OpenClaw can report memory success after persistence is denied

openclaw/openclaw issue #126906 is the inspected primary source: “Denying the write tool silently disables memory persistence, and the agent reports success anyway.” The related records below were inspected as supporting context rather than independent confirmation.

The facts

- openclaw/openclaw issue #126906 was created 2026-08-21T00:33:39Z and was open at inspection; its title is “Denying the write tool silently disables memory persistence, and the agent reports success anyway.” - openclaw/openclaw issue #126879 was created 2026-08-20T23:24:37Z and was open at inspection; its title is “[Bug]: renamed trajectory archives (*.trajectory.jsonl.deleted.<ts>) slip into the session memory corpus — archive filename predicates lack a trajectory guard.” - openclaw/openclaw PR #126912 was created 2026-08-21T00:35:56Z and was open at inspection; its title is “fix(sessions): exclude archived trajectory artifacts.” - The repository reported 386912 stars, 5841 open issues, default branch main, and last push 2026-08-21T00:34:50Z. - The latest tagged-release baseline checked was v2026.8.1-beta.2 published 2026-08-15T05:36:23Z.

What changed

openclaw/openclaw issue #126906 reports: Denying a tool via tools.deny can disable memory persistence, and nothing tells anyone — not the operator at startup, not doctor, and not the agent, which then reports success for saves that never happened. What happened Trimming the tool surface to shrink prompts (an assistant deployment, not a coding one), I denied a list that included write and edit. Everything kept working. Then: **me:** Remember this for later: … Save it to memory. **agent:** Guardado, che. … Nothing was written. workspace/memory/ had not changed since the previous day. Removing write from the deny list and repeating the request produced the file immediately. Why the agent claims success A denied tool is removed from the schema the model sees, so from the model's point of view the capability never existed. It has no signal that it was asked to do something it cannot do — so it answers as if it complied. That is a worse outcome than an error, because the operator has positive confirmation of something that did not occur. Why nothing else catches it Startup logs the removal by name and count, which reads like intended policy: tool policy removed 13 tool(s) via tools.deny: apply_patch, edit, …, write. Nothing connects write to memory persistence. openclaw doctor does not flag it. memorySearch stays "enabled" and search keeps working —

openclaw/openclaw issue #126879 reports: What happens Live trajectory runtime artifacts (.trajectory.jsonl) are excluded from session memory indexing by isPrimarySessionTranscriptFileName → isTrajectoryRuntimeArtifactName. But session deletion also archives the trajectory file (rename to.trajectory.jsonl.deleted., per the #89200 fix), and the renamed trajectory then matches the *archive* branch of the filename predicates and enters the session memory corpus: isUsageCountedSessionTranscriptFileName (src/config/sessions/artifacts.ts) returns true for any name carrying a.deleted. /.reset. suffix — the archive branch has no trajectory (or compaction-checkpoint) guard, unlike the primary branch. listSessionTranscriptArtifactFiles (packages/memory-host-sdk/src/host/session-transcript-corpus.ts) filters directory entries only through isUsageCountedSessionTranscriptFileName + isSessionArchiveArtifactName, so the renamed trajectory is enumerated as an archive artifact. parseUsageCountedSessionIdFromFileName then derives the malformed session id.trajectory (the.jsonl.deleted. marker sits after.trajectory), which matches no active entry, so the file is treated as an unowned retained archive and indexed. Retaining *transcript* archives in the corpus is intentional (#96132) — this report is only about trajectory archives riding along. Observed on a real deployment OpenClaw 2026.7.1, Linux arm64, builtin memory backend with sources=["memory","sessions"]: the sessions index (memory_index_sources, source sessions) contains a row for sessions/ /.trajectory.jsonl.deleted. created by a normal session deletion; the row produced 0 chunks (likely because trajectory lines do not parse as transcript messages), so the practical impact is corpus/status file-count pollution plus wasted parse work at index time — trajectory archives are often multi-MB and

openclaw/openclaw PR #126912 reports: Closes #126879 What Problem This Solves Fixes an issue where session memory discovery treats renamed trajectory runtime archives (*.trajectory.jsonl.deleted. and reset variants) as retained conversation transcripts, causing an invalid derived session id such as active.trajectory and allowing the runtime artifact into the memory corpus. Why This Change Was Made Archived trajectory runtime artifacts are now excluded at the shared usage-counted transcript classifier and parser boundary, while ordinary reset/deleted transcript archives remain retained. The corpus-level regression test exercises the production session-file listing path so the fix covers classification, id parsing, and enumeration together. User Impact Trajectory runtime traces no longer pollute session memory indexing or appear as malformed transcript sessions. Retained reset/deleted conversation history continues to be available for memory search. Evidence Real call chain proof: listSessionFilesForAgent("main") exercised the production corpus path with a temporary session directory. Before-fix/base included and parsed active.trajectory.jsonl.deleted... as active.trajectory; after-fix/exact head excludes it, returns no parsed id, and still includes ordinary reset/deleted archives. Focused regression tests: pnpm test src/config/sessions/artifacts.test.ts packages/memory-host-sdk/src/host/session-files.test.ts — 2 Vitest shards, 50 tests passed. Static gates: format check, oxlint, tsgo:core, and tsgo:core:test passed. Canonical precedent: merged PR #96132 intentionally retains reset/deleted transcript archives for memory indexing; this change narrows only trajectory runtime artifacts. Full proof source and raw output are retained in live-proof.md and proof-evidence.json for the validation receipt. Reproduction proof source AI-assisted:

Why it matters

Memory has two failure directions here: a write can disappear while the reply claims success, and deleted trajectory state can reappear as context. Both break the operator’s ability to distinguish durable state from narrative. The operator test is whether the system remains bounded and its receipts still describe the action after failure, retry or restart.

Current

The primary record was open when captured on 2026-08-21. The tagged-release baseline was v2026.8.1-beta.2 published 2026-08-15T05:36:23Z. Repository metadata, full source bodies, current pull requests and issues, releases, Google News, Hacker News, Lobsters, Metamesh and the rendered ClawCharts row were inspected. ClawCharts selected the subject; it did not prove the claim.

Evidence

The primary URL is https://github.com/openclaw/openclaw/issues/126906. Supporting records are https://github.com/openclaw/openclaw/issues/126879 and https://github.com/openclaw/openclaw/pull/126912. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts and reproductions remain attributed to their authors unless identified as independently rerun.

Source boundary

Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.

Operator take

Bind memory-success language to a verified persistence receipt, exclude archived trajectories at the corpus boundary, and test both denial and rediscovery paths. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently.

Caveat

Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.

Source inspected; source state, environment and release boundary remain explicit.