Pairing scope upgrades and recovery UX land so reconnects stop looking like mystery auth failures

Pairing scope upgrades and recovery UX land so reconnects stop looking like mystery auth failures

1. Pairing scope upgrades surface as explicit gateway auth errors: Read-only devices moving toward broader scopes now get pending-approval / scope-upgrade messaging in auth failures instead of generic “pairing broke” noise; reconnect flows spell out intentional upgrades in #69221, and pairing-required recovery details are corrected in #69227.
2. doctor surfaces device pairing auth drift: Local diagnostics now call out the same class of drift operators were inferring from flaky reconnect loops, so a quick doctor pass can separate credential rot from true gateway outages before you burn time on redeploys.
3. Gateway probe splits capability checks from bare reachability: Health and automation paths can distinguish “socket up” from “expected capabilities present,” which short-circuits false greens when the listener is alive but misconfigured for your lane.
4. Slack outbound tolerates unresolved channel SecretRef: Outbound Slack no longer hard-fails when the channel secret is mid-resolution—useful during secret rotation windows where sends previously looked randomly flaky.
5. Operator action today: Stable-tag fleets stay pinned to v2026.4.15. If you ride beta, v2026.4.19-beta.2 packages nested-lane scoping, usage carry-forward, and streaming usage for OpenAI-compatible backends (per release notes). After any scope change, redo pairing once and run a five-minute smoke: gateway auth error text, doctor, one Slack send during a deliberate secret reload.

Got a tip? Send it to tips@clawnews.org