OpenClaw
OpenClaw preserves update reports across gateway restarts
OpenClaw is moving update progress into a durable gateway ledger, adding a two-phase package executor and stopping automatic Doctor runs from disabling explicitly enabled skills. The combined direction is an updater whose state survives the restart it causes.
openclaw/openclaw PR #138737 is the inspected primary source: “feat(update): keep progress and reports across restarts.” The related records were inspected as supporting context rather than independent confirmation.
The facts
- openclaw/openclaw PR #138737 was created 2026-09-05T00:48:19Z and was open at inspection; its title is “feat(update): keep progress and reports across restarts.” - openclaw/openclaw PR #138730 was created 2026-09-05T00:32:25Z and was closed at inspection; its title is “fix(doctor): preserve enabled skills during automatic updates.” - openclaw/openclaw PR #137885 was created 2026-09-04T03:49:04Z and was open at inspection; its title is “refactor(update): add two-phase package executor.” - The repository reported 388870 stars, 6310 open issues, default branch main, and last push 2026-09-05T00:53:22Z. - The latest tagged-release baseline checked was v2026.9.1 published 2026-09-03T18:31:33Z.
What changed
openclaw/openclaw PR #138737 reports: What Problem This Solves Update progress and completion reports can disappear when the Gateway restarts, leaving Control UI, chat, and CLI users with different accounts of the same update. Internal chat sessions also need a durable final report without an unnecessary model turn. Related: #124396 (transactional update flow), #137580 (extended update outage). Stacked on #138690 (durable update-run history and shared reports), with main as the PR base. The parent diff remains visible until that PR lands; this PR must follow it. Transactional staging before Gateway shutdown and repair orchestration remain in their campaign PRs. Why This Change Was Made The Gateway ledger owns update identity, phases, and outcomes. The Control UI resumes that record after reconnect, shares one phase/details/verification view between the dialog and Settings, and retains terminal reports. Browser storage holds acknowledgment and triage receipts only; the browser verifier, inferred-success flow, success toast, and obsolete reload helper are removed. Existing native Mac update controls are preserved. Chat uses stable per-run delivery identities for acknowledgment, activation, verification, and the final report. A shared destination resolver handles external delivery custody and idempotent internal transcript appends. CLI progress follows recorded phases and flushes before the shared final report; JSON includes the durable run row. Unused Repairing stays hidden until entered. User Impact Operators can follow the same update through a restart, inspect its result after reopening the Control UI, and receive one
openclaw/openclaw PR #138730 reports: Related: #124396 Additional instructions MUST:** Keep **Allow edits from maintainers** enabled for this PR so maintainers can help update the branch when needed. What Problem This Solves Fixes an issue where users running an automatic update would have an explicitly enabled skill persistently disabled when an optional binary was missing in the update environment. This is a separate two-file Doctor approval-policy repair. It does not include the migration-planner feature in #136529. Why This Change Was Made Use Doctor's existing runtime-repair approval for optional skill disabling. That approval preserves preferences during noninteractive updates while allowing explicit standalone repair. Keep updater --fix, required migrations, skill discovery and the healthy-other-agent guard unchanged. Production +2/-1, net +1 for the caller-invariant comment. Tests +57/-7. No new configuration, environment option, schema, dependency or storage owner. User Impact Automatic updates retain enabled skills even when the current environment cannot use them. Explicit standalone Doctor repair can still disable unavailable skills. Required configuration migrations still run and persist independently. Evidence The disposable source/caller fixture exercises actual skill discovery, update policy, Doctor approval and the real config writer. Its approved scope is not full CLI, packaged, service or containment proof. Unmodified canonical 66fa0bd2be4f811a6c6dbee8bd5dd102dae8e544 reproduced the unwanted persisted disable. Standalone repair, an available skill and a required legacy migration supplied the controls. The regression also failed before the fix. The healthy-other-agent test verifies actual availability on another agent, rather than
openclaw/openclaw PR #137885 reports: Related: #137399 Additional instructions MUST:** Keep **Allow edits from maintainers** enabled for this PR so maintainers can help update the branch when needed. What Problem This Solves The two-phase package-update selector contract in #137399 was coupled to generation storage, broker, and rollout work that is not ready to land. Meanwhile, the existing package updater had no independently landable executor boundary or concrete consumer for that contract. Why This Change Was Made This replaces the dormant #137399 landing root with one behavior-preserving package executor. Package updates now prepare an opaque, executor-bound, one-shot handle before service mutation, activate it after the existing stop and schema recheck, and discard it when pre-activation checks refuse the update. Activation failure uses the existing recovery path without fallback. Git updates are unchanged. Generation storage, authentication, staging, Doctor, configuration, and production switching remain out of scope. User Impact There is no user-visible behavior change. The current package updater is the first consumer of the two-phase executor contract, which gives later selector work a tested lifecycle boundary without changing current update selection or rollout behavior. Evidence node scripts/run-vitest.mjs src/cli/update-cli/update-package-executor.test.ts src/cli/update-cli/update-execution.runtime.test.ts: 2 files, 8 tests passed. node scripts/check-changed.mjs -- src/cli/update-cli/update-command-execution.ts src/cli/update-cli/update-command-package.ts src/cli/update-cli/update-package-executor.ts src/cli/update-cli/update-package-executor.test.ts: passed. pnpm check:architecture: passed with zero runtime or Madge cycles and all database guards green. pnpm build: passed. A source-blind external CLI adapter passed five safe lifecycle probes: two fresh handles were frozen and fieldless, while
Why it matters
An updater becomes most dangerous exactly when it replaces its own runtime. One durable run identity must join preparation, activation, verification, recovery and the final user report. The practical test is whether the system remains bounded and its receipts still describe the action after failure, retry or restart.
Current
The primary record was open when captured on 2026-09-05. The tagged-release baseline was v2026.9.1 published 2026-09-03T18:31:33Z. Repository metadata, source bodies, current pull requests and issues, releases, Google News, Hacker News, Lobsters, Metamesh and the rendered ClawCharts row were inspected. ClawCharts selected the subject; it did not prove the claim.
Evidence
The primary URL is https://github.com/openclaw/openclaw/pull/138737. Supporting records are https://github.com/openclaw/openclaw/pull/138730 and https://github.com/openclaw/openclaw/pull/137885. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts and reproductions remain attributed to their authors unless identified as independently rerun.
Source boundary
Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.
Operator take
Keep the incumbent authoritative through preparation, freeze a one-shot activation handle, persist phase transitions before restart, and make post-restart UI, chat and CLI project the same ledger. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently.
Caveat
Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.
Source inspected; source state, environment and release boundary remain explicit.