OpenClaw Repairs SQLite Session Continuity Across Restarts and Model Streams

OpenClaw has merged a substantial session-correctness stack on main. The changes repair duplicate SQLite session identities, missing history in resumed Codex turns, restart rejection of already-persisted user turns, lost terminal OpenAI output, stale child-agent answers and Control UI observers that could remain dead after reconnect.

This is not one bug and it is not proof that any packaged release contains the fixes. It is a coordinated tightening of the boundary between what was durably recorded, which turn owns a result, and what the provider or interface declared terminal.

Operators using SQLite-backed sessions, Codex, OpenAI streaming, subagents or the Control UI should identify a containing release and test restart and reconnect behaviour before treating the stack as remediated.

What operators need to triage

Doctor now owns duplicate session-key repair

PR #116703 addresses canonical and alias-form session keys coexisting across SQLite stores. That state is dangerous because a runtime reader may reconcile duplicates by freshness while another indexed path assumes identity is unique. Two correct-looking reads can therefore select different histories.

The merged design gives Doctor the durable repair boundary. Upstream describes selecting canonical winners, preserving repair generations and validating the reopened destination before the repaired store becomes authoritative.

Do not improvise this migration with ad hoc SQL. Before running Doctor on a potentially affected installation:

1. stop writers through the supported shutdown path;
2. back up the complete SQLite database family, including sidecars;
3. record the exact OpenClaw revision and profile;
4. run the containing Doctor build against a disposable restore first; and
5. compare session identity, transcript length, routing and child relationships before reopening production.

Interpretation: canonicalization is not a cosmetic rename. It is a data merge, and the safety question is which record wins when two identities claim the same session.

Codex history now follows the canonical SQLite target

PR #116944 carries the typed canonical SQLite session target through Codex startup and settled-turn finalization. The reported failure was subtle: OpenClaw could show a resumed session while the next Codex turn did not receive the prior OpenClaw conversation history.

That can produce a plausible but context-free answer, which is worse than an explicit resume failure when the next action is consequential. A UI label or reused session ID is not proof that the model received the intended history.

Test continuity with synthetic markers rather than secrets. Record one harmless fact, settle the turn, restart or resume through the exact Codex path, and ask for that fact. Then inspect the persisted transcript to prove the marker exists once and belongs to the same canonical session.

Already-durable user turns should survive restart exactly once

PR #116924 fixes a restart path that could reject a current user turn with Session transcript parent entry was not persisted even though SQLite already held that exact turn. The restored active-session copy could be absent while recorder-confirmed durable identity remained valid.

The correction accepts exact, idempotency-confirmed persistence while retaining orphan handling for mismatched or unconfirmed turns. That distinction matters: weakening the check to “something similar exists” could attach an answer to the wrong parent or execute a replay twice.

Acceptance should therefore prove both sides. The exact recorded turn resumes once, while a changed identity or payload does not inherit its authority.

Provider terminal state is authoritative

Two OpenAI fixes close related streaming gaps.

PR #116910 covers Responses streams whose final answer or function call appears only in the terminal response.completed.output snapshot. If commentary had already streamed, OpenClaw could previously report success with only that commentary and discard the actual terminal output. The fix reconciles the final snapshot while preserving tool ordering.

PR #116922 applies the same ownership principle to Chat Completions tool calls, including the SDK-supported legacy delta.function_call form. Provisional fragments are not executable facts. Failed, truncated and text-only streams must not announce a completed action merely because enough arguments appeared during streaming.

For consequential tools, test a completed call, a text-only response, a deliberately interrupted stream and a terminal response that supplies the final output late. Compare model-visible history, tool execution and user-visible delivery. Each terminal call should execute once; incomplete calls should execute zero times.

Child results now belong to the current parent turn

PR #116897 fixes cases where repeated child-agent tasks could surface a previous task’s answer when the new turn produced no reply. It also stabilises concurrent child ordering and tightens child-session ownership. PR #116932 preserves blocked or failed child outcomes while bounding and sanitising the diagnostic text exposed through the parent projection.

The operator consequence is attribution. A fluent child answer is not useful if it belongs to yesterday’s request, and a generic “completed” label is not truthful if approval or execution was blocked.

Run two disposable child tasks with distinct markers, including one that intentionally produces no answer or a safe denial. Complete children in different orders. The parent summary must remain tied to the current turn, ordered deterministically and explicit about bounded failure without exposing raw provider or approval internals.

The Control UI must recover its observer, not merely repaint

PR #116887 repairs broad session subscription failure and reconnect handling. A successful list refresh could hide the observer error even though live session updates remained disabled. Targeted observers might still update parts of the screen, producing a dangerously convincing partial recovery.

Test by interrupting the subscription path, not just reloading the page. Confirm the error remains visible while observation is broken, reconnect establishes a new working subscription, and subsequent transcript and terminal events arrive without a manual refresh or duplication.

Safe rollout sequence

1. Back up SQLite and session state consistently with writers stopped.
2. Stage a containing build against a restored copy, then run Doctor and inspect its repair report.
3. Verify canonical identity and transcript continuity before testing providers.
4. Exercise Codex resume and restart-safe turn recovery with harmless markers.
5. Test OpenAI terminal-only output plus interrupted and completed tool calls.
6. Test repeated child tasks, no-reply outcomes and concurrent completion order.
7. Break and restore the Control UI subscription deliberately.
8. Roll out with exact revision tracking and retain a tested rollback that restores code and state together.

Do not downgrade binaries against a database already rewritten by a newer Doctor unless upstream explicitly documents that path. Restoring only the executable while retaining migrated state is not necessarily a rollback.

Evidence and limits

The official merged PR and commit records in the repository collector establish the chronology and reported failure boundaries. Direct GitHub extraction and independent web search were unavailable during this run, so implementation and test claims above remain explicitly attributed to upstream. OpenClaw Academy did not mutate a production SQLite store or run live Codex/OpenAI sessions.

The evidence supports merged source corrections, not package inclusion, universal impact or a guarantee that third-party session consumers honour the same ownership rules.

Bottom line

A durable transcript is only useful when every layer agrees on its identity and terminal state. Doctor must resolve duplicate keys safely, resumed models must receive the intended history, provider terminals must outrank provisional stream fragments, and child answers must belong to the turn that requested them.

Treat the containing upgrade as a state migration and recovery test—not a routine binary swap. Back up first, verify exact ownership after restart, and make the failure cases prove the fix.