Related: #166404
## What Problem This Solves
Fixes: shipped Plugin SDK subpaths and exports could be removed without the surface check noticing, which broke published third-party plugins such as `@tencent-weixin/openclaw-weixin` on 2026.10.1-beta.1.
## User Impact
User impact: the stable Plugin SDK surface can no longer silently disappear. Removing a subpath or named export that shipped in the latest stable release now fails `pnpm plugin-sdk:surface:check` unless a compatibility record covers it with a final compatibility day that has passed. No runtime behavior changes; nothing is restored here (restoring the removed subpaths for #166404 is a separate product decision).
## Why This Change Was Made
`plugin-sdk:surface:check` only enforced maximum export-count budgets, and the API baseline diff is report-only. The commits that retired `config-runtime`, `infra-runtime`, `channel-message`, `command-auth` and four other subpaths (912+ named exports that shipped in v2026.9.8) lowered those budgets in the same change, so the check passed. A ceiling cannot detect a removal.
This adds a committed inventory of the latest stable release's typed public surface (`scripts/lib/plugin-sdk-shipped-surface.json`, pinned to the current npm `latest` v2026.9.9: 158 typed subpaths, 4,591 named exports, identical to v2026.9.8). It is generated from the release tag's package exports and declarations by `pnpm plugin-sdk:shipped-surface:gen -- --release <tag>`, reusing the existing tagged-revision renderer from `plugin-sdk:api:diff`, and is regenerated during stable closeout (documented in RELEASING.md). The surface check compares the current tree against it:
- A missing shipped subpath, or a missing name in a surviving subpath, needs a compat record whose `surfaces` names `openclaw/plugin-sdk/<subpath>` (whole subpath) or the qualified `openclaw/plugin-sdk/<subpath>.<Name>`. Bare names do not count.
- The record must be `deprecated`, `removal-pending`, or `removed` with a `removeAfter` strictly before the current UTC date (the date is the final compatibility day). A `removalGate` alone or a future date does not authorize; budgets play no role.
- Packaged private runtime facades without a `types` condition are excluded: they are not a declared contract.
To make current `main` pass without restoring anything, the already-landed removals are recorded honestly:
- Dated tombstones for the five subpaths retired under the Sept 30 owner decision (`removeAfter` 2026-09-30) and new tombstones for `command-auth`, `discord`, `telegram-account`, whose records were deleted in 0d530ea5 (`removeAfter` 2026-10-01).
- 14 later named-export removals from surviving subpaths (2fec39f5#165431, bd64d93f#165288, f2de06b3#163587) recorded retroactively per owner decision; each release note states the export was removed without a compatibility window.
- The Skill Workshop proposal-hook types removed by cfee8511 (#161057) already had a tombstone; its surfaces are now qualified and dated.
Release-note context: Plugin SDK authors get a migration-guide row for each of the 14 retroactively recorded exports in `docs/plugins/sdk-migration/removed-surfaces.md`.
## Evidence
- Inventory generation from tag `v2026.9.8` (fc23bc86): 158 typed subpaths, 4,591 names; `config-runtime` 115, `infra-runtime` 583, `channel-message` 136, `command-auth` 78 names.
- Historical transition, guard + inventory overlaid on throwaway worktrees with `OPENCLAW_PLUGIN_SDK_SURFACE_NOW=2026-10-01`: `e649be31^` shows only pre-existing gaps; `e649be31` additionally fails on exactly `channel-lifecycle` (23), `channel-message` (136), `channel-reply-pipeline` (12), `config-runtime` (115), `infra-runtime` (583) despite its lowered budgets.
- Final tree: `pnpm plugin-sdk:surface:check` → `shipped Plugin SDK v2026.9.8: no unauthorized removals`. Reverting the tombstone dates re-reports all eight subpaths; pinning `OPENCLAW_PLUGIN_SDK_SURFACE_NOW=2026-10-07` re-reports the eight Skill Workshop types (strict date semantics).
- The guard already caught a live regression during this PR: cfee8511 landed on main mid-review and the rebased check failed on its eight unqualified types until the record was fixed.
- Regenerated against v2026.9.9 (bcfc8881) after it went stable mid-review: zero subpaths or names added or dropped versus v2026.9.8; check still clean.
- PR wrapper inventory lists the new compat-record module (first CI run failed `eager-import-closure` / `pr-worktree-provision` on its absence).
- Focused tests (`--maxWorkers=1`): `test/scripts/plugin-sdk-shipped-surface.test.ts` 20 passed (~2.2 s wall), `src/plugins/compat/registry.test.ts` 12 passed, `test/scripts/plugin-sdk-surface-report.test.ts` 11 passed / 1 Linux-only skip; all three ~11.7 s wall. Pure evaluator tests, no TS project boots, no timers.
- `node scripts/check-changed.mjs`: every lane passed except two inherited from `main`: the dead-export scan (`observePlacementAuthority`, already fixed on main by 017842386a) and core lint on three over-length files this PR does not touch. Direct oxlint on all changed `.ts`/`.mts` files is clean.
- Autoreview (Codex, P2 threshold): scoped-clean.
* build: generate Kysely declarations at build time
Prepare ignored type-only schema projections through existing install, build, compiler, test, SDK API, and package-boundary entrypoints. Preserve existing import paths and generated bytes, cache unchanged inputs, and cover unbundled SDK declaration consumers. No SQL, data, or runtime migration.
* build: finish Kysely preparation contract integration
Point explicit test roots at the type entrypoints and exercise generation through its production preparation owner without a test-only export.
* build: include Kysely generator in trusted tooling archive
Preserve shared beta/latest comparisons in a versioned pooled representation.
Keep full facts, logical digests, historical receipt support and admission limits.
Co-authored-by: steipete <58493+steipete@users.noreply.github.com>
Co-authored-by: vincentkoc <25068+vincentkoc@users.noreply.github.com>
Co-authored-by: RomneyDa <6581799+RomneyDa@users.noreply.github.com>
* refactor(plugin-sdk): replace API baselines with diffs
* perf(plugin-sdk): bound API diff resources
* fix(plugin-sdk): isolate API diff dependencies
* fix(release): forward Plugin SDK acknowledgement
* fix(release): enforce SDK acknowledgement on publish
* chore: preserve generated-doc ignore policy
* fix(release): freeze SDK API evidence before publish
* fix(ci): satisfy SDK evidence guards
* fix(release): bind complete SDK evidence
* fix(release): authenticate plugin SDK evidence
* fix(plugin-sdk): abort interrupted API diffs
* test(ui): freeze page clock in background-tasks rail e2e
The rail transcript is compared byte-for-byte across the detail-panel
round-trip while it renders live relative ages; on slow CI runners the
second boundary ticks between the two reads (11s -> 12s) and fails the
equality assertion. Fix the page Date with Playwright setFixedTime while
keeping timers running so the tasks.list polling assertions still hold.
Repro: a 1.5s stall between the reads fails pre-fix with the exact CI
diff and passes post-fix.
* fix(scripts): drop unused export on dependency-evidence CLI main
Knip's workflow scan re-roots script references after an actions/checkout
step that sets path:, so the new trusted-tooling checkout in
openclaw-npm-release.yml stops marking this CLI as a workflow entry and
its exported main() surfaces as an unused export in check-dependencies.
Nothing imports main; the module invokes it through its own entry guard,
so the export keyword was dead surface either way.
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
