OpenClaw live updater fails closed on Linux systemd following fast-forward merges

OpenClaw developers filed bug #152304 on September 19, 2026, documenting a critical update failure in the core openclaw-live-updater script update-main.mjs. Following clean fast-forward git merges on Linux hosts running systemd units, the script prematurely aborts before triggering the application rebuild because an unmanaged launch agent probe throws gateway_launchagent_unavailable. Because the updater fails closed on the Darwin-specific launchd check, the runtime binary remains uncompiled while the working tree reflects updated source code. This leaves daemonized services in a split state where systemd restarts either boot stale artifacts or crash immediately upon encountering changed internal interfaces. Compounding this operational friction, issue #152252 reveals that recent configuration writes automatically stamp the meta.migrations.utilityModelSeparation flag, causing older gateway releases to reject startup with exit code 78. In tandem, PR #123122 implements strict frame size validation on inbound gateway sockets, rejecting oversized payloads before serialization buffers can allocate gigabytes of resident heap memory.

The facts

- Bug #152304 details why update-main.mjs fails closed on Linux systemd after git fast-forward merges due to an unhandled gateway_launchagent_unavailable probe. - The update failure aborts compilation and leaves checked-out repository source out of sync with deployed build artifacts in production units. - Issue #152252 demonstrates that utilityModelSeparation configuration stamps cause older gateway binaries to hard-fail startup with exit code 78. - PR #123122 adds pre-serialization buffer size checks to the gateway socket listener, dropping frames exceeding configured limits before memory allocation. - Affected Linux deployments require manual invocation of the build command and explicit service restarts to clear the interrupted updater state.

Why it matters

Automated update scripts for long-running daemon agents must isolate platform-specific lifecycle hooks from portable compilation pipelines. When an update harness evaluates an operating system service probe—such as verifying macOS launchd agents—before executing universal build commands, any cross-platform mismatch aborts the deployment pipeline halfway through. For autonomous agents managed by systemd, a failed-closed updater leaves the codebase on disk inconsistent with the running process, triggering cascading startup failures if the service manager restarts the daemon under stale dependencies.

Current

Inspected on 2026-09-19. The OpenClaw stable-channel baseline is v2026.9.4 published 2026-09-11T03:46:22Z. The primary source was open when captured. Mainline merges, open proposals and packaged releases are distinct availability states; the release baseline does not establish that a proposal has shipped.

Evidence

Primary evidence: openclaw/openclaw issue #152304 (https://github.com/openclaw/openclaw/issues/152304). Supporting context: openclaw/openclaw issue #152252 (https://github.com/openclaw/openclaw/issues/152252); openclaw/openclaw PR #123122 (https://github.com/openclaw/openclaw/pull/123122). The source bodies and linked context were inspected. Test results quoted from contributors remain attributed reports, not independently reproduced experiments.

Operator take

Platform-specific service supervision should never gate standard artifact compilation. Deploying autonomous agents across mixed operating system fleets requires explicit separation between source updates, build verification, and supervisor signalling. DevOps engineers running OpenClaw on headless Linux servers should disable automated in-tree updater scripts until platform guards are decoupled from compiler execution, preferring containerized or staged artifact deployments over in-place live git pulls.

Caveat

The updater bug affects bare-metal and virtual machine installations running systemd, but does not impact containerized Docker deployments where rebuilds occur outside the host unit supervisor. Configuration migration failures on exit 78 can be worked around by manually stripping the utilityModelSeparation key from settings.json before downgrading or launching older gateway binaries.