Darwin killpg excludes zombies and returns EPERM when no signalable group
member remains. Strict normal-exit cleanup mistook this terminal state for
a surviving process group, even when later drainage observed termination.
Reuse the existing zombie census for Darwin, including BSD state flags,
and reconcile a group reaped during the census with a fresh ESRCH probe.
Both observation and termination require positive completion evidence;
live, mixed, and uninspectable groups retain their cleanup failures.
Keep snapshot work inside the existing escalation and drainage deadlines.
Native same-uid Z and ZN groups reproduce EPERM for signal 0 and SIGKILL.
The original owner fails four regression cases; the repair passes all 13.
Shared owner/output tests pass (146 passed, one platform skip). The full
mac-elevation-host shard passes all 123 cases in 383.63s; final metadata
replay passes all 13 selected cases. Independent review is scoped-clean.
Production delta: +44 lines for bounded Darwin termination evidence.
Test cost: node scripts/run-vitest.mjs test/scripts/managed-child-process.termination.test.ts --maxWorkers=1: 5.83s wall; node scripts/run-vitest.mjs test/scripts/managed-child-process.tree.test.ts --maxWorkers=1: 5.05s wall.
* fix(cli): release plugin resources when help finishes
Uncached CLI metadata loads now use the existing inspection acquisition when an executable invocation owns them. The source-plugin regression verifies that invocation release joins module disposal. Caller-owned programs retain their existing lifetime.
* fix(plugins): release retired registry preparation scope
Create the aggregate retirement observer outside the registry preparation
scope so it retains only child waiters. Preserve per-observation options,
cleanup ordering, failure identity, and deferred consumer results.
The unchanged cold registry-retention regression failed on the CI Bun
runtime before this change and passes after it. The original seven-file
shard passes all 172 cases, and Node retirement coverage passes 20 cases.
* fix(ci): carry the chat attachment lint repair
Carry the exact two-file fix from 2e95cdba84
(#160159). Move the unchanged image decoder into its existing helper
to restore the 700-line limit without changing attachment behavior.
Targeted lint and all 21 attachment tests pass on this candidate.
Independent review found no actionable defects.
* test: retain complete lifecycle helpers in lease fixtures
* test: isolate local command fixtures and join recovery cleanup
* test(ci): preserve CLI runtime ownership and harness staging
Keep the moved CLI command fixture in its runtime prerequisite group and
preserve complete agent coverage across the core and CLI process owners.
Carry the test-only trusted-harness fixture fix from #160024.
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
* fix(tests): scope Vitest preload to test workers
Apply the jsdom adapter only at Vitest worker entry points while preserving
package-local runtime resolution. Ordinary Workers may inherit the preload
without having a Vitest dependency. Exercise default native inheritance and
await worker termination.
Copy the static-check evidence helper into lint fixtures so the real oxlint
entry point can load its current import closure.
Validation: reproduced both original failure causes before repair; all 76
affected tests pass (351.44 seconds in Vitest), as do canonical changed-file
checks and independent review.
* test: isolate public runtime surface planning fixtures
Verify public runtime entries and packaged assets with a synthetic publishable plugin after the Diffs forwarding APIs were retired. Preserve the existing planner assertions without depending on one bundled plugin layout.
* fix(ci): carry shared lint repairs into CLI preparation
* test(tooling): repair extracted PR and npm fixtures
* test: retain gateway cleanup and isolate Windows temp paths
Close the prewarm gateway when client connection fails and retain cleanup
errors during orphaned recovery. Keep Windows-under-Bun coverage on
host-owned temporary directories, matching the fixture fix in #160985.
Validation: 13 focused fixture tests and canonical changed-file checks.
* fix(ci): keep extracted manifest within script contracts
Resolve inherited manifest lint errors without changing job selection. Move its closed true/1 flag parsing to the dependency-free argument owner and include that helper in trusted fixture copies. Validation passed 718 tests with eight existing skips, canonical changed checks, fixture lint, and independent review. The 74-case argument helper file took 1.79 seconds at one worker with warm inputs.
* test(state): apply upstream snapshot custody fixture isolation
Reuse the fixture repair from #161598 (af16b80a22). Keep the real exit callback and every custody assertion while isolating the synthetic cleanup owner from preceding files.
* test(pr): drain fake GitHub streams before exit
---------
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
Select the simulator before compilation, then boot and slim that exact
simulator alongside the app build. Join preparation before XCTest, retain
its failure log, and bound a hung join without changing test selection or
build settings.
Validate both focused groups on cold and warm native runs (139 tests each),
plus preparation failure and timeout controls. Linux proof includes full
test types, the whole tooling config, changed checks, source contracts,
and both preflight harness shapes for PR and scheduled-main inputs.
Use the shared ampersand-last decoder in native and Apple localization tooling, and inline the JSON.stringify forwarding helper. Preserve generated strings and catalogs without modifying locale or generated files.
Use structured Tool Search config from 2026.9.7 while retaining the legacy code-mode migration specimen for older baselines. Read the existing coverage receipt version for baseline assertions; keep post-upgrade cleanup checks strict.
The legacy-operator survivor lane can reach a forced Gateway exit with a
detached child still in the unit cgroup. Its synthetic manager drained only
the original process group and cleared custody, so the strict stop verifier
correctly refused before the no-op updater was invoked. This predates the
SQLite predecessor-receipt migration and host-lifetime changes.
Honor the loaded KillMode=mixed policy in the existing manager: TERM the
main process, escalate remaining unit members after its exit or the loaded
deadline, then join group and cgroup extinction before exit or restart.
Track native PID/start-time identities and recheck exact membership before
signaling. The existing observer also settles newly discovered members.
Keep all deadlines, containment permissions, stop assertions and backup
custody unchanged.
Concurrent config write during admission: production warning and re-read
behavior is unchanged; this repair only corrects service-manager fixtures.
Doctor sees its own finished update row: production terminal settlement and
original-state capture are unchanged, and the survivor Doctor proof passes.
Published driver x candidate: the same 2026.9.6 driver, 2026.9.7 candidate
and plugin registry are used before and after. The no-op stop, already-
current update, foreground survival, Doctor and backup rollback pass.
The real cgroup negative control fails with a surviving detached child;
the repaired manager empties the cgroup while preserving an unrelated
process. Twenty concurrent real cgroup probes pass. The stop-policy suite
retains every prior case and assertion; its 21 Linux cases cost 3.73s.
Validation: whole tooling ran 909 files: 901 passed; the only three failing
cases were the SDK export leak fixed by the preceding commit, then proved
11/11 on the same Linux lease. Whole tooling-docker passed 150 cases;
all six helper importers and 20 pressured new-regression runs are covered.
Legacy before passed in 1170.22s. After replays passed in 1453.89s and
940.18s; one earlier replay failed during published-baseline startup,
before candidate installation. That unrelated timeout remains recorded.
Changed lint, boundary lint and independent review through P2 pass.
Use the existing memory retrieval pool for noncreating index selection, counts, and vector inspection. Capture caller placement and matching facts before dispatch, share the existing scrub rules, and return only selected row identities and counts. Keep final lineage checks and write settlement with their existing transaction owner.
Validation: causal host count regression, 150 owning tests, native fetched-row and byte bounds, captured-input and read-error controls, full changed-file gate, and independent review.
* perf(state): retire periodic runtime integrity scans
Remove delayed and daily full-database scans from the Gateway while preserving requested agent quick checks, live-owner confirmation, and quarantine. Keep full verification with admission, migrations, and Doctor maintenance. No config or schema migration is required.
* fix(update): restore Windows task autostart after cancellation
Carry the existing restoration phase through Windows task recovery so SIGINT fences forward work without rejecting compensation. Preserve executor and native task ownership checks before side effects.
The original 40-file CI shard reproduced 821 passes and one SIGINT failure; it passes all 822 tests with this change. Testbox focused tests and changed checks passed, and independent Codex review found no actionable findings.
* fix(plugin-sdk): keep updater path context private
Pin the legacy home-directory facade to its existing eight exports so new internal updater helpers do not become public SDK contracts. Reduce the wildcard ratchet by one without expanding export or callable budgets.
All 11 SDK surface tests passed against the exact failed CI merge plus this fix on Testbox, along with core/script types, targeted lint, export guards, and formatting. Independent Codex review found no actionable findings.
* fix(update): keep recovery imports within their owners
Separate fixed public error codes from executable diagnostic catalogs. Move the existing active handoff map, lease reader, and current-process observer together so callers do not import the service launcher to inspect an existing handoff.
Preserve public identifiers, sanitization, store selection, lease validation, and sealed recovery behavior. Guard the production bundle against capturing Doctor and service controllers, with staged repair and retirement coverage.
* fix(tooling): include update codes in native wrapper inventory
* fix(ci): bound isolated Gateway fixture workers
Keep the Gateway isolated/database-worker cohort at its existing two-worker budget so cold startup has room within unchanged test deadlines. Preserve former eight-worker complete generations as conservative timing floors without relabeling them as current measurements.
Validation: 325 owning tests, selected changed checks, and fresh managed review. Generated job counts and coverage are unchanged. Exact changed CI remains required.
(cherry picked from commit 30e80e790d)
* test(ci): isolate runtime placement pricing fixtures
Control spare compact capacity and the two workload inputs before asserting co-location. Restore the real runtime timing reader so refitted observations still force the overloaded workloads into separate rows.
Validation: 207 owning cases passed; removing the refitted observations fails the after-placement assertion. Restored-case verification, selected checks, and fresh managed review passed.
(cherry picked from commit 450dba2dc6)
The generated Codex protocol probe still imported a private type alias removed from the maintained protocol barrel. Derive the edit type from the existing config/batchWrite request contract while preserving the upstream ConfigEdit assignability assertion.
The real pinned upstream generator reproduces TS2305 on the base and passes the maintained type probe after this fix. The 11 pre-existing JSON schema diagnostics remain identical. Focused tests, changed-file checks, independent review, fresh cycle checks, and import-boundary tests pass; schemas and runtime contracts are unchanged.
* test(copilot): deslop t0366 tests
* test(config): deslop t0377 tests
* test(plugins): deslop t0368 tests
* test(auth): deslop t0381 tests
* test(ui): deslop t0382 tests
* test(release): deslop t0384 tests
Port the shard while preserving newer SDK acknowledgement coverage and all six strengthened trusted-tooling cleanup scenarios.
Validation: 109 tests passed with no skips on Blacksmith Testbox from a fresh-main proof checkout; oxlint, oxfmt, diff checks, and independent review passed.
* test(agents): deslop t0369 tests
Port 2533d418dcab93da1aec73ee224072e29402ba08 onto the campaign lane, preserving all 25 test blocks changed on the lane and its four test removals. Retain the existing max-lines baseline because preserving that coverage keeps the planner suite above the limit.
Validation: all 60 tests passed on Blacksmith Testbox from a fresh-main proof checkout, with no skips. Scoped oxlint, oxfmt, diff checks, and independent review passed.
* test(pdf): deslop t0374 tests
* test(auto-reply): deslop t0378 tests
* test(gateway): deslop t0371 tests
* test: preserve persistence and release workflow coverage
Retain cold logout reload, persisted plugin-state reopening, and real workflow-input compatibility while keeping the batch test reductions.
Main can advance during prior-CI verification, leaving the final local-only
reread without its newly observed commit. Return that exact tip to bounded
pre-authority qualification instead of requiring another operator attempt.
Require Git's successful raw-object missing result with empty stderr and
readable previous/verified pins. Discard the active authority proof before
materializing, preserve the captured tip as an ancestry lower bound, and
rerun full live verification against the original proof fingerprint. Refuse
after three rounds without intent or dispatch. REST brackets stay unchanged.
Validation: original two regressions fail; all 47 final main-owner cases and both
confirmed cancelled-auto recovery cases pass, including revoked authority/evidence and
retained history. 47 REST sibling cases pass; one unchanged quota scenario returned
143 under its existing 20s fixture limit after merge/audit/comment and branch
deletions. That failed invocation is retained, not counted as full completion;
no deadline was increased. Initial truncated negative runs are also retained.
The ClawHub release planner and prepared-artifact resolver read the new public publication-state endpoint (/api/v1/packages/{name}/versions/{version}/publication). Only absent versions are republished; pending ones are skipped, and failed ones are excluded, with the recover command printed to the step summary. A 404, or a 200 without a state field, falls back to the legacy version probe.
A CI job can finish cancelled after its real-Gateway test step has already
failed. Preserve that failed step as an independently attributed root rather
than refusing its audited UI workflow family or treating it as collateral.
Bind the existing failedStep evidence to the exact UI command, private-QA
build, matrix selection, live check-run and ordered source steps. Recognize
only the explicit runner setup/cleanup pair, and retain all source, review,
security and cancellation checks. Cancelled coverage remains unrun.
Validation: both UI admission cases fail on the original owner; 66 combined
UI/Node/production-type cases pass, followed by 21 final UI cases including
cleanup refusals. The real retained job's 17-step sequence matches the
12-step source workflow plus its explicit runner prelude/postlude.
Share filesystem core package discovery with npm bundle preparation. Include every selected core package in beta-floor diagnostics and block postpublish on any core floor failure, while preserving reused and superseded core selectors.
Replace 46 repeated protocol-check records with an ordered file-to-snippets map and import the canonical JSON normalizer directly. Reuse canonical environment snapshot/restoration and oversized-response errors in the standalone MCP proof.
Preserves protocol assertions, diagnostic order, generated probe bytes, CLI contracts, and cleanup behavior. Removes 125 net tooling lines. Verified with independent review, zero import cycles, focused tests and import boundaries, check-changed, and a full Linux Testbox build.
Keep the Gateway isolated/database-worker cohort at its existing two-worker budget so cold startup has room within unchanged test deadlines. Preserve former eight-worker complete generations as conservative timing floors without relabeling them as current measurements.
Validation: 325 owning tests, selected changed checks, and fresh managed review. Generated job counts and coverage are unchanged. Exact changed CI remains required.
* fix(update): settle service receipts and interrupted rollback
Await the existing bound worker phase receipt before native service stop,
then revalidate the original executor/requester. Retain already admitted
compensation through signal settlement, including its later phase writes,
without retaining the unbounded forward operation.
Keep current-core and rollback authority policies distinct. Preserve the
existing ledger kernel, records, schema and recovery semantics.
Related: #161385
Canonical stale-baseline context: #161766
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
* fix(test): register post-update worker fixture once
Keep its existing worker registration instead of adding a duplicate that
prevents CI compact timing generation. Preserve the strict uniqueness
guard and the three newly required worker routes.
The actual CI merge failed manifest generation and its existing registry
regression; the baseline and one-entry correction passed the same selector.
* test(update): retain real owners in module failure fixtures
Load the mutable-signal and execution-guard owners in the existing VM
fixture so post-update failures reach their original backup-retention
assertions. Keep all19 inner cases and the synthetic service boundary.
The original three-file CI group failed on the unexpected dependency call;
the two real-module additions restore17 outer passes and19 inner passes.
---------
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
Report the previous-main, reread-main, or verified-main OID and Git exit
status when the final local-only commit check refuses admission. Sanitize
stderr through the existing redactor before bounded JSON-escaped display,
and use the selected trusted wrapper's loader configuration.
Keep probe ordering, no-lazy-fetch enforcement, authority checks, and merge
refusal unchanged. Cover all three roles, unavailable commits, unsupported
Git, oversized diagnostics, and an invalid caller checkout configuration.
Validation: original six diagnostic cases fail before the repair; final six
pass. Both prior-CI main-drift and REST owner suites passed (84 tests) before
the failure-only loader pin; the focused cases cover that final correction.
Move third-party app lint back to the existing Wear row and budget
Blacksmith phone tests across up to four isolated JVMs. Each JVM receives
its share of the available CPUs; the existing 1 GiB heaps remain unchanged.
On the same eight-CPU Linux Testbox, clean project outputs and warm
dependency caches reduced the affected phone row from 446.13 to 233.34
seconds of Gradle wall time. Wear moved from 20.49 to 174.36 seconds;
the two rows together fell from 466.62 to 407.70 runner-seconds.
All 3,665 third-party and 3,533 Play tests passed, along with Wear/shared
tests and the selected Android lint tasks.
Keep all four normal rows, all six full-validation rows, test assertions,
Gradle tasks, hosted settings and timeout budgets. Actions job-wall
measurement remains a follow-up for the next natural hourly.
Validation: complete 905-file tooling inventory across the interrupted and
resumed runs; 897 files passed, seven retained existing skips, and three
assertions in pr-merge-prior-ci-timeout.test.ts failed identically on the
unmodified parent (25 passed, three failed). Full test-types, main/PR/full
preflight smoke, workflow validation, boundary lint, six-file check-changed
and direct-API P2 review passed. No test or assertion was weakened.
Keep deadline context in the shared GitHub check-run identity refusal,
which also serves failed-step admission. The production-type extension
generalized that diagnostic and broke the existing deadline rejection
controls; all qualification predicates remain unchanged.
The unchanged deadline suite passes 20 runs (560 cases). Changed checks,
script types, typed and boundary lint, and independent P2 review pass.
Apply the existing exclusive-plan barrier to full-suite and explicit-parallel routes without changing deadlines, worker limits, or failure policy.
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
Supply the asynchronous absent-row fixture binding while retaining synchronous verification and recovery readers. Preserve all nineteen native regression cases and the strict unexpected-dependency guard.
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
Retain complete core graph validation in the existing required parallel boundary row for canonical extension-only changes. Discover all four noncore compiler consumers while preserving full fallback for aliases, missing inputs, mixed changes and incomplete inventories.
Complete the selected REST observation and main materialization before the last authority verification, without reopening a redundant local-only observation window. Preserve GraphQL and late fallback admission checks.
Drain fake GitHub CLI response pipes before exit so lifecycle tests retain complete evidence. Cover forward main movement, final authority revocation, and complete success/error output.
Recognize the audited check-prod-types failed-step shape under the existing prior-CI verifier. Bind the GitHub check-run, workflow command, matrix/task inputs, source-step positions, complete timestamps, and successful cleanup while retaining the cancelled conclusion.
Independent failure attribution, unchanged source inputs, exhaustive cancellations, security, admin authority, and enforced reviews remain required. The final fixture fails on the original Node-only owner; 67 verifier controls and selected checks pass with the repair. Managed P2 review is clean.
Bun builds that release SQLite native handles still paid for conservative worker retirement because lifecycle policy checked the runtime name. Capture the native-close capability after library selection and reuse it across broker placement, retirement, reader cleanup, and inherited worker admission. Bound probe termination to five seconds; timeout/error admission returns conservatively while unreferenced cleanup retains any unconfirmed live worker’s private directory. Stock Bun and Windows stay conservative; Node retains its existing policy. Register the disposable native probe with the SQLite guard and include the diagnostic parser, probe, and worker in the maintainer wrapper source inventory so isolated provisioning loads its complete dependency closure.
Proof: recovery median 11.4 s -> 0.1 s with 0/0 measured transcript worker creations/retirements. Gateway 50x25 load replies improved 128 -> 263 versus Node 273. Node 24 and the signed Bun test fork cover touched lifecycle and startup tests; changed checks, import-cycle checks, and full build verify the rebased tree.
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
Zoom meetings, Teams meetings and Slack huddles each carried the same
thirteen-file glue layer (entry, CLI, CLI metadata, config, errors, node
host, node invoke policy, runtime facade, probes, setup, Chrome transport,
types), feeding one platform adapter into a dozen separate
MeetingPlatformAdapter helpers. A new MeetingPlatformAdapter member,
defineBrowserMeetingPlugin, composes those helpers from one declaration,
so each plugin now declares only what is genuinely platform-specific. A
fourth browser meeting platform costs one declaration.
The helpers the factory replaces stay exported and are marked deprecated,
since published plugin versions call them. Tests inject Chrome bindings
through the factory's public spec instead of mocking core internals. The
three plugins drop their unused typebox dependency.
Zoom and Teams now require OpenClaw 2026.9.8 (install and plugin API
floors, catalog, docs), like Slack huddles, because they call a member
2026.9.7 lacks. Released plugin packages already require a matching host.
All plugin registrations and 42 generated page-script hashes are
identical to main.
Release note: Zoom meetings and Microsoft Teams meetings plugins require
OpenClaw 2026.9.8 or newer.
Moves the bundled runtime from fork release ee83b78b18 to
openclaw-v1.4.3-20260930-57fadf566d-webkit-f20ce77445: the upstream Bun
sync through ba3f27d1d1, the full CI-line compatibility port, the macOS
/dev/fd copy fix, child_process stdio handles, bounded compile-cache exit
persistence, TLS over paused CONNECT transports, and the net/fs/
structuredClone parity fixes.
The max-lines baseline is consumed by its existing ratchet, not Oxlint. Keep this exact path neutral when selecting changed-file lint, with the same guard and broad-input fallbacks.
Extend the mixed-owner planner regression across guarded baselines. The max-lines row failed before the fix; nine focused planner and fallback cases pass afterward. Scoped guards, lint, and typechecks pass after consuming the canonical workflow fixture type correction.
Include generated regular CLI children in both serial packing paths while preserving the 150-second child and 250-second job limits. Keep runner, worker, preparation and process policies intact.
The focused planner regression and neighboring budget case pass in 33.87 seconds on macOS. A local manifest probe emits 88 instead of 89 rows with the identical 3,884-target inventory; Linux integration proof remains required before landing.
