- C1: Removed weekly_strategy and meta_analysis from Elephant Alpha's SAFE_ACTIONS (orchestrator prompt and engine _ACTION_ZH) to prevent autonomous generation of scheduled reports
- C2: Removed hardcoded 0.85 confidence example from orchestrator prompt and implemented bounding validation (0.0~1.0) in _parse_strategic_decision
- C3: Expanded ADR-019 data freshness gate (_ppt_check_data_freshness) to cover /ppt weekly and /ppt strategy routes, proactively warning users of stale data
- B1 & B2: Updated SQL column names from 銷售金額 to 總業績 in openclaw_strategist_service.py and chart_generator_service.py
- B3: Removed bare except statements in DB fetchers to raise errors instead of failing silently
- B4: Implemented freshness gate (MAX(snapshot_date) < CURRENT_DATE - 2) in daily_sales_snapshot to prevent generating stale reports and send data stalled alerts
- B5: Replaced hardcoded 45.0 system load percentage with actual psutil CPU metric
Critic-approved 3-point revision (REVISE → adopted):
1. Disable weekly_insight trigger at definition (line 279-285) — EA no
longer evaluates the 6h / >=5 ai_insights condition that fired
_generate_strategy_report without force_tg_alert=True.
2. Remove the openclaw weekly/meta dispatch table branches (line 591-606).
The 5 actions (generate_strategic_analysis, generate_weekly_strategy,
generate_market_analysis, generate_pricing_strategy,
generate_meta_analysis) now fall through to the existing
`raise ValueError(f"Unrecognized step: ...")` at line 631, which
_execute_decision's try/except converts into a circuit-breaker failure.
This is the correct failure semantics critic asked for.
3. Convert _generate_strategy_report / _generate_meta_report into hard
RuntimeError raisers and drop their imports of
openclaw_strategist_service. Deep insurance: any future caller crashes
immediately instead of silently bypassing dedupe.
Evidence: ai_insights logged 35+ duplicate weekly_strategy sends in 7 days
because EA's `_generate_strategy_report` invoked
generate_weekly_strategy_report() without force_tg_alert=True, bypassing
the run_scheduler.py weekly dedupe gate.
Out of scope (per task contract):
- run_scheduler.py:115 Monday 06:00 schedule — preserved (sole owner)
- services/openclaw_strategist_service.py — owned by B-series (SQL)
- Other EA triggers (price_drop_alert / market_opportunity /
threat_escalation / code_exception / resource_optimization) — preserved
- Other dispatch branches (hermes / nemotron / auto_heal / code_fix /
price_adjustment review) — preserved
- Did NOT add force_tg_alert=True defensive layer (critic flagged as
anti-pattern)
- Did NOT touch _TRIGGER_TO_DECISION_TYPE / _ALLOWED_ACTION_TYPES
Not pushed, not deployed. D1 deployment will be issued separately and
must use `docker compose up -d --no-deps --force-recreate momo-scheduler`
(per feedback_compose_restart_vs_up).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Webhook (Flask) and polling (momo-telegram-bot) consumed the same
Telegram update_id, causing /menu callbacks to fire twice. Add a
shared dedup module backed by telegram_update_dedup table (300s TTL,
60s cleanup) with in-memory fallback, wired into both paths.
Polling launcher now skips startup when webhook is configured to
prevent dual-consumption at the source.
38 tests across webhook, menu keyboards, telegram_api, dedup guard,
and trend bot service.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- normalize URLs at write time (scheduler crawlers, routes) to drop
javascript:/EC404/placeholder i_code (momo_/manual_/pchome_)
- add global click+auxclick guard in base.html and ewoooc_base.html
that intercepts blocked MOMO URLs and redirects to safe i_code URL
- per-page dashboards reuse the same isLikelyMomoIcode validation
- /api/track_momo_link records blocked events for diagnosis
- ship sanitize_momo_urls.py to clean existing polluted DB rows
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
