[nmfretz]

Updates the packaged OpenClaw runtime to 2026.10.5 and pins Gateway, Doctor, onboarding and ordinary CLI calls to the image's runtime. A stale OpenClaw in persistent global npm storage can otherwise shadow the newly installed version.

The wrapper uses upstream startup migrations and its existing bounded Doctor repair. Production does not embed historical bridge releases, rewrite credential databases, or implement a separate snapshot/rollback system.

Upgrade scope

For this release, qualify normal upgrades from the three most recent public Store versions: 2026.9.2, 2026.9.4 and 2026.9.8, plus fresh installation. These paths assume the source has completed its normal upstream migrations. A recent version number alone does not establish that disabled plugins or imported data are current.

Very old installations and retained retired formats are outside this automatic-upgrade qualification. Upstream refusals remain failures and must preserve source data; the wrapper does not bypass them. Back up app data before updating. Reverting the image alone does not reverse database migrations.

Validation

Native amd64 and arm64 CI passed at b208b55: all three recent-source upgrades and fresh installation completed on each architecture. Both saved reports confirm full qualification, all 12 image unit tests, data integrity before and after restart, and preservation of refused retired input.

npm run test:upgrades builds the production image and uses exact digest-pinned published images with their original Node runtimes to prepare synthetic source state. The candidate starts through its normal wrapper entrypoint on the same persistent volume. Read-only database checks run with the Gateway stopped; live readiness and authentication use HTTP/WebSocket APIs. Native amd64 and arm64 CI cover:

• Recent-version upgrades: conversation messages, saved automation, Voice Wake, API-key and inline OAuth profiles, workspace/settings, SQLite integrity and the second Homebrew mount.
• Gateway readiness, browser authentication, cross-origin rejection, pinned CLI selection despite a stale persistent binary, and an ordinary restart.
• Fresh setup page, upstream non-interactive OpenAI onboarding, readiness, credential persistence and restart. Its pinned upstream Codex runtime is installed before adding synthetic credentials, then onboarding runs offline.
• Upstream refusal of retired cron data with the original bytes retained.
• Wrapper unit tests, including onboarding's pinned-module selection.

The historical Doctor investigation lab remains available through npm run test:migrations; it is separate from release qualification.

Image builds and dependency preparation use registry access. Credential-bearing fixtures and Gateway checks use synthetic credentials and isolated networks. They do not establish live provider replies, channel delivery, interactive TUI onboarding or encrypted Matrix recovery. The app update still needs a published image and final device testing against that exact image.