OpenClaw breaks restartless plugin management into reviewable layers

OpenClaw's plugin-management draft is moving through smaller landing units instead of presenting a full hot-reload feature as finished. The current proposal lists merged groundwork for registration ownership, install preparation, cleanup and diagnostics, then names the remaining instance ownership, Gateway activation and operator surfaces. That distinction matters after the broader OpenClaw 2.0 rollout: preparatory changes on main do not mean every running installation can safely replace a plugin without a restart.

The facts

- The draft explicitly says the complete restartless lifecycle feature has not landed. - The proposed lifecycle prepares replacements, fences affected instances, drains admitted work, publishes replacements and retires resources. - Unrelated plugin instances should remain in place, while affected services or channel accounts may restart internally. - Native binary changes and compiled core code keep their build, update and restart path; custom native module loaders require a separate process. - Managed Codex conversations would refresh native tool catalogs, but imported or supervised sessions need a new session for changed tool names or schemas. - A separate config-refresh proposal distinguishes superseded reads from failures and reports browser checks against mocked Gateway traffic, not a real backend.

Why it matters

A plugin reload is a resource-ownership problem disguised as a convenience button. Keeping a connection open is not enough if old callbacks can still run, admitted work loses its result, or cleanup retires resources belonging to the replacement. The architecture reference already distinguishes discovery metadata from active runtime registration. The new work extends that separation into lifecycle ownership, making it possible to describe whether a mutation was merely saved, applied, rejected or rolled back rather than collapsing all those outcomes into success.

Current

Inspected on 2026-09-07. The OpenClaw stable-release baseline is v2026.9.2 published 2026-09-05T20:00:07Z. The main source was open when captured. Release metadata is a version boundary, not evidence that an open proposal has shipped.

Evidence

The primary source is openclaw/openclaw PR #135599 (https://github.com/openclaw/openclaw/pull/135599). Supporting context comes from OpenClaw docs — plugin internals (https://docs.openclaw.ai/plugins/architecture); openclaw/openclaw PR #140551 (https://github.com/openclaw/openclaw/pull/140551). The linked records were inspected directly; related project records are not independent confirmations.

Operator take

Treat this as a direction-of-travel brief, not an upgrade instruction. Plugin authors should inspect their cleanup and lazy-import assumptions; operators should ask whether a demonstrated reload covered their source type and conversation mode. The separately proposed config-read repair illustrates why the UI receipt deserves its own test: a successful mutation can be followed by an obsolete refresh warning. Conversely, a later failed read must remain a failure. Do not use a synthetic browser demonstration as evidence of external channel delivery, and do not assume a trusted-plugin lifecycle doubles as a security sandbox.

Caveat

The main source remains an open proposal with historical and revision-specific test receipts. Final combined build and live acceptance are still pending. The source's merged-slice ledger is not a claim that the entire feature is available in the current stable release.