[roboclaw-bot]

What Problem This Solves

Fixes: Disconnect replaces a loaded native conversation with connection guidance.

Related: #1795 (fix: retain the selected assistant and conversation after reconnect); Workspace selection only.

User Impact

Keeps the loaded conversation offline; verified authority gates recovery. Draft: native/UI proof, CI and fork-first workflow compliance remain unresolved.

Why This Change Was Made

Existing owners retain state and verify recovery. No new transcript cache, client or credential reads.

Evidence

Current draft candidate: f9dbbaa. Windows CI qualification pending.

This update preserves the retention/security implementation and applies the reader-anchor and reload correction. Native anchoring remains enabled: bottom while following, top for an established reader away from the tail. Reload reattaches observation and positions only for following or admitted initial history. Unload retains initial admission, while version invalidation, queue clearing and detachment retire old work. Explicit cancellation, replacement and successful initial-dispatch boundaries remain.

Fresh final-source focused evidence: 57 timeline policy/source-contract cases passed, 0 failures/skips. The new lifecycle characterization failed before removing the unload admission clear, then passed after the correction. This is not WinUI compilation or native runtime proof. The earlier 91-case broad selection predates the correction and is not additive.

Independent source review identified initial-admission loss across Request -> non-tail ViewChanged -> Unloaded -> Loaded. The correction retains admission without retaining queued work. Canonical helper attempts returned outer aborted without final reports; no helper clean verdict is claimed.

Historical evidence from earlier published candidates, not current-head qualification

Current diagnostic continuation: f8508b7

The audit repairs below remain the published 9da baseline. This candidate appends only bounded test-owned diagnostics in the existing native Disconnect case (one file, +94/-1). It is not a claimed repair of reader-position loss. The exact anchor locator, 4-pixel tolerance, positioning predicate, scroll-percentage bounds, draft/input identity, disabled-IO and ordinary-Send assertions are unchanged. No sleep, retry, skip, viewport manipulation or production export was added.

At before-disconnect, offline-mounted and offline-anchor-failure, the normal failed-test output now records explicitly SYNTHETIC message ordinal, original expected offsets, freshly queried anchor/viewport/intersection rectangles, relative offsets, offscreen/visibility flags, UIA RuntimeIds, native scroll percentage/view size, selected-fixture-reader flag and real render/history/positioning receipt fields. Raw request keys are fingerprinted. No arbitrary UI/chat text, tree dump or exception message is logged. The existing provider snapshot is reduced to availability/readiness/history booleans only after the assertion has already failed, so it cannot refresh history and rescue the tested boundary. There are no newly authored test cases in this diagnostic-only delta.

Source reconstruction: Settings suspends but does not dispose the mounted chat; returning Home restores the existing page, queues the retained session and restores focus. Offline composer status can change layout, and the positioner/ScrollView owns navigation/anchoring. These are candidate boundaries, not an established failure cause. Actual baseline/offline geometry is not yet observed for this candidate. The protected 9da diagnostics archive was not accessed through another identity or transport.

Qualification for this delta:

• The five actual fixture source files compiled against real cached Windows reference assemblies and existing source-qualified fixture dependencies. Compiler-only check, not the WinUI application build, discovery or native execution.
• Independent OpenClaw-engine P0-P3 source review (effective openai/gpt-6.1-sol): scoped-clean, no actionable findings, source-only.
• Required Shared command rerun: 4482 passed / 337 failed / 25 skipped,4844 actual TRX rows. Required Tray command reached its existing 480-second bounded validation deadline without a terminal TRX; earlier4688-pass counts are not substituted for this attempt. Full local gates remain red/unverified. Exact commands were dotnet test tests/OpenClaw.Shared.Tests/OpenClaw.Shared.Tests.csproj --no-restore -p:BuildProjectReferences=false and dotnet test tests/OpenClaw.Tray.Tests/OpenClaw.Tray.Tests.csproj --no-restore, with invocation-specific TRX logging under .openclaw/tmp/retention-audit-repairs/reader-diagnostics. The old753+150 focused selections were not replayed or presented as new-head execution.
• ./build.ps1 remained permission/PowerShell blocked; setup-dev.ps1 -CheckOnly could not run without pwsh. The normal Windows-targeted UI project build reached CS0006 missing Windows project-reference assemblies. The separate compiler-only check does not waive this gate.
• Normal candidate CI is run 41560429591, observed queued/in progress. No workflow rerun or special dispatch was requested. Native diagnostic output and causal repair remain pending that exact-head execution.
• Last published ClawSweeper scores3/3/3 reviewed 9da, not this diagnostic head. No new re-review request was posted. Native, production-shaped Release runtime, fresh-install/actual installed-upgrade and fork-first gaps remain open.

Published audit repair baseline

Audit repair baseline: 9da2645. Scoped test-audit repairs A5/A6/A7/A9, not a new transport design. Final source-bound local selections: 753 owning tests + 150 protocol tests passed, no failures/skips. Native A5 compiled and executed in Windows CI, but failed the offline visible-reader-anchor check before reconnect. Current-head Release compilation passed. The uploaded native diagnostics remain uninspected because artifact payload access is blocked. The old46-case aggregate does not qualify these changed tests.

Audit item	Disposition
A5	Existing native Disconnect case now captures an actually visible mid-history text anchor and viewport-relative offset, requires a new history reply/revision, then waits for request-correlated native positioning/scroll completion and rendered geometry before rechecking the anchor. Draft, mounted input identity, selected session, disabled IO, strict scroll and ordinary Send checks remain. Four new receipt/safety unit facts passed locally. Current-head native case executed and failed at the offline visible-anchor/viewport-offset check (line45); reconnect fresh-history/positioning checks were not reached. Cause is not yet established.
A6	Exact authority request observations and actual final owner-post acknowledgements replace early drains/250ms absence windows. Retry commit is completed and queued, authority invalidated, then that known commit dispatched. Malformed/denied paths require terminal Failed.18 existing data rows were strengthened and passed; the containing lifetime selection has27 passes including the new A7 fail-closed case. These are not27 authored tests.
A7	10 new protocol-owner cases:8 literal malformed collection/row/duplicate cases plus independent empty/nonempty controls, through the existing real loopback client. One fail-closed lifetime case retained at the distinct binding boundary.
A9	Five executable navigation-identity cases replace one incidental source-slicing assertion. Actual timeline caller uses the tested projection. Root workflow prohibitions/ledger retirement remain; full effect-dependency spelling/order is no longer pinned.

Authored cases are not suite totals:20 authored unit/protocol cases (net19 additional executed cases), plus one strengthened existing native case. Existing lifecycle cases were also strengthened. No coverage deletion quota, skip, assertion relaxation, arbitrary settling sleep or test-only public API was introduced.

Negative controls failed at their intended assertions, not setup/compilation: row-count guard removed4/10 failures; duplicate guard removed1/10; the fail-closed lifetime control1/1; queued final token fence removed3/6; history revision made explicit navigation1/5; premature native receipt1/1. Missing render-revision receipt first failed2/5, then passed after extending the existing passive receipt. All temporary mutations were restored and the final assemblies recompiled. The original native tail-jump mutation still needs Windows execution.

An independent P2 review found input-idle alone insufficient. It was repaired using a passive fixture-only observer of the existing positioner's pending dispatch/layout work, real BringingIntoView/ScrollCompleted correlation IDs, native Idle and two actual composition frames. It cannot request navigation. Final independent P0-P3 source review: scoped-clean, not native proof or a Diamond rating.

Current-candidate stored-data interoperability

Recovered from the already-completed final owning TRX, not a rerun: OpenClaw.Tray.Tests.ChatProviderConnectionSecurityTests.LatestStableStoredProfileAndSigningIdentitySurviveCurrentReconnect Passed on candidate 9da264564ef72438d0b30cc2e0fdc1f03bc81880, executed 2026-11-03T00:14:00.1170890+00:00 (duration 00:00:00.1344708). It is included in the753-test owning selection whose exact command is below.

Actual test stdout:

stable-data producer=v2026.9.8-1; stored-key-signature=valid; identity-regenerated=false; shared-fallbacks=0; retained-reconnect=true

The fixture was emitted by the released DeviceIdentity/GatewayRegistry writers from stable v2026.9.8-1, source 2ba89f377ce8ce3f5ddfc452e4d509329f109114, asset OpenClawTray-2026.9.8-1-win-x64.zip SHA-256 c50955809afdd07c0d2c17f30bf7c45cf06bed09d751a915bd92945be27f2047. Fixture provenance and generated-file hashes are checked in alongside the exact producer. The current test verifies the stored public-key signature, device-token precedence without shared fallback, readable history/current send after reconnect and byte-identical stored files. The current test-owner source SHA-256 is 6f6810ed7046e4e37003f2e5f87f2dda9f5cbf95b2b99f96721020b3e9506326. Only the in-memory route is redirected to that owned synthetic loopback server.

This is current-reader/stored-format compatibility evidence, not actual installed-upgrade, native UI, real Gateway or provider proof. The installed-upgrade/current native behavior gates remain open. No protected artifact download, new test run or extra review request was used to recover this evidence.

Historical de5 production-client transport proof follows. It is not execution evidence for the new audit tests; its original source/assembly hashes and limits are preserved:

Inspectable transport request census and ordering

Historical evidence head: de5e667. Command run in this owned Linux x64 workspace with .NET SDK10.0.400:

dotnet test tests/OpenClaw.Tray.Tests/OpenClaw.Tray.Tests.csproj --no-build --no-restore --filter "FullyQualifiedName~RetiredProfileCannotWriteQueuedChatToTheSurvivingSocket|FullyQualifiedName~VerificationRosterTimeoutCannotBeDivertedToAnIndependentBootstrapRead" --logger "console;verbosity=detailed" --logger "trx;LogFileName=wire-inspectable-final.trx" --results-directory .openclaw/tmp/retention-diamond

Copied actual TRX Standard Output, not expected output. Request ordinals/census are recorded on the receiving server. The canceled task settles while the production send lock is held; an acknowledged health response follows release, then fresh profile/roster verification admits exactly one selected-session send and a final acknowledged health barrier. No random-delay absence window is used.

OpenClaw.Tray.Tests.ChatProviderConnectionSecurityTests.VerificationRosterTimeoutCannotBeDivertedToAnIndependentBootstrapRead

roster-observed authority=False; outcome=pending
roster-observed authority=True; outcome=pending

OpenClaw.Tray.Tests.ChatProviderConnectionSecurityTests.RetiredProfileCannotWriteQueuedChatToTheSurvivingSocket(revoked: True)

{"sequence":1,"stage":"old-send-queued-send-lock-held","invalidation":"manager-auth-observation","connected":true,"handshake":1,"bound":true,"chatSendCount":0,"events":[],"requests":[]}
{"sequence":2,"stage":"authority-invalidated-provider-retired-send-lock-held","invalidation":"manager-auth-observation","connected":true,"handshake":1,"bound":false,"chatSendCount":0,"events":[],"requests":[]}
{"sequence":3,"stage":"old-send-task-settled-before-release","outcome":"TaskCanceledException"}
{"sequence":4,"stage":"serialized-send-lock-released","invalidation":"manager-auth-observation","connected":true,"handshake":1,"bound":false,"chatSendCount":0,"events":[],"requests":[]}
{"sequence":5,"stage":"health-response-acknowledged-after-settled-old-send","invalidation":"manager-auth-observation","connected":true,"handshake":1,"bound":false,"chatSendCount":0,"events":[],"requests":[{"ordinal":8,"Method":"health","SessionKey":null,"AuthorityScoped":false,"Outcome":"ok"}]}
{"sequence":6,"stage":"fresh-authority-verified","sessionKey":"agent:research:fixture-other","sessionId":"00000000-0000-4000-8000-000000000003"}
{"sequence":7,"stage":"authorized-chat-send-acknowledged-final-health-barrier","invalidation":"manager-auth-observation","connected":true,"handshake":1,"bound":true,"chatSendCount":1,"events":[],"requests":[{"ordinal":8,"Method":"health","SessionKey":null,"AuthorityScoped":false,"Outcome":"ok"},{"ordinal":9,"Method":"users.self","SessionKey":null,"AuthorityScoped":true,"Outcome":"ok"},{"ordinal":10,"Method":"sessions.list","SessionKey":null,"AuthorityScoped":true,"Outcome":"ok"},{"ordinal":11,"Method":"models.list","SessionKey":null,"AuthorityScoped":false,"Outcome":"ok"},{"ordinal":12,"Method":"sessions.list","SessionKey":null,"AuthorityScoped":false,"Outcome":"ok"},{"ordinal":13,"Method":"models.list","SessionKey":null,"AuthorityScoped":false,"Outcome":"ok"},{"ordinal":14,"Method":"chat.send","SessionKey":"agent:research:fixture-other","AuthorityScoped":false,"Outcome":"ok"},{"ordinal":15,"Method":"health","SessionKey":null,"AuthorityScoped":false,"Outcome":"ok"}]}
final-effect invalidation=manager-auth-observation; stale-chat-writes=0; current-chat-writes=1; unchanged-socket-handshake=1

OpenClaw.Tray.Tests.ChatProviderConnectionSecurityTests.RetiredProfileCannotWriteQueuedChatToTheSurvivingSocket(revoked: False)

{"sequence":1,"stage":"old-send-queued-send-lock-held","invalidation":"wire-profile-identity","connected":true,"handshake":1,"bound":true,"chatSendCount":0,"events":[],"requests":[]}
{"sequence":2,"stage":"authority-invalidated-provider-retired-send-lock-held","invalidation":"wire-profile-identity","connected":true,"handshake":1,"bound":false,"chatSendCount":0,"events":[],"requests":[]}
{"sequence":3,"stage":"old-send-task-settled-before-release","outcome":"TaskCanceledException"}
{"sequence":4,"stage":"serialized-send-lock-released","invalidation":"wire-profile-identity","connected":true,"handshake":1,"bound":false,"chatSendCount":0,"events":[],"requests":[]}
{"sequence":5,"stage":"health-response-acknowledged-after-settled-old-send","invalidation":"wire-profile-identity","connected":true,"handshake":1,"bound":false,"chatSendCount":0,"events":[],"requests":[{"ordinal":8,"Method":"users.self","SessionKey":null,"AuthorityScoped":true,"Outcome":"ok"},{"ordinal":9,"Method":"health","SessionKey":null,"AuthorityScoped":false,"Outcome":"ok"},{"ordinal":10,"Method":"sessions.list","SessionKey":null,"AuthorityScoped":true,"Outcome":"pending"}]}
{"sequence":6,"stage":"fresh-authority-verified","sessionKey":"agent:research:fixture-other","sessionId":"00000000-0000-4000-8000-000000000003"}
{"sequence":7,"stage":"authorized-chat-send-acknowledged-final-health-barrier","invalidation":"wire-profile-identity","connected":true,"handshake":1,"bound":true,"chatSendCount":1,"events":[],"requests":[{"ordinal":8,"Method":"users.self","SessionKey":null,"AuthorityScoped":true,"Outcome":"ok"},{"ordinal":9,"Method":"health","SessionKey":null,"AuthorityScoped":false,"Outcome":"ok"},{"ordinal":10,"Method":"sessions.list","SessionKey":null,"AuthorityScoped":true,"Outcome":"ok"},{"ordinal":11,"Method":"models.list","SessionKey":null,"AuthorityScoped":false,"Outcome":"ok"},{"ordinal":12,"Method":"sessions.list","SessionKey":null,"AuthorityScoped":false,"Outcome":"ok"},{"ordinal":13,"Method":"chat.send","SessionKey":"agent:research:fixture-other","AuthorityScoped":false,"Outcome":"ok"},{"ordinal":14,"Method":"models.list","SessionKey":null,"AuthorityScoped":false,"Outcome":"ok"},{"ordinal":15,"Method":"health","SessionKey":null,"AuthorityScoped":false,"Outcome":"ok"}]}
final-effect invalidation=wire-profile-identity; stale-chat-writes=0; current-chat-writes=1; unchanged-socket-handshake=1

Profile reassignment is delivered over the real fixture socket and awaited through SelfProfileChanged. The auth branch is the existing production lifetime owner receiving a typed manager Auth observation while that socket survives. It is not server-side credential revocation, a real installed Gateway, native UI or upgrade proof.

SHA-256 of source read for the build/run:

{
  "src/OpenClaw.Shared/OpenClawGatewayClient.RequestLifetime.cs": "11163ff9d6682e872ba0ba666cdc3d7664b9e044c224ec9250c86e6892dd4633",
  "src/OpenClaw.Shared/WebSocketClientBase.cs": "18b301fd4d57740ef7dac3a77d381be1daeae0ea20bda5c2f2f2a0176d295088",
  "src/OpenClaw.Tray.WinUI/Chat/ChatProviderConnection.cs": "74cd395e9d7117ce819ecbc6d822cd3ca0e675bd6136899bbc25d7a14c7dcb10",
  "src/OpenClaw.Tray.WinUI/Chat/RetainedChatGatewayBridge.cs": "d16e29947d6774e6af55165699461d31ec5fd3fc33dacf7341b60961153cedf7",
  "tests/OpenClaw.TestSupport/Gateway/FixtureGatewayServer.cs": "7bd7533dc385a65d529799e5b3d0cc1adbe089a921e4b2b602751e12c62a546c",
  "tests/OpenClaw.Tray.Tests/ChatProviderConnectionRecoveryTests.cs": "05851d89b1a530e3e2f67f6c7272fefabdb28051fec05e048f641f55e4385828",
  "tests/OpenClaw.Tray.Tests/ChatProviderConnectionSecurityTests.cs": "06d992bea0b03fc13c541c336f3cff37eefcd12cf8504233a9c7b8ac6ffb5de8",
  "tests/OpenClaw.Tray.UITests/GatewayFixtureUiTests.VerificationRecovery.cs": "028ae32d4e0320a66f34cb198d4340d35b0d47ea0bf01baa1f9d12b2968f3142"
}

Executed assembly SHA-256:

{
  "src/OpenClaw.Shared/bin/Debug/net10.0/OpenClaw.Shared.dll": "d2c47f992392468fecae47243c1028aca52c6e4733408af82cc3839489a3153b",
  "src/OpenClaw.Connection/bin/Debug/net10.0/OpenClaw.Connection.dll": "1d87e7564285dd5a365e77b11ef6ad0e6ef2252e035df7b67e1e170c7b05337f",
  "tests/OpenClaw.TestSupport/bin/Debug/net10.0/OpenClaw.TestSupport.dll": "647fddff911e61f3563cde4a76158efc413adf3a680cb598ede22466b07c8003",
  "tests/OpenClaw.Tray.Tests/bin/Debug/net10.0/OpenClaw.Tray.Tests.dll": "4d93769b87fdd6e5fd576298bf0318288c1094e61dd97163641e27e28348e135",
  "tests/OpenClaw.Shared.Tests/bin/Debug/net10.0/OpenClaw.Shared.Tests.dll": "841bfe32a9a44b64c621f673815b1846db0ae5b04f42ed08bb17e137af9049ed"
}

Requested by Vitor Cepeda Lopes.

Work sessions

• Original discussion
• Implementation and verification

Change Type

• Bug fix
• Feature
• Refactor
• Docs or instructions
• Tests or validation
• Security hardening
• Chore or infrastructure

Scope

• Tray or WinUI UX
• Windows node capability
• Local MCP or winnode
• Gateway, connection, or pairing
• Setup or onboarding
• Permissions, privacy, or security
• Tests, CI, or docs

Required proof pools

• windows-winui-interactive: transcript/draft continuity, viewport anchoring, page reload and reconnect UX. Not verified on the current head. Hosted synthetic fixture execution is separate from interactive/visible proof.
• windows-wsl-gateway-e2e: verified Gateway recovery and routing. Ordinary Windows CI is requested; results must bind to the exact new head. Synthetic fixtures alone are not live Gateway proof.
• windows-clean-installer-upgrade: installed-profile preservation and previous-version upgrade. Not verified; no new host lease, install or shared-runtime authority is implied.

Validation

Current candidate f9dbbaa:

• Final-source timeline selection: 57 passed, 0 failed, 0 skipped. Test command: dotnet test tests/OpenClaw.Tray.Tests/OpenClaw.Tray.Tests.csproj --no-restore --filter FullyQualifiedName~ChatTimelinePresentationTests, with TRX output and task-owned isolated data/toolchain.
• Production-lifecycle source regression: 1 intended failure before correction, then included in the 57-case pass. Earlier mutations and the 91-case broad selection are historical evidence, not additional current-head cases.
• Required full Shared and Tray suites were attempted. Each reached the 480-second deadline during actual VSTest/xUnit execution, after assemblies built. No terminal TRX or full pass total was produced. Logs contain 217 Shared failure records/18 skipped records and 154 Tray failure records/3 skipped records, not terminal totals. Real assertion failures, Windows-only missing files/commands/APIs and three native-thread-start OutOfMemoryException failures occurred. No blanket host-only attribution or full-gate pass is claimed. No GitVersion/No base versions blocker appeared in these runs.
• Full repo build, prerequisite CheckOnly and docs validation were blocked locally by script execution/missing PowerShell. Native UI cross-build failed CS0006 for missing Windows project-reference assemblies. Earlier fixture-only compiler success is not native app build proof.
• git diff --check passed. The strict native fixture remains byte-identical to the preserved candidate: no 4px tolerance increase, fresh-history/draft/send relaxation or new skip.
• Independent source review found and checked the unload-admission correction. Canonical helper attempts aborted without reports. No helper scoped-clean, native pass or readiness rating is claimed.
• Published current-head checks show two successful ClawSweeper dispatch jobs only, not Windows build/test execution: push dispatch and metadata dispatch. No current-head Build and Test run has been observed. Normal Windows CI is authorized but dispatch is unavailable from this publishing session. Windows CI remains not started/not verified here, not passed. An operator must start the existing Build and Test workflow on the published branch and verify its exact head.

Real behavior proof

Current head f9dbbaa: not yet native-qualified. The unchanged strict Windows scenario must prove offline visible-reader offset within 4px, fresh verified reconnect-history consumption, mounted local draft, correct conversation and ordinary acknowledged Send. Initial/explicit positioning, streaming/tail, reflow, cancellation and lifecycle behavior also need current-head proof.

Historical native red on f8508b7, run41560429591/job125670946806: same visible fixture row189 and RuntimeIds/history/request, settled native receipt; viewport height646 ->628 and relative anchor Y294 ->276. The strict assertion failed by18px, and fresh reconnect-history consumption was not reached. This is a failure, not qualification of this update.

Not verified / blocked: current-head native and visible after-change proof, live Gateway recovery beyond synthetic fixtures, and installed upgrade/fresh-install compatibility. No private production credentials/configuration, global/shared runtime changes, direct host lease or protected artifact retry is authorized by this update.

Security Impact

• New permissions or capabilities? No
• Secrets or tokens handling changed? No
• New or changed network calls? Yes: fresh existing users.self and sessions.list reads.
• Command or tool execution surface changed? No
• Data access scope changed? No
• If any answer is Yes, explain the risk and mitigation: identity/cancellation fences; no content logged.

Compatibility and Migration

• Backward compatible? Bounded: fallback tested; native/installed compatibility unverified.
• Config or environment changes? Yes: optional OPENCLAW_CHAT_RECOVERY_TIMEOUT_MS, default 12000.
• Migration needed? No
• If yes, list the exact upgrade steps: N/A.

Review Conversations

• I replied to or resolved every bot review conversation addressed by this PR.
• I left unresolved only conversations that still need maintainer judgment.

Worked on by

• @TheAngryPit
• @vyctorbrzezowski

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge.

What this changes

Retains loaded native conversations during disconnection and verifies connection identity before restoring chat access.

Example: Disconnect while reading the fixture's 240-message conversation with an unsent draft.

• Before: The provider is disposed and connection guidance replaces the conversation.
• After: The conversation and draft remain mounted with sending disabled until verified recovery.

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The source repair is coherent and its authority trace is useful, but the latest native correction and required Windows validation are not qualified.
Proof confidence	🦪 silver shellfish (2/6)	Real behavior proof is not required for maintainer- or bot-authored pull requests.
Patch quality	🦐 gold shrimp (3/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: Disconnecting replaces an already-loaded native conversation with connection guidance.
Reason: Keeping readable conversation state through temporary outages has clear user value, and the maintainer-authored direction retains explicit authority checks and in-product retry.

Merge readiness

⛔ Blocked before merge - 2 items remain

This PR addresses a bug still present on main and merits continued work; it remains a conflicted draft with no newly identified source defect.

Priority: P2
Reviewed head: f9dbbaafdea633a90e472b2066dd0afe1b0dc79c

Before merge

• Complete next step - Resolve GitHub's reported merge conflict while preserving current-main voice playback and initial-history row-shift handling.
• Add data-model compatibility proof - The review found that existing stored data may not work after upgrade. Show that existing data still loads and works with this change.

Findings

None.

Tests

• Missing end-to-end proof: Current-head native proof must complete disconnect/reload, reader-offset preservation within 4 pixels, fresh reconnect history, unchanged draft and ordinary Send, alongside fresh-install and stable-release upgrade validation; only the focused source regression has a reported before-failure/after-pass.

Agent review details

How this fits together

The chat coordinator consumes manager-owned operator connections, binds them to the conversation provider, and supplies snapshots to the native Reactor timeline and composer.

flowchart LR
  A[Connection manager] --> B[Chat provider connection]
  B --> C[Retained gateway bridge]
  C --> D[Gateway client transport]
  C --> E[Conversation provider]
  E --> F[Native timeline and composer]

Loading

Technical review

Best possible solution:

Retain the existing provider through same-authority outages while preserving current-main navigation and voice behavior and restoring IO only after fresh verification.

Do we have a high-confidence way to reproduce the issue?

Current-main SetOperatorClient(null) unconditionally disposes the conversation provider, establishing the reported path from explicit disconnection to loss of the mounted conversation; no runtime reproduction was performed in this review.

Is this the best way to solve the issue?

The stable binding and verified recovery fit the existing connection and conversation owners, and the new bridge has a distinct lifetime from its immutable client adapter; source review found no smaller complete repair that preserves the demonstrated authority and cancellation boundaries.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 122bda71b221.

Provenance checked

• Provider recreation on operator-client replacement changes intended behavior with a stated reason (08cab69: The original native chat implementation constructed a provider around each operator client; the current PR explicitly separates conversation lifetime from transport lifetime.)
• Native tail positioning and anchoring changes intended behavior with a stated reason (ca8fb4a: fix(chat): stabilize bottom anchoring #1089 established stable bottom anchoring and generation-checked discrete navigation; this PR explains why history refresh and viewport-height changes must preserve an established reader.)
• Setup-bound recovery and provider association keeps the original intent (4895ed5: fix(chat): clear stale setup warnings after recovery #1624 retained drafts only after setup authority and provider association checks; the added bound-client check preserves that boundary.)
• Pending-response correlation and final transport generation keeps the original intent (323f46d: refactor(gateway): extract protocol core owners #1095 centralized terminal request ownership, while fix: bind SSH credential handoffs to owned listeners #1126 bound writes to the owning socket; scoped retirement and the final cancellation check extend those invariants.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Current main still disposes loaded chat: SetOperatorClient disposes the previous provider before returning for a null client; selection continuity does not fix this lifetime boundary. (src/OpenClaw.Tray.WinUI/Chat/OpenClawChatCoordinator.cs:156, 122bda71b221)
• Verified introduction and recovery boundary: The pinned introduced diff replaces unconditional provider recreation with suspension, fresh profile and authoritative roster verification, session-identity checks, and cancellation through serialized transport writes. (src/OpenClaw.Tray.WinUI/Chat/ChatProviderConnection.cs:215, f9dbbaafdea6)
• Inspectable final-effect authority trace: The full PR body records real production-client socket traces showing zero stale chat writes after manager-auth invalidation or wire-profile reassignment, followed by one acknowledged authorized send. The four production lifetime/transport source hashes still match those traces. (tests/OpenClaw.Tray.Tests/ChatProviderConnectionSecurityTests.cs:130, f9dbbaafdea6)
• Native correction remains unqualified: The author reports an 18-pixel reader-anchor failure on f8508b7. The current head changes anchoring and reload admission, but reports only 57 passing timeline policy/source-contract cases, without a native after-fix result. (src/OpenClaw.Tray.WinUI/Chat/ReactorItemsViewScrollController.cs:183, f9dbbaafdea6)
• Stored-profile compatibility evidence: The stable-writer fixture and reported passing reader test verify signing identity, device-token precedence, reconnect/send behavior, and unchanged stored bytes. This supports format compatibility but does not establish an installed upgrade. (tests/OpenClaw.Tray.Tests/ChatProviderConnectionSecurityTests.cs:341, f9dbbaafdea6)
• Actual check coverage and merge state: GitHub reports draft=true and mergeable_state=dirty. The current-head successful checks are dispatch jobs, not Windows build/test execution; the body explicitly leaves required full validation unqualified. (f9dbbaafdea6)

Likely related people:

• Barbara Kudiess: Raw commit f8a8825 adds src/OpenClaw.Tray.WinUI/Chat/ChatConversationState.cs:48 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: f8a8825ccbb4; files: src/OpenClaw.Tray.WinUI/Chat/ChatConversationState.cs)
• Régis Brid: Raw commit 08cab69 adds src/OpenClaw.Tray.WinUI/Chat/OpenClawChatCoordinator.cs:10 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: 08cab69a038c; files: src/OpenClaw.Tray.WinUI/Chat/OpenClawChatCoordinator.cs)

Preflight source

Source unknown. Source comparison at the observed PR snapshot only. Completion is self-reported; body, policy, tests, execution, and report bytes are not verified.

Review metrics

Metric	Value	Why it matters
Introduced source growth	Production +1048/-88; tests and fixtures +1838/-22	The growth primarily implements a distinct retained binding lifetime and protects authority, transport, persistence, and native-rendering boundaries.

Labels

Label changes:

• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦐 gold shrimp.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.
• remove rating: 🦐 gold shrimp: Current PR rating is rating: 🦪 silver shellfish, so this older rating label is no longer current.

Label justifications:

• P2: A bounded chat continuity bug hides loaded conversations during disconnection; current evidence does not establish an urgent regression or data loss.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Complete the strict native retention and retry scenarios on the integrated candidate.
• Demonstrate fresh installation and upgrade from v2026.9.8-1 with settings, registry and signing identity intact.
• Obtain current-head Windows build and full-suite results, attributing any failures with evidence.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

History

Review history (8 earlier review cycles)

• reviewed 2026-10-31T16:17:34.506Z sha d0e89c7 :: needs real behavior proof before merge. :: [P1] Wait for an authoritative session-list response before reusing history | [P1] Cancel queued writes when their chat binding is invalidated
• reviewed 2026-10-31T21:09:56.066Z sha 01a898f :: blocked before merge. :: [P2] Expose a recovery path after chat verification times out
• reviewed 2026-10-31T21:14:42.516Z sha 01a898f :: needs changes before merge. :: [P2] Expose recovery after chat verification times out
• reviewed 2026-10-31T22:32:53.950Z sha 086af98 :: needs real behavior proof before merge. :: none
• reviewed 2026-10-31T23:07:07.276Z sha de5e667 :: needs maintainer review before merge. :: none
• reviewed 2026-10-31T23:15:25.700Z sha de5e667 :: needs maintainer review before merge. :: none
• reviewed 2026-11-01T00:48:45.364Z sha de5e667 :: blocked before merge. :: none
• reviewed 2026-11-03T00:29:06.673Z sha 9da2645 :: blocked before merge. :: none

Reviewed November 6, 2026, 12:53 AM ET / 05:53 UTC (Revision 9).

[roboclaw-bot]

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/41242752342
• Updated: 2026-10-31T21:15:57.464Z

[roboclaw-bot]

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/41258465568
• Updated: 2026-11-01T00:50:14.351Z

[roboclaw-bot]

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/41553274557
• Updated: 2026-11-03T00:30:15.590Z

[roboclaw-bot]

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/42171201284
• Updated: 2026-11-06T05:55:05.365Z

[roboclaw-bot]

PR cleanup review

Reviewed head: f9dbbaafdea633a90e472b2066dd0afe1b0dc79c. Main comparison: e59374c064f43d68f5c72d070d4c89ef2d20ec3b.

This older draft is explicitly carried forward by #2037 (fix: keep loaded conversations visible while disconnected). The fix is not on main, and #2037 remains an open draft with native/upgrade proof and current-main reconciliation outstanding. I am leaving this PR open in this cleanup pass rather than claiming main supersession. Implementation and proof should remain in the existing replacement lane; the duplicate can be retired explicitly when that handoff is settled.

Action in this cleanup pass: leaving this PR open. No branch changes or runtime-proof waiver. The findings above come from source, discussion and recorded-CI review; Windows validation was not rerun in this pass.