Codex review: needs real behavior proof before merge. Reviewed July 11, 2026, 4:28 AM ET / 08:28 UTC.

Summary
The PR adds a bounded per-config and per-registry-generation guard for failed outbound channel plugin bootstraps, updates focused tests, and adds release changelog credits.

PR surface: Source +38, Tests +57, Docs +3. Total +98 across 4 files.

Reproducibility: yes. source inspection gives a high-confidence path: failed bootstrap attempts previously removed their marker, so the next bootstrap-enabled outbound resolution repeated the registry loader. The current replacement’s non-canonical full-config hashing is also directly source-reproducible, though no live benchmark was run in this read-only review.

Review metrics: 1 noteworthy metric.

• Retry cache bound: 64 config generations. The LRU bounds process-local state for interleaved agent-scoped configs, but its key must remain cheap on the shared delivery hot path.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🦐 gold shrimp
Result: blocked until real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• Replace full-config hashing with a prepared lifecycle config identity.
• Post redacted current-head gateway logs showing one failed bootstrap per generation and retry after config or registry reload.

Proof guidance:

• [P1] Needs real behavior proof before merge: The posted gateway logs demonstrate the superseded heartbeat-preactivation implementation, not the current config/registry generation guard; add redacted exact-head logs, update the PR body, and request @clawsweeper re-review if automatic review does not run.

Risk before merge

• [P1] Suppressing retries changes recovery behavior for all bootstrap-enabled outbound callers, so a stale key could leave an external channel unavailable until a recognized config or registry lifecycle change.
• [P2] The non-canonical config fallback serializes and hashes the full config on repeated unresolved deliveries, preserving avoidable request-time work on the hot path the PR is intended to protect.
• [P1] The branch lacks real current-head evidence that one failed activation is suppressed and a legitimate config or registry reload re-enables activation.

Maintainer options:

1. Fix the key and prove recovery (recommended)
   Replace non-canonical full-config hashing with a prepared lifecycle identity, preserve registry/config re-arming, and add redacted exact-head gateway proof before merge.
2. Pause the retry-semantics change
   Keep the PR open but do not merge until maintainers can verify that every supported plugin availability change re-arms the suppression guard.

@clawsweeper automerge

Special instructions:
replace the non-canonical full-config hash in outbound bootstrap retry suppression with a cheap lifecycle-owned config generation identity; preserve the 64-entry bound, per-channel suppression, and registry-generation re-arming; update focused tests without editing CHANGELOG.md

Next step before merge

• [P1] The branch has one narrow mechanical hot-path repair suitable for automation; contributor-specific exact-head real behavior proof must still be supplied separately before merge.

Security
Cleared: The diff adds in-process retry bookkeeping and tests without changing dependencies, permissions, secrets, workflow execution, package resolution, or downloaded code.

Review findings

• [P2] Avoid hashing the full config on every bootstrap miss — src/infra/outbound/channel-bootstrap.runtime.ts:31

@clawsweeper re-review

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Reviewed at 5373b541bd4da227466d5510d0c5a2547a0be003. The direction is right — pulling the resolveRuntimePluginRegistry scan off the wake path and doing it once at startup matches the hot-path guidance, and the root cause (the bootstrapAttempts guard in src/infra/outbound/channel-bootstrap.runtime.ts:63-88 clearing on failed loads so every tick re-scans) is accurately diagnosed. Two things before this lands, plus one question:

1. Cross-caller regression via the shared function. resolveHeartbeatDeliveryTarget isn't only the wake path — src/commands/doctor-heartbeat-session-target.ts:95 (describeHeartbeatSessionTargetIssues, run from src/commands/doctor-state-integrity.ts:1379) calls it too, and previously relied on allowBootstrap: true to resolve an external-plugin target standalone. The doctor flow doesn't activate the plugin runtime registry, and pre-activation only runs at gateway startup, so after this change an external-plugin heartbeat target with an explicit to and a pinned heartbeat.session that has no store entry now resolves to channel:"none". That makes the deliveryWithoutSession.channel !== "none" short-circuit at doctor-heartbeat-session-target.ts:99 fall through and emit a false "replies are dropped silently" warning that doesn't match real runtime behavior (where startup pre-activation would have loaded the plugin). Bundled channels aren't affected; only external plugin channels are. Consider threading a caller-controlled flag through resolveHeartbeatDeliveryTarget (wake path opts out of bootstrap, doctor keeps it) rather than hardcoding allowBootstrap: false for every caller.

2. src/infra/outbound/heartbeat-pre-activate.test.ts has no assertions — every case is a does-not-throw smoke test (a few even say "No assertion needed"). This is the module the fix depends on to not drop config-declared external targets, and the interesting logic (isExternalPluginTarget skipping standard/none/last, the per-agent target ?? defaults.target merge, and the dedup set) is exactly what's unverified. A spy on resolveOutboundChannelPlugin asserting it's invoked with allowBootstrap: true for the expected external targets and NOT invoked for standard/none/last/heartbeat-less entries would actually pin the behavior.

3. Question: for a wake that supplies requestedHeartbeat.target naming an external, non-config channel (merged via mergeRequestedHeartbeat: true), the target is neither pre-activated nor bootstrapped on the hot path. The common cron/commitment cases collapse to target:"last" and stay on the preserved bootstrap fallback, so I think this is fine in practice — can you confirm no supported wake source passes an external non-config target here, or add a note that it's intentionally out of scope?

The targets.test.ts changes look good and correctly prove both the no-bootstrap explicit path and the preserved target:"last" bootstrap.

Thanks for the thorough review Amir! All three points were spot on:

1. Doctor regression: Added allowBootstrap?: boolean to resolveHeartbeatDeliveryTarget. Defaults to false (wake hot path stays fast), doctor passes true so it resolves external plugin targets without preactivation.

2. Test assertions: Rewrote heartbeat-pre-activate.test.ts — it now uses vi.mock("./channel-resolution.js") and asserts resolveOutboundChannelPlugin call count, allowBootstrap: true param, standard-channel skip, dedup, and distinct-target paths. No more no-assertion smoke tests.

3. Requested override target: Yes, confirmed — cron and manual wakes all collapse to target: "last" through resolveHeartbeatForWake (see mergeRequestedHeartbeat: true + the source === "cron" guard that omits explicit destinations). External non-config targets from requestedHeartbeat only appear if a caller intentionally passes a non-standard override, which doesn't happen from the supported wake sources. Added a preactivation safety net in the wake handler anyway for future callers.

See the latest commit for details. Thanks again!

@clawsweeper re-review

Addressed the [P1] finding from the last review — explicit normalized heartbeat plugin targets now honor caller allowBootstrap and bundled fallback is disabled on the hot path.

Changes (b63f951165):

1. resolveHeartbeatDeliveryTarget (L217-225): plugin lookup for explicit normalized targets now threads params.allowBootstrap through (isSessionDerived || params.allowBootstrap === true) instead of hardcoding false. Bundled fallback disabled unconditionally.
2. resolveHeartbeatDeliveryTargetWithSessionRoute (L362-367): bundled fallback also disabled.
3. +2 regression tests in targets.test.ts exercising the production normalization path where normalizeDeliverableOutboundChannel preserves external plugin ids.

Test results: 145/145 pass across 4 test files.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Land-ready maintainer pass complete on exact head 1cb78cba2434eca714d42e0d7774494eee424ae2.

• Reworked the fix in the shared outbound bootstrap owner: one failed activation per channel/config/registry generation, bounded across interleaved configs, with retries only after a real config or registry reload.
• Focused Testbox proof: corepack pnpm test src/infra/outbound/channel-bootstrap.runtime.test.ts src/infra/outbound/channel-resolution.test.ts — 34/34 passed.
• Scoped Testbox changed gate: core and coreTests lanes passed.
• Disposable Gateway proof: an unavailable external channel activated once, repeated explicit/session-derived resolutions stayed no-target without rescanning, and config plus registry reloads each admitted exactly one new activation (OPENCLAW_PR100377_LIVE_CLEAN_OK).
• Fresh branch-scoped autoreview: no findings.
• Exact-head hosted CI: https://github.com/openclaw/openclaw/actions/runs/29145988256 — success.
• Native review artifacts and hosted prepare gate passed. No known proof gaps for this server-side fix.

Contributor credit is retained in the code commit and changelog. Thank you, @xialonglee.

Merged via squash.

• Prepared head SHA: 1cb78cba2434eca714d42e0d7774494eee424ae2
• Landed commit: 585914fcd5102a6421054a2030bd37b4b898d60e