OpenClaw Silently Ran Stale Hook Code, Lost Deleted Agents' Databases, and Stranded Browser Automation — Three Fixes

Three merged OpenClaw fixes share one property that makes them dangerous in production: every one of them failed silently. No error surfaced at the time of the fault — stale code kept running, files stayed on disk, automation froze. Each is now fixed on main with proof attached. Here is what to check in your deployment.

Hooks: same-size edits could keep old handler code running

PR #128477 fixes a cache-invalidation trap for mutable workspace, managed, and plugin hooks. OpenClaw keys the ESM import URL for a mutable hook on the file’s size and modification time. An edit that changed bytes but preserved both — equal byte length, restored mtime, which is exactly what sync tools, restores, and some editors produce — produced an identical cache key. After an in-process Gateway restart or hook reload, the module loader happily reused its cached copy: the previous handler kept executing while the disk held different code.

The fix adds ctimeMs to the import URL key using the already-available stat result, so any inode status change busts the cache; bundled hook URLs stay unchanged and cacheable. The PR includes a parent-red reproduction (disk said after!, execution returned "before"), exact-head real-handler proof, and an inspectable artifact commit with SHA-256 manifest.

Operator action: if you edit hooks through sync tooling or restores, update to a build containing this fix, then re-trigger your affected hooks once and confirm they behave per current source. If you audit hook behavior changes via file diffs alone, note that mtime-preserving edits are now safe but were not before.

Offline agent delete left databases behind

PR #129017 closes a data-retention gap with compliance implications. Deleting an agent while the Gateway was unavailable ran an offline fallback that removed registry ownership and completed the deletion journal — while leaving registered database files that lived outside the agent directory on disk. The stale files became undiscoverable and unretryable: deletion looked complete.

The fix routes the deletion journal’s full inventory — including SQLite WAL, SHM, and rollback-journal sidecars — through the existing Trash collector, skips paths still owned by surviving agents or workspaces, and gates registry cleanup and journal completion on every cleanup target succeeding, so failures stay retryable.

Operator action: if you deleted agents offline on older builds, search your state directories for orphaned agent database files (including -wal/-shm sidecars) and remove them deliberately after confirming no surviving agent references them. Shared paths were always preserved and remain so.

Browser automation: failed dialog handling no longer hangs forever

PR #129459 addresses Playwright’s one-shot dialog contract: it marks a dialog handled before awaiting the protocol response, so when accept/dismiss fails at the protocol boundary the failure cannot be retried — yet the plugin’s state machine kept offering the retry and left armed actions running. Symptom: automated browser sessions hang indefinitely or advertise permanently unhandleable dialogs as pending.

The browser plugin now treats handle failure as terminal — armed responses abort every active action with the original error; explicit responses drop the consumed dialog. Thirteen focused owner tests pass, plus independent verification across six suites (75 tests) and eleven real-production lifecycle scenarios.

Operator action: if your browser automations ever hung with no error until timeout, this was likely the cause. On updated builds, expect prompt failure with the real accept/dismiss error instead of silence.

The common thread

Silent divergence between what operators believe ran and what actually ran — code, deletions, or automation steps — compounds quietly until something visible breaks. All three fixes convert silent divergence into explicit outcomes: reload picks up new code, delete reports incomplete rather than falsely complete, and hang becomes error. That is the right direction of travel for an operator-facing platform.