Summary

• Bound guarded-fetch dispatcher cleanup so timeout/error paths cannot hang behind a stalled undici close.
• Add regression coverage for a timed-out fetch whose dispatcher close never resolves.

Real behavior proof

• Behavior or issue addressed: A timed-out guarded web_fetch must finish with a tool error instead of leaving the Gateway/tool lane stuck behind dispatcher cleanup.
• Real environment tested: Local OpenClaw candidate gateway from this PR head (9bb72ae) on macOS, profile web-fetch-proof, port 19089, token auth, real Gateway HTTP POST /tools/invoke surface.
• Exact steps or command run after this patch: Started pnpm openclaw --profile web-fetch-proof gateway run --port 19089 --auth token --token <redacted> --allow-unconfigured --dev --compact, then called POST /tools/invoke for web_fetch against https://1.1.1.1:81/; while that request was pending and again after it completed, checked /health and called web_fetch against https://example.com/.
• Evidence after fix: Redacted runtime log excerpt: 16:56:39 [fetch-timeout] fetch timeout after 30000ms (elapsed 30002ms) operation=fetchWithSsrFGuard url=https://1.1.1.1:81/; 16:56:39 [tools-invoke] tool execution failed: TimeoutError: request timed out. Live output during/after: /health returned {"ok":true,"status":"live"}; web_fetch for https://example.com/ returned {"ok":true,..."status":200...}.
• Observed result after fix: The timed-out fetch returned a tool error after about 30s, the gateway stayed live during the pending request, and a later web_fetch still succeeded with HTTP 200.
• What was not tested: Full Telegram group roundtrip was not rerun; this proof exercises the shared Gateway tools.invoke and web_fetch timeout path directly.

Verification

• pnpm test src/infra/net/fetch-guard.ssrf.test.ts -- --reporter=verbose
• OPENCLAW_LOCAL_CHECK_MODE=throttled OPENCLAW_TESTBOX=0 pnpm check:changed
• OPENCLAW_LOCAL_CHECK_MODE=throttled OPENCLAW_TESTBOX=0 pnpm test:changed
• pnpm exec oxfmt --check --threads=1 src/infra/net/ssrf.ts src/infra/net/fetch-guard.ssrf.test.ts
• git diff --check