OpenClaw Main Reworks Reply and Session Recovery Across Restarts

OpenClaw has merged a coordinated set of continuity fixes into main. A Gateway restart should no longer blindly replay a possibly delivered final reply, strand an interrupted main session, or leave ambiguous delivery without a later visible explanation.

The changes make recovery more honest, not magically certain. When provider evidence cannot prove whether a send was accepted, OpenClaw still has to choose between duplication and loss. The new design records that uncertainty and gives different owners explicit recovery rules.

Final-reply custody now has terminal states

PR #121908 repairs the pending-final state machine after an earlier attempt was reverted for breaking CI and leaving deliveries permanently prepared.

The re-landed path claims custody immediately before provider I/O, then settles the record according to evidence:

• proven success becomes delivered;
• a proven no-send failure can return to a replayable state;
• suppression is recorded as suppression; and
• an ambiguous post-dispatch error becomes unknown rather than being blindly resent.

After restart, only a final proven unsent is eligible for automatic replay. Unknown delivery fails closed against duplication.

That changes troubleshooting. A recipient-visible interruption may be the safe result of missing evidence, not proof that the model failed or the queue forgot the answer.

Ambiguity becomes durable notice debt

Failing closed prevents duplicates but can still leave a user wondering what happened. PR #121833 adds one durable, route-bound uncertainty notice owed to the next same-route interaction.

If a provider accepted the send but its response was lost, OpenClaw does not resend the answer. It records that delivery could not be confirmed and tells the user once on the next contact. The debt survives restart and session rollover.

Typed pre-dispatch rejection remains different: if the provider proves that nothing was sent, OpenClaw can fail visibly or preserve replay eligibility without creating a false “may have arrived” warning.

This is the right distinction. Retry safety should follow provider custody evidence, not regexes over outer error messages.

Interrupted main sessions resume through the agent pipeline

PR #121969 removes the ordinary “failed, please resend” outcome for recoverable main-session turns. Delivered finals and handled-silent hooks complete; other ordinary ambiguous states resume through a normal internal agent turn.

When side effects may have occurred, the resumed turn receives restart-safe tool restrictions. Exact replay-safe Code Mode checkpoints get their narrower controls. A message-tool-only recovery without durable channel-ingress authority remains tombstoned rather than being granted invented permission.

There is an explicit trade-off: a resume can produce a duplicate explanation when previous delivery was ambiguous. The model can inspect the transcript, while unsafe mutation tools are withheld. OpenClaw prefers a supervised continuation over a dead session.

Long session history no longer blocks new context commits

PR #121647 fixes durable context engines that stopped advancing after historical transcripts crossed 20,000 events or 8 MiB. The old read mixed the accepted turn with too much earlier history, so a small new turn could be classified too-large forever.

The repaired commit reads and persists the admitted turn’s bounded range. A turn that itself exceeds the safety limit still blocks; old history alone no longer poisons every later commit.

Slack participation becomes durable beyond one day

PR #121708 removes the 24-hour expiry for newly recorded Slack-thread participation. After the bot has legitimately joined an authorized thread, mention-free replies can continue beyond one day and across restart.

Existing expiry timestamps are not migrated or cleared. Already-expired legacy rows stay expired, and still-valid legacy rows keep their original deadline. Operators should expect one final mention to establish new non-expiring participation after upgrading, rather than assuming old threads are revived automatically.

Acceptance matrix

Test a containing build with synthetic traffic:

Compare recipient output, transcript, delivery record and session state. Any one of them alone can lie by omission.

Bottom line

Recovery is now based on custody: who owned the send, what the provider proved, which authority admitted the turn and whether the durable record advanced. Stage these fixes together. The goal is not “always retry”; it is one visible, explainable outcome without inventing certainty after a crash.