Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.agents/skills/openclaw-parallels-smoke/SKILL.md:
- Line 19: The runbook mixes two orders for invoking prlctl exec which causes
operator confusion; normalize all examples to the canonical form prlctl exec
"$VM" --current-user ... by finding every occurrence of prlctl exec and changing
instances that place --current-user before the VM argument so the VM name (e.g.,
"$VM") always immediately follows prlctl exec and --current-user comes after it;
update examples, usage lines and any inline snippets to use this single
canonical ordering.
- Line 25: Edit the sentence that begins "Same-guest update verification should
set the default model explicitly to `openai/gpt-5.4` before the agent turn and
use a fresh explicit `--session-id` so old session model state does not leak
into the check." to insert a comma before "and use" so it reads "...before the
agent turn, and use a fresh explicit `--session-id`..." to improve clarity in
SKILL.md.

In @.agents/skills/openclaw-release-maintainer/SKILL.md:
- Around line 37-38: The document alternates between two correction-tag formats
(`vYYYY.M.D-N` and `YYYY.M.D-N`); pick the canonical format (include the leading
"v" if that's the chosen standard) and replace all occurrences so the file uses
a single consistent tag style (update the references in the fallback
correction-tag sentence around the block with `For fallback correction tags like
...` and the other mentions around lines referenced, e.g., the section covering
“Bump version everywhere” and the occurrences noted at 85-87) so every example,
instruction, and variable uses the same format.

In @.github/pull_request_template.md:
- Around line 38-48: Update the template sentences that start with the
conjunctive adverb "Otherwise" to include the missing comma for correct grammar;
specifically edit the lines containing "For bug fixes or regressions, explain
why this happened, not just what changed. Otherwise write `N/A`." and "For bug
fixes or regressions, name the smallest reliable test coverage that should have
caught this. Otherwise write `N/A`." so each "Otherwise" is followed by a comma.

In @.github/workflows/ci.yml:
- Around line 10-11: The workflow currently sets cancel-in-progress: true
unconditionally which will cancel in-progress push builds; change the condition
so cancel-in-progress is only true for pull_request events and false for push
events (use the same event checks around the existing group expression),
targeting the cancel-in-progress key in the CI workflow to preserve in-progress
push builds while still cancelling PR runs.

In `@apps/macos/Sources/OpenClaw/OpenClawConfigFile.swift`:
- Around line 482-488: The code currently treats NSNull() as a present value
because entry["lastObservedSuspiciousSignature"] != nil is true for NSNull;
update the condition so the health state is only written when a real suspicious
signature exists (not nil and not NSNull). Modify the if that uses
sameFingerprint(...) and entry["lastObservedSuspiciousSignature"] to check both
nil and NSNull (e.g., require entry["lastObservedSuspiciousSignature"] != nil &&
!(entry["lastObservedSuspiciousSignature"] is NSNull)) before calling
setConfigHealthEntry and writeConfigHealthState; reference functions
sameFingerprint, setConfigHealthEntry, writeConfigHealthState and the key
entry["lastObservedSuspiciousSignature"] when making the change.

In `@apps/macos/Tests/OpenClawIPCTests/OpenClawConfigFileTests.swift`:
- Around line 197-200: The test currently expects a trailing newline when
comparing the file contents: update the assertion in the block that reads
`preserved` (the String from `clobberedPath`) so it compares `preserved` to the
`clobbered` value without appending `\n`; locate the `if let clobberedPath`
block and change the expectation from `preserved == "\(clobbered)\n"` to
`preserved == "\(clobbered)"` so the test matches the exact written string.

In `@docs/.generated/config-baseline.json`:
- Around line 31100-31109: The new config entry
channels.synology-chat.dangerouslyAllowInheritedWebhookPath is missing
user-facing metadata; add a "label" (e.g., "Allow inherited webhook path
(dangerous)") and a "help" string that clearly explains the risk and intended
use (e.g., warns about security implications, when to enable, and examples), and
include these properties in the JSON object for that key so docs and UI can
render a descriptive name and tooltip.

In `@docs/cli/index.md`:
- Around line 137-140: The Plugins command list is missing documentation entries
for the new commands; add matching "uninstall" and "update" subsections/entries
in the Plugins section to document their usage, flags, and examples so the
top-level command list (the entries "uninstall" and "update") matches the
detailed Plugin docs; update any nearby examples or the summary table that
references plugin commands to include uninstall and update as well.
- Around line 150-151: The docs mention the "broadcast" subcommand under the
message tree but the message reference list omits it; update the message
subcommand reference block to include the "broadcast" entry (label it as message
broadcast) so the commands list matches the tree and provides consistent
guidance for the message command set (look for the "message" subcommand list and
add an entry for "broadcast").

---

Outside diff comments:
In @.agents/skills/openclaw-release-maintainer/SKILL.md:
- Around line 14-234: Summary: The PR mixes an unrelated release-runbook rewrite
(SKILL.md) with the intended code change for sessionKey plumbing in
ContextEngine interfaces/tests; split or re-scope. Action: remove the large
SKILL.md/doc changes from this branch or move them into a separate PR so the
code-focused PR only contains the sessionKey plumbing and related tests;
alternatively, update this PR's title and description to clearly state it
includes the release-runbook rewrite and ensure review/CI expectations are
adjusted. Locate edits in .agents/skills/openclaw-release-maintainer/SKILL.md
(the release runbook content) and either revert that file from this branch or
extract its changes to a new branch/PR, then re-run CI and update reviewers
accordingly. Ensure references to "sessionKey", "ContextEngine" and related test
names remain in the original PR and that the new docs PR has its own
changelog/commit message describing the runbook rewrite.

---

Nitpick comments:
In @.agents/skills/openclaw-parallels-smoke/SKILL.md:
- Line 26: Update the ambiguous "current host"/"today" phrasing in the SKILL.md
sentence that references the aggregate npm-update wrapper and the fallback from
"Ubuntu 24.04.3 ARM64" to "Ubuntu 25.10" (and the related
`parallels-linux-smoke.sh` behavior) by replacing it with an explicit date stamp
(e.g., "as of 24 March 2026") so the fallback guidance remains unambiguous for
future runs; ensure the new text mentions the exact date and preserves the same
fallback policy and referenced distro strings.

In @.agents/skills/openclaw-release-maintainer/SKILL.md:
- Around line 89-114: The repeated release constraints under "Check all relevant
release builds" and the other duplicated blocks (referenced at ranges 117-166
and 198-234) should be consolidated into a single canonical checklist section
(e.g., "Release Preflight Checklist") and the other sections should be replaced
with short cross-links pointing to that canonical list; update references to
specific items (preflight pass criteria, dispatch constraints, publish ordering,
appcast rules) to link into the single checklist, remove duplicate bullet lists
in the other headings, and ensure any section that relied on the original
bullets references the checklist entries by name so future edits only change one
source of truth.
- Around line 112-113: Update the two bullets in SKILL.md that read “For stable
releases, confirm the latest beta already passed the broader release workflows
before cutting stable.” and “If any required build, packaging step, or release
workflow is red, do not say the release is ready.” to add an explicit exception
clause for urgent hotfixes: add a short conditional sentence that permits
cutting a stable hotfix when an incident override is authorized (e.g., by an
on-call engineer or release manager) and document required safeguards (manual QA
checklist, rollback plan, and communication steps) that must be completed before
using the override; ensure the wording makes this an exceptional, auditable path
rather than a routine bypass.

In @.github/workflows/openclaw-npm-release.yml:
- Around line 121-129: Remove the redundant "Validate tag input format" step
from the publish_openclaw_npm job since the same validation already runs in the
preflight_openclaw_npm job that publish_openclaw_npm depends on; locate the step
named "Validate tag input format" (the block that sets RELEASE_TAG and runs the
regex check) inside the publish_openclaw_npm job and delete it so validation
only occurs once in preflight_openclaw_npm, ensuring the publish job still
relies on the preflight job's success.

In @.github/workflows/upstream-sync.yml:
- Around line 58-64: Update the manual resolution bash snippet so the final push
uses a safer force option: locate the quoted command string "git push origin
main" in the upstream-sync workflow's bash block and replace it with "git push
origin main --force-with-lease" so rebased branches are pushed without risking
overwriting concurrent remote changes.

In `@apps/macos/Sources/OpenClaw/OpenClawConfigFile.swift`:
- Around line 565-599: appendConfigObserveAudit duplicates
appendConfigWriteAudit except for the "event" value; extract the shared logic
into a new helper (e.g., private static func appendConfigAudit(event: String,
fields: [String: Any])) that builds the record, validates/serializes JSON,
appends the newline, and writes to the file using configAuditLogURL(); then
implement appendConfigWriteAudit and appendConfigObserveAudit as thin callers
that pass "config.write" and "config.observe" respectively to appendConfigAudit
to remove duplication.

In `@docs/channels/feishu.md`:
- Around line 667-691: Add a new row to the Feishu configuration reference table
documenting channels.feishu.accounts.<id>.name: specify the setting key as
`channels.feishu.accounts.<id>.name`, a short description like "Account display
name" (or "Human-readable account name"), and indicate the default (e.g., `-` or
`none`) so the table matches examples that reference name and avoids reader
confusion; update the surrounding rows if needed to keep table alignment
consistent.

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@src/context-engine/context-engine.test.ts`:
- Around line 1029-1039: Add additional assertions to the "sessionKey is
optional" test to cover bootstrap, ingestBatch, and afterTurn on
MockContextEngine: call engine.bootstrap(...) with only sessionId,
engine.ingestBatch(...) with only sessionId and messages, and
engine.afterTurn(...) with the runtimeContext shape but without sessionKey, then
assert engine.lastSessionKeys.bootstrap, .ingestBatch, and .afterTurn are
undefined; follow the same pattern used for ingest/assemble/compact so the test
verifies backward compatibility for those methods as well.