Thanks for the thorough review @AliceLJY! All three must-fixes and two nice-to-haves addressed in commit ec1699c. Here is the breakdown:

Must-fix #1: Remove dead ensureHealthy() + reconnectCount

Chose the simpler path: deleted ensureHealthy() entirely and removed reconnectCount from PooledConnection. The current cold path (evict dead connection → create fresh one) is clear and explicit — a transparent reconnect that preserves the entry would add complexity without a concrete use case. If we need transparent reconnect later, it can be added as a separate feature.

Must-fix #2: isActive: boolean → refCount: number for concurrent safety

Great catch — this was a real bug. The fix:

• PooledConnection.isActive: boolean → PooledConnection.refCount: number
• acquire(): refCount++ on hot path reuse
• release(): refCount = Math.max(0, refCount - 1) — heartbeat and eviction timer only start when refCount === 0
• resetEviction(): eviction fires only when refCount === 0
• getStats(): refCount > 0 → active, refCount === 0 → idle

Added a new test "concurrent acquire: connection is not evicted while still in use" that:

1. Acquires the same connection twice (confirms same object)
2. Releases once — confirms connection stays active (refCount=1)
3. Waits past idle timeout — confirms connection is NOT evicted (refCount > 0)
4. Releases again — confirms connection transitions to idle
5. Waits past idle timeout — confirms eviction fires correctly

Must-fix #3: OpenClawAgentExecutor.close() + shutdown path

Added:

// OpenClawAgentExecutor
public close(): void {
  this.wsPool.destroy();
}

And wired it into index.ts plugin stop():

const agentExecutor = new OpenClawAgentExecutor(api, config);
// ... later in stop():
agentExecutor.close();

Nice-to-have #4: conn["socket"]?.readyState → conn.isOpen getter

Added a public getter on GatewayRpcConnection:

get isOpen(): boolean {
  return this.socket?.readyState === 1;
}

All three call sites in the pool (acquire() hot path, ensureHealthy — now deleted, heartbeat) now use conn.isOpen.

Nice-to-have #5: SHA-256 buildKey

private buildKey(config: GatewayRuntimeConfig): string {
  const h = crypto.createHash("sha256");
  h.update(config.wsUrl + "\0" + config.gatewayToken + "\0" + config.gatewayPassword);
  return h.digest("hex");
}

No more plaintext credentials in Map keys.

Items #6 (before/after benchmark) and #7 (echo RPC stability guarantee from gateway) are good suggestions — planning to address those in a follow-up PR.

All 13 pool tests pass (including the new concurrent acquire test). Full test suite (25 files) green. ✅