OpenClaw's updater gained an important recovery improvement Tuesday with PR #161044, titled fix(update): preserve original state before direct updates.
The P1 change focuses on what happens before a direct update or standalone Doctor repair starts moving pieces around. If an updater changes configuration, relocates state, or repairs storage before preserving the original inputs, post-failure investigation becomes harder than it needs to be.
This patch moves that preservation earlier in the flow.
What Gets Retained
The installed CLI now attempts to retain several categories of original state before direct update initialization or standalone Doctor repair:
- Original configuration and includes.
- SQLite databases.
- Declared plugin resources.
- Workshop resources.
- Refusal history and structured failure facts.
- The managed-installation context needed for later diagnosis.
Doctor continuations preserve the original reference across relocation, and update status now distinguishes manual captures from incomplete captures. The PR also notes that restoration claims require matching evidence before OpenClaw reports that an original capture was restored.
That is a useful tightening. Capture metadata is only valuable if the recovery path can explain what it captured, where it came from, and whether a later restore truly matches it.
Recovery, Not Magic Rollback
The PR is careful about the limits of the feature. These captures are manual recovery evidence, not an atomic snapshot of every active store and not an automatic rollback for legacy or full-state failures.
That distinction matters for operators. If a live system is changing while update admission begins, no simple preflight capture can freeze the entire world. What OpenClaw can do is preserve the original files and evidence it owns before it starts its own direct update path.
The change also keeps updater-local HTTP tracing deferred. Fresh updates and dry runs report that deferral, and dry-run notices go to stderr so JSON output stays parseable.
Why This Matters For Operators
Update failures are most painful when they erase the clues needed to understand the failure. The safer order is capture first, mutate second.
With this change, OpenClaw leans further into that model. If a direct update or Doctor repair cannot complete cleanly, the operator has a better chance of inspecting the original configuration, database state, plugin declarations, and recovery history that existed before the attempted change.
This is especially relevant for managed installations and hosts with complex plugin or Workshop setups. Those systems tend to have more moving parts, and recovery often depends on seeing the pre-update layout rather than only the partially migrated result.
The PR includes extensive proof notes across capture, ledger, refusal, dry-run, Doctor continuation, and managed-installation cases. It also keeps older updater limitations explicit instead of overselling the new behavior.
For self-hosters, the takeaway is straightforward: OpenClaw updates now do more preservation work before they start changing the installation, which should make failed-update diagnosis less blind.