OpenClaw 2026.10.5 Goes Stable With the Nested-Effect Doctor Fix, but Most Update-Hang Fixes Are Still Waiting
Stable 2026.10.5 landed Sunday afternoon with self-recovering updates, a stricter rule for tool-approval hooks, and the nested-effect Doctor fix. Beta.2 carries only one of the four bounded-wait fixes for the open hang reports. Plus: check that policy plugins fire under openclaw agent exec, and ClawSecCheck re-grounds on 10.4.
Stable 2026.10.5 Arrives After a Week of Betas
OpenClaw's next stable release is out. The OpenClaw 2026.10.5 release notes on GitHub were published at 2:47 PM Pacific on Sunday, October 18, and npm's latest tag now points at 2026.10.5. Extended-stable stays on 2026.9.33. The first highlight is the one stable fleets have waited for: openclaw update is described as finishing across devices, filesystems, pnpm 12, Windows elevation and macOS login shells, settling stale handoff leases and package-activation journals instead of stranding the install, and no longer letting a busy or unhealthy Gateway block the update. --no-restart package updates now record success honestly instead of reporting a failure.
Most of the other headline features were in the 2026.10.5 betas we tracked last week and are now in stable: conversations and subagent work that resume after a Gateway restart, session and history reads moved onto worker threads, the X mentions channel plugin with API cost limits, voice-call briefs and voicemail detection, recommended-first model pickers, and ClawHub browsing inside the Gateway. Google users should note that the release makes Gemini 4 Argon the default Google model. One packaging caveat sits in the release verification section: the Android APK was skipped for this tag because the app's version file still reads 2026.8.2.
This is a large stable release built mostly around update and restart reliability, which is exactly the area that has hurt operators this month. Move one canary host first, confirm a full update and Gateway restart cycle completes on its own, then roll the rest. If you depend on the Android app, plan for it to stay on its current build for now.
Two Changes That Can Break Existing Setups
The release lists two compatibility changes that are easy to miss in a very long changelog. The first comes from pull request #142700 preventing tool parameter changes after approval. Ordinary before_tool_call hooks can no longer rewrite tool arguments after a trusted inline approval. A plugin that transforms arguments must request a separate approval for its final arguments, or the call is blocked. The OpenClaw tool-side hooks and tool call policy guide gives the exact error, "Tool call parameters changed after trusted approval," and says the first approval does not authorize the replacement arguments.
The second is a runtime floor. Plugin admission in 2026.10.5 rejects official Codex runtimes older than 2026.9.7, with update and repair guidance, and keeps incompatible plugins inspectable without importing them. Anyone who pinned an older Codex runtime on purpose will see that plugin refused after the upgrade, not silently loaded.
The approval change is the right rule: what a person approved should be what runs. It will still surprise teams with in-house plugins that quietly normalize paths or add flags after approval. Search your plugins for before_tool_call handlers that return params, and test each one against an approved call before the upgrade reaches production.
Release Watch: The Doctor Fix Shipped, Most Hang Fixes Did Not
We have tracked the nested-effect Doctor fix for a week. It is now in stable: the 2026.10.5 notes list "Doctor cleanup during updates no longer fails with nested-effect errors" under update cleanup and exit, citing pull request #170070 fixing nested-effect errors in Doctor cleanup and issue #168750.
The newer fixes for hanging update and Doctor runs are a different story. None of the four pull requests we covered on Sunday (#173862, #174060, #174898 and #176131) is named in the 2026.10.5 notes. The OpenClaw 2026.10.10-beta.2 release notes, published at 5:23 AM Pacific today and now on npm's beta tag, name only #173862, which bounds the post-activation Doctor step by the update's time allowance. The status-inspection deadline (#174060), the Doctor SIGTERM fix (#174898) and the 30-second maintenance wait for managed Git updates (#176131) are merged on main but not in either release's notes. Both P1 reports, issue #173764 on update hanging in post-activation Doctor and issue #174842 on doctor --fix looping with the Gateway running, were still open this morning.
Beta.2 carries other useful fixes. Following pull request #160409 making multi-file apply_patch reject before writing, a patch whose later target is missing or mismatched now fails before any file changes, though the notes say commit-time I/O failures can still leave partial effects. It also stops a SIGBUS crash loop when session diff capture touched live SQLite files (#174017), keeps large cron histories from exhausting the SQLite worker's memory (#174530), and stops Windows Claude CLI turns stalling when Claude Code never reads the credential pipe (#174571).
For stable fleets, 2026.10.5 is the upgrade that finally removes the nested-effect Doctor failure, but it does not add the bounded waits for the two open hang reports. Keep the habits from last week: stop the Gateway before doctor --fix, watch updates live, and capture a process sample before killing anything that stalls.
Offline-Maintenance Lock Reports Draw New Fixes on Main
A separate cluster of reports involves commands that refuse to run because state is "undergoing offline maintenance." On native Windows, a P0 report against 2026.10.3 and 2026.10.4 found every state command failing on a fresh install because the command could not find its own schema lease. Pull request #176174 unblocking fresh Windows state initialization fixed that at 3:08 AM Pacific on Sunday by keying ownership to one canonical database identity, so Windows path spelling changes no longer orphan the lease.
At 4:27 PM Pacific, after 2026.10.5 was published, maintainers merged pull request #176548 making Gateway startup wait for offline maintenance. Startup previously exited when a live maintenance process held shared state, which caused service restart churn. It now uses its existing five-minute admission budget, reports the holder's PID and role every 30 seconds, and never kills the maintenance owner. The pull request is explicit that a broader shutdown-maintenance theory in the related report remains unverified.
Still open is issue #176300 on mixed-version writers corrupting the state database, a P1 data-loss report filed at 10:16 AM Pacific on Sunday. Its reporter describes an Ubuntu fleet upgrading from 2026.10.2 to 2026.10.4 while an older CLI or SDK writer stayed resident, and says the next clean start failed with a missing index row and exit 78, damage that was REINDEX-repairable. The automated triage review kept the issue open but called the proposed corruption mechanism unverified and said the mixed-version advisory does not actually detect competing writers. No fix pull request is linked yet.
Whatever the root cause of #176300 turns out to be, treat version swaps as a single-writer operation. Stop cron jobs, scripts and older CLI processes that write OpenClaw state before you upgrade the Gateway, then update the CLI on every host that talks to it. Back up the state directory first, because a repairable index is still an outage at the wrong moment.
Security Practice: Prove Your Tool Guards Fire in Headless Runs
Policy plugins were skipped under openclaw agent exec before this fix
One line in the 2026.10.5 security boundaries section matters for anyone who runs agents from scripts or CI. According to pull request #159333 on before_tool_call hooks skipped under agent exec, plugin before_tool_call hooks never ran when an agent was started with openclaw agent exec, so "a policy plugin that blocks a tool call is silently skipped and the call goes through." The headless run never created the global hook runner. The fix, which closes issue #158824, is listed in both 2026.10.5 and 2026.10.10-beta.2.
The tool call policy reference explains why a test matters: block: true is terminal, block: false counts as no decision, and a hook that is never dispatched decides nothing at all.
- Upgrade hosts that run
openclaw agent execto 2026.10.5 before relying on plugin guards in those runs. - After upgrading, run one headless job that tries a command your guard should block, and confirm the block appears in the run output.
- Run
openclaw security audit --json, which warns when installed plugin tools may be reachable under permissive tool policy. Note that--fixonly tightens policies and file permissions; it does not rotate keys or remove plugins.
Audit behavior is documented in the OpenClaw security audit CLI reference. Plain security audit stays on the read-only config path; --deep adds live Gateway checks and plugin-owned audit collectors.
Skill Card: ClawSecCheck Re-Grounds on OpenClaw 2026.10.4
ClawSecCheck v4.4.1, a local read-only security audit skill
The community project behind the ClawSecCheck read-only OpenClaw security scanner on GitHub shipped v4.4.1 at 11:28 AM Pacific on October 16, re-grounding its checks on OpenClaw 2026.10.4. The MIT-licensed tool installs as a skill with openclaw skills install @gl0di/clawseccheck or as a standalone Python CLI. Its README says the scanner makes no network calls, never changes your OpenClaw config, skills or bootstrap files, and writes only its own history under ~/.clawseccheck/.
The README lists 229 checks covering exposure, privilege, installed skills and plugins, prompt-injection surface, secrets at rest and monitoring. It also runs OpenClaw's native audit and inspects bootstrap files such as SOUL.md and AGENTS.md, which it says the built-in audit does not cover. For CI, clawseccheck --json, --sarif and --fail-on <severity> are available. The project notes that a clean report means no known pattern matched, not that a setup is provably safe.
A second, offline opinion is a reasonable addition to openclaw security audit, especially for bootstrap files that go straight into model context. Remember that a security skill is still third-party code you are installing. Pin a release tag, read what it reads, and expect it to lag 2026.10.5 until the maintainer re-grounds it again.
Rolling OpenClaw 2026.10.5 across a fleet?
SEN-X helps teams canary OpenClaw upgrades, audit plugins for the new approval-hook rule, serialize state writers during version swaps, and verify tool guards in headless runs.
Contact SEN-X →