PR #81533: fix(telegram): release polling leases at in-process gateway restart boundary

• Repository: openclaw/openclaw
• Author: SymbolStar
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/81533

Description (problem / solution / changelog)

Fixes #81507

Root cause

Telegram polling leases live on a process-global Symbol.for("openclaw.telegram.pollingLeases") Map. The registry survives any gateway restart that recycles the lifecycle without exiting the Node process (SIGUSR1 in-process restart, OPENCLAW_NO_RESPAWN reload, etc.).

When the previous lifecycle's monitorTelegramProvider task is dropped before its finally pollingLease.release() runs, the entry stays. The next lifecycle then calls acquireTelegramPollingLease(), finds a same-token entry whose abort signal hasn't observed an abort yet, and throws the duplicate-poller error indefinitely. This matches the reporter's "855 errors/day" symptom.

Fix

Lifecycle-owned cleanup at the in-process restart boundary, per Codex review.

1. New src/infra/in-process-restart-hooks.ts — small process-global registry of synchronous, idempotent reset hooks. Hooks are best-effort (errors swallowed) and the registry is stored on a Symbol.for(...) key so it deduplicates across module reloads.
2. New openclaw/plugin-sdk/lifecycle-restart-hooks re-export so plugins can register without importing internal infra.
3. extensions/telegram/src/polling-lease.ts — exports releaseTelegramPollingLeasesForLifecycleReset() and self-registers it on first module load (process-symbol-guarded so duplicate ESM loads don't double-register).
4. src/cli/gateway-cli/run-loop.ts — invokes runInProcessRestartHooks() from the existing restart iteration hook, alongside resetAllLanes() / resetGatewayRestartStateForInProcessRestart() / reloadTaskRegistryFromStore().

The cleanup is only invoked at the in-process restart boundary. Steady-state acquireTelegramPollingLease() still rejects two live pollers for the same bot token within one lifecycle. Late release() calls from dropped previous-lifecycle tasks are safe — release() is owner-checked and idempotent, so they won't delete a fresh lease that the new lifecycle just acquired.

Tests

• extensions/telegram/src/polling-lease.test.ts — three new regressions:
  • stale same-token leases get cleared at the restart boundary, fresh acquire succeeds, and a late stale release() does NOT delete the fresh lease;
  • two concurrent live pollers within one lifecycle still rejected (same-token guard preserved);
  • the cleanup is wired into the shared in-process restart hook registry (no Telegram-specific knowledge needed at the call site).
• src/cli/gateway-cli/run-loop.test.ts — adds runInProcessRestartHooks mock + assertion that it's called once per restart iteration alongside the existing lane/registry resets.

Verification

• pnpm test extensions/telegram/src/polling-lease.test.ts
• pnpm test src/cli/gateway-cli/run-loop.test.ts

(Local pnpm not available — relying on CI for the full run.)

Changed files

• extensions/telegram/src/polling-lease.test.ts (modified, +89/-0)
• extensions/telegram/src/polling-lease.ts (modified, +64/-0)
• package.json (modified, +4/-0)
• src/cli/gateway-cli/lifecycle.runtime.ts (modified, +1/-0)
• src/cli/gateway-cli/run-loop.test.ts (modified, +7/-0)
• src/cli/gateway-cli/run-loop.ts (modified, +5/-0)
• src/infra/in-process-restart-hooks.ts (added, +84/-0)
• src/plugin-sdk/lifecycle-restart-hooks.ts (added, +10/-0)