OpenClaw pushed dreaming, memory-wiki, and hardening to the front

This week’s story is not generic polish. The team itself emphasized dreaming UX, memory-wiki as a real knowledge layer, Android pairing recovery, and security hardening. Releases covered: v2026.4.9, v2026.4.8, v2026.4.7, v2026.4.5

The release narrative, according to @openclaw

• Dreaming got productized: REM backfill, diary timeline UI, and more visible memory flow became headline material.
• memory-wiki graduated into a real knowledge layer, with enough importance to earn its own separate X post.
• Security hardening was not buried: SSRF and node exec injection protection were called out directly.
• Android pairing recovery mattered enough to headline, which means onboarding friction is still a live focus area.
• 2026.4.8 was basically a correction release: packaging issue, compatibility fix, verification script tightened.

Dreaming stopped feeling like a hidden feature

• Structured diary timeline UI, backfill/reset controls, traceable dreaming summaries, and a grounded Scene lane make memory activity legible instead of mystical.
• `memory-wiki` came back as a bundled stack with sync/query/apply tooling, compiled digests, contradiction clustering, staleness dashboards, and freshness-weighted search.
• The separate `@openclaw` post about memory-wiki is the giveaway: this is not just a plugin comeback, it is part of the product thesis.

"Memory features seem to be the next big unlock"

This is what was missing. A real quote, plus the actual post image, so the slide feels like a reaction from the ecosystem instead of narrator commentary pretending to be one.

The useful part is not just the praise. It is the framing: memory is where serious agent work gets interesting.

"Second 🚢 of the day" is the whole vibe

• Short post, but honestly perfect.
• It tells you how maintainers and power users are reading the project now: fast cadence, frequent drops, less ceremony.
• That is why a cleanup release like 2026.4.8 does not feel embarrassing. It feels normal for a team shipping in public at this pace.

Security and safety

• Plugins/provider-auth: let provider manifests declare `providerAuthAliases` so provider variants can share env vars, auth profiles, config-backed auth, and API-key onboarding choices without core-specific wiring.
• Browser/security: re-run blocked-destination safety checks after interaction-driven main-frame navigations from click, evaluate, hook-triggered click, and batched action flows, so browser interactions cannot bypass the SSRF quarantine when they land on forbidden URLs.
• Security/dotenv: block runtime-control env vars plus browser-control override and skip-server env vars from untrusted workspace `.env` files, and reject unsafe URL-style browser control override specifiers before lazy loading. (#62660, #62663)
• Plugins/onboarding auth choices: prevent untrusted workspace plugins from colliding with bundled provider auth-choice ids during non-interactive onboarding, so bundled provider setup keeps operator secrets out of untrusted workspace plugin handlers unless those plugins are explicitly trusted.

Plugins and ecosystem

• Plugins/provider-auth: let provider manifests declare `providerAuthAliases` so provider variants can share env vars, auth profiles, config-backed auth, and API-key onboarding choices without core-specific wiring.
• Plugins/onboarding auth choices: prevent untrusted workspace plugins from colliding with bundled provider auth-choice ids during non-interactive onboarding, so bundled provider setup keeps operator secrets out of untrusted workspace plugin handlers unless those plugins are explicitly trusted.
• Bundled plugins: align packaged plugin compatibility metadata with the release version so bundled channels and providers load on OpenClaw 2026.4.8.
• Memory/wiki: restore the bundled `memory-wiki` stack with plugin, CLI, sync/query/apply tooling, memory-host integration, structured claim/evidence fields, compiled digest retrieval, claim-health linting, contradiction clustering, staleness dashboards, and freshness-weighted search.

Models and providers

• QA/lab: add character-vibes evaluation reports with model selection and parallel runs so live QA can compare candidate behavior faster.
• Agents/progress: keep `update_plan` available for OpenAI-family runs while returning compact success payloads and allowing `tools.experimental.planTool=false` to opt out.
• CLI/infer: add a first-class `openclaw infer ...` hub for provider-backed inference workflows across model, media, web, and embedding tasks.
• Providers/Google: add Gemma 4 model support and keep Google fallback resolution on the requested provider path so native Google Gemma routes work again.

Mobile and browser

• iOS: pin release versioning to an explicit CalVer in `apps/ios/version.json`, keep TestFlight iteration on the same short version until maintainers intentionally promote the next gateway version, and add the documented `pnpm ios:version:pin -- --from-gateway` workflow for release trains.
• Android/pairing: clear stale setup-code auth on new QR scans, bootstrap operator and node sessions from fresh pairing, prefer stored device tokens after bootstrap handoff, and pause pairing auto-retry while the app is backgrounded so scan-once Android pairing recovers reliably again.
• iOS/exec approvals: add generic APNs approval notifications that open an in-app exec approval modal, fetch command details only after authenticated operator reconnect, and clear stale notification state when the approval resolves.

API and performance

• Matrix/gateway: wait for Matrix sync readiness before marking startup successful, keep Matrix background handler failures contained, and route fatal Matrix sync stops through channel-level restart handling instead of crashing the whole gateway.
• Telegram/setup: load setup and secret contracts through packaged top-level sidecars so installed npm builds no longer try to import missing `dist/extensions/telegram/src/*` files during gateway startup.
• Bundled channels/setup: load shared secret contracts through packaged top-level sidecars across BlueBubbles, Feishu, Google Chat, IRC, Matrix, Mattermost, Microsoft Teams, Nextcloud Talk, Slack, and Zalo so installed npm builds no longer rely on missing `dist/extensions/*/src/*` files during gateway startup.
• Gateway/sessions: add persisted compaction checkpoints plus Sessions UI branch/restore actions so operators can inspect and recover pre-compaction session state.