The Brain Swap: Ten Backups, One Insurance Card, No Standby Factory
Key Takeaways — Executive & AI Summary
- The backup strata read like tree rings: ten openclaw.json files, the oldest of them the platform's birth certificate (2026-03-29 10:53, 2,459 bytes against today's 7,540) — and the first brain transplant landed 118 minutes after birth, glm-5 to glm-5.1, staged in the catalog before the flip.
- One link in the chain has no named grave: 139 days separate the before-glm51 and before-glm53 backups, and somewhere in that silence glm-5.2 became primary without ceremony — the honest gap that argues for the protocol that came later.
- The 5.3 swap of August 15 is the textbook run: twenty articles shipped on the day shift, then a two-stage evening surgery (Claude Code 20:52, OpenClaw itself 21:08) under a four-item protocol — dual-route precheck, named backup, the rollback command handed to the human before the self-restart, fallback chain frozen — and the factory shipped one article the next day and six the day after.
Episode 18 of One Man One Legion — fourth stop in the engine-room arc, after the mini-agent, the model stable, and the model exam. The exam graded the newest local horse. This one is about the cloud brain itself — and what it takes to replace it while the factory keeps running.
Every factory fears the day its brain must come out. This fleet has swapped its primary model at least three times — glm-5 to 5.1 to 5.2 to 5.3 — with no twin factory to fail over to, no maintenance window, and no operations team. The whole history sits in one directory: ten openclaw.json files, stacked like strata.
The strata
The layer holds 10 files: the live config, 5 rolling backups (.bak through .bak.4, the platform breathing on its own), and 4 with names — backup-glm5, backup-before-glm51, backup-before-glm53, backup-0818-notify. Rolling backups are routine; named backups are decisions. The oldest file anywhere in the directory is backup-glm5, timestamped 2026-03-29 10:53 — the platform’s birth certificate, 2,459 bytes. The live config, last touched 2026-08-18 at 18:39, is 7,540. The body tripled; the line that names the brain stayed one line.
Transplant at age two hours
The birth config is a newborn’s: primary zai/glm-5, one model, one alias, no fallback. Then, 118 minutes later, the second-oldest artifact: backup-before-glm51, 12:51 the same day. Inside it, glm-5.1 is already staged in the catalog while the primary is still glm-5 — snapshot, then flip, same day. The migration method is visible on day one: stage the new brain in the catalog, back up under a name that says why, then turn the key.
The unmarked grave
Between 12:51 on March 29 and 21:05 on August 15 — 139 days — not one named backup. Somewhere in that silence glm-5.2 became primary, and it left no named grave. The evidence is sideways: a July 3 diary entry already tests 5.2 as the default; the June deployment record argues about 5.2’s fallback. So the true chain is glm-5 → 5.1 → [gap] → 5.2 → 5.3, and one link was laid without ceremony. Honest archaeology reports the gap. The gap is also the argument for what came next.
August 15: two brains, one evening
Day shift first: 20 articles between 14:38 and 19:21 — 17 paper digests inside 13 minutes, 3 evening pieces after. Then, with the day’s work done, surgery.
From 20:52 to 21:00 the agent upgraded Claude Code’s own config: 3 edits — the model, the opus mapping, the availability list — with the Sonnet and Haiku mappings deliberately untouched. Backup at 20:54. A side discovery on the way: requests for 5.2 were coming back labeled 5.3. The provider may have rerouted server-side before anyone local touched anything.
At 21:05 the named backup (backup-before-glm53, primary still 5.2 inside). At 21:08 OpenClaw’s own brain — through the gateway’s validated config patch, not a hand edit, 3 edits again. The diary logs a 4-item protocol for upgrading oneself: verify both routes separately, back up under a name, send the insurance card before restarting — the rollback command handed to the human over Telegram before the agent reboots itself — and leave the fallback chain frozen, the local 9B catching any fall. The surgeon hands the undo switch to the owner mid-operation.
Then the evening’s correction, kept honest: a 21:17 test of the Anthropic-protocol route added a temporary provider, and the agent persisted it. The user’s verdict, recorded in the diary, was that this overstepped — the test was for connectivity only. Test entries removed, config restored; the two rolling backups at 21:18 and 21:27 fossilized the whole affair, and the final state is clean.
Did the factory crash?
The next day, August 16, shipped 1 article. August 17 brought 6. On August 18 the catalog grew to 7 seats — the 27B joined under its own provider, with the tool-call flag the diary warns must be on or OpenClaw never passes tools — but as a catalog seat only: not primary, not in the 2-rung chain where 1 local fallback waits beneath the cloud. The brain was swapped; the org chart of brains simply grew.
The craft, read from the strata: name your backups with reasons. Stage before flipping. Check both routes. Hand the rollback to the human before you reboot yourself. Touch nothing else — mappings, fallbacks, endpoints stay frozen. And when the test is over, erase the test. None of it needs a standby factory. It needs a morgue and a protocol.
Back to the fleet audit — the full map of one man commanding a legion, and the other episodes of the engine-room arc.
FAQ — Direct Answers
- Isn't swapping the primary model reckless when chat rooms and scheduled jobs all depend on it?
- That is exactly what the untouched fallback chain is for. The rule logged in the migration diary freezes the local 9B as the bottom rung during the swap, so a failed first call on the new model degrades the fleet instead of killing it. What the fallback cannot cover — the restart itself going wrong — is what the insurance card covers: the rollback command reaches the human before the agent reboots itself.
- The provider was already answering glm-5.2 requests with glm-5.3 — wasn't the local flip pointless?
- No, and the diary is careful about this. The reroute was a side discovery, not a plan: requests for 5.2 came back labeled 5.3 on both routes. The local flip still mattered because the two routes bill differently, and because a config that says one model while serving another is a lie waiting to trap the next migration. The flip made the intent explicit and was verified against the real endpoint.