Summary

When upgrading from v2026.4.27 to v2026.5.2, openclaw doctor --fix triggers a one-time plugin externalization migration that silently removes lobster (and potentially other allow-only externalized plugins) from both plugins.allow and plugins.entries in openclaw.json. This breaks all cron jobs that depend on lobster pipelines (briefings, digests, etc.) with no warning or error message.

Steps to Reproduce

1. Running v2026.4.27 with lobster configured:
   • plugins.allow: ["bluebubbles", "lobster", ...]
   • plugins.entries.lobster: { "enabled": true, "config": {} }
   • Multiple cron jobs running lobster pipelines (ClawFlow briefings/digests)
2. Upgrade to v2026.5.2: npm install -g openclaw
3. Run openclaw doctor --fix
4. Check config: lobster is gone from both plugins.allow and plugins.entries

Expected Behavior

Doctor should detect that lobster is in plugins.allow, recognize it as an official external plugin (it's in the catalog as @openclaw/lobster), install it via npm, and preserve the allow/entries configuration.

Actual Behavior

• Doctor's one-time release step (collectReleaseConfiguredPluginIds) does NOT read plugins.allow to determine which plugins to install
• It only collects from: channels, providers, model refs, slots, agent harness runtimes, web search/fetch providers
• Lobster is a pure workflow runtime plugin — none of those categories
• The stale-entry cleanup then runs, sees lobster has no install record, and calls removePluginFromConfig which wipes it from allow + entries
• All lobster-dependent cron jobs silently fail on next fire

Impact

In our case this silently broke 6 cron jobs (4 briefing/digest pipelines + 2 health checks) that all use .lobster pipeline files. No error was surfaced — cron just produced nothing. We only caught it because we verified immediately after upgrade.

Root Cause (confirmed in source)

• release-configured-plugin-installs-CvfnGeYf.js lines 151-173: collectReleaseConfiguredPluginIds calls multiple collect* helpers but never reads config.plugins.allow
• missing-configured-plugin-install-A5tUUqKF.js lines 46-67: The non-release repair function (collectConfiguredPluginIds) DOES read plugins.allow, but the release step bypasses it — it calls repairMissingPluginInstallsForIds with its own narrower collection instead of repairMissingConfiguredPluginInstalls
• uninstall-TRIhnPr4.js lines 181-270: removePluginFromConfig wipes allow, entries, installs, and load.paths

Suggested Fix

In collectReleaseConfiguredPluginIds, add plugins.allow entries to the collection set. Specifically: for each ID in config.plugins.allow, if it appears in listOfficialExternalPluginCatalogEntries() (i.e., it was a bundled plugin that's now external), include it in the set passed to repairMissingPluginInstallsForIds.

Alternatively, the release step could call repairMissingConfiguredPluginInstalls (which already reads allow) instead of constructing its own narrower set.

Workaround

Manually install the external package before running doctor:

npm install -g @openclaw/lobster
openclaw doctor --fix

Or re-add lobster to the config after doctor removes it:

openclaw plugins install @openclaw/lobster
# Then manually re-add "lobster" to plugins.allow and plugins.entries in openclaw.json

Environment

• OpenClaw v2026.5.2
• macOS 15.5 (Darwin 25.0.0)
• lobster plugin configured as workflow runtime for ClawFlow/.lobster pipeline files
• Also affects v2026.5.3-beta.1 through beta.4 (checked — same code path)