An OpenClaw gateway could come back after a long outage, see abortedLastRun, and try to resume a child agent whose useful moment had passed. The public failure report describes the consequence: stale work can return late and without the context that made it sensible. The obvious fix is a clock check. The landed 16-file patch shows why that was only the beginning.
The coding-agent proof is unusually explicit. Commit trailers credit Claude Opus 4.7 and 4.8 plus Cursor on the first guard, durable finalization, retry handling, and restart-path test. Pick-cat opened the change; the branch history then shows maintainer Peter Steinberger hardening it across exact-generation ownership, persistence, and lifecycle races. This is collaborative agent-assisted engineering, not a claim that a model authored the whole patch.
A session is not a generation
OpenClaw's recovery pass now freezes one scan time and applies a shared liveness rule: two hours at minimum, or the configured run timeout plus sixty seconds when that is longer. A stale aborted run is finalized by its exact runId; a fresh one can still receive the synthetic resume message. That distinction matters when an old and new run reuse the same child-session key.
Ending the stale row also has to survive failure. The lifecycle code records a sticky interrupted-recovery owner, persists the terminal evidence before downstream projection, restores the prior row if persistence fails, and retries incomplete terminal writes. Late provider callbacks cannot reopen the decided run, and cleanup of a stale predecessor cannot kill its fresh successor.
The transferable skill
Persist the winner before you notify the world. For restart recovery, identify the exact generation, evaluate liveness from one time snapshot, durably write the terminal outcome, make projection idempotent, and only then emit output or cleanup. A session identifier is often too broad to arbitrate competing generations.
The proof is mostly tests
About 73% of the patch's 1,321 added lines are in seven test files. The new integration path uses the real registry, shared liveness policy, detached-task state, and a temporary on-disk session store. It proves that a six-hour run fails without a gateway call, a 55-second run resumes, and a fresh generation survives beside a stale predecessor. The evidence is strong for the intended state machine, but the change is only verified on main here—not as a released guarantee across every crash mode.