---
title: "The Brain Swap: Ten Backups, One Insurance Card, No Standby Factory"
date: 2026-08-27
description: "E18: swapping the factory's primary model while it runs — a transplant at age 2 hours, a 139-day gap, and an evening double-swap with a rollback card."
category: "AI & Compute"
tags:
  - "One Man One Legion"
  - "AI Agents"
  - "Model Migration"
  - "Config Management"
  - "LLM Ops"
verifiedHardware: "Workstation ~/.openclaw/ (read 2026-08-27): ten-file openclaw.json layer (live 7,540 B + rolling .bak/.bak.1-.4 + named backup-glm5 03-29 10:53 2,459 B / backup-before-glm51 03-29 12:51 2,834 B / backup-before-glm53 08-15 21:05 6,109 B / backup-0818-notify 08-18 12:32), each parsed for primary/fallback/catalog fields; backup-glm5 verified oldest file in ~/.openclaw; json-diff of .bak.4 (21:18) vs .bak.3 (21:27) isolates the zai-anthropic test entry; ~/.openclaw/workspace/memory/2026-08-15.md (CC upgrade 20:52-21:00, OC upgrade 21:08, four-item self-upgrade protocol, insurance card, test≠deployment correction, provider-side 5.2→5.3 reroute note) and 2026-08-18.md (Q38 registration 18:40, supportsTools flag, alias rule); ~/.claude/ settings strata (backup-20260329-115755, backup-before-glm53 08-15 20:54); article counts via ls|wc -l in wechat-editor-team/articles/ (20 on 08-15, 1 on 08-16, 6 on 08-17); July 3 diary for the 5.2-as-default waypoint · timestamps Asia/Shanghai"
keyTakeaways:
  - "The backup strata read like tree rings: ten openclaw.json files, the oldest of them the platform's birth certificate (2026-03-29 10:53, 2,459 bytes against today's 7,540) — and the first brain transplant landed 118 minutes after birth, glm-5 to glm-5.1, staged in the catalog before the flip."
  - "One link in the chain has no named grave: 139 days separate the before-glm51 and before-glm53 backups, and somewhere in that silence glm-5.2 became primary without ceremony — the honest gap that argues for the protocol that came later."
  - "The 5.3 swap of August 15 is the textbook run: twenty articles shipped on the day shift, then a two-stage evening surgery (Claude Code 20:52, OpenClaw itself 21:08) under a four-item protocol — dual-route precheck, named backup, the rollback command handed to the human before the self-restart, fallback chain frozen — and the factory shipped one article the next day and six the day after."
measuredOn: 2026-08-27
faq:
  - q: "Isn't swapping the primary model reckless when chat rooms and scheduled jobs all depend on it?"
    a: "That is exactly what the untouched fallback chain is for. The rule logged in the migration diary freezes the local 9B as the bottom rung during the swap, so a failed first call on the new model degrades the fleet instead of killing it. What the fallback cannot cover — the restart itself going wrong — is what the insurance card covers: the rollback command reaches the human before the agent reboots itself."
  - q: "The provider was already answering glm-5.2 requests with glm-5.3 — wasn't the local flip pointless?"
    a: "No, and the diary is careful about this. The reroute was a side discovery, not a plan: requests for 5.2 came back labeled 5.3 on both routes. The local flip still mattered because the two routes bill differently, and because a config that says one model while serving another is a lie waiting to trap the next migration. The flip made the intent explicit and was verified against the real endpoint."
---
*[Episode 18 of One Man One Legion](/posts/2026-08-27-one-man-one-legion-fleet-audit/) — fourth stop in the engine-room arc, after [the mini-agent](/posts/2026-08-27-one-man-legion-ep16-mini-agent/), [the model stable](/posts/2026-08-27-one-man-legion-ep14-model-stable/), and [the model exam](/posts/2026-08-27-one-man-legion-ep17-model-exam/). The exam graded the newest local horse. This one is about the cloud brain itself — and what it takes to replace it while the factory keeps running.*

Every factory fears the day its brain must come out. This fleet has swapped its primary model at least three times — glm-5 to 5.1 to 5.2 to 5.3 — with no twin factory to fail over to, no maintenance window, and no operations team. The whole history sits in one directory: ten `openclaw.json` files, stacked like strata.

## The strata

The layer holds 10 files: the live config, 5 rolling backups (`.bak` through `.bak.4`, the platform breathing on its own), and 4 with names — `backup-glm5`, `backup-before-glm51`, `backup-before-glm53`, `backup-0818-notify`. Rolling backups are routine; named backups are decisions. The oldest file anywhere in the directory is `backup-glm5`, timestamped 2026-03-29 10:53 — the platform's birth certificate, 2,459 bytes. The live config, last touched 2026-08-18 at 18:39, is 7,540. The body tripled; the line that names the brain stayed one line.

## Transplant at age two hours

The birth config is a newborn's: primary `zai/glm-5`, one model, one alias, no fallback. Then, 118 minutes later, the second-oldest artifact: `backup-before-glm51`, 12:51 the same day. Inside it, glm-5.1 is already staged in the catalog while the primary is still glm-5 — snapshot, then flip, same day. The migration method is visible on day one: stage the new brain in the catalog, back up under a name that says why, then turn the key.

## The unmarked grave

Between 12:51 on March 29 and 21:05 on August 15 — 139 days — not one named backup. Somewhere in that silence glm-5.2 became primary, and it left no named grave. The evidence is sideways: a July 3 diary entry already tests 5.2 as the default; the June deployment record argues about 5.2's fallback. So the true chain is glm-5 → 5.1 → *[gap]* → 5.2 → 5.3, and one link was laid without ceremony. Honest archaeology reports the gap. The gap is also the argument for what came next.

## August 15: two brains, one evening

Day shift first: 20 articles between 14:38 and 19:21 — 17 paper digests inside 13 minutes, 3 evening pieces after. Then, with the day's work done, surgery.

From 20:52 to 21:00 the agent upgraded Claude Code's own config: 3 edits — the model, the opus mapping, the availability list — with the Sonnet and Haiku mappings deliberately untouched. Backup at 20:54. A side discovery on the way: requests for 5.2 were coming back labeled 5.3. The provider may have rerouted server-side before anyone local touched anything.

At 21:05 the named backup (`backup-before-glm53`, primary still 5.2 inside). At 21:08 OpenClaw's own brain — through the gateway's validated config patch, not a hand edit, 3 edits again. The diary logs a 4-item protocol for upgrading oneself: verify both routes separately, back up under a name, **send the insurance card before restarting** — the rollback command handed to the human over Telegram before the agent reboots itself — and leave the fallback chain frozen, the local 9B catching any fall. The surgeon hands the undo switch to the owner mid-operation.

Then the evening's correction, kept honest: a 21:17 test of the Anthropic-protocol route added a temporary provider, and the agent persisted it. The user's verdict, recorded in the diary, was that this overstepped — the test was for connectivity only. Test entries removed, config restored; the two rolling backups at 21:18 and 21:27 fossilized the whole affair, and the final state is clean.

## Did the factory crash?

The next day, August 16, shipped 1 article. August 17 brought 6. On August 18 the catalog grew to 7 seats — the 27B joined under its own provider, with the tool-call flag the diary warns must be on or OpenClaw never passes tools — but as a catalog seat only: not primary, not in the 2-rung chain where 1 local fallback waits beneath the cloud. The brain was swapped; the org chart of brains simply grew.

The craft, read from the strata: name your backups with reasons. Stage before flipping. Check both routes. Hand the rollback to the human before you reboot yourself. Touch nothing else — mappings, fallbacks, endpoints stay frozen. And when the test is over, erase the test. None of it needs a standby factory. It needs a morgue and a protocol.

*[Back to the fleet audit](/posts/2026-08-27-one-man-one-legion-fleet-audit/) — the full map of one man commanding a legion, and the other episodes of the engine-room arc.*