fix(telemetry): retain every reported public feature name

[vincentkoc]

Feature reports with more than 32 public IDs silently lose valid channel, provider, and plugin names because parsing sorts and truncates raw IDs before public-vocabulary filtering. A synthetic report containing 33 public plugin names stores only 32 while preserving pluginsEnabled: 33; unknown names and case duplicates can also consume the cutoff.

Move identifier validation, public-vocabulary filtering, case folding, and deduplication into the payload parser, then remove the 32-name cutoff and the receiver's duplicate filtering pass. Regression tests cover all three lists, malformed/private names, the sibling feature-body reader, and unchanged update responses. A worst-case UTF-8 byte-budget test guards future vocabulary refreshes against the existing upload and Analytics Engine blob limits.

Validation at 3d5e1e6ee5f477f6b7647eed365e9cc4ebf0ef3f:

• Base-versus-head actual-module harness: 33 public names retained as 32 before and 33 after; full public vocabulary, case/unknown/malformed filtering, recording quota, and invalid/oversized-body update responses verified with local fakes.
• npm test -- test/payload.test.ts test/feature-stats.test.ts test/latest-version.test.ts test/allowlist.test.ts test/update-result.test.ts: 204 tests passed.
• npm run typecheck and git diff --check passed.
• Local proof used Node 26.7.0 and the frozen lockfile. Node 24 PR CI passed on the exact head: frozen npm ci, vocabulary consistency, typecheck, full tests, and Wrangler dry-run build. The production deploy job was skipped.

Production LOC: +7/-13 (net -6). Tests: +99/-7. Documentation: +6.

Draft for review. Collection fields, deployment configuration, consent, and update availability are unchanged. The existing PR workflow runs checks and a dry-run build; deployment remains guarded to non-PR events on main.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review in progress

ClawSweeper is reviewing this revision. This supersedes any previous blocked status.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed October 1, 2026, 1:02 AM ET / 05:02 UTC.

ClawSweeper review

What this changes

Validate and canonicalize reported public feature names before storage, removing the 32-name cutoff and adding regression coverage and documentation.

Merge readiness

✅ Ready for maintainer review

This repair is still necessary: current main truncates feature lists before public-name filtering. The proposed patch fixes that ordering without widening the accepted vocabulary, and no blocking correctness defect was found.

Priority: P2
Reviewed head: 3d5e1e6ee5f477f6b7647eed365e9cc4ebf0ef3f

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused source-backed repair with relevant regression coverage and reported exact-head validation; no blocking defect was found.
Proof confidence	🌊 off-meta tidepool	Not applicable: MEMBER-authored work is exempt from ordinary contributor proof. The reported Node harness exercises parser-to-recording behavior with local fakes; it does not establish production ingestion. No material authority or stored-data-format change introduces an independent proof gate.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: MEMBER-authored work is exempt from ordinary contributor proof. The reported Node harness exercises parser-to-recording behavior with local fakes; it does not establish production ingestion. No material authority or stored-data-format change introduces an independent proof gate.
Evidence reviewed	7 items	Pinned introduced patch: The introduced delta changes two production files, three test files, README, and CHANGELOG. It moves existing public-name filtering into parsing and removes the raw-list cutoff; dependency, workflow, and deployment files are unchanged. Current main still has the defect: Main sorts and slices raw validated identifiers to 32 before the receiver filters public names. Therefore unknown names and case-distinct duplicates can displace valid names. A GitHub branch read confirmed main remains at the pinned base; this repair has not landed there, and no shipped fix was established. Storage and privacy boundaries: All production recording callers pass through parseFeatureStats, which retains whole-ID validation and uses the existing immutable public vocabulary. Analytics row positions, comma-separated encoding, sampling key, counts, upload cap, and quota remain unchanged; existing rows require no rewrite.
Findings	None	None.
Security	None	None.

How this fits together

The telemetry Worker receives update checks with optional feature inventories. It validates those inventories, records bounded Analytics Engine rows, and returns the latest OpenClaw version.

flowchart TD
 A[Update check with optional inventory] --> B[Recording quota]
 B --> C[Bounded upload reader]
 C --> D[Identifier validation and public vocabulary]
 D --> E[Analytics Engine row]
 B --> F[Latest version response]
 E --> F

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test LOC	production +7/-13; tests +99/-7	The focused repair reduces production code while adding coverage for retention, filtering, response stability, and byte budgets.

Technical review

Best possible solution:

Retain every validated public name within the existing upload and storage budgets, preserving the current privacy filter and row format.

Do we have a high-confidence way to reproduce the issue?

Yes, source establishes a focused path: submit more than 32 public names, or place unknown names before valid names in sort order. Main truncates before filtering; this review did not execute that path.

Is this the best way to solve the issue?

Yes, applying the existing public-name filter during parsing removes the defective cutoff and duplicate filtering pass while preserving privacy and storage contracts.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against fe0d0b706c0d.

Labels

Label changes:

• add P2: Silent omission affects optional telemetry inventories while update checks remain available.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: MEMBER-authored work is exempt from ordinary contributor proof. The reported Node harness exercises parser-to-recording behavior with local fakes; it does not establish production ingestion. No material authority or stored-data-format change introduces an independent proof gate.

Label justifications:

• P2: Silent omission affects optional telemetry inventories while update checks remain available.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: MEMBER-authored work is exempt from ordinary contributor proof. The reported Node harness exercises parser-to-recording behavior with local fakes; it does not establish production ingestion. No material authority or stored-data-format change introduces an independent proof gate.

Evidence

What I checked:

• Pinned introduced patch: The introduced delta changes two production files, three test files, README, and CHANGELOG. It moves existing public-name filtering into parsing and removes the raw-list cutoff; dependency, workflow, and deployment files are unchanged. (src/payload.ts:75, 3d5e1e6ee5f4)
• Current main still has the defect: Main sorts and slices raw validated identifiers to 32 before the receiver filters public names. Therefore unknown names and case-distinct duplicates can displace valid names. A GitHub branch read confirmed main remains at the pinned base; this repair has not landed there, and no shipped fix was established. (src/payload.ts:73, fe0d0b706c0d)
• Storage and privacy boundaries: All production recording callers pass through parseFeatureStats, which retains whole-ID validation and uses the existing immutable public vocabulary. Analytics row positions, comma-separated encoding, sampling key, counts, upload cap, and quota remain unchanged; existing rows require no rewrite. (src/analytics.ts:31, 3d5e1e6ee5f4)
• Focused regression coverage: Tests cover all three lists above 32 names, unknown-name and duplicate displacement, malformed identifiers, the alternate body reader, recorded rows, unchanged version answers, and worst-case UTF-8 upload and combined blob budgets. Tests were inspected but not executed during this read-only review. (test/payload.test.ts:186, 3d5e1e6ee5f4)
• Supplied validation and proof scope: The captured PR body reports an exact-head actual-module harness showing 32 names before and 33 after using local fakes, 204 focused passing tests, typecheck, and exact-head CI. This is supplemental validation rather than production-ingestion proof. The author has MEMBER association, so ordinary external-contributor proof is exempt; no material authority change triggers an additional proof requirement. (3d5e1e6ee5f4)
• Related work is complementary: fix(telemetry): refresh public vocabulary from released metadata #28 is open and refreshes the retained vocabulary, explicitly describing this PR as the separate truncation repair. It does not supersede the list-ordering fix.

Likely related people:

• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.