OpenClaw Main Repairs Realtime Voice Reconnect, Startup Audio and Teardown Boundaries

OpenClaw has merged a coordinated set of realtime voice lifecycle fixes across OpenAI, Google, xAI, Talk, voice-call, Discord and meeting-host paths. The corrected boundaries cover four operator-visible failure modes: lost opening speech, stale work crossing a reconnect, audio continuing after close, and tool or audio state growing without a hard lifecycle bound.

These changes are on main, not proof that a current package contains them. Realtime deployments should treat the containing upgrade as a state-machine change and stage it with synthetic audio plus harmless tools.

What changed

Opening speech is retained during provider startup

PR #117604 fixes the OpenAI GPT-Live WebRTC adoption gap. A caller who started speaking immediately after creating a Gateway Talk session could have those microphone frames silently discarded while the provider peer was still being created.

PR #117640 addresses the corresponding Google startup and reconnect queue: early audio must remain ordered, byte-bounded and closed to new input after terminal shutdown.

A reconnect cannot inherit stale ownership

PR #117599 reports stale speech, stale tool results and replacement-session cancellation when a provider reconnects without preserving session ownership correctly. The fix makes work belong to the active generation rather than merely to a transport that once represented it.

This is the crucial semantic change: reconnect continuity should preserve valid conversation state, but it must not grant old callbacks authority over the replacement session.

Close becomes a real admission boundary

PR #117682 stops Talk from admitting late input or output after provider or local closure. PR #117733 adds a bounded terminal lifecycle to meeting-host audio, while preserving a controlled final capture flush.

A closed session that still accepts queue writes is not closed; it is a memory and ordering fault waiting to surface.

WebRTC tools execute only from terminal provider evidence

PR #117732 makes a successful terminal response the executable boundary for WebRTC function calls, rejecting provisional or duplicate events and bounding retained argument and identity state. This matters because a replayed or partial provider event must not trigger the same side effect twice.

PR #117865 then centralizes common realtime lifecycle ownership across bundled providers. Upstream describes this as a refactor, but it raises compatibility risk because cancellation, readiness, retry, terminal notification and buffering now share one owner.

Deepgram endpointing owns the whole utterance

PR #117663 stops Deepgram is_final phrase segments from ending a caller turn before the configured endpointing boundary. Finalized segments accumulate until speech_final or a client Finalize result; provisional text remains replaceable, and close preserves already-finalized text without accepting an unbounded transcript.

The operator-visible symptom was an assistant responding during an ordinary mid-sentence pause. Test a single long sentence with several pauses and prove it becomes one turn, while two genuinely separate identical utterances remain two turns.

Final OpenAI transcription audio is flushed under the real VAD owner

PR #118782 preserves eligible final microphone audio when an OpenAI realtime transcription session closes. The fix distinguishes Server VAD-owned commits from manual commits, applies the provider’s 100 ms minimum for the negotiated 8 kHz G.711 µ-law format—800 bytes—and handles delayed or duplicate acknowledgements without duplicating the final transcript.

Do not infer the threshold for another codec or sample rate. Inspect the negotiated format in the containing build and test 799-byte, 800-byte, Server VAD and recoverable-error boundaries with synthetic audio.

Startup failure now hangs up the actual carrier

PR #118699 fixes a billing and lifecycle fault: when a realtime provider failed to start, local state could terminate while the Twilio or Telnyx carrier call remained active, billable and no longer recoverable. The plugin-owned finalizer now owns one carrier hangup for error terminals while stale predecessors cannot terminate a replacement call.

Monitor provider session state and carrier call state independently. A local terminal event is not evidence that the billable carrier leg ended.

Signed callbacks commit before replay is consumed

PR #118754 moves verified carrier callbacks behind durable voice-call state and generation-safe replay ownership. Legitimate retries after a persistence failure remain possible; duplicates, concurrent callbacks and stale call generations are suppressed without leaking one-time carrier tokens.

The critical ordering is verify, reserve, durably commit, then expose side effects. Consuming a replay token before state exists turns a transient database failure into permanent callback loss.

Fast voice context applies session visibility

PR #118498 fixes the default-off fast-context path returning transcript snippets from unrelated same-agent sessions even though normal memory search would reject them under tools.sessions.visibility. Memory Core now applies its canonical session-search visibility filter before Talk renders raw hits; runtimes without an authorizer fail closed for session hits while ordinary memory hits remain available.

Use synthetic markers in two unrelated sessions. The fast path must return the allowed marker and suppress the unrelated one without relying on the model to ignore it.

Rollout matrix

After identifying a build containing the relevant merges, test every enabled provider rather than assuming one passing path proves the others:

Use a no-op tool with an idempotency key. Do not test terminal-call deduplication using messages, purchases, account changes or production controls.

Monitoring that catches lifecycle drift

Track session generation, provider connection generation and terminal reason separately. Also capture:

• queued audio bytes or chunks, not only item count;
• oldest queued-frame age;
• dropped or rejected post-terminal frames;
• duplicate terminal notifications;
• tool-call identity and authoritative completion source; and
• whether reconnect created, adopted or replaced a session.

Interpretation: the repaired code is converging on one rule—buffers, callbacks and tools need an explicit owner plus a monotonic terminal state. A socket reconnect alone must never revive work.

Evidence and limits

The official merged-PR and commit records in the repository packet establish the reported defects and landed corrections. The packet also identifies a shared lifecycle refactor following the provider-specific repairs. Direct GitHub extraction was blocked with HTTP 403, and OpenClaw Academy did not place live calls or run upstream provider fixtures. Exact buffer constants and provider-specific protocol details should be taken from the containing revision.

Bottom line

Realtime voice operators should upgrade only after proving the beginning, reconnect and end of a call. A session is safe when opening audio is retained, old generations lose authority, terminal close rejects new work, and a tool can execute exactly once from authoritative provider evidence.