[joelagnel]

Windows Settings uninstall leaves Companion-created Gateways behind, allowing a later install to reuse an older Gateway. Register bounded cleanup outside the Companion MSIX, scoped to the current Windows user, and settle pending cleanup before reconnecting after reinstall.

• Bind owned WSL instances to their registration ID and path. Preserve replacements, unknown files, redirected paths, and unavailable inventory.
• Adopt proven legacy WSL installations prospectively. Historical uninstall receipts do not authorize deleting an in-use Gateway on first upgrade.
• Claim native ownership only after a verified acquisition of a previously absent package. Preserve pre-existing packages, uncertain deployments, replacement installations, and packages still used by another Companion variant.
• Offer preserve and continue when cleanup cannot safely proceed. Retire only the removed/relinquished managed connection and its authentication, including supported legacy formats; preserve unrelated profiles and settings.
• Allow deliberate WSL recreation to replace its old cleanup registration without relaxing unattended replacement protection. Include the user SID in the scheduled-task name.
• Check Store Gateway updates during native setup; retain development-package selection behavior.

Addresses #1712. Local AI diagnostics remain separate in #1716. One commit (0abcdf4c0e996112a3832bf9e4c16f7d8f7a5eb7), 25 files, 487 additions and 62 deletions; no new test files or test methods.

Required proof pools

• windows-11-arm64: final branch build and required tests on the requested Windows ARM64 device.
• windows-clean-installer-upgrade: actual signed disposable MSIX update/uninstall/reinstall plus product lifecycle APIs.
• windows-winui-interactive: real product recovery dialog captured below; full onboarding and Settings/consent screenshots were not captured in this desktop session.
• windows-wsl-gateway-e2e: real WSL registration/disk lifecycle; controlled minimal root filesystem, not a running inference/Gateway service.
• windows-wsl-mxc: strict E2E attempted; its Ubuntu acquisition failed with HTTP 404 before Gateway/MXC execution.

Validation

All new execution/testing used the requested Windows 11 ARM64 device, with isolated source checkouts, disposable packages, WSL registrations, and profiles.

.\build.ps1
dotnet test .\tests\OpenClaw.Shared.Tests\OpenClaw.Shared.Tests.csproj --no-restore
dotnet test .\tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --no-restore
dotnet test .\tests\OpenClaw.SetupEngine.Tests\OpenClaw.SetupEngine.Tests.csproj --no-restore

Suite	Passed	Failed	Skipped
Full repository build	Build passed	0	N/A
Shared	4,261	0	36
Tray	4,000	0	0
SetupEngine	2,291	0	1

Final independent code/structured reviews and commit-coherence advisory: clean / OK. Changed source files match the tested checkout after CRLF/LF normalization. Test projects were built/restored explicitly before --no-restore runs.

Proof completed

The WSL lifecycle and ownership checks below are complete. Full native acquisition/onboarding was intentionally skipped; WSL testing covers these lifecycle scenarios. Native ownership edge cases were checked with controlled package inventory/acquisition outcomes.

Real behavior proof

Real signed MSIX + actual WSL registration/disk, using product cleanup/initialization APIs:

{
  "ordinaryMsixUpdatePreservedGateway": true,
  "fastReinstallRemovedOwnedWsl": true,
  "savedSettingsReconciled": true,
  "replacementRegistrationPreserved": true,
  "replacementDataPreserved": true,
  "preserveContinuedStartup": true,
  "staleManagedAuthRetired": true
}

The fresh profile retained its unrelated remote Gateway/token, MCP preference, theme, and an unknown settings field. A recreated WSL distro at the same name/path was preserved because its registration ID differed.

Focused regressions, before/after:

• Ten controlled worker scenarios pass: prospective adoption, owned removal, deliberate recreation, same-path replacement, unknown directory, inventory denial, owned native removal, failed/cancelled native acquisition followed by an independent install, and shared native retention. Unsafe deletion/recreation cases failed before their fixes. Native package operations in this matrix are mocked; filesystem canaries are real and disposable.
• Legacy display-name records and settings-only legacy authentication both incorrectly survived cleanup before the reconciliation fix. Both clear afterward; the unrelated remote-settings control remains preserved (3/3 pass).
• The task-name policy produced one name for two synthetic user SIDs before the final fix, and two afterward. The final embedded worker also registered and retired a real limited-privilege, current-SID task without acquiring any Gateway-removal authority.

Earlier baseline screenshots document the original report:

Not verified / blocked

The strict scripts/validate-mxc-e2e.ps1 -NoBuild -RuntimeIdentifier win-arm64 run reached WSL acquisition and failed because the Ubuntu 24.04 download returned HTTP 404. It did not establish Gateway/MXC execution; no skip or capability bypass was substituted. This is separate from the passing real-package/WSL lifecycle checks above.

The desktop supplied no foreground HWND for the opt-in WinUI capture tests. Full shipped onboarding and Settings/consent capture remain unavailable. The recovery dialog and copied diagnostics were captured; no full native/GPU inference claim is made.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[joelagnel]

@clawsweeper review

Please review the current head (a1839d6). The PR body includes the Windows 11 ARM64 test machine validation, component receipts/screenshots, and the remaining proof limits.

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/38441770121
• Updated: 2026-10-13T17:49:50.365Z

[clawsweeper]

Codex review: needs real behavior proof before merge.

What this changes

This PR adds ownership-based Gateway cleanup after Companion uninstall, startup reconciliation and preservation recovery, and Store Gateway update checks.

Example: Uninstall Companion after it creates OpenClawGateway, then reinstall Companion.

• Before: The retained Gateway can be reused with its previous version and saved connection.
• After: Verified owned installations are removed and their managed connections retired; ownership conflicts offer preservation and continuation.

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	Useful lifecycle work with meaningful WSL runtime evidence, but an actionable deletion-safety defect and incomplete native authority and stable-upgrade evidence block merge.
Proof confidence	🦐 gold shrimp (3/6)	Real behavior proof is necessary before merge. See Before merge.
Patch quality	🦪 silver shellfish (2/6)	Security review found an item that needs attention.

Product

Kind: Feature · Worth it: Yes · Fix scope: Complete
User problem: Removing and reinstalling Companion can retain managed Gateways and their previous connections instead of producing a fresh local setup.
Reason: bkudiess explicitly supported cleanup and refresh on this PR; ownership-aware removal and visible preservation have clear value when their safety boundary holds.

Merge readiness

⛔ Blocked before merge - 5 items remain

Keep open: this PR contains useful, maintainer-supported lifecycle work absent from main, but legacy adoption can still authorize deletion of a replacement distro.

Priority: P1
Reviewed head: 0abcdf4c0e996112a3832bf9e4c16f7d8f7a5eb7

Before merge

• Add real behavior proof - Authority-chain proof required: credit the current-head signed-MSIX/real-WSL lifecycle results and inspected preservation dialog, but native acquisition and Remove-AppxPackage operations remain mocked. Supply redacted current-head terminal output or logs showing allowed owned removal and rejection before final removal for independent replacement, failed/cancelled acquisition followed by independent installation, and a surviving Companion consumer. Include replacement before initial legacy adoption; a complete native onboarding matrix is unnecessary. After adding proof, update the PR body, then request a new review with @clawsweeper re-review. The PR author or someone with repository write access can request it.
• Do not adopt a legacy distro from name and path alone (P1) - When no owned.json exists, a stale schema-1 setup-managed-distro.json can survive unregistering the original distro and importing a replacement as OpenClawGateway at the same managed path. HasPathBoundMarkerEvidence and HasRegisteredDistroEvidence both accept this state because they compare names and paths, not the original registration generation. RunAsync then records the replacement's current registration ID as owned, so a later Companion uninstall passes the worker's ID check and executes wsl --unregister against the replacement. Preserve unbound legacy registrations unless ownership is established independently or the user explicitly authorizes adoption, and add a regression covering replacement before the first upgraded launch.
• Resolve security concern: Stale provenance becomes current deletion authority - The new authority record outlives startup and is consumed by a scheduled worker; capturing the current registration ID does not establish that Companion created that registration.
• Resolve merge risk - Native cleanup's persisted ownership authority remains unverified at the real package-removal boundary for independent replacements and surviving Companion consumers.
• Add data-model compatibility proof - The review found that existing stored data may not work after upgrade. Show that existing data still loads and works with this change.

Findings

• [P1] Do not adopt a legacy distro from name and path alone — src/OpenClaw.SetupEngine/GatewayPackageCleanup.cs:26-32
• [high] Stale provenance becomes current deletion authority — src/OpenClaw.SetupEngine/GatewayPackageCleanup.cs:32

Tests

• Missing end-to-end proof: Missing coverage includes replacement before initial legacy adoption, real native acquisition/removal authority cases, and an upgrade from the latest stable release with existing settings and ownership state preserved.

Agent review details

How this fits together

Setup records Gateway ownership outside the Companion MSIX; a current-user scheduled worker observes package removal, performs authorized cleanup, and supplies receipts that startup uses to reconcile saved connections and credentials.

flowchart TD
  A[Companion setup] --> B[Ownership records]
  B --> C[Current user cleanup task]
  D[Windows package lifecycle] --> C
  C --> E[WSL or native package removal]
  C --> F[Cleanup receipts]
  F --> G[Startup reconciliation and recovery]

Loading

Technical review

Best possible solution:

Bind unattended deletion to a proven installation generation and preserve legacy distros whose ownership cannot be established.

Do we have a high-confidence way to reproduce the issue?

Source establishes the remaining failure: retain a legacy schema-1 marker, replace OpenClawGateway at the same path before first upgraded launch, and let startup adopt it without an existing owned.json; subsequent uninstall authorizes unregistering the replacement.

Is this the best way to solve the issue?

The external worker and visible preservation route address the approved lifecycle goal, but path-only legacy evidence must not silently become installation-specific deletion authority.

Full review comments:

• [P1] Do not adopt a legacy distro from name and path alone — src/OpenClaw.SetupEngine/GatewayPackageCleanup.cs:26-32
  When no owned.json exists, a stale schema-1 setup-managed-distro.json can survive unregistering the original distro and importing a replacement as OpenClawGateway at the same managed path. HasPathBoundMarkerEvidence and HasRegisteredDistroEvidence both accept this state because they compare names and paths, not the original registration generation. RunAsync then records the replacement's current registration ID as owned, so a later Companion uninstall passes the worker's ID check and executes wsl --unregister against the replacement. Preserve unbound legacy registrations unless ownership is established independently or the user explicitly authorizes adoption, and add a regression covering replacement before the first upgraded launch.
  Confidence: 0.96

Overall correctness: patch is incorrect
Overall confidence: 0.94

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 5f6b29290528.

Merge-risk options

Maintainer options:

1. Complete native authority validation (recommended)
   Show owned native removal and preservation of independently installed, replaced, and still-shared packages through the production acquisition and cleanup owners using real Windows package operations.
2. Defer native cleanup
   Remove native ownership registration and deletion from this PR, retaining that capability for a separately proven change.

Provenance checked

• Native healthy-package reuse and no-upgrade policy changes intended behavior with a stated reason (feat(setup): install native Gateway automatically through WinGet #1547: Healthy packages bypassed acquisition while missing packages used bounded, consented WinGet installation.)
• MSIX retention and explicit pre-uninstall cleanup changes intended behavior with a stated reason (feat(uninstall): WSL gateway uninstall — engine, CLI, Inno hook, MSIX docs, Settings UI #310: MSIX lacked an arbitrary uninstall hook, so Settings exposed explicit local Gateway removal.)
• Managed WSL path and registration binding keeps the original intent (fix(setup): bind cleanup to live WSL registration #1230: Automatic cleanup must reject missing, unreadable, duplicate, malformed, or mismatched registration evidence.)

Testing

Proof path: in-process harness.

Security

Needs attention: Legacy adoption can grant unattended deletion authority over a replacement installation.

Evidence

Security concerns:

• [high] Stale provenance becomes current deletion authority — src/OpenClaw.SetupEngine/GatewayPackageCleanup.cs:32
  The new authority record outlives startup and is consumed by a scheduled worker; capturing the current registration ID does not establish that Companion created that registration.
  Confidence: 0.96

What I checked:

• Pinned PR introduction: The verified introduction contains 25 changed files, including the new cleanup worker and startup gate; base-only changes were excluded from ownership assessment. (0abcdf4c0e99)
• Current main retains the existing lifecycle: Main documents retained WSL state after MSIX uninstall and still returns healthy native packages without acquisition; the central change is not already implemented. (docs/uninstall-msix.md:8, 5f6b29290528)
• Maintainer direction and prior findings: bkudiess explicitly supported cleanup and refresh while identifying lifecycle safeguards in fix(setup): clean up owned Gateways after Companion uninstall #1715 (comment); current source addresses the previously reported recorded-identity replacement, pre-acquisition native ownership, and recovery-exit paths.
• Legacy adoption lacks installation-generation evidence: Startup adopts from a path-bound schema-1 marker and live BasePath. That marker contains no registration ID; with no existing cleanup record, the worker captures whichever registration currently occupies the name and path. (src/OpenClaw.SetupEngine/GatewayPackageCleanup.cs:26, 0abcdf4c0e99)
• Deletion boundary: The worker compares the captured registration ID and path before wsl --unregister; a replacement mistakenly adopted at first startup therefore passes these later checks. (src/OpenClaw.SetupEngine/GatewayPackageCleanup.ps1:148, 0abcdf4c0e99)
• Supplied proof inspected: The downloaded recovery screenshot visibly offers preservation and continuation. The current body reports real signed-MSIX/WSL lifecycle results, but expressly identifies native package operations as mocked and full native acquisition as skipped: fix(setup): clean up owned Gateways after Companion uninstall #1715 (comment). (0abcdf4c0e99)

Likely related people:

• Scott Hanselman: Raw commit fd8901d adds src/OpenClaw.SetupEngine/ManagedDistroOwnership.cs:57 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: fd8901d85f44; files: src/OpenClaw.SetupEngine/ManagedDistroOwnership.cs)
• Barbara Kudiess: Raw commit 17a8b03 adds src/OpenClaw.Tray.WinUI/App.xaml.cs:579 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 17a8b0363a82; files: src/OpenClaw.Tray.WinUI/App.xaml.cs)
• Karen: Raw commit dba8121 adds src/OpenClaw.SetupEngine/NativeGatewayPackageAcquisition.cs:34 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: dba81213371c; files: src/OpenClaw.SetupEngine/NativeGatewayPackageAcquisition.cs)
• Linus Huang: Raw commit 6bcc68c adds src/OpenClaw.SetupEngine/NativeGatewayMsixInstaller.cs:23 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 6bcc68cde97c; files: src/OpenClaw.SetupEngine/NativeGatewayMsixInstaller.cs)

Review metrics

Metric	Value	Why it matters
Introduced scope	Production +429/-31; tests +25/-13; docs +33/-18	The two new cleanup files contribute 355 production lines, while committed test changes cover acquisition and existing UI contracts rather than the new cleanup lifecycle.

Labels

Label changes:

• add P1: Automatic adoption can turn a stale legacy marker into authority to unregister a replacement WSL installation and destroy its disk.
• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦐 gold shrimp and patch quality is 🦪 silver shellfish.
• remove rating: 🧂 unranked krab: Current PR rating is rating: 🦪 silver shellfish, so this older rating label is no longer current.
• remove merge-risk: 🚨 compatibility: Current PR review merge-risk labels are merge-risk: 🚨 security-boundary.
• remove merge-risk: 🚨 availability: Current PR review merge-risk labels are merge-risk: 🚨 security-boundary.
• remove P0: Current review triage priority is P1, so this older priority label is no longer current.

Label justifications:

• P1: Automatic adoption can turn a stale legacy marker into authority to unregister a replacement WSL installation and destroy its disk.
• merge-risk: 🚨 security-boundary: Persisted deletion authority can be assigned to an installation that Companion did not create.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦐 gold shrimp and patch quality is 🦪 silver shellfish.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

History

Review history (5 earlier review cycles)

• reviewed 2026-10-13T17:41:07.544Z sha a1839d6 :: needs real behavior proof before merge. :: [P1] Revalidate WSL ownership before deleting a replacement installation | [P1] Revoke native ownership when acquisition never installs the package | [P1] Offer recovery instead of exiting on a persistent cleanup refusal
• reviewed 2026-10-13T17:47:41.815Z sha a1839d6 :: needs real behavior proof before merge. :: [P1] Revalidate WSL ownership before deleting a replacement installation | [P1] Revoke native ownership when acquisition never installs the package | [P1] Offer recovery instead of exiting on a persistent cleanup refusal
• reviewed 2026-10-13T17:57:17.353Z sha a1839d6 :: needs real behavior proof before merge. :: [P1] Revalidate WSL ownership before deleting a replacement installation | [P1] Revoke native ownership when acquisition never installs the package | [P1] Offer recovery instead of exiting on a persistent cleanup refusal
• reviewed 2026-10-13T18:12:59.258Z sha a1839d6 :: needs real behavior proof before merge. :: [P1] Revalidate WSL ownership before deleting a replacement installation | [P1] Revoke native ownership when acquisition never installs the package | [P1] Offer recovery instead of exiting on a persistent cleanup refusal
• reviewed 2026-10-13T18:33:06.354Z sha a1839d6 :: needs real behavior proof before merge. :: [P1] Revalidate WSL ownership before deleting a replacement installation | [P1] Revoke native ownership when acquisition never installs the package | [P1] Offer recovery instead of exiting on a persistent cleanup refusal

Reviewed October 14, 2026, 7:56 PM ET / 23:56 UTC (Revision 6).

[joelagnel]

@clawsweeper re-review

Proof capture is completed for the documented WSL installer lifecycle scope at a1839d6. The PR description now records that scope explicitly, with receipts and screenshots. Full native-flow testing was intentionally skipped; WSL testing was sufficient for the installer lifecycle scenarios exercised.

Please reassess the proof labels against this scope: proof: sufficient and removal of status: 📣 needs proof. Review correctness and ownership findings separately; they remain visible for this re-review.

The requested product behavior is automatic cleanup of Companion-owned Gateways after uninstall through Windows Settings, allowing reinstall to provision a fresh Gateway. Gateways installed separately before Companion setup must remain user-owned.

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/38445064050
• Updated: 2026-10-13T18:14:19.394Z

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/38447825022
• Updated: 2026-10-13T18:34:35.787Z

[bkudiess]

The cleanup and refresh goal makes sense, but these lifecycle cases need fixing before merge. Reviewed head: a1839d68f082cea6c4bd7e9836eafa8a6e302c3e.

WSL deletion safety

In src\OpenClaw.SetupEngine\GatewayPackageCleanup.ps1:

• Lines 68-76: A historical uninstall/reinstall receipt can authorize deleting a Gateway still in use during an ordinary update. Please adopt legacy ownership prospectively and test that sequence.
• Lines 119-143: Suppressed Lxss read errors become "no registrations", allowing disk deletion without proving absence. Please fail closed on incomplete inventory and test access-denied handling.

Local mocked checks reached deletion in both cases; no real distro was removed.

Native package ownership

GatewayPackageCleanup.ps1:146-149 can remove the shared Store package while another installed Companion uses it. Please preserve surviving consumers and test uninstalling one of two Companion variants.

NativeGatewaySetupPage.xaml.cs:193-199 also claims ownership before WinGet starts. A definite failure-before-deployment leaves that claim over a later independent installation. Please distinguish pending acquisition from proven ownership and reconcile failed attempts without losing genuinely in-flight deployments.

Local mocks selected package removal for both ownership scenarios; their user impact is supported by code tracing.

Recoverable cleanup and reinstall

App.xaml.cs:657-661 exits on every launch when a moved-path ownership conflict remains pending. Please retain the deletion safeguards but provide a safe preserve/disown recovery route.

GatewayPackageCleanup.ps1:141-155 also leaves saved authenticated targets behind. When settings survive uninstall, the existing startup policy can skip onboarding and reconnect to the removed Gateway. Please test reinstall with preserved settings and reconcile only removed managed targets, preserving unrelated profiles and MCP state. These recovery findings are statically supported.

Consistent guidance

docs\ONBOARDING_WIZARD.md:244-245 still promises healthy-package bypass, contradicting the new Store-refresh policy at line 202. Please qualify the bypass to development/patch packages.

[joelagnel]

Review-update runtime proof: the product cleanup refused to unregister a WSL distro recreated at the same name and path with a different registration ID. The real preservation prompt then allowed startup to continue, retained the replacement distro and its data canary, and retired the stale managed connection and authentication. This used a disposable signed MSIX containing product assemblies and an actual WSL registration.

{
  "replacementRegistrationPreserved": true,
  "replacementDataPreserved": true,
  "productRecoveryPromptShown": true,
  "preserveContinuedStartup": true,
  "staleManagedAuthRetired": true
}

Final commit 0abcdf4c0e996112a3832bf9e4c16f7d8f7a5eb7 is pushed. The full build, Shared/Tray/SetupEngine suites, independent reviews, and commit-coherence check passed. The final embedded worker registered and retired a real per-user task after the user-SID naming change. Detailed results and proof limits are in the updated PR description.

[joelagnel]

Addressed the actionable review comments in the single amended commit 0abcdf4c0e996112a3832bf9e4c16f7d8f7a5eb7:

• Legacy adoption authorizes future cleanup only; historical receipts cannot delete a retained Gateway on upgrade.
• WSL cleanup requires the recorded registration ID/path and readable inventory; replacements, redirected paths, and unknown data are preserved. Deliberate recreation can register its new identity.
• Native ownership requires verified acquisition of a previously absent package. Independent installations, uncertain deployments, replacements, and packages shared by Companion variants are retained.
• Recovery offers preserve/continue and retires only the affected managed authentication, including legacy formats. Task names include the current user SID. Documentation and existing test expectations match these rules.

Full build passed. Shared: 4,261 passed, 36 skipped; Tray: 4,000 passed; SetupEngine: 2,291 passed, 1 skipped. Ten controlled ownership scenarios, three reconciliation checks, task-SID checks, and real signed-MSIX/WSL lifecycle proof passed. Independent code/structured reviews are clean; final commit coherence is OK. No new test files or test methods were added.

Recovery dialog and replacement-preservation proof. The PR description distinguishes the real lifecycle proof from mocked native inventory, the intentionally skipped full native flow, and the separate MXC download/UI-capture blockers.

@clawsweeper review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/38657230376
• Updated: 2026-10-14T23:58:21.153Z

[karkarl]

Implemented the two accepted review findings in 0a74e82e, preserving the contributor branch and its history. The published head is 98f9a62817ddc245821fca0b167ae8f31deb4f30, including main through 4da2e1e7c5b753d9e453141f84073d51ed21f427.

1. Do not adopt unbound legacy WSL registrations. Startup no longer treats a schema-1 marker plus matching name/path as permission to delete a distro. This preserves a replacement installed before the first upgraded startup. Fresh creation can still establish ownership, and existing bound registrations refresh without rebinding. The worker also checks the existing name, registration ID, and path before accepting a non-creation registration.
2. Fail closed on malformed cleanup evidence. The worker validates pending receipts under the cleanup lock before preservation, ownership mutation, or removal, and writes receipt updates atomically. C# validates receipt/settings types before retiring credentials. Invalid data retains the pending evidence, does not offer disowning as a workaround, and reaches the startup notification/exit path with the affected file paths and repair guidance. Normal ownership-conflict preservation remains available.

GatewayPackageCleanup remains the cleanup owner; App only invokes the startup gate and presents the error. Regression tests cover legacy replacement preservation, malformed receipts and settings, retained authentication, valid targeted reconciliation, preservation choices, and the exact embedded Windows PowerShell 5.1 registration/receipt functions in disposable directories. Documentation records the conservative legacy behavior.

Validation

Final-head validation used native Windows ARM64 with OPENCLAW_REPO_ROOT set to the isolated worktree. $out below is the session artifact directory; its machine-specific path is omitted.

.\build.ps1
dotnet test .\tests\OpenClaw.Shared.Tests\OpenClaw.Shared.Tests.csproj --no-restore --logger 'trx;LogFileName=head-shared.trx' --results-directory "$out\validation" --verbosity quiet
dotnet test .\tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --no-restore --logger 'trx;LogFileName=head-tray.trx' --results-directory "$out\validation" --verbosity quiet
dotnet test .\tests\OpenClaw.SetupEngine.Tests\OpenClaw.SetupEngine.Tests.csproj --no-restore --logger 'trx;LogFileName=head-setup.trx' --results-directory "$out\validation" --verbosity quiet

Check	Passed	Failed	Skipped
Full repository build	Build passed	0	N/A
Shared	4,312	0	35
Tray	4,072	0	0
SetupEngine	2,331	0	1

The earlier focused cleanup plus current-main WSL registration-retry run also passed: 32 passed, 0 failed, 0 skipped. These tests are included in the final-head suites above. The build's documentation validation passed.

Real behavior proof and remaining gates

The filesystem and exact-function PowerShell tests are isolated regression evidence, not real packaged uninstall or Gateway/MXC proof. The earlier signed-MSIX/WSL lifecycle evidence in the PR description belongs to 0abcdf4c and must not be treated as current-head evidence.

The strict command below was attempted before the final main-only integration, with the same cleanup implementation:

.\scripts\validate-mxc-e2e.ps1 -NoBuild -RuntimeIdentifier win-arm64 -ResultsDirectory "$out\validation\mxc"

Failed: 11 passed, 7 failed during fixture initialization. Ubuntu 24.04 acquisition returned Wsl/InstallDistro/HTTP_E_STATUS_NOT_FOUND (HTTP 404), before Gateway/MXC execution. The disposable fixture tore down successfully. No -AllowSkip or capability bypass was substituted.

The required proof pools remain windows-11-arm64, windows-clean-installer-upgrade, windows-winui-interactive, windows-wsl-gateway-e2e, and windows-wsl-mxc. Current-head signed upgrade/uninstall/reinstall, real native acquisition/removal, and visible packaged recovery UI have not been exercised by this patch validation. No real user Gateway was uninstalled.

An independent Copilot P0-P3 source review of the repair delta found no remaining P0/P1 issues. The final main merge left the cleanup implementation and its tests unchanged. The shared autoreview helper itself was unavailable (HTTP 401, no report produced); this is not a helper-clean or dual-model-clean claim.

This comment supersedes the description's prospective-adoption, single-commit, no-new-tests, and final-clean-review statements. Fresh CI and the remaining runtime proof still need evaluation; this update does not claim merge readiness.