Purpose

This PR adds the generic, dormant machinery needed to disable legacy allowFrom fallback per channel later. It does not disable fallback for any channel in this PR.

User Config Impact

This PR does not add user-facing fallback flags.

Users should never set *FallbackToAllowFrom in their OpenClaw config. Those booleans are channel runtime/package metadata for future channel-owned PRs.

The only user config change openclaw doctor --fix may make is copying existing allowlist values from allowFrom into the explicit allowlist that already represents the same access:

• channels.<id>.groupAllowFrom
• channels.<id>.commandGroupAllowFrom
• channels.<id>.groupOwnerAllowFrom
• commands.allowFrom.<channel-id>
• tools.elevated.allowFrom.<channel-id>

The goal is preservation: when a later channel PR disables a fallback in code, users keep the same effective access after doctor copies the old allowFrom values to the correct explicit target.

Future Channel PR Checklist

For each fallback a channel later disables, that channel PR must do both:

1. Change runtime behavior so the channel reads the explicit replacement allowlist.
2. Set the matching package doctor metadata boolean to false.

Doctor infers the copy target from the boolean:

Only set a fallback boolean to false after the target config key is accepted by that channel schema and actually read by that channel runtime. Multi-account channels must preserve account scope; otherwise doctor warns instead of copying into a broader provider target.

Example: future Telegram opt-out

A later Telegram PR that disables group-sender fallback would set the same capability in two places:

// Telegram runtime
createChannelIngressResolver({
  channelId: "telegram",
  accountId,
  identity: telegramIngressIdentity,
  cfg,
  groupAllowFromFallbackToAllowFrom: false,
});

// Package metadata
{
  "openclaw": {
    "channel": {
      "id": "telegram",
      "doctorCapabilities": {
        "groupAllowFromFallbackToAllowFrom": false
      }
    }
  }
}

The runtime flag changes live authorization behavior. The package metadata lets openclaw doctor --fix preserve existing configs without loading Telegram runtime.

When that future PR lands, doctor can copy:

{
  "channels": {
    "telegram": {
      "allowFrom": ["123456789"]
    }
  }
}

to:

{
  "channels": {
    "telegram": {
      "allowFrom": ["123456789"],
      "groupAllowFrom": ["123456789"]
    }
  }
}

This PR only adds that generic machinery; it does not set the Telegram runtime flag or package metadata.

Summary

• Adds fallback capability metadata to plugin manifests/read-only discovery.
• Wires shared runtime paths to honor fallback-disable metadata when channels opt out later.
• Adds openclaw doctor --fix preservation-copy repair.
• Adds capability-aware doctor warnings for configs still relying on fallback.
• Removes separate migration-target metadata; copy targets are inferred from the disabled fallback.

Verification

• pnpm test src/config/allowfrom-fallback-transition.test.ts src/config/materialize.test.ts src/commands/doctor/channel-capabilities.test.ts src/commands/doctor/shared/empty-allowlist-policy.test.ts src/commands/doctor/repair-sequencing.test.ts src/channels/plugins/read-only.test.ts -- --reporter=verbose
• pnpm test src/commands/doctor/repair-sequencing.test.ts src/commands/doctor/shared/empty-allowlist-policy.test.ts src/commands/doctor/shared/preview-warnings.test.ts src/config/allowfrom-fallback-transition.test.ts src/config/materialize.test.ts -- --reporter=verbose
• pnpm test src/config/allowfrom-fallback-transition.test.ts src/config/materialize.test.ts src/commands/doctor/repair-sequencing.test.ts src/commands/doctor/shared/empty-allowlist-policy.test.ts src/commands/doctor/shared/empty-allowlist-scan.test.ts src/commands/doctor/shared/open-policy-allowfrom.test.ts src/commands/doctor/shared/preview-warnings.test.ts src/commands/doctor/channel-capabilities.test.ts src/commands/doctor-config-flow.test.ts src/auto-reply/command-control.test.ts src/auto-reply/reply/reply-elevated.test.ts src/plugin-sdk/channel-ingress-runtime.test.ts src/channels/plugins/read-only.test.ts src/security/dm-policy-shared.test.ts -- --reporter=verbose
• pnpm docs:list
• pnpm check:changed before rebase
• git diff --check origin/main...HEAD

Known after rebase: pnpm check:changed currently fails in untouched src/agents/pi-embedded-runner/run/helpers.test.ts with an upstream-main UsageAccumulator type error. The file is identical to origin/main.