[RomneyDa]

What Problem This Solves

Fixes: the Store upgrade CI test fails with 0x80244007 when a hosted runner retains stale Windows Update delivery state.

User Impact

Contributors can run the existing Store-to-candidate upgrade proof with fresh delivery state. No installed-product behavior, Partner Center configuration, signing policy, or release publication changes. The reset is confined to the disposable GitHub-hosted Windows runner and only the Store upgrade matrix entry.

Why This Change Was Made

A standalone hosted reproduction exposed Windows Update SOAP ConfigChanged during GetExtendedUpdateInfo2, before the candidate package was involved. Gateway and an unrelated Store product both failed. Resetting Windows Update state on that same runner restored the Gateway install.

Prepare fresh delivery state before the test's single install attempt: stop wuauserv, rename SoftwareDistribution (retain it until runner disposal), and restart the service. Reject other runner environments and bound preparation to two minutes. Preparation and restart failures remain failures; a secondary restart error cannot replace the original error. No retries, skips, weakened upgrade assertions, or local-machine recovery hook.

The existing workflow contract suite executes the actual step against temporary filesystem fixtures and mocked services, covering eight success/guard/failure scenarios.

Evidence

Current PR head: c6dd70e275856a8b2a49a4b607d31cd5ced7e86f, based on b50ec33561a7a429587649ab07977321025c421f.

Fresh local validation (PowerShell 7 on macOS):

• pwsh -NoProfile -File scripts/Test-WorkflowSigningConfiguration.ps1: passed, including all eight Store preparation scenarios.
• TEMP=/tmp pwsh -NoProfile -File scripts/Test-SigningInputs.Tests.ps1: passed. First invocation without TEMP failed because the Windows-oriented suite expects that variable; rerun supplied the host temporary directory without changing source.
• scripts/Test-MSIXUpgradeMatrix.Tests.ps1, scripts/Test-MSIXUpgradeSafety.Tests.ps1, and scripts/Test-WorkflowPackageVersion.Tests.ps1: passed.
• actionlint -ignore 'unexpected key "cache-mode"' .github/workflows/gateway-msix.yml: passed. Stock actionlint rejects the repository's 12 existing cache-mode extension entries on main too; only that known extension diagnostic was excluded.
• git diff --check: passed.

Prior native causal proof, not presented as current-head execution:

• Standalone failure trace: ConfigChanged, zero download metadata, no repository candidate involved.
• Same-runner recovery experiment, diagnostic head 84f72a78bafeedf3c2a2379476efca5541f68665: Gateway and control product failed before reset; after reset, GetExtendedUpdateInfo2 succeeded and AFTER_CACHE_REFRESH_INSTALL_EXIT=0. The diagnostic job deliberately retained the original failure exit, so its overall red conclusion is expected.
• Windows 11 ARM64 Parallels independently installed the published Gateway 2026.10.400.0; probe registration and task directory were removed. No Windows Update reset was applied to that VM.

Current-head hosted full package/Store-upgrade proof is running in CI. Managed build, NativeAOT, and live signing/submission were not run locally: this changes only the CI preparation step and its contract tests. No claim of passing current-head Store upgrade proof or merge readiness yet.

Maintainer edits: this branch is in the canonical repository and uses normal repository write permissions. GitHub rejects maintainer_can_modify=true for same-repository PRs because that flag applies only to forks.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR refreshes Windows Update delivery state before the Store-upgrade test on disposable GitHub-hosted Windows runners.

Example: CI installs Store product 9NV70LV3D6XC before testing a candidate bundle.

• Before: Stale delivery state can stop baseline acquisition with 0x80244007 before the candidate is involved.
• After: The Store matrix entry stops Windows Update, retains its old cache under another name, restarts the service, and attempts the unchanged upgrade test.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	Focused and source-correct, with meaningful fixture validation and prior causal evidence; current-head Windows execution remains incomplete.
Proof confidence	🦐 gold shrimp (3/6)	This maintainer-authored PR is outside the ordinary contributor proof gate; supplied evidence reports native acquisition recovery using the same service/cache operations, while exact-head fixture coverage passed and the hosted Store scenario remained pending.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: Contributors encounter a failing Store-upgrade gate before CI can exercise their candidate package.
Reason: The maintainer-authored direction addresses a documented operational failure with a narrowly scoped runner change.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: it is a focused, maintainer-authored repair absent from main, and source review found no actionable defect.

Priority: P2
Reviewed head: c6dd70e275856a8b2a49a4b607d31cd5ced7e86f

Before merge

None.

Findings

None.

Tests

• Missing end-to-end proof: Current-head hosted preparation followed by Store acquisition and state-preserving candidate upgrade had not completed at review time.

Agent review details

How this fits together

The release workflow builds candidate packages and runs isolated upgrade scenarios whose results gate release authorization; this change prepares only the Store scenario's runner.

flowchart TD
  A[Candidate bundles] --> B[Upgrade matrix]
  B --> C[Store runner preparation]
  C --> D[Store baseline installation]
  D --> E[Candidate upgrade and state checks]
  B --> F[Other upgrade scenarios]
  E --> G[Release authorization gate]
  F --> G

Loading

Technical review

Best possible solution:

Keep runner preparation in the existing Store matrix entry while preserving the single installation attempt and all upgrade gates.

Do we have a high-confidence way to reproduce the issue?

The PR records a same-runner failure and recovery experiment, and the merged submission PR documents the failure on main; this review did not independently reproduce it on Windows.

Is this the best way to solve the issue?

The preparation targets the failing runner prerequisite at its workflow boundary, preserves the original error if restart also fails, and avoids adding recovery behavior to the installed product.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against b50ec33561a7.

Provenance checked

• Isolated upgrade matrix and release gating keeps the original intent (7d7acad: improve: finish MSIX upgrade validation in parallel #141 isolates each transition on its own runner while preserving authentic Store updates and aggregate failure gating.)
• Candidate dispatch coverage and executable workflow contracts keeps the original intent (2062d05: fix: validate Gateway upgrades during release dispatch #178 requires each release candidate to pass its own upgrade matrix and exercises embedded workflow logic through fixtures.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Pinned change and main comparison: The introduced diff adds one guarded preparation step and executable fixture coverage; main proceeds directly to the existing transition test. (.github/workflows/gateway-msix.yml:676, c6dd70e27585)
• Preserved upgrade contract: The existing harness still requires the authentic Store baseline, a newer candidate, matching package identity, and exact LocalState-marker retention; no retry, skip, or weakened assertion is introduced. (scripts/Test-MSIXStoreUpgrade.ps1:204, c6dd70e27585)
• Prior causal experiment: The PR reports same-runner acquisition recovery after resetting delivery state in https://github.com/openclaw/openclaw-windows-packaging/actions/runs/39737846653; its diagnostic commit independently confirms the stop, rename, restart, and second-install experiment. (.github/workflows/store-acquisition-diagnostic.yml, 84f72a78bafe)
• Independent report of inherited failure: feat(release): automate Microsoft Store submissions #99 records the same baseline-installation failure on its candidate and untouched main, before candidate upgrade or Store submission.
• Exact-head validation status: https://github.com/openclaw/openclaw-windows-packaging/actions/runs/39739067625 passed host, workflow-contract, NativeAOT, and architecture-build checks; the Store shard was still downloading its candidate, with preparation and transition pending. (c6dd70e27585)
• Policy and inspection limits: Read the full root and scripts AGENTS.md; no .github ancestor policy, maintainer-notes directory, or pr-simplify skill was present. PowerShell startup failed because its cache directory was read-only, so inspection used shell reads. Diagnostic-log downloads were proxy-blocked. No target code or tests ran, and final Git status remained clean. (AGENTS.md, c6dd70e27585)

Likely related people:

• Dallin Romney: Raw commit 2062d05 adds .github/workflows/gateway-msix.yml:620 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 2062d05176bd; files: .github/workflows/gateway-msix.yml)
• Paul Campbell (AgOS): Raw commit 4a55f98 adds .github/workflows/gateway-msix.yml:543 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: 4a55f98a85f5; files: .github/workflows/gateway-msix.yml)

Labels

Label changes:

• add P2: The repair addresses an evidenced CI prerequisite failure without changing installed-product behavior.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P2: The repair addresses an evidenced CI prerequisite failure without changing installed-product behavior.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Use the existing hosted Store scenario's result to confirm preparation and the subsequent state-preserving upgrade.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 22, 2026, 3:29 AM ET / 07:29 UTC.