Bug Report: Scope Upgrade Pending Approval Error After Upgrade to 2026.4.21

Summary

After upgrading OpenClaw from 2026.4.15 to 2026.4.21, spawn subagent and native approval operations fail with "scope upgrade pending approval" error.

Environment

• OpenClaw Version: 2026.4.21
• Node Version: v25.9.0
• Platform: macOS (Darwin)
• Deployment: Homebrew installation
• Gateway Port: 18789

Problem Description

After performing openclaw update on April 23, 2026 at 09:50 (HKT), the following operations began failing:

1. Spawning subagents via sessions_spawn
2. Native Telegram approval handler

Error message:

Gateway closed (1008): pairing required: device is asking for more scopes than currently approved

Log entries show:

{"subsystem":"telegram/native-approvals"} connect error: scope upgrade pending approval
{"subsystem":"gateway/channels/telegram"} failed to start native approval handler

Timeline

• 09:50 - OpenClaw upgraded 2026.4.15 → 2026.4.21
• 09:52 - First scope upgrade error logged (2 minutes after upgrade)
• Scope errors continue on every spawn attempt

Root Cause

Device scopes in paired.json were reset to only ['operator.read'] after upgrade, but new version requires additional scopes:

• operator.approvals
• operator.admin
• operator.read
• operator.write
• operator.pairing
• operator.talk.secrets

Workaround

Manually editing ~/.openclaw/devices/paired.json to add all required scopes to the affected device entry, then setting file to readonly (chmod 444) to prevent Gateway from overwriting.

Expected Behavior

1. Device scopes should persist across version upgrades
2. Or user should be prompted to approve new scopes before operations fail

Additional Context

• This is a fresh install/upgrade scenario, not a fresh setup
• Previously working normally on 2026.4.15
• Error occurs on all spawn operations, not just Telegram

Reproduction Steps

1. Have OpenClaw 2026.4.15 or earlier running normally
2. Perform openclaw update to upgrade to 2026.4.21
3. Attempt to spawn a subagent
4. Observe "scope upgrade pending approval" error