[paulcam206]

What Problem This Solves

Fixes: onboarding connection failures can leave users without the visible feedback needed to understand why setup did not complete.

User Impact

User impact: Users get an actionable visible setup failure instead of a silent unsuccessful transition. Existing provider, pairing and authorization gates remain in place.

Current-head hosted review passed: Overall diamond lobster (5/6), Proof diamond lobster (5/6), Patch diamond lobster (5/6). The inspected normal-flow screenshots and retry diagnostics are linked below.

Why This Change Was Made

Surface the owning setup failure through existing state and localized presentation rather than manufacturing successful completion or bypassing the normal setup workflow.

Requested-capture qualification now verifies a non-default private desktop, exact owning process, visible/non-minimized window, display-contained geometry and the existing nonuniform-pixel threshold. It moves only that owned private window from its fixture offscreen position and records failed-attempt metadata before rejecting a blank frame. It never switches the shared input desktop or substitutes a rendered image.

Landing coordination: the independent onboarding drafts share MountedControlCapture.cs at one canonical test-helper path. Neither requires the other to build. Whichever lands second must rebase and preserve this split's geometry diagnostics rather than diverging or duplicating the helper.

Evidence

Current independent head: fed3ec72294497568756fcbf50ca9888f156e45e, based on main 2b7cfce17bb496ec5d8f0c563fb71ebb46e015fa, with published Microsoft.Mxc.Sdk 1.0.0 unchanged. Current-head CI has 11 successful checks, zero failed checks at refresh.

The missing real-pixel proof is now collected. A fresh normal source-built application, not the installed Hub, used a throwaway profile on an explicitly authorized desktop slot. No fixture mode, setup preview, mounted test host, credential, install/provisioning or port 18789 was used. Normal Welcome -> Existing Gateway -> Next -> Check produced the real missing-credentials validation error; a separate second Check invoked the same retry action. No successful authenticated connection is claimed.

Both frames show the error above usable navigation in the actual 720 x 640 DIP window (1080 x 960 physical pixels at 150% scaling). The error bottom is 66 physical pixels above the navigation buttons. The endpoint and setup-code regions are blacked out offline; no other pixels were changed.

Public first-frame UIA diagnostics, retry UIA diagnostics, image/geometry provenance manifest and capture qualification are inspectable. Both public image URLs returned HTTP200 and byte-identical sanitized files. The source AppVersion embeds the full fed3 head.

Change Type

• Bug fix
• Feature
• Refactor
• Docs or instructions
• Tests or validation
• Security hardening
• Chore or infrastructure

Scope

• Tray or WinUI UX
• Windows node capability
• Local MCP or winnode
• Gateway, connection, or pairing
• Setup or onboarding
• Permissions, privacy, or security
• Tests, CI, or docs

Required proof pools

• windows-winui-interactive: actual onboarding failure and recovery presentation.
• windows-wsl-gateway-e2e: setup admission, operator/node readiness and pairing failure surfaces.

Validation

Existing exact-source mandatory closeout is unchanged:

Command	Result
.\build.ps1	PASS
dotnet test .\tests\OpenClaw.Shared.Tests\OpenClaw.Shared.Tests.csproj --no-restore	4,635 passed, 0 failed, 25 configured skips
dotnet test .\tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --no-restore	4,444 passed, 0 failed, 0 skipped; owned private desktop
Mounted NativeEditor_FailureRemainsVisibleWithoutScrolling, both routes	2 passed, 0 failed, 0 skipped
Historical requested private native capture	0 passed, 2 failed strict pixel qualification; retained, not relabeled
Fresh standalone normal-entry real-desktop capture, current fed3	Two qualified owned-HWND frames plus actual first/retry UIA diagnostics; PASS

The current app was rebuilt with -r win-x64 -p:Platform=x64 -p:DevBuild=false.
Visible proof completed 2026-10-21T21:39:34Z; exact app PID 53640 exited by
21:39:37.4729583Z and was independently verified absent. The desktop was released
immediately, before redaction/publication. The controller used process-local
quiet error-mode/WER scopes. Launch used CreateNoWindow, inherited error-mode
flags and no shell error dialog, exact PID/path/start checks and an explicit
90-second expiry gate. Capture was PrintWindow against the owned
window HWND only, with strict nonblank qualification, never a desktop capture.

No authenticated Gateway was bound or persisted. Next remains enabled by design
because it performs its own check before saving; these images do not claim that
Next completed or that invalid credentials were accepted. Historic combined63a
onboarding remains separate supporting history.

Real Behavior Proof

• Environment tested: actual running Companion source executable, normal first-run Welcome and Existing Gateway form, throwaway profile, no fixture or preview mode, no real credentials.
• PR head or commit tested: exact fed3ec72294497568756fcbf50ca9888f156e45e; the app's embedded version includes this complete SHA.
• Exact steps or command run: PID-bound native UIA invoked Continue, selected the visible Existing Gateway choice, invoked Next, resized only that owned window to 720 x 640 DIP, entered a throwaway non-18789 loopback endpoint and invoked Check twice. Empty credentials deliberately exercise the real validation failure without contacting a Gateway or writing a registry.
• Evidence after fix: actual helper output, with file observation timestamps:

2026-10-21T21:39:31.6817149Z
{"ok":true,"processId":53640,"action":"invoke","id":"CheckButton","name":"Check connection"}
2026-10-21T21:39:33.4086030Z
{"ok":true,"processId":53640,"action":"invoke","id":"CheckButton","name":"Check connection"}

Actual copied UIA state after both invocations:

{
  "Message": "Enter a setup code or shared token for this gateway.",
  "ResultBar": {"offscreen": false, "bottomInWindow": 799},
  "BackButton": {"enabled": true, "offscreen": false, "topInWindow": 865},
  "CheckButton": {"enabled": true, "offscreen": false, "topInWindow": 865},
  "NextButton": {"enabled": true, "offscreen": false, "topInWindow": 865},
  "visibleGapPixels": 66
}

• Observed result: the real validation error stays above visible, usable actions after initial Check and retry, without scrolling. The two independently captured frames and selected raw UIA diagnostics are above, not just test counters.
• Screenshot or artifact links verified? Yes: public sanitized image URLs fetched and hash-checked; only window pixels captured, with endpoint/code input regions redacted. Raw originals/profile data remain private.
• Not verified or blocked: authenticated Gateway success, real provider/package/pairing behavior and whole interactive-pool qualification. The previous screenshot resource blocker is resolved for this exact current head; no real connection or policy bypass was used.

Security Impact

• New permissions or capabilities? No
• Secrets or tokens handling changed? No
• New or changed network calls? No
• Command or tool execution surface changed? No
• Data access scope changed? No
• If any answer is Yes, explain the risk and mitigation: No new permissions, credential-handling contract, network endpoint or execution capability. Failures remain failures; presentation does not authorize or silently complete setup.

Compatibility and Migration

• Backward compatible? Yes. Existing authenticated connection, consent and ownership contracts remain authoritative.
• Config or environment changes? No persistent source-contract change.
• Migration needed? No
• If yes, list the exact upgrade steps: N/A. The separate local environment path repair is not a migration or private-file workaround shipped by this PR. Published SDK1.0.0 pins are unchanged.

Review Conversations

• I replied to or resolved every bot review conversation addressed by this PR.
• I left unresolved only conversations that still need maintainer judgment.

Current-head hosted review passed the readiness gate. No merge is authorized.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

Moves Gateway connection results outside the scrolling form so validation errors remain visible above navigation.

Example: In a 720 × 640 DIP setup window, press Check connection with no setup code or shared token, then retry.

• Before: The validation message can sit below the visible portion of the scrolling form.
• After: The message remains visible above usable Back, Check connection, and Next buttons after both attempts.

Review scores

Measure	Result	What it means
Overall readiness	🦞 diamond lobster (5/6)	A focused layout repair with direct current-head UI proof, meaningful rendering coverage, and no actionable correctness or security findings.
Proof confidence	🦞 diamond lobster (5/6) ✨ media proof bonus	Sufficient (screenshot): Inspected current-head Windows screenshots and matching diagnostics exercise normal Welcome → Existing Gateway → Check with empty credentials, then retry, showing the existing error above visible usable navigation at 720 × 640 DIP; authenticated Gateway success is outside this presentation change.
Patch quality	🦞 diamond lobster (5/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: Users can miss the reason a Gateway connection check failed because its feedback scrolls with the form.
Reason: The change restores actionable feedback within the existing editor contract; new environment controls are limited to optional test capture and add no product setting.

Merge readiness

✅ Ready for maintainer review

Keep open: current main still has the scrolling-error layout, and this PR provides a focused, visibly proven fix with no actionable findings; the previous draft hold is resolved.

Priority: P2
Reviewed head: fed3ec72294497568756fcbf50ca9888f156e45e

Before merge

None.

Findings

None.

Tests

• Missing end-to-end proof: A failing-base execution of the new mounted regression is not supplied; current-head normal-entry screenshots demonstrate the repaired layout.

Agent review details

How this fits together

The native connection page receives connection drafts and host results, renders localized feedback, and advances only through the existing committed-connection callback.

flowchart TD
    A[Welcome or Advanced setup] --> B[Native connection page]
    B --> C[Existing connection host]
    C --> D[Validation or connection result]
    D --> E[Persistent result bar]
    E --> F[Visible navigation actions]

Loading

Technical review

Best possible solution:

Land the focused result-bar relocation with its rendering coverage and supplied normal-entry proof.

Do we have a high-confidence way to reproduce the issue?

Current-main XAML places the result after the editor inside the scrolling region, establishing the clipping path; no current-main runtime reproduction was run.

Is this the best way to solve the issue?

Relocating the existing result control fixes its layout owner directly while preserving messages, live announcements, navigation, and connection gates.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 48cb8a18fdb5.

Provenance checked

• Native connection result placement keeps the original intent (3eed1f1: The onboarding redesign established the shared native connection editor, separate progress/actions, and actionable recovery while preserving connection ownership.)
• Localized feedback and mounted editor coverage keeps the original intent (f433589: The localization repair retained connection transaction behavior while correcting editor labels and status messages.)

Testing

Proof path: shipped entry point.

Security

None.

Evidence

What I checked:

• Pinned production change: The introduced diff relocates the existing ResultBar into its own automatic row above NavigationFooter; event handlers, localization, and transaction behavior are unchanged. (src/OpenClaw.SetupEngine.UI/Pages/SetupNativeConnectionPage.xaml:65, fed3ec722944)
• Still necessary on main: Fetched main still places ResultBar inside ScrollViewer, retaining the central visibility problem. (src/OpenClaw.SetupEngine.UI/Pages/SetupNativeConnectionPage.xaml:63, 48cb8a18fdb5)
• Original contract and feature history: Main blame attributes the existing result/footer layout to the merged onboarding redesign, feat: guide Windows onboarding from setup to native AI tasks #1531 (feat: guide Windows onboarding from setup to native AI tasks); its stated design preserves actionable recovery and connection ownership. (src/OpenClaw.SetupEngine.UI/Pages/SetupNativeConnectionPage.xaml:63, 3eed1f1bac56)
• Distinct rendering regression coverage: The added Existing and Remote cases mount the production page, induce a failed check, assert visible error geometry above the footer, and retain no-advance/no-registry-write assertions. (tests/OpenClaw.Tray.UITests/OnboardingWindowsFlowTests.cs:866, fed3ec722944)
• Inspected normal-entry screenshots and diagnostics: Both downloaded screenshots were inspected directly and their hashes match proof-manifest.json. The manifest ties them to the reviewed head and normal application entry on Windows at 150% scaling; first Check and retry show the real missing-credentials message 66 physical pixels above enabled navigation. Evidence: https://github.com/paulcam206/openclaw-windows-node/blob/f67ace7c097baedb39095a4074c3be13fdca775e/proof-manifest.json. (proof-manifest.json, f67ace7c097b)
• Current review state and validation: REST confirms the reviewed head is ready for review and mergeable clean. Supplied check context reports no failed checks; independently inspected exact-head results include successful CI Gate and UI tests. The full body reports successful build, Shared, Tray, and both focused mounted cases. No builds or tests were run during this read-only review. (fed3ec722944)

Likely related people:

• Dallin Romney: Raw commit 8dfedf9 adds tests/OpenClaw.Tray.UITests/OnboardingWindowsFlowTests.cs:821 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: 8dfedf9616c5; files: tests/OpenClaw.Tray.UITests/OnboardingWindowsFlowTests.cs)

Labels

Label changes:

• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.
• remove status: ⏳ waiting on author: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

• P2: A focused onboarding visibility repair keeps existing validation feedback and retry actions discoverable in shorter windows.
• rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.
• proof: sufficient: Contributor real behavior proof is sufficient.
• proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

History

Review history (3 earlier review cycles)

• reviewed 2026-10-21T04:26:59.532Z sha a514577 :: needs real behavior proof before merge. :: none
• reviewed 2026-10-21T20:13:32.033Z sha fed3ec7 :: needs real behavior proof before merge. :: none
• reviewed 2026-10-21T21:56:19.606Z sha fed3ec7 :: needs changes before merge. :: none

Reviewed October 27, 2026, 4:54 PM ET / 20:54 UTC (Revision 4).

[paulcam206]

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Review in progress
• Detail: The exact-review reservation is active; Codex is reviewing the item.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/39667808460
• Updated: 2026-10-21T20:09:44.883Z

[paulcam206]

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/39682898001
• Updated: 2026-10-21T21:57:55.052Z

[paulcam206]

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/40582414355
• Updated: 2026-10-27T20:56:28.731Z

[CompleteDotTech]

Confirming the symptom this PR fixes, on Hub v2026.9.8-1 (Windows 11 Pro 26300.9457, over RDP).

Steps: Setup → Connect to a gateway → enter an existing Gateway → Check connection with credentials it rejects.

Observed: maximized (2560×1440), the error is visible above the navigation. In the restored window (693×803), the SSH section and the error banner fall below the fold. The only cue is a thin scroll indicator, so the failed check looks silent. I haven't tested this PR's head yet.

Screenshots (gateway address and token field blacked out)

Maximized:

Restored:

[CompleteDotTech]

Tested this PR's head (fed3ec7) in a fresh Windows 11 VM (26300.9457), built from source with ./build.ps1. In a 720×640 window with an empty setup code and token, Check connection shows "Enter a setup code or shared token for this gateway." above Back / Check connection / Next, and still does on a second Check. On main (2b7cfce) at the same size, the error is reported off-screen.

Screenshots (address and code fields masked)

Before (released v2026.9.8-1, restored window): the error is below the fold

This PR, first Check / retry: