The candidate rehearsal copy lives under the service TMPDIR (for example ~/.openclaw/tmp), so Node module lookup from inside the copy walks up to the home directory; bundled playwright-core requires an undeclared optional chromium-bidi, which resolved from a home-level node_modules and made the outside-copy containment assertion fail the candidate Doctor on every 2026.9.6 to 9.7 attempt. The dependency scan now classifies an undeclared package that resolves only through an ancestor directory as unresolvable inside the temporary update copy (a warning before source capture); declared dependencies that resolve outside the copy and symlink escapes keep the fatal assertion. Auto-update admission pauses after two matching candidate Doctor failures for the same candidate using the existing SQLite update-run records, with a warning that states the recovery steps; a changed candidate or a manual openclaw update clears the pause. Thanks @iJaack for the diagnosis.
Closes#163486