diff --git a/docs/getting-started/installation.md b/docs/getting-started/installation.md
index 8d130ba..11b19ec 100644
--- a/docs/getting-started/installation.md
+++ b/docs/getting-started/installation.md
@@ -73,6 +73,10 @@ Do not use `sudo npm`. Point npm's global prefix at a directory you own (for exa
 
 Both desktop apps can set up a local Gateway on first run or connect to a remote one.
 
+:::warning Changing in 2026.10.10 (beta)
+2026.10.10-beta.1 (npm `beta`, 2026-10-15; not in 2026.10.4) requires **macOS 26.2, iOS 26.2 and Safari 26.2** or newer for the native apps and the Control UI ([PR #168595](https://github.com/openclaw/openclaw/pull/168595)). 2026.10.4's macOS app needs macOS 15.0 or later. If a Mac, iPhone or iPad you use cannot update to 26.2, stay on 2026.10.4 for the apps, or use the Control UI from another browser.
+:::
+
 ## Method 4: Docker
 
 Use Docker for a headless server or an isolated Gateway. The supported path is the setup script in the repo, which builds or pulls the image, runs onboarding, writes a Gateway token to `.env` and starts Docker Compose:
diff --git a/docs/guides/channels.md b/docs/guides/channels.md
index e4155db..c2c7247 100644
--- a/docs/guides/channels.md
+++ b/docs/guides/channels.md
@@ -84,7 +84,7 @@ openclaw channels status --probe
 
 With the default hot reload, a running Gateway applies new channel config without a restart. If the Gateway is not running, start it with `openclaw gateway start` (service) or `openclaw gateway run` (foreground).
 
-In 2026.10.4, `openclaw plugins install @openclaw/<id>` installs from npm first and falls back to the package's ClawHub listing only when the npm target is unavailable; prefix `npm:` or `clawhub:` to force a source. Reference: [`openclaw channels`](https://docs.openclaw.ai/cli/channels), [plugins](https://docs.openclaw.ai/tools/plugin).
+In 2026.10.4, `openclaw plugins install @openclaw/<id>` installs from npm first and falls back to the package's ClawHub listing only when the npm target is unavailable; prefix `npm:` or `clawhub:` to force a source. Upstream `main` (not yet in any release, including 2026.10.10-beta.1) resolves bare names through ClawHub instead, with no npm fallback ([PR #173669](https://github.com/openclaw/openclaw/pull/173669)); the official `@openclaw/*` channel plugins install either way, but scripts that need npm should say `npm:`. Reference: [`openclaw channels`](https://docs.openclaw.ai/cli/channels), [plugins](https://docs.openclaw.ai/tools/plugin).
 
 ---
 
@@ -310,8 +310,8 @@ openclaw channels status --probe
 
 OpenClaw 2026.10.4 has no built-in X / Twitter channel.
 
-:::note Next release
-Upstream `main` adds a bundled **X channel** (`x`) that turns mentions of your bot account into conversations and posts public replies, only for allowlisted authors by default, with no DMs, likes or original posts. It is not in 2026.10.4. See [docs.openclaw.ai/channels/x](https://docs.openclaw.ai/channels/x) once you upgrade.
+:::note Coming in 2026.10.10 (beta)
+2026.10.10-beta.1 (npm `beta`, 2026-10-15; not in 2026.10.4) adds an **X channel plugin** (`x`, [PR #165138](https://github.com/openclaw/openclaw/pull/165138)). It turns mentions of your bot account into conversations and posts public replies, only for allowlisted authors by default. It uses X Activity API streaming or mention polling, has an optional guest mode for unknown authors, and enforces daily and monthly X API cost limits. No DMs, likes or original posts. Until it is stable, use TweetClaw below or wait; see [docs.openclaw.ai/channels/x](https://docs.openclaw.ai/channels/x) once you upgrade.
 :::
 
 For X automation today (search, follower export, monitors, giveaways), [TweetClaw](https://github.com/Xquik-dev/tweetclaw) is a **third-party** plugin backed by Xquik's paid API:
diff --git a/docs/guides/clawhub.md b/docs/guides/clawhub.md
index 51ad2d8..8399c56 100644
--- a/docs/guides/clawhub.md
+++ b/docs/guides/clawhub.md
@@ -164,7 +164,7 @@ For CI, ClawHub ships a reusable GitHub Actions workflow; see [CI/CD & Testing](
 
 ### After you publish
 
-Publishes are staged: a release is held behind pre-publication checks (static analysis, VirusTotal, SkillSpector, Tencent A.I.G, ClawScan risk analysis) and appears in search once it clears. Releases that are held or blocked stay visible to their owner. Download the scan report for a blocked version with:
+Publishes are staged: since 2026-10-13 every skill version and package release is held as pending behind pre-publication checks, and a scanner failure or timeout leaves it unpublished rather than letting it through ([clawhub PR #3947](https://github.com/openclaw/clawhub/pull/3947)). The checks are static analysis, VirusTotal, SkillSpector, Tencent A.I.G and ClawScan risk analysis; the release appears in search once it clears. Releases that are held or blocked stay visible to their owner. Download the scan report for a blocked version with:
 
 ```bash
 clawhub scan download my-skill --version 1.0.1 --output report.zip
@@ -202,7 +202,7 @@ Each release gets a security audit on its skill page, combining ([Security audit
 - **ClawScan** risk analysis, which asks whether the name, description, declared permissions and actual content line up, using the OWASP Agentic Skills Top 10 as a lens
 - **VirusTotal** and static analysis results, shown as detail pages
 
-Signed-in users can report a skill with the **Report skill** button; a skill is hidden automatically after more than three unique reports, pending moderator review.
+Signed-in users can report a skill with the **Report skill** button. Reports never hide a skill automatically; moderators review them ([ClawHub moderation spec](https://github.com/openclaw/clawhub/blob/main/specs/security-moderation.md)). The old auto-hide rule was withdrawn after GHSA-5jj4-m8c9-gwcq showed that four ordinary accounts could hide any skill, official ones included.
 
 OpenClaw itself also has a local code-safety scanner (since 2026.2.6), and `openclaw skills install` refuses releases ClawHub has marked malicious or blocked.
 
diff --git a/docs/guides/deployment-options.md b/docs/guides/deployment-options.md
index 7d3a75e..0e16d55 100644
--- a/docs/guides/deployment-options.md
+++ b/docs/guides/deployment-options.md
@@ -39,7 +39,7 @@ openclaw gateway status
 openclaw gateway restart
 ```
 
-- **macOS:** a per-user LaunchAgent labelled `ai.openclaw.gateway`.
+- **macOS:** a per-user LaunchAgent labelled `ai.openclaw.gateway`. The Gateway itself only needs Node; from 2026.10.10 (now in beta) the macOS app and the Control UI in Safari need macOS or Safari 26.2 or newer ([PR #168595](https://github.com/openclaw/openclaw/pull/168595)).
 - **Linux:** a systemd **user** unit, `openclaw-gateway.service`. Inspect it with `systemctl --user status openclaw-gateway` and `journalctl --user -u openclaw-gateway -f`. On a headless server, run `sudo loginctl enable-linger $(whoami)` so it keeps running after you log out.
 - After changing `gateway.port`, run `openclaw gateway install --force` so the service starts on the new port.
 
diff --git a/docs/guides/plugin-system.md b/docs/guides/plugin-system.md
index b6ad29a..77a91fa 100644
--- a/docs/guides/plugin-system.md
+++ b/docs/guides/plugin-system.md
@@ -67,7 +67,7 @@ openclaw plugins install --link ./my-plugin --force   # link a dev checkout
 
 Git sources use `git:github.com/<owner>/<repo>` with an optional `@<ref>`. Claude-compatible marketplaces use `<plugin>@<marketplace>` or `--marketplace <source>`.
 
-In v2026.10.4, a **bare** name (`openclaw plugins install some-plugin`) installs from **npm**, unless it matches a bundled or official plugin id. Upstream `main` has switched bare names to ClawHub for the next release. Use an explicit `clawhub:` or `npm:` prefix so the command means the same thing on both.
+In v2026.10.4, a **bare** name (`openclaw plugins install some-plugin`) installs from **npm**, unless it matches a bundled or official plugin id. Upstream `main` has switched bare names to ClawHub with no npm fallback ([PR #173669](https://github.com/openclaw/openclaw/pull/173669)). That change merged after 2026.10.10-beta.1 and beta.2 were cut, so it is in no release yet and may or may not ship in 2026.10.10. Use an explicit `clawhub:` or `npm:` prefix so the command means the same thing on both sides.
 
 ClawHub packages and OpenClaw's bundled and official catalogue are trusted sources. Arbitrary npm packages, git, local paths and marketplaces warn and ask first; non-interactive installs need `--force` after you have reviewed the source. `--force` does not bypass `security.installPolicy`.
 
@@ -294,6 +294,7 @@ Points that trip people up:
 - Every plugin needs `openclaw.plugin.json` with a `configSchema`, even an empty one.
 - Every tool the plugin registers must be listed in `contracts.tools`.
 - The SDK is imported from the `openclaw` package itself (`openclaw/plugin-sdk/plugin-entry`, `openclaw/plugin-sdk/core` for channels). There is no separate `@openclaw/plugin-sdk` package on npm.
+- Deprecated synchronous SQLite-backed SDK members stay compatible through **2026-12-31**; upstream plans to remove them in the first January 2027 stable release. Move to the async replacements before then ([plugin compatibility](https://docs.openclaw.ai/plugins/compatibility), as documented in the 2026.10.10-beta.1 docs; the 2026.10.4 docs do not give the date yet).
 - Runtime imports go in `dependencies`; `devDependencies` are not installed for the plugin at runtime.
 - Published plugins point `openclaw.extensions` at built JavaScript, not `.ts` source.
 
diff --git a/docs/guides/privacy-compliance.md b/docs/guides/privacy-compliance.md
index d9ac546..68b9069 100644
--- a/docs/guides/privacy-compliance.md
+++ b/docs/guides/privacy-compliance.md
@@ -66,6 +66,10 @@ Upstream says to assume anything under `~/.openclaw/` (or `$OPENCLAW_STATE_DIR`)
 | **Gateway logs** | `/tmp/openclaw/openclaw-YYYY-MM-DD.log` | JSONL; known secret patterns masked before writing (best-effort); rotate at 100 MB, five archives kept ([logging](https://docs.openclaw.ai/gateway/logging)) |
 | **Sandbox workspaces** | `~/.openclaw/sandboxes/` | Copies of files the sandbox touched |
 
+:::warning Changing in 2026.10.10 (beta)
+In 2026.10.4, known secret patterns in tool arguments and results are masked before they reach the model and the transcript. 2026.10.10-beta.1 (npm `beta`, 2026-10-15; not in 2026.10.4) removes that masking: tool payloads and `.env` reads are stored and sent to the provider as-is, while logs, support exports and telemetry stay masked ([PR #169063](https://github.com/openclaw/openclaw/pull/169063)). Treat session transcripts as holding credentials, and review your provider's retention terms before upgrading.
+:::
+
 Nothing here is encrypted by OpenClaw. Use full-disk encryption on the Gateway host, keep `~/.openclaw` at `700` and its files at `600`, and on shared machines run the Gateway as a dedicated OS user.
 
 ### Does OpenClaw phone home? {#does-openclaw-phone-home}
diff --git a/docs/guides/skill-development.md b/docs/guides/skill-development.md
index e919a9a..1dda0e5 100644
--- a/docs/guides/skill-development.md
+++ b/docs/guides/skill-development.md
@@ -468,7 +468,7 @@ See [ClawHub — Publishing](https://docs.openclaw.ai/clawhub/publishing) for ow
 
 ### Via Skill Workshop
 
-Skills that the agent writes for itself go through [Skill Workshop](/guides/skill-workshop), not through your workspace folder.
+Skills that the agent writes for itself go through [Skill Workshop](/guides/skill-workshop), not through your workspace folder. On 2026.10.4 you can make them wait for review with `propose` mode. 2026.10.10-beta.1 (npm `beta`, 2026-10-15) removes proposals: changes apply immediately with Undo, and `openclaw doctor --fix` rewrites `propose` to `off`, which disables learning. Do not rely on `propose` as a lasting review gate.
 
 ---
 
@@ -506,7 +506,7 @@ There is no `openclaw skill` (singular) or `openclaw clawhub` command.
 ## See Also
 
 - [ClawHub](/guides/clawhub): find, verify and install community skills
-- [Skill Workshop](/guides/skill-workshop): skills the agent proposes for itself
+- [Skill Workshop](/guides/skill-workshop): skills the agent writes for itself
 - [Plugin System](/guides/plugin-system): when you need real code, not instructions
 - [Security hardening](/security/hardening): sandboxing and approvals
 - Upstream: [Creating skills](https://docs.openclaw.ai/tools/creating-skills), [Skills](https://docs.openclaw.ai/tools/skills), [Skills config](https://docs.openclaw.ai/tools/skills-config), [`openclaw skills`](https://docs.openclaw.ai/cli/skills)
diff --git a/docs/guides/skill-workshop.md b/docs/guides/skill-workshop.md
index d08ad79..ae88c17 100644
--- a/docs/guides/skill-workshop.md
+++ b/docs/guides/skill-workshop.md
@@ -15,8 +15,10 @@ Skills you write by hand (workspace, project, managed, ClawHub, plugin, bundled)
 
 The official reference is [Skill Workshop](https://docs.openclaw.ai/tools/skill-workshop) and [Self-learning](https://docs.openclaw.ai/tools/self-learning).
 
-:::info Version note
-This page describes **v2026.10.4**, the current stable release. The upstream `main` branch has already removed the proposal queue: learned skills apply immediately, every change keeps the previous version, and the CLI becomes `openclaw skills workshop list | changes | show | archive | restore`. docs.openclaw.ai may already describe that newer model. When you upgrade to the release that ships it, `openclaw doctor --fix` exports pending proposals and removes the old `approvalPolicy` and `maxPending` settings.
+:::warning Changing in 2026.10.10 (beta)
+This page describes **v2026.10.4**, the current stable release. **2026.10.10-beta.1** (npm `beta`, published 2026-10-15; not in 2026.10.4) retires the proposal flow: `propose` mode, `approvalPolicy`, `maxPending`, `propose-create`/`propose-update` and the other proposal subcommands are gone. Learned changes apply immediately, each keeps the previous version, and you revert with **Undo** (the Learned notice, or say "undo"). The CLI becomes `openclaw skills workshop list | changes | show | archive | restore`.
+
+On upgrade, `openclaw doctor --fix` rewrites `autonomous.mode: "propose"` to **`"off"`** (not `auto`), so self-learning is silently disabled, deletes `approvalPolicy` and `maxPending`, and exports pending or quarantined drafts to `<agentDir>/workshop-skills/.archive/.retired-proposals/` without installing them. If you use `propose` today, plan to check `openclaw config get skills.workshop.autonomous.mode` after upgrading and set it to `auto` or leave it `off` deliberately. Sources: [PR #161057](https://github.com/openclaw/openclaw/pull/161057), [PR #168577](https://github.com/openclaw/openclaw/pull/168577), [v2026.10.10-beta.1 notes](https://github.com/openclaw/openclaw/releases/tag/v2026.10.10-beta.1).
 :::
 
 ---
@@ -49,7 +51,7 @@ In the default `auto` mode, the agent edits its Workshop skills without asking.
 | `"propose"` | The background review can stage **one pending proposal** per review. Nothing goes live until it is applied. |
 | `"off"` | No background learning. You can still create skills on request or with `/learn`. |
 
-The default is `auto`, so learning is **on** on a fresh install. If you want every change reviewed before it goes live, switch to `propose`:
+The default is `auto`, so learning is **on** on a fresh install. On 2026.10.4, if you want every change reviewed before it goes live, switch to `propose`. This setup does not survive the next release: 2026.10.10 removes it and `doctor --fix` turns learning **off** (see the warning above).
 
 ```json5 title="~/.openclaw/openclaw.json"
 {
@@ -78,7 +80,7 @@ openclaw config set skills.workshop.autonomous.mode off
 ```
 
 :::note
-`approvalPolicy: "pending"` only matters for proposals. In `auto` mode the background review edits skills directly and never asks. For a reviewed setup you need both `mode: "propose"` and `approvalPolicy: "pending"`.
+`approvalPolicy: "pending"` only matters for proposals. In `auto` mode the background review edits skills directly and never asks. For a reviewed setup on 2026.10.4 you need both `mode: "propose"` and `approvalPolicy: "pending"`. Both keys are removed in 2026.10.10.
 :::
 
 The background review uses the same model and provider as the conversation, so it costs tokens. Incognito turns are never reviewed. The review keeps the source session's shell approvals; the Workshop file root is not a shell sandbox.
@@ -235,7 +237,7 @@ Do not edit these directories by hand while the Gateway runs. Upgrades from rele
 | `Proposal scan failed` | Inspect the scanner findings, then revise or quarantine |
 | Proposal missing from `list` | Check `--agent` and `OPENCLAW_STATE_DIR` |
 | Agent cannot call `skill_workshop` | Sandboxed run, or tool policy hides it; see above |
-| Agent changes skills without asking | Mode is `auto`; switch to `propose` and set `approvalPolicy: "pending"` |
+| Agent changes skills without asking | Mode is `auto`; on 2026.10.4 switch to `propose` and set `approvalPolicy: "pending"` (removed in 2026.10.10, where you use Undo or `mode: "off"`) |
 
 ---
 
diff --git a/docs/guides/upgrading-to-2.md b/docs/guides/upgrading-to-2.md
index 2cf2c7e..1cfba86 100644
--- a/docs/guides/upgrading-to-2.md
+++ b/docs/guides/upgrading-to-2.md
@@ -28,7 +28,7 @@ openclaw --version
 openclaw update status
 ```
 
-Write the version down: you need it to roll back. `update status` shows your update channel. If it says `extended-stable`, `openclaw update` takes you to the 2026.9.3x line, not to 2026.10.4. Pass `--channel stable` when you reach the last step.
+Write the version down: you need it to roll back. `update status` shows your update channel. If it says `extended-stable`, `openclaw update` takes you to the 2026.9.3x line, not to 2026.10.4. Pass `--channel stable` when you reach the last step. If it says `beta`, `openclaw update` installs 2026.10.10-beta.1 (npm `beta` since 2026-10-15), which is newer than this guide; version numbers are not chronological, and that beta was published before 2026.10.4. This guide covers the move to 2026.10.4.
 
 ### 2. Upgrade Node first
 
@@ -409,7 +409,7 @@ Results on 2026-10-18, run directly on 2026.10.4: `a-july-two-agents` and `e-gui
 
 Doctor does not flag these, because nothing is broken. They do change behaviour after the upgrade.
 
-- **Self-learning is on.** `skills.workshop.autonomous.mode` defaults to `auto`: the agent maintains its own Workshop skills. Set `propose` to review changes first, or `off` ([Self-learning](https://docs.openclaw.ai/tools/self-learning)).
+- **Self-learning is on.** `skills.workshop.autonomous.mode` defaults to `auto`: the agent maintains its own Workshop skills. On 2026.10.4 you can set `propose` to review changes first, or `off` ([Self-learning](https://docs.openclaw.ai/tools/self-learning)). `propose` is removed in 2026.10.10, where `doctor --fix` turns it into `off`; see [Skill Workshop](/guides/skill-workshop).
 - **Dreaming is on.** Background memory consolidation runs by default and writes `DREAMS.md` ([Dreaming](https://docs.openclaw.ai/concepts/dreaming)).
 - **Heartbeat alerts go to the owner's DM.** The default `target` is `owner`. Without a command owner, Doctor reports "No command owner is configured" and ambient alerts have nowhere to go. Set `commands.ownerAllowFrom`.
 - **Sessions no longer reset at idle or day boundaries** unless you configured a reset policy. An explicit `session.reset` is kept, as in Example 1.
@@ -477,7 +477,8 @@ openclaw gateway status --deep
 :::tip Changes on upstream `main` that will matter for your next upgrade
 These are in upstream's development docs as of 2026-10-18 and are **not** in 2026.10.4. They may change before release.
 
-- **Plugin installs default to ClawHub.** A bare `openclaw plugins install <package>`, including `@openclaw/*` names, will resolve through ClawHub with no automatic npm fallback. To install from npm, write `npm:@openclaw/<plugin>@<version>`. Scripts that rely on npm resolution will need the prefix.
+- **Already in 2026.10.10-beta.1** (npm `beta`, 2026-10-15): the Skill Workshop proposal flow is retired, and `doctor --fix` turns `propose` mode **off** ([Skill Workshop](/guides/skill-workshop)); tool payloads and `.env` reads are no longer masked in model context and transcripts ([hardening](/security/hardening)); the macOS and iOS apps and the Control UI in Safari need 26.2 or newer ([installation](/getting-started/installation)).
+- **Plugin installs default to ClawHub** (main only; merged after both 10.10 beta tags, so it may not be in 2026.10.10). A bare `openclaw plugins install <package>`, including `@openclaw/*` names, will resolve through ClawHub with no automatic npm fallback. To install from npm, write `npm:@openclaw/<plugin>@<version>`. Scripts that rely on npm resolution will need the prefix.
 - **`openai-codex-responses` joins the refused list.** In 2026.10.4, Doctor still rewrites this provider API id to `openai-chatgpt-responses`. On `main`, current Doctor refuses it and sends you to an intermediate release. Run `openclaw doctor --fix` on 2026.10.4 before you move past it.
 - **Crabbox cloud-worker `settings.setupEnv` is retired** in favour of `settings.setupSecrets` store references. This only matters if you use cloud workers.
 :::
diff --git a/docs/reference/cli.md b/docs/reference/cli.md
index d5e9dc5..dcff0d5 100644
--- a/docs/reference/cli.md
+++ b/docs/reference/cli.md
@@ -160,6 +160,12 @@ openclaw plugins list
 openclaw mcp list
 ```
 
+:::warning Changing in 2026.10.10 (beta)
+2026.10.10-beta.1 (npm `beta`, 2026-10-15; not in 2026.10.4) removes the Skill Workshop proposal subcommands (`propose-create`, `propose-update`, `inspect`, `revise`, `evaluate`, `apply`, `reject`, `quarantine`). `skills workshop` becomes `list`, `changes`, `show`, `archive` and `restore`. Scripts that call the proposal commands will fail after upgrading; see [Skill Workshop](/guides/skill-workshop).
+:::
+
+On 2026.10.4, `plugins install <name>` without a prefix installs from npm. Always write `clawhub:<package>` or `npm:<package>`: a change on upstream `main` (not in any release yet) makes bare names resolve to ClawHub, and explicit prefixes work on both sides of it. See [Plugin System](/guides/plugin-system).
+
 `openclaw clawhub` and `openclaw skill` (singular) do not exist. ClawHub also has its own separate `clawhub` CLI for publishing; see the [ClawHub CLI docs](https://docs.openclaw.ai/clawhub/cli).
 
 ## Security, approvals and sandbox
@@ -183,7 +189,7 @@ See [Security Hardening](/security/hardening) before giving the agent shell, bro
 
 ## Everything else
 
-`acp`, `audit`, `browser`, `clawbot` (legacy), `completion`, `connect`, `database`, `dns`, `docs` (search the live docs), `file-transfer`, `fleet`, `googlemeet`, `promos`, `proxy`, `storage`, `teamsmeetings`, `telemetry`, `transcripts`, `users`, `worker`, `worktrees`, `zoommeetings`. Plugins can add more (for example `workboard`). All are listed in the [command index](https://docs.openclaw.ai/cli).
+`acp`, `audit`, `browser`, `clawbot` (legacy), `completion`, `connect`, `database`, `dns`, `docs` (search the live docs), `file-transfer`, `fleet`, `googlemeet`, `promos`, `proxy`, `storage`, `teamsmeetings`, `telemetry`, `transcripts`, `users`, `worker`, `worktrees`, `zoommeetings`. Plugins can add more (for example `workboard`). All are listed in the [command index](https://docs.openclaw.ai/cli). `fleet` is removed in 2026.10.10 (beta); it is absent from the 2026.10.10-beta.1 command index.
 
 ## Exit codes and JSON errors
 
diff --git a/docs/reference/configuration.md b/docs/reference/configuration.md
index 00cd55a..6da1375 100644
--- a/docs/reference/configuration.md
+++ b/docs/reference/configuration.md
@@ -277,6 +277,12 @@ Skills are enabled or given keys under `skills.entries.<name>`. Plugins are conf
 }
 ```
 
+Self-learning lives under `skills.workshop` (`autonomous.mode`: `auto`, `propose` or `off`; plus `approvalPolicy`, `maxPending`, `maxSkillBytes`). See [Skill Workshop](/guides/skill-workshop).
+
+:::warning Changing in 2026.10.10 (beta)
+2026.10.10-beta.1 (npm `beta`, 2026-10-15; not in 2026.10.4) removes `propose` mode, `skills.workshop.approvalPolicy` and `skills.workshop.maxPending`. `openclaw doctor --fix` rewrites `mode: "propose"` to `"off"`, which turns learning off. If you set `propose`, re-check the mode after upgrading.
+:::
+
 Reference: [Configuration - MCP, skills, and plugins](https://docs.openclaw.ai/gateway/config-extensions), [`openclaw mcp`](https://docs.openclaw.ai/cli/mcp), [Memory config](https://docs.openclaw.ai/reference/memory-config).
 
 ### `logging`
diff --git a/docs/reference/faq.md b/docs/reference/faq.md
index aa06e9a..591f010 100644
--- a/docs/reference/faq.md
+++ b/docs/reference/faq.md
@@ -36,7 +36,7 @@ Upstream tells the story in [Lore](https://docs.openclaw.ai/start/lore).
 
 ### What is the OpenClaw Foundation?
 
-The [OpenClaw Foundation](https://openclaw.org) is an independent 501(c)(3) that develops OpenClaw in the open, employs the core team and signs releases. Donors listed in the upstream README include Amazon, OpenAI, Red Hat and the University of Michigan; "none of them own or direct the project". The code stays MIT-licensed.
+The [OpenClaw Foundation](https://openclaw.org) is an independent 501(c)(3) that develops OpenClaw in the open, employs the core team and signs releases. Its donor lists differ by source. The [README at v2026.10.4](https://github.com/openclaw/openclaw/blob/v2026.10.4/README.md#donors-and-sponsors) names Amazon, Lobster Computer Company, Offline Holdings, OpenAI, Red Hat and the University of Michigan; the Foundation's [donors page](https://www.openclaw.org/donors) (checked 2026-10-18) shows Microsoft, NVIDIA and OpenAI as partners alongside Offline Holdings, Red Hat and the University of Michigan, and does not list Amazon or Lobster Computer Company. Both say donors do not own the project; the README says "none of them own or direct the project". The code stays MIT-licensed.
 
 ### What is Moltbook?
 
@@ -46,6 +46,8 @@ Moltbook is a separate social network (created by Matt Schlicht) where AI agents
 
 As of 2026-10-18 the latest stable release is **v2026.10.4** (published 2026-10-16). OpenClaw uses calendar versions `YYYY.M.N`, where `N` is a release counter within the month, not a day. There are four update channels: `stable`, `extended-stable`, `beta` and `dev` ([development channels](https://docs.openclaw.ai/install/development-channels)). Check yours with `openclaw --version`.
 
+On 2026-10-18 npm's tags are `latest` 2026.10.4, `extended-stable` 2026.9.33 (a trailing, LTS-like line: end of September plus critical security fixes) and `beta` 2026.10.10-beta.1. Version numbers are not in time order: 2026.10.10-beta.1 was published on 2026-10-15, a few hours before 2026.10.4, because the 10.1 to 10.4 releases come from a maintenance branch while new features ship on the 10.10 beta line. `openclaw update --channel beta` installs 2026.10.10-beta.1 today. This site documents 2026.10.4 and will move when npm `latest` does.
+
 The v2026.6.11 regression where tools returned empty output after the first call in a turn (issue [#98528](https://github.com/openclaw/openclaw/issues/98528)) is closed; update to the current release.
 
 ---
diff --git a/docs/security/hardening.md b/docs/security/hardening.md
index 033fc67..9778102 100644
--- a/docs/security/hardening.md
+++ b/docs/security/hardening.md
@@ -503,7 +503,11 @@ openclaw secrets audit --check     # non-zero exit while plaintext or unresolved
 openclaw secrets configure         # interactive migration helper
 ```
 
-Give the agent its own scoped, short-lived credentials: a read-only GitHub token, a separate email account, a bot number. Don't hand it your personal ones. In v2026.10.4, sensitive-value redaction is always on and masks matching secrets before file-log lines and transcript text are written. It is best-effort pattern matching, so `logging.redactPatterns` for your own token formats is worth adding (it replaces the default string list; built-in structural protections still apply). Share `openclaw status --all` (redacted) rather than raw logs. (Upstream `main` changes this in a later release: file logs become raw `0600` files and redaction moves to log egress.)
+Give the agent its own scoped, short-lived credentials: a read-only GitHub token, a separate email account, a bot number. Don't hand it your personal ones. In v2026.10.4, sensitive-value redaction is always on and masks matching secrets before file-log lines and transcript text are written. It is best-effort pattern matching, so `logging.redactPatterns` for your own token formats is worth adding (it replaces the default string list; built-in structural protections still apply). Share `openclaw status --all` (redacted) rather than raw logs. This masking also covers tool payloads before they reach the model.
+
+:::warning Changing in 2026.10.10 (beta)
+2026.10.10-beta.1 (npm `beta`, 2026-10-15; not in 2026.10.4) removes automatic secret masking of tool payloads. Tool arguments, tool results and `.env` reads keep their original text, credentials included, in model context, transcripts, session history and UI tool events. Log tails, console output, support bundles and telemetry export stay masked; the log files themselves are written raw with `0600` permissions. Before upgrading, assume anything a tool reads will reach your provider and the session store: keep secrets in SecretRefs rather than in files the agent can read, and protect `~/.openclaw` and the log directory like a credentials store ([PR #169063](https://github.com/openclaw/openclaw/pull/169063)).
+:::
 
 ## Skills and plugins {#supply-chain}
 
diff --git a/docs/security/known-vulnerabilities.md b/docs/security/known-vulnerabilities.md
index 2d9be61..c5c1d7e 100644
--- a/docs/security/known-vulnerabilities.md
+++ b/docs/security/known-vulnerabilities.md
@@ -53,7 +53,7 @@ Also notable from February: [GHSA-g6q9-8fvw-f7rf](https://github.com/openclaw/op
 
 ## September 2026 advisory batch (September 11, 2026) {#september-2026-advisory-batch}
 
-On 2026-09-11 the project published **75 advisories**: 30 High, 40 Medium and 5 Low, none Critical. All were already fixed in releases from **2026.7.1 to 2026.9.3**. Many fixes are in channel plugins (`@openclaw/slack`, `discord`, `whatsapp`, `matrix`, `msteams`, `feishu`, `googlechat`, `line`, `voice-call`), and three are in the iOS app.
+On 2026-09-11 the project published **75 advisories**: 30 High, 40 Medium and 5 Low, none Critical. All were already fixed in releases from **2026.7.1 to 2026.9.3**. Two later CVEs without advisories need 2026.9.4 and 2026.9.5; see [CVEs without a GitHub advisory](#cves-without-ghsa). Many fixes are in channel plugins (`@openclaw/slack`, `discord`, `whatsapp`, `matrix`, `msteams`, `feishu`, `googlechat`, `line`, `voice-call`), and three are in the iOS app.
 
 The High advisories scored 8.0 or more:
 
@@ -82,6 +82,52 @@ Several of these weaken exec allowlists and approvals, which is one reason upstr
 
 ---
 
+## Other OpenClaw components {#other-components}
+
+The counts and chart above cover **openclaw/openclaw** only. As of 2026-10-18, two other repositories in the openclaw organisation have published advisories, and NVD lists a few OpenClaw CVEs that have no GitHub advisory.
+
+### CVEs without a GitHub advisory {#cves-without-ghsa}
+
+VulnCheck issued two CVEs on 2026-09-29 whose fixes come after the September batch, so "fixed in 2026.7.1–2026.9.3" is not the whole floor. Both are fixed in the current stable release.
+
+| CVE | Summary | Fixed in |
+|---|---|---|
+| [CVE-2026-102806](https://nvd.nist.gov/vuln/detail/CVE-2026-102806) | The Gateway's local media-root allowlist let a sandboxed session read sibling sessions' sandboxes and shared workspace directories | 2026.9.5 |
+| [CVE-2026-102807](https://nvd.nist.gov/vuln/detail/CVE-2026-102807) | `mcp.app.view` let `operator.read` tokens run MCP App tools that need `operator.write` | 2026.9.4 |
+| [CVE-2026-94094](https://nvd.nist.gov/vuln/detail/CVE-2026-94094) | Canvas host route buffers a whole file per request, a denial-of-service with a public PoC (VulDB, Low) | **Unconfirmed.** The reporter says it was unfixed in 2026.9.5; clawdocs could not confirm whether 2026.10.4 fixes it. Do not expose the Canvas host to untrusted networks. |
+
+### Windows Node (openclaw-windows-node) {#windows-node}
+
+On 2026-09-03 [openclaw-windows-node](https://github.com/openclaw/openclaw-windows-node/security/advisories) published 8 advisories (6 High, 2 Medium), all fixed in **v2026.7.1-3**. Update the Windows companion app if you run it as a node.
+
+| Advisory | Severity | Summary |
+|---|---|---|
+| [GHSA-fxch-cgcp-4v5h](https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-fxch-cgcp-4v5h) | High | `screen.snapshot`, `camera.snap` and `location.get` skipped per-use consent (silent capture) |
+| [GHSA-r3x2-vf2f-vvj8](https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-r3x2-vf2f-vvj8), [GHSA-vg38-vjq2-vgvh](https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-vg38-vjq2-vgvh) | High | Exec-approval rules missed pipeline `\|` and `$(...)` stages |
+| [GHSA-f32j-8759-w2fp](https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-f32j-8759-w2fp), [GHSA-g95v-c9r6-2hmq](https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-g95v-c9r6-2hmq) | High | `system.execApprovals.set` accepted wildcard and living-off-the-land allow rules, so a caller could self-grant arbitrary exec |
+| [GHSA-39cf-qcfw-g8pg](https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-39cf-qcfw-g8pg) | High | Env-override sanitizer missed `GIT_CONFIG_*`, `DOTNET_STARTUP_HOOKS` and `JAVA_TOOL_OPTIONS` |
+| [GHSA-xxr2-xm56-9cw5](https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-xxr2-xm56-9cw5) | Medium | Unbounded multi-frame WebSocket message (memory DoS) |
+| [GHSA-7vch-pmw9-3g4q](https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-7vch-pmw9-3g4q) | Medium | `canvas.present` skipped URL risk checks (SSRF to localhost and private networks) |
+
+The records disagree on the last one: NVD's [CVE-2026-101883](https://nvd.nist.gov/vuln/detail/CVE-2026-101883) says Windows Node is affected "through 2026.9.4", while the GitHub advisory says v2026.7.1-3 fixed it. Run the newest Windows Node release.
+
+### ClawHub (openclaw/clawhub) {#clawhub-advisories}
+
+On 2026-09-11 [ClawHub](https://github.com/openclaw/clawhub/security/advisories) published 5 advisories, all Medium on GitHub and all fixed on clawhub.ai the same day. They affect the registry service, not the OpenClaw runtime or the `clawhub` CLI, so there is nothing to update locally.
+
+- [GHSA-5jj4-m8c9-gwcq](https://github.com/openclaw/clawhub/security/advisories/GHSA-5jj4-m8c9-gwcq): four ordinary accounts could hide any skill, official ones included, through coordinated reports. This is why reports no longer auto-hide skills ([CVE-2026-100603](https://nvd.nist.gov/vuln/detail/CVE-2026-100603), rated High by NVD).
+- [GHSA-g3jp-jj55-jrcr](https://github.com/openclaw/clawhub/security/advisories/GHSA-g3jp-jj55-jrcr): the changelog preview could leak quarantined skill content to callers and the AI provider ([CVE-2026-100602](https://nvd.nist.gov/vuln/detail/CVE-2026-100602), rated High by NVD).
+- [GHSA-9558-q4f9-324f](https://github.com/openclaw/clawhub/security/advisories/GHSA-9558-q4f9-324f): former organisation publishers could transfer, delete or restore organisation-owned skills.
+- [GHSA-48gp-hx8w-wjvm](https://github.com/openclaw/clawhub/security/advisories/GHSA-48gp-hx8w-wjvm): SSRF in profile-image fetching.
+- [GHSA-4c7q-g7xf-5628](https://github.com/openclaw/clawhub/security/advisories/GHSA-4c7q-g7xf-5628): the anonymous API quota was shared and drainable.
+
+### ClawScan and third-party plugins {#clawscan-and-plugins}
+
+- **ClawScan** (the skill scanner ClawHub uses) up to 0.1.6 had three scanner-bypass CVEs, fixed in 0.1.7 (2026-09-04): [CVE-2026-91835](https://nvd.nist.gov/vuln/detail/CVE-2026-91835), [CVE-2026-91836](https://nvd.nist.gov/vuln/detail/CVE-2026-91836) and [CVE-2026-110689](https://nvd.nist.gov/vuln/detail/CVE-2026-110689). A public proof of concept for a skill that evades scanners exists, which is another reason to read a skill before installing it ([Skill Verification](/security/skill-verification)).
+- **pinclaw**, a community channel plugin (npm `pinclaw`), through 0.3.0 skips its auth token on `POST /pinclaw/send` and listens on port 18790 on all interfaces, so anyone who can reach it can inject prompts into the agent ([CVE-2026-108757](https://nvd.nist.gov/vuln/detail/CVE-2026-108757), High, 2026-10-11). 0.3.0 is the newest release on npm as of 2026-10-18. Uninstall it or firewall the port.
+
+---
+
 ## June 2026 Advisory Batch (June 30, 2026)
 
 On 2026-06-30 the project published **45 advisories**: 33 High and 12 Medium. They were a coordinated disclosure of issues already fixed between **v2026.5.12 and v2026.6.9**. Ten of them, including GHSA-7vrr-rp4x-4g76, were fixed only in **v2026.6.9** (released 2026-06-21). Version 2026.6.8 was **not** enough.
@@ -323,7 +369,10 @@ On January 27, 2026, Anthropic sent a trademark notice about the name "Clawdbot"
 | Apr 16 | Last critical advisory to date (Feishu webhook validation) | **Critical** |
 | Jun 30 | 45 advisories published (33 High, 12 Medium), fixed by v2026.6.9 | High |
 | Jun 30 | v2026.6.11: DOMPurify fix, lookalike package-source rejection | Mitigation |
+| Sep 3 | openclaw-windows-node: 8 advisories (6 High), fixed in v2026.7.1-3 | High |
 | Sep 11 | 75 advisories published (30 High, 40 Medium, 5 Low), fixed in 2026.7.1–2026.9.3 | High |
+| Sep 11 | ClawHub: 5 advisories, fixed on clawhub.ai the same day | Medium |
+| Sep 29 | VulnCheck CVE-2026-102806 and CVE-2026-102807, fixed in 2026.9.5 and 2026.9.4 | Medium |
 | Oct 16 | v2026.10.4, the current stable release as of 2026-10-18 | — |
 
 The "Severity" column only labels advisories. Third-party incidents are not scored.
diff --git a/docs/security/overview.md b/docs/security/overview.md
index c3af248..07bce53 100644
--- a/docs/security/overview.md
+++ b/docs/security/overview.md
@@ -125,12 +125,16 @@ OpenClaw is built as a personal assistant for one trusted operator, possibly wit
 | **ClawHub skills** | Malicious instructions or code | `openclaw skills verify`, manual review, `security.installPolicy` |
 | **Plugins** | Arbitrary code in the Gateway process | Install only what you trust, `plugins.allow` |
 | **Credentials** | Plaintext in `openclaw.json`, `.env`, `credentials/` | SecretRefs, `openclaw secrets audit --check`, `600`/`700` permissions |
-| **Transcripts and memory** | Private data at rest | Full-disk encryption, tight permissions, pruning |
+| **Transcripts and memory** | Private data at rest, including secrets that tools read (unmasked from 2026.10.10; see below) | Full-disk encryption, tight permissions, pruning |
 | **Browser automation** | SSRF into your LAN, session theft | Strict-by-default `browser.ssrfPolicy` (`allowedHostnames`, `blockedHostnames`) |
 | **LLM provider** | Your prompts and tool output leave the host | Choose a provider and retention terms you accept, or a local model |
 
 Details: [Security Hardening](/security/hardening), upstream [Security](https://docs.openclaw.ai/gateway/security).
 
+:::warning Changing in 2026.10.10 (beta)
+2026.10.10-beta.1 (npm `beta`, 2026-10-15; not in 2026.10.4) stops masking secrets in tool arguments, tool results and `.env` reads before they reach the model, transcripts and the UI. Logs, support exports and telemetry stay masked. On 2026.10.4 masking is still on. Plan for it now by keeping secrets in SecretRefs, not in files the agent reads; see [hardening](/security/hardening) and [PR #169063](https://github.com/openclaw/openclaw/pull/169063).
+:::
+
 ### The Prompt Injection Problem
 
 OpenClaw processes untrusted content (chat messages, web pages, documents, skill text) in the same model context as your instructions. Upstream wraps external content and offers controls such as `contextVisibility`, but the model can still be manipulated. Limit what a manipulated agent can do ([prompt injection](https://docs.openclaw.ai/gateway/security/prompt-injection)).
diff --git a/docs/security/skill-verification.md b/docs/security/skill-verification.md
index f482147..575282a 100644
--- a/docs/security/skill-verification.md
+++ b/docs/security/skill-verification.md
@@ -192,7 +192,7 @@ openclaw security audit --deep --json | jq '.findings[] | select(.checkId | star
 
 ### ClawHub scanning {#virustotal-integration-v202626}
 
-ClawHub scans releases when they are published and rescanned. Sources include VirusTotal, ClawScan and static analysis, plus SkillSpector and AIG reports where retained ([`openclaw skills`](https://docs.openclaw.ai/cli/skills), [ClawHub CLI: scan](https://github.com/openclaw/clawhub/blob/main/docs/cli.md)). Upstream's threat model notes that VirusTotal and LLM-based review depend on ClawHub's operator-side configuration being enabled ([THREAT-MODEL-ATLAS](https://docs.openclaw.ai/security/THREAT-MODEL-ATLAS)). At install time, OpenClaw refuses community releases that ClawHub marks malicious or blocked.
+Since 2026-10-13, every new skill version and package release on ClawHub is stored as **pending** and becomes installable only after the TruffleHog and ClawScan pre-publication checks pass on that exact artifact. A malicious verdict blocks the release; a scanner failure or timeout leaves it unpublished. Before that change, a deployment flag decided whether checks ran before or after a release went public ([clawhub PR #3947](https://github.com/openclaw/clawhub/pull/3947)). Releases are also rescanned later. Sources include VirusTotal, ClawScan and static analysis, plus SkillSpector and AIG reports where retained ([`openclaw skills`](https://docs.openclaw.ai/cli/skills), [ClawHub CLI: scan](https://github.com/openclaw/clawhub/blob/main/docs/cli.md)). Upstream's threat model notes that VirusTotal and LLM-based review depend on ClawHub's operator-side configuration being enabled ([THREAT-MODEL-ATLAS](https://docs.openclaw.ai/security/THREAT-MODEL-ATLAS)). At install time, OpenClaw refuses community releases that ClawHub marks malicious or blocked.
 
 ### Third-party scanning tools