fix(labels): make the label sync identity locale independent

[dwin-gharibi]

Closes #1136.

---

What Problem This Solves

Fixes an issue where the same batched label edit can be recorded under two different
idempotency keys, so the action ledger does not recognize it as a repeat and the
mutation can be published again.

flushIssueLabelMutationBatch stamps every published label edit with

issue_labels_sync:<number>:add=<sorted additions>:remove=<sorted removals>

and the ledger dedupes observed mutations on that string. The two lists were sorted
with String.prototype.localeCompare, which is locale-sensitive: it answers to the
ICU configuration of whatever machine produced the key. The identical label set,
batched identically, produces two different keys on two differently configured
runners:

en_US.UTF-8  issue_labels_sync:321:add=Alpha|apple|äpple|zulu:remove=
sv_SE.UTF-8  issue_labels_sync:321:add=Alpha|apple|zulu|äpple:remove=

localeCompare also returns 0 for strings a collator considers equivalent but
that are not equal — for example two label names differing only by a zero-width
joiner, which GitHub permits. A comparator that returns 0 is not a total order, so
Array.prototype.sort leaves those names in whatever order they were queued and the
key follows the queue rather than the set.

Why This Change Was Made

The sort feeds an identity, not a human-facing list, so it needs a total order that
is fully specified rather than a natural-language collation. The batch now sorts
with compareCodeUnits from src/stable-json.ts — the same code-unit ordering the
action ledger already uses for its canonical JSON — so the key depends only on the
label set.

Non-goals: the label sync decision logic, the batching behavior, and the ledger's
dedupe mechanism are all unchanged.

User Impact

A label sync that has already been applied is recognized as already applied,
regardless of which runner produced the earlier record. Operators stop seeing the
same label edit published twice for one item, and the ledger's dedupe guarantee
holds across a heterogeneous fleet.

OpenClaw Bay Impact

None. identity is an internal idempotency key for the action ledger; Bay does not
read or display it. No status, telemetry or dashboard data contract changes.

Documentation Lifecycle

No documentation lifecycle changes. The new file under
docs/proof/label-sync-identity-determinism/ is PR evidence, not a runbook or
reference.

Evidence

Change

• src/clawsweeper-label-mutations.ts — import compareCodeUnits; use it for both
  the additions and the removals sort.
• test/label-mutation-batch.test.ts — one regression test, plus three existing
  assertions updated (see below).

11 changed lines in source, 89 in tests.

A visible ordering change, and why it is safe

Code-unit order puts uppercase before lowercase, so P2 now sorts before
impact:message-loss where the collator put it after. That changes the order of
names inside the --add-label / --remove-label arguments, and three existing
assertions pinned the old order:

• an exact-publication label batch emits one combined deterministic issue edit
• label definition discovery is cached across item batches
• optional batch failures retain successful final operations and report skipped additions

Each was updated to the new order and still asserts the same behavior. GitHub treats
--add-label as a set, so the resulting label state is unchanged. In the third
test the per-label retry order also flips, which moves where the receipt lands: the
fixture rejects P2, so P2 is now the first retry and draws no receipt while
impact:message-loss succeeds and does. result.skippedAdditions is still ["P2"].

Focused tests

$ node --test test/label-mutation-batch.test.ts
ℹ tests 14   ℹ pass 14   ℹ fail 0

Reverting only src/clawsweeper-label-mutations.ts and rebuilding turns the new
test red along with the three updated ones (pass 10 / fail 4), which is what shows
they bind to this change.

Full suite and static gates

pnpm run check:static, pnpm run lint, pnpm run format:check and
pnpm run build:all all pass. The full suite is 2049 / 2066 with 2 failures —
test/action-ledger-runtime.test.ts temp-directory cleanup and
test/automerge-metrics.test.ts CLI JSON — both of which reproduce identically on
unmodified main at the same commit and neither of which imports
clawsweeper-label-mutations. That is exactly the baseline, with no additional
failure introduced.

Real Behavior Proof

Claim. The issue_labels_sync identity depends only on the label set — not on
the order the labels were queued, and not on the runner's locale.

Exercised surface.
createLabelMutationOperations(...).flushIssueLabelMutationBatch in
dist/clawsweeper-label-mutations.js, driven through the real batching API
(beginIssueLabelMutationBatch, addIssueLabel, removeIssueLabel, flush).

Scenario / fixture.
docs/proof/label-sync-identity-determinism/run-proof.mjs uses real ClawSweeper
label names (P2, impact:message-loss, maturity:stable, proof: sufficient)
plus a third-party name, and asserts four things: reversed / sorted / rotated queue
orders all yield the baseline identity; two names differing only by a zero-width
joiner sort deterministically (the run prints the localeCompare result of 0);
the exact key for a fixed set matches byte for byte; and the file re-executes itself
under LC_ALL=en_US.UTF-8 and LC_ALL=sv_SE.UTF-8 and compares the two keys.

Command and environment.

bash docs/proof/label-sync-identity-determinism/stage-before.sh
crabbox run --provider local-container --local-container-image node:24 --no-hydrate \
  --artifact-glob '.artifacts/**' -- \
  bash docs/proof/label-sync-identity-determinism/run-proof.sh

provider	local-container (runtime docker)
image	node:24 → v24.19.0, Linux aarch64
lease	cbx_22f9e117ae32 (swift-hermit)
run	run_16ab137d00ec
base staged	5439582b · src/clawsweeper-label-mutations.ts · sha256 f2fee8cc…f846
exit	0

The script refuses to run below Node 24, builds the Node lane, then runs the
fixtures twice — once against the module compiled from the base commit and once
against this branch. Container images carry no .git, so stage-before.sh writes
the base version of the changed file into the proof package on the host and it
rsyncs in; when git is available the script re-derives that file, so it cannot
drift from the base commit.

Observed result. Pre-fix, inside the lease, the two runners disagree:

== 4. two differently configured runners agree ==
  en_US.UTF-8  issue_labels_sync:321:add=Alpha|apple|äpple|zulu:remove=
  sv_SE.UTF-8  issue_labels_sync:321:add=Alpha|apple|zulu|äpple:remove=
  FAIL  en_US and sv_SE produce the same identity

The tied emoji names also follow queue order instead of sorting, and the exact key
assertion fails. On this branch both runners emit
issue_labels_sync:321:add=Alpha|apple|zulu|äpple:remove=, every assertion passes,
and the focused suite is pass 14 / fail 0. A batch still publishes a mutation in
both runs, and the script fails the proof if that ever stops holding — which is
what shows the change only affects ordering.

Artifact / trace.
.crabbox/runs/run_16ab137d00ec/run_16ab137d00ec-artifacts.tgz containing
.artifacts/label-sync-identity-determinism-proof/ — before-output.txt,
proof-output.txt, focused-tests.txt, install and build logs.

Limits. This proves the identity string and the ordering that feeds it. It does
not call GitHub and does not exercise the ledger's dedupe path end to end — it
establishes that the key handed to the ledger is stable, not what the ledger then
does with it. It also does not survey the repository for other locale-sensitive
sorts; the linked issue records what was checked.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[clawsweeper]

Codex review: found issues before merge. Reviewed August 19, 2026, 2:12 AM ET / 06:12 UTC.

ClawSweeper review

What this changes

This PR replaces locale-sensitive label-name sorting with deterministic UTF-16 code-unit ordering, adds regression coverage, and adds a container-based before/after proof package.

Merge readiness

⚠️ Needs maintainer review before merge - 3 items remain

Keep open: the code correctly canonicalizes the recorded label-mutation identity, but the PR description still claims it prevents duplicate GitHub edits and closes the linked issue despite the apply path having no pre-execution identity gate.

Priority: P2
Reviewed head: 2518cf2933a85cb72920baf56ff93646723f0bec

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The implementation and behavioral proof are strong, but the unresolved P1 makes the PR’s advertised and closing outcome unsafe.
Proof confidence	🦞 diamond lobster (5/6) ✨ media proof bonus	Sufficient (linked_artifact): The PR body provides a current-head Docker-backed Crabbox before/after trace against the compiled batching module, including two locales, queue-order variants, focused test output, and stated limits.
Patch quality	🐚 platinum hermit (4/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (linked_artifact): The PR body provides a current-head Docker-backed Crabbox before/after trace against the compiled batching module, including two locales, queue-order variants, focused test output, and stated limits.
Evidence reviewed	5 items	Canonical identity implementation: The submitted head sorts both batched label lists with the existing total, locale-independent code-unit comparator before constructing the identity. No duplicate-edit enforcement gate: The apply runner records an attempt but invokes the operation when no attempt is available and also invokes it on the normal path; it does not consult a prior identity to suppress a GitHub edit. Ledger identity is recorded, not used as a gate: The ledger hashes the supplied mutation identity into a workflow phase event; this code does not perform a lookup or return a duplicate-prevention decision.
Findings	1 actionable finding	[P1] Align the duplicate-edit claim with the enforcement boundary
Security	None	None.

Live Verification

Command: node --test test/label-mutation-batch.test.ts

Result: FAIL (partial) — step 2 expect_output the issue label sync identity does not depend on insertion order or runner locale: expected terminal output was not visible within 30 seconds: "the issue label sync identity does not depend on insertion order or runner locale"

node --test test/label-mutation-batch.test.ts
runner@runnervmzvulz:/tmp/clawsweeper-live-proof-1139-EUWFMX/target$ node --test test/label-mutation-batch.test.ts
node:internal/modules/esm/resolve:271
    throw new ERR_MODULE_NOT_FOUND(
          ^

Error [ERR_MODULE_NOT_FOUND]: Cannot find module '/tmp/clawsweeper-live-proof-1139-EUWFMX/target/dist/clawsweeper-label-mutations.js' imported from /tmp/clawswe
eper-live-proof-1139-EUWFMX/target/test/label-mutation-batch.test.ts
    at finalizeResolution (node:internal/modules/esm/resolve:271:11)
    at moduleResolve (node:internal/modules/esm/resolve:865:10)
    at defaultResolve (node:internal/modules/esm/resolve:992:11)
    at #cachedDefaultResolve (node:internal/modules/esm/loader:701:20)
    at #resolveAndMaybeBlockOnLoaderThread (node:internal/modules/esm/loader:721:38)
    at ModuleLoader.resolveSync (node:internal/modules/esm/loader:759:56)
    at #resolve (node:internal/modules/esm/loader:683:17)
    at ModuleLoader.getOrCreateModuleJob (node:internal/modules/esm/loader:603:35)
    at ModuleJob.syncLink (node:internal/modules/esm/module_job:163:33)
    at ModuleJob.link (node:internal/modules/esm/module_job:253:17) {
  code: 'ERR_MODULE_NOT_FOUND',
  url: 'file:///tmp/clawsweeper-live-proof-1139-EUWFMX/target/dist/clawsweeper-label-mutations.js'
}

Node.js v24.19.0
✖ test/label-mutation-batch.test.ts (90.393575ms)
ℹ tests 1
ℹ suites 0
ℹ pass 0
ℹ fail 1
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 99.217435

✖ failing tests:

test at test/label-mutation-batch.test.ts:1:1
✖ test/label-mutation-batch.test.ts (90.393575ms)
  'test failed'
runner@runnervmzvulz:/tmp/clawsweeper-live-proof-1139-EUWFMX/target$ node --test test/label-mutation-batch.test.ts
node:internal/modules/esm/resolve:271
    throw new ERR_MODULE_NOT_FOUND(
          ^

Error [ERR_MODULE_NOT_FOUND]: Cannot find module '/tmp/clawsweeper-live-proof-1139-EUWFMX/target/dist/clawsweeper-label-mutations.js' imported from /tmp/clawswe
eper-live-proof-1139-EUWFMX/target/test/label-mutation-batch.test.ts
    at finalizeResolution (node:internal/modules/esm/resolve:271:11)
    at moduleResolve (node:internal/modules/esm/resolve:865:10)
    at defaultResolve (node:internal/modules/esm/resolve:992:11)
    at #cachedDefaultResolve (node:internal/modules/esm/loader:701:20)
    at #resolveAndMaybeBlockOnLoaderThread (node:internal/modules/esm/loader:721:38)
    at ModuleLoader.resolveSync (node:internal/modules/esm/loader:759:56)
    at #resolve (node:internal/modules/esm/loader:683:17)
    at ModuleLoader.getOrCreateModuleJob (node:internal/modules/esm/loader:603:35)
    at ModuleJob.syncLink (node:internal/modules/esm/module_job:163:33)
    at ModuleJob.link (node:internal/modules/esm/module_job:253:17) {
  code: 'ERR_MODULE_NOT_FOUND',
  url: 'file:///tmp/clawsweeper-live-proof-1139-EUWFMX/target/dist/clawsweeper-label-mutations.js'
}

Node.js v24.19.0
✖ test/label-mutation-batch.test.ts (89.962976ms)
ℹ tests 1
ℹ suites 0
ℹ pass 0
ℹ fail 1
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 98.740639

✖ failing tests:

test at test/label-mutation-batch.test.ts:1:1
✖ test/label-mutation-batch.test.ts (89.962976ms)
  'test failed'
runner@runnervmzvulz:/tmp/clawsweeper-live-proof-1139-EUWFMX/target$

Assertions:

• FAIL expect_output: the issue label sync identity does not depend on insertion order or runner locale
• FAIL expect_output: pass 14

How this fits together

Label batching turns requested additions and removals into GitHub issue-edit operations and an identity recorded by the apply ledger. The identity supports durable audit correlation, while the apply workflow separately determines whether to invoke the GitHub operation.

flowchart LR
A[Label requests] --> B[Label batch]
B --> C[Code-unit ordering]
C --> D[Mutation identity]
D --> E[Apply ledger event]
E --> F[Apply workflow]
F --> G[GitHub label edit]

Loading

Before merge

• Align the duplicate-edit claim with the enforcement boundary (P1) - The PR body still says this prevents repeat GitHub edits and closes The issue_labels_sync idempotency key varies by runner locale #1136, while the proof itself says the enforcement gate is separate. The apply runner still calls options.operation() after recording an attempt, so revise the body and closing relation to the canonical-recording scope, or add and prove a pre-execution gate. This repeats the unresolved prior P1.
• Resolve merge risk (P1) - Merging with the current description would close The issue_labels_sync idempotency key varies by runner locale #1136 as though duplicate GitHub label edits are prevented, although this PR only makes the recorded identity deterministic.
• Complete next step (P2) - The remaining blocker is a contributor-facing correction to the current PR description and its closing relation, not a safe separate repair-lane change.

Findings

• [P1] Align the duplicate-edit claim with the enforcement boundary — docs/proof/label-sync-identity-determinism/README.md:18-21

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and proof footprint	production +12/-2, tests +81/-8, proof/docs +469	The functional change is small and covered, while most of the PR is evidence material; the remaining blocker is claim scope rather than implementation size.

Root-cause cluster

Relationship: fixed_by_candidate
Canonical: #1136
Summary: This PR is the candidate implementation for the linked locale-dependent label-identity issue, but it does not implement the duplicate-edit suppression described in its current body.

Members:

• canonical: The issue_labels_sync idempotency key varies by runner locale #1136 - The PR explicitly links this issue and implements its proposed code-unit ordering change.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge-risk options

Maintainer options:

1. Align the PR with canonical recording (recommended)
   Remove the duplicate-edit prevention and closing claims, retain the deterministic-identity scope, and request a fresh review.
2. Implement an enforcement gate
   If the intended outcome is duplicate suppression, add a pre-execution identity lookup plus an end-to-end apply/transport proof before closing the linked issue.

Technical review

Best possible solution:

Land the narrow canonical-identity repair only after the PR description and linked-issue relationship describe that limited behavior; track any pre-execution duplicate-suppression gate separately unless it is deliberately added with end-to-end proof.

Do we have a high-confidence way to reproduce the issue?

Yes: current source directly constructs the identity from sorted labels, and the submitted compiled-module proof exercises reversed orders plus two locales to show the prior nondeterminism.

Is this the best way to solve the issue?

No for the PR's stated duplicate-prevention outcome: code-unit sorting fixes canonical recording, but source shows no identity lookup before the GitHub operation; it is the right narrow solution only for identity determinism.

Full review comments:

• [P1] Align the duplicate-edit claim with the enforcement boundary — docs/proof/label-sync-identity-determinism/README.md:18-21
  The PR body still says this prevents repeat GitHub edits and closes The issue_labels_sync idempotency key varies by runner locale #1136, while the proof itself says the enforcement gate is separate. The apply runner still calls options.operation() after recording an attempt, so revise the body and closing relation to the canonical-recording scope, or add and prove a pre-execution gate. This repeats the unresolved prior P1.
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.98

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 02c930c53d1c.

Labels

Label justifications:

• P2: This is a bounded correctness and operator-automation repair, but the unresolved claim mismatch blocks safe closure of the linked issue.
• merge-risk: 🚨 automation: The PR changes the identity used to record automated GitHub label mutations, so incorrect scope claims could affect automation expectations.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (linked_artifact): The PR body provides a current-head Docker-backed Crabbox before/after trace against the compiled batching module, including two locales, queue-order variants, focused test output, and stated limits.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR body provides a current-head Docker-backed Crabbox before/after trace against the compiled batching module, including two locales, queue-order variants, focused test output, and stated limits.

Evidence

What I checked:

• Canonical identity implementation: The submitted head sorts both batched label lists with the existing total, locale-independent code-unit comparator before constructing the identity. (src/clawsweeper-label-mutations.ts:248, 2518cf2933a8)
• No duplicate-edit enforcement gate: The apply runner records an attempt but invokes the operation when no attempt is available and also invokes it on the normal path; it does not consult a prior identity to suppress a GitHub edit. (src/clawsweeper-apply-decision-workflow.ts:633, 2518cf2933a8)
• Ledger identity is recorded, not used as a gate: The ledger hashes the supplied mutation identity into a workflow phase event; this code does not perform a lookup or return a duplicate-prevention decision. (src/clawsweeper-apply-ledger.ts:274, 2518cf2933a8)
• Submitted proof recognizes the limit: The added proof document explicitly says this change does not prevent duplicate GitHub edits and that a future enforcement gate would be separate work, which conflicts with the current PR body and closing claim. (docs/proof/label-sync-identity-determinism/README.md:11, 2518cf2933a8)
• Related apply-path ownership: Local feature-history search identifies Peter Steinberger's commit c175faa as prior work touching the ledger identity path; the partial checkout could not retrieve deeper promisor history. (src/clawsweeper-apply-ledger.ts:274, c175faa03a95)

Likely related people:

• Peter Steinberger: Local history associates commit c175faa with the apply-ledger identity path that establishes the enforcement boundary. (role: recent adjacent contributor; confidence: low; commits: c175faa03a95; files: src/clawsweeper-apply-ledger.ts, src/clawsweeper-apply-decision-workflow.ts)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Revise the PR body to state that the change canonicalizes the recorded identity and does not suppress duplicate GitHub edits.
• Remove the closing relation to The issue_labels_sync idempotency key varies by runner locale #1136 unless that issue’s remaining expected behavior is explicitly narrowed to identity determinism.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (5 earlier review cycles)

• reviewed 2026-08-12T11:49:33.862Z sha 6220d87 :: needs real behavior proof before merge. :: [P1] Deduplicate before invoking GitHub
• reviewed 2026-08-12T12:19:28.853Z sha 1630b5c :: needs real behavior proof before merge. :: [P1] Gate the GitHub edit on the idempotency identity
• reviewed 2026-08-12T13:03:15.158Z sha f6071b7 :: needs real behavior proof before merge. :: [P1] Gate the GitHub edit before closing the duplicate-prevention issue
• reviewed 2026-08-12T23:32:11.187Z sha f6071b7 :: found issues before merge. :: [P1] Reconcile the closing claim with the actual enforcement boundary
• reviewed 2026-08-18T09:31:03.668Z sha f6071b7 :: found issues before merge. :: [P1] Align the closing claim with the enforcement boundary

[dwin-gharibi]

@steipete

[steipete]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/32122857953
• Updated: 2026-08-18T09:41:05.283Z