OpenClaw Main Teaches the Gateway to Resume Work After a Hard Kill as 2026.10.10 Waits and a 2026.11.1 Beta Seals Repairs
OpenClaw main now resumes sessions interrupted by SIGKILL and profiles wedged Gateways, with a same-night fix so older abandoned runs stay stopped. 2026.10.10 stable is still untagged while a 2026.11.1 beta branch seals a repair batch. Also: leaner state database and tool schema handling, the Linux kernel CVE-2026-98432, and the tmux skill.
Main Teaches the Gateway to Pick Up Work After a Hard Kill
The biggest change on OpenClaw's main branch overnight is about what happens when a Gateway dies mid-task. Pull request #190964, which diagnoses wedged Gateways and resumes sessions after SIGKILL, merged at 12:24 AM Pacific on Monday from Peter Steinberger's account. It fixes two gaps. A Gateway stuck in an unbounded JavaScript spin had no diagnostics, and a main-session turn interrupted by SIGKILL never continued on its own.
After the change, a supported Node Gateway writes a bounded, in-progress stall profile to stderr after 30 seconds, repeating at most once a minute. In the PR's endless-spin test on Node 26.12.1, the first profile appeared at 30.266 seconds and the repeat at 90.301 seconds. Root sessions that were interrupted by an unclean restart now get one ordinary resume input, through the same eligibility and admission path that graceful restart markers already use. The PR says no configuration or schema migration is needed. It is also careful about limits: the resume "asks the agent to inspect current state before repeating work," and it "does not guarantee external tool effects exactly once."
The first version went too far, and a follow-up fixed that three hours later. Pull request #190995, which prevents restarts from reviving abandoned sessions, merged at 3:25 AM Pacific. It says #190964 could revive abandoned sessions from older Gateway lifetimes if their persisted runs were still unfinished. Crash recovery now resumes only work from the immediately preceding Gateway lifetime, using the existing boot ledger to find that lifetime's exact start and end. Older orphaned runs are recorded as stopped and can't be adopted again. The PR adds that "a recent session edit is not evidence of live work" and that missing boot history does not authorize recovery.
The OpenClaw restart recovery docs already describe the new behavior. They note that "a crash or SIGKILL cannot write shutdown markers," explain that startup now recognizes a persisted unfinished run with no live owner when it started in the immediately preceding lifetime, and repeat that the Gateway does not reconstruct or replay the old execution. The transcript stays the agent's context. The docs also say the crash-loop breaker still suppresses automatic side-service startup after three unclean boots within five minutes.
This is a real reliability gain for anyone whose Gateway gets killed by an out-of-memory killer, a container runtime or a hasty restart. Read the limits closely, though. An agent that was halfway through sending email, writing to a database or calling a paid API may repeat that step when it resumes, because the PR doesn't promise exactly-once effects. Make tools that change outside systems idempotent where you can, and check transcripts after any unclean restart. The change is on main only for now.
Follow-Up: 2026.10.10 Is Still Untagged, and 2026.11.1 Is Waiting Behind It
As of about 6:25 AM Pacific on Monday, OpenClaw 2026.10.10 stable still hasn't shipped. The OpenClaw releases page on GitHub still shows 2026.10.10-beta.5 from October 29 as the newest build, and there is no v2026.10.10 tag. The npm registry metadata for the openclaw package still reads latest 2026.10.9, extended-stable 2026.9.36 and beta 2026.10.10-beta.5.
The release branch is now 229 commits ahead of beta.5, up from 171 on Sunday morning, and it took 51 commits after our last check. Most were tests and release tooling, along with Codex unload and resume fixes, Matrix CLI exit fixes and a cron startup fix. One user-facing fix was carried over from main: a cherry-pick of the Allow Once exec approval fix from pull request #176413, landed at 12:35 AM Pacific. The original PR says commands approved with Allow Once could be refused with "Exec approval policy is unavailable or changing before execution" when approval bookkeeping overlapped their final policy check, while a real policy change still refuses a stale approval. The branch was still changing as we checked. At 6:20 AM Pacific, maintainer Dallin Romney reverted a Gateway fix that rereads models.list after a superseded catalog generation, a fix the branch had picked up only about three and a half hours earlier.
A second train is lined up. The release/2026.11.1 branch has been stamped 2026.11.1-beta.1 since an October 29 commit titled "prepare 2026.11.1-beta.1." At 7:42 PM Pacific on Sunday it recorded a "seal qualification repair batch" commit on the 2026.11.1 branch, right after cherry-picks including the state database clone fix described below. No v2026.11.1-beta.1 tag exists, and npm doesn't list that version. We don't have a date for either release.
With 2026.10.10 stable still gated and a 2026.11.1 beta already sealing repairs behind it, teams might be tempted to jump straight to whichever train ships first. Don't plan around branches. Pin 2026.10.9 or 2026.9.36, watch the npm latest and beta tags, and read the release notes when a tag actually appears. If Allow Once refusals have been interrupting your operators, that fix is on the 2026.10.10 branch, so that release is the one to wait for.
Main Cuts Waste Around the State Database and Tool Catalogs
Several overnight merges target resource use on busy Gateways. Pull request #190761, which stops cloning the state database for Gateway RPC commands, merged at 5:35 PM Pacific on Sunday. It describes RPC-only CLI commands cloning the whole shared state database at startup once a Gateway had held its lock for more than five minutes and plugin source captures existed. On one reported btrfs install, an 11.8 GB database with about 555,000 extents made those repeated reflinks costly enough to stall unrelated writers, including Gateway WAL commits. Commands such as openclaw team-reports list can now check the live Gateway's readiness without copying its database, with no configuration or CLI contract changes.
Pull request #191099, which avoids copying tool schemas into every session, merged at 5:08 AM Pacific. Each session's tool checkpoint had been recopying schema strings that were already published, which raised retained memory. Sessions with large tool catalogs now keep less duplicate metadata, while provider tool definitions and transcript bytes stay unchanged.
For plugin authors, pull request #190919, which explains why a tool is or isn't available, merged at 4:59 AM Pacific. Plugins gain api.runtime.agent.explainToolAvailability. It replays the real final policy pipeline and reports whether a tool is blocked, at which stage (deny, harness, model, sandbox, profile, provider policy, allowlist or session), the config source, and a suggested fix. The PR says there is no user-visible change for Doctor or /learn, which now share the same diagnosis code.
Two smaller fixes affect credentials and routing. Pull request #190988, which lets Bedrock Mantle use ambient AWS credentials at runtime, fixes Mantle requests that failed with an invalid bearer token when configured with auth: "aws-sdk". Users can now rely on the AWS default credential chain, and explicit bearer credentials keep their precedence. Pull request #190863, which rejects ambiguous capability-scoped request paths, now returns HTTP 400 for scoped URLs whose inner path starts with repeated slashes or backslashes. Before, route checks and handlers could read the same request as two different paths.
Security Tip: Patch the Kernel Under Self-Hosted Linux Gateways for CVE-2026-98432
Posts on X overnight tied a Linux kernel bug to OpenClaw, and we checked it against primary sources before including it here. The bug is real, but it's in the host kernel, not in OpenClaw. The NVD entry for CVE-2026-98432 describes a use-after-free in IPv4 TCP request-socket handling, where a retransmitted SYN processed on another CPU can read IP options after the child socket has freed them. The fix moves those frees behind an RCU grace period. NVD lists a CNA-supplied CVSS 3.1 score of 9.8, network-reachable with no privileges or user interaction, and the record's status is still "Received."
The Go security team's oss-security advisory on CVE-2026-98432 says a demonstrated exploit reached remote code execution against a server with a Multipath TCP listener. It adds that the underlying bug is not specific to MPTCP, and that Go programs since Go 1.24 enable MPTCP by default on Linux listen sockets. Its central advice: "The best fix for this vulnerability is to upgrade to a patched kernel version."
- On every Linux VPS or server running a Gateway, install your distribution's kernel update that includes the stable fixes linked from NVD, then reboot. A package update without a reboot leaves the old kernel running.
- Check
uname -rafter the reboot. Then runopenclaw gateway statusto confirm the Gateway came back. - The Go team calls per-program MPTCP disabling, such as
GODEBUG=multipathtcp=0for Go sidecars, "a fragile mitigation." Use it only as a stopgap until the kernel is patched. - Containers run on the host's kernel, so updating a container image doesn't fix this. On managed hosting, ask your provider whether the host kernel is patched.
Skill Card: tmux, for Agents That Need a Real Terminal
This week's skill is tmux. It suits today's theme, since much of a Gateway's long-running work happens in interactive terminals. The bundled tmux SKILL.md in the OpenClaw repository describes it as a way to "control tmux sessions/panes for interactive CLIs: list, capture output, send keys, paste text, monitor prompts." It runs on macOS and Linux only and needs the tmux binary, with a Homebrew install option.
- When to use it. The skill limits itself to existing interactive tmux sessions. For one-shot commands it says to use the normal shell, and for new non-interactive background jobs, background execution.
- Safe input. It tells agents to send arbitrary text with
send-keys -l --and to send Enter separately, to "avoid paste/newline surprises." - Prompt checks. Agents capture the pane and search for prompts such as "proceed" or "permission," and the skill says to approve or select "only when the prompt is understood."
- The ClawHub version. The tmux skill listing on ClawHub by Peter Steinberger installs with
openclaw skills install @steipete/tmux. It uses a dedicated socket directory, prints monitor commands after starting a session, and shows tmux running several coding agents, such as Codex and Claude Code, in parallel.
tmux gives an agent a keyboard on a live terminal, so treat it like exec access. The bundled skill's rule to approve only prompts the agent understands is the most important line in it. For production Gateways, keep agent sessions on a dedicated socket as the ClawHub version does, so an agent can't type into an operator's own shell. The OpenClaw skills loading-order docs say the highest source wins when two skills share a name, and bundled skills rank below workspace and managed ones, so an installed copy named tmux would replace the bundled guidance.
What to Watch Next
First, the v2026.10.10 tag and the npm latest move, which bring the Allow Once approval fix along with the Codex and Bun changes we covered earlier. Second, whether 2026.11.1-beta.1 is tagged once 2026.10.10 ships. Third, whether crash resume from #190964 and #190995 and the state database clone fix reach a release; the clone fix is already on the 2026.11.1 branch. We'll recheck both tags on our next run.
Hardening your Gateway?
SEN-X helps teams plan OpenClaw upgrades, patch and monitor self-hosted Gateway hosts, and make agent tools safe to resume after crashes and restarts.
Contact SEN-X →