Summary

• Fix iMessage group link-preview watch payloads that lose their conversation anchor (chat_id=0, empty chat_guid / chat_identifier, is_group=false) before they can be classified as sender DMs.
• Move anchorless recovery/fail-closed drop ahead of live inbound debounce classification so coalesceSameSenderDms cannot merge malformed group payloads under the raw chat:0 DM bucket.
• Keep the existing recovery path for catchup/direct handling and add monitor-level regression coverage for the live coalescing path.

Real behavior proof

Behavior or issue addressed: iMessage group link-preview watch payloads can arrive without usable conversation anchor fields. Before this fix, live notifications entered the inbound debouncer first, so with coalesceSameSenderDms=true multiple anchorless group payloads from the same sender could be merged under imessage:<account>:dm:chat:0:<sender> before recovery. The merged turn was then repaired using only the first GUID and could route content from another group under the first recovered group.

Real environment tested: macOS 26.4.1, Node.js v24.15.0, OpenClaw v2026.5.19, worktree SHA e22876fd1bef, imsg 0.9.0 installed at /opt/homebrew/bin/imsg.

Exact steps or command run after this patch:

imsg status --json
printf '{"jsonrpc":"2.0","id":1,"method":"chats.list","params":{"limit":3}}\n' | imsg rpc --json

OPENCLAW_GATEWAY_PORT=19046 \
OPENCLAW_GATEWAY_TOKEN=pr-84503-local-token \
OPENCLAW_STATE_DIR=/Users/zhangguiping/daily_pr_work/proofs/openclaw-pr-84503-local-proof/state \
OPENCLAW_CONFIG_PATH=/Users/zhangguiping/daily_pr_work/proofs/openclaw-pr-84503-local-proof/state/openclaw.json \
node scripts/run-node.mjs --dev gateway --bind custom --port 19046

curl --noproxy '*' -sS -I http://127.0.0.1:19046/
curl --noproxy '*' -sS http://127.0.0.1:19046/health

OPENCLAW_GATEWAY_PORT=19046 \
OPENCLAW_GATEWAY_TOKEN=pr-84503-local-token \
OPENCLAW_STATE_DIR=/Users/zhangguiping/daily_pr_work/proofs/openclaw-pr-84503-local-proof/state \
OPENCLAW_CONFIG_PATH=/Users/zhangguiping/daily_pr_work/proofs/openclaw-pr-84503-local-proof/state/openclaw.json \
node scripts/run-node.mjs channels status --probe --channel imessage --json

pnpm exec vitest run \
  extensions/imessage/src/monitor.watch-subscribe-retry.test.ts \
  extensions/imessage/src/monitor/conversation-repair.test.ts \
  extensions/imessage/src/monitor.gating.test.ts \
  extensions/imessage/src/monitor/coalesce.test.ts

Evidence after fix:

$ imsg status --json
{
  "version": "0.9.0",
  "basic_features": true,
  "sip": "enabled",
  "advanced_features": false,
  "rpc_methods": [
    "chats.list",
    "messages.history",
    "watch.subscribe",
    "watch.unsubscribe",
    "send",
    "send.rich",
    "send.attachment"
  ]
}

$ printf '{"jsonrpc":"2.0","id":1,"method":"chats.list","params":{"limit":3}}\n' | imsg rpc --json
{"result":{"chats":[]},"id":1,"jsonrpc":"2.0"}

2026-05-24T18:23:21.205+08:00 [gateway] http server listening (10 plugins: acpx, bonjour, browser, canvas, device-pair, file-transfer, imessage, memory-core, phone-control, talk-voice; 1.7s)
2026-05-24T18:23:21.211+08:00 [gateway] starting channels and sidecars...
2026-05-24T18:23:21.264+08:00 [imessage] [default] starting provider (/opt/homebrew/bin/imsg db=/Users/zhangguiping/Library/Messages/chat.db)
2026-05-24T18:23:21.646+08:00 [gateway] ready

$ curl --noproxy '*' -sS -I http://127.0.0.1:19046/
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8

$ curl --noproxy '*' -sS http://127.0.0.1:19046/health
{"ok":true,"status":"live"}

$ node scripts/run-node.mjs channels status --probe --channel imessage --json
{
  "channels": {
    "imessage": {
      "configured": true,
      "cliPath": "/opt/homebrew/bin/imsg",
      "dbPath": "/Users/zhangguiping/Library/Messages/chat.db",
      "running": true,
      "lastError": null,
      "probe": {
        "ok": true,
        "privateApi": {
          "available": false,
          "rpcMethods": [
            "chats.list",
            "messages.history",
            "watch.subscribe",
            "watch.unsubscribe"
          ]
        }
      }
    }
  },
  "channelAccounts": {
    "imessage": [
      {
        "accountId": "default",
        "enabled": true,
        "configured": true,
        "running": true,
        "lastError": null,
        "probe": {
          "ok": true
        }
      }
    ]
  }
}

Test Files  4 passed (4)
Tests       51 passed (51)
Duration    2.82s

Observed result after fix: The patched PR source starts a real OpenClaw gateway with the real iMessage plugin enabled, not skipped. The gateway starts /opt/homebrew/bin/imsg against the local Messages database, reaches ready, reports the iMessage account as configured/running with lastError: null, and the live channel probe confirms the watch.subscribe, messages.history, and chats.list RPC methods required by the anchorless-payload recovery path. The regression test for the reported live coalescing path still verifies that two anchorless payloads from different groups are repaired before debounce classification, so they no longer share the raw chat:0 DM bucket.

Additional live evidence gathered after this patch:

• A real iMessage group chat exists locally (chat_id=3, is_group=true), and imsg messages.history shows a live URL message in that group:
  • https://github.com/openclaw/openclaw/pull/84503
• imsg watch.subscribe was started live and returned a real notification for a new group URL message sent with the same account:
  • subscription=1
  • chat_id=3
  • is_group=true
  • text=https://github.com/openclaw/openclaw/pull/84503
• That proves the local Messages.app + imsg + OpenClaw watch pipeline is live end-to-end on a real group conversation, but the notification payload itself was not malformed.

What was not tested: No new malformed group link-preview notification arrived from the local Messages account during this run, so the evidence does not include a live incoming private message/GUID. The live proof above verifies the patched OpenClaw runtime, real imsg bridge, local Messages DB access, and iMessage watch-capable channel startup; the exact malformed payload branch is covered by the monitor-level regression test using redacted synthetic GUIDs and handles.

Fixes #84470

Regression Test Plan

• Coverage level: Unit test
• Target test file: extensions/imessage/src/monitor.watch-subscribe-retry.test.ts, extensions/imessage/src/monitor/conversation-repair.test.ts, extensions/imessage/src/monitor.gating.test.ts, extensions/imessage/src/monitor/coalesce.test.ts
• Scenario locked in: Anchorless live iMessage payloads are repaired before inbound debounce classification, unrecoverable anchorless payloads fail closed, and existing conversation-repair/gating/coalescing behavior remains covered.
• Why this is the smallest reliable guardrail: The regression drives the same monitor/watch path where live watch.subscribe notifications enter OpenClaw, while keeping private iMessage handles and GUIDs out of the repository.

Root Cause

• Root cause: Live iMessage watch payloads were entering the inbound debouncer before conversation-anchor recovery. When a malformed group payload looked like chat_id=0, empty chat identifiers, and is_group=false, coalesceSameSenderDms could classify it as a sender DM before the GUID-based repair path had a chance to recover the real group.
• Missing detection / guardrail: The live monitor path lacked a pre-debounce guard for anchorless payloads and lacked regression coverage proving anchorless group payloads cannot be coalesced under a raw DM bucket.