Summary

Selective upstream sync from openclaw/openclaw as of 2026-06-06. The fork is 15,722 commits behind full upstream (a deliberately-large strategic backlog; the fork tracks upstream selectively, not commit-for-commit). This PR applies one self-contained, high-value runtime fix and documents why the other recent high-value upstream fixes were assessed as inapplicable to the fork's older/refactored baseline.

• Merge base (origin/main at branch cut): 207a49990013f7e9012d276c4d07e1fed249fcc9
• Watched upstream HEAD at scan: bbfe8ccaf60e87e84a3c695e56f4bee7c687c5b0 (was a4f7e4cbb9 when the task was filed)
• Branch: maintenance/upstream-openclaw-20260606

Applied fix

Agents / model-fallback — re-probe single-provider primary during cooldown (upstream 6da3b1f6a3, openclaw#90717, fixes openclaw#90702)

A single-provider primary (no fallback chain configured — the common local-model / Gemma-on-llama.cpp configuration) previously would not re-probe during cooldown, so a fallbacks:[] setup that hit a rate or subscription cap stayed suspended until the provider-reported reset timestamp (which can be days out), even though the rolling cap usually recovers earlier. The fix lets a single-provider primary probe through the existing throttle on every open slot. The 30s probe throttle still gates recovery probes (no hammering).

Because the fork is ~15.7k commits behind, src/agents/model-fallback.ts has diverged from upstream (996 vs 1776 lines), so this was applied as a targeted hand-reimplementation of the upstream diff at the fork's line numbers (not a cherry-pick), exactly mirroring the upstream semantic change in shouldProbePrimaryDuringCooldown and the billing branch of resolveCooldownDecision. The existing single candidate skips with rate_limit… test was updated to the new behavior to match the upstream test change.

Assessed but NOT applied (inapplicable to fork baseline)

A parallel triage of the 5 most relevant recent upstream fixes (security/runtime/provider/crash) found the following moot for the fork:

Preserved Gemmaclaw seams

This change touches only src/agents/model-fallback.ts (model-provider cooldown logic) + its test + CHANGELOG. It does not touch: setup/onboarding wizard, Gemma model defaults, local-model provider setup, Docker sandbox, shared-folder mounts, backup/restore, benchmark harnesses, site generation, branding, generated config schema, or session-store performance infrastructure (store-cache.ts/store.ts/store-load.ts, SESSION_STORE_SNAPSHOT_CACHE, STRING_INTERN_POOL). No escalation needed.

Test plan

• pnpm install --lockfile-only — lockfile unchanged (no dep changes)
• pnpm install + pnpm build (Node 22.22.2) — build EXIT=0
• pnpm check:changed — EXIT=0: tsgo core+test typecheck clean, lint:core 0 warnings/0 errors (7000 files), 0 import cycles, webhook/pairing guards pass, vitest.agents 393 files / 4205 passed | 5 skipped
• Focused: model-fallback.probe.test.ts + model-fallback.test.ts + model-fallback.image-provider.test.ts — 73/73 pass (incl. updated single-provider re-probe test)
• CLI smoke: gemmaclaw --version = OpenClaw 2026.7.0; setup/backup/backup restore --help render with Gemmaclaw branding and correct subcommands
• CI: Onboard Gemma E2E (Docker) live setup smoke (runs on PR; change is orthogonal to setup/sandbox/backup so the cooldown path is not exercised by the smoke, but the lane confirms no setup/runtime regression)

The change is covered behaviorally by the focused unit tests; the Docker live-setup smoke is delegated to CI rather than run locally on the shared build host.