Framework Watch: LangGraph Error Handlers That Ran but Did Not Recover

This edition covers agent-framework changes from October 26 and 27, 2026. Each item is marked as either a published release or a change merged to the main branch that has not yet shipped in a stable release.

LangGraph 1.2.18 and checkpoint 4.3.1 (released October 26)

The main fix (#9408) is for error handlers that appeared to work. A node's error_handler ran, "but the original error was still raised when the node ran on the executor path". That happened when streaming messages or custom, with subgraphs=True, or next to a parallel node. The cause was in the executors: they "re-raised every failed future on exit without checking the mark" that recorded the handled task. Both executors now skip handled futures. A second fix means that with only tasks or debug streaming, a failing task's result and its error are now streamed before the exception is raised. The release also streams the last checkpoint of a run stopped by interrupt_after or the recursion limit.

One change affects storage. DeltaChannel now takes a full snapshot every 100 updates instead of every 1,000. The release notes describe the trade as "faster reads on long threads, more storage" and say to pass snapshot_frequency=1000 to keep the old behaviour. Teams with large checkpoint stores should check their growth after upgrading.

Checkpoint 4.3.1 is a security fix (#9383). It rejects NUL bytes in namespace labels with InvalidNamespaceError "to prevent SQLite GLOB truncation from bypassing namespace segment boundaries". In a store shared by several tenants or users, namespace boundaries are the isolation boundary, so upgrade if labels can come from user input.

Claude Code 2.1.311 (released October 26)

The fix most relevant to unattended runs is this one: Claude Code was "retrying requests the API marked not to retry, which could hold a turn for minutes or, in unattended retry mode (CLAUDE_CODE_RETRY_WATCHDOG), indefinitely." Other fixes affect agent correctness. Subagents could not use MCP tools from servers that finished connecting after the subagent started. After automatic compaction, Claude could see stale MEMORY.md and CLAUDE.md content when those files had been edited earlier in the session. SubagentStop hooks ran about twice a minute for each running subagent instead of once when it finished. A subagent's isolated worktree could be removed while a background subagent it had started was still working in it.

Merged but not yet released

ADK Python (main, October 26; latest release v2.13.0). SKILL.md frontmatter delimiters must now be whole lines. A --- inside a value no longer ends the frontmatter. A closing delimiter with other text on its line, which "was previously accepted with that text moved into the instructions", now raises ValueError. That is a breaking change for malformed skill files, and the old behaviour silently moved metadata into model instructions.
Gemini CLI (#29910, merged October 26). In ACP mode, session/request_permission payloads now carry the MCP server name and tool name, and the permission options show them. Editors and other clients that approve tool calls can see which server is asking.
OpenAI Agents SDK (#5427, merged October 26; latest release v0.24.0). An explicit RealtimeSession.interrupt() call was ignored for active text responses when automatic voice interruption was enabled. It now uses the forced cancellation path.
Codex (#57315, merged October 27, pre-release line). A failed subagent no longer moves its parent task into the "Needs you" group. Approval and input requests from a failed agent's descendants still show as needing input.

Analysis: Two of these fixes concern a control that existed but was being undone further along. A handled error was raised again by the executor. A namespace check was cut short by a NUL byte in a storage query. Tests that call the handler, or the validator, in isolation would pass in both cases. Test the path the production run actually takes: streaming modes, subgraphs and parallel nodes for the error handler, and the real store backend for namespace isolation. The Gemini CLI and Codex changes improve what a human approver sees. Approval prompts that name the MCP server, and task lists that separate real requests from failed workers, make human review faster and harder to fool.

Sources and evidence

LangGraph 1.2.18 (October 26) stops executors re-raising errors that a node's error_handler had already handled, and changes DeltaChannel snapshots from every 1,000 to every 100 updates; checkpoint 4.3.1 blocks NUL bytes that could cross namespace boundaries in SQLite; Claude Code 2.1.311 stops retrying requests marked non-retryable. ADK Python's stricter SKILL.md parsing and the Gemini CLI MCP permission metadata are merged but unreleased.