fix(commitments): serialize load-modify-save with in-process queue + cross-process file lock by clawsweeper[bot] · Pull Request #86326 · openclaw/openclaw

clawsweeper · 2026-05-25T04:32:39Z

Makes #81153 merge-ready for the ClawSweeper automerge loop.
The edit pass should inspect the live PR diff, review comments, and failing checks; rebase if needed; keep the contributor branch credited; and stop only when validation is green or an external blocker is proven.

ClawSweeper 🐠 replacement reef notes:

Cluster: automerge-openclaw-openclaw-81153
Source PRs: fix(commitments): serialize load-modify-save with in-process queue + cross-process file lock #81153
Credit: Source PR: fix(commitments): serialize load-modify-save with in-process queue + cross-process file lock #81153
Validation: pnpm check:changed
Replacement reason: ClawSweeper could not update the source PR branch directly, so it opened a writable replacement PR instead.
Automerge requested by: @Takhoffman

Repair fallback: GitHub rejected the repair branch push because it updates workflow files and the ClawSweeper app token does not have workflows permission

Inherited issue-closing references from the source PR:
Closes #81145

Co-author credit kept:

@ai-hpc: Co-authored-by: NVIDIAN 183861985+ai-hpc@users.noreply.github.com

fish notes: model gpt-5.5, reasoning high; reviewed against 2d84450.

clawsweeper · 2026-05-25T04:35:25Z

Codex review: passed. Reviewed May 25, 2026, 1:14 AM ET / 05:14 UTC.

Summary
The PR adds a commitments-store writer helper, wraps load-modify-save mutators and expiry cleanup with a per-path queue plus withFileLock, adds three concurrency regressions, and updates the changelog.

PR surface: Source +153, Tests +61, Docs +1. Total +215 across 4 files.

Reproducibility: yes. Source inspection on current main shows the unqueued load-modify-save mutation path, and the linked proof log shows the Promise.all repro changing from 20/20 lost writes before the patch to 0/20 after.

Review metrics: 3 noteworthy metrics.

PR surface: 4 files changed; +291, -76. The change is moderate but confined to commitments storage, its tests, and the changelog.
Write paths protected: 4 load-modify-save paths wrapped. The patch covers the three mutators plus expiry cleanup that can write the commitments store.
Concurrency tests: 3 added. The added tests pin the reported same-process lost-write cases before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

none

Risk before merge

Exact-head CI had two in-progress checks during review, so merge should wait for the normal check and mergeability gates.
The proof directly exercises same-process races; cross-process daemon-plus-CLI behavior is supported by the existing withFileLock contract and matching precedent rather than a separate live cross-process run.

Maintainer options:

Decide the mitigation before merge
Land this focused writer queue/file-lock fix after exact-head gates pass, then close [Bug]: commitments store has no write serialization — concurrent markCommitmentsStatus / markCommitmentsAttempted calls silently lose dismiss/sent/attempt updates (data-loss class; can re-deliver an already-sent commitment) #81145 as implemented.
Pause or close
Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge
No repair job is needed; this automerge-armed PR has no blocking findings and should proceed through exact-head CI and mergeability gates.

Security
Cleared: The diff only adds local file-lock-backed store serialization, tests, and a changelog entry; it does not add dependencies, workflows, network calls, secret handling, or broader execution surfaces.

Review details

Best possible solution:

Land this focused writer queue/file-lock fix after exact-head gates pass, then close #81145 as implemented.

Do we have a high-confidence way to reproduce the issue?

Yes. Source inspection on current main shows the unqueued load-modify-save mutation path, and the linked proof log shows the Promise.all repro changing from 20/20 lost writes before the patch to 0/20 after.

Is this the best way to solve the issue?

Yes. The PR applies the existing in-process queue plus withFileLock pattern to the implicated commitments write critical sections without changing public mutator signatures or store schema.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 908b894432c4.

Label changes

Label justifications:

P1: The PR fixes a user-facing commitments state-loss bug that can lose dismissals, duplicate sent commitments, or roll back attempt counters under concurrent writes.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
status: 🚀 automerge armed: This PR is in ClawSweeper's automerge lane. Sufficient (live_output): The source PR includes after-fix live output showing the same race repro improve from 20/20 lost writes before the patch to 0/20 after, plus targeted test results.
proof: sufficient: Contributor real behavior proof is sufficient. The source PR includes after-fix live output showing the same race repro improve from 20/20 lost writes before the patch to 0/20 after, plus targeted test results.

Evidence reviewed

PR surface:

Source +153, Tests +61, Docs +1. Total +215 across 4 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	2	229	76	+153
Tests	1	61	0	+61
Docs	1	1	0	+1
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	4	291	76	+215

What I checked:

Current-main bug path: Current main still performs bare load-modify-save in markCommitmentsAttempted, so overlapping writers can read the same snapshot and overwrite one another. (src/commitments/store.ts:532, 908b894432c4)
Current-main status mutation path: markCommitmentsStatus has the same unqueued store load, mutation, and save shape on current main. (src/commitments/store.ts:562, 908b894432c4)
Patch write gate: The PR head adds runExclusiveCommitmentsStoreWrite, which queues per store path and wraps each task in withFileLock after ensuring the store directory exists. (src/commitments/store-writer.ts:102, a349f41ccfe8)
Patched mutators: The PR head routes upsertInferredCommitments, markCommitmentsAttempted, and markCommitmentsStatus through the new writer gate without changing their public signatures. (src/commitments/store.ts:394, a349f41ccfe8)
Lock contract: withFileLock acquires the sidecar file lock and releases it in a finally, which is the cross-process layer reused by the patch. (src/plugin-sdk/file-lock.ts:104, 908b894432c4)
Existing same-pattern precedent: persistent-dedupe documents why a re-entrant file lock alone is insufficient and uses an in-process per-file write queue before withFileLock. (src/plugin-sdk/persistent-dedupe.ts:157, 908b894432c4)

Likely related people:

vincentkoc: GitHub path history and local blame point to recent work on the current commitments store and tests, including the exact current-main mutator lines. (role: recent commitments storage contributor; confidence: high; commits: ba48d162af5a, 500c95b1ba8a; files: src/commitments/store.ts, src/commitments/store.test.ts)
vignesh07: GitHub path history shows the inferred commitments feature and follow-up safety/coverage work were introduced under this handle before the reported race. (role: introduced commitments feature; confidence: high; commits: 8e4035d09a88, 95bf450dc973, b277ae3f4c40; files: src/commitments/store.ts, src/commitments/store.test.ts, src/infra/heartbeat-runner.ts)
steipete: History on file-lock.ts and persistent-dedupe.ts shows repeated ownership of the shared lock helper and the existing queue-plus-file-lock precedent this PR mirrors. (role: adjacent file-lock and storage contributor; confidence: medium; commits: 52bfe5060cd8, e9905fd69674, e7ae306aa18b; files: src/plugin-sdk/file-lock.ts, src/plugin-sdk/persistent-dedupe.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

clawsweeper · 2026-05-25T04:43:05Z

ClawSweeper PR egg

✨ Hatched: 🥚 common Clockwork Branchling

Hatch command

Comment @clawsweeper hatch when this PR is hatchable.

Hatchability rules:

Merged PRs are hatchable.
Open PRs are hatchable when they are status: 👀 ready for maintainer look, status: 🚀 automerge armed, or labeled clawsweeper:automerge.
Closed unmerged PRs are hatchable only when one of those hatchable labels is still present in the durable record.

Rarity: 🥚 common.
Trait: finds missing screenshots.
Image traits: location flaky test forest; accessory review stamp; palette moss green and polished brass; mood mischievous; pose holding its accessory up for inspection; shell soft velvet shell; lighting clean product lighting; background tiny artifact crates.
Share on X: post this hatch
Copy: My PR egg hatched a 🥚 common Clockwork Branchling in ClawSweeper.

What is this egg doing here?

Eggs appear after the PR passes real-behavior proof. It is here for vibes, not verdicts: it does not change labels, ratings, merge decisions, or automation.
The shell reacts to review momentum: open follow-up work warms it up, re-review makes it wobble, and a clean final review lets it hatch.
Hatchability usually comes from sufficient real-behavior proof, no blocking P0/P1/P2 findings, no security attention needed, and clean correctness. A merged PR is already final, so merge makes the egg hatchable independently.
The hatch is seeded from this repository and PR number, so the same PR keeps the same creature; the reviewed head SHA can only change safe visual details.
Rarity is just collectible sparkle: 🥚 common, 🌱 uncommon, 💎 rare, ✨ glimmer, and 🌈 legendary.

clawsweeper · 2026-05-25T04:43:23Z

🦞✅
ClawSweeper merged this PR after the passing review.

Source: clawsweeper[bot]
Feedback: structured ClawSweeper verdict: pass (sha=a349f41ccfe88105a8b26733081759ac18e5a668)
Merge status: merged by ClawSweeper automerge
Merged at: 2026-05-25T05:18:20Z
Merge commit: d3c293d9c8f1

What merged:

The PR adds a commitments-store writer helper, wraps load-modify-save mutators and expiry cleanup with a per-path queue plus withFileLock, adds three concurrency regressions, and updates the changelog.
PR surface: Source +153, Tests +61, Docs +1. Total +215 across 4 files.
Reproducibility: yes. Source inspection on current main shows the unqueued load-modify-save mutation path, a ... inked proof log shows the Promise.all repro changing from 20/20 lost writes before the patch to 0/20 after.

Automerge notes:

PR branch already contained follow-up commit before automerge: fix(commitments): serialize load-modify-save with in-process queue + …

The automerge loop is complete.

Automerge progress:

2026-05-25 04:43:23 UTC repair queued 2d84450a65b6 (autonomous) Run: https://github.com/openclaw/clawsweeper/actions/runs/26383623117

2026-05-25 04:46:03 UTC repair started (running) in 0s Run: https://github.com/openclaw/clawsweeper/actions/runs/26383623117 automerge-openclaw-openclaw-81153

2026-05-25 04:46:06 UTC repair completed 2d84450a65b6 (no branch change) in 4s Run: https://github.com/openclaw/clawsweeper/actions/runs/26383623117 no planned fix actions

2026-05-25 04:46:05 UTC review queued 2d84450a65b6 (after no-op repair)

2026-05-25 04:55:27 UTC repair queued 2d84450a65b6 (autonomous) Run: https://github.com/openclaw/clawsweeper/actions/runs/26383952332

2026-05-25 04:57:50 UTC repair started (running) in 1s Run: https://github.com/openclaw/clawsweeper/actions/runs/26383952332 automerge-openclaw-openclaw-81153

2026-05-25 04:58:05 UTC validation plan (passed) in 16s Run: https://github.com/openclaw/clawsweeper/actions/runs/26383952332 node scripts/run-vitest.mjs src/commitments/store.test.ts; pnpm check:changed; pnpm lint; pnpm check:test-types

2026-05-25 04:58:18 UTC Codex write preflight (passed) in 29s Run: https://github.com/openclaw/clawsweeper/actions/runs/26383952332 danger-full-access

2026-05-25 05:04:39 UTC Codex edit 1 a349f41ccfe8 (complete) in 6m 49s Run: https://github.com/openclaw/clawsweeper/actions/runs/26383952332 exit 0

2026-05-25 05:08:05 UTC validation and review 1 a349f41ccfe8 (complete) in 10m 15s Run: https://github.com/openclaw/clawsweeper/actions/runs/26383952332 already-current

2026-05-25 05:08:08 UTC repair completed a349f41ccfe8 (branch updated) in 10m 19s Run: https://github.com/openclaw/clawsweeper/actions/runs/26383952332 initial automerge rebase is delegated to Codex repair

2026-05-25 05:08:08 UTC review queued a349f41ccfe8 (after repair)

2026-05-25 05:18:11 UTC automerge wait a349f41ccfe8 (waiting) in 20m 22s Run: https://github.com/openclaw/clawsweeper/actions/runs/26383952332 waiting for exact-head ClawSweeper review pass

2026-05-25 05:18:12 UTC repair finished a349f41ccfe8 (pushed) in 20m 23s Run: https://github.com/openclaw/clawsweeper/actions/runs/26383952332 repair_contributor_branch

2026-05-25 05:18:08 UTC review passed a349f41ccfe8 (structured ClawSweeper verdict: pass (sha=a349f41ccfe88105a8b26733081759ac18e5a...)

2026-05-25 05:18:21 UTC merged a349f41ccfe8 (merged by ClawSweeper automerge)

…cross-process file lock markCommitmentsAttempted, markCommitmentsStatus, upsertInferredCommitments, and the auto-expire pass in loadCommitmentStoreWithExpiredMarked each did an independent load-modify-save against ~/.openclaw/commitments/commitments.json with no lock. Two callers that overlapped in one event-loop tick — or in two different processes (gateway daemon heartbeat + standalone `openclaw commitments dismiss` CLI) — silently lost whichever save committed first. Verified 20/20 in a Promise.all repro on v2026.5.10-beta.1 (qa-reports/13-commitments-race-no-lock/programmatic-repro.log). User-visible symptoms: openclaw commitments dismiss silently reverts; a sent commitment can lose its sent stamp and get re-delivered; attempts counters can roll back past maxPerDay. Add src/commitments/store-writer.ts wrapping every mutator in runExclusiveCommitmentsStoreWrite, which layers a per-store-path in-process FIFO queue on top of withFileLock (advisory lockfile). The queue serializes same-process writers (CLI + heartbeat Promise.all + the now-queued loadCommitmentStoreWithExpiredMarked); the file lock serializes cross-process writers (gateway daemon vs. CLI), mirroring the same pattern used by src/plugin-sdk/persistent-dedupe.ts. Split the expire pass into an unchecked helper so upsertInferredCommitments can reuse it without re-entering the queue. Three regression tests in store.test.ts assert concurrent dismisses on disjoint ids, repeated attempted bumps, and a dismiss racing an attempted bump all converge — each fails on current main.

…cross-process file lock

…cross-process file lock (openclaw#86326) Summary: - The PR adds a commitments-store writer helper, wraps load-modify-save mutators and expiry cleanup with a per-path queue plus `withFileLock`, adds three concurrency regressions, and updates the changelog. - PR surface: Source +153, Tests +61, Docs +1. Total +215 across 4 files. - Reproducibility: yes. Source inspection on current main shows the unqueued load-modify-save mutation path, a ... inked proof log shows the Promise.all repro changing from 20/20 lost writes before the patch to 0/20 after. Automerge notes: - PR branch already contained follow-up commit before automerge: fix(commitments): serialize load-modify-save with in-process queue + … Validation: - ClawSweeper review passed for head a349f41. - Required merge gates passed before the squash merge. Prepared head SHA: a349f41 Review: openclaw#86326 (comment) Co-authored-by: ai-hpc <mail.speedy.hpc@hotmail.com> Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com> Co-authored-by: clawsweeper[bot] <274271284+clawsweeper[bot]@users.noreply.github.com> Approved-by: takhoffman Co-authored-by: takhoffman <781889+takhoffman@users.noreply.github.com>

…cross-process file lock (#86326) Summary: - The PR adds a commitments-store writer helper, wraps load-modify-save mutators and expiry cleanup with a per-path queue plus `withFileLock`, adds three concurrency regressions, and updates the changelog. - PR surface: Source +153, Tests +61, Docs +1. Total +215 across 4 files. - Reproducibility: yes. Source inspection on current main shows the unqueued load-modify-save mutation path, a ... inked proof log shows the Promise.all repro changing from 20/20 lost writes before the patch to 0/20 after. Automerge notes: - PR branch already contained follow-up commit before automerge: fix(commitments): serialize load-modify-save with in-process queue + … Validation: - ClawSweeper review passed for head a349f41. - Required merge gates passed before the squash merge. Prepared head SHA: a349f41 Review: #86326 (comment) Co-authored-by: ai-hpc <mail.speedy.hpc@hotmail.com> Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com> Co-authored-by: clawsweeper[bot] <274271284+clawsweeper[bot]@users.noreply.github.com> Approved-by: takhoffman Co-authored-by: takhoffman <781889+takhoffman@users.noreply.github.com> (cherry picked from commit d3c293d)

…cross-process file lock (openclaw#86326) Summary: - The PR adds a commitments-store writer helper, wraps load-modify-save mutators and expiry cleanup with a per-path queue plus `withFileLock`, adds three concurrency regressions, and updates the changelog. - PR surface: Source +153, Tests +61, Docs +1. Total +215 across 4 files. - Reproducibility: yes. Source inspection on current main shows the unqueued load-modify-save mutation path, a ... inked proof log shows the Promise.all repro changing from 20/20 lost writes before the patch to 0/20 after. Automerge notes: - PR branch already contained follow-up commit before automerge: fix(commitments): serialize load-modify-save with in-process queue + … Validation: - ClawSweeper review passed for head a349f41. - Required merge gates passed before the squash merge. Prepared head SHA: a349f41 Review: openclaw#86326 (comment) Co-authored-by: ai-hpc <mail.speedy.hpc@hotmail.com> Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com> Co-authored-by: clawsweeper[bot] <274271284+clawsweeper[bot]@users.noreply.github.com> Approved-by: takhoffman Co-authored-by: takhoffman <781889+takhoffman@users.noreply.github.com>

clawsweeper Bot mentioned this pull request May 25, 2026

fix(commitments): serialize load-modify-save with in-process queue + cross-process file lock #81153

Closed

22 tasks

openclaw-barnacle Bot removed the proof: supplied External PR includes structured after-fix real behavior proof. label May 25, 2026

clawsweeper Bot added status: 🚀 automerge armed This PR is in ClawSweeper's automerge lane. and removed status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels May 25, 2026

ai-hpc and others added 2 commits May 25, 2026 05:02

fix(commitments): serialize load-modify-save with in-process queue + …

a349f41

…cross-process file lock

clawsweeper Bot force-pushed the clawsweeper/automerge-openclaw-openclaw-81153 branch from 2d84450 to a349f41 Compare May 25, 2026 05:08

clawsweeper Bot merged commit d3c293d into main May 25, 2026
98 checks passed

clawsweeper Bot deleted the clawsweeper/automerge-openclaw-openclaw-81153 branch May 25, 2026 05:18

github-actions Bot mentioned this pull request May 25, 2026

📡 Upstream Digest — 2026-05-25 08:12 UTC curtismercier/openclaw-mods#942

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(commitments): serialize load-modify-save with in-process queue + cross-process file lock#86326

fix(commitments): serialize load-modify-save with in-process queue + cross-process file lock#86326
clawsweeper[bot] merged 2 commits into
mainfrom
clawsweeper/automerge-openclaw-openclaw-81153

clawsweeper Bot commented May 25, 2026

Uh oh!

clawsweeper Bot commented May 25, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented May 25, 2026

Uh oh!

clawsweeper Bot commented May 25, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

clawsweeper Bot commented May 25, 2026

Uh oh!

clawsweeper Bot commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clawsweeper Bot commented May 25, 2026

Hatch command

Uh oh!

clawsweeper Bot commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

clawsweeper Bot commented May 25, 2026 •

edited

Loading

clawsweeper Bot commented May 25, 2026 •

edited

Loading