Best possible solution:

Keep one verified exact-SHA JavaScript and Control UI build, then sign and atomically swap the Mac bundle without allowing the packaging subprocess to rebuild or clean those artifacts.

Do we have a high-confidence way to reproduce the issue?

Yes, from source with high confidence: after the exact-SHA build, Mac packaging independently runs JavaScript and Control UI builds unless both supported skip controls are forced. This read-only review did not execute the macOS workflow itself.

Is this the best way to solve the issue?

Yes. Pinning the existing package controls at the specialized live-updater boundary removes redundant cleanup-capable builds without creating another artifact path or changing ordinary developer packaging behavior.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against fe261b0f59aa.

Label changes:

• add proof: sufficient: Contributor real behavior proof is sufficient. The PR body provides after-fix live recovery evidence covering the single Control UI build, both later build skips, Developer ID bundle verification, and exact-target swap.
• add rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
• remove rating: 🐚 platinum hermit: Current PR rating is rating: 🦞 diamond lobster, so this older rating label is no longer current.

Label justifications:

• P2: This fixes a bounded but real reliability failure in internal live Mac update automation without evidence of broader user-runtime impact.
• rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body provides after-fix live recovery evidence covering the single Control UI build, both later build skips, Developer ID bundle verification, and exact-target swap.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR body provides after-fix live recovery evidence covering the single Control UI build, both later build skips, Developer ID bundle verification, and exact-target swap.

PR surface:

Tests 0, Docs 0, Other +11. Total +11 across 3 files.

What I checked:

• Exact-head orchestration: After the canonical exact-SHA build, the PR changes only the Mac restart invocation to force both existing package skip controls while retaining target verification and Gateway health checks. (.agents/skills/openclaw-live-updater/scripts/update-main.mjs:858, 32c5aa3cb048)
• Independent package builds: The Mac package script independently runs pnpm build unless SKIP_TSC=1 and builds Control UI unless SKIP_UI_BUILD=1, confirming that both controls are required for artifact reuse. (scripts/package-mac-app.sh:204, fe261b0f59aa)
• Ambient override exposure: The restart script passes SKIP_TSC=${SKIP_TSC:-1}, so an ambient non-empty value other than 1 overrides its default, and it does not otherwise pin SKIP_UI_BUILD; the caller-level invocation closes both paths. (scripts/restart-mac.sh:324, fe261b0f59aa)
• Normal and retry coverage: Exact-head tests assert the same pinned command for both the normal affected-Mac flow and the pending retry flow. (test/scripts/openclaw-live-updater.test.ts:407, 32c5aa3cb048)
• Real recovery proof: The PR body reports an after-fix recovery that rebuilt Control UI once, packaged with both JavaScript paths skipped, verified the Developer ID bundle, and completed the exact-target swap. (32c5aa3cb048)
• Exact-head checks: The current head has successful applicable Node, lint, dependency, and boundary checks; macOS Swift and UI jobs were path-skipped rather than failed. (32c5aa3cb048)

Likely related people:

• steipete: Authored the merged live-updater introduction and subsequent staged Mac restart, Gateway isolation, and bundle-preservation changes defining the affected path. (role: feature owner and recent area contributor; confidence: high; commits: 2ace363e9866, 2ed24246182f, 107b95e1ad89; files: .agents/skills/openclaw-live-updater/SKILL.md, .agents/skills/openclaw-live-updater/scripts/update-main.mjs, scripts/restart-mac.sh)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

• reviewed 2026-07-11T13:10:58.739Z sha 791cfee :: needs real behavior proof before merge. :: none
• reviewed 2026-07-11T13:17:04.602Z sha 791cfee :: needs real behavior proof before merge. :: none
• reviewed 2026-07-11T13:25:08.061Z sha 32c5aa3 :: needs real behavior proof before merge. :: none