OpenClaw Main Fixes Gateway Starvation, Large-History Startup and Named Profiles

OpenClaw has merged five changes aimed at Gateway availability under real operational load. Hook-triggered agents no longer share the saturated inner-cron lane, large session stores are counted before optional sidebar/catalog prewarm, post-ready background work yields, and canonical named profiles can again own native Gateway services.

All five changes are on main. They are not proof that an installed release contains them, and they do not justify an arbitrary source upgrade. Match the exact revision, then test with production-shaped concurrency and history volume.

Triage table

Cron load no longer owns webhook admission

PR #116666 fixes a queue-classification problem. Hook-triggered agent turns entered the cron lane; the isolated cron runner then remapped them to cron-nested, which has a hard budget of eight inner agent slots. Eight busy cron turns could therefore occupy every slot and make an unrelated /hooks/agent request fail after the 15-second admission timeout.

The merge introduces a dedicated hook-dispatch command lane. This is better than merely raising the shared limit: webhooks and scheduled jobs now have separate admission ownership, so one workload class cannot consume the other’s entire budget by construction.

Interpretation: concurrency limits are also availability policy. If unrelated ingress paths share one bounded pool, the busiest producer decides which work the system is allowed to accept.

Operators should still cap hook traffic and cron fan-out independently. Isolation prevents accidental starvation; it does not create unlimited capacity.

Large session histories should not block a “ready” Gateway

PR #117108 first skipped expensive catalog prewarm for large histories. Live deployment evidence then showed another eager path remained: sidebar session-list prewarm could materialize a roughly 15,000-row store before the safeguard took effect. The official PR #117118 reports Gateways announcing readiness and then timing out health and RPC checks while one CPU core remained busy.

The follow-up counts before prewarm, aligns the admission targets and budgets repeated shared-store preparation. PR #117083 adds a yield before post-ready background work.

The operator lesson is stricter than “startup is faster.” Readiness must mean the event loop can serve health and control traffic. Logging a ready message immediately before synchronous background work is a false contract if probes cannot run.

Test this with a restored, non-sensitive copy of your real store shape. A fresh profile with ten sessions cannot represent a long-lived Gateway with thousands.

Named profiles regain native service ownership

PR #116314 repairs service commands for canonical lowercase named profiles and relocated OPENCLAW_HOME installations. The shared install-identity guard compared them with the unprofiled OS account default, classified valid profile-specific paths as isolated state and refused service lifecycle commands.

The correction resolves identity against the active OpenClaw home and profile. This is a compatibility boundary because each profile projects distinct state, configuration and native service identity.

Before adopting it on a multi-profile host:

1. record each profile’s exact home, config and state paths;
2. list native service units or launch agents through supported platform controls;
3. start one profile and verify only its service becomes active;
4. stop or restart it and confirm sibling profiles remain untouched; and
5. verify the service process reads the intended profile rather than the default account state.

Do not rename profile directories or hand-edit service definitions merely to bypass the old refusal. A refusal is safer than starting a Gateway against the wrong credentials and message routes.

Availability acceptance run

Use a staging host with synthetic hook payloads and a restored redacted history:

1. occupy the supported cron-inner budget with bounded harmless jobs;
2. submit a hook agent request and confirm it is admitted through its own lane;
3. restart with a production-sized session count and poll both /healthz and a basic RPC from the moment readiness is reported;
4. verify background prewarm remains optional and does not repeatedly monopolize the shared store;
5. repeat cold start under your actual CPU and disk limits; and
6. exercise install, start, stop and restart for every named profile while checking service and state isolation.

Set time and resource limits before load testing. Do not turn a staging proof into uncontrolled queue growth.

Evidence and limits

The official repository packet provides the merged PR and commit chronology, the eight-slot/15-second starvation mechanism, live large-history startup evidence and the named-profile identity correction. Direct GitHub extraction and independent search were unavailable, so detailed upstream results are attributed rather than independently reproduced.

OpenClaw Academy did not run a 15,000-session Gateway or saturate a live cron queue. The evidence establishes merged source fixes, not their presence in a release or capacity guarantees for a particular host.

Bottom line

Gateway availability depends on work ownership before it depends on bigger limits. Hooks need a lane cron cannot exhaust, optional prewarm must stay behind readiness, and a named profile must control only its own service identity.

Track a containing build, test with your real history shape and concurrency, and treat a responsive health endpoint—not a log line—as the proof that startup completed.