OpenClaw makes update finalization auditable

openclaw/openclaw PR #126107 is the inspected primary source: “improve(update): make managed finalization timing auditable.” The related records below were inspected as supporting context rather than independent confirmation.

The facts

- openclaw/openclaw PR #126107 was created 2026-08-19T01:00:04Z and was open at inspection; its title is “improve(update): make managed finalization timing auditable.” - openclaw/openclaw PR #126106 was created 2026-08-19T00:58:57Z and was open at inspection; its title is “fix(gateway): make activeRunIds presence mean a complete exact run set.” - openclaw/openclaw PR #126082 was created 2026-08-18T23:34:44Z and was open at inspection; its title is “Audit exact-bound owner-native lifecycle receipts.” - The repository reported 386678 stars, 5774 open issues, default branch main, and last push 2026-08-19T01:04:21Z. - The latest tagged-release baseline checked was v2026.8.1-beta.2 published 2026-08-15T05:36:23Z.

What changed

openclaw/openclaw PR #126107 reports: What Problem This Solves Resolves a problem where managed OpenClaw upgrades expose only aggregate finalization time, so operators cannot distinguish target config validation, snapshotting, Doctor, plugin convergence, completion generation, or final config convergence. Best-effort shell completion generation also remains on the stopped path even when an external supervisor can safely refresh it after readiness. Why This Change Was Made The hidden update finalizer now returns stable, numeric, secret-free phase timings. When the existing post-core capability handshake is present, only the hidden finalizer defers the best-effort completion cache; public update repair behavior is unchanged. Required config, Doctor, and plugin work stays synchronous and failure-gating. User Impact External supervisors can persist an auditable breakdown of finalization cost and can move completion cache refresh after HTTP readiness. Direct OpenClaw update and repair callers retain their existing completion behavior. Evidence Red on canonical main: a finalizer deferral request still invoked completion generation, and no phase receipt existed. Focused Vitest: 3 passed, 242 skipped for receipt shape, hidden-only capability gating, and completion deferral. Changed-file guards passed for formatting, env-var budget, assertion safety, dependency pins, API usage, plugin boundaries, and other reached lanes. The dead-export lane found one unnecessary type export; it was removed and the focused Knip rerun passed all three scans. Source-blind combined OCM fixture attributed distinct 110/130/170/190/230 ms finalizer delays and placed completion

openclaw/openclaw PR #126106 reports: What Problem This Solves Sessions could report hasActiveRun: true with activeRunIds: [] because ids came only from chatAbortControllers, while consumers papered over the ambiguity with arbitrary [0] picks. This is the projection ambiguity called out in the #125983 close decision. Why This Change Was Made This implements that decision's supported direction: the field stays as Gateway-owned exact facts; presence means a complete exact set, omission means identities are unavailable, and [] means proven idle. One soleActiveSessionRunId() helper replaces every arbitrary first-run selection in observer digest resolution, the transcript cache key, the activity inspector, and stale-terminal reconciliation, each with its owner-fact fallback. Producer-side liveness and observer projections—active-set generation plus run-scoped terminal/observer facts—remain the named follow-up requiring an owner-level Gateway contract. User Impact No more stale or wrong run attribution from guessed ids on projected or hidden-owner sessions; otherwise behavior-neutral. Evidence The producer regression fails pre-fix because an active lifecycle-owned projection emitted activeRunIds: []; it passes with omission semantics. Focused touched-owner and sibling suites: 7 files, 71 tests green. The requested 3-file subset also passes independently: 3 files, 10 tests. pnpm ui:build passed, including finalized sidecar and Control UI performance checks. Docs link audit checked 6,542 internal links with 0 broken links. Autoreview clean: no accepted/actionable findings, overall confidence 0.96. Production +48/-27; tests +178/-11; docs +7/-4. Source-blind live overlap proof is not

openclaw/openclaw PR #126082 reports: Summary append static cron, task, and flow owner-native lifecycle sources after the existing approval, message, and generic receipt sources bind exact context_id + execution_id at admitted cron/task/flow execution boundaries without using runId as a join key or copying owner state into generic decision facts retain webhook mapping IDs as ingress-source attribution only, keep direct/shared hook invokers unattributed, and source restart facts from the authoritative recovery owner Root cause and best fix Cron/task/flow lifecycle state already had authoritative owner rows, but those rows lacked an exact admitted-execution binding and the receipt presenter could only see legacy approval/message/generic facts. Joining by operational runId would be ambiguous, and duplicating lifecycle state downstream would create a second terminal-policy owner. This patch records the two exact identity keys at the owner boundary, then projects directly from each owner store through a closed static source list. Settlement remains in the existing owner, including terminal precedence from src/agents/agent-run-terminal-outcome.ts; missing, corrupt, deleted, or mismatched bindings remain unknown and never affect execution behavior. This is the best fix because it repairs the missing fact at its producer and avoids a generic duplicate, fallback store, dynamic registry, or rederived terminal policy. Compatibility and surface metrics SQLite: **6 added / 0 changed / 0 removed** columns: bare nullable TEXT context_id and execution_id on each of cron_run_receipts, task_runs, and flow_runs schema/protocol versions:

Why it matters

Update safety depends on knowing which owner finalized which run and when. Exact run sets and owner-native receipts make interrupted maintenance diagnosable. The operator test is whether the system remains bounded and its receipts still describe the action after failure, retry or restart.

Current

The primary record was open when captured on 2026-08-19. The tagged-release baseline was v2026.8.1-beta.2 published 2026-08-15T05:36:23Z. Repository metadata, full source bodies, current pull requests and issues, releases, Google News, Hacker News, Lobsters, Metamesh and the rendered ClawCharts row were inspected. ClawCharts selected the subject; it did not prove the claim.

Evidence

The primary URL is https://github.com/openclaw/openclaw/pull/126107. Supporting records are https://github.com/openclaw/openclaw/pull/126106 and https://github.com/openclaw/openclaw/pull/126082. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts and reproductions remain attributed to their authors unless identified as independently rerun.

Source boundary

Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.

Operator take

Record the update owner, active-run set and finalization timestamp in one receipt; refuse success when any member is ambiguous. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently.

Caveat

Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.

Source inspected; source state, environment and release boundary remain explicit.