OpenClaw Main Tightens Async Ownership Across Agents, Restarts and Channels

OpenClaw has merged five high-impact lifecycle fixes after the 2026.7.2-beta.7 tag. They affect different surfaces, but enforce one operational rule: asynchronous work must retain the right owner until completion, then lose authority exactly once.

The fixes are on main. They are not present merely because an installation reports beta.7.

The five failure boundaries

Equivalent terminal failures now count as a loop

PR #118071 reports that an agent could issue roughly 40 argument-varying exec calls that all produced the same meaningful terminal failure. Because each command had a different argument hash, existing loop detection did not fire. The session remained blocked while model calls continued.

The repair recognizes equivalent completed or failed terminal outcomes rather than treating every argument variation as novel progress.

Operator impact: watch for repeated failure meaning, not only repeated command text. A changing command string can still be one stuck strategy.

Delayed agent-to-agent replies keep valid admission

PR #118105 fixes delayed sessions_send replies that could fail before provider execution after the parent tool request had already completed. The detached follow-up inherited an admission root whose lifecycle was over.

This is especially relevant to ping-pong coordination and final announcements: accepting the initial send is not enough if the delayed reply loses permission to execute.

The replacement Gateway owns restart recovery

PR #118026 covers a lease-handoff race. An old Gateway could surface a late failure and clear restart-recovery state after the replacement process had already acquired the authoritative SQLite session lease.

The fix confirms lease loss against the current owner before allowing the old process to alter recovery state. A stale process may report what happened to itself; it must not rewrite the replacement’s truth.

Discord acknowledgements commit after provider acceptance

PR #117417 moves local acknowledgement state behind accepted Discord callback delivery. Previously, reply, defer, component update, modal, activity or autocomplete paths could mark an interaction acknowledged before Discord accepted the HTTP request. A rejected initial response then poisoned local state and pushed recovery toward a webhook that had no accepted initial interaction.

This is a transaction boundary: provider acceptance is the commit point.

Transcription reconnects own separate generations

PR #117592 separates WebSocket, provider transport, readiness, reconnect and shutdown state for overlapping realtime transcription connections. Late callbacks from an old socket could otherwise corrupt the active connection, and superseded asynchronous preparation could open an extra socket.

The replacement generation must be able to proceed while old callbacks become harmless.

Rollout matrix

Use a revision containing the relevant merge and isolate each boundary:

Use no-op tools, synthetic audio and disposable Discord interactions. Do not create a failure test with external messages, purchases or destructive commands.

Monitoring changes

Add identities to the evidence you retain:

• agent run and tool-attempt identity;
• normalized terminal failure class;
• parent request and detached follow-up identity;
• Gateway process and SQLite lease owner;
• Discord interaction and accepted callback type; and
• transcription connection generation.

A generic “request failed” log is insufficient when the question is which generation was still allowed to act.

Incident response on older builds

If a session appears stuck or a callback disappears:

1. stop automatic replay of any side-effecting operation;
2. determine whether the provider or node accepted the earlier attempt;
3. preserve old and replacement process identities;
4. reconcile the authoritative session transcript and provider receipt; and
5. resume only after proving which owner still has permission to complete.

Interpretation: availability and duplication risk meet at the same boundary. Revoking ownership too early loses valid work; revoking it too late lets stale work interfere.

Evidence and limits

The official GitHub PR pages and merged records establish the reported failure modes and landed changes. Several upstream reviews still described proof or compatibility risk despite merge. OpenClaw Academy did not execute concurrent agents, replace a live Gateway lease, call Discord or open realtime transcription sockets.

Bottom line

Do not treat these as generic cleanup. Operators using delegated agents, restart recovery, Discord interactions or realtime transcription should stage a containing build and force the handoff boundary. The proof is that the current owner completes once and every stale owner becomes powerless.