[bkudiess]

Original implementation by @bkudiess. Review repairs and additional verification by Roboclaw.

Work sessions

• Discussion, implementation and verification

Review readiness (2026-11-09): preparing for author review, not merge-ready. Current head 9d4b0d8b2bf2 is conflict-free against incorporated main 045d13ac19b8. Fresh CI is pending for the independently reviewed diagnostic repair. Historical failures and source-bound proof remain below; fresh overall Platinum and remaining runtime proof are still required.

Depends on #2063 (feat: decide approvals from the Inbox and background toasts), which depends on #2060 (feat: show live Gateway approvals, automation failures and account alerts in the Inbox) and #2057 (feat: web-aligned Inbox for the footer bell and notifications page). This is layer 4 of 4. The branch remains cumulative; the dependency must land first and the stack must be reconciled before the next landing.

What Problem This Solves

There was no way to silence OpenClaw alerts without also missing approvals, and nothing told you when Windows privacy settings blocked a device that an enabled node capability (camera, microphone, location) needs.

User Impact

User impact: the Inbox (bell flyout and full Inbox page) has a Do not disturb toggle. While it is on, Windows toasts, their sounds and in-app banners stay silent for everything except approvals and device pairing or scope-upgrade requests; the Inbox still collects items and the bell still counts them, and the bell switches to a slashed bell with help text "Do not disturb is on. N waiting". The System tab now shows This PC alerts (for example "This PC: camera access is off") with Open Windows privacy settings, which disappear when the block clears or the capability is turned off. This PC alerts work in the packaged (MSIX/Store) app; unpackaged development builds never show them (see Evidence).

Why This Change Was Made

• One Do not disturb rule. DoNotDisturbPolicy decides; ToastService.ShowToast applies it using the alert kind AppNotificationPublisher derives from the existing Inbox classification (so exec-approval Gateway notifications still toast), and AppNotificationInfoBarPresenter applies it to banner eligibility without forgetting banners the user closed. Background approval toasts from ApprovalToastPresenter are never silenced. The Settings Send test notification button stays an explicit user test.
• Persisted through the settings owner. SettingsData.DoNotDisturb is a field-scoped ISettingsStore save; hosts read and toggle it only through InboxFeed, which ignores stale change events.
• No consent prompts. This PC alerts read AppCapability.CheckAccess (no prompt) only for devices an enabled capability needs while node or MCP mode is on: camera for camera.*, microphone for speech-to-text and camera clips (they record sound by default), location for location.get. They re-read on settings saves and Windows access-change events; a dismissed row stays dismissed until its block clears or changes. The action opens only the matching ms-settings:privacy-* page.
• Fixture isolation kept. Fixture mode never reads host privacy state and never launches Settings; OPENCLAW_FIXTURE_DEVICE_ACCESS supplies synthetic access for manual fixture proof.
• New strings are localized in all six locales; docs/ARCHITECTURE.md gains the Do not disturb and This PC rows.

Evidence

Earlier rating-repair evidence

Earlier native screenshots

Exact source, test assertions and limits. These are current successful states, not a pre-repair comparison.

Public asset bytes match the inspected PNGs. Browser rendering verification remains unavailable. The static DND footer, where present, does not prove native toast suppression or packaged privacy behavior.

The latest test-only correction waits within the existing observation budget for the exact row action to be visible and enabled, retains that native button handle, then invokes once outside the poll. It does not retry an action, increase a timeout, weaken an outcome check or change product behavior. Independent source review found no confirmed defect; the current native fixture suite passed 89/89 with zero skips.

Adds three real-client protocol facts and two mounted native journeys for live approval redaction on page/bell, real local expiry, initial/reconnect inventory hydration, native navigation and the actual restricted Ask OpenClaw send. These tests use the existing authenticated synthetic Gateway, not live providers or command execution. Complete meaningful text, gap-free native visible ranges and every finite positive viewport rectangle are required. Provider-supported Character round trips may remove only strictly zero-content outer positions; FindText is not used. Source, closure and joined-fixture reviews found no remaining confirmed finding. Current native execution and inspected images are documented in this source-bound proof comment.

The test adapter also restores checked native Character movement for approval selections, with content-preserving normalization of a zero-start target. Actual selection endpoint readback remains required. The previous unsupported FindText failures are retained below, not counted as a pass.

Addresses the latest source findings: complete scoped command, publication visibility, listed recipients and audience are displayed and included in permit gating; shared redaction covers Inbox/accessibility and non-exec toast text. Unknown or malformed scope stays deny-only. Recipient snapshots are immutable and structurally compared, and chat cannot permit consent it does not display. Independent source/proof reviews closed the known-field compatibility and snapshot-ownership follow-ups. Mounted tests use the supported plugin event shape. Both current scoped-consent facts now passed on this layer’s identified CI merge, including ten Allow and six Deny decisions. Earlier range failures are retained as historical attempts below.

Earlier visual evidence and source context

Prior repair evidence (historical)

Includes the reviewed approval disclosure, final-send fencing and uncertain-outcome repairs from the preceding layer. The original DND and This PC increment is preserved without unrelated changes.

Inspected native before/after comparison and limitations. The original approval head fails the complete-disclosure assertion; repaired source passes.

Earlier author evidence (historical)

Fixture Gateway (chat-interactive, approval). The first two screenshots come from an earlier build of this branch, before the fix that attaches settings after the service provider exists (the bell badge path did not change); the rest come from the final code. Plain bell, nothing waiting:

Amber count while an approval waits; the flyout shows the new Do not disturb row:

Do not disturb on: slashed bell, the amber count still shows, and the approval is still listed. The bell's help text reads "Do not disturb is on. 1 waiting" and settings.json holds "DoNotDisturb": true:

Do not disturb on the full Inbox page:

This PC row in the System tab with an accent (non-approval) count, from a fixture app launched with camera enabled and OPENCLAW_FIXTURE_DEVICE_ACCESS=camera=denied-by-user:

Change Type

• Bug fix
• Feature
• Refactor
• Docs or instructions
• Tests or validation
• Security hardening
• Chore or infrastructure

Scope

• Tray or WinUI UX
• Windows node capability
• Local MCP or winnode
• Gateway, connection, or pairing
• Setup or onboarding
• Permissions, privacy, or security
• Tests, CI, or docs

Required proof pools

• windows-wsl-mxc: required approval/transport containment path. Blocked on Windows Server; needs an MXC-enabled Windows client runner.
• windows-winui-interactive: new Inbox Do not disturb states, the slashed bell and This PC rows need current-head visual, accessibility and notification proof in the WinUI app, including on-screen toast suppression and a real privacy block in the packaged app.

Validation

Current diagnostic and review repair

Head 9d4b0d8b2bf25b77aef40dc003ca59bf07d42ae4, tree d7ac34e4a7e1ab56f970d67cb7fc2d1ba84ea773. Build and Test 42669877128 is pending.

The optional file sink no longer suppresses default exception reporting: a bounded, content-free stderr fallback preserves sanitized exception type and signed/hex HResult for disabled, unavailable, failed or overflowed capture. Original exception propagation and native event lifetimes remain unchanged. The real sink class now has29 cases, including ten added regressions. Exact translated-wording snapshots were replaced by required-key membership; all-locale parity/nonempty checks and native focus assertions remain. The later-layer OpenRoute callbacks remain because they serve live Gateway/approval/This PC actions; L1-only dead-code deletions and its closure guard were not copied into this layer.

Native whole-head validation remains pending for this layer. The common29-case sink regression passed on all three hosts using the L1 candidate, but that is not a substitute for this layer-specific closeout.

The bounded complete source review found no confirmed P0-P3 issue. Local build/Shared/Tray/focused attempts remain blocked by missing PowerShell/.NET; no local execution is claimed. Current native UI/animation lanes, historical crash and visibility failures, and fresh ClawSweeper assessment remain separate gates. The previous L1 review rated proof Platinum but patch quality/overall Silver; these are the repairs for its two findings, not a self-assigned new rating. Automatic review dispatch on this push failed to start, so no completed new review is claimed.

Previous joint-readiness revision (historical)

Head c34c2cff28a107b138766b41b003a8f591edad58, tree 311994c7398e8e387617e71c77f0d355595565eb. Build and Test 42616075814 failed.

Current CI failed in Tray and UI. The main-identical voice-cancellation test missed its inner two-second callback wait, then completed outer cleanup; independent source classification does not establish an Inbox cause. The ordinary UI host reported0xC000027B while ReasoningPicker_ReflectsInheritedDefaultWithoutOverridingExplicitChoices was active after311 passes/6 skips. All three Back-to-app activation rows passed beforehand. The mounted fixture completed92 passes/1 failure: message240 was not visible at wide width. Stable-profile DND and unchanged compatibility each passed1/1; both animation lanes passed6/6 and1/1; Accessibility including About passed21 with13 existing skips. Current-head full hardware closeout is pending, and preceding-source hardware remains source-bound below. No rerun, weaker visibility oracle or cause claim.

The reviewed readiness correction preserves the original actions, real native focus/Gateway assertions and deadlines. L1 has only the Workspace helper change; the other layers also retain the same-page feed-tab wait and one native invocation. Local required/focused commands were attempted but blocked by missing PowerShell/.NET; zero local tests executed. Historical failures and source-bound prior passes remain below. The separate non-memory ObserveOnly draft has not run or been published; its two independent review findings are being corrected. No memory capture, debugger or failed-suite replay has occurred.

Previous prerequisite-observation revision (historical)

Head 454fab2e52de5556a9db7e2a1603b7bcf631a500, tree 889e9e92ee79b43f1040a8966bc99edb12a6d75f. Build and Test 42606906277 passed. The reviewed change preserves transport250ms/two-second budgets and all existing assertions, adds prerequisite observations before cleanup, and starts the fixture accept pump eagerly. This is test readiness/instrumentation, not a proven cause-specific product fix.

Exact current-source native closeout 42608459586 passed full ./build.ps1, Shared/Tray and cleanup on Azurex64 and both ARM64 hosts. Actual six TRX files confirm AzureShared5101 passed/25 existing skips, ARMShared5102/24 each, and Tray5709/zero skips on each host. All14 backoff cases and all13 production-owner/real-wire plus cleanup-policy cases passed on every host. This closes the current execution gap without claiming a cause for the earlier Azure timeout or proving OS-delivered notification activation.

Current CI tested merge 4a7c5bd3062f70ed0d0ad21f4c6a286631d3ecb3. Ordinary UI passed771/7 existing skips, including81 named AxeHelper cases; enabled/disabled animation proof passed6/6 and1/1, full mounted fixture93/93, profile48/48, Functional19/19, DND released-profile1/1 and unchanged compatibility1/1. Accessibility passed21/13 existing skips, including About. The helper emitted33 diagnostic records in controlled ordinary-test cases and none in the real Accessibility step; no diagnostic record is attributed to the old About failure. The previous violation remains retained and its cause unresolved.

The bounded Axe projection preserves the25-pixel rule, exclusions, original native reads and single conditional retry. Current DND/native save-restart and portable-profile proof is real; OS toast/sound exceptions, Windows-delivered approval activation, packaged privacy/settings recovery and strict Gateway/MXC remain distinct outstanding boundaries.

Local mandatory/focused commands were attempted but cannot execute without PowerShell/.NET on the Linux coordinator; no local pass is claimed. Retained earlier runs and their exact source limits remain below. No assertions, timeouts or test selections are relaxed, and no fresh ClawSweeper assessment is claimed. Private capture remains parked; only a separately reviewed non-memory ObserveOnly preflight draft is being prepared for the still-blocking, unattributed L1 process failure.

Retained diagnostic-revision scope and limits

Diagnostic revision before terminal results

Head 454fab2e52de5556a9db7e2a1603b7bcf631a500, tree 889e9e92ee79b43f1040a8966bc99edb12a6d75f. Build and Test 42606906277 is running. This revision preserves every existing transport assertion and250ms/two-second budget, starts the test server accept pump eagerly, and records bounded prerequisite observations before cleanup. The reported historical line600 wait is RetryEntered, not evidence of missing HTTP headers. The focused source inventory is14 cases; native execution remains pending. Independent source review found no confirmed P0-P3 finding.

This layer additionally records capped, content-free cached Axe geometry and the existing retry decision. All40 existing helper cases, the25-pixel rule, one conditional retry, native getter sequence and exclusions remain;41 new cases give81 expected focused cases. The console record is helper-scoped, so native delivery and association with the actual failing scan must be verified before interpreting it. This is instrumentation, not an About-page fix or permission to rerun an unchanged failed job.

Required local build/Shared/Tray and focused validation attempts remain blocked by absent PowerShell/.NET on the Linux coordinator; zero local execution is claimed. New exact-L3 hardware42607019175 is running after the preceding attempt finished. Other current-head native closeout follows serially; previous failures and proof identities remain below. Private memory capture is parked.

Immediately preceding validation and retained failures

Preceding source-bound readiness results

Head 697f1dfac0233a80fa1771f45a6458b82ec3267f, tree 9e0dc43134f51f38be8d70f213816fa8f6d679e7, main 045d13ac19b80523578ae9b2648d7dafa3460efc. Build and Test 42598022108 is failed. This is a reviewed source revision, not an unchanged retry. The merge preserves native exit diagnostics, animation-preference restoration, strict TRX admission and the new separate six-case enabled/one-case disabled animation lanes.

The reviewed corrections retain a live owned assistant-selector peer while reading fresh selection state, require stable post-unpin geometry within the original limits, and drive genuine queued retry callbacks within the same single 300 ms budget. No action retries, timeout increases, weakened assertions or test exclusions were introduced. All twelve focused queue cases and nine new passive Boolean-observation cases passed in the exact-source L1/L2 three-host runs below. Source review remains separate from those executions. The voice observations do not change scrolling policy or establish a crash cause.

The preceding published head completed all required CI checks successfully; that earlier pass does not validate this new SDK/source combination.

Production decision-owner plus authenticated real-WebSocket proof: 11 authority cases + 2 cleanup-policy controls passed on all three native hosts in run 42583672049, exact previous L4 head 41f800e0cabf/tree 483af600. The same test/consumed owner sources are retained. All builds/Shared/cleanup passed; one ARM64 Tray suite retained a queued-send probe failure, now corrected at its test driver. This is direct decision-owner plus real wire, not Windows-delivered toast activation, and not a fresh whole-head hardware pass.

Current-head DND and UI proof: CI42598022108 tested merge f435e92568da20b64e441fc49f6b64f5e81fbbc2, tree-identical to published 697f1dfac023. Downloaded selected TRX/JSON receipts confirm ordinary UI730 passed/7 existing skips, animation-enabled6/6, disabled1/1 with preference restored, Functional19/19, profile48/48 and full fixture93/93 with zero skips. The twelve-cycle selector, post-unpin geometry and natural voice-tail facts passed. Native DND bell/page saves, banner/row/badge behavior and restarts passed; DND latest-stable portable-profile1/1 and unchanged compatibility1/1 also passed. legacyDndFieldAbsent=true, initialfalse, true/false saves across restarts, three Gateway records, identity hashes and unrelated preferences were preserved. Stable v2026.11.1 appSHA C8F4A14857177683D74C1E176D7C83E3584B658976F070D941E1CD0F99E14446 and candidate appSHA 5284422B9FB1FB4598883C400C26DAC42CA1872B44BA659A82EFDA9EC81871D0 were verified. This is portable-profile/native UI evidence, not installer/Store, OS toast/sound exceptions or packaged privacy.

The sole CI failure is Accessibility:20 passed/1 failed/13 existing skips. About context reported one unidentified Text peer below the25-pixel BoundingRectangleSizeReasonable requirement. The scan includes changed shared Workspace chrome, so equal About sources and passing main baselines do not establish an unrelated flake. A bounded metadata diagnostic is under development; the rule, existing retry policy and failed gate remain unchanged.

Required local commands (./build.ps1, Shared and Tray dotnet test --no-restore) cannot start on the Linux coordinator because PowerShell/.NET are absent; zero local tests are claimed. Exact-source native L1 42598243404 and L2 42599700292 passed full build/Shared/Tray/cleanup on Azure x64 and both ARM64 hosts. Actual six TRX files per run confirm L1 Shared4903/4904 passed with25/24 existing skips and Tray5436/zero skips each; L2 Shared4939/4940 with25/24 skips and Tray5497/zero skips each. Each host passed queue12/12 and passive options9/9.

Exact-current L3 hardware 42601217991 retains one Azure Shared failure:5096 passed/1 failed/25 skipped in the PR-added pre-header negative control, before its manual phase. The stack maps to RetryEntered observation, not evidence of missing HTTP headers. Azure Tray was not reached. Both ARM64 hosts passed Shared5098/24 existing skips and Tray5669/zero skips, including all13 real-wire/failure-policy cases. All builds/cleanup passed. This aggregate failure is not waived by those selected passes; L4 hardware remains held while the shared test is diagnosed.

Not verified / blocked: the retained native test-control failure, L4 Accessibility gate, OS/security/runtime boundaries and fresh ClawSweeper rating. The passing PR CI runs do not substitute for these additional proof requirements. Private memory capture remains parked. The single non-memory comparison42590088617 did not reproduce the host crash but failed diagnostic admission; it remains incomplete, with no unchanged rerun planned.

Previous source-bound results and failures

Previous source-bound validation

Latest terminal readback: The published head still has only the Shared ledger and dependent CI Gate failures; full UI passed as recorded below. The unpublished DND proof now has full independent review plus closure of its visible-footer navigation precondition. Two native DND/profile cases remain unexecuted. The identical real-wire authority test file is composed into the local candidate after review, with consumed production/fixture owners verified equal to the L3 tested source. This does not establish OS notification delivery, packaged privacy, or a current-head passing run.

Head 901c71571cf7f845950c15651fd054fedd1f7cb2, tree b65f1fe192837a2496100f9c3fb3d3e761877521, incorporating main b5c37e14. Build and Test 42571411224 is failed. GitHub reported the reconciled branch mergeable; required checks and proof still govern review readiness.

Ordinary UI passed 720 cases/7 existing skips; full mounted fixture UI passed 92/92 with zero skips. All five new feed-admission cases passed. The only failed job was Core/CLI because of the malformed architecture-ledger guard reference; CI Gate correctly failed. The reviewed one-line ledger correction is locally committed. Additional DND proof is being prepared; no new DND runtime result is claimed.

The completed preceding/current source-bound Tray suite passed 5,644 cases with zero skips. Fixture profile integration passed 48/48, Functional UI 19/19, and the existing portable-profile compatibility case passed. These boundaries do not prove native OS toast authority, packaged privacy or DND-specific upgrade behavior.

The ledger correction preserves both real guard tests: one valid Type.Method stays in the machine-readable column, and the companion guard is named in the invariant. No production behavior, assertions, filters, cycles or timeouts are relaxed. Earlier test compiler/analyzer and positive-GUID-fixture corrections are included.

Three-host run 42571519795 on L1 tree bebd585e passed all builds/cleanup and metadata 19/19 per host, then failed the same ledger check (Azure Shared 4,902 passed/1 failed/25 skips; each ARM64 4,903/1/24). Tray was not reached. Earlier run 42569076140 passed full build/Shared/Tray on pre-main tree d2b8fa95; it remains supporting correction evidence, not a later-head pass.

Not verified / blocked: current passing full validation and fresh ClawSweeper assessment; all layer-specific proof and second-model limits below remain open. A passing UI run does not establish a historical crash cause. Separate main-only crash capture remains parked, with no memory capture performed.

Earlier diagnostic-source validation (historical)

Current head b5fc44022df0ead4764bacd1861b82ded4fff5d5, tree 7a232d919417f80b95c5d0b0ff4e9ff039e373aa, main parent 1c7901f6cb1e743ad42e8528780824ffd23af214. CI run 42562512661 completed with failure. Current-source results below do not validate the later local corrections.

• Shared test-project compilation failed with CS0619: the synchronous throwing lambda selected xUnit's obsolete async overload. The local correction explicitly types it as Action, preserving the body and all 19 diagnostic-case assertions.
• Tray test-project compilation failed with xUnit2013 at two exact-one collection assertions. The local correction uses Assert.Single on the same collection at the same points; no assertion is relaxed.
• These corrections passed bounded source closure reviews. They are not yet changes to this published PR head, and no Shared/Tray pass is claimed for it.
• Native diagnostic self-tests: 29 passed. Functional UI: 19/19 passed. Fixture profile/app integration: 48/48 passed.

Ordinary UI passed 720 cases / 7 existing skips, including all three Back-to-app mouse/Enter/Escape cases and all five new pure voice/selector observation cases. Mounted Gateway fixture UI passed 89/89, zero skips. Latest-stable portable profile compatibility passed 1/1; Local AI profile proof passed 12/12. These passing UI results do not override the Shared/Tray compilation failures or establish the cause of other runs’ native crashes.

Exact-source three-host full build/Shared/Tray closeout remains pending; another layer’s candidate result is not substituted for this tree.

No test filters, cycle counts, visible assertions, exception-handling outcomes or timeouts were relaxed. Independent source reviews covered components and composition, but native compiler/runtime evidence remains decisive. Private crash classification and the separate Windows runtime proof pools remain open. Prior screenshots and results below keep their original source identities.

Earlier combined-source native results

Current head 94008bf6c291756e62aa536b1aca862ba7f92a06, tree 4417f348381e7dd01b55ee8c37c28e0b7b15205f, with main parent a39bd70aab55bfdc0053b278756a87c8a3305bcf. Current CI run 42554760126 completed with success. GitHub tested synthetic merge 19957dea against main a39bd70a, not the branch tip alone.

• Shared: 5,095 passed / 8 existing skips / 0 failed. Tray: 5,596 passed / 0 skipped / 0 failed.

• Diagnostic self-tests: 29 passed. Failure-lifecycle owner: 18 passed. Inbox/Settings composition: 7 passed. Fixture profile/app integration: 48/48 passed. Functional UI: 19/19 passed.

• Mounted Gateway fixture UI: 89/89 passed, 0 failed, zero skips.

• Latest-stable portable-profile compatibility: 1/1 passed. It does not establish installer/Store or DND-specific upgrade behavior.

• Ordinary UI: 675 passed / 7 existing skips / 0 failed, including all three Back-to-app mouse/Enter/Escape cases. The final CI Gate passed. Native screenshots for the newly composed focus paths still require separate artifact inspection.

The complete native fixture lane passed all twelve repeated switching cycles and the existing scope, selection, redaction and decision assertions. This passing result does not establish the cause of earlier host crashes. Independent source reviews covered the composition, resource unions, failure ownership, exit diagnostics and causal reconnect tests. Required exact-source three-host full build/Shared/Tray closeout remains pending.

No assertions, cycle counts, test filters or timeouts were relaxed. No unchanged rerun was used to clear these failures. New local candidates are not included in the published source above. Previous screenshots and results below retain their historical source identities.

Earlier verified native validation

PR head eacfa342e165394e970f573858cd62d227e0bff3, tree 19df4da32d312e7208d6feb5b8129a86d1284fd0. CI run 42526534115 tested merge f64957c8dda5bc54eb2805812b17f61f7cadfbbf with main e70292487958be9e70170e2f3affe7afc42056e8, not the branch tip alone.

• Shared: 5,086 passed / 8 permitted skips / 0 failed, including all three new real-client feed protocol facts.
• Tray: 5,578 passed / 0 skipped / 0 failed.
• Fixture profile/app integration: 38/38 passed.
• Mounted Gateway fixture UI: 89/89 passed, zero skips. The new live feed, expiry, reconnect, destination and actual single-send assertions all passed.
• Latest-stable portable-profile compatibility: 1/1 passed. This is not installer/Store or DND-specific upgrade proof.
• Axe.Windows: 21 passed / 13 permitted skips. Permitted ordinary skips do not clear custom native proof pools.
• Ordinary in-process UI lane: 674 passed / 7 permitted skips. Build, core/CLI, setup, WSL recovery, packaging and the final CI Gate passed.
• The scope facts passed ten Allow and six Deny decisions on page/flyout, including full malformed-note selection and secret/oversize refusal. The pre-existing plugin selection proof also passed. These do not substitute for native toast activation or final-I/O revocation proof.

The complete three-PR proof delta and merged fixture admission passed independent source reviews. Required local commands were attempted but could not execute on the Linux coordinator; the native results above are separately identified. Historical crashes and failures remain retained below, not declared fixed from a later green run.

The unchanged authorized three-host exact-tree closeout completed successfully on validation commit fc6b472a7ce689f0ed889e39b5630657e2ff7e99. Its tree 19df4da32d312e7208d6feb5b8129a86d1284fd0 exactly matches this PR head, distinct from the CI merge above.

• ./build.ps1: passed on Azure x64 and both native ARM64 hosts.
• Shared: x64 5,062 passed / 25 skipped; each ARM64 5,063 passed / 24 skipped. All three new feed protocol facts passed on every host.
• Tray: 5,536 passed / zero skipped on each host.
• Test projects were built first with the native RID, then tested with --no-restore. Six exact TRX files were downloaded and parsed; all isolated-settings cleanup steps succeeded.
• This workflow does not execute the separate UI or strict MXC proof and does not clear those gates.

Earlier validation and original author results

Earlier attempt logs remain available: initial native scope visibility, 86/87 after wrapped-range correction, unsupported FindText failures, and 88/89 before action readiness. These belong to their original source revisions and are not passing results for this head. The earlier ordinary UI host crashes remain unclassified; later green runs do not establish a root cause. Earlier three-host build/Shared/Tray proof also retains its original tree.

Earlier author validation (historical)

Run on head e825aeaf (on #2063's review fixes, 3e904ada) (Windows 11 ARM64, .NET SDK 10.0.403, OPENCLAW_REPO_ROOT set to the worktree):

• ./build.ps1: passed (Shared, Cli, WinNodeCli, SetupEngine, WinUI; documentation and proof-pool validation passed).
• dotnet test ./tests/OpenClaw.Shared.Tests/OpenClaw.Shared.Tests.csproj --no-restore: passed 4922, failed 0, skipped 25 (existing opt-in integration/MXC/GPU skips).
• dotnet test ./tests/OpenClaw.Tray.Tests/OpenClaw.Tray.Tests.csproj --no-restore: passed 5407, failed 0, skipped 0.
• git diff --check: clean.
• Focused: DoNotDisturbTests (policy matrix, pairing and scope-upgrade requests come through while a standard alert stays silent, pairing results stay standard, both App pairing-request toasts tagged as approvals, approval tagging in AppNotificationPublisher, banner suppression/restore including closing an approval banner while on, persistence, settings attached later, stale change events, toast-service source guard), ThisPcAlertsTests (only enabled capabilities are read, unknown/allowed is not a block, camera needs the microphone, system-managed copy, route allowlist, fixture override parsing, publish/withdraw/dismiss/re-episode/replace through ThisPcAlertSource), GatewayFixtureIsolationContractTests (no host privacy reads or Settings launch in fixture mode), LocalizationValidationTests.
• Independent review: rubber-duck reviewed the implementation; its blocking findings (fixture Settings launch, microphone for camera clips, banner hide state, settings attached before the store existed) were fixed, and its re-check found no remaining blocking issues.

Review fixes

• Dual-model review of the stack (L4-dnd-pairing-requests, low): Do not disturb silenced device pairing and scope-upgrade request toasts and banners although users decide them like approvals. DoNotDisturbPolicy now treats Inbox access requests as approvals, and App's node-pairing-pending and pairing-request toasts pass AlertKind.Approval; paired/rejected results stay standard.
• User-directed: removed the "Approvals always come through" note beside the toggle and its help text (all six locales); behavior is unchanged. On e825aeaf the flyout and page footers show only the icon, label and toggle, left-aligned, and UI Automation reads the toggle as Do not disturb with no help text. The screenshots above predate this removal and still show the note.
• Rebased onto feat: decide approvals from the Inbox and background toasts #2063's review fixes; the ledger keeps the lower layers' updated approval rows.

Real Behavior Proof

Earlier rating-repair proof and limits

• Current source: commit eacfa342e165394e970f573858cd62d227e0bff3, tree 19df4da32d312e7208d6feb5b8129a86d1284fd0 (test-only action-readiness follow-up).
• Current-head mounted fixture UI execution: 89/89 passed, zero skips, with inspected source-bound images embedded above. The preceding FindText failures remain historical evidence. The age-clock case and, in layers 3/4, scoped plugin consent/redaction cases are included in the ordinary fixture CI lane.
• Observed native results: the preceding product/Shared/Tray source passed the three-host run above, with downloaded TRX inspected. The current test-adapter and feed cases passed the complete native fixture lane; overall CI status is stated above.
• Independent reviews cover implementation and proof design, not full requested two-model consensus. Opus 5.5 remains unavailable under the model allowlist.
• Historical images retain their original source labels. The new native screenshots above have separate current-CI source bindings.
• New scope tests assert full-document equality for both listed recipients; explicit native selection/viewport checks target the last recipient and then the audience. They do not independently select every recipient.
• Remaining runtime gates: strict Gateway/MXC execution, native toast authority/suppression and real packaged privacy behavior. Previous-head CI proved bounded latest-stable portable-profile compatibility, not installer/Store or DND-specific upgrade behavior. GitHub image bytes were verified; browser rendering remains unverified.

Historical behavior evidence and its original limits

Historical approval comparisons and their source limits remain in the original repair evidence. The current images above are separately source-bound. Earlier pictures and assertions below are the original author’s evidence, not fresh execution of this head.

Earlier author behavior proof (historical)

• Environment tested: Windows 11 ARM64, Debug build (unpackaged) of this commit's source, Gateway fixture (scripts/run-gateway-fixture.ps1 -Scenario chat-interactive -Interaction approval), plus a second fixture-isolated app on a copy of that profile with NodeCameraEnabled true and OPENCLAW_FIXTURE_DEVICE_ACCESS=camera=denied-by-user.
• PR head or commit tested: screenshots and UIA reads come from the source of 00f4c9f2 (the pre-rebase layer-4 commit). The review fix and the rebase onto feat: decide approvals from the Inbox and background toasts #2063 do not change the bell, toggle or This PC rendering; head 247abef2 was revalidated with the full test run above but not re-screenshotted.
• Exact steps or command run: sent run approval to trigger a real fixture exec.approval.requested; opened the bell; switched Do not disturb on; opened Open Inbox; read the bell and toggle through UI Automation; read the profile settings.json.
• Evidence after fix: screenshots above; UIA bell help "Do not disturb is on. 1 waiting", toggle Name: Do not disturb, value on/off; settings.json DoNotDisturb: true.
• Observed result: plain, amber, slashed and accent bell states render as designed; Do not disturb persists and keeps the approval listed and counted; the This PC row lands in the System tab with the privacy-settings action.
• Screenshot or artifact links verified? (Yes/No/N/A) Yes
• Not verified or blocked: on-screen toast suppression (fixture and isolated instances suppress all toasts by design, so the rule is covered by unit and source tests only); a real Windows privacy block (needs an OS settings change on this shared host) and native AppCapability behavior in the packaged MSIX app. A native probe from an unpackaged process returned UserPromptRequired for webcam, microphone and location even though all are allowed, so unpackaged builds map to Unknown and show no This PC alerts (fail-safe, documented in the ledger). Clicking Open Windows privacy settings outside fixture mode was not exercised.

Security Impact

Current cumulative repairs retain one decision owner and enforce exact observation, scope, expiry and connection checks after queue admission. Unknown transmitted outcomes retain application-lifetime quarantine, not durable exactly-once storage. No production dependency was added; UIA3 interop is private to the UI test project.

• New permissions or capabilities? (Yes/No) No
• Secrets or tokens handling changed? (Yes/No) Yes, display-only redaction uses the shared sanitizer; stored credentials and observed raw approval identity are unchanged.
• New or changed network calls? (Yes/No) Yes, inherited connection-bound approval reconciliation; no new DND/device-probe RPC.
• Command or tool execution surface changed? (Yes/No) Yes, inherited approval admission hardening; the DND/device-alert increment adds no execution surface.
• Data access scope changed? (Yes/No) Yes
• If any answer is Yes, explain the risk and mitigation: the app now reads Windows privacy access status for camera, microphone and location with AppCapability.CheckAccess, which never prompts, only for capabilities the user enabled and only while node or MCP mode is on. Only the status enum is logged; no notification or user content is logged or exported. The Inbox action launches only three allowlisted ms-settings:privacy-* URIs, and never in fixture mode.

Compatibility and Migration

• Backward compatible? (Yes/No) Yes
• Config or environment changes? (Yes/No) Yes
• Migration needed? (Yes/No) No
• If yes, list the exact upgrade steps: none. settings.json gains DoNotDisturb (default false when absent). OPENCLAW_FIXTURE_DEVICE_ACCESS is read only in Gateway fixture mode.

Review Conversations

Current repair review is separate from the earlier author reviews. Confirmed source findings are addressed with regressions; remaining runtime requests stay open. Fresh ClawSweeper review will be requested after the current native evidence is complete. Existing review checkboxes remain unchecked until verified.

• I replied to or resolved every bot review conversation addressed by this PR.
• I left unresolved only conversations that still need maintainer judgment.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge.

What this changes

Adds persisted Do not disturb controls and Windows device privacy alerts to the shared Inbox, including the preceding Inbox and approval layers.

Example: Do not disturb is enabled when a channel warning and an exec approval arrive.

• Before: There is no separate interruption policy that preserves approval alerts.
• After: The warning stays in the Inbox without interrupting, while the approval can still alert and both remain counted.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	Useful implementation with strong native disclosure evidence, but incomplete evidence for its authority-sensitive and OS-specific boundaries.
Proof confidence	🦐 gold shrimp (3/6)	Real behavior proof is necessary before merge. See Before merge.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Product

Kind: Feature · Worth it: Yes · Fix scope: Complete
User problem: Users cannot independently silence ordinary interruptions while preserving approval alerts, and enabled device capabilities provide no Inbox guidance when Windows privacy settings block them.
Reason: Maintainer authorship establishes direction, and the change offers a focused interruption control plus visible device recovery without adding consent prompts.

Merge readiness

⛔ Blocked before merge - 4 items remain

Keep open: this maintainer-authored PR adds useful capabilities absent from main, remains part of an explicitly paused landing stack, and has no confirmed new source finding from this review.

Priority: P2
Reviewed head: eacfa342e165394e970f573858cd62d227e0bff3

Before merge

• Add real behavior proof - Authority-chain proof required: inspected current-source screenshots show complete scoped consent, and the source-bound comment reports successful native feed, expiry, reconnect and decision journeys against an authenticated synthetic Gateway. They do not exercise allowed versus forged/replayed toast activation or request, expiry, scope and connection changes before final resolve I/O, including revocation while queued. Current DND interruption suppression, real packaged privacy detection/settings launch/recovery and strict Gateway/MXC execution also remain explicitly open. Supply redacted terminal traces, logs or recordings, removing IPs, API keys and non-public endpoints. Compatibility remains insufficient because the reported portable-profile run expressly excludes DND-specific upgrade behavior; show latest-stable settings and data preserved through upgrade and DND save/restart. After adding proof, update the PR body, then request a new review with @clawsweeper re-review. The PR author or someone with repository write access can request it.
• Resolve security concern: Establish rejection at the native activation boundary - Source contains one-shot grants and final-admission checks, but the supplied native journeys exercise Inbox decisions rather than forged, replayed or subsequently revoked toast grants; no concrete bypass was established.
• Resolve merge risk - The PR owner must establish that native toast activation cannot retain usable approval authority after token revocation, request replacement, expiry, scope loss or connection replacement, including while queued before the resolve write.
• Add data-model compatibility proof - The review found that existing stored data may not work after upgrade. Show that existing data still loads and works with this change.

Findings

• [medium] Establish rejection at the native activation boundary — src/OpenClaw.Tray.WinUI/Services/OperatorApprovalDecisions.cs:165

Tests

• Missing end-to-end proof: Still missing current-source native toast allowed/forbidden final-I/O traces, DND suppression with approval and pairing exceptions, packaged privacy detection/settings launch/recovery, strict Gateway/MXC execution, and DND-specific latest-stable upgrade proof.

Agent review details

How this fits together

Companion combines local notifications, authenticated Gateway facts and Windows privacy status into one Inbox; presentation policy controls banners and toasts, while approval decisions return through the existing operator WebSocket.

flowchart LR
  A[Local notifications] --> D[Inbox feed]
  B[Gateway facts] --> D
  C[Windows privacy status] --> D
  D --> E[Inbox page and bell]
  D --> F[Alert policy]
  E --> G[Approval decision owner]
  G --> H[Gateway WebSocket]

Loading

Technical review

Best possible solution:

Land the dependency stack in order, retaining the shared settings, notification and approval owners, after the scoped runtime and upgrade gates are satisfied.

Do we have a high-confidence way to reproduce the issue?

This is a feature request implemented by the PR; current main lacks the DND preference and This PC privacy-alert source, while supplied native images demonstrate parts of the cumulative Inbox behavior.

Is this the best way to solve the issue?

The design fits existing ownership: DND gates interruptions without discarding Inbox items, privacy alerts reuse notifications and allowlisted recovery routes, and approval decisions share one owner.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against e70292487958.

Merge-risk options

Maintainer options:

1. Verify native approval authority (recommended)
   The PR owner supplies allowed and forbidden activation traces through the production decision owner and real transport, recording rejection before resolve I/O, including queued revocation.
2. Keep the stack paused
   The landing owner retains the recorded pause until the native authority boundary can be exercised on a suitable Windows host.

Provenance checked

• Notification list and banner behavior changes intended behavior with a stated reason (06ed71f: The original notification surface kept the list authoritative and banner dismissal non-destructive.)
• Shared footer ownership keeps the original intent (3f6765e: Chat and Settings share one footer and one window-owned state applicator to prevent drift.)
• Disclosure before approval keeps the original intent (3331b5e: Permit actions must correspond to completely reviewable commands and matching pending approval state before RPC I/O.)
• Shared automation catalog reads changes intended behavior with a stated reason (4ea07e8: Navigation search uses bounded authenticated reads; the Inbox extends the same reader with revision-consistent inventory requirements.)

Testing

Proof path: shipped entry point.

Security

Needs attention: Native approval activation needs final-effect authority evidence before the security boundary can be cleared.

Evidence

Security concerns:

• [medium] Establish rejection at the native activation boundary — src/OpenClaw.Tray.WinUI/Services/OperatorApprovalDecisions.cs:165
  Source contains one-shot grants and final-admission checks, but the supplied native journeys exercise Inbox decisions rather than forged, replayed or subsequently revoked toast grants; no concrete bypass was established.
  Confidence: 0.97

What I checked:

• Keep-open guard and recorded landing pause: REST confirms COLLABORATOR authorship, head eacfa34 and a clean merge state. The full body explicitly says not merge-ready and requires the cumulative dependencies to land first. (eacfa342e165)
• Introduced scope and current-main boundary: The pinned introduction contains the DND preference, alert policy and Windows privacy reader; current main retains the earlier notification implementation without these capabilities. Endpoint-only changes were not attributed to this PR. (src/OpenClaw.Shared/SettingsData.cs:38, eacfa342e165)
• Approval authority reaches final transport admission: Toast grants bind the client, epoch, observation and offered decisions; the decision owner rechecks live authority after queue admission, immediately before WebSocket transmission. This is the boundary requiring the outstanding forbidden-activation proof. (src/OpenClaw.Shared/WebSocketClientBase.cs:924, eacfa342e165)
• Inspected native evidence and explicit limits: The prepared images directly show complete standing-command and recipient/audience disclosure. The source-bound discussion credits current native fixture execution but explicitly excludes native toast authority, packaged privacy recovery and strict Gateway/MXC proof: feat: Do not disturb and This PC alerts in the Inbox #2064 (comment). (tests/OpenClaw.Tray.UITests/GatewayFixtureUiTests.InboxScopeConsent.cs:23, eacfa342e165)
• Validation source binding: REST confirms successful current-head CI at https://github.com/openclaw/openclaw-windows-node/actions/runs/42526534115. The body reports 89 mounted fixture cases with zero skips and separately identifies the successful three-host validation run; these are supplied results, not tests executed during this read-only review. (eacfa342e165)
• Settings and privacy ownership: InboxFeed saves only the DND field through the existing settings store. Privacy checks do not request consent, fixture mode supplies synthetic access, and settings launches accept only the three device privacy routes. The body explicitly excludes DND-specific upgrade proof from its portable-profile result. (src/OpenClaw.Tray.WinUI/Services/InboxFeed.cs:87, eacfa342e165)

Likely related people:

• Barbara Kudiess: Raw commit 3f6765e adds src/OpenClaw.Tray.WinUI/Controls/WorkspacePaneFooter.xaml.cs:26 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 3f6765ea02f4; files: src/OpenClaw.Tray.WinUI/Controls/WorkspacePaneFooter.xaml.cs)
• Régis Brid: Raw commit 06ed71f adds src/OpenClaw.Tray.WinUI/Services/AppNotificationService.cs:104 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 06ed71f3c01f; files: src/OpenClaw.Tray.WinUI/Services/AppNotificationService.cs)
• Sebastien Tardif: Raw commit 3331b5e adds src/OpenClaw.Tray.WinUI/Chat/ChatEventMapper.cs:466 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: 3331b5e38876; files: src/OpenClaw.Tray.WinUI/Chat/ChatEventMapper.cs)

Preflight source

Source unknown. Source comparison at the observed PR snapshot only. Completion is self-reported; body, policy, tests, execution, and report bytes are not verified.

Review metrics

Metric	Value	Why it matters
Cumulative source and test delta	Production +5,471/-852; tests +6,836/-55; documentation +34/-3	These are merge-base-to-head totals for four cumulative Inbox layers; protocol, persistence, authority and mounted rendering coverage explain the distinct test layers.

Labels

Label changes:

No label changes.

Label justifications:

• P2: Adds useful alert controls and device recovery guidance with limited user-facing scope and no established urgent regression.
• merge-risk: 🚨 security-boundary: Actionable toast tokens carry approval authority across native activation and transport queuing, and the nearest forbidden activation cases remain unproven at final I/O.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.
• proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Add final-effect proof that forged, replayed, replaced or revoked toast authority is rejected before approval RPC I/O, including revocation while queued.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

History

Review history (3 earlier review cycles)

• reviewed 2026-11-07T05:04:34.893Z sha 00f4c9f :: needs real behavior proof before merge. :: [P1] Expose the complete command before enabling approval | [P1] Preserve plugin reviewer detail before offering approval | [P2] Report uncertain approval completion without claiming no send
• reviewed 2026-11-08T16:36:25.021Z sha f605e92 :: needs real behavior proof before merge. :: [P1] Disclose approval scope fields before enabling Allow
• reviewed 2026-11-08T18:43:36.491Z sha f6320b6 :: needs real behavior proof before merge. :: none

Reviewed November 8, 2026, 5:37 PM ET / 22:37 UTC (Revision 4).

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	nuget/​interop.uiautomationclient@​10.19041.0

View full report

[roboclaw-bot]

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/42500840732
• Updated: 2026-11-08T16:37:52.311Z

[roboclaw-bot]

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/42511526941
• Updated: 2026-11-08T18:45:14.138Z

[roboclaw-bot]

Current native Inbox proof (eacfa34)

Source: PR head eacfa342e165394e970f573858cd62d227e0bff3. GitHub executed CI merge f64957c8dda5bc54eb2805812b17f61f7cadfbbf with main e70292487958be9e70170e2f3affe7afc42056e8. Run 42526534115 is green, including 89/89 mounted fixture cases, zero skips.

The native scope facts completed ten Allow and six Deny decisions on page and flyout. Full text, actual selection endpoint readback, ordered gap-free visible ranges and every target rectangle are checked before decisions. Recipient full-document equality covers both entries; explicit selection targets the final recipient and audience. The live feed and reconnect/action journeys also passed, including the real local expiry and a single accepted explanation send.

These are actual current WinUI controls against an authenticated synthetic Gateway. No command/plugin operation or external provider executed. The frames are current successful scenarios, not pre-repair comparisons.

Complete standing command

Listed recipients and external audience

Limits: the visible DND footer is not proof of native toast suppression, and the containment warning is not an MXC pass. Native toast final-I/O authority, real packaged privacy/settings/recovery, strict Gateway/MXC execution and the requested second-model review remain open. Browser image rendering verification is unavailable; uploaded asset bytes are checked against the inspected PNGs. Earlier host crashes remain retained rather than labelled fixed or flaky from this green run.

[roboclaw-bot]

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/42531222814
• Updated: 2026-11-08T22:38:41.999Z

[roboclaw-bot]

PR cleanup review

Reviewed head: 9d4b0d8b2bf25b77aef40dc003ca59bf07d42ae4. Main comparison: e59374c064f43d68f5c72d070d4c89ef2d20ec3b.

Source cleanup review at 9d4b0d8 against main e59374c: this is not fully superseded. Main now contains the Inbox shell/live-fact layers from #2057 (feat: web-aligned Inbox for the footer bell and notifications page)/#2060 (feat: show live Gateway approvals, automation failures and account alerts in the Inbox), with 29 changed files already identical, but DND, This PC privacy alerts and the still-open #2063 (feat: decide approvals from the Inbox and background toasts) approval-decision layer remain. The current merge preview has 44 conflicting paths even though the body still describes an older conflict-free base. Current-head CI is green, but that does not replace Windows-delivered toast, actual packaged privacy denial/recovery, DND notification/sound exception and strict Gateway/MXC proof. Please reconcile the stack onto main and refresh those proof boundaries before landing.

Action in this cleanup pass: leaving this PR open. No branch changes or runtime-proof waiver. The findings above come from source, discussion and recorded-CI review; Windows validation was not rerun in this pass.