Best possible solution:

Merge the focused network fix after maintainer review if the IPv4-preferred automatic lookup policy is accepted, keeping DNS-answer validation before candidate selection and the new regression coverage in place.

Do we have a high-confidence way to reproduce the issue?

Yes, source-level reproduction is high confidence: the linked report gives concrete WSL2/no-IPv6-route steps, current main can rotate automatic pinned lookups from IPv4 to IPv6, and EADDRNOTAVAIL is absent from the relevant classifiers. I did not run the full WSL2 Gateway crash scenario in this read-only pass.

Is this the best way to solve the issue?

Yes, from source review this is the narrowest maintainable fix for the reported dual-stack trigger: keep automatic pinned lookups on IPv4 when IPv4 exists, preserve explicit IPv6 lookup behavior, and classify the observed network error like adjacent unreachable-network errors. The remaining question is maintainer policy acceptance, not a repairable code defect.

Acceptance criteria:

• Contributor reported: OPENCLAW_VITEST_FS_MODULE_CACHE_PATH=/tmp/openclaw-vitest-cache-80078 pnpm test src/infra/net/ssrf.pinning.test.ts src/infra/net/ssrf.dispatcher.test.ts src/infra/unhandled-rejections.test.ts src/agents/provider-transport-fetch.test.ts
• Contributor reported: pnpm check:changed
• Contributor reported: pnpm exec oxfmt --check --threads=1 src/infra/net/ssrf.ts src/infra/net/ssrf.pinning.test.ts src/infra/unhandled-rejections.ts src/infra/unhandled-rejections.test.ts CHANGELOG.md
• Contributor reported: git diff --check

What I checked:

• Protected open PR state: Live PR metadata shows this PR is open, unmerged, based on main 09132effa82a463beb75839040f3a083f535471a, at head 89b3fac6cecc5f7d4dd650f9d915957580c68b75, and has the protected maintainer label plus proof: sufficient. (89b3fac6cecc)
• Current main can rotate automatic pinned lookups onto IPv6: Current main builds pinned records from all resolved addresses, uses all records when no explicit family is requested, and advances a shared round-robin index, so a dual-stack host can return IPv4 first and IPv6 on a later automatic lookup. (src/infra/net/ssrf.ts:344, 09132effa82a)
• Current main omits EADDRNOTAVAIL from transient and benign handling: ENETUNREACH is classified in the transient and benign network sets/regexes on current main, while EADDRNOTAVAIL is absent before this PR. (src/infra/unhandled-rejections.ts:51, 09132effa82a)
• The affected runtime path uses pinned dispatchers after DNS policy validation: Guarded fetch resolves and policy-checks the target hostname before constructing createPinnedDispatcher, so the PR changes the production guarded transport path while keeping preselection DNS-answer validation in place. (src/infra/net/fetch-guard.ts:441, 09132effa82a)
• Node lookup contract reaches the automatic all-record path: A local Node v24.14.1 probe showed net.connect({ autoSelectFamily: true }) calls a custom lookup with { "hints": 32, "all": true }, matching the pinned lookup path changed by the PR.
• PR keeps automatic candidates on IPv4 while preserving explicit IPv6: At the PR head, createPinnedLookup builds automaticRecords from IPv4 records when any exist, uses them for automatic lookups, and still filters the original records for explicit family 4 or 6 requests. (src/infra/net/ssrf.ts:348, 89b3fac6cecc)

Likely related people:

• steipete: Commit history shows repeated recent work on pinned SSRF dispatchers, guarded fetch family fallback, SSRF security hardening, and transient unhandled network error classification. (role: recent network/SSRF area contributor; confidence: high; commits: e9ed688c2c06, ecec68d06d19, 824d1e095b5e; files: src/infra/net/ssrf.ts, src/infra/net/ssrf.dispatcher.test.ts, src/infra/unhandled-rejections.ts)
• obviyus: File history includes recent guarded fetch cleanup and prior SSRF/Telegram transport work, including global family policy handling for pinned dispatchers. (role: recent guarded-fetch and pinned-dispatcher contributor; confidence: medium; commits: 2465217b238a, e4825a0f9385, 30fd2bbe195a; files: src/infra/net/ssrf.ts, src/infra/net/ssrf.dispatcher.test.ts)
• Glucksberg: History for the pinning test surface includes the earlier fix that sorted IPv4 before IPv6 in SSRF pinned DNS for IPv6-broken hosts, which is directly adjacent to this PR's policy change. (role: IPv4-before-IPv6 SSRF ordering contributor; confidence: medium; commits: dd9ba974d035; files: src/infra/net/ssrf.pinning.test.ts, src/infra/net/ssrf.ts)
• HemantSudarshan: History for src/infra/unhandled-rejections.ts includes recent work keeping unreachable polling sockets non-fatal, adjacent to this PR's EADDRNOTAVAIL classifier change. (role: recent transient network error contributor; confidence: medium; commits: db6951088a19; files: src/infra/unhandled-rejections.ts)

Remaining risk / open question:

• The WSL2 gateway crash path from the linked report was not live-reproduced in this read-only review; the reproduction confidence is source-level plus reporter logs and PR terminal smoke proof.
• The intentional policy tradeoff is that automatic pinned lookups no longer attempt IPv6 when an A record exists, so a maintainer should accept that behavior before landing.
• The linked report's broader TLSSocket uncaught-error concern may still matter for explicit IPv6 or IPv6-only unreachable paths; this PR targets the dual-stack IPv4-working crash trigger.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 09132effa82a.