v0.54.1.0

Your brain has safer repairs and working managed-memory paths.

Keeping a brain current should not require guessing whether a note was saved,
whether a background job is stuck, or whether a backup can actually be read.
This release names blocked work and provides deliberate recovery steps. Health
checks report proposed repairs instead of executing them, and forced migration
previews no longer change the database or migration history.

Managed brains can extract facts into existing entity pages, create atoms,
import Google and GitHub content, and run the supported local synthesis,
patterns and consolidation paths without bypassing their writer protections.
Accepted extraction output can be replayed without another model call. Missing
search data has a separate, preview-first repair with an explicit source and
cost limit. Failed embedding work stops after bounded attempts instead of
retrying forever.

Backup status now distinguishes a configured destination from a recently
verified remote copy. OpenClaw startup and current-turn context handling are
also corrected, and new Apple-silicon release binaries receive a signature
check before execution and publication.

How to inspect before repairing

gbrain sources writer status --json
gbrain backup check --json
gbrain embed --stale --facts --source source-example --dry-run --json

Replace the example source with the one you intend to inspect. None of these
commands authorizes an ownership transfer or a paid repair.

Situation	What you can now see or do
A managed sync file fails	Inspect the source, file, receipt and pinned run, then explicitly retry the corrected input.
An embedding effect exhausts its retries	Reconcile already-complete vectors or authorize one additional bounded cycle for the original request.
A backup destination disappears	See failed or unknown evidence instead of treating configuration as a verified backup.

Things to watch

Stop and drain older writers before upgrading a managed deployment, then
restart its owners and workers together. PGLite inline maintenance still needs
exclusive access: gracefully stop its owner/supervisor, complete the local job,
then restart it. Live fact extraction and fact-vector repair have resident IPC
routes; this is not live-owner delegation for every dream command.

Only the named managed paths are restored. Legacy cycle fence reconciliation,
bulk conversation extraction/backfill and Google loop extraction refuse before
provider work. Private facts are not promoted by managed consolidation. Git
verification covers committed files, not a complete database restore. Native
macOS 26.2 checks passed; macOS 27 certification, native Windows backup behavior
and the reported aged-store reindex hang remain separate verification limits.

To take advantage of v0.54.1.0

Follow the managed-upgrade and recovery instructions.
The new repair commands are opt-in; upgrading does not approve a backfill,
ownership change, service installation or model spend. Existing OpenClaw users
must inspect the context-engine slot and use gbrain-context-engine on current
hosts. Keep the original installation and a verified full backup until the
upgraded owner has reopened and the scoped readback checks pass.

Itemized changes

• Managed writer administration normalizes large counters before IPC, adds
  reviewed same-owner recovery for device/marker drift, identifies incomplete
  onboarding, and allows explicit exact dead-local-lock cleanup without a
  timeout-based takeover.
• Managed sync records durable, deduplicated failure evidence, preserves
  unfinished cursors, reports it through CLI/doctor, and performs explicit
  fresh admission without mutating terminal receipts or hiding another run.
• Coordinated fact/atom publication retains source authority, private
  visibility, accepted output and completion receipts. Named local maintenance
  retains publication results and consolidates semantic evidence atomically;
  retired takes leave facts unconsolidated.
• Google/GitHub connectors use guarded imports, deletion and checkpoint CAS.
  Unbound API sources explicitly publish to the database; bound sources retain
  canonical file publication. Restarted sync recovers retained publication;
  explicit --retry-failed replaces a failed attempt without changing its old
  receipt or resetting the API bookmark. Google embedding requests respect the
  100-item provider limit.
• Fact reconciliation preserves valid existing vectors on failed embedding
  and cancellation while retaining privacy/withdrawal changes. Explicit
  null-vector backfill validates source, model, row version, selected-brain
  policy and budget before installing projections.
• Embedding effects check actual vector provenance, avoid re-embedding complete
  chunks, retain lifetime attempt accounting, and atomically complete vectors
  with their effect. Readback and explicit retry remain source/authority-bound.
• Backup checks use bounded, rotating remote-ref readback and expiring evidence.
  Directory durability uses the narrow Windows error guard without swallowing
  regular-file or unexpected I/O failures.
• Retrieval output reuses the canonical credential scanner without changing
  ranking or opaque identity. This is bounded display hygiene, not a guarantee
  about all secret formats or earlier provider/evaluation inputs.
• OpenClaw supports zero-argument factories, canonical slot registration and
  separate current-turn prompts. Release executables use Bun 1.4.2; required
  native checks retain older runtimes and add real pinned-host startup coverage.
• Forced previews are read-only, failed migration phases remain retryable, and
  installer fixtures no longer overwrite live autopilot files. A detection
  guard reports accidental real-home changes during tests.

Contributed by @olivershe (garrytan#5171), @javieraldape (garrytan#5220), @sheelcheyne (garrytan#5000),
@haumanto (garrytan#5132), @thiagosian (garrytan#5201), @Masashi-Ono0611 (garrytan#5314, garrytan#5352, garrytan#5355),
@VXNCXNX (garrytan#5322), @Mr-B-1 (garrytan#4867), @turian (garrytan#5305),
@rokas-tarasevicius (garrytan#5287), and @lubosxyz (garrytan#5348). Their focused contributions
were adapted to the current persistence and source-identity contracts.