* fix(agents): clear sub-agent failure warning after successful spawn retry
A failed sessions_spawn followed by a successful retry in the same run
kept appending the durable "Sub-agent failed" warning to channel
replies. The recovery seam (lastToolRecovery) already existed, but
sessions_spawn has no stable-target arg key, so its recovery
fingerprint fell back to display meta built from label/task/model.
Retries adjust those args (drop a rejected cwd, reword the task), the
fingerprints never matched, and recordSuccess could not clear the
failure.
Collapse the sessions_spawn recovery identity to tool level: any later
successful spawn in the same run is recovery proof. A lone failed spawn
still warns, and a failure after recovery still invalidates the
receipt.
Observed 2026-08-19 on team.openclaw.ai: Roboclaw's first nested spawn
returned forbidden (visible-session cwd outside workspace), the retry
without cwd succeeded, the reply said "Started Investigate…", and
Discord still showed "⚠️🧑🔧 Sub-agent failed".
* ci: register run-attempt-tools test in the attempt-light lane
#126189 added extensions/codex/src/app-server/run-attempt-tools.test.ts
without assigning it to a full-suite lane, so the Vitest ownership audit
(test/vitest-projects-config.test.ts) fails on main and every PR head.
Register it in the codex app-server attempt-light shard next to its
run-attempt siblings.
* test(gateway): drop the chat image-capability mask
The vi.mock of resolveGatewayModelSupportsImages in
server.chat.gateway-server-chat.test.ts was added by #123847 as an
isolation workaround while the gateway shard's chat failures were
unexplained. The producers are fixed on main (#126183 for the
root-work drain race; #126062/#125946/#126113 for detached completion
binding), and the exact #126030 shard invocation is green with the
mask removed (5/5 on 95ac5b27fa, 2/2 on this head), so the mask now
only hides the real capability-resolution path from the suite.
* test(gateway): assert inline-image dispatch after mask removal
ClawSweeper P2 on #126217: the two image sends only asserted RPC success
and drain, so a silent false from the real capability resolver would
offload the images and the suite would stay green without proving the
discovered model's image capability. Capture the dispatch args and
assert both runs deliver exactly one inline image. Teeth check: with the
discovered model narrowed to text-only input, the assertion fails with
images undefined (offloaded).
* feat(discord): auto-join occupied voice rooms
Add opt-in voice.autoJoin[].whenOccupied residency so Discord voice bots join for the first human and leave when the room becomes empty while preserving existing always-on, manual, transcript, and follow-user behavior.\n\nCloses #125973
* test(discord): isolate process runtime mocks
Use stable hoisted runtime-env mocks so isolate=false Discord test ordering cannot turn sleepWithAbort back into an unmocked function.
* fix(discord): defer unknown voice occupancy
Treat memberless voice states as unresolved instead of human so bot-only rooms cannot trigger occupancy-managed auto-join. Add cache-to-listener and manager regressions.\n\nCloses #125973
* test: isolate shared module mocks
Replace ineffective non-isolated module spies with stable hoisted mocks and a child-process SQLite connection-reuse probe so gateway and Discord shards are order-independent.
* test(gateway): inline connection reuse probe
Keep the child-process SQLite ownership probe in its owning Vitest file so Knip sees the full test surface without weakening process isolation or the original order regression.
Pinned sessions inherited the nav zone's muted colour on the session *title*, so a
pinned row's preview line outshone its own name and the same session read dimmer
pinned than unpinned. A title is content in every zone; only glyphs, meta and the
hover fill follow the zone. The subtitle drops to plain --muted, already proven AA
against every surface by theme-contrast.test.ts.
Rows with no preview text reserved a fixed 18px second line anyway, leaving a dead
band or a lone spinner hanging below-right of the title. They now collapse to one
line via a --single-line class plus a CSS variant, so the endcap rides beside the
title. Rows also gained a little vertical air and reclaimed the right-hand gutter
inside the row, leaving the deliberate scrollbar clearance from #124879 intact.
Adds a localStorage-backed "Show message preview" toggle to the session sort menu
(default on). Operator-actionable state is exempt: attention, the queued
concurrency-slot explanation, and critical observer headlines (stuck /
waiting-on-user) always show, because hiding them behind a display preference is
the silent-failure class.
Also registers extensions/codex/src/app-server/run-attempt-tools.test.ts, which
arrived in #126189 with no shard claim and left main red.
Scope embedded Desktop refresh and connection ownership to the active presented sidebar slot. Hidden retained panels now invalidate pending work and disconnect RFB, while reactivation returns to a freshly loaded picker without silently reconnecting.
* fix(agents): scope simple completion runtime preparation
Explicit local model runs no longer build the broad plugin/live model catalog before inference.
Related to #125802 and #125834 as discovery context only; this commit does not claim to close either issue.
* refactor(agents): simplify runtime scope planning
Reuse canonical configured-slot and metadata-snapshot resolution, and consolidate test temp cleanup without changing the selected prepared-runtime contract.
* fix(codex): preserve model effort capabilities
Keep public model identities separate from app-server execution routing, and retain provider-owned complete effort metadata when account discovery is partial.
Fixes#126005
* refactor(codex): avoid redundant thread rotation
* fix(codex): preserve model fallbacks without leaking wire ids
Records native Telegram Desktop from a digest-pinned prebaked image: a ready desktop in ~12s with no per-lease apt installs or downloads, which also removes the dpkg-lock failures that killed recent runs.
The recorder only records; callers drive the turn and supply the TDLib driver used for QR authorization. Nothing in this repository invokes it yet - routing the Mantis Telegram Desktop Proof workflow through it is a follow-up.
Paired Control UI device credentials now share the canonical same-origin read authorizer, while session-derived routes retain read+owner policy. Fresh dashboard handoffs and reloads can therefore render workspace, channel, and plugin icons without exposing or persisting the shared Gateway secret.
Remove the old shared-secret-first UI workaround.
* fix(ui): preserve workshop revisions until admission
Skill Workshop revision instructions now remain retryable until the Gateway admits the request, including navigation and overlapping admission failures.
* fix(ui): materialize workshop revision binding
Manifest-only Skill Workshop proposals now resolve their revision hash inside the durable admission owner, and retries reuse the same binding and idempotency key.
* chore(ui): keep revision types internal
* fix(msteams): preserve replies across ingress replay
Recovered Teams channel and group-chat responses now preserve reply and quote context across durable ingress replay. Discovery metadata also advertises the existing group and reaction capabilities.
* chore(msteams): document replay assertion safety
* test(msteams): normalize replay delivery errors
* perf(gateway): remove repeated logging and delivery scans
Exact session-delivery retries no longer scan the full queue. Logging and diagnostics reuse lifecycle-owned settings and listener interest so uninterested projections are skipped, while outbound WebSocket summaries are built only after recipient admission.
* fix(infra): break diagnostic listener import cycle
Keep event-type validation at the diagnostic dispatcher while the process-wide listener presence counter remains a leaf module.
* test(cli): use logging override owner
Exercise late one-shot JSON diagnostics through the canonical logger override setter so lifecycle-cached console settings are invalidated as they are in production.
* test(auth): use logging override owner
Configure the locked-update warning test through the canonical logger override setter so lifecycle-cached console settings are invalidated before assertion.
* test(gateway): normalize redacted media fixture
Compare durable inbound media facts against the public redaction contract so random identifiers that resemble sensitive text do not make the Gateway suite flaky.
* fix(channels): reject malformed ingress queue claims instead of minting sentinel identity
A status=claimed row missing claim_token, claim_owner, or claimed_at was
decoded into a fake claim (token "", owner "", claimedAt 0). Release then
guarded on claim_token = "" (never matches NULL) and the stale-claim scan's
claimed_at <= cutoff never selected NULL timestamps, so such rows were stuck
claimed forever and blocked their dedupe slot.
Claimed rows now decode through a strict claim-column decoder; malformed
claims are tombstoned as failed/corrupt_claim by stale recovery without an
ownership-policy consult (no reachable owner can exist), preserving a valid
payload so the event stays operator-resubmittable. Regression test fails
pre-fix: listClaims leaked the sentinel claim and recovery never scanned
the row.
* fix(channels): rename recovery claim decode variable to avoid method shadow
* fix(channels): scan malformed claims into recovery regardless of timestamp
A claimed row missing token/owner but carrying a corrupt future claimed_at
dodged both the cutoff and IS NULL predicates, so it never reached the strict
decoder. Recovery now selects any row with incomplete claim columns; the
malformed-claim tombstone relies on the exact-token guard alone instead of a
stale-cutoff comparison its timestamp cannot satisfy.
* fix(workboard): recover interrupted worker launches
Persist prepared, accepted, and failed launch phases so Gateway restart reconciliation cannot leave cards permanently running between launch preparation and worker acceptance.
* fix(workboard): require durable terminal evidence
Do not synthesize terminal-session acceptance timing during restart reconciliation; stale same-key terminal rows without updatedAt now fail the prepared launch instead of being adopted.
* fix(gateway): bound audit and Codex backlogs
Live Gateway SQLite lock failures and process heap pressure exposed two
independent queue owners. Route best-effort audit persistence through the
canonical shared-state connection with bounded contention retries, and remove
the per-notification Codex yield so the keyed turn queue can drain directly.
Follow-up to #126033 and #126073.
* fix(gateway): annotate raw SQLite cold-open probe
* test(codex): register notification burst shard
startChatDispatch reserved the detached dispatch's root-work continuation
after the ACK, and swallowed a failed reservation with ?? undefined. When
the reservation did not land, the request's root was released before
chat-send-dispatch-errors finalize() awaited
persistGatewaySessionLifecycleEvent, so a concurrent restart drain saw
zero active roots and completed while the session's terminal state was
still being written.
Reserve in admitChatSend instead, where the request root is provably
live, and release it from the single cleanupAdmittedRun owner. Callers
outside a Gateway request envelope hold no root, so their continuation is
a no-op.
The regression now starts a real waitForActiveGatewayRootWork() drain
while persistence is blocked and asserts it cannot settle until the write
is released, instead of asserting an absolute process-global counter.
Peter Steinberger