PR #71754: fix(bonjour): register ciao unhandled-rejection handler before service creation

• Repository: openclaw/openclaw
• Author: Sanjays2402
• State: closed | merged: False
• Link: https://github.com/openclaw/openclaw/pull/71754

Description (problem / solution / changelog)

Summary

Fixes #71751. The Docker container crashes on 2026.4.23 (and 2026.4.24) with:

[openclaw] Unhandled promise rejection: CIAO PROBING CANCELLED
[openclaw] wrote stability bundle: …openclaw-stability-…-unhandled_rejection.json

…immediately followed by a process exit.

Root cause

startGatewayBonjourAdvertiser already has the right machinery — classifyCiaoUnhandledRejection recognizes both CIAO PROBING CANCELLED and CIAO ANNOUNCEMENT CANCELLED, and the wired-up handleCiaoUnhandledRejection returns true to suppress them via registerUnhandledRejectionHandler.

But the registration happens inside createCycle(), which runs after getResponder() and responder.createService(...) — and @homebridge/ciao begins probing as soon as a service is created. If the host network reconfigures during early startup, or the multicast interface flaps inside a container (very common in Docker/k8s with overlay networking), the probe promise rejects asynchronously, but at that instant the handler may not yet be in the handlers set in src/infra/unhandled-rejections.ts. The rejection escapes, the global handler logs Unhandled promise rejection: CIAO PROBING CANCELLED, writes the stability bundle, and the gateway exits.

Fix

Hoist registerUnhandledRejectionHandler(handleCiaoUnhandledRejection) to the top of startGatewayBonjourAdvertiser, before loadCiaoModule() and before any service is created, so any cancelled probe — early-startup or otherwise — is already caught.

Side benefit: the handler now stays installed for the entire lifetime of the advertiser, including across watchdog-driven recreates. Previously each recreate re-registered/unregistered; that's strictly less robust.

Behavior matrix

The existing test in advertiser.test.ts that asserts order = ["shutdown", "cleanup"] and registerUnhandledRejectionHandler was called exactly once still passes by inspection — the early registration replaces the per-cycle one and the cleanup runs after responder.shutdown() in stop().

Risk

Low. No public API change. The only behavioral difference is that benign ciao cancellation rejections during early startup are now correctly classified instead of escaping to the global handler. Non-classified rejections still escape exactly as before.

Tests

The two relevant existing tests (logs ciao handler classifications… and the cleanup-order test) cover the new path:

• The handler is still registered exactly once per advertiser (now early instead of inside the cycle).
• cleanup is invoked after responder.shutdown() in stop().
• Recreates do not re-register the handler.

Closes #71751.

Changed files

• extensions/bonjour/src/advertiser.ts (modified, +28/-7)