OpenClaw Main Preserves Media and Run State Through Long Finalization

OpenClaw has merged four corrections for long or heavily tooled turns whose durable result, operator-visible state and generated attachments could disagree.

A live turn lasting beyond the outgoing-media retention threshold could lose generated images, audio or video before its transcript message committed. A successful session could remain marked running after a timestamp race. Returning to an active Control UI session could hide useful history and restart its visible timer, while settled finalization could drop completed action facts from the result.

The changes are on main; the reviewed records do not identify the first packaged version containing all four.

Generated media now remains owned by the live run

Generated assistant media is initially stored without a committed transcript messageId and with transient retention. Finalization later commits the assistant message and attaches the media record.

Before PR #119764, managed outgoing-media garbage collection could reap that transient record purely by age after 15 minutes—even though the session run that created it was still active. The later attachment step could no longer recover the deleted file, leaving the completed chat reply without its image, audio or video.

The fix adds an active-session-run check to the managed cleanup path. Age-based reaping skips uncommitted media while its registered run remains live; ordinary retention can resume after ownership settles.

Interpretation: retention time is not sufficient authority for deleting an in-flight artifact. The system must also know whether a live run still owns the pending commit.

A same-run terminal event beats timestamp ordering

PR #119752 repairs successful sessions left in a running state. A terminal lifecycle event could carry an older timestamp than a newer metadata write from the same run and be discarded as stale, even though it was the authoritative completion event.

The repaired session entry tracks durable run ownership. A terminal event for the same run can settle the session despite timestamp ordering, while an event from an unrelated or replaced run remains fenced.

Do not “repair” a stuck status by marking every old terminal event current. Run correlation is the safety property; timestamps alone are not enough, but neither is terminal status without ownership.

Returning to an active session keeps its real history and clock

PR #119729 preserves otherwise-displayable prompt history, assistant progress, reasoning, running tool activity, stop control and elapsed time when an operator navigates away and returns, reconnects or reloads the Control UI.

The old history budget included private metadata that was removed only later. That metadata could consume the budget and cause useful visible content to be replaced by an omission marker. The UI also restarted its working timer from the navigation or reconnect point rather than the authoritative run start.

The fix removes private metadata before budgeting and carries the original run-start timestamp. This improves operator truth without making private metadata visible.

Completed actions survive settled finalization

PR #119726 keeps completed tools, automations, MCP App views and other settled action facts in the final run result. Isolated finalization previously created a synthetic terminal attempt without carrying all settled tool metadata, so downstream consumers could lose evidence of work that had already completed.

That is more than presentation polish. An operator deciding whether to retry needs to know which actions already happened. Missing action facts can turn a harmless display bug into duplicate external side effects.

Acceptance test for a containing build

Use synthetic media and idempotent tools:

1. run a turn for longer than 15 minutes and generate a uniquely marked test image before finalization;
2. trigger the managed media sweep while the run remains active and prove the file and record survive;
3. complete the turn and prove media attaches once to the committed message;
4. race a newer same-run metadata update ahead of terminal delivery and prove the session settles;
5. deliver an old terminal from another run and prove it cannot settle the current run;
6. navigate away, reload and reconnect during a tool call, then verify visible history, stop control and elapsed time remain truthful; and
7. complete several harmless tools and confirm the final result retains their settled action facts.

Inspect the recipient-visible response, transcript, media store and session status together. Any one can look healthy while another boundary has failed.

Incident review on older builds

For a missing attachment or apparently stuck run:

• preserve the session ID, run ID, lifecycle timestamps and managed-media record before maintenance;
• distinguish “file was generated” from “record was committed and attached”;
• reconcile tool receipts before retrying a turn whose completed actions disappeared;
• do not extend transient retention indefinitely as a blanket workaround; and
• avoid editing SQLite session or media rows by hand.

A longer TTL may reduce frequency but does not fix ownership. A future long turn can still outlive it.

Evidence and limits

The official merged PRs and commits establish the four production failure paths and focused regression coverage. The 15-minute threshold is the affected managed transient-media TTL described by the upstream record, not a recommendation for operator configuration. OpenClaw Academy did not run a paid 15-minute media generation turn or mutate a production session store.

Collector IDs 40681/40555, 40450/40417, 40379/40350, and 40306/40256 identify the supporting changes.

Bottom line

A run is not complete merely because one clock, screen or transcript says so. Adopt a containing build only after live media survives until commit, same-run terminals settle status, reconnect preserves the true active view and completed actions remain visible before anyone considers a retry.