Repro:

1. OpenClaw 2026.5.2 (likely affects 2026.4.x as well)
2. Start gateway with tools.web.search.provider: "brave" (and/or openaiCodex.enabled: true); confirm web tools registered.
3. Trigger one or more config writes (doctor --fix, plugins registry --refresh, third-party agent writing config concurrently).
4. Open a fresh chat session: web_search, web_fetch, memory_*, lobster, image/music/video_generate are all missing from the tool list.

Cause:

• dist/runtime-Dg2ko22y.js:161 canUseSecretsRuntimeFastPath returns true when source config has no tools.web.{search,x_search,fetch} AND no plugin entry with webSearch/webFetch config AND no secret-ref candidates.
• When fast-path returns true, prepareSecretsRuntimeSnapshot returns webTools: createEmptyRuntimeWebToolsMetadata() (line 188).
• finalizeRuntimeSnapshotWrite (in dist/runtime-snapshot-Bgtbceve.js:139) invokes the refresh handler with nextSourceConfig, which can be a stripped or rewritten config from a writer.
• The refresh handler (registered at runtime-Dg2ko22y.js:267) calls prepareSecretsRuntimeSnapshot with that nextSourceConfig. If the writer's source config view lacks tools.web, fast-path triggers, and setActiveRuntimeWebToolsMetadata overwrites the working metadata with the empty struct.

Suggested fix:

• The fast-path optimization should not be allowed to OVERWRITE a populated active webTools metadata with an empty one. Either:
  (a) prepareSecretsRuntimeSnapshot should require an explicit "I know there's no web surface" assertion before returning empty metadata, and otherwise preserve the prior populated state; or
  (b) The refresh handler should diff nextSourceConfig against activeSnapshot.sourceConfig and skip the fast-path branch if nextSourceConfig is not strictly a superset of the prior config's web surface; or
  (c) Writers that produce a nextSourceConfig should never elide tools.web if it was present in the prior source — i.e. the spread-write shape ({...sourceConfig, ...overrides}) needs a guard rail.

Workaround:

• Set tools.web.search.openaiCodex.enabled: true in ~/.openclaw/openclaw.json. The patchCodexNativeWebSearchPayload at dist/codex-native-web-search-*.js injects web_search at API-payload time, masking the bug for web search but not for the other plugin tools (web_fetch, lobster, memory_*, etc.).
• Restart gateway after the bug fires to reset state.

Filer notes:

• Investigation artifact: local workspace research/infra/2026-05-04_plugin-tool-drop-investigation.md
• Original repro session 2026-04-25 by Mr. Grayden user; auto-memory entry project_grayden_web_tool_probe.
• File hashes will rotate; quote function names + line numbers, not file paths.