Verifiedon 2026.7.1-2
Action boundary
Before you act
- Expected result
- An approved update plan names target, install method, preflight evidence, restart effect, success checks, and rollback owner.
- Failure mode
- An update is run during an unexplained fault, without a clean worktree or maintenance window, and is later mistaken for a diagnosis.
- Rollback
- Do not begin the mutation; retain the before-state, stop at a failed post-check, and follow the release-specific recovery path with the service owner.
Update is a controlled change
Start read-only: openclaw update status --json identifies channel and availability; openclaw update --dry-run previews target, restart flow, and planned actions without writing config, installing, syncing plugins, or restarting. Installation method matters: package-manager and source checkout flows differ, and Nix mode disables mutating update runs.
Lab: change card
Write: current version, target/channel, install method, maintenance owner, backup/rollback reference, expected restart behavior, and pre/post commands. Pre-checks should include config validation, health evidence, and any affected channel’s scoped status. Do not use --yes until an accountable operator approves the change card.
Post-check gate
A restart-enabled package update verifies the restarted gateway version before succeeding; source updates verify gateway health and readiness after the rebuild. Independently repeat the version, config validation, health, and affected channel probe. If post-core plugin or finalization work fails after package change, openclaw update repair is the supported convergence path—but it is still a state-changing operation with its own evidence and approval requirement.
Recovery boundary
Do not downgrade casually: older versions can break configuration, and SQLite session migration has documented restoration requirements. If version rollback is not explicitly tested for this target, stop and hand off rather than improvising package commands.
Source provenanceVerification and sources
Review receipt rr_cli_safe_update
- Outcome
- approved
- Method
- source-review
- Reviewer
- forge-independent-review
- Reviewed
Evidence
- openclaw-docs-index — openclaw-main-1237c0c-cli-update; snapshot
83c0d28d7753…
Limitations
- Primary-source editorial review; no update was executed.
Lesson checkpoint
Ready to move on?
Mark this lesson complete when you can apply its outcome without relying on the examples above.