fix(dashboard): restore aggregate status compatibility

[brokemac79]

Summary

Restore the Overview and main OpenClaw Bay aggregate surfaces after the public status privacy projection made the embedded exact-review queue non-idempotent and left identity-only close rows as empty placeholders.

This is an aggregate-only compatibility hotfix. It does not restore repository, item, workflow, title, URL, query, token, credential, or failure-key identities to any public response.

Problem

The deployed /api/status document is itself passed through a second closed public projection before caching/serving and again through browser-side validation. Three naming collisions broke that path:

• pending, dispatching, and leased are both closed numeric fields and aggregate phase-container names, but the generic projection admitted only the numeric form.
• the exact-review collection enum is complete, while the generic closed enum admitted only completed.
• identity-bearing recent-close rows were correctly stripped, but their empty object placeholders remained and caused Overview relative-time rendering to throw on a missing timestamp.

Bay also applied its 10,000 live-depth ceiling to bounded lifetime cumulative lane totals, even though current totals are already larger.

The direct /api/exact-review-queue response remained complete while the same aggregate embedded in /api/status became unknown / malformed. Overview then fell back after a RangeError; Bay rejected the aggregate status snapshot. Reverting the GitHub-throttle chart change from #1174 would not repair any of these paths. Reverting the privacy containment from #1171 would reopen its metadata exposure and still would not repair the independent durable-lifecycle over-cap state.

Implementation

• Admit only the three named aggregate phase containers and the complete enum through both server and Overview client projectors.
• Keep live depths bounded at their existing limits while allowing _total fields through the existing 1,000,000,000,000 public-status bound.
• Apply that same bounded-total contract to five-minute history storage and both clients so established counters above 10,000,000 do not create false chart gaps.
• Drop only fully sanitized closed_items placeholders; retain aggregate close counts.
• Treat malformed legacy close-list caches and invalid timestamps as unavailable detail instead of throwing.
• Preserve legacy cached-snapshot compatibility and fail-closed behavior for malformed aggregate documents.

Privacy and cardinality

• The public allowlist remains closed and field-based.
• No new identifiers or free-form text fields are admitted.
• Phase keys are fixed to pending, dispatching, and leased.
• Lifetime totals remain safe integers under a fixed 1,000,000,000,000 ceiling; live depths retain their tighter bounds.
• Sanitized close details render an explicit aggregate-only empty state.
• The existing durable-lifecycle 512-row fail-closed boundary is unchanged.

Validation

Exact head: a484445e03c5a091851f054d5fb75b10fb358079
Base: d7a3ac19a833ef019b6e0bcacb422a3d3b8544e3 (main)

Focused:

pnpm run build:dashboard
node --test test/dashboard-operational-health.test.ts test/dashboard-worker-status-privacy.test.ts test/dashboard-worker-dashboard-status.test.ts test/dashboard-worker-bay-records-routes.test.ts test/dashboard-worker-observability.test.ts
# 149 passed, 0 failed
pnpm run check:dashboard-queue-boundary
pnpm run lint:dashboard
git diff --check

Exact-head Docker/browser proof:

provider=local-container target=linux
image=mcr.microsoft.com/playwright:v1.60.0-noble
lease=cbx_c0197fb9b0a7 run=run_00d7872c9160
head=a484445e03c5a091851f054d5fb75b10fb358079
build:all: pass
focused dashboard/status/history tests: 149/149 pass
aggregate/privacy behavior receipt: pass
Overview and Bay browser receipt: pass, zero browser exceptions
lint: pass
check:active-surface: pass
check:dashboard-queue-boundary: pass
check:dashboard-strict: pass
check:docs: pass
check:limits: pass
format:check: 729/729 files pass from a native-Linux checkout of the exact head
artifact bundle: .crabbox/runs/run_00d7872c9160/run_00d7872c9160-artifacts.tgz (212,095 bytes)
artifact SHA-256: 881E569ADCB6E16A8994D8D12B77F4E2D5BBED2FEAD9031627184C582FEA4DF4

Behavior receipt:

{"proof":"dashboard-aggregate-status-compatible","collection":"complete","handoff":{"pending":7,"dispatching":2,"leased":1},"review_enqueued_total":11120211,"publication_completed_total":11123501,"close_placeholders":0,"identity_marker_present":false}

Browser receipt:

{"proof":"dashboard-browser-render","overview_fallback":false,"bay_status_unavailable":false,"active_units":28,"browser_exceptions":0,"identity_detail":"omitted","artifacts":["overview.png","overview.html","bay.html"]}

The bundle contains the redacted browser receipt, Overview PNG/HTML, Bay HTML,
and local proof-server/browser logs. Its closed fixture contains aggregate counts
only. The Crabbox lease was released automatically after proof.

An earlier supplemental AWS run and local-container run passed at the first repair commit. They are superseded by the exact-head run above after review-driven follow-up changes.

Native Windows format:check reports checkout-wide CRLF noise across all 729 files. The Linux proof initially exposed one genuine changed-test formatting issue despite that noise; it was fixed, and the exact amended head then passed all 729 files. No repository-wide line-ending or platform-policy change is included.

Real Behavior Proof

• Claim: a complete closed exact-review aggregate survives the server's second public projection and both dashboard clients without restoring identity fields.
• Exercised surface: publicExactReviewQueueProjection -> publicStatusProjection -> Overview and Bay client sanitizers/renderers.
• Scenario: live-shaped aggregate status plus direct exact-review aggregate, with totals above ten million, all three handoff phases, an identity-bearing close row, and a private sentinel.
• Command/environment: exact committed head a484445e03c5a091851f054d5fb75b10fb358079 in Docker-backed Crabbox local-container run run_00d7872c9160, image mcr.microsoft.com/playwright:v1.60.0-noble, lease cbx_c0197fb9b0a7.
• Observed result: the server collection remained complete; handoff rendered pending/dispatching/leased counts; totals above ten million survived current and history contracts; close placeholders became an honest aggregate-only empty state; the sentinel was absent. The browser receipt recorded overview_fallback=false, bay_status_unavailable=false, active_units=28, and browser_exceptions=0.
• Browser render receipt: Overview rendered without console errors or Live refresh failed, restored exact-review cards and handoff phases, and displayed the aggregate-only close-detail message. Bay rendered without aggregate-status unavailable, restored its six main stages and handoff phases, and retained the GitHub-throttle chart.
• Artifact/trace: .crabbox/runs/run_00d7872c9160/run_00d7872c9160-artifacts.tgz (212,095 bytes; SHA-256 881E569ADCB6E16A8994D8D12B77F4E2D5BBED2FEAD9031627184C582FEA4DF4) and the emitted CSW-131-local-container-browser-proof-final.md receipt.
• Limits: the proof composes current public aggregate endpoints through the patched modules; it does not deploy or mutate production. The separate durable-lifecycle endpoint still honestly reports unknown / over_cap and is out of scope here.

Review

• Dirty Codex review findings were fixed and rerun until clean: client phase containers, lifetime-total bounds in Bay and server projection, malformed close-list normalization, and alignment of history-total bounds across storage and both clients.
• The first hosted ClawSweeper review questioned whether the reprojection fixture was complete. The helper did supply the missing fields, but the test was made explicit: it now calls the strict projector with a complete fixture, verifies public_projection_complete=true, and proves an identity-bearing close sentinel is removed.
• A committed Codex review then found the 10,000,000 history ceiling could create gaps once admitted cumulative totals passed it. That valid finding was fixed with a separate 1,000,000,000,000 total bound while live depths keep tight limits; exact-head proof was rerun.
• Final committed codex review --base origin/main: clean — “The patch consistently expands aggregate total bounds across queue projection, stored history, dashboard parsing, and Bay parsing, while preserving the privacy projection's idempotence.”
• Final local ClawSweeper committed-range review at the exact head: exit 0, decision=keep_open, confidence=high, action=kept_open; it made no GitHub mutation.

Risks and rollback

Risk is limited to public aggregate status validation and rendering. The principal risk is admitting an unintended nested namespace; fixed allowlists, bounded values, sentinel tests, idempotence tests, and queue-boundary checks cover that path.

If this hotfix regresses the dashboard, revert this commit. Do not revert #1171 without equivalent privacy containment. No storage migration, schedule, queue, capacity, credential, or production-state change is included.

Overlap

• fix: contain public worker status metadata #1171 introduced the privacy projector this hotfix preserves and makes idempotent.
• feat(bay): chart GitHub throttle history #1174 added the throttle chart but did not cause the Overview/status/lifecycle failures; this hotfix leaves that chart intact.
• fix(publication): stop repository pool on first throttle #1145 remains draft/inactive and does not overlap this status compatibility repair.
• No current open PR modifies these dashboard/status compatibility paths.

Related investigation: CSW-131.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[brokemac79]

@clawsweeper review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/31945741056
• Updated: 2026-08-16T11:57:45.619Z

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 16, 2026, 8:45 AM ET / 12:45 UTC.

ClawSweeper review

What this changes

The PR restores aggregate exact-review status through the public Worker projection, Overview, and OpenClaw Bay without re-admitting identity-bearing status data.

Regression provenance

Possible regression — probable (reviewed change; reproduction). No predecessor PR is attributed.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

This PR remains necessary: current main still drops the aggregate phase objects and complete state during repeated public-status projection. The branch provides a focused, bounded compatibility repair with sufficient exact-head behavior proof and no actionable correctness finding.

Priority: P2
Reviewed head: a484445e03c5a091851f054d5fb75b10fb358079

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	The focused patch has strong exact-head behavior evidence and no actionable review finding; the public-schema expansion warrants normal maintainer scrutiny.
Proof confidence	🦞 diamond lobster (5/6) ✨ media proof bonus	Sufficient (linked_artifact): The PR body supplies exact-head Docker browser and aggregate receipts showing restored Overview and Bay rendering while identity sentinels remain absent.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (linked_artifact): The PR body supplies exact-head Docker browser and aggregate receipts showing restored Overview and Bay rendering while identity sentinels remain absent.
Evidence reviewed	5 items	Current-main compatibility gap: Current main only retains object values whose field names are public containers; its phase-object names are absent, so a reprojection cannot preserve the nested handoff phase aggregates. Bounded repair on the PR head: The PR head admits only the three fixed phase-object names, preserves the closed-item aggregate empty state, and uses a separate one-trillion ceiling for lifetime totals. Regression coverage: Focused tests cover a complete second projection with identity sentinels removed, phase aggregates retained, malformed close rows normalized, and totals above ten million retained through history clients.
Findings	None	None.
Security	None	None.

How this fits together

The dashboard Worker emits a privacy-filtered aggregate status document that cached responses, Overview, and OpenClaw Bay consume. The changed projection and client parsers determine which bounded queue aggregates survive that path and reach read-only dashboards.

flowchart LR
A[Private queue status] --> B[Closed public projection]
B --> C[Cached status document]
C --> D[Overview dashboard]
C --> E[OpenClaw Bay]
B --> F[Aggregate queue counters]
F --> D
F --> E

Loading

Before merge

• Resolve merge risk (P1) - The generic status projector now recognizes three phase names as object containers globally; any future reuse of those names outside the exact-review aggregate needs the same closed-schema privacy review.
• Complete next step (P2) - The PR already has a focused implementation, current proof, and no concrete mechanical repair for an automated worker to perform.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Changed surface	8 files; +189/-51 lines	The patch is limited to the public status contract, two dashboard consumers, history normalization, and focused regression tests.
Production versus tests	production +50/-24; tests +139/-27	Most of the change is focused coverage for projection, rendering, and lifetime-total boundaries.

Merge-risk options

Maintainer options:

1. Accept the bounded aggregate contract (recommended)
   Treat the three phase maps and one-trillion lifetime-total ceiling as the intentional public compatibility contract, retaining the supplied idempotence and privacy-sentinel coverage.

Technical review

Best possible solution:

Land the narrow aggregate-only compatibility repair while retaining fixed field allowlists, bounded totals, and privacy-sentinel coverage.

Do we have a high-confidence way to reproduce the issue?

Yes: current-main source shows the missing object and enum admission path, while the supplied exact-head proof exercises the repeated projection and both clients with aggregate-only fixtures.

Is this the best way to solve the issue?

Yes: extending only the closed aggregate schema and normalizing sanitized detail is narrower and safer than weakening the privacy projection.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against d7a3ac19a833.

Labels

Label justifications:

• P2: This is a bounded dashboard compatibility regression with a focused repair and no demonstrated data exposure.
• merge-risk: 🚨 compatibility: The PR changes the public aggregate status contract consumed by cached responses and both dashboard surfaces.
• merge-risk: 🚨 security-boundary: The public status privacy allowlist is expanded for fixed aggregate containers and must remain closed.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (linked_artifact): The PR body supplies exact-head Docker browser and aggregate receipts showing restored Overview and Bay rendering while identity sentinels remain absent.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR body supplies exact-head Docker browser and aggregate receipts showing restored Overview and Bay rendering while identity sentinels remain absent.

Evidence

What I checked:

• Current-main compatibility gap: Current main only retains object values whose field names are public containers; its phase-object names are absent, so a reprojection cannot preserve the nested handoff phase aggregates. (dashboard/worker.ts:2225, d7a3ac19a833)
• Bounded repair on the PR head: The PR head admits only the three fixed phase-object names, preserves the closed-item aggregate empty state, and uses a separate one-trillion ceiling for lifetime totals. (dashboard/worker.ts:1752, a484445e03c5)
• Regression coverage: Focused tests cover a complete second projection with identity sentinels removed, phase aggregates retained, malformed close rows normalized, and totals above ten million retained through history clients. (test/dashboard-worker-status-privacy.test.ts:859, a484445e03c5)
• Feature provenance: The merged privacy-boundary work appears to date to the status containment merge, followed by current-main Bay status work; the PR is a compatibility follow-up rather than a duplicate of either change. (dashboard/worker.ts:1691, 43799a11fc26)
• Patch hygiene: The reviewed range has no whitespace errors and the checkout remained clean after read-only inspection. (a484445e03c5)

Likely related people:

• brokemac79: Authored the merged public-status privacy work and adjacent Bay status work identified in the supplied pull-request history. (role: introduced adjacent public-status behavior; confidence: high; commits: fb0e3d73520c, efbe0ac96a43; files: dashboard/worker.ts, dashboard/dashboard-pages.ts, dashboard/bay-page.ts)
• Martin Cleary: Merged the public-status containment change and the current-main Bay status change that form this PR's immediate baseline. (role: recent merger and area contributor; confidence: high; commits: 43799a11fc26, d7a3ac19a833; files: dashboard/worker.ts, dashboard/dashboard-pages.ts, dashboard/bay-page.ts)
• Peter Steinberger: History shows substantial earlier work on dashboard status rendering and extraction around the affected surfaces. (role: historical dashboard contributor; confidence: medium; commits: c145b4599285, 1c4abe0c2908; files: dashboard/worker.ts, dashboard/dashboard-pages.ts)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (4 earlier review cycles)

• reviewed 2026-08-16T11:51:38.458Z sha f581b4d :: needs real behavior proof before merge. :: none
• reviewed 2026-08-16T11:55:54.574Z sha f581b4d :: needs real behavior proof before merge. :: [P2] Exercise the second projection with a complete status document
• reviewed 2026-08-16T12:21:52.459Z sha f581b4d :: needs maintainer review before merge. :: none
• reviewed 2026-08-16T12:40:54.060Z sha a484445 :: needs maintainer review before merge. :: none

[brokemac79]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/31946924002
• Updated: 2026-08-16T12:23:39.918Z

[brokemac79]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.