@flame0510/project-aether 1.4.2 → 1.5.1

package/app/agents/BrowserAccessSection.tsx

@@ -6,11 +6,11 @@
  * From OpenClaw 9.x every new browser must be approved once before the Control UI
  * connects. This section lists the requests waiting for approval and the browsers
  * already approved, with approve, reject, rename and revoke. Agents created on
- * 2026.7.x run with device approval disabled and have nothing to list.
+ * Every supported agent lists its browsers through the CLI.
  *
  * `OpenControlUiButton` opens the Control UI through a one-time link that pairs the
  * browser with no approval, or through the plain token link when no one-time link can
- * be issued (2026.7.x has no `openclaw dashboard --json`).
+ * be issued.
  *
  * Data comes from `/api/agents/[id]/devices`, which runs the OpenClaw CLI inside the
  * container. It refreshes every few seconds only while this section is mounted.
@@ -352,7 +352,7 @@ export default function BrowserAccessSection({
 
       {access?.requiresApproval === false && (
         <div style={metaStyle}>
-          This agent runs with browser approval disabled (OpenClaw 2026.7.x): its Control UI opens with the token alone,
+          This agent could not be read: its Control UI may open with the token alone,
           so there is nothing to approve.
         </div>
       )}

package/app/api/agents/[id]/open-control-ui/route.ts

@@ -3,7 +3,7 @@
  *
  * What the "Open" buttons navigate to, in a new tab. Redirects to the agent's Control
  * UI: through a one-time link that pairs the browser with no approval on OpenClaw 9.x,
- * or through the plain token link on 2026.7.x or when no one-time link can be issued.
+ * or through the plain token link when no one-time link can be issued.
  *
  * The target host is the one this request reached Rev4a on (the `Host` header), with
  * the agent's published port. It is never a parameter: a page elsewhere that gets a

package/app/api/agents/devices-summary/route.ts

@@ -2,9 +2,8 @@
  * GET /api/agents/devices-summary
  *
  * Browsers waiting for approval, per running agent — the "browser waiting" badge on
- * the agent cards. Agents whose config disables device auth (2026.7.x) are answered
- * from the config alone, without the CLI. One agent that cannot be read reports
- * `error: true` and does not blank the others.
+ * the agent cards. One agent that cannot be read reports `error: true` and does not
+ * blank the others.
  */
 import { NextResponse, type NextRequest } from 'next/server';
 import { requireAuthJWT } from '@/lib/rev4a-auth';

package/app/api/gateway/sync.ts

@@ -38,8 +38,9 @@ const PROVIDER_GATEWAY_BASE_URL = detectProviderGatewayUrl();
  */
 /**
  * Model `input` values an agent's OpenClaw version accepts. The list is per version
- * (lib/agent-versions.json): 7.1-2 knows only `text | image`, and one value it does not
- * know invalidates the whole generated catalogue ("model catalog load issue").
+ * (lib/agent-versions.json): a value the running Gateway does not know invalidates the
+ * whole generated catalogue ("model catalog load issue"), and the accepted set grows
+ * between releases.
  */
 function modalityToInput(modality: string, version?: string | null): string[] {
   const allowed = new Set(modelInputFor(version));
@@ -376,8 +377,8 @@ export function syncAllAgents(): SyncOutcome {
       continue;
     }
     try {
-      // Per agent: the `input` list follows the version that agent runs, so a 7.x
-      // release never receives a modality value it would reject.
+      // Per agent: the `input` list follows the version that agent runs, so an agent on
+      // an older supported release never receives a modality value it would reject.
       syncContainer(container, buildRev4aProviderConfig(containerVersionSync(container.name)));
       outcome.synced.push(container.name);
       if (!container.running) outcome.stopped.push(container.name);

package/app/api/update-check/route.ts

@@ -68,45 +68,56 @@ export async function GET(request: Request): Promise<NextResponse> {
     }
   }
 
-  return NextResponse.json({ installed, latest, updateAvailable, package: getPackageInfo().name });
+  return NextResponse.json({ installed, latest, updateAvailable, package: getPackageInfo().name, log: 'update.log' });
 }
 
 /**
  * POST /api/update-check
  *
- * Spawns rev4a update as a detached background process.
- * rev4a update installs the latest version and writes .restart-flag,
- * which rev4a serve detects and exits with code 42, then auto-restarts
- * with the newly installed binary. No systemd required.
+ * Spawns `rev4a update` as a detached background process: it installs the latest
+ * version, writes `.restart-flag` and lets `rev4a serve` restart the child (`rev4a
+ * _run`) with the new binary. Nothing here has to restart anything — the update kills
+ * this very process on its way in (`fuser -k <port>/tcp`), so any callback meant to run
+ * after it is dead code; the CLI's own flag is the only mechanism that has to work.
+ *
+ * The child's output goes to `update.log` in the data directory: since the update
+ * restarts this process mid-run, that file is the only record of what happened.
  */
 export async function POST(request: Request): Promise<NextResponse> {
   const denied = await requireAuthJWT(request);
   if (denied) return denied;
 
-  // Spawn rev4a update in background, then write restart flag directly
-  // from this process so rev4a serve detects it and restarts.
   const { spawn } = require('child_process');
   const { join } = require('path');
-  const { writeFileSync } = require('fs');
+  const { openSync, closeSync, appendFileSync } = require('fs');
 
   const dataDir = process.env.REV4A_DATA_DIR ||
     join(process.env.HOME || '/root', '.config', 'rev4a', 'data');
+  const logPath = join(dataDir, 'update.log');
+
+  let log: number | null = null;
+  try {
+    log = openSync(logPath, 'a');
+    appendFileSync(logPath, `\n[${new Date().toISOString()}] rev4a update, started from the dashboard\n`);
+  } catch {
+    // Unwritable log: run the update anyway, we just lose the record.
+  }
 
   const child = spawn('rev4a', ['update'], {
-    stdio: 'ignore',
+    stdio: log === null ? 'ignore' : ['ignore', log, log],
     detached: true,
+    cwd: dataDir,
   });
+  if (log !== null) closeSync(log);
 
-  // When rev4a update finishes, write the restart flag so rev4a serve
-  // picks it up and exits with code 42, triggering the auto-restart loop.
-  child.on('exit', () => {
-    try { writeFileSync(join(dataDir, '.restart-flag'), ''); } catch {}
+  child.on('error', (e: Error) => {
+    try { appendFileSync(logPath, `[dashboard] could not start the update: ${e.message}\n`); } catch {}
   });
-
   child.unref();
 
   return NextResponse.json({
     success: true,
-    message: 'Update started. The dashboard will restart once complete.',
+    message: 'Update started. Rev4a restarts itself once the new version is installed.',
+    log: 'update.log',
   });
 }

package/app/components/VersionBanner.tsx

@@ -1,14 +1,42 @@
 'use client';
 
+/**
+ * "Update available" banner for Rev4a itself.
+ *
+ * The update is spawned by `POST /api/update-check` and restarts the server, so this
+ * component cannot be told the outcome by the response. It records what it asked for,
+ * waits for the server to answer again, and on the next mount compares: if the
+ * installed version moved it was updated, and if the same update is still offered it
+ * did not complete (the log file says why).
+ */
 import { useEffect, useState } from 'react';
 
 interface VersionInfo {
   installed: string;
   latest: string | null;
   updateAvailable: boolean;
+  log?: string;
 }
 
 const DISMISS_KEY = 'rev4a-update-dismissed';
+/** What we asked for and from which version, so the next mount can judge the outcome. */
+const PENDING_KEY = 'rev4a-update-pending';
+
+/** How long to poll for the restart before reloading anyway. */
+const WAIT_MS = 120_000;
+
+interface Pending { target: string; from: string }
+
+function readPending(): Pending | null {
+  try {
+    const raw = sessionStorage.getItem(PENDING_KEY);
+    if (!raw) return null;
+    const parsed = JSON.parse(raw) as Pending;
+    return parsed && typeof parsed.target === 'string' && typeof parsed.from === 'string' ? parsed : null;
+  } catch {
+    return null;
+  }
+}
 
 export default function VersionBanner() {
   const [info, setInfo] = useState<VersionInfo | null>(null);
@@ -18,17 +46,37 @@ export default function VersionBanner() {
   const [updateOk, setUpdateOk] = useState<string | null>(null);
 
   useEffect(() => {
+    let active = true;
     fetch('/api/update-check?check=1')
       .then((r) => r.json())
       .then((d: VersionInfo) => {
+        if (!active) return;
+        const pending = readPending();
+        // Back from an update: did the installed version actually move?
+        if (pending && d.installed !== pending.from) {
+          sessionStorage.removeItem(PENDING_KEY);
+          setUpdateOk(`Updated to v${d.installed}`);
+          setTimeout(() => { if (active) window.location.reload(); }, 2000);
+          return;
+        }
+        if (pending) {
+          sessionStorage.removeItem(PENDING_KEY);
+          setInfo(d);
+          setDismissed(false);
+          setUpdateError(
+            `The update to v${pending.target} did not complete: Rev4a is still on v${d.installed}.`
+            + ` See ${d.log ?? 'update.log'} in the Rev4a data directory.`,
+          );
+          return;
+        }
         if (d.updateAvailable) {
           setInfo(d);
           const saved = localStorage.getItem(DISMISS_KEY);
-          if (saved === d.latest) setDismissed(true);
-          else setDismissed(false);
+          setDismissed(saved === d.latest);
         }
       })
       .catch(() => {});
+    return () => { active = false; };
   }, []);
 
   function handleDismiss() {
@@ -39,6 +87,7 @@ export default function VersionBanner() {
   }
 
   async function handleUpdate() {
+    if (!info) return;
     setUpdating(true);
     setUpdateError(null);
     setUpdateOk(null);
@@ -49,21 +98,37 @@ export default function VersionBanner() {
         headers: { 'Content-Type': 'application/json' },
       });
       const data = await res.json();
-      if (data.success) {
-        setUpdateOk('Update started. Restarting\u2026');
-        localStorage.removeItem(DISMISS_KEY);
-        setTimeout(function() { window.location.reload(); }, 5000);
-      } else {
+      if (!data.success) {
         setUpdateError(data.error || 'Update failed');
         setUpdating(false);
+        return;
       }
+      sessionStorage.setItem(PENDING_KEY, JSON.stringify({ target: info.latest ?? '', from: info.installed }));
+      localStorage.removeItem(DISMISS_KEY);
+      setUpdateOk('Update started. Rev4a is restarting…');
+      // The server goes down and comes back on the new version: wait for its answer,
+      // then reload. A timeout reloads too — the next mount reports the outcome.
+      const deadline = Date.now() + WAIT_MS;
+      const poll = async () => {
+        if (Date.now() > deadline) { window.location.reload(); return; }
+        try {
+          const r = await fetch('/api/update-check', { cache: 'no-store' });
+          const d = (await r.json()) as VersionInfo;
+          if (d.installed !== info.installed) { window.location.reload(); return; }
+        } catch { /* the server is down for the update: expected */ }
+        setTimeout(poll, 3000);
+      };
+      setTimeout(poll, 3000);
     } catch (err) {
       setUpdateError(err instanceof Error ? err.message : 'Network error');
       setUpdating(false);
     }
   }
 
-  if (!info || dismissed) return null;
+  // The result states stand on their own (there may be no `info` when the update just
+  // succeeded); the "available" state needs the version info and no dismissal.
+  const show = Boolean(updateOk) || Boolean(updateError) || Boolean(info?.updateAvailable && !dismissed);
+  if (!show) return null;
 
   return (
     <div className="update-banner">
@@ -73,25 +138,25 @@ export default function VersionBanner() {
             <span className="update-banner__ok">{updateOk}</span>
           ) : updateError ? (
             <span className="update-banner__err">{updateError}</span>
-          ) : (
+          ) : info ? (
             <>
               <span className="update-banner__label">Update available</span>
               <span className="update-banner__sep">&mdash;</span>
               <span className="update-banner__version">v{info.latest}</span>
               <span className="update-banner__sep">(installed: v{info.installed})</span>
             </>
-          )}
+          ) : null}
         </span>
 
         {!updateOk && (
           <div className="update-banner__actions">
             {updateError ? (
               <button className="ui-btn ui-btn--primary ui-btn--sm" onClick={handleUpdate} disabled={updating}>
-                {updating ? 'Updating\u2026' : 'Retry'}
+                {updating ? 'Updating…' : 'Retry'}
               </button>
             ) : (
               <button className="ui-btn ui-btn--primary ui-btn--sm" onClick={handleUpdate} disabled={updating}>
-                {updating ? 'Updating\u2026' : 'Update now'}
+                {updating ? 'Updating…' : 'Update now'}
               </button>
             )}
             <button className="ui-btn ui-btn--ghost ui-btn--sm" onClick={handleDismiss}>

package/docs/ARCHITECTURE.md

@@ -120,11 +120,13 @@ The central container, running the Next.js dashboard + orchestration API.
 - Immutable by agents — enforced by the `:ro` mount
 - See `lib/agent-setup.ts` for the centralized volume + config guarantee logic
 - **Waiting for a new container** is `waitForGatewayReady()` in
-  `lib/agent-readiness.ts`, used by create, recreate and the agent route. On
-  OpenClaw 9.x it waits for `/startupz` to report `started` (503 while starting).
-  The 2026.7.1-2 image has no `/startupz` — its gateway serves the web UI with 200
-  for unknown paths — so there it falls back to `/health`, which only shows the
-  server is listening. Do not reimplement the wait in a route.
+  `lib/agent-readiness.ts`, used by create, recreate and the agent route. It waits for
+  `/startupz` to report `started` (503 while starting or draining, a non-JSON 200 or no
+  answer mean "not yet"). A Gateway that refused readiness — one that found a legacy
+  session store and wants `doctor --fix` — answers 200 on `/health` while draining; the
+  old fallback that accepted that as "ready" was removed with 7.x support, because it
+  let callers configure an agent that was still migrating. Do not reimplement the wait in
+  a route.
 - **The model catalogue** is read only through `lib/model-catalogue.ts`:
   `loadModelsConfig()`, `loadOfferedModels()` (enabled after overrides, provider has
   a key), `isModelOffered()` (enforced by the proxy and the assistant) and
@@ -134,10 +136,12 @@ The central container, running the Next.js dashboard + orchestration API.
   OpenClaw versions, newest first, with the model `input` list for each; the server reads
   it through `lib/agent-versions.ts`, the `rev4a` CLI with `require`. The provider sync
   takes each agent's own list (`containerVersionSync()`: image tag, else the entrypoint's
-  `.last-version` file), so a 2026.7.x agent is never sent an `input` value it would
-  reject — one unknown value discards the whole generated catalogue. The previous
-  versions stay listed while agents still run them: that is also what lets a rollback
-  pull the previous image. `lib/agent-images.ts`
+  `.last-version` file), so an agent on an older supported release is never sent an
+  `input` value it would reject — one unknown value discards the whole generated
+  catalogue. A version stays listed while agents still run it, and listing it is also what
+  lets a rollback pull its image: since 2026.9.3 is the only entry, a rollback whose target
+  is no longer listed is refused up front (`startAgentRollback()`) instead of restoring a
+  volume on a version this build cannot run. `lib/agent-images.ts`
   lists local `openclaw-agent-base:<version>` images through the Docker API, reads an
   agent's version (image label or tag, else `openclaw --version` in the container, cached
   per image id), reads the registry tag list over HTTP (cached 10 min), pulls a version
@@ -209,9 +213,9 @@ The central container, running the Next.js dashboard + orchestration API.
   `openclaw devices list | approve | reject | rename | remove` and
   `openclaw dashboard --json`, run inside the container with the async `dockerExec`.
   The gateway token is resolved inside the container (`/root/.agent-token`, then its
-  environment), never passed in argv. Whether approval applies is decided by the
-  OpenClaw version: 9.x answers `/startupz` with JSON and always requires it;
-  2026.7.x follows `gateway.controlUi.dangerouslyDisableDeviceAuth`.
+  environment), never passed in argv. Every supported OpenClaw answers `/startupz` with
+  JSON and always requires approval; when that read fails the panel says it could not
+  tell, instead of guessing.
   `buildInviteLink()` builds the plain token link for someone else; the invite route
    refuses agents without approval. Every link's token is read inside the container,
    and its host is the request's `Host` header (`hostnameFromHostHeader()`), never a

package/docs/REV4A.md

@@ -306,7 +306,7 @@ Lists all agents (Docker containers with `AGENT_ID` label), with:
 - **Control UI link** — the **Open** buttons go through `GET /api/agents/[id]/open-control-ui`, which redirects to the agent's published port on the host the dashboard was reached on: a one-time link on OpenClaw 9.x, the plain `#token=` link otherwise, with the token read inside the container.
 - **Agent creation wizard** — multi-step form at `/agents/create`.
 - **Channel Manager** — each agent detail panel has a Channels section with Telegram configuration and pairing management. Pending requests (a sender's `/start` creates one) show an **Approve** button; approved senders show **Revoke** with a confirmation. Approved senders are OpenClaw's pairing store, not the agent config: on 2026.9.x the SQLite store, read and revoked through OpenClaw's own store functions (see [ARCHITECTURE.md](ARCHITECTURE.md)).
-- **Browser access** — the detail panel section right after Channels. From OpenClaw 9.x each new browser must be approved once before the Control UI connects: the section lists requests waiting for approval (Approve / Reject) and approved browsers (Rename / Revoke), and the agent card shows a "browser waiting" badge. The **Open** buttons first ask the agent for a one-time link that pairs the browser with no approval, and open the plain token link when none can be issued (every 2026.7.x agent). **Invite link** (9.x agents only) gives a link to send to someone else: their browser passes gateway auth and waits in the approval list until approved. The link carries the gateway token every agent shares; changing the agents token invalidates every link sent. All of it runs the OpenClaw CLI inside the container asynchronously.
+- **Browser access** — the detail panel section right after Channels. From OpenClaw 9.x each new browser must be approved once before the Control UI connects: the section lists requests waiting for approval (Approve / Reject) and approved browsers (Rename / Revoke), and the agent card shows a "browser waiting" badge. The **Open** buttons first ask the agent for a one-time link that pairs the browser with no approval, and open the plain token link when none can be issued (the agent is stopped, or the link fails). **Invite link** gives a link to send to someone else: their browser passes gateway auth and waits in the approval list until approved. The link carries the gateway token every agent shares; changing the agents token invalidates every link sent. All of it runs the OpenClaw CLI inside the container asynchronously.
 
 ### Agent Creation Wizard (`/agents/create`)
 
@@ -326,9 +326,8 @@ Available templates:
 1. The container boots with the newest supported OpenClaw version downloaded here, `openclaw-agent-base:<version>`; the create answers `409` when none is — see [Agent Templates](#agent-templates) below.
 2. OpenClaw gateway starts automatically with `--allow-unconfigured`, generating its own default config.
 3. The route waits for the gateway to finish starting with `waitForGatewayReady()`, up
-   to 60 s. On OpenClaw 9.x it waits for `/startupz` to report `started`. The
-   2026.7.1-2 image has no `/startupz`, so there it waits for `/health`, which only
-   shows the server is listening.
+   to 60 s: `/startupz` has to report `started`. A 503 (starting or draining), a
+   non-JSON 200 or no answer all mean "not yet".
 4. Once ready, the route writes:
    - `gateway.controlUi` with the browser-origin policy (`withControlUiPolicy()` in `lib/agent-setup.ts`): the Host-header fallback on, so the Control UI is accepted from the host the browser connected to — a public IP is refused without it — while pages from other origins are refused; an `allowedOrigins: ["*"]` list and the retired `dangerouslyDisableDeviceAuth` are dropped, any other allowlist is kept. Recreate re-applies the policy. Each new browser still needs a one-time device approval
    - `agents.defaults.model.primary` + fallbacks — the primary model selected in the wizard

package/docs/dev/API-REFERENCE.md

@@ -1148,7 +1148,7 @@ agent was never recreated).
 {
   "recreate": {
     "id": 12, "agentId": "agent_9253eee3", "status": "backing_up",
-    "image": "openclaw-agent-base:2026.7.1-2",
+    "image": "openclaw-agent-base:2026.9.3",
     "backupFile": "agent-agent_9253eee3-prerecreate-2026-09-17_171000.tar.gz",
     "backupPercent": 40, "error": null,
     "startedAtMs": 1789656372120, "finishedAtMs": null
@@ -1170,12 +1170,12 @@ The agent's OpenClaw version, the update it could take, and its latest update
 
 ```json
 {
-  "currentVersion": "2026.7.1-2",
-  "candidate": { "fromVersion": "2026.7.1-2", "toVersion": "2026.9.3" },
+  "currentVersion": "2026.9.3",
+  "candidate": { "fromVersion": "2026.9.3", "toVersion": "2026.9.4" },
   "update": {
     "id": 3, "agentId": "agent_9253eee3", "status": "backing_up",
-    "fromVersion": "2026.7.1-2", "toVersion": "2026.9.3",
-    "backupFile": "agent-agent_9253eee3-preupdate-2026.7.1-2-2026-09-16_003512345.tar.gz",
+    "fromVersion": "2026.9.3", "toVersion": "2026.9.4",
+    "backupFile": "agent-agent_9253eee3-preupdate-2026.9.3-2026-09-16_003512345.tar.gz",
     "backupPercent": 40, "verification": null, "error": null,
     "startedAtMs": 1789524912000, "finishedAtMs": null
   }
@@ -1197,9 +1197,10 @@ the background.
 
 1. **Preflight** (refused with `409`): the agent runs, the target is downloaded,
    supported and newer than the agent's version, no update or backup is running.
-2. **Baseline**, inside the agent: transcript events per session (`.jsonl` lines on
-   2026.7.x, `transcript_events` rows from 9.x; trajectory files not counted) and cron
-   job names.
+2. **Baseline**, inside the agent: transcript events per session (`transcript_events`
+   rows in `openclaw-agent.sqlite`, plus `sessions/*.jsonl` and the
+   `session-sqlite-import-archive/` the 9.x import moves old files into, taking the
+   maximum per session; trajectory files not counted) and cron job names.
 3. **`backing_up`**: cold backup `agent-<id>-preupdate-<from>-<ts>.tar.gz`
    (`startColdBackup`, agent left stopped).
 4. **`migrating`**: the container is recreated on `openclaw-agent-base:<to>`
@@ -1384,8 +1385,8 @@ There is no CLI or RPC for this (`openclaw pairing` covers pending requests only
 `channels.pairing.*` has no remove — verified on 2026.9.3). The pairing store's own
 writer is used instead: `removeChannelAllowFromStoreEntry`, located by function name in
 OpenClaw's `pairing-store` module and run inside the container, so the write goes
-through the same state transaction the CLI uses. Verifying a 2026.7.x agent is out of
-scope: Rev4a targets 2026.9.3. On a release that no longer exposes the writer the call
+through the same state transaction the CLI uses. Rev4a supports 2026.9.x only, so no
+older layout is handled. On a release that no longer exposes the writer the call
 fails with a message pointing at `/allowlist remove` from the chat — nothing is silently
 left unchanged.
 
@@ -1412,9 +1413,8 @@ already approved.
 **Auth:** browser cookie
 
 Runs `openclaw devices list --json` inside the container with the async `dockerExec`;
-see `lib/agent-devices.ts`. On OpenClaw 2026.7.x, which answers `/startupz` with HTML
-and whose config disables device approval, the CLI is not called and both lists are
-empty.
+see `lib/agent-devices.ts`. When the Gateway cannot be read `requiresApproval` is null
+and both lists are empty.
 
 **Response:**
 ```json
@@ -1515,12 +1515,12 @@ Control UI.
 The target host is the one the request reached Rev4a on (the `Host` header), with the
 agent's published port — never a parameter, so the link cannot be sent to another host.
 
-- **OpenClaw 9.x** (it answers `/startupz` with JSON): runs `openclaw dashboard --json`
-  in the container and redirects to its `browserUrl`, with the host, the port and the
-  `gatewayUrl` fragment parameter rewritten to that host and the published port. The
-  link is single-use, expires after ten minutes, and pairs the browser with no approval.
-- **OpenClaw 2026.7.x**, or when no one-time link can be issued: redirects to the plain
-  link `http://<host>:<port>/#token=<token>`, with the token read inside the container
+- Runs `openclaw dashboard --json` in the container and redirects to its `browserUrl`,
+  with the host, the port and the `gatewayUrl` fragment parameter rewritten to that host
+  and the published port. The link is single-use, expires after ten minutes, and pairs
+  the browser with no approval.
+- When no one-time link can be issued: redirects to the plain link
+  `http://<host>:<port>/#token=<token>`, with the token read inside the container
   (`/root/.agent-token`, then `OPENCLAW_GATEWAY_TOKEN`).
 
 A navigation, not a JSON call: the button opens this URL inside the click, so no tab
@@ -2559,14 +2559,28 @@ Installed version against the latest published one.
 **Query params:** `check=1` queries the registry; without it the answer comes
 from local state only.
 
-**Response:** `{ "installed": "1.1.15", "latest": "1.1.16", "updateAvailable": true, "package": "@flame0510/project-aether" }`
+**Response:** `{ "installed": "1.4.2", "latest": "1.5.0", "updateAvailable": true, "package": "@flame0510/project-aether", "log": "update.log" }`
+
+`log` is the file name, in the Rev4a data directory, where the update's output is
+written.
 
 ### `POST /api/update-check`
-Run `rev4a update` as a detached background process. The dashboard restarts
-itself as part of the update, so the connection drops.
+Run `rev4a update` as a detached background process. Nothing here restarts anything:
+the update kills this process on its way in (`fuser -k <port>/tcp`) and `rev4a serve`
+brings the child back on the new binary via its `.restart-flag`, so the connection
+drops and the page has to wait for the server to answer again.
+
+The child's output goes to `update.log` in the data directory — the update restarts
+the process that spawned it, so that file is the only record of what happened.
 
 **Auth:** browser cookie or bearer token
 
+**Response:** `{ "success": true, "message": "...", "log": "update.log" }`
+
+The banner records what it asked for, polls `/api/version` until the installed version
+moves (or two minutes pass), reloads, and on the next mount either confirms
+"Updated to vX" or reports that the update did not complete and points at the log.
+
 ### `GET /api/alerts/smoke`
 Send a test alert, to verify the Telegram alerting path end to end.
 

package/docs/dev/GATEWAY.md

@@ -170,10 +170,10 @@ Saving calls `PUT /api/gateway/agent`, which writes the container's
   container's existing list untouched, `[]` clears it. The Model panel is the only
   UI that sets them; the create wizard does not
 - **no restart** — `agents` is in OpenClaw's hot-reload column, so the write
-  applies on the agent's next turn. Exception on OpenClaw 2026.7.1-2: a Telegram
-  channel keeps the configuration it had when it started, so Telegram replies stay on
-  the old model until the container is restarted. The Control UI picks the change up
-  at once. OpenClaw 9.x reads the configuration per message
+  applies on the agent's next turn. Current OpenClaw reads the configuration per
+  message; the Control UI picks the change up at once. (On 2026.7.1-2 a Telegram
+  channel kept the configuration it had when it started, so Telegram replies stayed on
+  the old model until the container was restarted — that build is no longer supported.)
 
 The agent list shows each agent's current model as a chip, fed by
 `GET /api/agents/models-summary`. The red states are split by remedy, because they
@@ -366,11 +366,11 @@ Restart the Rev4a server (via systemd).
    to the file directly without restarting the gateway.
 
    The model `input` list follows each agent's OpenClaw version
-   (`lib/agent-versions.json`, resolved by `containerVersionSync()`): the newest release
-   accepts `text | image | audio | video`, while `2026.7.1-2` accepts only `text | image`,
-   and one unknown value makes it discard the whole generated catalogue
-   (`model catalog load issue`). That is why the previous version stays in the table
-   while agents still run it.
+   (`lib/agent-versions.json`, resolved by `containerVersionSync()`): 2026.9.3 accepts
+   `text | image | audio | video`, an older release may accept less, and one unknown
+   value makes it discard the whole generated catalogue
+   (`model catalog load issue`). That is why a version stays in the table while agents
+   still run it.
 
 5. **Entrypoint does not generate openclaw.json** — The entrypoint resolves the
    auth token and starts the gateway with `--allow-unconfigured`; OpenClaw

package/docs/rag/REV4A-OVERVIEW.md

@@ -34,7 +34,7 @@ Manage Docker containers running OpenClaw agents. See which agents are running,
 
 The agent list also shows a compact TG chip next to each agent name (green = connected, hidden if not configured).
 
-**Browser access:** on agents running OpenClaw 9.x, every new browser has to be approved once before the agent's Control UI connects. The detail panel's "BROWSER ACCESS" section lists browsers waiting for approval, with Approve and Reject, and the browsers already approved, with Rename and Revoke. A yellow "BROWSER WAITING" chip on the agent card says a request is pending. The **Open** button tries a one-time link that lets the browser in without any approval; if the agent cannot issue one (agents still on OpenClaw 2026.7.x) it opens the normal link, which on those agents needs no approval anyway. To let someone else in, **Invite link** gives a link to send them: their browser appears under waiting for approval, and nothing opens until you approve it. The link contains the token all agents share; changing the agents token cancels every link already sent.
+**Browser access:** on agents running OpenClaw 9.x, every new browser has to be approved once before the agent's Control UI connects. The detail panel's "BROWSER ACCESS" section lists browsers waiting for approval, with Approve and Reject, and the browsers already approved, with Rename and Revoke. A yellow "BROWSER WAITING" chip on the agent card says a request is pending. The **Open** button tries a one-time link that lets the browser in without any approval; if the agent cannot issue one (it is stopped, or the link fails) it opens the normal link. To let someone else in, **Invite link** gives a link to send them: their browser appears under waiting for approval, and nothing opens until you approve it. The link contains the token all agents share; changing the agents token cancels every link already sent.
 
 The Agents page includes a banner for the **agent base image**, which is kept per
 OpenClaw version. It is hidden when a supported version is downloaded and nothing newer

package/lib/agent-devices.ts

@@ -9,11 +9,8 @@
  * with the entrypoint's precedence — `/root/.agent-token`, then the container's
  * `OPENCLAW_GATEWAY_TOKEN` — so it never reaches argv on the host.
  *
- * Browser approval exists from OpenClaw 9.x. Agents created on 2026.7.x carry
- * `gateway.controlUi.dangerouslyDisableDeviceAuth: true`: they open with the token
- * alone and have nothing to approve, so `requiresApproval` is false for them and
- * the CLI is not called. `openclaw dashboard --json` does not exist on 2026.7.x
- * either, so `resolveControlUiUrl` gives those agents the plain token link.
+ * Browser approval is part of OpenClaw 9.x, the only major this build supports. An
+ * agent whose Gateway cannot be read answers "unknown" rather than guessing.
  */
 import { dockerExec, dockerExecNoFail } from '@/lib/docker-exec';
 import { dockerFetch } from '@/lib/docker-socket';
@@ -110,35 +107,26 @@ async function runCli(container: string, args: string[], timeoutMs = CLI_TIMEOUT
   return parseCliJson(out);
 }
 
-/** True when the Gateway answers `/startupz` with JSON carrying its version, which only OpenClaw 9.x does. */
+/** True when the Gateway answers `/startupz` with JSON carrying its version: a 9.x Gateway. */
 async function answersStartupzWithVersion(container: string): Promise<boolean> {
   const probe = await dockerExecNoFail(container, ['curl', '-s', '--max-time', '3', 'http://127.0.0.1:3000/startupz'], { timeoutMs: CONFIG_TIMEOUT_MS });
   try {
     return typeof (JSON.parse(probe) as { version?: unknown })?.version === 'string';
   } catch {
-    // Not JSON: the 2026.7.x web UI answers every unknown path with HTML.
+    // Not JSON (a 9.x Gateway that is still starting answers 503, and a stopped agent
+    // answers nothing): the version cannot be read.
     return false;
   }
 }
 
 /**
- * Whether browsers need approval on this agent.
- *
- * The OpenClaw version decides first. 9.x answers `/startupz` with a JSON document
- * carrying its version, and there approval always applies: it ignores
- * `dangerouslyDisableDeviceAuth`, which an agent created on 2026.7.x may still carry.
- * Anything else is 2026.7.x, where that key does disable approval. Null when neither
- * can be read.
+ * Whether browsers need approval on this agent. Every supported OpenClaw answers
+ * `/startupz` with a JSON document carrying its version, and there approval always
+ * applies. Null when the Gateway cannot be read, so callers can answer "unknown"
+ * instead of guessing.
  */
 export async function requiresBrowserApproval(container: string): Promise<boolean | null> {
-  if (await answersStartupzWithVersion(container)) return true;
-  try {
-    const raw = await dockerExec(container, ['cat', '/root/.openclaw/openclaw.json'], { timeoutMs: CONFIG_TIMEOUT_MS });
-    const cfg = JSON.parse(raw) as { gateway?: { controlUi?: { dangerouslyDisableDeviceAuth?: unknown } } };
-    return cfg?.gateway?.controlUi?.dangerouslyDisableDeviceAuth !== true;
-  } catch {
-    return null;
-  }
+  return (await answersStartupzWithVersion(container)) ? true : null;
 }
 
 const str = (v: unknown): string | null => (typeof v === 'string' && v.trim() ? v.trim() : null);
@@ -329,9 +317,8 @@ const plainLink = (hostname: string, port: string, token: string) =>
   `http://${hostForUrl(hostname)}:${port}/#token=${encodeURIComponent(token)}`;
 
 /**
- * Where "Open" should take the browser: the one-time link on OpenClaw 9.x, which pairs
- * the browser with no approval, else the plain token link — on 2026.7.x, which has no
- * `dashboard --json` and needs no approval, or when no one-time link could be issued.
+ * Where "Open" should take the browser: the one-time link, which pairs the browser with
+ * no approval, else the plain token link when no one-time link could be issued.
  */
 export async function resolveControlUiUrl(
   container: string,

package/lib/agent-images.ts

@@ -128,7 +128,7 @@ const UNKNOWN_VERSION_TTL_MS = 5 * 60 * 1000;
 /**
  * The OpenClaw version a container runs: its image's label or version tag, else
  * `openclaw --version` inside the running container, for images built before the
- * label existed (2026.7.1-2 published as `:latest` only). Null for a stopped container
+ * label existed (a release published as `:latest` only). Null for a stopped container
  * whose image carries neither.
  */
 export async function containerOpenClawVersion(

package/lib/agent-readiness.ts

@@ -14,16 +14,14 @@
  * route deletes the container when this probe times out, so a false negative
  * there destroys a healthy agent over an unrelated channel.
  *
- * **Two OpenClaw majors.** `/startupz` exists from 9.x: 503 while starting or
- * draining, 200 with `{"status":"started"}` when done. The 2026.7.1-2 image that
- * `openclaw-agent-base` currently pins has no `/startupz`; its Gateway answers
- * every unknown path with 200 and the web UI's HTML. So the probe reads the
- * status code *and* the body, and falls back to `/health` only for a 200 that is
- * not JSON — the old image. A 503, or no answer, means "not yet", never "use
- * `/health`": reading an empty answer as "old image" makes a 9.x Gateway count as
- * ready the moment it starts listening.
- *
- * Delete the `/health` fallback once every image is on 9.x.
+ * **The endpoint used.** `/startupz` exists from 9.x: 503 while starting or
+ * draining, 200 with `{"status":"started"}` when done. The probe reads the status
+ * code *and* the body: a 503, a non-JSON 200 or no answer means "not yet". A
+ * Gateway that refused readiness — for instance one that found a legacy session
+ * store and wants `doctor --fix` — answers 200 on `/health` while draining; reading
+ * that as ready would let the create route configure an agent that is still
+ * migrating (the 2026.7.1-2 fallback that used to do exactly that was removed with
+ * 7.x support).
  *
  * **Async.** A request path must not hold Node's single thread for up to a
  * minute; see docs/ARCHITECTURE.md §3.1.
@@ -88,16 +86,9 @@ export async function waitForGatewayReady(
 
     if (startupz.status === 200) {
       const json = asJson(startupz.body);
-      if (json) {
-        // 9.x: accept only the answer that means startup finished.
-        if (json.status === 'started') return true;
-      } else {
-        // 200 with a non-JSON body: the 2026.7.1-2 web UI catch-all, so this build
-        // has no /startupz. Liveness is the best signal it offers.
-        const health = await probe(container, '/health');
-        const h = health.status === 200 ? asJson(health.body) : null;
-        if (h && (h.ok === true || h.status === 'live')) return true;
-      }
+      // 9.x: accept only the answer that means startup finished. A 200 with any other
+      // body is not a ready Gateway.
+      if (json && json.status === 'started') return true;
     }
     // 503 (starting or draining), any other code, or no answer: not yet.
 

package/lib/agent-update.ts

@@ -47,34 +47,51 @@ const COLD_BACKUP_WAIT_TIMEOUT_MS = 30 * 60 * 1000;
 export class UpdateRefusedError extends Error {}
 
 /**
- * Counts transcript events per session, inside the agent: `.jsonl` lines on 2026.7.x,
- * `transcript_events` rows in `openclaw-agent.sqlite` from 9.x. Keys are
- * `<agent>/<session id>`; trajectory files are debug traces and are not counted.
+ * Counts transcript events per session, inside the agent: `transcript_events` rows in
+ * `openclaw-agent.sqlite`. Keys are `<agent>/<session id>`; trajectory files are debug
+ * traces and are not counted.
+ *
+ * Two other places are read as well, each taking the maximum per session (never the sum):
+ *  - `sessions/*.jsonl`, for a build that still writes transcripts as files;
+ *  - `session-sqlite-import-archive/archive-tier.<id>.jsonl.imported-<ts>`, where 9.x
+ *    moves the old `.jsonl` files after importing them into SQLite. A session whose
+ *    events were **not** imported lives only there, so without it the count drops to
+ *    zero and a healthy migration reads as lost data (seen on the VPS with 10 short
+ *    sessions of an agent: the archived file still held the same 8 lines).
  */
 const COUNT_TRANSCRIPTS = `
 const fs = require('fs'), path = require('path');
 const out = {};
+const bump = (key, n) => { if (n > (out[key] || 0)) out[key] = n; };
+const linesOf = (file) => {
+  try { return fs.readFileSync(file, 'utf8').split('\\n').filter((l) => l.trim()).length; } catch { return 0; }
+};
 const root = '/root/.openclaw/agents';
 for (const agent of fs.existsSync(root) ? fs.readdirSync(root) : []) {
-  const sessions = path.join(root, agent, 'sessions');
+  const base = path.join(root, agent);
+  const sessions = path.join(base, 'sessions');
   if (fs.existsSync(sessions)) {
     for (const f of fs.readdirSync(sessions)) {
       if (!f.endsWith('.jsonl') || f.endsWith('.trajectory.jsonl')) continue;
-      const n = fs.readFileSync(path.join(sessions, f), 'utf8').split('\\n').filter((l) => l.trim()).length;
-      const key = agent + '/' + f.slice(0, -'.jsonl'.length);
-      out[key] = Math.max(out[key] || 0, n);
+      bump(agent + '/' + f.slice(0, -'.jsonl'.length), linesOf(path.join(sessions, f)));
+    }
+  }
+  const archive = path.join(base, 'session-sqlite-import-archive');
+  if (fs.existsSync(archive)) {
+    for (const f of fs.readdirSync(archive)) {
+      if (f.includes('.trajectory.jsonl')) continue;
+      const m = f.match(/^archive-tier\\.(.+?)\\.jsonl\\.imported-\\d+$/);
+      if (m) bump(agent + '/' + m[1], linesOf(path.join(archive, f)));
     }
   }
-  const dbFile = path.join(root, agent, 'agent', 'openclaw-agent.sqlite');
+  const dbFile = path.join(base, 'agent', 'openclaw-agent.sqlite');
   if (fs.existsSync(dbFile)) {
     const { DatabaseSync } = require('node:sqlite');
     const db = new DatabaseSync(dbFile, { readOnly: true });
-    // 2026.7.x creates this database too, without the transcript table.
     const hasEvents = db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'transcript_events'").get();
     if (hasEvents) {
       for (const r of db.prepare('SELECT session_id, COUNT(*) AS n FROM transcript_events GROUP BY session_id').all()) {
-        const key = agent + '/' + r.session_id;
-        out[key] = Math.max(out[key] || 0, Number(r.n));
+        bump(agent + '/' + r.session_id, Number(r.n));
       }
     }
     db.close();
@@ -361,6 +378,13 @@ async function runRollbackStart(agentId: string): Promise<number> {
   const row = latestUpdate(agentId);
   if (!row || !ROLLBACK_FROM.includes(row.status)) throw new UpdateRefusedError('There is no update of this agent to roll back');
   if (!row.backup_file || !row.from_version) throw new UpdateRefusedError('This update has no pre-update backup to restore');
+  // Refused up front, not mid-way: this Rev4a supports 9.x only, so a row recorded
+  // before 2026.7.x support was dropped has no image this build can recreate, and the
+  // readiness probe would never see the old Gateway as ready either. Better to say so
+  // than to restore a volume and leave the agent on a version this build cannot run.
+  if (!isSupportedVersion(row.from_version)) {
+    throw new UpdateRefusedError(`This Rev4a no longer supports OpenClaw ${row.from_version} (the version this update moved away from), so it cannot roll back to it`);
+  }
   if (!(await backupFileExists(row.backup_file))) {
     throw new UpdateRefusedError(`The pre-update backup ${row.backup_file} no longer exists`);
   }

package/lib/agent-versions.json

@@ -5,10 +5,6 @@
     {
       "version": "2026.9.3",
       "modelInput": ["text", "image", "audio", "video"]
-    },
-    {
-      "version": "2026.7.1-2",
-      "modelInput": ["text", "image"]
     }
   ]
 }

package/lib/agent-versions.ts

@@ -58,7 +58,7 @@ export function modelInputFor(version?: string | null): string[] {
 
 const VERSION_RE = /(\d{4})\.(\d{1,2})\.(\d{1,2})(?:-(\d+))?/;
 
-/** The version in `2026.9.3`, `2026.7.1-2` or `OpenClaw 2026.9.3 (1391f7c)`; null when there is none. */
+/** The version in `2026.9.3` or `OpenClaw 2026.9.3 (1391f7c)`; null when there is none. */
 export function parseOpenClawVersion(text: string | null | undefined): string | null {
   const m = VERSION_RE.exec(text ?? '');
   if (!m) return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flame0510/project-aether",
-  "version": "1.4.2",
+  "version": "1.5.1",
   "description": "Rev4a — Revolution for Agents. OpenClaw agent fleet orchestrator.",
   "keywords": [
     "openclaw",