OpenClaw v2026.9.1-beta.1: Gateway restart recovery, recovery notes

v2026.9.1-beta.1 is easiest to understand through failure. The official record describes a provider, model, voice, or context change; the sections below spell out what to save, what to interrupt, and what must remain available afterward.

This candidate is still pre-release. Treat provider, channel, and migration behavior as unconfirmed until your own bounded test passes. Treat the version as one input to the decision. Local credentials, enabled plugins, channels, and host support still need their own evidence.

Failure and recovery path

Gateway restart recovery

What changed. preserve admitted turns across repeated Gateway restarts so restart-safe runs continue through each checkpoint and deliver their final response.

Check it with. Before relying on Gateway restart recovery, rehearse it on a disposable install. Record the schema, configuration, service owner, and exact point at which rollback is allowed or refused.

Gateway config-write reliability

What changed. keep committed config writes pending through watcher handoff so same-write reloads settle against the observed generation instead of failing during source transfer.

Check it with. Use Gateway config-write reliability for a small reproducible task: save the input, visible result, useful failure, and version context another operator would need.

Codex managed runtime

What changed. update the bundled Codex runtime to 0.150.1 across Linux, macOS, and Windows while retaining platform-specific package resolution and current compaction behavior.

Check it with. Check Codex managed runtime with a known prompt and a disposable account. Save the selected route, reasoning setting, latency, and refusal or fallback result so another operator can reproduce it.

Linux installation reliability

What changed. provision the stable Node 24 LTS stream and constrain RPM installs to the configured NodeSource repository so Linux setup cannot select an incompatible prerelease. PR 130369.

Check it with. For Linux installation reliability, inspect state rather than only the new control. Repeat the flow after reload and reconnect, and note the session, pending action, URL, and visible error.

The limits of the recovery promise

Worker recovery

re-arm admission-deadline launches, terminalize dead-worker turns, and defer debris cleanup so interrupted delegated work settles visibly.

Exercise Worker recovery twice with a disposable trigger. The expected result is one side effect, a readable terminal state, and a cancellation path while work is still pending.

Audit decisions

record generic tool-action decisions at their authoritative execution boundary for clearer operator diagnostics.

Read Audit decisions as an authorization checkpoint: prove who may act, what the action can reach, and how the rejected attempt is surfaced to the operator.

Codex app-server compatibility

carry Codex 0.150.1 collaboration, status, and activity protocol additions through the managed bridge without weakening exact platform package checks.

The safe reading of Codex app-server compatibility is operational: prove the model can answer the intended task, then force a bounded failure and verify that no side effect is repeated.

Run the smallest useful rehearsal

1. Write down the baseline for Gateway restart recovery, including the installed version, host, provider, and workspace.
2. Confirm what can be restored, then take a verified backup before applying the candidate package.
3. Use a disposable session to compare the new model or provider with the previous route on one fixed input.
4. Restore the previous provider setting after the check and retain the measured result beside the release tag.
5. Keep the experiment bounded; an unexpected result belongs in the release record before any wider rollout.

openclaw --version
openclaw gateway status
openclaw security audit

Leave a usable maintenance note

Save the command, output, source link, and environment used for this check. Future operators should be able to tell whether a difference belongs to the release or to local provider, channel, or platform state.

Fix details to carry forward

Gateway restart recovery. retain admitted restart-safe runs across cleanup and repeated restarts, preserving checkpoints and final delivery. This is the edge case to include in a regression check, especially when the release is pre-release.

Gateway config watcher handoff. preserve pending config writes until the watcher observes the committed generation, preventing config.patch from failing during same-write source handoff. Fixes #131405. Treat the fix as a boundary condition and retain the source wording beside your local result.

Keep the full v2026.9.1-beta.1 notes with your test result. Read the official release index for neighboring versions and the model provider reference for configuration limits.