
+    requireValue(
+      JSON.stringify(sourcePackages) ===
+        JSON.stringify(packages.map((entry) => normalizePackage(entry, manifest.npmDistTag))),
+      "Prepared npm roster differs from the complete selected frozen-source roster.",
+    );
+  }
+  return { ...manifest, producer, packages };
+}
+
+export function createPreparedNpmRelease(params) {
+  const producer = normalizeProducer(params.producer);
+  const packages = params.matrix
+    .map((value) => {
+      const entry = normalizePackage(value, params.npmDistTag);
+      const matches = params.artifacts.filter((artifact) =>
+        [...ROUTES].some((route) => artifact.name === packageArtifactName(entry, route, producer)),
+      );
+      requireValue(
+        matches.length === 1,
+        `Expected one qualified npm artifact for ${entry.packageName}.`,
+      );
+      const [metadata] = matches;
+      const route = [...ROUTES].find(
+        (candidate) => metadata.name === packageArtifactName(entry, candidate, producer),
+      );
+      const artifact = artifactTuple(metadata, producer);
+      const expected = {
+        ...artifact,
+        runStatePolicy: "same-run-producer-success",
+        consumerRunAttempt: producer.runAttempt,
+        producerJobName: `Preflight plugin npm package (${entry.packageName})`,
+      };
+      validateActionsArtifactBinding({
+        artifactMetadata: metadata,
+        expected,
+        workflowRun: params.workflowRun,
+      });
+      validateActionsArtifactProducerJob({ expected, workflowJobs: params.workflowJobs });
+      return { ...entry, route, artifact };
+    })
+    .toSorted((a, b) =>
+      a.packageName < b.packageName ? -1 : a.packageName > b.packageName ? 1 : 0,
+    );
+  return validatePreparedNpmRelease(
+    {
+      schema: SCHEMA,
+      runtimeQualification: "packed-runtime-v1",
+      sourceSha: params.sourceSha,
+      npmDistTag: params.npmDistTag,
+      selectionMode: params.selectionMode,
+      publisherPolicySha256: params.publisherPolicySha256,
+      producer,
+      packages,
+    },
+    { ...params, repository: producer.repository, workflowSha: producer.workflowSha },
+  );
+}
+
+export async function downloadPreparedNpmRelease(params) {
+  requireValue(
+    typeof params.sourceRoot === "string",
+    "Prepared npm admission requires the frozen source root.",
+  );
+  const producer = normalizeProducer(params.artifact);
+  requireValue(
+    producer.repository === params.repository &&
+      producer.workflowSha === params.workflowSha &&
+      params.artifact.artifactName === preparedNpmArtifactName(params.sourceSha, producer),
+    "Prepared npm manifest artifact differs from the approved producer.",
+  );
+  const downloaded = await downloadActionsArtifactArchive({
+    token: params.token,
+    fetchImpl: params.fetchImpl,
+    expected: { ...params.artifact, runStatePolicy: "completed-success" },
+    archivePath: params.archivePath,
+    maxArchiveBytes: MAX_MANIFEST_BYTES,
+  });
+  const files = inspectActionsArtifactZipWithPolicy(downloaded.archiveBytes, {
+    minEntries: 1,
+    maxEntries: 1,
+    maxArchiveBytes: MAX_MANIFEST_BYTES,
+    maxExpandedBytes: MAX_MANIFEST_BYTES,
+    maxEntryBytes: () => MAX_MANIFEST_BYTES,
+    allowPath: (name) => name === PREPARED_NPM_MANIFEST,
+  });
+  const manifest = validatePreparedNpmRelease(
+    JSON.parse(files.get(PREPARED_NPM_MANIFEST).toString("utf8")),
+    params,
+  );
+  requireValue(
+    JSON.stringify(manifest.producer) === JSON.stringify(producer),
+    "Prepared npm manifest producer differs from its artifact.",
+  );
+  return manifest;
+}
+
+export async function consumePreparedNpmPackage(params) {
+  const entry = params.package;
+  const producer = normalizeProducer(entry.artifact);
+  normalizePackage(entry, params.npmDistTag);
+  requireValue(
+    producer.repository === params.repository &&
+      producer.workflowSha === params.workflowSha &&
+      ROUTES.has(entry.route) &&
+      entry.artifact.artifactName === packageArtifactName(entry, entry.route, producer),
+    "Prepared npm package differs from the approved publication identity.",
+  );
+  const cacheDir = resolve(params.cacheDir);
+  mkdirSync(cacheDir, { recursive: true });
+  const archivePath = join(cacheDir, `${entry.artifact.artifactId}.zip`);
+  const downloaded = await downloadActionsArtifactArchive({
+    token: params.token,
+    fetchImpl: params.fetchImpl,
+    expected: { ...entry.artifact, runStatePolicy: "completed-success" },
+    archivePath,
+  });
+  const metadataPath = join(cacheDir, `${entry.artifact.artifactId}.metadata.json`);
+  const runPath = join(cacheDir, `${entry.artifact.artifactId}.run.json`);
+  writeFileSync(metadataPath, JSON.stringify(downloaded.artifactMetadata));
+  writeFileSync(runPath, JSON.stringify(downloaded.workflowRun));
+  return verifyPluginPublicationArtifact({
+    ...entry.artifact,
+    artifactMetadataPath: metadataPath,
+    artifactZipPath: archivePath,
+    workflowRunMetadataPath: runPath,
+    runStatePolicy: "completed-success",
+    packageDir: entry.packageDir,
+    packageName: entry.packageName,
+    version: entry.version,
+    publishTag: entry.publishTag,
+    route: entry.route,
+    targetSha: params.sourceSha,
+    publicationReason: `Stable npm registry preflight selected ${entry.route}.`,
+    publisherPolicy: {
+      policyId: "plugin-npm-release-workflow",
+      schema: "openclaw.plugin-npm-publisher-policy/v1",
+      sha256: params.publisherPolicySha256,
+    },
+    sourcePackageJsonSha256: sha256(
+      readBoundedRegularFile(params.sourcePackageJson, {
+        label: "source package.json",
+        maxBytes: MAX_MANIFEST_BYTES,
+      }),
+    ),
+    outputDir: params.outputDir,
+  });
+}
+
+export async function verifyPreparedNpmRegistry(params) {
+  const tarball = readBoundedRegularFile(params.tarballPath, {
+    label: "qualified plugin tarball",
+    maxBytes: MAX_PACKAGE_BYTES,
+  });
+  const integrity = `sha512-${createHash("sha512").update(tarball).digest("base64")}`;
+  const shasum = createHash("sha1").update(tarball).digest("hex");
+  requireValue(
+    PACKAGE.test(params.packageName) && ROUTES.has(params.route),
+    "Invalid prepared npm publication request.",
+  );
+  const registry = await fetchNpmRegistryPackumentWithRetry({
+    packageName: params.packageName,
+    packageUrl: `https://registry.npmjs.org/${encodeURIComponent(params.packageName)}`,
+    fetchImpl: params.fetchImpl,
+  });
+  requireValue(
+    registry.status === 404 || registry.ok,
+    `npm registry returned HTTP ${registry.status}.`,
+  );
+  if (registry.ok) {
+    requireValue(
+      registry.packument?.name === params.packageName &&
+        registry.packument.versions &&
+        typeof registry.packument.versions === "object" &&
+        !Array.isArray(registry.packument.versions) &&
+        registry.packument["dist-tags"] &&
+        typeof registry.packument["dist-tags"] === "object" &&
+        !Array.isArray(registry.packument["dist-tags"]),
+      "npm registry response is not an authoritative package inventory.",
+    );
+  }
+  const version = registry.packument?.versions?.[params.version];
+  if (!version) {
+    if (params.allowMissing !== true && (params.remainingReadbacks ?? 5) > 0) {
+      // npm replication can lag an accepted publish; conflicts never enter this retry.
+      await delay(5_000);
+      return verifyPreparedNpmRegistry({
+        ...params,
+        remainingReadbacks: (params.remainingReadbacks ?? 5) - 1,
+      });
+    }
+    requireValue(
+      params.allowMissing === true && params.route !== "npm-readback",
+      `${params.packageName}@${params.version}: exact version is not visible yet; verification pending. Retry readback, not publication.`,
+    );
+    requireValue(
+      registry.status !== 404 || params.route === "npm-token-bootstrap",
+      "Prepared OIDC package no longer exists; obtain an explicitly approved bootstrap.",
+    );
+    return { alreadyPublished: false };
+  }
+  requireValue(
+    version.name === params.packageName && version.version === params.version,
+    "npm registry version identity differs from the qualified package.",
+  );
+  requireValue(
+    version.dist?.integrity === integrity && version.dist?.shasum === shasum,
+    `${params.packageName}@${params.version}: registry bytes conflict with the qualified artifact.`,
+  );
+  const url = new URL(version.dist.tarball);
+  requireValue(
+    url.origin === "https://registry.npmjs.org" && !url.username && !url.password,
+    "Prepared npm readback requires the canonical registry tarball URL.",
+  );
+  const published = await fetchNpmRegistryTarballWithRetry({
+    packageName: params.packageName,
+    packageUrl: url.href,
+    maxBytes: tarball.length,
+    fetchImpl: params.fetchImpl,
+  });
+  requireValue(
+    published.length === tarball.length && sha256(published) === sha256(tarball),
+    "Published npm tarball bytes differ from the qualified artifact.",
+  );
+  requireValue(
+    registry.packument["dist-tags"]?.[params.publishTag] === params.version,
+    `${params.packageName}: ${params.publishTag} differs from the prepared version; use authorized tag repair.`,
+  );
+  return { alreadyPublished: true };
+}
+
+function outputValues(file, values) {
+  writeFileSync(
+    file,
+    `${Object.entries(values)
+      .map(([key, value]) => `${key}=${value}`)
+      .join("\n")}\n`,
+    { flag: "a" },
+  );
+}
+
+async function main(argv) {
+  const [command, ...args] = argv;
+  const options = {};
+  for (let index = 0; index < args.length; index += 2) {
+    const key = args[index];
+    requireValue(
+      key?.startsWith("--") && args[index + 1] !== undefined && !Object.hasOwn(options, key),
+      "Invalid prepared npm arguments.",
+    );
+    options[key] = args[index + 1];
+  }
+  const common = {
+    repository: process.env.GITHUB_REPOSITORY,
+    workflowSha: process.env.GITHUB_SHA,
+    sourceSha: options["--source-sha"],
+    npmDistTag: options["--npm-dist-tag"] ?? "default",
+    selectionMode: options["--selection-mode"],
+    plugins: options["--plugins"] ?? "",
+    publisherPolicySha256: options["--policy-file"]
+      ? sha256(readFileSync(options["--policy-file"]))
+      : undefined,
+    token: process.env.GH_TOKEN,
+  };
+  if (command === "seal") {
+    const producer = {
+      repository: common.repository,
+      runId: Number(process.env.GITHUB_RUN_ID),
+      runAttempt: Number(process.env.GITHUB_RUN_ATTEMPT),
+      workflowPath: WORKFLOW_PATH,
+      workflowEvent: process.env.GITHUB_EVENT_NAME,
+      workflowHeadBranch: process.env.GITHUB_REF_NAME,
+      workflowSha: common.workflowSha,
+    };
+    const manifest = createPreparedNpmRelease({
+      ...common,
+      producer,
+      matrix: JSON.parse(process.env.PLUGIN_MATRIX),
+      artifacts: readJson(options["--artifacts-file"], 4 * MAX_MANIFEST_BYTES).artifacts,
+      workflowRun: readJson(options["--run-file"]),
+      workflowJobs: readJson(options["--jobs-file"], 4 * MAX_MANIFEST_BYTES),
+    });
+    mkdirSync(options["--output-dir"], { recursive: true });
+    writeFileSync(
+      join(options["--output-dir"], PREPARED_NPM_MANIFEST),
+      `${JSON.stringify(manifest)}\n`,
+    );
+    outputValues(options["--github-output"], {
+      artifact_name: preparedNpmArtifactName(common.sourceSha, producer),
+    });
+  } else if (command === "load") {
+    const manifest = await downloadPreparedNpmRelease({
+      ...common,
+      sourceRoot: options["--source-root"] ?? process.cwd(),
+      artifact: JSON.parse(options["--artifact"]),
+      archivePath: options["--archive-path"],
+    });
+    writeFileSync(options["--output"], JSON.stringify(manifest));
+    outputValues(options["--github-output"], {
+      has_candidates: true,
+      has_selection: true,
+      candidate_count: manifest.packages.length,
+      selection_count: manifest.packages.length,
+      matrix: JSON.stringify(manifest.packages),
+      all_matrix: JSON.stringify(manifest.packages),
+    });
+  } else if (command === "consume") {
+    const result = await consumePreparedNpmPackage({
+      ...common,
+      package: JSON.parse(options["--package"]),
+      sourcePackageJson: options["--source-package-json"],
+      cacheDir: options["--cache-dir"],
+      outputDir: options["--output-dir"],
+    });
+    outputValues(options["--github-output"], {
+      package_name: result.manifest.package.name,
+      package_version: result.manifest.package.version,
+      publish_route: result.manifest.publication.route,
+      publish_tag: result.manifest.publication.tag,
+      tarball_path: result.tarballPath,
+      tarball_sha256: result.tarballSha256,
+    });
+  } else if (command === "registry") {
+    const result = await verifyPreparedNpmRegistry({
+      packageName: options["--package-name"],
+      version: options["--version"],
+      publishTag: options["--publish-tag"],
+      route: options["--route"],
+      tarballPath: options["--tarball"],
+      allowMissing: options["--allow-missing"] === "true",
+    });
+    if (options["--github-output"]) {
+      outputValues(options["--github-output"], { already_published: result.alreadyPublished });
+    }
+    console.log(
+      `${options["--package-name"]}@${options["--version"]}: ${result.alreadyPublished ? "verified exact published bytes and selector" : "qualified artifact ready for publication"}`,
+    );
+  } else {
+    throw new Error(
+      "Usage: plugin-npm-prepared-release.mjs <seal|load|consume|registry> [options]",
+    );
+  }
+}
+
+if (process.argv[1] && pathToFileURL(process.argv[1]).href === import.meta.url) {
+  try {
+    await main(process.argv.slice(2));
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    console.error("[plugin-npm-prepared-release] FAILED (exit 1)");
+    process.exitCode = 1;
+  }
+}
diff --git a/scripts/plugin-npm-security-prepare.mts b/scripts/plugin-npm-security-prepare.mts
new file mode 100644
index 0000000000000000000000000000000000000000..327af51b70d9a4f433c4c4d8a79458d171100319
--- /dev/null
+++ b/scripts/plugin-npm-security-prepare.mts
@@ -0,0 +1,267 @@
+import { execFileSync, spawnSync } from "node:child_process";
+import {
+  appendFileSync,
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  realpathSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, join, relative, resolve, sep } from "node:path";
+import { pathToFileURL } from "node:url";
+import { resolveNpmJsonEntries } from "./lib/npm-json-output.mts";
+import {
+  listPublishablePluginPackages,
+  resolveCandidatePluginPackageDir,
+  type PublishablePluginPackage,
+} from "./lib/plugin-npm-security-scan.mts";
+import { resolveNpmRunner } from "./npm-runner.mts";
+import {
+  inspectPackageTarballBytes,
+  readBoundedRegularFile,
+} from "./plugin-publication-artifact.mjs";
+
+const MAX_PACK_STDOUT_BYTES = 8 * 1024 * 1024;
+const MAX_TARBALL_BYTES = 128 * 1024 * 1024;
+const PACK_TIMEOUT_MS = 20 * 60 * 1000;
+
+type ParsedArgs = {
+  candidateRoot: string;
+  candidateSha: string;
+  command: "plan" | "prepare";
+  extensionId: string;
+  githubOutput: string;
+  outputDir: string;
+  packageDir: string;
+  packageName: string;
+  toolingSha: string;
+};
+
+function parseArgs(argv: string[]): ParsedArgs {
+  const command = argv[0];
+  if (command !== "plan" && command !== "prepare") {
+    throw new Error("Expected plugin npm security prepare command: plan or prepare.");
+  }
+  const values = new Map<string, string>();
+  for (let index = 1; index < argv.length; index += 2) {
+    const name = argv[index];
+    const value = argv[index + 1];
+    if (!name?.startsWith("--") || value === undefined || values.has(name)) {
+      throw new Error(`Invalid plugin npm security prepare argument near ${name}.`);
+    }
+    values.set(name, value);
+  }
+  const candidateRoot = values.get("--candidate-root") ?? "";
+  if (!candidateRoot) {
+    throw new Error("--candidate-root is required.");
+  }
+  const parsed: ParsedArgs = {
+    candidateRoot: resolve(candidateRoot),
+    candidateSha: values.get("--candidate-sha") ?? "",
+    command,
+    extensionId: values.get("--extension-id") ?? "",
+    githubOutput: values.get("--github-output") ?? "",
+    outputDir: values.get("--output-dir") ?? "",
+    packageDir: values.get("--package-dir") ?? "",
+    packageName: values.get("--package-name") ?? "",
+    toolingSha: values.get("--tooling-sha") ?? "",
+  };
+  if (command === "plan") {
+    if (!parsed.githubOutput) {
+      throw new Error("plan requires --github-output.");
+    }
+    return parsed;
+  }
+  if (
+    !/^[0-9a-f]{40}$/u.test(parsed.candidateSha) ||
+    !/^[0-9a-f]{40}$/u.test(parsed.toolingSha) ||
+    !/^[a-z0-9][a-z0-9._-]*$/u.test(parsed.extensionId) ||
+    parsed.packageDir !== `extensions/${parsed.extensionId}` ||
+    !parsed.packageName ||
+    !parsed.outputDir
+  ) {
+    throw new Error("prepare received an invalid package or commit identity.");
+  }
+  parsed.outputDir = resolve(parsed.outputDir);
+  return parsed;
+}
+
+function relativePackage(plugin: PublishablePluginPackage, candidateRoot: string) {
+  const packageDir = relative(candidateRoot, plugin.packageDir).split(sep).join("/");
+  if (packageDir !== `extensions/${plugin.extensionId}`) {
+    throw new Error(`${plugin.packageName}: package directory escaped the candidate checkout.`);
+  }
+  return {
+    extensionId: plugin.extensionId,
+    packageDir,
+    packageName: plugin.packageName,
+    packageVersion: plugin.packageVersion,
+  };
+}
+
+async function planPackages(args: ParsedArgs): Promise<void> {
+  const candidateRoot = realpathSync(args.candidateRoot);
+  const packages = (await listPublishablePluginPackages(candidateRoot)).map((plugin) =>
+    relativePackage(plugin, candidateRoot),
+  );
+  appendFileSync(args.githubOutput, `packages_json=${JSON.stringify(packages)}\n`, "utf8");
+}
+
+function gitSha(root: string): string {
+  return execFileSync("git", ["-C", root, "rev-parse", "HEAD"], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+  }).trim();
+}
+
+function parsePackOutput(stdout: string): Array<Record<string, unknown>> {
+  const raw = stdout.trim();
+  for (let index = raw.length - 1; index >= 0; index -= 1) {
+    if (raw[index] !== "[" && raw[index] !== "{") {
+      continue;
+    }
+    try {
+      const entries = resolveNpmJsonEntries(JSON.parse(raw.slice(index)));
+      if (entries.length > 0) {
+        return entries as Array<Record<string, unknown>>;
+      }
+    } catch {
+      // npm can print bundled dependency diagnostics before its JSON result.
+    }
+  }
+  throw new Error("Trusted plugin packaging did not emit npm pack JSON.");
+}
+
+async function preparePackage(args: ParsedArgs): Promise<void> {
+  const toolingRoot = realpathSync(process.cwd());
+  const candidateRoot = realpathSync(args.candidateRoot);
+  if (gitSha(toolingRoot) !== args.toolingSha || gitSha(candidateRoot) !== args.candidateSha) {
+    throw new Error("Plugin packaging checkout identity differs from the trusted plan.");
+  }
+  const packages = await listPublishablePluginPackages(candidateRoot);
+  const selected = packages.find(
+    (plugin) =>
+      plugin.extensionId === args.extensionId &&
+      plugin.packageName === args.packageName &&
+      relativePackage(plugin, candidateRoot).packageDir === args.packageDir,
+  );
+  if (!selected) {
+    throw new Error("Selected plugin package is absent from the trusted package plan.");
+  }
+  resolveCandidatePluginPackageDir(candidateRoot, args.extensionId);
+  if (existsSync(args.outputDir)) {
+    if (readdirSync(args.outputDir).length !== 0) {
+      throw new Error("Plugin security artifact output directory must be empty.");
+    }
+  } else {
+    mkdirSync(args.outputDir, { recursive: true });
+  }
+
+  // This is supplemental inert checked-in npm input, never a final or
+  // publication artifact. Exact-byte scanning is a future publisher redesign,
+  // not a capability of this workflow.
+  const npm = resolveNpmRunner({
+    env: {
+      CI: "1",
+      HOME: tmpdir(),
+      NODE_OPTIONS: "--max-old-space-size=512",
+      NPM_CONFIG_AUDIT: "false",
+      NPM_CONFIG_FUND: "false",
+      NPM_CONFIG_GLOBALCONFIG: "/dev/null",
+      NPM_CONFIG_IGNORE_SCRIPTS: "true",
+      NPM_CONFIG_PROVENANCE: "false",
+      NPM_CONFIG_USERCONFIG: join(tmpdir(), "openclaw-plugin-security-empty-npmrc"),
+      NPM_CONFIG_WORKSPACES: "false",
+      PATH: process.env.PATH,
+      TMPDIR: tmpdir(),
+    },
+    npmArgs: [
+      "pack",
+      "--json",
+      "--ignore-scripts",
+      "--workspaces=false",
+      "--pack-destination",
+      args.outputDir,
+    ],
+  });
+  const result = spawnSync(npm.command, npm.args, {
+    cwd: selected.packageDir,
+    encoding: "utf8",
+    env: npm.env,
+    killSignal: "SIGKILL",
+    maxBuffer: MAX_PACK_STDOUT_BYTES,
+    shell: npm.shell,
+    stdio: ["ignore", "pipe", "inherit"],
+    timeout: PACK_TIMEOUT_MS,
+    windowsVerbatimArguments: npm.windowsVerbatimArguments,
+  });
+  if (result.status !== 0 || result.signal || result.error) {
+    throw new Error(`${selected.packageName}: trusted inert plugin pack failed.`);
+  }
+  const packEntries = parsePackOutput(result.stdout);
+  if (packEntries.length !== 1) {
+    throw new Error(`${selected.packageName}: npm pack returned an invalid result count.`);
+  }
+  const tarballName = packEntries[0]?.filename;
+  if (
+    typeof tarballName !== "string" ||
+    !/^[A-Za-z0-9][A-Za-z0-9._-]*\.tgz$/u.test(tarballName) ||
+    basename(tarballName) !== tarballName
+  ) {
+    throw new Error(`${selected.packageName}: npm pack returned an unsafe tarball name.`);
+  }
+  const tarballPath = join(args.outputDir, tarballName);
+  const tarballBytes = readBoundedRegularFile(tarballPath, {
+    label: "Prepared plugin tarball",
+    maxBytes: MAX_TARBALL_BYTES,
+  });
+  const inspection = inspectPackageTarballBytes(tarballBytes, {
+    maxArchiveBytes: MAX_TARBALL_BYTES,
+  });
+  if (
+    inspection.packageManifest.name !== selected.packageName ||
+    inspection.packageManifest.version !== selected.packageVersion
+  ) {
+    throw new Error(`${selected.packageName}: inert package input identity mismatch.`);
+  }
+  const artifactEntries = readdirSync(args.outputDir);
+  if (artifactEntries.length !== 1 || artifactEntries[0] !== tarballName) {
+    throw new Error(`${selected.packageName}: packaging produced unexpected artifact files.`);
+  }
+  const metadata = {
+    artifactKind: "supplemental-inert-package-input",
+    candidateSha: args.candidateSha,
+    extensionId: selected.extensionId,
+    packageDir: args.packageDir,
+    packageName: selected.packageName,
+    packageVersion: selected.packageVersion,
+    schemaVersion: 1,
+    tarballName,
+    tarballSha256: inspection.tarballSha256,
+    toolingSha: args.toolingSha,
+  };
+  writeFileSync(
+    join(args.outputDir, "plugin-npm-security-artifact.json"),
+    `${JSON.stringify(metadata, null, 2)}\n`,
+    { encoding: "utf8", mode: 0o600 },
+  );
+}
+
+async function main(): Promise<void> {
+  const args = parseArgs(process.argv.slice(2));
+  if (args.command === "plan") {
+    await planPackages(args);
+  } else {
+    await preparePackage(args);
+  }
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+  try {
+    await main();
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+  }
+}
diff --git a/scripts/plugin-npm-security-scan-runner.mjs b/scripts/plugin-npm-security-scan-runner.mjs
new file mode 100644
index 0000000000000000000000000000000000000000..cd3c69250b8633d8859ce50b2b3cbe941c744601
--- /dev/null
+++ b/scripts/plugin-npm-security-scan-runner.mjs
@@ -0,0 +1,289 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { runManagedCommand, terminateManagedChild } from "./lib/managed-child-process.mts";
+
+const DEFAULT_HEAP_MB = 768;
+const DEFAULT_RSS_MB = 1024;
+const DEFAULT_TIMEOUT_MS = 15 * 60 * 1000;
+const MAX_CAPTURE_BYTES = 512 * 1024;
+const MAX_REPORT_BYTES = 1024 * 1024;
+const SCANNER_PATH = fileURLToPath(new URL("./plugin-npm-security-scan.mts", import.meta.url));
+
+function parseArgs(argv) {
+  const values = new Map();
+  for (let index = 0; index < argv.length; index += 2) {
+    const name = argv[index];
+    const value = argv[index + 1];
+    if (!name?.startsWith("--") || value === undefined || values.has(name)) {
+      throw new Error(`Invalid plugin npm security runner argument near ${String(name)}.`);
+    }
+    values.set(name, value);
+  }
+  const artifactRoot = values.get("--artifact-root") ?? "";
+  const candidateSha = values.get("--candidate-sha") ?? "";
+  const report = values.get("--report") ?? "";
+  const toolingSha = values.get("--tooling-sha") ?? "";
+  if (
+    !artifactRoot ||
+    !/^[0-9a-f]{40}$/u.test(candidateSha) ||
+    !report ||
+    !/^[0-9a-f]{40}$/u.test(toolingSha)
+  ) {
+    throw new Error("Plugin npm security runner received an invalid identity or path.");
+  }
+  return {
+    artifactRoot: path.resolve(artifactRoot),
+    candidateSha,
+    report: path.resolve(report),
+    toolingSha,
+  };
+}
+
+function testOverride(name, fallback) {
+  if (process.env.NODE_ENV !== "test") {
+    return fallback;
+  }
+  return process.env[name] || fallback;
+}
+
+function boundedAppend(current, chunk) {
+  if (current.length >= MAX_CAPTURE_BYTES) {
+    return current;
+  }
+  return Buffer.concat([current, chunk]).subarray(0, MAX_CAPTURE_BYTES);
+}
+
+function processGroupRssBytes(pid) {
+  if (process.platform === "win32") {
+    return { status: "unavailable" };
+  }
+  const result = spawnSync("ps", ["-A", "-o", "pid=,pgid=,rss=,stat="], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: 5_000,
+  });
+  if (result.error || result.status !== 0) {
+    return { status: "failed" };
+  }
+  const rows = result.stdout
+    .split("\n")
+    .map((line) => line.trim().split(/\s+/u))
+    .filter((columns) => columns.length >= 4 && Number(columns[1]) === pid);
+  const activeRows = rows.filter((columns) => !columns[3].startsWith("Z"));
+  if (activeRows.length === 0) {
+    return rows.length > 0 || !processExists(pid) ? { status: "exited" } : { status: "failed" };
+  }
+  const samples = activeRows.map((columns) => Number(columns[2]));
+  // Linux can release a task's memory before marking it zombie; zero RSS is
+  // a valid measurement, not a sampler failure or proof that the group exited.
+  if (samples.some((value) => !Number.isSafeInteger(value) || value < 0)) {
+    return { status: "failed" };
+  }
+  return {
+    bytes: samples.reduce((total, value) => total + value, 0) * 1024,
+    status: "measured",
+  };
+}
+
+function processExists(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error?.code !== "ESRCH";
+  }
+}
+
+function sanitizeOutput(value, args) {
+  let output = value.toString("utf8");
+  for (const [source, replacement] of [
+    [args.artifactRoot, "<artifacts>"],
+    [path.dirname(args.report), "<report-dir>"],
+    [process.cwd(), "<tooling>"],
+  ]) {
+    output = output.replaceAll(source, replacement);
+  }
+  return output
+    .replaceAll(/\/(?:private\/)?tmp\/openclaw-plugin-npm-scan-[^/\s:]+/gu, "<scanner-stage>")
+    .replaceAll(/(^|[\s:(])\/[^ \t\n\r:,)\]}]+/gu, "$1<path>");
+}
+
+function compactFailureReport(args, category) {
+  return {
+    candidateSha: args.candidateSha,
+    errors: [`Plugin npm security scanner ${category}.`],
+    layout: null,
+    packages: [],
+    scanScope: "supplemental-inert-package-input",
+    schemaVersion: 1,
+    status: "fail",
+    summary: {
+      findingCount: 0,
+      packageCount: 0,
+      reviewedCriticalFindingCount: 0,
+      unexpectedCriticalFindingCount: 0,
+    },
+    toolingSha: args.toolingSha,
+  };
+}
+
+function writeFailureReport(args, category) {
+  mkdirSync(path.dirname(args.report), { recursive: true });
+  writeFileSync(args.report, `${JSON.stringify(compactFailureReport(args, category))}\n`, {
+    encoding: "utf8",
+    mode: 0o600,
+  });
+}
+
+function existingReportStatus(args) {
+  if (!existsSync(args.report)) {
+    return null;
+  }
+  const stat = lstatSync(args.report);
+  if (!stat.isFile() || stat.size === 0 || stat.size > MAX_REPORT_BYTES) {
+    return null;
+  }
+  try {
+    const report = JSON.parse(readFileSync(args.report, "utf8"));
+    const valid =
+      report?.candidateSha === args.candidateSha &&
+      Array.isArray(report?.errors) &&
+      Array.isArray(report?.packages) &&
+      report?.scanScope === "supplemental-inert-package-input" &&
+      (report?.status === "pass" || report?.status === "fail") &&
+      typeof report?.summary === "object" &&
+      report?.toolingSha === args.toolingSha &&
+      report?.schemaVersion === 1;
+    return valid ? report.status : null;
+  } catch {
+    return null;
+  }
+}
+
+async function run(argv) {
+  const args = parseArgs(argv);
+  const scannerPath = testOverride("OPENCLAW_PLUGIN_SECURITY_RUNNER_CHILD", SCANNER_PATH);
+  const heapMb = Number(testOverride("OPENCLAW_PLUGIN_SECURITY_RUNNER_HEAP_MB", DEFAULT_HEAP_MB));
+  const rssMb = Number(testOverride("OPENCLAW_PLUGIN_SECURITY_RUNNER_RSS_MB", DEFAULT_RSS_MB));
+  const timeoutMs = Number(
+    testOverride("OPENCLAW_PLUGIN_SECURITY_RUNNER_TIMEOUT_MS", DEFAULT_TIMEOUT_MS),
+  );
+  if (
+    !Number.isSafeInteger(heapMb) ||
+    heapMb < 16 ||
+    heapMb > 4096 ||
+    !Number.isSafeInteger(rssMb) ||
+    rssMb < 16 ||
+    rssMb > 4096 ||
+    !Number.isSafeInteger(timeoutMs) ||
+    timeoutMs < 10 ||
+    timeoutMs > DEFAULT_TIMEOUT_MS
+  ) {
+    throw new Error("Plugin npm security runner limits are invalid.");
+  }
+
+  let stdout = Buffer.alloc(0);
+  let stderr = Buffer.alloc(0);
+  let rssFailure;
+  let cancellationSignal;
+  let child;
+  let rssTimer;
+  let exitCode = 1;
+  let failure;
+  try {
+    exitCode = await runManagedCommand({
+      bin: process.execPath,
+      args: [`--max-old-space-size=${heapMb}`, "--import", "tsx", scannerPath, ...argv],
+      cwd: process.cwd(),
+      shell: false,
+      requireProcessTreeExit: process.platform !== "win32",
+      timeoutMs,
+      timeoutKillGraceMs: 0,
+      env: {
+        CI: "1",
+        HOME: process.env.HOME,
+        NODE_ENV: process.env.NODE_ENV,
+        PATH: process.env.PATH,
+      },
+      stdio: ["ignore", "pipe", "pipe"],
+      onSignal: (signal) => {
+        cancellationSignal ??= signal;
+      },
+      onReady: (scanner) => {
+        child = scanner;
+        scanner.stdout.on("data", (chunk) => {
+          stdout = boundedAppend(stdout, chunk);
+        });
+        scanner.stderr.on("data", (chunk) => {
+          stderr = boundedAppend(stderr, chunk);
+        });
+        rssTimer = setInterval(() => {
+          if (scanner.exitCode !== null || scanner.signalCode !== null || !scanner.pid) {
+            return;
+          }
+          const rssMeasurement = processGroupRssBytes(scanner.pid);
+          if (rssMeasurement.status === "failed") {
+            rssFailure ??= "could not measure RSS";
+          } else if (
+            rssMeasurement.status === "measured" &&
+            rssMeasurement.bytes > rssMb * 1024 * 1024
+          ) {
+            rssFailure ??= "exceeded its RSS limit";
+          } else {
+            return;
+          }
+          terminateManagedChild(scanner, "SIGKILL");
+        }, 250);
+      },
+    });
+  } catch (error) {
+    failure = error;
+  } finally {
+    clearInterval(rssTimer);
+  }
+
+  const safeStdout = sanitizeOutput(stdout, args);
+  const safeStderr = sanitizeOutput(stderr, args);
+  if (safeStdout) {
+    process.stdout.write(safeStdout);
+  }
+  if (safeStderr) {
+    process.stderr.write(safeStderr);
+  }
+  // Failed physical cleanup must not look like a successfully joined cancellation or timeout.
+  if (failure && failure.code !== "ETIMEDOUT") {
+    writeFailureReport(args, child?.pid ? "could not complete process cleanup" : "could not start");
+    return 1;
+  }
+  const failureCategory = cancellationSignal
+    ? `cancelled by ${String(cancellationSignal)}`
+    : failure
+      ? "timed out"
+      : rssFailure;
+  if (failureCategory) {
+    writeFailureReport(args, failureCategory);
+    return cancellationSignal ? exitCode : 1;
+  }
+  const reportStatus = existingReportStatus(args);
+  if (!reportStatus) {
+    writeFailureReport(
+      args,
+      child?.signalCode
+        ? "exceeded its process limit"
+        : existsSync(args.report)
+          ? "wrote an invalid report"
+          : "did not write a report",
+    );
+    return 1;
+  }
+  return exitCode === 0 && reportStatus === "pass" ? 0 : 1;
+}
+
+try {
+  process.exitCode = await run(process.argv.slice(2));
+} catch (error) {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+}
diff --git a/scripts/plugin-sdk-api-release-evidence.mjs b/scripts/plugin-sdk-api-release-evidence.mjs
new file mode 100644
index 0000000000000000000000000000000000000000..9281488855a7539ad438a7b268a50cd3f0294006
--- /dev/null
+++ b/scripts/plugin-sdk-api-release-evidence.mjs
@@ -0,0 +1,243 @@
+#!/usr/bin/env node
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const PLUGIN_SDK_API_RELEASE_EVIDENCE_SCHEMA = "openclaw.plugin-sdk-api-release-evidence/v1";
+const PLUGIN_SDK_API_RELEASE_EVIDENCE_SET_SCHEMA =
+  "openclaw.plugin-sdk-api-release-evidence-set/v1";
+
+const SHA_PATTERN = /^[a-f0-9]{40}$/u;
+const DIGEST_PATTERN = /^[a-f0-9]{64}$/u;
+
+// Release workflows fetch this file directly from their trusted workflow SHA,
+// so it must stay runnable without a workspace install.
+function isReleaseEvidenceObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function assertSha(value, label) {
+  if (typeof value !== "string" || !SHA_PATTERN.test(value)) {
+    throw new Error(`${label} must be a full lowercase commit SHA`);
+  }
+}
+
+function diffPayload(diff) {
+  if (
+    !isReleaseEvidenceObject(diff) ||
+    !Array.isArray(diff.entrypointsAdded) ||
+    !Array.isArray(diff.entrypointsRemoved) ||
+    !Array.isArray(diff.exports) ||
+    typeof diff.digest !== "string" ||
+    !DIGEST_PATTERN.test(diff.digest)
+  ) {
+    throw new Error("Plugin SDK API release evidence contains an invalid diff");
+  }
+  return {
+    entrypointsAdded: diff.entrypointsAdded,
+    entrypointsRemoved: diff.entrypointsRemoved,
+    exports: diff.exports,
+  };
+}
+
+function hasChanges(payload) {
+  return (
+    payload.entrypointsAdded.length > 0 ||
+    payload.entrypointsRemoved.length > 0 ||
+    payload.exports.length > 0
+  );
+}
+
+export function createPluginSdkApiReleaseEvidence({
+  baseRef,
+  baseSha,
+  diff,
+  headSha,
+  workflowSha,
+}) {
+  assertSha(baseSha, "Plugin SDK API evidence base SHA");
+  assertSha(headSha, "Plugin SDK API evidence head SHA");
+  assertSha(workflowSha, "Plugin SDK API evidence workflow SHA");
+  if (typeof baseRef !== "string" || baseRef.length === 0) {
+    throw new Error("Plugin SDK API evidence base ref is required");
+  }
+  const payload = diffPayload(diff);
+  const digest = createHash("sha256").update(JSON.stringify(payload), "utf8").digest("hex");
+  if (diff.digest !== digest) {
+    throw new Error("Plugin SDK API diff digest does not match its payload");
+  }
+  return {
+    schema: PLUGIN_SDK_API_RELEASE_EVIDENCE_SCHEMA,
+    status: "checked",
+    baseRef,
+    baseSha,
+    headSha,
+    hasChanges: hasChanges(payload),
+    digest,
+    diff,
+    workflowSha,
+  };
+}
+
+export function selectPluginSdkApiReleaseEvidence({ evidence, npmDistTag }) {
+  if (evidence?.schema !== PLUGIN_SDK_API_RELEASE_EVIDENCE_SET_SCHEMA) {
+    return evidence;
+  }
+  const selectors = evidence.selectors;
+  if (
+    Object.keys(evidence).length !== 2 ||
+    !isReleaseEvidenceObject(selectors) ||
+    Object.keys(selectors).length !== 2 ||
+    ["beta", "latest"].some(
+      (selector) => selectors[selector]?.schema !== PLUGIN_SDK_API_RELEASE_EVIDENCE_SCHEMA,
+    ) ||
+    selectors.beta.headSha !== selectors.latest.headSha ||
+    selectors.beta.workflowSha !== selectors.latest.workflowSha
+  ) {
+    throw new Error(
+      "Plugin SDK API selector evidence must bind beta and latest to one release and tooling SHA",
+    );
+  }
+  if (npmDistTag !== "beta" && npmDistTag !== "latest") {
+    throw new Error("Plugin SDK API selector evidence requires the beta or latest npm dist-tag");
+  }
+  return selectors[npmDistTag];
+}
+
+export function createPluginSdkApiReleaseEvidenceSet(selectors) {
+  const evidence = { schema: PLUGIN_SDK_API_RELEASE_EVIDENCE_SET_SCHEMA, selectors };
+  selectPluginSdkApiReleaseEvidence({ evidence, npmDistTag: "beta" });
+  return evidence;
+}
+
+export function validatePluginSdkApiReleaseEvidence({
+  acknowledgement,
+  currentSelectorRef = "",
+  currentSelectorSha = "",
+  evidence: inputEvidence,
+  expectedHeadSha,
+  expectedWorkflowSha,
+  npmDistTag = "",
+  targetRef = "",
+}) {
+  const evidence = selectPluginSdkApiReleaseEvidence({ evidence: inputEvidence, npmDistTag });
+  assertSha(expectedHeadSha, "Expected Plugin SDK API evidence head SHA");
+  if (
+    !isReleaseEvidenceObject(evidence) ||
+    evidence.schema !== PLUGIN_SDK_API_RELEASE_EVIDENCE_SCHEMA
+  ) {
+    throw new Error("Plugin SDK API release evidence is missing or invalid");
+  }
+  assertSha(evidence.workflowSha, "Plugin SDK API evidence workflow SHA");
+  assertSha(expectedWorkflowSha, "Expected Plugin SDK API evidence workflow SHA");
+  if (evidence.workflowSha !== expectedWorkflowSha) {
+    throw new Error("Plugin SDK API evidence workflow SHA does not match trusted tooling");
+  }
+  if (evidence.status !== "checked") {
+    throw new Error("Plugin SDK API release evidence has an invalid status");
+  }
+  assertSha(evidence.baseSha, "Plugin SDK API evidence base SHA");
+  assertSha(evidence.headSha, "Plugin SDK API evidence head SHA");
+  if (evidence.headSha !== expectedHeadSha) {
+    throw new Error("Plugin SDK API evidence head SHA does not match the release");
+  }
+  if (typeof evidence.baseRef !== "string" || evidence.baseRef.length === 0) {
+    throw new Error("Plugin SDK API evidence base ref is missing");
+  }
+  const selectorValues = [currentSelectorRef, currentSelectorSha, targetRef];
+  const selectorValueCount = selectorValues.filter((value) => value !== "").length;
+  if (selectorValueCount !== 0 && selectorValueCount !== selectorValues.length) {
+    throw new Error("Current Plugin SDK API selector validation is incomplete");
+  }
+  if (selectorValueCount > 0) {
+    if (
+      typeof currentSelectorRef !== "string" ||
+      currentSelectorRef.length === 0 ||
+      typeof targetRef !== "string" ||
+      targetRef.length === 0
+    ) {
+      throw new Error("Current Plugin SDK API selector refs are invalid");
+    }
+    assertSha(currentSelectorSha, "Current Plugin SDK API selector SHA");
+    if (currentSelectorRef === targetRef && currentSelectorSha !== expectedHeadSha) {
+      throw new Error("Current npm dist-tag target does not match the release SHA");
+    }
+    if (
+      currentSelectorRef !== targetRef &&
+      (evidence.baseRef !== currentSelectorRef || evidence.baseSha !== currentSelectorSha)
+    ) {
+      throw new Error("Plugin SDK API evidence predecessor no longer matches the npm dist-tag");
+    }
+  }
+  const payload = diffPayload(evidence.diff);
+  const digest = createHash("sha256").update(JSON.stringify(payload), "utf8").digest("hex");
+  if (evidence.digest !== digest || evidence.diff.digest !== digest) {
+    throw new Error("Plugin SDK API release evidence digest does not match its diff");
+  }
+  const changed = hasChanges(payload);
+  if (evidence.hasChanges !== changed) {
+    throw new Error("Plugin SDK API release evidence change state does not match its diff");
+  }
+  const expectedAcknowledgement = digest.slice(0, 8);
+  if (changed && acknowledgement !== expectedAcknowledgement) {
+    throw new Error(
+      `Plugin SDK API changes require acknowledgement digest ${expectedAcknowledgement}`,
+    );
+  }
+  return {
+    acknowledgement: changed ? expectedAcknowledgement : null,
+    digest,
+    hasChanges: changed,
+    status: "checked",
+  };
+}
+
+function readJson(filePath) {
+  return JSON.parse(fs.readFileSync(filePath, "utf8"));
+}
+
+function readArgs(argv) {
+  const values = new Map();
+  for (let index = 0; index < argv.length; index += 2) {
+    const flag = argv[index];
+    const value = argv[index + 1];
+    if (!flag?.startsWith("--") || value === undefined) {
+      throw new Error(
+        "Usage: plugin-sdk-api-release-evidence --manifest <path> --head <sha> --workflow-sha <sha> [--npm-dist-tag <tag>] [--acknowledge <digest>] [--current-selector-ref <tag> --current-selector-sha <sha> --target-ref <tag>]",
+      );
+    }
+    values.set(flag, value);
+  }
+  for (const flag of ["--manifest", "--head", "--workflow-sha"]) {
+    if (!values.has(flag)) {
+      throw new Error(`${flag} is required`);
+    }
+  }
+  return values;
+}
+
+function main() {
+  const args = readArgs(process.argv.slice(2));
+  const manifest = readJson(args.get("--manifest"));
+  const result = validatePluginSdkApiReleaseEvidence({
+    acknowledgement: args.get("--acknowledge") ?? "",
+    currentSelectorRef: args.get("--current-selector-ref"),
+    currentSelectorSha: args.get("--current-selector-sha"),
+    evidence: manifest.pluginSdkApi,
+    expectedHeadSha: args.get("--head"),
+    expectedWorkflowSha: args.get("--workflow-sha"),
+    npmDistTag: args.get("--npm-dist-tag"),
+    targetRef: args.get("--target-ref"),
+  });
+  process.stdout.write(`${JSON.stringify(result)}\n`);
+}
+
+if (process.argv[1] && pathToFileURL(path.resolve(process.argv[1])).href === import.meta.url) {
+  try {
+    main();
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+  }
+}
diff --git a/scripts/pr-crabbox-gate-publisher.mjs b/scripts/pr-crabbox-gate-publisher.mjs
new file mode 100644
index 0000000000000000000000000000000000000000..bb215281c2dfb8a300efb64bc1d289218d307a7f
--- /dev/null
+++ b/scripts/pr-crabbox-gate-publisher.mjs
@@ -0,0 +1,692 @@
+#!/usr/bin/env node
+import { execFileSync, spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { isRecord } from "./lib/record-shared.mjs";
+import {
+  buildCrabboxGateCommand,
+  crabboxGatePlanDigest,
+  CRABBOX_GATE_CHECK_NAME,
+  formatCrabboxGateCheckSummary,
+  validateCrabboxGatePlan,
+  validateForwardAncestry,
+} from "./pr-lib/crabbox-gate-contract.mjs";
+import { resolveCrabboxGatePlan } from "./pr-lib/crabbox-gate-plan.mts";
+
+const REPOSITORY = "openclaw/openclaw";
+const ORGANIZATION = "openclaw";
+const WORKFLOW = ".github/workflows/pr-crabbox-gate-publisher.yml";
+const BOOTSTRAP_PATH = "scripts/crabbox-untrusted-bootstrap.sh";
+const CHECK_NAME = CRABBOX_GATE_CHECK_NAME;
+const CHECK_APP_ID = 15368;
+const SHA_PATTERN = /^[0-9a-f]{40}$/u;
+const RUN_ID_PATTERN = /^run_[a-z0-9]+$/u;
+const LEASE_ID_PATTERN = /^cbx_[a-z0-9]+$/u;
+const MAX_PROOF_AGE_MS = 2 * 60 * 60 * 1000;
+const EXPECTED_MARKERS = [
+  "OPENCLAW_CRABBOX_GATE_VERSION=1",
+  "OPENCLAW_CRABBOX_GATE_MODE=remote_crabbox_aws",
+  "OPENCLAW_CRABBOX_GATE_STAGE=build:ok",
+  "OPENCLAW_CRABBOX_GATE_STAGE=check:ok",
+  "OPENCLAW_CRABBOX_GATE_STAGE=test:ok",
+  "OPENCLAW_CRABBOX_GATE_RESULT=success",
+];
+
+function requiredString(value, label) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`${label} is required`);
+  }
+  return value;
+}
+
+function requiredPositiveInteger(value, label) {
+  const number = Number(value);
+  if (!Number.isSafeInteger(number) || number < 1) {
+    throw new Error(`${label} must be a positive integer`);
+  }
+  return number;
+}
+
+function record(value, label) {
+  if (!isRecord(value)) {
+    throw new Error(`${label} must be an object`);
+  }
+  return value;
+}
+
+function assertExactKeys(value, expected, label) {
+  const input = record(value, label);
+  const actual = Object.keys(input).toSorted((a, b) => a.localeCompare(b));
+  const wanted = [...expected].toSorted((a, b) => a.localeCompare(b));
+  if (JSON.stringify(actual) !== JSON.stringify(wanted)) {
+    throw new Error(`${label} keys must be exactly: ${wanted.join(", ")}`);
+  }
+  return input;
+}
+
+function requiredEnv(env, name) {
+  return requiredString(env[name], name);
+}
+
+export { buildCrabboxGateCommand };
+
+export function validatePublisherRequest(event, env) {
+  if (requiredEnv(env, "GITHUB_REPOSITORY") !== REPOSITORY) {
+    throw new Error(`Crabbox gate publisher requires repository ${REPOSITORY}`);
+  }
+  if (requiredEnv(env, "GITHUB_EVENT_NAME") !== "workflow_dispatch") {
+    throw new Error("Crabbox gate publisher requires workflow_dispatch");
+  }
+  if (requiredEnv(env, "GITHUB_REF") !== "refs/heads/main") {
+    throw new Error("Crabbox gate publisher must run from refs/heads/main");
+  }
+  const workflowSha = requiredEnv(env, "GITHUB_WORKFLOW_SHA");
+  if (!SHA_PATTERN.test(workflowSha) || workflowSha !== requiredEnv(env, "GITHUB_SHA")) {
+    throw new Error("Crabbox gate publisher requires one exact trusted workflow SHA");
+  }
+  const expectedWorkflowRef = `${REPOSITORY}/${WORKFLOW}@refs/heads/main`;
+  if (requiredEnv(env, "GITHUB_WORKFLOW_REF") !== expectedWorkflowRef) {
+    throw new Error(`Crabbox gate publisher requires ${expectedWorkflowRef}`);
+  }
+  const actor = requiredEnv(env, "GITHUB_ACTOR");
+  if (actor !== requiredEnv(env, "GITHUB_TRIGGERING_ACTOR")) {
+    throw new Error("Crabbox gate publisher actor must match the triggering actor");
+  }
+  const inputs = assertExactKeys(
+    record(event, "workflow event").inputs,
+    ["base_sha", "head_sha", "pr_number"],
+    "workflow inputs",
+  );
+  const context = {
+    actor,
+    baseSha: requiredString(inputs.base_sha, "base_sha"),
+    headSha: requiredString(inputs.head_sha, "head_sha"),
+    prNumber: requiredPositiveInteger(inputs.pr_number, "pr_number"),
+    repository: REPOSITORY,
+    workflowSha,
+  };
+  if (!SHA_PATTERN.test(context.baseSha) || !SHA_PATTERN.test(context.headSha)) {
+    throw new Error("base_sha and head_sha must be exactly 40 lowercase hex characters");
+  }
+  return context;
+}
+
+function validatePullRequest(value, context) {
+  const pull = record(value, "pull request");
+  const head = record(pull.head, "pull request.head");
+  const base = record(pull.base, "pull request.base");
+  if (pull.number !== context.prNumber || pull.state !== "open") {
+    throw new Error("gate target must be the requested open pull request");
+  }
+  if (
+    base.sha !== context.baseSha ||
+    head.sha !== context.headSha ||
+    record(head.repo, "pull request.head.repo").full_name !== REPOSITORY
+  ) {
+    throw new Error("pull request exact base, head, or head repository does not match");
+  }
+  if (base.ref !== "main" || record(base.repo, "pull request.base.repo").full_name !== REPOSITORY) {
+    throw new Error("pull request base must be openclaw/openclaw main");
+  }
+}
+
+function validateActiveAdminMembership(value, actor) {
+  const membership = record(value, "organization membership");
+  if (
+    membership.state !== "active" ||
+    membership.role !== "admin" ||
+    record(membership.user, "organization membership.user").login !== actor
+  ) {
+    throw new Error(`actor ${actor} is not an active ${ORGANIZATION} organization admin`);
+  }
+}
+
+function parseProtectedMainRef(value) {
+  const ref = record(value, "main ref");
+  const mainSha = requiredString(record(ref.object, "main ref.object").sha, "main ref SHA");
+  if (ref.ref !== "refs/heads/main" || !SHA_PATTERN.test(mainSha)) {
+    throw new Error("protected main ref is malformed");
+  }
+  return mainSha;
+}
+
+async function validateCurrentProtectedMain(github, workflowSha) {
+  const mainPath = `/repos/${REPOSITORY}/git/ref/heads/main`;
+  const mainSha = parseProtectedMainRef(await github.request("GET", mainPath));
+  validateForwardAncestry(
+    await github.request("GET", `/repos/${REPOSITORY}/compare/${workflowSha}...${mainSha}`),
+    { baseSha: workflowSha, headSha: mainSha },
+    "protected main",
+  );
+  if (parseProtectedMainRef(await github.request("GET", mainPath)) !== mainSha) {
+    throw new Error("protected main moved during Crabbox authority validation");
+  }
+  return { mainSha, workflowSha };
+}
+
+function parseTime(value, label) {
+  const timestamp = Date.parse(requiredString(value, label));
+  if (!Number.isFinite(timestamp)) {
+    throw new Error(`${label} must be an ISO timestamp`);
+  }
+  return timestamp;
+}
+
+function validateServicePrincipal(value) {
+  const principal = record(value, "Crabbox service principal");
+  const allowedKeys = new Set(["admin", "auth", "org", "owner", "tokenExpiresAt"]);
+  if (
+    Object.keys(principal).some((key) => !allowedKeys.has(key)) ||
+    principal.auth !== "bearer" ||
+    principal.org !== ORGANIZATION ||
+    principal.admin !== false ||
+    (principal.tokenExpiresAt !== undefined && typeof principal.tokenExpiresAt !== "string")
+  ) {
+    throw new Error("Crabbox coordinator did not resolve the expected service principal");
+  }
+  return {
+    auth: principal.auth,
+    org: principal.org,
+    owner: requiredString(principal.owner, "Crabbox service principal owner"),
+  };
+}
+
+function validateCrabboxConfig(value, coordinator) {
+  const config = record(value, "Crabbox resolved config");
+  if (
+    config.coordinator !== coordinator ||
+    record(config.aws, "Crabbox resolved config.aws").instanceProfile !== ""
+  ) {
+    throw new Error("Crabbox AWS gate requires the trusted coordinator and no instance profile");
+  }
+}
+
+function parseCrabboxTiming(result, expectedLabel) {
+  if (result.exitCode !== 0) {
+    throw new Error(`Crabbox AWS command failed with exit code ${result.exitCode}`);
+  }
+  const timing = result.stderr
+    .trimEnd()
+    .split("\n")
+    .toReversed()
+    .map((line) => {
+      try {
+        return JSON.parse(line);
+      } catch {
+        return undefined;
+      }
+    })
+    .find((value) => isRecord(value) && value.provider === "aws");
+  const report = record(timing, "Crabbox timing report");
+  if (
+    report.provider !== "aws" ||
+    report.runStatus !== "succeeded" ||
+    report.exitCode !== 0 ||
+    report.leaseStopped !== true ||
+    report.label !== expectedLabel ||
+    !RUN_ID_PATTERN.test(report.runId) ||
+    !LEASE_ID_PATTERN.test(report.leaseId)
+  ) {
+    throw new Error("Crabbox timing report is not a successful released AWS proof");
+  }
+  return {
+    leaseId: report.leaseId,
+    runId: report.runId,
+  };
+}
+
+function sanitizedCrabboxEnvironment(env, home) {
+  const sanitized = {
+    CI: "1",
+    CRABBOX_COORDINATOR: requiredEnv(env, "CRABBOX_COORDINATOR"),
+    CRABBOX_COORDINATOR_TOKEN: requiredEnv(env, "CRABBOX_COORDINATOR_TOKEN"),
+    CRABBOX_ENV_ALLOW: "CI",
+    HOME: home,
+    LANG: env.LANG ?? "C.UTF-8",
+    NO_COLOR: "1",
+    PATH: requiredEnv(env, "PATH"),
+    TMPDIR: env.RUNNER_TEMP ?? env.TMPDIR ?? tmpdir(),
+  };
+  const accessClientId = env.CRABBOX_ACCESS_CLIENT_ID ?? "";
+  const accessClientSecret = env.CRABBOX_ACCESS_CLIENT_SECRET ?? "";
+  if (Boolean(accessClientId) !== Boolean(accessClientSecret)) {
+    throw new Error("Crabbox Access client id and secret must be provided together");
+  }
+  if (accessClientId) {
+    sanitized.CRABBOX_ACCESS_CLIENT_ID = accessClientId;
+    sanitized.CRABBOX_ACCESS_CLIENT_SECRET = accessClientSecret;
+  }
+  return sanitized;
+}
+
+export function appendCrabboxOutputTail(current, chunk) {
+  return Buffer.concat([current, Buffer.from(chunk)]).subarray(-64 * 1024);
+}
+
+async function executeCrabbox({ args, bin, env, stream = false }) {
+  return await new Promise((resolve, reject) => {
+    const child = spawn(bin, args, {
+      cwd: process.cwd(),
+      env,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    let stdout = Buffer.alloc(0);
+    let stderr = Buffer.alloc(0);
+    child.stdout.on("data", (chunk) => {
+      if (stream) {
+        process.stdout.write(chunk);
+      } else {
+        stdout = appendCrabboxOutputTail(stdout, chunk);
+      }
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr = appendCrabboxOutputTail(stderr, chunk);
+      if (stream) {
+        process.stderr.write(chunk);
+      }
+    });
+    child.on("error", reject);
+    child.on("close", (exitCode) => {
+      resolve({ exitCode, stderr: stderr.toString(), stdout: stdout.toString() });
+    });
+  });
+}
+
+function buildCrabboxRunArgs(context, bootstrapSha256) {
+  const label = `openclaw-pr-gate:${context.prNumber}:${context.baseSha}:${context.headSha}`;
+  const args =
+    `run --provider aws --target linux --class standard --market on-demand --network public ` +
+    `--tailscale=false --no-hydrate --fresh-pr ${REPOSITORY}#${context.prNumber} ` +
+    `--idle-timeout 90m --ttl 240m --stop-after always --timing-json --label ${label} ` +
+    `--script ${BOOTSTRAP_PATH} --`;
+  const command = buildCrabboxGateCommand(context.plan, bootstrapSha256);
+  return {
+    args: [...args.split(" "), context.headSha, "/bin/bash", "-lc", command],
+    label,
+  };
+}
+
+export function validateBrokerProof({
+  bootstrapSha256,
+  context,
+  events,
+  log,
+  now,
+  principal,
+  run,
+}) {
+  const proof = record(run, "Crabbox run");
+  const plan = validateCrabboxGatePlan(context.plan);
+  if (plan.baseSha !== context.baseSha || plan.headSha !== context.headSha) {
+    throw new Error("Crabbox run plan does not bind the requested base and head");
+  }
+  const expectedCommand = [
+    "--script",
+    BOOTSTRAP_PATH,
+    context.headSha,
+    "/bin/bash",
+    "-lc",
+    buildCrabboxGateCommand(plan, bootstrapSha256),
+  ];
+  const leaseIds = new Set([
+    proof.leaseID,
+    ...(Array.isArray(proof.leaseIDs) ? proof.leaseIDs : []),
+  ]);
+  if (
+    proof.id !== context.runId ||
+    proof.owner !== principal.owner ||
+    proof.org !== principal.org ||
+    proof.provider !== "aws" ||
+    proof.target !== "linux" ||
+    proof.state !== "succeeded" ||
+    proof.phase !== "released" ||
+    proof.exitCode !== 0 ||
+    proof.logTruncated !== false ||
+    !leaseIds.has(context.leaseId)
+  ) {
+    throw new Error(
+      "Crabbox run identity, ownership, provider, lifecycle, or result does not match",
+    );
+  }
+  if (
+    proof.label !== `openclaw-pr-gate:${context.prNumber}:${context.baseSha}:${context.headSha}`
+  ) {
+    throw new Error("Crabbox run label does not bind the requested PR, base, and exact head");
+  }
+  if (
+    !Array.isArray(proof.command) ||
+    JSON.stringify(proof.command) !== JSON.stringify(expectedCommand)
+  ) {
+    throw new Error("Crabbox run command does not match the canonical exact-head gate");
+  }
+  const startedAt = parseTime(proof.startedAt, "Crabbox run startedAt");
+  const endedAt = parseTime(proof.endedAt, "Crabbox run endedAt");
+  if (startedAt > endedAt || endedAt > now || now - endedAt > MAX_PROOF_AGE_MS) {
+    throw new Error("Crabbox run is not a fresh completed proof");
+  }
+  if (!Array.isArray(events) || events.length === 0 || proof.eventCount !== events.length) {
+    throw new Error("Crabbox events are missing or incomplete");
+  }
+  const expectedUpload = `.crabbox/scripts/${bootstrapSha256.slice(0, 12)}-crabbox-untrusted-bootstrap.sh`;
+  const eventTypes = [];
+  for (const [index, value] of events.entries()) {
+    const event = record(value, `Crabbox event ${index + 1}`);
+    const eventType = requiredString(event.type, `Crabbox event ${index + 1} type`);
+    if (event.runID !== context.runId || event.seq !== index + 1) {
+      throw new Error("Crabbox event sequence or run identity does not match");
+    }
+    eventTypes.push(eventType);
+    if (eventType === "run.failed" || eventType.endsWith(".failed")) {
+      throw new Error(`Crabbox proof contains failed event ${eventType}`);
+    }
+    if (eventType === "script.uploaded" && event.message !== expectedUpload) {
+      throw new Error("Crabbox uploaded bootstrap hash does not match trusted main");
+    }
+    if (eventType === "lease.created") {
+      if (
+        event.leaseID !== context.leaseId ||
+        event.provider !== "aws" ||
+        event.target !== "linux"
+      ) {
+        throw new Error("Crabbox lease event does not match AWS/Linux proof");
+      }
+    }
+    if (eventType === "command.finished" && event.exitCode !== 0) {
+      throw new Error("Crabbox command event did not finish successfully");
+    }
+  }
+  const requiredOrder = [
+    "run.started",
+    "lease.created",
+    "script.uploaded",
+    "command.started",
+    "command.finished",
+    "lease.released",
+  ];
+  let priorIndex = -1;
+  for (const type of requiredOrder) {
+    const index = eventTypes.indexOf(type);
+    if (index < 0) {
+      throw new Error(`Crabbox proof is missing ${type}`);
+    }
+    if (index <= priorIndex) {
+      throw new Error(`Crabbox proof event order is invalid at ${type}`);
+    }
+    priorIndex = index;
+  }
+  if (typeof log !== "string") {
+    throw new Error("Crabbox retained log must be a string");
+  }
+  if (log.length > 0) {
+    for (const marker of [
+      ...EXPECTED_MARKERS,
+      `OPENCLAW_CRABBOX_GATE_BASE=${context.baseSha}`,
+      `OPENCLAW_CRABBOX_GATE_HEAD=${context.headSha}`,
+      `OPENCLAW_CRABBOX_GATE_PLAN_SHA256=${crabboxGatePlanDigest(plan)}`,
+      `OPENCLAW_CRABBOX_GATE_TARGET_COUNT=${plan.targets.length}`,
+      `OPENCLAW_CRABBOX_BOOTSTRAP_SHA256=${bootstrapSha256}`,
+    ]) {
+      if (log.split(marker).length !== 2) {
+        throw new Error(`Crabbox retained log must contain exactly one ${marker} marker`);
+      }
+    }
+  }
+}
+
+function bootstrapHash(bootstrapPath = BOOTSTRAP_PATH) {
+  return createHash("sha256").update(readFileSync(bootstrapPath)).digest("hex");
+}
+
+function resolvePlanInDetachedWorktree(context) {
+  const tempRoot = mkdtempSync(path.join(tmpdir(), "openclaw-crabbox-gate-plan-"));
+  const worktree = path.join(tempRoot, "head");
+  try {
+    execFileSync("git", ["fetch", "--no-tags", "origin", context.headSha], {
+      stdio: ["ignore", "ignore", "pipe"],
+    });
+    execFileSync("git", ["worktree", "add", "--detach", worktree, context.headSha], {
+      stdio: ["ignore", "ignore", "pipe"],
+    });
+    return resolveCrabboxGatePlan({
+      baseSha: context.baseSha,
+      cwd: worktree,
+      headSha: context.headSha,
+    });
+  } finally {
+    try {
+      if (existsSync(worktree)) {
+        execFileSync("git", ["worktree", "remove", "--force", worktree], {
+          stdio: ["ignore", "ignore", "ignore"],
+        });
+      }
+    } finally {
+      rmSync(tempRoot, { force: true, recursive: true });
+    }
+  }
+}
+
+/** @type {(context: Parameters<typeof resolvePlanInDetachedWorktree>[0]) => ReturnType<typeof resolvePlanInDetachedWorktree> | Promise<ReturnType<typeof resolvePlanInDetachedWorktree>>} */
+const defaultResolvePlan = resolvePlanInDetachedWorktree;
+
+export async function runPublisher({
+  broker,
+  clock = Date.now,
+  event,
+  github,
+  organization,
+  env,
+  resolvePlan = defaultResolvePlan,
+  runCrabbox = executeCrabbox,
+}) {
+  const context = validatePublisherRequest(event, env);
+  const localBootstrapHash = bootstrapHash();
+  validateActiveAdminMembership(
+    await organization.request(
+      "GET",
+      `/orgs/${ORGANIZATION}/memberships/${encodeURIComponent(context.actor)}`,
+    ),
+    context.actor,
+  );
+  validatePullRequest(
+    await github.request("GET", `/repos/${REPOSITORY}/pulls/${context.prNumber}`),
+    context,
+  );
+  validateForwardAncestry(
+    await github.request(
+      "GET",
+      `/repos/${REPOSITORY}/compare/${context.baseSha}...${context.workflowSha}`,
+    ),
+    { baseSha: context.baseSha, headSha: context.workflowSha },
+    "pull request base ancestry",
+  );
+  await validateCurrentProtectedMain(github, context.workflowSha);
+  context.plan = await Promise.resolve(resolvePlan(context));
+  if (context.plan.baseSha !== context.baseSha || context.plan.headSha !== context.headSha) {
+    throw new Error("Crabbox gate plan does not bind the requested base and head");
+  }
+  const principal = validateServicePrincipal(await broker.request("/v1/whoami"));
+  const crabboxBin = requiredEnv(env, "CRABBOX_BIN");
+  const crabboxHome = mkdtempSync(path.join(tmpdir(), "openclaw-crabbox-publisher-"));
+  try {
+    const crabboxEnv = sanitizedCrabboxEnvironment(env, crabboxHome);
+    const configResult = await runCrabbox({
+      args: ["config", "show", "--provider", "aws", "--json"],
+      bin: crabboxBin,
+      env: crabboxEnv,
+    });
+    if (configResult.exitCode !== 0) {
+      throw new Error(`Crabbox config resolution failed with exit code ${configResult.exitCode}`);
+    }
+    validateCrabboxConfig(JSON.parse(configResult.stdout), requiredEnv(env, "CRABBOX_COORDINATOR"));
+    const { args, label } = buildCrabboxRunArgs(context, localBootstrapHash);
+    const timing = parseCrabboxTiming(
+      await runCrabbox({ args, bin: crabboxBin, env: crabboxEnv, stream: true }),
+      label,
+    );
+    context.runId = timing.runId;
+    context.leaseId = timing.leaseId;
+  } finally {
+    rmSync(crabboxHome, { force: true, recursive: true });
+  }
+  const runResponse = record(
+    await broker.request(`/v1/runs/${context.runId}`),
+    "Crabbox run response",
+  );
+  const eventsResponse = record(
+    await broker.request(`/v1/runs/${context.runId}/events?limit=500`),
+    "Crabbox events response",
+  );
+  validateBrokerProof({
+    bootstrapSha256: localBootstrapHash,
+    context,
+    events: eventsResponse.events,
+    log: await broker.request(`/v1/runs/${context.runId}/logs`, { text: true }),
+    now: clock(),
+    principal,
+    run: runResponse.run,
+  });
+  validatePullRequest(
+    await github.request("GET", `/repos/${REPOSITORY}/pulls/${context.prNumber}`),
+    context,
+  );
+  validateActiveAdminMembership(
+    await organization.request(
+      "GET",
+      `/orgs/${ORGANIZATION}/memberships/${encodeURIComponent(context.actor)}`,
+    ),
+    context.actor,
+  );
+  await validateCurrentProtectedMain(github, context.workflowSha);
+  const check = record(
+    await github.request("POST", `/repos/${REPOSITORY}/check-runs`, {
+      conclusion: "success",
+      details_url: `${requiredEnv(env, "GITHUB_SERVER_URL")}/${REPOSITORY}/actions/runs/${requiredEnv(env, "GITHUB_RUN_ID")}`,
+      head_sha: context.headSha,
+      name: CHECK_NAME,
+      output: {
+        summary: formatCrabboxGateCheckSummary({
+          baseSha: context.baseSha,
+          headSha: context.headSha,
+          leaseId: context.leaseId,
+          planDigest: crabboxGatePlanDigest(context.plan),
+          runId: context.runId,
+          targetCount: context.plan.targets.length,
+          workflowSha: context.workflowSha,
+        }),
+        title: "Crabbox AWS exact-head gate passed",
+      },
+      status: "completed",
+    }),
+    "published check run",
+  );
+  if (
+    check.name !== CHECK_NAME ||
+    check.head_sha !== context.headSha ||
+    check.conclusion !== "success" ||
+    record(check.app, "published check run.app").id !== CHECK_APP_ID
+  ) {
+    throw new Error(
+      "published check run identity or GitHub Actions app integration does not match",
+    );
+  }
+  return { checkId: requiredPositiveInteger(check.id, "published check ID"), context };
+}
+
+export function createJsonApi({
+  accessClientId = "",
+  accessClientSecret = "",
+  baseUrl,
+  token,
+  fetchImpl = fetch,
+}) {
+  const base = new URL(requiredString(baseUrl, "Crabbox coordinator URL"));
+  const hasAccess = Boolean(accessClientId);
+  if (hasAccess !== Boolean(accessClientSecret)) {
+    throw new Error("Crabbox Access client id and secret must be provided together");
+  }
+  const headers = {
+    Authorization: `Bearer ${requiredString(token, "Crabbox coordinator token")}`,
+    ...(hasAccess
+      ? {
+          "CF-Access-Client-Id": accessClientId,
+          "CF-Access-Client-Secret": accessClientSecret,
+        }
+      : {}),
+  };
+  return {
+    async request(requestPath, options = {}) {
+      const response = await fetchImpl(new URL(requestPath, base), {
+        headers,
+        signal: AbortSignal.timeout(30_000),
+      });
+      if (!response.ok) {
+        throw new Error(
+          `API GET ${requestPath} failed (${response.status}): ${(await response.text()).slice(0, 300)}`,
+        );
+      }
+      return options.text ? response.text() : response.json();
+    },
+  };
+}
+
+export function createGitHubApi({ token, fetchImpl = fetch }) {
+  return {
+    async request(method, requestPath, body) {
+      const response = await fetchImpl(`https://api.github.com${requestPath}`, {
+        body: body === undefined ? undefined : JSON.stringify(body),
+        headers: {
+          Accept: "application/vnd.github+json",
+          Authorization: `Bearer ${token}`,
+          "Content-Type": "application/json",
+          "X-GitHub-Api-Version": "2022-11-28",
+        },
+        method,
+        signal: AbortSignal.timeout(30_000),
+      });
+      if (!response.ok) {
+        throw new Error(
+          `GitHub API ${method} ${requestPath} failed (${response.status}): ${(await response.text()).slice(0, 300)}`,
+        );
+      }
+      return response.status === 204 ? null : response.json();
+    },
+  };
+}
+
+async function main() {
+  const event = JSON.parse(readFileSync(requiredEnv(process.env, "GITHUB_EVENT_PATH"), "utf8"));
+  const brokerUrl = requiredEnv(process.env, "CRABBOX_COORDINATOR");
+  const broker = createJsonApi({
+    accessClientId: process.env.CRABBOX_ACCESS_CLIENT_ID,
+    accessClientSecret: process.env.CRABBOX_ACCESS_CLIENT_SECRET,
+    baseUrl: brokerUrl.endsWith("/") ? brokerUrl : `${brokerUrl}/`,
+    token: requiredEnv(process.env, "CRABBOX_COORDINATOR_TOKEN"),
+  });
+  const github = createGitHubApi({ token: requiredEnv(process.env, "GH_TOKEN") });
+  const organization = createGitHubApi({
+    token: requiredEnv(process.env, "GH_APP_TOKEN"),
+  });
+  const result = await runPublisher({ broker, env: process.env, event, github, organization });
+  console.log(`published_check_id=${result.checkId}`);
+  console.log(`published_head_sha=${result.context.headSha}`);
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+  try {
+    if (process.argv[2] === "--print-command") {
+      const plan = validateCrabboxGatePlan(
+        JSON.parse(readFileSync(requiredString(process.argv[3], "plan path"), "utf8")),
+      );
+      const bootstrapSha256 = requiredString(process.argv[4], "bootstrap SHA-256");
+      console.log(buildCrabboxGateCommand(plan, bootstrapSha256));
+    } else {
+      await main();
+    }
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+  }
+}
diff --git a/scripts/prepare-apple-mermaid.mjs b/scripts/prepare-apple-mermaid.mjs
new file mode 100644
index 0000000000000000000000000000000000000000..f70c1708d547fb78547f486b610ce9a895404670
--- /dev/null
+++ b/scripts/prepare-apple-mermaid.mjs
@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import { cp, mkdir, rm } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import { createPnpmRunnerSpawnSpec } from "./pnpm-runner.mts";
+
+const root = fileURLToPath(new URL("../", import.meta.url));
+const spec = createPnpmRunnerSpawnSpec({
+  cwd: root,
+  pnpmArgs: ["--dir", "packages/mermaid-renderer", "build"],
+  stdio: "inherit",
+});
+const result = spawnSync(spec.command, spec.args, spec.options);
+if (result.error) {
+  throw result.error;
+}
+if (result.status !== 0) {
+  process.exit(result.status ?? 1);
+}
+
+const source = new URL("../apps/shared/mermaid/assets/mermaid/", import.meta.url);
+const resources = new URL(
+  "../apps/shared/OpenClawKit/Sources/OpenClawChatUI/Resources/",
+  import.meta.url,
+);
+const destination = new URL("Mermaid/", resources);
+await mkdir(resources, { recursive: true });
+// SwiftPM needs the complete resource directory before project generation.
+// Replace generated assets together so old content-addressed scripts cannot linger.
+await rm(destination, { recursive: true, force: true });
+await cp(source, destination, { recursive: true });
diff --git a/scripts/prepare-extension-package-boundary-artifacts.mts b/scripts/prepare-extension-package-boundary-artifacts.mts
new file mode 100644
index 0000000000000000000000000000000000000000..f5308d55aeb269c1d936c1b8bebba32b473b815f
--- /dev/null
+++ b/scripts/prepare-extension-package-boundary-artifacts.mts
@@ -0,0 +1,382 @@
+// Local declaration ownership is disjoint from packaged tsdown declarations.
+import fs from "node:fs";
+import path, { resolve } from "node:path";
+import {
+  MAX_TIMER_TIMEOUT_MS,
+  resolveTimerTimeoutMs,
+} from "../packages/normalization-core/src/number-coercion.ts";
+import {
+  listCacheFiles,
+  portableRelativePath,
+  readArtifactRecord,
+  writeArtifactRecord,
+} from "./lib/build-artifact-cache.mts";
+import { isDirectRunUrl } from "./lib/direct-run.mjs";
+import { withDistArtifactOwnership } from "./lib/dist-artifact-ownership.mts";
+import {
+  BOUNDARY_CACHE_ROOT,
+  BOUNDARY_PLUGIN_UNITS,
+  LOCAL_PLUGIN_ROOT,
+  LOCAL_SDK_ROOT,
+  BoundaryInputSnapshot,
+} from "./lib/extension-boundary-inputs.mts";
+import { ensureRepoNodeModulesLink, isLocalCheckEnabled } from "./lib/local-check-runtime.mts";
+import { runManagedCommand, signalExitCode } from "./lib/managed-child-process.mts";
+import { parsePositiveInt } from "./lib/numeric-options.mjs";
+import { pluginSdkEntrypoints } from "./lib/plugin-sdk-entries.mts";
+import { resolveRepoRoot } from "./lib/repo-root.mjs";
+import { prepareTsgoCommand } from "./run-tsgo.mts";
+const repoRoot = resolveRepoRoot(import.meta.url);
+const runTsgoScript = path.join(repoRoot, "scripts/run-tsgo.mts");
+const DEFAULT_NODE_STEP_ABORT_KILL_GRACE_MS = 1_000;
+type NodeStepParams = {
+  bin?: string;
+  shell?: boolean;
+  windowsVerbatimArguments?: boolean;
+  abortController?: AbortController;
+  abortKillGraceMs?: number;
+  env?: NodeJS.ProcessEnv;
+  onStdoutLine?: (line: string) => boolean;
+};
+type NodeStep = Omit<NodeStepParams, "abortController"> & {
+  args: string[];
+  label: string;
+  timeoutMs: number;
+};
+const activeNodeSteps = new Set<Promise<number>>();
+let nodeStepParentSignal: NodeJS.Signals | undefined;
+export function parseMode(argv: string[] = process.argv.slice(2)) {
+  const mode = argv.find((arg) => arg.startsWith("--mode="))?.slice("--mode=".length) ?? "all";
+  if (mode !== "all" && mode !== "package-boundary") {
+    throw new Error(`Unknown mode: ${mode}`);
+  }
+  return mode;
+}
+export function resolveBoundaryRootShimsTimeoutMs(env: NodeJS.ProcessEnv = process.env) {
+  const raw = env.OPENCLAW_PLUGIN_SDK_BOUNDARY_ROOT_SHIMS_TIMEOUT_MS?.trim();
+  return raw
+    ? parsePositiveInt(raw, "OPENCLAW_PLUGIN_SDK_BOUNDARY_ROOT_SHIMS_TIMEOUT_MS")
+    : 300_000;
+}
+/**
+ * Prefixes streamed child output line-by-line without breaking partial chunks.
+ */
+export function createPrefixedOutputWriter(
+  label: string,
+  target: { write(chunk: string): void },
+  onLine?: (line: string) => boolean,
+) {
+  let buffered = "";
+  const prefix = `[${label}] `;
+
+  return {
+    write(chunk: string) {
+      buffered += chunk;
+      while (true) {
+        const newlineIndex = buffered.indexOf("\n");
+        if (newlineIndex === -1) {
+          return;
+        }
+        const line = buffered.slice(0, newlineIndex + 1);
+        buffered = buffered.slice(newlineIndex + 1);
+        if (onLine?.(line) !== false) {
+          target.write(`${prefix}${line}`);
+        }
+      }
+    },
+    flush() {
+      if (!buffered) {
+        return;
+      }
+      target.write(`${prefix}${buffered}`);
+      buffered = "";
+    },
+  };
+}
+
+/** Runs a declaration step through the shared managed lifecycle with prefixed output. */
+export async function runNodeStep(
+  label: string,
+  args: string[],
+  timeoutMs: number,
+  params: NodeStepParams = {},
+) {
+  if (params.abortController?.signal.aborted || nodeStepParentSignal) {
+    throw new Error(`${label} canceled before starting`);
+  }
+  const resolvedTimeoutMs = resolveTimerTimeoutMs(timeoutMs, MAX_TIMER_TIMEOUT_MS);
+  const stdoutWriter = createPrefixedOutputWriter(label, process.stdout, params.onStdoutLine);
+  const stderrWriter = createPrefixedOutputWriter(label, process.stderr);
+  const command = runManagedCommand({
+    bin: params.bin ?? process.execPath,
+    args,
+    cwd: repoRoot,
+    env: params.env ? { ...process.env, ...params.env } : process.env,
+    shell: params.shell ?? false,
+    windowsVerbatimArguments: params.windowsVerbatimArguments,
+    stdio: ["ignore", "pipe", "pipe"],
+    // Artifact writers must finish before stamps, dependent readers, or lock release.
+    requireProcessTreeExit: process.platform !== "win32",
+    timeoutMs: resolvedTimeoutMs,
+    signal: params.abortController?.signal,
+    abortKillGraceMs: Math.max(
+      0,
+      Math.floor(params.abortKillGraceMs ?? DEFAULT_NODE_STEP_ABORT_KILL_GRACE_MS),
+    ),
+    onSignal(signal) {
+      nodeStepParentSignal ??= signal;
+    },
+    onReady(child) {
+      // This invocation explicitly requests both output pipes above.
+      child.stdout!.setEncoding("utf8");
+      child.stderr!.setEncoding("utf8");
+      child.stdout!.on("data", (chunk: string) => stdoutWriter.write(chunk));
+      child.stderr!.on("data", (chunk: string) => stderrWriter.write(chunk));
+    },
+  });
+  activeNodeSteps.add(command);
+  try {
+    const code = await command;
+    if (code !== 0) {
+      throw new Error(`${label} failed with exit code ${code}`);
+    }
+  } catch (error) {
+    const code = error && typeof error === "object" && "code" in error ? error.code : undefined;
+    const failure =
+      code === "ETIMEDOUT"
+        ? new Error(`${label} timed out after ${resolvedTimeoutMs}ms`, { cause: error })
+        : code === "ABORT_ERR"
+          ? new Error(`${label} canceled after sibling failure`, { cause: error })
+          : error;
+    if (nodeStepParentSignal && code === "EPROCESSGROUP_CLEANUP_FAILED") {
+      console.error(failure);
+    }
+    if (params.abortController && !params.abortController.signal.aborted) {
+      params.abortController.abort(failure);
+    }
+    throw failure;
+  } finally {
+    stdoutWriter.flush();
+    stderrWriter.flush();
+    activeNodeSteps.delete(command);
+    // The last sibling exits only after all managed cancellation has joined.
+    if (nodeStepParentSignal && activeNodeSteps.size === 0) {
+      process.exit(signalExitCode(nodeStepParentSignal));
+    }
+  }
+}
+
+/**
+ * Runs independent artifact steps together and aborts siblings on first failure.
+ */
+export async function runNodeStepsInParallel(steps: NodeStep[]) {
+  const abortController = new AbortController();
+  const results = await Promise.allSettled(
+    steps.map((step) =>
+      runNodeStep(step.label, step.args, step.timeoutMs, {
+        ...step,
+        abortController,
+      }),
+    ),
+  );
+  const failures: unknown[] = results.flatMap((result) =>
+    result.status === "rejected" ? [result.reason] : [],
+  );
+  if (failures.length > 0) {
+    const primary = abortController.signal.reason ?? failures[0];
+    const cleanupFailures = failures.filter(
+      (error: unknown) =>
+        error &&
+        typeof error === "object" &&
+        "code" in error &&
+        error.code === "EPROCESSGROUP_CLEANUP_FAILED" &&
+        error !== primary,
+    );
+    if (cleanupFailures.length > 0) {
+      throw new AggregateError(
+        [primary, ...cleanupFailures],
+        `${primary instanceof Error ? primary.message : String(primary)}; sibling cleanup could not be verified`,
+      );
+    }
+    throw primary;
+  }
+}
+
+/**
+ * Chooses serial or parallel artifact execution based on local check policy.
+ */
+export async function runNodeSteps(steps: NodeStep[], env: NodeJS.ProcessEnv = process.env) {
+  if (!isLocalCheckEnabled(env)) {
+    await runNodeStepsInParallel(steps);
+    return;
+  }
+
+  for (const step of steps) {
+    await runNodeStep(step.label, step.args, step.timeoutMs, step);
+  }
+}
+
+async function runTsgoSteps(steps: NodeStep[]) {
+  const commands = steps.flatMap((step) => {
+    const command = prepareTsgoCommand(step.args, step.env ?? process.env, repoRoot);
+    return command
+      ? [
+          {
+            ...step,
+            ...command,
+            // Go honors PWD aliases; emitted paths must use this owner's actual cwd.
+            env: { ...command.env, PWD: repoRoot },
+            timeoutMs: Math.min(step.timeoutMs, command.timeoutMs ?? step.timeoutMs),
+          },
+        ]
+      : [];
+  });
+  // The native bin stays in this owner's group; no nested CLI supervisor can escape its join.
+  await runNodeSteps(commands);
+  return new Set(commands.map((command) => command.label));
+}
+
+async function prepareExtensionPackageBoundaryArtifacts(argv: string[] = process.argv.slice(2)) {
+  const mode = parseMode(argv);
+  const sdk = {
+    id: "plugin-sdk",
+    outDir: LOCAL_SDK_ROOT,
+    config: "packages/plugin-sdk/tsconfig.json",
+    rootDir: ".",
+    required: pluginSdkEntrypoints.map((entry) => `${LOCAL_SDK_ROOT}/src/plugin-sdk/${entry}.d.ts`),
+  };
+  const plugins = BOUNDARY_PLUGIN_UNITS.map(([id, entry]) => ({
+    id,
+    outDir: `${LOCAL_PLUGIN_ROOT}/${id}`,
+    config: `extensions/${id}/tsconfig.json`,
+    rootDir: `extensions/${id}`,
+    required: [`${LOCAL_PLUGIN_ROOT}/${id}/${entry}.d.ts`],
+  }));
+  const batches = [[sdk], mode === "all" ? plugins : []].map((batch) =>
+    batch.map((unit) => {
+      fs.mkdirSync(resolve(repoRoot, unit.outDir), { recursive: true });
+      if (unit.id !== "plugin-sdk") {
+        // Relocated declarations still resolve third-party types through their package owner.
+        ensureRepoNodeModulesLink(resolve(repoRoot, unit.rootDir, "node_modules"), {
+          cwd: resolve(repoRoot, unit.outDir),
+        });
+      }
+      return { ...unit, outputRoot: fs.realpathSync.native(resolve(repoRoot, unit.outDir)) };
+    }),
+  );
+  for (const batch of batches) {
+    if (!batch.length) {
+      continue;
+    }
+    // Upstream pruning changes consumer topology; snapshot after the preceding batch's cleanup.
+    const before = new BoundaryInputSnapshot(repoRoot);
+    const pending = batch
+      .map((unit) => {
+        const recordPath = resolve(repoRoot, BOUNDARY_CACHE_ROOT, `${unit.id}.json`);
+        const buildInfo = `${unit.outDir}/.tsbuildinfo`;
+        const args = [
+          runTsgoScript,
+          "-p",
+          unit.config,
+          "--declaration",
+          "true",
+          "--emitDeclarationOnly",
+          "true",
+          "--noEmit",
+          "false",
+          "--outDir",
+          unit.outDir,
+          "--rootDir",
+          unit.rootDir,
+          "--incremental",
+          "--tsBuildInfoFile",
+          buildInfo,
+          "--listEmittedFiles",
+        ];
+        const previous = readArtifactRecord(recordPath);
+        // Prime config/toolchain/topology before starting even an uncached owner.
+        before.signature(unit.config, args, [], unit.outputRoot);
+        if (
+          before.matches(
+            previous,
+            unit.config,
+            args,
+            [...unit.required, buildInfo],
+            unit.outputRoot,
+          )
+        ) {
+          process.stdout.write(`[${unit.id} boundary dts] fresh; skipping\n`);
+          return null;
+        }
+        fs.rmSync(recordPath, { force: true });
+        // Historical Matrix/Slack repair: every stale owner gets a full native emit.
+        // Output directories stay intact until a successful complete inventory exists.
+        fs.rmSync(resolve(repoRoot, buildInfo), { force: true });
+        const outputs = new Set<string>();
+        return Object.assign(unit, { recordPath, buildInfo, args, outputs, startedAt: 0 });
+      })
+      .filter((unit) => unit !== null);
+    const emitted = await runTsgoSteps(
+      pending.map((unit) => {
+        unit.startedAt = Date.now();
+        return {
+          label: `${unit.id} boundary dts`,
+          args: unit.args.slice(1),
+          timeoutMs: unit.id === "plugin-sdk" ? resolveBoundaryRootShimsTimeoutMs() : 300_000,
+          onStdoutLine(line: string) {
+            if (!line.startsWith("TSFILE: ")) {
+              return true;
+            }
+            unit.outputs.add(portableRelativePath(repoRoot, line.slice(8).trim()));
+            return false;
+          },
+        };
+      }),
+    );
+    if (!pending.length) {
+      continue;
+    }
+    const after = new BoundaryInputSnapshot(repoRoot);
+    // Join and validate every owner before publishing any success in this batch.
+    const completed = pending
+      .filter((unit) => emitted.has(`${unit.id} boundary dts`))
+      .map((unit) => {
+        const outputs = [...unit.outputs].toSorted();
+        if (
+          [...unit.required, unit.buildInfo].some((file) => !unit.outputs.has(file)) ||
+          outputs.some((file) => !file.startsWith(`${unit.outDir}/`))
+        ) {
+          throw new Error(`Incomplete ${unit.id} native declaration inventory`);
+        }
+        const record = after.record(
+          unit.config,
+          unit.args,
+          unit.buildInfo,
+          outputs,
+          before,
+          unit.startedAt,
+          unit.outputRoot,
+        );
+        return Object.assign(unit, { record });
+      });
+    for (const unit of completed) {
+      // Surviving files are cleanup candidates, never evidence of successful emit.
+      for (const file of listCacheFiles(
+        repoRoot,
+        [{ path: unit.outDir, extensions: [".d.ts", ".d.mts", ".d.cts"] }],
+        fs,
+      )) {
+        if (!unit.outputs.has(portableRelativePath(repoRoot, file))) {
+          fs.rmSync(file);
+        }
+      }
+      writeArtifactRecord(unit.recordPath, unit.record);
+      process.stdout.write(`[${unit.id} boundary dts] emitted ${unit.outputs.size} files\n`);
+    }
+  }
+}
+
+if (isDirectRunUrl(process.argv[1], import.meta.url)) {
+  // The private entry must observe cleanup metadata before releasing its claim.
+  await withDistArtifactOwnership(repoRoot, () => prepareExtensionPackageBoundaryArtifacts());
+}
diff --git a/scripts/profile-extension-memory.mts b/scripts/profile-extension-memory.mts
new file mode 100644
index 0000000000000000000000000000000000000000..af7f5c70d71db610ea33953ba0a3ed2e0b8f03e1
--- /dev/null
+++ b/scripts/profile-extension-memory.mts
@@ -0,0 +1,808 @@
+#!/usr/bin/env node
+
+// Profiles peak RSS for built bundled plugin entrypoints and emits a JSON
+// report suitable for extension memory budget review.
+import {
+  spawn,
+  type ChildProcessByStdio,
+  type SpawnOptionsWithStdioTuple,
+} from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import type { Readable } from "node:stream";
+import { pathToFileURL } from "node:url";
+import pMap, { pMapSkip } from "p-map";
+import {
+  ensureExtensionMemoryBuild,
+  findBuiltExtensionMemoryEntries,
+} from "./ensure-extension-memory-build.mts";
+import { stripLeadingPackageManagerSeparator } from "./lib/arg-utils.mts";
+import { appendBoundedTail } from "./lib/bounded-output-tail.mjs";
+import { formatErrorMessage } from "./lib/error-format.mts";
+import { hasUnjoinedWork, inspectManagedProcessGroup } from "./lib/managed-child-process.mts";
+import { parsePositiveInt } from "./lib/numeric-options.mjs";
+
+const DEFAULT_CONCURRENCY = 6;
+const DEFAULT_TIMEOUT_MS = 90_000;
+const DEFAULT_COMBINED_TIMEOUT_MS = 180_000;
+const DEFAULT_CHILD_SHUTDOWN_GRACE_MS = 1_000;
+const DEFAULT_TOP = 10;
+const OUTPUT_CAPTURE_MAX_CHARS = 128 * 1024;
+const STDERR_PREVIEW_MAX_CHARS = 8 * 1024;
+const RSS_MARKER = "__OPENCLAW_MAX_RSS_KB__=";
+type ParentSignal = "SIGHUP" | "SIGINT" | "SIGTERM";
+type OutputCapture = { text: string; truncatedChars: number };
+type RunCaseResult = {
+  code: number | null;
+  error: string | null;
+  maxRssMb: number | null;
+  name: string;
+  signal: NodeJS.Signals | null;
+  stderr: string;
+  stdout: string;
+  timedOut: boolean;
+};
+type CaseChild = ChildProcessByStdio<null, Readable, Readable>;
+type ActiveCase = {
+  stop: (signal: NodeJS.Signals) => void;
+  completion: Promise<RunCaseResult>;
+};
+
+const PARENT_SIGNAL_EXIT_CODES = new Map<ParentSignal, number>([
+  ["SIGHUP", 129],
+  ["SIGINT", 130],
+  ["SIGTERM", 143],
+]);
+const activeCases = new Set<ActiveCase>();
+const parentSignalHandlers = new Map<ParentSignal, () => void>();
+let parentSignalHandlersInstalled = false;
+let parentSignalShutdownStarted = false;
+let parentSignalShutdown: Promise<void> | undefined;
+
+function defaultJsonReportPath(): string {
+  return path.join(
+    os.tmpdir(),
+    `openclaw-extension-memory-${process.pid}-${Date.now()}-${randomUUID()}.json`,
+  );
+}
+
+function printHelp(): void {
+  console.log(`Usage: node --import tsx scripts/profile-extension-memory.mts [options]
+
+Profiles peak RSS for built bundled plugin entrypoints.
+Run pnpm build first if you want stats for the latest source changes.
+
+Options:
+  --extension, -e <id>     Limit profiling to one or more extension ids (repeatable)
+  --concurrency <n>        Number of per-extension workers (default: ${DEFAULT_CONCURRENCY})
+  --timeout-ms <ms>        Per-extension timeout in milliseconds (default: ${DEFAULT_TIMEOUT_MS})
+  --combined-timeout-ms <ms>
+                           Combined-import timeout in milliseconds (default: ${DEFAULT_COMBINED_TIMEOUT_MS})
+  --top <n>                Show top N entries by delta from baseline (default: ${DEFAULT_TOP})
+  --json <path>            Write full JSON report to this path
+  --skip-combined          Skip the combined all-imports measurement
+  --help                   Show this help
+
+Examples:
+  pnpm test:extensions:memory
+  pnpm test:extensions:memory -- --extension discord
+  pnpm test:extensions:memory -- --extension discord --extension telegram --skip-combined
+`);
+}
+
+/**
+ * Parses extension memory profiler options after pnpm's optional separator.
+ */
+export function parseArgs(argv: string[]): {
+  extensions: string[];
+  concurrency: number;
+  timeoutMs: number;
+  combinedTimeoutMs: number;
+  top: number;
+  jsonPath: string | null;
+  skipCombined: boolean;
+} {
+  const args = stripLeadingPackageManagerSeparator(argv);
+  const options: ReturnType<typeof parseArgs> = {
+    extensions: [],
+    concurrency: DEFAULT_CONCURRENCY,
+    timeoutMs: DEFAULT_TIMEOUT_MS,
+    combinedTimeoutMs: DEFAULT_COMBINED_TIMEOUT_MS,
+    top: DEFAULT_TOP,
+    jsonPath: null,
+    skipCombined: false,
+  };
+
+  parseArgv: for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    switch (arg) {
+      case "--":
+        break parseArgv;
+      case "--extension":
+      case "-e": {
+        const next = args[index + 1];
+        if (!next || next.startsWith("-")) {
+          throw new Error(`${arg} requires a value`);
+        }
+        options.extensions.push(next);
+        index += 1;
+        break;
+      }
+      case "--concurrency":
+        options.concurrency = parsePositiveInt(args[index + 1] ?? "", arg);
+        index += 1;
+        break;
+      case "--timeout-ms":
+        options.timeoutMs = parsePositiveInt(args[index + 1] ?? "", arg);
+        index += 1;
+        break;
+      case "--combined-timeout-ms":
+        options.combinedTimeoutMs = parsePositiveInt(args[index + 1] ?? "", arg);
+        index += 1;
+        break;
+      case "--top":
+        options.top = parsePositiveInt(args[index + 1] ?? "", arg);
+        index += 1;
+        break;
+      case "--json": {
+        const next = args[index + 1];
+        if (!next || next.startsWith("-")) {
+          throw new Error(`${arg} requires a value`);
+        }
+        options.jsonPath = path.resolve(next);
+        index += 1;
+        break;
+      }
+      case "--skip-combined":
+        options.skipCombined = true;
+        break;
+      case "--help":
+      case "-h":
+        printHelp();
+        process.exit(0);
+      default:
+        throw new Error(`Unknown argument: ${arg}`);
+    }
+  }
+
+  return options;
+}
+
+function parseMaxRssMb(stderr: string): number | null {
+  const matches = [...stderr.matchAll(new RegExp(`^${RSS_MARKER}(\\d+)\\s*$`, "gm"))];
+  const last = matches.at(-1);
+  return last ? Number(last[1]) / 1024 : null;
+}
+
+function createOutputCapture(): OutputCapture {
+  return { text: "", truncatedChars: 0 };
+}
+
+function formatCapturedOutput(capture: OutputCapture): string {
+  if (capture.truncatedChars === 0) {
+    return capture.text;
+  }
+  return `[output truncated ${capture.truncatedChars} chars; showing tail]\n${capture.text}`;
+}
+
+function scanMaxRssMb(tail: string, chunk: unknown, current: number | null) {
+  const text = `${tail}${String(chunk)}`;
+  const parsed = parseMaxRssMb(text);
+  const lineBreakIndex = Math.max(text.lastIndexOf("\n"), text.lastIndexOf("\r"));
+  const openLine = lineBreakIndex === -1 ? text : text.slice(lineBreakIndex + 1);
+  return {
+    maxRssMb: parsed ?? current,
+    tail: openLine.slice(-(RSS_MARKER.length + 32)),
+  };
+}
+
+function summarizeStderr(stderr: string, lines = 8, maxChars = STDERR_PREVIEW_MAX_CHARS): string {
+  const text = stderr.trim().split("\n").filter(Boolean).slice(0, lines).join("\n");
+  if (text.length <= maxChars) {
+    return text;
+  }
+  const firstLine = text.split("\n", 1)[0] ?? "";
+  const prefix = firstLine.startsWith("[output truncated") ? `${firstLine}\n` : "";
+  return `${prefix}[stderr preview truncated ${text.length - maxChars} chars; showing tail]\n${text.slice(
+    -maxChars,
+  )}`;
+}
+
+function describeCaseFailure(result: RunCaseResult, errors: Error[] = []): string {
+  const limit = Math.floor(STDERR_PREVIEW_MAX_CHARS / (errors.length + 2));
+  return [
+    `${result.name}: code=${result.code}, signal=${result.signal}, timedOut=${result.timedOut}`,
+    result.stderr,
+    ...errors.map(formatErrorMessage),
+  ]
+    .map((part) => summarizeStderr(part, 8, limit))
+    .filter(Boolean)
+    .join("; ");
+}
+
+function summarizeCase(result: RunCaseResult) {
+  const status = result.timedOut ? "timeout" : result.error || result.code !== 0 ? "fail" : "ok";
+  return {
+    status,
+    code: result.code,
+    signal: result.signal,
+    error: result.error ?? (status === "ok" ? null : describeCaseFailure(result)),
+    maxRssMb: result.maxRssMb,
+    stderrPreview: summarizeStderr(result.stderr),
+  };
+}
+
+/**
+ * Runs one import scenario in a child process and captures bounded output plus RSS.
+ */
+export function runCase({
+  repoRoot,
+  env,
+  hookPath,
+  name,
+  body,
+  timeoutMs,
+  shutdownGraceMs = DEFAULT_CHILD_SHUTDOWN_GRACE_MS,
+  spawnImpl = spawn,
+}: {
+  repoRoot: string;
+  env: NodeJS.ProcessEnv;
+  hookPath: string;
+  name: string;
+  body: string;
+  timeoutMs: number;
+  shutdownGraceMs?: number | undefined;
+  spawnImpl?: (
+    command: string,
+    args: string[],
+    options: SpawnOptionsWithStdioTuple<"ignore", "pipe", "pipe">,
+  ) => CaseChild;
+}): Promise<RunCaseResult> {
+  if (parentSignalShutdownStarted) {
+    return Promise.reject(new Error("Profiling interrupted by parent signal"));
+  }
+  let child: CaseChild | undefined;
+  let stdout = createOutputCapture();
+  let stderr = createOutputCapture();
+  let stderrRssTail = "";
+  let maxRssMb: number | null = null;
+  let timedOut = false;
+  let closed = false;
+  let code: number | null = null;
+  let signal: NodeJS.Signals | null = null;
+  let failure: Error | undefined;
+  const errors: Error[] = [];
+  let parentStopDeadline: number | undefined;
+  let killDeadline: number | undefined;
+  let registrationError: Error | undefined;
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  let wake!: () => void;
+  const outcome = new Promise<void>((resolve) => {
+    wake = resolve;
+  });
+  const recordFailure = (error: unknown) => {
+    const next = error instanceof Error ? error : new Error(formatErrorMessage(error));
+    errors.push(next);
+    failure = failure
+      ? new AggregateError([failure, next], `${failure.message}; ${next.message}`)
+      : next;
+  };
+  const sendSignal = (requested: NodeJS.Signals, deadlineAt = Date.now() + shutdownGraceMs) => {
+    if (!child || (requested === "SIGKILL" && killDeadline !== undefined)) {
+      return;
+    }
+    if (requested === "SIGKILL") {
+      killDeadline = deadlineAt;
+    }
+    try {
+      signalChildProcessTree(child, requested);
+    } catch (error) {
+      recordFailure(error);
+    }
+  };
+  const stop = (requested: NodeJS.Signals) => {
+    if (parentStopDeadline === undefined) {
+      parentStopDeadline = Date.now() + shutdownGraceMs;
+      if (killDeadline === undefined) {
+        sendSignal(requested);
+      }
+    } else if (requested === "SIGKILL") {
+      sendSignal(requested);
+    }
+    // A failed signal or missing exit event must still enter bounded case finalization.
+    wake();
+  };
+  const fullyClosed = (deadlineAt: number) =>
+    closed && child !== undefined && !childProcessTreeIsAlive(child, deadlineAt);
+  const waitForClosure = async (deadline: number, graceful = false) => {
+    while (!fullyClosed(deadline)) {
+      if (graceful && killDeadline !== undefined) {
+        break;
+      }
+      const remainingMs = deadline - Date.now();
+      if (remainingMs <= 0) {
+        break;
+      }
+      await new Promise((resolve) => {
+        setTimeout(resolve, Math.min(50, remainingMs));
+      });
+    }
+  };
+  // Publish the completion before installing signal handlers or spawning. The parent
+  // joins this same promise, including finally, and the case never awaits the parent.
+  const completion = Promise.resolve()
+    .then(async () => {
+      if (registrationError !== undefined) {
+        throw registrationError;
+      }
+      if (parentSignalShutdownStarted) {
+        throw new Error("Profiling interrupted by parent signal");
+      }
+      child = spawnImpl(
+        process.execPath,
+        ["--import", hookPath, "--input-type=module", "--eval", body],
+        {
+          cwd: repoRoot,
+          detached: process.platform !== "win32",
+          env,
+          stdio: ["ignore", "pipe", "pipe"],
+        },
+      );
+      let cleanupError: Error | undefined;
+      try {
+        try {
+          child.on("error", (error) => {
+            recordFailure(error);
+            wake();
+          });
+          // Exit starts cleanup even when descendants still hold the output pipes.
+          child.once("exit", (exitCode, exitSignal) => {
+            code = exitCode;
+            signal = exitSignal;
+            wake();
+          });
+          child.once("close", (exitCode, exitSignal) => {
+            code = exitCode;
+            signal = exitSignal;
+            closed = true;
+            wake();
+          });
+          child.stdout.setEncoding("utf8").on("data", (chunk) => {
+            stdout = appendBoundedTail(stdout, chunk, OUTPUT_CAPTURE_MAX_CHARS);
+          });
+          child.stderr.setEncoding("utf8").on("data", (chunk) => {
+            const rssScan = scanMaxRssMb(stderrRssTail, chunk, maxRssMb);
+            stderrRssTail = rssScan.tail;
+            maxRssMb = rssScan.maxRssMb;
+            stderr = appendBoundedTail(stderr, chunk, OUTPUT_CAPTURE_MAX_CHARS);
+          });
+          timer = setTimeout(() => {
+            timedOut = true;
+            wake();
+          }, timeoutMs);
+          timer.unref?.();
+        } catch (error) {
+          recordFailure(error);
+          wake();
+        }
+        await outcome;
+        clearTimeout(timer);
+        if (child.pid) {
+          // Charge the preliminary snapshot to cleanup too; it cannot earn a
+          // fresh drainage allowance after consuming the current phase.
+          const cleanupDeadline =
+            killDeadline ?? (parentStopDeadline ?? Date.now()) + shutdownGraceMs;
+          if (parentStopDeadline !== undefined && killDeadline === undefined) {
+            await waitForClosure(parentStopDeadline, true);
+          }
+          if (timedOut || !fullyClosed(killDeadline ?? parentStopDeadline ?? cleanupDeadline)) {
+            sendSignal("SIGKILL", cleanupDeadline);
+          }
+          const deadlineAt = killDeadline ?? cleanupDeadline;
+          await waitForClosure(deadlineAt);
+          if (!fullyClosed(deadlineAt)) {
+            cleanupError = Object.assign(
+              new Error(
+                `${name} cleanup could not verify child, process group, and output closure`,
+              ),
+              { code: "EPROCESSGROUP_CLEANUP_FAILED", processTreeState: "indeterminate" },
+            );
+          }
+        }
+      } finally {
+        clearTimeout(timer);
+        if (!closed) {
+          for (const stream of [child.stdout, child.stderr]) {
+            try {
+              stream.destroy();
+            } catch (error) {
+              recordFailure(error);
+            }
+          }
+        }
+      }
+      const stderrText = formatCapturedOutput(stderr);
+      const result: RunCaseResult = {
+        name,
+        code,
+        signal,
+        timedOut,
+        error: null,
+        stdout: formatCapturedOutput(stdout),
+        stderr: stderrText,
+        maxRssMb: maxRssMb ?? parseMaxRssMb(stderrText),
+      };
+      if (cleanupError) {
+        const message = describeCaseFailure(result, [...errors, cleanupError]);
+        // Keep the cleanup tag for HOME retention and terminal evidence even without
+        // an Error event. Structured primary errors remain intact in the aggregate.
+        Object.assign(cleanupError, {
+          message,
+          exitCode: code,
+          exitSignal: signal,
+          timedOut,
+          stderrPreview: summarizeStderr(stderrText),
+        });
+        throw failure ? new AggregateError([failure, cleanupError], message) : cleanupError;
+      }
+      result.error = failure ? describeCaseFailure(result, errors) : null;
+      return result;
+    })
+    .finally(() => untrackActiveCase(owner));
+  const owner = { stop, completion };
+  try {
+    trackActiveCase(owner);
+  } catch (error) {
+    registrationError = error instanceof Error ? error : new Error(formatErrorMessage(error));
+  }
+  return completion;
+}
+
+function signalChildProcessTree(child: CaseChild, signal: NodeJS.Signals): void {
+  if (process.platform !== "win32" && typeof child.pid === "number") {
+    try {
+      process.kill(-child.pid, signal);
+      return;
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === "ESRCH") {
+        return;
+      }
+      // The POSIX spawn owns a detached group; signaling just its leader cannot replace it.
+      throw error;
+    }
+  }
+  child.kill(signal);
+}
+
+function childProcessTreeIsAlive(child: CaseChild, deadlineAt: number): boolean {
+  if (typeof child.pid !== "number") {
+    return false;
+  }
+  return (
+    inspectManagedProcessGroup(child, {
+      deadlineAt,
+      errorPolicy: "indeterminate",
+      inspectLeaderWhenNoGroup: true,
+    }) !== "dead"
+  );
+}
+
+function trackActiveCase(owner: ActiveCase): void {
+  activeCases.add(owner);
+  installParentSignalHandlers();
+}
+
+function untrackActiveCase(owner: ActiveCase): void {
+  activeCases.delete(owner);
+  if (activeCases.size === 0) {
+    removeParentSignalHandlers();
+  }
+}
+
+function installParentSignalHandlers(): void {
+  if (parentSignalHandlersInstalled) {
+    return;
+  }
+  parentSignalHandlersInstalled = true;
+  for (const signal of PARENT_SIGNAL_EXIT_CODES.keys()) {
+    const handler = () => handleParentSignal(signal);
+    parentSignalHandlers.set(signal, handler);
+    process.on(signal, handler);
+  }
+}
+
+function removeParentSignalHandlers(): void {
+  if (!parentSignalHandlersInstalled || parentSignalShutdownStarted) {
+    return;
+  }
+  removeInstalledParentSignalHandlers();
+}
+
+function removeInstalledParentSignalHandlers(): void {
+  if (!parentSignalHandlersInstalled) {
+    return;
+  }
+  parentSignalHandlersInstalled = false;
+  for (const [signal, handler] of parentSignalHandlers) {
+    process.off(signal, handler);
+  }
+  parentSignalHandlers.clear();
+}
+
+function handleParentSignal(signal: ParentSignal): void {
+  if (parentSignalShutdownStarted) {
+    for (const owner of activeCases) {
+      owner.stop("SIGKILL");
+    }
+    return;
+  }
+  parentSignalShutdownStarted = true;
+  parentSignalShutdown = cleanupActiveCaseChildrenForParentSignal(signal);
+}
+
+async function cleanupActiveCaseChildrenForParentSignal(signal: ParentSignal): Promise<void> {
+  const owners = [...activeCases];
+  for (const owner of owners) {
+    owner.stop(signal);
+  }
+  const outcomes = await Promise.allSettled(owners.map((owner) => owner.completion));
+  for (const outcome of outcomes) {
+    if (outcome.status === "rejected") {
+      console.error(`[extension-memory] ${formatErrorMessage(outcome.reason)}`);
+    } else if (summarizeCase(outcome.value).status !== "ok") {
+      console.error(
+        `[extension-memory] ${outcome.value.error ?? describeCaseFailure(outcome.value)}`,
+      );
+    }
+  }
+  removeInstalledParentSignalHandlers();
+  process.exit(PARENT_SIGNAL_EXIT_CODES.get(signal) ?? 1);
+}
+
+function buildImportBody(entryFiles: string[], label: string): string {
+  const imports = entryFiles
+    .map((filePath) => `await import(${JSON.stringify(filePath)});`)
+    .join("\n");
+  return `${imports}\nconsole.log(${JSON.stringify(label)});\nprocess.exit(0);\n`;
+}
+
+async function main(): Promise<void> {
+  const options = parseArgs(process.argv.slice(2));
+  const repoRoot = process.cwd();
+  ensureExtensionMemoryBuild({
+    rootDir: repoRoot,
+    requiredExtensionIds: options.extensions,
+  });
+  const allEntries = findBuiltExtensionMemoryEntries(repoRoot);
+  if (allEntries.length === 0) {
+    throw new Error(
+      "No built plugin entrypoints found in root or package-local output. Run pnpm build or build the plugin package first.",
+    );
+  }
+  const selectedEntries =
+    options.extensions.length === 0
+      ? allEntries
+      : allEntries.filter((entry) => options.extensions.includes(entry.dir));
+
+  const missing = options.extensions.filter((id) => !allEntries.some((entry) => entry.dir === id));
+  if (missing.length > 0) {
+    throw new Error(`Unknown built extension ids: ${missing.join(", ")}`);
+  }
+  if (selectedEntries.length === 0) {
+    throw new Error("No extensions selected for profiling");
+  }
+
+  const tmpHome = mkdtempSync(path.join(os.tmpdir(), "openclaw-extension-memory-"));
+  const hookPath = path.join(tmpHome, "measure-rss.mjs");
+  const jsonPath = options.jsonPath ?? defaultJsonReportPath();
+
+  writeFileSync(
+    hookPath,
+    [
+      "import { writeSync } from 'node:fs';",
+      "process.on('exit', () => {",
+      "  const usage = typeof process.resourceUsage === 'function' ? process.resourceUsage() : null;",
+      `  if (usage && typeof usage.maxRSS === 'number') writeSync(2, '${RSS_MARKER}' + String(usage.maxRSS) + '\\n');`,
+      "});",
+      "",
+    ].join("\n"),
+    "utf8",
+  );
+
+  const env = {
+    ...process.env,
+    HOME: tmpHome,
+    USERPROFILE: tmpHome,
+    XDG_CONFIG_HOME: path.join(tmpHome, ".config"),
+    XDG_DATA_HOME: path.join(tmpHome, ".local", "share"),
+    XDG_CACHE_HOME: path.join(tmpHome, ".cache"),
+    NODE_DISABLE_COMPILE_CACHE: "1",
+    OPENCLAW_NO_RESPAWN: "1",
+    TERM: process.env.TERM ?? "dumb",
+    LANG: process.env.LANG ?? "C.UTF-8",
+  };
+
+  const runErrors: unknown[] = [];
+  try {
+    const baseline = await runCase({
+      repoRoot,
+      env,
+      hookPath,
+      name: "baseline",
+      body: "process.exit(0)",
+      timeoutMs: options.timeoutMs,
+    });
+
+    const combined = options.skipCombined
+      ? null
+      : await runCase({
+          repoRoot,
+          env,
+          hookPath,
+          name: "combined",
+          body: buildImportBody(
+            selectedEntries.map((entry) => entry.file),
+            "IMPORTED_ALL",
+          ),
+          timeoutMs: options.combinedTimeoutMs,
+        });
+
+    const mapperErrors: unknown[] = [];
+    const results = await pMap(
+      selectedEntries,
+      async (next) => {
+        if (mapperErrors.length > 0 || parentSignalShutdownStarted) {
+          return pMapSkip;
+        }
+        try {
+          const result = await runCase({
+            repoRoot,
+            env,
+            hookPath,
+            name: next.dir,
+            body: buildImportBody([next.file], "IMPORTED"),
+            timeoutMs: options.timeoutMs,
+          });
+          const entry = {
+            dir: next.dir,
+            file: next.file,
+            ...summarizeCase(result),
+            deltaFromBaselineMb:
+              result.maxRssMb !== null && baseline.maxRssMb !== null
+                ? result.maxRssMb - baseline.maxRssMb
+                : null,
+          };
+
+          const rss = result.maxRssMb === null ? "n/a" : `${result.maxRssMb.toFixed(1)} MB`;
+          console.log(`[extension-memory] ${next.dir}: ${entry.status} ${rss}`);
+          return entry;
+        } catch (error) {
+          // p-map rejects before active mappers join. Fulfill failures, stop new admission,
+          // then propagate every error only after all admitted case owners have settled.
+          mapperErrors.push(error);
+          return pMapSkip;
+        }
+      },
+      { concurrency: options.concurrency, stopOnError: false },
+    );
+    if (parentSignalShutdownStarted) {
+      mapperErrors.push(new Error("Profiling interrupted by parent signal"));
+    }
+    if (mapperErrors.length > 0) {
+      throw new AggregateError(mapperErrors, mapperErrors.map(formatErrorMessage).join("; "));
+    }
+
+    results.sort((a, b) => a.dir.localeCompare(b.dir));
+    const top = results
+      .filter((entry) => entry.status === "ok" && typeof entry.deltaFromBaselineMb === "number")
+      .toSorted((a, b) => (b.deltaFromBaselineMb ?? 0) - (a.deltaFromBaselineMb ?? 0))
+      .slice(0, options.top);
+
+    const report = {
+      generatedAt: new Date().toISOString(),
+      repoRoot,
+      selectedExtensions: selectedEntries.map((entry) => entry.dir),
+      baseline: summarizeCase(baseline),
+      combined:
+        combined === null
+          ? null
+          : {
+              ...summarizeCase(combined),
+              stderrPreview: summarizeStderr(combined.stderr, 12),
+            },
+      counts: {
+        totalEntries: selectedEntries.length,
+        ok: results.filter((entry) => entry.status === "ok").length,
+        fail: results.filter((entry) => entry.status === "fail").length,
+        timeout: results.filter((entry) => entry.status === "timeout").length,
+      },
+      options: {
+        concurrency: options.concurrency,
+        timeoutMs: options.timeoutMs,
+        combinedTimeoutMs: options.combinedTimeoutMs,
+        skipCombined: options.skipCombined,
+      },
+      topByDeltaMb: top,
+      results,
+    };
+
+    mkdirSync(path.dirname(jsonPath), { recursive: true });
+    writeFileSync(jsonPath, `${JSON.stringify(report, null, 2)}\n`, "utf8");
+
+    console.log(`[extension-memory] report: ${jsonPath}`);
+    console.log(
+      JSON.stringify(
+        {
+          baselineMb: report.baseline.maxRssMb,
+          combinedMb: report.combined?.maxRssMb ?? null,
+          counts: report.counts,
+          topByDeltaMb: report.topByDeltaMb,
+        },
+        null,
+        2,
+      ),
+    );
+
+    const failures = [];
+    if (report.baseline.status !== "ok") {
+      failures.push(`baseline import ${report.baseline.status}: ${report.baseline.error}`);
+    }
+    if (report.baseline.maxRssMb === null) {
+      failures.push("baseline import did not report RSS");
+    }
+    if (report.combined !== null) {
+      if (report.combined.status !== "ok") {
+        failures.push(`combined import ${report.combined.status}: ${report.combined.error}`);
+      }
+      if (report.combined.maxRssMb === null) {
+        failures.push("combined import did not report RSS");
+      }
+    }
+    for (const result of report.results) {
+      if (result.status !== "ok") {
+        failures.push(`${result.dir} import ${result.status}: ${result.error}`);
+      }
+      if (result.maxRssMb === null) {
+        failures.push(`${result.dir} import did not report RSS`);
+      }
+    }
+    if (failures.length > 0) {
+      for (const failure of failures) {
+        console.error(`[extension-memory] ${failure}`);
+      }
+      process.exitCode = 1;
+    }
+  } catch (error) {
+    runErrors.push(error);
+  }
+  // The signal owner retains the exit status and must finish its snapshot's cleanup.
+  if (parentSignalShutdown) {
+    await parentSignalShutdown;
+    return;
+  }
+  if (runErrors.some(hasUnjoinedWork)) {
+    console.error(
+      `[extension-memory] retained temporary home after unverified cleanup: ${tmpHome}`,
+    );
+  } else {
+    try {
+      rmSync(tmpHome, { recursive: true, force: true });
+    } catch (error) {
+      runErrors.push(error);
+    }
+  }
+  if (runErrors.length > 0) {
+    throw new AggregateError(runErrors, runErrors.map(formatErrorMessage).join("; "));
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  try {
+    await main();
+  } catch (error) {
+    console.error(`[extension-memory] ${formatErrorMessage(error)}`);
+    process.exit(1);
+  }
+}
diff --git a/scripts/prompt-snapshot-files.ts b/scripts/prompt-snapshot-files.ts
new file mode 100644
index 0000000000000000000000000000000000000000..60af9b1b552dd6d93f9f591afa027e730dcfbd32
--- /dev/null
+++ b/scripts/prompt-snapshot-files.ts
@@ -0,0 +1,37 @@
+// Prompt Snapshot Files script supports OpenClaw repository automation.
+import fs from "node:fs/promises";
+import path from "node:path";
+import { CODEX_RUNTIME_HAPPY_PATH_PROMPT_SNAPSHOT_DIR } from "../test/helpers/agents/prompt-snapshot-paths.js";
+
+function hasErrorCode(error: unknown, code: string): boolean {
+  return Boolean(error && typeof error === "object" && "code" in error && error.code === code);
+}
+
+export async function listCommittedSnapshotArtifactPaths(root: string): Promise<string[]> {
+  let committedEntries: string[];
+  try {
+    committedEntries = await fs.readdir(
+      path.resolve(root, CODEX_RUNTIME_HAPPY_PATH_PROMPT_SNAPSHOT_DIR),
+    );
+  } catch (error) {
+    if (!hasErrorCode(error, "ENOENT")) {
+      throw error;
+    }
+    committedEntries = [];
+  }
+  return committedEntries
+    .filter((entry) => /\.(?:json|md(?:\.(?:diff|patch))?)$/u.test(entry))
+    .map((entry) => path.join(CODEX_RUNTIME_HAPPY_PATH_PROMPT_SNAPSHOT_DIR, entry));
+}
+
+export async function deleteStalePromptSnapshotFiles(
+  root: string,
+  files: Array<{ path: string }>,
+): Promise<string[]> {
+  const expectedPaths = new Set(files.map((file) => file.path));
+  const stalePaths = (await listCommittedSnapshotArtifactPaths(root)).filter(
+    (snapshotPath) => !expectedPaths.has(snapshotPath),
+  );
+  await Promise.all(stalePaths.map((snapshotPath) => fs.rm(path.resolve(root, snapshotPath))));
+  return stalePaths;
+}
diff --git a/scripts/proxy-install-ca.mts b/scripts/proxy-install-ca.mts
new file mode 100644
index 0000000000000000000000000000000000000000..8f2aa906b2698b976d04cff8ae574e48975eb9f0
--- /dev/null
+++ b/scripts/proxy-install-ca.mts
@@ -0,0 +1,81 @@
+#!/usr/bin/env node
+// Creates the debug proxy CA and, on macOS, trusts it in the system keychain.
+import { spawnSync } from "node:child_process";
+import process from "node:process";
+import { resolveSystemBin } from "../src/infra/resolve-system-bin.js";
+import { ensureDebugProxyCa } from "../src/proxy-capture/ca.js";
+import { resolveDebugProxySettings } from "../src/proxy-capture/env.js";
+
+const parsedArgs = parseArgs(process.argv.slice(2));
+const printOnly = parsedArgs.printOnly;
+
+async function installCa(): Promise<void> {
+  const settings = resolveDebugProxySettings();
+  const ca = await ensureDebugProxyCa(settings.certDir);
+  process.stdout.write(`Debug proxy CA: ${ca.certPath}\n`);
+  if (printOnly) {
+    process.stdout.write("Created or reused the debug proxy CA without changing system trust.\n");
+    return;
+  }
+
+  if (process.platform !== "darwin") {
+    process.stdout.write(
+      "Automatic CA trust is only implemented for macOS. Use the printed CA path to trust it manually on this platform.\n",
+    );
+    return;
+  }
+
+  const security = resolveSystemBin("security");
+  if (!security) {
+    throw new Error("security CLI is required on macOS to trust the debug proxy CA");
+  }
+
+  const result = spawnSync(
+    security,
+    [
+      "add-trusted-cert",
+      "-d",
+      "-r",
+      "trustRoot",
+      "-k",
+      "/Library/Keychains/System.keychain",
+      ca.certPath,
+    ],
+    {
+      stdio: "inherit",
+    },
+  );
+  if (result.status !== 0) {
+    throw new Error(`security add-trusted-cert failed with exit code ${result.status ?? 1}`);
+  }
+  process.stdout.write("Trusted the OpenClaw debug proxy CA in System.keychain.\n");
+}
+
+void installCa().catch((error: unknown) => {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(1);
+});
+
+function parseArgs(argv: string[]): { printOnly: boolean } {
+  let wantsPrintOnly = false;
+  for (const arg of argv) {
+    if (arg === "--help") {
+      printUsage(console.log);
+      process.exit(0);
+    }
+    if (arg === "--print-only") {
+      wantsPrintOnly = true;
+      continue;
+    }
+    console.error(`Unknown proxy install CA argument: ${arg}`);
+    printUsage(console.error);
+    process.exit(1);
+  }
+  return { printOnly: wantsPrintOnly };
+}
+
+function printUsage(writeLine: (line: string) => void): void {
+  writeLine("Usage: node --import tsx scripts/proxy-install-ca.mts [--print-only]");
+  writeLine("");
+  writeLine("  --print-only  create or reuse the debug proxy CA without changing system trust");
+}
diff --git a/scripts/qa-parity-report.ts b/scripts/qa-parity-report.ts
new file mode 100644
index 0000000000000000000000000000000000000000..f62d51475d1ef038367fcad39823af9cd5b0954e
--- /dev/null
+++ b/scripts/qa-parity-report.ts
@@ -0,0 +1,86 @@
+// Qa Parity Report script supports OpenClaw repository automation.
+import { booleanFlag, parseFlagArgs, stringFlag } from "./lib/arg-utils.mts";
+
+type Options = {
+  baselineLabel?: string;
+  baselineSummary?: string;
+  candidateLabel?: string;
+  candidateSummary?: string;
+  outputDir?: string;
+  repoRoot?: string;
+  runtimeAxis?: boolean;
+  summary?: string;
+  tokenEfficiency?: boolean;
+};
+
+function parseArgs(args: string[]): Options {
+  return parseFlagArgs(
+    args,
+    {},
+    [
+      stringFlag("--baseline-label", "baselineLabel", { rejectShortOptions: true }),
+      stringFlag("--baseline-summary", "baselineSummary", { rejectShortOptions: true }),
+      stringFlag("--candidate-label", "candidateLabel", { rejectShortOptions: true }),
+      stringFlag("--candidate-summary", "candidateSummary", { rejectShortOptions: true }),
+      stringFlag("--output-dir", "outputDir", { rejectShortOptions: true }),
+      stringFlag("--repo-root", "repoRoot", { rejectShortOptions: true }),
+      booleanFlag("--runtime-axis", "runtimeAxis"),
+      stringFlag("--summary", "summary", { rejectShortOptions: true }),
+      booleanFlag("--token-efficiency", "tokenEfficiency"),
+    ],
+    {
+      onUnhandledArg(arg: string) {
+        if (arg !== "--help" && arg !== "-h") {
+          throw new Error(`Unknown qa parity-report option: ${arg}`);
+        }
+        process.stdout.write(`Usage: openclaw qa parity-report [options]
+
+Options:
+  --candidate-summary <path>  Candidate qa-suite-summary.json path
+  --baseline-summary <path>   Baseline qa-suite-summary.json path
+  --candidate-label <label>   Candidate display label
+  --baseline-label <label>    Baseline display label
+  --runtime-axis              Interpret --summary as a runtime-pair summary
+  --summary <path>            Runtime-axis qa-suite-summary.json path
+  --token-efficiency          Also write the runtime token-efficiency report
+  --repo-root <path>          Repository root to target
+  --output-dir <path>         Artifact directory for the parity report
+  -h, --help                  Display help
+`);
+        process.exit(0);
+      },
+    },
+  ) as Options;
+}
+
+try {
+  const opts = parseArgs(process.argv.slice(2));
+  if (opts.runtimeAxis) {
+    if (!opts.summary) {
+      throw new Error("--summary is required when --runtime-axis is set.");
+    }
+  } else {
+    if (!opts.candidateSummary) {
+      throw new Error("--candidate-summary is required.");
+    }
+    if (!opts.baselineSummary) {
+      throw new Error("--baseline-summary is required.");
+    }
+  }
+
+  const { runQaParityReportCommand } = await import("../extensions/qa-lab/src/cli.runtime.ts");
+  await runQaParityReportCommand({
+    ...(opts.baselineSummary ? { baselineSummary: opts.baselineSummary } : {}),
+    ...(opts.candidateSummary ? { candidateSummary: opts.candidateSummary } : {}),
+    ...(opts.baselineLabel ? { baselineLabel: opts.baselineLabel } : {}),
+    ...(opts.candidateLabel ? { candidateLabel: opts.candidateLabel } : {}),
+    ...(opts.outputDir ? { outputDir: opts.outputDir } : {}),
+    ...(opts.repoRoot ? { repoRoot: opts.repoRoot } : {}),
+    ...(opts.runtimeAxis ? { runtimeAxis: opts.runtimeAxis } : {}),
+    ...(opts.summary ? { summary: opts.summary } : {}),
+    ...(opts.tokenEfficiency ? { tokenEfficiency: opts.tokenEfficiency } : {}),
+  });
+} catch (error) {
+  process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+  process.exitCode = 1;
+}
diff --git a/scripts/release-check.ts b/scripts/release-check.ts
new file mode 100644
index 0000000000000000000000000000000000000000..515f12c80030bbfbc682b65bf8b9c0019e66c8c1
--- /dev/null
+++ b/scripts/release-check.ts
@@ -0,0 +1,1472 @@
+#!/usr/bin/env -S node --import tsx
+// Release Check script supports OpenClaw repository automation.
+
+import { execFileSync, type ExecFileSyncOptions } from "node:child_process";
+import {
+  copyFileSync,
+  existsSync,
+  lstatSync,
+  mkdtempSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import type { Dirent } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, dirname, join, posix, resolve, win32 } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { parseArgs } from "node:util";
+import { extract } from "tar";
+import { expectDefined } from "../packages/normalization-core/src/expect.js";
+import { COMPLETION_SKIP_PLUGIN_COMMANDS_ENV } from "../src/cli/completion-runtime.ts";
+import { escapeRegExp } from "../src/shared/regexp.js";
+import { checkCliBootstrapExternalImports } from "./check-cli-bootstrap-imports.mts";
+import {
+  collectBundledExtensionManifestErrors,
+  type BundledExtension,
+  type ExtensionPackageJson as PackageJson,
+} from "./lib/bundled-extension-manifest.ts";
+import { GATEWAY_RUN_CHUNK_METADATA_VERSION } from "./lib/gateway-run-chunk-metadata.mts";
+import { importToolingTypeScript } from "./lib/import-tooling-typescript.mts";
+import { collectPackUnpackedSizeErrors as collectNpmPackUnpackedSizeErrors } from "./lib/npm-pack-budget.mts";
+import { readPositiveEnvInt } from "./lib/numeric-options.mjs";
+import { isLegacyPluginDependencyInstallStagePath } from "./lib/package-dist-inventory.ts";
+import { collectBundledPluginPackageDependencySpecs } from "./lib/plugin-package-dependencies.mts";
+import { runInstalledWorkspaceBootstrapSmoke } from "./lib/workspace-bootstrap-smoke.mts";
+import { resolveNpmRunner } from "./npm-runner.mts";
+import {
+  collectInstalledPackageErrors,
+  normalizeInstalledBinaryVersion,
+} from "./openclaw-npm-postpublish-verify.ts";
+import { assertPreparedOpenClawAiDependency } from "./openclaw-npm-prepublish-verify.ts";
+import { parseNpmPackJsonOutput, type NpmPackResult } from "./openclaw-npm-release-check.ts";
+import { resolvePnpmRunner } from "./pnpm-runner.mts";
+import { sparkleBuildFloorsFromShortVersion, type SparkleBuildFloors } from "./sparkle-build.ts";
+import { buildCmdExeCommandLine, resolveWindowsCmdExePath } from "./windows-cmd-helpers.mjs";
+
+type ReleaseCheckExecOptions = ExecFileSyncOptions & {
+  windowsVerbatimArguments?: boolean;
+};
+
+export const RELEASE_CHECK_LOCAL_PACKAGE_TARBALL_DIR_ENV =
+  "OPENCLAW_RELEASE_CHECK_LOCAL_PACKAGE_TARBALL_DIR";
+
+type ReleaseCheckCommandInvocation = {
+  command: string;
+  args: string[];
+  env?: NodeJS.ProcessEnv;
+  shell?: boolean | string;
+  windowsVerbatimArguments?: boolean;
+};
+
+const forbiddenPrivateQaContentMarkers = [
+  "//#region extensions/qa-lab/",
+  "qa-channel/runtime-api.js",
+  "qa-channel.js",
+  "qa-channel-protocol.js",
+  "qa-lab/cli.js",
+  "qa-lab/runtime-api.js",
+] as const;
+const forbiddenPrivatePluginSdkDeclarationMarkers = [
+  "//#region src/agents/test-helpers/",
+  "//#region src/plugin-sdk/test-helpers/",
+  "//#region src/test-helpers/",
+  "//#region src/test-utils/",
+] as const;
+const forbiddenPrivateQaContentScanPrefixes = ["dist/"] as const;
+const appcastPath = resolve("appcast.xml");
+const laneBuildMin = 1_000_000_000;
+const laneFloorAdoptionReleaseKey = 20260227;
+const SAFE_UNIX_SMOKE_PATH = "/usr/bin:/bin";
+const DEFAULT_RELEASE_CHECK_COMMAND_TIMEOUT_MS = 5 * 60 * 1000;
+const DEFAULT_RELEASE_CHECK_COMMAND_MAX_BUFFER_BYTES = 100 * 1024 * 1024;
+const PACKAGE_TARBALL_VERIFIER_PATH = fileURLToPath(
+  new URL("./check-openclaw-package-tarball.mjs", import.meta.url),
+);
+export const MAX_CRITICAL_PLUGIN_SDK_ENTRYPOINT_BYTES = 2 * 1024 * 1024;
+const CRITICAL_PLUGIN_SDK_SIZE_CHECK_SPECIFIERS = [
+  "openclaw/plugin-sdk/core",
+  "openclaw/plugin-sdk/provider-entry",
+  "openclaw/plugin-sdk/runtime",
+] as const;
+const CRITICAL_PLUGIN_SDK_IMPORT_SMOKE_SPECIFIERS = ["openclaw/plugin-sdk/core"] as const;
+export const PACKED_CLI_SMOKE_COMMANDS = [
+  ["--help"],
+  ["onboard", "--help"],
+  ["doctor", "--help"],
+  ["status", "--json", "--timeout", "1"],
+  ["config", "schema"],
+  ["models", "list", "--provider", "openai"],
+] as const;
+export const PACKED_BUNDLED_RUNTIME_DEPS_REPAIR_ARGS = [
+  "doctor",
+  "--fix",
+  "--non-interactive",
+] as const;
+export const PACKED_COMPLETION_SMOKE_ARGS = [
+  "completion",
+  "--write-state",
+  "--shell",
+  "zsh",
+] as const;
+// The checker owns fixture bytes; the target checkout supplies package metadata.
+const PACKED_PLUGIN_SDK_TYPESCRIPT_SMOKE_FIXTURE = new URL(
+  "./fixtures/packed-plugin-sdk-type-smoke.ts",
+  import.meta.url,
+);
+const PACKED_PLUGIN_SDK_SETUP_CONSUMER_FIXTURE = new URL(
+  "./fixtures/packed-plugin-sdk-setup-consumer.ts",
+  import.meta.url,
+);
+const PACKED_PLUGIN_SDK_SETUP_DECLARATIONS = [
+  "dist/plugin-sdk/setup.d.ts",
+  "dist/plugin-sdk/setup-runtime.d.ts",
+] as const;
+const PACKED_PLUGIN_SDK_SETUP_SURFACE_OMISSION_VERSIONS = new Set(["2026.7.33"]);
+
+export function packedPluginSdkSupportsSetupSurface(installedOpenClawRoot: string): boolean {
+  return PACKED_PLUGIN_SDK_SETUP_DECLARATIONS.every((relativePath) => {
+    const declarationPath = join(installedOpenClawRoot, relativePath);
+    return (
+      existsSync(declarationPath) && readFileSync(declarationPath, "utf8").includes("setupSurface")
+    );
+  });
+}
+
+export function packedPluginSdkMayOmitSetupSurface(packageVersion: string): boolean {
+  return PACKED_PLUGIN_SDK_SETUP_SURFACE_OMISSION_VERSIONS.has(packageVersion);
+}
+const PACKED_BUNDLED_CHANNEL_ENTRY_SMOKE_ENTRYPOINTS = [
+  "scripts/test-built-bundled-channel-entry-smoke.mts",
+  "scripts/test-built-bundled-channel-entry-smoke.mjs",
+] as const;
+
+export function resolvePackedBundledChannelEntrySmokeCommand(
+  fileExists: (path: string) => boolean = existsSync,
+  nodeExecPath = process.execPath,
+) {
+  const entrypoint = PACKED_BUNDLED_CHANNEL_ENTRY_SMOKE_ENTRYPOINTS.find(fileExists);
+  if (!entrypoint) {
+    throw new Error(
+      "release-check: target does not provide scripts/test-built-bundled-channel-entry-smoke.mts or .mjs",
+    );
+  }
+  return {
+    command: nodeExecPath,
+    args: [...(entrypoint.endsWith(".mts") ? ["--import", "tsx"] : []), entrypoint],
+  };
+}
+
+export function runReleaseCheckCommand(
+  invocation: ReleaseCheckCommandInvocation,
+  options: {
+    cwd?: string;
+    encoding?: BufferEncoding;
+    env?: NodeJS.ProcessEnv;
+    maxBuffer?: number;
+    shell?: boolean | string;
+    stdio: "inherit" | ["ignore", "pipe", "pipe"];
+    timeoutMs?: number;
+  },
+): string {
+  const execOptions: ReleaseCheckExecOptions = {
+    cwd: options.cwd,
+    encoding: options.encoding,
+    env: invocation.env ?? options.env,
+    killSignal: "SIGKILL",
+    maxBuffer:
+      options.maxBuffer ??
+      readPositiveEnvInt(
+        "OPENCLAW_RELEASE_CHECK_COMMAND_MAX_BUFFER_BYTES",
+        process.env,
+        DEFAULT_RELEASE_CHECK_COMMAND_MAX_BUFFER_BYTES,
+      ),
+    shell: invocation.shell ?? options.shell,
+    stdio: options.stdio,
+    timeout:
+      options.timeoutMs ??
+      readPositiveEnvInt(
+        "OPENCLAW_RELEASE_CHECK_COMMAND_TIMEOUT_MS",
+        process.env,
+        DEFAULT_RELEASE_CHECK_COMMAND_TIMEOUT_MS,
+      ),
+    windowsVerbatimArguments: invocation.windowsVerbatimArguments,
+  };
+  const output: Buffer | string | null = execFileSync(
+    invocation.command,
+    invocation.args,
+    execOptions,
+  );
+  if (output == null) {
+    return "";
+  }
+  return typeof output === "string" ? output : output.toString("utf8");
+}
+
+export function collectSkillShellScriptExecutableErrors(rootDir = resolve(".")): string[] {
+  if (process.platform === "win32") {
+    return [];
+  }
+
+  const skillsDir = join(rootDir, "skills");
+  const errors: string[] = [];
+  let entries: Dirent[];
+  try {
+    entries = readdirSync(skillsDir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+
+  for (const entry of entries) {
+    if (!entry.isDirectory()) {
+      continue;
+    }
+    const scriptsDir = join(skillsDir, entry.name, "scripts");
+    let scriptEntries: Dirent[];
+    try {
+      scriptEntries = readdirSync(scriptsDir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const scriptEntry of scriptEntries) {
+      if (!scriptEntry.isFile() || !scriptEntry.name.endsWith(".sh")) {
+        continue;
+      }
+      const scriptPath = join(scriptsDir, scriptEntry.name);
+      if ((statSync(scriptPath).mode & 0o111) === 0) {
+        errors.push(
+          `skill shell script is not executable: skills/${entry.name}/scripts/${scriptEntry.name}`,
+        );
+      }
+    }
+  }
+
+  return errors;
+}
+
+function collectBundledExtensions(): BundledExtension[] {
+  const extensionsDir = resolve("extensions");
+  const entries = readdirSync(extensionsDir, { withFileTypes: true }).filter((entry) =>
+    entry.isDirectory(),
+  );
+
+  return entries.flatMap((entry) => {
+    const packagePath = join(extensionsDir, entry.name, "package.json");
+    try {
+      return [
+        {
+          id: entry.name,
+          packageJson: JSON.parse(readFileSync(packagePath, "utf8")) as PackageJson,
+        },
+      ];
+    } catch {
+      return [];
+    }
+  });
+}
+
+function checkBundledExtensionMetadata() {
+  const extensions = collectBundledExtensions();
+  const manifestErrors = collectBundledExtensionManifestErrors(extensions);
+  const bundledPackageDependencySpecs = collectBundledPluginPackageDependencySpecs(
+    resolve("extensions"),
+  );
+  const dependencyConflictErrors = [...bundledPackageDependencySpecs.entries()]
+    .flatMap(([dependencyName, record]) =>
+      record.conflicts.map(
+        (conflict) =>
+          `bundled plugin package dependency '${dependencyName}' has conflicting specs: ${record.pluginIds.join(", ")} use '${record.spec}', ${conflict.pluginId} uses '${conflict.spec}'.`,
+      ),
+    )
+    .toSorted((left, right) => left.localeCompare(right));
+  const errors = [...manifestErrors, ...dependencyConflictErrors];
+  if (errors.length > 0) {
+    console.error("release-check: bundled extension manifest validation failed:");
+    for (const error of errors) {
+      console.error(`  - ${error}`);
+    }
+    process.exit(1);
+  }
+}
+
+function checkSkillShellScriptsExecutable() {
+  const errors = collectSkillShellScriptExecutableErrors();
+  if (errors.length > 0) {
+    console.error("release-check: skill shell script permission validation failed:");
+    for (const error of errors) {
+      console.error(`  - ${error}`);
+    }
+    process.exit(1);
+  }
+}
+
+export function resolveReleaseNpmCommand(
+  args: string[],
+  params: {
+    comSpec?: string;
+    env?: NodeJS.ProcessEnv;
+    execPath?: string;
+    existsSync?: typeof existsSync;
+    platform?: NodeJS.Platform;
+  } = {},
+) {
+  return resolveNpmRunner({
+    comSpec: params.comSpec,
+    env: params.env,
+    execPath: params.execPath,
+    existsSync: params.existsSync,
+    npmArgs: args,
+    platform: params.platform,
+  });
+}
+
+function execNpm(
+  args: string[],
+  options: {
+    cwd?: string;
+    encoding: BufferEncoding;
+    env?: NodeJS.ProcessEnv;
+    maxBuffer?: number;
+    stdio: "inherit" | ["ignore", "pipe", "pipe"];
+  },
+): string {
+  const invocation = resolveReleaseNpmCommand(args, { env: options.env ?? process.env });
+  return runReleaseCheckCommand(invocation, options);
+}
+
+function execPnpm(
+  args: string[],
+  options: {
+    cwd?: string;
+    encoding: BufferEncoding;
+    env?: NodeJS.ProcessEnv;
+    maxBuffer?: number;
+    stdio: "inherit" | ["ignore", "pipe", "pipe"];
+  },
+): string {
+  const invocation = resolvePnpmRunner({ env: options.env ?? process.env, pnpmArgs: args });
+  return runReleaseCheckCommand(invocation, options);
+}
+
+function inspectPackedTarball(tarballPath: string): NpmPackResult[] {
+  const raw = execNpm(
+    ["pack", tarballPath, "--dry-run", "--json", "--ignore-scripts", "--offline"],
+    {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      maxBuffer: 1024 * 1024 * 100,
+    },
+  );
+  return expectDefined(parseNpmPackJsonOutput(raw), "npm pack tarball contents receipt");
+}
+
+function runPack(packDestination: string, cwd?: string): NpmPackResult[] {
+  const raw = execPnpm(["pack", "--json", "--pack-destination", packDestination], {
+    cwd,
+    encoding: "utf8",
+    env: { ...process.env, OPENCLAW_PREPACK_PREPARED: "1" },
+    stdio: ["ignore", "pipe", "pipe"],
+    maxBuffer: 1024 * 1024 * 100,
+  });
+  return expectDefined(parseNpmPackJsonOutput(raw), "pnpm pack package receipt");
+}
+
+export function resolvePackedTarballPath(
+  packDestination: string,
+  results: NpmPackResult[],
+): string {
+  const filenames = results
+    .map((entry) => entry.filename)
+    .filter((filename): filename is string => typeof filename === "string" && filename.length > 0);
+  if (filenames.length !== 1) {
+    throw new Error(
+      `release-check: npm pack produced ${filenames.length} tarballs; expected exactly one.`,
+    );
+  }
+  const filename = expectDefined(filenames[0], "npm pack tarball filename");
+  const filenameBasename = basename(filename);
+  const resolvedDestination = resolve(packDestination);
+  const resolvedTarball = resolve(resolvedDestination, filenameBasename);
+  const isLocalFilename = filename === filenameBasename;
+  const isAbsolutePathInDestination = resolve(filename) === resolvedTarball;
+  if (
+    !filenameBasename.endsWith(".tgz") ||
+    filename.includes("\0") ||
+    filenameBasename !== win32.basename(filename) ||
+    (!isLocalFilename && !isAbsolutePathInDestination)
+  ) {
+    throw new Error(
+      `release-check: npm pack reported unsafe tarball filename ${JSON.stringify(filename)}.`,
+    );
+  }
+  return resolvedTarball;
+}
+
+export function resolveReleaseCheckLocalPackageTarballs(
+  tarballDir: string | undefined = process.env[RELEASE_CHECK_LOCAL_PACKAGE_TARBALL_DIR_ENV],
+  requiresAi = rootPackageRequiresLocalAiTarball(),
+): string[] {
+  if (!tarballDir) {
+    return [];
+  }
+  const resolvedDir = resolve(tarballDir);
+  if (!existsSync(resolvedDir) || !statSync(resolvedDir).isDirectory()) {
+    throw new Error(
+      `release-check: ${RELEASE_CHECK_LOCAL_PACKAGE_TARBALL_DIR_ENV} must name a directory.`,
+    );
+  }
+  const tarballs = readdirSync(resolvedDir, { withFileTypes: true })
+    .filter((entry) => entry.isFile() && entry.name.endsWith(".tgz"))
+    .map((entry) => resolve(resolvedDir, entry.name))
+    .toSorted((left, right) => left.localeCompare(right));
+  const aiTarballs = tarballs.filter(
+    (tarballPath) => localPackageNameForTarball(tarballPath) === "@openclaw/ai",
+  );
+  const gatewayProtocolTarballs = tarballs.filter(
+    (tarballPath) => localPackageNameForTarball(tarballPath) === "@openclaw/gateway-protocol",
+  );
+  const gatewayClientTarballs = tarballs.filter(
+    (tarballPath) => localPackageNameForTarball(tarballPath) === "@openclaw/gateway-client",
+  );
+  const recognizedTarballs =
+    aiTarballs.length + gatewayProtocolTarballs.length + gatewayClientTarballs.length;
+  if (recognizedTarballs !== tarballs.length) {
+    throw new Error(
+      `release-check: ${RELEASE_CHECK_LOCAL_PACKAGE_TARBALL_DIR_ENV} contains an unsupported package tarball.`,
+    );
+  }
+  const expectedAiTarballs = requiresAi ? 1 : 0;
+  const aiTarballRequirement = requiresAi
+    ? "exactly one @openclaw/ai tarball"
+    : "no @openclaw/ai tarballs";
+  if (
+    aiTarballs.length !== expectedAiTarballs ||
+    gatewayProtocolTarballs.length > 1 ||
+    gatewayClientTarballs.length > 1
+  ) {
+    throw new Error(
+      `release-check: ${RELEASE_CHECK_LOCAL_PACKAGE_TARBALL_DIR_ENV} must contain ${aiTarballRequirement}, at most one @openclaw/gateway-protocol tarball, and at most one @openclaw/gateway-client tarball; found ${aiTarballs.length}, ${gatewayProtocolTarballs.length}, and ${gatewayClientTarballs.length}.`,
+    );
+  }
+  return tarballs;
+}
+
+function rootPackageRequiresLocalAiTarball(): boolean {
+  const packageJson = JSON.parse(readFileSync(resolve("package.json"), "utf8")) as {
+    dependencies?: Record<string, unknown>;
+  };
+  return typeof packageJson.dependencies?.["@openclaw/ai"] === "string";
+}
+
+function localPackageNameForTarball(tarballPath: string): string | undefined {
+  const filename = basename(tarballPath);
+  if (/^openclaw-ai(?:-.+)?\.tgz$/.test(filename)) {
+    return "@openclaw/ai";
+  }
+  if (/^openclaw-gateway-protocol(?:-.+)?\.tgz$/.test(filename)) {
+    return "@openclaw/gateway-protocol";
+  }
+  if (/^openclaw-gateway-client(?:-.+)?\.tgz$/.test(filename)) {
+    return "@openclaw/gateway-client";
+  }
+  return undefined;
+}
+
+export function prepareReleaseCheckLocalPackageTarballs(params: {
+  tmpRoot: string;
+  tarballDir?: string;
+  packLocalAi?: (packDestination: string) => NpmPackResult[];
+}): string[] {
+  if (params.tarballDir) {
+    return resolveReleaseCheckLocalPackageTarballs(params.tarballDir);
+  }
+  if (!rootPackageRequiresLocalAiTarball()) {
+    return [];
+  }
+
+  // The root tarball requires the exact sibling AI version. Never fall back to
+  // registry bytes, which could silently validate an older publication.
+  const packDir = join(params.tmpRoot, "ai-pack");
+  mkdirSync(packDir);
+  const packResults = params.packLocalAi
+    ? params.packLocalAi(packDir)
+    : runPack(packDir, resolve("packages/ai"));
+  return [resolvePackedTarballPath(packDir, packResults)];
+}
+
+export function createPackedTarballInstallArgs(prefixDir: string): string[] {
+  return ["install", "--prefix", prefixDir, "--no-audit", "--no-fund"];
+}
+
+export function writePackedTarballInstallManifest(
+  prefixDir: string,
+  tarballPath: string,
+  localPackageTarballs: string[],
+  requiresAi = rootPackageRequiresLocalAiTarball(),
+): void {
+  const localPackages = localPackageTarballs.map((localPackageTarballPath) => ({
+    packageName: localPackageNameForTarball(localPackageTarballPath),
+    tarballPath: localPackageTarballPath,
+  }));
+  const aiTarballs = localPackages.filter(({ packageName }) => packageName === "@openclaw/ai");
+  const expectedAiTarballs = requiresAi ? 1 : 0;
+  const aiTarballRequirement = requiresAi
+    ? "exactly one @openclaw/ai tarball"
+    : "no @openclaw/ai tarballs";
+  if (aiTarballs.length !== expectedAiTarballs) {
+    throw new Error(
+      `release-check: packed install requires ${aiTarballRequirement}; found ${aiTarballs.length}.`,
+    );
+  }
+  const unsupportedTarball = localPackages.find(({ packageName }) => !packageName);
+  if (unsupportedTarball) {
+    throw new Error(
+      `release-check: packed install received an unsupported package tarball: ${basename(unsupportedTarball.tarballPath)}.`,
+    );
+  }
+  const dependencies = Object.fromEntries(
+    localPackages.map(({ packageName, tarballPath: localPackageTarballPath }) => [
+      packageName as string,
+      pathToFileURL(localPackageTarballPath).href,
+    ]),
+  );
+  if (Object.keys(dependencies).length !== localPackages.length) {
+    throw new Error("release-check: packed install received duplicate local package tarballs.");
+  }
+  dependencies.openclaw = pathToFileURL(tarballPath).href;
+  mkdirSync(prefixDir, { recursive: true });
+  writeFileSync(
+    join(prefixDir, "package.json"),
+    `${JSON.stringify(
+      {
+        private: true,
+        dependencies,
+      },
+      null,
+      2,
+    )}\n`,
+  );
+}
+
+function installPackedTarball(
+  prefixDir: string,
+  tarballPath: string,
+  cwd: string,
+  localPackageTarballs: string[],
+): void {
+  writePackedTarballInstallManifest(prefixDir, tarballPath, localPackageTarballs);
+  execNpm(createPackedTarballInstallArgs(prefixDir), {
+    cwd,
+    encoding: "utf8",
+    env: { ...process.env, OPENCLAW_DISABLE_BUNDLED_ENTRY_SOURCE_FALLBACK: "1" },
+    stdio: "inherit",
+  });
+}
+
+export function resolvePackedInstalledBinaryPath(
+  prefixDir: string,
+  platform: NodeJS.Platform = process.platform,
+): string {
+  return join(
+    prefixDir,
+    "node_modules",
+    ".bin",
+    platform === "win32" ? "openclaw.cmd" : "openclaw",
+  );
+}
+
+function resolvePackedInstalledBinaryCommandInvocation(
+  prefixDir: string,
+  args: string[],
+): ReleaseCheckCommandInvocation {
+  const binaryPath = resolvePackedInstalledBinaryPath(prefixDir);
+  return process.platform === "win32"
+    ? {
+        command: resolveWindowsCmdExePath(),
+        args: ["/d", "/s", "/c", buildCmdExeCommandLine(binaryPath, args)],
+        windowsVerbatimArguments: true,
+      }
+    : { command: binaryPath, args };
+}
+
+export function createPackedCliSmokeEnv(
+  env: NodeJS.ProcessEnv,
+  overrides: NodeJS.ProcessEnv = {},
+): NodeJS.ProcessEnv {
+  const allowlistedEnvEntries = [
+    "HOME",
+    "TMPDIR",
+    "TMP",
+    "TEMP",
+    "SystemRoot",
+    "ComSpec",
+    "PATHEXT",
+    "WINDIR",
+  ] as const;
+  const windowsRoot = env.SystemRoot ?? env.WINDIR ?? "C:\\Windows";
+  const nodeBinDir = dirname(process.execPath);
+  const trustedCmdPath = join(windowsRoot, "System32", "cmd.exe");
+  const safePath =
+    process.platform === "win32"
+      ? `${nodeBinDir};${windowsRoot}\\System32;${windowsRoot}`
+      : `${nodeBinDir}:${SAFE_UNIX_SMOKE_PATH}`;
+  const homeDir = overrides.HOME ?? env.HOME ?? overrides.USERPROFILE ?? env.USERPROFILE ?? "";
+
+  return {
+    ...Object.fromEntries(
+      allowlistedEnvEntries.flatMap((key) => {
+        const value = env[key];
+        return typeof value === "string" && value.length > 0 ? [[key, value]] : [];
+      }),
+    ),
+    PATH: safePath,
+    HOME: homeDir,
+    USERPROFILE: homeDir,
+    ComSpec: trustedCmdPath,
+    APPDATA: homeDir ? join(homeDir, "AppData", "Roaming") : undefined,
+    LOCALAPPDATA: homeDir ? join(homeDir, "AppData", "Local") : undefined,
+    AWS_EC2_METADATA_DISABLED: "true",
+    AWS_SHARED_CREDENTIALS_FILE: homeDir ? join(homeDir, ".aws", "credentials") : undefined,
+    AWS_CONFIG_FILE: homeDir ? join(homeDir, ".aws", "config") : undefined,
+    OPENCLAW_DISABLE_BUNDLED_ENTRY_SOURCE_FALLBACK: "1",
+    OPENCLAW_NO_ONBOARD: "1",
+    OPENCLAW_SERVICE_REPAIR_POLICY: "external",
+    OPENCLAW_SUPPRESS_NOTES: "1",
+    ...overrides,
+  };
+}
+
+export function createPackedCompletionSmokeEnv(
+  env: NodeJS.ProcessEnv,
+  overrides: NodeJS.ProcessEnv = {},
+): NodeJS.ProcessEnv {
+  return {
+    ...env,
+    ...overrides,
+    OPENCLAW_SUPPRESS_NOTES: "1",
+    OPENCLAW_DISABLE_BUNDLED_ENTRY_SOURCE_FALLBACK: "1",
+    [COMPLETION_SKIP_PLUGIN_COMMANDS_ENV]: "1",
+  };
+}
+
+export function collectPackedInstalledPackageVerificationErrors(params: {
+  additionalCompanionManifestRoots?: string[];
+  expectedVersion: string;
+  installedBinaryVersion?: string;
+  packageRoot: string;
+}): string[] {
+  const packageJson = JSON.parse(
+    readFileSync(join(params.packageRoot, "package.json"), "utf8"),
+  ) as { version?: string };
+  const errors = collectInstalledPackageErrors({
+    additionalCompanionManifestRoots: params.additionalCompanionManifestRoots,
+    expectedVersion: params.expectedVersion,
+    installedVersion: packageJson.version?.trim() ?? "",
+    packageRoot: params.packageRoot,
+  });
+  if (
+    params.installedBinaryVersion !== undefined &&
+    normalizeInstalledBinaryVersion(params.installedBinaryVersion) !== params.expectedVersion
+  ) {
+    errors.push(
+      `installed openclaw binary version mismatch: expected ${params.expectedVersion}, found ${params.installedBinaryVersion || "<missing>"}.`,
+    );
+  }
+  return errors;
+}
+
+function verifyPackedInstalledPackage(params: {
+  expectedVersion: string;
+  packageRoot: string;
+  prefixDir: string;
+  tmpRoot: string;
+}): void {
+  const invocation = resolvePackedInstalledBinaryCommandInvocation(params.prefixDir, ["--version"]);
+  const installedBinaryVersion = runReleaseCheckCommand(
+    {
+      command: invocation.command,
+      args: invocation.args,
+      windowsVerbatimArguments: invocation.windowsVerbatimArguments,
+    },
+    {
+      cwd: params.tmpRoot,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+    },
+  ).trim();
+  const errors = collectPackedInstalledPackageVerificationErrors({
+    // The selected source checkout is immutable release input. Its companion
+    // manifests are the exact inputs packed by the following plugin preflight.
+    additionalCompanionManifestRoots: [resolve("extensions")],
+    expectedVersion: params.expectedVersion,
+    installedBinaryVersion,
+    packageRoot: params.packageRoot,
+  });
+  if (errors.length > 0) {
+    throw new Error(
+      `release-check: packed installed package verification failed:\n- ${errors.join("\n- ")}`,
+    );
+  }
+}
+
+export function createPackedPluginSdkTypescriptSmokeProject(params: {
+  consumerDir: string;
+  packageSpec: string;
+  aiPackageSpec?: string;
+}): void {
+  const dependencies: Record<string, string> = {
+    openclaw: params.packageSpec,
+    // Strict declaration checking needs the release-declared ws types; without
+    // them skipLibCheck:false reports TS7016 before the __exportAll TS2304.
+    "@types/ws": "8.18.1",
+    typescript: "6.0.3",
+  };
+  if (params.aiPackageSpec) {
+    dependencies["@openclaw/ai"] = params.aiPackageSpec;
+  }
+  mkdirSync(join(params.consumerDir, "src"), { recursive: true });
+  writeFileSync(
+    join(params.consumerDir, "package.json"),
+    `${JSON.stringify(
+      {
+        name: "openclaw-plugin-sdk-type-smoke",
+        private: true,
+        type: "module",
+        dependencies,
+      },
+      null,
+      2,
+    )}\n`,
+    "utf8",
+  );
+  writeFileSync(
+    join(params.consumerDir, "tsconfig.json"),
+    `${JSON.stringify(
+      {
+        compilerOptions: {
+          module: "NodeNext",
+          moduleResolution: "NodeNext",
+          noEmit: true,
+          strict: true,
+          skipLibCheck: false,
+          types: ["node"],
+          target: "ES2022",
+        },
+        include: ["src/index.ts"],
+      },
+      null,
+      2,
+    )}\n`,
+    "utf8",
+  );
+  copyFileSync(
+    PACKED_PLUGIN_SDK_TYPESCRIPT_SMOKE_FIXTURE,
+    join(params.consumerDir, "src", "index.ts"),
+  );
+  copyFileSync(
+    PACKED_PLUGIN_SDK_SETUP_CONSUMER_FIXTURE,
+    join(params.consumerDir, "src", "packed-plugin-sdk-setup-consumer.ts"),
+  );
+}
+
+function runPackedPluginSdkTypescriptSmoke(
+  tarballPath: string,
+  tmpRoot: string,
+  localPackageTarballs: string[],
+): void {
+  const aiTarball = localPackageTarballs.find(
+    (localPackageTarball) => localPackageNameForTarball(localPackageTarball) === "@openclaw/ai",
+  );
+  for (const target of [
+    {
+      name: "plugin-sdk-released-setup-consumer",
+      packageSpec: "2026.9.4",
+      aiPackageSpec: undefined,
+      setupConsumerOnly: true,
+    },
+    {
+      name: "plugin-sdk-type-consumer",
+      packageSpec: `file:${tarballPath}`,
+      aiPackageSpec: aiTarball ? `file:${aiTarball}` : undefined,
+      setupConsumerOnly: false,
+    },
+  ]) {
+    const consumerDir = join(tmpRoot, target.name);
+    createPackedPluginSdkTypescriptSmokeProject({ consumerDir, ...target });
+    if (target.setupConsumerOnly) {
+      copyFileSync(PACKED_PLUGIN_SDK_SETUP_CONSUMER_FIXTURE, join(consumerDir, "src", "index.ts"));
+    }
+    console.log(`release-check: compiling ${target.name} against ${target.packageSpec}`);
+    execNpm(["install", "--ignore-scripts", "--no-audit", "--no-fund"], {
+      cwd: consumerDir,
+      encoding: "utf8",
+      stdio: "inherit",
+    });
+
+    const installedOpenClawRoot = join(consumerDir, "node_modules", "openclaw");
+    if (!target.setupConsumerOnly && !packedPluginSdkSupportsSetupSurface(installedOpenClawRoot)) {
+      const installedPackageVersion = (
+        JSON.parse(readFileSync(join(installedOpenClawRoot, "package.json"), "utf8")) as {
+          version?: unknown;
+        }
+      ).version;
+      if (
+        typeof installedPackageVersion !== "string" ||
+        !packedPluginSdkMayOmitSetupSurface(installedPackageVersion)
+      ) {
+        throw new Error(
+          `release-check: packed plugin SDK ${String(installedPackageVersion)} is missing setupSurface declarations`,
+        );
+      }
+      const indexPath = join(consumerDir, "src", "index.ts");
+      writeFileSync(
+        indexPath,
+        readFileSync(indexPath, "utf8").replace(
+          'import "./packed-plugin-sdk-setup-consumer.js";\n',
+          "",
+        ),
+      );
+    }
+    const tscPath = [
+      join(consumerDir, "node_modules", "typescript", "bin", "tsc"),
+      join(installedOpenClawRoot, "node_modules", "typescript", "bin", "tsc"),
+    ].find((candidate) => existsSync(candidate));
+    if (!tscPath) {
+      throw new Error("release-check: packed plugin SDK TypeScript smoke could not find tsc.");
+    }
+    runReleaseCheckCommand(
+      { command: process.execPath, args: [tscPath, "-p", "tsconfig.json", "--pretty", "false"] },
+      {
+        cwd: consumerDir,
+        stdio: "inherit",
+      },
+    );
+    console.log(`release-check: ${target.name} compiled successfully`);
+  }
+}
+
+export function writePackedBundledPluginActivationConfig(homeDir: string): void {
+  const configPath = join(homeDir, ".openclaw", "openclaw.json");
+  mkdirSync(join(homeDir, ".openclaw"), { recursive: true });
+  writeFileSync(
+    configPath,
+    `${JSON.stringify(
+      {
+        agents: {
+          defaults: {
+            model: { primary: "openai/gpt-5.6-luna" },
+          },
+        },
+        channels: {
+          telegram: {
+            enabled: true,
+          },
+        },
+        models: {
+          providers: {
+            openai: {
+              apiKey: "sk-openclaw-release-check",
+              baseUrl: "https://api.openai.com/v1",
+              models: [],
+            },
+          },
+        },
+        plugins: {
+          enabled: true,
+          entries: {
+            telegram: {
+              enabled: true,
+            },
+          },
+        },
+      },
+      null,
+      2,
+    )}\n`,
+    "utf8",
+  );
+}
+
+function runPackedBundledPluginActivationSmoke(packageRoot: string, tmpRoot: string): void {
+  const homeDir = join(tmpRoot, "activation-home");
+  mkdirSync(homeDir, { recursive: true });
+  const env = createPackedCliSmokeEnv(process.env, {
+    HOME: homeDir,
+    OPENAI_API_KEY: "sk-openclaw-release-check",
+  });
+
+  writePackedBundledPluginActivationConfig(homeDir);
+  runReleaseCheckCommand(
+    {
+      command: process.execPath,
+      args: [join(packageRoot, "openclaw.mjs"), ...PACKED_BUNDLED_RUNTIME_DEPS_REPAIR_ARGS],
+    },
+    {
+      cwd: packageRoot,
+      stdio: "inherit",
+      env,
+    },
+  );
+  runReleaseCheckCommand(
+    { command: process.execPath, args: [join(packageRoot, "openclaw.mjs"), "plugins", "doctor"] },
+    {
+      cwd: packageRoot,
+      stdio: "inherit",
+      env,
+    },
+  );
+}
+
+function runPackedTaskRegistryControlRuntimeSmoke(packageRoot: string): void {
+  const runtimePath = join(packageRoot, "dist", "task-registry-control.runtime.js");
+  if (!existsSync(runtimePath)) {
+    throw new Error("release-check: packed task-registry control runtime is missing.");
+  }
+  const runtimeImportExpression = [
+    `(0, Function)("specifier", "return " + "im" + "port(specifier)")`,
+    `(${JSON.stringify(pathToFileURL(runtimePath).href)})`,
+  ].join("");
+  const source = `
+const runtime = await ${runtimeImportExpression};
+if (typeof runtime.getAcpSessionManager !== "function") {
+  throw new Error("missing getAcpSessionManager export");
+}
+if (typeof runtime.killSubagentRunAdmin !== "function") {
+  throw new Error("missing killSubagentRunAdmin export");
+}
+`;
+  runReleaseCheckCommand(
+    { command: process.execPath, args: ["--input-type=module", "--eval", source] },
+    {
+      cwd: packageRoot,
+      stdio: "inherit",
+      env: createPackedCliSmokeEnv(process.env),
+    },
+  );
+}
+
+function runPackedCliSmoke(params: {
+  prefixDir: string;
+  cwd: string;
+  homeDir: string;
+  stateDir: string;
+}): void {
+  const binaryPath = resolvePackedInstalledBinaryPath(params.prefixDir);
+  const env = createPackedCliSmokeEnv(process.env, {
+    HOME: params.homeDir,
+    OPENCLAW_STATE_DIR: params.stateDir,
+    OPENAI_API_KEY: "sk-openclaw-release-check",
+  });
+  const windowsRoot = env.SystemRoot ?? env.WINDIR ?? "C:\\Windows";
+  const trustedCmdPath = join(windowsRoot, "System32", "cmd.exe");
+
+  for (const args of PACKED_CLI_SMOKE_COMMANDS) {
+    if (process.platform === "win32") {
+      runReleaseCheckCommand(
+        {
+          command: trustedCmdPath,
+          args: ["/d", "/s", "/c", buildCmdExeCommandLine(binaryPath, [...args])],
+          shell: false,
+          windowsVerbatimArguments: true,
+        },
+        {
+          cwd: params.cwd,
+          stdio: "inherit",
+          env,
+        },
+      );
+      continue;
+    }
+    runReleaseCheckCommand(
+      { command: binaryPath, args: [...args], shell: false },
+      {
+        cwd: params.cwd,
+        stdio: "inherit",
+        env,
+      },
+    );
+  }
+}
+
+function runPackedBundledChannelEntrySmoke(tarballPath: string, packedRoot: string): void {
+  const tmpRoot = mkdtempSync(join(tmpdir(), "openclaw-release-pack-smoke-"));
+  try {
+    const expectedVersion = (
+      JSON.parse(readFileSync(resolve("package.json"), "utf8")) as {
+        version?: string;
+      }
+    ).version;
+    if (!expectedVersion) {
+      throw new Error("release-check: root package.json is missing version.");
+    }
+    const prefixDir = join(tmpRoot, "prefix");
+    const localPackageTarballs = prepareReleaseCheckLocalPackageTarballs({
+      tmpRoot,
+      tarballDir: process.env[RELEASE_CHECK_LOCAL_PACKAGE_TARBALL_DIR_ENV],
+    });
+    const aiTarball = localPackageTarballs.find(
+      (localPackageTarball) => localPackageNameForTarball(localPackageTarball) === "@openclaw/ai",
+    );
+    if (aiTarball) {
+      assertPreparedOpenClawAiDependency({
+        aiManifest: JSON.parse(
+          execFileSync("tar", ["-xOf", aiTarball, "package/package.json"], {
+            encoding: "utf8",
+            maxBuffer: 1024 * 1024,
+          }),
+        ),
+        rootManifest: JSON.parse(readFileSync(join(packedRoot, "package.json"), "utf8")),
+      });
+    }
+    // Separately published core packages must not conceal a missing root dependency.
+    installPackedTarball(prefixDir, tarballPath, tmpRoot, aiTarball ? [aiTarball] : []);
+
+    const packageRoot = join(prefixDir, "node_modules", "openclaw");
+    verifyPackedInstalledPackage({
+      expectedVersion,
+      packageRoot,
+      prefixDir,
+      tmpRoot,
+    });
+    const homeDir = join(tmpRoot, "home");
+    const stateDir = join(tmpRoot, "state");
+    mkdirSync(homeDir, { recursive: true });
+    runPackedCliSmoke({
+      prefixDir,
+      cwd: packageRoot,
+      homeDir,
+      stateDir,
+    });
+    runCriticalPluginSdkEntrypointImportSmoke(packageRoot);
+    runPackedBundledPluginActivationSmoke(packageRoot, tmpRoot);
+    runPackedTaskRegistryControlRuntimeSmoke(packageRoot);
+    runPackedPluginSdkTypescriptSmoke(tarballPath, tmpRoot, localPackageTarballs);
+    const bundledChannelEntrySmoke = resolvePackedBundledChannelEntrySmokeCommand();
+    runReleaseCheckCommand(
+      {
+        ...bundledChannelEntrySmoke,
+        args: [...bundledChannelEntrySmoke.args, "--package-root", packageRoot],
+      },
+      {
+        stdio: "inherit",
+        env: {
+          ...process.env,
+          OPENCLAW_DISABLE_BUNDLED_ENTRY_SOURCE_FALLBACK: "1",
+        },
+      },
+    );
+
+    runReleaseCheckCommand(
+      {
+        command: process.execPath,
+        args: [join(packageRoot, "openclaw.mjs"), ...PACKED_COMPLETION_SMOKE_ARGS],
+      },
+      {
+        cwd: packageRoot,
+        stdio: "inherit",
+        env: createPackedCompletionSmokeEnv(process.env, {
+          HOME: homeDir,
+          OPENCLAW_STATE_DIR: stateDir,
+        }),
+      },
+    );
+
+    const completionFiles = readdirSync(join(stateDir, "completions")).filter(
+      (entry) => !entry.startsWith("."),
+    );
+    if (completionFiles.length === 0) {
+      throw new Error("release-check: packed completion smoke produced no completion files.");
+    }
+
+    runInstalledWorkspaceBootstrapSmoke({ packageRoot });
+  } finally {
+    rmSync(tmpRoot, { recursive: true, force: true });
+  }
+}
+
+export function collectForbiddenPackPaths(paths: Iterable<string>): string[] {
+  return [...paths]
+    .filter(
+      (path) =>
+        isLegacyPluginDependencyInstallStagePath(path) ||
+        /(^|\/)\.openclaw-runtime-deps-[^/]+(\/|$)/u.test(path) ||
+        path.endsWith("/.openclaw-runtime-deps-stamp.json"),
+    )
+    .toSorted((left, right) => left.localeCompare(right));
+}
+
+export function collectForbiddenPackContentPaths(
+  paths: Iterable<string>,
+  rootDir = process.cwd(),
+): string[] {
+  const textPathPattern = /\.(?:[cm]?js|d\.ts|json|md|mjs|cjs)$/u;
+  return [...paths]
+    .filter((packedPath) => {
+      if (!forbiddenPrivateQaContentScanPrefixes.some((prefix) => packedPath.startsWith(prefix))) {
+        return false;
+      }
+      if (!textPathPattern.test(packedPath)) {
+        return false;
+      }
+      let content: string;
+      try {
+        content = readFileSync(resolve(rootDir, packedPath), "utf8");
+      } catch {
+        return false;
+      }
+      return (
+        forbiddenPrivateQaContentMarkers.some((marker) => content.includes(marker)) ||
+        forbiddenPrivatePluginSdkDeclarationMarkers.some((marker) => content.includes(marker))
+      );
+    })
+    .toSorted((left, right) => left.localeCompare(right));
+}
+
+function extractTag(item: string, tag: string): string | null {
+  const escapedTag = escapeRegExp(tag);
+  const regex = new RegExp(`<${escapedTag}>([^<]+)</${escapedTag}>`);
+  return regex.exec(item)?.[1]?.trim() ?? null;
+}
+
+export function collectAppcastSparkleVersionErrors(xml: string): string[] {
+  const itemMatches = [...xml.matchAll(/<item>([\s\S]*?)<\/item>/g)];
+  const errors: string[] = [];
+  const calverItems: Array<{ title: string; sparkleBuild: number; floors: SparkleBuildFloors }> =
+    [];
+
+  if (itemMatches.length === 0) {
+    errors.push("appcast.xml contains no <item> entries.");
+  }
+
+  for (const [index, match] of itemMatches.entries()) {
+    const item = expectDefined(match[1], `appcast item body at index ${index}`);
+    const title = extractTag(item, "title") ?? "unknown";
+    const shortVersion = extractTag(item, "sparkle:shortVersionString");
+    const sparkleVersion = extractTag(item, "sparkle:version");
+    const sparkleChannel = extractTag(item, "sparkle:channel");
+
+    if (!sparkleVersion) {
+      errors.push(`appcast item '${title}' is missing sparkle:version.`);
+      continue;
+    }
+    if (!/^[0-9]+$/.test(sparkleVersion)) {
+      errors.push(`appcast item '${title}' has non-numeric sparkle:version '${sparkleVersion}'.`);
+      continue;
+    }
+
+    if (!shortVersion) {
+      continue;
+    }
+    if (/(?:^|[.-])beta(?:[.-]|$)/i.test(shortVersion) && sparkleChannel !== "beta") {
+      errors.push(`appcast item '${title}' must set sparkle:channel to 'beta'.`);
+    }
+    const floors = sparkleBuildFloorsFromShortVersion(shortVersion);
+    if (floors === null) {
+      errors.push(
+        `appcast item '${title}' has invalid sparkle:shortVersionString '${shortVersion}'.`,
+      );
+      continue;
+    }
+
+    calverItems.push({ title, sparkleBuild: Number(sparkleVersion), floors });
+  }
+
+  const observedLaneAdoptionReleaseKey = calverItems
+    .filter((item) => item.sparkleBuild >= laneBuildMin)
+    .map((item) => item.floors.releaseKey)
+    .toSorted((a, b) => a - b)[0];
+  const effectiveLaneAdoptionReleaseKey =
+    typeof observedLaneAdoptionReleaseKey === "number"
+      ? Math.min(observedLaneAdoptionReleaseKey, laneFloorAdoptionReleaseKey)
+      : laneFloorAdoptionReleaseKey;
+
+  for (const item of calverItems) {
+    const expectLaneFloor =
+      item.sparkleBuild >= laneBuildMin ||
+      item.floors.releaseKey >= effectiveLaneAdoptionReleaseKey;
+    const floor = expectLaneFloor ? item.floors.laneFloor : item.floors.legacyFloor;
+    if (item.sparkleBuild < floor) {
+      const floorLabel = expectLaneFloor ? "lane floor" : "legacy floor";
+      errors.push(
+        `appcast item '${item.title}' has sparkle:version ${item.sparkleBuild} below ${floorLabel} ${floor}.`,
+      );
+    }
+  }
+
+  return errors;
+}
+
+function checkAppcastSparkleVersions() {
+  const xml = readFileSync(appcastPath, "utf8");
+  const errors = collectAppcastSparkleVersionErrors(xml);
+  if (errors.length > 0) {
+    console.error("release-check: appcast sparkle version validation failed:");
+    for (const error of errors) {
+      console.error(`  - ${error}`);
+    }
+    process.exit(1);
+  }
+}
+
+// Critical functions that channel extension plugins import from openclaw/plugin-sdk.
+// If any are missing from the compiled output, plugins crash at runtime (#27569).
+const requiredPluginSdkExports = [
+  "isDangerousNameMatchingEnabled",
+  "createAccountListHelpers",
+  "buildAgentMediaPayload",
+  "createReplyPrefixOptions",
+  "createTypingCallbacks",
+  "logInboundDrop",
+  "logTypingFailure",
+  "buildPendingHistoryContextFromMap",
+  "clearHistoryEntriesIfEnabled",
+  "recordPendingHistoryEntryIfEnabled",
+  "resolveControlCommandGate",
+  "resolveDmGroupAccessWithLists",
+  "resolveAllowlistProviderRuntimeGroupPolicy",
+  "resolveDefaultGroupPolicy",
+  "resolveChannelMediaMaxBytes",
+  "warnMissingProviderGroupPolicyFallbackOnce",
+  "emptyPluginConfigSchema",
+  "onDiagnosticEvent",
+  "normalizePluginHttpPath",
+  "registerPluginHttpRoute",
+  "DEFAULT_ACCOUNT_ID",
+  "DEFAULT_GROUP_HISTORY_LIMIT",
+];
+
+function collectDistPluginSdkExports(rootDir: string): Set<string> {
+  const pluginSdkDir = join(rootDir, "dist", "plugin-sdk");
+  let entries: string[];
+  try {
+    entries = readdirSync(pluginSdkDir)
+      .filter((entry) => entry.endsWith(".js"))
+      .toSorted();
+  } catch {
+    throw new Error("release-check: packed dist/plugin-sdk directory not found.");
+  }
+
+  const exportedNames = new Set<string>();
+  for (const entry of entries) {
+    const content = readFileSync(join(pluginSdkDir, entry), "utf8");
+    for (const match of content.matchAll(/export\s*\{([^}]+)\}(?:\s*from\s*["'][^"']+["'])?/g)) {
+      const names = match[1]?.split(",") ?? [];
+      for (const name of names) {
+        const parts = name.trim().split(/\s+as\s+/);
+        const exportName = (parts[parts.length - 1] || "").trim();
+        if (exportName) {
+          exportedNames.add(exportName);
+        }
+      }
+    }
+    for (const match of content.matchAll(
+      /export\s+(?:const|function|class|let|var)\s+([A-Za-z0-9_$]+)/g,
+    )) {
+      const exportName = match[1]?.trim();
+      if (exportName) {
+        exportedNames.add(exportName);
+      }
+    }
+  }
+
+  return exportedNames;
+}
+
+function checkPluginSdkExports(rootDir: string) {
+  const exportedNames = collectDistPluginSdkExports(rootDir);
+  const missingExports = requiredPluginSdkExports.filter((name) => !exportedNames.has(name));
+  if (missingExports.length > 0) {
+    throw new Error(
+      `release-check: missing critical plugin-sdk exports (#27569):\n- ${missingExports.join("\n- ")}`,
+    );
+  }
+}
+
+export function collectCriticalPluginSdkEntrypointSizeErrors(rootDir = process.cwd()): string[] {
+  const errors: string[] = [];
+  for (const specifier of CRITICAL_PLUGIN_SDK_SIZE_CHECK_SPECIFIERS) {
+    const subpath = specifier.slice("openclaw/plugin-sdk/".length);
+    const relativePath = `dist/plugin-sdk/${subpath}.js`;
+    const filePath = resolve(rootDir, relativePath);
+    if (!existsSync(filePath)) {
+      errors.push(`${relativePath} is missing.`);
+      continue;
+    }
+    const stat = lstatSync(filePath);
+    if (!stat.isFile()) {
+      errors.push(`${relativePath} is not a file.`);
+      continue;
+    }
+    if (stat.size > MAX_CRITICAL_PLUGIN_SDK_ENTRYPOINT_BYTES) {
+      errors.push(
+        `${relativePath} is ${stat.size} bytes, exceeding ${MAX_CRITICAL_PLUGIN_SDK_ENTRYPOINT_BYTES} bytes. Keep public SDK package entrypoints lazy and avoid bundling compiler/runtime internals.`,
+      );
+    }
+  }
+  return errors;
+}
+
+function runCriticalPluginSdkEntrypointImportSmoke(packageRoot: string) {
+  const script = [
+    `const specifiers = ${JSON.stringify(CRITICAL_PLUGIN_SDK_IMPORT_SMOKE_SPECIFIERS)};`,
+    `const importModule = new Function("specifier", "return imp" + "ort(specifier)");`,
+    "for (const specifier of specifiers) {",
+    "  await importModule(specifier);",
+    "}",
+  ].join("\n");
+  runReleaseCheckCommand(
+    { command: process.execPath, args: ["--input-type=module", "--eval", script] },
+    {
+      cwd: packageRoot,
+      stdio: "inherit",
+    },
+  );
+}
+
+async function main() {
+  const { values } = parseArgs({ options: { tarball: { type: "string" } } });
+  checkAppcastSparkleVersions();
+  checkSkillShellScriptsExecutable();
+  checkBundledExtensionMetadata();
+  const temporaryDir = mkdtempSync(join(tmpdir(), "openclaw-release-check-"));
+  try {
+    const tarballPath = values.tarball
+      ? resolve(values.tarball)
+      : resolvePackedTarballPath(temporaryDir, runPack(temporaryDir));
+    const results = inspectPackedTarball(tarballPath);
+    const packedDir = join(temporaryDir, "unpacked");
+    mkdirSync(packedDir);
+    await extract({ cwd: packedDir, file: tarballPath, strict: true, preservePaths: false });
+    const packedRoot = join(packedDir, "package");
+    const rootPackage = JSON.parse(readFileSync(resolve("package.json"), "utf8"));
+    const packedPackage = JSON.parse(readFileSync(join(packedRoot, "package.json"), "utf8"));
+    if (packedPackage.name !== "openclaw" || packedPackage.version !== rootPackage.version) {
+      throw new Error("release-check: prepared tarball does not match the target package version.");
+    }
+    await verifyPackedContents(results, packedRoot, tarballPath);
+    runPackedBundledChannelEntrySmoke(tarballPath, packedRoot);
+    console.log("release-check: final npm tarball contents and installed runtime look OK.");
+  } finally {
+    rmSync(temporaryDir, { recursive: true, force: true });
+  }
+}
+
+async function verifyPackedContents(
+  results: NpmPackResult[],
+  packedRoot: string,
+  tarballPath: string,
+): Promise<void> {
+  // WORKER_BUNDLE_*_PATH exports declare the target's sealed deploy artifacts.
+  // Trusted tooling may be newer than the frozen target in the working directory.
+  // The producer owns this contract; shared worker helpers can predate deploy output.
+  const workerProducerPath = resolve("src/worker/worker-deploy-entry.ts");
+  const workerBundlePath = resolve("src/shared/worker-bundle-hash.ts");
+  const workerDeployEntrypoints = existsSync(workerProducerPath)
+    ? Object.entries(
+        await importToolingTypeScript(pathToFileURL(workerBundlePath).href, import.meta.url),
+      )
+        .filter(([name]) => /^WORKER_BUNDLE_.*_PATH$/u.test(name))
+        .map(([name, value]) => {
+          if (typeof value !== "string" || !value.trim()) {
+            throw new Error(
+              `release-check: target worker artifact ${name} must be a non-empty path string.`,
+            );
+          }
+          const normalizedPath = posix.normalize(value);
+          const workerPath = posix.join("dist/worker", normalizedPath);
+          if (
+            value !== value.trim() ||
+            value !== normalizedPath ||
+            value.includes("\\") ||
+            normalizedPath.split("/").includes("..") ||
+            win32.isAbsolute(value) ||
+            !workerPath.startsWith("dist/worker/")
+          ) {
+            throw new Error(
+              `release-check: target worker artifact ${name} must be a normalized relative path within dist/worker.`,
+            );
+          }
+          return workerPath;
+        })
+    : [];
+  if (existsSync(workerProducerPath) && workerDeployEntrypoints.length === 0) {
+    throw new Error(
+      "release-check: target worker producer is missing WORKER_BUNDLE_*_PATH declarations.",
+    );
+  }
+  // New tooling may qualify a frozen target without the build-owned locator generator.
+  // Never infer legacy mode from missing output: current targets must rebuild missing metadata.
+  const locatorModulePath = resolve("scripts/lib/gateway-run-chunk-metadata.mts");
+  const locatorModule = existsSync(locatorModulePath)
+    ? await importToolingTypeScript(pathToFileURL(locatorModulePath).href, import.meta.url)
+    : undefined;
+  if (
+    locatorModule &&
+    locatorModule.GATEWAY_RUN_CHUNK_METADATA_VERSION !== GATEWAY_RUN_CHUNK_METADATA_VERSION
+  ) {
+    throw new Error("release-check: unsupported target gateway run chunk metadata version.");
+  }
+  checkCliBootstrapExternalImports({
+    rootDir: packedRoot,
+    workerDeployEntrypoints,
+    legacyGatewayChunkDiscovery: locatorModule === undefined,
+    logger: {
+      error: (message: string) => console.error(`release-check: ${message}`),
+    },
+  });
+  checkPluginSdkExports(packedRoot);
+  const criticalPluginSdkEntrypointErrors =
+    collectCriticalPluginSdkEntrypointSizeErrors(packedRoot);
+  if (criticalPluginSdkEntrypointErrors.length > 0) {
+    throw new Error(
+      `release-check: critical plugin-sdk entrypoint validation failed:\n- ${criticalPluginSdkEntrypointErrors.join("\n- ")}`,
+    );
+  }
+  // The tarball verifier owns lifecycle and target-declared dist layout. It
+  // accepts valid historical entries without duplicating current package policy.
+  runReleaseCheckCommand(
+    {
+      command: process.execPath,
+      args: [PACKAGE_TARBALL_VERIFIER_PATH, tarballPath],
+    },
+    { stdio: "inherit" },
+  );
+  const files = results.flatMap((entry) => entry.files ?? []);
+  const paths = new Set(files.map((file) => file.path));
+
+  const forbidden = collectForbiddenPackPaths(paths);
+  const forbiddenContent = collectForbiddenPackContentPaths(paths, packedRoot);
+  const sizeErrors = collectNpmPackUnpackedSizeErrors(results);
+
+  if (forbidden.length > 0 || forbiddenContent.length > 0 || sizeErrors.length > 0) {
+    if (forbidden.length > 0) {
+      console.error("release-check: forbidden files in npm pack:");
+      for (const path of forbidden) {
+        console.error(`  - ${path}`);
+      }
+    }
+    if (forbiddenContent.length > 0) {
+      console.error("release-check: forbidden private QA markers in npm pack:");
+      for (const path of forbiddenContent) {
+        console.error(`  - ${path}`);
+      }
+    }
+    if (sizeErrors.length > 0) {
+      console.error("release-check: npm pack unpacked size budget exceeded:");
+      for (const error of sizeErrors) {
+        console.error(`  - ${error}`);
+      }
+    }
+    throw new Error("release-check: final npm tarball content checks failed.");
+  }
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+  void main().catch((error: unknown) => {
+    console.error(error);
+    process.exit(1);
+  });
+}
diff --git a/scripts/release-telegram-provenance.sh b/scripts/release-telegram-provenance.sh
new file mode 100644
index 0000000000000000000000000000000000000000..53e43a66094e7e3c835d1d989e54dd490bd52eab
--- /dev/null
+++ b/scripts/release-telegram-provenance.sh
@@ -0,0 +1,288 @@
+#!/usr/bin/env bash
+# Bash 5.3+ can deadlock writing heredoc pipes on macOS before the reader starts.
+if [[ ${OSTYPE:-} == darwin* && $BASH != /bin/bash ]] && ((BASH_VERSINFO[0] > 5 || (BASH_VERSINFO[0] == 5 && BASH_VERSINFO[1] >= 3))); then
+  exec /bin/bash "$0" "$@"
+fi
+set -euo pipefail
+
+gh_with_retry() {
+  local stdout stderr_file stderr_output output status attempt
+  for attempt in 1 2 3 4 5; do
+    stderr_file="$(mktemp)"
+    set +e
+    stdout="$(gh "$@" 2>"$stderr_file")"
+    status=$?
+    set -e
+    if [[ "$status" -eq 0 ]]; then
+      if [[ -s "$stderr_file" ]]; then
+        cat "$stderr_file" >&2
+      fi
+      rm -f "$stderr_file"
+      printf '%s\n' "$stdout"
+      return 0
+    fi
+    stderr_output="$(cat "$stderr_file")"
+    rm -f "$stderr_file"
+    output="$stdout"
+    if [[ -n "$stderr_output" ]]; then
+      output+="${output:+$'\n'}${stderr_output}"
+    fi
+    if [[ "$output" =~ $GH_TRANSIENT_SERVER_OR_NETWORK_PATTERN ]]; then
+      echo "::warning::Transient GitHub response from gh $* on attempt ${attempt}; retrying." >&2
+      sleep $((attempt * 3))
+      continue
+    fi
+    printf '%s\n' "$output" >&2
+    return "$status"
+  done
+  printf '%s\n' "$output" >&2
+  return "$status"
+}
+
+candidate_root="${CANDIDATE_ROOT:?}"
+candidate_git_dir="${CANDIDATE_GIT_DIR:-}"
+remote_git_dir="${candidate_git_dir:-.}"
+candidate_sha="$TARGET_SHA"
+if [[ -n "$candidate_git_dir" ]]; then
+  [[ "$(git -C "$candidate_git_dir" rev-parse HEAD)" == "$candidate_sha" ]]
+fi
+
+normalized_context_ref="${TARGET_CONTEXT_REF:-}"
+normalized_context_ref="${normalized_context_ref#refs/heads/}"
+normalized_context_ref="${normalized_context_ref#refs/tags/}"
+context_release_branch=""
+context_release_tag=""
+frozen_release_branch_pattern=""
+if [[ "$normalized_context_ref" =~ ^release/([0-9]{4}\.[0-9]+\.[0-9]+)$ ]]; then
+  release_version="${BASH_REMATCH[1]}"
+  release_version_pattern="${release_version//./\.}"
+  candidate_version="$(jq -er '.version' "${candidate_root}/package.json")"
+  if [[ "$candidate_version" == "$release_version" ]]; then
+    context_release_branch="$normalized_context_ref"
+  elif [[ "$candidate_version" =~ ^${release_version_pattern}-beta\.[0-9]+$ ]]; then
+    context_release_branch="$normalized_context_ref"
+    candidate_version_pattern="${candidate_version//./\.}"
+    frozen_release_branch_pattern="^release/${candidate_version_pattern}-code-frozen(-r[1-9][0-9]*)?$"
+  else
+    echo "Telegram candidate version ${candidate_version} does not belong to release ${release_version}." >&2
+    exit 1
+  fi
+elif [[ "$normalized_context_ref" =~ ^extended-stable/([0-9]{4}\.([1-9]|1[0-2])\.33)$ ]]; then
+  context_version="${BASH_REMATCH[1]}"
+  context_line="${context_version%.33}"
+  candidate_version="$(jq -er '.version' "${candidate_root}/package.json")"
+  if [[ ! "$candidate_version" =~ ^([0-9]{4}\.([1-9]|1[0-2]))\.([1-9][0-9]*)$ ]] ||
+     [[ "${BASH_REMATCH[1]}" != "$context_line" ]] ||
+     (( 10#${BASH_REMATCH[3]} < 33 )); then
+    echo "Telegram candidate version ${candidate_version} does not belong to context ${normalized_context_ref}; expected a final ${context_line}.PATCH version with PATCH >= 33." >&2
+    exit 1
+  fi
+  context_release_branch="$normalized_context_ref"
+elif [[ "$normalized_context_ref" =~ ^v([0-9]{4}\.[0-9]+\.[0-9]+(-(alpha|beta)\.[0-9]+)?)$ ]]; then
+  context_version="${BASH_REMATCH[1]}"
+  candidate_version="$(jq -er '.version' "${candidate_root}/package.json")"
+  if [[ "$candidate_version" != "$context_version" ]]; then
+    echo "Telegram candidate version ${candidate_version} does not match context ${normalized_context_ref}." >&2
+    exit 1
+  fi
+  context_release_tag="$normalized_context_ref"
+fi
+
+repository_owner="${GITHUB_REPOSITORY%%/*}"
+repository_name="${GITHUB_REPOSITORY#*/}"
+candidate_metadata_json="$(
+  # GraphQL expands these variables server-side, not in the shell.
+  # shellcheck disable=SC2016
+  gh_with_retry api graphql \
+    -f query='query($owner:String!,$name:String!,$oid:GitObjectID!){repository(owner:$owner,name:$name){object(oid:$oid){... on Commit{oid messageHeadline signature{isValid state signer{login}} associatedPullRequests(first:100){nodes{state headRefOid headRepository{nameWithOwner} baseRefName baseRepository{nameWithOwner} mergeCommit{oid} mergedBy{login}}}}}}}' \
+    -f owner="$repository_owner" \
+    -f name="$repository_name" \
+    -f oid="$candidate_sha"
+)"
+pr_head_count="$(
+  jq -er \
+    --arg repo "$GITHUB_REPOSITORY" \
+    --arg sha "$candidate_sha" \
+    '[.data.repository.object.associatedPullRequests.nodes[] |
+      select(.state == "OPEN" and .headRepository.nameWithOwner == $repo and
+        .headRefOid == $sha)] | length' \
+    <<<"$candidate_metadata_json"
+)"
+if [[ "$pr_head_count" != "0" ]]; then
+  echo "Telegram candidate ${candidate_sha} is an open same-repository PR head." >&2
+  exit 1
+fi
+
+compare_status="$(
+  gh_with_retry api \
+    "repos/${GITHUB_REPOSITORY}/compare/${candidate_sha}...main" \
+    --jq '.status'
+)"
+trusted_reason=""
+trusted_release_branch=""
+if [[ -n "$context_release_branch" ]]; then
+  branch_sha="$(
+    git -C "$remote_git_dir" ls-remote --exit-code --refs origin \
+      "refs/heads/${context_release_branch}" |
+      awk 'NR == 1 { print $1 } END { if (NR != 1) exit 1 }' ||
+      true
+  )"
+  if [[ "$branch_sha" == "$candidate_sha" ]]; then
+    trusted_reason="release-branch-head"
+    trusted_release_branch="$context_release_branch"
+  fi
+elif [[ -n "$context_release_tag" ]]; then
+  tag_refs="$(
+    git -C "$remote_git_dir" ls-remote --exit-code origin \
+      "refs/tags/${context_release_tag}" "refs/tags/${context_release_tag}^{}"
+  )"
+  awk -v sha="$candidate_sha" '$1 == sha { found = 1 } END { exit(found ? 0 : 1) }' \
+    <<<"$tag_refs"
+  trusted_reason="release-tag"
+elif [[ "$compare_status" == "ahead" || "$compare_status" == "identical" ]]; then
+  trusted_reason="main-ancestor"
+else
+  normalized_ref="${TARGET_REF#refs/heads/}"
+  if [[ "$normalized_ref" =~ ^(release/[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*|extended-stable/[0-9]{4}\.[1-9][0-9]*\.33)$ ]]; then
+    branch_sha="$(
+      git -C "$remote_git_dir" ls-remote --exit-code --refs origin \
+        "refs/heads/${normalized_ref}" |
+        awk 'NR == 1 { print $1 } END { if (NR != 1) exit 1 }'
+    )"
+    [[ "$branch_sha" == "$candidate_sha" ]]
+    trusted_reason="release-branch-head"
+    trusted_release_branch="$normalized_ref"
+  elif [[ "$TARGET_REF" =~ ^refs/tags/v ]] || [[ "$TARGET_REF" =~ ^v ]]; then
+    normalized_tag="${TARGET_REF#refs/tags/}"
+    tag_refs="$(
+      git -C "$remote_git_dir" ls-remote --exit-code origin \
+        "refs/tags/${normalized_tag}" "refs/tags/${normalized_tag}^{}"
+    )"
+    awk -v sha="$candidate_sha" '$1 == sha { found = 1 } END { exit(found ? 0 : 1) }' \
+      <<<"$tag_refs"
+    trusted_reason="release-tag"
+  elif [[ "$TARGET_REF" =~ ^[a-f0-9]{40}$ && "$TARGET_REF" == "$candidate_sha" ]]; then
+    matching_release_branches="$(
+      gh_with_retry api --paginate \
+        "repos/${GITHUB_REPOSITORY}/commits/${candidate_sha}/branches-where-head" \
+        --jq '.[].name' |
+        awk '$0 ~ /^release\/[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*$/ ||
+             $0 ~ /^extended-stable\/[0-9]{4}\.[1-9][0-9]*\.33$/ { print }'
+    )"
+    if [[ "$(wc -l <<<"$matching_release_branches" | tr -d ' ')" == "1" &&
+          -n "$matching_release_branches" ]]; then
+      trusted_reason="release-branch-head"
+      trusted_release_branch="$matching_release_branches"
+    else
+      matching_release_tags="$(
+        git -C "$remote_git_dir" ls-remote origin 'refs/tags/v*' |
+          awk -v sha="$candidate_sha" '$1 == sha { sub(/\^\{\}$/, "", $2); print $2 }' |
+          sort -u
+      )"
+      if [[ -n "$matching_release_tags" ]]; then
+        trusted_reason="release-tag"
+      fi
+    fi
+  fi
+fi
+
+if [[ -z "$trusted_reason" && -n "$frozen_release_branch_pattern" &&
+      "$TARGET_REF" =~ ^[a-f0-9]{40}$ && "$TARGET_REF" == "$candidate_sha" ]]; then
+  matching_frozen_release_branches="$(
+    gh_with_retry api --paginate \
+      "repos/${GITHUB_REPOSITORY}/commits/${candidate_sha}/branches-where-head" \
+      --jq '.[].name' |
+      awk -v frozen="$frozen_release_branch_pattern" '$0 ~ frozen { print }'
+  )"
+  if [[ "$(wc -l <<<"$matching_frozen_release_branches" | tr -d ' ')" == "1" &&
+        -n "$matching_frozen_release_branches" ]]; then
+    trusted_reason="frozen-release-branch-head"
+    trusted_release_branch="$matching_frozen_release_branches"
+  fi
+fi
+
+if [[ -z "$trusted_reason" ]]; then
+  echo "Telegram candidate ${candidate_sha} is not trusted release provenance." >&2
+  exit 1
+fi
+
+if [[ "$trusted_reason" != "main-ancestor" ]]; then
+  signature_status="$(
+    jq -er \
+      --arg sha "$candidate_sha" \
+      '.data.repository.object |
+       select(.oid == $sha) |
+       if .signature == null then "missing"
+       elif .signature.isValid == true and .signature.state == "VALID" and
+         (.signature.signer.login // "") != "" then "valid"
+       else "invalid"
+       end' \
+      <<<"$candidate_metadata_json"
+  )"
+  if [[ "$signature_status" == "invalid" ]]; then
+    echo "Release candidate ${candidate_sha} has an invalid commit signature." >&2
+    exit 1
+  fi
+  signer="$(jq -r '.data.repository.object.signature.signer.login // ""' <<<"$candidate_metadata_json")"
+  if [[ "$trusted_reason" == "frozen-release-branch-head" &&
+        ( "$signature_status" != "valid" || "$signer" == "web-flow" ) ]]; then
+    echo "Frozen release candidate ${candidate_sha} requires a valid maintainer signature." >&2
+    exit 1
+  fi
+  permission_actor="$signer"
+  if [[ "$signature_status" == "missing" || "$signer" == "web-flow" ]]; then
+    if [[ "$trusted_reason" != "release-branch-head" || -z "$trusted_release_branch" ]]; then
+      echo "Unsigned or GitHub web-flow candidates require an exact release branch head." >&2
+      exit 1
+    fi
+    merge_pr_candidates="$(jq -c '.data.repository.object.associatedPullRequests.nodes' <<<"$candidate_metadata_json")"
+    if [[ "$(jq 'length' <<<"$merge_pr_candidates")" == "0" ]]; then
+      # GitHub can omit a squash merge from its commit-to-PR association index.
+      # The subject supplies only a lookup hint: the direct PR record must still
+      # satisfy the exact merge/repository checks below and live actor permission.
+      candidate_subject="$(jq -r '.data.repository.object.messageHeadline // ""' <<<"$candidate_metadata_json")"
+      merge_pr_hint_pattern='\(#([1-9][0-9]*)\)$'
+      if [[ "$candidate_subject" =~ $merge_pr_hint_pattern ]]; then
+        merge_pr_number="${BASH_REMATCH[1]}"
+        direct_pr_json="$(
+          # shellcheck disable=SC2016
+          gh_with_retry api graphql \
+            -f query='query($owner:String!,$name:String!,$number:Int!){repository(owner:$owner,name:$name){pullRequest(number:$number){state baseRepository{nameWithOwner} mergeCommit{oid} mergedBy{login}}}}' \
+            -f owner="$repository_owner" \
+            -f name="$repository_name" \
+            -F number="$merge_pr_number"
+        )"
+        merge_pr_candidates="$(jq -c '[.data.repository.pullRequest | select(. != null)]' <<<"$direct_pr_json")"
+      fi
+    fi
+    matching_merge_prs="$(
+      jq -c \
+        --arg repo "$GITHUB_REPOSITORY" \
+        --arg sha "$candidate_sha" \
+        '[.[] |
+          select(.state == "MERGED" and .baseRepository.nameWithOwner == $repo and
+            .mergeCommit.oid == $sha)]' \
+        <<<"$merge_pr_candidates"
+    )"
+    if [[ "$(jq 'length' <<<"$matching_merge_prs")" != "1" ]]; then
+      echo "Unsigned or GitHub web-flow candidate ${candidate_sha} requires one exact merged same-repository PR." >&2
+      exit 1
+    fi
+    permission_actor="$(
+      jq -er '.[0].mergedBy.login | select(type == "string" and length > 0)' \
+        <<<"$matching_merge_prs"
+    )"
+  fi
+  permission_json="$(
+    gh_with_retry api \
+      "repos/${GITHUB_REPOSITORY}/collaborators/${permission_actor}/permission"
+  )"
+  permission="$(jq -r '.permission // ""' <<<"$permission_json")"
+  role_name="$(jq -r '.role_name // ""' <<<"$permission_json")"
+  if [[ "$permission" != "admin" && "$role_name" != "maintain" ]]; then
+    echo "Release candidate actor ${permission_actor} lacks maintain/admin access." >&2
+    exit 1
+  fi
+fi
+
+echo "Telegram candidate trust reason: ${trusted_reason}"
diff --git a/scripts/release-validation-intent.mjs b/scripts/release-validation-intent.mjs
new file mode 100644
index 0000000000000000000000000000000000000000..fc99b657734e551b73149c3e38c048e60f3a7a88
--- /dev/null
+++ b/scripts/release-validation-intent.mjs
@@ -0,0 +1,56 @@
+const RELEASE_VALIDATION_INTENTS = Object.freeze({
+  "release-beta": Object.freeze({ profile: "beta", publishable: true, soak: false }),
+  "release-stable": Object.freeze({ profile: "stable", publishable: true, soak: true }),
+  "main-daily": Object.freeze({ profile: "beta", publishable: false, soak: false }),
+  "main-weekly": Object.freeze({ profile: "full", publishable: false, soak: true }),
+  "diagnostic-full": Object.freeze({ profile: "full", publishable: false, soak: true }),
+});
+
+const PURPOSE_INTENTS = Object.freeze({
+  "beta-publish": Object.freeze(["release-beta"]),
+  "stable-publish": Object.freeze(["release-stable"]),
+  diagnostic: Object.freeze(["diagnostic-full"]),
+  "postpublish-confidence": Object.freeze(["diagnostic-full"]),
+  "main-qualification": Object.freeze(["main-daily", "main-weekly"]),
+});
+
+function displayValue(value) {
+  return typeof value === "string" ? value : JSON.stringify(value);
+}
+
+export function resolveReleaseValidationIntent(intent, assertions = {}) {
+  if (typeof intent !== "string" || !Object.hasOwn(RELEASE_VALIDATION_INTENTS, intent)) {
+    throw new Error(`unsupported release validation intent: ${displayValue(intent)}`);
+  }
+  const policy = RELEASE_VALIDATION_INTENTS[intent];
+  if (assertions.profile !== undefined && assertions.profile !== policy.profile) {
+    throw new Error(
+      `release validation intent ${intent} profile assertion conflicts: expected ${policy.profile}, got ${displayValue(assertions.profile)}`,
+    );
+  }
+  if (assertions.soak !== undefined && assertions.soak !== policy.soak) {
+    throw new Error(
+      `release validation intent ${intent} soak assertion conflicts: expected ${policy.soak}, got ${displayValue(assertions.soak)}`,
+    );
+  }
+  return { intent, ...policy };
+}
+
+export function releaseValidationIntentForPurpose(purpose, requestedIntent) {
+  if (typeof purpose !== "string" || !Object.hasOwn(PURPOSE_INTENTS, purpose)) {
+    throw new Error(`unsupported release plan purpose: ${displayValue(purpose)}`);
+  }
+  const allowedIntents = PURPOSE_INTENTS[purpose];
+  if (requestedIntent === undefined) {
+    if (allowedIntents.length !== 1) {
+      throw new Error(`release plan purpose ${purpose} requires an explicit validation intent`);
+    }
+    return allowedIntents[0];
+  }
+  if (typeof requestedIntent !== "string" || !allowedIntents.includes(requestedIntent)) {
+    throw new Error(
+      `release plan purpose ${purpose} does not allow validation intent: ${displayValue(requestedIntent)}`,
+    );
+  }
+  return requestedIntent;
+}
diff --git a/scripts/repo-e2e-artifacts.mts b/scripts/repo-e2e-artifacts.mts
new file mode 100644
index 0000000000000000000000000000000000000000..247bd59266cc1b17f665e19f7e0fbc4b8d5f012d
--- /dev/null
+++ b/scripts/repo-e2e-artifacts.mts
@@ -0,0 +1,96 @@
+#!/usr/bin/env node
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { isDeepStrictEqual } from "node:util";
+import { isDirectRunUrl } from "./lib/direct-run.mjs";
+import { refreshLocalBuildStampTimes } from "./lib/local-build-metadata.mts";
+import { listGeneratedExtensionAssetSources } from "./lib/static-extension-assets.mts";
+
+const archiveName = "repo-e2e-build.tar.gz";
+
+/** Carry one completed build between exact-target E2E jobs, without dependency or build caches. */
+export function transferRepoE2eArtifacts(
+  operation: string,
+  artifactDir: string,
+  profile: string,
+  repoRoot = process.cwd(),
+) {
+  if (operation !== "pack" && operation !== "restore") {
+    throw new Error("Expected pack or restore");
+  }
+  if (profile !== "full" && profile !== "ciArtifacts") {
+    throw new Error("Expected full or ciArtifacts build profile");
+  }
+  const root = path.resolve(repoRoot);
+  const artifactRoot = path.resolve(artifactDir);
+  const identity = {
+    version: 1,
+    targetSha: execFileSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8" }).trim(),
+    profile,
+    node: process.versions.node,
+    platform: process.platform,
+    arch: process.arch,
+    privateQa: process.env.OPENCLAW_BUILD_PRIVATE_QA === "1",
+  };
+  if (!identity.privateQa) {
+    throw new Error("Repo E2E artifacts require a private-QA build");
+  }
+  const archive = path.join(artifactRoot, archiveName);
+  const manifest = path.join(artifactRoot, "repo-e2e-build.json");
+  if (operation === "pack") {
+    const outputs = [
+      "dist",
+      ...(fs.existsSync(path.join(root, "dist-runtime")) ? ["dist-runtime"] : []),
+      ...fs.readdirSync(path.join(root, "packages")).flatMap((name) => {
+        const output = `packages/${name}/dist`;
+        return fs.existsSync(path.join(root, output)) ? [output] : [];
+      }),
+      ...listGeneratedExtensionAssetSources({ rootDir: root }),
+    ];
+    fs.mkdirSync(artifactRoot, { recursive: true });
+    // Tar preserves hidden stamps, executable bits, and relative runtime-overlay links.
+    execFileSync("tar", ["-czf", archive, "--null", "-T", "-"], {
+      cwd: root,
+      input: outputs.join("\0") + "\0",
+    });
+    fs.writeFileSync(manifest, JSON.stringify({ identity, sha256: digest(archive) }) + "\n");
+    return;
+  }
+  const recorded = JSON.parse(fs.readFileSync(manifest, "utf8"));
+  if (!isDeepStrictEqual(recorded.identity, identity)) {
+    throw new Error("Repo E2E artifact identity differs from this target, profile, or runtime");
+  }
+  if (recorded.sha256 !== digest(archive)) {
+    throw new Error("Repo E2E artifact archive digest mismatch");
+  }
+  execFileSync("tar", ["-xzf", archive], { cwd: root });
+  // Checkout config mtimes are newer than the producer's stamps. Refresh only
+  // local freshness metadata after exact identity verification, before readers start.
+  refreshLocalBuildStampTimes({ cwd: root });
+}
+
+function digest(file: string) {
+  const hash = createHash("sha256");
+  const descriptor = fs.openSync(file, "r");
+  const buffer = Buffer.alloc(1024 * 1024);
+  try {
+    for (let length; (length = fs.readSync(descriptor, buffer)) > 0;) {
+      hash.update(buffer.subarray(0, length));
+    }
+    return hash.digest("hex");
+  } finally {
+    fs.closeSync(descriptor);
+  }
+}
+
+if (isDirectRunUrl(process.argv[1], import.meta.url)) {
+  const [operation, artifactDir, profile] = process.argv.slice(2);
+  if (!operation || !artifactDir || !profile || process.argv.length !== 5) {
+    throw new Error(
+      "Usage: repo-e2e-artifacts.mts <pack|restore> <artifact-dir> <full|ciArtifacts>",
+    );
+  }
+  transferRepoE2eArtifacts(operation, artifactDir, profile);
+}
diff --git a/scripts/report-test-temp-creations.mts b/scripts/report-test-temp-creations.mts
new file mode 100644
index 0000000000000000000000000000000000000000..ecde682bc11a13562cc22f6b24384e50b6d4d3b6
--- /dev/null
+++ b/scripts/report-test-temp-creations.mts
@@ -0,0 +1,556 @@
+#!/usr/bin/env node
+
+import { execFileSync, spawnSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import ts from "typescript";
+import { isChangedLaneTestPath } from "./changed-lanes.mts";
+import {
+  booleanFlag,
+  isOpenEndedTruthyValue,
+  parseFlagArgs,
+  stringFlag,
+} from "./lib/arg-utils.mts";
+import { runAsScript } from "./lib/ts-guard-utils.mts";
+
+type AddedLine = {
+  line: number;
+  source: string;
+};
+
+type TempCreationFinding = {
+  file: string;
+  line: number;
+  reason: string;
+  source: string;
+};
+
+type ManualHelperImport = {
+  line: number;
+  source: string;
+};
+
+type AllowNextLine = {
+  file: string;
+  line: number;
+};
+
+type ScriptIo = {
+  env?: NodeJS.ProcessEnv;
+  stderr?: { write: (text: string) => unknown };
+  stdout?: { write: (text: string) => unknown };
+};
+
+const DEFAULT_BASE_REF = "origin/main";
+const DEFAULT_HEAD_REF = "HEAD";
+const TEMP_DIR_HELPER_PATH = "test/helpers/temp-dir.ts";
+const TEMP_DIR_HELPER_TEST_PATH = "test/helpers/temp-dir.test.ts";
+const MANUAL_TEMP_DIR_HELPERS = new Set(["cleanupTempDirs", "createTempDirTracker", "makeTempDir"]);
+const FINDING_PATTERNS = [
+  {
+    pattern: /\bmkdtemp(?:Sync)?\s*\(/u,
+    reason: "new mkdtemp temp directory creation",
+  },
+  {
+    pattern: /\btmp\s*\.\s*dir(?:Sync)?\s*\(/u,
+    reason: "new tmp.dir temp directory creation",
+  },
+];
+const TEMP_DIR_ALLOW_COMMENT_RE =
+  /(?:^|\s)(?:\/\/|\/\*|\*|#)\s*openclaw-temp-dir:\s*allow\s+(.+)$/u;
+
+function usage(): string {
+  return `Usage: node scripts/report-test-temp-creations.mjs [options]
+
+Description:
+  Reports new test temp-directory migration warnings in added diff lines.
+  This is a low-noise migration aid, not a cleanup data-flow checker. It does
+  not scan existing lines for bare temp dirs and does not decide whether cleanup is sufficient.
+  Add "openclaw-temp-dir: allow <reason>" in a same-line or immediately
+  preceding added comment when a test intentionally needs bare temp creation.
+  File scope intentionally reuses scripts/changed-lanes.mjs test-path
+  classification instead of maintaining a separate test-helper heuristic.
+
+Options:
+  --base <ref>       Base ref for branch diffs. Default: ${DEFAULT_BASE_REF}
+  --head <ref>       Head ref for branch diffs. Default: ${DEFAULT_HEAD_REF}
+  --no-merge-base    Use a two-dot base..head diff for shallow CI checkouts.
+  --staged           Inspect staged changes instead of a branch diff.
+  --json             Print JSON findings to stdout.
+  --fail-on-findings Exit 1 when findings are present. Default is report-only.
+  -h, --help         Show this help.
+
+Outputs:
+  Human mode prints findings to stderr and exits 0 unless --fail-on-findings is set.
+  GitHub Actions mode prints warning annotations and exits 0 unless --fail-on-findings is set.
+  JSON mode prints an array of { file, line, reason, source } to stdout.
+
+Examples:
+  node scripts/report-test-temp-creations.mjs --base origin/main --head HEAD
+  node scripts/report-test-temp-creations.mjs --staged --json
+`;
+}
+
+function normalizePath(filePath: string): string {
+  return filePath.replaceAll("\\", "/").replace(/^\.\/+/u, "");
+}
+
+function shouldInspectFile(filePath: string): boolean {
+  const normalizedPath = normalizePath(filePath);
+  return normalizedPath !== TEMP_DIR_HELPER_PATH && isChangedLaneTestPath(normalizedPath);
+}
+
+function shouldInspectManualHelperUsage(filePath: string): boolean {
+  const normalizedPath = normalizePath(filePath);
+  return normalizedPath !== TEMP_DIR_HELPER_TEST_PATH && shouldInspectFile(normalizedPath);
+}
+
+function escapeGithubCommandValue(value: unknown): string {
+  return String(value).replaceAll("%", "%25").replaceAll("\r", "%0D").replaceAll("\n", "%0A");
+}
+
+function escapeGithubCommandProperty(value: unknown): string {
+  return escapeGithubCommandValue(value).replaceAll(":", "%3A").replaceAll(",", "%2C");
+}
+
+function hasTempDirAllowMarker(source: string): boolean {
+  const reason = source.match(TEMP_DIR_ALLOW_COMMENT_RE)?.[1]?.trim() ?? "";
+  return reason.length > 0;
+}
+
+function isTempDirAllowComment(source: string): boolean {
+  const trimmed = source.trim();
+  return /^(?:\/\/|\/\*|\*|#)/u.test(trimmed) && hasTempDirAllowMarker(trimmed);
+}
+
+export function formatGithubWarning(finding: TempCreationFinding): string {
+  const file = escapeGithubCommandProperty(finding.file);
+  const line = escapeGithubCommandProperty(finding.line);
+  const message = escapeGithubCommandValue(
+    `${finding.reason}: prefer useAutoCleanupTempDirTracker(afterEach) from test/helpers/temp-dir.ts for new test-owned temp directories.`,
+  );
+  return `::warning file=${file},line=${line}::${message}`;
+}
+
+function parseArgs(argv: readonly string[]) {
+  const args = {
+    base: DEFAULT_BASE_REF,
+    failOnFindings: false,
+    head: DEFAULT_HEAD_REF,
+    help: false,
+    json: false,
+    noMergeBase: false,
+    staged: false,
+  };
+  return parseFlagArgs(argv, args, [
+    stringFlag("--base", "base"),
+    booleanFlag("--fail-on-findings", "failOnFindings"),
+    stringFlag("--head", "head"),
+    booleanFlag("-h", "help"),
+    booleanFlag("--help", "help"),
+    booleanFlag("--json", "json"),
+    booleanFlag("--no-merge-base", "noMergeBase"),
+    booleanFlag("--staged", "staged"),
+  ]);
+}
+
+function readDiff(args: ReturnType<typeof parseArgs>, cwd = process.cwd()): string {
+  let useMergeBase = !args.noMergeBase;
+  if (useMergeBase && !args.staged) {
+    const mergeBase = spawnSync("git", ["merge-base", args.base, args.head], {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "ignore", "pipe"],
+    });
+    if (mergeBase.error) {
+      throw mergeBase.error;
+    }
+    if (mergeBase.status === 1) {
+      // Delegated CI syncs can contain both refs without their shared history.
+      // Compare the endpoint trees so this warning-only report still runs.
+      useMergeBase = false;
+    } else if (mergeBase.status !== 0) {
+      throw new Error(mergeBase.stderr.trim() || "git merge-base failed");
+    }
+  }
+  const range = useMergeBase ? `${args.base}...${args.head}` : `${args.base}..${args.head}`;
+  const diffArgs = ["diff", ...(args.staged ? ["--cached"] : [range]), "--diff-filter=ACMR"];
+  const readGitDiff = (...options: string[]) =>
+    execFileSync("git", ["--literal-pathspecs", ...diffArgs, ...options], {
+      cwd,
+      encoding: "utf8",
+      maxBuffer: 64 * 1024 * 1024,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+  // Select paths before reading patches so unrelated generated output cannot
+  // exhaust the diff buffer. Both rename/copy endpoints preserve added-line scope.
+  const fields = readGitDiff("--name-status", "-z", "--").split("\0");
+  const paths = new Set<string>();
+  for (let index = 0; index < fields.length;) {
+    const status = fields[index++];
+    const from = fields[index++];
+    if (!status || !from) {
+      break;
+    }
+    const to = status.startsWith("R") || status.startsWith("C") ? fields[index++] : from;
+    if (to && shouldInspectFile(to)) {
+      paths.add(from);
+      paths.add(to);
+    }
+  }
+  return paths.size > 0 ? readGitDiff("--unified=0", "--", ...paths) : "";
+}
+
+function readWorktreeSource(filePath: string, cwd: string): string {
+  try {
+    return fs.readFileSync(path.join(cwd, filePath), "utf8");
+  } catch {
+    return "";
+  }
+}
+
+function readStagedSource(filePath: string, cwd: string): string {
+  try {
+    return execFileSync("git", ["show", `:${filePath}`], {
+      cwd,
+      encoding: "utf8",
+      maxBuffer: 64 * 1024 * 1024,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+  } catch {
+    return "";
+  }
+}
+
+function readSourceForDiff(
+  filePath: string,
+  args: ReturnType<typeof parseArgs>,
+  cwd: string,
+): string {
+  // Staged checks must parse the index blob. Reading the worktree mixes in
+  // unstaged edits and can warn on code that will not be committed.
+  return args.staged ? readStagedSource(filePath, cwd) : readWorktreeSource(filePath, cwd);
+}
+
+function stripKnownExtension(filePath: string): string {
+  return filePath.replace(/\.(?:c|m)?[jt]sx?$/u, "");
+}
+
+function isTempDirHelperImportSpec(filePath: string, specifier: string): boolean {
+  const normalizedSpecifier = normalizePath(specifier);
+  const resolvedPath = normalizedSpecifier.startsWith(".")
+    ? path.posix.normalize(path.posix.join(path.posix.dirname(filePath), normalizedSpecifier))
+    : normalizedSpecifier;
+  return stripKnownExtension(resolvedPath) === stripKnownExtension(TEMP_DIR_HELPER_PATH);
+}
+
+function createSourceFile(filePath: string, sourceText: string): ts.SourceFile {
+  return ts.createSourceFile(filePath, sourceText, ts.ScriptTarget.Latest, true);
+}
+
+function lineForNode(sourceFile: ts.SourceFile, node: ts.Node): number {
+  return sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1;
+}
+
+function sourceLineText(sourceFile: ts.SourceFile, line: number): string {
+  const lineStarts = sourceFile.getLineStarts();
+  const start = lineStarts[line - 1] ?? 0;
+  const end = lineStarts[line] ?? sourceFile.text.length;
+  return sourceFile.text.slice(start, end).trim();
+}
+
+function nodeOverlapsAddedLine(
+  sourceFile: ts.SourceFile,
+  node: ts.Node,
+  addedLineNumbers: Set<number>,
+): boolean {
+  const startLine = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1;
+  const endLine = sourceFile.getLineAndCharacterOfPosition(node.getEnd()).line + 1;
+  for (let line = startLine; line <= endLine; line += 1) {
+    if (addedLineNumbers.has(line)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function normalizeFileTextMap(
+  fileTextByPath: Map<string, string> | Record<string, string> | undefined,
+) {
+  if (!fileTextByPath) {
+    return null;
+  }
+  if (fileTextByPath instanceof Map) {
+    return fileTextByPath;
+  }
+  return new Map(Object.entries(fileTextByPath));
+}
+
+function readCurrentSource(
+  filePath: string,
+  options: { readFile?: (filePath: string) => string | null | undefined },
+  fileTextByPath: Map<string, string> | null,
+): string {
+  if (fileTextByPath?.has(filePath)) {
+    return fileTextByPath.get(filePath) ?? "";
+  }
+  if (options.readFile) {
+    return options.readFile(filePath) ?? "";
+  }
+  return "";
+}
+
+function collectManualTempDirHelperImports(
+  sourceFile: ts.SourceFile,
+  filePath: string,
+  addedLineNumbers: Set<number> | null = null,
+): { imports: ManualHelperImport[]; localNames: Set<string> } {
+  const imports: ManualHelperImport[] = [];
+  const localNames = new Set<string>();
+  for (const statement of sourceFile.statements) {
+    if (
+      !ts.isImportDeclaration(statement) ||
+      !statement.importClause?.namedBindings ||
+      !ts.isStringLiteral(statement.moduleSpecifier) ||
+      !isTempDirHelperImportSpec(filePath, statement.moduleSpecifier.text) ||
+      !ts.isNamedImports(statement.importClause.namedBindings)
+    ) {
+      continue;
+    }
+    let importWarningLine: number | null = null;
+    for (const element of statement.importClause.namedBindings.elements) {
+      const imported = element.propertyName?.text ?? element.name.text;
+      if (!MANUAL_TEMP_DIR_HELPERS.has(imported)) {
+        continue;
+      }
+      localNames.add(element.name.text);
+      if (
+        importWarningLine === null &&
+        (!addedLineNumbers || nodeOverlapsAddedLine(sourceFile, element, addedLineNumbers))
+      ) {
+        importWarningLine = lineForNode(sourceFile, element);
+      }
+    }
+    if (importWarningLine !== null) {
+      imports.push({
+        line: importWarningLine,
+        source: statement.getText(sourceFile).trim().replace(/\s+/gu, " "),
+      });
+    }
+  }
+  return { imports, localNames };
+}
+
+function findManualHelperUsageFindings(
+  filePath: string,
+  sourceText: string,
+  addedLines: AddedLine[],
+): TempCreationFinding[] {
+  const addedLineNumbers = new Set(addedLines.map((line) => line.line));
+  const sourceFile = createSourceFile(filePath, sourceText);
+  const { imports, localNames } = collectManualTempDirHelperImports(
+    sourceFile,
+    filePath,
+    addedLineNumbers,
+  );
+  const findings = imports.map((manualImport) => ({
+    file: filePath,
+    line: manualImport.line,
+    reason: "new manual temp-dir helper import",
+    source: manualImport.source,
+  }));
+  if (localNames.size === 0) {
+    return findings;
+  }
+  const visit = (node: ts.Node): void => {
+    if (
+      ts.isCallExpression(node) &&
+      ts.isIdentifier(node.expression) &&
+      localNames.has(node.expression.text) &&
+      nodeOverlapsAddedLine(sourceFile, node.expression, addedLineNumbers)
+    ) {
+      findings.push({
+        file: filePath,
+        line: lineForNode(sourceFile, node.expression),
+        reason: "new manual temp-dir helper usage",
+        source: sourceLineText(sourceFile, lineForNode(sourceFile, node.expression)),
+      });
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(sourceFile);
+  return findings;
+}
+
+function collectAddedLinesByFile(diffText: string): Map<string, AddedLine[]> {
+  const addedLinesByFile = new Map<string, AddedLine[]>();
+  let currentFile: string | null = null;
+  let currentLine = 0;
+
+  for (const line of diffText.split(/\r?\n/u)) {
+    const fileMatch = line.match(/^\+\+\+ b\/(.+)$/u);
+    if (fileMatch) {
+      const filePath = fileMatch[1];
+      if (!filePath) {
+        continue;
+      }
+      currentFile = normalizePath(filePath);
+      continue;
+    }
+    if (line === "+++ /dev/null") {
+      currentFile = null;
+      continue;
+    }
+
+    const hunkMatch = line.match(/^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/u);
+    if (hunkMatch) {
+      currentLine = Number.parseInt(hunkMatch[1] ?? "0", 10);
+      continue;
+    }
+
+    if (line.startsWith("+") && !line.startsWith("+++")) {
+      if (currentFile && shouldInspectFile(currentFile)) {
+        const lines = addedLinesByFile.get(currentFile) ?? [];
+        lines.push({ line: currentLine, source: line.slice(1) });
+        addedLinesByFile.set(currentFile, lines);
+      }
+      currentLine += 1;
+      continue;
+    }
+
+    if (line.startsWith(" ") || line === "") {
+      currentLine += 1;
+    }
+  }
+
+  return addedLinesByFile;
+}
+
+export function collectTempCreationFindingsFromDiff(
+  diffText: string,
+  options: {
+    fileTextByPath?: Map<string, string> | Record<string, string>;
+    readFile?: (filePath: string) => string | null | undefined;
+  } = {},
+): TempCreationFinding[] {
+  const diff = diffText;
+  const findings: TempCreationFinding[] = [];
+  const addedLinesByFile = collectAddedLinesByFile(diff);
+  const fileTextByPath = normalizeFileTextMap(options.fileTextByPath);
+  let currentFile: string | null = null;
+  let currentLine = 0;
+  let allowNextLine: AllowNextLine | null = null;
+
+  for (const line of diff.split(/\r?\n/u)) {
+    const fileMatch = line.match(/^\+\+\+ b\/(.+)$/u);
+    if (fileMatch) {
+      const filePath = fileMatch[1];
+      if (!filePath) {
+        continue;
+      }
+      currentFile = normalizePath(filePath);
+      allowNextLine = null;
+      continue;
+    }
+    if (line === "+++ /dev/null") {
+      currentFile = null;
+      allowNextLine = null;
+      continue;
+    }
+
+    const hunkMatch = line.match(/^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/u);
+    if (hunkMatch) {
+      currentLine = Number.parseInt(hunkMatch[1] ?? "0", 10);
+      allowNextLine = null;
+      continue;
+    }
+
+    if (line.startsWith("+") && !line.startsWith("+++")) {
+      if (currentFile && shouldInspectFile(currentFile)) {
+        const source = line.slice(1);
+        const allowed =
+          hasTempDirAllowMarker(source) ||
+          (allowNextLine?.file === currentFile && allowNextLine.line === currentLine);
+        for (const { pattern, reason } of FINDING_PATTERNS) {
+          if (pattern.test(source)) {
+            if (!allowed) {
+              findings.push({
+                file: currentFile,
+                line: currentLine,
+                reason,
+                source: source.trim(),
+              });
+            }
+            break;
+          }
+        }
+        allowNextLine = isTempDirAllowComment(source)
+          ? { file: currentFile, line: currentLine + 1 }
+          : null;
+      }
+      currentLine += 1;
+      continue;
+    }
+
+    if (line.startsWith(" ") || line === "") {
+      allowNextLine = null;
+      currentLine += 1;
+    }
+  }
+
+  for (const [file, addedLines] of addedLinesByFile) {
+    if (!shouldInspectManualHelperUsage(file)) {
+      continue;
+    }
+    const sourceText = readCurrentSource(file, options, fileTextByPath);
+    if (!sourceText) {
+      continue;
+    }
+    findings.push(...findManualHelperUsageFindings(file, sourceText, addedLines));
+  }
+
+  return findings;
+}
+
+async function main(argv?: string[], io?: ScriptIo): Promise<0 | 1> {
+  const args = parseArgs(argv ?? process.argv.slice(2));
+  const stdout = io?.stdout ?? process.stdout;
+  const stderr = io?.stderr ?? process.stderr;
+  const env = io?.env ?? process.env;
+  if (args.help) {
+    stdout.write(usage());
+    return 0;
+  }
+
+  const cwd = process.cwd();
+  const findings = collectTempCreationFindingsFromDiff(readDiff(args, cwd), {
+    readFile(filePath: string) {
+      return readSourceForDiff(filePath, args, cwd);
+    },
+  });
+  if (args.json) {
+    stdout.write(`${JSON.stringify(findings, null, 2)}\n`);
+  } else if (findings.length === 0) {
+    stderr.write("No new test temp-directory migration warnings found.\n");
+  } else if (isOpenEndedTruthyValue(env.GITHUB_ACTIONS)) {
+    for (const finding of findings) {
+      stderr.write(`${formatGithubWarning(finding)}\n`);
+    }
+  } else {
+    stderr.write("New test temp-directory migration warnings:\n");
+    for (const finding of findings) {
+      stderr.write(`- ${finding.file}:${finding.line} ${finding.reason}: ${finding.source}\n`);
+    }
+    stderr.write(
+      "Prefer useAutoCleanupTempDirTracker(afterEach) from test/helpers/temp-dir.ts for new test-owned temp directories.\n",
+    );
+  }
+
+  return args.failOnFindings && findings.length > 0 ? 1 : 0;
+}
+
+runAsScript(import.meta.url, async () => {
+  const exitCode = await main();
+  process.exitCode = exitCode;
+  return exitCode;
+});
diff --git a/scripts/run-opengrep.sh b/scripts/run-opengrep.sh
new file mode 100644
index 0000000000000000000000000000000000000000..96ce2f500ce37bd62b530624d66d77202f48095d
--- /dev/null
+++ b/scripts/run-opengrep.sh
@@ -0,0 +1,238 @@
+#!/usr/bin/env bash
+# Bash 5.3+ can deadlock writing heredoc pipes on macOS before the reader starts.
+if [[ ${OSTYPE:-} == darwin* && $BASH != /bin/bash ]] && ((BASH_VERSINFO[0] > 5 || (BASH_VERSINFO[0] == 5 && BASH_VERSINFO[1] >= 3))); then
+  exec /bin/bash "$0" "$@"
+fi
+# scripts/run-opengrep.sh
+#
+# Run the OpenClaw precise OpenGrep rulepack against the local working tree
+# using the same paths and exclusions as CI. The .semgrepignore at the repo root
+# is the single source of truth for skipped paths.
+#
+# Usage:
+#   scripts/run-opengrep.sh                    # precise, human output
+#   scripts/run-opengrep.sh precise            # same
+#   scripts/run-opengrep.sh --sarif            # write SARIF for upload/triage
+#   scripts/run-opengrep.sh --json             # write JSON for ad-hoc parsing
+#   scripts/run-opengrep.sh --changed          # scan changed first-party paths
+#   scripts/run-opengrep.sh --error            # fail non-zero on findings
+#
+# Optional positional path overrides come last:
+#   scripts/run-opengrep.sh -- src/agents/     # scan a single dir
+#
+# Exit code: non-zero on scan errors, and on findings when --error is passed.
+
+set -euo pipefail
+
+BUCKET="precise"
+if [[ "${1:-}" == "precise" ]]; then
+  shift
+elif [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
+  sed -n '2,22p' "$0"
+  exit 0
+elif [[ "${1:-}" == "broad" ]]; then
+  echo "error: broad OpenGrep rulepacks are not supported in this repo workflow" >&2
+  exit 64
+fi
+
+# Resolve repo root from this script's location so the command works from any cwd.
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+CONFIG="$REPO_ROOT/security/opengrep/precise.yml"
+
+if [[ ! -f "$CONFIG" ]]; then
+  echo "error: rulepack not found at $CONFIG" >&2
+  echo "Recompile with: node security/opengrep/compile-rules.mjs --rules-dir <rules-dir> --out-dir security/opengrep" >&2
+  exit 66
+fi
+
+if ! command -v opengrep >/dev/null 2>&1; then
+  cat >&2 <<'EOF'
+error: 'opengrep' not found on PATH.
+
+Install with:
+  curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/v1.27.1/install.sh | bash -s -- -v v1.27.1
+
+(See https://opengrep.dev for other options.)
+EOF
+  exit 127
+fi
+
+# Pull off our own flags from the remaining args; pass everything else through to opengrep.
+EXTRA_ARGS=()
+PATHS_PASSED=0
+SAW_DOUBLE_DASH=0
+CHANGED_ONLY=0
+FAIL_ON_FINDINGS=0
+SARIF_OUTPUT=""
+while (( $# > 0 )); do
+  case "$1" in
+    --sarif)
+      mkdir -p "$REPO_ROOT/.opengrep-out"
+      SARIF_OUTPUT="$REPO_ROOT/.opengrep-out/$BUCKET.sarif"
+      EXTRA_ARGS+=( "--sarif-output=$SARIF_OUTPUT" )
+      shift
+      ;;
+    --json)
+      mkdir -p "$REPO_ROOT/.opengrep-out"
+      EXTRA_ARGS+=( "--json" "--output=$REPO_ROOT/.opengrep-out/$BUCKET.json" )
+      shift
+      ;;
+    --changed)
+      CHANGED_ONLY=1
+      shift
+      ;;
+    --error)
+      FAIL_ON_FINDINGS=1
+      shift
+      ;;
+    --)
+      SAW_DOUBLE_DASH=1
+      shift
+      ;;
+    *)
+      if (( SAW_DOUBLE_DASH )); then
+        # Treat anything after `--` as a path-positional override
+        if (( PATHS_PASSED == 0 )); then
+          PATHS_PASSED=1
+          EXTRA_ARGS+=( "$1" )
+        else
+          EXTRA_ARGS+=( "$1" )
+        fi
+      else
+        EXTRA_ARGS+=( "$1" )
+      fi
+      shift
+      ;;
+  esac
+done
+
+write_empty_sarif() {
+  local output="$1"
+
+  mkdir -p "$(dirname "$output")"
+  cat > "$output" <<'JSON'
+{
+  "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
+  "version": "2.1.0",
+  "runs": [
+    {
+      "tool": {
+        "driver": {
+          "name": "Opengrep OSS",
+          "informationUri": "https://opengrep.dev",
+          "semanticVersion": "1.27.1",
+          "rules": []
+        }
+      },
+      "results": []
+    }
+  ]
+}
+JSON
+}
+
+cd "$REPO_ROOT"
+
+if (( CHANGED_ONLY && PATHS_PASSED )); then
+  echo "error: --changed cannot be combined with explicit path overrides" >&2
+  exit 64
+fi
+
+resolve_changed_diff_ref() {
+  local diff_ref="${OPENCLAW_OPENGREP_BASE_REF:-origin/main...HEAD}"
+  local base_ref
+  local head_ref
+  local resolved_base
+
+  if [[ "$diff_ref" != *"..."* ]]; then
+    printf '%s\n' "$diff_ref"
+    return 0
+  fi
+  if [[ "${OPENCLAW_OPENGREP_MERGE_HEAD_FIRST_PARENT:-0}" != "1" ]]; then
+    printf '%s\n' "$diff_ref"
+    return 0
+  fi
+
+  base_ref="${diff_ref%%...*}"
+  head_ref="${diff_ref#*...}"
+  # First-parent resolution is shared with the Node CI routers so PR diff
+  # scope cannot drift between changed-lanes, changed-scope, and OpenGrep.
+  resolved_base="$(
+    node "$REPO_ROOT/scripts/lib/merge-head-diff-base.mjs" \
+      --base "$base_ref" \
+      --head "$head_ref" \
+      --prefer-first-parent 2>/dev/null || true
+  )"
+  if [[ -z "$resolved_base" || "$resolved_base" == "$base_ref" ]]; then
+    printf '%s\n' "$diff_ref"
+    return 0
+  fi
+
+  printf '%s...%s\n' "$resolved_base" "$head_ref"
+}
+
+# Default scan paths match CI. Override by passing `-- <paths...>`.
+if (( PATHS_PASSED == 0 )); then
+  if (( CHANGED_ONLY )); then
+    CHANGED_DIFF_REF="$(resolve_changed_diff_ref)"
+    CHANGED_PATHS_DIR="$(mktemp -d)"
+    trap 'rm -rf -- "$CHANGED_PATHS_DIR"' EXIT
+    {
+      git diff --name-only -z --diff-filter=ACMRTUXB "$CHANGED_DIFF_REF"
+      git diff --cached --name-only -z --diff-filter=ACMRTUXB --
+      git diff --name-only -z --diff-filter=ACMRTUXB --
+      git ls-files -z --others --exclude-standard
+    } > "$CHANGED_PATHS_DIR/all"
+    LC_ALL=C sort -zu "$CHANGED_PATHS_DIR/all" > "$CHANGED_PATHS_DIR/sorted"
+    SCAN_PATHS=()
+    RULEPACK_CHANGED=0
+    while IFS= read -r -d '' path; do
+      case "$path" in
+        src/*|extensions/*|apps/*|packages/*|scripts/*)
+          # OpenGrep errors when an explicit changed path is a symlink; scan the
+          # real target content, not duplicate guide aliases such as CLAUDE.md.
+          if [[ ! -L "$path" && ( -f "$path" || -d "$path" ) ]]; then
+            SCAN_PATHS+=( "$path" )
+          fi
+          ;;
+      esac
+      case "$path" in
+        security/opengrep/*|scripts/run-opengrep.sh|.semgrepignore|.github/workflows/opengrep-*)
+          RULEPACK_CHANGED=1
+          ;;
+      esac
+    done < "$CHANGED_PATHS_DIR/sorted"
+    rm -rf -- "$CHANGED_PATHS_DIR"
+    if (( ${#SCAN_PATHS[@]} == 0 && RULEPACK_CHANGED )); then
+      # Exercise rulepack loading without scanning the compiled YAML, which contains
+      # rule pattern literals that can match themselves.
+      SCAN_PATHS=( "scripts/run-opengrep.sh" )
+    fi
+    if (( ${#SCAN_PATHS[@]} == 0 )); then
+      echo "→ No changed first-party paths for opengrep." >&2
+      if [[ -n "$SARIF_OUTPUT" ]]; then
+        write_empty_sarif "$SARIF_OUTPUT"
+      fi
+      exit 0
+    fi
+  else
+    SCAN_PATHS=( "src/" "extensions/" "apps/" "packages/" "scripts/" )
+  fi
+else
+  SCAN_PATHS=()
+fi
+
+if (( FAIL_ON_FINDINGS )); then
+  EXTRA_ARGS+=( "--error" )
+fi
+
+echo "→ Running opengrep ($BUCKET) against $(IFS=' '; echo "${SCAN_PATHS[*]:-overridden}")" >&2
+echo "  Using exclusions from .semgrepignore" >&2
+OPENGREP_ARGS=( scan --no-strict --config "$CONFIG" --no-git-ignore )
+if (( ${#EXTRA_ARGS[@]} > 0 )); then
+  OPENGREP_ARGS+=( "${EXTRA_ARGS[@]}" )
+fi
+if (( ${#SCAN_PATHS[@]} > 0 )); then
+  OPENGREP_ARGS+=( "${SCAN_PATHS[@]}" )
+fi
+exec opengrep "${OPENGREP_ARGS[@]}"
diff --git a/scripts/run-oxlint.mjs b/scripts/run-oxlint.mjs
new file mode 100644
index 0000000000000000000000000000000000000000..d60b82079990920396d390f8bee857096b7768c3
--- /dev/null
+++ b/scripts/run-oxlint.mjs
@@ -0,0 +1,6 @@
+import { runTsxCliShim } from "./lib/tsx-cli-shim.mjs";
+
+await runTsxCliShim(import.meta.url, {
+  implementation: "./run-oxlint.mts",
+  failureTool: "oxlint",
+});
diff --git a/scripts/run-tsgo.mjs b/scripts/run-tsgo.mjs
new file mode 100644
index 0000000000000000000000000000000000000000..6ab4a6550072a93709598d7cf0348bb882f156ad
--- /dev/null
+++ b/scripts/run-tsgo.mjs
@@ -0,0 +1,9 @@
+import { runNodeCliShim } from "./lib/tsx-cli-shim.mjs";
+
+await runNodeCliShim(import.meta.url, {
+  implementation: "./run-tsgo.mts",
+  failureTool: "tsgo",
+  // The implementation owns a detached compiler group and escalates after 5s.
+  // Its outer shim must stay alive long enough to finish that cleanup.
+  forceKillDelayMs: 10_000,
+});
diff --git a/scripts/run-vitest-profile-child.mts b/scripts/run-vitest-profile-child.mts
new file mode 100644
index 0000000000000000000000000000000000000000..7aeedb1b60b47e0508acf1e15adb457eb3ccaa51
--- /dev/null
+++ b/scripts/run-vitest-profile-child.mts
@@ -0,0 +1,88 @@
+import { getHashes } from "node:crypto";
+import { fileURLToPath } from "node:url";
+import type { ViteUserConfig } from "vitest/config";
+import { isVitestProfileError, startVitestProfile } from "./lib/vitest-profiler.mts";
+
+async function main() {
+  const [mode, outputDir, ...args] = process.argv.slice(2);
+  if ((mode !== "main" && mode !== "runner") || !outputDir) {
+    throw new Error("Expected profiler mode and output directory.");
+  }
+  // Start before importing Vitest so main capture includes Vite/Vitest startup.
+  const finishMain = mode === "main" ? await startVitestProfile(outputDir, false) : undefined;
+  try {
+    // Node 24's background CA loader can deadlock with Undici's first hash enumeration.
+    // Populate that cached result before TLS loads, inside main's startup capture.
+    // Remove when supported Node/OpenSSL versions make concurrent initialization safe.
+    getHashes();
+    const { parseCLI, startVitest } = await import("vitest/node");
+    const { normalizePath } = await import("vite");
+    const { filter, options } = parseCLI(["vitest", ...args]);
+    // Match native help truthiness (including repeated-flag arrays); parseCLI's type omits help.
+    if ("help" in options && options.help) {
+      await finishMain?.();
+      // Let Node drain before platform shutdown, as on the error path.
+      return;
+    }
+    const cliOptions = {
+      config: "test/vitest/vitest.unit.config.ts",
+      fileParallelism: false,
+      ...options,
+    };
+    // parseCLI parses flags; Vitest's CLI applies these run-mode normalizations
+    // separately. Keep additive excludes and file:line/typecheck selection intact.
+    if (cliOptions.exclude) {
+      cliOptions.cliExclude = cliOptions.exclude;
+      delete cliOptions.exclude;
+    }
+    if (filter.some((file) => file.includes(":"))) {
+      cliOptions.includeTaskLocation ??= true;
+    }
+    if (typeof cliOptions.typecheck?.only === "boolean") {
+      cliOptions.typecheck.enabled ??= true;
+    }
+    if (cliOptions.clearCache || cliOptions.listTags) {
+      cliOptions.watch = false;
+      cliOptions.run = true;
+    }
+    const profilingConfig: ViteUserConfig = {};
+    if (mode === "runner") {
+      const setup = fileURLToPath(new URL("./lib/vitest-profiler.mts", import.meta.url));
+      // Vite appends this array to the configured setup, including scalar setup paths.
+      profilingConfig.test = {
+        globalSetup: [setup],
+        provide: { openclawVitestProfileDir: outputDir },
+      };
+    }
+    const normalizedFilters = filter.map((file) => normalizePath(file.replaceAll("\\", "/")));
+    const vitest = await startVitest("test", normalizedFilters, cliOptions, profilingConfig);
+    if (!vitest.shouldKeepServer()) {
+      try {
+        await finishMain?.();
+      } finally {
+        await vitest.exit();
+      }
+      // Worker teardown can report errors after Vitest has finalized the test result.
+      const profileErrors = vitest.state.getUnhandledErrors().filter(isVitestProfileError);
+      if (profileErrors.length) {
+        vitest.logger.printUnhandledErrors(profileErrors);
+        process.exitCode ||= 1;
+      }
+    }
+  } catch (error) {
+    try {
+      await finishMain?.();
+    } catch (cleanupError) {
+      // Keep the startup error as the thrown failure while reporting a distinct
+      // finalization failure; reawaiting one failed finalizer must not report it twice.
+      if (cleanupError !== error) {
+        console.error(cleanupError);
+      }
+    }
+    // Node 24 can deadlock joining GC-waiting V8 workers during uncaught-exception shutdown.
+    console.error(error);
+    process.exitCode = 1;
+  }
+}
+
+await main();
diff --git a/scripts/run-with-env.mts b/scripts/run-with-env.mts
new file mode 100644
index 0000000000000000000000000000000000000000..89e7b3b352d130cb93208a25ef3190841e7343de
--- /dev/null
+++ b/scripts/run-with-env.mts
@@ -0,0 +1,224 @@
+// Runs a command with inline KEY=value assignments while preserving signal behavior.
+import { spawn } from "node:child_process";
+import { terminateManagedChild } from "./lib/managed-child-process.mts";
+import { parsePositiveInt } from "./lib/numeric-options.mjs";
+
+const ENV_ASSIGNMENT_RE = /^[A-Za-z_][A-Za-z0-9_]*=/u;
+const USAGE =
+  "Usage: node --import tsx scripts/run-with-env.mts KEY=value [KEY=value ...] -- command [args...]";
+const MAX_TIMER_TIMEOUT_MS = 2_147_000_000;
+type ForwardedSignal = "SIGHUP" | "SIGINT" | "SIGTERM";
+
+/**
+ * Detects help requests before the command separator.
+ */
+export function isRunWithEnvHelpRequest(argv: readonly string[]) {
+  for (const arg of argv) {
+    if (arg === "--") {
+      return false;
+    }
+    if (arg === "--help" || arg === "-h") {
+      return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Parses KEY=value assignments and the command following --.
+ */
+export function parseRunWithEnvArgs(argv: string[]) {
+  const separatorIndex = argv.indexOf("--");
+  if (separatorIndex <= 0 || separatorIndex === argv.length - 1) {
+    throw new Error(USAGE);
+  }
+
+  const assignments = argv.slice(0, separatorIndex);
+  const env: Record<string, string> = {};
+  for (const assignment of assignments) {
+    if (!ENV_ASSIGNMENT_RE.test(assignment)) {
+      throw new Error(`invalid environment assignment: ${assignment}`);
+    }
+    const equalsIndex = assignment.indexOf("=");
+    env[assignment.slice(0, equalsIndex)] = assignment.slice(equalsIndex + 1);
+  }
+
+  const [command, ...args] = argv.slice(separatorIndex + 1);
+  if (command === undefined) {
+    throw new Error(USAGE);
+  }
+  return { env, command, args };
+}
+
+/**
+ * Resolves bare Node command names to the current executable so wrapper and child use the same
+ * runtime. Windows command lookup is case-insensitive; explicit paths remain caller-owned.
+ */
+export function resolveSpawnCommand(
+  command: string,
+  args: string[],
+  execPath = process.execPath,
+  platform: NodeJS.Platform = process.platform,
+) {
+  const normalizedCommand = platform === "win32" ? command.toLowerCase() : command;
+  const isNodeCommand =
+    normalizedCommand === "node" || (platform === "win32" && normalizedCommand === "node.exe");
+  if (isNodeCommand) {
+    return {
+      command: execPath,
+      args,
+    };
+  }
+  return {
+    command,
+    args,
+  };
+}
+
+/**
+ * Reads the signal-forwarding force-kill grace period.
+ */
+export function resolveForceKillDelayMs(env: NodeJS.ProcessEnv = process.env) {
+  const raw = env.OPENCLAW_RUN_WITH_ENV_FORCE_KILL_MS;
+  const text = raw?.trim();
+  if (!text) {
+    return 5_000;
+  }
+  const parsed = parsePositiveInt(text, "OPENCLAW_RUN_WITH_ENV_FORCE_KILL_MS");
+  return Math.min(parsed, MAX_TIMER_TIMEOUT_MS);
+}
+
+/**
+ * Signals the wrapped command tree when this small parent wrapper is stopped.
+ */
+function main(argv: string[] = process.argv.slice(2)) {
+  if (isRunWithEnvHelpRequest(argv)) {
+    console.log(USAGE);
+    return;
+  }
+
+  let parsed: ReturnType<typeof parseRunWithEnvArgs>;
+  try {
+    parsed = parseRunWithEnvArgs(argv);
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(2);
+  }
+
+  let forceKillDelayMs;
+  try {
+    forceKillDelayMs = resolveForceKillDelayMs();
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(2);
+  }
+
+  const spawnCommand = resolveSpawnCommand(parsed.command, parsed.args);
+  const useChildProcessGroup = process.platform !== "win32" && !process.stdin.isTTY;
+  const child = spawn(spawnCommand.command, spawnCommand.args, {
+    detached: useChildProcessGroup,
+    env: {
+      ...process.env,
+      ...parsed.env,
+    },
+    stdio: "inherit",
+  });
+  let forwardedSignal: ForwardedSignal | undefined;
+  let forceKillTimer: ReturnType<typeof setTimeout> | undefined;
+  // Keep the child in the foreground process group so TTY signals such as
+  // Ctrl-C, Ctrl-Z, and window resizes stay native. Forward direct wrapper
+  // shutdown signals that would otherwise only kill this small parent process.
+  const forwardedSignals: ForwardedSignal[] = useChildProcessGroup
+    ? ["SIGTERM", "SIGHUP", "SIGINT"]
+    : ["SIGTERM", "SIGHUP"];
+  const signalChild = (signal: NodeJS.Signals) =>
+    terminateManagedChild(child, signal, { useProcessGroup: useChildProcessGroup });
+  const childProcessGroupAlive = () => {
+    if (!useChildProcessGroup || typeof child.pid !== "number") {
+      return false;
+    }
+    try {
+      process.kill(-child.pid, 0);
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  const exitWithForwardedSignal = () => {
+    const signal = forwardedSignal;
+    if (!signal) {
+      return;
+    }
+    const finish = () => {
+      if (forceKillTimer) {
+        clearTimeout(forceKillTimer);
+      }
+      process.kill(process.pid, signal);
+    };
+    if (!childProcessGroupAlive()) {
+      finish();
+      return;
+    }
+    const deadline = Date.now() + forceKillDelayMs;
+    const drainTimer = setInterval(() => {
+      if (!childProcessGroupAlive()) {
+        clearInterval(drainTimer);
+        finish();
+        return;
+      }
+      if (Date.now() >= deadline) {
+        clearInterval(drainTimer);
+        signalChild("SIGKILL");
+        finish();
+      }
+    }, 50);
+  };
+
+  const cleanupSignalHandlers = () => {
+    for (const [signal, handler] of signalHandlers) {
+      process.off(signal, handler);
+    }
+  };
+  const signalHandlers = new Map<ForwardedSignal, () => void>(
+    forwardedSignals.map((signal) => [
+      signal,
+      () => {
+        forwardedSignal ??= signal;
+        signalChild(signal);
+        forceKillTimer ??= setTimeout(() => signalChild("SIGKILL"), forceKillDelayMs);
+      },
+    ]),
+  );
+  for (const [signal, handler] of signalHandlers) {
+    process.on(signal, handler);
+  }
+
+  child.on("exit", (code, signal) => {
+    cleanupSignalHandlers();
+    if (forwardedSignal) {
+      exitWithForwardedSignal();
+      return;
+    }
+    if (forceKillTimer) {
+      clearTimeout(forceKillTimer);
+    }
+    if (signal) {
+      process.kill(process.pid, signal);
+      return;
+    }
+    process.exit(code ?? 1);
+  });
+
+  child.on("error", (error) => {
+    cleanupSignalHandlers();
+    if (forceKillTimer) {
+      clearTimeout(forceKillTimer);
+    }
+    console.error(error);
+    process.exit(1);
+  });
+}
+
+if (import.meta.main) {
+  main();
+}
diff --git a/scripts/runtime-postbuild.mts b/scripts/runtime-postbuild.mts
new file mode 100644
index 0000000000000000000000000000000000000000..1626a20f4a4141c77b28358851e31921ce69e861
--- /dev/null
+++ b/scripts/runtime-postbuild.mts
@@ -0,0 +1,821 @@
+// Generates postbuild runtime artifacts: plugin metadata, SDK aliases, stable
+// runtime aliases, static assets, and compatibility chunks for live upgrades.
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { performance } from "node:perf_hooks";
+import { pathToFileURL } from "node:url";
+import { buildSync } from "esbuild";
+import { verifyBuiltPluginControlPlaneModules } from "./check-built-plugin-control-plane-modules.mts";
+import { copyBundledPluginMetadata } from "./copy-bundled-plugin-metadata.mts";
+import { copyHookMetadata, listHookMetadataOutputs } from "./copy-hook-metadata.ts";
+import { withDistArtifactOwnership } from "./lib/dist-artifact-ownership.mts";
+import { assertRealOutputRoot } from "./lib/output-root-guard.mjs";
+import { escapeRegExp } from "./lib/regexp.mjs";
+import { resolveRepoRoot } from "./lib/repo-root.mjs";
+import {
+  readRuntimeDependencyOwnership,
+  RUNTIME_DEPENDENCY_OWNERSHIP_RELATIVE_PATH,
+  type RuntimeDependencyOwnership,
+} from "./lib/runtime-dependency-ownership-contract.mts";
+import {
+  copyStaticExtensionAssets,
+  copyStaticExtensionAssetsToRuntimeOverlay,
+  discoverStaticExtensionAssets,
+  shouldCopyStaticExtensionAssets,
+} from "./lib/static-extension-assets.mts";
+import {
+  isUpdateCompatibilityChunk,
+  listUpdateCompatibilityChunkPaths,
+  readUpdateCompatibilityInventory,
+  UPDATE_COMPATIBILITY_INVENTORY_FILE,
+  writeUpdateCompatibilityChunks,
+} from "./lib/update-compat-chunks.mts";
+import { writeTextFileIfChanged } from "./runtime-postbuild-shared.mjs";
+import { stageBundledPluginRuntime } from "./stage-bundled-plugin-runtime.mts";
+import { writeBuildInfo } from "./write-build-info.ts";
+import { writeOfficialChannelCatalog } from "./write-official-channel-catalog.mts";
+
+type RuntimePostBuildParams = {
+  rootDir?: string;
+  repoRoot?: string;
+  cwd?: string;
+  env?: NodeJS.ProcessEnv;
+  fs?: typeof fs;
+  timings?: boolean | "verbose";
+  warn?: (message: string) => void;
+};
+type RuntimeFsParams = Pick<RuntimePostBuildParams, "rootDir" | "fs">;
+type LegacyCliExitCompatChunk = { dest: string; contents: string };
+type LegacyRuntimeAlias = {
+  legacyFileName: string;
+  aliasFileName: string;
+  sourceIncludes?: readonly string[];
+};
+
+const LEGACY_UPDATE_NODE_RUNNER_COMPAT_CHUNK = [
+  'import path from "node:path";',
+  "export function resolveNodeRunner() {",
+  "  const base = path.basename(process.execPath).trim().toLowerCase();",
+  '  return base === "node" || base === "node.exe" ? process.execPath : "node";',
+  "}",
+  "",
+].join("\n");
+
+const ROOT = resolveRepoRoot(import.meta.url);
+const UPDATE_COMPATIBILITY_INVENTORY = path.join(ROOT, "scripts/lib/update-compat-inventory.json");
+const ROOT_RUNTIME_ALIAS_PATTERN = /^(?<base>.+\.(?:runtime|contract))-[A-Za-z0-9_-]+\.m?js$/u;
+const ROOT_STABLE_RUNTIME_ALIAS_PATTERN = /^.+\.(?:runtime|contract)\.js$/u;
+const ROOT_RUNTIME_IMPORT_SPECIFIER_PATTERN =
+  /(["'])\.\/([^"']+\.(?:runtime|contract)-[A-Za-z0-9_-]+\.m?js)\1/gu;
+const OFFICIAL_CHANNEL_CATALOG_OUTPUT = "dist/channel-catalog.json";
+const EXPORT_HTML_SOURCE_DIR = "src/auto-reply/reply/export-html";
+const EXPORT_HTML_OUTPUT_DIR = "dist/export-html";
+const EXPORT_HTML_OUTPUTS = [
+  `${EXPORT_HTML_OUTPUT_DIR}/template.css`,
+  `${EXPORT_HTML_OUTPUT_DIR}/template.html`,
+  `${EXPORT_HTML_OUTPUT_DIR}/template.js`,
+  `${EXPORT_HTML_OUTPUT_DIR}/vendor/highlight.min.js`,
+  `${EXPORT_HTML_OUTPUT_DIR}/vendor/marked.min.js`,
+];
+const EXPORT_HTML_VENDOR_ENTRYPOINTS = [
+  {
+    fileName: "marked.min.js",
+    packageEntry: "marked",
+    packageName: "marked",
+    globalName: "marked",
+    licenseFile: "LICENSE",
+  },
+  {
+    fileName: "highlight.min.js",
+    packageEntry: "highlight.js/lib/common",
+    packageName: "highlight.js",
+    globalName: "hljs",
+    footer: "hljs = hljs.default || hljs;",
+    licenseFile: "LICENSE",
+  },
+];
+const LEGACY_ROOT_RUNTIME_COMPAT_ALIASES: Array<readonly [string, string]> = [
+  // v2026.4.29 dispatch lazy chunks. Package updates used to replace the
+  // dist tree before the live gateway had restarted, so an already-loaded old
+  // dispatch chunk could still resolve these names after the swap.
+  ["abort.runtime-DX6vo4yJ.js", "abort.runtime.js"],
+  ["get-reply-from-config.runtime-uABrvCZ-.js", "get-reply-from-config.runtime.js"],
+  ["reply-media-paths.runtime-C5UnVaLF.js", "reply-media-paths.runtime.js"],
+  ["route-reply.runtime-D4PGzijU.js", "route-reply.runtime.js"],
+  ["runtime-plugins.runtime-fLHuT7Vs.js", "runtime-plugins.runtime.js"],
+  ["tts.runtime-66taD50M.js", "tts.runtime.js"],
+  // v2026.5.2-beta.1 dispatch lazy chunks.
+  ["abort.runtime-CKviLU0L.js", "abort.runtime.js"],
+  ["get-reply-from-config.runtime-BzFAggVK.js", "get-reply-from-config.runtime.js"],
+  ["reply-media-paths.runtime-ZpULeITb.js", "reply-media-paths.runtime.js"],
+  ["route-reply.runtime-uzaOjbd1.js", "route-reply.runtime.js"],
+  ["runtime-plugins.runtime-CNAfmQRG.js", "runtime-plugins.runtime.js"],
+  ["tts.runtime-D-THXDsp.js", "tts.runtime.js"],
+  // v2026.5.2 -> v2026.5.3-beta.3 gateway shutdown chunks. The running
+  // gateway may resolve these only after an npm package tree replacement.
+  ["server-close-DsVPJDIx.js", "server-close.runtime.js"],
+  ["server-close-DvAvfgr8.js", "server-close.runtime.js"],
+  // v2026.5.12-beta.8 gateway shutdown hook chunks.
+  ["hook-runner-global-B8rMIo8I.js", "plugins/hook-runner-global.js"],
+  // v2026.5.3 beta reply-dispatch lazy chunks.
+  ["provider-dispatcher-6EQEtc-t.js", "provider-dispatcher.runtime.js"],
+  ["provider-dispatcher-BpL2E92x.js", "provider-dispatcher.runtime.js"],
+  ["provider-dispatcher-JG96SkLX.js", "provider-dispatcher.runtime.js"],
+  // v2026.5.4 tool/control-plane lazy chunks. These predate the stable
+  // nested dist entries, but live gateways may still import them after update.
+  ["manager-DzRWrKSA.js", "acp/control-plane/manager.js"],
+  ["runtime-CeGN4XUC.js", "web-fetch/runtime.js"],
+  // v2026.5.22 and v2026.6.8 text-transform runtimes. The stable alias remains
+  // for old chunks, but new chunks keep hashed imports because the alias export
+  // set expanded in v2026.6.8 and may already be cached in a live gateway.
+  ["text-transforms.runtime-D9-SpAmI.js", "text-transforms.runtime.js"],
+  ["text-transforms.runtime-sEqsN4pN.js", "text-transforms.runtime.js"],
+];
+const ROOT_RUNTIME_STABLE_IMPORT_SKIP_ALIASES = new Set(["text-transforms.runtime.js"]);
+const LEGACY_PLUGIN_INSTALL_RUNTIME_MARKERS = [
+  "scanPackageInstallSource",
+  "scanFileInstallSource",
+  "scanInstalledPackageDependencyTree",
+  "scanBundleInstallSource",
+];
+const PLUGIN_INSTALL_RUNTIME_ALIAS = {
+  aliasFileName: "install.runtime.js",
+  sourceIncludes: LEGACY_PLUGIN_INSTALL_RUNTIME_MARKERS,
+};
+const LEGACY_PLUGIN_INSTALL_RUNTIME_COMPAT_ALIASES = [
+  // Published releases from v2026.3.22 onward. Older updaters could
+  // overlay package dist instead of swapping it, leaving old install chunks
+  // that still import these hashed plugin install runtime files.
+  "install.runtime-D7SL02B2.js",
+  "install.runtime-Deq6Beal.js",
+  "install.runtime-Eoq8y3HE.js",
+  "install.runtime-DDmlaKdG.js",
+  "install.runtime-ADTafpVD.js",
+  "install.runtime-v8X-j3Tm.js",
+  "install.runtime-BLcZ-44g.js",
+  "install.runtime-vS4aFJvO.js",
+  "install.runtime-Dm_c092A.js",
+  "install.runtime-D_7OUvuY.js",
+  "install.runtime-BLEE0OIk.js",
+  "install.runtime-3LpjZbr8.js",
+  "install.runtime-BrsB9OnV.js",
+  "install.runtime-BEOb-kNW.js",
+  "install.runtime-Cx_xphd1.js",
+  "install.runtime-B-MtEMSR.js",
+  "install.runtime-C-Y4HAqX.js",
+  "install.runtime-j1SedTZh.js",
+  "install.runtime-4zsL_8wt.js",
+  "install.runtime-BhCKlLSJ.js",
+  "install.runtime-tGJ0KhMF.js",
+  "install.runtime-DtmATpak.js",
+  "install.runtime-BzZ38ePb.js",
+  "install.runtime-DwQr7nEE.js",
+  "install.runtime-CEIURnUz.js",
+  "install.runtime-D3EPlM0r.js",
+  "install.runtime-DIlN5H3O.js",
+  "install.runtime-DjcOwVH_.js",
+  "install.runtime-B13jZink.js",
+  "install.runtime-O8MXNrwm.js",
+  "install.runtime-Bkf_VMnk.js",
+  "install.runtime-QOfEzAcZ.js",
+  "install.runtime-BRVACueI.js",
+  "install.runtime-DX8jy7tN.js",
+  "install.runtime-BdfsTamp.js",
+  "install.runtime-B6OA2_P8.js",
+  "install.runtime-D9cTH-C0.js",
+  "install.runtime-OCJULXQo.js",
+  "install.runtime-9ZXBhZSk.js",
+  "install.runtime-DlL3C3t_.js",
+  "install.runtime-TU-jP-TN.js",
+  "install.runtime-a2FlfOSp.js",
+  "install.runtime-BwuRABU1.js",
+  "install.runtime-B3mZL_R2.js",
+  "install.runtime-CWUzypNQ.js",
+  "install.runtime-D6FSd9v2.js",
+  "install.runtime-DQ-ui3nL.js",
+  "install.runtime-CNHwKOIb.js",
+  "install.runtime-Dzuj9tSw.js",
+  "install.runtime-BuF-YAfQ.js",
+  "install.runtime-Xom5hOHq.js",
+  "install.runtime-tnhNR9WW.js",
+].map((legacyFileName) => ({
+  legacyFileName,
+  aliasFileName: PLUGIN_INSTALL_RUNTIME_ALIAS.aliasFileName,
+  sourceIncludes: LEGACY_PLUGIN_INSTALL_RUNTIME_MARKERS,
+}));
+/** Compatibility chunks for old updater and CLI exit modules after package replacement. */
+const LEGACY_CLI_EXIT_COMPAT_CHUNKS = [
+  // v2026.8.2 and the exact d413210 and 0229a108 builds load these after replacing dist/.
+  // Remove only after the source artifacts fall outside the supported upgrade window.
+  ...["shared-Y6bNiw2w.js", "shared-DTaQo6Hi.js", "shared-1Uyqkfns.js"].map((fileName) => ({
+    dest: `dist/${fileName}`,
+    contents: LEGACY_UPDATE_NODE_RUNNER_COMPAT_CHUNK,
+  })),
+  ...["memory-state-CcqRgDZU.js", "memory-state-DwGdReW4.js"].map((fileName) => ({
+    dest: `dist/${fileName}`,
+    contents: "export function hasMemoryRuntime() {\n  return false;\n}\n",
+  })),
+];
+
+/**
+ * Lists generated official channel catalog outputs.
+ */
+function listOfficialChannelCatalogOutputs() {
+  return [OFFICIAL_CHANNEL_CATALOG_OUTPUT];
+}
+
+function collectStableRootRuntimeAliasCandidates(distDir: string, fsImpl: typeof fs) {
+  let entries;
+  try {
+    entries = fsImpl.readdirSync(distDir, { withFileTypes: true });
+  } catch {
+    return { entries: [], candidatesByAlias: new Map<string, string[]>() };
+  }
+
+  const candidatesByAlias = new Map<string, string[]>();
+  for (const entry of entries.toSorted((left, right) => left.name.localeCompare(right.name))) {
+    if (!entry.isFile()) {
+      continue;
+    }
+    const match = entry.name.match(ROOT_RUNTIME_ALIAS_PATTERN);
+    if (!match?.groups?.base) {
+      continue;
+    }
+    try {
+      if (isUpdateCompatibilityChunk(fsImpl.readFileSync(path.join(distDir, entry.name), "utf8"))) {
+        continue;
+      }
+    } catch {
+      // Unreadable candidates still participate in ambiguity detection below.
+    }
+    const aliasFileName = `${match.groups.base}.js`;
+    const candidates = candidatesByAlias.get(aliasFileName) ?? [];
+    candidates.push(entry.name);
+    candidatesByAlias.set(aliasFileName, candidates);
+  }
+  // Importer rewrites retain directory order; only alias candidates are sorted.
+  return { entries, candidatesByAlias };
+}
+
+function resolveStableRootRuntimeAliasCandidate(
+  aliasFileName: string,
+  candidates: string[],
+  distDir: string,
+  fsImpl: typeof fs,
+) {
+  const candidatesWithSources = candidates.map((candidate) => {
+    const filePath = path.join(distDir, candidate);
+    let source = "";
+    try {
+      source = fsImpl.readFileSync(filePath, "utf8");
+    } catch {
+      // Keep unreadable candidates visible to the ambiguous-candidate logic.
+    }
+    return { candidate, source };
+  });
+  const implementationCandidates = candidatesWithSources.filter(
+    ({ source }) => !isRuntimeAliasSource(source, aliasFileName),
+  );
+  const candidateNames = implementationCandidates.map(({ candidate }) => candidate);
+  if (candidateNames.length === 1) {
+    return candidateNames[0] ?? null;
+  }
+  if (aliasFileName === PLUGIN_INSTALL_RUNTIME_ALIAS.aliasFileName) {
+    return resolveRootRuntimeCandidateByMarkers(
+      aliasFileName,
+      distDir,
+      fsImpl,
+      PLUGIN_INSTALL_RUNTIME_ALIAS.sourceIncludes,
+    );
+  }
+  const candidateSet = new Set(candidateNames);
+  const wrappers = implementationCandidates
+    .map(({ candidate, source }) => ({ candidate, source }))
+    .filter(({ candidate, source }) => {
+      return candidates.some(
+        (target) =>
+          target !== candidate &&
+          candidateSet.has(target) &&
+          source.includes(`"./${target}"`) &&
+          !source.includes("\n//#region "),
+      );
+    });
+  return wrappers.length === 1 ? (wrappers[0]?.candidate ?? null) : null;
+}
+
+/**
+ * Lists stable aliases for hashed root runtime/contract chunks.
+ */
+function listStableRootRuntimeAliasOutputs(params: RuntimeFsParams = {}) {
+  const rootDir = params.rootDir ?? ROOT;
+  const distDir = path.join(rootDir, "dist");
+  const fsImpl = params.fs ?? fs;
+  return [...collectStableRootRuntimeAliasCandidates(distDir, fsImpl).candidatesByAlias]
+    .filter(([aliasFileName, candidates]) =>
+      resolveStableRootRuntimeAliasCandidate(aliasFileName, candidates, distDir, fsImpl),
+    )
+    .map(([aliasFileName]) => `dist/${aliasFileName}`)
+    .toSorted((left, right) => left.localeCompare(right));
+}
+
+/**
+ * Lists compatibility chunk outputs required for old CLI exit paths.
+ */
+function listLegacyCliExitCompatOutputs(params: { chunks?: LegacyCliExitCompatChunk[] } = {}) {
+  const chunks = params.chunks ?? LEGACY_CLI_EXIT_COMPAT_CHUNKS;
+  return chunks
+    .map(({ dest }) => dest.replace(/\\/g, "/"))
+    .toSorted((left, right) => left.localeCompare(right));
+}
+
+/**
+ * Lists legacy hashed runtime aliases that may be needed during live upgrades.
+ */
+function listLegacyRootRuntimeCompatOutputs(params: RuntimeFsParams = {}) {
+  const rootDir = params.rootDir ?? ROOT;
+  const distDir = path.join(rootDir, "dist");
+  const fsImpl = params.fs ?? fs;
+  const aliases: LegacyRuntimeAlias[] = [
+    ...LEGACY_ROOT_RUNTIME_COMPAT_ALIASES.map(([legacyFileName, aliasFileName]) => ({
+      legacyFileName,
+      aliasFileName,
+    })),
+    ...LEGACY_PLUGIN_INSTALL_RUNTIME_COMPAT_ALIASES,
+  ];
+  return aliases
+    .filter((entry) =>
+      resolveLegacyRootRuntimeCompatTarget(
+        entry.legacyFileName,
+        entry.aliasFileName,
+        distDir,
+        fsImpl,
+        entry.sourceIncludes,
+      ),
+    )
+    .map(({ legacyFileName }) => `dist/${legacyFileName}`)
+    .toSorted((left, right) => left.localeCompare(right));
+}
+
+/**
+ * Lists all core runtime postbuild outputs expected after a build.
+ */
+export function listCoreRuntimePostBuildOutputs(
+  params: RuntimeFsParams & { chunks?: LegacyCliExitCompatChunk[] } = {},
+) {
+  return [
+    "dist/build-info.json",
+    ...listHookMetadataOutputs(params),
+    ...listOfficialChannelCatalogOutputs(),
+    ...listExportHtmlTemplateOutputs(params),
+    ...listStableRootRuntimeAliasOutputs(params),
+    ...listLegacyRootRuntimeCompatOutputs(params),
+    ...listLegacyCliExitCompatOutputs(params),
+    `dist/${UPDATE_COMPATIBILITY_INVENTORY_FILE}`,
+    ...listUpdateCompatibilityChunkPaths(
+      readUpdateCompatibilityInventory(UPDATE_COMPATIBILITY_INVENTORY),
+    ).map((fileName) => `dist/${fileName}`),
+  ].toSorted((left, right) => left.localeCompare(right));
+}
+
+/** Builds deterministic browser globals from the pinned workspace packages. */
+export function generateExportHtmlVendorAssets(
+  params: Pick<RuntimePostBuildParams, "rootDir"> = {},
+): Readonly<Record<string, string>> {
+  const rootDir = path.resolve(params.rootDir ?? ROOT);
+  const resolveFromRoot = createRequire(path.join(rootDir, "package.json")).resolve;
+  return Object.fromEntries(
+    EXPORT_HTML_VENDOR_ENTRYPOINTS.map(
+      ({ fileName, packageEntry, packageName, globalName, footer, licenseFile }) => {
+        const result = buildSync({
+          absWorkingDir: rootDir,
+          bundle: true,
+          entryPoints: [packageEntry],
+          footer: footer ? { js: footer } : undefined,
+          format: "iife",
+          globalName,
+          legalComments: "inline",
+          logLevel: "silent",
+          minify: true,
+          platform: "browser",
+          target: "es2018",
+          write: false,
+        });
+        const output = result.outputFiles?.[0];
+        if (!output || result.outputFiles?.length !== 1) {
+          throw new Error(`Expected one generated export-html asset for ${packageEntry}`);
+        }
+        const packageRoot = path.dirname(resolveFromRoot(`${packageName}/package.json`));
+        const license = fs.readFileSync(path.join(packageRoot, licenseFile), "utf8").trimEnd();
+        if (license.includes("*/")) {
+          throw new Error(`Cannot embed ${packageName} license in a JavaScript comment`);
+        }
+        return [fileName, `/*!\n${license}\n*/\n${output.text}`];
+      },
+    ),
+  );
+}
+
+function listExportHtmlTemplateOutputs(params: RuntimeFsParams = {}) {
+  const rootDir = params.rootDir ?? ROOT;
+  const fsImpl = params.fs ?? fs;
+  const hasSource = fsImpl.existsSync(path.join(rootDir, EXPORT_HTML_SOURCE_DIR));
+  const hasBuiltAssets = fsImpl.existsSync(path.join(rootDir, EXPORT_HTML_OUTPUT_DIR));
+  return hasSource || hasBuiltAssets ? [...EXPORT_HTML_OUTPUTS] : [];
+}
+
+/** Copies authored templates and generates dependency-owned browser payloads. */
+export function copyExportHtmlTemplates(params: RuntimeFsParams = {}) {
+  const rootDir = path.resolve(params.rootDir ?? ROOT);
+  const fsImpl = params.fs ?? fs;
+  const sourceDir = path.join(rootDir, EXPORT_HTML_SOURCE_DIR);
+  if (!fsImpl.existsSync(sourceDir)) {
+    return;
+  }
+  const outputDir = path.join(rootDir, EXPORT_HTML_OUTPUT_DIR);
+  assertRealOutputRoot(path.join(rootDir, "dist"), { fs: fsImpl });
+  fsImpl.rmSync(outputDir, { recursive: true, force: true });
+  fsImpl.mkdirSync(outputDir, { recursive: true });
+  for (const entry of fsImpl.readdirSync(sourceDir, { withFileTypes: true })) {
+    if (!entry.isFile() || entry.name.endsWith(".test.ts")) {
+      continue;
+    }
+    fsImpl.copyFileSync(path.join(sourceDir, entry.name), path.join(outputDir, entry.name));
+  }
+  const vendorDir = path.join(outputDir, "vendor");
+  fsImpl.mkdirSync(vendorDir, { recursive: true });
+  for (const [fileName, contents] of Object.entries(generateExportHtmlVendorAssets({ rootDir }))) {
+    fsImpl.writeFileSync(path.join(vendorDir, fileName), contents);
+  }
+}
+
+const RUNTIME_CHUNK_DEFAULT_EXPORT_PATTERN =
+  /(^|\n)\s*export\b\s*(?:default\b|\{[^}]*(?:\bas\s+default\b|\bdefault\b\s*(?=[,}]))[^}]*\})/u;
+
+function formatRuntimeAliasSource(targetFileName: string, forwardDefault = false) {
+  const specifier = JSON.stringify(`./${targetFileName}`);
+  const starSource = `export * from ${specifier};\n`;
+  return forwardDefault ? `${starSource}export { default } from ${specifier};\n` : starSource;
+}
+
+function isRuntimeAliasSource(source: string, targetFileName: string) {
+  const normalizedSource = source.trim();
+  return (
+    normalizedSource === formatRuntimeAliasSource(targetFileName).trim() ||
+    normalizedSource === formatRuntimeAliasSource(targetFileName, true).trim()
+  );
+}
+
+/**
+ * Builds alias module source for a runtime chunk target. `export * from`
+ * never re-exports `default`, so when the target chunk has a default export
+ * the alias must forward it explicitly — otherwise lazy `import()` consumers
+ * that destructure `default` receive `undefined` (e.g. the post-compaction
+ * count reconcile failed this way with "TypeError: reconcile is not a
+ * function" on every compaction).
+ */
+function buildRuntimeAliasSource(targetFileName: string, distDir: string, fsImpl: typeof fs) {
+  let targetSource;
+  try {
+    targetSource = fsImpl.readFileSync(path.join(distDir, targetFileName), "utf8");
+  } catch {
+    return formatRuntimeAliasSource(targetFileName);
+  }
+  return formatRuntimeAliasSource(
+    targetFileName,
+    RUNTIME_CHUNK_DEFAULT_EXPORT_PATTERN.test(targetSource),
+  );
+}
+
+function writeRuntimeDependencyOwnership(
+  rootDir: string,
+  ownership: RuntimeDependencyOwnership | null,
+  fsImpl: typeof fs,
+) {
+  if (ownership) {
+    fsImpl.writeFileSync(
+      path.join(rootDir, RUNTIME_DEPENDENCY_OWNERSHIP_RELATIVE_PATH),
+      `${JSON.stringify({ chunks: Object.fromEntries(Object.entries(ownership.chunks).toSorted(([a], [b]) => a.localeCompare(b))) })}\n`,
+    );
+  }
+}
+
+/**
+ * Writes stable aliases for current hashed runtime chunks.
+ * @internal Directly tested script implementation detail.
+ */
+export function writeStableRootRuntimeAliases(params: RuntimeFsParams = {}) {
+  const rootDir = params.rootDir ?? ROOT;
+  const distDir = path.join(rootDir, "dist");
+  const fsImpl = params.fs ?? fs;
+  // Alias rewrites delete files under dist; fail closed on a symlinked root
+  // so a stale alias removal cannot land inside the link target.
+  assertRealOutputRoot(distDir, { fs: fsImpl });
+  const { candidatesByAlias } = collectStableRootRuntimeAliasCandidates(distDir, fsImpl);
+
+  const ownership = readRuntimeDependencyOwnership(rootDir, fsImpl);
+  for (const [aliasFileName, candidates] of candidatesByAlias) {
+    const aliasPath = path.join(distDir, aliasFileName);
+    const candidate = resolveStableRootRuntimeAliasCandidate(
+      aliasFileName,
+      candidates,
+      distDir,
+      fsImpl,
+    );
+    if (!candidate) {
+      fsImpl.rmSync?.(aliasPath, { force: true });
+      if (ownership) {
+        delete ownership.chunks[aliasFileName];
+      }
+      continue;
+    }
+    const source = buildRuntimeAliasSource(candidate, distDir, fsImpl);
+    const owner = ownership?.chunks[candidate];
+    if (ownership && owner) {
+      const targetSource = fsImpl.readFileSync(path.join(distDir, candidate));
+      if (createHash("sha256").update(targetSource).digest("hex") !== owner.sha256) {
+        throw new Error(
+          `runtime dependency ownership no longer matches ${candidate}; rebuild dist`,
+        );
+      }
+      ownership.chunks[aliasFileName] = {
+        extensions: owner.extensions,
+        sha256: createHash("sha256").update(source).digest("hex"),
+      };
+    } else if (ownership) {
+      delete ownership.chunks[aliasFileName];
+    }
+    writeTextFileIfChanged(aliasPath, source);
+  }
+  writeRuntimeDependencyOwnership(rootDir, ownership, fsImpl);
+}
+
+/**
+ * Rewrites hashed runtime imports to stable aliases so live updates survive swaps.
+ * @internal Directly tested script implementation detail.
+ */
+export function rewriteRootRuntimeImportsToStableAliases(params: RuntimeFsParams = {}) {
+  const rootDir = params.rootDir ?? ROOT;
+  const distDir = path.join(rootDir, "dist");
+  const fsImpl = params.fs ?? fs;
+  const { entries, candidatesByAlias } = collectStableRootRuntimeAliasCandidates(distDir, fsImpl);
+  const runtimeAliasFiles = new Map<string, string>();
+  for (const [aliasFileName, candidates] of candidatesByAlias) {
+    const candidate = resolveStableRootRuntimeAliasCandidate(
+      aliasFileName,
+      candidates,
+      distDir,
+      fsImpl,
+    );
+    if (candidate) {
+      if (ROOT_RUNTIME_STABLE_IMPORT_SKIP_ALIASES.has(aliasFileName)) {
+        continue;
+      }
+      runtimeAliasFiles.set(candidate, aliasFileName);
+    }
+  }
+  if (runtimeAliasFiles.size === 0) {
+    return;
+  }
+
+  const ownership = readRuntimeDependencyOwnership(rootDir, fsImpl);
+  for (const entry of entries) {
+    if (!entry.isFile() || !/\.m?js$/u.test(entry.name)) {
+      continue;
+    }
+    if (ROOT_STABLE_RUNTIME_ALIAS_PATTERN.test(entry.name)) {
+      continue;
+    }
+    const filePath = path.join(distDir, entry.name);
+    let source;
+    try {
+      source = fsImpl.readFileSync(filePath, "utf8");
+    } catch {
+      continue;
+    }
+    const rewritten = source.replace(
+      ROOT_RUNTIME_IMPORT_SPECIFIER_PATTERN,
+      (specifier: string, quote: string, fileName: string) => {
+        const aliasFileName = runtimeAliasFiles.get(fileName);
+        return aliasFileName ? `${quote}./${aliasFileName}${quote}` : specifier;
+      },
+    );
+    if (rewritten !== source) {
+      const owner = ownership?.chunks[entry.name];
+      // Carry the producer's proof through this exact transformation; never
+      // rehash unknown or independently modified build outputs.
+      if (owner) {
+        if (createHash("sha256").update(source).digest("hex") !== owner.sha256) {
+          throw new Error(
+            `runtime dependency ownership no longer matches ${entry.name}; rebuild dist`,
+          );
+        }
+        owner.sha256 = createHash("sha256").update(rewritten).digest("hex");
+      }
+      writeTextFileIfChanged(filePath, rewritten);
+    }
+  }
+  writeRuntimeDependencyOwnership(rootDir, ownership, fsImpl);
+}
+
+function resolveRootRuntimeCandidateByMarkers(
+  aliasFileName: string,
+  distDir: string,
+  fsImpl: typeof fs,
+  sourceIncludes?: readonly string[],
+) {
+  if (!sourceIncludes?.length) {
+    return null;
+  }
+  const match = aliasFileName.match(ROOT_STABLE_RUNTIME_ALIAS_PATTERN);
+  if (!match) {
+    return null;
+  }
+  const aliasBaseFileName = aliasFileName.replace(/\.js$/u, "");
+  const hashedPattern = new RegExp(
+    `^${escapeRegExp(aliasBaseFileName)}-[A-Za-z0-9_-]+\\.m?js$`,
+    "u",
+  );
+  let entries;
+  try {
+    entries = fsImpl.readdirSync(distDir, { withFileTypes: true });
+  } catch {
+    return null;
+  }
+  const candidates: string[] = [];
+  for (const entry of entries.toSorted((left, right) => left.name.localeCompare(right.name))) {
+    if (!entry.isFile() || !hashedPattern.test(entry.name)) {
+      continue;
+    }
+    const candidatePath = path.join(distDir, entry.name);
+    let source;
+    try {
+      source = fsImpl.readFileSync(candidatePath, "utf8");
+    } catch {
+      continue;
+    }
+    if (sourceIncludes.every((marker) => source.includes(marker))) {
+      candidates.push(entry.name);
+    }
+  }
+  return candidates.length === 1 ? (candidates[0] ?? null) : null;
+}
+
+function resolveLegacyRootRuntimeCompatTarget(
+  legacyFileName: string,
+  aliasFileName: string,
+  distDir: string,
+  fsImpl: typeof fs,
+  sourceIncludes?: readonly string[],
+) {
+  if (aliasFileName && fsImpl.existsSync(path.join(distDir, aliasFileName))) {
+    return aliasFileName;
+  }
+  const match = legacyFileName.match(ROOT_RUNTIME_ALIAS_PATTERN);
+  if (!match?.groups?.base) {
+    return null;
+  }
+  return resolveRootRuntimeCandidateByMarkers(
+    `${match.groups.base}.js`,
+    distDir,
+    fsImpl,
+    sourceIncludes,
+  );
+}
+
+/**
+ * Writes compatibility aliases for shipped hashed runtime chunk names.
+ * @internal Directly tested script implementation detail.
+ */
+export function writeLegacyRootRuntimeCompatAliases(params: RuntimeFsParams = {}) {
+  const rootDir = params.rootDir ?? ROOT;
+  const distDir = path.join(rootDir, "dist");
+  const fsImpl = params.fs ?? fs;
+  const aliases: LegacyRuntimeAlias[] = [
+    ...LEGACY_ROOT_RUNTIME_COMPAT_ALIASES.map(([legacyFileName, aliasFileName]) => ({
+      legacyFileName,
+      aliasFileName,
+    })),
+    ...LEGACY_PLUGIN_INSTALL_RUNTIME_COMPAT_ALIASES,
+  ];
+  for (const entry of aliases) {
+    const { legacyFileName } = entry;
+    const legacyPath = path.join(distDir, legacyFileName);
+    if (fsImpl.existsSync(legacyPath)) {
+      continue;
+    }
+    const targetFileName = resolveLegacyRootRuntimeCompatTarget(
+      legacyFileName,
+      entry.aliasFileName,
+      distDir,
+      fsImpl,
+      entry.sourceIncludes,
+    );
+    if (!targetFileName) {
+      continue;
+    }
+    writeTextFileIfChanged(legacyPath, buildRuntimeAliasSource(targetFileName, distDir, fsImpl));
+  }
+}
+
+/**
+ * Writes small compatibility chunks for old CLI exit imports.
+ * @internal Directly tested script implementation detail.
+ */
+export function writeLegacyCliExitCompatChunks(
+  params: { rootDir?: string; chunks?: LegacyCliExitCompatChunk[] } = {},
+) {
+  const rootDir = params.rootDir ?? ROOT;
+  const chunks = params.chunks ?? LEGACY_CLI_EXIT_COMPAT_CHUNKS;
+  for (const { dest, contents } of chunks) {
+    writeTextFileIfChanged(path.join(rootDir, dest), contents);
+  }
+}
+
+/**
+ * Runs every runtime postbuild phase after the main dist build.
+ */
+export function runRuntimePostBuild(params: RuntimePostBuildParams = {}) {
+  const rootDir = path.resolve(params.rootDir ?? params.cwd ?? params.repoRoot ?? ROOT);
+  const fsImpl = params.fs ?? fs;
+  const phaseParams = { ...params, cwd: rootDir, repoRoot: rootDir, rootDir };
+  // Postbuild phases share both roots. Validate the whole mutation set before
+  // any phase runs so a later unsafe root cannot leave earlier output changed.
+  assertRealOutputRoot(path.join(rootDir, "dist"), { fs: fsImpl });
+  assertRealOutputRoot(path.join(rootDir, "dist-runtime"), { fs: fsImpl });
+  const timingsSetting = params.timings ?? process.env.OPENCLAW_RUNTIME_POSTBUILD_TIMINGS;
+  const timingsEnabled = timingsSetting !== "0" && timingsSetting !== false;
+  // Per-phase lines are debug detail; default output is one summary line so a
+  // routine rebuild does not print nine near-identical timing rows.
+  const perPhaseEnabled = timingsSetting === "verbose" || timingsSetting === true;
+  const phaseTimings: Array<{ label: string; durationMs: number }> = [];
+  const runPhase = <T,>(label: string, action: () => T): T => {
+    const startedAt = performance.now();
+    try {
+      return action();
+    } finally {
+      const durationMs = Math.round(performance.now() - startedAt);
+      phaseTimings.push({ label, durationMs });
+      if (perPhaseEnabled) {
+        console.error(`runtime-postbuild: ${label} completed in ${durationMs}ms`);
+      }
+    }
+  };
+  const logSummary = () => {
+    if (!timingsEnabled || perPhaseEnabled || phaseTimings.length === 0) {
+      return;
+    }
+    const totalMs = phaseTimings.reduce((sum, phase) => sum + phase.durationMs, 0);
+    const slowest = phaseTimings.reduce((max, phase) =>
+      phase.durationMs > max.durationMs ? phase : max,
+    );
+    console.error(
+      `runtime-postbuild: ${phaseTimings.length} phases completed in ${totalMs}ms (slowest: ${slowest.label} ${slowest.durationMs}ms)`,
+    );
+  };
+  runPhase("bundled plugin metadata", () => copyBundledPluginMetadata(phaseParams));
+  runPhase("bundled hook metadata", () => copyHookMetadata(phaseParams));
+  runPhase("official channel catalog", () => writeOfficialChannelCatalog(phaseParams));
+  runPhase("export HTML assets", () => copyExportHtmlTemplates(phaseParams));
+  runPhase("bundled plugin runtime overlay", () => stageBundledPluginRuntime(phaseParams));
+  runPhase("static extension assets", () => {
+    if (!shouldCopyStaticExtensionAssets(phaseParams)) {
+      return;
+    }
+    const assetParams = {
+      ...phaseParams,
+      assets: discoverStaticExtensionAssets(phaseParams),
+    };
+    copyStaticExtensionAssets(assetParams);
+    copyStaticExtensionAssetsToRuntimeOverlay(assetParams);
+  });
+  runPhase("stable root runtime imports", () =>
+    rewriteRootRuntimeImportsToStableAliases(phaseParams),
+  );
+  runPhase("stable root runtime aliases", () => writeStableRootRuntimeAliases(phaseParams));
+  runPhase("legacy root runtime compat aliases", () =>
+    writeLegacyRootRuntimeCompatAliases(phaseParams),
+  );
+  runPhase("legacy CLI exit compat chunks", () => writeLegacyCliExitCompatChunks(phaseParams));
+  runPhase("previous release update compat chunks", () =>
+    writeUpdateCompatibilityChunks({
+      distDir: path.join(rootDir, "dist"),
+      sourceDir: rootDir,
+      inventory: readUpdateCompatibilityInventory(UPDATE_COMPATIBILITY_INVENTORY),
+    }),
+  );
+  runPhase("built plugin control-plane loads", () =>
+    verifyBuiltPluginControlPlaneModules(phaseParams),
+  );
+  // Source runners launch directly after postbuild, without the full UI build's
+  // final metadata step. Publish identity only after the runtime is complete.
+  runPhase("build provenance", () => writeBuildInfo({ rootDir, env: params.env }));
+  logSummary();
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+  await withDistArtifactOwnership(process.cwd(), async () => {
+    runRuntimePostBuild();
+  });
+}
diff --git a/scripts/sandbox-setup.sh b/scripts/sandbox-setup.sh
new file mode 100644
index 0000000000000000000000000000000000000000..cca20386cbbdce6dc604dcc58b5835d73f6d72df
--- /dev/null
+++ b/scripts/sandbox-setup.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# Bash 5.3+ can deadlock writing heredoc pipes on macOS before the reader starts.
+if [[ ${OSTYPE:-} == darwin* && $BASH != /bin/bash ]] && ((BASH_VERSINFO[0] > 5 || (BASH_VERSINFO[0] == 5 && BASH_VERSINFO[1] >= 3))); then
+  exec /bin/bash "$0" "$@"
+fi
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+source "$ROOT_DIR/scripts/lib/docker-build.sh"
+
+IMAGE_NAME="${OPENCLAW_SANDBOX_IMAGE:-openclaw-sandbox:bookworm-slim}"
+
+docker_build_exec -t "${IMAGE_NAME}" -f "$ROOT_DIR/scripts/docker/sandbox/Dockerfile" "$ROOT_DIR"
+echo "Built ${IMAGE_NAME}"
diff --git a/scripts/stage-bundled-plugin-runtime.mjs b/scripts/stage-bundled-plugin-runtime.mjs
new file mode 100644
index 0000000000000000000000000000000000000000..1af1e9828dd5aba016604e6c75371d4e8582c80d
--- /dev/null
+++ b/scripts/stage-bundled-plugin-runtime.mjs
@@ -0,0 +1,5 @@
+import { runTsxCliShim } from "./lib/tsx-cli-shim.mjs";
+
+await runTsxCliShim(import.meta.url, {
+  implementation: "./stage-bundled-plugin-runtime.mts",
+});
diff --git a/scripts/termux-quick-auth.sh b/scripts/termux-quick-auth.sh
new file mode 100644
index 0000000000000000000000000000000000000000..503605dc9b0579e55ef6a4b5b65c988c81322f4f
--- /dev/null
+++ b/scripts/termux-quick-auth.sh
@@ -0,0 +1,30 @@
+#!/data/data/com.termux/files/usr/bin/bash
+# Quick Auth Check - Minimal widget for Termux
+# Place in ~/.shortcuts/ for Termux:Widget
+#
+# One-tap: shows status toast
+# If expired: directly opens auth URL
+
+SERVER="${OPENCLAW_SERVER:-openclaw-host}"
+
+STATUS=$(ssh -o ConnectTimeout=5 "$SERVER" '$HOME/openclaw/scripts/claude-auth-status.sh simple' 2>&1)
+
+case "$STATUS" in
+    OK)
+        termux-toast -s "Auth OK"
+        ;;
+    *EXPIRING*)
+        termux-vibrate -d 100
+        termux-toast "Auth expiring soon - tap again if needed"
+        ;;
+    *EXPIRED*|*MISSING*)
+        termux-vibrate -d 200
+        termux-toast "Auth expired - opening console..."
+        termux-open-url "https://console.anthropic.com/settings/api-keys"
+        sleep 2
+        termux-notification -t "OpenClaw Re-Auth" -c "After getting key, run: ssh $SERVER '~/openclaw/scripts/mobile-reauth.sh'" --id openclaw-auth
+        ;;
+    *)
+        termux-toast "Connection error"
+        ;;
+esac
diff --git a/scripts/test-built-bundled-channel-entry-smoke.mts b/scripts/test-built-bundled-channel-entry-smoke.mts
new file mode 100644
index 0000000000000000000000000000000000000000..36b9c91768124b2b4f9aeb42e0fea55f2929255c
--- /dev/null
+++ b/scripts/test-built-bundled-channel-entry-smoke.mts
@@ -0,0 +1,268 @@
+// Smoke-tests packaged bundled channel entrypoints in source and installed
+// package layouts.
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { collectRootPackageExcludedExtensionDirs } from "./lib/bundled-plugin-build-entries.mjs";
+import { parsePackageRootArg } from "./lib/package-root-args.mts";
+// Keep this prepack smoke independent of workspace package links.
+import { isRecord } from "./lib/record-shared.mjs";
+import { installProcessWarningFilter } from "./process-warning-filter.mts";
+
+installProcessWarningFilter();
+
+process.env.OPENCLAW_DISABLE_BUNDLED_ENTRY_SOURCE_FALLBACK ??= "1";
+
+const { packageRoot } = parsePackageRootArg(
+  process.argv.slice(2),
+  "OPENCLAW_BUNDLED_CHANNEL_SMOKE_ROOT",
+);
+const distExtensionsRoot = path.join(packageRoot, "dist", "extensions");
+const excludedPackageExtensionDirs = collectRootPackageExcludedExtensionDirs({ cwd: packageRoot });
+const installedLayoutEnv = "OPENCLAW_BUNDLED_CHANNEL_SMOKE_INSTALLED_LAYOUT";
+
+type PackageManifest = {
+  files?: unknown;
+  openclaw?: Partial<Record<"channel" | "extensions" | "setupEntry", unknown>>;
+};
+
+type BuiltEntryFile = { id: string; kind: "channel" | "setup"; path: string };
+
+function collectExcludedDistExtensionIds() {
+  const packageJsonPath = path.join(packageRoot, "package.json");
+  if (!fs.existsSync(packageJsonPath)) {
+    return new Set<string>();
+  }
+  const packageJson = readJson(packageJsonPath);
+  const files = Array.isArray(packageJson.files) ? packageJson.files : [];
+  const excludedIds = new Set<string>();
+  for (const entry of files) {
+    if (typeof entry !== "string") {
+      continue;
+    }
+    const match = /^!dist\/extensions\/([^/*]+)\/\*\*$/u.exec(entry.replaceAll("\\", "/"));
+    if (match?.[1]) {
+      excludedIds.add(match[1]);
+    }
+  }
+  return excludedIds;
+}
+
+function packageRootLooksInstalled(root: string) {
+  return root.replaceAll("\\", "/").endsWith("/node_modules/openclaw");
+}
+
+function smokeInInstalledLayout() {
+  const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-channel-entry-smoke-"));
+  const nodeModulesRoot = path.join(tempRoot, "node_modules");
+  const installedPackageRoot = path.join(nodeModulesRoot, "openclaw");
+  try {
+    fs.mkdirSync(installedPackageRoot, { recursive: true });
+    fs.copyFileSync(
+      path.join(packageRoot, "package.json"),
+      path.join(installedPackageRoot, "package.json"),
+    );
+    fs.cpSync(path.join(packageRoot, "dist"), path.join(installedPackageRoot, "dist"), {
+      recursive: true,
+      mode: fs.constants.COPYFILE_FICLONE,
+    });
+    fs.symlinkSync(
+      fs.realpathSync(path.join(packageRoot, "node_modules")),
+      path.join(installedPackageRoot, "node_modules"),
+      process.platform === "win32" ? "junction" : "dir",
+    );
+    const result = spawnSync(
+      process.execPath,
+      [fileURLToPath(import.meta.url), "--package-root", installedPackageRoot],
+      {
+        env: { ...process.env, [installedLayoutEnv]: "1" },
+        stdio: "inherit",
+      },
+    );
+    return result.status ?? 1;
+  } finally {
+    fs.rmSync(tempRoot, { recursive: true, force: true });
+  }
+}
+
+if (process.env[installedLayoutEnv] !== "1" && !packageRootLooksInstalled(packageRoot)) {
+  // Let the layout owner's finally run before terminating this process.
+  process.exit(smokeInInstalledLayout());
+}
+
+async function importBuiltModule(absolutePath: string): Promise<unknown> {
+  const imported: unknown = await import(pathToFileURL(absolutePath).href);
+  assert.ok(isRecord(imported) && "default" in imported);
+  return imported.default;
+}
+
+function readJson(pathname: string): PackageManifest {
+  return JSON.parse(fs.readFileSync(pathname, "utf8"));
+}
+
+function extensionEntryToDistFilename(entry: string) {
+  return entry.replace(/^\.\//u, "").replace(/\.[^.]+$/u, ".js");
+}
+
+function collectBundledChannelEntryFiles() {
+  const files: BuiltEntryFile[] = [];
+  const excludedDistExtensionIds = collectExcludedDistExtensionIds();
+  for (const dirent of fs.readdirSync(distExtensionsRoot, { withFileTypes: true })) {
+    if (!dirent.isDirectory()) {
+      continue;
+    }
+    if (excludedDistExtensionIds.has(dirent.name)) {
+      continue;
+    }
+    const extensionRoot = path.join(distExtensionsRoot, dirent.name);
+    const packageJsonPath = path.join(extensionRoot, "package.json");
+    if (!fs.existsSync(packageJsonPath)) {
+      continue;
+    }
+    const packageJson = readJson(packageJsonPath);
+    if (!packageJson.openclaw?.channel) {
+      continue;
+    }
+    if (excludedPackageExtensionDirs.has(dirent.name)) {
+      continue;
+    }
+
+    const extensionEntries =
+      Array.isArray(packageJson.openclaw.extensions) && packageJson.openclaw.extensions.length > 0
+        ? packageJson.openclaw.extensions
+        : ["./index.ts"];
+    for (const entry of extensionEntries) {
+      if (typeof entry !== "string" || entry.trim().length === 0) {
+        continue;
+      }
+      files.push({
+        id: dirent.name,
+        kind: "channel",
+        path: path.join(extensionRoot, extensionEntryToDistFilename(entry)),
+      });
+    }
+
+    const setupEntry = packageJson.openclaw.setupEntry;
+    if (typeof setupEntry === "string" && setupEntry.trim().length > 0) {
+      files.push({
+        id: dirent.name,
+        kind: "setup",
+        path: path.join(extensionRoot, extensionEntryToDistFilename(setupEntry)),
+      });
+    }
+
+    const channelEntryPath = path.join(extensionRoot, "channel-entry.js");
+    if (fs.existsSync(channelEntryPath)) {
+      files.push({
+        id: dirent.name,
+        kind: "channel",
+        path: channelEntryPath,
+      });
+    }
+  }
+
+  return files.toSorted((left, right) =>
+    `${left.id}:${left.kind}:${left.path}`.localeCompare(`${right.id}:${right.kind}:${right.path}`),
+  );
+}
+
+function assertSecretContractShape(secrets: unknown, context: string) {
+  assert.ok(isRecord(secrets), `${context}: missing secrets contract`);
+  assert.equal(
+    typeof secrets.collectRuntimeConfigAssignments,
+    "function",
+    `${context}: collectRuntimeConfigAssignments must be a function`,
+  );
+  assert.ok(
+    Array.isArray(secrets.secretTargetRegistryEntries),
+    `${context}: secretTargetRegistryEntries must be an array`,
+  );
+}
+
+function assertEntryFileExists(entry: BuiltEntryFile) {
+  assert.ok(
+    fs.existsSync(entry.path),
+    `${entry.id} ${entry.kind} entry missing from packed dist: ${entry.path}`,
+  );
+}
+
+async function smokeChannelEntry(entryFile: BuiltEntryFile) {
+  assertEntryFileExists(entryFile);
+  let entry: unknown;
+  try {
+    entry = await importBuiltModule(entryFile.path);
+  } catch (error) {
+    throw new Error(
+      `${entryFile.id} ${entryFile.kind} entry failed to import ${entryFile.path}: ${error instanceof Error ? error.message : String(error)}`,
+      { cause: error },
+    );
+  }
+  assert.ok(isRecord(entry));
+  assert.equal(entry.kind, "bundled-channel-entry", `${entryFile.id} channel entry kind mismatch`);
+  assert.ok("loadChannelPlugin" in entry && typeof entry.loadChannelPlugin === "function");
+  const plugin = entry.loadChannelPlugin();
+  assert.equal(plugin?.id, entryFile.id, `${entryFile.id} channel plugin failed to load`);
+  if ("loadChannelSecrets" in entry && typeof entry.loadChannelSecrets === "function") {
+    assertSecretContractShape(
+      entry.loadChannelSecrets(),
+      `${entryFile.id} channel entry packaged secrets`,
+    );
+  }
+}
+
+async function smokeSetupEntry(entryFile: BuiltEntryFile) {
+  assertEntryFileExists(entryFile);
+  let entry: unknown;
+  try {
+    entry = await importBuiltModule(entryFile.path);
+  } catch (error) {
+    throw new Error(
+      `${entryFile.id} ${entryFile.kind} entry failed to import ${entryFile.path}: ${error instanceof Error ? error.message : String(error)}`,
+      { cause: error },
+    );
+  }
+  if (!isRecord(entry) || entry.kind !== "bundled-channel-setup-entry") {
+    return false;
+  }
+  assert.equal(
+    entry.kind,
+    "bundled-channel-setup-entry",
+    `${entryFile.id} setup entry kind mismatch`,
+  );
+  assert.ok("loadSetupPlugin" in entry && typeof entry.loadSetupPlugin === "function");
+  const plugin = entry.loadSetupPlugin();
+  assert.equal(plugin?.id, entryFile.id, `${entryFile.id} setup plugin failed to load`);
+  if ("loadSetupSecrets" in entry && typeof entry.loadSetupSecrets === "function") {
+    assertSecretContractShape(
+      entry.loadSetupSecrets(),
+      `${entryFile.id} setup entry packaged secrets`,
+    );
+  }
+  return true;
+}
+
+const entryFiles = collectBundledChannelEntryFiles();
+let channelCount = 0;
+let setupCount = 0;
+let legacySetupCount = 0;
+
+for (const entryFile of entryFiles) {
+  if (entryFile.kind === "channel") {
+    await smokeChannelEntry(entryFile);
+    channelCount += 1;
+    continue;
+  }
+  if (await smokeSetupEntry(entryFile)) {
+    setupCount += 1;
+  } else {
+    legacySetupCount += 1;
+  }
+}
+
+assert.ok(channelCount > 0, "no bundled channel entries found");
+process.stdout.write(
+  `[build-smoke] bundled channel entry smoke passed packageRoot=${packageRoot} channel=${channelCount} setup=${setupCount} legacySetup=${legacySetupCount}\n`,
+);
diff --git a/scripts/test-desktop-resize-real.mts b/scripts/test-desktop-resize-real.mts
new file mode 100644
index 0000000000000000000000000000000000000000..d207e77e3be6347c5993016dbb6bb9222e611a58
--- /dev/null
+++ b/scripts/test-desktop-resize-real.mts
@@ -0,0 +1,750 @@
+import assert from "node:assert/strict";
+import { createHash, randomBytes } from "node:crypto";
+import { access, chmod, mkdir, mkdtemp, readFile, rm, statfs, writeFile } from "node:fs/promises";
+import net from "node:net";
+import { userInfo } from "node:os";
+import path from "node:path";
+import { setTimeout as sleep } from "node:timers/promises";
+import { getFreePort } from "../src/test-utils/ports.ts";
+import { assertPrebuiltUiE2eRuntime } from "../test/vitest/vitest.ui-e2e-prebuilt.global-setup.ts";
+import {
+  type DesktopProofSourceStatus,
+  desktopProofSshdFailure,
+  exportDesktopResizeProof,
+  inspectDesktopSshdRuntimeDirectory,
+  readDesktopProofPhase,
+  readDesktopProofSource,
+  readDesktopProofTestReport,
+  withDesktopProofCleanup,
+} from "./lib/desktop-resize-proof.mts";
+import { hasUnjoinedWork, runManagedCommand } from "./lib/managed-child-process.mts";
+
+const root = process.cwd();
+const output = path.join(root, ".artifacts/control-ui-e2e/real-gateway/desktop-resize");
+const packages = [
+  "tigervnc-standalone-server",
+  "tigervnc-tools",
+  "xauth",
+  "openbox",
+  "xterm",
+  "xdotool",
+  "x11-xserver-utils",
+  "x11-utils",
+  "procps",
+  "fonts-dejavu-core",
+];
+const sha256 = (bytes: Buffer | string) => createHash("sha256").update(bytes).digest("hex");
+const lifetime = new AbortController();
+const receipt = {
+  complete: false,
+  phase: "preflight",
+  failureCode: null as string | null,
+  startedAt: new Date().toISOString(),
+  provisioning:
+    "Upstream Ubuntu packages and synthetic worker records; not Crabbox installer or cloud provisioning proof",
+  source: null as Awaited<ReturnType<typeof readDesktopProofSource>> | null,
+  sourceStatus: null as DesktopProofSourceStatus | null,
+  workflowSha: process.env.DESKTOP_PROOF_WORKFLOW_SHA ?? null,
+  runId: process.env.GITHUB_RUN_ID ?? null,
+  runAttempt: process.env.GITHUB_RUN_ATTEMPT ?? null,
+  nodeVersion: process.version,
+  architecture: process.arch,
+  initialFreeBytes: 0,
+  prebuiltGeneration: "",
+  preinstalledSsh: {
+    serverVersion: "",
+    serverBinarySha256: "",
+    runtimeDirectory: null as Awaited<ReturnType<typeof inspectDesktopSshdRuntimeDirectory>> | null,
+    configFailure: null as ReturnType<typeof desktopProofSshdFailure> | null,
+  },
+  provenance: {
+    kind: "upstream-os" as const,
+    osRelease: "",
+    packageOrigin:
+      "Observed runner APT metadata and dpkg versions; archive origin not independently qualified",
+    packages: [] as Array<{ name: string; version: string; sha256: string }>,
+    serverBinarySha256: "",
+  },
+  commands: [] as Array<{ label: string; exitCode: number | null; elapsedMs: number }>,
+  carriers: [] as string[],
+  testDiagnostics: [] as Array<{
+    carrier: "node" | "ssh";
+    status: "pending" | "available" | "missing" | "invalid";
+    report: Awaited<ReturnType<typeof readDesktopProofTestReport>> | null;
+    checkpoint: Awaited<ReturnType<typeof readDesktopProofPhase>>;
+  }>,
+  cleanup: {
+    joined: false,
+    unjoinedWork: false,
+    testOwnersClosed: true,
+    listenersClosed: false,
+    privateFixtureRemoved: false,
+  },
+};
+let privateRoot: string;
+let sshd:
+  | { pid: number; config: string; stop: (before?: () => Promise<void>) => Promise<void> }
+  | undefined;
+const daemons: Array<() => Promise<void>> = [];
+const ports: number[] = [];
+const artifactBudget = { entries: 0, bytes: 0 };
+const saveReceipt = () =>
+  writeFile(path.join(output, "receipt.json"), `${JSON.stringify(receipt, null, 2)}\n`);
+
+function recordFailure(error: unknown) {
+  // Record at the child owner, before another error can mask failed process-tree cleanup.
+  receipt.cleanup.unjoinedWork ||= hasUnjoinedWork(error);
+  if (receipt.cleanup.unjoinedWork) {
+    receipt.cleanup.joined = false;
+  }
+  const code = error instanceof Error && "code" in error ? error.code : undefined;
+  const known = ["ENOSPC", "ENOENT", "EACCES", "ETIMEDOUT", "ABORT_ERR", "ERR_ASSERTION"];
+  receipt.failureCode = receipt.cleanup.unjoinedWork
+    ? "EPROCESSGROUP_CLEANUP_FAILED"
+    : (receipt.failureCode ??
+      (typeof code === "string" && known.includes(code) ? code : "FIXTURE_OR_EVIDENCE_FAILURE"));
+}
+
+async function requireSpace(minimumGiB: number) {
+  const disk = await statfs(root);
+  const available = disk.bavail * disk.bsize;
+  assert(available >= minimumGiB * 1024 ** 3, `Desktop proof requires ${minimumGiB} GiB free`);
+  return available;
+}
+
+async function run(
+  label: string,
+  bin: string,
+  args: string[],
+  options: { env?: NodeJS.ProcessEnv; input?: string; timeoutMs?: number; cleanup?: boolean } = {},
+) {
+  if (!options.cleanup) {
+    lifetime.signal.throwIfAborted();
+  }
+  receipt.phase = label;
+  console.log(`[desktop-resize-proof] ${label}`);
+  const cap = new AbortController();
+  const stdout: Buffer[] = [];
+  const stderr: Buffer[] = [];
+  const log: Buffer[] = [];
+  let bytes = 0;
+  let exitCode: number | null = null;
+  const started = Date.now();
+  return withDesktopProofCleanup(
+    async () => {
+      exitCode = await runManagedCommand({
+        bin,
+        args,
+        cwd: root,
+        env: {
+          ...process.env,
+          GIT_OPTIONAL_LOCKS: "0",
+          GIT_NO_LAZY_FETCH: "1",
+          GIT_NO_REPLACE_OBJECTS: "1",
+          ...options.env,
+        },
+        stdio: [options.input === undefined ? "ignore" : "pipe", "pipe", "pipe"],
+        timeoutMs: options.timeoutMs ?? 30_000,
+        signal: options.cleanup ? cap.signal : AbortSignal.any([lifetime.signal, cap.signal]),
+        requireProcessTreeExit: true,
+        onReady(child) {
+          const append = (data: Buffer, target?: Buffer[]) => {
+            bytes += data.length;
+            if (bytes > 8 * 1024 ** 2) {
+              cap.abort();
+            } else {
+              log.push(data);
+              target?.push(data);
+            }
+          };
+          child.stdout!.on("data", (data: Buffer) => append(data, stdout));
+          child.stderr!.on("data", (data: Buffer) => append(data, stderr));
+          child.stdin?.end(options.input);
+        },
+      });
+      assert.equal(exitCode, 0, `${label} failed`);
+      return Buffer.concat(stdout);
+    },
+    async () => {
+      receipt.commands.push({ label, exitCode, elapsedMs: Date.now() - started });
+      await withDesktopProofCleanup(
+        async () => {
+          if (label === "sshd-config" && exitCode !== 0) {
+            receipt.preinstalledSsh.configFailure = desktopProofSshdFailure(
+              Buffer.concat(stderr).toString(),
+            );
+          }
+        },
+        async () => {
+          if (privateRoot) {
+            await writeFile(path.join(privateRoot, `${label}.log`), Buffer.concat(log), {
+              mode: 0o600,
+            });
+          }
+          await saveReceipt();
+        },
+        recordFailure,
+      );
+    },
+    recordFailure,
+  );
+}
+
+function daemon(label: string, bin: string, args: string[], env: NodeJS.ProcessEnv = {}) {
+  const stop = new AbortController();
+  let stopping = false;
+  let bytes = 0;
+  const log: Buffer[] = [];
+  const completion = withDesktopProofCleanup(
+    () =>
+      runManagedCommand({
+        bin,
+        args,
+        cwd: root,
+        env: { ...process.env, ...env },
+        stdio: ["ignore", "pipe", "pipe"],
+        signal: stop.signal,
+        requireProcessTreeExit: true,
+        onReady(child) {
+          const append = (data: Buffer) => {
+            bytes += data.length;
+            if (bytes > 4 * 1024 ** 2) {
+              lifetime.abort();
+            } else {
+              log.push(data);
+            }
+          };
+          child.stdout!.on("data", append);
+          child.stderr!.on("data", append);
+        },
+      }).then(
+        () => {
+          if (!stopping) {
+            throw new Error(`${label} exited early`);
+          }
+        },
+        (error: unknown) => {
+          if (
+            !stopping ||
+            !(error instanceof Error) ||
+            !("code" in error) ||
+            error.code !== "ABORT_ERR"
+          ) {
+            throw error;
+          }
+        },
+      ),
+    () => writeFile(path.join(privateRoot, `${label}.log`), Buffer.concat(log), { mode: 0o600 }),
+    recordFailure,
+  );
+  void completion.catch(() => lifetime.abort());
+  return async (before?: () => Promise<void>) => {
+    stopping = true;
+    await withDesktopProofCleanup(
+      async () => {
+        await before?.();
+      },
+      async () => {
+        stop.abort();
+        await completion;
+      },
+      recordFailure,
+    );
+  };
+}
+
+async function tcpReady(port: number) {
+  return new Promise<boolean>((resolve) => {
+    const socket = net.connect({ host: "127.0.0.1", port });
+    const finish = (ready: boolean) => {
+      socket.destroy();
+      resolve(ready);
+    };
+    socket.once("connect", () => finish(true));
+    socket.once("error", () => finish(false));
+    socket.setTimeout(500, () => finish(false));
+  });
+}
+
+async function waitFor(test: () => Promise<boolean>, cleanup = false) {
+  const deadline = Date.now() + 20_000;
+  while (Date.now() < deadline) {
+    if (!cleanup) {
+      lifetime.signal.throwIfAborted();
+    }
+    if (await test()) {
+      return;
+    }
+    await sleep(100);
+  }
+  throw new Error("Desktop fixture readiness deadline exceeded");
+}
+
+async function sourceIdentity() {
+  const source = await readDesktopProofSource(
+    (label, args) => run(label, "git", args),
+    {
+      checkout: process.env.DESKTOP_PROOF_CHECKOUT_SHA ?? "",
+      head: process.env.DESKTOP_PROOF_PR_HEAD_SHA,
+      base: process.env.DESKTOP_PROOF_PR_BASE_SHA,
+    },
+    (status) => {
+      receipt.sourceStatus = status;
+    },
+  );
+  if (receipt.source) {
+    assert.deepEqual(source, receipt.source);
+  }
+  return source;
+}
+
+async function main() {
+  await mkdir(path.dirname(output), { recursive: true });
+  await mkdir(output);
+  await saveReceipt();
+  const interrupt = () => lifetime.abort();
+  const signals = ["SIGINT", "SIGTERM", "SIGHUP"] as const;
+  for (const signal of signals) {
+    process.once(signal, interrupt);
+  }
+  const deadline = setTimeout(interrupt, 12 * 60_000);
+  const watchdog = setInterval(() => void requireSpace(5).catch(interrupt), 10_000);
+  let failure: unknown;
+  try {
+    assert.equal(process.platform, "linux");
+    assert(process.env.RUNNER_TEMP, "RUNNER_TEMP is required");
+    assert.notEqual(process.getuid!(), 0, "Run the proof as the CI job user");
+    assert.match(receipt.workflowSha ?? "", /^[a-f0-9]{40}$/u);
+    assert.match(receipt.runId ?? "", /^\d+$/u);
+    assert.match(receipt.runAttempt ?? "", /^\d+$/u);
+    receipt.initialFreeBytes = await requireSpace(15);
+    privateRoot = await mkdtemp(path.join(process.env.RUNNER_TEMP, "desktop-resize-"));
+    await chmod(privateRoot, 0o700);
+    receipt.source = await sourceIdentity();
+    receipt.prebuiltGeneration = assertPrebuiltUiE2eRuntime(root);
+    const osRelease = await readFile("/etc/os-release", "utf8");
+    assert.match(osRelease, /^ID=ubuntu$/mu);
+    receipt.provenance.osRelease = /^PRETTY_NAME="([^"]+)"$/mu.exec(osRelease)![1]!;
+    await access("/usr/sbin/sshd");
+    await access("/usr/bin/ssh");
+    receipt.preinstalledSsh.serverVersion = (
+      await run("sshd-package", "dpkg-query", ["-W", "-f=${Version}", "openssh-server"])
+    )
+      .toString()
+      .trim();
+    receipt.preinstalledSsh.serverBinarySha256 = sha256(await readFile("/usr/sbin/sshd"));
+    await run("apt-update", "sudo", ["-n", "apt-get", "update"], { timeoutMs: 180_000 });
+    await run(
+      "apt-install",
+      "sudo",
+      [
+        "-n",
+        "env",
+        "DEBIAN_FRONTEND=noninteractive",
+        "apt-get",
+        "install",
+        "-y",
+        "--no-install-recommends",
+        ...packages,
+      ],
+      { timeoutMs: 300_000 },
+    );
+    for (const name of packages) {
+      const version = (await run(`version-${name}`, "dpkg-query", ["-W", "-f=${Version}", name]))
+        .toString()
+        .trim();
+      const metadata = (
+        await run(`archive-${name}`, "apt-cache", ["show", `${name}=${version}`])
+      ).toString();
+      const hash = /^SHA256: ([a-f0-9]{64})$/mu.exec(metadata)?.[1];
+      assert(hash, `Missing APT metadata hash for ${name}`);
+      receipt.provenance.packages.push({ name, version, sha256: hash });
+    }
+    receipt.provenance.serverBinarySha256 = sha256(await readFile("/usr/bin/Xtigervnc"));
+    const authority = path.join(privateRoot, "Xauthority");
+    const passwordFile = path.join(privateRoot, "vnc-password");
+    const encodedPassword = path.join(privateRoot, "vnc-password-encoded");
+    const password = randomBytes(6).toString("hex").slice(0, 8);
+    await writeFile(passwordFile, password, { mode: 0o600 });
+    await writeFile(
+      encodedPassword,
+      await run("vnc-password", "tigervncpasswd", ["-f"], { input: `${password}\n` }),
+      { mode: 0o600 },
+    );
+    await writeFile(authority, "", { mode: 0o600 });
+    for (const display of [99, 100]) {
+      for (const file of [`/tmp/.X${display}-lock`, `/tmp/.X11-unix/X${display}`]) {
+        await assert.rejects(access(file), { code: "ENOENT" });
+      }
+      const port = 5900 + display;
+      assert.equal(await tcpReady(port), false, "Desktop fixture port is already occupied");
+      ports.push(port);
+      await run(`xauth-${display}`, "xauth", [
+        "-f",
+        authority,
+        "add",
+        `:${display}`,
+        ".",
+        randomBytes(16).toString("hex"),
+      ]);
+      daemons.push(
+        daemon(`vnc-${display}`, "Xtigervnc", [
+          `:${display}`,
+          "-auth",
+          authority,
+          "-rfbport",
+          String(port),
+          "-geometry",
+          "1920x1080",
+          "-depth",
+          "24",
+          "-localhost",
+          "yes",
+          "-SecurityTypes",
+          "VncAuth",
+          "-PasswordFile",
+          encodedPassword,
+          "-AlwaysShared",
+          "-AcceptSetDesktopSize",
+          display === 99 ? "1" : "0",
+          "-nolisten",
+          "tcp",
+          "-desktop",
+          "OpenClaw resize proof",
+        ]),
+      );
+      await waitFor(() => tcpReady(port));
+      const home = path.join(privateRoot, `desktop-${display}`);
+      await mkdir(home, { mode: 0o700 });
+      const env = {
+        DISPLAY: `:${display}`,
+        XAUTHORITY: authority,
+        HOME: home,
+        XDG_CONFIG_HOME: path.join(home, ".config"),
+        XDG_CACHE_HOME: path.join(home, ".cache"),
+        XDG_RUNTIME_DIR: home,
+      };
+      // Plain Openbox has no session autostart; authentication agents would escape
+      // process-group ownership. The fixture needs only a foreground WM and xterm.
+      daemons.push(daemon(`wm-${display}`, "openbox", ["--sm-disable"], env));
+      await waitFor(async () =>
+        /0x[1-9a-f][a-f0-9]*/iu.test(
+          (
+            await run(`wm-${display}`, "xprop", ["-root", "_NET_SUPPORTING_WM_CHECK"], { env })
+          ).toString(),
+        ),
+      );
+      daemons.push(
+        daemon(
+          `terminal-${display}`,
+          "xterm",
+          [
+            "-title",
+            "OpenClaw resize proof",
+            "-geometry",
+            "100x30+0+0",
+            "-fa",
+            "DejaVu Sans Mono",
+            "-fs",
+            "14",
+            "-e",
+            "bash",
+            "--noprofile",
+            "--norc",
+          ],
+          { ...env, PS1: "proof$ ", HISTFILE: "/dev/null" },
+        ),
+      );
+    }
+    const identity = path.join(privateRoot, "identity");
+    const hostKey = path.join(privateRoot, "host-key");
+    for (const file of [identity, hostKey]) {
+      await run(`key-${path.basename(file)}`, "ssh-keygen", [
+        "-q",
+        "-t",
+        "ed25519",
+        "-N",
+        "",
+        "-C",
+        "desktop-resize-proof",
+        "-f",
+        file,
+      ]);
+    }
+    const publicKey = async (file: string) =>
+      (await readFile(`${file}.pub`, "utf8")).trim().split(/\s+/u).slice(0, 2).join(" ");
+    const authorized = path.join(privateRoot, "authorized-keys");
+    await writeFile(authorized, `${await publicKey(identity)}\n`, { mode: 0o600 });
+    const sshPort = await getFreePort();
+    ports.push(sshPort);
+    const config = path.join(privateRoot, "sshd_config");
+    const pidFile = path.join(privateRoot, "sshd.pid");
+    const user = userInfo().username;
+    await writeFile(
+      config,
+      [
+        `Port ${sshPort}`,
+        "ListenAddress 127.0.0.1",
+        `HostKey ${hostKey}`,
+        `PidFile ${pidFile}`,
+        `AuthorizedKeysFile ${authorized}`,
+        `AllowUsers ${user}`,
+        "AuthenticationMethods publickey",
+        "PubkeyAuthentication yes",
+        "PasswordAuthentication no",
+        "KbdInteractiveAuthentication no",
+        "PermitEmptyPasswords no",
+        "PermitRootLogin no",
+        "UsePAM yes",
+        "StrictModes no",
+        "AllowTcpForwarding local",
+        "GatewayPorts no",
+        "X11Forwarding no",
+        "PermitTunnel no",
+        "PrintMotd no",
+        "LogLevel ERROR",
+        "",
+      ].join("\n"),
+      { mode: 0o600 },
+    );
+    // Ubuntu compiles this privsep path; direct sshd does not create the service runtime directory.
+    await run("sshd-runtime-directory", "sudo", [
+      "-n",
+      "/bin/mkdir",
+      "-p",
+      "-m",
+      "0755",
+      "/run/sshd",
+    ]);
+    receipt.preinstalledSsh.runtimeDirectory =
+      await inspectDesktopSshdRuntimeDirectory("/run/sshd");
+    await run("sshd-config", "sudo", ["-n", "/usr/sbin/sshd", "-t", "-f", config]);
+    const stop = daemon("sshd", "sudo", ["-n", "/usr/sbin/sshd", "-D", "-e", "-f", config]);
+    // Register teardown before readiness: a failed bootstrap still owns its child.
+    sshd = { pid: 0, config, stop };
+    await waitFor(() => tcpReady(sshPort));
+    sshd.pid = Number((await readFile(pidFile, "utf8")).trim());
+    assert(Number.isSafeInteger(sshd.pid) && sshd.pid > 1);
+    const fixture = {
+      ssh: {
+        host: "127.0.0.1",
+        port: sshPort,
+        user,
+        hostKey: await publicKey(hostKey),
+        keyRef: { source: "env", provider: "default", id: "DESKTOP_PROOF_KEY" },
+      },
+      identityPath: identity,
+      xauthorityPath: authority,
+      desktop: { protocol: "rfb", port: 5999, passwordFilePath: passwordFile },
+      fixedDesktop: { protocol: "rfb", port: 6000, passwordFilePath: passwordFile },
+      provenance: receipt.provenance,
+      controlUiRoot: path.join(root, "dist/control-ui"),
+    };
+    for (const carrier of ["node", "ssh"] as const) {
+      const raw = path.join(privateRoot, carrier);
+      await mkdir(raw);
+      const fixtureFile = path.join(privateRoot, `${carrier}.json`);
+      const reportFile = path.join(privateRoot, `${carrier}-vitest.json`);
+      const diagnosticDirectory = path.join(privateRoot, `${carrier}-diagnostics`);
+      await mkdir(diagnosticDirectory, { mode: 0o700 });
+      const diagnostic: (typeof receipt.testDiagnostics)[number] = {
+        carrier,
+        status: "pending",
+        report: null,
+        checkpoint: {
+          status: "unavailable",
+          lastObservedPhase: null,
+          owners: null,
+        },
+      };
+      receipt.testDiagnostics.push(diagnostic);
+      receipt.cleanup.testOwnersClosed = false;
+      await writeFile(fixtureFile, JSON.stringify({ ...fixture, carrier }), { mode: 0o600 });
+      await withDesktopProofCleanup(
+        async () => {
+          await run(
+            `test-${carrier}`,
+            process.execPath,
+            [
+              "scripts/run-vitest.mjs",
+              "run",
+              "--config",
+              "test/vitest/vitest.ui-e2e-prebuilt.config.ts",
+              "--configLoader",
+              "runner",
+              "--reporter=json",
+              "--outputFile",
+              reportFile,
+              "--includeTaskLocation",
+              "ui/src/e2e/desktop-resize.real-gateway.e2e.test.ts",
+            ],
+            {
+              timeoutMs: 240_000,
+              env: {
+                OPENCLAW_DESKTOP_REAL_FIXTURE: fixtureFile,
+                OPENCLAW_UI_E2E_ARTIFACT_DIR: raw,
+                OPENCLAW_UI_E2E_DIAGNOSTIC_DIR: diagnosticDirectory,
+              },
+            },
+          );
+        },
+        () =>
+          withDesktopProofCleanup(
+            async () => {
+              // Terminal JSON may be absent after process termination; collect this independently.
+              diagnostic.checkpoint = await readDesktopProofPhase(
+                path.join(diagnosticDirectory, "desktop-phase.json"),
+              );
+              // The Gateway owns a detached group; joining Vitest alone cannot retire it.
+              const owners = diagnostic.checkpoint.owners;
+              const ownersClosed =
+                owners !== null && owners.gateway !== "owned" && owners.endpointTap !== "owned";
+              receipt.cleanup.testOwnersClosed = receipt.testDiagnostics.every(
+                ({ checkpoint }) =>
+                  checkpoint.owners !== null &&
+                  checkpoint.owners.gateway !== "owned" &&
+                  checkpoint.owners.endpointTap !== "owned",
+              );
+              try {
+                diagnostic.report = await readDesktopProofTestReport(reportFile);
+                diagnostic.status = "available";
+              } catch (error) {
+                diagnostic.status =
+                  error instanceof Error && "code" in error && error.code === "ENOENT"
+                    ? "missing"
+                    : "invalid";
+                throw error;
+              }
+              assert.equal(diagnostic.checkpoint.status, "available");
+              assert(ownersClosed, "Desktop child resource cleanup is unverified");
+              assert.deepEqual(owners, { gateway: "closed", endpointTap: "closed" });
+            },
+            async () => {
+              const exported = await exportDesktopResizeProof(
+                raw,
+                path.join(output, carrier),
+                carrier,
+                artifactBudget,
+              );
+              if (exported.proof) {
+                for (const [name, hash] of Object.entries(exported.proof.assets)) {
+                  assert.equal(
+                    sha256(await readFile(path.join(root, "dist/control-ui/assets", name))),
+                    hash,
+                  );
+                }
+              }
+              assert(
+                exported.complete,
+                `Incomplete ${carrier} desktop proof (including a skipped test)`,
+              );
+            },
+            recordFailure,
+          ),
+        recordFailure,
+      );
+      await sourceIdentity();
+      assert.equal(assertPrebuiltUiE2eRuntime(root), receipt.prebuiltGeneration);
+      receipt.carriers.push(carrier);
+    }
+  } catch (error) {
+    recordFailure(error);
+    failure = error;
+  } finally {
+    clearInterval(watchdog);
+    clearTimeout(deadline);
+    const failedPhase = failure ? receipt.phase : null;
+    const cleanupErrors: unknown[] = [];
+    if (sshd) {
+      try {
+        const owned = sshd;
+        await owned.stop(async () => {
+          if (!owned.pid) {
+            owned.pid = Number((await readFile(path.join(privateRoot, "sshd.pid"), "utf8")).trim());
+          }
+          assert(Number.isSafeInteger(owned.pid) && owned.pid > 1);
+          assert.equal(
+            (
+              await run("sshd-executable", "sudo", ["-n", "readlink", `/proc/${owned.pid}/exe`], {
+                cleanup: true,
+              })
+            )
+              .toString()
+              .trim(),
+            "/usr/sbin/sshd",
+          );
+          const command = (
+            await run("sshd-owner", "sudo", ["-n", "cat", `/proc/${owned.pid}/cmdline`], {
+              cleanup: true,
+            })
+          )
+            .toString()
+            .replaceAll("\0", " ");
+          assert(command.includes(`-f ${owned.config}`), "Private sshd ownership changed");
+          await run("stop-sshd", "sudo", ["-n", "/bin/kill", "-TERM", String(owned.pid)], {
+            cleanup: true,
+          });
+        });
+      } catch (error) {
+        cleanupErrors.push(error);
+      }
+    }
+    for (const stop of daemons.toReversed()) {
+      try {
+        await stop();
+      } catch (error) {
+        cleanupErrors.push(error);
+      }
+    }
+    try {
+      await waitFor(
+        async () => (await Promise.all(ports.map(tcpReady))).every((ready) => !ready),
+        true,
+      );
+      receipt.cleanup.listenersClosed = true;
+    } catch (error) {
+      cleanupErrors.push(error);
+    }
+    for (const error of cleanupErrors) {
+      recordFailure(error);
+    }
+    receipt.cleanup.joined =
+      cleanupErrors.length === 0 &&
+      !receipt.cleanup.unjoinedWork &&
+      receipt.cleanup.testOwnersClosed;
+    if (!failure && receipt.cleanup.joined) {
+      try {
+        await sourceIdentity();
+        assert.equal(assertPrebuiltUiE2eRuntime(root), receipt.prebuiltGeneration);
+        assert.deepEqual(receipt.carriers, ["node", "ssh"]);
+        receipt.complete = true;
+      } catch (error) {
+        recordFailure(error);
+        failure = error;
+      }
+    }
+    if (!failure && receipt.cleanup.joined && privateRoot) {
+      try {
+        await rm(privateRoot, { recursive: true });
+        receipt.cleanup.privateFixtureRemoved = true;
+      } catch (error) {
+        recordFailure(error);
+        receipt.complete = false;
+      }
+    }
+    receipt.phase = failedPhase ?? (receipt.complete ? "complete" : "cleanup");
+    await saveReceipt();
+    for (const signal of signals) {
+      process.removeListener(signal, interrupt);
+    }
+  }
+  if (!receipt.complete) {
+    throw new Error(`Desktop proof incomplete at ${receipt.phase}`);
+  }
+}
+
+await main().catch((error: unknown) => {
+  console.error(error instanceof Error ? error.message : "Desktop proof failed");
+  console.error("[desktop-resize-proof] FAILED (exit 1)");
+  process.exitCode = 1;
+});
diff --git a/scripts/test-docker-all.mts b/scripts/test-docker-all.mts
new file mode 100644
index 0000000000000000000000000000000000000000..95b8da4fec06b6b085dd9b24dffa4a626ed9def3
--- /dev/null
+++ b/scripts/test-docker-all.mts
@@ -0,0 +1,2151 @@
+// Docker E2E aggregate scheduler.
+// Builds shared Docker images, prepares one OpenClaw npm tarball, assigns lanes
+// to bare/functional images, and runs lanes through weighted resource pools.
+
+import assert from "node:assert/strict";
+import { execFileSync, spawn, type ChildProcess } from "node:child_process";
+import fs from "node:fs";
+import { mkdir, open, readFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { isRecord } from "@openclaw/normalization-core/record-coerce";
+import {
+  DEFAULT_E2E_BARE_IMAGE,
+  DEFAULT_E2E_FUNCTIONAL_IMAGE,
+  DEFAULT_LIVE_RETRIES,
+  DEFAULT_PARALLELISM,
+  DEFAULT_PROFILE,
+  DEFAULT_RESOURCE_LIMITS,
+  DEFAULT_TAIL_PARALLELISM,
+  RELEASE_PATH_PROFILE,
+  findLaneByName,
+  laneResources,
+  laneSummary,
+  laneWeight,
+  lanesNeedE2eImageKind,
+  lanesNeedOpenClawPackage,
+  normalizeReleaseProfile,
+  parseLaneSelection,
+  parseLiveMode,
+  parseProfile,
+  resolveDockerE2ePlan,
+} from "./lib/docker-e2e-plan.mts";
+import { liveDockerScriptCommand, type DockerE2eLane } from "./lib/docker-e2e-scenarios.mts";
+import {
+  inspectManagedProcessGroup,
+  terminateManagedChild,
+  waitForManagedProcessGroupExit,
+} from "./lib/managed-child-process.mts";
+import { sleep } from "./lib/sleep.mjs";
+import {
+  createPrepublishPluginRegistryArtifact,
+  inspectNpmPackageTarball,
+  validatePrepublishPluginRegistryArtifact,
+} from "./prepublish-plugin-registry-artifact.mjs";
+
+const SCRIPT_ROOT_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const ROOT_DIR = path.resolve(process.env.OPENCLAW_DOCKER_E2E_REPO_ROOT || SCRIPT_ROOT_DIR);
+const HARNESS_ROOT_DIR = path.resolve(
+  ROOT_DIR,
+  process.env.OPENCLAW_DOCKER_E2E_TRUSTED_HARNESS_DIR || SCRIPT_ROOT_DIR,
+);
+const DEFAULT_FAILURE_TAIL_LINES = 80;
+const DEFAULT_LANE_TIMEOUT_MS = 120 * 60 * 1000;
+const DEFAULT_LANE_START_STAGGER_MS = 2_000;
+const DEFAULT_STATUS_INTERVAL_MS = 30_000;
+const DEFAULT_PREFLIGHT_RUN_TIMEOUT_MS = 60_000;
+const CLEANUP_SMOKE_NAME = "cleanup-smoke";
+export const SHELL_CAPTURE_MAX_CHARS = 1024 * 1024;
+export const LOG_TAIL_MAX_BYTES = 1024 * 1024;
+const SHELL_TIMEOUT_KILL_GRACE_MS = 10_000;
+const SHELL_POST_FORCE_KILL_WAIT_MS = 1_000;
+const MAX_TIMER_TIMEOUT_MS = 2_147_000_000;
+const DEFAULT_TIMINGS_FILE = path.join(ROOT_DIR, ".artifacts/docker-tests/lane-timings.json");
+const DEFAULT_GITHUB_WORKFLOW = "openclaw-live-and-e2e-checks-reusable.yml";
+const CANDIDATE_ENV_KEYS =
+  "OPENCLAW_DOCKER_E2E_SELECTED_SHA OPENCLAW_CURRENT_PACKAGE_TGZ OPENCLAW_CURRENT_PACKAGE_VERSION OPENCLAW_CURRENT_PACKAGE_SHA256".split(
+    " ",
+  );
+const REGISTRY_ENV_KEYS =
+  "OPENCLAW_PREPUBLISH_PLUGIN_REGISTRY_DIR OPENCLAW_PREPUBLISH_PLUGIN_REGISTRY_CANDIDATE_VERSION OPENCLAW_PREPUBLISH_PLUGIN_REGISTRY_MANIFEST_SHA256".split(
+    " ",
+  );
+
+type SchedulerLimits = ReturnType<typeof parseSchedulerOptions>;
+type DockerCandidatePlan = ReturnType<typeof resolveDockerE2ePlan>["plan"];
+
+type SchedulerActiveState = {
+  count: number;
+  resources: Map<string, number>;
+  weight: number;
+};
+
+type SchedulerLane = Pick<DockerE2eLane, "name"> &
+  Partial<Pick<DockerE2eLane, "resources" | "weight">>;
+
+type TimingStore = Awaited<ReturnType<typeof loadTimingStore>>;
+
+type ShellCommandResult = Omit<ReturnType<typeof shellCommandSkippedForShutdown>, "signal"> & {
+  signal: ChildProcess["signalCode"];
+};
+type ShellCaptureResult = Omit<ReturnType<typeof shellCaptureSkippedForShutdown>, "signal"> & {
+  signal: ChildProcess["signalCode"];
+};
+
+type ShellCommandOptions = {
+  command: string;
+  env: NodeJS.ProcessEnv;
+  label: string;
+  logFile?: string;
+  noOutputTimeoutMs?: number;
+  timeoutKillGraceMs?: number;
+  timeoutMs?: number;
+};
+
+type ShellCaptureOptions = Omit<ShellCommandOptions, "logFile" | "noOutputTimeoutMs"> &
+  Required<Pick<ShellCommandOptions, "timeoutMs">>;
+
+type LaneResult = Omit<Awaited<ReturnType<typeof runLane>>, "imageKind"> & {
+  imageKind?: DockerE2eLane["e2eImageKind"];
+  targetable?: boolean;
+};
+
+type RunLaneSummary = Pick<LaneResult, "name" | "status"> & Partial<LaneResult>;
+
+type RunSummary = Record<string, unknown> & {
+  failures?: RunLaneSummary[];
+  github?: ReturnType<typeof githubRunSummary>;
+  images?: { bare?: string; functional?: string };
+  lanes?: RunLaneSummary[];
+  status?: string;
+};
+
+type LanePoolOptions = SchedulerLimits & {
+  failFast: boolean;
+  poolLabel: string;
+  startStaggerMs: number;
+  statusIntervalMs: number;
+  timeoutMs: number;
+};
+
+type ForegroundEntry = {
+  command: string;
+  env?: NodeJS.ProcessEnv;
+  label: string;
+  phaseDetails?: Record<string, unknown>;
+  phases?: Array<Record<string, unknown>>;
+};
+
+type ShutdownSignal = "SIGINT" | "SIGKILL" | "SIGTERM";
+
+const IS_MAIN = (() => {
+  const entrypoint = process.argv[1];
+  if (!entrypoint) {
+    return false;
+  }
+  try {
+    // Node resolves ESM URLs through symlinks, but argv keeps the invoked path.
+    return fs.realpathSync(entrypoint) === fs.realpathSync(fileURLToPath(import.meta.url));
+  } catch {
+    return false;
+  }
+})();
+
+function dockerAllUsage() {
+  return [
+    "Usage: node scripts/test-docker-all.mjs [--plan-json | --prepare-only=<manifest> | --prepare-plugin-registry]",
+    "",
+    "Options:",
+    "  --plan-json              Print the resolved Docker E2E plan as JSON and exit.",
+    "  --prepare-only=<manifest> Prepare one immutable candidate manifest and exit.",
+    "  --prepare-plugin-registry Prepare only the selected lanes' plugin registry.",
+    "  -h, --help               Show this help.",
+    "",
+    "Lane selection and scheduler settings are configured with OPENCLAW_DOCKER_ALL_* env vars.",
+  ].join("\n");
+}
+
+export function parseDockerAllCliArgs(argv: readonly string[]) {
+  const options: {
+    help: boolean;
+    planJson: boolean;
+    prepareOnly?: string;
+    preparePluginRegistry: boolean;
+  } = {
+    help: false,
+    planJson: false,
+    preparePluginRegistry: false,
+  };
+  for (const arg of argv) {
+    if (arg === "--plan-json") {
+      options.planJson = true;
+    } else if (arg.startsWith("--prepare-only=")) {
+      options.prepareOnly = arg.slice("--prepare-only=".length);
+      if (!options.prepareOnly) {
+        throw new Error(`--prepare-only requires a manifest path\n\n${dockerAllUsage()}`);
+      }
+    } else if (arg === "--prepare-plugin-registry") {
+      options.preparePluginRegistry = true;
+    } else if (arg === "--help" || arg === "-h") {
+      options.help = true;
+    } else {
+      throw new Error(`unknown argument: ${arg}\n\n${dockerAllUsage()}`);
+    }
+  }
+  assert(
+    [options.planJson, Boolean(options.prepareOnly), options.preparePluginRegistry].filter(Boolean)
+      .length <= 1,
+    "conflicting plan/prep options",
+  );
+  return options;
+}
+
+let cliOptions: ReturnType<typeof parseDockerAllCliArgs> = {
+  help: false,
+  planJson: false,
+  preparePluginRegistry: false,
+};
+if (IS_MAIN) {
+  try {
+    cliOptions = parseDockerAllCliArgs(process.argv.slice(2));
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+  }
+  if (cliOptions.help) {
+    console.log(dockerAllUsage());
+    process.exit(0);
+  }
+}
+
+function parsePositiveInt(raw: string | undefined, fallback: number, label: string) {
+  if (raw === undefined || raw === "") {
+    return fallback;
+  }
+  const text = raw.trim();
+  if (!/^\d+$/u.test(text)) {
+    throw new Error(`${label} must be a positive integer. Got: ${JSON.stringify(raw)}`);
+  }
+  const parsed = Number(text);
+  if (!Number.isSafeInteger(parsed) || parsed < 1) {
+    throw new Error(`${label} must be a positive integer. Got: ${JSON.stringify(raw)}`);
+  }
+  return parsed;
+}
+
+function parseNonNegativeInt(raw: string | undefined, fallback: number, label: string) {
+  if (raw === undefined || raw === "") {
+    return fallback;
+  }
+  const text = raw.trim();
+  if (!/^\d+$/u.test(text)) {
+    throw new Error(`${label} must be a non-negative integer. Got: ${JSON.stringify(raw)}`);
+  }
+  const parsed = Number(text);
+  if (!Number.isSafeInteger(parsed) || parsed < 0) {
+    throw new Error(`${label} must be a non-negative integer. Got: ${JSON.stringify(raw)}`);
+  }
+  return parsed;
+}
+
+function parseBool(raw: string | undefined, fallback: boolean) {
+  if (raw === undefined || raw === "") {
+    return fallback;
+  }
+  return !/^(?:0|false|no)$/i.test(raw);
+}
+
+function normalizeReleaseProfileEnv(raw: string | undefined) {
+  const profile = raw?.trim();
+  if (!profile) {
+    return normalizeReleaseProfile(undefined);
+  }
+  if (profile === "minimum" || profile === "beta" || profile === "stable" || profile === "full") {
+    return normalizeReleaseProfile(profile);
+  }
+  throw new Error(
+    `release profile must be one of: beta, stable, full. Got: ${JSON.stringify(raw)}`,
+  );
+}
+
+function numericTimerValueMs(valueMs: unknown) {
+  const value = Number(valueMs);
+  return Number.isFinite(value) ? Math.floor(value) : undefined;
+}
+
+function resolveDockerSchedulerTimeoutMs(
+  valueMs: unknown,
+  fallbackMs: unknown = MAX_TIMER_TIMEOUT_MS,
+) {
+  const value = numericTimerValueMs(valueMs) ?? numericTimerValueMs(fallbackMs);
+  return Math.min(Math.max(value ?? MAX_TIMER_TIMEOUT_MS, 1), MAX_TIMER_TIMEOUT_MS);
+}
+
+function resolveOptionalTimerTimeoutMs(valueMs: unknown) {
+  const value = numericTimerValueMs(valueMs);
+  if (value === undefined || value <= 0) {
+    return undefined;
+  }
+  return resolveDockerSchedulerTimeoutMs(value);
+}
+
+function resourceLimitsSummary(resourceLimits: Record<string, number>) {
+  return Object.entries(resourceLimits)
+    .map(([resource, limit]) => `${resource}=${String(limit)}`)
+    .join(" ");
+}
+
+export function describeDockerSchedulerLimits(parallelism: number, options: SchedulerLimits) {
+  return `parallelism=${parallelism} weightLimit=${options.weightLimit} resources=${resourceLimitsSummary(
+    options.resourceLimits,
+  )}`;
+}
+
+function parseSchedulerOptions(env: NodeJS.ProcessEnv, parallelism: number) {
+  const weightLimit = parsePositiveInt(
+    env.OPENCLAW_DOCKER_ALL_WEIGHT_LIMIT,
+    parallelism,
+    "OPENCLAW_DOCKER_ALL_WEIGHT_LIMIT",
+  );
+  const resourceLimits: Record<string, number> = {};
+  for (const [resource, fallback] of Object.entries(DEFAULT_RESOURCE_LIMITS)) {
+    const envName = `OPENCLAW_DOCKER_ALL_${resource.toUpperCase().replace(/[^A-Z0-9]+/g, "_")}_LIMIT`;
+    resourceLimits[resource] = parsePositiveInt(
+      env[envName],
+      Math.min(parallelism, fallback),
+      envName,
+    );
+  }
+  return {
+    resourceLimits,
+    weightLimit,
+  };
+}
+
+export function canStartSchedulerLane(
+  candidate: SchedulerLane,
+  active: SchedulerActiveState,
+  parallelism: number,
+  options: SchedulerLimits,
+) {
+  const weight = Math.max(1, candidate.weight ?? 1);
+  if (active.count >= parallelism) {
+    return false;
+  }
+
+  const exceedsWeightLimit = active.weight + weight > options.weightLimit;
+  const resources = [...new Set(["docker", ...(candidate.resources ?? [])])];
+  const exceedsResourceLimit = resources.some((resource) => {
+    const limit = options.resourceLimits[resource] ?? options.weightLimit;
+    const current = active.resources.get(resource) ?? 0;
+    return current + weight > limit;
+  });
+
+  if (!exceedsWeightLimit && !exceedsResourceLimit) {
+    return true;
+  }
+
+  return active.count === 0;
+}
+
+function timingSeconds(timings: Record<string, unknown>, poolLane: DockerE2eLane) {
+  const timing = timings[poolLane.name];
+  const fromStore = isRecord(timing) ? timing.durationSeconds : undefined;
+  if (typeof fromStore === "number" && Number.isFinite(fromStore) && fromStore > 0) {
+    return fromStore;
+  }
+  return poolLane.estimateSeconds ?? 0;
+}
+
+function orderLanes(poolLanes: DockerE2eLane[], timingStore?: unknown) {
+  const timings = isRecord(timingStore) && isRecord(timingStore.lanes) ? timingStore.lanes : {};
+  return poolLanes
+    .map((poolLane, index) => ({
+      index,
+      poolLane,
+      seconds: timingSeconds(timings, poolLane),
+    }))
+    .toSorted((a, b) => b.seconds - a.seconds || a.index - b.index)
+    .map(({ poolLane }) => poolLane);
+}
+
+function utcStampForPath() {
+  return new Date().toISOString().replaceAll("-", "").replaceAll(":", "").replace(/\..*$/, "Z");
+}
+
+function utcStamp() {
+  return new Date().toISOString().replace(/\..*$/, "Z");
+}
+
+function appendExtension(env: NodeJS.ProcessEnv, extension: string) {
+  const current = env.OPENCLAW_DOCKER_BUILD_EXTENSIONS ?? env.OPENCLAW_EXTENSIONS ?? "";
+  const tokens = current.split(/\s+/).filter(Boolean);
+  if (!tokens.includes(extension)) {
+    tokens.push(extension);
+  }
+  env.OPENCLAW_DOCKER_BUILD_EXTENSIONS = tokens.join(" ");
+}
+
+function commandEnv(extra: NodeJS.ProcessEnv = {}): NodeJS.ProcessEnv {
+  const env = {
+    ...process.env,
+    ...extra,
+  };
+  const pathEntries = [
+    env.PATH,
+    env.PNPM_HOME,
+    env.npm_execpath ? path.dirname(env.npm_execpath) : undefined,
+    path.dirname(process.execPath),
+  ]
+    .flatMap((entry) => (entry ? entry.split(path.delimiter) : []))
+    .filter(Boolean);
+  env.PATH = [...new Set(pathEntries)].join(path.delimiter);
+  return env;
+}
+
+function gitOutput(repoRoot: string, args: string[]) {
+  return execFileSync("git", args, { cwd: repoRoot, encoding: "utf8" }).trim();
+}
+
+function rootPackageVersion(repoRoot: string) {
+  return JSON.parse(fs.readFileSync(path.join(repoRoot, "package.json"), "utf8")).version as string;
+}
+
+function readCompleteTuple(env: NodeJS.ProcessEnv, keys: readonly string[], label: string) {
+  const entries = keys.flatMap((key) => (env[key] ? [[key, env[key]]] : []));
+  const complete = entries.length === keys.length;
+  assert(!entries.length || complete, `${label} fields must be complete`);
+  return complete ? Object.fromEntries(entries) : undefined;
+}
+
+function validateRegistryEnvironment(baseEnv: NodeJS.ProcessEnv, plan: DockerCandidatePlan) {
+  validatePrepublishPluginRegistryArtifact({
+    artifactDir: baseEnv.OPENCLAW_PREPUBLISH_PLUGIN_REGISTRY_DIR!,
+    expectedCandidateVersion: baseEnv.OPENCLAW_PREPUBLISH_PLUGIN_REGISTRY_CANDIDATE_VERSION!,
+    expectedManifestSha256: baseEnv.OPENCLAW_PREPUBLISH_PLUGIN_REGISTRY_MANIFEST_SHA256!,
+    expectedSourceSha: baseEnv.OPENCLAW_DOCKER_E2E_SELECTED_SHA!,
+    requiredPackages: plan.requiredPrepublishPluginPackages,
+  });
+}
+
+export function validateDockerCandidateEnvironment(
+  baseEnv: NodeJS.ProcessEnv,
+  plan: DockerCandidatePlan,
+  repoRoot = ROOT_DIR,
+) {
+  const strictCandidate = CANDIDATE_ENV_KEYS.slice(2).some((key) => baseEnv[key]);
+  if (!strictCandidate || !plan.needs.package) {
+    baseEnv.OPENCLAW_CURRENT_PACKAGE_TGZ &&= path.resolve(baseEnv.OPENCLAW_CURRENT_PACKAGE_TGZ);
+    const registryDir = baseEnv.OPENCLAW_PREPUBLISH_PLUGIN_REGISTRY_DIR;
+    if (!registryDir) {
+      delete baseEnv.OPENCLAW_PREPUBLISH_PLUGIN_REGISTRY_DIR;
+      return;
+    }
+    baseEnv.OPENCLAW_PREPUBLISH_PLUGIN_REGISTRY_DIR = path.resolve(registryDir);
+    validateRegistryEnvironment(baseEnv, plan);
+    return;
+  }
+  const candidate = readCompleteTuple(baseEnv, CANDIDATE_ENV_KEYS, "Docker candidate")!;
+  const registry = readCompleteTuple(baseEnv, REGISTRY_ENV_KEYS, "Docker candidate registry");
+  const packagePath = candidate.OPENCLAW_CURRENT_PACKAGE_TGZ;
+  if (
+    !path.isAbsolute(packagePath) ||
+    gitOutput(repoRoot, ["rev-parse", "HEAD"]) !== candidate.OPENCLAW_DOCKER_E2E_SELECTED_SHA
+  ) {
+    throw new Error("Docker candidate path must be absolute and selected SHA must equal HEAD");
+  }
+  const packed = inspectNpmPackageTarball(packagePath);
+  if (
+    packed.packageJson.name !== "openclaw" ||
+    packed.packageJson.version !== rootPackageVersion(repoRoot) ||
+    packed.packageJson.version !== candidate.OPENCLAW_CURRENT_PACKAGE_VERSION ||
+    packed.sha256 !== candidate.OPENCLAW_CURRENT_PACKAGE_SHA256
+  ) {
+    throw new Error("Docker candidate package identity differs from the immutable tuple");
+  }
+  if (registry) {
+    const registryDir = registry.OPENCLAW_PREPUBLISH_PLUGIN_REGISTRY_DIR;
+    assert(path.isAbsolute(registryDir), "Docker candidate registry path must be absolute");
+    validateRegistryEnvironment(baseEnv, plan);
+  } else if (plan.needs.prepublishPluginRegistry) {
+    throw new Error("Docker plan requires a prepublish plugin registry tuple");
+  }
+}
+
+function shellQuote(value: string) {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+
+function maybeGhcrImage(value: unknown) {
+  return typeof value === "string" && value.startsWith("ghcr.io/") ? value : "";
+}
+
+export function githubWorkflowRerunCommand(
+  laneNames: readonly string[],
+  ref: string,
+  env: NodeJS.ProcessEnv = process.env,
+) {
+  const workflowRef = env.OPENCLAW_DOCKER_E2E_WORKFLOW_REF || undefined;
+  const releasePath = env.OPENCLAW_DOCKER_ALL_PROFILE === RELEASE_PATH_PROFILE;
+  const allowUnreleasedChangelog = env.OPENCLAW_DOCKER_E2E_ALLOW_UNRELEASED_CHANGELOG === "true";
+  const bareImage = maybeGhcrImage(env.OPENCLAW_DOCKER_E2E_BARE_IMAGE);
+  const functionalImage = maybeGhcrImage(env.OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE);
+  const fields = [
+    "gh workflow run",
+    shellQuote(env.OPENCLAW_DOCKER_E2E_WORKFLOW || DEFAULT_GITHUB_WORKFLOW),
+    ...(workflowRef ? ["--ref", shellQuote(workflowRef)] : []),
+    "-f",
+    `ref=${shellQuote(ref)}`,
+    "-f",
+    "include_repo_e2e=false",
+    "-f",
+    `include_release_path_suites=${releasePath ? "true" : "false"}`,
+    "-f",
+    "include_openwebui=false",
+    "-f",
+    `docker_lanes=${shellQuote(laneNames.join(" "))}`,
+    "-f",
+    "include_live_suites=false",
+    "-f",
+    "live_models_only=false",
+  ];
+  if (allowUnreleasedChangelog) {
+    fields.push("-f", "allow_unreleased_changelog=true");
+  }
+  if (env.OPENCLAW_UPGRADE_SURVIVOR_BASELINE_SPEC) {
+    fields.push(
+      "-f",
+      `published_upgrade_survivor_baseline=${shellQuote(env.OPENCLAW_UPGRADE_SURVIVOR_BASELINE_SPEC)}`,
+    );
+  }
+  if (env.OPENCLAW_UPGRADE_SURVIVOR_BASELINE_SPECS) {
+    fields.push(
+      "-f",
+      `published_upgrade_survivor_baselines=${shellQuote(env.OPENCLAW_UPGRADE_SURVIVOR_BASELINE_SPECS)}`,
+    );
+  }
+  if (env.OPENCLAW_UPGRADE_SURVIVOR_SCENARIOS) {
+    fields.push(
+      "-f",
+      `published_upgrade_survivor_scenarios=${shellQuote(env.OPENCLAW_UPGRADE_SURVIVOR_SCENARIOS)}`,
+    );
+  }
+  if (bareImage) {
+    fields.push("-f", `docker_e2e_bare_image=${shellQuote(bareImage)}`);
+  }
+  if (functionalImage) {
+    fields.push("-f", `docker_e2e_functional_image=${shellQuote(functionalImage)}`);
+  }
+  if (bareImage || functionalImage) {
+    fields.push("-f", "shared_image_policy=existing-only");
+  }
+  return fields.join(" ");
+}
+
+export function buildLaneRerunCommand(name: string, baseEnv: NodeJS.ProcessEnv) {
+  const poolLane = findLaneByName(name);
+  const build = name.startsWith("live-") ? "1" : "0";
+  const image = poolLane ? e2eImageForLane(poolLane, baseEnv) : baseEnv.OPENCLAW_DOCKER_E2E_IMAGE;
+  const env: Array<readonly [string, string | undefined]> = [
+    ["OPENCLAW_DOCKER_ALL_LANES", name],
+    ["OPENCLAW_DOCKER_ALL_BUILD", build],
+    ["OPENCLAW_DOCKER_ALL_PREFLIGHT", "0"],
+    ["OPENCLAW_SKIP_DOCKER_BUILD", "1"],
+    ["OPENCLAW_DOCKER_E2E_IMAGE", image || DEFAULT_E2E_FUNCTIONAL_IMAGE],
+    ["OPENCLAW_DOCKER_E2E_BARE_IMAGE", baseEnv.OPENCLAW_DOCKER_E2E_BARE_IMAGE],
+    ["OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE", baseEnv.OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE],
+    ["OPENCLAW_DOCKER_E2E_REPO_ROOT", baseEnv.OPENCLAW_DOCKER_E2E_REPO_ROOT],
+    ["OPENCLAW_DOCKER_E2E_TRUSTED_HARNESS_DIR", baseEnv.OPENCLAW_DOCKER_E2E_TRUSTED_HARNESS_DIR],
+    ...CANDIDATE_ENV_KEYS.map((key) => [key, baseEnv[key]] as const),
+    ...REGISTRY_ENV_KEYS.map((key) => [key, baseEnv[key]] as const),
+    ["OPENCLAW_UPGRADE_SURVIVOR_BASELINE_SPEC", baseEnv.OPENCLAW_UPGRADE_SURVIVOR_BASELINE_SPEC],
+    ["OPENCLAW_UPGRADE_SURVIVOR_BASELINE_SPECS", baseEnv.OPENCLAW_UPGRADE_SURVIVOR_BASELINE_SPECS],
+    ["OPENCLAW_UPGRADE_SURVIVOR_SCENARIOS", baseEnv.OPENCLAW_UPGRADE_SURVIVOR_SCENARIOS],
+  ];
+  if (baseEnv.OPENCLAW_DOCKER_ALL_PNPM_COMMAND) {
+    env.push(["OPENCLAW_DOCKER_ALL_PNPM_COMMAND", baseEnv.OPENCLAW_DOCKER_ALL_PNPM_COMMAND]);
+  }
+  const envPrefix = env
+    .filter(
+      (entry): entry is readonly [string, string] => entry[1] !== undefined && entry[1] !== "",
+    )
+    .map(([key, value]) => `${key}=${shellQuote(value)}`)
+    .join(" ");
+  return prepareHarnessCommand("pnpm test:docker:all", baseEnv, envPrefix);
+}
+
+function prepareHarnessCommand(command: string, env: NodeJS.ProcessEnv, envPrefix = "") {
+  if (!/(^|\s)pnpm(?=\s)/.test(command)) {
+    return command;
+  }
+  const pinnedPnpm = env.OPENCLAW_DOCKER_ALL_PNPM_COMMAND?.trim();
+  const executable = pinnedPnpm?.includes("/") ? path.resolve(ROOT_DIR, pinnedPnpm) : pinnedPnpm;
+  const invocation = command.replace(
+    /(^|\s)pnpm(?=\s)/g,
+    (_, prefix: string) => `${prefix}${executable ? shellQuote(executable) : "pnpm"}`,
+  );
+  // Quoted environment values may themselves contain " pnpm ". Substitute only
+  // the catalog invocation, then add the already-quoted rerun assignments.
+  const prepared = envPrefix ? `${envPrefix} ${invocation}` : invocation;
+  // Corepack selects the package-manager pin before pnpm parses --dir. Enter
+  // the harness first; candidate paths have already been prepared as absolute.
+  return HARNESS_ROOT_DIR === ROOT_DIR
+    ? prepared
+    : `(cd ${shellQuote(HARNESS_ROOT_DIR)} && ${prepared})`;
+}
+
+async function loadTimingStore(file: string, enabled: boolean) {
+  if (!enabled) {
+    return { enabled: false, file, lanes: {}, version: 1 };
+  }
+  const raw = await readFile(file, "utf8").catch(() => "");
+  if (!raw.trim()) {
+    return { enabled: true, file, lanes: {}, version: 1 };
+  }
+  try {
+    const parsed: unknown = JSON.parse(raw);
+    return {
+      enabled: true,
+      file,
+      lanes: isRecord(parsed) && isRecord(parsed.lanes) ? parsed.lanes : {},
+      version: 1,
+    };
+  } catch (error) {
+    console.warn(
+      `WARN: ignoring unreadable Docker lane timings ${file}: ${
+        error instanceof Error ? error.message : String(error)
+      }`,
+    );
+    return { enabled: true, file, lanes: {}, version: 1 };
+  }
+}
+
+async function writeTimingStore(timingStore: TimingStore, results: LaneResult[]) {
+  if (!timingStore.enabled || results.length === 0) {
+    return;
+  }
+  const next = {
+    lanes: { ...timingStore.lanes },
+    updatedAt: new Date().toISOString(),
+    version: 1,
+  };
+  for (const result of results) {
+    if (!result || typeof result.elapsedSeconds !== "number") {
+      continue;
+    }
+    next.lanes[result.name] = {
+      durationSeconds: result.elapsedSeconds,
+      status: result.status,
+      timedOut: result.timedOut,
+      updatedAt: new Date().toISOString(),
+    };
+  }
+  await mkdir(path.dirname(timingStore.file), { recursive: true });
+  await fs.promises.writeFile(timingStore.file, `${JSON.stringify(next, null, 2)}\n`);
+  timingStore.lanes = next.lanes;
+  console.log(`==> Docker lane timings: ${timingStore.file}`);
+}
+
+function githubRunSummary(env: NodeJS.ProcessEnv) {
+  return {
+    ref: env.GITHUB_REF_NAME || undefined,
+    repository: env.GITHUB_REPOSITORY || undefined,
+    runId: env.GITHUB_RUN_ID || undefined,
+    runUrl:
+      env.GITHUB_SERVER_URL && env.GITHUB_REPOSITORY && env.GITHUB_RUN_ID
+        ? `${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}`
+        : undefined,
+    selectedSha: env.OPENCLAW_DOCKER_E2E_SELECTED_SHA || undefined,
+    sha: env.GITHUB_SHA || undefined,
+    workflow: env.GITHUB_WORKFLOW || undefined,
+  };
+}
+
+export async function writeRunSummary(
+  logDir: string,
+  summary: RunSummary,
+  env: NodeJS.ProcessEnv = process.env,
+) {
+  const file = path.join(logDir, "summary.json");
+  const payload = {
+    ...summary,
+    // Summary reruns do not carry failure-index commands, so preserve this exact package intent.
+    allowUnreleasedChangelog:
+      env.OPENCLAW_DOCKER_E2E_ALLOW_UNRELEASED_CHANGELOG === "true" ? true : undefined,
+    packageArtifactName: env.OPENCLAW_DOCKER_E2E_PACKAGE_ARTIFACT_NAME || undefined,
+    finishedAt: new Date().toISOString(),
+    github: githubRunSummary(env),
+    version: 1,
+  };
+  await fs.promises.writeFile(file, `${JSON.stringify(payload, null, 2)}\n`);
+  await writeFailureIndex(logDir, payload, env);
+  console.log(`==> Docker run summary: ${file}`);
+}
+
+async function writeFailureIndex(logDir: string, summary: RunSummary, env: NodeJS.ProcessEnv) {
+  const ref =
+    summary.github?.selectedSha ||
+    env.OPENCLAW_DOCKER_E2E_SELECTED_SHA ||
+    summary.github?.sha ||
+    summary.github?.ref ||
+    env.GITHUB_SHA ||
+    "HEAD";
+  const failures = Array.isArray(summary.failures)
+    ? summary.failures
+    : (summary.lanes ?? []).filter((lane) => lane.status !== 0);
+  const workflowRerunFailures = failures.filter((failure) => failure.targetable !== false);
+  const lanes = failures.map((failure) => ({
+    ghWorkflowCommand:
+      failure.targetable === false
+        ? undefined
+        : githubWorkflowRerunCommand([failure.name], ref, env),
+    image: failure.image,
+    imageKind: failure.imageKind,
+    lane: failure.name,
+    logFile: failure.logFile,
+    name: failure.name,
+    noOutputTimedOut: failure.noOutputTimedOut,
+    rerunCommand: failure.rerunCommand,
+    status: failure.status,
+    targetable: failure.targetable,
+    timedOut: failure.timedOut,
+  }));
+  const failureIndex = {
+    combinedGhWorkflowCommand:
+      workflowRerunFailures.length > 0
+        ? githubWorkflowRerunCommand(
+            workflowRerunFailures.map((failure) => failure.name),
+            ref,
+            env,
+          )
+        : undefined,
+    generatedAt: new Date().toISOString(),
+    lanes,
+    note: "Targeted GitHub reruns repack the exact selected ref and reuse only GHCR-backed shared images when the generated command includes docker_e2e_*_image inputs.",
+    images: summary.images,
+    packageArtifactName: env.OPENCLAW_DOCKER_E2E_PACKAGE_ARTIFACT_NAME || undefined,
+    ref,
+    runUrl: summary.github?.runUrl,
+    status: summary.status,
+    version: 1,
+    workflow: env.OPENCLAW_DOCKER_E2E_WORKFLOW || DEFAULT_GITHUB_WORKFLOW,
+  };
+  await fs.promises.writeFile(
+    path.join(logDir, "failures.json"),
+    `${JSON.stringify(failureIndex, null, 2)}\n`,
+  );
+}
+
+function phaseElapsedSeconds(startedAtMs: number) {
+  return Math.round((Date.now() - startedAtMs) / 1000);
+}
+
+function laneAttempt(
+  attempt: number,
+  startedAtMs: number,
+  result: Pick<ShellCommandResult, "noOutputTimedOut" | "status" | "timedOut">,
+) {
+  return {
+    attempt,
+    elapsedSeconds: phaseElapsedSeconds(startedAtMs),
+    finishedAt: new Date().toISOString(),
+    noOutputTimedOut: result.noOutputTimedOut,
+    startedAt: new Date(startedAtMs).toISOString(),
+    status: result.status,
+    timedOut: result.timedOut,
+  };
+}
+
+function cleanupSmokeResult(
+  baseEnv: NodeJS.ProcessEnv,
+  logFile: string,
+  command: string,
+  startedAtMs: number,
+  result: Pick<ShellCommandResult, "noOutputTimedOut" | "status" | "timedOut">,
+) {
+  return {
+    command,
+    attempts: [laneAttempt(1, startedAtMs, result)],
+    elapsedSeconds: phaseElapsedSeconds(startedAtMs),
+    finishedAt: new Date().toISOString(),
+    image: baseEnv.OPENCLAW_DOCKER_E2E_IMAGE,
+    logFile,
+    name: CLEANUP_SMOKE_NAME,
+    noOutputTimedOut: result.noOutputTimedOut,
+    rerunCommand: command,
+    startedAt: new Date(startedAtMs).toISOString(),
+    status: result.status,
+    targetable: false,
+    timedOut: result.timedOut,
+  };
+}
+
+async function runPhase<T>(
+  phases: Array<Record<string, unknown>>,
+  name: string,
+  details: Record<string, unknown>,
+  fn: () => Promise<T>,
+): Promise<T> {
+  const startedAtMs = Date.now();
+  const startedAt = new Date(startedAtMs).toISOString();
+  let status: "failed" | "passed" = "passed";
+  let errorMessage: string | undefined;
+  try {
+    const result = await fn();
+    return result;
+  } catch (error) {
+    status = "failed";
+    errorMessage = error instanceof Error ? error.message : String(error);
+    throw error;
+  } finally {
+    const phase = {
+      ...details,
+      name,
+      startedAt,
+      status,
+      ...(errorMessage === undefined ? {} : { error: errorMessage }),
+      elapsedSeconds: phaseElapsedSeconds(startedAtMs),
+      finishedAt: new Date().toISOString(),
+    };
+    phases.push(phase);
+    console.log(`==> Phase ${phase.status}: ${name} ${phase.elapsedSeconds}s`);
+  }
+}
+
+function printLaneManifest(
+  label: string,
+  poolLanes: DockerE2eLane[],
+  timingStore: TimingStore,
+): void {
+  console.log(`==> ${label} lanes (${poolLanes.length})`);
+  for (const [index, poolLane] of poolLanes.entries()) {
+    const seconds = timingSeconds(timingStore.lanes, poolLane);
+    const estimate = seconds > 0 ? ` last=${Math.round(seconds)}s` : "";
+    console.log(`  ${index + 1}. ${laneSummary(poolLane)}${estimate}`);
+  }
+}
+
+export function dockerPreflightContainerNames(raw: string): string[] {
+  return raw.split(/\r?\n/).flatMap((line) => {
+    const name = line.trim().split(/\s+/, 1)[0];
+    return name &&
+      /^(?:openclaw-[a-z0-9-]+-e2e-\d+|openclaw-openwebui(?:-gateway)?-\d+)$/u.test(name)
+      ? [name]
+      : [];
+  });
+}
+
+export function resolveDockerPreflightPlatform(arch: NodeJS.Architecture = process.arch) {
+  return arch === "arm64" ? "linux/arm64" : "linux/amd64";
+}
+
+export function dockerPreflightSmokeCommand(arch: NodeJS.Architecture = process.arch) {
+  const platform = resolveDockerPreflightPlatform(arch);
+  return `docker run --rm --platform ${shellQuote(platform)} alpine:3.24 true`;
+}
+
+export function runShellCommand({
+  command,
+  env,
+  label,
+  logFile,
+  timeoutMs,
+  noOutputTimeoutMs,
+  timeoutKillGraceMs = SHELL_TIMEOUT_KILL_GRACE_MS,
+}: ShellCommandOptions) {
+  if (activeChildrenShutdownPromise) {
+    return activeChildrenShutdownPromise.then(() => shellCommandSkippedForShutdown());
+  }
+  return new Promise<ShellCommandResult>((resolve) => {
+    const resolvedTimeoutMs = resolveOptionalTimerTimeoutMs(timeoutMs);
+    const resolvedNoOutputTimeoutMs = resolveOptionalTimerTimeoutMs(noOutputTimeoutMs);
+    const resolvedTimeoutKillGraceMs = resolveDockerSchedulerTimeoutMs(
+      timeoutKillGraceMs,
+      SHELL_TIMEOUT_KILL_GRACE_MS,
+    );
+    const pipeOutput = Boolean(logFile || resolvedNoOutputTimeoutMs);
+    const child = spawn("bash", ["-c", command], {
+      cwd: ROOT_DIR,
+      detached: process.platform !== "win32",
+      env,
+      stdio: pipeOutput ? ["ignore", "pipe", "pipe"] : "inherit",
+    });
+    activeChildren.set(child, resolvedTimeoutKillGraceMs);
+    let timedOut = false;
+    let noOutputTimedOut = false;
+    let killTimer: ReturnType<typeof setTimeout> | undefined;
+    let killAt: number | undefined;
+    const stream = logFile ? fs.createWriteStream(logFile, { flags: "a" }) : undefined;
+    let noOutputTimer: ReturnType<typeof setTimeout> | undefined;
+    const terminateForTimeout = (message: string, options: { noOutput?: boolean } = {}) => {
+      if (timedOut) {
+        return;
+      }
+      timedOut = true;
+      noOutputTimedOut = options.noOutput === true;
+      if (stream) {
+        stream.write(`\n==> [${label}] ${message}; sending SIGTERM\n`);
+      } else {
+        console.error(`==> [${label}] ${message}; sending SIGTERM`);
+      }
+      terminateChild(child, "SIGTERM");
+      killAt = Date.now() + resolvedTimeoutKillGraceMs;
+      killTimer = setTimeout(() => terminateChild(child, "SIGKILL"), resolvedTimeoutKillGraceMs);
+      killTimer.unref?.();
+    };
+    const resetNoOutputTimer = () => {
+      if (!resolvedNoOutputTimeoutMs || timedOut) {
+        return;
+      }
+      if (noOutputTimer) {
+        clearTimeout(noOutputTimer);
+      }
+      noOutputTimer = setTimeout(() => {
+        terminateForTimeout(`no output for ${resolvedNoOutputTimeoutMs}ms`, { noOutput: true });
+      }, resolvedNoOutputTimeoutMs);
+      noOutputTimer.unref?.();
+    };
+    const timeoutTimer =
+      resolvedTimeoutMs !== undefined
+        ? setTimeout(() => {
+            terminateForTimeout(`timeout after ${resolvedTimeoutMs}ms`);
+          }, resolvedTimeoutMs)
+        : undefined;
+    timeoutTimer?.unref?.();
+
+    if (stream) {
+      stream.write(`==> [${label}] command: ${command}\n`);
+      stream.write(`==> [${label}] started: ${utcStamp()}\n`);
+    }
+    if (pipeOutput && child.stdout && child.stderr) {
+      const writeOutput = (target: NodeJS.WriteStream, chunk: Uint8Array) => {
+        resetNoOutputTimer();
+        if (stream) {
+          stream.write(chunk);
+        } else {
+          target.write(chunk);
+        }
+      };
+      child.stdout.on("data", (chunk: Uint8Array) => writeOutput(process.stdout, chunk));
+      child.stderr.on("data", (chunk: Uint8Array) => writeOutput(process.stderr, chunk));
+      resetNoOutputTimer();
+    }
+
+    child.on("close", (status, signal) => {
+      if (timeoutTimer) {
+        clearTimeout(timeoutTimer);
+      }
+      if (noOutputTimer) {
+        clearTimeout(noOutputTimer);
+      }
+      const finish = () => {
+        if (killTimer) {
+          clearTimeout(killTimer);
+        }
+        killAt = undefined;
+        activeChildren.delete(child);
+        const exitCode = typeof status === "number" ? status : signal ? 128 : 1;
+        if (stream) {
+          stream.write(
+            `\n==> [${label}] finished: ${utcStamp()} status=${exitCode}${
+              noOutputTimedOut ? " noOutputTimedOut=true" : ""
+            }\n`,
+          );
+          stream.end();
+        }
+        resolve({ signal, status: exitCode, timedOut, noOutputTimedOut });
+      };
+      if (timedOut) {
+        void finishTimedOutShellProcessTree(child, killAt, resolvedTimeoutKillGraceMs).then(
+          finish,
+          finish,
+        );
+        return;
+      }
+      finish();
+    });
+  });
+}
+
+export function appendBoundedShellCapture(
+  current: string,
+  chunk: unknown,
+  maxChars = SHELL_CAPTURE_MAX_CHARS,
+) {
+  const combined = `${current}${String(chunk)}`;
+  if (combined.length <= maxChars) {
+    return { text: combined, truncated: false };
+  }
+  return { text: combined.slice(-maxChars), truncated: true };
+}
+
+export function runShellCaptureCommand({
+  command,
+  env,
+  label,
+  timeoutMs,
+  timeoutKillGraceMs = SHELL_TIMEOUT_KILL_GRACE_MS,
+}: ShellCaptureOptions) {
+  if (activeChildrenShutdownPromise) {
+    return activeChildrenShutdownPromise.then(() => shellCaptureSkippedForShutdown(label));
+  }
+  return new Promise<ShellCaptureResult>((resolve) => {
+    const resolvedTimeoutMs = resolveOptionalTimerTimeoutMs(timeoutMs);
+    const resolvedTimeoutKillGraceMs = resolveDockerSchedulerTimeoutMs(
+      timeoutKillGraceMs,
+      SHELL_TIMEOUT_KILL_GRACE_MS,
+    );
+    const child = spawn("bash", ["-c", command], {
+      cwd: ROOT_DIR,
+      detached: process.platform !== "win32",
+      env,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    activeChildren.set(child, resolvedTimeoutKillGraceMs);
+    let stdout = "";
+    let stderr = "";
+    let stdoutTruncated = false;
+    let stderrTruncated = false;
+    let timedOut = false;
+    let killTimer: ReturnType<typeof setTimeout> | undefined;
+    let killAt: number | undefined;
+    const timeoutTimer =
+      resolvedTimeoutMs !== undefined
+        ? setTimeout(() => {
+            timedOut = true;
+            terminateChild(child, "SIGTERM");
+            killAt = Date.now() + resolvedTimeoutKillGraceMs;
+            killTimer = setTimeout(
+              () => terminateChild(child, "SIGKILL"),
+              resolvedTimeoutKillGraceMs,
+            );
+            killTimer.unref?.();
+          }, resolvedTimeoutMs)
+        : undefined;
+    timeoutTimer?.unref?.();
+    child.stdout.on("data", (chunk: Buffer) => {
+      const next = appendBoundedShellCapture(stdout, chunk);
+      stdout = next.text;
+      stdoutTruncated ||= next.truncated;
+    });
+    child.stderr.on("data", (chunk: Buffer) => {
+      const next = appendBoundedShellCapture(stderr, chunk);
+      stderr = next.text;
+      stderrTruncated ||= next.truncated;
+    });
+    child.on("close", (status, signal) => {
+      if (timeoutTimer) {
+        clearTimeout(timeoutTimer);
+      }
+      const finish = () => {
+        if (killTimer) {
+          clearTimeout(killTimer);
+        }
+        killAt = undefined;
+        activeChildren.delete(child);
+        const exitCode = typeof status === "number" ? status : signal ? 128 : 1;
+        resolve({
+          label,
+          signal,
+          status: exitCode,
+          stderr,
+          stderrTruncated,
+          stdout,
+          stdoutTruncated,
+          timedOut,
+        });
+      };
+      if (timedOut) {
+        void finishTimedOutShellProcessTree(child, killAt, resolvedTimeoutKillGraceMs).then(
+          finish,
+          finish,
+        );
+        return;
+      }
+      finish();
+    });
+  });
+}
+
+async function runForeground(label: string, command: string, env: NodeJS.ProcessEnv) {
+  console.log(`==> ${label}`);
+  const result = await runShellCommand({ command, env, label });
+  if (result.status !== 0) {
+    throw new Error(`${label} failed with status ${result.status}`);
+  }
+}
+
+export async function runCleanupSmokePhase(
+  baseEnv: NodeJS.ProcessEnv,
+  logDir: string,
+  phases: Array<Record<string, unknown>>,
+) {
+  const command = prepareHarnessCommand("pnpm test:docker:cleanup", baseEnv);
+  const logFile = path.join(logDir, `${CLEANUP_SMOKE_NAME}.log`);
+  const startedAtMs = Date.now();
+  let failure: LaneResult | undefined;
+  try {
+    await runPhase(phases, CLEANUP_SMOKE_NAME, {}, async () => {
+      const result = await runShellCommand({
+        command,
+        env: baseEnv,
+        label: CLEANUP_SMOKE_NAME,
+        logFile,
+      });
+      if (result.status !== 0) {
+        failure = cleanupSmokeResult(baseEnv, logFile, command, startedAtMs, result);
+      }
+      if (failure) {
+        throw new Error(
+          `Run cleanup smoke after parallel lanes failed with status ${failure.status}`,
+        );
+      }
+    });
+  } catch (error) {
+    if (!failure) {
+      const status = 1;
+      const message = error instanceof Error ? error.message : String(error);
+      await fs.promises.writeFile(
+        logFile,
+        [
+          `==> [${CLEANUP_SMOKE_NAME}] command: ${command}`,
+          `==> [${CLEANUP_SMOKE_NAME}] status: ${status}`,
+          `==> [${CLEANUP_SMOKE_NAME}] error: ${message}`,
+        ].join("\n"),
+      );
+      failure = cleanupSmokeResult(baseEnv, logFile, command, startedAtMs, {
+        noOutputTimedOut: false,
+        status,
+        timedOut: false,
+      });
+    }
+  }
+  return failure;
+}
+
+async function runForegroundGroup(entries: ForegroundEntry[], env: NodeJS.ProcessEnv) {
+  const failures: Array<{ entry: ForegroundEntry; error: unknown }> = [];
+  for (const entry of entries) {
+    try {
+      const { command, label, phaseDetails = {}, phases } = entry;
+      const entryEnv = { ...env, ...entry.env };
+      if (phases) {
+        await runPhase(phases, `build:${label}`, phaseDetails, async () => {
+          await runForeground(label, command, entryEnv);
+        });
+      } else {
+        await runForeground(label, command, entryEnv);
+      }
+    } catch (error) {
+      failures.push({ entry, error });
+    }
+  }
+  if (failures.length > 0) {
+    throw new Error(
+      failures
+        .map(
+          ({ entry, error }) =>
+            `${entry.label}: ${error instanceof Error ? error.message : String(error)}`,
+        )
+        .join("\n"),
+    );
+  }
+}
+
+async function runDockerPreflight(
+  baseEnv: NodeJS.ProcessEnv,
+  options: { cleanup: boolean; enabled: boolean; runTimeoutMs: number },
+) {
+  if (!options.enabled) {
+    console.log("==> Docker preflight: skipped");
+    return;
+  }
+  console.log("==> Docker preflight");
+  const version = await runShellCaptureCommand({
+    command: "docker version --format '{{.Server.Version}}'",
+    env: baseEnv,
+    label: "docker-version",
+    timeoutMs: 20_000,
+  });
+  if (version.status !== 0) {
+    throw new Error(
+      `Docker preflight failed: docker version status=${version.status}\n${version.stderr}${version.stdout}`,
+    );
+  }
+  console.log(`==> Docker server: ${version.stdout.trim()}`);
+
+  if (options.cleanup) {
+    const stale = await runShellCaptureCommand({
+      command:
+        "docker ps -a --filter status=created --filter status=exited --filter status=dead --format '{{.Names}} {{.Status}}'",
+      env: baseEnv,
+      label: "docker-stale-list",
+      timeoutMs: 20_000,
+    });
+    if (stale.status === 0) {
+      const names = dockerPreflightContainerNames(stale.stdout);
+      if (names.length > 0) {
+        console.log(`==> Docker preflight cleanup: ${names.join(", ")}`);
+        const cleanup = await runShellCommand({
+          command: `docker rm -f ${names.map(shellQuote).join(" ")}`,
+          env: baseEnv,
+          label: "docker-stale-cleanup",
+          timeoutMs: 90_000,
+        });
+        if (cleanup.status !== 0) {
+          throw new Error(`Docker preflight cleanup failed with status ${cleanup.status}`);
+        }
+      }
+    }
+  }
+
+  const startedAt = Date.now();
+  const run = await runShellCommand({
+    command: dockerPreflightSmokeCommand(),
+    env: baseEnv,
+    label: "docker-run-smoke",
+    timeoutMs: options.runTimeoutMs,
+  });
+  const elapsedSeconds = Math.round((Date.now() - startedAt) / 1000);
+  if (run.status !== 0) {
+    throw new Error(
+      `Docker preflight failed: ${dockerPreflightSmokeCommand()} status=${run.status} elapsed=${elapsedSeconds}s`,
+    );
+  }
+  console.log(`==> Docker preflight run: ${elapsedSeconds}s`);
+}
+
+async function prepareOpenClawPackage(baseEnv: NodeJS.ProcessEnv, logDir: string) {
+  const existing = baseEnv.OPENCLAW_CURRENT_PACKAGE_TGZ;
+  if (existing) {
+    const packageTgz = path.resolve(existing);
+    baseEnv.OPENCLAW_CURRENT_PACKAGE_TGZ = packageTgz;
+    baseEnv.OPENCLAW_BUNDLED_CHANNEL_HOST_BUILD = "0";
+    baseEnv.OPENCLAW_NPM_ONBOARD_HOST_BUILD = "0";
+    console.log(`==> OpenClaw package: ${packageTgz}`);
+    return;
+  }
+
+  const packDir = path.join(logDir, "openclaw-package");
+  await mkdir(packDir, { recursive: true });
+  const packageTgz = path.join(packDir, "openclaw-current.tgz");
+  await runForeground(
+    "Prepare OpenClaw package once",
+    `node ${shellQuote(path.join(HARNESS_ROOT_DIR, "scripts/package-openclaw-for-docker.mjs"))} --source-dir ${shellQuote(ROOT_DIR)} --allow-unreleased-changelog --output-dir ${shellQuote(packDir)} --output-name openclaw-current.tgz`,
+    baseEnv,
+  );
+  await fs.promises.access(packageTgz);
+  // Preserve current-tree package intent in generated GitHub reruns; otherwise a local QA
+  // failure would retry through the strict release path and fail before reaching its lane.
+  baseEnv.OPENCLAW_DOCKER_E2E_ALLOW_UNRELEASED_CHANGELOG = "true";
+  baseEnv.OPENCLAW_CURRENT_PACKAGE_TGZ = packageTgz;
+  baseEnv.OPENCLAW_BUNDLED_CHANNEL_HOST_BUILD = "0";
+  baseEnv.OPENCLAW_NPM_ONBOARD_HOST_BUILD = "0";
+  console.log(`==> OpenClaw package: ${baseEnv.OPENCLAW_CURRENT_PACKAGE_TGZ}`);
+}
+
+export function preparePrepublishPluginRegistry(
+  plan: DockerCandidatePlan,
+  logDir: string,
+  sourceSha: string,
+  candidateVersion: string,
+) {
+  const registryDir = path.join(logDir, "prepublish-plugin-registry");
+  fs.rmSync(registryDir, { force: true, recursive: true });
+  const artifact = createPrepublishPluginRegistryArtifact({
+    repoRoot: ROOT_DIR,
+    outputDir: registryDir,
+    sourceSha,
+    candidateVersion,
+    requiredPackages: plan.requiredPrepublishPluginPackages,
+  });
+  return { dir: registryDir, candidateVersion, manifestSha256: artifact.manifestSha256 };
+}
+
+async function prepareDockerCandidate(
+  plan: DockerCandidatePlan,
+  logDir: string,
+  manifestPath: string,
+) {
+  const sourceSha = gitOutput(ROOT_DIR, ["rev-parse", "HEAD"]);
+  let candidate = null;
+  if (plan.needs.package) {
+    if (gitOutput(ROOT_DIR, ["status", "--porcelain=v1"])) {
+      throw new Error("repository has working-tree changes; refusing to prepare Docker candidate");
+    }
+    const candidateEnv = commandEnv();
+    for (const key of [...CANDIDATE_ENV_KEYS, ...REGISTRY_ENV_KEYS]) {
+      delete candidateEnv[key];
+    }
+    await prepareOpenClawPackage(candidateEnv, logDir);
+    const packagePath = candidateEnv.OPENCLAW_CURRENT_PACKAGE_TGZ!;
+    const packed = inspectNpmPackageTarball(packagePath);
+    const version = rootPackageVersion(ROOT_DIR);
+    if (packed.packageJson.name !== "openclaw" || packed.packageJson.version !== version) {
+      throw new Error("packed Docker candidate name or version differs from the root package");
+    }
+    let registry = null;
+    if (plan.needs.prepublishPluginRegistry) {
+      registry = preparePrepublishPluginRegistry(plan, logDir, sourceSha, version);
+    }
+    candidate = {
+      package: { path: packagePath, name: packed.packageJson.name, version, sha256: packed.sha256 },
+      registry,
+    };
+  }
+  await mkdir(path.dirname(manifestPath), { recursive: true });
+  fs.writeFileSync(
+    manifestPath,
+    `${JSON.stringify({ schema: "openclaw.qa-docker-candidate/v1", schemaVersion: 1, sourceSha, candidate }, null, 2)}\n`,
+  );
+}
+
+function e2eImageForLane(poolLane: DockerE2eLane, baseEnv: NodeJS.ProcessEnv) {
+  if (poolLane.e2eImageKind === "bare") {
+    return baseEnv.OPENCLAW_DOCKER_E2E_BARE_IMAGE;
+  }
+  if (poolLane.e2eImageKind === "functional") {
+    return baseEnv.OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE;
+  }
+  return undefined;
+}
+
+type DockerLaneEnv = {
+  [key: string]: string | undefined;
+  OPENCLAW_DOCKER_CACHE_HOME_DIR: string;
+  OPENCLAW_DOCKER_CLI_TOOLS_DIR: string;
+};
+
+function laneEnv(
+  poolLane: DockerE2eLane,
+  baseEnv: NodeJS.ProcessEnv,
+  logDir: string,
+  cacheKey: string | undefined,
+): DockerLaneEnv {
+  const name = poolLane.name;
+  const cacheName = cacheKey || name;
+  const env: DockerLaneEnv = {
+    ...baseEnv,
+    OPENCLAW_DOCKER_CACHE_HOME_DIR: path.resolve(
+      process.env.OPENCLAW_DOCKER_CACHE_HOME_DIR ?? path.join(logDir, `${cacheName}-cache`),
+    ),
+    OPENCLAW_DOCKER_CLI_TOOLS_DIR: path.resolve(
+      process.env.OPENCLAW_DOCKER_CLI_TOOLS_DIR ?? path.join(logDir, `${cacheName}-cli-tools`),
+    ),
+  };
+  env.OPENCLAW_DOCKER_ALL_LANE_NAME = name;
+  const image = e2eImageForLane(poolLane, baseEnv);
+  if (image) {
+    env.OPENCLAW_DOCKER_E2E_IMAGE = image;
+  }
+  if (poolLane.e2eImageKind) {
+    env.OPENCLAW_DOCKER_E2E_IMAGE_KIND = poolLane.e2eImageKind;
+  }
+  return env;
+}
+
+async function runLane(
+  lane: DockerE2eLane,
+  baseEnv: NodeJS.ProcessEnv,
+  logDir: string,
+  fallbackTimeoutMs: number,
+) {
+  const { name } = lane;
+  const timeoutMs = lane.timeoutMs ?? fallbackTimeoutMs;
+  const noOutputTimeoutMs = lane.noOutputTimeoutMs;
+  const logFile = path.join(logDir, `${name}.log`);
+  const env = laneEnv(lane, baseEnv, logDir, lane.cacheKey);
+  const command = prepareHarnessCommand(lane.command, env);
+  await mkdir(env.OPENCLAW_DOCKER_CLI_TOOLS_DIR, { recursive: true });
+  await mkdir(env.OPENCLAW_DOCKER_CACHE_HOME_DIR, { recursive: true });
+  await fs.promises.writeFile(
+    logFile,
+    [
+      `==> [${name}] cli tools dir: ${env.OPENCLAW_DOCKER_CLI_TOOLS_DIR}`,
+      `==> [${name}] cache dir: ${env.OPENCLAW_DOCKER_CACHE_HOME_DIR}`,
+      `==> [${name}] timeout: ${timeoutMs}ms`,
+      `==> [${name}] no output timeout: ${noOutputTimeoutMs ?? 0}ms`,
+      `==> [${name}] retries: ${lane.retries ?? 0}`,
+      `==> [${name}] e2e image kind: ${lane.e2eImageKind ?? "none"}`,
+      `==> [${name}] e2e image: ${env.OPENCLAW_DOCKER_E2E_IMAGE ?? ""}`,
+      `==> [${name}] trusted harness: ${HARNESS_ROOT_DIR}`,
+      `==> [${name}] candidate source: ${ROOT_DIR}`,
+      "",
+    ].join("\n"),
+  );
+  console.log(`==> [${name}] start`);
+  const startedAt = Date.now();
+  const startedAtIso = new Date(startedAt).toISOString();
+  let result: ShellCommandResult;
+  const attempts: ReturnType<typeof laneAttempt>[] = [];
+  const maxAttempts = 1 + Math.max(0, lane.retries ?? 0);
+  for (let attempt = 1; ; attempt += 1) {
+    const attemptStartedAt = Date.now();
+    if (attempt > 1) {
+      await fs.promises.appendFile(logFile, `\n==> [${name}] retry attempt ${attempt}\n`);
+      console.log(`==> [${name}] retry ${attempt}/${maxAttempts}`);
+    }
+    result = await runShellCommand({
+      command,
+      env,
+      label: name,
+      logFile,
+      timeoutMs,
+      noOutputTimeoutMs,
+    });
+    attempts.push(laneAttempt(attempt, attemptStartedAt, result));
+    if (result.status === 0 || attempt >= maxAttempts) {
+      break;
+    }
+    // An exhausted lane deadline alone does not diagnose a transient failure.
+    if (!(await laneLogMatchesRetryPattern(logFile, lane.retryPatterns))) {
+      break;
+    }
+  }
+  const elapsedSeconds = Math.round((Date.now() - startedAt) / 1000);
+  if (result.status === 0) {
+    console.log(`==> [${name}] pass ${elapsedSeconds}s`);
+  } else {
+    const timeoutLabel = result.timedOut ? " timeout" : "";
+    console.error(
+      `==> [${name}] fail${timeoutLabel} status=${result.status} ${elapsedSeconds}s log=${logFile}`,
+    );
+  }
+  return {
+    command,
+    attempts,
+    finishedAt: new Date().toISOString(),
+    image: env.OPENCLAW_DOCKER_E2E_IMAGE,
+    imageKind: lane.e2eImageKind,
+    logFile,
+    name,
+    elapsedSeconds,
+    rerunCommand: buildLaneRerunCommand(name, baseEnv),
+    startedAt: startedAtIso,
+    status: result.status,
+    noOutputTimedOut: result.noOutputTimedOut,
+    timedOut: result.timedOut,
+  };
+}
+
+async function runLanePool(
+  poolLanes: DockerE2eLane[],
+  baseEnv: NodeJS.ProcessEnv,
+  logDir: string,
+  parallelism: number,
+  options: LanePoolOptions,
+) {
+  const failures: LaneResult[] = [];
+  const results: LaneResult[] = [];
+  const pending = [...poolLanes];
+  const running = new Map<symbol, Promise<{ id: symbol; result: LaneResult }>>();
+  const active = {
+    count: 0,
+    resources: new Map<string, number>(),
+    weight: 0,
+  } satisfies SchedulerActiveState;
+  const activeLanes = new Map<string, number>();
+  let lastLaneStartAt = 0;
+  let laneStartQueue: Promise<void> = Promise.resolve();
+  const statusTimer =
+    options.statusIntervalMs > 0
+      ? setInterval(() => {
+          const runningSummary = [...activeLanes]
+            .map(([name, startedAt]) => `${name}:${Math.round((Date.now() - startedAt) / 1000)}s`)
+            .join(", ");
+          const resources = [...active.resources.entries()]
+            .map(([resource, value]) => `${resource}=${value}`)
+            .join(" ");
+          console.log(
+            `==> [${options.poolLabel}] active=${active.count} pending=${pending.length} ${resources}${
+              runningSummary ? ` lanes=${runningSummary}` : ""
+            }`,
+          );
+        }, options.statusIntervalMs)
+      : undefined;
+  statusTimer?.unref?.();
+
+  async function waitForLaneStartSlot() {
+    if (options.startStaggerMs <= 0) {
+      return;
+    }
+    const previous = laneStartQueue;
+    let releaseNext = () => {};
+    laneStartQueue = new Promise<void>((resolve) => {
+      releaseNext = resolve;
+    });
+    await previous;
+    const waitMs = Math.max(0, lastLaneStartAt + options.startStaggerMs - Date.now());
+    if (waitMs > 0) {
+      await sleep(waitMs);
+    }
+    lastLaneStartAt = Date.now();
+    releaseNext();
+  }
+
+  function canStartLane(candidate: DockerE2eLane) {
+    return canStartSchedulerLane(candidate, active, parallelism, options);
+  }
+
+  function reserve(candidate: DockerE2eLane) {
+    const weight = laneWeight(candidate);
+    active.count += 1;
+    active.weight += weight;
+    for (const resource of laneResources(candidate)) {
+      active.resources.set(resource, (active.resources.get(resource) ?? 0) + weight);
+    }
+  }
+
+  function release(candidate: DockerE2eLane) {
+    const weight = laneWeight(candidate);
+    active.count -= 1;
+    active.weight -= weight;
+    for (const resource of laneResources(candidate)) {
+      const next = (active.resources.get(resource) ?? 0) - weight;
+      if (next > 0) {
+        active.resources.set(resource, next);
+      } else {
+        active.resources.delete(resource);
+      }
+    }
+  }
+
+  async function startLane(poolLane: DockerE2eLane) {
+    await waitForLaneStartSlot();
+    reserve(poolLane);
+    activeLanes.set(poolLane.name, Date.now());
+    const id = Symbol(poolLane.name);
+    const promise = runLane(poolLane, baseEnv, logDir, options.timeoutMs)
+      .then((result) => ({ id, result }))
+      .finally(() => {
+        activeLanes.delete(poolLane.name);
+        release(poolLane);
+      });
+    running.set(id, promise);
+  }
+
+  try {
+    while (pending.length > 0 || running.size > 0) {
+      let started = false;
+      if (!options.failFast || failures.length === 0) {
+        for (let index = 0; index < pending.length;) {
+          const candidate = pending[index];
+          if (!candidate) {
+            break;
+          }
+          if (!canStartLane(candidate)) {
+            index += 1;
+            continue;
+          }
+          pending.splice(index, 1);
+          await startLane(candidate);
+          started = true;
+        }
+      }
+
+      if (started) {
+        continue;
+      }
+      if (running.size === 0) {
+        const blocked = pending.map(laneSummary).join(", ");
+        throw new Error(
+          `No Docker lanes fit scheduler limits (${describeDockerSchedulerLimits(
+            parallelism,
+            options,
+          )}): ${blocked}. Tune OPENCLAW_DOCKER_ALL_PARALLELISM, OPENCLAW_DOCKER_ALL_WEIGHT_LIMIT, or OPENCLAW_DOCKER_ALL_<RESOURCE>_LIMIT.`,
+        );
+      }
+
+      const { id, result } = await Promise.race(running.values());
+      running.delete(id);
+      results.push(result);
+      if (result.status !== 0) {
+        failures.push(result);
+      }
+      if (options.failFast && failures.length > 0) {
+        const remainingResults = await Promise.all(running.values());
+        running.clear();
+        for (const remaining of remainingResults) {
+          results.push(remaining.result);
+          if (remaining.result.status !== 0) {
+            failures.push(remaining.result);
+          }
+        }
+        break;
+      }
+    }
+  } finally {
+    if (statusTimer) {
+      clearInterval(statusTimer);
+    }
+  }
+
+  return { failures, results };
+}
+
+export async function tailFile(file: string, lines: number, maxBytes = LOG_TAIL_MAX_BYTES) {
+  let content: string;
+  try {
+    const handle = await open(file, "r");
+    try {
+      const stat = await handle.stat();
+      const bytesToRead = Math.min(Math.max(1, maxBytes), stat.size);
+      const buffer = Buffer.alloc(bytesToRead);
+      await handle.read(buffer, 0, bytesToRead, stat.size - bytesToRead);
+      content = buffer.toString("utf8");
+    } finally {
+      await handle.close().catch(() => {});
+    }
+  } catch {
+    content = "";
+  }
+  const tail = content.split(/\r?\n/).slice(-lines).join("\n");
+  return tail.trimEnd();
+}
+
+async function laneLogMatchesRetryPattern(logFile: string, patterns: RegExp[]) {
+  if (!patterns || patterns.length === 0) {
+    return false;
+  }
+  const tail = await tailFile(logFile, 160);
+  return patterns.some((pattern) => pattern.test(tail));
+}
+
+async function printFailureSummary(failures: LaneResult[], tailLines: number) {
+  console.error(`ERROR: ${failures.length} Docker lane(s) failed.`);
+  for (const failure of failures) {
+    console.error(`---- ${failure.name} failed (status=${failure.status}): ${failure.logFile}`);
+    const tail = await tailFile(failure.logFile, tailLines);
+    if (tail) {
+      console.error(tail);
+    }
+  }
+}
+
+const activeChildren = new Map<ChildProcess, number>();
+let activeChildrenShutdownPromise: Promise<unknown> | undefined;
+
+function shellCommandSkippedForShutdown(signal: ShutdownSignal | null = null) {
+  return {
+    noOutputTimedOut: false,
+    signal,
+    status: 143,
+    timedOut: false,
+  };
+}
+
+function shellCaptureSkippedForShutdown(label: string, signal: ShutdownSignal | null = null) {
+  return {
+    label,
+    signal,
+    status: 143,
+    stderr: "",
+    stderrTruncated: false,
+    stdout: "",
+    stdoutTruncated: false,
+    timedOut: false,
+  };
+}
+
+function shellProcessGroupAlive(child: ChildProcess) {
+  return inspectManagedProcessGroup(child, { errorPolicy: "alive-on-eperm" }) === "live";
+}
+
+function waitForShellProcessGroupExit(child: ChildProcess, timeoutMs: number) {
+  return waitForManagedProcessGroupExit(child, timeoutMs, { errorPolicy: "alive-on-eperm" });
+}
+
+async function finishTimedOutShellProcessTree(
+  child: ChildProcess,
+  killAt: number | undefined,
+  timeoutKillGraceMs: number,
+) {
+  if (!shellProcessGroupAlive(child)) {
+    return;
+  }
+  const graceRemainingMs =
+    killAt === undefined ? timeoutKillGraceMs : Math.max(0, killAt - Date.now());
+  if (graceRemainingMs > 0) {
+    await waitForShellProcessGroupExit(child, graceRemainingMs);
+  }
+  if (shellProcessGroupAlive(child)) {
+    terminateChild(child, "SIGKILL");
+  }
+  await waitForShellProcessGroupExit(child, SHELL_POST_FORCE_KILL_WAIT_MS);
+}
+
+function terminateChild(child: ChildProcess, signal: ShutdownSignal) {
+  terminateManagedChild(child, signal, {
+    onChildSignalError(error) {
+      throw error;
+    },
+    useWindowsTaskkill: false,
+  });
+}
+
+function terminateActiveChildren(signal: ShutdownSignal) {
+  for (const child of activeChildren.keys()) {
+    terminateChild(child, signal);
+  }
+}
+
+async function shutdownActiveChildren(signal: ShutdownSignal, exitCode: number) {
+  if (activeChildrenShutdownPromise) {
+    terminateActiveChildren("SIGKILL");
+    return activeChildrenShutdownPromise;
+  }
+  const children = [...activeChildren.entries()];
+  terminateActiveChildren(signal);
+  activeChildrenShutdownPromise = Promise.all(
+    children.map(([child, timeoutKillGraceMs]) =>
+      finishTimedOutShellProcessTree(child, Date.now() + timeoutKillGraceMs, timeoutKillGraceMs),
+    ),
+  ).finally(() => {
+    process.exit(exitCode);
+  });
+  return activeChildrenShutdownPromise;
+}
+
+process.on("SIGINT", () => {
+  void shutdownActiveChildren("SIGINT", 130);
+});
+process.on("SIGTERM", () => {
+  void shutdownActiveChildren("SIGTERM", 143);
+});
+
+async function main() {
+  const runStartedAt = new Date().toISOString();
+  const phases: Array<Record<string, unknown>> = [];
+  const parallelism = parsePositiveInt(
+    process.env.OPENCLAW_DOCKER_ALL_PARALLELISM,
+    DEFAULT_PARALLELISM,
+    "OPENCLAW_DOCKER_ALL_PARALLELISM",
+  );
+  const tailParallelism = parsePositiveInt(
+    process.env.OPENCLAW_DOCKER_ALL_TAIL_PARALLELISM,
+    Math.min(parallelism, DEFAULT_TAIL_PARALLELISM),
+    "OPENCLAW_DOCKER_ALL_TAIL_PARALLELISM",
+  );
+  const tailLines = parsePositiveInt(
+    process.env.OPENCLAW_DOCKER_ALL_FAILURE_TAIL_LINES,
+    DEFAULT_FAILURE_TAIL_LINES,
+    "OPENCLAW_DOCKER_ALL_FAILURE_TAIL_LINES",
+  );
+  const laneTimeoutMs = parsePositiveInt(
+    process.env.OPENCLAW_DOCKER_ALL_LANE_TIMEOUT_MS,
+    DEFAULT_LANE_TIMEOUT_MS,
+    "OPENCLAW_DOCKER_ALL_LANE_TIMEOUT_MS",
+  );
+  const laneStartStaggerMs = parseNonNegativeInt(
+    process.env.OPENCLAW_DOCKER_ALL_START_STAGGER_MS,
+    DEFAULT_LANE_START_STAGGER_MS,
+    "OPENCLAW_DOCKER_ALL_START_STAGGER_MS",
+  );
+  const statusIntervalMs = parseNonNegativeInt(
+    process.env.OPENCLAW_DOCKER_ALL_STATUS_INTERVAL_MS,
+    DEFAULT_STATUS_INTERVAL_MS,
+    "OPENCLAW_DOCKER_ALL_STATUS_INTERVAL_MS",
+  );
+  const preflightRunTimeoutMs = parsePositiveInt(
+    process.env.OPENCLAW_DOCKER_ALL_PREFLIGHT_RUN_TIMEOUT_MS,
+    DEFAULT_PREFLIGHT_RUN_TIMEOUT_MS,
+    "OPENCLAW_DOCKER_ALL_PREFLIGHT_RUN_TIMEOUT_MS",
+  );
+  const failFast = parseBool(process.env.OPENCLAW_DOCKER_ALL_FAIL_FAST, true);
+  const dryRun = parseBool(process.env.OPENCLAW_DOCKER_ALL_DRY_RUN, false);
+  const preflightEnabled = parseBool(process.env.OPENCLAW_DOCKER_ALL_PREFLIGHT, true);
+  const preflightCleanup = parseBool(process.env.OPENCLAW_DOCKER_ALL_PREFLIGHT_CLEANUP, true);
+  const timingsEnabled = parseBool(process.env.OPENCLAW_DOCKER_ALL_TIMINGS, true);
+  const buildEnabled = parseBool(process.env.OPENCLAW_DOCKER_ALL_BUILD, true);
+  const allowFrozenTargetScenarioOmissions = parseBool(
+    process.env.OPENCLAW_ALLOW_FROZEN_TARGET_SCENARIO_OMISSIONS,
+    false,
+  );
+  const planJson =
+    cliOptions.planJson || parseBool(process.env.OPENCLAW_DOCKER_ALL_PLAN_JSON, false);
+  const planReleaseAll = parseBool(process.env.OPENCLAW_DOCKER_ALL_PLAN_RELEASE_ALL, false);
+  const profile = parseProfile(process.env.OPENCLAW_DOCKER_ALL_PROFILE);
+  const releaseProfile = normalizeReleaseProfileEnv(
+    process.env.OPENCLAW_DOCKER_ALL_RELEASE_PROFILE || process.env.OPENCLAW_RELEASE_PROFILE,
+  );
+  const releaseChunk = process.env.OPENCLAW_DOCKER_ALL_CHUNK || process.env.DOCKER_E2E_CHUNK || "";
+  const includeOpenWebUI = parseBool(
+    process.env.OPENCLAW_DOCKER_ALL_INCLUDE_OPENWEBUI ?? process.env.INCLUDE_OPENWEBUI,
+    true,
+  );
+  const selectedLaneNamesRaw =
+    process.env.OPENCLAW_DOCKER_ALL_LANES || process.env.DOCKER_E2E_LANES || "";
+  const selectedLaneNames = parseLaneSelection(selectedLaneNamesRaw);
+  if (selectedLaneNamesRaw && selectedLaneNames.length === 0) {
+    throw new Error("OPENCLAW_DOCKER_ALL_LANES must include at least one lane name");
+  }
+  const liveMode = parseLiveMode(process.env.OPENCLAW_DOCKER_ALL_LIVE_MODE);
+  const liveRetries = parseNonNegativeInt(
+    process.env.OPENCLAW_DOCKER_ALL_LIVE_RETRIES,
+    DEFAULT_LIVE_RETRIES,
+    "OPENCLAW_DOCKER_ALL_LIVE_RETRIES",
+  );
+  const timingsFile = path.resolve(
+    process.env.OPENCLAW_DOCKER_ALL_TIMINGS_FILE || DEFAULT_TIMINGS_FILE,
+  );
+  const runId = process.env.OPENCLAW_DOCKER_ALL_RUN_ID || utcStampForPath();
+  const logDir = path.resolve(
+    process.env.OPENCLAW_DOCKER_ALL_LOG_DIR ||
+      path.join(ROOT_DIR, ".artifacts/docker-tests", runId),
+  );
+
+  const baseEnv = commandEnv({
+    OPENCLAW_DOCKER_E2E_REPO_ROOT: ROOT_DIR,
+    OPENCLAW_DOCKER_E2E_TRUSTED_HARNESS_DIR: HARNESS_ROOT_DIR,
+    OPENCLAW_LIVE_DOCKER_REPO_ROOT: ROOT_DIR,
+    OPENCLAW_DOCKER_E2E_BARE_IMAGE:
+      process.env.OPENCLAW_DOCKER_E2E_BARE_IMAGE ||
+      process.env.OPENCLAW_DOCKER_E2E_IMAGE ||
+      DEFAULT_E2E_BARE_IMAGE,
+    OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE:
+      process.env.OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE ||
+      process.env.OPENCLAW_DOCKER_E2E_IMAGE ||
+      DEFAULT_E2E_FUNCTIONAL_IMAGE,
+  });
+  baseEnv.OPENCLAW_DOCKER_E2E_IMAGE =
+    process.env.OPENCLAW_DOCKER_E2E_IMAGE || baseEnv.OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE;
+  const writeSummary = (summary: RunSummary) => writeRunSummary(logDir, summary, baseEnv);
+  appendExtension(baseEnv, "matrix");
+  appendExtension(baseEnv, "acpx");
+  appendExtension(baseEnv, "codex");
+
+  const timingStore = await loadTimingStore(timingsFile, timingsEnabled);
+  const { omittedUnsupportedLaneNames, orderedLanes, orderedTailLanes, plan, scheduledLanes } =
+    resolveDockerE2ePlan({
+      includeOpenWebUI,
+      liveMode,
+      liveRetries,
+      orderLanes,
+      planReleaseAll: planJson && planReleaseAll,
+      profile,
+      releaseChunk,
+      releaseProfile,
+      selectedLaneNames,
+      timingStore,
+      upgradeSurvivorBaselines: process.env.OPENCLAW_UPGRADE_SURVIVOR_BASELINE_SPECS,
+      upgradeSurvivorScenarios: process.env.OPENCLAW_UPGRADE_SURVIVOR_SCENARIOS,
+      upgradeSurvivorTargetRoot: process.env.OPENCLAW_UPGRADE_SURVIVOR_TARGET_ROOT,
+      allowFrozenTargetScenarioOmissions,
+    });
+  if (omittedUnsupportedLaneNames.length > 0 && !allowFrozenTargetScenarioOmissions) {
+    throw new Error(
+      `frozen target scenario omissions require trusted workflow opt-in: ${omittedUnsupportedLaneNames.join(", ")}`,
+    );
+  }
+  if (scheduledLanes.length === 0 && omittedUnsupportedLaneNames.length === 0) {
+    throw new Error(
+      [
+        "resolved zero Docker lanes",
+        `profile=${profile}`,
+        `releaseChunk=${releaseChunk || "<none>"}`,
+        `releaseProfile=${releaseProfile}`,
+        `liveMode=${liveMode}`,
+        `includeOpenWebUI=${includeOpenWebUI ? "1" : "0"}`,
+        `selectedLanes=${selectedLaneNames.length > 0 ? selectedLaneNames.join(",") : "<none>"}`,
+      ].join("; "),
+    );
+  }
+  const omittedUnsupportedLanes =
+    omittedUnsupportedLaneNames.length > 0 ? omittedUnsupportedLaneNames : undefined;
+
+  if (cliOptions.preparePluginRegistry) {
+    if (!plan.needs.prepublishPluginRegistry) {
+      throw new Error("selected Docker lanes do not require a prepublish plugin registry");
+    }
+    const registry = preparePrepublishPluginRegistry(
+      plan,
+      logDir,
+      gitOutput(ROOT_DIR, ["rev-parse", "HEAD"]),
+      rootPackageVersion(ROOT_DIR),
+    );
+    process.stdout.write(`${JSON.stringify(registry)}\n`);
+    return;
+  }
+  if (planJson) {
+    process.stdout.write(`${JSON.stringify(plan, null, 2)}\n`);
+    return;
+  }
+  if (cliOptions.prepareOnly) {
+    await prepareDockerCandidate(plan, logDir, path.resolve(cliOptions.prepareOnly));
+    return;
+  }
+
+  await mkdir(logDir, { recursive: true });
+  console.log(`==> Docker test logs: ${logDir}`);
+  console.log(`==> Profile: ${profile}${releaseChunk ? ` chunk=${releaseChunk}` : ""}`);
+  if (profile === RELEASE_PATH_PROFILE) {
+    console.log(`==> Release profile: ${releaseProfile}`);
+  }
+  console.log(`==> Parallelism: ${parallelism}`);
+  console.log(`==> Tail parallelism: ${tailParallelism}`);
+  console.log(`==> Lane timeout: ${laneTimeoutMs}ms`);
+  console.log(`==> Live mode: ${liveMode}`);
+  console.log(`==> Live retries: ${liveRetries}`);
+  console.log(`==> Lane start stagger: ${laneStartStaggerMs}ms`);
+  console.log(`==> Status interval: ${statusIntervalMs}ms`);
+  console.log(`==> Fail fast: ${failFast ? "yes" : "no"}`);
+  console.log(`==> Dry run: ${dryRun ? "yes" : "no"}`);
+  console.log(
+    `==> Docker preflight: ${preflightEnabled ? "yes" : "no"}${
+      preflightCleanup ? " cleanup=yes" : " cleanup=no"
+    }`,
+  );
+  console.log(`==> Build shared Docker images: ${buildEnabled ? "yes" : "no"}`);
+  console.log(`==> Docker E2E bare image: ${baseEnv.OPENCLAW_DOCKER_E2E_BARE_IMAGE}`);
+  console.log(`==> Docker E2E functional image: ${baseEnv.OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE}`);
+  if (profile === RELEASE_PATH_PROFILE) {
+    console.log(`==> Include Open WebUI: ${includeOpenWebUI ? "yes" : "no"}`);
+  }
+  if (selectedLaneNames.length > 0) {
+    console.log(`==> Selected lanes: ${selectedLaneNames.join(", ")}`);
+  }
+  console.log(`==> Docker lane timings: ${timingStore.enabled ? timingsFile : "disabled"}`);
+  console.log(`==> Live-test bundled plugins: ${baseEnv.OPENCLAW_DOCKER_BUILD_EXTENSIONS}`);
+  const schedulerOptions = parseSchedulerOptions(process.env, parallelism);
+  const tailSchedulerOptions = parseSchedulerOptions(process.env, tailParallelism);
+  console.log(
+    `==> Scheduler: weight=${schedulerOptions.weightLimit} ${resourceLimitsSummary(schedulerOptions.resourceLimits)}`,
+  );
+  console.log(
+    `==> Tail scheduler: weight=${tailSchedulerOptions.weightLimit} ${resourceLimitsSummary(tailSchedulerOptions.resourceLimits)}`,
+  );
+  printLaneManifest("Main", orderedLanes, timingStore);
+  printLaneManifest("Tail", orderedTailLanes, timingStore);
+  if (omittedUnsupportedLanes) {
+    console.log(
+      `==> Docker lanes omitted: target lacks ${omittedUnsupportedLanes.join(", ")} scenario support`,
+    );
+  }
+  if (dryRun) {
+    console.log("==> Dry run complete");
+    return;
+  }
+  validateDockerCandidateEnvironment(baseEnv, plan);
+
+  // An authorized frozen target can prove that a selected scenario did not exist yet.
+  // Preserve that explicit non-outcome instead of fabricating a failed execution.
+  if (scheduledLanes.length === 0) {
+    await writeSummary({
+      chunk: releaseChunk || undefined,
+      failures: [],
+      lanes: [],
+      omittedUnsupportedLanes,
+      phases,
+      profile,
+      selectedLanes: selectedLaneNames.length > 0 ? selectedLaneNames : undefined,
+      startedAt: runStartedAt,
+      status: "passed",
+    });
+    console.log("==> Docker test suite passed: no selected lane is supported by the frozen target");
+    return;
+  }
+
+  await runPhase(
+    phases,
+    "docker-preflight",
+    { cleanup: preflightCleanup, enabled: preflightEnabled },
+    async () => {
+      await runDockerPreflight(baseEnv, {
+        cleanup: preflightCleanup,
+        enabled: preflightEnabled,
+        runTimeoutMs: preflightRunTimeoutMs,
+      });
+    },
+  );
+  if (lanesNeedOpenClawPackage(scheduledLanes)) {
+    await runPhase(phases, "prepare-openclaw-package", {}, async () => {
+      await prepareOpenClawPackage(baseEnv, logDir);
+    });
+  } else {
+    console.log("==> OpenClaw package: not needed for selected lanes");
+  }
+  if (plan.needs.prepublishPluginRegistry && !baseEnv.OPENCLAW_PREPUBLISH_PLUGIN_REGISTRY_DIR) {
+    await runPhase(phases, "prepare-prepublish-plugin-registry", {}, async () => {
+      const registry = preparePrepublishPluginRegistry(
+        plan,
+        logDir,
+        gitOutput(ROOT_DIR, ["rev-parse", "HEAD"]),
+        rootPackageVersion(ROOT_DIR),
+      );
+      baseEnv.OPENCLAW_PREPUBLISH_PLUGIN_REGISTRY_DIR = registry.dir;
+      baseEnv.OPENCLAW_PREPUBLISH_PLUGIN_REGISTRY_CANDIDATE_VERSION = registry.candidateVersion;
+      baseEnv.OPENCLAW_PREPUBLISH_PLUGIN_REGISTRY_MANIFEST_SHA256 = registry.manifestSha256;
+    });
+  }
+
+  if (buildEnabled) {
+    const buildEntries: ForegroundEntry[] = [];
+    if (scheduledLanes.some((poolLane) => poolLane.needsLiveImage)) {
+      buildEntries.push({
+        command: liveDockerScriptCommand("test-live-build-docker.sh", "", { skipBuild: false }),
+        label: "shared live-test image once",
+        phaseDetails: { imageKind: "live" },
+        phases,
+      });
+    }
+    if (lanesNeedE2eImageKind(scheduledLanes, "bare")) {
+      buildEntries.push({
+        command: prepareHarnessCommand("pnpm test:docker:e2e-build", baseEnv),
+        env: {
+          OPENCLAW_DOCKER_E2E_IMAGE: baseEnv.OPENCLAW_DOCKER_E2E_BARE_IMAGE,
+          OPENCLAW_DOCKER_E2E_TARGET: "bare",
+        },
+        label: `shared bare Docker E2E image once: ${baseEnv.OPENCLAW_DOCKER_E2E_BARE_IMAGE}`,
+        phaseDetails: { image: baseEnv.OPENCLAW_DOCKER_E2E_BARE_IMAGE, imageKind: "bare" },
+        phases,
+      });
+    }
+    if (lanesNeedE2eImageKind(scheduledLanes, "functional")) {
+      buildEntries.push({
+        command: prepareHarnessCommand("pnpm test:docker:e2e-build", baseEnv),
+        env: {
+          OPENCLAW_DOCKER_E2E_IMAGE: baseEnv.OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE,
+          OPENCLAW_DOCKER_E2E_TARGET: "functional",
+        },
+        label: `shared functional Docker E2E image once: ${baseEnv.OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE}`,
+        phaseDetails: {
+          image: baseEnv.OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE,
+          imageKind: "functional",
+        },
+        phases,
+      });
+    }
+    await runForegroundGroup(buildEntries, baseEnv);
+  } else {
+    console.log(`==> Shared Docker image builds: skipped`);
+  }
+
+  const options = {
+    ...schedulerOptions,
+    failFast,
+    poolLabel: "main",
+    startStaggerMs: laneStartStaggerMs,
+    statusIntervalMs,
+    timeoutMs: laneTimeoutMs,
+  } satisfies LanePoolOptions;
+  const mainResult = await runPhase(phases, "main-lane-pool", { lanes: orderedLanes.length }, () =>
+    runLanePool(orderedLanes, baseEnv, logDir, parallelism, options),
+  );
+  const failures = [...mainResult.failures];
+  const allResults = [...mainResult.results];
+  await writeTimingStore(timingStore, mainResult.results);
+  if (failFast && failures.length > 0) {
+    await writeSummary({
+      chunk: releaseChunk || undefined,
+      failures,
+      image: baseEnv.OPENCLAW_DOCKER_E2E_IMAGE,
+      images: {
+        bare: baseEnv.OPENCLAW_DOCKER_E2E_BARE_IMAGE,
+        functional: baseEnv.OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE,
+      },
+      lanes: allResults,
+      omittedUnsupportedLanes,
+      phases,
+      profile,
+      selectedLanes: selectedLaneNames.length > 0 ? selectedLaneNames : undefined,
+      startedAt: runStartedAt,
+      status: "failed",
+    });
+    await printFailureSummary(failures, tailLines);
+    process.exit(1);
+  }
+
+  if (orderedTailLanes.length > 0) {
+    console.log("==> Running provider-sensitive Docker tail lanes");
+    const tailResult = await runPhase(
+      phases,
+      "tail-lane-pool",
+      { lanes: orderedTailLanes.length },
+      () =>
+        runLanePool(orderedTailLanes, baseEnv, logDir, tailParallelism, {
+          ...options,
+          ...tailSchedulerOptions,
+          poolLabel: "tail",
+        }),
+    );
+    failures.push(...tailResult.failures);
+    allResults.push(...tailResult.results);
+    await writeTimingStore(timingStore, tailResult.results);
+  } else {
+    console.log("==> Provider-sensitive Docker tail lanes: none");
+  }
+  if (failures.length > 0) {
+    await writeSummary({
+      chunk: releaseChunk || undefined,
+      failures,
+      image: baseEnv.OPENCLAW_DOCKER_E2E_IMAGE,
+      images: {
+        bare: baseEnv.OPENCLAW_DOCKER_E2E_BARE_IMAGE,
+        functional: baseEnv.OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE,
+      },
+      lanes: allResults,
+      omittedUnsupportedLanes,
+      phases,
+      profile,
+      selectedLanes: selectedLaneNames.length > 0 ? selectedLaneNames : undefined,
+      startedAt: runStartedAt,
+      status: "failed",
+    });
+    await printFailureSummary(failures, tailLines);
+    process.exit(1);
+  }
+
+  if (profile === DEFAULT_PROFILE && selectedLaneNames.length === 0) {
+    const cleanupFailure = await runCleanupSmokePhase(baseEnv, logDir, phases);
+    if (cleanupFailure) {
+      failures.push(cleanupFailure);
+    }
+  } else {
+    console.log("==> Cleanup smoke after parallel lanes: skipped for selected/release lanes");
+  }
+  await writeTimingStore(timingStore, allResults);
+  if (failures.length > 0) {
+    await writeSummary({
+      chunk: releaseChunk || undefined,
+      failures,
+      image: baseEnv.OPENCLAW_DOCKER_E2E_IMAGE,
+      images: {
+        bare: baseEnv.OPENCLAW_DOCKER_E2E_BARE_IMAGE,
+        functional: baseEnv.OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE,
+      },
+      lanes: allResults,
+      omittedUnsupportedLanes,
+      phases,
+      profile,
+      selectedLanes: selectedLaneNames.length > 0 ? selectedLaneNames : undefined,
+      startedAt: runStartedAt,
+      status: "failed",
+    });
+    await printFailureSummary(failures, tailLines);
+    process.exit(1);
+  }
+  await writeSummary({
+    chunk: releaseChunk || undefined,
+    failures,
+    image: baseEnv.OPENCLAW_DOCKER_E2E_IMAGE,
+    images: {
+      bare: baseEnv.OPENCLAW_DOCKER_E2E_BARE_IMAGE,
+      functional: baseEnv.OPENCLAW_DOCKER_E2E_FUNCTIONAL_IMAGE,
+    },
+    lanes: allResults,
+    omittedUnsupportedLanes,
+    phases,
+    profile,
+    selectedLanes: selectedLaneNames.length > 0 ? selectedLaneNames : undefined,
+    startedAt: runStartedAt,
+    status: "passed",
+  });
+  console.log("==> Docker test suite passed");
+}
+
+if (IS_MAIN) {
+  await main().catch((error: unknown) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+  });
+}
diff --git a/scripts/test-extension.mts b/scripts/test-extension.mts
new file mode 100644
index 0000000000000000000000000000000000000000..a30d2d7150f46974006dee8bf50d60e7adeff54e
--- /dev/null
+++ b/scripts/test-extension.mts
@@ -0,0 +1,68 @@
+#!/usr/bin/env node
+
+// Runs the Vitest plan for one bundled plugin by id or path.
+import { formatErrorMessage } from "./lib/error-format.mts";
+import { mergeExtensionTestPlans, resolveExtensionTestPlan } from "./lib/extension-test-plan.mts";
+import { isDirectScriptRun } from "./lib/vitest-batch-runner.mts";
+import { runExtensionBatchPlan } from "./test-extension-batch.mts";
+
+const ALLOW_NO_TESTS_FLAG = "--allow-no-tests";
+
+function printUsage(): void {
+  console.error(
+    `Usage: pnpm test:extension <extension-name|path> [${ALLOW_NO_TESTS_FLAG}] [vitest args...]`,
+  );
+  console.error(
+    `       node --import tsx scripts/test-extension.mts [extension-name|path] [${ALLOW_NO_TESTS_FLAG}] [vitest args...]`,
+  );
+}
+
+function printNoTestsMessage(plan: { extensionDir: string }): void {
+  console.error(`[test-extension] No tests found for ${plan.extensionDir}.`);
+}
+
+async function run(): Promise<void> {
+  const rawArgs = process.argv.slice(2);
+  if (rawArgs.includes("--help") || rawArgs.includes("-h")) {
+    printUsage();
+    return;
+  }
+
+  const allowNoTests = rawArgs.includes(ALLOW_NO_TESTS_FLAG);
+  const passthroughArgs = rawArgs.filter((arg) => arg !== "--" && arg !== ALLOW_NO_TESTS_FLAG);
+
+  let targetArg: string | undefined;
+  if (passthroughArgs[0] && !passthroughArgs[0].startsWith("-")) {
+    targetArg = passthroughArgs.shift();
+  }
+
+  let plan;
+  try {
+    plan = resolveExtensionTestPlan({ cwd: process.cwd(), targetArg });
+  } catch (error) {
+    printUsage();
+    console.error(formatErrorMessage(error));
+    process.exit(1);
+  }
+
+  if (!plan.hasTests) {
+    printNoTestsMessage(plan);
+    if (!allowNoTests) {
+      process.exit(1);
+    }
+    return;
+  }
+
+  console.log(`[test-extension] Running ${plan.testFileCount} test files for ${plan.extensionId}`);
+  const finalExitCode = await runExtensionBatchPlan(mergeExtensionTestPlans([plan]), {
+    expandExactExcludes: false,
+    vitestArgs: passthroughArgs,
+  });
+  if (finalExitCode !== 0) {
+    process.exit(finalExitCode);
+  }
+}
+
+if (isDirectScriptRun(import.meta.url)) {
+  await run();
+}
diff --git a/scripts/test-hotspots.mts b/scripts/test-hotspots.mts
new file mode 100644
index 0000000000000000000000000000000000000000..fb1fd12a487227cde24e42fd440efd54e6899f89
--- /dev/null
+++ b/scripts/test-hotspots.mts
@@ -0,0 +1,54 @@
+// Prints the slowest test files from a Vitest JSON report.
+import {
+  formatMs,
+  loadVitestReportFromArgs,
+  parseVitestReportArgs,
+} from "./lib/vitest-report-cli-utils.mts";
+import { collectVitestFileDurations } from "./test-report-utils.mts";
+
+if (process.argv.slice(2).includes("--help")) {
+  console.log(
+    [
+      "Usage: node --import tsx scripts/test-hotspots.mts [options]",
+      "",
+      "Print the slowest test files from a Vitest JSON report.",
+      "",
+      "Options:",
+      "  --config <path>    Vitest config to run when no report is supplied",
+      "  --report <path>    Reuse an existing Vitest JSON report",
+      "  --limit <count>    Number of files to print (default: 20)",
+      "  --help             Show this help text",
+      "",
+      "Examples:",
+      "  node --import tsx scripts/test-hotspots.mts",
+      "  node --import tsx scripts/test-hotspots.mts --config test/vitest/vitest.channels.config.ts --limit 10",
+      "  node --import tsx scripts/test-hotspots.mts --report /tmp/vitest-report.json",
+    ].join("\n"),
+  );
+  process.exit(0);
+}
+
+const opts = parseVitestReportArgs(process.argv.slice(2), {
+  config: "test/vitest/vitest.unit.config.ts",
+  limit: 20,
+});
+const report = loadVitestReportFromArgs(opts, "openclaw-vitest-hotspots");
+const fileResults = collectVitestFileDurations(report).toSorted(
+  (a, b) => b.durationMs - a.durationMs,
+);
+if (fileResults.length === 0) {
+  console.error("[test-hotspots] Vitest JSON report contained no timed file results.");
+  process.exit(1);
+}
+
+const top = fileResults.slice(0, opts.limit);
+const totalDurationMs = fileResults.reduce((sum, item) => sum + item.durationMs, 0);
+console.log(
+  `\n[test-hotspots] top ${String(top.length)} by file duration (${formatMs(totalDurationMs)} total)`,
+);
+for (const [index, item] of top.entries()) {
+  const label = String(index + 1).padStart(2, " ");
+  const duration = formatMs(item.durationMs).padStart(10, " ");
+  const tests = String(item.testCount).padStart(4, " ");
+  console.log(`${label}. ${duration} | tests=${tests} | ${item.file}`);
+}
diff --git a/scripts/test-live-build-docker.sh b/scripts/test-live-build-docker.sh
new file mode 100644
index 0000000000000000000000000000000000000000..450ae22d4e4252c36c7ff55de7b39dc1f2b08fa3
--- /dev/null
+++ b/scripts/test-live-build-docker.sh
@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# Bash 5.3+ can deadlock writing heredoc pipes on macOS before the reader starts.
+if [[ ${OSTYPE:-} == darwin* && $BASH != /bin/bash ]] && ((BASH_VERSINFO[0] > 5 || (BASH_VERSINFO[0] == 5 && BASH_VERSINFO[1] >= 3))); then
+  exec /bin/bash "$0" "$@"
+fi
+set -euo pipefail
+
+SCRIPT_ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+ROOT_DIR="${OPENCLAW_LIVE_DOCKER_REPO_ROOT:-$SCRIPT_ROOT_DIR}"
+ROOT_DIR="$(cd "$ROOT_DIR" && pwd)"
+source "$SCRIPT_ROOT_DIR/scripts/lib/docker-build.sh"
+source "$SCRIPT_ROOT_DIR/scripts/lib/docker-e2e-container.sh"
+DOCKER_COMMAND_TIMEOUT="${DOCKER_COMMAND_TIMEOUT:-${OPENCLAW_LIVE_DOCKER_PULL_TIMEOUT:-600s}}"
+IMAGE_NAME="${OPENCLAW_IMAGE:-openclaw:local}"
+LIVE_IMAGE_NAME="${OPENCLAW_LIVE_IMAGE:-${IMAGE_NAME}-live}"
+DOCKER_BUILD_EXTENSIONS="${OPENCLAW_DOCKER_BUILD_EXTENSIONS:-${OPENCLAW_EXTENSIONS:-}}"
+LIVE_IMAGE_PULL_ATTEMPTS="${OPENCLAW_LIVE_DOCKER_PULL_ATTEMPTS:-3}"
+LIVE_IMAGE_PULL_RETRY_DELAY_SECONDS="${OPENCLAW_LIVE_DOCKER_PULL_RETRY_DELAY_SECONDS:-5}"
+
+if ! [[ "$LIVE_IMAGE_PULL_ATTEMPTS" =~ ^[1-9][0-9]*$ ]]; then
+  echo "OPENCLAW_LIVE_DOCKER_PULL_ATTEMPTS must be a positive integer, got: $LIVE_IMAGE_PULL_ATTEMPTS" >&2
+  exit 2
+fi
+if ! [[ "$LIVE_IMAGE_PULL_RETRY_DELAY_SECONDS" =~ ^[0-9]+$ ]]; then
+  echo "OPENCLAW_LIVE_DOCKER_PULL_RETRY_DELAY_SECONDS must be a non-negative integer, got: $LIVE_IMAGE_PULL_RETRY_DELAY_SECONDS" >&2
+  exit 2
+fi
+
+DOCKER_BUILD_EXTENSIONS="$(node "$SCRIPT_ROOT_DIR/scripts/print-live-docker-plugin-selection.mjs" "$ROOT_DIR" "$DOCKER_BUILD_EXTENSIONS")"
+
+DOCKER_BUILD_ARGS=()
+if [[ -n "${DOCKER_BUILD_EXTENSIONS}" ]]; then
+  DOCKER_BUILD_ARGS+=(--build-arg "OPENCLAW_EXTENSIONS=${DOCKER_BUILD_EXTENSIONS}")
+fi
+
+pull_live_image() {
+  local attempt
+  for attempt in $(seq 1 "$LIVE_IMAGE_PULL_ATTEMPTS"); do
+    echo "==> Pull live-test image attempt ${attempt}/${LIVE_IMAGE_PULL_ATTEMPTS}: $LIVE_IMAGE_NAME"
+    if docker_e2e_docker_cmd pull "$LIVE_IMAGE_NAME"; then
+      return 0
+    fi
+    if [[ "$attempt" -lt "$LIVE_IMAGE_PULL_ATTEMPTS" && "$LIVE_IMAGE_PULL_RETRY_DELAY_SECONDS" -gt 0 ]]; then
+      sleep "$LIVE_IMAGE_PULL_RETRY_DELAY_SECONDS"
+    fi
+  done
+  return 1
+}
+
+if [[ "${OPENCLAW_SKIP_DOCKER_BUILD:-}" == "1" ]]; then
+  echo "==> Reuse live-test image: $LIVE_IMAGE_NAME"
+  if docker_e2e_docker_cmd image inspect "$LIVE_IMAGE_NAME" >/dev/null 2>&1; then
+    exit 0
+  fi
+  if [[ "${OPENCLAW_LIVE_REQUIRE_LOCAL_IMAGE:-0}" == "1" ]]; then
+    echo "Required local live-test image not found: $LIVE_IMAGE_NAME" >&2
+    exit 1
+  fi
+  echo "==> Live-test image not found locally; pulling: $LIVE_IMAGE_NAME"
+  if pull_live_image; then
+    exit 0
+  fi
+  if ! docker_build_on_missing_enabled; then
+    echo "Live-test image not found: $LIVE_IMAGE_NAME" >&2
+    echo "Build it first or unset OPENCLAW_SKIP_DOCKER_BUILD." >&2
+    exit 1
+  fi
+  echo "==> Live-test image not available; building because OPENCLAW_DOCKER_BUILD_ON_MISSING/OPENCLAW_TESTBOX allows fallback."
+fi
+
+echo "==> Build live-test image: $LIVE_IMAGE_NAME (target=build)"
+echo "==> Bundled plugins: ${DOCKER_BUILD_EXTENSIONS}"
+docker_build_run live-build ${DOCKER_BUILD_ARGS[@]+"${DOCKER_BUILD_ARGS[@]}"} --target build -t "$LIVE_IMAGE_NAME" -f "$ROOT_DIR/Dockerfile" "$ROOT_DIR"
diff --git a/scripts/test-live-cli-backend-docker.sh b/scripts/test-live-cli-backend-docker.sh
new file mode 100644
index 0000000000000000000000000000000000000000..74a6b47661a61bae0ed23c97110b5e8ff96f0165
--- /dev/null
+++ b/scripts/test-live-cli-backend-docker.sh
@@ -0,0 +1,400 @@
+#!/usr/bin/env bash
+# Bash 5.3+ can deadlock writing heredoc pipes on macOS before the reader starts.
+if [[ ${OSTYPE:-} == darwin* && $BASH != /bin/bash ]] && ((BASH_VERSINFO[0] > 5 || (BASH_VERSINFO[0] == 5 && BASH_VERSINFO[1] >= 3))); then
+  exec /bin/bash "$0" "$@"
+fi
+set -euo pipefail
+
+SCRIPT_ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+ROOT_DIR="${OPENCLAW_LIVE_DOCKER_REPO_ROOT:-$SCRIPT_ROOT_DIR}"
+ROOT_DIR="$(cd "$ROOT_DIR" && pwd)"
+TRUSTED_HARNESS_DIR="${OPENCLAW_LIVE_DOCKER_TRUSTED_HARNESS_DIR:-$SCRIPT_ROOT_DIR}"
+if [[ -z "$TRUSTED_HARNESS_DIR" || ! -d "$TRUSTED_HARNESS_DIR" ]]; then
+  echo "ERROR: trusted live Docker harness directory not found: ${TRUSTED_HARNESS_DIR:-<empty>}." >&2
+  exit 1
+fi
+TRUSTED_HARNESS_DIR="$(cd "$TRUSTED_HARNESS_DIR" && pwd)"
+source "$TRUSTED_HARNESS_DIR/scripts/lib/live-docker-auth.sh"
+IMAGE_NAME="${OPENCLAW_IMAGE:-openclaw:local}"
+LIVE_IMAGE_NAME="${OPENCLAW_LIVE_IMAGE:-${IMAGE_NAME}-live}"
+CONFIG_DIR="${OPENCLAW_CONFIG_DIR:-$HOME/.openclaw}"
+WORKSPACE_DIR="${OPENCLAW_WORKSPACE_DIR:-$HOME/.openclaw/workspace}"
+PROFILE_FILE="$(openclaw_live_default_profile_file)"
+DEFAULT_PROVIDER="${OPENCLAW_DOCKER_CLI_BACKEND_PROVIDER:-claude-cli}"
+CLI_MODEL="${OPENCLAW_LIVE_CLI_BACKEND_MODEL:-}"
+CLI_PROVIDER="${CLI_MODEL%%/*}"
+CLI_DISABLE_MCP_CONFIG="${OPENCLAW_LIVE_CLI_BACKEND_DISABLE_MCP_CONFIG:-}"
+CLI_AUTH_MODE="${OPENCLAW_LIVE_CLI_BACKEND_AUTH:-auto}"
+CLI_SETUP_TIMEOUT_SECONDS="$(openclaw_live_read_positive_int_env OPENCLAW_LIVE_CLI_BACKEND_SETUP_TIMEOUT_SECONDS 180)"
+DOCKER_EXTRA_ENV_FILES=()
+DOCKER_AUTH_PRESTAGED=0
+DOCKER_TRUSTED_HARNESS_CONTAINER_DIR="/trusted-harness"
+DOCKER_TRUSTED_HARNESS_MOUNT=(-v "$TRUSTED_HARNESS_DIR":"$DOCKER_TRUSTED_HARNESS_CONTAINER_DIR":ro)
+
+if [[ -z "$CLI_PROVIDER" || "$CLI_PROVIDER" == "$CLI_MODEL" ]]; then
+  CLI_PROVIDER="$DEFAULT_PROVIDER"
+fi
+if [[ -f "$PROFILE_FILE" && -r "$PROFILE_FILE" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROFILE_FILE"
+  set +a
+fi
+
+case "$CLI_AUTH_MODE" in
+  auto | api-key | subscription)
+    ;;
+  *)
+    echo "ERROR: OPENCLAW_LIVE_CLI_BACKEND_AUTH must be one of: auto, api-key, subscription." >&2
+    exit 1
+    ;;
+esac
+
+if [[ "$CLI_AUTH_MODE" == "subscription" && "$CLI_PROVIDER" != "claude-cli" ]]; then
+  echo "ERROR: OPENCLAW_LIVE_CLI_BACKEND_AUTH=subscription is only supported for claude-cli." >&2
+  exit 1
+fi
+
+if [[ "$CLI_PROVIDER" == "codex-cli" ]]; then
+  echo "ERROR: codex-cli is no longer a bundled CLI backend. Use openai/* with the Codex app-server runtime instead." >&2
+  exit 1
+fi
+
+CLI_METADATA_JSON="$(node --import tsx "$ROOT_DIR/scripts/print-cli-backend-live-metadata.ts" "$CLI_PROVIDER")"
+read_metadata_field() {
+  local field="$1"
+  node -e 'const data = JSON.parse(process.argv[1]); const field = process.argv[2]; const value = data?.[field]; if (value == null) process.exit(1); process.stdout.write(typeof value === "string" ? value : JSON.stringify(value));' \
+    "$CLI_METADATA_JSON" \
+    "$field"
+}
+
+DEFAULT_MODEL="$(read_metadata_field defaultModelRef 2>/dev/null || printf '%s' 'claude-cli/claude-sonnet-4-6')"
+CLI_MODEL="${CLI_MODEL:-$DEFAULT_MODEL}"
+CLI_DEFAULT_COMMAND="$(read_metadata_field command 2>/dev/null || true)"
+CLI_DOCKER_NPM_PACKAGE="$(read_metadata_field dockerNpmPackage 2>/dev/null || true)"
+CLI_DOCKER_BINARY_NAME="$(read_metadata_field dockerBinaryName 2>/dev/null || true)"
+
+if [[ "$CLI_PROVIDER" == "claude-cli" && -z "$CLI_DISABLE_MCP_CONFIG" ]]; then
+  if [[ "$CLI_AUTH_MODE" == "subscription" ]]; then
+    CLI_DISABLE_MCP_CONFIG="1"
+  else
+    CLI_DISABLE_MCP_CONFIG="0"
+  fi
+fi
+export OPENCLAW_LIVE_CLI_BACKEND_MODEL_SWITCH_PROBE="${OPENCLAW_LIVE_CLI_BACKEND_MODEL_SWITCH_PROBE:-0}"
+export OPENCLAW_LIVE_CLI_BACKEND_IMAGE_PROBE="${OPENCLAW_LIVE_CLI_BACKEND_IMAGE_PROBE:-0}"
+export OPENCLAW_LIVE_CLI_BACKEND_MCP_PROBE="${OPENCLAW_LIVE_CLI_BACKEND_MCP_PROBE:-0}"
+
+openclaw_live_init_temp_dirs
+openclaw_live_init_cli_tools_dir
+openclaw_live_init_cache_home_dir
+openclaw_live_init_managed_home
+
+if [[ "$CLI_PROVIDER" == "claude-cli" && "$CLI_AUTH_MODE" == "subscription" ]]; then
+  CLAUDE_CREDS_FILE="$HOME/.claude/.credentials.json"
+  CLAUDE_SUBSCRIPTION_AUTH_SOURCE=""
+  CLAUDE_SUBSCRIPTION_TYPE=""
+  if [[ -n "${CLAUDE_CODE_OAUTH_TOKEN:-}" ]]; then
+    CLAUDE_SUBSCRIPTION_TYPE="oauth-token"
+    CLAUDE_SUBSCRIPTION_AUTH_SOURCE="env-token"
+  elif [[ -f "$CLAUDE_CREDS_FILE" ]]; then
+    CLAUDE_SUBSCRIPTION_TYPE="$(
+      node -e '
+        const fs = require("node:fs");
+        const file = process.argv[1];
+        const data = JSON.parse(fs.readFileSync(file, "utf8"));
+        const subscriptionType = String(data?.claudeAiOauth?.subscriptionType ?? "").trim();
+        if (!subscriptionType || subscriptionType === "unknown") process.exit(2);
+        process.stdout.write(subscriptionType);
+      ' "$CLAUDE_CREDS_FILE" 2>/dev/null
+    )" || {
+      echo "ERROR: $CLAUDE_CREDS_FILE does not look like Claude subscription OAuth auth." >&2
+      echo "Expected claudeAiOauth.subscriptionType to be present." >&2
+      exit 1
+    }
+    CLAUDE_SUBSCRIPTION_AUTH_SOURCE="credentials-file"
+  else
+    echo "ERROR: Claude subscription auth requires either:" >&2
+    echo "  - $CLAUDE_CREDS_FILE with claudeAiOauth.subscriptionType, or" >&2
+    echo "  - CLAUDE_CODE_OAUTH_TOKEN from 'claude setup-token'." >&2
+    exit 1
+  fi
+  if [[ -z "${OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV:-}" ]]; then
+    if [[ "$CLAUDE_SUBSCRIPTION_AUTH_SOURCE" == "env-token" ]]; then
+      export OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV='["CLAUDE_CODE_OAUTH_TOKEN"]'
+    else
+      export OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV="[]"
+    fi
+  fi
+  if [[ "$OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV" == *ANTHROPIC_API_KEY* ]]; then
+    echo "ERROR: subscription auth smoke must not preserve Anthropic API-key env vars." >&2
+    exit 1
+  fi
+  if [[ "$CLAUDE_SUBSCRIPTION_AUTH_SOURCE" == "env-token" && "$OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV" != *CLAUDE_CODE_OAUTH_TOKEN* ]]; then
+    echo "ERROR: CLAUDE_CODE_OAUTH_TOKEN subscription smoke must preserve CLAUDE_CODE_OAUTH_TOKEN for the Gateway child process." >&2
+    exit 1
+  fi
+  export OPENCLAW_LIVE_CLI_BACKEND_MODEL_SWITCH_PROBE="${OPENCLAW_LIVE_CLI_BACKEND_MODEL_SWITCH_PROBE:-0}"
+  export OPENCLAW_LIVE_CLI_BACKEND_RESUME_PROBE="${OPENCLAW_LIVE_CLI_BACKEND_RESUME_PROBE:-1}"
+  export OPENCLAW_LIVE_CLI_BACKEND_IMAGE_PROBE="${OPENCLAW_LIVE_CLI_BACKEND_IMAGE_PROBE:-0}"
+  export OPENCLAW_LIVE_CLI_BACKEND_MCP_PROBE="${OPENCLAW_LIVE_CLI_BACKEND_MCP_PROBE:-0}"
+fi
+
+openclaw_live_init_profile_mount
+
+ensure_live_build_extension() {
+  local extension="$1"
+  local current="${OPENCLAW_DOCKER_BUILD_EXTENSIONS:-${OPENCLAW_EXTENSIONS:-}}"
+  case " ${current//,/ } " in
+    *" $extension "*) ;;
+    *) export OPENCLAW_DOCKER_BUILD_EXTENSIONS="${current:+$current }$extension" ;;
+  esac
+}
+
+if [[ "$CLI_PROVIDER" == "claude-cli" ]]; then
+  ensure_live_build_extension anthropic
+fi
+
+openclaw_live_collect_auth_for_providers "$CLI_PROVIDER"
+if [[ "${CLAUDE_SUBSCRIPTION_AUTH_SOURCE:-}" == "env-token" ]]; then
+  retained_auth_files=()
+  for auth_file in ${AUTH_FILES[@]+"${AUTH_FILES[@]}"}; do
+    case "$auth_file" in
+      .claude.json | .claude/.credentials.json) ;;
+      *) retained_auth_files+=("$auth_file") ;;
+    esac
+  done
+  AUTH_FILES=(${retained_auth_files[@]+"${retained_auth_files[@]}"})
+fi
+openclaw_live_finalize_auth_mounts
+
+read -r -d '' LIVE_TEST_CMD <<'EOF' || true
+set -euo pipefail
+[ -f "$HOME/.profile" ] && [ -r "$HOME/.profile" ] && source "$HOME/.profile" || true
+export NPM_CONFIG_PREFIX="${NPM_CONFIG_PREFIX:-$HOME/.npm-global}"
+export npm_config_prefix="$NPM_CONFIG_PREFIX"
+export XDG_CACHE_HOME="${XDG_CACHE_HOME:-$HOME/.cache}"
+export COREPACK_HOME="${COREPACK_HOME:-$XDG_CACHE_HOME/node/corepack}"
+export NPM_CONFIG_CACHE="${NPM_CONFIG_CACHE:-$XDG_CACHE_HOME/npm}"
+export npm_config_cache="$NPM_CONFIG_CACHE"
+mkdir -p "$NPM_CONFIG_PREFIX" "$XDG_CACHE_HOME" "$COREPACK_HOME" "$NPM_CONFIG_CACHE"
+chmod 700 "$XDG_CACHE_HOME" "$COREPACK_HOME" "$NPM_CONFIG_CACHE" || true
+export PATH="$NPM_CONFIG_PREFIX/bin:$PATH"
+trusted_scripts_dir="${OPENCLAW_LIVE_DOCKER_SCRIPTS_DIR:-/src/scripts}"
+source "$trusted_scripts_dir/lib/live-docker-stage.sh"
+openclaw_live_stage_mounted_auth
+provider="${OPENCLAW_DOCKER_CLI_BACKEND_PROVIDER:-claude-cli}"
+default_command="${OPENCLAW_DOCKER_CLI_BACKEND_COMMAND_DEFAULT:-}"
+docker_package="${OPENCLAW_DOCKER_CLI_BACKEND_NPM_PACKAGE:-}"
+binary_name="${OPENCLAW_DOCKER_CLI_BACKEND_BINARY_NAME:-}"
+if [ -z "$binary_name" ] && [ -n "$default_command" ]; then
+  binary_name="$(basename "$default_command")"
+fi
+if [ -z "${OPENCLAW_LIVE_CLI_BACKEND_COMMAND:-}" ] && [ -n "$binary_name" ]; then
+  export OPENCLAW_LIVE_CLI_BACKEND_COMMAND="$NPM_CONFIG_PREFIX/bin/$binary_name"
+fi
+openclaw_live_prepare_cli_backend \
+  "${OPENCLAW_LIVE_CLI_BACKEND_COMMAND:?missing CLI backend command}" \
+  "$docker_package" "$OPENCLAW_LIVE_CLI_BACKEND_SETUP_TIMEOUT_SECONDS"
+if [ -n "${OPENCLAW_LIVE_CLI_BACKEND_COMMAND:-}" ] && [ -x "${OPENCLAW_LIVE_CLI_BACKEND_COMMAND}" ]; then
+  echo "==> CLI backend binary: ${OPENCLAW_LIVE_CLI_BACKEND_COMMAND}"
+  "${OPENCLAW_LIVE_CLI_BACKEND_COMMAND}" -V || "${OPENCLAW_LIVE_CLI_BACKEND_COMMAND}" --version || true
+fi
+if [ "$provider" = "google-gemini-cli" ]; then
+  openclaw_live_stage_gemini_auth
+fi
+if [ "$provider" = "claude-cli" ]; then
+  auth_mode="${OPENCLAW_LIVE_CLI_BACKEND_AUTH:-auto}"
+  if [ "$auth_mode" = "subscription" ]; then
+    unset ANTHROPIC_API_KEY
+    unset ANTHROPIC_API_KEY_OLD
+    unset ANTHROPIC_API_TOKEN
+    unset ANTHROPIC_AUTH_TOKEN
+    unset ANTHROPIC_OAUTH_TOKEN
+    node - <<'NODE'
+const fs = require("node:fs");
+const file = `${process.env.HOME}/.claude/.credentials.json`;
+if (process.env.CLAUDE_CODE_OAUTH_TOKEN?.trim()) {
+  console.error("[claude-subscription] using CLAUDE_CODE_OAUTH_TOKEN from environment");
+} else if (fs.existsSync(file)) {
+  const data = JSON.parse(fs.readFileSync(file, "utf8"));
+  const subscriptionType = String(data?.claudeAiOauth?.subscriptionType ?? "").trim();
+  if (!subscriptionType || subscriptionType === "unknown") {
+    throw new Error("Claude subscription OAuth credentials are missing subscriptionType.");
+  }
+  console.error(`[claude-subscription] subscriptionType=${subscriptionType}`);
+} else {
+  throw new Error("Claude subscription OAuth token or credentials file is required.");
+}
+NODE
+  fi
+  real_claude="$NPM_CONFIG_PREFIX/bin/claude-real"
+  if [ ! -x "$real_claude" ] && [ -x "$NPM_CONFIG_PREFIX/bin/claude" ]; then
+    mv "$NPM_CONFIG_PREFIX/bin/claude" "$real_claude"
+  fi
+  if [ -x "$real_claude" ]; then
+    cat > "$NPM_CONFIG_PREFIX/bin/claude" <<WRAP
+#!/usr/bin/env bash
+script_dir="\$(CDPATH= cd -- "\$(dirname -- "\$0")" && pwd)"
+if [ -n "\${OPENCLAW_LIVE_CLI_BACKEND_ANTHROPIC_API_KEY:-}" ]; then
+  export ANTHROPIC_API_KEY="\${OPENCLAW_LIVE_CLI_BACKEND_ANTHROPIC_API_KEY}"
+fi
+if [ -n "\${OPENCLAW_LIVE_CLI_BACKEND_ANTHROPIC_API_KEY_OLD:-}" ]; then
+  export ANTHROPIC_API_KEY_OLD="\${OPENCLAW_LIVE_CLI_BACKEND_ANTHROPIC_API_KEY_OLD}"
+fi
+exec "\$script_dir/claude-real" "\$@"
+WRAP
+    chmod +x "$NPM_CONFIG_PREFIX/bin/claude"
+  fi
+  if [ -z "${OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV:-}" ]; then
+    export OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV='["ANTHROPIC_API_KEY","ANTHROPIC_API_KEY_OLD"]'
+  fi
+  if [ "$auth_mode" = "subscription" ]; then
+    claude --version
+    direct_probe_log="$(mktemp)"
+    set +e
+    claude \
+      -p "This is a local CLI smoke test. What is two plus two? Reply with only the result." \
+      --output-format text \
+      --model sonnet \
+      --permission-mode bypassPermissions \
+      --setting-sources user \
+      --strict-mcp-config \
+      --mcp-config '{"mcpServers":{}}' \
+      --no-session-persistence >"$direct_probe_log" 2>&1
+    direct_probe_status=$?
+    set -e
+    print_redacted_direct_probe_log() {
+      sed -E \
+        -e 's/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/<redacted-email>/g' \
+        -e 's/(sk-ant-|sk-)[A-Za-z0-9_-]+/<redacted-secret>/g' \
+        "$direct_probe_log" >&2
+    }
+    if [ "$direct_probe_status" -ne 0 ]; then
+      echo "ERROR: direct Claude subscription probe exited with status $direct_probe_status." >&2
+      print_redacted_direct_probe_log
+      rm -f "$direct_probe_log"
+      exit "$direct_probe_status"
+    fi
+    if ! grep -Eiq '(^|[^[:alnum:]])(4|four)([^[:alnum:]]|$)' "$direct_probe_log"; then
+      echo "ERROR: direct Claude subscription probe did not return the expected arithmetic result." >&2
+      print_redacted_direct_probe_log
+      rm -f "$direct_probe_log"
+      exit 1
+    fi
+    rm -f "$direct_probe_log"
+    echo "[claude-subscription] direct claude -p probe ok"
+  else
+    claude auth status || true
+  fi
+fi
+tmp_dir="$(mktemp -d)"
+openclaw_live_stage_source_tree "$tmp_dir"
+# Use a writable node_modules overlay in the temp repo. Vite writes bundled
+# config artifacts under the nearest node_modules/.vite-temp path, and the
+# build-stage /app/node_modules tree is root-owned in this Docker lane.
+openclaw_live_stage_node_modules "$tmp_dir"
+openclaw_live_link_runtime_tree "$tmp_dir"
+openclaw_live_stage_state_dir "$tmp_dir/.openclaw-state"
+openclaw_live_prepare_staged_config
+cd "$tmp_dir"
+openclaw_live_run_staged_script scripts/test-live -- src/gateway/gateway-cli-backend.live.test.ts
+EOF
+
+OPENCLAW_LIVE_DOCKER_REPO_ROOT="$ROOT_DIR" "$TRUSTED_HARNESS_DIR/scripts/test-live-build-docker.sh"
+if openclaw_live_uses_managed_bind_dirs; then
+  openclaw_live_chown_bind_dirs_for_container_user \
+    "$LIVE_IMAGE_NAME" \
+    "$DOCKER_USER" \
+    "$CLI_TOOLS_DIR" \
+    "$CACHE_HOME_DIR" \
+    "${DOCKER_HOME_DIR:-}"
+fi
+
+echo "==> Run CLI backend live test in Docker"
+echo "==> Model: $CLI_MODEL"
+echo "==> Provider: $CLI_PROVIDER"
+echo "==> Auth mode: $CLI_AUTH_MODE"
+echo "==> Setup timeout: ${CLI_SETUP_TIMEOUT_SECONDS}s"
+echo "==> Profile file: $PROFILE_STATUS"
+if [[ "$CLI_PROVIDER" == "claude-cli" && "$CLI_AUTH_MODE" == "subscription" ]]; then
+  echo "==> Claude subscription: $CLAUDE_SUBSCRIPTION_TYPE"
+  echo "==> Claude subscription source: $CLAUDE_SUBSCRIPTION_AUTH_SOURCE"
+fi
+echo "==> External auth dirs: ${AUTH_DIRS_CSV:-none}"
+echo "==> External auth files: ${AUTH_FILES_CSV:-none}"
+DOCKER_AUTH_ENV=(
+  -e OPENCLAW_LIVE_CLI_BACKEND_AUTH="$CLI_AUTH_MODE"
+)
+if [[ "$CLI_PROVIDER" == "claude-cli" && "$CLI_AUTH_MODE" == "subscription" ]]; then
+  DOCKER_AUTH_ENV+=(
+    -e CLAUDE_CODE_OAUTH_TOKEN="${CLAUDE_CODE_OAUTH_TOKEN:-}"
+    -e OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV="$OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV"
+  )
+else
+  DOCKER_AUTH_ENV+=(
+    -e ANTHROPIC_API_KEY
+    -e ANTHROPIC_API_KEY_OLD
+    -e OPENCLAW_LIVE_CLI_BACKEND_ANTHROPIC_API_KEY="${ANTHROPIC_API_KEY:-}"
+    -e OPENCLAW_LIVE_CLI_BACKEND_ANTHROPIC_API_KEY_OLD="${ANTHROPIC_API_KEY_OLD:-}"
+    -e OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV="${OPENCLAW_LIVE_CLI_BACKEND_PRESERVE_ENV:-}"
+  )
+fi
+
+DOCKER_RUN_ARGS=()
+openclaw_live_init_docker_run_args DOCKER_RUN_ARGS "${OPENCLAW_LIVE_CLI_BACKEND_DOCKER_RUN_TIMEOUT:-2700s}"
+DOCKER_RUN_ARGS+=(--rm -t \
+  -u "$DOCKER_USER" \
+  --entrypoint bash \
+  -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \
+  -e HOME=/home/node \
+  -e NODE_OPTIONS="$(openclaw_live_container_node_options)" \
+  -e OPENCLAW_SKIP_CHANNELS=1 \
+  -e OPENCLAW_VITEST_FS_MODULE_CACHE=0 \
+  -e OPENCLAW_DOCKER_AUTH_PRESTAGED="$DOCKER_AUTH_PRESTAGED" \
+  -e OPENCLAW_DOCKER_AUTH_DIRS_RESOLVED="$AUTH_DIRS_CSV" \
+  -e OPENCLAW_DOCKER_AUTH_FILES_RESOLVED="$AUTH_FILES_CSV" \
+  -e OPENCLAW_LIVE_DOCKER_SCRIPTS_DIR="${DOCKER_TRUSTED_HARNESS_CONTAINER_DIR}/scripts" \
+  -e OPENCLAW_LIVE_DOCKER_SOURCE_STAGE_MODE="${OPENCLAW_LIVE_DOCKER_SOURCE_STAGE_MODE:-copy}" \
+  -e OPENCLAW_LIVE_CLI_BACKEND_SETUP_TIMEOUT_SECONDS="$CLI_SETUP_TIMEOUT_SECONDS" \
+  -e OPENCLAW_DOCKER_CLI_BACKEND_PROVIDER="$CLI_PROVIDER" \
+  -e OPENCLAW_DOCKER_CLI_BACKEND_COMMAND_DEFAULT="$CLI_DEFAULT_COMMAND" \
+  -e OPENCLAW_DOCKER_CLI_BACKEND_NPM_PACKAGE="$CLI_DOCKER_NPM_PACKAGE" \
+  -e OPENCLAW_DOCKER_CLI_BACKEND_BINARY_NAME="$CLI_DOCKER_BINARY_NAME" \
+  -e OPENCLAW_LIVE_TEST=1 \
+  -e OPENCLAW_LIVE_CLI_BACKEND=1 \
+  -e OPENCLAW_LIVE_CLI_BACKEND_DEBUG="${OPENCLAW_LIVE_CLI_BACKEND_DEBUG:-}" \
+  -e OPENCLAW_LIVE_CLI_BACKEND_ADVISORY="${OPENCLAW_LIVE_CLI_BACKEND_ADVISORY:-}" \
+  -e OPENCLAW_LIVE_CLI_BACKEND_ALLOW_PROVIDER_SKIP="${OPENCLAW_LIVE_CLI_BACKEND_ALLOW_PROVIDER_SKIP:-}" \
+  -e OPENCLAW_CLI_BACKEND_LOG_OUTPUT="${OPENCLAW_CLI_BACKEND_LOG_OUTPUT:-}" \
+  -e OPENCLAW_TEST_CONSOLE="${OPENCLAW_TEST_CONSOLE:-}" \
+  -e OPENCLAW_LIVE_CLI_BACKEND_MODEL="$CLI_MODEL" \
+  -e OPENCLAW_LIVE_CLI_BACKEND_COMMAND="${OPENCLAW_LIVE_CLI_BACKEND_COMMAND:-}" \
+  -e OPENCLAW_LIVE_CLI_BACKEND_ARGS="${OPENCLAW_LIVE_CLI_BACKEND_ARGS:-}" \
+  -e OPENCLAW_LIVE_CLI_BACKEND_RESUME_ARGS="${OPENCLAW_LIVE_CLI_BACKEND_RESUME_ARGS:-}" \
+  -e OPENCLAW_LIVE_CLI_BACKEND_CLEAR_ENV="${OPENCLAW_LIVE_CLI_BACKEND_CLEAR_ENV:-}" \
+  -e OPENCLAW_LIVE_CLI_BACKEND_DISABLE_MCP_CONFIG="$CLI_DISABLE_MCP_CONFIG" \
+  -e OPENCLAW_LIVE_CLI_BACKEND_CACHE_PROBE="${OPENCLAW_LIVE_CLI_BACKEND_CACHE_PROBE:-}" \
+  -e OPENCLAW_LIVE_CLI_BACKEND_RESUME_PROBE="${OPENCLAW_LIVE_CLI_BACKEND_RESUME_PROBE:-}" \
+  -e OPENCLAW_LIVE_CLI_BACKEND_MODEL_SWITCH_PROBE="${OPENCLAW_LIVE_CLI_BACKEND_MODEL_SWITCH_PROBE:-}" \
+  -e OPENCLAW_LIVE_CLI_BACKEND_IMAGE_PROBE="${OPENCLAW_LIVE_CLI_BACKEND_IMAGE_PROBE:-}" \
+  -e OPENCLAW_LIVE_CLI_BACKEND_MCP_PROBE="${OPENCLAW_LIVE_CLI_BACKEND_MCP_PROBE:-}" \
+  -e OPENCLAW_LIVE_CLI_BACKEND_MCP_SCHEMA_PROBE="${OPENCLAW_LIVE_CLI_BACKEND_MCP_SCHEMA_PROBE:-}" \
+  -e OPENCLAW_LIVE_CLI_BACKEND_IMAGE_ARG="${OPENCLAW_LIVE_CLI_BACKEND_IMAGE_ARG:-}" \
+  -e OPENCLAW_LIVE_CLI_BACKEND_IMAGE_MODE="${OPENCLAW_LIVE_CLI_BACKEND_IMAGE_MODE:-}")
+openclaw_live_append_array DOCKER_RUN_ARGS DOCKER_HOME_MOUNT
+openclaw_live_append_array DOCKER_RUN_ARGS DOCKER_EXTRA_ENV_FILES
+openclaw_live_append_array DOCKER_RUN_ARGS DOCKER_TRUSTED_HARNESS_MOUNT
+DOCKER_RUN_ARGS+=(\
+  -v "$CACHE_HOME_DIR":/home/node/.cache \
+  -v "$ROOT_DIR":/src:ro \
+  -v "$CONFIG_DIR":/home/node/.openclaw \
+  -v "$WORKSPACE_DIR":/home/node/.openclaw/workspace \
+  -v "$CLI_TOOLS_DIR":/home/node/.npm-global)
+openclaw_live_append_array DOCKER_RUN_ARGS EXTERNAL_AUTH_MOUNTS
+openclaw_live_append_array DOCKER_RUN_ARGS DOCKER_AUTH_ENV
+openclaw_live_append_array DOCKER_RUN_ARGS PROFILE_MOUNT
+DOCKER_RUN_ARGS+=(\
+  "$LIVE_IMAGE_NAME" \
+  -lc "$LIVE_TEST_CMD")
+"${DOCKER_RUN_ARGS[@]}"
diff --git a/scripts/test-live-models-docker.sh b/scripts/test-live-models-docker.sh
new file mode 100644
index 0000000000000000000000000000000000000000..9080e1ebda8638017d5173d0d9e71171b22ff12d
--- /dev/null
+++ b/scripts/test-live-models-docker.sh
@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+# Bash 5.3+ can deadlock writing heredoc pipes on macOS before the reader starts.
+if [[ ${OSTYPE:-} == darwin* && $BASH != /bin/bash ]] && ((BASH_VERSINFO[0] > 5 || (BASH_VERSINFO[0] == 5 && BASH_VERSINFO[1] >= 3))); then
+  exec /bin/bash "$0" "$@"
+fi
+set -euo pipefail
+
+SCRIPT_ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+ROOT_DIR="${OPENCLAW_LIVE_DOCKER_REPO_ROOT:-$SCRIPT_ROOT_DIR}"
+ROOT_DIR="$(cd "$ROOT_DIR" && pwd)"
+TRUSTED_HARNESS_DIR="${OPENCLAW_LIVE_DOCKER_TRUSTED_HARNESS_DIR:-$SCRIPT_ROOT_DIR}"
+if [[ -z "$TRUSTED_HARNESS_DIR" || ! -d "$TRUSTED_HARNESS_DIR" ]]; then
+  echo "ERROR: trusted live Docker harness directory not found: ${TRUSTED_HARNESS_DIR:-<empty>}." >&2
+  exit 1
+fi
+TRUSTED_HARNESS_DIR="$(cd "$TRUSTED_HARNESS_DIR" && pwd)"
+source "$TRUSTED_HARNESS_DIR/scripts/lib/live-docker-auth.sh"
+IMAGE_NAME="${OPENCLAW_IMAGE:-openclaw:local}"
+LIVE_IMAGE_NAME="${OPENCLAW_LIVE_IMAGE:-${IMAGE_NAME}-live}"
+PROFILE_FILE="$(openclaw_live_default_profile_file)"
+DOCKER_AUTH_PRESTAGED=0
+DOCKER_TRUSTED_HARNESS_CONTAINER_DIR="/trusted-harness"
+DOCKER_TRUSTED_HARNESS_MOUNT=(-v "$TRUSTED_HARNESS_DIR":"$DOCKER_TRUSTED_HARNESS_CONTAINER_DIR":ro)
+
+LIVE_MAX_MODELS="${OPENCLAW_LIVE_MAX_MODELS:-}"
+if [[ -n "$LIVE_MAX_MODELS" && ! "$LIVE_MAX_MODELS" =~ ^\+?[0-9]+$ ]]; then
+  echo "invalid OPENCLAW_LIVE_MAX_MODELS: $LIVE_MAX_MODELS" >&2
+  exit 2
+fi
+LIVE_MODEL_TIMEOUT_MS="${OPENCLAW_LIVE_MODEL_TIMEOUT_MS:-}"
+if [[ -n "$LIVE_MODEL_TIMEOUT_MS" ]]; then
+  LIVE_MODEL_TIMEOUT_MS="$(openclaw_live_read_positive_int_env OPENCLAW_LIVE_MODEL_TIMEOUT_MS "$LIVE_MODEL_TIMEOUT_MS")"
+fi
+openclaw_live_init_temp_dirs
+
+if openclaw_live_truthy "${OPENCLAW_DOCKER_PROFILE_ENV_ONLY:-}"; then
+  CONFIG_DIR="$(mktemp -d)"
+  WORKSPACE_DIR="$(mktemp -d)"
+  TEMP_DIRS+=("$CONFIG_DIR" "$WORKSPACE_DIR")
+  OPENCLAW_DOCKER_AUTH_DIRS=none
+else
+  CONFIG_DIR="${OPENCLAW_CONFIG_DIR:-$HOME/.openclaw}"
+  WORKSPACE_DIR="${OPENCLAW_WORKSPACE_DIR:-$HOME/.openclaw/workspace}"
+fi
+openclaw_live_init_cache_home_dir
+openclaw_live_init_managed_home
+openclaw_live_init_profile_mount
+
+openclaw_live_collect_auth_for_providers "${OPENCLAW_LIVE_PROVIDERS:-},${OPENCLAW_LIVE_GATEWAY_PROVIDERS:-}"
+openclaw_live_finalize_auth_mounts
+
+read -r -d '' LIVE_TEST_CMD <<'EOF' || true
+set -euo pipefail
+[ -f "$HOME/.profile" ] && [ -r "$HOME/.profile" ] && source "$HOME/.profile" || true
+export XDG_CACHE_HOME="${XDG_CACHE_HOME:-$HOME/.cache}"
+export COREPACK_HOME="${COREPACK_HOME:-$XDG_CACHE_HOME/node/corepack}"
+export NPM_CONFIG_CACHE="${NPM_CONFIG_CACHE:-$XDG_CACHE_HOME/npm}"
+export npm_config_cache="$NPM_CONFIG_CACHE"
+mkdir -p "$XDG_CACHE_HOME" "$COREPACK_HOME" "$NPM_CONFIG_CACHE"
+chmod 700 "$XDG_CACHE_HOME" "$COREPACK_HOME" "$NPM_CONFIG_CACHE" || true
+tmp_dir="$(mktemp -d)"
+trusted_scripts_dir="${OPENCLAW_LIVE_DOCKER_SCRIPTS_DIR:-/src/scripts}"
+source "$trusted_scripts_dir/lib/live-docker-stage.sh"
+openclaw_live_stage_mounted_auth
+openclaw_live_stage_source_tree "$tmp_dir"
+openclaw_live_stage_node_modules "$tmp_dir"
+openclaw_live_link_runtime_tree "$tmp_dir"
+openclaw_live_stage_state_dir "$tmp_dir/.openclaw-state"
+openclaw_live_prepare_staged_config
+cd "$tmp_dir"
+openclaw_live_run_staged_script scripts/test-live -- src/agents/models.profiles.live.test.ts
+EOF
+
+OPENCLAW_LIVE_DOCKER_REPO_ROOT="$ROOT_DIR" "$TRUSTED_HARNESS_DIR/scripts/test-live-build-docker.sh"
+if openclaw_live_uses_managed_bind_dirs; then
+  openclaw_live_chown_bind_dirs_for_container_user \
+    "$LIVE_IMAGE_NAME" \
+    "$DOCKER_USER" \
+    "$CACHE_HOME_DIR" \
+    "${DOCKER_HOME_DIR:-}"
+fi
+
+echo "==> Run live model tests (profile keys)"
+echo "==> Target: src/agents/models.profiles.live.test.ts"
+echo "==> Profile env only: ${OPENCLAW_DOCKER_PROFILE_ENV_ONLY:-0}"
+echo "==> Profile file: $PROFILE_STATUS"
+echo "==> External auth dirs: ${AUTH_DIRS_CSV:-none}"
+echo "==> External auth files: ${AUTH_FILES_CSV:-none}"
+DOCKER_RUN_ARGS=()
+openclaw_live_init_docker_run_args DOCKER_RUN_ARGS "${OPENCLAW_LIVE_MODELS_DOCKER_RUN_TIMEOUT:-2100s}"
+DOCKER_RUN_ARGS+=(--rm -t \
+  -u "$DOCKER_USER" \
+  --entrypoint bash \
+  -e COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \
+  -e HOME=/home/node \
+  -e NODE_OPTIONS="$(openclaw_live_container_node_options)" \
+  -e OPENCLAW_SKIP_CHANNELS=1 \
+  -e OPENCLAW_SUPPRESS_NOTES=1 \
+  -e OPENCLAW_DOCKER_AUTH_PRESTAGED="$DOCKER_AUTH_PRESTAGED" \
+  -e OPENCLAW_DOCKER_AUTH_DIRS_RESOLVED="$AUTH_DIRS_CSV" \
+  -e OPENCLAW_DOCKER_AUTH_FILES_RESOLVED="$AUTH_FILES_CSV" \
+  -e OPENCLAW_LIVE_DOCKER_SCRIPTS_DIR="${DOCKER_TRUSTED_HARNESS_CONTAINER_DIR}/scripts" \
+  -e OPENCLAW_LIVE_DOCKER_SOURCE_STAGE_MODE="${OPENCLAW_LIVE_DOCKER_SOURCE_STAGE_MODE:-copy}" \
+  -e OPENCLAW_LIVE_TEST=1 \
+  -e OPENCLAW_LIVE_MODELS="${OPENCLAW_LIVE_MODELS:-modern}" \
+  -e OPENCLAW_LIVE_PROVIDERS="${OPENCLAW_LIVE_PROVIDERS:-}" \
+  -e OPENCLAW_LIVE_MAX_MODELS="$LIVE_MAX_MODELS" \
+  -e OPENCLAW_LIVE_MODEL_TIMEOUT_MS="$LIVE_MODEL_TIMEOUT_MS" \
+  -e OPENCLAW_LIVE_REQUIRE_PROFILE_KEYS="${OPENCLAW_LIVE_REQUIRE_PROFILE_KEYS:-}" \
+  -e OPENCLAW_LIVE_GATEWAY_MODELS="${OPENCLAW_LIVE_GATEWAY_MODELS:-}" \
+  -e OPENCLAW_LIVE_GATEWAY_PROVIDERS="${OPENCLAW_LIVE_GATEWAY_PROVIDERS:-}" \
+  -e OPENCLAW_LIVE_GATEWAY_MAX_MODELS="${OPENCLAW_LIVE_GATEWAY_MAX_MODELS:-}" \
+  -e OPENCLAW_VITEST_FS_MODULE_CACHE=0)
+openclaw_live_append_array DOCKER_RUN_ARGS DOCKER_HOME_MOUNT
+openclaw_live_append_array DOCKER_RUN_ARGS DOCKER_TRUSTED_HARNESS_MOUNT
+DOCKER_RUN_ARGS+=(\
+  -v "$CACHE_HOME_DIR":/home/node/.cache \
+  -v "$ROOT_DIR":/src:ro \
+  -v "$CONFIG_DIR":/home/node/.openclaw \
+  -v "$WORKSPACE_DIR":/home/node/.openclaw/workspace)
+openclaw_live_append_array DOCKER_RUN_ARGS EXTERNAL_AUTH_MOUNTS
+openclaw_live_append_array DOCKER_RUN_ARGS PROFILE_MOUNT
+DOCKER_RUN_ARGS+=(\
+  "$LIVE_IMAGE_NAME" \
+  -lc "$LIVE_TEST_CMD")
+"${DOCKER_RUN_ARGS[@]}"
diff --git a/scripts/test-macos-native.mts b/scripts/test-macos-native.mts
new file mode 100644
index 0000000000000000000000000000000000000000..26a203b90a014dd8c14419e5cf41a0ac33fc679f
--- /dev/null
+++ b/scripts/test-macos-native.mts
@@ -0,0 +1,279 @@
+// CI resource owner; the disposable credentialless runner is the isolation boundary.
+import { randomUUID } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { root as openCaptureRoot } from "@openclaw/fs-safe/root";
+import { runWithFailedTrailer } from "./lib/failed-trailer.mts";
+import { runManagedCommand } from "./lib/managed-child-process.mts";
+
+await runWithFailedTrailer("macos-native", async () => {
+  const env = process.env;
+  // Invocation checks prevent accidental local use; these markers are not a sandbox.
+  if (
+    env.CI !== "true" ||
+    env.GITHUB_ACTIONS !== "true" ||
+    env.RUNNER_OS !== "macOS" ||
+    !env.RUNNER_TEMP ||
+    !env.HOME ||
+    process.platform === "win32"
+  ) {
+    throw new Error(
+      "Run native app tests in the disposable macos-swift GitHub CI job, never on an operator desktop.",
+    );
+  }
+  const [profileMode, ...args] = process.argv.slice(2);
+  if (profileMode !== "default" && profileMode !== "named") {
+    throw new Error("Select default or named profile semantics before the Swift test arguments.");
+  }
+  if (!args.includes("--skip-build")) {
+    throw new Error(
+      "Build tests first with swift build --build-tests; this launcher requires --skip-build.",
+    );
+  }
+
+  // Keep paths short for tools honoring TMPDIR, independently of RUNNER_TEMP's length.
+  // Foundation's Darwin temp directory belongs to the disposable OS worker instead.
+  const root = fs.realpathSync(fs.mkdtempSync("/tmp/oc-test-"));
+  let canRemove = true;
+  try {
+    const home = path.join(root, "home");
+    const state = path.join(root, "state");
+    const tmp = path.join(root, "tmp");
+    const menuCaptures = path.join(root, "menu-captures");
+    for (const dir of [home, state, tmp, menuCaptures]) {
+      fs.mkdirSync(dir, { mode: 0o700 });
+    }
+    const captureRoot = await openCaptureRoot(menuCaptures);
+    const childEnv: NodeJS.ProcessEnv = {};
+    for (const key of [
+      "PATH",
+      "DEVELOPER_DIR",
+      "SDKROOT",
+      "TOOLCHAINS",
+      "LANG",
+      "LC_ALL",
+      "TERM",
+      "DYLD_FRAMEWORK_PATH",
+      "DYLD_LIBRARY_PATH",
+      "LLVM_PROFILE_FILE",
+      "SWIFTPM_MODULECACHE_OVERRIDE",
+      "CLANG_MODULE_CACHE_PATH",
+      // Preserve Actions' orphan-cleanup correlation through the isolated child env.
+      "RUNNER_TRACKING_ID",
+    ]) {
+      if (env[key] !== undefined) {
+        childEnv[key] = env[key];
+      }
+    }
+    Object.assign(childEnv, {
+      CI: "true",
+      HOME: home,
+      CFFIXED_USER_HOME: home,
+      TMPDIR: `${tmp}/`,
+      TMP: tmp,
+      TEMP: tmp,
+      // The full suite protects default-profile lifecycle behavior. Named-profile
+      // construction is exercised separately; both use the disposable runner's account.
+      OPENCLAW_PROFILE: profileMode === "named" ? `test-${randomUUID()}` : "default",
+      OPENCLAW_STATE_DIR: state,
+      OPENCLAW_CONFIG_PATH: path.join(state, "openclaw.json"),
+      OPENCLAW_TEST_MENU_CAPTURE_DIR: menuCaptures,
+    });
+
+    // Keep SwiftPM's build cache available without inheriting the runner's app state.
+    const cache = path.join(home, "Library/Caches");
+    fs.mkdirSync(cache, { recursive: true, mode: 0o700 });
+    fs.symlinkSync(
+      path.join(env.HOME, "Library/Caches/org.swift.swiftpm"),
+      path.join(cache, "org.swift.swiftpm"),
+    );
+    const keychain = path.join(home, "Library/Keychains/native-tests.keychain-db");
+    // Security writes its user preferences beneath HOME but does not create the parent.
+    for (const dir of [path.dirname(keychain), path.join(home, "Library/Preferences")]) {
+      fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    }
+    const run = async (bin: string, commandArgs: string[], timeoutMs?: number) => {
+      canRemove = false;
+      const code = await runManagedCommand({
+        bin,
+        args: commandArgs,
+        env: childEnv,
+        stdio: "inherit",
+        requireProcessTreeExit: true,
+        timeoutMs,
+      });
+      canRemove = true;
+      return code;
+    };
+    // Empty test-only password prevents prompts; no automatic locking while the suite runs.
+    // Only the user domain changes. Common/dynamic Keychains still require a disposable host.
+    try {
+      for (const command of [
+        ["create-keychain", "-p", "", keychain],
+        ["unlock-keychain", "-p", "", keychain],
+        ["set-keychain-settings", keychain],
+        ["list-keychains", "-d", "user", "-s", keychain],
+        ["default-keychain", "-d", "user", "-s", keychain],
+      ]) {
+        process.exitCode = await run("security", command, 30_000);
+        if (process.exitCode !== 0) {
+          console.error(`[macos-native] security ${command[0]} failed (exit ${process.exitCode})`);
+          return;
+        }
+      }
+      const eventStreamPath = path.join(root, "swift-testing-events.jsonl");
+      process.exitCode = await run("swift", [
+        "test",
+        ...args,
+        "--event-stream-output-path",
+        eventStreamPath,
+        "--event-stream-version",
+        "6.3",
+      ]);
+      // Export synthetic images after every child/output closes and before resource cleanup.
+      try {
+        const exported = fs.mkdtempSync(
+          path.join(env.RUNNER_TEMP, `openclaw-menu-${profileMode}-`),
+        );
+        const names =
+          profileMode === "default"
+            ? ["catalog", "selected", "effort", "fast", "inherited"]
+            : ["thread-reasoning", "thread-tool-activity", "model-initial", "thread-restored"];
+        const allowed = new RegExp(
+          `^(?:${names.join("|")})(?:-window\\.png|-menu-[0-9]+\\.png|-capture-status\\.json)$`,
+        );
+        const files: string[] = [];
+        for (const entry of fs.readdirSync(menuCaptures, { withFileTypes: true })) {
+          if (!entry.isFile() || !allowed.test(entry.name)) {
+            continue;
+          }
+          const source = await captureRoot.open(entry.name, {
+            hardlinks: "reject",
+            symlinks: "reject",
+          });
+          try {
+            const before = await source.handle.stat({ bigint: true });
+            const bytes = await source.handle.readFile();
+            const after = await source.handle.stat({ bigint: true });
+            const current = await fs.promises.lstat(path.join(menuCaptures, entry.name), {
+              bigint: true,
+            });
+            if (
+              BigInt(bytes.byteLength) !== before.size ||
+              [before, after, current].some(
+                (stat) =>
+                  !stat.isFile() ||
+                  stat.nlink !== 1n ||
+                  stat.dev !== before.dev ||
+                  stat.ino !== before.ino ||
+                  stat.size !== before.size ||
+                  stat.mtimeNs !== before.mtimeNs ||
+                  stat.ctimeNs !== before.ctimeNs,
+              )
+            ) {
+              throw new Error(`Menu capture changed before export: ${entry.name}`);
+            }
+            fs.writeFileSync(path.join(exported, entry.name), bytes, { flag: "wx", mode: 0o600 });
+            files.push(entry.name);
+          } finally {
+            await source.handle.close();
+          }
+        }
+        fs.writeFileSync(
+          path.join(exported, "capture-export.json"),
+          JSON.stringify(
+            {
+              profileMode,
+              source: "ordinary-swift-run",
+              swiftExitCode: process.exitCode,
+              files,
+              missingCaptureStatus: names.filter(
+                (name) => !files.includes(`${name}-capture-status.json`),
+              ),
+              requiresVisualInspection: true,
+            },
+            null,
+            2,
+          ) + "\n",
+        );
+        if (env.GITHUB_OUTPUT) {
+          fs.appendFileSync(env.GITHUB_OUTPUT, `menu-${profileMode}-artifact-path=${exported}\n`);
+        }
+        console.error(`[macos-native] Synthetic menu capture artifacts: ${exported}`);
+      } catch (captureError) {
+        console.error(
+          "[macos-native] Menu capture export unavailable; preserving test outcome",
+          captureError,
+        );
+      }
+      if (process.exitCode === 0) {
+        try {
+          let phase: "pending" | "running" | "ended" = "pending";
+          const lines = fs.readFileSync(eventStreamPath, "utf8").split("\n");
+          if (lines.at(-1) === "") {
+            lines.pop();
+          }
+          for (const line of lines) {
+            const record: unknown = JSON.parse(line);
+            if (typeof record !== "object" || record === null || !("kind" in record)) {
+              throw new Error("Invalid Swift Testing event record");
+            }
+            // Swift Testing permits new record and event kinds without a schema change.
+            if (record.kind !== "event" && record.kind !== "test") {
+              continue;
+            }
+            if (!("version" in record) || record.version !== "6.3.0") {
+              throw new Error("Expected Swift Testing event schema 6.3.0");
+            }
+            if (record.kind !== "event") {
+              continue;
+            }
+            if (
+              !("payload" in record) ||
+              typeof record.payload !== "object" ||
+              record.payload === null ||
+              !("kind" in record.payload) ||
+              typeof record.payload.kind !== "string"
+            ) {
+              throw new Error("Invalid Swift Testing event payload");
+            }
+            if (record.payload.kind === "runStarted") {
+              if (phase !== "pending") {
+                throw new Error("Unexpected Swift Testing runStarted");
+              }
+              phase = "running";
+            } else if (record.payload.kind === "runEnded") {
+              if (phase !== "running") {
+                throw new Error("Unexpected Swift Testing runEnded");
+              }
+              phase = "ended";
+            }
+          }
+          if (phase !== "ended") {
+            throw new Error("Swift Testing did not finish its run");
+          }
+        } catch (error) {
+          process.exitCode = 1;
+          console.error("[macos-native] Swift exited 0 without valid test completion", error);
+        }
+      }
+    } finally {
+      // A completed failed create may leave a database. Never delete it until every child closed.
+      if (canRemove && fs.existsSync(keychain)) {
+        const cleanupCode = await run("security", ["delete-keychain", keychain], 30_000);
+        if (cleanupCode !== 0) {
+          canRemove = false;
+          process.exitCode ||= cleanupCode;
+          console.error(`[macos-native] security delete-keychain failed (exit ${cleanupCode})`);
+        }
+      }
+    }
+  } finally {
+    // Retain evidence/resources if process-tree completion could not be established.
+    if (canRemove) {
+      fs.rmSync(root, { recursive: true, force: true });
+    } else {
+      console.error(`[macos-native] retained resources after incomplete launch/cleanup: ${root}`);
+    }
+  }
+});
diff --git a/scripts/test-shell-completion.ts b/scripts/test-shell-completion.ts
new file mode 100644
index 0000000000000000000000000000000000000000..680119ea0936aafe5e2535c8a4199e67ad5f8811
--- /dev/null
+++ b/scripts/test-shell-completion.ts
@@ -0,0 +1,243 @@
+/**
+ * Test script for shell completion installation feature.
+ *
+ * This script simulates the shell completion prompt that appears during
+ * `openclaw update`. Use it to verify the completion installation flow
+ * without running a full update.
+ *
+ * Run from repo root:
+ *   node --import tsx scripts/test-shell-completion.ts [options]
+ *   npx tsx scripts/test-shell-completion.ts [options]
+ *   bun scripts/test-shell-completion.ts [options]
+ *
+ * Options:
+ *   --shell <shell>   Override shell detection (zsh, bash, fish, powershell)
+ *   --check-only      Only check status, don't prompt to install
+ *   --force           Skip the "already installed" check and prompt anyway
+ *   --help            Show this help message
+ *
+ * Examples:
+ *   node --import tsx scripts/test-shell-completion.ts
+ *   node --import tsx scripts/test-shell-completion.ts --check-only
+ *   node --import tsx scripts/test-shell-completion.ts --shell bash
+ *   node --import tsx scripts/test-shell-completion.ts --force
+ */
+
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { confirm, isCancel } from "@clack/prompts";
+import { expectDefined } from "../packages/normalization-core/src/expect.js";
+import { stylePromptMessage } from "../packages/terminal-core/src/prompt-style.js";
+import { theme } from "../packages/terminal-core/src/theme.js";
+import {
+  COMPLETION_SHELLS,
+  installCompletion,
+  isCompletionShell,
+  resolveCompletionProfilePath,
+  type CompletionShell,
+} from "../src/cli/completion-runtime.js";
+import {
+  checkShellCompletionStatus,
+  ensureCompletionCacheExists,
+} from "../src/commands/doctor-completion.js";
+
+const CLI_NAME = "openclaw";
+
+interface Options {
+  checkOnly: boolean;
+  force: boolean;
+  help: boolean;
+  shell?: CompletionShell;
+}
+
+function parseArgs(args: string[]): Options {
+  const options: Options = {
+    checkOnly: false,
+    force: false,
+    help: false,
+  };
+
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = expectDefined(args[index], `shell completion argument at index ${index}`);
+    if (arg === "--check-only") {
+      options.checkOnly = true;
+    } else if (arg === "--force") {
+      options.force = true;
+    } else if (arg === "--help" || arg === "-h") {
+      options.help = true;
+    } else if (arg === "--shell") {
+      const value = args[index + 1];
+      options.shell = parseShellOptionValue(value);
+      index += 1;
+    } else if (arg.startsWith("--shell=")) {
+      options.shell = parseShellOptionValue(arg.slice("--shell=".length));
+    } else {
+      throw new Error(`Unknown argument: ${arg}`);
+    }
+  }
+
+  return options;
+}
+
+function parseShellOptionValue(value: string | undefined): CompletionShell {
+  if (!value || value.startsWith("-")) {
+    throw new Error("--shell requires a value");
+  }
+  if (!isCompletionShell(value)) {
+    throw new Error(`--shell must be one of: ${COMPLETION_SHELLS.join(", ")}`);
+  }
+  return value;
+}
+
+function printHelp(): void {
+  console.log(`
+${theme.heading("Shell Completion Test Script")}
+
+This script simulates the shell completion checks that run during
+\`openclaw update\`, \`openclaw doctor\`, and \`openclaw onboard\`.
+
+${theme.heading("Usage (run from repo root):")}
+  node --import tsx scripts/test-shell-completion.ts [options]
+  npx tsx scripts/test-shell-completion.ts [options]
+  bun scripts/test-shell-completion.ts [options]
+
+${theme.heading("Options:")}
+  --shell <shell>   Override shell detection (zsh, bash, fish, powershell)
+  --check-only      Only check status, don't prompt to install
+  --force           Skip the "already installed" check and prompt anyway
+  --help, -h        Show this help message
+
+${theme.heading("Behavior:")}
+  - If profile has completion but no cache: auto-regenerates cache
+  - If no completion at all: prompts to install
+  - If both profile and cache exist: nothing to do
+
+${theme.heading("Examples:")}
+  node --import tsx scripts/test-shell-completion.ts
+  node --import tsx scripts/test-shell-completion.ts --check-only
+  node --import tsx scripts/test-shell-completion.ts --shell bash
+  node --import tsx scripts/test-shell-completion.ts --force
+`);
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+  const options = parseArgs(args);
+
+  if (options.help) {
+    printHelp();
+    return;
+  }
+
+  console.log(theme.heading("Shell Completion Test"));
+  console.log("");
+
+  // Get completion status using the same function used by doctor/update/onboard
+  const status = await checkShellCompletionStatus(CLI_NAME, { shell: options.shell });
+  const shellSource = options.shell ? "(from --shell)" : "(detected from $SHELL)";
+
+  console.log(`  Shell: ${theme.accent(status.shell)} ${theme.muted(shellSource)}`);
+  console.log(`  Platform: ${theme.muted(process.platform)} ${theme.muted(`(${os.release()})`)}`);
+  console.log(`  Profile: ${theme.muted(resolveCompletionProfilePath(status.shell))}`);
+  console.log(`  Cache path: ${theme.muted(status.cachePath)}`);
+  console.log("");
+  console.log(
+    `  Profile configured: ${status.profileInstalled ? theme.success("yes") : theme.warn("no")}`,
+  );
+  console.log(`  Cache exists: ${status.cacheExists ? theme.success("yes") : theme.warn("no")}`);
+  console.log(
+    `  Uses slow pattern: ${status.usesSlowPattern ? theme.error("yes (needs upgrade)") : theme.success("no")}`,
+  );
+  console.log("");
+
+  if (options.checkOnly) {
+    console.log(theme.muted("Check-only mode, exiting."));
+    return;
+  }
+
+  // Profile uses slow dynamic pattern - upgrade to cached version
+  if (status.usesSlowPattern) {
+    console.log(theme.warn("Profile uses slow dynamic completion. Upgrading to cached version..."));
+    const cacheGenerated = await ensureCompletionCacheExists(CLI_NAME, {
+      shell: status.shell,
+      generationMode: "full",
+    });
+    if (cacheGenerated) {
+      await installCompletion(status.shell, false, CLI_NAME);
+      console.log(theme.success("Upgraded to cached completion."));
+    } else {
+      console.log(theme.error("Failed to generate cache."));
+    }
+    return;
+  }
+
+  // Profile has completion but no cache - auto-fix
+  if (status.profileInstalled && !status.cacheExists) {
+    console.log(theme.warn("Profile has completion but cache is missing. Regenerating..."));
+    const cacheGenerated = await ensureCompletionCacheExists(CLI_NAME, {
+      shell: status.shell,
+      generationMode: "full",
+    });
+    if (cacheGenerated) {
+      console.log(theme.success("Cache regenerated successfully."));
+    } else {
+      console.log(theme.error("Failed to regenerate cache."));
+    }
+    return;
+  }
+
+  // Both profile and cache exist - nothing to do
+  if (status.profileInstalled && status.cacheExists && !options.force) {
+    console.log(theme.muted("Shell completion is fully configured. To test the prompt:"));
+    console.log(
+      theme.muted("  1. Remove the '# OpenClaw Completion' block from your shell profile"),
+    );
+    console.log(theme.muted("  2. Re-run this script"));
+    console.log(theme.muted("  Or use --force to prompt anyway"));
+    console.log("");
+    return;
+  }
+
+  // No profile configured - prompt to install
+  console.log(theme.heading("Shell completion"));
+
+  const shouldInstall = await confirm({
+    message: stylePromptMessage(`Enable ${status.shell} shell completion for ${CLI_NAME}?`),
+    initialValue: true,
+  });
+
+  if (isCancel(shouldInstall) || !shouldInstall) {
+    console.log(theme.muted(`Skipped. Run \`openclaw completion --install\` later to enable.`));
+    return;
+  }
+
+  // Generate cache first (required for fast shell startup)
+  if (!status.cacheExists) {
+    console.log(theme.muted("Generating completion cache..."));
+    const cacheGenerated = await ensureCompletionCacheExists(CLI_NAME, {
+      shell: status.shell,
+      generationMode: "full",
+    });
+    if (!cacheGenerated) {
+      console.log(theme.error("Failed to generate completion cache."));
+      return;
+    }
+    console.log(theme.success("Cache generated."));
+  }
+
+  // Install to shell profile
+  await installCompletion(status.shell, false, CLI_NAME);
+}
+
+export const testing = {
+  parseArgs,
+};
+
+if (import.meta.url === pathToFileURL(path.resolve(process.argv[1] ?? "")).href) {
+  main().catch((err: unknown) => {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(theme.error(`Error: ${message}`));
+    process.exit(1);
+  });
+}
diff --git a/scripts/transitive-manifest-risk-report.mts b/scripts/transitive-manifest-risk-report.mts
new file mode 100644
index 0000000000000000000000000000000000000000..d187b6677c98325379a8c0e26831fc6b60292c53
--- /dev/null
+++ b/scripts/transitive-manifest-risk-report.mts
@@ -0,0 +1,643 @@
+#!/usr/bin/env node
+
+// Reports transitive npm package manifest risks such as lifecycle scripts,
+// exotic specs, and recently published versions.
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import process from "node:process";
+import { asRecord, isRecord } from "@openclaw/normalization-core/record-coerce";
+import YAML from "yaml";
+import { readBoundedResponseText } from "./lib/bounded-response.mjs";
+import { classifyDependencySpec } from "./lib/dependency-spec-policy.mts";
+import { escapeRegExp } from "./lib/regexp.mjs";
+import { parseReportCliArgs, writeReportArtifact } from "./lib/report-cli-helpers.mts";
+import {
+  collectAllResolvedPackagesFromLockfile,
+  createBulkAdvisoryPayload,
+} from "./pre-commit/pnpm-audit-prod.mjs";
+
+const INSTALL_LIFECYCLE_SCRIPTS = ["preinstall", "install", "postinstall", "prepare"];
+const RECENTLY_PUBLISHED_VERSION_TYPE = "recently-published-version";
+const NPM_PACKUMENT_ACCEPT_HEADER = "application/json";
+/** Maximum npm packument response size accepted by the risk scanner. */
+const NPM_PACKUMENT_RESPONSE_MAX_BYTES = 16 * 1024 * 1024;
+const NPM_PACKUMENT_FETCH_TIMEOUT_MS = 60_000;
+
+type PackageVersion = { packageName: string; version: string };
+type ManifestFinding = PackageVersion & {
+  type: string;
+  dependency?: { name: string; spec: unknown; section: string };
+  source?: string;
+  script?: string;
+  publishedAt?: string;
+  minimumReleaseAgeMinutes?: number;
+  workspaceExcluded?: boolean;
+  workspaceExclusion?: string;
+};
+type ManifestLoadResult = { manifest: Record<string, unknown>; publishedAt: string | null };
+type ManifestFindingsOptions = PackageVersion &
+  ManifestLoadResult & {
+    now: Date;
+    minimumReleaseAgeMinutes: number | null;
+    minimumReleaseAgeExclude?: string[];
+  };
+
+function encodePackageName(name: string) {
+  return encodeURIComponent(name).replace(/^%40/u, "@");
+}
+
+function resolveRegistryBaseUrl() {
+  const configured =
+    process.env.npm_config_registry ??
+    process.env.NPM_CONFIG_REGISTRY ??
+    process.env.npm_config_userconfig_registry ??
+    "https://registry.npmjs.org";
+  return configured.replace(/\/+$/u, "");
+}
+
+export async function readBoundedNpmRegistryText(
+  response: Response,
+  maxBytes = NPM_PACKUMENT_RESPONSE_MAX_BYTES,
+  options: { signal?: AbortSignal } = {},
+) {
+  return await readBoundedResponseText(response, "npm registry", maxBytes, {
+    signal: options.signal,
+    formatTooLargeMessage: (_label: string, bytes: number) =>
+      `npm registry response exceeded ${bytes} bytes`,
+  });
+}
+
+function packageVersionsFromPayload(payload: unknown): PackageVersion[] {
+  return Object.entries(asRecord(payload)).flatMap(([packageName, versions]) =>
+    Array.isArray(versions)
+      ? versions.flatMap((version) =>
+          typeof version === "string" ? [{ packageName, version }] : [],
+        )
+      : [],
+  );
+}
+
+async function loadWorkspaceRiskSettings(rootDir: string) {
+  const workspacePath = path.join(rootDir, "pnpm-workspace.yaml");
+  try {
+    const workspace = asRecord(YAML.parse(await readFile(workspacePath, "utf8")));
+    const { minimumReleaseAge, minimumReleaseAgeExclude } = workspace;
+    return {
+      minimumReleaseAgeMinutes: typeof minimumReleaseAge === "number" ? minimumReleaseAge : null,
+      minimumReleaseAgeExclude: Array.isArray(minimumReleaseAgeExclude)
+        ? minimumReleaseAgeExclude.filter((entry) => typeof entry === "string")
+        : [],
+    };
+  } catch {
+    return { minimumReleaseAgeMinutes: null, minimumReleaseAgeExclude: [] };
+  }
+}
+
+function splitMinimumReleaseAgeExcludeSelector(selector: string) {
+  const trimmed = selector.trim();
+  if (!trimmed) {
+    return null;
+  }
+  let versionSeparatorIndex;
+  if (trimmed.startsWith("@")) {
+    const scopeSeparatorIndex = trimmed.indexOf("/");
+    versionSeparatorIndex =
+      scopeSeparatorIndex === -1 ? -1 : trimmed.indexOf("@", scopeSeparatorIndex + 1);
+  } else {
+    versionSeparatorIndex = trimmed.indexOf("@");
+  }
+  if (versionSeparatorIndex === -1) {
+    return { packagePattern: trimmed, versionSelectors: [] };
+  }
+  return {
+    packagePattern: trimmed.slice(0, versionSeparatorIndex),
+    versionSelectors: trimmed
+      .slice(versionSeparatorIndex + 1)
+      .split("||")
+      .map((entry) => entry.trim())
+      .filter(Boolean),
+  };
+}
+
+function countFindingTypes(findings: ManifestFinding[]) {
+  const counts: Record<string, number> = {};
+  for (const finding of findings) {
+    counts[finding.type] = (counts[finding.type] ?? 0) + 1;
+  }
+  return counts;
+}
+
+function compareManifestFindings(left: ManifestFinding, right: ManifestFinding) {
+  if (left.type !== right.type) {
+    return left.type.localeCompare(right.type);
+  }
+  if (left.packageName !== right.packageName) {
+    return left.packageName.localeCompare(right.packageName);
+  }
+  return left.version.localeCompare(right.version);
+}
+
+function packagePatternMatches(pattern: string, packageName: string) {
+  const regex = new RegExp(`^${pattern.split("*").map(escapeRegExp).join(".*")}$`, "u");
+  return regex.test(packageName);
+}
+
+function matchesMinimumReleaseAgeExclude(selector: string, packageName: string, version: string) {
+  const parsed = splitMinimumReleaseAgeExcludeSelector(selector);
+  if (!parsed || !packagePatternMatches(parsed.packagePattern, packageName)) {
+    return false;
+  }
+  return parsed.versionSelectors.length === 0 || parsed.versionSelectors.includes(version);
+}
+
+function collectManifestFindings({
+  packageName,
+  version,
+  manifest,
+  publishedAt,
+  now,
+  minimumReleaseAgeMinutes,
+  minimumReleaseAgeExclude = [],
+}: ManifestFindingsOptions) {
+  const findings: ManifestFinding[] = [];
+  const workspaceExcludedFindings: ManifestFinding[] = [];
+  for (const section of ["dependencies", "optionalDependencies"] as const) {
+    const dependencies = asRecord(manifest[section]);
+    for (const [dependencyName, spec] of Object.entries(dependencies)) {
+      const classification = classifyDependencySpec(spec);
+      if (!classification.allowedPinned) {
+        findings.push({
+          type: "floating-transitive-spec",
+          packageName,
+          version,
+          dependency: { name: dependencyName, spec, section },
+        });
+      }
+      if (classification.exotic && typeof spec === "string") {
+        findings.push({
+          type: "exotic-source",
+          packageName,
+          version,
+          source: spec,
+          dependency: { name: dependencyName, spec, section },
+        });
+      }
+    }
+  }
+
+  const scripts = asRecord(manifest.scripts);
+  for (const script of INSTALL_LIFECYCLE_SCRIPTS) {
+    if (typeof scripts[script] === "string") {
+      findings.push({ type: "lifecycle-script", packageName, version, script });
+    }
+  }
+
+  if (!publishedAt) {
+    findings.push({ type: "missing-publish-time", packageName, version });
+  } else if (typeof minimumReleaseAgeMinutes === "number") {
+    const ageMs = now.getTime() - Date.parse(publishedAt);
+    if (Number.isFinite(ageMs) && ageMs < minimumReleaseAgeMinutes * 60_000) {
+      const finding = {
+        type: RECENTLY_PUBLISHED_VERSION_TYPE,
+        packageName,
+        version,
+        publishedAt,
+        minimumReleaseAgeMinutes,
+      };
+      const exclusion = minimumReleaseAgeExclude.find((selector) =>
+        matchesMinimumReleaseAgeExclude(selector, packageName, version),
+      );
+      if (exclusion) {
+        workspaceExcludedFindings.push({
+          ...finding,
+          workspaceExcluded: true,
+          workspaceExclusion: exclusion,
+        });
+      } else {
+        findings.push(finding);
+      }
+    }
+  }
+
+  return { findings, workspaceExcludedFindings };
+}
+
+export async function fetchNpmManifest({
+  packageName,
+  version,
+  fetchImpl,
+  registryBaseUrl,
+  maxBytes = NPM_PACKUMENT_RESPONSE_MAX_BYTES,
+  timeoutMs = NPM_PACKUMENT_FETCH_TIMEOUT_MS,
+}: {
+  packageName: string;
+  version: string;
+  fetchImpl: typeof fetch;
+  registryBaseUrl: string;
+  maxBytes?: number;
+  timeoutMs?: number;
+}): Promise<ManifestLoadResult> {
+  const signal = AbortSignal.timeout(timeoutMs);
+  const response = await fetchImpl(`${registryBaseUrl}/${encodePackageName(packageName)}`, {
+    headers: {
+      Accept: NPM_PACKUMENT_ACCEPT_HEADER,
+    },
+    signal,
+  });
+  if (!response.ok) {
+    throw new Error(`${response.status} ${response.statusText}`);
+  }
+  const packumentText = await readBoundedNpmRegistryText(response, maxBytes, { signal });
+  const packument: unknown = JSON.parse(packumentText);
+  if (!isRecord(packument)) {
+    throw new Error("invalid packument payload");
+  }
+  const versions = asRecord(packument.versions);
+  const manifest = versions[version];
+  if (!isRecord(manifest)) {
+    throw new Error(`version ${version} not found`);
+  }
+  const times = asRecord(packument.time);
+  return {
+    manifest,
+    publishedAt: typeof times[version] === "string" ? times[version] : null,
+  };
+}
+
+export async function createTransitiveManifestRiskReport({
+  packageVersions,
+  manifestLoader,
+  now = new Date(),
+  minimumReleaseAgeMinutes = null,
+  minimumReleaseAgeExclude = [],
+}: {
+  packageVersions: PackageVersion[];
+  manifestLoader: (entry: PackageVersion) => Promise<ManifestLoadResult>;
+  now?: Date;
+  minimumReleaseAgeMinutes?: number | null;
+  minimumReleaseAgeExclude?: string[];
+}) {
+  const findings: ManifestFinding[] = [];
+  const workspaceExcludedFindings: ManifestFinding[] = [];
+  const metadataFailures: Array<PackageVersion & { error: string }> = [];
+  for (const { packageName, version } of packageVersions) {
+    if (classifyDependencySpec(version).exotic) {
+      findings.push({
+        type: "exotic-source",
+        packageName,
+        version,
+        source: version,
+      });
+      continue;
+    }
+    try {
+      const { manifest, publishedAt } = await manifestLoader({ packageName, version });
+      const manifestFindings = collectManifestFindings({
+        packageName,
+        version,
+        manifest,
+        publishedAt,
+        now,
+        minimumReleaseAgeMinutes,
+        minimumReleaseAgeExclude,
+      });
+      findings.push(...manifestFindings.findings);
+      workspaceExcludedFindings.push(...manifestFindings.workspaceExcludedFindings);
+    } catch (error) {
+      metadataFailures.push({
+        packageName,
+        version,
+        error: error instanceof Error ? error.message : String(error),
+      });
+    }
+  }
+  const sortedFindings = findings.toSorted(compareManifestFindings);
+  const byType = countFindingTypes(sortedFindings);
+  return {
+    generatedAt: now.toISOString(),
+    packageVersions: packageVersions.length,
+    findingCount: sortedFindings.length,
+    byType,
+    workspacePolicy: {
+      minimumReleaseAgeMinutes,
+      minimumReleaseAgeExclude,
+    },
+    workspaceExcludedFindingCount: workspaceExcludedFindings.length,
+    workspaceExcludedByType: countFindingTypes(workspaceExcludedFindings),
+    workspaceExcludedFindings: workspaceExcludedFindings.toSorted(compareManifestFindings),
+    metadataFailures,
+    findings: sortedFindings,
+  };
+}
+
+type ManifestRiskReport = Awaited<ReturnType<typeof createTransitiveManifestRiskReport>>;
+
+function markdownCode(value: string) {
+  return `\`${value.replaceAll("`", "\\`")}\``;
+}
+
+function findingPackageKey(finding: PackageVersion) {
+  return `${finding.packageName}@${finding.version}`;
+}
+
+function typeBreakdown(findings: ManifestFinding[]) {
+  return Object.entries(countFindingTypes(findings))
+    .toSorted(([left], [right]) => left.localeCompare(right))
+    .map(([type, count]) => `${type}: ${count}`)
+    .join(", ");
+}
+
+const createFloatingTarget = () => ({
+  declarations: 0,
+  sourcePackages: new Set<string>(),
+  specifiers: new Map<string, number>(),
+});
+
+function collectMarkdownRollups(findings: ManifestFinding[]) {
+  const packageFindings = new Map<string, ManifestFinding[]>();
+  const floatingTargets = new Map<string, ReturnType<typeof createFloatingTarget>>();
+  const lifecyclePackages = new Map<string, Set<string>>();
+  const recentlyPublishedVersions: ManifestFinding[] = [];
+  const exoticSources: ManifestFinding[] = [];
+
+  for (const finding of findings) {
+    const packageKey = findingPackageKey(finding);
+    const packageList = packageFindings.get(packageKey) ?? [];
+    packageList.push(finding);
+    packageFindings.set(packageKey, packageList);
+
+    if (finding.type === "floating-transitive-spec" && finding.dependency?.name) {
+      const target = floatingTargets.get(finding.dependency.name) ?? createFloatingTarget();
+      target.declarations += 1;
+      target.sourcePackages.add(packageKey);
+      const specifier =
+        typeof finding.dependency.spec === "string" ? finding.dependency.spec : "unknown";
+      target.specifiers.set(specifier, (target.specifiers.get(specifier) ?? 0) + 1);
+      floatingTargets.set(finding.dependency.name, target);
+    }
+
+    if (finding.type === "lifecycle-script") {
+      const scripts = lifecyclePackages.get(packageKey) ?? new Set();
+      scripts.add(finding.script ?? "unknown");
+      lifecyclePackages.set(packageKey, scripts);
+    }
+
+    if (finding.type === RECENTLY_PUBLISHED_VERSION_TYPE) {
+      recentlyPublishedVersions.push(finding);
+    }
+
+    if (finding.type === "exotic-source") {
+      exoticSources.push(finding);
+    }
+  }
+
+  return {
+    packageFindings,
+    floatingTargets,
+    lifecyclePackages,
+    recentlyPublishedVersions,
+    exoticSources,
+  };
+}
+
+type PackageFindings = ReturnType<typeof collectMarkdownRollups>["packageFindings"];
+type FloatingTargets = ReturnType<typeof collectMarkdownRollups>["floatingTargets"];
+type LifecyclePackages = ReturnType<typeof collectMarkdownRollups>["lifecyclePackages"];
+
+function renderPackageFindingSummary(lines: string[], packageFindings: PackageFindings) {
+  lines.push("## Published Package Manifests With Risk Findings", "");
+  for (const [packageKey, findings] of [...packageFindings.entries()].toSorted((left, right) => {
+    if (right[1].length !== left[1].length) {
+      return right[1].length - left[1].length;
+    }
+    return left[0].localeCompare(right[0]);
+  })) {
+    lines.push(
+      `- ${markdownCode(packageKey)}: ${findings.length} manifest finding${findings.length === 1 ? "" : "s"} ` +
+        `(${typeBreakdown(findings)})`,
+    );
+  }
+  lines.push("");
+}
+
+function renderFloatingDependencyTargets(lines: string[], floatingTargets: FloatingTargets) {
+  if (floatingTargets.size === 0) {
+    return;
+  }
+
+  lines.push("## Floating Dependency Targets", "");
+  for (const [dependencyName, detail] of [...floatingTargets.entries()].toSorted((left, right) => {
+    if (right[1].declarations !== left[1].declarations) {
+      return right[1].declarations - left[1].declarations;
+    }
+    return left[0].localeCompare(right[0]);
+  })) {
+    const specifiers = [...detail.specifiers.entries()]
+      .toSorted((left, right) => right[1] - left[1] || left[0].localeCompare(right[0]))
+      .map(([specifier, count]) => `${specifier}: ${count}`)
+      .join(", ");
+    lines.push(
+      `- ${markdownCode(dependencyName)}: ${detail.declarations} declarations from ` +
+        `${detail.sourcePackages.size} resolved packages; specifiers: ${specifiers}`,
+    );
+  }
+  lines.push("");
+}
+
+function renderLifecycleScriptPackages(lines: string[], lifecyclePackages: LifecyclePackages) {
+  if (lifecyclePackages.size === 0) {
+    return;
+  }
+
+  lines.push("## Lifecycle Script Packages", "");
+  for (const [packageKey, scripts] of [...lifecyclePackages.entries()].toSorted(([left], [right]) =>
+    left.localeCompare(right),
+  )) {
+    lines.push(
+      `- ${markdownCode(packageKey)}: ${[...scripts]
+        .toSorted((left, right) => left.localeCompare(right))
+        .join(", ")}`,
+    );
+  }
+  lines.push("");
+}
+
+function renderRecentlyPublishedVersions(
+  lines: string[],
+  findings: ManifestFinding[],
+  heading: string,
+) {
+  if (findings.length === 0) {
+    return;
+  }
+
+  lines.push(`## ${heading}`, "");
+  const minimumReleaseAgeMinutes = findings.find(
+    (finding) => typeof finding.minimumReleaseAgeMinutes === "number",
+  )?.minimumReleaseAgeMinutes;
+  if (typeof minimumReleaseAgeMinutes === "number") {
+    lines.push(`Workspace minimum release age: ${minimumReleaseAgeMinutes} minutes.`, "");
+  }
+  for (const finding of findings.toSorted((left, right) => {
+    const dateDelta = Date.parse(right.publishedAt ?? "") - Date.parse(left.publishedAt ?? "");
+    if (Number.isFinite(dateDelta) && dateDelta !== 0) {
+      return dateDelta;
+    }
+    return findingPackageKey(left).localeCompare(findingPackageKey(right));
+  })) {
+    const suffix = finding.workspaceExclusion
+      ? `; workspace exclusion ${markdownCode(finding.workspaceExclusion)}`
+      : "";
+    lines.push(
+      `- ${markdownCode(findingPackageKey(finding))}: published ${finding.publishedAt}${suffix}`,
+    );
+  }
+  lines.push("");
+}
+
+function renderExoticSources(lines: string[], exoticSources: ManifestFinding[]) {
+  if (exoticSources.length === 0) {
+    return;
+  }
+
+  lines.push("## Exotic Sources", "");
+  for (const finding of exoticSources.toSorted((left, right) =>
+    findingPackageKey(left).localeCompare(findingPackageKey(right)),
+  )) {
+    lines.push(`- ${markdownCode(findingPackageKey(finding))}: source ${finding.source}`);
+  }
+  lines.push("");
+}
+
+export function renderTransitiveManifestRiskMarkdownReport(report: ManifestRiskReport) {
+  const lines = [
+    "# Transitive Manifest Risk Report",
+    "",
+    `Generated: ${report.generatedAt}`,
+    "",
+    "## Scope",
+    "",
+    "This report inspects published package manifests for resolved packages in the lockfile. It looks for supply-chain risk signals such as floating dependency specs, lifecycle scripts, exotic sources, recently published versions, and missing publish time metadata. It is report-only.",
+    "",
+    "## Summary",
+    "",
+    `- Resolved package versions inspected: ${report.packageVersions}`,
+    `- Reported risk signals: ${report.findingCount}`,
+    `- Signals covered by workspace policy exclusions: ${report.workspaceExcludedFindingCount ?? 0}`,
+    `- Metadata failures: ${report.metadataFailures.length}`,
+    "",
+    "## Reported Risk Signals By Type",
+    "",
+  ];
+  for (const [type, count] of Object.entries(report.byType).toSorted(([left], [right]) =>
+    left.localeCompare(right),
+  )) {
+    lines.push(`- ${type}: ${count}`);
+  }
+  lines.push("");
+
+  if (Object.keys(report.workspaceExcludedByType ?? {}).length > 0) {
+    lines.push("## Signals Covered By Workspace Policy Exclusions", "");
+    lines.push(
+      "These are not included in the reported risk signal totals above. They are tracked separately because the workspace package-manager policy already excludes them.",
+    );
+    lines.push("");
+    for (const [type, count] of Object.entries(report.workspaceExcludedByType ?? {}).toSorted(
+      ([left], [right]) => left.localeCompare(right),
+    )) {
+      lines.push(`- ${type}: ${count}`);
+    }
+    lines.push("");
+  }
+
+  lines.push(
+    "## Complete Evidence",
+    "",
+    "The complete reported signal list is available in the JSON report, including every package, version, dependency, and specifier. Recently published versions covered by pnpm workspace release-age exclusions are listed separately under workspaceExcludedFindings. The sections below summarize the same data by package, dependency target, and finding class for human review.",
+    "",
+  );
+
+  if (report.findings.length > 0) {
+    const rollups = collectMarkdownRollups(report.findings);
+    renderPackageFindingSummary(lines, rollups.packageFindings);
+    renderFloatingDependencyTargets(lines, rollups.floatingTargets);
+    renderLifecycleScriptPackages(lines, rollups.lifecyclePackages);
+    renderExoticSources(lines, rollups.exoticSources);
+    renderRecentlyPublishedVersions(
+      lines,
+      rollups.recentlyPublishedVersions,
+      "Recently Published Versions Not Covered By Workspace Exclusions",
+    );
+  }
+
+  renderRecentlyPublishedVersions(
+    lines,
+    report.workspaceExcludedFindings ?? [],
+    "Recently Published Versions Covered By Workspace Exclusions",
+  );
+
+  if (report.metadataFailures.length > 0) {
+    lines.push("## Metadata Failures", "");
+    for (const failure of report.metadataFailures) {
+      lines.push(
+        `- ${markdownCode(`${failure.packageName}@${failure.version}`)}: ${failure.error}`,
+      );
+    }
+    lines.push("");
+  }
+  return `${lines.join("\n")}\n`;
+}
+
+async function runTransitiveManifestRiskReport(
+  rootDir = process.cwd(),
+  fetchImpl = fetch,
+  now = new Date(),
+) {
+  const lockfileText = await readFile(path.join(rootDir, "pnpm-lock.yaml"), "utf8");
+  const payload = createBulkAdvisoryPayload(collectAllResolvedPackagesFromLockfile(lockfileText));
+  const packageVersions = packageVersionsFromPayload(payload);
+  const settings = await loadWorkspaceRiskSettings(rootDir);
+  return createTransitiveManifestRiskReport({
+    packageVersions,
+    now,
+    minimumReleaseAgeMinutes: settings.minimumReleaseAgeMinutes,
+    minimumReleaseAgeExclude: settings.minimumReleaseAgeExclude,
+    manifestLoader: ({ packageName, version }) =>
+      fetchNpmManifest({
+        packageName,
+        version,
+        fetchImpl,
+        registryBaseUrl: resolveRegistryBaseUrl(),
+      }),
+  });
+}
+
+export async function main(argv = process.argv.slice(2)) {
+  const options = parseReportCliArgs(argv);
+  const report = await runTransitiveManifestRiskReport(options.rootDir);
+  await writeReportArtifact(options.jsonPath, `${JSON.stringify(report, null, 2)}\n`);
+  await writeReportArtifact(
+    options.markdownPath,
+    renderTransitiveManifestRiskMarkdownReport(report),
+  );
+  const artifactHint =
+    typeof options.markdownPath === "string" ? " See ".concat(options.markdownPath, ".") : "";
+  process.stdout.write(
+    `INFO transitive manifest risk report: inspected ${report.packageVersions} resolved ` +
+      `package manifests; ${report.findingCount} reported risk signals, ` +
+      `${report.metadataFailures.length} metadata failures; release not blocked.${artifactHint}\n`,
+  );
+  return 0;
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === path.resolve(import.meta.filename)) {
+  main().then(
+    (exitCode) => {
+      process.exitCode = exitCode;
+    },
+    (error: unknown) => {
+      process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+      process.exitCode = 1;
+    },
+  );
+}
diff --git a/scripts/type-suppression-inventory.ts b/scripts/type-suppression-inventory.ts
new file mode 100644
index 0000000000000000000000000000000000000000..6453b9ed5bd723907242a2dec62dca952200fb00
--- /dev/null
+++ b/scripts/type-suppression-inventory.ts
@@ -0,0 +1,221 @@
+#!/usr/bin/env node
+// Type Suppression Inventory reports unchecked any casts and expected TypeScript errors.
+
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import ts from "typescript";
+import {
+  REPO_SCAN_ROOTS,
+  REPO_SCAN_SKIPPED_DIR_NAMES,
+  listRepoFilesSync,
+  toPosixPath,
+} from "./check-file-utils.js";
+import { collectTypeScriptCommentRanges } from "./lib/ts-guard-utils.mts";
+
+type TypeSuppressionKind = "as-any" | "expect-error" | "type-assertion-any";
+
+export type TypeSuppressionFinding = {
+  excerpt: string;
+  file: string;
+  kind: TypeSuppressionKind;
+  line: number;
+};
+
+export type TypeSuppressionReport = {
+  findings: TypeSuppressionFinding[];
+  scannedFileCount: number;
+  schemaVersion: 1;
+  summary: {
+    findingCount: number;
+    kindCounts: Record<TypeSuppressionKind, number>;
+    scannedFileCount: number;
+    touchedFileCount: number;
+  };
+};
+
+const TYPE_SUPPRESSION_WHITESPACE_PATTERN = /\s/u;
+
+function skipTypeScriptTrivia(source: string, start: number): number {
+  let offset = start;
+  while (offset < source.length) {
+    const character = source[offset];
+    if (character && TYPE_SUPPRESSION_WHITESPACE_PATTERN.test(character)) {
+      offset += 1;
+      continue;
+    }
+    if (source.startsWith("/*", offset)) {
+      const commentEnd = source.indexOf("*/", offset + 2);
+      offset = commentEnd === -1 ? source.length : commentEnd + 2;
+      continue;
+    }
+    if (source.startsWith("//", offset)) {
+      offset += 2;
+      while (offset < source.length && !/[\r\n\u2028\u2029]/u.test(source[offset] ?? "")) {
+        offset += 1;
+      }
+      continue;
+    }
+    break;
+  }
+  return offset;
+}
+
+function isAnyKeywordAt(source: string, offset: number): boolean {
+  return (
+    source.startsWith("any", offset) && !/[A-Za-z0-9_$]/u.test(source[offset + "any".length] ?? "")
+  );
+}
+
+function hasTypeSuppressionTextCandidate(source: string): boolean {
+  if (source.includes("@ts-expect-error")) {
+    return true;
+  }
+  for (const match of source.matchAll(/\bas\b/gu)) {
+    if (
+      isAnyKeywordAt(source, skipTypeScriptTrivia(source, (match.index ?? 0) + match[0].length))
+    ) {
+      return true;
+    }
+  }
+  for (let offset = source.indexOf("<"); offset !== -1; offset = source.indexOf("<", offset + 1)) {
+    const anyOffset = skipTypeScriptTrivia(source, offset + 1);
+    if (
+      isAnyKeywordAt(source, anyOffset) &&
+      source[skipTypeScriptTrivia(source, anyOffset + "any".length)] === ">"
+    ) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function listCandidateFiles(repoRoot: string, roots: readonly string[]): string[] {
+  return listRepoFilesSync(repoRoot, {
+    includeFile: (file) => {
+      const pathSegments = toPosixPath(file).split("/");
+      return (
+        /\.[cm]?tsx?$/u.test(file) &&
+        !file.endsWith(".d.ts") &&
+        !pathSegments.some((segment) => REPO_SCAN_SKIPPED_DIR_NAMES.has(segment))
+      );
+    },
+    roots,
+  });
+}
+
+function addAnyCastFindings(
+  sourceFile: ts.SourceFile,
+  file: string,
+  findings: TypeSuppressionFinding[],
+): void {
+  const visit = (node: ts.Node): void => {
+    const kind =
+      ts.isAsExpression(node) && node.type.kind === ts.SyntaxKind.AnyKeyword
+        ? "as-any"
+        : ts.isTypeAssertionExpression(node) && node.type.kind === ts.SyntaxKind.AnyKeyword
+          ? "type-assertion-any"
+          : null;
+    if (kind) {
+      const { line } = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));
+      findings.push({
+        excerpt: node.getText(sourceFile).replace(/\s+/gu, " ").trim(),
+        file,
+        kind,
+        line: line + 1,
+      });
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(sourceFile);
+}
+
+function addExpectErrorFindings(
+  sourceFile: ts.SourceFile,
+  file: string,
+  findings: TypeSuppressionFinding[],
+): void {
+  const source = sourceFile.getFullText();
+  if (!source.includes("@ts-expect-error")) {
+    return;
+  }
+  for (const range of collectTypeScriptCommentRanges(ts, sourceFile)) {
+    const comment = source.slice(range.pos, range.end);
+    const markerPattern = /@ts-expect-error[^\r\n]*/gu;
+    for (const match of comment.matchAll(markerPattern)) {
+      const position = range.pos + (match.index ?? 0);
+      const line = sourceFile.getLineAndCharacterOfPosition(position).line;
+      findings.push({
+        excerpt: match[0].trim(),
+        file,
+        kind: "expect-error",
+        line: line + 1,
+      });
+    }
+  }
+}
+
+export function collectTypeSuppressionReport(params: {
+  files?: readonly string[];
+  repoRoot: string;
+  roots?: readonly string[];
+}): TypeSuppressionReport {
+  const files = [
+    ...(params.files ?? listCandidateFiles(params.repoRoot, params.roots ?? REPO_SCAN_ROOTS)),
+  ]
+    .map(toPosixPath)
+    .toSorted((left, right) => left.localeCompare(right));
+  const findings: TypeSuppressionFinding[] = [];
+
+  for (const file of files) {
+    const absolutePath = path.join(params.repoRoot, file);
+    if (!fs.existsSync(absolutePath)) {
+      continue;
+    }
+    const source = fs.readFileSync(absolutePath, "utf8");
+    // Full AST parsing dominates the repository ratchet. This syntax-shaped text
+    // gate keeps false positives cheap; the AST remains the source of truth.
+    if (!hasTypeSuppressionTextCandidate(source)) {
+      continue;
+    }
+    const sourceFile = ts.createSourceFile(file, source, ts.ScriptTarget.Latest);
+    addAnyCastFindings(sourceFile, file, findings);
+    addExpectErrorFindings(sourceFile, file, findings);
+  }
+
+  findings.sort(
+    (left, right) =>
+      left.file.localeCompare(right.file) ||
+      left.line - right.line ||
+      left.kind.localeCompare(right.kind),
+  );
+  const kindCounts: Record<TypeSuppressionKind, number> = {
+    "as-any": 0,
+    "expect-error": 0,
+    "type-assertion-any": 0,
+  };
+  for (const finding of findings) {
+    kindCounts[finding.kind] = kindCounts[finding.kind] + 1;
+  }
+
+  return {
+    findings,
+    scannedFileCount: files.length,
+    schemaVersion: 1,
+    summary: {
+      findingCount: findings.length,
+      kindCounts,
+      scannedFileCount: files.length,
+      touchedFileCount: new Set(findings.map((finding) => finding.file)).size,
+    },
+  };
+}
+
+function main(): void {
+  const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+  process.stdout.write(`${JSON.stringify(collectTypeSuppressionReport({ repoRoot }), null, 2)}\n`);
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  main();
+}
diff --git a/scripts/ui.js b/scripts/ui.js
new file mode 100644
index 0000000000000000000000000000000000000000..ddee295833d845e7f010778864e2aa313e783182
--- /dev/null
+++ b/scripts/ui.js
@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import { runUiCli } from "./ui.mts";
+
+// Native imports avoid loader startup and leave process lifetime with the UI owner.
+runUiCli();
diff --git a/scripts/update-compat-inventory.mts b/scripts/update-compat-inventory.mts
new file mode 100644
index 0000000000000000000000000000000000000000..c25a63e8cb94ec1835b1ed267ee8180204bda0f9
--- /dev/null
+++ b/scripts/update-compat-inventory.mts
@@ -0,0 +1,144 @@
+#!/usr/bin/env node
+import childProcess from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { parseArgs } from "node:util";
+import { isDirectRunUrl } from "./lib/direct-run.mjs";
+import { resolveNpmJsonEntries, resolveNpmJsonString } from "./lib/npm-json-output.mts";
+import { compareReleaseVersions, parseReleaseVersion } from "./lib/release-version.mjs";
+import {
+  parseUpdateCompatibilityInventory,
+  recordUpdateCompatibilityRelease,
+  readUpdateCompatibilityInventory,
+  type UpdateCompatibilityInventory,
+} from "./lib/update-compat-chunks.mts";
+
+const DEFAULT_OUTPUT = "scripts/lib/update-compat-inventory.json";
+const INTEGRITY = /^sha512-[A-Za-z0-9+/]{86}==$/;
+
+function npmView(packageName: string, field: string): unknown {
+  return JSON.parse(
+    childProcess.execFileSync("npm", ["view", packageName, field, "--json"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 30_000,
+      shell: process.platform === "win32",
+    }),
+  );
+}
+
+function sortedReleases<T extends { version: string }>(releases: T[]): T[] {
+  return releases.toSorted((left, right) => {
+    const order = compareReleaseVersions(left.version, right.version);
+    if (order === null) {
+      throw new Error(`Invalid release version: ${left.version} or ${right.version}`);
+    }
+    return order;
+  });
+}
+
+function shellArgument(value: string): string {
+  return /^[A-Za-z0-9_./=+-]+$/.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`;
+}
+
+function checkRegistryCoverage(inventory: UpdateCompatibilityInventory, output: string): void {
+  const entries = resolveNpmJsonEntries(npmView("openclaw", "dist-tags"));
+  const tags = entries.length === 1 ? entries[0] : undefined;
+  if (typeof tags !== "object" || tags === null || Array.isArray(tags)) {
+    throw new Error("npm returned invalid OpenClaw dist-tags; expected latest and beta versions");
+  }
+  const taggedVersions: string[] = [];
+  for (const tag of ["latest", "beta"]) {
+    const version: unknown = Reflect.get(tags, tag);
+    if (typeof version !== "string" || parseReleaseVersion(version)?.version !== version) {
+      throw new Error(`npm OpenClaw dist-tag ${tag} is missing or invalid`);
+    }
+    taggedVersions.push(version);
+  }
+  const missing = [...new Set(taggedVersions)].filter(
+    (version) => !inventory.releases.some((release) => release.version === version),
+  );
+  if (missing.length === 0) {
+    return;
+  }
+  const releases = inventory.releases.map(({ version, integrity }) => ({ version, integrity }));
+  for (const version of missing) {
+    const integrity = resolveNpmJsonString(npmView(`openclaw@${version}`, "dist.integrity"));
+    if (!INTEGRITY.test(integrity)) {
+      throw new Error(`npm returned invalid SHA-512 integrity for openclaw@${version}`);
+    }
+    releases.push({ version, integrity });
+  }
+  const command = ["pnpm update:compat:gen"];
+  if (output !== DEFAULT_OUTPUT) {
+    command.push(`--output ${shellArgument(output)}`);
+  }
+  for (const release of sortedReleases(releases)) {
+    command.push(
+      `--release ${shellArgument(`.artifacts/update-compat/${release.version}/package=${release.integrity}`)}`,
+    );
+  }
+  throw new Error(
+    [
+      `Update compatibility inventory is missing current npm release versions: ${missing.join(", ")}.`,
+      "Download and verify each npm tarball against its SHA-512 integrity before unpacking it to .artifacts/update-compat/<version>/package, then run:",
+      command.join(" "),
+    ].join("\n"),
+  );
+}
+
+function runUpdateCompatibilityInventory(args: string[] = process.argv.slice(2)): void {
+  const { values } = parseArgs({
+    args,
+    options: {
+      release: { type: "string", multiple: true },
+      output: { type: "string", default: DEFAULT_OUTPUT },
+      check: { type: "boolean", default: false },
+    },
+  });
+  const output = path.resolve(values.output);
+  let inventory: UpdateCompatibilityInventory;
+  if (values.release?.length) {
+    inventory = parseUpdateCompatibilityInventory({
+      schemaVersion: 1,
+      releases: sortedReleases(
+        values.release.map((release) => {
+          const split = release.indexOf("=sha512-");
+          if (split <= 0 || !INTEGRITY.test(release.slice(split + 1))) {
+            throw new Error(
+              `Invalid --release ${release}; expected <unpacked-dir>=<npm-dist.integrity>`,
+            );
+          }
+          return recordUpdateCompatibilityRelease({
+            packageDir: release.slice(0, split),
+            integrity: release.slice(split + 1),
+          });
+        }),
+      ),
+    });
+    const contents = `${JSON.stringify(inventory, null, 2)}\n`;
+    if (values.check) {
+      readUpdateCompatibilityInventory(output);
+      if (fs.readFileSync(output, "utf8") !== contents) {
+        throw new Error(`Stale update compatibility inventory: ${output}`);
+      }
+    } else {
+      fs.mkdirSync(path.dirname(output), { recursive: true });
+      fs.writeFileSync(output, contents);
+    }
+  } else if (values.check) {
+    inventory = readUpdateCompatibilityInventory(output);
+    checkRegistryCoverage(inventory, values.output);
+  } else {
+    throw new Error(
+      "Usage: pnpm update:compat:gen --release <unpacked-dir>=<npm-dist.integrity> [--release ...] [--output <file>] or pnpm update:compat:check",
+    );
+  }
+  console.log(
+    `${values.check ? "Verified" : "Recorded"} update compatibility inventory: ${inventory.releases.map((release) => `${release.version} (${release.chunks.length} chunks)`).join(", ")}`,
+  );
+}
+
+if (isDirectRunUrl(process.argv[1], import.meta.url)) {
+  runUpdateCompatibilityInventory();
+}
diff --git a/scripts/validate-full-release-validation-evidence.mjs b/scripts/validate-full-release-validation-evidence.mjs
new file mode 100644
index 0000000000000000000000000000000000000000..a203a54b4504d732fc38cf26692ed8e317111c75
--- /dev/null
+++ b/scripts/validate-full-release-validation-evidence.mjs
@@ -0,0 +1,625 @@
+#!/usr/bin/env node
+// Binds Full Release Validation run metadata to its supported evidence manifest.
+import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import {
+  normalizePublicationIntent,
+  publicationAdmissionContract,
+  publicationObservationJson,
+  publicationSourceContract,
+  publicationSourceJson,
+  validatePublicationAdmissionBinding,
+  validatePublicationSourceBinding,
+} from "./full-release-publication-contract.mjs";
+import {
+  normalizeReleaseCoveragePolicy,
+  isSplitChangelogEvidenceDelta,
+  SPLIT_CHANGELOG_EVIDENCE_REUSE_POLICY,
+} from "./full-release-validation-policy.mjs";
+import { resolveReleaseContextIdentity } from "./lib/release-context.mjs";
+import { createReleaseEvidenceClient, validateReleaseRunEvidence } from "./release-ci-summary.mjs";
+
+const FULL_RELEASE_WORKFLOW = "Full Release Validation";
+const FULL_RELEASE_WORKFLOW_PATH = ".github/workflows/full-release-validation.yml";
+const SHA_PATTERN = /^[a-f0-9]{40}$/u;
+const PINNED_BRANCH_PATTERN = /^release-ci\/([a-f0-9]{12})-([1-9][0-9]*)$/u;
+const TRUSTED_RELEASE_PUBLISH_TAG_PATTERN =
+  /^refs\/tags\/release-publish\/([a-f0-9]{12})-[1-9][0-9]*$/u;
+const EXACT_TARGET_EVIDENCE_REUSE_POLICY = "exact-target-full-validation-v1";
+const CHANGELOG_ONLY_EVIDENCE_REUSE_POLICY = "changelog-only-release-v1";
+
+/** @param {unknown} value */
+function scalarString(value) {
+  if (
+    typeof value === "string" ||
+    typeof value === "number" ||
+    typeof value === "boolean" ||
+    typeof value === "bigint"
+  ) {
+    return String(value);
+  }
+  return "";
+}
+
+/** @param {unknown} value */
+function displayValue(value) {
+  if (value === null || value === undefined) {
+    return "<missing>";
+  }
+  const scalar = scalarString(value);
+  if (scalar) {
+    return scalar;
+  }
+  try {
+    return JSON.stringify(value) ?? "<unserializable>";
+  } catch {
+    return "<unserializable>";
+  }
+}
+
+/**
+ * @typedef {object} StrictReleaseEvidence
+ * @property {unknown} [schema]
+ * @property {unknown} [valid]
+ * @property {{ runId?: unknown, targetSha?: unknown, runAttempt?: unknown, manifest?: unknown }} [current]
+ * @property {{ runId?: unknown, targetSha?: unknown }} [root]
+ * @property {{ changedPaths?: unknown, evidenceSha?: unknown, policy?: unknown, rootRunId?: unknown, selectedRunId?: unknown }} [evidenceReuse]
+ * @property {{ allRequiredSucceeded?: unknown }} [conclusions]
+ */
+/**
+ * @typedef {object} FullReleaseValidationManifest
+ * @property {unknown} [version]
+ * @property {unknown} [workflowName]
+ * @property {unknown} [runId]
+ * @property {unknown} [runAttempt]
+ * @property {unknown} [workflowRef]
+ * @property {unknown} [workflowSha]
+ * @property {unknown} [workflowFullRef]
+ * @property {unknown} [workflowRefType]
+ * @property {unknown} [targetRef]
+ * @property {unknown} [targetSha]
+ * @property {unknown} [releaseProfile]
+ * @property {unknown} [rerunGroup]
+ * @property {unknown} [runReleaseSoak]
+ * @property {unknown} [sourceAdmissionContract]
+ * @property {unknown} [sourceAdmission]
+ * @property {unknown} [publicationAdmissionContract]
+ * @property {unknown} [publicationAdmission]
+ * @property {unknown} [sourceParentRunAttempt]
+ * @property {{ package?: { version?: unknown } }} [candidateBinding]
+ * @property {{ coveragePolicy?: unknown, targetVersion?: unknown, targetContextRef?: unknown }} [validationInputs]
+ * @property {{ changedPaths?: unknown, evidenceSha?: unknown, policy?: unknown, runId?: unknown, selectedRunId?: unknown }} [evidenceReuse]
+ */
+/**
+ * @typedef {object} FullReleaseValidationEvidenceOptions
+ * @property {unknown} run
+ * @property {FullReleaseValidationManifest} manifest
+ * @property {string} expectedRepository
+ * @property {string | number} expectedRunId
+ * @property {string | number} [expectedRunAttempt]
+ * @property {string} expectedTargetSha
+ * @property {string} [expectedReleaseTag]
+ * @property {string} [expectedTrustedWorkflowFullRef]
+ * @property {string} [expectedTrustedWorkflowSha]
+ * @property {string} [expectedWorkflowBranch]
+ * @property {import("./full-release-publication-contract.mjs").PublicationSelection | (() => import("./full-release-publication-contract.mjs").PublicationSelection)} [expectedPublicationSelection]
+ * @property {{ npmDistTag: string }} [expectedCoreNpmPublication]
+ * @property {(sha: string) => string} [getWorkflowSource]
+ * @property {(sha: string) => boolean} [isTrustedMainAncestor]
+ * @property {(params: { repository: string, runId: string, targetSha: string }) => StrictReleaseEvidence} [validateEvidenceReuseStrictly]
+ */
+
+function normalizeWorkflowPathRef(ref) {
+  if (!ref || ref.startsWith("refs/")) {
+    return ref;
+  }
+  return `refs/heads/${ref}`;
+}
+
+export function normalizeFullReleaseValidationRun(run) {
+  const [workflowPath, workflowQualifiedRef] = String(run.path ?? run.workflowPath ?? "").split(
+    "@",
+    2,
+  );
+  return {
+    databaseId: String(run.id ?? run.databaseId ?? ""),
+    runAttempt: Number(run.run_attempt ?? run.runAttempt ?? run.attempt),
+    workflowName: run.name ?? run.workflowName,
+    workflowPath,
+    workflowQualifiedRef,
+    repository: run.repository?.full_name ?? run.repository,
+    headBranch: run.head_branch ?? run.headBranch,
+    headSha: run.head_sha ?? run.headSha,
+    event: run.event,
+    status: run.status,
+    conclusion: run.conclusion,
+    url: run.html_url ?? run.url,
+  };
+}
+
+export function isShaPinnedReleaseValidationBranch(branch) {
+  return PINNED_BRANCH_PATTERN.test(branch ?? "");
+}
+
+/** @param {FullReleaseValidationEvidenceOptions} options */
+export function validateFullReleaseValidationEvidence({
+  run: rawRun,
+  manifest,
+  expectedRepository,
+  expectedRunId,
+  expectedRunAttempt,
+  expectedTargetSha,
+  expectedReleaseTag,
+  expectedTrustedWorkflowFullRef,
+  expectedTrustedWorkflowSha,
+  expectedWorkflowBranch,
+  expectedPublicationSelection,
+  expectedCoreNpmPublication,
+  getWorkflowSource,
+  isTrustedMainAncestor,
+  validateEvidenceReuseStrictly,
+}) {
+  if (expectedPublicationSelection && expectedCoreNpmPublication) {
+    throw new Error("Publication evidence requires one actual consumption selection.");
+  }
+  const run = normalizeFullReleaseValidationRun(rawRun);
+  const trustedWorkflowFullRef = expectedTrustedWorkflowFullRef ?? "refs/heads/main";
+  const protectedTag = TRUSTED_RELEASE_PUBLISH_TAG_PATTERN.exec(trustedWorkflowFullRef);
+  if (protectedTag) {
+    if (!SHA_PATTERN.test(expectedTrustedWorkflowSha ?? "")) {
+      throw new Error("Protected release-publish evidence requires an exact trusted workflow SHA.");
+    }
+    if (expectedTrustedWorkflowSha.slice(0, 12) !== protectedTag[1]) {
+      throw new Error("Protected release-publish tag does not match its trusted workflow SHA.");
+    }
+  } else if (
+    !trustedWorkflowFullRef.startsWith("refs/heads/") ||
+    trustedWorkflowFullRef.startsWith("refs/heads/release-publish/")
+  ) {
+    throw new Error("Trusted release-publish workflow ref must be an exact protected tag.");
+  }
+  const checks = [
+    ["databaseId", String(expectedRunId)],
+    ["workflowName", FULL_RELEASE_WORKFLOW],
+    ["workflowPath", FULL_RELEASE_WORKFLOW_PATH],
+    ["repository", expectedRepository],
+    ["event", "workflow_dispatch"],
+    ["status", "completed"],
+    ["conclusion", "success"],
+  ];
+  for (const [key, expected] of checks) {
+    if (run[key] !== expected) {
+      throw new Error(
+        `Referenced full release validation run ${expectedRunId} must have ${key}=${expected}, got ${run[key] ?? "<missing>"}.`,
+      );
+    }
+  }
+  if (!Number.isInteger(run.runAttempt) || run.runAttempt < 1) {
+    throw new Error(`Referenced full release validation run ${expectedRunId} has invalid attempt.`);
+  }
+  if (expectedRunAttempt !== undefined && run.runAttempt !== Number(expectedRunAttempt)) {
+    throw new Error("Referenced full release validation attempt differs from the consumer.");
+  }
+  if (!SHA_PATTERN.test(run.headSha ?? "")) {
+    throw new Error(
+      `Referenced full release validation run ${expectedRunId} has invalid head SHA.`,
+    );
+  }
+  const expectedQualifiedRef = `refs/heads/${run.headBranch}`;
+  const workflowQualifiedRef = normalizeWorkflowPathRef(run.workflowQualifiedRef);
+  if (workflowQualifiedRef && workflowQualifiedRef !== expectedQualifiedRef) {
+    throw new Error(
+      `Referenced full release validation run ${expectedRunId} has workflow path ref ${run.workflowQualifiedRef}, expected ${expectedQualifiedRef}.`,
+    );
+  }
+
+  if (manifest.version !== 3 && manifest.version !== 4) {
+    throw new Error(
+      `Full release validation manifest must use version 3 or 4, got ${displayValue(manifest.version)}.`,
+    );
+  }
+  const coveragePolicy = normalizeReleaseCoveragePolicy({
+    ...manifest.validationInputs,
+    candidateVersion: manifest.candidateBinding?.package?.version,
+    releaseProfile: manifest.releaseProfile,
+    rerunGroup: manifest.rerunGroup,
+    runReleaseSoak: manifest.runReleaseSoak,
+  });
+  const coveredReleaseTag =
+    coveragePolicy === "npm-stable-v1"
+      ? resolveReleaseContextIdentity(
+          scalarString(manifest.validationInputs?.targetContextRef) ||
+            scalarString(manifest.targetRef),
+          scalarString(manifest.validationInputs?.targetVersion),
+        )?.releaseTag
+      : `v${scalarString(manifest.validationInputs?.targetVersion)}`;
+  if (
+    coveragePolicy &&
+    (manifest.version !== 4 || !coveredReleaseTag || expectedReleaseTag !== coveredReleaseTag)
+  ) {
+    throw new Error(
+      "Release coverage policy requires version 4 evidence for the exact publication tag.",
+    );
+  }
+  const manifestChecks = [
+    ["workflowName", FULL_RELEASE_WORKFLOW],
+    ["runId", String(expectedRunId)],
+    ["runAttempt", String(run.runAttempt)],
+    ["workflowRef", run.headBranch],
+    ["workflowSha", run.headSha],
+    ["workflowFullRef", expectedQualifiedRef],
+    ["workflowRefType", "branch"],
+    ["targetSha", expectedTargetSha],
+  ];
+  for (const [key, expected] of manifestChecks) {
+    if (scalarString(manifest[key]) !== expected) {
+      throw new Error(
+        `Full release validation manifest ${key} mismatch: expected ${expected}, got ${displayValue(manifest[key])}.`,
+      );
+    }
+  }
+  const workflowSource = getWorkflowSource
+    ? getWorkflowSource(run.headSha)
+    : createReleaseEvidenceClient(expectedRepository).getWorkflowSource(run.headSha);
+  const contract = publicationSourceContract(workflowSource);
+  const registryContract = publicationAdmissionContract(workflowSource);
+  if (manifest.sourceAdmissionContract !== contract) {
+    throw new Error(
+      "Publication evidence differs from its immutable source-admission workflow contract.",
+    );
+  }
+  const sourceAdmission = validatePublicationSourceBinding(manifest, {
+    sourceAdmissionContract: contract,
+    repository: expectedRepository,
+    targetSha: expectedTargetSha,
+    parentRunId: String(expectedRunId),
+  });
+  if (manifest.publicationAdmissionContract !== registryContract) {
+    throw new Error("Publication evidence differs from its immutable registry-admission contract.");
+  }
+  const publicationAdmission = validatePublicationAdmissionBinding(manifest, {
+    publicationAdmissionContract: registryContract,
+  });
+  let strictEvidence;
+  const strict = () => {
+    if (!strictEvidence) {
+      if (typeof validateEvidenceReuseStrictly !== "function") {
+        throw new Error("Publication evidence requires authenticated strict validation.");
+      }
+      strictEvidence = validateEvidenceReuseStrictly({
+        repository: expectedRepository,
+        runId: String(expectedRunId),
+        targetSha: expectedTargetSha,
+      });
+    }
+    return strictEvidence;
+  };
+  if (sourceAdmission) {
+    // Historical recovery must not acquire a new publication-selection contract.
+    const selected =
+      typeof expectedPublicationSelection === "function"
+        ? expectedPublicationSelection()
+        : expectedPublicationSelection;
+    if (
+      sourceAdmission.validationPurpose !== "publish" ||
+      (selected &&
+        publicationSourceJson(sourceAdmission.publicationSelection) !==
+          publicationSourceJson(selected))
+    ) {
+      throw new Error(
+        "New-contract nonpublish or differently selected evidence cannot prepare publication.",
+      );
+    }
+    if (expectedCoreNpmPublication) {
+      const selection = sourceAdmission.publicationSelection;
+      if (
+        Object.keys(expectedCoreNpmPublication).join(",") !== "npmDistTag" ||
+        selection?.publishOpenclawNpm !== true ||
+        selection.npmDistTag !== expectedCoreNpmPublication.npmDistTag ||
+        !sourceAdmission.projection?.packages.some(
+          (entry) =>
+            entry.name === "openclaw" &&
+            entry.version === sourceAdmission.projection.version &&
+            entry.targets.includes("npm"),
+        )
+      ) {
+        throw new Error("Publication evidence does not cover the actual core npm operation.");
+      }
+    }
+  }
+  if (registryContract) {
+    const contextIdentity = sourceAdmission?.projection
+      ? resolveReleaseContextIdentity(
+          sourceAdmission.targetContextRef,
+          sourceAdmission.projection.version,
+        )
+      : null;
+    const sourceReleaseTag =
+      contextIdentity?.releaseTag ??
+      (!manifest.validationInputs?.targetContextRef && sourceAdmission?.projection
+        ? `v${sourceAdmission.projection.version}`
+        : undefined);
+    if (
+      !publicationAdmission ||
+      (!expectedPublicationSelection && !expectedCoreNpmPublication) ||
+      sourceReleaseTag !== expectedReleaseTag
+    ) {
+      throw new Error("B publication evidence requires the actual selection and release tag.");
+    }
+    const authenticated = strict();
+    if (
+      authenticated.valid !== true ||
+      authenticated.current?.runId !== String(expectedRunId) ||
+      authenticated.current?.targetSha !== expectedTargetSha ||
+      authenticated.current?.runAttempt !== run.runAttempt ||
+      authenticated.conclusions?.allRequiredSucceeded !== true ||
+      publicationObservationJson(authenticated.current?.manifest) !==
+        publicationObservationJson(manifest)
+    ) {
+      throw new Error("B publication evidence differs from its authenticated retained manifest.");
+    }
+  }
+
+  const pinnedMatch = PINNED_BRANCH_PATTERN.exec(run.headBranch ?? "");
+  if (!pinnedMatch) {
+    if (protectedTag) {
+      throw new Error(
+        "Protected-tag release evidence must use a canonical release-ci producer branch.",
+      );
+    }
+    if (run.headBranch?.startsWith("release-ci/")) {
+      throw new Error(
+        `Referenced full release validation run ${expectedRunId} has untrusted head branch ${run.headBranch}.`,
+      );
+    }
+    const directBranches = new Set(["main", expectedWorkflowBranch].filter(Boolean));
+    if (directBranches.has(run.headBranch)) {
+      if (run.headBranch === "main" && !isTrustedMainAncestor?.(run.headSha)) {
+        throw new Error(
+          `Direct main validation workflow ${run.headSha} is not reachable from current main.`,
+        );
+      }
+      return { run, source: "direct", coveragePolicy };
+    }
+    throw new Error(
+      `Referenced full release validation run ${expectedRunId} has untrusted head branch ${run.headBranch ?? "<missing>"}.`,
+    );
+  }
+  if (pinnedMatch[1] !== run.headSha.slice(0, 12)) {
+    throw new Error(
+      `SHA-pinned validation branch ${run.headBranch} does not match workflow SHA ${run.headSha}.`,
+    );
+  }
+  if (manifest.targetRef !== expectedTargetSha) {
+    throw new Error(
+      `SHA-pinned validation target ref mismatch: expected ${expectedTargetSha}, got ${displayValue(manifest.targetRef)}.`,
+    );
+  }
+  // The protected tag authenticates the current publisher. An older validation
+  // producer remains trusted only through its independent current-main lineage.
+  const historicalProtectedProducer = protectedTag && run.headSha !== expectedTrustedWorkflowSha;
+  if ((historicalProtectedProducer || !protectedTag) && !isTrustedMainAncestor?.(run.headSha)) {
+    const subject = protectedTag
+      ? "Protected-tag release evidence workflow SHA"
+      : "SHA-pinned validation workflow";
+    throw new Error(`${subject} ${run.headSha} is not reachable from current main.`);
+  }
+  const source = protectedTag
+    ? historicalProtectedProducer
+      ? "sha-pinned-protected-tag-main-ancestor"
+      : "sha-pinned-protected-tag"
+    : "sha-pinned-main";
+  if (Object.hasOwn(manifest, "evidenceReuse")) {
+    const reuse = manifest.evidenceReuse;
+    const exactTarget =
+      reuse?.policy === EXACT_TARGET_EVIDENCE_REUSE_POLICY &&
+      reuse.evidenceSha === expectedTargetSha &&
+      Array.isArray(reuse.changedPaths) &&
+      reuse.changedPaths.length === 0;
+    const changelogOnly =
+      reuse?.policy === CHANGELOG_ONLY_EVIDENCE_REUSE_POLICY &&
+      reuse.evidenceSha !== expectedTargetSha &&
+      Array.isArray(reuse.changedPaths) &&
+      reuse.changedPaths.length === 1 &&
+      reuse.changedPaths[0] === "CHANGELOG.md";
+    const splitChangelog =
+      reuse?.policy === SPLIT_CHANGELOG_EVIDENCE_REUSE_POLICY &&
+      reuse.evidenceSha !== expectedTargetSha &&
+      isSplitChangelogEvidenceDelta(
+        reuse.changedPaths,
+        manifest.candidateBinding?.package?.version ?? manifest.validationInputs?.targetVersion,
+      );
+    if (
+      !reuse ||
+      typeof reuse !== "object" ||
+      Array.isArray(reuse) ||
+      (!exactTarget && !changelogOnly && !splitChangelog) ||
+      !/^[1-9][0-9]*$/u.test(scalarString(reuse.runId)) ||
+      !/^[1-9][0-9]*$/u.test(scalarString(reuse.selectedRunId))
+    ) {
+      throw new Error("SHA-pinned validation evidence reuse is invalid.");
+    }
+    if (typeof validateEvidenceReuseStrictly !== "function") {
+      throw new Error("SHA-pinned validation evidence reuse requires strict chain validation.");
+    }
+    const reusedEvidence = strict();
+    if (
+      reusedEvidence?.schema !== `openclaw.release-validation-evidence/v${manifest.version}` ||
+      reusedEvidence.valid !== true ||
+      scalarString(reusedEvidence.current?.runId) !== String(expectedRunId) ||
+      reusedEvidence.current?.targetSha !== expectedTargetSha ||
+      reusedEvidence.root?.targetSha !== reuse.evidenceSha ||
+      reusedEvidence.evidenceReuse?.evidenceSha !== reuse.evidenceSha ||
+      reusedEvidence.evidenceReuse?.policy !== reuse.policy ||
+      JSON.stringify(reusedEvidence.evidenceReuse?.changedPaths) !==
+        JSON.stringify(reuse.changedPaths) ||
+      scalarString(reusedEvidence.evidenceReuse?.rootRunId) !== scalarString(reuse.runId) ||
+      scalarString(reusedEvidence.evidenceReuse?.selectedRunId) !==
+        scalarString(reuse.selectedRunId) ||
+      reusedEvidence.conclusions?.allRequiredSucceeded !== true
+    ) {
+      throw new Error("SHA-pinned validation evidence reuse failed strict chain validation.");
+    }
+  }
+  return { run, source, coveragePolicy };
+}
+
+/**
+ * Authenticate once, then adapt that same current manifest to the real consumer.
+ * Historical producers retain their exact-source validation without a registry sweep.
+ * @param {Omit<FullReleaseValidationEvidenceOptions, "manifest" | "getWorkflowSource" | "validateEvidenceReuseStrictly"> & {
+ *   manifest?: FullReleaseValidationManifest,
+ *   manifestPath?: string,
+ *   verifierSourceSha?: string,
+ *   verifierSourceContent?: string | Uint8Array,
+ * }} options
+ * @param {ReturnType<typeof createReleaseEvidenceClient>} [client]
+ */
+export async function authenticateFullReleaseValidationEvidence(options, client) {
+  const evidenceClient = client ?? createReleaseEvidenceClient(options.expectedRepository);
+  const run = normalizeFullReleaseValidationRun(options.run);
+  const workflowSources = new Map();
+  const getWorkflowSource = (sha) => {
+    if (!workflowSources.has(sha)) {
+      workflowSources.set(sha, evidenceClient.getWorkflowSource(sha));
+    }
+    return workflowSources.get(sha);
+  };
+  const evidence = await validateReleaseRunEvidence(
+    {
+      repository: options.expectedRepository,
+      runId: String(options.expectedRunId),
+      manifestPath: options.manifestPath,
+      trustedWorkflowFullRef: options.expectedTrustedWorkflowFullRef,
+      trustedWorkflowRef:
+        options.expectedTrustedWorkflowFullRef?.replace(/^refs\/(?:heads|tags)\//u, "") ?? "main",
+      trustedWorkflowSha: options.expectedTrustedWorkflowSha,
+      verifierSourceSha: options.verifierSourceSha,
+      verifierSourceContent: options.verifierSourceContent,
+    },
+    { ...evidenceClient, getWorkflowSource },
+  );
+  if (!evidence.conclusions.allRequiredSucceeded) {
+    throw new Error("Required release validation evidence did not pass.");
+  }
+  if (evidence.current.runAttempt !== run.runAttempt) {
+    throw new Error("Authenticated publication evidence attempt differs from the consumer.");
+  }
+  const manifest = options.manifest ?? evidence.current.manifest;
+  if (
+    publicationObservationJson(manifest) !== publicationObservationJson(evidence.current.manifest)
+  ) {
+    throw new Error("Supplied publication evidence differs from the authenticated manifest.");
+  }
+  const result = validateFullReleaseValidationEvidence({
+    ...options,
+    manifest,
+    getWorkflowSource,
+    validateEvidenceReuseStrictly: () => evidence,
+  });
+  return { ...result, evidence, publicationAdmission: manifest.publicationAdmission ?? null };
+}
+
+function gitIsAncestor(ancestor, target) {
+  const result = spawnSync(
+    "git",
+    ["merge-base", "--is-ancestor", `${ancestor}^{commit}`, `${target}^{commit}`],
+    { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] },
+  );
+  if (result.status === 0) {
+    return true;
+  }
+  if (result.status === 1) {
+    return false;
+  }
+  throw new Error(
+    `Could not validate trusted workflow ancestry: ${result.stderr?.trim() || result.signal || result.status}.`,
+  );
+}
+
+async function main() {
+  const manifestPath = process.env.MANIFEST_FILE ?? "";
+  if (!manifestPath) {
+    throw new Error("MANIFEST_FILE is required.");
+  }
+  const run = JSON.parse(readFileSync(0, "utf8"));
+  const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+  const trustedMainRef = process.env.TRUSTED_MAIN_REF ?? "refs/remotes/origin/main";
+  const consumer = process.env.PUBLICATION_CONSUMER ?? "";
+  const coreProjection = consumer === "core-npm" || consumer === "docker-only";
+  if (consumer && !["publisher", "core-npm", "docker-only"].includes(consumer)) {
+    throw new Error("Unknown publication evidence consumer.");
+  }
+  if (
+    consumer === "docker-only" &&
+    (process.env.PUBLISH_DOCKER_ONLY !== "true" || process.env.PUBLISH_OPENCLAW_NPM !== "false")
+  ) {
+    throw new Error("Docker-only evidence consumption requires its actual recovery operands.");
+  }
+  if (consumer === "publisher" && process.env.PUBLISH_DOCKER_ONLY === "true") {
+    throw new Error("Contradictory Docker-only publication operands.");
+  }
+  const result = await authenticateFullReleaseValidationEvidence({
+    run,
+    manifest,
+    expectedRepository: process.env.GITHUB_REPOSITORY,
+    expectedRunId: process.env.FULL_RELEASE_VALIDATION_RUN_ID,
+    expectedRunAttempt: process.env.FULL_RELEASE_VALIDATION_RUN_ATTEMPT,
+    expectedTargetSha: process.env.EXPECTED_SHA,
+    expectedReleaseTag: process.env.RELEASE_TAG,
+    expectedTrustedWorkflowFullRef: process.env.TRUSTED_WORKFLOW_FULL_REF,
+    expectedTrustedWorkflowSha: process.env.TRUSTED_WORKFLOW_SHA,
+    expectedWorkflowBranch: process.env.EXPECTED_WORKFLOW_BRANCH,
+    expectedCoreNpmPublication: coreProjection
+      ? { npmDistTag: process.env.RELEASE_NPM_DIST_TAG ?? "" }
+      : undefined,
+    expectedPublicationSelection:
+      consumer === "publisher"
+        ? () =>
+            normalizePublicationIntent(
+              "publish",
+              JSON.stringify({
+                route: process.env.PREPARED_PLUGINS?.trim()
+                  ? "prepared"
+                  : process.env.RELEASE_NPM_DIST_TAG === "alpha"
+                    ? "alpha"
+                    : process.env.RELEASE_NPM_DIST_TAG === "extended-stable"
+                      ? "extended-stable"
+                      : "normal",
+                npmDistTag: process.env.RELEASE_NPM_DIST_TAG,
+                publishOpenclawNpm: process.env.PUBLISH_OPENCLAW_NPM === "true",
+                pluginPublishScope: process.env.PLUGIN_PUBLISH_SCOPE,
+                plugins: (process.env.RELEASE_PLUGINS ?? "").split(/[\s,]+/u).filter(Boolean),
+                ...(process.env.WINDOWS_NODE_TAG
+                  ? {
+                      windowsNodeTag: process.env.WINDOWS_NODE_TAG,
+                      windowsNodeInstallerDigests: JSON.parse(
+                        process.env.WINDOWS_NODE_INSTALLER_DIGESTS ?? "",
+                      ),
+                    }
+                  : {}),
+              }),
+            ).publicationSelection
+        : undefined,
+    manifestPath,
+    verifierSourceSha: process.env.WORKFLOW_SHA ?? process.env.GITHUB_SHA,
+    verifierSourceContent: readFileSync(
+      process.env.STRICT_VALIDATOR_FILE ??
+        fileURLToPath(new URL("./release-ci-summary.mjs", import.meta.url)),
+    ),
+    isTrustedMainAncestor: (sha) => gitIsAncestor(sha, trustedMainRef),
+  });
+  console.log(
+    `Using full release validation run ${result.run.databaseId} (${result.source}): ${result.run.url}`,
+  );
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+  try {
+    await main();
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+  }
+}
diff --git a/scripts/vercel-container-registry-publish.d.mts b/scripts/vercel-container-registry-publish.d.mts
new file mode 100644
index 0000000000000000000000000000000000000000..976a1cfc4c3b0319f0c479b8b8fe5452e8fb4a48
--- /dev/null
+++ b/scripts/vercel-container-registry-publish.d.mts
@@ -0,0 +1,44 @@
+export type VercelContainerRegistryPublishPlan = {
+  channel: "stable" | "extended-stable" | "beta";
+  copies: Array<{ sourceRef: string; targetRef: string; targetTag: string }>;
+  readinessTags: string[];
+  sourceImage: string;
+  targetImage: string;
+  version: string;
+};
+
+export function createVercelContainerRegistryPublishPlan(params: {
+  includeBrowser: boolean;
+  version: string;
+  sourceImage: string;
+  targetImage: string;
+}): VercelContainerRegistryPublishPlan;
+
+export function publishVercelContainerRegistryImages(
+  params: {
+    includeBrowser: boolean;
+    version: string;
+    sourceRefs: string[];
+    targetImage: string;
+  },
+  options?: {
+    execFileSyncImpl?: (command: string, args: string[], options: object) => unknown;
+    log?: (message: string) => void;
+  },
+): VercelContainerRegistryPublishPlan;
+
+export function promoteVercelContainerRegistryAliases(
+  params: {
+    includeBrowser: boolean;
+    version: string;
+    targetImage: string;
+  },
+  options?: {
+    execFileSyncImpl?: (command: string, args: string[], options: object) => unknown;
+    log?: (message: string) => void;
+  },
+): {
+  channel: "stable" | "extended-stable" | "beta";
+  targetImage: string;
+  version: string;
+};
diff --git a/scripts/verify-clawhub-published-artifact.mjs b/scripts/verify-clawhub-published-artifact.mjs
new file mode 100644
index 0000000000000000000000000000000000000000..287912ecea6df54bc58ee0876b3017c1b819cb70
--- /dev/null
+++ b/scripts/verify-clawhub-published-artifact.mjs
@@ -0,0 +1,562 @@
+#!/usr/bin/env node
+
+import { createHash } from "node:crypto";
+import { readdirSync } from "node:fs";
+import { mkdir, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { pathToFileURL } from "node:url";
+import { readClawHubBootstrapManifest } from "./lib/clawhub-bootstrap-artifact.mjs";
+import { readBoundedRegularFile } from "./plugin-publication-artifact.mjs";
+
+const DEFAULT_ATTEMPTS = 12;
+const DEFAULT_DELAY_MS = 5_000;
+const DEFAULT_ATTEMPT_TIMEOUT_MS = 120_000;
+const MAX_ATTEMPTS = 12;
+const MAX_DELAY_MS = 60_000;
+const MAX_ARTIFACT_BYTES = 130 * 1024 * 1024;
+const MAX_JSON_BYTES = 1024 * 1024;
+const PACKAGE_NAME_PATTERN = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/u;
+const PACKAGE_VERSION_PATTERN =
+  /^[0-9]{4}\.[1-9][0-9]*\.[1-9][0-9]*(?:-(?:alpha|beta)\.[1-9][0-9]*|-[1-9][0-9]*)?$/u;
+const PUBLISH_TAG_PATTERN = /^(?:alpha|beta|latest)$/u;
+const SHA256_PATTERN = /^[a-f0-9]{64}$/u;
+const SHA512_INTEGRITY_PATTERN = /^sha512-[A-Za-z0-9+/]{86}==$/u;
+const TOOLCHAIN_VERSION_PATTERN = /^(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)$/u;
+
+class PermanentReadbackError extends Error {}
+
+class RetryableReadbackError extends Error {
+  constructor(message, requestedDelayMs) {
+    super(message);
+    this.retryAfterMs = requestedDelayMs;
+  }
+}
+
+function fail(message) {
+  throw new Error(message);
+}
+
+function positiveInteger(value, fallback, label, maximum = Number.MAX_SAFE_INTEGER) {
+  const raw = value === undefined ? fallback : value;
+  const text = raw === undefined ? "" : String(raw);
+  if (!/^[1-9][0-9]*$/u.test(text)) {
+    fail(`${label} must be an integer from 1 through ${maximum}.`);
+  }
+  const parsed = Number(text);
+  if (!Number.isSafeInteger(parsed) || parsed <= 0 || parsed > maximum) {
+    fail(`${label} must be an integer from 1 through ${maximum}.`);
+  }
+  return parsed;
+}
+
+function requiredPattern(value, pattern, label) {
+  if (typeof value !== "string" || !pattern.test(value)) {
+    fail(`${label} is invalid.`);
+  }
+  return value;
+}
+
+function requiredString(value, label) {
+  if (typeof value !== "string" || value.trim() !== value || value.length === 0) {
+    fail(`${label} is invalid.`);
+  }
+  return value;
+}
+
+function retryAfterMs(headers) {
+  const retryAfter = headers?.get("retry-after")?.trim();
+  if (!retryAfter) {
+    return undefined;
+  }
+  const seconds = Number(retryAfter);
+  if (Number.isFinite(seconds) && seconds >= 0) {
+    return Math.min(MAX_DELAY_MS, Math.max(1, Math.round(seconds * 1_000)));
+  }
+  const dateMs = Date.parse(retryAfter);
+  if (Number.isFinite(dateMs)) {
+    return Math.min(MAX_DELAY_MS, Math.max(1, dateMs - Date.now()));
+  }
+  return undefined;
+}
+
+function retryableStatus(status) {
+  return status === 404 || status === 408 || status === 425 || status === 429 || status >= 500;
+}
+
+async function cancelResponse(response) {
+  await response.body?.cancel().catch(() => undefined);
+}
+
+async function readBoundedBytes(response, label, maximumBytes) {
+  const contentLength = response.headers.get("content-length");
+  if (contentLength !== null) {
+    const parsedLength = Number(contentLength);
+    if (Number.isFinite(parsedLength) && parsedLength > maximumBytes) {
+      await cancelResponse(response);
+      throw new PermanentReadbackError(`${label} exceeded ${maximumBytes} bytes.`);
+    }
+  }
+  if (!response.body) {
+    throw new RetryableReadbackError(`${label} returned no response body.`);
+  }
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) {
+        break;
+      }
+      total += value.byteLength;
+      if (total > maximumBytes) {
+        await reader.cancel();
+        throw new PermanentReadbackError(`${label} exceeded ${maximumBytes} bytes.`);
+      }
+      chunks.push(value);
+    }
+  } catch (error) {
+    await reader.cancel().catch(() => undefined);
+    throw error;
+  }
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return bytes;
+}
+
+async function fetchResponse(url, options, context) {
+  let response;
+  try {
+    response = await context.fetchImpl(url, {
+      ...options,
+      redirect: "follow",
+      signal: context.signal,
+    });
+  } catch (error) {
+    throw new RetryableReadbackError(
+      `${url} request failed: ${error instanceof Error ? error.message : String(error)}.`,
+    );
+  }
+  if (retryableStatus(response.status)) {
+    const delay = retryAfterMs(response.headers);
+    await cancelResponse(response);
+    throw new RetryableReadbackError(`${url} returned HTTP ${response.status}.`, delay);
+  }
+  if (!response.ok) {
+    await cancelResponse(response);
+    throw new PermanentReadbackError(`${url} returned HTTP ${response.status}.`);
+  }
+  return response;
+}
+
+async function fetchJson(url, context) {
+  const response = await fetchResponse(url, { headers: { accept: "application/json" } }, context);
+  let bytes;
+  try {
+    bytes = await readBoundedBytes(response, url, MAX_JSON_BYTES);
+  } catch (error) {
+    if (error instanceof PermanentReadbackError) {
+      throw error;
+    }
+    throw new RetryableReadbackError(
+      `${url} body read failed: ${error instanceof Error ? error.message : String(error)}.`,
+    );
+  }
+  try {
+    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+  } catch (error) {
+    throw new RetryableReadbackError(
+      `${url} returned invalid JSON: ${error instanceof Error ? error.message : String(error)}.`,
+    );
+  }
+}
+
+async function fetchArtifact(url, context) {
+  const response = await fetchResponse(url, {}, context);
+  let bytes;
+  try {
+    bytes = await readBoundedBytes(response, url, MAX_ARTIFACT_BYTES);
+  } catch (error) {
+    if (error instanceof PermanentReadbackError) {
+      throw error;
+    }
+    throw new RetryableReadbackError(
+      `${url} body read failed: ${error instanceof Error ? error.message : String(error)}.`,
+    );
+  }
+  return { bytes, headers: response.headers };
+}
+
+function requireObject(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new RetryableReadbackError(`${label} is missing or invalid.`);
+  }
+  return value;
+}
+
+function requireExact(value, expected, label) {
+  if (value !== expected) {
+    throw new RetryableReadbackError(
+      `${label} mismatch: expected ${String(expected)}, found ${String(value)}.`,
+    );
+  }
+}
+
+function artifactIdentity(bytes) {
+  return {
+    sha256: createHash("sha256").update(bytes).digest("hex"),
+    size: bytes.byteLength,
+    npmIntegrity: `sha512-${createHash("sha512").update(bytes).digest("base64")}`,
+    npmShasum: createHash("sha1").update(bytes).digest("hex"),
+  };
+}
+
+function readExpectedPackageArtifact(directory) {
+  const artifactDirectory = requiredString(directory, "expectedArtifactDir");
+  const entries = readdirSync(artifactDirectory, { withFileTypes: true });
+  if (entries.length !== 1 || !entries[0].isFile() || !entries[0].name.endsWith(".tgz")) {
+    fail("Expected artifact directory must contain exactly one root .tgz regular file.");
+  }
+  const fileName = entries[0].name;
+  const bytes = readBoundedRegularFile(join(artifactDirectory, fileName), {
+    label: "Expected ClawHub package artifact",
+    maxBytes: MAX_ARTIFACT_BYTES,
+  });
+  return { bytes, fileName };
+}
+
+function validateArtifactMetadata(entry, metadata, identity, headers) {
+  const packageDetail = requireObject(metadata.package, `${entry.packageName} artifact package`);
+  const artifact = requireObject(metadata.artifact, `${entry.packageName} artifact metadata`);
+  requireExact(packageDetail.name, entry.packageName, `${entry.packageName} artifact package name`);
+  requireExact(metadata.version, entry.version, `${entry.packageName} artifact version`);
+  requireExact(artifact.kind, "npm-pack", `${entry.packageName} artifact kind`);
+  requireExact(artifact.sha256, identity.sha256, `${entry.packageName} artifact sha256`);
+  requireExact(artifact.size, identity.size, `${entry.packageName} artifact size`);
+  requireExact(
+    artifact.npmIntegrity,
+    identity.npmIntegrity,
+    `${entry.packageName} artifact npmIntegrity`,
+  );
+  requireExact(artifact.npmShasum, identity.npmShasum, `${entry.packageName} artifact npmShasum`);
+
+  const headerSha256 = headers.get("x-clawhub-artifact-sha256");
+  const headerIntegrity = headers.get("x-clawhub-npm-integrity");
+  const headerShasum = headers.get("x-clawhub-npm-shasum");
+  requireExact(headerSha256, identity.sha256, `${entry.packageName} download sha256 header`);
+  requireExact(
+    headerIntegrity,
+    identity.npmIntegrity,
+    `${entry.packageName} download npm integrity header`,
+  );
+  requireExact(headerShasum, identity.npmShasum, `${entry.packageName} download shasum header`);
+  return {
+    kind: artifact.kind,
+    sha256: artifact.sha256,
+    size: artifact.size,
+    npmIntegrity: artifact.npmIntegrity,
+    npmShasum: artifact.npmShasum,
+    packageName: packageDetail.name,
+    version: metadata.version,
+  };
+}
+
+async function verifyEntryOnce(entry, options, context) {
+  const registry = options.registry;
+  const encodedName = encodeURIComponent(entry.packageName);
+  const encodedVersion = encodeURIComponent(entry.version);
+  const detailUrl = `${registry}/api/v1/packages/${encodedName}`;
+  const versionUrl = `${detailUrl}/versions/${encodedVersion}`;
+  const metadataUrl = `${versionUrl}/artifact`;
+  const artifactUrl = `${metadataUrl}/download`;
+
+  const detail = await fetchJson(detailUrl, context);
+  requireExact(
+    detail?.package?.tags?.[entry.publishTag],
+    entry.version,
+    `${entry.packageName} ClawHub tag ${entry.publishTag}`,
+  );
+  if (options.mode === "postpublish") {
+    const trustedPublisher = (await fetchJson(`${detailUrl}/trusted-publisher`, context))
+      ?.trustedPublisher;
+    requireExact(
+      trustedPublisher?.provider,
+      "github-actions",
+      `${entry.packageName} trusted publisher provider`,
+    );
+    requireExact(
+      trustedPublisher?.repository,
+      "openclaw/openclaw",
+      `${entry.packageName} trusted publisher repository`,
+    );
+    requireExact(
+      trustedPublisher?.workflowFilename,
+      "plugin-clawhub-release.yml",
+      `${entry.packageName} trusted publisher workflow`,
+    );
+    requireExact(
+      trustedPublisher?.environment ?? null,
+      null,
+      `${entry.packageName} trusted publisher environment`,
+    );
+  }
+
+  const metadata = await fetchJson(metadataUrl, context);
+  const { bytes, headers } = await fetchArtifact(artifactUrl, context);
+  const identity = artifactIdentity(bytes);
+  requireExact(identity.sha256, entry.sha256, `${entry.packageName} registry artifact sha256`);
+  requireExact(identity.size, entry.size, `${entry.packageName} registry artifact size`);
+  const artifactMetadata = validateArtifactMetadata(entry, metadata, identity, headers);
+
+  return {
+    packageName: entry.packageName,
+    version: entry.version,
+    publishTag: entry.publishTag,
+    bootstrapMode: entry.bootstrapMode,
+    expectedSha256: entry.sha256,
+    expectedSize: entry.size,
+    registrySha256: identity.sha256,
+    registrySize: identity.size,
+    npmIntegrity: identity.npmIntegrity,
+    npmShasum: identity.npmShasum,
+    artifactMetadata,
+  };
+}
+
+async function runBoundedRetry(label, operation, retryOptions = {}) {
+  const attempts = positiveInteger(
+    retryOptions.attempts,
+    DEFAULT_ATTEMPTS,
+    "attempts",
+    MAX_ATTEMPTS,
+  );
+  const delayMs = positiveInteger(retryOptions.delayMs, DEFAULT_DELAY_MS, "delayMs", MAX_DELAY_MS);
+  const timeoutMs = positiveInteger(
+    retryOptions.timeoutMs,
+    DEFAULT_ATTEMPT_TIMEOUT_MS,
+    "timeoutMs",
+  );
+  const sleep =
+    retryOptions.sleep ??
+    ((milliseconds) =>
+      new Promise((resolveDelay) => {
+        setTimeout(resolveDelay, milliseconds);
+      }));
+  const fetchImpl = retryOptions.fetchImpl ?? fetch;
+  let lastError;
+
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    const signal = AbortSignal.timeout(timeoutMs);
+    try {
+      return await operation({ fetchImpl, signal });
+    } catch (error) {
+      if (error instanceof PermanentReadbackError) {
+        throw error;
+      }
+      lastError = error;
+      if (attempt < attempts) {
+        const requestedDelay =
+          error instanceof RetryableReadbackError ? error.retryAfterMs : undefined;
+        await sleep(requestedDelay ?? Math.min(MAX_DELAY_MS, delayMs * attempt));
+      }
+    }
+  }
+
+  const detail = lastError instanceof Error ? lastError.message : String(lastError);
+  throw new Error(`${label} did not stabilize after ${attempts} attempts; last failure ${detail}`);
+}
+
+export async function verifyPublishedClawHubArtifacts(options) {
+  const registry = String(options.registry ?? "https://clawhub.ai").replace(/\/+$/u, "");
+  const manifest = readClawHubBootstrapManifest(options.manifestPath);
+  const expectedToolchain = {
+    clawhubToolchainIntegrity: requiredPattern(
+      options.clawhubToolchainIntegrity,
+      SHA512_INTEGRITY_PATTERN,
+      "clawhubToolchainIntegrity",
+    ),
+    clawhubToolchainSha256: requiredPattern(
+      options.clawhubToolchainSha256,
+      SHA256_PATTERN,
+      "clawhubToolchainSha256",
+    ),
+    clawhubToolchainVersion: requiredPattern(
+      options.clawhubToolchainVersion,
+      TOOLCHAIN_VERSION_PATTERN,
+      "clawhubToolchainVersion",
+    ),
+  };
+  for (const [key, expected] of Object.entries(expectedToolchain)) {
+    if (manifest[key] !== expected) {
+      fail(`Validated ClawHub bootstrap manifest ${key} mismatch.`);
+    }
+  }
+  const mode = options.mode ?? "postpublish";
+  if (mode !== "postpublish" && mode !== "configure-only-preflight") {
+    fail(`Unsupported ClawHub artifact verification mode: ${String(mode)}.`);
+  }
+  const producerRunAttempt = positiveInteger(manifest.runAttempt, undefined, "manifest runAttempt");
+  const terminalRunAttempt = positiveInteger(
+    options.terminalRunAttempt,
+    undefined,
+    "terminalRunAttempt",
+  );
+  if (terminalRunAttempt < producerRunAttempt) {
+    fail("terminalRunAttempt must be greater than or equal to the producer run attempt.");
+  }
+  const artifactId = String(positiveInteger(options.artifactId, undefined, "artifactId"));
+  const artifactDigest = requiredPattern(options.artifactDigest, SHA256_PATTERN, "artifactDigest");
+
+  const entries =
+    mode === "configure-only-preflight"
+      ? manifest.entries.filter((entry) => entry.bootstrapMode === "configure-only")
+      : manifest.entries;
+  const results = [];
+  for (const entry of entries) {
+    results.push(
+      await runBoundedRetry(
+        `${entry.packageName}@${entry.version} ClawHub artifact`,
+        (context) => verifyEntryOnce(entry, { registry, mode }, context),
+        options.retryOptions,
+      ),
+    );
+  }
+  return {
+    schemaVersion: 2,
+    repository: manifest.repository,
+    targetSha: manifest.targetSha,
+    workflowSha: manifest.workflowSha,
+    runId: manifest.runId,
+    producerRunAttempt: String(producerRunAttempt),
+    terminalRunAttempt: String(terminalRunAttempt),
+    artifactName: manifest.artifactName,
+    artifactId,
+    artifactDigest,
+    clawhubToolchainIntegrity: manifest.clawhubToolchainIntegrity,
+    clawhubToolchainSha256: manifest.clawhubToolchainSha256,
+    clawhubToolchainVersion: manifest.clawhubToolchainVersion,
+    requestedPlugins: manifest.requestedPlugins,
+    verificationMode: mode,
+    packages: results,
+  };
+}
+
+export async function verifyPublishedClawHubPackage(options) {
+  const registry = String(options.registry ?? "https://clawhub.ai").replace(/\/+$/u, "");
+  const packageName = requiredPattern(options.packageName, PACKAGE_NAME_PATTERN, "packageName");
+  const version = requiredPattern(
+    options.packageVersion,
+    PACKAGE_VERSION_PATTERN,
+    "packageVersion",
+  );
+  const publishTag = requiredPattern(options.publishTag, PUBLISH_TAG_PATTERN, "publishTag");
+  const { bytes, fileName } = readExpectedPackageArtifact(options.expectedArtifactDir);
+  const expected = artifactIdentity(bytes);
+  const entry = {
+    bootstrapMode: null,
+    packageName,
+    publishTag,
+    sha256: expected.sha256,
+    size: expected.size,
+    version,
+  };
+  const result = await runBoundedRetry(
+    `${packageName}@${version} ClawHub artifact`,
+    (context) => verifyEntryOnce(entry, { registry, mode: "postpublish" }, context),
+    options.retryOptions,
+  );
+  return {
+    schemaVersion: 1,
+    // Registry bytes and current publisher configuration do not attest the
+    // actor or credential that originally published this version.
+    verificationMode: "artifact-postpublish",
+    publicationAuthentication: "not-verified",
+    expectedArtifact: {
+      fileName,
+      ...expected,
+    },
+    package: result,
+  };
+}
+
+function parseArgs(argv) {
+  const result = {};
+  for (let index = 0; index < argv.length; index += 2) {
+    const key = argv[index];
+    const value = argv[index + 1];
+    if (!key?.startsWith("--") || value === undefined) {
+      fail(`Invalid argument: ${String(key)}`);
+    }
+    result[key.slice(2).replaceAll("-", "_")] = value;
+  }
+  return result;
+}
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  const retryOptions = {
+    attempts: positiveInteger(
+      process.env.OPENCLAW_CLAWHUB_VERIFY_ATTEMPTS,
+      DEFAULT_ATTEMPTS,
+      "OPENCLAW_CLAWHUB_VERIFY_ATTEMPTS",
+      MAX_ATTEMPTS,
+    ),
+    delayMs: positiveInteger(
+      process.env.OPENCLAW_CLAWHUB_VERIFY_DELAY_MS,
+      DEFAULT_DELAY_MS,
+      "OPENCLAW_CLAWHUB_VERIFY_DELAY_MS",
+      MAX_DELAY_MS,
+    ),
+    timeoutMs: positiveInteger(
+      process.env.OPENCLAW_CLAWHUB_VERIFY_ATTEMPT_TIMEOUT_MS,
+      DEFAULT_ATTEMPT_TIMEOUT_MS,
+      "OPENCLAW_CLAWHUB_VERIFY_ATTEMPT_TIMEOUT_MS",
+    ),
+  };
+  const directMode = [
+    args.expected_artifact_dir,
+    args.package_name,
+    args.package_version,
+    args.publish_tag,
+  ].some((value) => value !== undefined);
+  if (directMode && args.manifest !== undefined) {
+    fail("Direct package verification and bootstrap manifest verification are mutually exclusive.");
+  }
+  if (!directMode && args.manifest === undefined) {
+    fail("Expected --manifest or --expected-artifact-dir.");
+  }
+  const evidence = directMode
+    ? await verifyPublishedClawHubPackage({
+        expectedArtifactDir: args.expected_artifact_dir,
+        packageName: args.package_name,
+        packageVersion: args.package_version,
+        publishTag: args.publish_tag,
+        registry: args.registry,
+        retryOptions,
+      })
+    : await verifyPublishedClawHubArtifacts({
+        registry: args.registry,
+        manifestPath: args.manifest,
+        artifactId: args.artifact_id,
+        artifactDigest: args.artifact_digest,
+        clawhubToolchainIntegrity: args.clawhub_toolchain_integrity,
+        clawhubToolchainSha256: args.clawhub_toolchain_sha256,
+        clawhubToolchainVersion: args.clawhub_toolchain_version,
+        mode: args.mode,
+        terminalRunAttempt: args.terminal_run_attempt,
+        retryOptions,
+      });
+  if (args.output) {
+    await mkdir(dirname(args.output), { recursive: true });
+    await writeFile(args.output, `${JSON.stringify(evidence, null, 2)}\n`, "utf8");
+  }
+  process.stdout.write(`${JSON.stringify(evidence, null, 2)}\n`);
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+  await main();
+}
diff --git a/scripts/verify-mac-node-worker.mjs b/scripts/verify-mac-node-worker.mjs
new file mode 100644
index 0000000000000000000000000000000000000000..06c7127fd0e1a52599bb1e418a8b77125f80e72d
--- /dev/null
+++ b/scripts/verify-mac-node-worker.mjs
@@ -0,0 +1,199 @@
+#!/usr/bin/env node
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+// Package proof: relocation, native load dependencies, provenance, and actual
+// JSONL worker readiness. Never admits or opens the operator's live state.
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import { createRequire } from "node:module";
+import os from "node:os";
+import path from "node:path";
+import { createInterface } from "node:readline";
+import { DatabaseSync } from "node:sqlite";
+import { fileURLToPath } from "node:url";
+import {
+  seedMacNodeWorkerProofState,
+  readMacNodeWorkerProofRows,
+} from "./lib/mac-node-worker-proof-state.mjs";
+import { auditMacWorkerPortability } from "./lib/mac-worker-portability.mjs";
+import { runManagedCommand, terminateManagedChild } from "./lib/managed-child-process.mts";
+
+const [runtimeArg, expectedInfoPath] = process.argv.slice(2);
+if (!runtimeArg || !expectedInfoPath) {
+  throw new Error("Usage: verify-mac-node-worker.mjs <runtime> <expected-build-info.json>");
+}
+const runtime = fs.realpathSync(runtimeArg);
+const node = path.join(runtime, "bin/node");
+const packageRoot = path.join(runtime, "lib/node_modules/openclaw");
+const expected = JSON.parse(fs.readFileSync(expectedInfoPath, "utf8"));
+const actual = JSON.parse(fs.readFileSync(path.join(packageRoot, "dist/build-info.json"), "utf8"));
+for (const key of ["version", "commit", "builtAt", "buildId"]) {
+  if (!expected[key] || expected[key] !== actual[key]) {
+    throw new Error(`Private worker build mismatch: ${key}`);
+  }
+}
+if (fs.realpathSync(process.execPath) !== node) {
+  throw new Error("Worker proof must execute the bundled Node for the requested architecture");
+}
+
+const nativeFiles = auditMacWorkerPortability(runtime, node);
+
+const home = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-worker-proof-")));
+try {
+  // Ready manifests do not load lazy native capabilities. Exercise their real
+  // package loaders so omitted optional packages and wrong slices fail staging.
+  const require = createRequire(path.join(packageRoot, "package.json"));
+  // Keep required native mode and bundled module identity in a fresh process;
+  // worker readiness below must still use OpenClaw's normal defaults.
+  execFileSync(
+    node,
+    [fileURLToPath(new URL("./verify-mac-node-worker-fs.mjs", import.meta.url)), packageRoot, home],
+    {
+      cwd: home,
+      env: { HOME: home, TMPDIR: home, FS_SAFE_NATIVE_MODE: "require" },
+      stdio: "inherit",
+    },
+  );
+  const database = new DatabaseSync(":memory:", { allowExtension: true });
+  try {
+    require("sqlite-vec").load(database);
+    assert.equal(
+      typeof database.prepare("SELECT vec_version() AS version").get().version,
+      "string",
+    );
+  } finally {
+    database.close();
+  }
+  await new Promise((resolve, reject) => {
+    const terminal = require("@lydell/node-pty").spawn(
+      "/bin/sh",
+      ["-c", "printf worker-pty-proof"],
+      {
+        cwd: home,
+        env: { HOME: home, PATH: "/usr/bin:/bin" },
+        name: "xterm",
+        cols: 80,
+        rows: 24,
+      },
+    );
+    let output = "";
+    const timeout = setTimeout(() => {
+      terminal.kill("SIGKILL");
+      reject(new Error("Bundled PTY did not exit"));
+    }, 10_000);
+    terminal.onData((data) => {
+      output += data;
+    });
+    terminal.onExit(({ exitCode }) => {
+      clearTimeout(timeout);
+      if (exitCode === 0 && output === "worker-pty-proof") {
+        resolve();
+      } else {
+        reject(new Error(`Bundled PTY failed (${exitCode}): ${output}`));
+      }
+    });
+  });
+  for (const nativeFirst of [false, true]) {
+    const proofHome = path.join(home, nativeFirst ? "native-first" : "absent");
+    const stateDir = path.join(proofHome, "state");
+    const databasePath = path.join(stateDir, "state", "openclaw.sqlite");
+    fs.mkdirSync(proofHome, { recursive: true });
+    // State lifecycle coordination lives outside removable state. Only remove
+    // this fresh fixture's exact hashes after the complete worker tree exits.
+    const coordinatorHash = createHash("sha256").update(databasePath).digest("hex").slice(0, 8);
+    const coordinatorFiles = ["state-lifecycle", "gateway-lifecycle"].flatMap((family) => {
+      const file = path.join(
+        fs.realpathSync("/tmp"),
+        `openclaw-state-locks-${process.getuid()}`,
+        `${family}.${coordinatorHash}.lock.sqlite`,
+      );
+      return [file, `${file}-journal`, `${file}-wal`, `${file}-shm`];
+    });
+    assert(
+      coordinatorFiles.every((file) => !fs.existsSync(file)),
+      "Proof coordinator already exists",
+    );
+    const nativeRows = nativeFirst ? seedMacNodeWorkerProofState(databasePath) : undefined;
+    let ready = false;
+    let failure;
+    let diagnostic = "";
+    const exitCode = await runManagedCommand({
+      bin: node,
+      args: [path.join(packageRoot, "dist/entry.js"), "node", "worker"],
+      cwd: proofHome,
+      env: {
+        HOME: proofHome,
+        TMPDIR: proofHome,
+        OPENCLAW_STATE_DIR: stateDir,
+        OPENCLAW_CONFIG_PATH: path.join(proofHome, "openclaw.json"),
+        PATH: `${path.dirname(node)}:/usr/bin:/bin:/usr/sbin:/sbin`,
+        OPENCLAW_NODE_EXEC_HOST: "app",
+        OPENCLAW_NODE_EXEC_FALLBACK: "0",
+        // Same launch shape as MacNodeHostWorker: the worker must stay in the owned
+        // process group, or requireProcessTreeExit only proves the respawn wrapper died.
+        OPENCLAW_NO_RESPAWN: "1",
+      },
+      stdio: ["pipe", "pipe", "pipe"],
+      timeoutMs: 300_000,
+      requireProcessTreeExit: true,
+      onReady(child) {
+        const lines = createInterface({ input: child.stdout });
+        child.stderr.on("data", (data) => {
+          diagnostic = (diagnostic + data.toString()).slice(0, 4000);
+        });
+        lines.on("line", (line) => {
+          let message;
+          try {
+            message = JSON.parse(line);
+          } catch {
+            return;
+          }
+          if (message.type !== "ready") {
+            return;
+          }
+          if (
+            message.version !== expected.version ||
+            !message.manifest?.commands?.includes("system.run") ||
+            !message.manifest?.commands?.includes("system.which") ||
+            !message.manifest?.commands?.includes("browser.proxy") ||
+            !message.manifest?.commands?.includes("browser.proxy.upload.v1") ||
+            !message.manifest?.commands?.includes("mcp.tools.call.v1")
+          ) {
+            failure = new Error("Bundled worker returned an incompatible capability manifest");
+            child.stdin.end('{"type":"stop"}\n');
+            return;
+          }
+          ready = true;
+          process.stdout.write(
+            `${JSON.stringify({ architecture: process.arch, nativeFirst, build: actual, nativeFiles, databasePath, manifest: message.manifest })}\n`,
+          );
+          child.stdin.end('{"type":"stop"}\n');
+        });
+        child.on("close", () => lines.close());
+        child.stdin.on("error", (error) => {
+          failure = error;
+          terminateManagedChild(child, "SIGKILL");
+        });
+      },
+    });
+    for (const file of coordinatorFiles) {
+      fs.rmSync(file, { force: true });
+    }
+    if (failure || !ready || exitCode !== 0 || /failed during register/u.test(diagnostic)) {
+      throw new Error(
+        `Bundled worker proof failed (${exitCode}): ${failure?.message ?? "missing readiness or registration failure"}; ${diagnostic}`,
+        { cause: failure },
+      );
+    }
+    if (nativeRows) {
+      const initialized = new DatabaseSync(databasePath, { readOnly: true });
+      try {
+        assert.deepEqual(readMacNodeWorkerProofRows(initialized), nativeRows);
+      } finally {
+        initialized.close();
+      }
+    }
+  }
+} finally {
+  fs.rmSync(home, { recursive: true, force: true });
+}
diff --git a/scripts/verify-plugin-npm-published-runtime.mts b/scripts/verify-plugin-npm-published-runtime.mts
new file mode 100644
index 0000000000000000000000000000000000000000..af7f9bde305809ce8810350c5b9bc29593662b7a
--- /dev/null
+++ b/scripts/verify-plugin-npm-published-runtime.mts
@@ -0,0 +1,426 @@
+#!/usr/bin/env node
+// Verifies published plugin npm packages include built runtime entries and
+// metadata expected by OpenClaw.
+
+import { execFileSync, type ExecFileSyncOptionsWithStringEncoding } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { isRecord } from "@openclaw/normalization-core/record-coerce";
+import * as tar from "tar";
+import {
+  isTypeScriptPackageEntry,
+  listBuiltRuntimeEntryCandidates,
+} from "../src/plugins/package-entrypoints.js";
+import { readPositiveIntEnv } from "./e2e/lib/env-limits.mjs";
+import { resolveNpmJsonString } from "./lib/npm-json-output.mts";
+import { sleep } from "./lib/sleep.mjs";
+
+const DEFAULT_NPM_COMMAND_TIMEOUT_MS = 5 * 60 * 1000;
+const DEFAULT_NPM_COMMAND_MAX_BUFFER_BYTES = 16 * 1024 * 1024;
+
+type ExecFileSyncText = (
+  file: string,
+  args: string[],
+  options: ExecFileSyncOptionsWithStringEncoding,
+) => string;
+
+function readPackageStringList(packageLabel: string, fieldName: string, value: unknown) {
+  if (!Array.isArray(value)) {
+    return { entries: [], errors: [] };
+  }
+  const entries: string[] = [];
+  const errors: string[] = [];
+  for (const [index, entry] of value.entries()) {
+    const normalized = typeof entry === "string" ? entry.trim() : "";
+    if (!normalized) {
+      errors.push(`${packageLabel} package.json ${fieldName}[${index}] must be a non-empty string`);
+      continue;
+    }
+    entries.push(normalized);
+  }
+  return { entries, errors };
+}
+
+function readOptionalPackageString(packageLabel: string, fieldName: string, value: unknown) {
+  if (value === undefined || value === null) {
+    return { entry: "", errors: [] };
+  }
+  const entry = typeof value === "string" ? value.trim() : "";
+  if (!entry) {
+    return {
+      entry: "",
+      errors: [`${packageLabel} package.json ${fieldName} must be a non-empty string`],
+    };
+  }
+  return { entry, errors: [] };
+}
+
+function normalizePackagePath(value: string) {
+  return value
+    .replace(/\\/g, "/")
+    .replace(/^package\//u, "")
+    .replace(/^\.\//u, "");
+}
+
+function hasPackedFile(packageFiles: Set<string>, entryPath: string) {
+  return packageFiles.has(normalizePackagePath(entryPath));
+}
+
+function missingCompiledRuntimeError(packageLabel: string, entry: string, candidates: string[]) {
+  return `${packageLabel} requires compiled runtime output for TypeScript entry ${entry}: expected ${candidates.join(", ")}`;
+}
+
+function formatPackageLabel(packageJson: Record<string, unknown>, fallbackSpec = "") {
+  const packageName = typeof packageJson.name === "string" ? packageJson.name.trim() : "";
+  const packageVersion = typeof packageJson.version === "string" ? packageJson.version.trim() : "";
+  if (packageName && packageVersion) {
+    return `${packageName}@${packageVersion}`;
+  }
+  return packageName || fallbackSpec || "<package>";
+}
+
+export function collectPluginNpmPublishedRuntimeErrors(params: {
+  spec?: string;
+  packageJson?: Record<string, unknown>;
+  files: Iterable<string>;
+  readme?: string;
+}) {
+  const packageJson = params.packageJson ?? {};
+  const openclaw = isRecord(packageJson.openclaw) ? packageJson.openclaw : {};
+  const packageFiles = new Set([...params.files].map(normalizePackagePath));
+  const packageLabel = formatPackageLabel(packageJson, params.spec);
+  const errors: string[] = [];
+  const extensionsResult = readPackageStringList(
+    packageLabel,
+    "openclaw.extensions",
+    openclaw.extensions,
+  );
+  const runtimeExtensionsResult = readPackageStringList(
+    packageLabel,
+    "openclaw.runtimeExtensions",
+    openclaw.runtimeExtensions,
+  );
+  const setupEntryResult = readOptionalPackageString(
+    packageLabel,
+    "openclaw.setupEntry",
+    openclaw.setupEntry,
+  );
+  const runtimeSetupEntryResult = readOptionalPackageString(
+    packageLabel,
+    "openclaw.runtimeSetupEntry",
+    openclaw.runtimeSetupEntry,
+  );
+  errors.push(
+    ...extensionsResult.errors,
+    ...runtimeExtensionsResult.errors,
+    ...setupEntryResult.errors,
+    ...runtimeSetupEntryResult.errors,
+  );
+  if (errors.length > 0) {
+    return errors;
+  }
+  if (!hasPackedFile(packageFiles, "openclaw.plugin.json")) {
+    errors.push(`${packageLabel} plugin npm package must include openclaw.plugin.json`);
+    return errors;
+  }
+  const extensions = extensionsResult.entries;
+  const runtimeExtensions = runtimeExtensionsResult.entries;
+  const setupEntry = setupEntryResult.entry;
+  const runtimeSetupEntry = runtimeSetupEntryResult.entry;
+
+  if (runtimeExtensions.length > 0 && runtimeExtensions.length !== extensions.length) {
+    errors.push(
+      `${packageLabel} package.json openclaw.runtimeExtensions length (${runtimeExtensions.length}) must match openclaw.extensions length (${extensions.length})`,
+    );
+    return errors;
+  }
+
+  for (const [index, entry] of extensions.entries()) {
+    const runtimeEntry = runtimeExtensions[index] ?? (isTypeScriptPackageEntry(entry) ? "" : entry);
+    if (runtimeEntry) {
+      if (!hasPackedFile(packageFiles, runtimeEntry)) {
+        errors.push(`${packageLabel} runtime extension entry not found: ${runtimeEntry}`);
+      }
+      continue;
+    }
+
+    const candidates = listBuiltRuntimeEntryCandidates(entry);
+    if (candidates.some((candidate) => hasPackedFile(packageFiles, candidate))) {
+      continue;
+    }
+
+    errors.push(missingCompiledRuntimeError(packageLabel, entry, candidates));
+  }
+
+  if (runtimeSetupEntry && !setupEntry) {
+    errors.push(
+      `${packageLabel} package.json openclaw.runtimeSetupEntry requires openclaw.setupEntry`,
+    );
+    return errors;
+  }
+
+  if (setupEntry) {
+    if (runtimeSetupEntry) {
+      if (!hasPackedFile(packageFiles, runtimeSetupEntry)) {
+        errors.push(`${packageLabel} runtime setup entry not found: ${runtimeSetupEntry}`);
+      }
+      return errors;
+    }
+
+    const candidates = listBuiltRuntimeEntryCandidates(setupEntry);
+    if (candidates.length > 0) {
+      if (candidates.some((candidate) => hasPackedFile(packageFiles, candidate))) {
+        return errors;
+      }
+      errors.push(missingCompiledRuntimeError(packageLabel, setupEntry, candidates));
+      return errors;
+    }
+
+    if (!hasPackedFile(packageFiles, setupEntry)) {
+      errors.push(`${packageLabel} setup entry not found: ${setupEntry}`);
+    }
+  }
+
+  return errors;
+}
+
+export function resolveNpmPackFilename(output: string) {
+  const filename = output
+    .split(/\r?\n/u)
+    .findLast((line) => line.trim().length > 0)
+    ?.trim();
+  if (
+    typeof filename !== "string" ||
+    !filename.endsWith(".tgz") ||
+    filename.includes("\0") ||
+    filename !== path.basename(filename) ||
+    filename !== path.win32.basename(filename)
+  ) {
+    throw new Error(`npm pack did not report a tarball filename`);
+  }
+  return filename;
+}
+
+export function readPluginNpmCommandOptions(env: NodeJS.ProcessEnv = process.env) {
+  return {
+    encoding: "utf8",
+    killSignal: "SIGKILL",
+    maxBuffer: readPositiveIntEnv(
+      "OPENCLAW_PLUGIN_NPM_COMMAND_MAX_BUFFER_BYTES",
+      DEFAULT_NPM_COMMAND_MAX_BUFFER_BYTES,
+      env,
+    ),
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: readPositiveIntEnv(
+      "OPENCLAW_PLUGIN_NPM_COMMAND_TIMEOUT_MS",
+      DEFAULT_NPM_COMMAND_TIMEOUT_MS,
+      env,
+    ),
+  } satisfies ExecFileSyncOptionsWithStringEncoding;
+}
+
+export function runPluginNpmCommand(
+  args: string[],
+  params: { execFileSyncImpl?: ExecFileSyncText; env?: NodeJS.ProcessEnv } = {},
+) {
+  const execFileSyncImpl =
+    params.execFileSyncImpl ??
+    ((file, childArgs, options) => execFileSync(file, childArgs, options));
+  return execFileSyncImpl("npm", args, readPluginNpmCommandOptions(params.env));
+}
+
+function npmPack(spec: string, destinationDir: string) {
+  const output = runPluginNpmCommand([
+    "pack",
+    spec,
+    "--ignore-scripts",
+    // Publication readback must include fresh releases; this downloads only the
+    // requested artifact and does not change the dependency-install age policy.
+    "--min-release-age=0",
+    "--pack-destination",
+    destinationDir,
+  ]);
+  const filename = resolveNpmPackFilename(output);
+  return path.isAbsolute(filename) ? filename : path.join(destinationDir, filename);
+}
+
+export function parseNpmReadmeMetadata(raw: string) {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return "";
+  }
+  return resolveNpmJsonString(parsed);
+}
+
+function npmViewReadme(spec: string) {
+  return runPluginNpmCommand(["view", spec, "readme", "--json", "--prefer-online"]);
+}
+
+async function packPublishedPackage(spec: string, destinationDir: string) {
+  const attempts = readPositiveIntEnv("OPENCLAW_PLUGIN_NPM_VERIFY_ATTEMPTS", 90);
+  const delayMs = readPositiveIntEnv("OPENCLAW_PLUGIN_NPM_VERIFY_DELAY_MS", 10000);
+  let lastError: unknown;
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    try {
+      return npmPack(spec, destinationDir);
+    } catch (error) {
+      lastError = error;
+      if (attempt < attempts) {
+        console.error(
+          `npm pack ${spec} not visible yet (attempt ${attempt}/${attempts}); retrying in ${delayMs}ms...`,
+        );
+        await sleep(delayMs);
+      }
+    }
+  }
+  throw lastError;
+}
+
+async function verifyPublishedPackageReadme(spec: string) {
+  const attempts = readPositiveIntEnv("OPENCLAW_PLUGIN_NPM_README_VERIFY_ATTEMPTS", 6);
+  const delayMs = readPositiveIntEnv("OPENCLAW_PLUGIN_NPM_README_VERIFY_DELAY_MS", 10000);
+  let lastError: unknown;
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    try {
+      const readme = parseNpmReadmeMetadata(npmViewReadme(spec));
+      if (readme) {
+        return readme;
+      }
+      lastError = new Error(`npm view ${spec} readme returned empty metadata`);
+    } catch (error) {
+      lastError = error;
+    }
+    if (attempt < attempts) {
+      console.error(
+        `npm readme metadata for ${spec} not ready (attempt ${attempt}/${attempts}); retrying in ${delayMs}ms...`,
+      );
+      await sleep(delayMs);
+    }
+  }
+  throw lastError;
+}
+
+function listFiles(rootDir: string, prefix = ""): string[] {
+  const files: string[] = [];
+  for (const entry of fs.readdirSync(path.join(rootDir, prefix), { withFileTypes: true })) {
+    const relativePath = path.join(prefix, entry.name).replace(/\\/g, "/");
+    if (entry.isDirectory()) {
+      files.push(...listFiles(rootDir, relativePath));
+    } else if (entry.isFile()) {
+      files.push(relativePath);
+    }
+  }
+  return files;
+}
+
+function readPackedPackage(tarballPath: string, extractDir: string) {
+  tar.x({ file: tarballPath, cwd: extractDir, sync: true });
+  const packageDir = path.join(extractDir, "package");
+  const packageJson: unknown = JSON.parse(
+    fs.readFileSync(path.join(packageDir, "package.json"), "utf8"),
+  );
+  if (!isRecord(packageJson)) {
+    throw new Error("published package package.json must contain an object");
+  }
+  const files = listFiles(packageDir);
+  return {
+    packageJson,
+    files,
+    readme: readPackedPackageReadme(packageDir, files),
+  };
+}
+
+export function findPackedPackageReadmePath(files: string[]) {
+  return files.find((file) => /^readme(?:\.(?:md|markdown|txt|rst))?$/iu.test(file)) ?? "";
+}
+
+function readPackedPackageReadme(packageDir: string, files: string[]) {
+  const readmePath = findPackedPackageReadmePath(files);
+  if (!readmePath) {
+    return "";
+  }
+  return fs.readFileSync(path.join(packageDir, readmePath), "utf8").trim();
+}
+
+export function usage() {
+  return "Usage: node --import tsx scripts/verify-plugin-npm-published-runtime.mts <package-spec>";
+}
+
+export function parseVerifyPublishedPluginRuntimeArgs(argv: string[]) {
+  const args = argv[0] === "--" ? argv.slice(1) : argv;
+  const first = args[0]?.trim();
+  if (first === "--help" || first === "-h") {
+    return { help: true, spec: "" };
+  }
+  if (!first) {
+    throw new Error(usage());
+  }
+  if (first.startsWith("-")) {
+    throw new Error(`Unknown plugin npm verifier option: ${first}`);
+  }
+  if (args.length > 1) {
+    throw new Error(`Unexpected plugin npm verifier argument: ${args[1]}`);
+  }
+  return { help: false, spec: first };
+}
+
+async function verifyPublishedPluginRuntime(spec: string) {
+  const workingDir = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-plugin-npm-runtime."));
+  try {
+    const tarballPath = await packPublishedPackage(spec, workingDir);
+    const extractDir = path.join(workingDir, "extract");
+    fs.mkdirSync(extractDir, { recursive: true });
+    const packedPackage = readPackedPackage(tarballPath, extractDir);
+    const errors = collectPluginNpmPublishedRuntimeErrors({
+      ...packedPackage,
+      spec,
+    });
+    if (errors.length > 0) {
+      throw new Error(errors.join("\n"));
+    }
+    let readme: string;
+    try {
+      readme = await verifyPublishedPackageReadme(spec);
+    } catch (error) {
+      if (!packedPackage.readme) {
+        throw error;
+      }
+      console.error(
+        `npm readme metadata for ${spec} was unavailable; verified README from published tarball instead.`,
+      );
+      readme = packedPackage.readme;
+    }
+    return {
+      packageLabel: formatPackageLabel(packedPackage.packageJson, spec),
+      fileCount: packedPackage.files.length,
+      readmeLength: readme.length,
+    };
+  } finally {
+    fs.rmSync(workingDir, { force: true, recursive: true });
+  }
+}
+
+async function main(argv: string[]) {
+  const args = parseVerifyPublishedPluginRuntimeArgs(argv);
+  if (args.help) {
+    console.log(usage());
+    return;
+  }
+  const result = await verifyPublishedPluginRuntime(args.spec);
+  console.log(
+    `plugin-npm-published-runtime-check: ${result.packageLabel} OK (${result.fileCount} files, ${result.readmeLength} readme chars)`,
+  );
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+  main(process.argv.slice(2)).catch((error: unknown) => {
+    console.error(
+      `plugin-npm-published-runtime-check: ${error instanceof Error ? error.message : String(error)}`,
+    );
+    process.exitCode = 1;
+  });
+}
diff --git a/scripts/vitest-pair-benchmark.mts b/scripts/vitest-pair-benchmark.mts
new file mode 100644
index 0000000000000000000000000000000000000000..47e6e29dc03bfb46dcef8c7a987d1e172352323c
--- /dev/null
+++ b/scripts/vitest-pair-benchmark.mts
@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import {
+  assertSingleWorkflowAttempt,
+  loadBenchmarkManifest,
+  runVitestPairBenchmark,
+  withTerminalManifest,
+} from "./lib/vitest-pair-benchmark.mts";
+
+function parseArgs(argv: string[]) {
+  const values = new Map<string, string>();
+  for (let index = 0; index < argv.length; index += 2) {
+    const name = argv[index];
+    const value = argv[index + 1];
+    if (!name?.startsWith("--") || value === undefined) {
+      throw new Error(`invalid argument near ${name ?? "<end>"}`);
+    }
+    values.set(name.slice(2), value);
+  }
+  const required = (name: string) => {
+    const value = values.get(name);
+    if (!value) {
+      throw new Error(`--${name} is required`);
+    }
+    return value;
+  };
+  const scriptDir = path.dirname(fileURLToPath(import.meta.url));
+  return {
+    baselineDir: required("baseline"),
+    baselineSha: required("baseline-sha"),
+    candidateDir: required("candidate"),
+    candidateSha: required("candidate-sha"),
+    manifestPath:
+      values.get("manifest") ?? path.join(scriptDir, "vitest-pair-benchmark-lanes.json"),
+    outputDir: required("output"),
+    pnpmBin: required("pnpm-bin"),
+    runAttempt: required("run-attempt"),
+    scratchDir: required("scratch"),
+  };
+}
+
+const options = parseArgs(process.argv.slice(2));
+await withTerminalManifest(options.outputDir, async () => {
+  assertSingleWorkflowAttempt(options.runAttempt);
+  await runVitestPairBenchmark({
+    baselineDir: options.baselineDir,
+    baselineSha: options.baselineSha,
+    candidateDir: options.candidateDir,
+    candidateSha: options.candidateSha,
+    manifest: loadBenchmarkManifest(options.manifestPath),
+    outputDir: options.outputDir,
+    pnpmBin: options.pnpmBin,
+    scratchDir: options.scratchDir,
+  });
+});
diff --git a/scripts/write-cli-startup-metadata.ts b/scripts/write-cli-startup-metadata.ts
new file mode 100644
index 0000000000000000000000000000000000000000..177fe6748367868c24f73aaf6f116ee8ad4ccaa1
--- /dev/null
+++ b/scripts/write-cli-startup-metadata.ts
@@ -0,0 +1,1132 @@
+// Write Cli Startup Metadata script supports OpenClaw repository automation.
+import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import fs, { existsSync, mkdtempSync, readdirSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { toErrorObject } from "@openclaw/normalization-core/error-coercion";
+import pMap from "p-map";
+import type { RootHelpRenderOptions } from "../src/cli/program/root-help.js";
+import type { OpenClawConfig } from "../src/config/config.js";
+import { replaceFileAtomicSync } from "../src/infra/replace-file.js";
+import { resolveCliStartupRootHelpBundleIdentity } from "./lib/cli-startup-root-help-bundle.js";
+import { terminateManagedChild } from "./lib/managed-child-process.mts";
+
+function dedupe(values: string[]): string[] {
+  const seen = new Set<string>();
+  const out: string[] = [];
+  for (const value of values) {
+    if (!value || seen.has(value)) {
+      continue;
+    }
+    seen.add(value);
+    out.push(value);
+  }
+  return out;
+}
+
+const scriptPath = fileURLToPath(import.meta.url);
+const scriptDir = path.dirname(scriptPath);
+const rootDir = path.resolve(scriptDir, "..");
+const distDir = path.join(rootDir, "dist");
+const outputPath = path.join(distDir, "cli-startup-metadata.json");
+const extensionsDir = path.join(rootDir, "extensions");
+const ROOT_HELP_RENDER_TIMEOUT_MS = 120_000;
+const COMMAND_HELP_RENDER_TIMEOUT_MS = 120_000;
+const COMMAND_HELP_RENDER_MAX_OUTPUT_BYTES = 16 * 1024 * 1024;
+const COMMAND_HELP_RENDER_KILL_GRACE_MS = 5_000;
+// Cold CLI boots compete for the same module graph, so CPU count is not a safe
+// proxy for module-loading throughput on a disk-contended host.
+const COMMAND_HELP_RENDER_CONCURRENCY = 2;
+const PRECOMPUTED_SUBCOMMAND_HELP_COMMANDS = [
+  "config",
+  "doctor",
+  "gateway",
+  "models",
+  "plugins",
+  "sessions",
+  "tasks",
+] as const;
+const CORE_CHANNEL_ORDER = [
+  "telegram",
+  "whatsapp",
+  "discord",
+  "irc",
+  "googlechat",
+  "slack",
+  "signal",
+  "imessage",
+] as const;
+const generatorSignature = createHash("sha1").update(readFileSync(scriptPath)).digest("hex");
+
+type ExtensionChannelEntry = {
+  id: string;
+  order: number;
+  label: string;
+};
+
+type BundledChannelCatalog = {
+  ids: string[];
+  signature: string;
+};
+
+type PrecomputedSubcommandHelpCommand = (typeof PRECOMPUTED_SUBCOMMAND_HELP_COMMANDS)[number];
+type PrecomputedSubcommandHelpText = Record<PrecomputedSubcommandHelpCommand, string>;
+type RootHelpRenderContext = Pick<RootHelpRenderOptions, "config" | "env">;
+type Awaitable<T> = T | Promise<T>;
+type SourceCommandHelpCommand = "browser" | "nodes" | "secrets" | PrecomputedSubcommandHelpCommand;
+type SourceCommandHelpText = Record<SourceCommandHelpCommand, string>;
+type ExistingCliStartupMetadata = {
+  rootHelpBundleSignature?: unknown;
+  generatorSignature?: unknown;
+  browserHelpSourceSignature?: unknown;
+  secretsHelpSourceSignature?: unknown;
+  nodesHelpSourceSignature?: unknown;
+  subcommandHelpSourceSignature?: unknown;
+  channelCatalogSignature?: unknown;
+  browserHelpText?: unknown;
+  secretsHelpText?: unknown;
+  nodesHelpText?: unknown;
+  subcommandHelpText?: unknown;
+  rootHelpText?: unknown;
+};
+type RenderTaskContext = {
+  reportFailure: (error: unknown) => void;
+  signal: AbortSignal;
+};
+type SourceHelpRenderer<T = string> = (
+  renderContext: RootHelpRenderContext,
+  taskContext?: RenderTaskContext,
+) => Awaitable<T>;
+class CliStartupMetadataRenderSupervisor {
+  readonly #abortController = new AbortController();
+  readonly #parentSignalHandlers: Array<{ handler: () => void; signal: NodeJS.Signals }> = [];
+  #firstFailure: Error | undefined;
+  #parentSignal: NodeJS.Signals | null = null;
+  #preserveRenderState = false;
+
+  constructor() {
+    const signals: NodeJS.Signals[] =
+      process.platform === "win32" ? ["SIGINT", "SIGTERM"] : ["SIGINT", "SIGTERM", "SIGHUP"];
+    for (const signal of signals) {
+      const handler = () => {
+        this.#parentSignal ??= signal;
+        if (!this.#abortController.signal.aborted) {
+          this.#abortController.abort(new Error(`CLI startup metadata interrupted by ${signal}`));
+        }
+      };
+      this.#parentSignalHandlers.push({ handler, signal });
+      process.once(signal, handler);
+    }
+  }
+
+  get firstFailure(): Error | undefined {
+    return this.#firstFailure;
+  }
+
+  get signal(): AbortSignal {
+    return this.#abortController.signal;
+  }
+
+  get preserveRenderState(): boolean {
+    return this.#preserveRenderState;
+  }
+
+  reportFailure(error: unknown): void {
+    if (
+      error instanceof Error &&
+      "preserveRenderState" in error &&
+      error.preserveRenderState === true
+    ) {
+      this.#preserveRenderState = true;
+    }
+    if (this.#firstFailure || this.#parentSignal) {
+      return;
+    }
+    this.#firstFailure = toErrorObject(error, "CLI startup metadata render failed");
+    this.#abortController.abort(this.#firstFailure);
+  }
+
+  async run<T>(render: (context: RenderTaskContext) => Awaitable<T>): Promise<T> {
+    // Register every sibling before a synchronous renderer can abort the shared group.
+    await Promise.resolve();
+    if (this.signal.aborted) {
+      throw this.signal.reason ?? new Error("CLI startup metadata render aborted");
+    }
+    try {
+      return await render({
+        reportFailure: (error) => this.reportFailure(error),
+        signal: this.signal,
+      });
+    } catch (error) {
+      this.reportFailure(error);
+      throw error;
+    }
+  }
+
+  finish(
+    primaryFailure: unknown,
+    cleanupError?: unknown,
+    preservedStateDir?: string,
+  ): never | void {
+    for (const { signal, handler } of this.#parentSignalHandlers) {
+      process.off(signal, handler);
+    }
+    this.#parentSignalHandlers.length = 0;
+    if (this.#parentSignal) {
+      process.kill(process.pid, this.#parentSignal);
+      return;
+    }
+    const failure =
+      this.#firstFailure ??
+      (primaryFailure
+        ? toErrorObject(primaryFailure, "CLI startup metadata render failed")
+        : undefined);
+    if (!failure) {
+      if (cleanupError) {
+        throw toErrorObject(cleanupError, "CLI startup metadata cleanup failed");
+      }
+      return;
+    }
+    if (cleanupError) {
+      Object.assign(failure, { cleanupError });
+    }
+    if (preservedStateDir) {
+      failure.message += `\nPreserved CLI startup metadata render state: ${preservedStateDir}`;
+    }
+    throw failure;
+  }
+}
+
+function updateHashFromFiles(
+  hash: ReturnType<typeof createHash>,
+  files: string[],
+  sourceRootDir: string = rootDir,
+): void {
+  for (const file of files.toSorted()) {
+    hash.update(`${path.relative(sourceRootDir, file)}\0`);
+    hash.update(readFileSync(file));
+    hash.update("\0");
+  }
+}
+
+function resolveBrowserHelpSourceSignature(sourceRootDir: string = rootDir): string {
+  const hash = createHash("sha1");
+  const browserCliDir = path.join(sourceRootDir, "extensions/browser/src/cli");
+  const browserCliFiles = readdirSync(browserCliDir)
+    .filter((entry) => entry.endsWith(".ts"))
+    .map((entry) => path.join(browserCliDir, entry));
+  updateHashFromFiles(hash, browserCliFiles, sourceRootDir);
+  updateHashFromFiles(
+    hash,
+    [
+      path.join(sourceRootDir, "src/cli/program/help.ts"),
+      path.join(sourceRootDir, "src/cli/program/context.ts"),
+      path.join(sourceRootDir, "src/cli/banner.ts"),
+    ],
+    sourceRootDir,
+  );
+  return hash.digest("hex");
+}
+
+function resolveSecretsHelpSourceSignature(sourceRootDir: string = rootDir): string {
+  const hash = createHash("sha1");
+  updateHashFromFiles(
+    hash,
+    [
+      path.join(sourceRootDir, "src/cli/secrets-cli.ts"),
+      path.join(sourceRootDir, "src/cli/program/help.ts"),
+      path.join(sourceRootDir, "src/cli/program/context.ts"),
+      path.join(sourceRootDir, "src/cli/banner.ts"),
+    ],
+    sourceRootDir,
+  );
+  return hash.digest("hex");
+}
+
+function resolveNodesHelpSourceSignature(sourceRootDir: string = rootDir): string {
+  const hash = createHash("sha1");
+  const nodesCliDir = path.join(sourceRootDir, "src/cli/nodes-cli");
+  const nodesCliFiles = readdirSync(nodesCliDir)
+    .filter((entry) => entry.endsWith(".ts") && !entry.endsWith(".test.ts"))
+    .map((entry) => path.join(nodesCliDir, entry));
+  updateHashFromFiles(hash, nodesCliFiles, sourceRootDir);
+  updateHashFromFiles(
+    hash,
+    [
+      path.join(sourceRootDir, "extensions/canvas/cli-metadata.ts"),
+      path.join(sourceRootDir, "extensions/canvas/index.ts"),
+      path.join(sourceRootDir, "extensions/canvas/src/cli.ts"),
+      path.join(sourceRootDir, "src/cli/program/help.ts"),
+      path.join(sourceRootDir, "src/cli/program/context.ts"),
+      path.join(sourceRootDir, "src/cli/banner.ts"),
+      path.join(sourceRootDir, "src/plugins/register-plugin-cli-command-groups.ts"),
+    ],
+    sourceRootDir,
+  );
+  return hash.digest("hex");
+}
+
+function resolveSubcommandHelpSourceSignature(sourceRootDir: string = rootDir): string {
+  const hash = createHash("sha1");
+  updateHashFromFiles(
+    hash,
+    [
+      path.join(sourceRootDir, "src/cli/program/help.ts"),
+      path.join(sourceRootDir, "src/cli/program/context.ts"),
+      path.join(sourceRootDir, "src/cli/banner.ts"),
+      path.join(sourceRootDir, "src/cli/help-format.ts"),
+      path.join(sourceRootDir, "src/cli/config-cli.ts"),
+      path.join(sourceRootDir, "src/cli/daemon-cli/register-service-commands.ts"),
+      path.join(sourceRootDir, "src/cli/program/register.maintenance.ts"),
+      path.join(sourceRootDir, "src/cli/program/register.status-health-sessions.ts"),
+      path.join(sourceRootDir, "src/cli/gateway-cli.ts"),
+      path.join(sourceRootDir, "src/cli/gateway-cli/register.ts"),
+      path.join(sourceRootDir, "src/cli/gateway-cli/run-command.ts"),
+      path.join(sourceRootDir, "src/cli/models-cli.ts"),
+      path.join(sourceRootDir, "src/cli/plugins-cli.ts"),
+      path.join(sourceRootDir, "packages/terminal-core/src/links.ts"),
+      path.join(sourceRootDir, "packages/terminal-core/src/theme.ts"),
+    ],
+    sourceRootDir,
+  );
+  return hash.digest("hex");
+}
+
+function readBundledChannelCatalog(
+  extensionsDirOverride: string = extensionsDir,
+): BundledChannelCatalog {
+  const entries: ExtensionChannelEntry[] = [];
+  const signature = createHash("sha1");
+  for (const dirEntry of readdirSync(extensionsDirOverride, { withFileTypes: true })) {
+    if (!dirEntry.isDirectory()) {
+      continue;
+    }
+    const packageJsonPath = path.join(extensionsDirOverride, dirEntry.name, "package.json");
+    try {
+      const raw = readFileSync(packageJsonPath, "utf8");
+      signature.update(`${dirEntry.name}\0${raw}\0`);
+      const parsed = JSON.parse(raw) as {
+        openclaw?: {
+          channel?: {
+            id?: unknown;
+            order?: unknown;
+            label?: unknown;
+          };
+        };
+      };
+      const id = parsed.openclaw?.channel?.id;
+      if (typeof id !== "string" || !id.trim()) {
+        continue;
+      }
+      const orderRaw = parsed.openclaw?.channel?.order;
+      const labelRaw = parsed.openclaw?.channel?.label;
+      entries.push({
+        id: id.trim(),
+        order: typeof orderRaw === "number" ? orderRaw : 999,
+        label: typeof labelRaw === "string" ? labelRaw : id.trim(),
+      });
+    } catch {
+      // Ignore malformed or missing extension package manifests.
+    }
+  }
+  return {
+    ids: entries
+      .toSorted((a, b) =>
+        a.order === b.order ? a.label.localeCompare(b.label) : a.order - b.order,
+      )
+      .map((entry) => entry.id),
+    signature: signature.digest("hex"),
+  };
+}
+
+function createRootHelpRenderStateDir(): string {
+  return mkdtempSync(path.join(tmpdir(), "openclaw-build-root-help-"));
+}
+
+function cleanupRootHelpRenderStateDir(stateDir: string): void {
+  fs.rmSync(stateDir, { force: true, recursive: true, maxRetries: 6, retryDelay: 25 });
+}
+
+function withIsolatedRootHelpRenderContext<T>(
+  bundledPluginsDir: string,
+  render: (context: RootHelpRenderContext) => T,
+): T {
+  const stateDir = createRootHelpRenderStateDir();
+  try {
+    const result = render(createIsolatedRootHelpRenderContext(bundledPluginsDir, stateDir));
+    if (result instanceof Promise) {
+      return result.finally(() => cleanupRootHelpRenderStateDir(stateDir)) as T;
+    }
+    cleanupRootHelpRenderStateDir(stateDir);
+    return result;
+  } catch (error) {
+    cleanupRootHelpRenderStateDir(stateDir);
+    throw error;
+  }
+}
+
+async function settleRootHelpRenderPromises<T extends readonly unknown[]>(
+  values: T,
+  stateDir: string,
+  supervisor: CliStartupMetadataRenderSupervisor,
+): Promise<{ -readonly [P in keyof T]: Awaited<T[P]> }> {
+  const settled = await Promise.allSettled(values);
+  const rejected = settled.find(
+    (result): result is PromiseRejectedResult => result.status === "rejected",
+  );
+  let cleanupError: unknown;
+  if (!supervisor.preserveRenderState) {
+    try {
+      cleanupRootHelpRenderStateDir(stateDir);
+    } catch (error) {
+      cleanupError = error;
+    }
+  }
+  supervisor.finish(
+    rejected?.reason,
+    cleanupError,
+    supervisor.preserveRenderState ? stateDir : undefined,
+  );
+  return settled.map((result) => (result as PromiseFulfilledResult<unknown>).value) as {
+    -readonly [P in keyof T]: Awaited<T[P]>;
+  };
+}
+
+function createIsolatedRootHelpRenderContext(
+  bundledPluginsDir: string,
+  stateDir: string,
+): RootHelpRenderContext {
+  const workspaceDir = path.join(stateDir, "workspace");
+  const homeDir = path.join(stateDir, "home");
+  const env: NodeJS.ProcessEnv = {
+    HOME: homeDir,
+    LOGNAME: process.env.LOGNAME ?? process.env.USER ?? "openclaw-build",
+    USER: process.env.USER ?? process.env.LOGNAME ?? "openclaw-build",
+    PATH: process.env.PATH ?? "",
+    TMPDIR: process.env.TMPDIR ?? "/tmp",
+    LANG: process.env.LANG ?? "C.UTF-8",
+    LC_ALL: process.env.LC_ALL ?? "C.UTF-8",
+    TERM: process.env.TERM ?? "dumb",
+    NO_COLOR: "1",
+    OPENCLAW_BUNDLED_PLUGINS_DIR: bundledPluginsDir,
+    OPENCLAW_DISABLE_BUNDLED_PLUGINS: "",
+    OPENCLAW_STATE_DIR: stateDir,
+  };
+  const config: OpenClawConfig = {
+    agents: {
+      defaults: {
+        workspace: workspaceDir,
+      },
+    },
+  };
+  return { config, env };
+}
+
+function createSpawnTextFailure(params: {
+  cause?: unknown;
+  detail?: string;
+  failureMessage: string;
+  kind:
+    | "aborted"
+    | "nonzero-exit"
+    | "output-limit"
+    | "process-tree-cleanup"
+    | "spawn-error"
+    | "stream-error"
+    | "timeout";
+  startedAt: number;
+}): Error {
+  const elapsedMs = Date.now() - params.startedAt;
+  return Object.assign(
+    new Error(
+      `${params.failureMessage}${params.detail ? `: ${params.detail}` : ""} (elapsed ${elapsedMs}ms)`,
+      params.cause === undefined ? undefined : { cause: params.cause },
+    ),
+    {
+      code:
+        params.kind === "timeout"
+          ? "ETIMEDOUT"
+          : params.kind === "aborted"
+            ? "EABORTED"
+            : params.kind === "process-tree-cleanup"
+              ? "EPROCESSGROUP_CLEANUP_FAILED"
+              : "ECLI_STARTUP_METADATA_RENDER",
+      elapsedMs,
+      renderFailureKind: params.kind,
+    },
+  );
+}
+
+async function spawnText(
+  args: string[],
+  options: {
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    failureMessage: string;
+    killGraceMs?: number;
+    maxOutputBytes?: number;
+    onTerminalFailure?: (error: Error) => void;
+    signal?: AbortSignal;
+    spawnProcess?: typeof spawn;
+    timeoutMs: number;
+  },
+): Promise<string> {
+  const maxOutputBytes = options.maxOutputBytes ?? COMMAND_HELP_RENDER_MAX_OUTPUT_BYTES;
+  const killGraceMs = options.killGraceMs ?? COMMAND_HELP_RENDER_KILL_GRACE_MS;
+  const spawnProcess = options.spawnProcess ?? spawn;
+  const useProcessGroup = process.platform !== "win32";
+  const startedAt = Date.now();
+  if (options.signal?.aborted) {
+    throw createSpawnTextFailure({
+      cause: options.signal.reason,
+      detail: "aborted before start",
+      failureMessage: options.failureMessage,
+      kind: "aborted",
+      startedAt,
+    });
+  }
+  return await new Promise((resolve, reject) => {
+    const child = spawnProcess(process.execPath, args, {
+      cwd: options.cwd,
+      detached: useProcessGroup,
+      env: options.env,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    let stdout = "";
+    let stderr = "";
+    let outputBytes = 0;
+    let settled = false;
+    let terminalFailure: Error | undefined;
+    let processTreeCleanupFailure: Error | undefined;
+    let waitingForKillGrace = false;
+    let forceKillInFlight = false;
+    let childClosedResult: { code: number | null; signal: NodeJS.Signals | null } | null = null;
+    let killTimer: ReturnType<typeof setTimeout> | undefined;
+    const signalChild = (signal: NodeJS.Signals) => {
+      terminateManagedChild(child, signal, {
+        onProcessGroupSignalError: (error) => {
+          stderr += `failed to send ${signal} to process group: ${error instanceof Error ? error.message : String(error)}\n`;
+        },
+        useProcessGroup,
+      });
+    };
+    const processGroupIsAlive = () => {
+      if (!useProcessGroup || typeof child.pid !== "number") {
+        return false;
+      }
+      try {
+        process.kill(-child.pid, 0);
+        return true;
+      } catch (error) {
+        return (error as NodeJS.ErrnoException).code === "EPERM";
+      }
+    };
+    const waitForProcessGroupExit = async (timeoutMs: number) => {
+      const deadline = Date.now() + timeoutMs;
+      while (Date.now() < deadline) {
+        if (!processGroupIsAlive()) {
+          return true;
+        }
+        await new Promise((resolvePoll) => {
+          setTimeout(resolvePoll, 25);
+        });
+      }
+      return !processGroupIsAlive();
+    };
+    const recordTerminalFailure = (error: Error) => {
+      if (terminalFailure) {
+        return terminalFailure;
+      }
+      terminalFailure = error;
+      options.onTerminalFailure?.(error);
+      return error;
+    };
+    const createFailure = (
+      kind: Parameters<typeof createSpawnTextFailure>[0]["kind"],
+      detail: string,
+      cause?: unknown,
+    ) =>
+      createSpawnTextFailure({
+        cause,
+        detail,
+        failureMessage: options.failureMessage,
+        kind,
+        startedAt,
+      });
+    const fail = (
+      kind: Parameters<typeof createSpawnTextFailure>[0]["kind"],
+      detail: string,
+      cause?: unknown,
+    ) => recordTerminalFailure(createFailure(kind, detail, cause));
+    const abortListener = () => {
+      if (settled || terminalFailure) {
+        return;
+      }
+      fail("aborted", "aborted after sibling failure", options.signal?.reason);
+      signalChild("SIGTERM");
+      scheduleKill();
+    };
+    const settle = (callback: () => void) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      clearTimeout(timeout);
+      if (killTimer) {
+        clearTimeout(killTimer);
+      }
+      options.signal?.removeEventListener("abort", abortListener);
+      callback();
+    };
+    const finishClose = (result: { code: number | null; signal: NodeJS.Signals | null }) => {
+      settle(() => {
+        if (result.code === 0 && !terminalFailure) {
+          resolve(stdout);
+          return;
+        }
+        const detail = stderr.trim() || (result.signal ? `terminated by ${result.signal}` : "");
+        const failure = terminalFailure ?? createFailure("nonzero-exit", detail);
+        if (processTreeCleanupFailure) {
+          Object.assign(failure, {
+            preserveRenderState: true,
+            processTreeCleanupFailure,
+          });
+        }
+        reject(failure);
+      });
+    };
+    const scheduleKill = () => {
+      if (waitingForKillGrace) {
+        return;
+      }
+      waitingForKillGrace = true;
+      killTimer = setTimeout(() => {
+        waitingForKillGrace = false;
+        killTimer = undefined;
+        forceKillInFlight = true;
+        signalChild("SIGKILL");
+        const forceDrain = useProcessGroup
+          ? waitForProcessGroupExit(killGraceMs)
+          : Promise.resolve(true);
+        void forceDrain.then((drained) => {
+          forceKillInFlight = false;
+          if (!drained) {
+            processTreeCleanupFailure = Object.assign(
+              createFailure(
+                "process-tree-cleanup",
+                `process group did not exit within ${killGraceMs}ms after SIGKILL`,
+              ),
+              { preserveRenderState: true },
+            );
+            options.onTerminalFailure?.(processTreeCleanupFailure);
+          }
+          if (childClosedResult) {
+            finishClose(childClosedResult);
+          } else if (!drained) {
+            child.stdout.destroy();
+            child.stderr.destroy();
+            child.unref?.();
+            finishClose({ code: null, signal: "SIGKILL" });
+          }
+        });
+      }, killGraceMs);
+      if (useProcessGroup) {
+        void waitForProcessGroupExit(killGraceMs).then((drained) => {
+          if (!drained || !waitingForKillGrace) {
+            return;
+          }
+          waitingForKillGrace = false;
+          if (killTimer) {
+            clearTimeout(killTimer);
+            killTimer = undefined;
+          }
+          if (childClosedResult) {
+            finishClose(childClosedResult);
+          }
+        });
+      }
+    };
+    const requestStop = () => {
+      signalChild("SIGTERM");
+      scheduleKill();
+    };
+    options.signal?.addEventListener("abort", abortListener, { once: true });
+    if (options.signal?.aborted) {
+      abortListener();
+    }
+    const failOutputStream = (streamName: "stdout" | "stderr", error: Error) => {
+      // Keep the first stop cause: killing for a timeout or output cap can make
+      // the stdio pipes fail secondarily while the child is shutting down.
+      if (terminalFailure) {
+        return;
+      }
+      fail("stream-error", `${streamName} read error: ${error.message}`, error);
+      requestStop();
+    };
+    const timeout = setTimeout(() => {
+      fail("timeout", `timed out after ${options.timeoutMs}ms`);
+      requestStop();
+    }, options.timeoutMs);
+    timeout.unref();
+    child.stdout.setEncoding("utf8");
+    child.stdout.on("data", (chunk: string) => {
+      if (terminalFailure) {
+        return;
+      }
+      outputBytes += Buffer.byteLength(chunk);
+      if (outputBytes > maxOutputBytes) {
+        fail("output-limit", `output exceeded ${maxOutputBytes} bytes`);
+        requestStop();
+        return;
+      }
+      stdout += chunk;
+    });
+    child.stderr.setEncoding("utf8");
+    child.stderr.on("data", (chunk: string) => {
+      if (terminalFailure) {
+        return;
+      }
+      outputBytes += Buffer.byteLength(chunk);
+      if (outputBytes > maxOutputBytes) {
+        fail("output-limit", `output exceeded ${maxOutputBytes} bytes`);
+        requestStop();
+        return;
+      }
+      stderr += chunk;
+    });
+    child.stdout.once("error", (error: Error) => {
+      failOutputStream("stdout", error);
+    });
+    child.stderr.once("error", (error: Error) => {
+      failOutputStream("stderr", error);
+    });
+    child.once("error", (error) => {
+      const failure = fail(
+        "spawn-error",
+        error instanceof Error ? error.message : String(error),
+        error,
+      );
+      settle(() => {
+        reject(failure);
+      });
+    });
+    child.once("close", (code, signal) => {
+      const result = { code, signal };
+      if (code !== 0 && !terminalFailure) {
+        fail("nonzero-exit", stderr.trim() || (signal ? `terminated by ${signal}` : ""));
+      }
+      if (processGroupIsAlive()) {
+        childClosedResult = result;
+        if (!waitingForKillGrace && !forceKillInFlight) {
+          requestStop();
+        }
+        return;
+      }
+      finishClose(result);
+    });
+  });
+}
+
+async function renderBundledRootHelpText(
+  _distDirOverride: string = distDir,
+  renderContext?: RootHelpRenderContext,
+  taskContext?: RenderTaskContext,
+): Promise<string> {
+  if (!renderContext) {
+    const bundledPluginsDir = existsSync(path.join(_distDirOverride, "extensions"))
+      ? path.join(_distDirOverride, "extensions")
+      : extensionsDir;
+    return await withIsolatedRootHelpRenderContext(
+      bundledPluginsDir,
+      async (context) => await renderBundledRootHelpText(_distDirOverride, context, taskContext),
+    );
+  }
+  const bundleIdentity = resolveCliStartupRootHelpBundleIdentity(_distDirOverride);
+  if (!bundleIdentity) {
+    throw new Error("No root-help bundle found in dist; cannot write CLI startup metadata.");
+  }
+  const moduleUrl = pathToFileURL(path.join(_distDirOverride, bundleIdentity.bundleName)).href;
+  const renderOptions = {
+    config: renderContext.config,
+    env: renderContext.env,
+  } satisfies RootHelpRenderOptions;
+  const inlineModule = [
+    `const mod = await import(${JSON.stringify(moduleUrl)});`,
+    "if (typeof mod.outputRootHelp !== 'function') {",
+    `  throw new Error(${JSON.stringify(`Bundle ${bundleIdentity.bundleName} does not export outputRootHelp.`)});`,
+    "}",
+    `await mod.outputRootHelp(${JSON.stringify(renderOptions)});`,
+    "process.exit(0);",
+  ].join("\n");
+  return await spawnText(["--input-type=module", "--eval", inlineModule], {
+    cwd: _distDirOverride,
+    // RootHelpRenderOptions marks env optional; spawnText requires one.
+    env: renderContext.env ?? process.env,
+    failureMessage: `Failed to render bundled root help from ${bundleIdentity.bundleName}`,
+    onTerminalFailure: taskContext?.reportFailure,
+    signal: taskContext?.signal,
+    timeoutMs: ROOT_HELP_RENDER_TIMEOUT_MS,
+  });
+}
+
+async function renderSourceRootHelpText(
+  renderContext?: RootHelpRenderContext,
+  taskContext?: RenderTaskContext,
+): Promise<string> {
+  if (!renderContext) {
+    return await withIsolatedRootHelpRenderContext(
+      extensionsDir,
+      async (context) => await renderSourceRootHelpText(context, taskContext),
+    );
+  }
+  const moduleUrl = pathToFileURL(path.join(rootDir, "src/cli/program/root-help.ts")).href;
+  const renderOptions = {
+    pluginSdkResolution: "src",
+    config: renderContext.config,
+    env: renderContext.env,
+  } satisfies RootHelpRenderOptions;
+  const inlineModule = [
+    `const mod = await import(${JSON.stringify(moduleUrl)});`,
+    "if (typeof mod.renderRootHelpText !== 'function') {",
+    `  throw new Error(${JSON.stringify("Source root-help module does not export renderRootHelpText.")});`,
+    "}",
+    `const output = await mod.renderRootHelpText(${JSON.stringify(renderOptions)});`,
+    "process.stdout.write(output);",
+    "process.exit(0);",
+  ].join("\n");
+  return await spawnText(["--import", "tsx", "--input-type=module", "--eval", inlineModule], {
+    cwd: rootDir,
+    env: renderContext.env ?? process.env,
+    failureMessage: "Failed to render source root help",
+    onTerminalFailure: taskContext?.reportFailure,
+    signal: taskContext?.signal,
+    timeoutMs: ROOT_HELP_RENDER_TIMEOUT_MS,
+  });
+}
+
+async function renderSourceBrowserHelpText(
+  renderContext: RootHelpRenderContext,
+  taskContext?: RenderTaskContext,
+): Promise<string> {
+  // The launcher CLI boot renders byte-identical browser help to a direct
+  // tsx source render (registerBrowserCli + configureProgramHelp) while
+  // avoiding a tsx evaluation of the whole browser CLI import graph, which
+  // dominated this script's wall time.
+  return await renderSourceCommandHelpText("browser", renderContext, taskContext);
+}
+
+async function renderSourceCommandHelpText(
+  command: SourceCommandHelpCommand,
+  renderContext: RootHelpRenderContext,
+  taskContext?: RenderTaskContext,
+): Promise<string> {
+  return await spawnText(["openclaw.mjs", command, "--help"], {
+    cwd: rootDir,
+    env: {
+      ...renderContext.env,
+      OPENCLAW_DISABLE_CLI_STARTUP_HELP_FAST_PATH: "1",
+    },
+    failureMessage: `Failed to render source ${command} help`,
+    onTerminalFailure: taskContext?.reportFailure,
+    signal: taskContext?.signal,
+    timeoutMs: COMMAND_HELP_RENDER_TIMEOUT_MS,
+  });
+}
+
+async function renderSourceSecretsHelpText(
+  renderContext: RootHelpRenderContext,
+  taskContext?: RenderTaskContext,
+): Promise<string> {
+  return await renderSourceCommandHelpText("secrets", renderContext, taskContext);
+}
+
+async function renderSourceNodesHelpText(
+  renderContext: RootHelpRenderContext,
+  taskContext?: RenderTaskContext,
+): Promise<string> {
+  return await renderSourceCommandHelpText("nodes", renderContext, taskContext);
+}
+
+async function renderSourceCommandHelpTextRecord(
+  commands: readonly SourceCommandHelpCommand[],
+  renderContext: RootHelpRenderContext,
+  supervisor: CliStartupMetadataRenderSupervisor,
+): Promise<SourceCommandHelpText> {
+  const helpTexts: Partial<Record<SourceCommandHelpCommand, string>> = {};
+  await pMap(
+    commands,
+    async (commandName) => {
+      if (supervisor.signal.aborted) {
+        return;
+      }
+      try {
+        helpTexts[commandName] = await supervisor.run(async (taskContext) =>
+          renderSourceCommandHelpText(commandName, renderContext, taskContext),
+        );
+      } catch {
+        // Keep the mapper fulfilled so p-map waits for every active process-tree drain.
+      }
+    },
+    {
+      concurrency: COMMAND_HELP_RENDER_CONCURRENCY,
+      stopOnError: false,
+    },
+  );
+  if (supervisor.signal.aborted) {
+    throw supervisor.firstFailure ?? supervisor.signal.reason;
+  }
+  return helpTexts as SourceCommandHelpText;
+}
+
+async function renderSourceSubcommandHelpTextRecord(
+  renderContext: RootHelpRenderContext,
+  supervisor: CliStartupMetadataRenderSupervisor,
+): Promise<PrecomputedSubcommandHelpText> {
+  const commandHelpText = await renderSourceCommandHelpTextRecord(
+    PRECOMPUTED_SUBCOMMAND_HELP_COMMANDS,
+    renderContext,
+    supervisor,
+  );
+  return Object.fromEntries(
+    PRECOMPUTED_SUBCOMMAND_HELP_COMMANDS.map((commandName) => [
+      commandName,
+      commandHelpText[commandName],
+    ]),
+  ) as PrecomputedSubcommandHelpText;
+}
+
+async function writeCliStartupMetadata(options?: {
+  distDir?: string;
+  outputPath?: string;
+  extensionsDir?: string;
+  sourceRootDir?: string;
+  renderBundledRootHelpText?: typeof renderBundledRootHelpText;
+  renderSourceRootHelpText?: SourceHelpRenderer;
+  renderSourceBrowserHelpText?: SourceHelpRenderer;
+  renderSourceSecretsHelpText?: SourceHelpRenderer;
+  renderSourceNodesHelpText?: SourceHelpRenderer;
+  renderSourceSubcommandHelpTextRecord?: SourceHelpRenderer<PrecomputedSubcommandHelpText>;
+}): Promise<void> {
+  const resolvedDistDir = options?.distDir ?? distDir;
+  const resolvedOutputPath = options?.outputPath ?? outputPath;
+  const resolvedExtensionsDir = options?.extensionsDir ?? extensionsDir;
+  const resolvedSourceRootDir = options?.sourceRootDir ?? rootDir;
+  const channelCatalog = readBundledChannelCatalog(resolvedExtensionsDir);
+  const bundleIdentity = resolveCliStartupRootHelpBundleIdentity(resolvedDistDir);
+  const browserHelpSourceSignature = resolveBrowserHelpSourceSignature(resolvedSourceRootDir);
+  const secretsHelpSourceSignature = resolveSecretsHelpSourceSignature(resolvedSourceRootDir);
+  const nodesHelpSourceSignature = resolveNodesHelpSourceSignature(resolvedSourceRootDir);
+  const subcommandHelpSourceSignature = resolveSubcommandHelpSourceSignature(resolvedSourceRootDir);
+  const bundledPluginsDir = path.join(resolvedDistDir, "extensions");
+  const channelOptions = dedupe([...CORE_CHANNEL_ORDER, ...channelCatalog.ids]);
+
+  let existing: ExistingCliStartupMetadata | undefined;
+  try {
+    existing = JSON.parse(readFileSync(resolvedOutputPath, "utf8")) as ExistingCliStartupMetadata;
+  } catch {
+    // Missing or malformed existing metadata means we should regenerate it.
+  }
+
+  const reusableExisting =
+    existing?.generatorSignature === generatorSignature &&
+    existing.channelCatalogSignature === channelCatalog.signature
+      ? existing
+      : undefined;
+  const reusableRootHelpText =
+    reusableExisting &&
+    bundleIdentity &&
+    reusableExisting.rootHelpBundleSignature === bundleIdentity.signature &&
+    typeof reusableExisting.rootHelpText === "string" &&
+    reusableExisting.rootHelpText.length > 0
+      ? reusableExisting.rootHelpText
+      : undefined;
+  const reusableBrowserHelpText =
+    reusableExisting &&
+    bundleIdentity &&
+    reusableExisting.rootHelpBundleSignature === bundleIdentity.signature &&
+    reusableExisting.browserHelpSourceSignature === browserHelpSourceSignature &&
+    typeof reusableExisting.browserHelpText === "string" &&
+    reusableExisting.browserHelpText.length > 0
+      ? reusableExisting.browserHelpText
+      : undefined;
+  const reusableSecretsHelpText =
+    reusableExisting &&
+    bundleIdentity &&
+    reusableExisting.rootHelpBundleSignature === bundleIdentity.signature &&
+    reusableExisting.secretsHelpSourceSignature === secretsHelpSourceSignature &&
+    typeof reusableExisting.secretsHelpText === "string" &&
+    reusableExisting.secretsHelpText.length > 0
+      ? reusableExisting.secretsHelpText
+      : undefined;
+  const reusableNodesHelpText =
+    reusableExisting &&
+    bundleIdentity &&
+    reusableExisting.rootHelpBundleSignature === bundleIdentity.signature &&
+    reusableExisting.nodesHelpSourceSignature === nodesHelpSourceSignature &&
+    typeof reusableExisting.nodesHelpText === "string" &&
+    reusableExisting.nodesHelpText.length > 0
+      ? reusableExisting.nodesHelpText
+      : undefined;
+  const reusableSubcommandHelpText =
+    reusableExisting &&
+    bundleIdentity &&
+    reusableExisting.rootHelpBundleSignature === bundleIdentity.signature &&
+    reusableExisting.subcommandHelpSourceSignature === subcommandHelpSourceSignature &&
+    hasAllPrecomputedSubcommandHelpText(reusableExisting.subcommandHelpText)
+      ? (reusableExisting.subcommandHelpText as PrecomputedSubcommandHelpText)
+      : undefined;
+  if (
+    reusableRootHelpText &&
+    reusableBrowserHelpText &&
+    reusableSecretsHelpText &&
+    reusableNodesHelpText &&
+    reusableSubcommandHelpText
+  ) {
+    return;
+  }
+
+  const renderStateDir = createRootHelpRenderStateDir();
+  const renderContext = createIsolatedRootHelpRenderContext(
+    existsSync(bundledPluginsDir) ? bundledPluginsDir : resolvedExtensionsDir,
+    renderStateDir,
+  );
+  const supervisor = new CliStartupMetadataRenderSupervisor();
+  const rootHelpTextPromise = reusableRootHelpText
+    ? Promise.resolve(reusableRootHelpText)
+    : supervisor.run(async (taskContext) =>
+        bundleIdentity
+          ? (options?.renderBundledRootHelpText ?? renderBundledRootHelpText)(
+              resolvedDistDir,
+              renderContext,
+              taskContext,
+            )
+          : // Missing built metadata is the only source-fallback contract. A built
+            // renderer failure is terminal and must cancel the whole render group.
+            (options?.renderSourceRootHelpText ?? renderSourceRootHelpText)(
+              renderContext,
+              taskContext,
+            ),
+      );
+  // Root help traverses the plugin metadata graph too; finish it before command
+  // fan-out so sibling cold boots cannot starve its bounded render.
+  const afterRootHelp = <T>(render: () => Awaitable<T>) => rootHelpTextPromise.then(render);
+  const runSourceRenderer = <T>(render: SourceHelpRenderer<T>) =>
+    afterRootHelp(() => supervisor.run((taskContext) => render(renderContext, taskContext)));
+  const hasCustomCommandRenderer =
+    options?.renderSourceBrowserHelpText ||
+    options?.renderSourceSecretsHelpText ||
+    options?.renderSourceNodesHelpText ||
+    options?.renderSourceSubcommandHelpTextRecord;
+  const sourceCommandsToRender: SourceCommandHelpCommand[] = [];
+  if (!reusableBrowserHelpText) {
+    sourceCommandsToRender.push("browser");
+  }
+  if (!reusableSecretsHelpText) {
+    sourceCommandsToRender.push("secrets");
+  }
+  if (!reusableNodesHelpText) {
+    sourceCommandsToRender.push("nodes");
+  }
+  if (!reusableSubcommandHelpText) {
+    sourceCommandsToRender.push(...PRECOMPUTED_SUBCOMMAND_HELP_COMMANDS);
+  }
+  const commandHelpTextPromise =
+    hasCustomCommandRenderer || sourceCommandsToRender.length === 0
+      ? null
+      : afterRootHelp(() =>
+          renderSourceCommandHelpTextRecord(sourceCommandsToRender, renderContext, supervisor),
+        );
+  const browserHelpTextPromise = reusableBrowserHelpText
+    ? Promise.resolve(reusableBrowserHelpText)
+    : commandHelpTextPromise
+      ? commandHelpTextPromise.then((commandHelpText) => commandHelpText.browser)
+      : runSourceRenderer(options?.renderSourceBrowserHelpText ?? renderSourceBrowserHelpText);
+  const secretsHelpTextPromise = reusableSecretsHelpText
+    ? Promise.resolve(reusableSecretsHelpText)
+    : commandHelpTextPromise
+      ? commandHelpTextPromise.then((commandHelpText) => commandHelpText.secrets)
+      : runSourceRenderer(options?.renderSourceSecretsHelpText ?? renderSourceSecretsHelpText);
+  const nodesHelpTextPromise = reusableNodesHelpText
+    ? Promise.resolve(reusableNodesHelpText)
+    : commandHelpTextPromise
+      ? commandHelpTextPromise.then((commandHelpText) => commandHelpText.nodes)
+      : runSourceRenderer(options?.renderSourceNodesHelpText ?? renderSourceNodesHelpText);
+  const subcommandHelpTextPromise = reusableSubcommandHelpText
+    ? Promise.resolve(reusableSubcommandHelpText)
+    : commandHelpTextPromise
+      ? commandHelpTextPromise.then(
+          (commandHelpText) =>
+            Object.fromEntries(
+              PRECOMPUTED_SUBCOMMAND_HELP_COMMANDS.map((commandName) => [
+                commandName,
+                commandHelpText[commandName],
+              ]),
+            ) as PrecomputedSubcommandHelpText,
+        )
+      : options?.renderSourceSubcommandHelpTextRecord
+        ? runSourceRenderer(options.renderSourceSubcommandHelpTextRecord)
+        : afterRootHelp(() => renderSourceSubcommandHelpTextRecord(renderContext, supervisor));
+  const [rootHelpText, browserHelpText, secretsHelpText, nodesHelpText, subcommandHelpText] =
+    await settleRootHelpRenderPromises(
+      [
+        rootHelpTextPromise,
+        browserHelpTextPromise,
+        secretsHelpTextPromise,
+        nodesHelpTextPromise,
+        subcommandHelpTextPromise,
+      ] as const,
+      renderStateDir,
+      supervisor,
+    );
+
+  const outputDir = fs.realpathSync(path.dirname(resolvedOutputPath));
+  replaceFileAtomicSync({
+    filePath: path.join(outputDir, path.basename(resolvedOutputPath)),
+    content: `${JSON.stringify(
+      {
+        generatedBy: "scripts/write-cli-startup-metadata.ts",
+        generatorSignature,
+        channelOptions,
+        channelCatalogSignature: channelCatalog.signature,
+        rootHelpBundleSignature: bundleIdentity?.signature ?? null,
+        browserHelpSourceSignature,
+        secretsHelpSourceSignature,
+        nodesHelpSourceSignature,
+        subcommandHelpSourceSignature,
+        browserHelpText,
+        secretsHelpText,
+        nodesHelpText,
+        subcommandHelpText,
+        rootHelpText,
+      },
+      null,
+      2,
+    )}\n`,
+    // Keep build artifact permissions; the atomic helper defaults to private files/directories.
+    mode: 0o666 & ~process.umask(),
+    dirMode: fs.statSync(outputDir).mode,
+    preserveExistingMode: true,
+  });
+}
+
+function hasAllPrecomputedSubcommandHelpText(value: unknown): boolean {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const record = value as Partial<Record<PrecomputedSubcommandHelpCommand, unknown>>;
+  return PRECOMPUTED_SUBCOMMAND_HELP_COMMANDS.every(
+    (commandName) => typeof record[commandName] === "string" && record[commandName].length > 0,
+  );
+}
+
+export const testing = {
+  renderSourceRootHelpText,
+  spawnText,
+  writeCliStartupMetadata,
+};
+
+if (process.argv[1] && path.resolve(process.argv[1]) === scriptPath) {
+  await writeCliStartupMetadata();
+}
diff --git a/scripts/write-official-channel-catalog.mts b/scripts/write-official-channel-catalog.mts
new file mode 100644
index 0000000000000000000000000000000000000000..25f00078f551208622f7733a922e465074b5454a
--- /dev/null
+++ b/scripts/write-official-channel-catalog.mts
@@ -0,0 +1,738 @@
+// Builds the generated official channel catalog from publishable channel plugins.
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { parse as parseYaml } from "yaml";
+import officialExternalChannelSeed from "./lib/official-external-channel-seed.json" with { type: "json" };
+import { collectExcludedPackagedExtensionDirs } from "./lib/packaged-extension-dirs.mts";
+import { isRecord, trimString } from "./lib/record-shared.mjs";
+import { writeTextFileIfChanged } from "./runtime-postbuild-shared.mjs";
+
+type CatalogParams = { repoRoot?: string; cwd?: string };
+type CatalogInstall = Partial<
+  Record<"clawhubSpec" | "npmSpec" | "localPath" | "minHostVersion" | "expectedIntegrity", string>
+> & {
+  defaultChoice?: "clawhub" | "npm" | "local";
+  allowInvalidConfigRecovery?: boolean;
+};
+type CatalogEntry = Partial<Record<"version" | "description" | "source" | "kind", string>> & {
+  name: string;
+  openclaw: {
+    plugin?: Record<string, unknown>;
+    setupFeatures?: Record<string, unknown>;
+    catalog?: Record<string, unknown>;
+    contracts?: Record<string, string[] | undefined>;
+    channel: Record<string, unknown>;
+    channelHostConfig?: Record<string, unknown>;
+    channelConfigs?: Record<string, { schema?: unknown; label?: string }>;
+    providerEndpoints?: Array<Record<string, unknown>>;
+    legacyNpmPackageNames?: string[];
+    install: CatalogInstall;
+  };
+};
+type CatalogOwnerEntry = { entry: CatalogEntry; owner: string };
+type RepositoryPackageJson = { dirName: string; packageJson: unknown; pluginManifest?: unknown };
+type ChannelDocsSource = "official" | "external" | "bundled" | "built-in";
+type ChannelDocsEntry = { id: string; docsPath: string; source: ChannelDocsSource };
+type CompleteChannelDocsEntry = ChannelDocsEntry & { label: string; summary: string };
+
+/** Generated official channel catalog committed for source and packaged runtime consumers. */
+export const OFFICIAL_CHANNEL_CATALOG_SOURCE_RELATIVE_PATH =
+  "scripts/lib/official-external-channel-catalog.json";
+export const OFFICIAL_CHANNEL_DOCS_INDEX_RELATIVE_PATH = "docs/channels/index.md";
+const OFFICIAL_CHANNEL_DOCS_NAV_RELATIVE_PATH = "docs/docs.json";
+
+/**
+ * Generated official channel catalog path in dist.
+ * @internal Directly tested script implementation detail.
+ */
+export const OFFICIAL_CHANNEL_CATALOG_RELATIVE_PATH = "dist/channel-catalog.json";
+
+const OFFICIAL_CHANNEL_DOCS_START_MARKER = "<!-- BEGIN GENERATED: official channel catalog -->";
+const OFFICIAL_CHANNEL_DOCS_END_MARKER = "<!-- END GENERATED: official channel catalog -->";
+const WEBCHAT_DOCS_ENTRY = {
+  id: "webchat",
+  docsPath: "/web/webchat",
+  source: "built-in",
+} satisfies ChannelDocsEntry;
+
+function readRepositoryPackageJsons(repoRoot: string) {
+  const extensionsRoot = path.join(repoRoot, "extensions");
+  if (!fs.existsSync(extensionsRoot)) {
+    return [];
+  }
+
+  const packageJsons: RepositoryPackageJson[] = [];
+  const extensionDirectories = fs
+    .readdirSync(extensionsRoot, { withFileTypes: true })
+    .filter((dirent) => dirent.isDirectory())
+    .toSorted((left, right) => left.name.localeCompare(right.name));
+  for (const dirent of extensionDirectories) {
+    const packageJsonPath = path.join(extensionsRoot, dirent.name, "package.json");
+    if (!fs.existsSync(packageJsonPath)) {
+      continue;
+    }
+    try {
+      const pluginManifestPath = path.join(extensionsRoot, dirent.name, "openclaw.plugin.json");
+      packageJsons.push({
+        dirName: dirent.name,
+        packageJson: JSON.parse(fs.readFileSync(packageJsonPath, "utf8")),
+        pluginManifest: fs.existsSync(pluginManifestPath)
+          ? JSON.parse(fs.readFileSync(pluginManifestPath, "utf8"))
+          : undefined,
+      });
+    } catch {
+      // Invalid package metadata must not prevent unrelated channels from being generated.
+    }
+  }
+  return packageJsons;
+}
+
+function readExcludedPackagedExtensionDirs(repoRoot: string) {
+  const packageJsonPath = path.join(repoRoot, "package.json");
+  if (!fs.existsSync(packageJsonPath)) {
+    return new Set();
+  }
+  const rootPackageJson: unknown = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"));
+  const files = isRecord(rootPackageJson) ? rootPackageJson.files : undefined;
+  return collectExcludedPackagedExtensionDirs({ files: Array.isArray(files) ? files : undefined });
+}
+
+function toCatalogInstall(value: unknown, packageName: string): CatalogInstall | null {
+  const install = isRecord(value) ? value : {};
+  const clawhubSpec = trimString(install.clawhubSpec);
+  const npmSpec = trimString(install.npmSpec) || packageName;
+  if (!clawhubSpec && !npmSpec) {
+    return null;
+  }
+  const rawDefaultChoice = trimString(install.defaultChoice);
+  const defaultChoice =
+    rawDefaultChoice === "clawhub" || rawDefaultChoice === "npm" || rawDefaultChoice === "local"
+      ? rawDefaultChoice
+      : undefined;
+  const minHostVersion = trimString(install.minHostVersion);
+  const expectedIntegrity = trimString(install.expectedIntegrity);
+  return {
+    ...(clawhubSpec ? { clawhubSpec } : {}),
+    ...(npmSpec ? { npmSpec } : {}),
+    ...(defaultChoice ? { defaultChoice } : {}),
+    ...(minHostVersion ? { minHostVersion } : {}),
+    ...(expectedIntegrity ? { expectedIntegrity } : {}),
+    ...(install.allowInvalidConfigRecovery === true ? { allowInvalidConfigRecovery: true } : {}),
+  };
+}
+
+function toCatalogContracts(value: unknown) {
+  if (!isRecord(value)) {
+    return null;
+  }
+  const contracts: Record<string, string[] | undefined> = {};
+  for (const [name, members] of Object.entries(value)) {
+    if (
+      members === undefined ||
+      (Array.isArray(members) && members.every((item) => typeof item === "string"))
+    ) {
+      contracts[name] = members;
+    }
+  }
+  return contracts;
+}
+
+function toCatalogChannelConfigs(value: unknown) {
+  if (!isRecord(value)) {
+    return null;
+  }
+  const channelConfigs: Record<string, { schema?: unknown }> = {};
+  for (const [channelId, config] of Object.entries(value)) {
+    if (isRecord(config)) {
+      channelConfigs[channelId] = config;
+    }
+  }
+  return channelConfigs;
+}
+
+function toCatalogProviderEndpoints(value: unknown) {
+  return Array.isArray(value) ? value.filter(isRecord) : null;
+}
+
+function toCatalogManifestFields(value: unknown) {
+  const manifest = isRecord(value) ? value : {};
+  const catalog = isRecord(manifest.catalog) ? manifest.catalog : null;
+  const contracts = toCatalogContracts(manifest.contracts);
+  const channelConfigs = toCatalogChannelConfigs(manifest.channelConfigs);
+  const providerEndpoints = toCatalogProviderEndpoints(manifest.providerEndpoints);
+  return {
+    ...(catalog ? { catalog } : {}),
+    ...(contracts ? { contracts } : {}),
+    ...(channelConfigs ? { channelConfigs } : {}),
+    ...(providerEndpoints ? { providerEndpoints } : {}),
+  };
+}
+
+function buildCatalogEntry(packageJson: unknown, pluginManifest: unknown): CatalogEntry | null {
+  if (!isRecord(packageJson)) {
+    return null;
+  }
+  const packageName = trimString(packageJson.name);
+  const manifest = isRecord(packageJson.openclaw) ? packageJson.openclaw : null;
+  const release = manifest && isRecord(manifest.release) ? manifest.release : null;
+  const channel = manifest && isRecord(manifest.channel) ? manifest.channel : null;
+  if (!packageName || !channel || release?.publishToNpm !== true) {
+    return null;
+  }
+  const install = toCatalogInstall(manifest?.install, packageName);
+  if (!install) {
+    return null;
+  }
+  const version = trimString(packageJson.version);
+  const description = trimString(packageJson.description);
+  return {
+    name: packageName,
+    ...(version ? { version } : {}),
+    ...(description ? { description } : {}),
+    source: "official",
+    kind: "channel",
+    openclaw: {
+      ...toCatalogManifestFields(pluginManifest),
+      channel,
+      install,
+    },
+  };
+}
+
+function getCatalogChannelId(entry: CatalogEntry) {
+  return trimString(entry.openclaw.channel.id) || trimString(entry.name);
+}
+
+function getCatalogChannelKey(entry: CatalogEntry) {
+  return getCatalogChannelId(entry).toLowerCase();
+}
+
+function setUniqueCatalogEntry(
+  entriesByChannelId: Map<string, CatalogOwnerEntry>,
+  entry: CatalogEntry,
+  owner: string,
+) {
+  const channelId = getCatalogChannelId(entry);
+  const channelKey = getCatalogChannelKey(entry);
+  if (!channelKey) {
+    throw new Error(`official channel catalog entry from ${owner} is missing a channel id`);
+  }
+  const existing = entriesByChannelId.get(channelKey);
+  if (existing) {
+    throw new Error(
+      `duplicate official channel id "${channelId}" from ${existing.owner} and ${owner}`,
+    );
+  }
+  entriesByChannelId.set(channelKey, { entry, owner });
+}
+
+function stripSeedOnlyDocsMetadata(entry: CatalogEntry): CatalogEntry {
+  const hostConfig = isRecord(entry.openclaw.channelHostConfig)
+    ? entry.openclaw.channelHostConfig
+    : null;
+  if (!hostConfig || !("docsInventory" in hostConfig)) {
+    return entry;
+  }
+  const runtimeHostConfig = { ...hostConfig };
+  delete runtimeHostConfig.docsInventory;
+  return {
+    ...entry,
+    openclaw: {
+      ...entry.openclaw,
+      channelHostConfig: runtimeHostConfig,
+    },
+  };
+}
+
+/**
+ * Collects publishable channel catalog entries from bundled and external channels.
+ * @internal Directly tested script implementation detail.
+ */
+export function buildOfficialChannelCatalog(params: CatalogParams = {}): {
+  entries: CatalogEntry[];
+} {
+  const repoRoot = params.cwd ?? params.repoRoot ?? process.cwd();
+  const seedEntriesByChannelId = new Map<string, CatalogOwnerEntry>();
+  for (const entry of Array.isArray(officialExternalChannelSeed.entries)
+    ? officialExternalChannelSeed.entries
+    : []) {
+    const defaultChoice = entry.openclaw.install.defaultChoice;
+    if (defaultChoice !== "clawhub" && defaultChoice !== "npm" && defaultChoice !== "local") {
+      throw new Error(`invalid install choice for official channel seed package "${entry.name}"`);
+    }
+    const channelConfigs = toCatalogChannelConfigs(entry.openclaw.channelConfigs);
+    if (!channelConfigs) {
+      throw new Error(`invalid channel configs for official channel seed package "${entry.name}"`);
+    }
+    const catalogEntry = {
+      ...entry,
+      openclaw: {
+        ...entry.openclaw,
+        channelConfigs,
+        install: { ...entry.openclaw.install, defaultChoice },
+      },
+    } satisfies CatalogEntry;
+    setUniqueCatalogEntry(
+      seedEntriesByChannelId,
+      stripSeedOnlyDocsMetadata(catalogEntry),
+      `scripts/lib/official-external-channel-seed.json package "${trimString(entry.name)}"`,
+    );
+  }
+
+  const repositoryEntriesByChannelId = new Map<string, CatalogOwnerEntry>();
+  for (const { dirName, packageJson, pluginManifest } of readRepositoryPackageJsons(repoRoot)) {
+    const entry = buildCatalogEntry(packageJson, pluginManifest);
+    if (entry) {
+      setUniqueCatalogEntry(
+        repositoryEntriesByChannelId,
+        entry,
+        `extensions/${dirName}/package.json`,
+      );
+    }
+  }
+
+  // Repository packages deliberately replace same-id external seeds when a
+  // channel moves in tree. Duplicates within either ownership class are errors.
+  const entriesByChannelId = new Map(seedEntriesByChannelId);
+  for (const [channelId, entry] of repositoryEntriesByChannelId) {
+    entriesByChannelId.set(channelId, entry);
+  }
+  const entries = [...entriesByChannelId.values()].map(({ entry }) => entry);
+  entries.sort((left, right) => {
+    const leftId = trimString(left.openclaw?.channel?.id) || left.name;
+    const rightId = trimString(right.openclaw?.channel?.id) || right.name;
+    return leftId.localeCompare(rightId);
+  });
+
+  return { entries };
+}
+
+function serializeOfficialChannelCatalog(catalog: { entries: readonly CatalogEntry[] }): string {
+  return [
+    "{",
+    '  "entries": [',
+    ...catalog.entries.map(
+      (entry, index) =>
+        `    ${JSON.stringify(entry)}${index === catalog.entries.length - 1 ? "" : ","}`,
+    ),
+    "  ]",
+    "}",
+    "",
+  ].join("\n");
+}
+
+function renderOfficialChannelCatalog(params: CatalogParams = {}) {
+  return serializeOfficialChannelCatalog(buildOfficialChannelCatalog(params));
+}
+
+export function writeOfficialChannelCatalog(params: CatalogParams = {}) {
+  const repoRoot = params.cwd ?? params.repoRoot ?? process.cwd();
+  const outputPath = path.join(repoRoot, OFFICIAL_CHANNEL_CATALOG_RELATIVE_PATH);
+  return writeTextFileIfChanged(outputPath, renderOfficialChannelCatalog({ repoRoot }));
+}
+
+export function writeOfficialChannelCatalogSource(params: CatalogParams = {}) {
+  const repoRoot = params.cwd ?? params.repoRoot ?? process.cwd();
+  const outputPath = path.join(repoRoot, OFFICIAL_CHANNEL_CATALOG_SOURCE_RELATIVE_PATH);
+  return writeTextFileIfChanged(outputPath, renderOfficialChannelCatalog({ repoRoot }));
+}
+
+export function checkOfficialChannelCatalogSource(params: CatalogParams = {}) {
+  const repoRoot = params.cwd ?? params.repoRoot ?? process.cwd();
+  const outputPath = path.join(repoRoot, OFFICIAL_CHANNEL_CATALOG_SOURCE_RELATIVE_PATH);
+  const current = fs.existsSync(outputPath) ? fs.readFileSync(outputPath, "utf8") : "";
+  return current === renderOfficialChannelCatalog({ repoRoot });
+}
+
+function toChannelDocsEntry(
+  entry: {
+    source?: string;
+    openclaw: {
+      channel: Record<string, unknown>;
+      channelHostConfig?: Record<string, unknown>;
+    };
+  },
+  sourceOverride?: ChannelDocsSource,
+) {
+  const channel = isRecord(entry.openclaw.channel) ? entry.openclaw.channel : null;
+  const hostConfig = isRecord(entry.openclaw.channelHostConfig)
+    ? entry.openclaw.channelHostConfig
+    : null;
+  const exposure = channel && isRecord(channel.exposure) ? channel.exposure : null;
+  if (!channel || exposure?.docs === false) {
+    return null;
+  }
+  const id = trimString(channel.id);
+  if (!id) {
+    return null;
+  }
+  const docsPath = trimString(channel.docsPath) || `/channels/${id}`;
+  const source = sourceOverride ?? (trimString(hostConfig?.docsSource) || trimString(entry.source));
+  return {
+    id,
+    docsPath,
+    source:
+      source === "external" || source === "bundled" || source === "built-in" ? source : "official",
+  } satisfies ChannelDocsEntry;
+}
+
+function readChannelDocsFrontmatter(repoRoot: string, entry: ChannelDocsEntry) {
+  const route = entry.docsPath.split(/[?#]/u, 1)[0]?.replace(/^\/+/u, "");
+  if (!route) {
+    throw new Error(`channel ${entry.id} has an invalid docs route: ${entry.docsPath}`);
+  }
+  const candidates = [
+    path.join(repoRoot, "docs", `${route}.md`),
+    path.join(repoRoot, "docs", `${route}.mdx`),
+  ];
+  const docsPath = candidates.find((candidate) => fs.existsSync(candidate));
+  if (!docsPath) {
+    throw new Error(`channel ${entry.id} docs route does not resolve: ${entry.docsPath}`);
+  }
+  const content = fs.readFileSync(docsPath, "utf8");
+  const frontmatterMatch = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/u.exec(content);
+  if (!frontmatterMatch) {
+    throw new Error(`${path.relative(repoRoot, docsPath)} is missing YAML frontmatter`);
+  }
+  const frontmatter: unknown = parseYaml(frontmatterMatch[1] ?? "");
+  const label = trimString(isRecord(frontmatter) ? frontmatter.title : undefined);
+  const summary = trimString(isRecord(frontmatter) ? frontmatter.summary : undefined);
+  if (!label || !summary) {
+    throw new Error(`${path.relative(repoRoot, docsPath)} must define title and summary`);
+  }
+  return { ...entry, label, summary };
+}
+
+function isInstallableChannelManifest(manifest: Record<string, unknown>) {
+  const release = isRecord(manifest.release) ? manifest.release : null;
+  const install = isRecord(manifest.install) ? manifest.install : null;
+  return (
+    release?.publishToNpm === true ||
+    release?.publishToClawHub === true ||
+    Boolean(trimString(install?.npmSpec) || trimString(install?.clawhubSpec))
+  );
+}
+
+/**
+ * Builds the public docs projection from the install catalog plus bundled channel manifests.
+ * @internal Directly tested script implementation detail.
+ */
+export function buildOfficialChannelDocsCatalog(params: CatalogParams = {}): {
+  entries: CompleteChannelDocsEntry[];
+} {
+  const repoRoot = params.cwd ?? params.repoRoot ?? process.cwd();
+  const entriesByChannelId = new Map<string, ChannelDocsEntry>();
+  const excludedPackagedExtensionDirs = readExcludedPackagedExtensionDirs(repoRoot);
+
+  for (const entry of buildOfficialChannelCatalog({ repoRoot }).entries) {
+    const docsEntry = toChannelDocsEntry(entry);
+    if (docsEntry) {
+      entriesByChannelId.set(docsEntry.id, docsEntry);
+    }
+  }
+
+  for (const { dirName, packageJson } of readRepositoryPackageJsons(repoRoot)) {
+    const manifest =
+      isRecord(packageJson) && isRecord(packageJson.openclaw) ? packageJson.openclaw : {};
+    const channel = isRecord(manifest.channel) ? manifest.channel : null;
+    if (!channel) {
+      continue;
+    }
+    const exposure = isRecord(channel.exposure) ? channel.exposure : null;
+    const isCoreBundled = !excludedPackagedExtensionDirs.has(dirName);
+    const isInstallable = isInstallableChannelManifest(manifest);
+    if (!isCoreBundled && !isInstallable) {
+      if (exposure?.docs === false) {
+        continue;
+      }
+      throw new Error(
+        `docs-visible channel ${trimString(channel.id) || dirName} is neither bundled nor installable`,
+      );
+    }
+    const docsEntry = toChannelDocsEntry(
+      { openclaw: { channel } },
+      isCoreBundled ? "bundled" : "official",
+    );
+    if (docsEntry) {
+      entriesByChannelId.set(docsEntry.id, docsEntry);
+    }
+  }
+
+  entriesByChannelId.set(WEBCHAT_DOCS_ENTRY.id, WEBCHAT_DOCS_ENTRY);
+  const entries = [...entriesByChannelId.values()].map((entry) =>
+    readChannelDocsFrontmatter(repoRoot, entry),
+  );
+  entries.sort(
+    (left, right) =>
+      left.label.localeCompare(right.label, "en") || left.id.localeCompare(right.id, "en"),
+  );
+  return { entries };
+}
+
+function renderChannelDocsSummary(entry: CompleteChannelDocsEntry) {
+  const summary = entry.summary.replace(/[.!?]+$/u, "");
+  const normalizedSummary = summary
+    ? `${summary.slice(0, 1).toUpperCase()}${summary.slice(1)}`
+    : `${entry.label} messaging for OpenClaw`;
+  const sourceLabel =
+    entry.source === "external"
+      ? "external plugin"
+      : entry.source === "bundled"
+        ? "bundled plugin"
+        : entry.source === "built-in"
+          ? "included in core"
+          : "official plugin";
+  return `- [${entry.label}](${entry.docsPath}) - ${normalizedSummary} (${sourceLabel}).`;
+}
+
+function renderOfficialChannelDocsBlock(params: CatalogParams = {}) {
+  const repoRoot = params.cwd ?? params.repoRoot ?? process.cwd();
+  const lines = buildOfficialChannelDocsCatalog({ repoRoot }).entries.map(renderChannelDocsSummary);
+  return [
+    OFFICIAL_CHANNEL_DOCS_START_MARKER,
+    "<!-- Generated by `pnpm channels:catalog:gen`. Edit manifests/seed for membership and routes; edit page frontmatter for public names and summaries. -->",
+    "",
+    ...lines,
+    "",
+    OFFICIAL_CHANNEL_DOCS_END_MARKER,
+  ].join("\n");
+}
+
+function replaceOfficialChannelDocsBlock(current: string, block: string) {
+  const startIndex = current.indexOf(OFFICIAL_CHANNEL_DOCS_START_MARKER);
+  const endIndex = current.indexOf(OFFICIAL_CHANNEL_DOCS_END_MARKER);
+  const startCount = current.split(OFFICIAL_CHANNEL_DOCS_START_MARKER).length - 1;
+  const endCount = current.split(OFFICIAL_CHANNEL_DOCS_END_MARKER).length - 1;
+  if (
+    startCount !== 1 ||
+    endCount !== 1 ||
+    startIndex === -1 ||
+    endIndex === -1 ||
+    endIndex < startIndex
+  ) {
+    throw new Error(
+      `${OFFICIAL_CHANNEL_DOCS_INDEX_RELATIVE_PATH} must contain exactly one generated channel marker pair`,
+    );
+  }
+  const afterEndIndex = endIndex + OFFICIAL_CHANNEL_DOCS_END_MARKER.length;
+  return `${current.slice(0, startIndex)}${block}${current.slice(afterEndIndex)}`;
+}
+
+export function renderOfficialChannelDocsIndex(params: CatalogParams = {}) {
+  const repoRoot = params.cwd ?? params.repoRoot ?? process.cwd();
+  const outputPath = path.join(repoRoot, OFFICIAL_CHANNEL_DOCS_INDEX_RELATIVE_PATH);
+  const current = fs.readFileSync(outputPath, "utf8");
+  return replaceOfficialChannelDocsBlock(current, renderOfficialChannelDocsBlock({ repoRoot }));
+}
+
+export function writeOfficialChannelDocsIndex(params: CatalogParams = {}) {
+  const repoRoot = params.cwd ?? params.repoRoot ?? process.cwd();
+  const outputPath = path.join(repoRoot, OFFICIAL_CHANNEL_DOCS_INDEX_RELATIVE_PATH);
+  return writeTextFileIfChanged(outputPath, renderOfficialChannelDocsIndex({ repoRoot }));
+}
+
+export function checkOfficialChannelDocsIndex(params: CatalogParams = {}) {
+  const repoRoot = params.cwd ?? params.repoRoot ?? process.cwd();
+  const outputPath = path.join(repoRoot, OFFICIAL_CHANNEL_DOCS_INDEX_RELATIVE_PATH);
+  if (!fs.existsSync(outputPath)) {
+    return false;
+  }
+  const current = fs.readFileSync(outputPath, "utf8");
+  try {
+    return current === renderOfficialChannelDocsIndex({ repoRoot });
+  } catch {
+    return false;
+  }
+}
+
+function collectDocsNavPageCounts(node: unknown, counts: Map<string, number> = new Map()) {
+  if (Array.isArray(node)) {
+    for (const item of node) {
+      collectDocsNavPageCounts(item, counts);
+    }
+    return counts;
+  }
+  if (!isRecord(node)) {
+    return counts;
+  }
+  if (Array.isArray(node.pages)) {
+    for (const page of node.pages) {
+      if (typeof page === "string") {
+        const route = page.replace(/^\/+/u, "");
+        counts.set(route, (counts.get(route) ?? 0) + 1);
+      } else {
+        collectDocsNavPageCounts(page, counts);
+      }
+    }
+  }
+  for (const value of Object.values(node)) {
+    if (value !== node.pages) {
+      collectDocsNavPageCounts(value, counts);
+    }
+  }
+  return counts;
+}
+
+function findEnglishChannelsTab(docsConfig: unknown) {
+  const navigation =
+    isRecord(docsConfig) && isRecord(docsConfig.navigation) ? docsConfig.navigation : null;
+  const languages = Array.isArray(navigation?.languages) ? navigation.languages : [];
+  const english = languages.find(
+    (language) => isRecord(language) && trimString(language.language) === "en",
+  );
+  const tabs = isRecord(english) && Array.isArray(english.tabs) ? english.tabs : [];
+  return tabs.find((tab) => isRecord(tab) && trimString(tab.tab) === "Channels") ?? null;
+}
+
+function readDocsNavCounts(repoRoot: string) {
+  const navPath = path.join(repoRoot, OFFICIAL_CHANNEL_DOCS_NAV_RELATIVE_PATH);
+  const docsConfig: unknown = JSON.parse(fs.readFileSync(navPath, "utf8"));
+  return {
+    all: collectDocsNavPageCounts(docsConfig),
+    channels: collectDocsNavPageCounts(findEnglishChannelsTab(docsConfig)),
+  };
+}
+
+function buildHiddenChannelDocsRoutes(repoRoot: string) {
+  const channelsById = new Map<string, Record<string, unknown>>();
+  for (const entry of Array.isArray(officialExternalChannelSeed.entries)
+    ? officialExternalChannelSeed.entries
+    : []) {
+    const channel = isRecord(entry?.openclaw?.channel) ? entry.openclaw.channel : null;
+    const channelId = trimString(channel?.id);
+    if (channelId && channel) {
+      channelsById.set(channelId, channel);
+    }
+  }
+  for (const { packageJson } of readRepositoryPackageJsons(repoRoot)) {
+    const manifest =
+      isRecord(packageJson) && isRecord(packageJson.openclaw) ? packageJson.openclaw : {};
+    const channel = isRecord(manifest.channel) ? manifest.channel : null;
+    const channelId = trimString(channel?.id);
+    if (channelId && channel) {
+      channelsById.set(channelId, channel);
+    }
+  }
+
+  const routes = new Set<string>();
+  for (const channel of channelsById.values()) {
+    const exposure = isRecord(channel.exposure) ? channel.exposure : null;
+    const docsPath = trimString(channel.docsPath);
+    if (exposure?.docs !== false || !docsPath.startsWith("/")) {
+      continue;
+    }
+    const route = docsPath.split("#", 1)[0]?.replace(/^\/+/u, "");
+    if (route) {
+      routes.add(route);
+    }
+  }
+  return routes;
+}
+
+export function findMissingOfficialChannelDocsNavRoutes(params: CatalogParams = {}) {
+  const repoRoot = params.cwd ?? params.repoRoot ?? process.cwd();
+  const navCounts = readDocsNavCounts(repoRoot);
+  const missing = new Set<string>();
+  for (const entry of buildOfficialChannelDocsCatalog({ repoRoot }).entries) {
+    if (!entry.docsPath.startsWith("/")) {
+      continue;
+    }
+    const route = entry.docsPath.split("#", 1)[0]?.replace(/^\/+/u, "");
+    const counts = route?.startsWith("channels/") ? navCounts.channels : navCounts.all;
+    if (route && (counts.get(route) ?? 0) === 0) {
+      missing.add(route);
+    }
+  }
+  return [...missing].toSorted((left, right) => left.localeCompare(right, "en"));
+}
+
+export function findUnexpectedOfficialChannelDocsNavRoutes(params: CatalogParams = {}) {
+  const repoRoot = params.cwd ?? params.repoRoot ?? process.cwd();
+  const navCounts = readDocsNavCounts(repoRoot).all;
+  return [...buildHiddenChannelDocsRoutes(repoRoot)]
+    .filter((route) => (navCounts.get(route) ?? 0) > 0)
+    .toSorted((left, right) => left.localeCompare(right, "en"));
+}
+
+export function findDuplicateOfficialChannelDocsNavRoutes(params: CatalogParams = {}) {
+  const repoRoot = params.cwd ?? params.repoRoot ?? process.cwd();
+  const navCounts = readDocsNavCounts(repoRoot).all;
+  const duplicateRoutes = new Set<string>();
+  for (const entry of buildOfficialChannelDocsCatalog({ repoRoot }).entries) {
+    const route = entry.docsPath.split("#", 1)[0]?.replace(/^\/+/u, "");
+    if (route && (navCounts.get(route) ?? 0) > 1) {
+      duplicateRoutes.add(route);
+    }
+  }
+  return [...duplicateRoutes].toSorted((left, right) => left.localeCompare(right, "en"));
+}
+
+function reportOfficialChannelDocsNavIssues(params: CatalogParams = {}) {
+  const issueGroups = [
+    {
+      label: "is missing channel routes",
+      routes: findMissingOfficialChannelDocsNavRoutes(params),
+    },
+    {
+      label: "exposes hidden channel routes",
+      routes: findUnexpectedOfficialChannelDocsNavRoutes(params),
+    },
+    {
+      label: "duplicates channel routes",
+      routes: findDuplicateOfficialChannelDocsNavRoutes(params),
+    },
+  ];
+  let failed = false;
+  for (const issue of issueGroups) {
+    if (issue.routes.length === 0) {
+      continue;
+    }
+    console.error(
+      `${OFFICIAL_CHANNEL_DOCS_NAV_RELATIVE_PATH} ${issue.label}: ${issue.routes.join(", ")}`,
+    );
+    failed = true;
+  }
+  return failed;
+}
+
+function main(argv: string[] = process.argv.slice(2)) {
+  const write = argv.includes("--write");
+  const check = argv.includes("--check");
+  if (write === check) {
+    console.error("usage: node scripts/write-official-channel-catalog.mjs --write|--check");
+    process.exitCode = 2;
+    return;
+  }
+  if (write) {
+    writeOfficialChannelCatalogSource();
+    writeOfficialChannelDocsIndex();
+    if (reportOfficialChannelDocsNavIssues()) {
+      process.exitCode = 1;
+    }
+    return;
+  }
+  let failed = false;
+  if (!checkOfficialChannelCatalogSource()) {
+    console.error(
+      `${OFFICIAL_CHANNEL_CATALOG_SOURCE_RELATIVE_PATH} is stale. Run \`pnpm channels:catalog:gen\`.`,
+    );
+    failed = true;
+  }
+  if (!checkOfficialChannelDocsIndex()) {
+    console.error(
+      `${OFFICIAL_CHANNEL_DOCS_INDEX_RELATIVE_PATH} is stale. Run \`pnpm channels:catalog:gen\`.`,
+    );
+    failed = true;
+  }
+  if (reportOfficialChannelDocsNavIssues()) {
+    failed = true;
+  }
+  if (failed) {
+    process.exitCode = 1;
+  }
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+  main();
+}
diff --git a/scripts/write-package-dist-inventory.ts b/scripts/write-package-dist-inventory.ts
new file mode 100644
index 0000000000000000000000000000000000000000..c8a4c39c0d4d722e4ee1c72435d48c1d6c8aba06
--- /dev/null
+++ b/scripts/write-package-dist-inventory.ts
@@ -0,0 +1,11 @@
+#!/usr/bin/env -S node --import tsx
+// Write Package Dist Inventory script supports OpenClaw repository automation.
+
+import { fileURLToPath } from "node:url";
+import { isMainModule } from "../src/infra/is-main.ts";
+import { writePackageDistInventoryForPublish } from "./lib/package-dist-inventory.ts";
+
+// Match argv only; PM2 hints must not turn an import into a package write.
+if (isMainModule({ currentFile: fileURLToPath(import.meta.url), env: {} })) {
+  await writePackageDistInventoryForPublish(process.cwd());
+}
diff --git a/scripts/write-plugin-sdk-entry-dts.ts b/scripts/write-plugin-sdk-entry-dts.ts
new file mode 100644
index 0000000000000000000000000000000000000000..cb6fbbc9545e5855a51db247cb145967b6c6bafc
--- /dev/null
+++ b/scripts/write-plugin-sdk-entry-dts.ts
@@ -0,0 +1,19 @@
+// CI artifacts use the same SDK declaration partitions as full/package builds.
+import fs from "node:fs";
+import { listCacheFiles } from "./lib/build-artifact-cache.mts";
+import { TSDOWN_PLUGIN_SDK_DTS_CONFIG_GROUPS } from "./lib/tsdown-config-groups.mts";
+import { writeTsdownDeclarations } from "./lib/tsdown-declaration-writer.mts";
+import { TSDOWN_DECLARATION_EXTENSIONS } from "./tsdown-build.mts";
+
+await writeTsdownDeclarations(
+  TSDOWN_PLUGIN_SDK_DTS_CONFIG_GROUPS,
+  "tsdown-plugin-sdk",
+  (root) =>
+    // This subset owns flat SDK entries, never other groups' shared root chunks.
+    listCacheFiles(
+      root,
+      [{ path: "dist/plugin-sdk", extensions: TSDOWN_DECLARATION_EXTENSIONS, recursive: false }],
+      fs,
+    ),
+  "scripts/write-plugin-sdk-entry-dts.ts",
+);