feat: Systems shows Gateway machines, live resource readings and related sessions

.editorconfig

@@ -154,9 +154,6 @@ dotnet_diagnostic.REACTOR_DIALOG_001.severity = none
 [src/OpenClaw.Tray.WinUI/Helpers/**/*.cs]
 dotnet_diagnostic.REACTOR_DIALOG_001.severity = none
 
-[src/OpenClaw.Tray.WinUI/Helpers/InstanceManagementControls.cs]
-dotnet_diagnostic.REACTOR_DIALOG_001.severity = none
-
 [src/OpenClaw.Tray.WinUI/Pages/**/*.cs]
 dotnet_diagnostic.REACTOR_DIALOG_001.severity = none
 

.github/workflows/ci.yml

@@ -181,6 +181,10 @@ jobs:
       shell: pwsh
       run: ./scripts/test-proof-evidence.ps1
 
+    - name: Test safe native failure metadata
+      shell: pwsh
+      run: ./scripts/test-ci-native-failure-metadata.ps1
+
     - name: Test read-only agent readiness
       shell: pwsh
       run: ./scripts/test-agent-readiness.ps1
@@ -211,6 +215,10 @@ jobs:
         ./scripts/test-ci-workflow-contract.ps1
         ./scripts/test-ci-crash-metadata-source.ps1
 
+    - name: Validate official Reactor package bootstrap
+      shell: pwsh
+      run: ./scripts/test-reactor-packages.ps1
+
     - name: Validate MSIX CI artifacts
       shell: pwsh
       run: ./scripts/test-msix-ci-artifacts.ps1
@@ -608,6 +616,8 @@ jobs:
 
     - name: Restore tray test projects
       run: |
+        $ErrorActionPreference = 'Stop'
+        ./scripts/Initialize-ReactorPackages.ps1
         dotnet restore src/OpenClaw.Tray.WinUI -r win-x64
         dotnet restore tests/OpenClaw.Tray.Tests -r win-x64
         dotnet restore tests/OpenClaw.SetupEngine.Tests -r win-x64
@@ -711,6 +721,8 @@ jobs:
 
     - name: Restore UI test projects
       run: |
+        $ErrorActionPreference = 'Stop'
+        ./scripts/Initialize-ReactorPackages.ps1
         dotnet restore tests/OpenClaw.Tray.UITests -r win-x64
         dotnet restore tests/OpenClawTray.FunctionalUI.Tests -r win-x64
 
@@ -779,6 +791,7 @@ jobs:
         -Runtime win-x64
         -Filter "Category!=Accessibility&Category!=NativeOnboardingProof&Category!=GatewayFixture&Category!=AnimationPreferenceEnabled&Category!=AnimationPreferenceDisabled"
         -HangTimeoutSeconds 300
+        -CollectNativeFailureMetadata
         -CaptureHostExit
 
     - name: Capture non-memory Tray UI crash metadata
@@ -1001,6 +1014,8 @@ jobs:
 
     - name: Restore E2E project graph
       run: |
+        $ErrorActionPreference = 'Stop'
+        ./scripts/Initialize-ReactorPackages.ps1
         dotnet restore src/OpenClaw.Tray.WinUI -r win-x64
         dotnet restore tests/OpenClaw.E2ETests -r win-x64
 
@@ -1077,6 +1092,8 @@ jobs:
 
     - name: Restore E2E project graph
       run: |
+        $ErrorActionPreference = 'Stop'
+        ./scripts/Initialize-ReactorPackages.ps1
         dotnet restore src/OpenClaw.Tray.WinUI -r win-x64
         dotnet restore tests/OpenClaw.E2ETests -r win-x64
 
@@ -1153,6 +1170,8 @@ jobs:
 
     - name: Restore E2E project graph
       run: |
+        $ErrorActionPreference = 'Stop'
+        ./scripts/Initialize-ReactorPackages.ps1
         dotnet restore src/OpenClaw.Tray.WinUI -r win-x64
         dotnet restore tests/OpenClaw.E2ETests -r win-x64
 
@@ -1316,7 +1335,10 @@ jobs:
         restore-keys: nuget-${{ runner.os }}-
 
     - name: Restore WinUI Tray App
-      run: dotnet restore src/OpenClaw.Tray.WinUI -r win-x64
+      run: |
+        $ErrorActionPreference = 'Stop'
+        ./scripts/Initialize-ReactorPackages.ps1
+        dotnet restore src/OpenClaw.Tray.WinUI -r win-x64
 
     - name: Download signed cleanup host
       if: needs.sign-cleanup-host.result == 'success'
@@ -1404,7 +1426,10 @@ jobs:
         restore-keys: nuget-${{ runner.os }}-
 
     - name: Restore WinUI Tray App
-      run: dotnet restore src/OpenClaw.Tray.WinUI -r win-arm64
+      run: |
+        $ErrorActionPreference = 'Stop'
+        ./scripts/Initialize-ReactorPackages.ps1
+        dotnet restore src/OpenClaw.Tray.WinUI -r win-arm64
 
     - name: Download signed cleanup host
       if: needs.sign-cleanup-host.result == 'success'

.github/workflows/codeql.yml

@@ -82,7 +82,10 @@ jobs:
           dotnet-version: 10.0.x
 
       - name: Restore dependencies
-        run: dotnet restore
+        run: |
+          $ErrorActionPreference = 'Stop'
+          ./scripts/Initialize-ReactorPackages.ps1
+          dotnet restore
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4

.github/workflows/release-candidate-e2e.yml

@@ -387,6 +387,8 @@ jobs:
         working-directory: app-under-test
         shell: pwsh
         run: |
+          $ErrorActionPreference = 'Stop'
+          & "$env:GITHUB_WORKSPACE/scripts/Initialize-ReactorPackages.ps1" -DestinationDirectory (Join-Path (Get-Location) 'artifacts/reactor-packages')
           dotnet restore src/OpenClaw.Tray.WinUI -r win-x64
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           dotnet build src/OpenClaw.Tray.WinUI -c Debug -r win-x64 --no-restore

DESIGN.md

@@ -1027,6 +1027,48 @@ The [120-DPI comparison](.agents/design/reference/chat-comparison.png) preserves
 
 The Colophon catalog now uses the actual geometry, semantic alpha brushes and Fluent glyphs. It is **not a verified pixel-identical native renderer**: Mica is wallpaper/activation-dependent; this host's native UI Automation reports Segoe UI Variable while Chromium resolves the requested family to Segoe UI; and text rasterization/layout rounding differ. The installed schema also lacks responsive breakpoints, row-hover opacity, gradient elevation borders and native input/flyout behavior. Fixed-size references must not become production layout code. High-contrast preview swatches are resource simulations, not evidence of Windows HC mode.
 
+## Systems page
+
+Machine, worker and connected-app card lists use spacing token `2`
+(`PageResponsiveLayout.GapInner`, 8 effective pixels) between individually
+rounded, bordered rows. An expanded machine keeps its contents inside that row's
+boundary. Dense capability, session and diagnostic rows are not card lists;
+statistic grids retain their separate 12-pixel grid spacing.
+
+The Systems page (`Systems/SystemsPageView.cs`, Reactor) has more personality than the calm settings surfaces, because it is a fleet dashboard. Its palette lives in `Themes/SystemsResources.xaml`, with Default, Light and HighContrast dictionaries:
+
+| Role | Resource | Dark | Light |
+| --- | --- | --- | --- |
+| Load, Gateway host | `SystemsLoadBrush` | `SystemAccentColorLight2` | `SystemAccentColorDark1` |
+| Memory, paired nodes, sessions | `SystemsMemoryBrush` | #B9A4FF violet | #6B4FBB violet |
+| Disk, workers, storage | `SystemsDiskBrush` | #5FD4D9 teal | #00747A teal |
+| Neutral, connected apps | `SystemsNeutralBrush` | `TextFillColorSecondary` | `TextFillColorSecondary` |
+
+- **Usage.** Each hue has a `*TintBrush` (same color at 10-16% opacity) for glyph chips, pills and meter tracks. Success, caution and critical states use the native `SystemFillColor*` brushes with matching `Systems*TintBrush` tints. The shared native adapter `Presentation/Adapters/PageHero.cs` owns the hero's Windows-accent gradient inside the card; there is no full-page wash.
+- **Rules.**
+  - Load follows the user's accent. Violet and teal are fixed so the three metrics stay distinguishable.
+  - Every hue appears with a glyph and a text label, so status never relies on color alone.
+  - In high contrast, every hue maps to `SystemColorHighlightColor` or window colors. The hero wash is removed.
+- **Scope.** Statistics show the latest reported reading, a usage meter and its age; there are no trend charts. Windows nodes report processor count, memory and system-drive space, so no processor usage is shown for them. The page reports desktop availability only. Desktop viewing and setup, storage and backup administration, and other deeper machine work stay in the web interface behind the single page-level "Open in web" button. It opens the web Systems page when supported, or the web root on an older Gateway; it does not promise a selected-machine destination, so the machine identifier remains copyable.
+- **Responsive container.** `Presentation/PageResponsiveLayout.cs` owns page-host (not window) tiers: Wide at 1000 or more effective pixels, Medium at 720-999, Narrow below 720, supported down to 480. Content is centered, capped at 1200, with 32-pixel horizontal margins (20 on Narrow). Horizontal scrolling and measurement are disabled. The hero and inventory share one scroll. The production window minimum remains 800; narrower proof mounts the actual page in the existing test viewport.
+- **Page anatomy.** The shared hero card contains the Systems title, a real Gateway attachment sentence and wrapping Open in web/Add a system actions. The title is 28 semibold, 24 on Narrow; actions center vertically on wider layouts and move below the copy on Narrow. Card radius is 8, padding 24,20 (16 on Narrow), with a noninteractive system-accent gradient inside the card. Online and Issues are the only summary tiles. Measured content width governs their shared layout: two equal columns down to 380, one below it. Online reports machine rows, not connected apps or workers; disconnected copy qualifies retained counts as last reported. Unknown data is not a zero or a successful current report. Refresh is beside the inventory heading. Add a system explains the three pairing steps before opening Connection. "Devices and Gateway" always shows the complete reported inventory in online-first order, without search, status filters or sort controls. Workers and Connected apps retain their own groups. Independent native Expanders preserve siblings and scroll position. Inventory groups keep stable identities when a preceding pairing group is added or removed; a default selection arriving after the initial load expands only after its current native row has loaded. Intentional collapse survives later inventory refreshes.
+- **Row attention.** There is no Needs you section or separate Issues view. Pending pairing requests appear first as distinct rows with Wants to join and Review. Machines and workers carry all existing approval, reapproval, offline, update, disabled-permission or reported-error badges in one stable wrapping host below the name and subtitle at every width. This intentionally replaces wide inline placement, preserving the identity's full width and the badge host's native parent across tier changes. Identity stack spacing is 2; the badge host has a 4-pixel top margin, 6-pixel item gaps and 4-pixel line gaps. Badge order, copy and motion remain unchanged. Only names ellipsize; badges retain their words and full-reason tooltips. Issues counts badged inventory entries and pending-request rows, not individual reasons; its action reveals, focuses and highlights the first current badged row without hiding inventory. Row details retain the explanation and appropriate resolution action. Pairing review and offline recovery open Connection; local Windows permission review opens Permissions; remote administration uses Open in web. Systems does not approve pairings or repair remote operating systems. Backup reads, the Last backup tile and backup badges remain closed.
+- **Inline details.** Multiple rows may remain expanded independently. Names and subtitles stay single-line with ellipsis and tooltips. Status is a glyph and text, not a filled pill, capped in width so it cannot starve the name. On Narrow, metadata moves below the subtitle, decorative badges disappear, and the chevron stays centered at the right. One native CommandBar owns all node actions and reverse-priority dynamic overflow, with mutations disabled when pairing access is absent. Flat, small-heading sections place Capabilities in a fixed 340-pixel column, then a 32-pixel gap, then Resources, Desktop availability and Related sessions, only on Wide; Medium and Narrow stack with a fixed 16-pixel gap. Resource tiles use equal columns, at least 160 pixels each with 12-pixel gaps, computed from the available inline pane after padding and the container cap. A single tile in the last row stretches across the available columns; other incomplete rows retain equal tile widths. Tiles show value, label and meter without icon badges; freshness sits beside Resources and report age at the right. Every page poll re-renders ages and Live versus Last known, including when nothing, a worker or a connected app is selected, without an extra Gateway read. Presence-only apps expose diagnostic presence data, never machine actions, resources or sessions.
+- **Header spacing and metadata.** Machine header content has 8-DIP vertical padding so badges do not touch the native row border. Medium and Wide rows reserve the same 180-DIP metadata column, with status and secondary text aligned at its start; Narrow rows keep metadata below the identity. Update summaries use the short localized "Update required" label, with full instructions retained in the tooltip and expanded details. The Expander still owns its template, chrome and interaction states.
+- **Dialogs.** Add and Forget use native ContentDialog title templates with an inline glyph badge. Width is capped at the smaller of 560 and viewport minus 48 on the visible dialog card, so the native overlay spans the window and the card stays centered. Forget explains unpairing from the reviewed Gateway and reapproval, without speculating about active sessions. A 120-pixel label column presents platform, last seen and paired date; below 400 pixels of dialog width labels move above values. The scoped native footer keeps Forget left with AccentButtonStyle and Cancel right normally, and stacks full-width primary then close buttons on Narrow. Forget has no default button and initially focuses Cancel. Add initially focuses Open Connection. Responsive updates never reset focus. Confirmation retains its Gateway epoch guard.
+- **Disclosure and copy.** Diagnostics starts collapsed, with commands and PATH in nested expanders. Copied diagnostic summaries are allowlisted and exclude both raw commands and PATH. Related sessions use a subtle icon-only chat button whose accessible name includes the title. No selection animation or resource history is shown.
+- **Motion and mast alignment.** The shared hero supplies reduced-motion-aware entrance, reflow and attention-jump transitions; the page applies them to inventory and pairing rows too and observes changes to Windows animation settings. Open in web and Add a system retain native control states and centered glyphs, without icon-specific offsets. Refresh remains a separate inventory action.
+- **Hero focus continuity.** The native hero adapter keeps glyph, copy and action containers as fixed siblings under one three-column, two-row Grid. Narrow placement changes only Grid attachments, spans, margins and alignment, never the action parent. Crossing 720 in either direction must retain the original native Add button, action host and focused object without programmatic refocusing.
+- **Reported labels and dates.** Records and examples are never invented. Known capabilities use native translations. Unrecognized capability labels only replace separators and capitalize the first character; the exact Gateway ID remains in the tooltip and permission lookup.
+
+Disconnected inventory keeps one error recovery banner under the hero and an
+honest last-report sentence. Retained resource tiles each carry a Last known
+label, so freshness remains visible when their heading scrolls out of view.
+Named joining devices appear in the row title, not repeated in the guidance.
+The alternative hero implementation is awaiting its final shared-helper snapshot
+and current-source Light/Dark visual acceptance; this contract is not a claim of
+completed native proof.
+
 ## Workspace shell
 
 ### Navigation search popup

DEVELOPMENT.md

@@ -171,6 +171,19 @@ Legacy MXC payload cleanup uses the Windows PowerShell included with Windows and
 
 ### Build Individual Projects
 
+Before a direct WinUI build, restore, run, or the first Visual Studio restore,
+initialize the repository-local feed for the published Reactor packages:
+
+```powershell
+.\scripts\Initialize-ReactorPackages.ps1
+```
+
+`NuGet.Config` maps Reactor exclusively to this verified feed. `build.ps1` and
+`run-app-local.ps1` initialize it before building; `run-app-local.ps1 -NoBuild`
+does not acquire packages and requires existing output. Shared-only builds do
+not require Reactor. The initializer does not change the global NuGet cache or
+configuration.
+
 **Shared Library:**
 ```bash
 dotnet build src/OpenClaw.Shared

NuGet.Config

@@ -2,9 +2,14 @@
 <configuration>
   <packageSources>
     <clear />
+    <add key="reactor-release" value="artifacts/reactor-packages" />
     <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
   </packageSources>
   <packageSourceMapping>
+    <packageSource key="reactor-release">
+      <package pattern="Microsoft.UI.Reactor" />
+      <package pattern="Microsoft.UI.Reactor.Advanced" />
+    </packageSource>
     <packageSource key="nuget.org">
       <package pattern="*" />
     </packageSource>

README.md

@@ -214,11 +214,18 @@ the same runtime resolver as the app build and rejects a missing or outdated com
 Direct WinUI builds require a runtime identifier:
 
 ```powershell
+.\scripts\Initialize-ReactorPackages.ps1
 dotnet build .\src\OpenClaw.Tray.WinUI\OpenClaw.Tray.WinUI.csproj -r win-x64
 dotnet build .\src\OpenClaw.Tray.WinUI\OpenClaw.Tray.WinUI.csproj -r win-arm64
 dotnet build .\src\OpenClaw.Tray.WinUI\OpenClaw.Tray.WinUI.csproj -r win-x64 -p:PackageMsix=true
 ```
 
+The initializer verifies the published Reactor packages in the repository-local
+feed selected by `NuGet.Config`. Run it before direct restore/build/run commands
+or the first Visual Studio restore. `build.ps1` and `run-app-local.ps1` perform
+this step automatically when building; `-NoBuild` uses existing output without
+acquiring packages. No global NuGet configuration or cache is changed.
+
 ### Run
 
 ```powershell

build.ps1

@@ -585,6 +585,9 @@ function Build-Project($name, $path, $useRid = $false, $packageMsix = $false) {
             $dotnetArgs += "-p:MsixPackageBaseVersion=$effectiveMsixBaseVersion"
         }
     }
+    if ($name -eq "WinUI" -or $name -eq "Tray") {
+        & (Join-Path $repoRoot "scripts\Initialize-ReactorPackages.ps1")
+    }
     $result = Invoke-DotNetCaptured $dotnetArgs
     $exitCode = $LASTEXITCODE