OpenClaw merged the next foundation piece for durable node-host worker execution. PR #122829, titled "feat(node-host): supervise durable worker launches," adds a private worker supervision boundary that can keep node-runner work owned by the node-host process instead of tying it to a fragile control WebSocket request.
This PR does not expose a finished user-facing runner command on its own. It is still a major infrastructure step because it creates the lifecycle owner needed for paired devices to host complete session turns safely in later milestone slices.
The Problem With Request-Owned Work
The current node.invoke lifecycle is request-shaped. That is fine for short calls, but durable worker turns need stronger guarantees. A node control WebSocket can reconnect. A host process can restart. A worker process can outlive the request that launched it. A terminal result can arrive after a disconnect.
If the request owns all of that directly, OpenClaw cannot safely recover or reap the worker tree after reconnects and restarts. It also cannot prove that a recovered process is still the same worker rather than a reused PID or unrelated descendant.
What The New Boundary Adds
The new node-host supervision layer records worker launch identity in a lazy same-v6 SQLite journal. It tracks launch, supervisor, and worker identity without persisting the worker credential. Exact-plan launch IDs are idempotent, while changed replays fail closed.
Worker startup now waits behind private Node child-process IPC until the PID and start identity are durable. From there, the IPC channel binds worker lifetime to the node-host process. POSIX workers get separately signalable process groups, while Windows teardown continues through the existing taskkill /T tree-kill path.
The PR also adds several safety controls:
- PID-reuse-safe owner checks before recovery decisions
- Recovery that adopts or interrupts work only after confirmed worker-tree death
- Terminal outcomes held under active ownership until SQLite CAS commits
- Bounded stdout, stderr, and durable diagnostics
- Credential redaction even when secrets cross the stderr cutoff
- Runtime environment isolation from ambient provider, channel, Gateway, proxy, config, and state credentials
Why It Matters
Durable worker execution is one of the harder parts of making remote and paired-device agents feel reliable. Users expect a long-running turn to survive brief control-plane interruptions, but they also expect abandoned work to be killed cleanly and secrets to stay out of logs.
This PR is OpenClaw drawing that boundary at the process owner instead of the transient transport. That is a better fit for work that may span reconnects or need restart reconciliation.
Verification
The evidence in PR #122829 covers macOS focused lifecycle tests, Linux real-process tests, changed gates, full build, schema checks, runtime sidecar checks, import-cycle checks, autoreview, and TruffleHog. The Linux run specifically covered owner death, worker and grandchild termination, cancel/close teardown, and foreign live launch replay behavior.
The PR notes one proof gap: native Windows execution of IPC disconnect, process-start identity, and taskkill /F /T descendant teardown was not available. The implementation reuses existing Windows primitives, while macOS and Linux behavior were executed end to end.
The Bottom Line
PR #122829 is not a flashy feature button yet. It is the durable process-control layer that makes a future feature button safer. That matters because reliable paired-device workers need ownership, recovery, bounded logs, and teardown before they need marketing polish.