feat: restart the managed gateway after sign-in

[paulcam206]

What Problem This Solves

A managed gateway must restart after sign-in so a completed setup does not leave the operator to start it manually.

User Impact

Setup reports recovery state. The managed gateway restarts at user logon through a per-user scheduled task, with a Startup-folder fallback if task registration is refused.

Why This Change Was Made

One generated launcher is shared by both recovery lanes, making their command behavior reviewable and preventing them from diverging. This layer adds recovery registration; it does not add diagnostic collection or fresh reset.

Review fixes addressed

• Recovery invokes the package-bound clawctl.exe app execution alias rather than a versioned installation path or the agent entrypoint. Existing actions with the old versioned path are treated as drift and repaired.
• Generated command files are UTF-8 without a BOM so CMD can execute them; the schtasks XML remains UTF-16 with a BOM as required by that tool.
• Trigger-user comparison resolves identities to SIDs, preserving idempotent setup while detecting a task retargeted to another user.
• Teardown removes recovery registration and surfaces removal failure. Cancellation is checked before scheduler launch, and the Startup fallback is validated before readiness is declared.

Current validation

Latest hosted follow-up: CodeQL traced generated recovery-file operations to .NET's environment-sensitive Startup-folder lookup. Recovery now resolves the Windows Startup known folder directly with SHGetKnownFolderPath before constructing any managed path; the 40 focused persistence tests, static-analysis quality gate, full 628-test suite, and x64 NativeAOT launcher publish pass.

Latest review hardening: generated activation C# now uses Windows PowerShell 5.1-compatible predeclared out variables. A regression test extracts the emitted source and compiles it with inbox Windows PowerShell 5.1.

Current layer head: 7130e294640f04fe712624cdaf52094b761263f2. This layer is included in the final integrated stack tip cce2b02f3acd5791654b7a6b1a5a9c27db5ff63b rebased onto 685ee93b7ebbec1e784205a3544c460bea740e11.

Integrated local gates: exact .NET SDK 10.0.100; Test-DotNetQuality.ps1 with 0 warnings/errors; full solution tests 642/642; NativeAOT x64 and ARM64 publishes for both launcher and session host; NativeAOT CLI, deployment, MXC, signing, runtime-input, release-identity, bundle, isolation-plugin, and packaging-relevance policy suites.

Live x64 MXC evidence: final-tip Developer Mode deployment registered OpenClaw.Gateway_0.1.2451.40134_x64__kaa03rpbbqef6 from workflow payload run 35191206689; openclaw --version returned OpenClaw 2026.9.4 (3a9d69d); clawctl status confirmed the isolated session was running. Earlier final-tip validation also exercised setup, Node.js 24.20.0 reuse, package-qualified activation, detached gateway launch, and redacted diagnostics collection.

Signed package evidence: local NativeAOT x64 and ARM64 packages and a multi-architecture bundle were composed and test-signed. Elevated upgrade validation passed all four proof-release transitions (v0.0.0.0 and v0.0.0.1, standalone and bundle), retained package-family LocalState in every transition, and accepted fresh standalone and bundle installs. The temporary certificate and test package were removed, then the Developer Mode registration was restored.

Layer 7 of 12. Parent: #48 - feat/session-gateway-service. Child: #50 - feat/session-diagnostics

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge. Reviewed September 17, 2026, 4:01 PM ET / 20:01 UTC (Revision 27).

ClawSweeper review

What this changes

Adds per-user gateway restart after Windows sign-in through a scheduled task or Startup-folder fallback, using a package-bound management entrypoint.

Merge readiness

⛔ Blocked before merge - 3 items remain

Keep open: this remains a distinct contribution absent from current main and belongs to an active collaborator-owned stack. The earlier concrete findings are addressed.

Priority: P2
Reviewed head: 7130e294640f04fe712624cdaf52094b761263f2
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A coherent implementation with substantial regression coverage; the remaining uncertainty is the installed application-identity transition.
Proof confidence	🌊 off-meta tidepool	Not applicable: The collaborator-authored PR is exempt from the ordinary contributor-proof gate. Its captured Windows setup, package activation, and detached-launch observations are relevant, but do not establish alias-setting preservation or post-upgrade sign-in recovery.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The collaborator-authored PR is exempt from the ordinary contributor-proof gate. Its captured Windows setup, package activation, and detached-launch observations are relevant, but do not establish alias-setting preservation or post-upgrade sign-in recovery.
Evidence reviewed	8 items	Verified review boundary: Reviewed the complete local delta from pinned merge base 056de40 to head 7130e29. The supplied test merge has stale parents and was not used to infer removal of main-branch behavior. Current-main necessity: Current main documents only package readiness and launcher version commands for clawctl, and its source tree lacks the gateway recovery manager and scheduler. Tag v2026.9.4-msix.0 points to this main revision; the supplied related PRs are open stack layers, not merged replacements. Earlier findings addressed: The generated launcher selects the exact package family and Control application, both CMD files select UTF-8 before consuming paths, emitted activation C# predeclares out variables, and task parsing counts all action elements. Regression coverage includes Windows PowerShell compilation and mixed task-action rejection.
Findings	None	None.
Security	None	None.

How this fits together

The Windows launcher manages OpenClaw’s isolated gateway session. Setup registers sign-in recovery, which activates the installed package’s management command to restart that gateway.

flowchart TD
  A[Explicit setup] --> B[Register recovery]
  B --> C[Per-user scheduled task]
  B --> D[Startup-folder fallback]
  C --> E[Shared package activation script]
  D --> E
  E --> F[Management entrypoint]
  F --> G[Owned gateway session]

Loading

Decision needed

Question	Recommendation
Must the App-to-Control transition preserve released clawctl alias settings, or is an explicitly documented reset acceptable for this release?	Verify preservation: Require Windows upgrade observations showing enabled and disabled alias preferences survive and enabled commands still dispatch correctly.

Why: The released package already exposes clawctl under App, and the supplied pre-release isolation decision does not explicitly settle compatibility for that existing alias.

Before merge

• Resolve merge risk (P1) - Moving clawctl.exe from App to Control may change existing alias registration or user-selected enablement during upgrade, making the command unavailable or resetting a disabled preference; the reported package and LocalState checks do not resolve this uncertainty.
• Complete next step (P2) - Resolve the App-to-Control alias upgrade contract with Windows compatibility observations or explicit maintainer acceptance of the demonstrated transition.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test delta	Production +1705/-15 lines; tests +1075/-15 lines	Production growth implements the stated scheduler, fallback, package activation, and reconciliation responsibilities.

Merge-risk options

Maintainer options:

1. Establish alias upgrade compatibility (recommended)
   Record enabled and disabled alias settings before and after upgrading the released manifest, then verify enabled alias dispatch and gateway recovery.
2. Approve the observed transition
   Accept an observed preference reset only with an explicit release decision and documented recovery instructions.

Technical review

Best possible solution:

Retain package-bound recovery while preserving installed alias preferences and demonstrating working dispatch and sign-in recovery across the supported package upgrade.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this adds automatic sign-in recovery; it is not a reproduced current-main bug. Alias upgrade behavior remains unverified.

Is this the best way to solve the issue?

Yes, the shared package-bound activation path is a coherent solution and avoids versioned executable paths; its installed-alias compatibility still needs resolution.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against 685ee93b7ebb.

Labels

Label justifications:

• P2: Sign-in recovery is a bounded Windows lifecycle improvement without evidence of an urgent shipped regression.
• merge-risk: 🚨 compatibility: The patch relocates an existing execution alias to a different application identity without demonstrating preservation of installed alias preferences.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The collaborator-authored PR is exempt from the ordinary contributor-proof gate. Its captured Windows setup, package activation, and detached-launch observations are relevant, but do not establish alias-setting preservation or post-upgrade sign-in recovery.

Evidence

What I checked:

• Verified review boundary: Reviewed the complete local delta from pinned merge base 056de40 to head 7130e29. The supplied test merge has stale parents and was not used to infer removal of main-branch behavior. (7130e294640f)
• Current-main necessity: Current main documents only package readiness and launcher version commands for clawctl, and its source tree lacks the gateway recovery manager and scheduler. Tag v2026.9.4-msix.0 points to this main revision; the supplied related PRs are open stack layers, not merged replacements. (README.md:62, 685ee93b7ebb)
• Earlier findings addressed: The generated launcher selects the exact package family and Control application, both CMD files select UTF-8 before consuming paths, emitted activation C# predeclares out variables, and task parsing counts all action elements. Regression coverage includes Windows PowerShell compilation and mixed task-action rejection. (tests/OpenClaw.Launcher.Tests/Gateway/GatewayPersistenceManagerTests.cs:497, 7130e294640f)
• Alias identity transition: The released manifest registers both aliases under App; this patch moves clawctl.exe under Control. GitHub content inspection confirmed the manifest blob is unchanged from the previous reviewed head, so the existing upgrade concern remains applicable. (src/OpenClaw.Launcher/Package.appxmanifest:55, 7130e294640f)
• Upgrade evidence coverage: The captured PR body reports real Windows package activation, detached gateway launch, four signed-package upgrade transitions, and fresh installs. The checked-in upgrade harness verifies package identity, status, and LocalState retention; its transition assertions do not verify alias enablement, alias dispatch, or sign-in recovery. These observations therefore do not settle the application-identity transition. (scripts/Test-MSIXUpgrade.ps1:238, 7130e294640f)
• Recovery authority boundary: Recovery derives the current Windows SID and package family, registers an InteractiveToken task at LeastPrivilege, and checks current package registration before activation. Gateway startup re-enters setup, session ownership, generation, and lifecycle-lock checks rather than persisting credentials or bypassing those checks. (src/OpenClaw.Launcher/Gateway/GatewayRuntime.cs:23, 7130e294640f)

Likely related people:

• paulcam206: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Linus Huang: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Complete the existing follow-up with redacted fresh-install and upgrade observations for alias settings, command dispatch, and recovery, including a non-ASCII profile under a legacy code page.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (26 earlier review cycles; latest 8 shown)

• reviewed 2026-09-17T16:11:46.227Z sha 5bcbb60 :: blocked before merge. :: none
• reviewed 2026-09-17T16:24:00.751Z sha 9af89b5 :: blocked before merge. :: [P1] [P1] Emit C# 5-compatible out arguments for Windows PowerShell
• reviewed 2026-09-17T16:38:16.806Z sha 876965c :: blocked before merge. :: [P1] [P1] Emit C# 5-compatible out arguments for Windows PowerShell
• reviewed 2026-09-17T16:56:37.103Z sha 876965c :: blocked before merge. :: [P1] [P1] Predeclare out variables in the generated activation code
• reviewed 2026-09-17T17:04:46.363Z sha 876965c :: blocked before merge. :: [P1] [P1] Predeclare out variables in the generated activation code
• reviewed 2026-09-17T19:01:31.749Z sha 3a11ece :: blocked before merge. :: none
• reviewed 2026-09-17T19:22:09.498Z sha e591968 :: blocked before merge. :: none
• reviewed 2026-09-17T19:40:38.608Z sha e591968 :: blocked before merge. :: none