v2026.10.4

## 2026.10.4

### Highlights

- The Gateway keeps running after the computer sleeps or the system clock jumps, instead of restarting itself because its ownership heartbeat looked stale. (#170790) Thanks @AnvinaLI, @sgh6688, @waynegault, and @RomneyDa.
- Gateway shutdown and restart no longer hang on a stalled transcript worker or in-flight session lifecycle events. (#170493, #170555) Thanks @Oldrich333.
- Tlon group DMs no longer treat other participants as the owner, closing an owner-impersonation path. (#165801) Thanks @eleqtrizit.
- Headless browser pages keep responding to clicks while a site waits for a passkey. (#170857) Thanks @trukhinyuri.
- Manual `/compact` settles the active run before compacting instead of aborting it and dropping the pending request. (#166163) Thanks @holny and @alexph-dev.

### Changes

- Stability patch for 2026.10.3 with no new features or configuration changes. Thanks @RomneyDa.

### Fixes

- Gateway: stays responsive during long reply-tagged streams, and long replies that quote tool-call XML no longer re-parse Markdown on every token. (#166782, #171573) Thanks @boeingchoco.
- Gateway: blocked durable context-engine turns are logged once instead of on every run. (#167595) Thanks @jalehman.
- Control UI: delayed application heartbeats no longer force a reconnect. (#171253)
- Gateway: recover state ownership after sleep and wall-clock changes, and allow `openclaw gateway restart` from verified external macOS terminals. (#170790, #170354) Thanks @AnvinaLI, @sgh6688, @waynegault, and @RomneyDa.
- Gateway: bound transcript-worker shutdown waits and wait for session lifecycle publication during shutdown. (#170493, #170555) Thanks @Oldrich333.
- Gateway: start enabled standalone plugin files with the Gateway, and keep worker heap limits enforced when the managed service sets a process-wide heap flag. (#171330, #166581) Thanks @holgergruenhagen, @valkyriweb, @xydigitLybnnnn, @goslingmanagment, @waynegault, and @obviyus.
- Agents: launched plugin turns no longer fail with writer-claim errors, and Claude CLI sessions no longer fork history across message routes. (#170077, #167241) Thanks @cmatrx0.
- Agents: manual compaction settles the active run instead of aborting it. (#166163) Thanks @holny and @alexph-dev.
- OpenAI: tool turns for reasoning models on api.openai.com Completions routes no longer fail with a 400. (#166182) Thanks @obviyus and @AsTutoAI.
- Updates: agent databases are no longer flagged as changed during snapshot capture, the success summary stops repeating settled plugin data/settings upgrades as pending, and metadata inventory keeps running under progress-output backpressure. (#170351, #170413, #168493) Thanks @DonnieFi, @RomneyDa, and @vincentkoc.
- Updates: slow host admission no longer holds the database writer and disrupts Gateway work, progress keeps reporting through temporary Doctor maintenance, snapshot failures get an accurate headline and recovery advice, and Linux updates can clean up abandoned runtime directories under protected systemd user managers. (#171493, #171454, #171457, #171488, #170783, #166335) Thanks @RomneyDa, @DonnieFi, and @vincentkoc.
- Updates: candidate validation no longer amplifies private SQLite snapshots on live installs, older drivers stop reading candidate-migrated state and stale restart verdicts clear, and optional cron inspection or snapshot cleanup failures no longer stall updates. (#167451, #170130, #170754) Thanks @angeliti999 and @RomneyDa.
- Updates: `openclaw update repair` turns no longer time out before running tools on slower hosts; nested authority checks reuse the current state snapshot instead of copying the database again. (#166847)
- Doctor: updates no longer refuse unreferenced retired OAuth sidecars, and offline state repair works for app-owned Gateways. (#165420, #170768) Thanks @obviyus and @RomneyDa.
- Tailscale: an interrupted start stops its serve process, local access stays available when the tailnet denies Serve, and Doctor checks configured Tailscale startup prerequisites. (#167514, #171509, #166947) Thanks @pandysp and @RomneyDa.
- macOS: app recovery keeps compatible newer Gateways instead of downgrading them, and repair accepts a verified LaunchAgent bootstrap that is already in progress. (#170766, #170740) Thanks @RomneyDa.
- Sessions: equivalent POSIX path aliases such as `/tmp` and `/private/tmp` no longer restart channels. (#166462) Thanks @ericcaiwx-star.
- MCP: OAuth login completes when the authorization server registers loopback redirect URIs without a port. (#170876) Thanks @9fw2pq8sgb-art.
- Browser: headless pages accept clicks while a site waits for a passkey. (#170857) Thanks @trukhinyuri.
- Control UI: updated chats recover through the serving document. (#168941)
- Tlon: never treat group DM authors as the owner. (#165801) Thanks @eleqtrizit.
- Telegram: polling workers resolve in both source and package builds. (#154286) Thanks @xydt-juyaohui and @markfietje.
- Discord: agent consults keep working after voice changes. (#171029) Thanks @ericcaiwx-star and @brainmonger.
- Feishu: config hot-reload no longer orphans conversation bindings. (#169226) Thanks @ruel225, @junniar, and @obviyus.
- IRC: long non-ASCII replies are no longer lost when the server relays them. (#159730) Thanks @rodricksz4h5.
- Release: plugin npm publish tolerates repeated artifact pagination entries, Linux builds trigger after automatic requests with hosted-runner credentials, and ratchet checks read large Git baselines. (#171044, #167087, #167237, #164743) Thanks @RomneyDa and @shakkernerd.

### Complete contribution record

This audited record covers the complete v2026.10.3..d58dd3ceef67f10eab31d93387d2c90866b3ec93 history: 61 in-range PRs + 0 retained seed-only PRs = 61 unique PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.

#### Pull requests

- **PR #166581** Related #157575, #157630. Thanks @valkyriweb and @xydigitLybnnnn and @goslingmanagment and @waynegault.
- **PR #164743** Related #164741. Thanks @shakkernerd.
- **PR #166163** Related #166038. Thanks @holny and @alexph-dev.
- **PR #166182** Related #166125. Thanks @obviyus and @AsTutoAI.
- **PR #167087** Thanks @RomneyDa.
- **PR #167241** Related #167077. Thanks @cmatrx0.
- **PR #168493** Thanks @vincentkoc.
- **PR #168941**
- **PR #169226** Related #169190. Thanks @ruel225 and @obviyus and @junniar.
- **PR #170351** Thanks @DonnieFi and @RomneyDa.
- **PR #171029** Related #171013. Thanks @ericcaiwx-star and @brainmonger.
- **PR #171044** Thanks @RomneyDa.
- **PR #171330** Thanks @holgergruenhagen and @obviyus.
- **PR #166462** Related #166456. Thanks @ericcaiwx-star.
- **PR #170857** Thanks @trukhinyuri.
- **PR #170413** Related #170334. Thanks @RomneyDa and @DonnieFi.
- **PR #170702** Thanks @RomneyDa.
- **PR #170790** Related #169829, #170525, #170597. Thanks @AnvinaLI and @sgh6688 and @waynegault.
- **PR #170354** Thanks @RomneyDa.
- **PR #165801** Thanks @eleqtrizit.
- **PR #170876** Related #170848. Thanks @9fw2pq8sgb-art.
- **PR #159730** Thanks @rodricksz4h5.
- **PR #154286** Related #154180. Thanks @xydt-juyaohui and @markfietje.
- **PR #170077**
- **PR #170493** Related #169777. Thanks @Oldrich333.
- **PR #170555**
- **PR #167237**
- **PR #171493** Related #169260. Thanks @RomneyDa and @DonnieFi.
- **PR #171457** Related #171408. Thanks @RomneyDa and @DonnieFi.
- **PR #170783**
- **PR #171454** Related #171409. Thanks @RomneyDa and @DonnieFi.
- **PR #166335** Thanks @vincentkoc.
- **PR #171488** Related #171410. Thanks @RomneyDa and @DonnieFi.
- **PR #170766** Thanks @RomneyDa.
- **PR #170740** Thanks @RomneyDa.
- **PR #167514** Related #167436. Thanks @pandysp.
- **PR #171509** Thanks @RomneyDa.
- **PR #166947** Thanks @RomneyDa.
- **PR #167451**
- **PR #170130** Related #169422. Thanks @angeliti999.
- **PR #170754** Thanks @RomneyDa.
- **PR #165420** Thanks @obviyus.
- **PR #170768** Thanks @RomneyDa.
- **PR #160056** Related #159926, #159927. Thanks @oscarsixsecllc.
- **PR #171715** Thanks @RomneyDa.
- **PR #171747** Thanks @RomneyDa.
- **PR #163177** Thanks @RomneyDa.
- **PR #171928** Thanks @RomneyDa.
- **PR #166847**
- **PR #166782** Related #166781. Thanks @boeingchoco.
- **PR #171573** Related #171363. Thanks @boeingchoco.
- **PR #167595** Thanks @jalehman.
- **PR #171253**
- **PR #172666** Thanks @RomneyDa.
- **PR #166218** Thanks @RomneyDa.
- **PR #161543**
- **PR #168922**
- **PR #172038** Thanks @vincentkoc.
- **PR #172596** Thanks @RomneyDa.
- **PR #171952** Thanks @RomneyDa.
- **PR #172786** Thanks @RomneyDa.

### Release verification

- npm package: https://www.npmjs.com/package/openclaw/v/2026.10.4
- registry tarball: https://registry.npmjs.org/openclaw/-/openclaw-2026.10.4.tgz
- integrity: `sha512-+FH0StZF1tlTazM7JJGY6JePeJmhFNSRByi2Q3jXPRiLO7o4dJh2xa9Vy4Dk8Cd2ic8B7Zkf5NfEaCCWUkgqnQ==`
- release SHA: `383c124cc32ffee3f8e56f549b88da94d269a4af`
- full release CI report: https://github.com/openclaw/releases/blob/main/evidence/2026.10.4/release-evidence.md
- release publish: https://github.com/openclaw/openclaw/actions/runs/38827593754
- npm preflight: https://github.com/openclaw/openclaw/actions/runs/38775953219
- full release validation: https://github.com/openclaw/openclaw/actions/runs/38774938703
- plugin npm publish: https://github.com/openclaw/openclaw/actions/runs/38828956361
- plugin ClawHub publish: no normal OIDC candidates
- plugin ClawHub bootstrap: not needed
- OpenClaw npm publish: https://github.com/openclaw/openclaw/actions/runs/38824408033/attempts/1
- npm Telegram beta E2E: not supplied
- Android APK: skipped — apps/android/version.json is 2026.8.2, release train is 2026.10.4; run pnpm android:version:pin -- --from-gateway before the next tag.