[bkudiess]

Related: #1424 (Track WinUI ItemsView fix and retire Reactor preview.12 Markdown workaround)

What Problem This Solves

Windows users need a native view of the Gateway’s reported machines, workers, resource measurements and related sessions without losing node-management and legacy navigation paths.

User Impact

User impact: Systems replaces Instances with an online-first inventory of reported devices and the Gateway, separate worker and connected-app groups, and independently expandable machine details. It shows current or last-known resource measurements, capabilities, pending declarations, desktop availability and related-session links. systems, instances and nodes open the same page; machine deep links expand the requested row.

Pairing review stays on Connection. Desktop viewing/setup, backup and storage administration stay in the web interface through Open in web. The native page has no backup reads, trend/history charts, search/filter/sort toolbar, inline pairing decisions or desktop configuration writes. Rename and confirmed Forget remain native, permission-checked node actions.

Validation is incomplete for frozen head 75a1f38ec13dbcc88047949248dee409ed1c0470. Its one-file Daily viewport-readiness correction has not been executed natively. Current-head CI is in progress; no current-head Platinum verdict is verified. Historical Server 2022 x64 results below are not Windows 11/ARM64 proof. The Azure lease was released at 02:33 UTC with original 1024x768 restored and no proof processes remaining. No native runtime is retained; further Windows 11/ARM64 host approval has been requested, not granted. This PR remains draft, with no ready-for-review or merge-readiness claim.

The candidate uses Reactor 0.1.0-preview.17, System.Drawing.Common 10.0.14 and main’s Windows App SDK 2.6.5. The obsolete Markdown list workaround associated with #1424 is removed. These are source dependency versions, not current-build runtime proof.

Why This Change Was Made

Shared projections own inventory joins, presence, session relations, measurement freshness and desktop availability; SystemsController owns page state. Reactor renders native controls in one scroll with independent inline expanders. The shared page hero and responsive layout retain shell geometry and focus ownership. Status uses text and glyphs as well as theme-aware colors.

The November 9 repair merges pinned main 1c223f14f6b66cf0928eeb8686f34208b5ea4d51 into the existing PR head without rewriting its history. It retains both native diagnostic paths, Systems and Inbox fixtures, theme and timeout arguments, and host-statistics shutdown alongside main’s file/progress cancellation. Main’s shared Inbox remains authoritative; an obsolete notification-page source guard now checks the shared owner.

Follow-up repairs removed unused session-attention/mirrored freshness state while retaining canonical Gateway publication guards, corrected delayed default expansion and inventory group identity, and aligned fixtures with actual row realization and accessible controls. The latest test-only correction treats a missing or unmeasured viewport as an incomplete observation inside the existing pane-expansion wait. It resets width stability without changing timeouts or geometry/capture assertions.

Current source scope, not a runtime completion checklist

Surface	Current native behavior and owner
Inventory	Reported Gateway/devices, workers and presence-only connected apps; exact-identity joins; older-Gateway node-list fallback.
Summary and navigation	Online and Issues tiles; Issues reveals the first badged row without hiding inventory. Legacy aliases and machine deep links remain.
Inline details	Independent expanders retain siblings; platform, identifiers, timestamps, provider/state, capabilities and diagnostics remain available.
Measurements	Latest reported values, meters, age and Live/Last known semantics. Windows nodes publish processor count, memory and system-drive space every 60 seconds by default, not processor utilization or load average. No native history charts.
Sessions	Reported placement/runner/attachment relations link into native Chat; a configured binding is not claimed as execution.
Attention and recovery	Approval/reapproval, offline, update, permission and reported-error badges. Own-node pairing awareness survives queue filtering. Pairing/offline recovery opens Connection; local permission recovery opens Permissions.
Node mutations	Rename and confirmed Forget through existing operator methods, with current pairing-scope and Gateway-epoch checks.
Desktop and deeper administration	Desktop availability only. One page-level Open in web opens Systems when supported or the web root on an older Gateway; no selected-machine destination is promised. Backup reads, backup health, storage probes and desktop administration remain closed native responsibilities.
Presentation	One scroll, responsive shared hero, theme/high-contrast resources, focus continuity and all six locales. Quiet polls advance displayed ages without unnecessary reads.

The initial web reference was openclaw/openclaw@5089aa71b681ee275515f2de037b7813d73b45c3. The current native scope is defined by this candidate’s source, DESIGN.md and architecture ledger, not the earlier feature-parity checklist.

Evidence

• Current 75a1f38: one test file, +8/-1. Static reverse-patch equivalence and predicate-model checks passed. Production code, prior repairs, geometry/capture assertions and timeout owners are unchanged. No native execution of this correction.
• Independent review: the exact current tree received bounded P0-P3 source review and separate rubber-duck proof-plan assessment with no actionable findings. Earlier session-state, native-layout, ledger and fixture repairs also received bounded reviews. These are narrative OpenClaw subagent assessments (runtime model openai/gpt-6-astra), not whole-PR approval, shared-helper certification or native acceptance.
• Historical native a3fb18e: full build passed; Shared 5309 passed/28 ordinary skips; Tray 5600 passed; focused mounted 4/4; full 75 Systems + 7 dispatcher = 82/82; two repaired whole-app fixtures 2/2. Custom selections had zero skips. These Server 2022 x64 executions are not current 75a or Windows 11/ARM64 proof. Exact a3fb build/test receipt.
• Failure retained: a3fb CI run 42739682666, UI job 129577615904, tested synthetic merge b2f91906cca771788ae78eb129d5ce516b632158. Fixtures passed 95/96; Daily frames failed on a null UIA viewport lookup. The current correction needs a fresh successful run.
• Earlier campaign failures retained: 9e01ec2 native Systems 41/72 and six-case reproduction 0/6; 668b841 ledger guard-reference failure; 83840ec hosted Systems 71/75 and fixtures 94/96. Later bounded passes do not erase these failures.
• Historical integration checks at 1dd6f56 / tree 79e67030: 14 textual conflicts plus an obsolete source guard repaired; 18 changed XML files; six locales with 3,469 unique keys each; 1,374 both-parent resource additions retained; 21 workflow jobs; both Inbox blobs and all three teardown paths checked. Independent merge review found no actionable defect in that bounded scope.
• Historical ClawSweeper dispositions: the timestamp and four earlier UI findings were source-reconciled. The later unused session aggregate was removed while canonical identity/epoch/admission guards and seven dispatcher tests remain. Fresh hosted review and live final-effect proof are still required. Older Windows/Gateway/image evidence remains below at its original revisions.

Historical review lineage

• Four initial independent Opus 5.5/GPT-6 Astra rounds informed the implementation fixes. A historical two-stage Hanselman review used claude-opus-5.5 in an isolated child session and gpt-6-astra, both at high reasoning, on 3fc16592 versus b0059dc1: all 44 changed files plus the retained Ready-flow merge resolution. It found no new delta defects and one LOW stale-description finding. The later four ClawSweeper corrections and merge resolution received a separate bounded independent rubber-duck review of the exact 88d5ad5 tree, with no blockers. The runtime did not expose that reviewer's model identity. No earlier review verdict is presented as a fresh review of later code.

• Earlier safe native diagnostics correlated a testhost fault with Microsoft.UI.Xaml.dll 3.2.3.0 and 0xC000027B while a reasoning flyout test was active. This identifies a fault surface, not its root cause or a fix.

Original feature and PR by Barbara Kudiess (@bkudiess). RoboClaw’s November 9-10 campaign scope is integration and follow-up source/test repairs, bounded verification and metadata reconciliation, not authorship of the original feature.

Work sessions

Linked for team reference; these sessions aren’t public.

• Original discussion with @bkudiess
• Implementation and verification
• Native validation

These links refer to the November 9-10 readiness campaign. Implementation-session checks were source/static; the separate native session owns historical Windows executions and their limits.

Change Type

• Bug fix
• Feature
• Refactor
• Docs or instructions
• Tests or validation
• Security hardening
• Chore or infrastructure

Scope

• Tray or WinUI UX
• Windows node capability
• Local MCP or winnode
• Gateway, connection, or pairing
• Setup or onboarding
• Permissions, privacy, or security
• Tests, CI, or docs

Required proof pools

• windows-winui-interactive: current Systems visuals, focus/keyboard behavior, rename/Forget confirmation fencing, Inbox integration and accessibility.
• windows-wsl-gateway-e2e: real Gateway-mediated Windows-node statistics and connection lifecycle. Historical WSL or protocol results are not current inventory-bound pool completion.
• windows-wsl-mxc: the integrated Windows-node teardown retains cancellation of file and system.run work. Validate the real containment/cancellation path on a capable authorized host; an AllowSkip result is not proof.
• windows-11-arm64: native dependency loading, build/launch and current rendering. Cross-compilation does not establish native ARM64 behavior.

None is complete for the current head. Historical Server 2022 x64 executions provide bounded interactive evidence, not Windows 11/ARM64 pool completion. The lease was released at 02:33 UTC; no native runtime remains. Further Windows 11/ARM64 host approval is requested but not granted. Signed install/upgrade preservation is not claimed.

Validation

Frozen head: 75a1f38ec13dbcc88047949248dee409ed1c0470, tree a5c2027f6d79b913a6f11c6b3ee0bcf62e49d9d0, parent a3fb18e6d5a552a672662b1266109d7b5922da4b. The earlier integration commit 1dd6f56 retained PR parent 3bfb542 and pinned main 1c223f1 history-preservingly; later repairs did not rewrite that history.

Fresh exact-head checks read November 10 at 03:01 UTC: Build and Test 42744848034 is in progress, including Core/CLI, Tray/setup/integration, UI/accessibility, WSL and MSIX lanes. Fast validation, change classification, proof-pool contracts, release metadata and x64 publish smoke passed. CodeQL 42744848025 checks are skipped, not security-validation passes. ClawSweeper dispatch success is not completed review or Platinum. No green-CI claim.

Current 75a command/check	Actual result
git diff HEAD^ HEAD --check	Passed for the one-file Daily repair.
git -c core.whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol diff --check 1c223f14f6b66cf0928eeb8686f34208b5ea4d51 HEAD	Passed with repository CRLF policy recognized; normal whitespace checks retained and no persistent config change. Raw aggregate checking previously failed on inherited CRLF in NodeExecDenialWireTests.cs and is not claimed passed.
Reverse-patch/source and predicate-model checks	Passed: only viewport admission changed; absent/zero size and wrong geometry do not pass. Static models are not C#/UIA execution or native timeout proof.
pwsh -NoProfile -File ./scripts/setup-dev.ps1 -CheckOnly	Could not start: pwsh missing, exit 127.
pwsh -NoProfile -File ./build.ps1	Could not start: pwsh missing, exit 127.
dotnet test ./tests/OpenClaw.Shared.Tests/OpenClaw.Shared.Tests.csproj --no-restore	Could not start: dotnet missing, exit 127; 0 tests.
dotnet test ./tests/OpenClaw.Tray.Tests/OpenClaw.Tray.Tests.csproj --no-restore	Could not start: dotnet missing, exit 127; 0 tests.
dotnet test ./tests/OpenClaw.Tray.UITests/OpenClaw.Tray.UITests.csproj --filter 'FullyQualifiedName~GatewayFixtureUiTests.SystemsDaily_InsetAndExpandedNativeFrames'	Could not start: dotnet missing, exit 127; 0 tests.
winapp --version and winapp --cli-schema	Both unavailable in the Linux source lane.

Historical native a3fb only: pwsh -NoProfile -File build.ps1 -NoTrustRepository passed. Fresh Shared/Tray project builds preceded required dotnet test <project> --no-restore: Shared 5337 total, 5309 passed, 28 ordinary skips; Tray 5600 passed, zero failures/skips. Isolated OPENCLAW_REPO_ROOT and AppData roots were recorded. Focused 4/4, full Systems 75 + dispatcher 7 = 82/82, and the two earlier repaired fixtures 2/2 passed with zero selected skips. Execution receipt. This does not certify the full 96-case fixture lane, production-shaped Release, current 75a or live authority proof.

The last native a3fb app DLL SHA256 was 9DF7EC6A1931D21BAF801C3E18C11B16ECAAD4F5F36E9143F7B8BE737637E0E2. Source correspondence is not a new binary execution. Server 2022 x64 lease cbx_2eea04ed8573 was verified absent at 02:33:40 UTC after original 1024x768 restoration and zero remaining proof processes. No native runtime remains reserved; Windows 11/ARM64 approval is pending.

Remaining required validation: current-head build and nonzero Shared/Tray closeout; Daily frames in both Light/Dark and the full 96 fixture lane; Debug/non-Dev Release, keyboard/focus, High Contrast and accessibility; controlled native-diagnostics failure paths; paired host-statistics lifecycle/transport teardown; real Rename/Forget success and missing-scope/revocation/two-live-Gateway switch rejection with independent final-state observers; applicable WSL/MXC, native ARM64 and install/upgrade proof. Ordinary skips or unpaired socket tests cannot satisfy these pools.

Use isolated roots and build fresh test projects before --no-restore. The real-app partial class is GatewayFixtureUiTests, not the filename. Preserve timeouts, geometry and no-skip assertions; -KeyboardProof requires an authorized exclusive desktop. The 75-case mounted class has no explicit unresolved-deep-link case, so no such mounted proof is claimed. No current-head Platinum verdict, complete before/after pair or readiness is verified.

Historical validation and original failures, retained from the earlier PR body

Historical head f841d88, with main 65c7ddb. The earlier bootstrap resolution retained phase logs and DPI traces with one COM-wrapper initialization and SDK bootstrap. A fresh read during this campaign confirms Build and Test 40738600091 completed successfully for that historical head. CodeQL 40738600123 is retained as a historical link; its final outcome was not rechecked in this pass. Neither validates the current candidate.

The prior ddd8e150 CI attempt tested synthetic merge 240d6675 against a newer main tip and exposed a semantic merge conflict: two placement locals in one protocol test (CS0128). That historical repair integrated the main change and keeps one typed catalog load, main's Gateway-environment assertions and the independent default-workspace assertion. Shadowed duplicate empty catalog handlers are removed. The original author reported the focused protocol test passing at that historical revision; this is a fixture-contract reconciliation, not a weakened assertion or a product workaround.

Historical hosted evidence: Build and Test 40633651864, attempt 1 and its CI Gate passed for head 3fc16592. Its actual checkout was synthetic merge 56ea5aa, merging 3fc16592 into cb50915d. All selected jobs passed, with ARM64 release publish and publication-only jobs skipped as intended; CodeQL 40633651879 passed too. The checkout log and downloaded TRX establish that historical execution, not a pass for the new candidate.

Historical local Windows 11 ARM64 closeout tested frozen tree e3ea87721d510766ea89414f394128397781c812, subsequently committed unchanged as f841d88f, using isolated settings and OPENCLAW_REPO_ROOT. The successful full build used task-local UseSharedCompilation=false, MSBUILDDISABLENODEREUSE=1 and DOTNET_CLI_DO_NOT_USE_MSBUILD_SERVER=1. Earlier attempts are retained rather than silently replaced.

Exact command	Result
.\build.ps1	Passed all five builds and documentation validation
dotnet test .\tests\OpenClaw.Shared.Tests\OpenClaw.Shared.Tests.csproj --no-restore --blame-hang --blame-hang-timeout 5m --blame-hang-dump-type none	4766 passed, 25 skipped, 0 failed
dotnet test .\tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --no-restore --blame-hang --blame-hang-timeout 5m --blame-hang-dump-type none	4746 passed, 0 failed, 0 skipped
dotnet test .\tests\OpenClaw.Tray.UITests\OpenClaw.Tray.UITests.csproj -r win-arm64 --no-restore -p:BuildProjectReferences=false -p:UseSharedCompilation=false --filter 'FullyQualifiedName~SystemsPageProofTests|FullyQualifiedName~WindowCaptionThemeTests|FullyQualifiedName~NativeSharedFlowTests.ConfigurationChangeWithdrawsReadyWithoutReplayingSetup' --blame-hang --blame-hang-timeout 3m --blame-hang-dump-type none	11 passed, 0 failed, 0 skipped. Includes eight Systems rendering/authority cases, caption-theme behavior and two Ready invalidation cases
dotnet test .\tests\OpenClaw.Shared.Tests\OpenClaw.Shared.Tests.csproj --no-restore --filter FullyQualifiedName~GatewayFixtureProtocolTests.RealClient_SupportingReadsUseTypedModelsAndConsistentConfiguration	Historical fixture repair: failed before correction, passed afterward
.\scripts\test-gateway-fixture.ps1 -AppPath '.\src\OpenClaw.Tray.WinUI\bin\Debug\net10.0-windows10.0.22621.0\win-arm64\OpenClaw.Tray.WinUI.exe' -Configuration Debug -Screenshots	At ddd8e150, serial desktop run: 32 profile/app + 31 UI passed, 0 skipped. Includes natural message-240 visibility, long-history restoration and session switching; not re-executed after the October 28 main integration or during this campaign
.\scripts\test-gateway-fixture.ps1 -AppPath '.\src\OpenClaw.Tray.WinUI\bin\ARM64\Release\net10.0-windows10.0.22621.0\win-arm64\OpenClaw.Tray.WinUI.exe' -Configuration Release -Screenshots	At ddd8e150, production-shaped Release build and serial desktop run: 32 profile/app + 31 UI passed, 0 skipped; not re-executed after the October 28 main integration or during this campaign
.\scripts\test-ci-native-failure-metadata.ps1	At 3fc16592: 9 privacy/parser/exit-code cases passed under PowerShell 7 and under WindowsPowerShell\v1.0\powershell.exe -NoLogo -NoProfile -File .\scripts\test-ci-native-failure-metadata.ps1. The added case forces metadata output failure; both original-exit and message-privacy mutations were rejected during the repair
.\scripts\test-proof-evidence.ps1	At 09721901: 83 checks passed, including 24 controlled runner invocations
.\scripts\test-ci-workflow-contract.ps1	At the validated 282e87e6 repair tree: routing, watchdog and result guards passed; no new execution claimed for the later merge
dotnet test .\tests\OpenClaw.Shared.Tests\OpenClaw.Shared.Tests.csproj --filter FullyQualifiedName~NativeTestFailureTraceTests	At b0059dc1: 3 passed in Debug and 3 passed in Release
dotnet test .\tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --no-build --no-restore --filter 'FullyQualifiedName~SandboxStatusStoreTests|FullyQualifiedName~ChatComposerSessionTests|FullyQualifiedName~ChatComposerViewModelTests|FullyQualifiedName~LocalizationValidationTests'	At 3fc16592: 70 passed, 0 failed, 0 skipped

Historical 3fc16592 local Tray results were 4625 passed and four BuildPrerequisiteTests.CheckOnly_UsesTheAppLocalRuntimeResolver failures. That historical incoming main corrected the child-process architecture fixture without weakening its expected results; an intermediate local run was reported as passing all 4630 tests; its exact revision is not identified in this paragraph. No class was excluded. The older hosted x64 suite passed all 4629 cases at its own revision.

At b0059dc1, the full local Shared run had 4724 passed, 25 skipped and two failures: MarkdownParserFuzzTests.Build_ManyListItems_ScalingCurve (543 ms versus its 500 ms bound) and ExecApprovalsStoreTests.Changed_ExternalCorruptThenValid_RaisesFailureThenRecovery (temporary file still in use). Both passed isolated, 2/2. The later full local run passed all 4726 executed cases, but the original failures are retained.

At 3fc16592, a native selection executed 22 cases locally: 20 passed and two Sandbox flyout cases failed the pre-existing exact-size assertion at 175% scale (44 versus 43.999996185302734, widths 320 and 480). All 22 corresponding cases passed in that revision's hosted x64 TRX. Those historical DPI failures are not erased by the historical 11 selected passes or the SDK upgrade. A first follow-up UI attempt also exposed a test-harness popup lookup/teardown error; it was corrected by locating Popup.Child and closing owned dialogs before disposing their host. The historical final native cases passed without suppressing exceptions or weakening assertions.

Historical downloaded TRX results from run 40633651864, attempt 1, for the synthetic merge of 3fc1659, not the new candidate:

Suite	Passed	Failed	Skipped
Shared	4743	0	8
Connection	1694	0	1
WinNode CLI	129	0	0
Tray	4629	0	0
SetupEngine	2477	0	1
Tray integration	55	0	3
Dev settings	31	0	0
WSL setup/connect	43	0	7
WSL revocation recovery	1	0	0
WSL network recovery	2	0	0
Framework UI	557	0	33
Accessibility	23	0	0
Functional UI	19	0	0
Local AI hardware-profile UI	12	0	0

Ordinary CI skips are not custom proof. Earlier failures are retained: 40596342567 had a native crash and bootstrap stall; 40613723082 captured the correlated WinUI stowed exception. 40616319196 subsequently passed at the older b0059dc1 head. Neither that pass nor the historical green run establishes the earlier fault's root cause or a fix. No memory dumps were collected.

Real Behavior Proof

• Environment tested: Linux source/static lane for 75a. Historical a3fb native execution used Windows Server 2022 x64 with AppSDK 2.6.5 and isolated profiles, not Windows 11/ARM64. Its lease is released and original display/process state restored.
• PR head or commit tested: 75a / tree a5c2027f received static checks and bounded independent review only. Historical a3fb / tree 52594879 produced the build, 82 native and two fixture passes above. CI's 95/96 fixture result used synthetic merge b2f9190 for a3fb, not 75a.
• Exact steps or command run: current blocked commands and historical native commands/counts are in Validation. Next focused case: GatewayFixtureUiTests.SystemsDaily_InsetAndExpandedNativeFrames, both themes, followed by the full fixture lane. No successor execution yet.
• Evidence after fix: current Daily guard source/model checks and independent source/proof-plan review. Historical a3fb captures show the current inline design but some have containment-toast occlusion; they are not complete visual acceptance or 75a after-images. No media was uploaded by this metadata update.
• Observed result: the new bounded predicate rejects missing/zero viewport observations and resets width stability without altering geometry or later captures. Native success remains unverified; permanent absence must still time out.
• Screenshot or artifact links verified? (Yes/No/N/A) No new media-link validation. Eight original image URLs remain unchanged as historical evidence; safe a3fb run links come from the verified native closeout.
• Not verified or blocked: final current-head CI and ClawSweeper Platinum; native 75a execution; full Debug/Release fixture, High Contrast/accessibility/keyboard and current before/after evidence; live Rename/Forget permitted/denied/revoked/switched final effects; paired host-statistics teardown; WSL/MXC, Windows 11/ARM64 and install/upgrade pools. Historical startup/native-fault causes remain unresolved. Another native host requires approval; none remains retained. Old native backup/desktop/inline-pairing receipts do not prove current closed responsibilities.

Historical proof limitations remain material: the additional old statistics replay could not authenticate with its previous operator identity; authority proof used separately qualified generated clients; Gateway identity switching was simulated rather than exercised across two live Gateways; overlapping Debug/Release attempts produced token-file startup and UI Automation failures before serial runs passed. No unsafe foreground bypass or product workaround is claimed.

Historical Windows and Gateway evidence: superseded design, not current-candidate proof

The following records preserve the original feature author’s receipts, limitations and artifact links. Native inline approve/reject, desktop-enable, backup and master/detail surfaces shown or exercised there have since been removed from the current Systems design. They must not be treated as current behavior or current-head validation.

The historical fixture lanes ran sequentially on the shared desktop, each with a separate -ArtifactsDirectory. Earlier overlapping attempts were not accepted as complete proof: Debug recorded an MCP-token file-sharing startup failure, and Release recorded UI Automation selection/timeouts before being stopped. The serial runs passed without source edits, sleeps, weakened assertions or hidden skips. Those passes correct the test procedure; they do not prove a code fix for the earlier startup failure.

• Historical environment: Windows 11 ARM64 at 175% scale with isolated local profiles, Windows App SDK 2.6.4 and Reactor preview.16; separately, the explicitly approved task-owned systems-proof native Gateway. The older hosted x64 CI is labeled by its revision.
• Historical source identity: the then-latest local build, Shared/Tray and 11 native cases correspond to e3ea877, committed as f841d88f. Authority proof and the passing serial Debug/Release fixtures ran at the earlier four-fix tree 88d5ad5/ddd8e150. The October 28 merge to f841d88 did not change those then-current Systems presentation/controller/Gateway-action owners, but that source correspondence is not a new whole-app or live-Gateway execution. Historical hosted CI tested synthetic merge 56ea5aa1 for head 3fc16592 and base cb50915d. Gallery screenshots are executions of 16183d3a; contrast rendering and the older statistics run used e4c474e5. These old captures are not fresh executions of the corrected head.
• Historical steps: historical fixture systems-inventory/systems-empty; discover with winnode --mcp-url <fixture URL> --list-tools, then --command app.navigate --params '{"page":"systems"}' or a machine deep link, always binding the matching isolated profile. Discovery exposed 33 tools. Pairing confirmation was opened without approving; stopping only the synthetic Gateway closed it and disabled writes. The historical hosted TRX separately records all 22 selected native Ready-flow/Sandbox/disposal cases passing.
• Historical evidence: mounted-control diagnostics, authority observations and captures below belong to their stated old revisions. They do not establish current-candidate CI or runtime behavior.
• Historical observed result: at the captured revisions, inventory and resource displays rendered natively; offline information was retained; pairing had a confirmation step; disconnect closed the dialog, reported eight effective offline machines, and disabled Refresh/Rename/Forget.
• Historical link check reported by the original author: all eight embedded images fetched successfully then; not freshly verified by this metadata task.
• Historical gaps: new-head CI was pending when that report was written; startup/native-failure causes, fresh whole-app and related-session captures, signed-install/upgrade preservation, an unauthenticated statistics replay and two-live-Gateway switching were not proved. The old Backups capture obligation is superseded by the current closed native-backup scope.

Historical native-control diagnostics from the passing 11-case run:

400px Systems: inventory viewport=138.29, machine bounds=89.71..138.29, selected=node:studio.
Own-node-only pairing: recovery banner and Connection action are visible; no approve prompt.
Pending declarations: initial/reapproval x capability/command, all four rendered.
Gateway switch with approve confirmation: closed, writes=0.
Gateway switch with reject confirmation: closed, writes=0.

Real authority proof at 88d5ad5/ddd8e150 used production OpenClawGatewayClient, SystemsGatewayClient and the WinUI-free production SystemsController, with generated identities against the isolated Gateway. Authorized changes were checked by separate admin reads of persisted state. Read-only sessions received actual Gateway scope errors; revoked privileged sessions were invalidated and could not write. The original flag was restored, generated identities removed and the service stopped. No production machines or settings were touched.

{
  "Complete": true,
  "AuthorizedDesktopPersisted": true,
  "AuthorizedPairingPersisted": true,
  "MissingAdminDeniedWithoutDesktopChange": true,
  "MissingPairingDeniedWithoutPairingChange": true,
  "RevokedAdminDeniedWithoutDesktopChange": true,
  "RevokedPairingDeniedWithoutPairingChange": true,
  "GatewaySwitchCancelledBeforePatchDispatch": true,
  "OriginalDesktopSettingRestored": true,
  "GeneratedIdentitiesCleaned": true,
  "SharedAssemblySha256": "E57ADBF8F2E50E60F82B28010EB19846372700B6C0792475BFD9DD924D4BFF44"
}

This receipt comes from the real Gateway and production client/controller boundary, not a rendered desktop-enable dialog or two live Gateways. Separate historical mounted tests covered stale approve/reject dialogs. Earlier proof-driver attempts failed because the driver assumed in-band token delivery and then used an invalid empty constructor credential; those failures and successful cleanup were retained, not counted as complete proof.

Native runtime identity: OpenClawFoundation.OpenClawGateway-systems-proof_rfcbke2p71se2, package 0.1.2491.54761, packaging commit 424969910aa55dc7c44f2fb82b17882345730e55, OpenClaw 2026.10.8 at dc2523e5a5c7a309517fd7fa834add938231d526. Only generated proof identities were paired. At the end of that historical run, the author reported the Gateway service stopped and the side-by-side registration retained; its present runtime state was not inspected. No production machines or Gateway state were changed.

The historical live proof at e4c474e5 used production WindowsNodeClient, SystemsGatewayClient and SystemsProjection, separately from the fixture UI, with the supported OPENCLAW_NODE_HOST_STATS_INTERVAL_SECONDS=10 override:

{
  "OperatorConnected": true,
  "TaskOwnedNodePaired": true,
  "DistinctHostStatsEvents": 2,
  "NodeListRetainedStatistics": true,
  "ProjectionRetainedStatistics": true,
  "EnvironmentsSupported": true,
  "GatewaySystemInfoSupported": true,
  "BackupsSupported": true,
  "SharedAssemblySha256": "604D2ED9504E8E3238882EFB8EE7DC4F21E36B511ABF7FBCBB95FB0540BAE081"
}

Historical captures at 16183d3: inventory, host, node statistics and dark worker details

Historical captures at 16183d3: offline, confirmation, disconnect fencing and empty state

Historical capture at e4c474e: Windows Aquatic high contrast

The original Windows contrast setting, None, was restored after capture.

Security Impact

• New permissions or capabilities? (Yes/No) No
• Secrets or tokens handling changed? (Yes/No) No
• New or changed network calls? (Yes/No) Yes
• Command or tool execution surface changed? (Yes/No) No
• Data access scope changed? (Yes/No) No
• If any answer is Yes, explain the risk and mitigation: relative to pinned main, Systems adds authenticated inventory/resource reads and operational node.host.stats publication. Native rename/Forget use existing operator methods with live operator.pairing checks and connection-epoch fencing. Pairing decisions stay with Connection; Systems does not issue backup/storage reads or desktop configuration writes. No new credential store or local listener is introduced. Main’s file-transfer feature is inherited integration context, not a new capability introduced by this PR’s Systems delta. Current transport and mutation proof remains outstanding.

Compatibility and Migration

• Backward compatible? (Yes/No) Yes, by source contract; current runtime compatibility remains unverified.
• Config or environment changes? (Yes/No) Yes
• Migration needed? (Yes/No) No
• If yes, list the exact upgrade steps: none. Optional tuning uses OPENCLAW_SYSTEMS_POLL_SECONDS (default 15, minimum 5), OPENCLAW_SYSTEMS_EVENT_REFRESH_MS (default 1500, nonnegative) and OPENCLAW_NODE_HOST_STATS_INTERVAL_SECONDS (default 60, minimum 10). Older Gateways fall back to node inventory and the web root; legacy routes remain valid. Backup support is not probed by the native page.

Review Conversations

• I replied to or resolved every bot review conversation addressed by this PR.
• I left unresolved only conversations that still need maintainer judgment.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge.

What this changes

This PR replaces Instances with a native Systems inventory showing Gateway machines, resource readings, related sessions and node-management actions.

Example: A Gateway reports node:studio with four processors, memory measurements and a related session.

• Before: Instances shows presence and node-management details.
• After: Systems adds expandable resource readings, freshness labels and a link to the related conversation.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The feature has clear value and substantial source coverage, but current behavior proof is explicitly unavailable and an unnecessary production subsystem remains.
Proof confidence	🧂 unranked krab (1/6)	Real behavior proof is necessary before merge. See Before merge.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Product

Kind: Feature · Worth it: Yes · Fix scope: Complete
User problem: Windows users lack a native consolidated view of Gateway machines, resource measurements and related sessions.
Reason: The maintainer-authored direction provides concrete operator value while preserving legacy routes and keeping deeper administration with its existing owners.

Merge readiness

⛔ Blocked before merge - 4 items remain

Keep this maintainer-authored feature open: main does not provide the Systems dashboard, and the prior findings are addressed in source; remove the unused session-attention machinery before landing.

Priority: P2
Reviewed head: 1dd6f568a83a94a9b8f60f615bdbc8791bf3ac08

Before merge

• Add real behavior proof - Authority-chain proof required: demonstrate current-build Rename/Forget success and rejection for missing pairing scope, revocation and a Gateway-switched confirmation, with independent final-state checks. The full body expressly labels its native captures and live statistics receipts historical; inspected images do not show the current inline design. Supply current shipped-app screenshots or recordings plus transport output for the changed UI, dialog/dependency behavior and paired statistics lifecycle, redacting IPs, credentials and non-public endpoints. After adding proof, update the PR body, then request a new review with @clawsweeper re-review. The PR author or someone with repository write access can request it.
• Remove the unused session-attention state (P2) - The final Systems hero reads inventory and pairing issues, and no production code reads SessionsAttentionCount or SessionsConnectionEpoch. Nevertheless every authenticated session publication now updates this extra state, emits its notifications and passes through a second admission implementation after GatewayService has already checked the same generation and epoch. This machinery is unnecessary for the shipped feature. Keep the stale-callback checks in GatewayService, publish the existing Sessions array there, and remove the unused aggregate, its mirrored freshness bookkeeping and corresponding ledger claim.
• Resolve security concern: Verify deferred mutations at the final Gateway effect - The rewritten dialogs carry a connection epoch and subsequently resolve a live operator client. No reachable bypass was established, but the old authority receipt exercised removed desktop-enable and pairing-approval paths, not current Rename/Forget. Establish rejection before mutation for an operator lacking operator.pairing, a revoked operator and a confirmation carried across a Gateway switch.
• Resolve merge risk - Before merge, the PR owner must establish that the rewritten deferred Rename and Forget flow cannot mutate a replacement Gateway or retain permission after operator revocation.

Findings

• [P2] Remove the unused session-attention state — src/OpenClaw.Tray.WinUI/Services/AppState.cs:92-98
• [medium] Verify deferred mutations at the final Gateway effect — src/OpenClaw.Tray.WinUI/Pages/SystemsPage.xaml.cs:257

Tests

• Low-value test tests/OpenClaw.Tray.Tests/Services/SessionsAttentionSnapshotTests.cs: Remove the aggregate/count-notification cases alongside the unused subsystem; preserve stale-client and reconnect rejection coverage at GatewayService's publication boundary.
• Missing end-to-end proof: Current-build shipped-entry-point evidence is missing for the inline UI, dependency-sensitive dialogs and chat, paired statistics lifecycle, and final-effect mutation rejection; relevant fixes also lack demonstrated base-fail/head-pass results.

Agent review details

How this fits together

Authenticated Gateway inventory, node, presence and session data flow through shared projections and a page controller into native Reactor controls; node mutations use the existing operator client.

flowchart LR
  A[Windows node sampler] --> B[Authenticated Gateway]
  B --> C[Operator client]
  C --> D[Systems projections]
  D --> E[Systems controller]
  E --> F[Native Systems page]
  F --> C

Loading

Technical review

Best possible solution:

Land the scoped Systems page using existing Gateway, session and shared-presentation owners, without the unused session-attention subsystem.

Do we have a high-confidence way to reproduce the issue?

This is a feature addition; source inspection confirms the earlier reported defects are addressed, but this review ran no application or tests.

Is this the best way to solve the issue?

The shared projections, page-scoped controller and existing operator client fit the feature; keep session admission in GatewayService and remove count/freshness state that no production consumer uses.

Full review comments:

• [P2] Remove the unused session-attention state — src/OpenClaw.Tray.WinUI/Services/AppState.cs:92-98
  The final Systems hero reads inventory and pairing issues, and no production code reads SessionsAttentionCount or SessionsConnectionEpoch. Nevertheless every authenticated session publication now updates this extra state, emits its notifications and passes through a second admission implementation after GatewayService has already checked the same generation and epoch. This machinery is unnecessary for the shipped feature. Keep the stale-callback checks in GatewayService, publish the existing Sessions array there, and remove the unused aggregate, its mirrored freshness bookkeeping and corresponding ledger claim.
  Confidence: 0.96

Overall correctness: patch is incorrect
Overall confidence: 0.86

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 1c223f14f6b6.

Merge-risk options

Maintainer options:

1. Establish the mutation boundary (recommended)
   The PR owner supplies current-build final-effect evidence for authorized, missing-pairing-scope, revoked and Gateway-switched Rename/Forget attempts.
2. Keep the candidate in draft
   Retain the draft while the already-planned native validation completes.

Provenance checked

• Instances replacement and node management changes intended behavior with a stated reason (27dd4dd: The predecessor combined presence and paired nodes while preserving identity, capabilities, commands, PATH, Rename and Forget.)
• Application session state keeps the original intent (ece8758: Pages observe one application-owned state model instead of maintaining forwarding chains or duplicate session inventories.)
• Reactor compatibility changes intended behavior with a stated reason (a4dd026: Main adopted the preview.16 recycled-anchor workaround while retaining row-targeted scrolling and native compatibility proof obligations.)
• Responsive Config editor changes intended behavior with a stated reason (9de9b5b: The schema-guided editor introduced independent panes, minimum widths and automatic preview collapse; the PR explains adaptation while retaining mounted draft controls.)

Testing

Proof path: in-process harness.

Security

Needs attention: Package provenance checks pass, while current-build authorization evidence for deferred node mutations remains incomplete.

Evidence

Security concerns:

• [medium] Verify deferred mutations at the final Gateway effect — src/OpenClaw.Tray.WinUI/Pages/SystemsPage.xaml.cs:257
  The rewritten dialogs carry a connection epoch and subsequently resolve a live operator client. No reachable bypass was established, but the old authority receipt exercised removed desktop-enable and pairing-approval paths, not current Rename/Forget. Establish rejection before mutation for an operator lacking operator.pairing, a revoked operator and a confirmation carried across a Gateway switch.
  Confidence: 0.91

What I checked:

• Pinned change and main boundary: The introduced comparison adds Systems and removes Instances; the reviewed head remains a mergeable draft authored by a collaborator. (src/OpenClaw.Tray.WinUI/Pages/SystemsPage.xaml.cs:21, 1dd6f568a83a)
• Previous findings reconciled: Legacy ConnectedAt now maps to LastConnectedAt with exact timestamp and null assertions; own-node awareness, pending declarations, desktop availability and a shared scrolling region remain in the current implementation. (tests/OpenClaw.Shared.Tests/Systems/SystemsTests.cs:282, 1dd6f568a83a)
• Unused production aggregate: SessionsAttentionCount and SessionsConnectionEpoch have no production readers; GatewayService already checks client generation and connection epoch before calling the additional AppState admission layer. (src/OpenClaw.Tray.WinUI/Services/AppState.cs:93, 1dd6f568a83a)
• Proof identity and limits: The full body identifies current-candidate verification as source-only and explicitly disclaims current runtime acceptance; both prepared images were inspected, and neither demonstrates the current inline Systems design. (1dd6f568a83a)
• Deferred mutation boundary: Confirmation checks the controller epoch, then the page obtains the live client and checks pairing scope before node mutations; the mounted stale-Forget test records a callback count rather than a real Gateway effect. (src/OpenClaw.Tray.WinUI/Pages/SystemsPage.xaml.cs:257, 1dd6f568a83a)
• Dependency source verified: The PR directly imports Reactor preview.17; Microsoft's release asset digests match both SHA-256 values pinned by the initializer, and the release documents folder-feed distribution. (a61657ff404c)

Likely related people:

• Ranjesh Jaganathan: Raw commit cff1033 adds src/OpenClaw.Tray.WinUI/Services/GatewayService.cs:296 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: cff1033b3bb3; files: src/OpenClaw.Tray.WinUI/Services/GatewayService.cs)
• Scott Hanselman: Raw commit 674b0e5 adds src/OpenClaw.Shared/WindowsNodeClient.cs:557 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: 674b0e5a8373; files: src/OpenClaw.Shared/WindowsNodeClient.cs)

Preflight source

Source unknown. Source comparison at the observed PR snapshot only. Completion is self-reported; body, policy, tests, execution, and report bytes are not verified.

Review metrics

Metric	Value	Why it matters
Production source delta	+6671 / -2105 lines	Includes six localization files and replacement of the old page; the unused attention aggregate is avoidable growth.
Test delta	+5671 / -52 lines	Native rendering, transport and lifecycle coverage serve distinct boundaries, while aggregate-only assertions have no shipped consumer.

Labels

Label changes:

• add merge-risk: 🚨 security-boundary: Deferred confirmations invoke privileged node mutations across connection lifetimes; current final-effect rejection evidence is outstanding.
• add proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp. Replaced prior rating: 🦐 gold shrimp.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.
• remove proof: sufficient: Current real behavior proof status is insufficient, not sufficient.
• remove rating: 🦐 gold shrimp: Current PR rating is rating: 🧂 unranked krab, so this older rating label is no longer current.
• remove status: ⏳ waiting on author: Current PR status label is status: 📣 needs proof.

Label justifications:

• P2: Useful native inventory functionality with bounded user impact and no established urgent regression.
• merge-risk: 🚨 security-boundary: Deferred confirmations invoke privileged node mutations across connection lifetimes; current final-effect rejection evidence is outstanding.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp. Replaced prior rating: 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.
• proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

History

Review history (3 earlier review cycles)

• reviewed 2026-10-27T18:25:49.073Z sha 4cbc221 :: needs real behavior proof before merge. :: [P2] [P2] Preserve the own-node pairing warning | [P2] [P2] Keep machine rows reachable at minimum window height | [P2] [P2] Show an available host desktop instead of waiting indefinitely | [P2] [P2] Retain pending declarations when approved capabilities are empty
• reviewed 2026-10-28T17:55:47.477Z sha f841d88 :: blocked before merge. :: [P3] Preserve connection timestamps in the legacy inventory
• reviewed 2026-10-28T18:01:36.060Z sha f841d88 :: needs changes before merge. :: [P3] Preserve connection timestamps in the legacy inventory

Reviewed November 9, 2026, 6:08 PM ET / 23:08 UTC (Revision 4).

[bkudiess]

Final-head dark worker capture (16183d3). Both full fixture lanes now pass: Debug 32 profile/app + 31 UI tests, Release 32 profile/app + 31 UI tests, all with zero skips. Hosted CI remains blocked by the separately recorded native UI testhost/bootstrap failures; this image is not a CI-pass claim.

[bkudiess]

Addressed the four Systems findings, with latest head f841d88ff4676c41dfa5e11c4c18c94617c3740a and main at 65c7ddba. GitHub now reports the PR mergeable. The bootstrap resolution preserves both diagnostics and main's Windows App SDK 2.6.4 update.

Finding	Correction and proof
Own-node pairing awareness	Read the raw node pairing list and the same canonical device/node IDs used by the approval queue. Keep the queue's own-node prompt filter. Mounted proof shows the own-node-only banner and Connection recovery action, with no self-approval prompt.
Minimum-height inventory	Search, filters, sort and machine rows share one scrolling region. At 400 pixels, mounted native proof measured a 138.29-pixel viewport, scrolled the Studio row fully into view, and selected it.
Available host desktop	Advertised availability is resolved before setup-only waiting guidance. Tests cover setup/no-setup and admin/read-only presentation. Remote viewing/control remains deferred.
Pending-only declarations	Pending initial/reapproval capability or command declarations keep the section visible even when effective capabilities, commands and PATH are empty. All four mounted cases pass.

Authority-chain proof ran against the explicitly approved, task-owned systems-proof native Gateway (OpenClaw 2026.10.8, isolated-session package 0.1.2491.54761). It used production OpenClawGatewayClient and SystemsGatewayClient, generated identities only, and independently re-read persisted state through a separate admin connection:

• Authorized desktop enable and device pairing persisted successfully.
• A read-only operator session received two actual Gateway scope rejections, with no desktop or pairing change.
• Revoking a previously privileged live operator invalidated its connection. Both attempted operations were rejected, and persisted state stayed unchanged.
• The production controller cancelled an operation after a real config.get when its Gateway identity changed; no config.patch was dispatched. This portion simulates the identity switch, not two live Gateways.
• Mounted native approve and reject confirmations were invoked after a Gateway change, before redraw: both closed and dispatched zero mutations.

The original desktop flag was restored, generated identities were removed, and the task-owned Gateway was stopped. No production machines, credentials, or settings were changed.

Latest validation on frozen tree e3ea877, committed unchanged as this head:

Check	Result
.\build.ps1	All five builds and documentation passed
Shared full suite, --no-restore	4766 passed, 25 ordinary skips, 0 failed
Tray full suite, --no-restore	4746 passed, 0 skipped or failed
Focused native Systems/caption/Ready-flow tests	11 passed, 0 skipped or failed
Debug fixture at ddd8e150	32 profile/app + 31 UI passed, 0 skipped
Production-shaped Release fixture at ddd8e150	32 profile/app + 31 UI passed, 0 skipped

Debug and Release real-app UI lanes ran sequentially on the shared desktop. Natural message-240 visibility, long-history restoration and session switching passed in both. Earlier overlapping attempts and a token-file startup lock remain recorded; serial passes are not claimed as a source fix for those failures. Independent bounded rubber-duck review found no blockers.

The first CI attempt exposed a semantic collision with moving main: duplicate placement locals and overlapping catalog fixtures. The final integration keeps one production catalog load, main's current Gateway-environment assertions and the default-workspace contract. The focused protocol case passes; no duplicate empty handlers or weaker expectations remain.

The successful authority proof and serial app fixtures ran on 88d5ad5/ddd8e150, before the last main integration. The Systems owners are unchanged by that integration, but these runs are not presented as new executions of the final merged tree.

Build and Test for this head is running. Historical screenshots and the earlier host-statistics receipt retain their original revision labels. An extra current-source statistics replay was blocked by authentication on the old proof operator identity, so it is not counted as passed. The earlier native-crash cause, fresh whole-app Systems captures and signed-upgrade preservation are not claimed resolved. Gateway-switch proof is scoped above; it is not a two-live-Gateway test.

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: A newer review tuple already exists; this stale result was superseded.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/40750807627
• Updated: 2026-10-28T19:03:46.754Z

[roboclaw-bot]

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/42718143994
• Updated: 2026-11-09T23:10:00.744Z

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	nuget/​microsoft.ui.reactor.advanced@​0.1.0-preview.16 ⏵ 0.1.0-preview.17
	nuget/​system.drawing.common@​10.0.12 ⏵ 10.0.14
	nuget/​microsoft.ui.reactor@​0.1.0-preview.16 ⏵ 0.1.0-preview.17

View full report