Co-authored-by: rolandrscheel <20336324+rolandrscheel@users.noreply.github.com>

…PY (openclaw#74359)

Merged via squash.

Prepared head SHA: 3b4a889
Co-authored-by: fede-kamel <209537060+fede-kamel@users.noreply.github.com>
Co-authored-by: sallyom <11166065+sallyom@users.noreply.github.com>
Reviewed-by: @sallyom

Fixes openclaw#75452.

Heartbeat runs can use a per-turn model override via agents.defaults.heartbeat.model. Before this change, the run metadata was written back to the shared session store, so the next normal turn could inherit the heartbeat provider/model and a smaller context window.

This lands the contributor fix plus maintainer polish:
- preserve existing session runtime model/provider/context metadata when persisting heartbeat turns
- avoid creating invalid provider/model pairs for legacy model-only session entries
- leave empty prior runtime state unset for heartbeat-only turns
- keep normal non-heartbeat runtime persistence unchanged
- add focused regression coverage for the session-store edge cases
- refresh heartbeat docs and changelog attribution

Validation:
- pnpm test src/agents/command/session-store.test.ts src/agents/openclaw-tools.session-status.test.ts
- pnpm exec oxfmt --check --threads=1 src/agents/agent-command.ts src/agents/command/session-store.ts src/agents/command/session-store.test.ts CHANGELOG.md docs/gateway/heartbeat.md
- git diff --check
- GitHub checks on 42a00dc: clean; no active checks and no relevant failures

Duplicate PR openclaw#75567 was already closed; openclaw#75557 is the canonical fix.

Adds validated gateway.controlUi.chatMessageMaxWidth support for grouped Control UI chat messages, carries it through the Gateway bootstrap payload into UI state, applies it as a CSS custom property, and documents the setting while preserving the existing default width.

Fixes openclaw#67935.

Validation:
- Targeted config, gateway, and Control UI tests passed locally.
- Config schema/docs checks passed.
- Testbox changed-file gate passed.
- GitHub CI and security checks are green on cea25a4.

Fix Control UI blank sections caused by malformed persisted cron rows.

- filter invalid cron payloads at the cron.list UI boundary
- guard stale cron payload reads in render, edit, and detail paths
- add regression coverage for malformed cron rows from openclaw#55047 and openclaw#54439

Closes openclaw#55047.
Closes openclaw#54439.
Supersedes openclaw#54550.
Supersedes openclaw#54552.

Fixes openclaw#70991.

Adds authenticated Gateway WebSocket protocol pings, exposes active session-run state to Control UI, and keeps session-scoped Stop available after reconnect or reload when the browser lost the local run id.

Validation:
- pnpm test ui/src/ui/app-chat.test.ts ui/src/ui/app-gateway.node.test.ts src/gateway/server.sessions.list-changed.test.ts src/gateway/server/ws-connection.test.ts
- OPENCLAW_LOCAL_CHECK=1 OPENCLAW_LOCAL_CHECK_MODE=throttled pnpm check:changed
- GitHub CI and high-signal security checks passed on head 1f4c872

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…fc-apply-journal.md

Per Codex P2 review on PR #548:
> tmp-drop-me-rfc-apply.md is an ephemeral worklog (it even uses a tmp-drop-me name)
> that captures branch-local execution notes... it should be dropped from the commit
> or moved to external review artifacts.

Applying the same canonical pattern from #542 (where tmp-drop-me-v29-uptake.md
was moved to docs/design/541-v29-uptake-journal.md). Audit trail preserved at
durable home matching existing <issue>-<descriptor>-journal.md naming convention.

Refs #547, #548 codex-review

Absorb merged wave #542, #545, and #537 from frond-scribe/20260429/v3-cohort-fixes.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Folds RFC scientific-literature review apply work + #537-aware §4 diagram
refreshes into the v52 successor candidate, per figs's directive:
v52 candidate becomes the complete rotation surface (v5.2 base + tonight's
wave + RFC apply substrate).

Source: frond-scribe/20260503/rfc-apply-copilot @ e624547
- Apply lane DECLARE-DONE (4ee47f2): folded #544 review findings into
  docs/design/continue-work-signal-v2.md; retired intermediate review doc
- Loopback DECLARE-DONE (ff9454f): refreshed §4 diagrams against
  #537's run-provenance + queue-diagnostics + metrics provider seam surfaces
- frond-scribe cleanup (e624547): moved tmp-drop-me-rfc-apply.md to
  docs/design/547-rfc-apply-journal.md per Codex P2

Refs #544, #547, #548

…v52-uptake-journal.md

Per 🌻's first-pass byte-walk REQUEST_CHANGES on PR #549 (msg 1500336626482544691):
> tmp-drop-me-v52-uptake.md (63 KB) at repo root. Filename literally says 'drop me.'
> Same shape as the tmp-drop-me-v29-uptake.md we cleaned out of #542 — recommend the
> same canonical pattern: git mv to docs/design/546-v52-uptake-journal.md.

Applying same canonical pattern from #542 + #537 cleanups. Naming matches
existing <issue>-<descriptor>-journal.md convention from #541 precedent.
Audit trail preserved at durable home.

🌻's soft suggestion #2 (inherited WORKORDER-v3-cleanup-path-B.md +
WORKORDER-v3-cohort-fixes.md at root from prior cohort-cleanup-needed lanes)
flagged as separate cleanup pass — not folded here to keep this commit
surgical to REQUEST_CHANGES (1).

Refs #546, #549

…bution

Per figs's directive 2026-05-03 ~03:38Z: 'we can leave no dev detritus; our
single contribution in docs/design is our rfc doc, thats it'.

Earlier waves had moved tmp-drop-me journals + WORKORDER-* files from repo
root INTO docs/design/ (canonical mv-pattern from #542 / #537 / v52 cleanup
cycles). figs's directive overrides: those journals should be DELETED entirely,
not relocated. The cohort-substrate audit-trail lives in:
- git log + branch history (preserved on origin savegame branches)
- GitHub issue tracking (#541 + #546 + #547 + #532 etc.)
- PR descriptions + comment threads

NOT in tree as in-source dev artifacts.

Files removed (all originated as dev-cycle journals/workorders):
- 541-v29-uptake-journal.md (was tmp-drop-me-v29-uptake.md, #542 cleanup)
- 546-v52-uptake-journal.md (was tmp-drop-me-v52-uptake.md, v52 absorption)
- 547-rfc-apply-journal.md (was tmp-drop-me-rfc-apply.md, rfc-apply lane)
- 532-silas-saturation-workorder.md (was WORKORDER.md, #537 cleanup)
- v3-cleanup-path-B-workorder.md (inherited workorder, swim-39 era)
- v3-cohort-fixes-workorder.md (inherited workorder, v3-cohort-fixes era)

Pre-existing princely design memos (332-* + 334-* + swim-37-* + continuation-integration.md)
NOT touched in this commit — flagged separately for figs's call on whether
those also count as dev-detritus.

Refs #549

Per figs's 'no tmp_*.md files at root or anything, clean feature, tests, and
our design doc RFC' framing 2026-05-03 ~03:50Z + cohort cosign on extending
the dev-detritus canon to pre-existing princely design memos:

Removed pre-existing princely design-history memos (predate v52 cycle but match
the dev-detritus shape per 🌫 + 🌊 reads at msgs 1500341881 + 1500342124):
- 332-item-b-post-compaction-release-audit.md
- 334-slice2-chunk5b/5c/6b/6c-* (5 files)
- swim-37-classifier-span-memo.md
- swim-37-continue-delegate-wiring-memo.md
- swim-37-heartbeat-wiring-memo.md
- swim-37-lich-wiring-memo.md
- continuation-integration.md
- continue-work-signal-v2/ subdirectory (contained swim-evidence/swim-07/SWIM7-RESULTS.md)

docs/design/ now contains exactly one file: continue-work-signal-v2.md (the RFC).
Single contribution canon held; cohort-substrate audit-trail lives in
git log + GitHub issue tracking + PR comment threads, NOT in tree.

13th closure-costume by 🌊 cured at code layer too:
canonical-pattern-establishment-via-precedent-without-figs-canon-check.

Refs #549

openclaw#52147

Per pr-review-toolkit:code-reviewer + pr-test-analyzer findings on PR #549:
upstream openclaw#52147 (commit 2605490 'classify tool-execution timeouts')
removed the unconditional 'timedOut → surface_error' early-return so the new
shouldRotateAssistant gate could see timedOutDuringToolExecution. Cohort's v52
absorption preserved the early-return, leaving the upstream fix dead-code +
3 unit tests failing in failover-policy.test.ts (openclaw#52147 tool-exec-timeout
suppression + LLM-phase rotation).

Fix gates the early-return: only fires when timedOut + !aborted + !toolExec
+ !compaction. Then:
- Plain LLM-phase timedOut, !aborted: surface_error (per #86 deadlock fix; preserved)
- LLM-phase timedOut, aborted: falls through to shouldRotateAssistant → rotate_profile (test 4)
- toolExec or compaction timedOut: falls through to shouldRotateAssistant → continue_normal (openclaw#52147)

Result on failover-policy.test.ts: 13 → 16 pass (strict +3).

Known regression on run.timeout-triggered-compaction.test.ts (-2 tests): the
runner integration tests for 'no rotate after compaction-failure' previously
relied on the blanket early-return to suppress rotation in the compaction-
failure flow. The runner code may need to set timedOutDuringCompaction:true
when calling failover-policy after compaction failure, OR the integration
tests need updating to align with the new failover-policy semantics. Filed
as known-conflict for figs's call before COHORT_TARGET_TAG bump; net test
delta is +1 (3→2 failing total).

Refs #549; pr-review-toolkit findings 2026-05-03 ~03:55Z

Per figs's directive to align RFC prose to truth-of-the-matter in code.

Byte-walk evidence: src/auto-reply/continuation/context-pressure.ts:checkSessionContextPressure
gates the pre-fire check on three conditions:
1. threshold != null && threshold > 0
2. Number.isFinite(contextWindowTokens) && contextWindowTokens > 0
3. sessionEntry.totalTokens valid AND (postCompaction || totalTokensFresh !== false)

The §4.2 prose previously omitted condition 3 (totalTokensFresh staleness guard
with post-compaction bypass nuance). The D.1 sketch had it as truthy-check
(totalTokensFresh truthy) when actual semantics is !== false (only explicit
false blocks; undefined/true both pass).

Updated:
- §4.2 prose now names all three conditions explicitly + names the
  post-compaction bypass + adds the [context-pressure:noop] breadcrumb
  pointer for operator investigation
- D.1 sketch now uses 'totalTokensFresh !== false' matching real code +
  adds inline note explaining staleness-guard semantics + post-compaction
  bypass

Both surfaces now align to the actual checkSessionContextPressure
implementation. Per figs's 'align that way, sure you will' directive +
princes-canon-honored shape ('you don't wait for figs').

Refs: PR #549 + frond-scribe pr-review-toolkit catch list (msg 1500342459...)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…r code

Per cohort precision-pin (msg 1500351...): my prior precision-pin (commit
ca72ebb) named THREE conditions but the actual short-circuit set in
src/auto-reply/continuation/context-pressure.ts:checkSessionContextPressure
is FOUR conditions:

1. contextPressureThreshold non-null and positive
2. contextWindow positive finite
3. activeSessionEntry.totalTokens valid (populated, finite, positive)
4. (non-post-compaction only) totalTokensFresh !== false (staleness guard)

I dropped condition (1) from the prior framing because threshold is a
feature-config gate not a per-turn runtime gate. But code-wise it IS a
short-circuit check, and operators investigating 'no band fires' need to
walk all four conditions in order.

Updated:
- §4.2 precondition prose now enumerates all four conditions explicitly
  with their per-condition semantics
- Post-compaction asymmetry (only condition 4 is bypassed; conditions 1-3
  still apply) named explicitly
- Operator-investigation walk re-ordered to cover all four conditions in
  order (a) threshold (b) contextWindow (c) totalTokens (d) totalTokensFresh

Single surface, single push, bundled per cohort verdict ask: 'keep the
existing rolled-up push shape (D.2 trim + D.4 Swim 41 forward-looking)
and bundle the §4.2 alignment as a more-than-one-line fix.'

Refs: PR #549, frond-scribe cohort precision-pin (msg 1500351...)