Bug Report: Update from 4.23 → 4.24+ causes gateway paralysis on power-user setups

Environment

• OpenClaw version: 2026.4.23 (stable) → 2026.4.24 / 2026.4.25 (broken)
• OS: macOS 15.7.3 (Sequoia), Intel x86_64 (iMac Pro)
• Node.js: v25.9.0
• npm: 11.12.1
• Install method: npm install -g openclaw

Setup Profile (power user)

• 7 configured agents
• 30 enabled cron jobs (all sessionTarget: "isolated", agentTurn payloads)
• 144MB QMD semantic search index (22,668 vectors, 2,022 files, 88 memory markdown files)
• Active-memory plugin enabled
• Multiple provider configs (Anthropic, OpenAI, Google, OpenRouter disabled)
• Bonjour + device-pair for macOS node

What Happened

Updated from 4.23 → 4.24 via openclaw update. Gateway failed to restart and never recovered. Later attempted 4.25 — same result. Rolled back to 4.23 — immediately stable.

Root Cause Analysis

1. Runtime-deps install produces empty package.json

After the update, the runtime-deps directory (~/.openclaw/plugin-runtime-deps/openclaw-2026.4.25-17c3fa238f70/package.json) contained:

{
  "name": "openclaw-runtime-deps-install",
  "private": true
}

No dependencies field. The .openclaw-runtime-deps.json manifest lists ~70 specs that should have been installed, but the actual package.json used for npm install was empty. chokidar (required by the QMD file watcher qmd-manager-FuXCtSYP.js) was completely missing from node_modules/.

2. Missing chokidar breaks QMD → memory cascade

Cannot find package 'chokidar' imported from .../qmd-manager-FuXCtSYP.js

QMD falls back to a degraded mode. Memory search calls start timing out (15s default). The active-memory plugin, which queries memory on every direct message, hammers the broken backend repeatedly.

3. 30 cron jobs amplify the failure

Each cron job spawns an isolated session that bootstraps memory/QMD. With QMD broken, every session startup either hangs or times out. 30 jobs firing on schedule = 30 concurrent timeout storms flooding the Node.js event loop.

4. Event loop starvation causes total gateway paralysis

Once the event loop is saturated:

• WebSocket handshakes time out — handshake timeout (136 occurrences in one day)
• Pricing fetches time out — OpenRouter + LiteLLM 60s timeouts (even though curl to the same URLs works in <0.2s from the same machine)
• Remote node bin probes time out — system.which timeoutMs=15000
• Bonjour advertiser gets stuck — service stuck in "announcing" for 60s+
• Discord health-monitor — keeps restarting due to disconnection
• Sessions marked "stuck" — stuck session: state=processing
• openclaw status itself times out — can't even self-diagnose

The gateway accepts TCP connections and appears "alive" but is functionally brain-dead.

Evidence from Logs

# Memory broken
qmd memory unavailable; falling back to builtin: Cannot find package 'chokidar'

# Active-memory timing out
active-memory ... done status=timeout

# WS handshakes failing
closed before connect conn=... code=1006
handshake timeout conn=...

# Pricing fetches (blocked event loop, not network)
OpenRouter pricing fetch failed (timeout 60s): TimeoutError: The operation was aborted due to timeout
LiteLLM pricing fetch failed (timeout 60s): TimeoutError: The operation was aborted due to timeout

# Node probe failures
remote bin probe timed out (Nigel's iMac Pro; command=system.which timeoutMs=15000 requiredBins=45 connected=yes)

# Sessions stuck
stuck session: sessionId=main state=processing age=159s queueDepth=0

# Embedded runs failing
embedded_run_failover_decision stage=assistant decision=surface_error failoverReason=timeout

Verification

After manually installing chokidar into the runtime-deps folder:

cd ~/.openclaw/plugin-runtime-deps/openclaw-2026.4.25-17c3fa238f70
npm install chokidar@latest --no-save

...QMD-related errors stopped. But the accumulated event loop damage from active-memory + cron jobs meant recovery required a full rollback to 4.23.

Suggestions

1. Runtime-deps installer should validate its own output. If the package.json has no dependencies after the install step, that's a hard failure — don't let the gateway boot on a broken dep tree.

2. Missing chokidar should be a loud startup error, not a silent fallback. The current behavior silently degrades QMD, which cascades into everything else.

3. Consider circuit-breaking for memory/QMD failures. If QMD fails N times on boot, disable memory-dependent features (active-memory, session memory search) rather than letting them timeout-loop indefinitely.

4. Cron job startup should be gated on core subsystem health. If QMD/memory isn't ready, delay cron job execution rather than spawning 30 sessions that all independently discover the failure.

5. openclaw status should have its own fast-path that doesn't depend on the event loop being healthy — if the diagnostic tool is also a victim of event loop starvation, the operator has no visibility.

Workaround

Rolled back to 4.23 via:

npm install -g [email protected]
openclaw gateway restart

Gateway immediately stable. All 30 cron jobs, 7 agents, QMD, and memory working normally.