openclaw - 💡(How to fix) Fix Webhook in-flight limiter can evict active request counters [1 pull requests]

Problem

createWebhookInFlightLimiter is meant to cap concurrent webhook handlers per key. It currently records the incremented active count and then prunes the active map with a generic size helper.

When maxTrackedKeys is reached, acquiring a different key can delete an entry that still represents an active request. A later release() for that evicted key sees no counter and returns, so the limiter has lost track of that in-flight request. The same key can then be acquired from zero again, weakening the intended maxInFlightPerKey cap.

Repro shape

1. Create a limiter with maxInFlightPerKey: 1 and maxTrackedKeys: 1.
2. Acquire key a.
3. Acquire key b while a is still active.
4. Observe that the active counter for a can be evicted instead of rejecting b.

Expected behavior

Treat maxTrackedKeys as a hard cap for active in-flight state. If a new key arrives while the active key table is full, reject the acquire attempt. Existing tracked keys should still be allowed to acquire up to maxInFlightPerKey and release normally.