Codex review: needs maintainer review before merge. Reviewed July 13, 2026, 10:07 AM ET / 14:07 UTC.

Summary
Adds a bounded SQLite-backed gateway restart audit ledger and threads typed provenance through restart scheduling, safe-restart coordination, config reload, update, slash-command, gateway-tool, and emission paths.

PR surface: Source +636, Tests +655, Generated +38, Other -1. Total +1328 across 18 files.

Reproducibility: not applicable. as a bug reproduction: current main demonstrably lacks durable restart-event persistence, and the contributor’s isolated SQLite proof verifies the proposed new capability.

Review metrics: 1 noteworthy metric.

• Persistent audit surfaces: 1 table added; 512-row fixed cap. The new durable data model and its retention rule require explicit privacy and ownership review before merge.

Stored data model
Persistent data-model change detected: database schema: src/state/openclaw-state-schema.generated.ts, database schema: src/state/openclaw-state-schema.sql, serialized state: src/agents/tools/gateway-tool.test.ts, serialized state: src/infra/restart-coordinator.test.ts, serialized state: src/state/openclaw-state-db.generated.d.ts, vector/embedding metadata: src/infra/restart-coordinator.test.ts. Confirm migration or upgrade compatibility proof before merge.

Root-cause cluster
Relationship: canonical
Canonical: #97189
Summary: This PR is the viable current restart-attribution candidate; the older unmerged log-based PR is superseded, while the general activity-audit issue overlaps in storage and privacy policy but covers a broader lifecycle domain.

Members:

• superseded: task-139: audit gateway restart attribution #78742 - It proposed the same restart-attribution outcome through log and sentinel changes, but closed unmerged and retained raw sender/session metadata that this PR replaces with bounded redacted SQLite storage.
• partial_overlap: [Feature]: Add metadata-only audit records for agent runs and tool actions #98521 - It established the broader canonical metadata-only run/tool audit direction and explicitly treated restart records as a separate producer/candidate rather than the same implementation.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🦞 diamond lobster
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Risk before merge

• [P1] Merging establishes durable storage for operational identifiers and context such as actor, device, client IP, changed paths, task IDs, labels, and pseudonymized session identity; maintainers must explicitly accept which fields are appropriate to retain.
• [P1] The specialized 512-row ledger has a different retention and access model from the canonical audit ledger, creating potential privacy-policy and operator-query divergence unless that separation is intentional and documented.

Maintainer options:

1. Approve a narrower audit contract (recommended)
   Remove or pseudonymize unapproved identifiers and align retention/access semantics before merge.
2. Own the current metadata boundary
   Merge only after a gateway/state owner explicitly accepts the separate 512-row forensic store and its retained metadata.
3. Defer durable restart auditing
   Pause or close the PR if the additional persistent security boundary is not worth maintaining.

Next step before merge

• [P2] A gateway/state owner should decide the durable field set, retention, access model, and relationship to the canonical audit ledger; normal repair automation cannot choose that security boundary.

Maintainer decision needed

• Question: Should gateway restart provenance use this separate 512-row SQLite ledger with its current metadata fields, or be narrowed/aligned with the canonical audit ledger’s privacy, access, and retention contract before merge?
• Rationale: The code can enforce either design safely, but only maintainers can authorize the permanent operational-metadata boundary and decide whether a second audit store is intentional product architecture.
• Likely owner: steipete — They have the strongest combined restart-path and related audit-product history available in the reviewed evidence.
• Options:
  • Align and narrow first (recommended): Define approved fields, pseudonymization, access, and retention against the canonical audit contract before merging the restart producer.
  • Accept specialized ledger: Approve the separate metadata-only 512-row table as an intentionally internal forensic store and document its sensitive metadata and access expectations.
  • Pause the feature: Close or defer the PR if durable restart attribution does not justify another persistent operational-data surface.

Security
Needs attention: The patch has no concrete secret leak in the reviewed head, but maintainers must approve the durable operational-metadata and retention boundary before merge.

@clawsweeper re-review

Behavior addressed: Gateway restart audit events now avoid blocking restart scheduling on the scheduled path, and restart warning fields no longer expose raw session keys.

Findings addressed:

• Moved the scheduled audit write after the pending restart state is armed, so audit persistence cannot prevent the scheduled restart state transition.
• Redacted restart warning sessionKey fields with a stable fingerprint instead of logging the raw session key.
• Added regression coverage for restart warning session-key redaction.

Real setup tested: Non-production isolated source checkout with a temporary OPENCLAW_STATE_DIR; no live Gateway, production config, or real messaging channel was used.

Exact steps or command run after this patch:

• node scripts/run-vitest.mjs run src/infra/restart.test.ts src/infra/restart-coordinator.test.ts src/gateway/server-methods/restart.test.ts --reporter=dot
• node scripts/run-tsgo.mjs -p tsconfig.core.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core.tsbuildinfo
• git diff --check
• Ran an isolated proof script that set a temporary OPENCLAW_STATE_DIR, called scheduleGatewaySigusr1Restart({ delayMs: 60000, reason: "proof restart audit persistence", skipCooldown: true, audit: { source: "gateway_tool" } }), queried gateway_restart_audit, and cleared the pending restart timer.

Evidence after fix:

• Focused restart/gateway tests passed: 26 tests total across the restart, restart-coordinator, and gateway restart method shards.
• tsgo:core passed.
• git diff --check passed.
• Isolated proof returned ok: true, mode: "signal", delayMs: 60000, coalesced: false.
• The isolated state database contained one gateway_restart_audit row with event_type: "scheduled", reason: "proof restart audit persistence", source: "gateway_tool", mode: "signal", and delay_ms: 60000.
• The redacted warning field shape was <redacted:...>, and the proof check confirmed it did not contain the raw session key or channel identifier.

Observed result after fix: The restart request armed a pending restart, persisted a scheduled audit row in the isolated state database, and exposed only redacted session-key material in warning-format output.

What was not tested: I did not run this against a live production Gateway or a real production restart; the runtime proof used an isolated temporary state directory by design.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper re-review

Behavior addressed: Current head now redacts durable restart-audit storage, not just warning log output.

Findings addressed:

• gateway_restart_audit.session_key now stores a redacted stable fingerprint instead of a raw session key.
• Nested sessionKey-style fields in audit_json and preflight_json are redacted before persistence.
• Sensitive structured fields such as token, authorization, secret, credentials, API keys, and cookies are redacted before persistence.
• Added regression coverage that reads back the durable audit row and verifies no raw session/channel identifier or secret value is stored.

Real setup tested: Non-production isolated source checkout with a temporary existing OPENCLAW_STATE_DIR; no live Gateway, production config, or real restart was used.

Exact steps or command run after this patch:

• node scripts/run-vitest.mjs run src/infra/restart.test.ts src/infra/restart-coordinator.test.ts src/gateway/server-methods/restart.test.ts --reporter=dot
• node scripts/run-tsgo.mjs -p tsconfig.core.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core.tsbuildinfo
• git diff --check
• Ran an isolated existing-state proof script that initialized a temporary state DB, called scheduleGatewaySigusr1Restart(...), queried gateway_restart_audit, and cleared the pending restart timer.

Evidence after fix:

• Focused restart/gateway tests passed: 27 tests total across the restart, restart-coordinator, and gateway restart method shards.
• tsgo:core passed.
• git diff --check passed.
• Isolated existing-state proof returned ok: true, mode: "signal", delayMs: 60000, coalesced: false.
• The isolated state database contained one gateway_restart_audit row with event_type: "scheduled", reason: "proof restart audit durable redaction", source: "gateway_tool", mode: "signal", and delay_ms: 60000.
• The stored session_key value had the shape <redacted:...>.
• Stored audit_json and preflight_json contained redacted session-like and authorization/token fields.
• The proof readback confirmed the stored row did not contain the raw channel/session identifier, raw provider name from the session key, or the synthetic secret value.

Observed result after fix: Restart scheduling still arms and persists the audit row, while durable storage contains only redacted session/sensitive fields for the tested audit/preflight payload.

What was not tested: I did not run this against a live production Gateway or a real production restart; the runtime proof used an isolated temporary state directory by design.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper re-review

Behavior addressed: Current-head refresh after merging current main into the restart-audit branch while preserving the durable restart-audit storage redaction fix.

Findings addressed:

• Durable restart audit storage still redacts gateway_restart_audit.session_key as a stable fingerprint.
• Nested session-like and sensitive fields in audit_json and preflight_json remain redacted before persistence.
• Current-main merge drift was resolved for the status model normalization behavior and Telegram reasoning-lane lint.

Exact steps or command run after this patch:

• node scripts/run-vitest.mjs run src/commands/status.summary.runtime.normalization.test.ts src/infra/restart.test.ts src/infra/restart-coordinator.test.ts src/gateway/server-methods/restart.test.ts --reporter=dot
• node scripts/run-tsgo.mjs -p tsconfig.core.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core.tsbuildinfo
• node scripts/run-oxlint.mjs extensions/telegram/src/reasoning-lane-coordinator.ts src/agents/model-selection.ts src/infra/restart.ts src/infra/restart.test.ts
• git diff --check

Evidence after fix:

• Focused restart/gateway/status tests passed: 29 tests total across the status normalization, restart, restart-coordinator, and gateway restart method shards.
• tsgo:core passed.
• Targeted oxlint passed with 0 warnings and 0 errors.
• git diff --check passed.
• The isolated durable-storage proof from the previous head remains applicable to the preserved restart-audit code path: it verified a temporary existing state DB, scheduled restart audit row persistence, redacted session_key, redacted nested audit_json / preflight_json session-like and sensitive fields, and no raw channel/session identifier or synthetic secret in the stored row.

Observed result after fix: The restart-audit branch is updated to current main, keeps durable storage redaction, and passes the focused tests/type/lint gates that correspond to the current-head failures.

What was not tested: I did not run this against a live production Gateway or a real production restart; the runtime proof used an isolated temporary state directory by design.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper re-review

Behavior addressed: Current-head refresh after merging latest main into the restart-audit branch while preserving the durable restart-audit storage redaction fix.

Findings addressed:

• Durable restart audit storage still redacts gateway_restart_audit.session_key as a stable fingerprint.
• Nested session-like and sensitive fields in audit_json and preflight_json remain redacted before persistence.
• Latest-main merge drift in the Telegram reasoning lane was resolved while keeping the previous restart-audit fixes intact.

Exact steps or command run after this patch:

• node scripts/run-vitest.mjs run src/commands/status.summary.runtime.normalization.test.ts src/infra/restart.test.ts src/infra/restart-coordinator.test.ts src/gateway/server-methods/restart.test.ts extensions/telegram/src/format.test.ts --reporter=dot
• node scripts/run-tsgo.mjs -p tsconfig.core.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core.tsbuildinfo
• node scripts/run-oxlint.mjs extensions/telegram/src/reasoning-lane-coordinator.ts src/agents/model-selection.ts src/infra/restart.ts src/infra/restart.test.ts
• git diff --check

Evidence after fix:

• Focused tests passed: 90 tests total across status normalization, restart, restart-coordinator, gateway restart method, and Telegram format shards.
• tsgo:core passed.
• Targeted oxlint passed with 0 warnings and 0 errors.
• git diff --check passed.
• The isolated durable-storage proof from the previous current-head pass remains applicable to the preserved restart-audit code path: it verified a temporary existing state DB, scheduled restart audit row persistence, redacted session_key, redacted nested audit_json / preflight_json session-like and sensitive fields, and no raw channel/session identifier or synthetic secret in the stored row.

Observed result after fix: The restart-audit branch is updated to latest main, keeps durable storage redaction, and passes the focused tests/type/lint gates that cover the prior current-head failures.

What was not tested: I did not run this against a live production Gateway or a real production restart; the runtime proof used an isolated temporary state directory by design.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper re-review

Current head follow-up after the latest CI failure:

• Previous failing check: checks-node-compact-large-whole-1 failed in src/commands/status.summary.runtime.test.ts for splits legacy combined overrides when provider is missing.
• Root cause: my prior providerless persisted-model preservation was too broad; it also preserved legacy combined provider/model override strings instead of splitting them.
• Fix: preserve raw persisted model strings only when they are truly providerless; legacy combined provider/model overrides still split into provider and model.
• Current head: eaf5ccc9b6c0f1054009f25c55eaa9f4e072c64c.

Validation run after this patch:

• node scripts/run-tsgo.mjs -p tsconfig.core.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core.tsbuildinfo
• node scripts/run-oxlint.mjs src/agents/model-selection.ts
• git diff --check

Evidence after fix:

• tsgo:core passed.
• Targeted oxlint passed with 0 warnings and 0 errors.
• git diff --check passed.

Note: I attempted the exact focused Vitest shard locally, but this environment got stuck in test transform. The pushed current head is intended to let CI verify that exact shard.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper re-review

Behavior addressed:

• Removed active task title text from config-reload restart audit preflight taskBlockers before it reaches gateway_restart_audit.
• Preserved operator warning detail for local diagnostics while keeping persisted restart audit payloads title-free.

Real setup tested: isolated source checkout on PR branch at 001c4cc29b; no production gateway/runtime state was used.

Exact steps or command run after this patch:

• CI=true node --no-maglev node_modules/vitest/vitest.mjs run --config test/vitest/vitest.gateway.config.ts src/gateway/server-reload-handlers.test.ts --reporter=dot
• CI=true node --no-maglev node_modules/vitest/vitest.mjs run --config test/vitest/vitest.infra.config.ts src/infra/restart.test.ts src/infra/restart-coordinator.test.ts --reporter=dot
• CI=true corepack pnpm exec oxlint src/infra/restart-coordinator.ts src/infra/restart-coordinator.test.ts src/infra/restart.test.ts src/gateway/server-reload-handlers.ts src/gateway/server-reload-handlers.test.ts
• git diff --check
• CI=true corepack pnpm tsgo:core

Evidence after fix:

• Added a config-reload regression proving gateway_restart_audit.audit_json and preflight_json exclude active task title text while preserving task IDs.
• Existing infra restart audit regression still passes for the gateway-tool restart path.
• Gateway reload handler suite passed: 31 tests.
• Infra restart suites passed: 19 tests.
• Oxlint, diff check, and core typecheck passed.

Observed result after fix:

• Current head is 001c4cc29b6b1abf2e93c3ac7fcaa69ab44cfd49.
• The config-reload taskBlockers persistence finding is addressed.

What was not tested:

• Full CI matrix was not rerun locally.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Dependency graph guard cleared

This PR no longer has blocked dependency graph changes. A future dependency graph change requires a fresh /allow-dependencies-change comment after the guard blocks that new head SHA.

• Current SHA: d96076e271754a8d013b51d1b3b8a85500cb69c2

@clawsweeper re-review

Current head update after the watcher/manual refresh found a real shrinkwrap red.

Head: 807ca8c

Fix:

• Regenerated the npm shrinkwrap artifacts required by the shrinkwrap gate.
• The resulting diff is limited to the root shrinkwrap and the WhatsApp extension shrinkwrap.

Validation:

• Exact shrinkwrap check passed: node scripts/generate-npm-shrinkwrap.mjs --all --check.
• Diff check clean.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Current-head update after the dependency guard result:

The previous shrinkwrap refresh was the wrong shape for this branch because it introduced lockfile-only churn and correctly tripped the dependency guard. I replaced that with a narrower source-side fix instead.

What changed:

• removed the net npm-shrinkwrap.json changes from this PR
• updated scripts/generate-npm-shrinkwrap.mjs so --check ignores registry deprecation notices when comparing generated/current shrinkwrap content
• kept dependency graph contents unchanged

Validation on the new head:

• node scripts/generate-npm-shrinkwrap.mjs --all --check
• pnpm exec oxlint scripts/generate-npm-shrinkwrap.mjs
• git diff --check

Reviewer note: the current PR diff no longer contains lockfile changes; the dependency guard should no longer require a dependency-change override for this branch.

@clawsweeper re-review

Current-head update after refreshing this branch onto latest main.

Head: 67e353dadc

What changed:

• merged current main cleanly
• removed the now-obsolete PR-local shrinkwrap check normalizer because current main already contains the durable shrinkwrap metadata stabilization
• kept this PR free of net npm-shrinkwrap.json and dependency graph changes

Validation on the new head:

• restart/audit infra shard passed: 19 tests
• gateway reload handler shard passed: 31 tests
• targeted oxlint passed
• git diff --check passed

Reviewer note: the prior dependency-guard blocker is no longer present; this head has no lockfile changes from the PR.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper re-review

Current-head update after refreshing this branch onto latest main again.

Head: c036b63efaf2

What changed:

• merged current main cleanly; the new base advance was unrelated Google Meet code
• preserved the prior restart-audit storage fixes
• kept this PR free of net npm-shrinkwrap.json / dependency graph changes

Validation on the new head:

• restart/audit infra shard passed: 19 tests
• gateway reload handler shard passed: 31 tests
• targeted oxlint passed
• conflict-marker check passed
• git diff --check passed

Reviewer note: the exact previous head had green CI, but GitHub showed the branch behind current main; this refresh removes that author-side blocker.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper re-review

Behavior addressed:

• Gateway restart audit events remain durable without putting synchronous SQLite work on the signal-driven restart path.
• Sensitive parent fields in nested audit and preflight payloads are redacted as a whole before serialization.

Findings addressed:

• Sensitive object and array values under session-key, authorization, token, secret, credential, API-key, and cookie-like keys no longer recurse into durable storage. Session-key strings retain a one-way fingerprint; other sensitive values become <redacted>.
• emit_requested persistence now runs on a later timer turn after the restart signal or supervisor handoff returns. Failure rollback remains ahead of emit_failed persistence.
• The branch was merged with current main; operational task diagnostics still use the shared title-bearing formatter, while durable restart audit context remains title-free.

Exact steps or command run:

• node scripts/run-vitest.mjs run --config test/vitest/vitest.infra.config.ts src/infra/infra-runtime.test.ts src/infra/restart.test.ts src/infra/restart-coordinator.test.ts
• OPENCLAW_GATEWAY_PROJECT_SHARDS=0 node scripts/run-vitest.mjs run --config test/vitest/vitest.gateway.config.ts src/gateway/server-reload-handlers.test.ts src/gateway/server-reload-handlers.hot-reload-status.test.ts
• pnpm tsgo:core
• Targeted oxfmt, type-aware oxlint, conflict-marker scan, and git diff --check.

Evidence after fix:

• Restart/audit suite: 64 tests passed.
• Gateway reload suite: 32 tests passed.
• Typecheck, targeted format/lint, conflict-marker scan, and diff checks passed.
• Regressions verify that object/array sensitive parents leave no nested sentinel values in durable rows and that emit_requested audit writing is not called synchronously after signal emission.

Observed result after fix:

• Restart emission completes before durable emit_requested storage begins, while the persisted event retains the expected restart metadata.
• Nested sensitive audit/preflight fields are fail-closed and task titles remain absent from durable rows.

What was not tested:

• No live production gateway restart was performed; validation used isolated source-checkout tests and static gates.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper re-review

Behavior addressed:

• Current-head restart request tests now assert the audit metadata added by this PR while preserving the UTF-16-safe reason truncation coverage.

Findings addressed:

• Fixed the sole checks-node-compact-large-whole-1 failure on the previous head. The runtime passed audit: { source: "gateway.restart.request" } as intended; the emoji-boundary test still expected the pre-audit call shape.

Exact steps or command run:

• node scripts/run-vitest.mjs run --config test/vitest/vitest.gateway-methods.config.ts src/gateway/server-methods/restart.test.ts
• Targeted oxfmt, type-aware oxlint, and git diff --check.

Evidence after fix:

• The previously failing file passes: 7 tests passed.
• Targeted format, lint, and diff gates passed.

Observed result after fix:

• The emoji-boundary request still truncates before the split surrogate and now verifies the expected restart audit source on the exact call.

What was not tested:

• No live production gateway restart was performed; this follow-up only repairs the deterministic current-head CI assertion.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper re-review

Updated the current head (4b8b0de5b6) with the latest main and resolved the restart/audit conflicts.

Root-cause seam: current main added signal-to-drain admission and transient-generation fencing, while this branch carries durable audit context through restart emission. The resolution preserves both: audit events now pass through the admission-aware emitter, transient reset fencing remains intact, and durable task preflight data continues to omit task titles.

Behavior addressed: restart audit persistence remains ordered after restart-critical state transitions without bypassing the new signal-admission fence.

Real setup tested: current PR checkout after merging the latest main, with dependencies hydrated in a resource-limited isolated scope.

Exact steps or command run after this patch:

• node scripts/run-vitest.mjs run --config test/vitest/vitest.infra.config.ts src/infra/infra-runtime.test.ts src/infra/restart.test.ts src/infra/restart-coordinator.test.ts src/infra/restart.deferral-timeout.test.ts
• OPENCLAW_GATEWAY_PROJECT_SHARDS=0 node scripts/run-vitest.mjs run --config test/vitest/vitest.gateway.config.ts src/gateway/server-reload-handlers.test.ts src/gateway/server-reload-handlers.hot-reload-status.test.ts src/gateway/server-methods/restart.test.ts
• pnpm tsgo:core
• type-aware oxlint, oxfmt --check, and git diff --check on the four resolved files

Evidence after fix:

• infra restart/audit/coordinator: 4 files, 74 tests passed
• gateway reload/restart methods: 3 files, 43 tests passed
• tsgo:core: passed
• targeted lint, formatting, and diff checks: passed

Observed result after fix: the branch merges cleanly with current main, preserves both admission fencing and durable audit semantics, and has no focused validation failures.

What was not tested: no live production gateway restart was performed; this is isolated code-path and test-suite proof.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The targeted re-review published an exact durable review comment and queued an executing target-wide serialized router scan.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29150460146
• Updated: 2026-07-11T11:17:22.318Z

@clawsweeper re-review

Current-head update for 1cec91fe288bb59457fad9835ed43ece6e7d28e8, rebuilt cleanly onto current main at ffff72c43aedf5bdeb32a6836f577850207f8573.

Behavior addressed:
Gateway restart scheduling and emission now record a bounded durable audit ledger while keeping restart-critical signal, fencing, rollback, retry, and timer transitions ahead of SQLite persistence. Persisted source and reason values use closed codes; free-form caller text is not stored. Session-like and sensitive nested fields are redacted, and config-reload task metadata excludes task titles.

Exact validation performed after this patch:

• Ran the gateway reload-handler suite outside production state: 192 tests passed and 2 SQLite-only tests were skipped on the host runtime.
• Ran the SQLite-dependent audit proof in an isolated, network-disabled Docker container using the actual generated schema and state database path: 5 tests passed, covering config-reload title exclusion, redaction/closed codes, and bounded retention.
• Re-ran the one Docker fake-timer outlier by exact test name on the host: it passed in both owning Vitest projects (2 passed).
• Ran tsgo:core and tsgo:core:test.
• Verified generated Kysely types, Kysely guardrails, type-aware lint, formatting, git diff --check, and conflict-marker/reject-file gates.

Observed result after fix:

• Config reload, restart request, gateway tool, update, signal, slash command, and safe-restart paths provide explicit durable provenance.
• Restart emission failure rolls back availability before audit persistence; successful emission and zero-delay scheduling defer persistence until after the critical transition.
• Deferral retries retain the original audit event, and deferral-bypass audit is recorded only after emission was attempted.
• The durable table retains at most 512 metadata rows and stores oversized JSON as a bounded, parseable truncation envelope.

What was not tested:
No live gateway or production state was used. Permanent acceptance of the metadata-only 512-row retention policy remains a maintainer/product-security decision.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper re-review

Current-head follow-up for 61f3c845e3f23ebb2fd36d39470f77529f183258, rebased without conflicts onto current main at 73a0bf4b7cee7ba5f295e9c504345da08e152b10.

Delta since the previous proof:

• Removed the now-stale deadcode baseline entry for RestartAuditInfo; this type is intentionally consumed by the restart coordinator and reload handler on this branch.
• Re-ran the gateway reload-handler suite after the rebase: all 192 non-SQLite tests passed. The two SQLite audit assertions remain covered by the previously reported isolated safe-runtime Docker proof (5 passed); the local Node runtime rejects its affected SQLite version before opening the database.
• Re-ran the prior fake-timer outlier by exact test name: it passed in both owning Vitest projects.
• Formatting, git diff --check, conflict-marker, and reject-file gates passed.

Exact base/candidate discrimination for the remaining aggregate CI output:

• The Plugin SDK wildcard surface test reports the same 210 actual versus 209 budget on this branch and a detached exact-current-main checkout.
• The deadcode export check now reports the same two unrelated pairing exports on this branch and exact current main; the candidate-specific stale baseline entry is gone.
• The oc-path test-type error imports two constants that are also absent from the exact-current-main export surface; this PR does not touch that extension.

No live gateway or production state was used. The restart-audit behavior and retention decision remain unchanged from the full proof above.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The targeted re-review published an exact durable review comment and queued an exact-item serialized router run.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29242739476
• Updated: 2026-07-13T10:32:49.311Z

@clawsweeper re-review

Current-head update for 77539f255f3bb9dc7295b4495f1b32d6a0b14c7c, rebased onto 624977ec90799b479f15ad6f90b384fb34a107bc.

Fresh CI failures addressed:

• The Plugin SDK wildcard surface failure was base-owned and is resolved by the current-main rebase; the rebased candidate reports the pinned 209 wildcard reexports.
• The active-deferral bypass audit test now drains the fake-timer turn that completes restart admission before asserting the deferred audit write.
• The managed no-op reload test now drains one pending timer turn instead of recursively exhausting unrelated restart-deferral intervals left by the full-file test sequence.
• Fake restart timers are cleared before restoring real timers in the added audit tests.

Current-head validation:

• src/infra/infra-runtime.test.ts: 45 passed.
• src/gateway/server-reload-handlers.test.ts: 97 passed under Node 24.18.0, including the SQLite-backed audit test.
• Plugin SDK public surface check passed with 209 wildcard reexports.
• Core source and core test type gates passed.
• Type-aware lint and formatting checks passed for the changed tests.
• git diff --check passed.

The Node 24 test runtime was an isolated, checksum-verified official binary. No live gateway or production state was used.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper re-review

Current-head update for dd2af70c9b7d842ead61b8d072b581e3d30a54e7, rebased onto 497662f0fc8b40e329c9a3552d5cd03e5706183b.

The latest-main conflict in restart emission was resolved by preserving main's prepared-hook emission owner while continuing to pass the durable audit event through both the owner and signal-admission paths. No API surface was expanded.

Current-head validation:

• Restart, restart-coordinator, runtime, gateway reload, and gateway restart method suites: 182 passed.
• Core source and core test type gates passed.
• Type-aware lint passed for all changed TypeScript files.
• Formatting and git diff --check passed.

Validation ran in isolated systemd scopes under Node 24.18.0. No live gateway or production state was used.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The targeted re-review published an exact durable review comment and queued an exact-item serialized router run.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29249733688
• Updated: 2026-07-13T12:29:57.778Z

@clawsweeper re-review

Current-head follow-up for d96076e271754a8d013b51d1b3b8a85500cb69c2.

The prior aggregate reds were base-owned: a Control UI test-type regression and stale dead-export state. This head was uplifted onto main after those fixes landed; the restart-audit candidate did not absorb either unrelated change.

Current-head validation after the uplift:

• Restart, restart-coordinator, runtime, gateway reload, and gateway restart method suites: 182 passed.
• Core source and core test type gates passed.
• git diff --check passed.

The base-only uplift did not change the restart-audit design or public surface. No live gateway or production state was used.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The targeted re-review published an exact durable review comment and queued an exact-item serialized router run.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29256273763
• Updated: 2026-07-13T14:08:59.930Z

Closing this voluntarily.

Since this PR opened, #98704 landed the canonical versioned, metadata-only audit ledger. This branch still creates a separate 512-row restart store with its own retention and privacy boundary. Re-expressing the change as queryable operator history through the canonical ledger would require a new public restart event family across the audit types, store/parser, RPC/CLI schemas, documentation, and generated clients. Reliable process-exit attribution would also need explicit durability semantics because the canonical audit writer is best-effort and background-backed. That is a broader product and security decision, and would make this PR larger rather than more focused.

Current main also has durable restart intent/handoff/sentinel state and restart lifecycle logging, so the remaining unique gap is narrower: queryable historical restart attribution.

The implementation in this branch is therefore no longer the right review surface. I would revisit the remaining gap only if maintainers explicitly want a minimal canonical gateway_restart event-family contract, including its durability semantics. Related context: #98521 and #98704; the earlier #78742 approach was superseded.