Best possible solution:

Land this narrow CI-stabilization patch after exact-head checks finish green, keeping the runtime update behavior unchanged.

Do we have a high-confidence way to reproduce the issue?

Yes, at source level: current main has an unannotated Promise catch callback under an enabled lint rule and a launchd handoff test that does not declare the launchd identity it needs. I did not run tests because this review is read-only.

Is this the best way to solve the issue?

Yes: this is the narrowest maintainable fix, using an existing test env helper and adding only the TypeScript catch type annotation required by the configured rule. Broader runtime changes or loosening the test/lint contract would be less appropriate for the reported gate failures.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 8f295f183da6.

Label justifications:

• P2: This is a normal-priority CI/test-gate stabilization fix with limited runtime blast radius but meaningful maintainer workflow impact.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The PR is labeled as maintainer-authored and only stabilizes internal CI/lint/test gates, so the external contributor real-behavior proof gate does not apply.

PR surface:

Source 0, Tests +2. Total +2 across 2 files.

What I checked:

• Current main still has the lint-sensitive catch callback: Current main has readPreUpdateConfigForPostCoreFinalize().catch((err) => { while .oxlintrc.json enables typescript/use-unknown-in-catch-callback-variable as an error. (src/gateway/server-methods/update.ts:299, 8f295f183da6)
• PR head applies the narrow catch annotation: The PR head changes only the Promise catch callback parameter to err: unknown, leaving the runtime warning and fallback behavior unchanged. (src/gateway/server-methods/update.ts:299, 93e784351b2d)
• Launchd handoff requires explicit identity: hasManagedServiceHandoffContext only treats launchd as actionable when a launchd identity env value is present, so the test should declare that identity instead of inheriting host state. (src/gateway/server-methods/update.ts:98, 8f295f183da6)
• Existing test helper safely scopes env changes: withProcessEnv records prior env values and restores or deletes them in finally, matching the PR's test isolation shape used by neighboring launchd/systemd tests. (src/gateway/server-methods/update.test.ts:272, 8f295f183da6)
• PR head scopes the launchd identity only to the affected test: The PR wraps the managed-service handoff/finalizer exclusion test in withProcessEnv({ OPENCLAW_LAUNCHD_LABEL: "ai.openclaw.gateway" }, ...) and does not alter production code for handoff selection. (src/gateway/server-methods/update.test.ts:809, 93e784351b2d)
• Entry point and callee boundary checked: update.run is the lazy-loaded gateway update method, and the post-core finalizer helper documents that package/global installs already converge through managed-service handoff, so skipping finalizer on handoff remains the intended invariant. (src/gateway/server-methods.ts:507, 8f295f183da6)

Likely related people:

• vincentkoc: Git blame shows Vincent Koc authored the current pre-update config catch block and committed the related gateway update changes that contain both affected areas. (role: introduced behavior and recent committer; confidence: high; commits: c1a414bf286a, 90d385cb9328; files: src/gateway/server-methods/update.ts, src/gateway/server-methods/update.test.ts)
• masatohoshino: Git blame shows masatohoshino authored the managed-service finalizer test and the gateway git-update convergence work that this PR stabilizes. (role: feature owner; confidence: high; commits: 90d385cb9328; files: src/gateway/server-methods/update.test.ts, src/infra/update-post-core-finalize.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.