OpenClaw v2026.4.10: Memory/Active Memory, operator field notes

The source record for v2026.4.10 names a provider, model, voice, or context change. This is an operator's reading of that record, with the exact source facts kept next to a bounded experiment rather than a generic feature list.

Treat this as a stable maintenance checkpoint and keep the release record beside the backup and rollback evidence. A release tag describes the project change. Your Gateway's provider, channel, platform, and account support should be recorded separately.

A small field test

Models/Codex

What changed. add the bundled Codex provider and plugin-owned app-server harness so codex/gpt-* models use Codex-managed auth, native threads, model discovery, and compaction while openai/gpt-* stays on the normal OpenAI provider path.

Check it with. Read Models/Codex as an authorization checkpoint: prove who may act, what the action can reach, and how the rejected attempt is surfaced to the operator.

Memory/Active Memory

What changed. add a new optional Active Memory plugin that gives OpenClaw a dedicated memory sub-agent right before the main reply, so ongoing chats can automatically pull in relevant preferences, context, and past details without making users remember to manually say "remember this" or "search memory" first. Includes configurable message/recent/full context modes, live /verbose inspection, advanced prompt/thinking overrides for tuning, and opt-in transcript persistence for debugging. Docs: https://docs.openclaw.ai/concepts/active-memory.

Check it with. For Memory/Active Memory, delivery is only proven when identity survives an interruption. Keep a disposable channel, send one request, and check for a single reply in the intended thread.

macOS/Talk

What changed. add an experimental local MLX speech provider for Talk Mode, with explicit provider selection, local utterance playback, interruption handling, and system-voice fallback.

Check it with. Check macOS/Talk with a known prompt and a disposable account. Save the selected route, reasoning setting, latency, and refusal or fallback result so another operator can reproduce it.

Browser/security

What changed. tighten browser and sandbox navigation defenses across strict SSRF defaults, hostname allowlists, interaction-driven redirects, subframes, CDP discovery, existing sessions, tab actions, noVNC, marker-span sanitization, and Docker CDP source-range enforcement.

Check it with. Treat Browser/security as a boundary change. Exercise one permitted request and one refused request with a test identity, then keep both decisions in the log.

The details that affect a runbook

Security/tools

harden exec preflight reads, host env denylisting, node output boundaries, outbound host-media reads, profile-mutation authorization, plugin install dependency scanning, ACPX tool hooks, Gmail watcher token redaction, and oversized realtime WebSocket frame handling.

Before widening access for Security/tools, replay a narrow allow and deny case. A readable denial and a revoked test credential are part of the acceptance record.

Operator checklist before rollout

1. Before touching persistent state, capture the version, host, provider, and workspace for Models/Codex.
2. Read the linked release record and verify a backup whenever the change can alter configuration or session data.
3. Interrupt one delivery after admission, reconnect the transport, and compare the final reply with the original conversation.
4. Force a short transport interruption and verify that retry or recovery preserves the original thread and sender.
5. Close the test with the evidence attached, and do not widen the rollout while a behavior remains unexplained.

openclaw --version
openclaw gateway status
openclaw security audit

Keep the source trail attached

Close the loop with an explicit next action: keep the candidate isolated, proceed with the staged upgrade, or stop and investigate. Do not treat a green install as proof that the runtime path is correct.

Regression cases from the source

Browser/security. tighten browser and sandbox navigation defenses across strict SSRF defaults, hostname allowlists, interaction-driven redirects, subframes, CDP discovery, existing sessions, tab actions, noVNC, marker-span sanitization, and Docker CDP source-range enforcement. Treat the fix as a boundary condition and retain the source wording beside your local result.

Security/tools. harden exec preflight reads, host env denylisting, node output boundaries, outbound host-media reads, profile-mutation authorization, plugin install dependency scanning, ACPX tool hooks, Gmail watcher token redaction, and oversized realtime WebSocket frame handling. Keep the reproduction and the post-fix result together in the acceptance record.

This page is a practical reading of the v2026.4.10 source record; the release index and session concepts remain the references to use for migrations and support boundaries.