Bug type

Regression (worked before, now fails)

Beta release blocker

No

Summary

sessions_spawn with runtime=subagent fails 100% of the time with WebSocket 1008 "pairing required" after upgrading to v2026.4.1.

Steps to reproduce

1. Have OpenClaw v2026.4.1 running with a local gateway (systemd user service)
2. From the main agent session, call sessions_spawn with runtime="subagent" and any task
3. Observe immediate failure with error: "gateway closed (1008): pairing required"
4. Gateway logs show: "security audit: device access upgrade requested" → "gateway connect failed: GatewayClientRequestError: pairing required"
5. Pattern: gateway-client requests scope-upgrade from operator.read to operator.admin, gateway responds with "pairing required"

Expected behavior

Sub-agent spawns successfully and begins processing the assigned task in a background session.

Actual behavior

Sub-agent spawn fails immediately with WebSocket code 1008 "pairing required". No sub-agent session is created. Gateway logs show the gateway-client fails to connect because the scope upgrade from operator.read to operator.admin is denied with "pairing required".

OpenClaw version

2026.4.1 (213a704)

Operating system

Linux Debian 13 (Trixie)

Install method

npm global

Model

minimax-m2.7:cloud

Provider / routing chain

Ollama (cloud) — model served via Ollama Cloud using minimax-m2.7

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Gateway log output (redacted):
[gateway] security audit: device access upgrade requested reason=scope-upgrade device=<REDACTED> ip=unknown-ip auth=token roleFrom=operator roleTo=operator scopesFrom=operator.read scopesTo=operator.admin client=gateway-client conn=<REDACTED>
gateway connect failed: GatewayClientRequestError: pairing required
[ws] closed before connect ... code=1008 reason=pairing required
Gateway target: ws://127.0.0.1:18789
Source: local loopback
Config: ~/.openclaw/openclaw.json
Bind: auto
Sessions API response: {"ok":false,"error":"GatewayClientRequestError: pairing required","code":1008}

Impact and severity

• Affected: OpenClaw users relying on sub-agent spawning for background tasks
• Severity: High — blocks all sub-agent workflows (long-running tasks, research, code generation)
• Frequency: 100% reproducible on every spawn attempt
• Consequence: Sub-agents cannot be spawned. All multi-step tasks must run inline in the main session, increasing memory pressure and blocking the main agent during long operations.

Additional information

Regression: broken since approximately v2026.3.28 or earlier. Issue #58085 shows sub-agents were already failing in v2026.3.28 with a different error (agentId is not allowed for sessions_spawn). The v2026.4.1 changelog mentions fix #59092 which addresses pairing-required errors for exec/node clients, but the sub-agent code path (gateway-client escalating to operator.admin) remains broken.

Attempted fixes (none resolved the issue):

• Gateway restart via 'gateway restart' tool
• Gateway restart via 'systemctl --user restart openclaw-gateway'
• Full update from v2026.3.31 to v2026.4.1 via 'openclaw update'
• Multiple restart cycles after update

A related issue #59393 "Subagent tool calls never execute" is also open as a regression. The root cause may be shared (both involve sub-agent session management failing).

Workaround: None reliable. Long-running tasks must run in the main session.