Summary

After updating OpenClaw from 2026.5.12 to 2026.5.18, the Telegram main session failed twice with:

⚠️ Missing API key for provider "openai-codex". Configure the gateway auth for that provider, then try again.

Running openclaw doctor restored the session. After that:

openclaw --version
# OpenClaw 2026.5.18 (50a2481)

openclaw models list
# openai/gpt-5.5 ... Auth yes
# codex/gpt-5.5 ... Auth yes

Gateway and dashboard health were also fine:

systemctl --user is-active openclaw-gateway
# active

curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:4000/
# 200

Why this matters

The installed model auth was healthy, but the live session surfaced a stale openai-codex missing-key error until doctor ran. For users updating via package manager or gateway restart flows, this looks like a broken auth setup even when doctor can repair it immediately.

Expected behavior

Post-update/restart should either:

• run the same stale Codex route/session repair that doctor applies before sessions resume, or
• detect this specific stale openai-codex auth-route state and point directly at openclaw doctor --fix / auto-repair, instead of generic API-key setup guidance.

Observed behavior

• Update completed.
• Session replies failed with generic missing API key guidance for openai-codex.
• Manual openclaw doctor fixed the session.
• Model auth was healthy afterward.

Notes

This may be related to the existing Codex route repair path in src/commands/doctor/shared/codex-route-warnings.ts, especially stale session entries with providerOverride / modelProvider set to openai-codex.