fix: local gateway connections recover after listener or token drift

[bkudiess]

What Problem This Solves

Fixes an issue where setup-managed local WSL gateways could enter misleading token/re-pair states or unstable reconnect loops after listener collisions, WSL outages, or role-specific device-token drift.

Why This Change Was Made

GatewayConnectionManager is the canonical operator/node lifecycle and user-intent owner. ManagedLocalGatewayPortProvenanceService proves local listener ownership before stronger credentials or remediation are allowed. ManagedLocalGatewayAutoRepairMonitor and ManagedLocalGatewayRepairCoordinator provide bounded, intent-aware WSL recovery.

Unknown listeners are never killed. Explicit Disconnect/Stop always suppress automatic restart, remediation, and reconnect until the operator explicitly connects/starts again.

User Impact

App-installed local gateways self-recover by default, matching macOS local-mode launchd supervision. Manual localhost, repointed, SSH, remote, and ambiguous records are excluded.

Evidence

• Redacted non-isolated recovery, reconnect, Disconnect-intent, and upgrade transcript
• Current-head endpoint-ownership proof addendum
• Explicit macOS-parity default-on policy decision and proof
• Final GPT-5.6 Sol max reviews of migration, provenance, architecture, endpoint ownership, and the persisted policy reported no significant issues.

Change Type

• Bug fix
• Feature
• Refactor
• Docs or instructions
• Tests or validation
• Security hardening
• Chore or infrastructure

Scope

• Tray or WinUI UX
• Windows node capability
• Local MCP or winnode
• Gateway, connection, or pairing
• Setup or onboarding
• Permissions, privacy, or security
• Tests, CI, or docs

Validation

• .\build.ps1 — all five projects passed.
• Shared — 3,241 passed, 31 skipped.
• Connection — 504 passed.
• SetupEngine — 700 passed.
• Tray — 2,003 passed.
• Unit/closeout total — 6,448 passed, 31 skipped, 0 failed.
• Setup/connect + MXC E2E — 18 passed.
• Revocation recovery E2E — 1 passed.
• Network recovery E2E — 2 passed.

Real Behavior Proof

• Environment: Windows 11, WSL2 OpenClawGateway, setup-managed ws://localhost:18789.
• Current head: 22fd6e84.
• Live non-isolated recovery was captured on ancestor 2ac177a5; later deltas change only endpoint-ownership preservation and explicit policy persistence/docs/tests, not repair behavior.
• A proven obsolete native PID was stopped, its exact task disabled, signed wslrelay.exe and the expected WSL systemd service restored, and LastConnected advanced.
• After visible Connection-page Disconnect via UI Automation, the same collision remained untouched for 75 seconds beyond the repair threshold: native PID/task stayed active, WSL stayed stopped, LastConnected remained unchanged, and app state stayed Disconnected / Idle.
• Current-head endpoint tests prove repointed endpoints lose explicit and legacy ownership while exact endpoints and standard localhost/127.0.0.1/::1 aliases retain it only when all other URI components match.
• Screenshot or artifact links verified? Yes — linked PR comments are inspectable redacted transcripts.
• Not verified or blocked: no technical or product-policy proof blocker remains. Default-on bounded recovery for existing and fresh app-installed gateways is intentional macOS parity; visible Disconnect/Stop suppress it.

Security Impact

• New permissions or capabilities? No.
• Secrets or tokens handling changed? Yes.
• New or changed network calls? Yes, local provenance/reconnect probes only.
• Command or tool execution surface changed? Yes, bounded recovery can restart the expected WSL service/VM and disable/stop only a fully proven obsolete OpenClaw native task/process.
• Data access scope changed? No.
• Mitigation: complete Windows listener capture, canonical Microsoft-signed relay verification, expected-distro systemd MainPID/port ownership, listener recapture, native task/profile/process lineage, and PID start identity. Unknown or changed owners fail closed.

Compatibility and Migration

• Backward compatible? Yes — intentional supervised-local upgrade contract.
• Config or environment changes? No.
• Migration needed? Automatic only.
• Existing and fresh positively identified app-installed gateways default to automatic recovery, matching macOS local supervision.
• Fresh setup writes the default explicitly; pre-field settings deserialize default-on.
• Explicitly persisted false survives setup reruns as a policy/debug kill switch.
• Manual localhost, repointed, URL-less, SSH, remote, and ambiguous records remain manual.

Review Conversations

• I replied to or resolved every bot review conversation addressed by this PR.
• I left unresolved only conversations that still need maintainer judgment.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 29, 2026, 11:40 PM ET / July 30, 2026, 03:40 UTC.

ClawSweeper review

What this changes

Adds provenance-gated recovery for setup-managed local WSL gateways, including listener-conflict handling, device-token recovery, explicit Disconnect/Stop suppression, migration safeguards, and regression coverage.

Merge readiness

⚠️ Ready for maintainer review - 3 items remain

The prior upgrade-compatibility blocker is resolved by the recorded collaborator approval of the default-on recovery contract. Current main does not contain this recovery system, and this collaborator-authored PR must remain open for normal merge handling rather than cleanup closure.

Priority: P1
Reviewed head: 7c54c865ce608a49678a7d0b8ec1eb73ca44afc0

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	Strong real-environment proof, focused regression coverage, clean checks, and recorded approval resolve the previous blocker.
Proof confidence	🦞 diamond lobster (5/6)	Sufficient (terminal): The PR supplies redacted terminal proof of real recovery and visible Disconnect suppression on Windows 11 with WSL2, supplemented by current-head focused test and E2E results; future proof should continue to redact endpoints and credentials.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (terminal): The PR supplies redacted terminal proof of real recovery and visible Disconnect suppression on Windows 11 with WSL2, supplemented by current-head focused test and E2E results; future proof should continue to redact endpoints and credentials.
Evidence reviewed	5 items	Current main lacks the proposed setting: The current-main SettingsData source does not define EnableManagedLocalGatewayAutoRepair, so the central recovery behavior is not already implemented on the default branch. Approved upgrade contract: A collaborator explicitly approved default-on bounded managed-WSL restart and proven-native-process remediation for settings that predate the new field, resolving the previous P1 compatibility decision. Safety boundary in the proposed implementation: The provenance service classifies unknown listeners separately from fully proven obsolete OpenClaw owners, supporting the stated fail-closed credential and remediation boundary.
Findings	None	None.
Security	None	None.

How this fits together

The tray application owns operator and Windows-node gateway connections through saved gateway records and the connection manager. This PR checks who owns a local endpoint before supplying credentials or restarting WSL, then reports the resulting connection state through the tray UI.

flowchart LR
  Records[Saved gateway records] --> Eligibility[Managed-local eligibility]
  Listener[Local listener ownership] --> Provenance[Endpoint provenance check]
  Intent[Connect or Disconnect intent] --> Coordinator[Bounded repair coordinator]
  Eligibility --> Coordinator
  Provenance --> Coordinator
  Coordinator --> WSL[Managed WSL gateway]
  Coordinator --> Reconnect[Connection manager reconnect]
  Reconnect --> UI[Tray recovery status]

Loading

Before merge

• Resolve merge risk (P1) - Merging intentionally enables bounded automatic recovery for existing positively identified app-installed local gateways whose settings predate the new field; collaborator approval documents that upgrade behavior, while an explicitly persisted false remains the supported kill switch.
• Resolve merge risk (P1) - The PR can restart a managed WSL distro and disable or stop a native process only after provenance checks. Future edits to the ownership predicate should preserve its fail-closed treatment of unknown listeners.
• Complete next step (P2) - The remaining action is normal maintainer merge handling; there is no discrete mechanical repair for an automated worker.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Changed surface	64 files, 6,618 additions, 138 deletions	The patch spans connection management, setup migration, tray UI, safety checks, and tests, so the recorded end-to-end evidence is material to merge confidence.
Focused runtime proof	3 recovery scenarios and 21 targeted E2E tests reported	The provided evidence covers recovery, explicit Disconnect suppression, and setup/connect, revocation, and network-recovery paths.

Merge-risk options

Maintainer options:

1. Merge the approved recovery contract (recommended)
   Accept the documented upgrade behavior because settings without the field intentionally become eligible for bounded recovery and explicit false remains preserved.
2. Stage through a release candidate
   Pause only if maintainers want additional upgrade telemetry from existing setup-managed local gateways before broad release exposure.

Technical review

Best possible solution:

Land the approved recovery contract with the provenance checks, explicit user-intent suppression, and persisted false kill switch intact, then monitor release feedback from upgraded setup-managed local gateways.

Do we have a high-confidence way to reproduce the issue?

Yes. The supplied redacted Windows 11 and WSL2 transcript demonstrates collision recovery and a UI-initiated Disconnect suppression case, and focused tests cover the corresponding source paths; this read-only review did not rerun the Windows environment.

Is this the best way to solve the issue?

Yes. The change confines recovery and credential authorization to positively identified setup-managed endpoints, preserves explicit user disconnect intent, and now has recorded approval for its intentional upgrade behavior.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against b46e91e21b45.

Labels

Label changes:

• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR supplies redacted terminal proof of real recovery and visible Disconnect suppression on Windows 11 with WSL2, supplemented by current-head focused test and E2E results; future proof should continue to redact endpoints and credentials.
• remove rating: 🦐 gold shrimp: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
• remove status: ⏳ waiting on author: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

• P1: The PR repairs gateway recovery and connection stability for active setup-managed Windows workflows.
• merge-risk: 🚨 compatibility: Existing settings that lack the new field intentionally receive default-on automatic recovery after upgrade.
• merge-risk: 🚨 auth-provider: The patch changes device-token recovery and gates stronger credential use on endpoint provenance.
• merge-risk: 🚨 security-boundary: The patch may restart WSL or remediate a process only after local listener ownership verification.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR supplies redacted terminal proof of real recovery and visible Disconnect suppression on Windows 11 with WSL2, supplemented by current-head focused test and E2E results; future proof should continue to redact endpoints and credentials.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR supplies redacted terminal proof of real recovery and visible Disconnect suppression on Windows 11 with WSL2, supplemented by current-head focused test and E2E results; future proof should continue to redact endpoints and credentials.

Evidence

What I checked:

• Current main lacks the proposed setting: The current-main SettingsData source does not define EnableManagedLocalGatewayAutoRepair, so the central recovery behavior is not already implemented on the default branch. (src/OpenClaw.Shared/SettingsData.cs:936, b46e91e21b45)
• Approved upgrade contract: A collaborator explicitly approved default-on bounded managed-WSL restart and proven-native-process remediation for settings that predate the new field, resolving the previous P1 compatibility decision. (src/OpenClaw.Shared/SettingsData.cs:106, 22fd6e84baee)
• Safety boundary in the proposed implementation: The provenance service classifies unknown listeners separately from fully proven obsolete OpenClaw owners, supporting the stated fail-closed credential and remediation boundary. (src/OpenClaw.Connection/ManagedLocalGatewayPortProvenanceService.cs:1, 309130377f3c)
• Regression coverage and live proof: The supplied PR evidence records a real Windows 11 and WSL2 recovery run, a visible Disconnect suppression run, endpoint-ownership tests, and successful targeted CI E2E suites. (tests/OpenClaw.Tray.Tests/ManagedLocalGatewayRepairCoordinatorTests.cs:1, 7c54c865ce60)
• Likely related people: bkudiess introduced the proposed recovery implementation across six commits; shanselman recorded the compatibility decision and supplied the current branch merge from upstream. (src/OpenClaw.Connection/GatewayConnectionManager.cs:1, 7c54c865ce60)

Likely related people:

• bkudiess: Authored the recovery, provenance, migration, UI, documentation, and regression-test changes that define this new subsystem. (role: feature author and recent area contributor; confidence: high; commits: 309130377f3c, ff2ad8b03d21, 2ac177a5be7c; files: src/OpenClaw.Connection/GatewayConnectionManager.cs, src/OpenClaw.Connection/ManagedLocalGatewayPortProvenanceService.cs, src/OpenClaw.Tray.WinUI/Services/ManagedLocalGatewayRepairCoordinator.cs)
• shanselman: Recorded the explicit approval for the compatibility contract and merged current upstream main into the reviewed head. (role: reviewer and recent adjacent contributor; confidence: high; commits: 7c54c865ce60; files: src/OpenClaw.Shared/SettingsData.cs, src/OpenClaw.SetupEngine/SetupContext.cs)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (8 earlier review cycles)

• reviewed 2026-07-24T20:35:30.039Z sha 9d41843 :: needs maintainer review before merge. :: none
• reviewed 2026-07-27T07:08:39.232Z sha ff2ad8b :: found issues before merge. :: [P1] Restrict setup-managed migration to verified records | [P2] Record the ownership transfer in the architecture ledger
• reviewed 2026-07-27T20:56:00.572Z sha 2ac177a :: found issues before merge. :: [P1] Drop managed ownership when the loopback endpoint changes
• reviewed 2026-07-27T21:55:16.927Z sha 0e8756b :: found issues before merge. :: [P1] Preserve the pre-upgrade recovery contract
• reviewed 2026-07-28T07:08:29.705Z sha 22fd6e8 :: found issues before merge. :: [P1] Preserve recovery behavior for pre-field settings
• reviewed 2026-07-29T13:01:03.604Z sha 22fd6e8 :: found issues before merge. :: [P1] Preserve recovery behavior for pre-field settings
• reviewed 2026-07-30T03:22:00.739Z sha 7c54c86 :: found issues before merge. :: [P1] Preserve recovery behavior for pre-field settings
• reviewed 2026-07-30T03:36:47.362Z sha 7c54c86 :: found issues before merge. :: [P1] Preserve recovery behavior for pre-field settings

[bkudiess]

Current-head managed-local recovery proof

Commit: 2ac177a5be7cdcaba066bff937fdcac2ad3c8963
Environment: Windows 11, WSL2 OpenClawGateway, non-isolated Release identity,
ws://localhost:18789
Redaction: No credential values, command output, prompts, or file contents are included.

Proven native-listener collision and automatic recovery

Baseline UTC: 2026-07-27T20:34:41Z
App: PID 39016, exact commit build, responding=True
Gateway: localhost:18789, IsLocal=True, managedDistro=OpenClawGateway
Native task: Disabled
Windows listener: PID 38548, wslrelay,
  C:\Program Files\WSL\wslrelay.exe, Authenticode=Valid
Expected WSL service: MainPID=483, ActiveState=active, SubState=running
LastConnected: 2026-07-27T20:34:09Z

Fault injected:
  wsl.exe --terminate OpenClawGateway
  enabled and started exact legacy task:
    OpenClaw Gateway (OpenClawGateway)

Injected UTC: 2026-07-27T20:36:05Z
Native task: Ready
Windows listener: PID 44460, node.exe,
  C:\Program Files\nodejs\node.exe
Expected WSL service behind collision:
  MainPID=367, ActiveState=active, SubState=running

Tray log:
[2026-07-27 13:36:24.480] [INFO] [GatewayPort] Disabled
'OpenClaw Gateway (OpenClawGateway)' and stopped proven obsolete native
gateway PID 44460.

Recovered UTC: 2026-07-27T20:36:44Z
Native task: Disabled
Native PID 44460 alive: False
Windows listener: PID 38548, wslrelay,
  C:\Program Files\WSL\wslrelay.exe, Authenticode=Valid
Expected WSL service: MainPID=437, ActiveState=active, SubState=running
App: PID 39016, responding=True

Reconnect observed UTC: 2026-07-27T20:37:02Z
LastConnected: 2026-07-27T20:36:47Z
LastConnected advanced: True

Explicit Disconnect remains authoritative

The visible Connection-page control was invoked through Windows UI Automation,
not by calling an internal manager method.

User disconnect UTC: 2026-07-27T20:39:40Z
UI Automation:
  AutomationId=ConnectionToggle
  Name="Disconnect or reconnect"
  ToggleState before action=On
  Action=Toggle

App MCP state after action:
  status=Disconnected
  overallState=Idle
  nodeState=Idle

Same fault injected while disconnected:
  wsl.exe --terminate OpenClawGateway
  started exact legacy native task

Injected UTC: 2026-07-27T20:40:24Z
Native task: Ready
Native listener: PID 33904, node.exe

Observed after 75 seconds (beyond repair threshold):
  Native task: Ready (not disabled)
  Native PID 33904 alive: True (not terminated)
  Listener still native PID 33904
  OpenClawGateway WSL state: Stopped (not restarted)
  LastConnected: 2026-07-27T20:36:47Z (unchanged)
  App status: Disconnected
  overallState: Idle
  nodeState: Idle

After capture, PID 33904 was stopped explicitly, the task was returned to
Disabled, WSL was reset, and the previously running tray from the other
worktree was restored as PID 34812 and verified responsive.

Upgrade ownership matrix

Current-head focused output:

Passed GatewayRegistryMigrationTests.
  MigrateFromSettings_LocalhostWithSetupState_BackfillsManagedDistro
Passed GatewayRegistryMigrationTests.
  MigrateFromSettings_ManualLocalhostWithDifferentSetupEndpoint_RemainsManual
Passed GatewayRegistryMigrationTests.
  MigrateFromSettings_SetupStateWithoutGatewayUrl_RemainsManual
Passed GatewayRegistryMigrationTests.
  MigrateFromSettings_LocalSshTunnelWithMatchingSetupState_RemainsManual

Test Run Successful.
Total tests: 4
Passed: 4

The migration now assigns setup-managed ownership only when
setup-state.json.GatewayUrl is endpoint-equivalent to the legacy loopback URL.
Ambient setup state alone no longer adopts manual localhost or SSH-backed
records.

Intent regression guards

Passed ManagedLocalGatewayAutoRepairMonitorTests.
  UserDisconnectedIntent_NeverRepairs
Passed ManagedLocalGatewayRepairCoordinatorTests.
  UserDisconnectedIntent_AbortsBeforeProbeOrRestart

Test Run Successful.
Total tests: 2
Passed: 2

Validation

• Repository build: passed, all five projects.
• Shared: 3,241 passed, 31 skipped.
• Connection: 500 passed.
• SetupEngine: 698 passed.
• Tray: 2,001 passed.
• Setup/connect and MXC E2E: 18 passed.
• Revocation recovery E2E: 1 passed.
• Network recovery E2E: 2 passed.
• Final GPT-5.6 Sol max security review: no significant issues.

Maintainer decision still requested

Please confirm that default-on bounded WSL restart and remediation of a fully
proven obsolete OpenClaw native task/process is the intended product contract
for setup-managed local gateways.

[bkudiess]

@clawsweeper re-review

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.

[bkudiess]

Current-head endpoint-ownership proof addendum

Commit: 0e8756b7
Prior live recovery proof: exact-head transcript for the unchanged repair
implementation

The delta from 2ac177a5 to 0e8756b7 changes only gateway-record endpoint
identity/preservation and its tests. Managed ownership is now retained only
when URI components identify the same endpoint:

• scheme and host use URI-appropriate case-insensitive comparison;
• localhost, 127.0.0.1, and ::1 are the only interchangeable loopback aliases;
• port, user-info, path, query, and fragment must remain ordinally identical;
• changed endpoints clear SetupManagedDistroName, RequiresV2Signature, and
  any friendly label accepted by the shared legacy Local (<distro>) parser;
• stale ownership fields supplied by an edit caller cannot restore ownership.

Current-head focused result:

GatewayRegistryTests + GatewayRegistryMigrationTests
Passed: 59
Failed: 0
Skipped: 0

Covered cases include:

Changed loopback port with stale explicit ownership -> ownership dropped
Legacy label "Local ( OpenClawGateway )" -> ownership dropped
Nonstandard 127.0.0.2 alias -> ownership dropped
Path/query case change -> ownership dropped
localhost -> 127.0.0.1 same endpoint -> ownership retained
localhost -> ::1 same endpoint -> ownership retained
Unchanged non-loopback managed/Tailscale endpoint -> ownership retained
Manual localhost + unrelated setup state -> remains manual
SSH-backed localhost + matching setup state -> remains manual

Full current-head validation:

Build: passed (5 projects)
Shared: 3,241 passed, 31 skipped
Connection: 504 passed
SetupEngine: 698 passed
Tray: 2,001 passed
Setup/connect + MXC E2E: 18 passed
Revocation recovery E2E: 1 passed
Network recovery E2E: 2 passed

Final GPT-5.6 Sol max review of this endpoint-ownership delta reported no
significant issues.

[bkudiess]

@clawsweeper re-review

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.

[bkudiess]

Maintainer/product decision: default-on recovery

Current head: 22fd6e84
Decision: Existing and fresh app-installed local gateways are enrolled in
bounded automatic recovery by default.

This intentionally matches the macOS local-mode contract:

• macOS GatewayAutostartPolicy.shouldStartGateway enables launchd supervision
  whenever connection mode is local and OpenClaw is not paused;
• launchd/PortGuardian attach to a healthy listener and supervise the app-owned
  gateway by default;
• macOS exposes the broader OpenClaw active / paused control, not a separate
  automatic-recovery toggle.

Windows parity:

• only positively identified setup-managed local WSL records are eligible;
• manual localhost, repointed, SSH, remote, and ambiguous records are excluded;
• visible Disconnect and Stop record explicit operator intent and
  suppress automatic WSL restart, native-process remediation, and reconnect
  until an explicit Connect/Start;
• an explicitly persisted
  EnableManagedLocalGatewayAutoRepair=false remains available as a policy/debug
  kill switch and survives setup reruns;
• fresh setup explicitly writes the default-on value;
• existing settings files that predate the field deserialize to default-on.

Current-head focused policy tests:

TraySettingsConfig setup tests: 8 passed
  Fresh setup writes default-on
  Explicit configured false is persisted
  Setup rerun preserves existing false

Settings compatibility tests: 2 passed
  Existing settings without field default on
  Explicit false round-trips

Full current-head validation:

Build: passed (5 projects)
Shared: 3,241 passed, 31 skipped
Connection: 504 passed
SetupEngine: 700 passed
Tray: 2,003 passed
Setup/connect + MXC E2E: 18 passed
Revocation recovery E2E: 1 passed
Network recovery E2E: 2 passed

GPT-5.6 Sol max review of the documented/persisted policy found no significant
issues.

[bkudiess]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Review in progress
• Detail: The exact-review queue leased this run; Codex is reviewing the item.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/30511733009
• Updated: 2026-07-30T03:39:19.751Z

[shanselman]

Maintainer decision: approve the documented default-on upgrade behavior for existing settings that lack EnableManagedLocalGatewayAutoRepair. The bounded managed-WSL restart and proven-native-process remediation behavior is intentional and accepted as the compatibility contract for this change.

@clawsweeper re-review