OpenClaw v2026.4.15: Google/TTS, recovery notes

v2026.4.15 is easiest to understand through failure. The official record describes a health, liveness, or runtime-observability change; the sections below spell out what to save, what to interrupt, and what must remain available afterward.

Stable status describes the release line, not every local provider or channel. Check the version-specific notes before upgrading. Treat the version as one input to the decision. Local credentials, enabled plugins, channels, and host support still need their own evidence.

Failure and recovery path

01 / Anthropic/models

Source signal. default Anthropic selections, opus aliases, Claude CLI defaults, and bundled image understanding to Claude Opus 4.7.

A catalog label for Anthropic/models is only the first signal. Confirm the account, endpoint, context limit, and tool policy that the running Gateway actually selected.

02 / Google/TTS

Source signal. add Gemini text-to-speech support to the bundled google plugin, including provider registration, voice selection, WAV reply output, PCM telephony output, and setup/docs guidance.

Check Google/TTS with a known prompt and a disposable account. Save the selected route, reasoning setting, latency, and refusal or fallback result so another operator can reproduce it.

03 / Control UI/Overview

Source signal. add a Model Auth status card showing OAuth token health and provider rate-limit pressure at a glance, with attention callouts when OAuth tokens are expiring or expired. Backed by a new models.authStatus gateway method that strips credentials and caches for 60s.

Treat Control UI/Overview as a boundary change. Exercise one permitted request and one refused request with a test identity, then keep both decisions in the log.

04 / Gateway/tools

Source signal. anchor trusted local MEDIA: tool-result passthrough on the exact raw name of this run's registered built-in tools, and reject client tool definitions whose names normalize-collide with a built-in or with another client tool in the same request (400 invalid_request_error on both JSON and SSE paths), so a client-supplied tool named like a built-in can no longer inherit its local-media trust.

The useful evidence for Gateway/tools is the refusal path as well as the success path. Use synthetic credentials and record the policy that made each decision.

The limits of the recovery promise

Agents/replay recovery

classify the provider wording 401 input item ID does not belong to this connection as replay-invalid, so users get the existing /new session reset guidance instead of a raw 401-style failure.

Agents/replay recovery changes a capability choice, not automatically a billing or privacy agreement. Record provider, model id, context setting, and fallback behavior before changing a default.

Run the smallest useful rehearsal

1. Write down the baseline for Anthropic/models, including the installed version, host, provider, and workspace.
2. Confirm what can be restored, then take a verified backup before applying the candidate package.
3. Use a disposable session to compare the new model or provider with the previous route on one fixed input.
4. Restore the previous provider setting after the check and retain the measured result beside the release tag.
5. Keep the experiment bounded; an unexpected result belongs in the release record before any wider rollout.

openclaw --version
openclaw gateway status
openclaw security audit

Leave a usable maintenance note

Save the command, output, source link, and environment used for this check. Future operators should be able to tell whether a difference belongs to the release or to local provider, channel, or platform state.

Fix details to carry forward

Gateway/tools. anchor trusted local MEDIA: tool-result passthrough on the exact raw name of this run's registered built-in tools, and reject client tool definitions whose names normalize-collide with a built-in or with another client tool in the same request (400 invalid_request_error on both JSON and SSE paths), so a client-supplied tool named like a built-in can no longer inherit its local-media trust. This is the edge case to include in a regression check, especially when the release is pre-release.

Agents/replay recovery. classify the provider wording 401 input item ID does not belong to this connection as replay-invalid, so users get the existing /new session reset guidance instead of a raw 401-style failure. Treat the fix as a boundary condition and retain the source wording beside your local result.

Keep the full v2026.4.15 notes with your test result. Read the official release index for neighboring versions and the Gateway health guide for configuration limits.