@totalreclaw/totalreclaw 3.3.12-rc.18 → 3.3.12-rc.19

package/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: totalreclaw
 description: "End-to-end encrypted, decentralized memory for OpenClaw. A native kind:memory provider — recall is automatic via memory_search/memory_get, and facts are captured in the background. Trigger on 'install TotalReclaw', 'set up TotalReclaw', 'restore my recovery phrase', any recall request ('what do you remember about me', 'what's my X'), AND any explicit remember request ('remember X', 'save X')."
-version: 3.3.12-rc.18
+version: 3.3.12-rc.19
 author: TotalReclaw Team
 license: MIT
 homepage: https://totalreclaw.xyz

package/dist/index.js

@@ -4452,6 +4452,25 @@ const plugin = {
             // ---------------------------------------------------------------
             startTrajectoryPoller({
                 logger: api.logger,
+                // 3.3.12-rc.19: re-assert slots.memory each poll tick. OpenClaw's
+                // config-rewrite-after-restart can strip it after register()'s
+                // self-heal (pop-os reinstall 2026-06-30 → slot reverted to disabled
+                // memory-core → memory_search/memory_get never bound). Cheap fs
+                // read; heals + restarts only if the slot is wrong.
+                recheckSlot: () => {
+                    try {
+                        if (patchOpenClawConfig(undefined, pluginVersion ?? undefined) === 'patched') {
+                            api.logger.warn('TotalReclaw: slots.memory was wrong at poll — re-healed openclaw.json, restarting to apply');
+                            try {
+                                process.kill(process.pid, 'SIGUSR1');
+                            }
+                            catch { /* gateway shutting down */ }
+                        }
+                    }
+                    catch (err) {
+                        api.logger.warn(`TotalReclaw: slot recheck failed: ${err instanceof Error ? err.message : String(err)}`);
+                    }
+                },
                 ensureInitialized: () => ensureInitialized(api.logger),
                 isPairingPending: () => needsSetup,
                 isImportActive: () => _importInProgress,

package/dist/subgraph-store.js

@@ -233,6 +233,31 @@ async function withSenderLock(sender, fn) {
 export function __resetSenderLocksForTests() {
     _senderSubmissionLocks.clear();
 }
+// ---------------------------------------------------------------------------
+// Test-only WASM mock seams (AA10 submit-path retry test)
+// ---------------------------------------------------------------------------
+/**
+ * Test-only seam: inject a mock WASM module.
+ *
+ * The AA10 submit-path retry test needs to drive the real submitFactBatchOnChain
+ * while controlling WASM behavior (deriveEoa, encodeBatchCall, hashUserOp,
+ * signUserOp, getEntryPointAddress). This seam swaps the module-level _wasm
+ * reference so the test can provide stubs.
+ *
+ * MUST be followed by __clearWasmForTests() in teardown.
+ */
+export function __setWasmForTests(mock) {
+    _wasm = mock;
+}
+/**
+ * Test-only seam: restore the real WASM module.
+ *
+ * Clears a test-injected mock WASM and resets the module to null so the next
+ * getWasm() call reloads the real @totalreclaw/core.
+ */
+export function __clearWasmForTests() {
+    _wasm = null;
+}
 /**
  * Check if a Smart Account is deployed and return factory/factoryData if not.
  *
@@ -325,8 +350,6 @@ async function submitFactOnChainLocked(protobufPayload, config, eoa, sender) {
     const gasPrices = await rpc('pimlico_getUserOperationGasPrice', []);
     const fast = gasPrices.fast;
     const rpcUrl = config.rpcUrl || CONFIG.rpcUrl || getDefaultRpcUrl(config.chainId);
-    // 4. Check if Smart Account is deployed (needed for factory/factoryData)
-    const { factory, factoryData } = await getInitCode(sender, eoa.address, rpcUrl);
     // 5. Get nonce from EntryPoint via bundler RPC.
     //    Routing through the bundler lets Pimlico account for pending mempool
     //    UserOps, preventing AA25 nonce conflicts on rapid submissions.
@@ -336,79 +359,50 @@ async function submitFactOnChainLocked(protobufPayload, config, eoa, sender) {
     const senderPadded = sender.slice(2).toLowerCase().padStart(64, '0');
     const keyPadded = '0'.repeat(64);
     const nonceCalldata = `0x35567e1a${senderPadded}${keyPadded}`;
-    let nonce;
-    try {
-        const nonceResult = await rpc('eth_call', [{ to: entryPoint, data: nonceCalldata }, 'latest']);
-        nonce = nonceResult || '0x0';
-    }
-    catch {
-        // Fallback to public RPC if bundler doesn't support eth_call
-        const nonceJson = await rpcRequest({
-            url: rpcUrl,
-            headers: { 'Content-Type': 'application/json' },
-            method: 'eth_call',
-            params: [{ to: entryPoint, data: nonceCalldata }, 'latest'],
-        });
-        nonce = nonceJson.result || '0x0';
-    }
-    // 6. Build unsigned UserOp (v0.7 fields, camelCase for Rust JSON serde)
-    const unsignedOp = {
-        sender,
-        nonce,
-        callData,
-        callGasLimit: '0x0',
-        verificationGasLimit: '0x0',
-        preVerificationGas: '0x0',
-        maxFeePerGas: fast.maxFeePerGas,
-        maxPriorityFeePerGas: fast.maxPriorityFeePerGas,
-        signature: DUMMY_SIGNATURE,
-    };
-    if (factory) {
-        unsignedOp.factory = factory;
-        unsignedOp.factoryData = factoryData;
+    // Helper to fetch nonce (with bundler fallback)
+    async function fetchNonce() {
+        try {
+            const nonceResult = await rpc('eth_call', [{ to: entryPoint, data: nonceCalldata }, 'latest']);
+            return nonceResult || '0x0';
+        }
+        catch {
+            // Fallback to public RPC if bundler doesn't support eth_call
+            const nonceJson = await rpcRequest({
+                url: rpcUrl,
+                headers: { 'Content-Type': 'application/json' },
+                method: 'eth_call',
+                params: [{ to: entryPoint, data: nonceCalldata }, 'latest'],
+            });
+            return nonceJson.result || '0x0';
+        }
     }
-    // 7. Get paymaster sponsorship (fills gas limits + paymaster fields)
-    const sponsorResult = await rpc('pm_sponsorUserOperation', [unsignedOp, entryPoint]);
-    Object.assign(unsignedOp, sponsorResult);
-    // 8. Hash and sign the UserOp via WASM
-    const opJson = JSON.stringify(unsignedOp);
-    const hashHex = getWasm().hashUserOp(opJson, entryPoint, BigInt(config.chainId));
-    const sigHex = signUserOp(hashHex, eoa.private_key);
-    unsignedOp.signature = `0x${sigHex}`;
-    // 9. Submit the signed UserOp (with AA25 nonce conflict retry)
+    // Track force-deployed senders for AA10 retry (local to this submission attempt)
+    const forceDeployed = new Set();
+    // Single retry loop: getInitCode → build UserOp → sponsor → sign → send
+    // On AA10 "sender already constructed", mark sender as force-deployed and retry.
+    // AA10 can occur at pm_sponsorUserOperation (initCode present on deployed sender)
+    // or eth_sendUserOperation (same root cause). This loop handles both.
     let userOpHash;
-    try {
-        userOpHash = await rpc('eth_sendUserOperation', [unsignedOp, entryPoint]);
-    }
-    catch (err) {
-        const msg = err?.message || '';
-        if (/AA25|AA10|invalid account nonce|already being processed/i.test(msg)) {
-            console.error('AA25/AA10 nonce conflict detected, rebuilding UserOp with fresh nonce...');
-            // getInitCode always re-checks eth_getCode (no session cache to bust),
-            // so the retry below naturally picks up the post-deployment state.
-            // Wait for previous UserOp to mine before retrying with fresh nonce.
-            // Public RPC won't reflect the new nonce until the tx is on-chain.
-            await new Promise(r => setTimeout(r, 15000));
-            // Re-fetch initCode and nonce
-            const { factory: retryFactory, factoryData: retryFactoryData } = await getInitCode(sender, eoa.address, rpcUrl);
-            let retryNonce;
-            try {
-                const retryNonceResult = await rpc('eth_call', [{ to: entryPoint, data: nonceCalldata }, 'latest']);
-                retryNonce = retryNonceResult || '0x0';
-            }
-            catch {
-                const retryNonceJson = await rpcRequest({
-                    url: rpcUrl,
-                    headers: { 'Content-Type': 'application/json' },
-                    method: 'eth_call',
-                    params: [{ to: entryPoint, data: nonceCalldata }, 'latest'],
-                });
-                retryNonce = retryNonceJson.result || '0x0';
+    let attempt = 0;
+    const maxAttempts = 2;
+    while (attempt < maxAttempts) {
+        attempt++;
+        try {
+            // 4. Check if Smart Account is deployed (needed for factory/factoryData)
+            // If force-deployed, skip eth_getCode and return null initCode.
+            let factory = null;
+            let factoryData = null;
+            if (!forceDeployed.has(sender.toLowerCase())) {
+                const initCode = await getInitCode(sender, eoa.address, rpcUrl);
+                factory = initCode.factory;
+                factoryData = initCode.factoryData;
             }
-            // Rebuild unsigned UserOp with fresh nonce and initCode
-            const retryOp = {
+            // Fetch fresh nonce for each attempt
+            const nonce = await fetchNonce();
+            // 6. Build unsigned UserOp (v0.7 fields, camelCase for Rust JSON serde)
+            const unsignedOp = {
                 sender,
-                nonce: retryNonce,
+                nonce,
                 callData,
                 callGasLimit: '0x0',
                 verificationGasLimit: '0x0',
@@ -417,20 +411,42 @@ async function submitFactOnChainLocked(protobufPayload, config, eoa, sender) {
                 maxPriorityFeePerGas: fast.maxPriorityFeePerGas,
                 signature: DUMMY_SIGNATURE,
             };
-            if (retryFactory) {
-                retryOp.factory = retryFactory;
-                retryOp.factoryData = retryFactoryData;
+            if (factory) {
+                unsignedOp.factory = factory;
+                unsignedOp.factoryData = factoryData;
             }
-            // Re-sponsor and re-sign
-            const retrySponsor = await rpc('pm_sponsorUserOperation', [retryOp, entryPoint]);
-            Object.assign(retryOp, retrySponsor);
-            const retryOpJson = JSON.stringify(retryOp);
-            const retryHashHex = getWasm().hashUserOp(retryOpJson, entryPoint, BigInt(config.chainId));
-            const retrySigHex = signUserOp(retryHashHex, eoa.private_key);
-            retryOp.signature = `0x${retrySigHex}`;
-            userOpHash = await rpc('eth_sendUserOperation', [retryOp, entryPoint]);
+            // 7. Get paymaster sponsorship (fills gas limits + paymaster fields)
+            // This is where AA10 "sender already constructed" can occur if initCode
+            // is present but the sender is already deployed.
+            const sponsorResult = await rpc('pm_sponsorUserOperation', [unsignedOp, entryPoint]);
+            Object.assign(unsignedOp, sponsorResult);
+            // 8. Hash and sign the UserOp via WASM
+            const opJson = JSON.stringify(unsignedOp);
+            const hashHex = getWasm().hashUserOp(opJson, entryPoint, BigInt(config.chainId));
+            const sigHex = signUserOp(hashHex, eoa.private_key);
+            unsignedOp.signature = `0x${sigHex}`;
+            // 9. Submit the signed UserOp
+            userOpHash = await rpc('eth_sendUserOperation', [unsignedOp, entryPoint]);
+            // Success — break out of retry loop
+            break;
         }
-        else {
+        catch (err) {
+            const msg = err?.message || '';
+            // AA10 "sender already constructed" or AA25 invalid nonce → retry
+            if (/AA25|AA10|invalid account nonce|already being processed/i.test(msg)) {
+                console.error(`AA25/AA10 detected (attempt ${attempt}/${maxAttempts}), retrying...`);
+                // On AA10, force-mark sender as deployed so next retry omits initCode
+                if (/AA10/i.test(msg)) {
+                    forceDeployed.add(sender.toLowerCase());
+                    console.error('AA10: force-marking sender as deployed, retrying without initCode');
+                }
+                // Wait for previous UserOp to mine before retrying with fresh nonce.
+                // Public RPC won't reflect the new nonce until the tx is on-chain.
+                await new Promise(r => setTimeout(r, 15000));
+                // Continue to next iteration of retry loop
+                continue;
+            }
+            // Not a retryable error — re-throw
             throw err;
         }
     }
@@ -509,101 +525,51 @@ async function submitFactBatchOnChainLocked(protobufPayloads, config, eoa, sende
     const gasPrices = await rpc('pimlico_getUserOperationGasPrice', []);
     const fast = gasPrices.fast;
     const rpcUrl = config.rpcUrl || CONFIG.rpcUrl || getDefaultRpcUrl(config.chainId);
-    // Check if Smart Account is deployed (needed for factory/factoryData)
-    const { factory, factoryData } = await getInitCode(sender, eoa.address, rpcUrl);
     // Get nonce via bundler (accounts for pending mempool UserOps) with public RPC fallback
     const senderPadded = sender.slice(2).toLowerCase().padStart(64, '0');
     const keyPadded = '0'.repeat(64);
     const nonceCalldata = `0x35567e1a${senderPadded}${keyPadded}`;
-    let nonce;
-    try {
-        const nonceResult = await rpc('eth_call', [{ to: entryPoint, data: nonceCalldata }, 'latest']);
-        nonce = nonceResult || '0x0';
-    }
-    catch {
-        const nonceJson = await rpcRequest({
-            url: rpcUrl,
-            headers: { 'Content-Type': 'application/json' },
-            method: 'eth_call',
-            params: [{ to: entryPoint, data: nonceCalldata }, 'latest'],
-        });
-        nonce = nonceJson.result || '0x0';
-    }
-    // Build unsigned UserOp
-    const unsignedOp = {
-        sender,
-        nonce,
-        callData,
-        callGasLimit: '0x0',
-        verificationGasLimit: '0x0',
-        preVerificationGas: '0x0',
-        maxFeePerGas: fast.maxFeePerGas,
-        maxPriorityFeePerGas: fast.maxPriorityFeePerGas,
-        signature: DUMMY_SIGNATURE,
-    };
-    if (factory) {
-        unsignedOp.factory = factory;
-        unsignedOp.factoryData = factoryData;
-    }
-    // Gas estimation for batch operations — get accurate gas limits from Pimlico
-    // before paymaster sponsorship (can't bump after sponsorship as it invalidates
-    // the paymaster's signature, causing AA34).
-    if (protobufPayloads.length > 1) {
+    // Helper to fetch nonce (with bundler fallback)
+    async function fetchNonce() {
         try {
-            const gasEstimate = await rpc('eth_estimateUserOperationGas', [unsignedOp, entryPoint]);
-            if (gasEstimate.callGasLimit)
-                unsignedOp.callGasLimit = gasEstimate.callGasLimit;
-            if (gasEstimate.verificationGasLimit)
-                unsignedOp.verificationGasLimit = gasEstimate.verificationGasLimit;
-            if (gasEstimate.preVerificationGas)
-                unsignedOp.preVerificationGas = gasEstimate.preVerificationGas;
+            const nonceResult = await rpc('eth_call', [{ to: entryPoint, data: nonceCalldata }, 'latest']);
+            return nonceResult || '0x0';
         }
         catch {
-            // If estimation fails, let the paymaster handle it (default behavior)
+            const nonceJson = await rpcRequest({
+                url: rpcUrl,
+                headers: { 'Content-Type': 'application/json' },
+                method: 'eth_call',
+                params: [{ to: entryPoint, data: nonceCalldata }, 'latest'],
+            });
+            return nonceJson.result || '0x0';
         }
     }
-    // Paymaster sponsorship (uses gas limits from estimation above for batches)
-    const sponsorResult = await rpc('pm_sponsorUserOperation', [unsignedOp, entryPoint]);
-    Object.assign(unsignedOp, sponsorResult);
-    // Hash and sign via WASM
-    const opJson = JSON.stringify(unsignedOp);
-    const hashHex = getWasm().hashUserOp(opJson, entryPoint, BigInt(config.chainId));
-    const sigHex = signUserOp(hashHex, eoa.private_key);
-    unsignedOp.signature = `0x${sigHex}`;
-    // Submit (with AA25 nonce conflict retry)
+    // Track force-deployed senders for AA10 retry (local to this submission attempt)
+    const forceDeployed = new Set();
+    // Single retry loop: getInitCode → build UserOp → estimate → sponsor → sign → send
+    // On AA10 "sender already constructed", mark sender as force-deployed and retry.
     let userOpHash;
-    try {
-        userOpHash = await rpc('eth_sendUserOperation', [unsignedOp, entryPoint]);
-    }
-    catch (err) {
-        const msg = err?.message || '';
-        if (/AA25|AA10|invalid account nonce|already being processed/i.test(msg)) {
-            console.error('AA25/AA10 nonce conflict detected (batch), rebuilding UserOp with fresh nonce...');
-            // getInitCode always re-checks eth_getCode (no session cache to bust),
-            // so the retry below naturally picks up the post-deployment state.
-            // Wait for previous UserOp to mine before retrying with fresh nonce.
-            // Public RPC won't reflect the new nonce until the tx is on-chain.
-            await new Promise(r => setTimeout(r, 15000));
-            // Re-fetch initCode and nonce
-            const { factory: retryFactory, factoryData: retryFactoryData } = await getInitCode(sender, eoa.address, rpcUrl);
-            let retryNonce;
-            try {
-                const retryNonceResult = await rpc('eth_call', [{ to: entryPoint, data: nonceCalldata }, 'latest']);
-                retryNonce = retryNonceResult || '0x0';
-            }
-            catch {
-                const retryNonceJson = await rpcRequest({
-                    url: rpcUrl,
-                    headers: { 'Content-Type': 'application/json' },
-                    method: 'eth_call',
-                    params: [{ to: entryPoint, data: nonceCalldata }, 'latest'],
-                });
-                retryNonce = retryNonceJson.result || '0x0';
+    let attempt = 0;
+    const maxAttempts = 2;
+    while (attempt < maxAttempts) {
+        attempt++;
+        try {
+            // Check if Smart Account is deployed (needed for factory/factoryData)
+            // If force-deployed, skip eth_getCode and return null initCode.
+            let factory = null;
+            let factoryData = null;
+            if (!forceDeployed.has(sender.toLowerCase())) {
+                const initCode = await getInitCode(sender, eoa.address, rpcUrl);
+                factory = initCode.factory;
+                factoryData = initCode.factoryData;
             }
-            // Rebuild unsigned UserOp with fresh nonce and initCode
-            const retryOp = {
+            // Fetch fresh nonce for each attempt
+            const nonce = await fetchNonce();
+            // Build unsigned UserOp
+            const unsignedOp = {
                 sender,
-                nonce: retryNonce,
+                nonce,
                 callData,
                 callGasLimit: '0x0',
                 verificationGasLimit: '0x0',
@@ -612,20 +578,59 @@ async function submitFactBatchOnChainLocked(protobufPayloads, config, eoa, sende
                 maxPriorityFeePerGas: fast.maxPriorityFeePerGas,
                 signature: DUMMY_SIGNATURE,
             };
-            if (retryFactory) {
-                retryOp.factory = retryFactory;
-                retryOp.factoryData = retryFactoryData;
+            if (factory) {
+                unsignedOp.factory = factory;
+                unsignedOp.factoryData = factoryData;
             }
-            // Re-sponsor and re-sign
-            const retrySponsor = await rpc('pm_sponsorUserOperation', [retryOp, entryPoint]);
-            Object.assign(retryOp, retrySponsor);
-            const retryOpJson = JSON.stringify(retryOp);
-            const retryHashHex = getWasm().hashUserOp(retryOpJson, entryPoint, BigInt(config.chainId));
-            const retrySigHex = signUserOp(retryHashHex, eoa.private_key);
-            retryOp.signature = `0x${retrySigHex}`;
-            userOpHash = await rpc('eth_sendUserOperation', [retryOp, entryPoint]);
+            // Gas estimation for batch operations — get accurate gas limits from Pimlico
+            // before paymaster sponsorship (can't bump after sponsorship as it invalidates
+            // the paymaster's signature, causing AA34).
+            if (protobufPayloads.length > 1) {
+                try {
+                    const gasEstimate = await rpc('eth_estimateUserOperationGas', [unsignedOp, entryPoint]);
+                    if (gasEstimate.callGasLimit)
+                        unsignedOp.callGasLimit = gasEstimate.callGasLimit;
+                    if (gasEstimate.verificationGasLimit)
+                        unsignedOp.verificationGasLimit = gasEstimate.verificationGasLimit;
+                    if (gasEstimate.preVerificationGas)
+                        unsignedOp.preVerificationGas = gasEstimate.preVerificationGas;
+                }
+                catch {
+                    // If estimation fails, let the paymaster handle it (default behavior)
+                }
+            }
+            // Paymaster sponsorship (uses gas limits from estimation above for batches)
+            // This is where AA10 "sender already constructed" can occur if initCode
+            // is present but the sender is already deployed.
+            const sponsorResult = await rpc('pm_sponsorUserOperation', [unsignedOp, entryPoint]);
+            Object.assign(unsignedOp, sponsorResult);
+            // Hash and sign via WASM
+            const opJson = JSON.stringify(unsignedOp);
+            const hashHex = getWasm().hashUserOp(opJson, entryPoint, BigInt(config.chainId));
+            const sigHex = signUserOp(hashHex, eoa.private_key);
+            unsignedOp.signature = `0x${sigHex}`;
+            // Submit the signed UserOp
+            userOpHash = await rpc('eth_sendUserOperation', [unsignedOp, entryPoint]);
+            // Success — break out of retry loop
+            break;
         }
-        else {
+        catch (err) {
+            const msg = err?.message || '';
+            // AA10 "sender already constructed" or AA25 invalid nonce → retry
+            if (/AA25|AA10|invalid account nonce|already being processed/i.test(msg)) {
+                console.error(`AA25/AA10 detected (batch, attempt ${attempt}/${maxAttempts}), retrying...`);
+                // On AA10, force-mark sender as deployed so next retry omits initCode
+                if (/AA10/i.test(msg)) {
+                    forceDeployed.add(sender.toLowerCase());
+                    console.error('AA10: force-marking sender as deployed, retrying without initCode');
+                }
+                // Wait for previous UserOp to mine before retrying with fresh nonce.
+                // Public RPC won't reflect the new nonce until the tx is on-chain.
+                await new Promise(r => setTimeout(r, 15000));
+                // Continue to next iteration of retry loop
+                continue;
+            }
+            // Not a retryable error — re-throw
             throw err;
         }
     }

package/dist/tr-cli.js

@@ -51,7 +51,7 @@ const STATE_PATH = CONFIG.onboardingStatePath;
 // Auto-synced by skill/scripts/sync-version.mjs from skill/plugin/package.json::version.
 // Do not edit by hand — running tests will catch drift but the publish workflow
 // rewrites this constant at the start of every npm/ClawHub publish.
-const PLUGIN_VERSION = '3.3.12-rc.18';
+const PLUGIN_VERSION = '3.3.12-rc.19';
 function die(msg, code = 1) {
     process.stderr.write(`tr: ${msg}\n`);
     process.exit(code);

package/dist/trajectory-poller.js

@@ -127,6 +127,9 @@ export function startTrajectoryPoller(deps, opts = {}) {
     const stateFile = opts.stateFile ?? STATE_FILE;
     const pollAndExtract = async () => {
         try {
+            // 3.3.12-rc.19: re-assert slots.memory each tick in case OpenClaw's
+            // config-rewrite stripped it after register() (see deps.recheckSlot).
+            deps.recheckSlot?.();
             await deps.ensureInitialized();
             if (deps.isPairingPending())
                 return;

package/index.ts

@@ -5239,6 +5239,21 @@ const plugin = {
 
     startTrajectoryPoller({
       logger: api.logger,
+      // 3.3.12-rc.19: re-assert slots.memory each poll tick. OpenClaw's
+      // config-rewrite-after-restart can strip it after register()'s
+      // self-heal (pop-os reinstall 2026-06-30 → slot reverted to disabled
+      // memory-core → memory_search/memory_get never bound). Cheap fs
+      // read; heals + restarts only if the slot is wrong.
+      recheckSlot: () => {
+        try {
+          if (patchOpenClawConfig(undefined, pluginVersion ?? undefined) === 'patched') {
+            api.logger.warn('TotalReclaw: slots.memory was wrong at poll — re-healed openclaw.json, restarting to apply');
+            try { process.kill(process.pid, 'SIGUSR1'); } catch { /* gateway shutting down */ }
+          }
+        } catch (err) {
+          api.logger.warn(`TotalReclaw: slot recheck failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+      },
       ensureInitialized: () => ensureInitialized(api.logger),
       isPairingPending: () => needsSetup,
       isImportActive: () => _importInProgress,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@totalreclaw/totalreclaw",
-  "version": "3.3.12-rc.18",
+  "version": "3.3.12-rc.19",
   "description": "End-to-end encrypted, agent-portable memory for OpenClaw and any LLM-agent runtime. XChaCha20-Poly1305 with protobuf v4 + on-chain Memory Taxonomy v1 (claim / preference / directive / commitment / episode / summary).",
   "type": "module",
   "keywords": [

package/skill.json

@@ -1,6 +1,6 @@
 {
   "name": "totalreclaw",
-  "version": "3.3.12-rc.18",
+  "version": "3.3.12-rc.19",
   "description": "End-to-end encrypted memory for AI agents — portable, yours forever. XChaCha20-Poly1305 E2EE: server never sees plaintext.",
   "author": "TotalReclaw Team",
   "license": "MIT",

package/subgraph-store.ts

@@ -294,6 +294,34 @@ export function __resetSenderLocksForTests(): void {
   _senderSubmissionLocks.clear();
 }
 
+// ---------------------------------------------------------------------------
+// Test-only WASM mock seams (AA10 submit-path retry test)
+// ---------------------------------------------------------------------------
+
+/**
+ * Test-only seam: inject a mock WASM module.
+ *
+ * The AA10 submit-path retry test needs to drive the real submitFactBatchOnChain
+ * while controlling WASM behavior (deriveEoa, encodeBatchCall, hashUserOp,
+ * signUserOp, getEntryPointAddress). This seam swaps the module-level _wasm
+ * reference so the test can provide stubs.
+ *
+ * MUST be followed by __clearWasmForTests() in teardown.
+ */
+export function __setWasmForTests(mock: any): void {
+  _wasm = mock;
+}
+
+/**
+ * Test-only seam: restore the real WASM module.
+ *
+ * Clears a test-injected mock WASM and resets the module to null so the next
+ * getWasm() call reloads the real @totalreclaw/core.
+ */
+export function __clearWasmForTests(): void {
+  _wasm = null;
+}
+
 /**
  * Check if a Smart Account is deployed and return factory/factoryData if not.
  *
@@ -413,9 +441,6 @@ async function submitFactOnChainLocked(
 
   const rpcUrl = config.rpcUrl || CONFIG.rpcUrl || getDefaultRpcUrl(config.chainId);
 
-  // 4. Check if Smart Account is deployed (needed for factory/factoryData)
-  const { factory, factoryData } = await getInitCode(sender, eoa.address, rpcUrl);
-
   // 5. Get nonce from EntryPoint via bundler RPC.
   //    Routing through the bundler lets Pimlico account for pending mempool
   //    UserOps, preventing AA25 nonce conflicts on rapid submissions.
@@ -426,83 +451,55 @@ async function submitFactOnChainLocked(
   const keyPadded = '0'.repeat(64);
   const nonceCalldata = `0x35567e1a${senderPadded}${keyPadded}`;
 
-  let nonce: string;
-  try {
-    const nonceResult = await rpc('eth_call', [{ to: entryPoint, data: nonceCalldata }, 'latest']);
-    nonce = nonceResult || '0x0';
-  } catch {
-    // Fallback to public RPC if bundler doesn't support eth_call
-    const nonceJson = await rpcRequest({
-      url: rpcUrl,
-      headers: { 'Content-Type': 'application/json' },
-      method: 'eth_call',
-      params: [{ to: entryPoint, data: nonceCalldata }, 'latest'],
-    });
-    nonce = (nonceJson.result as string) || '0x0';
+  // Helper to fetch nonce (with bundler fallback)
+  async function fetchNonce(): Promise<string> {
+    try {
+      const nonceResult = await rpc('eth_call', [{ to: entryPoint, data: nonceCalldata }, 'latest']);
+      return nonceResult || '0x0';
+    } catch {
+      // Fallback to public RPC if bundler doesn't support eth_call
+      const nonceJson = await rpcRequest({
+        url: rpcUrl,
+        headers: { 'Content-Type': 'application/json' },
+        method: 'eth_call',
+        params: [{ to: entryPoint, data: nonceCalldata }, 'latest'],
+      });
+      return (nonceJson.result as string) || '0x0';
+    }
   }
 
-  // 6. Build unsigned UserOp (v0.7 fields, camelCase for Rust JSON serde)
-  const unsignedOp: Record<string, any> = {
-    sender,
-    nonce,
-    callData,
-    callGasLimit: '0x0',
-    verificationGasLimit: '0x0',
-    preVerificationGas: '0x0',
-    maxFeePerGas: fast.maxFeePerGas,
-    maxPriorityFeePerGas: fast.maxPriorityFeePerGas,
-    signature: DUMMY_SIGNATURE,
-  };
-  if (factory) {
-    unsignedOp.factory = factory;
-    unsignedOp.factoryData = factoryData;
-  }
+  // Track force-deployed senders for AA10 retry (local to this submission attempt)
+  const forceDeployed = new Set<string>();
 
-  // 7. Get paymaster sponsorship (fills gas limits + paymaster fields)
-  const sponsorResult = await rpc('pm_sponsorUserOperation', [unsignedOp, entryPoint]);
-  Object.assign(unsignedOp, sponsorResult);
+  // Single retry loop: getInitCode → build UserOp → sponsor → sign → send
+  // On AA10 "sender already constructed", mark sender as force-deployed and retry.
+  // AA10 can occur at pm_sponsorUserOperation (initCode present on deployed sender)
+  // or eth_sendUserOperation (same root cause). This loop handles both.
+  let userOpHash: string;
+  let attempt = 0;
+  const maxAttempts = 2;
 
-  // 8. Hash and sign the UserOp via WASM
-  const opJson = JSON.stringify(unsignedOp);
-  const hashHex = getWasm().hashUserOp(opJson, entryPoint, BigInt(config.chainId));
-  const sigHex = signUserOp(hashHex, eoa.private_key);
-  unsignedOp.signature = `0x${sigHex}`;
+  while (attempt < maxAttempts) {
+    attempt++;
 
-  // 9. Submit the signed UserOp (with AA25 nonce conflict retry)
-  let userOpHash: string;
-  try {
-    userOpHash = await rpc('eth_sendUserOperation', [unsignedOp, entryPoint]);
-  } catch (err: any) {
-    const msg = err?.message || '';
-    if (/AA25|AA10|invalid account nonce|already being processed/i.test(msg)) {
-      console.error('AA25/AA10 nonce conflict detected, rebuilding UserOp with fresh nonce...');
-      // getInitCode always re-checks eth_getCode (no session cache to bust),
-      // so the retry below naturally picks up the post-deployment state.
-
-      // Wait for previous UserOp to mine before retrying with fresh nonce.
-      // Public RPC won't reflect the new nonce until the tx is on-chain.
-      await new Promise(r => setTimeout(r, 15000));
-
-      // Re-fetch initCode and nonce
-      const { factory: retryFactory, factoryData: retryFactoryData } = await getInitCode(sender, eoa.address, rpcUrl);
-      let retryNonce: string;
-      try {
-        const retryNonceResult = await rpc('eth_call', [{ to: entryPoint, data: nonceCalldata }, 'latest']);
-        retryNonce = retryNonceResult || '0x0';
-      } catch {
-        const retryNonceJson = await rpcRequest({
-          url: rpcUrl,
-          headers: { 'Content-Type': 'application/json' },
-          method: 'eth_call',
-          params: [{ to: entryPoint, data: nonceCalldata }, 'latest'],
-        });
-        retryNonce = (retryNonceJson.result as string) || '0x0';
+    try {
+      // 4. Check if Smart Account is deployed (needed for factory/factoryData)
+      // If force-deployed, skip eth_getCode and return null initCode.
+      let factory: string | null = null;
+      let factoryData: string | null = null;
+      if (!forceDeployed.has(sender.toLowerCase())) {
+        const initCode = await getInitCode(sender, eoa.address, rpcUrl);
+        factory = initCode.factory;
+        factoryData = initCode.factoryData;
       }
 
-      // Rebuild unsigned UserOp with fresh nonce and initCode
-      const retryOp: Record<string, any> = {
+      // Fetch fresh nonce for each attempt
+      const nonce = await fetchNonce();
+
+      // 6. Build unsigned UserOp (v0.7 fields, camelCase for Rust JSON serde)
+      const unsignedOp: Record<string, any> = {
         sender,
-        nonce: retryNonce,
+        nonce,
         callData,
         callGasLimit: '0x0',
         verificationGasLimit: '0x0',
@@ -511,21 +508,44 @@ async function submitFactOnChainLocked(
         maxPriorityFeePerGas: fast.maxPriorityFeePerGas,
         signature: DUMMY_SIGNATURE,
       };
-      if (retryFactory) {
-        retryOp.factory = retryFactory;
-        retryOp.factoryData = retryFactoryData;
+      if (factory) {
+        unsignedOp.factory = factory;
+        unsignedOp.factoryData = factoryData;
       }
 
-      // Re-sponsor and re-sign
-      const retrySponsor = await rpc('pm_sponsorUserOperation', [retryOp, entryPoint]);
-      Object.assign(retryOp, retrySponsor);
-      const retryOpJson = JSON.stringify(retryOp);
-      const retryHashHex = getWasm().hashUserOp(retryOpJson, entryPoint, BigInt(config.chainId));
-      const retrySigHex = signUserOp(retryHashHex, eoa.private_key);
-      retryOp.signature = `0x${retrySigHex}`;
-
-      userOpHash = await rpc('eth_sendUserOperation', [retryOp, entryPoint]);
-    } else {
+      // 7. Get paymaster sponsorship (fills gas limits + paymaster fields)
+      // This is where AA10 "sender already constructed" can occur if initCode
+      // is present but the sender is already deployed.
+      const sponsorResult = await rpc('pm_sponsorUserOperation', [unsignedOp, entryPoint]);
+      Object.assign(unsignedOp, sponsorResult);
+
+      // 8. Hash and sign the UserOp via WASM
+      const opJson = JSON.stringify(unsignedOp);
+      const hashHex = getWasm().hashUserOp(opJson, entryPoint, BigInt(config.chainId));
+      const sigHex = signUserOp(hashHex, eoa.private_key);
+      unsignedOp.signature = `0x${sigHex}`;
+
+      // 9. Submit the signed UserOp
+      userOpHash = await rpc('eth_sendUserOperation', [unsignedOp, entryPoint]);
+      // Success — break out of retry loop
+      break;
+    } catch (err: any) {
+      const msg = err?.message || '';
+      // AA10 "sender already constructed" or AA25 invalid nonce → retry
+      if (/AA25|AA10|invalid account nonce|already being processed/i.test(msg)) {
+        console.error(`AA25/AA10 detected (attempt ${attempt}/${maxAttempts}), retrying...`);
+        // On AA10, force-mark sender as deployed so next retry omits initCode
+        if (/AA10/i.test(msg)) {
+          forceDeployed.add(sender.toLowerCase());
+          console.error('AA10: force-marking sender as deployed, retrying without initCode');
+        }
+        // Wait for previous UserOp to mine before retrying with fresh nonce.
+        // Public RPC won't reflect the new nonce until the tx is on-chain.
+        await new Promise(r => setTimeout(r, 15000));
+        // Continue to next iteration of retry loop
+        continue;
+      }
+      // Not a retryable error — re-throw
       throw err;
     }
   }
@@ -625,104 +645,57 @@ async function submitFactBatchOnChainLocked(
 
   const rpcUrl = config.rpcUrl || CONFIG.rpcUrl || getDefaultRpcUrl(config.chainId);
 
-  // Check if Smart Account is deployed (needed for factory/factoryData)
-  const { factory, factoryData } = await getInitCode(sender, eoa.address, rpcUrl);
-
   // Get nonce via bundler (accounts for pending mempool UserOps) with public RPC fallback
   const senderPadded = sender.slice(2).toLowerCase().padStart(64, '0');
   const keyPadded = '0'.repeat(64);
   const nonceCalldata = `0x35567e1a${senderPadded}${keyPadded}`;
 
-  let nonce: string;
-  try {
-    const nonceResult = await rpc('eth_call', [{ to: entryPoint, data: nonceCalldata }, 'latest']);
-    nonce = nonceResult || '0x0';
-  } catch {
-    const nonceJson = await rpcRequest({
-      url: rpcUrl,
-      headers: { 'Content-Type': 'application/json' },
-      method: 'eth_call',
-      params: [{ to: entryPoint, data: nonceCalldata }, 'latest'],
-    });
-    nonce = (nonceJson.result as string) || '0x0';
-  }
-
-  // Build unsigned UserOp
-  const unsignedOp: Record<string, any> = {
-    sender,
-    nonce,
-    callData,
-    callGasLimit: '0x0',
-    verificationGasLimit: '0x0',
-    preVerificationGas: '0x0',
-    maxFeePerGas: fast.maxFeePerGas,
-    maxPriorityFeePerGas: fast.maxPriorityFeePerGas,
-    signature: DUMMY_SIGNATURE,
-  };
-  if (factory) {
-    unsignedOp.factory = factory;
-    unsignedOp.factoryData = factoryData;
-  }
-
-  // Gas estimation for batch operations — get accurate gas limits from Pimlico
-  // before paymaster sponsorship (can't bump after sponsorship as it invalidates
-  // the paymaster's signature, causing AA34).
-  if (protobufPayloads.length > 1) {
+  // Helper to fetch nonce (with bundler fallback)
+  async function fetchNonce(): Promise<string> {
     try {
-      const gasEstimate = await rpc('eth_estimateUserOperationGas', [unsignedOp, entryPoint]);
-      if (gasEstimate.callGasLimit) unsignedOp.callGasLimit = gasEstimate.callGasLimit;
-      if (gasEstimate.verificationGasLimit) unsignedOp.verificationGasLimit = gasEstimate.verificationGasLimit;
-      if (gasEstimate.preVerificationGas) unsignedOp.preVerificationGas = gasEstimate.preVerificationGas;
+      const nonceResult = await rpc('eth_call', [{ to: entryPoint, data: nonceCalldata }, 'latest']);
+      return nonceResult || '0x0';
     } catch {
-      // If estimation fails, let the paymaster handle it (default behavior)
+      const nonceJson = await rpcRequest({
+        url: rpcUrl,
+        headers: { 'Content-Type': 'application/json' },
+        method: 'eth_call',
+        params: [{ to: entryPoint, data: nonceCalldata }, 'latest'],
+      });
+      return (nonceJson.result as string) || '0x0';
     }
   }
 
-  // Paymaster sponsorship (uses gas limits from estimation above for batches)
-  const sponsorResult = await rpc('pm_sponsorUserOperation', [unsignedOp, entryPoint]);
-  Object.assign(unsignedOp, sponsorResult);
-
-  // Hash and sign via WASM
-  const opJson = JSON.stringify(unsignedOp);
-  const hashHex = getWasm().hashUserOp(opJson, entryPoint, BigInt(config.chainId));
-  const sigHex = signUserOp(hashHex, eoa.private_key);
-  unsignedOp.signature = `0x${sigHex}`;
+  // Track force-deployed senders for AA10 retry (local to this submission attempt)
+  const forceDeployed = new Set<string>();
 
-  // Submit (with AA25 nonce conflict retry)
+  // Single retry loop: getInitCode → build UserOp → estimate → sponsor → sign → send
+  // On AA10 "sender already constructed", mark sender as force-deployed and retry.
   let userOpHash: string;
-  try {
-    userOpHash = await rpc('eth_sendUserOperation', [unsignedOp, entryPoint]);
-  } catch (err: any) {
-    const msg = err?.message || '';
-    if (/AA25|AA10|invalid account nonce|already being processed/i.test(msg)) {
-      console.error('AA25/AA10 nonce conflict detected (batch), rebuilding UserOp with fresh nonce...');
-      // getInitCode always re-checks eth_getCode (no session cache to bust),
-      // so the retry below naturally picks up the post-deployment state.
-
-      // Wait for previous UserOp to mine before retrying with fresh nonce.
-      // Public RPC won't reflect the new nonce until the tx is on-chain.
-      await new Promise(r => setTimeout(r, 15000));
-
-      // Re-fetch initCode and nonce
-      const { factory: retryFactory, factoryData: retryFactoryData } = await getInitCode(sender, eoa.address, rpcUrl);
-      let retryNonce: string;
-      try {
-        const retryNonceResult = await rpc('eth_call', [{ to: entryPoint, data: nonceCalldata }, 'latest']);
-        retryNonce = retryNonceResult || '0x0';
-      } catch {
-        const retryNonceJson = await rpcRequest({
-          url: rpcUrl,
-          headers: { 'Content-Type': 'application/json' },
-          method: 'eth_call',
-          params: [{ to: entryPoint, data: nonceCalldata }, 'latest'],
-        });
-        retryNonce = (retryNonceJson.result as string) || '0x0';
+  let attempt = 0;
+  const maxAttempts = 2;
+
+  while (attempt < maxAttempts) {
+    attempt++;
+
+    try {
+      // Check if Smart Account is deployed (needed for factory/factoryData)
+      // If force-deployed, skip eth_getCode and return null initCode.
+      let factory: string | null = null;
+      let factoryData: string | null = null;
+      if (!forceDeployed.has(sender.toLowerCase())) {
+        const initCode = await getInitCode(sender, eoa.address, rpcUrl);
+        factory = initCode.factory;
+        factoryData = initCode.factoryData;
       }
 
-      // Rebuild unsigned UserOp with fresh nonce and initCode
-      const retryOp: Record<string, any> = {
+      // Fetch fresh nonce for each attempt
+      const nonce = await fetchNonce();
+
+      // Build unsigned UserOp
+      const unsignedOp: Record<string, any> = {
         sender,
-        nonce: retryNonce,
+        nonce,
         callData,
         callGasLimit: '0x0',
         verificationGasLimit: '0x0',
@@ -731,21 +704,58 @@ async function submitFactBatchOnChainLocked(
         maxPriorityFeePerGas: fast.maxPriorityFeePerGas,
         signature: DUMMY_SIGNATURE,
       };
-      if (retryFactory) {
-        retryOp.factory = retryFactory;
-        retryOp.factoryData = retryFactoryData;
+      if (factory) {
+        unsignedOp.factory = factory;
+        unsignedOp.factoryData = factoryData;
       }
 
-      // Re-sponsor and re-sign
-      const retrySponsor = await rpc('pm_sponsorUserOperation', [retryOp, entryPoint]);
-      Object.assign(retryOp, retrySponsor);
-      const retryOpJson = JSON.stringify(retryOp);
-      const retryHashHex = getWasm().hashUserOp(retryOpJson, entryPoint, BigInt(config.chainId));
-      const retrySigHex = signUserOp(retryHashHex, eoa.private_key);
-      retryOp.signature = `0x${retrySigHex}`;
+      // Gas estimation for batch operations — get accurate gas limits from Pimlico
+      // before paymaster sponsorship (can't bump after sponsorship as it invalidates
+      // the paymaster's signature, causing AA34).
+      if (protobufPayloads.length > 1) {
+        try {
+          const gasEstimate = await rpc('eth_estimateUserOperationGas', [unsignedOp, entryPoint]);
+          if (gasEstimate.callGasLimit) unsignedOp.callGasLimit = gasEstimate.callGasLimit;
+          if (gasEstimate.verificationGasLimit) unsignedOp.verificationGasLimit = gasEstimate.verificationGasLimit;
+          if (gasEstimate.preVerificationGas) unsignedOp.preVerificationGas = gasEstimate.preVerificationGas;
+        } catch {
+          // If estimation fails, let the paymaster handle it (default behavior)
+        }
+      }
 
-      userOpHash = await rpc('eth_sendUserOperation', [retryOp, entryPoint]);
-    } else {
+      // Paymaster sponsorship (uses gas limits from estimation above for batches)
+      // This is where AA10 "sender already constructed" can occur if initCode
+      // is present but the sender is already deployed.
+      const sponsorResult = await rpc('pm_sponsorUserOperation', [unsignedOp, entryPoint]);
+      Object.assign(unsignedOp, sponsorResult);
+
+      // Hash and sign via WASM
+      const opJson = JSON.stringify(unsignedOp);
+      const hashHex = getWasm().hashUserOp(opJson, entryPoint, BigInt(config.chainId));
+      const sigHex = signUserOp(hashHex, eoa.private_key);
+      unsignedOp.signature = `0x${sigHex}`;
+
+      // Submit the signed UserOp
+      userOpHash = await rpc('eth_sendUserOperation', [unsignedOp, entryPoint]);
+      // Success — break out of retry loop
+      break;
+    } catch (err: any) {
+      const msg = err?.message || '';
+      // AA10 "sender already constructed" or AA25 invalid nonce → retry
+      if (/AA25|AA10|invalid account nonce|already being processed/i.test(msg)) {
+        console.error(`AA25/AA10 detected (batch, attempt ${attempt}/${maxAttempts}), retrying...`);
+        // On AA10, force-mark sender as deployed so next retry omits initCode
+        if (/AA10/i.test(msg)) {
+          forceDeployed.add(sender.toLowerCase());
+          console.error('AA10: force-marking sender as deployed, retrying without initCode');
+        }
+        // Wait for previous UserOp to mine before retrying with fresh nonce.
+        // Public RPC won't reflect the new nonce until the tx is on-chain.
+        await new Promise(r => setTimeout(r, 15000));
+        // Continue to next iteration of retry loop
+        continue;
+      }
+      // Not a retryable error — re-throw
       throw err;
     }
   }

package/tr-cli.ts

@@ -68,7 +68,7 @@ const STATE_PATH = CONFIG.onboardingStatePath;
 // Auto-synced by skill/scripts/sync-version.mjs from skill/plugin/package.json::version.
 // Do not edit by hand — running tests will catch drift but the publish workflow
 // rewrites this constant at the start of every npm/ClawHub publish.
-const PLUGIN_VERSION = '3.3.12-rc.18';
+const PLUGIN_VERSION = '3.3.12-rc.19';
 
 function die(msg: string, code = 1): never {
   process.stderr.write(`tr: ${msg}\n`);

package/trajectory-poller.ts

@@ -104,6 +104,18 @@ export interface TrajectoryPollerDeps {
     error: (msg: string) => void;
   };
 
+  /**
+   * 3.3.12-rc.19: optional slot-self-heal hook invoked once per poll
+   * tick. OpenClaw's config-rewrite-after-restart can strip
+   * plugins.slots.memory after register()'s self-heal ran (observed on
+   * pop-os reinstall 2026-06-30 → slot reverted to disabled memory-core
+   * → memory_search/memory_get never bound). The host wires this to
+   * patchOpenClawConfig + a SIGUSR1 restart so the slot is re-asserted
+   * on the next tick if it was clobbered. Runs before the pairing/
+   * import gates so it fires even when extraction is deferred.
+   */
+  recheckSlot?: () => void;
+
   /** Initialization gate — same one the agent_end hook uses. */
   ensureInitialized: () => Promise<void>;
 
@@ -218,6 +230,9 @@ export function startTrajectoryPoller(
 
   const pollAndExtract = async (): Promise<void> => {
     try {
+      // 3.3.12-rc.19: re-assert slots.memory each tick in case OpenClaw's
+      // config-rewrite stripped it after register() (see deps.recheckSlot).
+      deps.recheckSlot?.();
       await deps.ensureInitialized();
       if (deps.isPairingPending()) return;
       if (deps.isImportActive()) return;