What

Adds a storage-neutral session patch projection seam for Path 3 so Gateway sessions.patch and embedded TUI patchSession no longer wrap applySessionsPatchToStore(...) in a mutable whole-store updateSessionStore(...) callback.

Why

The SQLite session-store follow-up needs a transaction-sized operation that applies key migration/pruning and the projected entry update together without exposing a mutable whole-store callback to Gateway/TUI callers.

Changes

• Added projection accessor operation
• Split patch projection from persistence
• Migrated Gateway/TUI patch callers
• Preserved legacy key pruning
• Added TUI writer ratchet

Testing

• PNPM_CONFIG_MODULES_DIR=<hydrated-node_modules> node scripts/run-vitest.mjs src/config/sessions/session-accessor.test.ts src/gateway/sessions-patch.test.ts src/tui/embedded-backend.test.ts test/scripts/check-session-accessor-boundary.test.ts
• node scripts/check-session-accessor-boundary.mjs
• node scripts/run-oxlint.mjs src/config/sessions/store.ts src/config/sessions/session-accessor.ts src/config/sessions/session-accessor.test.ts src/gateway/sessions-patch.ts src/gateway/server-methods/sessions.ts src/tui/embedded-backend.ts src/tui/embedded-backend.test.ts scripts/check-session-accessor-boundary.mjs test/scripts/check-session-accessor-boundary.test.ts
• node scripts/run-tsgo.mjs -p tsconfig.core.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core.tsbuildinfo
• node scripts/run-tsgo.mjs -p test/tsconfig/tsconfig.test.src.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/test-src.tsbuildinfo
• <hydrated-node_modules>/.bin/oxfmt --check --threads=1 src/config/sessions/store.ts src/config/sessions/session-accessor.ts src/config/sessions/session-accessor.test.ts src/gateway/sessions-patch.ts src/gateway/server-methods/sessions.ts src/tui/embedded-backend.ts src/tui/embedded-backend.test.ts scripts/check-session-accessor-boundary.mjs test/scripts/check-session-accessor-boundary.test.ts
• git diff --check
• .agents/skills/autoreview/scripts/autoreview --mode branch --base upstream/main
• pnpm build

Real behavior proof

Behavior addressed: Gateway sessions.patch still applies and persists session metadata through the new patch projection seam after the Path 3 rebase.

Real environment tested: Local live Gateway LaunchAgent from this checkout at SHA 8b78f55f8de6b86e6b869ab37e36e1b0adba56cb, base ec3f76b3806aa9731854fd8b1249f458c2df6f6b, OpenClaw 2026.6.8 (8b78f55), Node v24.15.0.

Exact steps or command run after this patch:

pnpm build
pnpm openclaw gateway restart --force --json
pnpm openclaw --version
curl -fsS http://127.0.0.1:18789/healthz
curl -fsS http://127.0.0.1:18789/readyz
pnpm openclaw gateway status --json
pnpm openclaw gateway call sessions.patch --params '{"key":"agent:main:subagent:path3-proof-93739","label":"Path 3 proof 93739","sendPolicy":"deny","verboseLevel":"off"}'
pnpm openclaw gateway call sessions.describe --params '{"key":"agent:main:subagent:path3-proof-93739"}'
node -e 'const fs=require("fs"); const p=`${process.env.HOME}/.openclaw/agents/main/sessions/sessions.json`; const s=JSON.parse(fs.readFileSync(p,"utf8")); const e=s["agent:main:subagent:path3-proof-93739"]; console.log(JSON.stringify({exists:Boolean(e), label:e?.label, sendPolicy:e?.sendPolicy, verboseLevel:e?.verboseLevel, sessionId:Boolean(e?.sessionId)}, null, 2));'
pnpm openclaw gateway call sessions.delete --params '{"key":"agent:main:subagent:path3-proof-93739","deleteTranscript":true}'
node -e 'const fs=require("fs"); const p=`${process.env.HOME}/.openclaw/agents/main/sessions/sessions.json`; const s=JSON.parse(fs.readFileSync(p,"utf8")); console.log(JSON.stringify({existsAfterCleanup:Boolean(s["agent:main:subagent:path3-proof-93739"])}));'

Evidence after fix: /healthz returned {"ok":true,"status":"live"} and /readyz returned {"ready":true,"failing":[]...}. gateway status --json reported RPC ok: true, server version 2026.6.8, and admin_capable operator auth. sessions.patch returned ok: true, key agent:main:subagent:path3-proof-93739, label Path 3 proof 93739, sendPolicy: "deny", verboseLevel: "off", and resolved model metadata. sessions.describe returned the same label, display name, send policy, verbose level, model, and runtime. Direct persisted session-store inspection returned {"exists":true,"label":"Path 3 proof 93739","sendPolicy":"deny","verboseLevel":"off","sessionId":true}. Cleanup via sessions.delete returned deleted: true, and the final store check returned {"existsAfterCleanup":false}.

Observed result after fix: The live Gateway accepted a real sessions.patch RPC, persisted the projected metadata, served it back through sessions.describe, and removed the proof-only session entry through sessions.delete.

What was not tested: The future SQLite backend implementation, doctor migration from file-backed stores to SQLite, SDK compatibility beyond the focused test set, and unrelated session lifecycle mutations outside this patch-projection slice.

SQLite Follow-up

Implement the SQLite backend for applySessionPatchProjection(...) as one transaction that resolves the target key/candidates, applies legacy migration/pruning semantics, validates/projects the patch, and writes the projected entry metadata atomically.

Refs #88838.