OpenClaw 2026.10.3 Clears Update Blockers and Protects Credentials as Beta.3 Hardens Restart Recovery
Stable 2026.10.3 is the production story: stuck updates can move again, and Doctor stops discarding saved sign-ins or rewriting memory files during affected repairs. Beta.3 previews the next layer, including the nested-effect cleanup fix that the stable notes do not yet list.
2026.10.3 Clears the Update Blockers That Stalled Recent Upgrades
The official OpenClaw 2026.10.3 release notes describe a patch that fixes several update blockers, preserves saved sign-ins and memory files during affected Doctor repairs, helps the Mac app connect during local setup, and lets conversations continue after compaction or interrupted provider replies, across 79 pull requests and 97 contributors. The GitHub release for v2026.10.3 published October 13 at 6:49 AM Pacific, and the official @openclaw announcement of the v2026.10.3 patch followed that afternoon with the same themes plus Muse Wonder and MiniMax support.
The update section is long and specific. Updates can clear eligible leftover recovery work and archive completed update records that blocked the next upgrade (#168388, #169038). The CLI can settle supported aborted records from interrupted 2026.9.8 updates, Doctor can remove an eligible abandoned npm updater copy, and a Doctor cleanup check that falsely refused permission and rolled back chat-requested updates is fixed in #170218. Windows service accounts, pnpm's durable install link, and briefly busy state databases also get targeted fixes.
One caveat runs through the notes: many repairs require the fixed updater to be installed before it starts the upgrade, and already-blocked older updaters need a manual installation or recovery step first. 10.3 smooths the update after it; it cannot free an updater that is already wedged.
For production fleets, 10.3 is the stable tag worth scheduling. It targets the blockers that turned routine upgrades into recovery sessions, and it adds no risky new surface. Read the "requires the fixed updater" lines first: hosts already stuck on an older updater need the documented manual recovery step, so inventory which Gateways are blocked before you book one fleet-wide rollout window.
Doctor Stops Discarding Saved Sign-Ins and Memory Bytes
The Security and Privacy section of the 10.3 notes holds a single entry, and it matters most. Under #170256, an unreadable legacy auth file no longer causes the affected Doctor cleanup to discard saved OAuth profiles. Doctor names the file to inspect or restore before retrying, while unrelated repairs continue. Previously deleted profiles and retired credential imports are not restored, so anyone who already lost sign-ins still has to log in again.
Memory gets the same treatment. Under #169029, when malformed UTF-8 prevents merging MEMORY.md with the older memory.md, Doctor preserves the original bytes; the guidance is to keep the originals and repair or convert a copy to UTF-8 before retrying. Recovery copies taken before repairs now also include older Canvas documents and Memory Core files.
Mac Setup, Conversation Continuity, and New Models in 10.3
On macOS, eligible "On this Mac" setups that failed with "Gateway rejected auth" can now connect (#169403), the app reconnects after a trusted Gateway certificate renewal (#168151), and it recognizes its protected Bun Gateway command, addressing one cause of a stuck recovery screen (#170006). The next message after native compaction waits for saved history instead of failing, and an interrupted ChatGPT reply can continue from the saved conversation within existing retry limits.
Providers expand too: Meta users can select Muse Wonder (#170232), eligible MiniMax users can pick M3.1 Flash Preview (#160089), and MiniMax OAuth sign-ins now renew at their issuing regional endpoint (#160459).
Watch Item: The Nested-Effect Doctor Fix Ships in Beta.3, Not in 10.3
Yesterday's caution was GitHub issue #168750 on the nested-effect Doctor failure during updates. The repair, pull request #170070 fixing nested-effect failures during chat update cleanup, merged to main on October 12. The 2026.10.5-beta.3 notes now list #170070 and #168750 under update outcomes. Neither number appears in the 10.3 notes, and when SEN-X checked the tags, the fix commit sat in beta.3's history but not in v2026.10.3.
The practical reading: 10.3 is still a strong production upgrade for its update-unblocking, OAuth, and memory work, and its separate chat-update fix (#170218) addresses a related false-refusal path. But do not tell a client 10.3 closes #168750. Keep openclaw update repair in the runbook and wait for a stable release whose notes name #170070.
2026.10.5-beta.3 Keeps the Gateway Up and Turns Alive Through Restarts
The OpenClaw 2026.10.5-beta.3 prerelease notes on GitHub went up October 13 at 3:00 AM Pacific, covering 71 pull requests since beta.2; there is no docs page for this beta yet. Headline items: updates leave the Gateway running across pnpm 12, Windows Scheduled Task, and macOS Bun service setups; stuck updates recover after filesystem remounts or a briefly locked state database; and Doctor keeps credentials and data.
Restart durability is the deeper beta story. Interrupted turns, subagent work, automation turns, steered sessions, and node-hosted turns are meant to resume after a Gateway restart. Telegram gets a notable safety fix: the first start after updating no longer re-dispatches months-old legacy spool updates as new owner instructions, because entries older than 24 hours now import as stale. Plugins built against 2026.10.1 and 2026.10.2 can again import createSessionHeaderLink from openclaw/plugin-sdk/control-ui.
The Telegram spool fix is the beta.3 item to test hardest. Replaying months-old messages as fresh owner instructions is an authority problem, not a cosmetic bug, so teams running Telegram-connected agents should stage beta.3 on a non-production Gateway, run an update, and confirm no stale commands execute. Stable 10.3 stays the production pin until these behaviors graduate to a stable tag.
Security Practice: Treat Skill Metadata as Untrusted Input
MetaCascade shows a skill's name and description can win the selection
A new paper, MetaCascade: End-to-End Attacks on Agent Skills via Metadata-Only Poisoning on arXiv, studies attacks that change only a skill's metadata so a malicious copy is retrieved and then chosen by the agent. Its evaluation names OpenClaw and Hermes, draws on ClawHub skills among four datasets, and reports average attack success of 74.24% with no defense and 63.33% across four tested defenses. The authors did not publish poisoned skills to live registries.
The tested defenses were research tools, not ClawHub's ClawScan, so the paper does not say how ClawHub's pipeline would fare. It does show that a persuasive description is not evidence of trust.
- Before installing, use the ClawHub security audits guide to check owner, source, version, and changelog alongside the audit result; ClawHub's review asks whether the name, summary, metadata, and requested authority line up with the actual content.
- Prefer a skill you chose deliberately by owner and slug over one an agent picked because its description matched the task best.
- Treat a
Highrisk level as a reason to narrow permissions even when the status readsPass. - Apply least privilege from the OpenClaw Gateway security documentation: per-agent tool profiles, sandboxing, and a regular
openclaw security audit, so a mis-selected skill can reach less.
The authors call for metadata-integrity and provenance defenses; until those mature, checking provenance is the operator's job.
Model Spotlight: Muse Wonder in OpenClaw
meta/muse-wonder-1.0: explicit selection, 1M context, tools
According to the OpenClaw Meta provider guide, Meta ships as the official external plugin @openclaw/meta-provider. Muse Wonder's model ref is meta/muse-wonder-1.0, with text and image input, tool calling, streaming, reasoning, and a 1,048,576-token context window. New setups keep meta/muse-spark-1.3 as the default; Wonder is an explicit choice, priced well above Spark in the guide's catalog table.
Two details matter. The API offers Wonder Standard only, and setting reasoning effort to max does not select Wonder Full. If the Gateway runs as a daemon, MODEL_API_KEY must reach that service process, for example through ~/.openclaw/.env. Confirm with openclaw models list --provider meta.
Community Context: A Maintenance Release With Operational Weight
OpenClaw Chronicles' coverage of the 2026.10.3 release calls 10.3 the stable consolidation point for a week of update, Doctor, Gateway, and session-durability work, and reports that npm moved the latest dist-tag to 2026.10.3 while beta advanced to 2026.10.5-beta.3.
For SEN-X clients the decision tree is short. Production: stage 10.3 on one Gateway, check saved OAuth profiles and memory files after Doctor runs, then roll out. Staging: put beta.3 on a disposable host to exercise restart recovery and the Telegram spool fix. Skills: install by provenance, not description.
This week's releases make Doctor a safer repair tool, and that should change how teams use it. Back up the auth store and MEMORY.md before repairs anyway, because 10.3 explicitly does not restore profiles already lost. Then let Doctor run. The larger risk now sits upstream: skills chosen on the strength of persuasive metadata, which no OpenClaw update can patch for you.
Need help operating OpenClaw safely?
SEN-X helps teams plan OpenClaw upgrades, channel guardrails, permission boundaries, and staged beta testing.
Contact SEN-X →