openclaw gets a memory that actually remembers — if the reflection bug doesn't eat it first

Seven days, seven releases, and the centerpiece is a new Active Memory plugin that spins up a dedicated memory sub-agent before every reply, pulling in preferences and past context without the user having to say "remember this." Pair that with the REM backfill lane that replays old daily notes into Dreams and durable memory, and @steipete's openclaw now has something approaching autobiographical continuity. The irony: issue reports confirm that memory-core embedded reflection generation has been falling back to minimal pointers since April 3, producing zero reflection files since April 8. The plumbing is beautiful; it's just been running dry. The v2026.4.10 and v2026.4.11-beta.1 releases shipped the Active Memory plugin, dreaming diary UI with timeline navigation, and a restored memory-wiki stack complete with claim-health linting and contradiction clustering — a genuinely ambitious knowledge graph, assuming the reflection pipeline gets unkilled.

The browser safety model assumed that if a navigation started from a user interaction, it was trustworthy. It wasn't. Click, evaluate, hook-triggered click, and batched action flows could all land on forbidden URLs without tripping the SSRF quarantine, because blocked-destination checks only ran on the initial request, not after interaction-driven main-frame navigations. The v2026.4.9 release (#63226, thanks @eleqtrizit) re-runs those safety checks post-navigation. A companion fix (#62660, #62663) also blocks runtime-control and browser-control override env vars from untrusted workspace .env files — because letting an untrusted dotenv override your sandbox policy is the kind of thing that sounds obvious in retrospect and terrifying in a postmortem.

If your Claude usage in codexbar looked suspiciously high, it was. Subagent JSONL logs were being counted across files, and streaming chunk deduplication wasn't catching duplicates, so token and cost figures were inflated — sometimes significantly. The v0.20 release (thanks @enzonaute for the investigation) fixes the double-counting and adds claude-sonnet-4-6 pricing. On the new-provider front, Perplexity lands with recurring, bonus, and purchased-credit tracking, Pro/Max plan detection, and browser-cookie auto-import (#449, thanks @BeelixGit). Codex itself gets multi-workspace account support with proper canonical identity reconciliation — meaning @steipete can finally switch between system accounts without the logout-login dance. Nineteen commits, five open PRs, and a filed issue noting that login state is "completely broken and persists across reinstalls." The menu bar giveth, the menu bar taketh away.