chore: release OpenClaw 2026.9.8 with Windows recovery fixes

[RomneyDa]

What Problem This Solves

The published OpenClaw 2026.9.8 MSIX does not include the gateway and isolated-session recovery fixes merged since its release.

User Impact

Prepare v2026.9.8-msix.1 (2026.9.801.0) from current packaging main, including #157, #158, #159, and #164, without changing the upstream payload or package identities.

Why This Change Was Made

Increment the packaging revision to 1. Retain stable-channel source ownership (npm latest currently resolves to 2026.9.8); the official workflow captures and validates immutable source provenance. Refresh only the latest production upgrade fixtures to the accepted v2026.9.8-msix.0 standalone and bundle assets, using GitHub's published SHA-256 digests. Preserve the all-zero proof baselines.

Release scope is an officially signed GitHub rebuild using OpenClaw 2026.9.8 and current packaging main. Do not dispatch official signing until this exact-head CI, including the 13-scenario upgrade matrix, succeeds and the PR is merged. Future upstream releases must reset the revision to 0.

Evidence

Head: b2fe4368b6b204d03953214db2034c5a4bf2746c.

• Passed locally: Test-MSIXReleaseIdentity.Tests.ps1, Test-MSIXUpgradeMatrix.Tests.ps1, Test-WorkflowPackageVersion.Tests.ps1, Test-OpenClawSource.Tests.ps1 (55 cases), and git diff --check. These inputs are unchanged from the tested final file contents.

• Windows exact-head CI passed Test-SigningInputs.Tests.ps1 (Test signing policy), managed quality/tests, NativeAOT CLI execution, both architecture builds, and bundle composition. The interrupted local signing-suite result was not recovered; CI supplies completed proof against the same inputs. No production validator or assertion was weakened.

• Not run locally: Windows managed quality/tests, NativeAOT, x64/ARM64 packaging, actual installed-package upgrades, or signing. Windows PR CI owns the first four; signing and publication remain in the official main workflow.

• Accepted baseline: https://github.com/openclaw/openclaw-windows-packaging/releases/tag/v2026.9.8-msix.0

• Previous production release workflow: https://github.com/openclaw/openclaw-windows-packaging/actions/runs/37089606868

• Final exact-head Windows CI succeeded: https://github.com/openclaw/openclaw-windows-packaging/actions/runs/37717732737. All 13 upgrade scenarios passed and retained evidence, including Microsoft Store in-place upgrade from 2026.9.800.0 to 2026.9.801.0 with LocalState preserved. Upstream source captured as 2026.9.8 at fc23bc864e4553c2d215e479eeec47b67a0bf943.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed October 7, 2026, 10:26 PM ET / October 8, 2026, 02:26 UTC.

ClawSweeper review

What this changes

The branch increments the MSIX rebuild revision to 1 and refreshes the two production upgrade fixtures to the published OpenClaw 2026.9.8 packages.

Example: A maintainer builds an OpenClaw 2026.9.8 release

• Before: The release identity resolves to v2026.9.8-msix.0 and package version 2026.9.800.0.
• After: The release identity resolves to v2026.9.8-msix.1 and package version 2026.9.801.0.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The release-input patch is focused and source-consistent; available proof covers policy inputs rather than candidate installation and upgrades.
Proof confidence	🦐 gold shrimp (3/6)	Not applicable: This area-owner maintenance PR is outside the external-contributor proof gate. It changes release metadata, with reported policy-suite validation and independently verified published digests; candidate installation and upgrade results remain pending in the existing CI lane.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes
User problem: The published Windows package lacks the recently merged gateway and isolated-session recovery fixes.
Reason: A packaging rebuild delivers useful existing fixes through the established release path. The area's prior merged release changes and this owner-authored proposal support the direction.

Merge readiness

✅ Ready for maintainer review

This PR remains necessary: current main still selects packaging revision 0. The release-input changes follow the established rebuild policy, and no concrete patch defect was found.

Priority: P2
Reviewed head: b2fe4368b6b204d03953214db2034c5a4bf2746c

Before merge

None.

Findings

None.

Tests

• Missing end-to-end proof: The candidate's thirteen installed-package transition scenarios have not yet produced evidence; their prerequisite CI jobs are still running. This review did not execute target code.

Agent review details

How this fits together

The Windows packaging workflow combines the selected OpenClaw release with a packaging revision to produce MSIX packages. Hash-pinned previous packages feed its installation and upgrade checks before release.

flowchart TD
 A[Selected OpenClaw release] --> C[Release identity calculation]
 B[Packaging revision] --> C
 C --> D[Windows package builds]
 E[Hash-pinned previous packages] --> F[Installation and upgrade checks]
 D --> F
 F --> G[Reviewed main release workflow]

Loading

Technical review

Best possible solution:

Use the existing release workflow to ship the reviewed recovery fixes after its package and upgrade gates succeed, preserving stable-source selection and package identities.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is release preparation; source inspection confirms the version mapping and published API data confirms both baseline digests.

Is this the best way to solve the issue?

Yes: updating the existing revision and production fixtures is the established narrow path for a packaging-only rebuild.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against cadb7e860d24.

Provenance checked

• release-policy.json: msixRevision keeps the original intent (chore: prepare OpenClaw 2026.9.8 Gateway MSIX #151: Start the new OpenClaw 2026.9.8 release train at revision 0 with deterministic package and release identities.)
• scripts/msix-upgrade-baselines.json: production fixtures keeps the original intent (chore: prepare Gateway MSIX revision 6 #135: Pin the previous accepted production release assets for the packaging rebuild's upgrade gate.)

Testing

Proof path: unit tests only. Added test files: 0.

Security

None.

Evidence

What I checked:

• Verified introduced scope: The pinned introduced delta changes only the rebuild revision and two production baseline entries; all four proof fixtures and package identities remain unchanged. (release-policy.json:4, b2fe4368b6b2)
• Published baseline digests match: GitHub reports x64 digest cc7ab3df9c5250f85eeb21ba080b756eb740569b0c4f11892a2863e4d374333a and bundle digest c14faee6f063061fc9a89759583e8b892e250e1cfcfb13553f262c98382355f1 for v2026.9.8-msix.0; both exactly match the proposed fixtures. (scripts/msix-upgrade-baselines.json:32, b2fe4368b6b2)
• Current main still needs the revision change: Current main has msixRevision 0. The merged recovery changes described in fix: Companion cannot recover after isolated session replacement #157, fix: verify gateway logon recovery after registration #158, fix: recover denied gateway PIDs with verified process identity #159, and fix: preserve isolated capability in clawctl error responses #164 provide release contents, rather than replacing this release-preparation work. (release-policy.json:4, cadb7e860d24)
• Established release-owner direction: chore: prepare OpenClaw 2026.9.8 Gateway MSIX #151 established revision 0 for the first 2026.9.8 package; chore: prepare Gateway MSIX revision 6 #135 documents the same packaging-only rebuild and production-fixture refresh pattern. (release-policy.json:4, beacce88d786)
• Upgrade checks remain enforced: Six baselines generate twelve reset/sideload scenarios plus one authentic Store update scenario. The workflow runs these for versioning PRs, retains transition evidence, and includes their result in the aggregate CI gate. (.github/workflows/gateway-msix.yml:828, b2fe4368b6b2)
• Validation coverage at review time: The PR reports passing release-identity, upgrade-matrix, workflow-version, and source-selection suites. GitHub confirms the npm-package build succeeded; host tests and both architecture builds remain in progress, so installed-upgrade evidence is not yet available. Official signing remains reserved for the reviewed main workflow. (b2fe4368b6b2)

Likely related people:

• RomneyDa: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Labels

Label changes:

• add P2: This bounded release preparation makes already-merged Windows recovery improvements available to package users.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P2: This bounded release preparation makes already-merged Windows recovery improvements available to package users.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Retain the existing CI matrix's candidate installation and upgrade evidence to establish package-level proof.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only; repair and merge need explicit maintainer commands such as @clawsweeper autofix or @clawsweeper automerge.