chore: auto-commit uncommitted changes

MEMORY.md

@@ -161,9 +161,10 @@ I do NOT ask for permission or approval. I use my judgment. I only escalate if s
 - Main session now only used for actual conversations with Johan.
 
 ### OpenClaw Patches (reapply after every OC update)
-Two patches must be reapplied to `dist/` files after each OpenClaw update:
+**Updated for 2026.2.23** (file hashes change each release — grep to find current files):
-1. **Scope preservation** (`dist/gateway-cli-DbznSfRg.js`): `if (scopes.length > 0)` → `if (scopes.length > 0 && !disableControlUiDeviceAuth)` — prevents `dangerouslyDisableDeviceAuth` from clearing scopes
+
-2. **Deleted transcript indexing** (`dist/sqlite-C54NeA1C.js`): `.filter((name) => name.endsWith(".jsonl"))` → add `|| name.includes(".jsonl.deleted.")` — makes memory_search find old sessions
+1. **Deleted transcript indexing** — grep `dist/query-expansion-*.js` for `filter((name) => name.endsWith(".jsonl"))`, add `|| name.includes(".jsonl.deleted.")`. Makes memory_search find old sessions. Applied to all 4 query-expansion files in 2026.2.23.
+2. ~~Scope preservation~~ — **no longer needed** as of 2026.2.23. `dangerouslyDisableDeviceAuth` not used in our config; scopes intact without patch.
 
 ### ✅ sessions_spawn — Working (Feb 22)
 Subagent spawning works from conversation sessions. Auth is via `tokens.operator.scopes` in `device-auth.json` + `paired.json` — both have full operator scopes. Gateway bind set to `custom/0.0.0.0` resolved the bind issue. Tested and confirmed working.
@@ -879,6 +880,34 @@ Final architecture (after painful debug session):
 - **DO NOT re-enable Bayes without proper training plan**
 - **DO NOT lower DMARC/DKIM scores — they are intentionally high**
 
+## Google Antigravity — DEAD (2026-02-24)
+- Token expired Feb 19, refresh fails — Google revoked/banned the Antigravity OAuth app
+- `google-antigravity:johan@jongsma.me` profile in OC has credentials but can't refresh
+- **inou unaffected** — uses direct Gemini API key (`AIzaSyAsSUSCVs3SPXL7ugsbXa-chzcOKKJJrbA`), confirmed working
+- Johan: "I don't mind." Not a priority to fix.
+
+## ClawHub Malware Incident (2026-02-24)
+- #1 most downloaded skill was SSH key stealer + reverse shell via prompt injection in SKILL.md
+- ~20% of ClawHub skills were malware (1,184 bad). OC 2026.2.23 exec hardening is the response.
+- **We are safe** — only use built-in OC skills + manually written `~/clawd/skills/`. Zero ClawHub installs.
+- SkillSMP.com = third-party marketplace filling the gap. Treat all third-party skill sources as hostile.
+
+## inou Labs — LOINC Matching Bug (OPEN)
+- Symptom: "pretty charts" not showing in Labs; LOINC matching not working
+- Root cause: 0 lab entries in prod DB have `data["loinc"]` set; `buildLabRefData()` returns `{}`
+- `Normalize()` skips all entries (thinks they're done because `SearchKey2` is set)
+- reference.db has 448 lab_test + 1551 lab_reference entries — data is there
+- Gemini API key valid (200 confirmed)
+- **Fix needed**: force re-normalize or fix `buildLabRefData` to fall back to `e.SearchKey` (which IS the LOINC code)
+- **Server**: 192.168.1.253, `/tank/inou/`
+
+## DealRoom — Misha Requests (2026-02-24)
+- Claude Code agent shipped most of spec, commit `24f4702`, pushed to Zurich
+- **3 gaps remaining** (need another agent run):
+  1. Per-group folder visibility checkboxes (spec 2.e.i.2)
+  2. Saved folder structure templates with reuse (spec 2.f.i.2.i)
+  3. Auto-assign review step — currently fires silently, needs user review UI (spec 3.b.2)
+
 ## Andrew/Spacebot Update (2026-02-24)
 - **v0.1.15**, Claude Sonnet 4.6 via Anthropic OAuth, config at `/home/johan/spacebot-config.toml` on 192.168.1.17
 - **Worker dispatch broken**: channel calls reply() and stops — no workers ever spawned for multi-step tasks. Revisiting 2026-03-03.

memory/2026-02-24.md

@@ -40,3 +40,56 @@ St. Pete tonight: **9°C (48°F), clear, 27 km/h wind** — cold. Andrew halluci
 
 ## Spacebot Monitoring
 Added to HEARTBEAT.md: weekly check for new Spacebot releases, specifically worker dispatch fix. Don't update Andrew container until Johan says so.
+
+---
+
+## Night Shift Session (10:30pm – ~3:30am)
+
+### OpenClaw updated to 2026.2.23
+- Updated from 2026.2.22-2
+- Key changes: Kilo Gateway provider, Moonshot/Kimi vision+video, compaction overflow recovery, exec hardening, ACP/OTEL secret redaction, `allowFrom` now ID-only (but `"*"` still required for `open` dmPolicy)
+- **ClawHub malware incident** disclosed in this release: #1 downloaded skill was SSH key stealer + reverse shell. ~20% of marketplace skills malware. 1,184 bad skills. We're safe — only use built-in + manual skills.
+- **SkillSMP.com** — third-party marketplace trying to fill the ClawHub gap. Treat all third-party skill marketplaces as hostile.
+- **Patch reapplied**: deleted transcript indexing now in `query-expansion-*.js` (was `sqlite-C54NeA1C.js` in old version)
+- **Scope preservation patch**: no longer needed — `dangerouslyDisableDeviceAuth` not in our config, scopes intact
+
+### Google Antigravity key — DEAD
+- Token expired **Feb 19**, refresh fails — Google banned/revoked the Antigravity OAuth app
+- Affects: Gemini via `google-antigravity` provider in OC sessions
+- **inou is fine** — inou uses a direct Gemini API key (`AIzaSyAsSUSCVs3SPXL7ugsbXa-chzcOKKJJrbA`) which works (200)
+- Johan: "I don't mind" — not a priority
+
+### iOS / iPhone OC status
+- Internal preview only, not publicly distributed
+- Works as a node (camera, screen, location, voice wake)
+- 2026.2.21 had "iOS/Watch polish", so it exists and works
+- Third-party "GoClaw" on App Store (not official)
+
+### Arcee Trinity-Large-Preview (OpenRouter, free)
+- 400B MoE, 13B active params per token (4-of-256 expert routing)
+- #1 most popular model for OC on OpenRouter during preview
+- 128k context, agentic-capable, free during preview
+- Worth watching when non-preview Trinity-Large drops
+
+### DealRoom — Misha's Feature Requests
+- Claude Code agent ran, implemented most of spec (973 insertions, 11 files)
+- Committed and pushed to Zurich: `24f4702`
+- **3 gaps identified after review:**
+  1. **Per-group folder visibility checkboxes** (spec 2.e.i.2) — MISSING. Groups have name/role/email but no folder checkbox tree.
+  2. **Saved folder structure templates** (spec 2.f.i.2.i) — MISSING. Can't name/save/reuse folder layouts.
+  3. **Auto-assign review step** (spec 3.b.2) — fires automatically, no user review UI before commit.
+- **TODO**: spawn another agent to fix these 3 gaps (deferred — Johan sleeping)
+
+### inou Labs / LOINC matching — BUG OPEN
+- Johan: "pretty charts not showing in Labs, LOINC matching not working"
+- Root cause partially traced:
+  - `buildLabRefData()` reads `data["loinc"]` from lab entries
+  - Production DB (192.168.1.253:/tank/inou/data/inou.db): 0 entries have loinc in data JSON
+  - `Normalize()` says "all entries already normalized" — because `SearchKey2` is set for all entries
+  - But `data["loinc"]` is never set (maybe normalize ran before that field was added, or Gemini returned empty LOINC codes)
+  - Gemini API key IS valid (200 response confirmed)
+  - reference.db has 448 lab_test + 1551 lab_reference entries — reference data is there
+  - Entry data is encrypted — can't inspect raw from SQLite
+- **Next step**: debug normalize on prod with a test run that forces re-normalization; or fix buildLabRefData to fall back to e.SearchKey (which is also set to the LOINC code by normalize)
+- **TODO**: fix this when Johan wakes up
+

memory/claude-usage.json

@@ -1,9 +1,9 @@
 {
-  "last_updated": "2026-02-24T11:00:01.769669Z",
+  "last_updated": "2026-02-24T17:00:01.752461Z",
   "source": "api",
-  "session_percent": 0,
+  "session_percent": 5,
-  "session_resets": null,
+  "session_resets": "2026-02-24T21:00:00.720343+00:00",
-  "weekly_percent": 40,
+  "weekly_percent": 42,
-  "weekly_resets": "2026-02-28T19:00:00.729257+00:00",
+  "weekly_resets": "2026-02-28T19:00:00.720363+00:00",
-  "sonnet_percent": 47
+  "sonnet_percent": 51
 }

memory/heartbeat-state.json

@@ -1,19 +1,20 @@
 {
   "lastChecks": {
-    "email": 1771889498,
+    "email": 1771948934,
     "calendar": null,
-    "weather": 1771597876,
+    "weather": 1771942030,
     "briefing": 1771597876,
     "news": 1771597876,
     "claude_usage": 1771889498
   },
-  "lastBriefing": "2026-02-22T15:55:54.305561Z",
+  "lastBriefing": "2026-02-24T14:07:10.852040+00:00",
   "lastWeeklyDocker": "2026-02-22T08:33:05.950745+00:00",
   "lastWeeklyHAOS": "2026-02-22T08:33:05.950745+00:00",
   "lastWeeklyMemorySynthesis": "2026-02-22T10:05:38.031320Z",
-  "lastDocInbox": "2026-02-20T14:30:00.000Z",
+  "lastDocInbox": "2026-02-24T11:30:00.000Z",
   "lastTechScan": "2026-02-23T13:02:43.785Z",
-  "lastMemoryReview": "2026-02-23T13:01:00.000000+00:00",
+  "lastMemoryReview": "2026-02-24T11:29:00.000000+00:00",
-  "lastIntraDayXScan": "2026-02-24T07:02:30.000Z",
+  "lastIntraDayXScan": "2026-02-24T16:03:00.000Z",
-  "lastInouSuggestion": "2026-02-23T13:05:33.000000+00:00"
+  "lastInouSuggestion": "2026-02-24T13:02:03.000000+00:00",
+  "lastEmail": 1771948934
 }

memory/updates/2026-02-24.json

@@ -0,0 +1,20 @@
+{
+  "date": "2026-02-24",
+  "timestamp": "2026-02-24T09:00:01-05:00",
+  "openclaw": {
+    "before": "2026.2.23",
+    "latest": "2026.2.23",
+    "updated": false
+  },
+  "claude_code": {
+    "before": "2.1.52",
+    "latest": "2.1.52",
+    "updated": false
+  },
+  "os": {
+    "available": "0\n0",
+    "updated": false,
+    "packages": []
+  },
+  "gateway_restarted": false
+}