refactor(connection): extract domain coordinators

[bkudiess]

Summary

• Extract node lifecycle/generation/start/recovery/telemetry into NodeConnectionCoordinator.
• Extract bootstrap/device/shared-token handoff, durable-token clearing, and operator recovery timing into BootstrapTokenLifecycle.
• Extract device-pair approval, confirmation, dedupe, and bounded reconnect queue into DevicePairApprovalCoordinator.
• Keep GatewayConnectionManager as the stable public façade and sole writer of the overall state machine, operator lifecycle, active gateway/identity/tunnel, operator reconnect, v2 persistence, DI, and disposal.
• Deduplicate operator/node credential failure copy through one internal pure formatter.

GatewayConnectionManager shrinks from 3,892 to 2,657 lines without changing IGatewayConnectionManager behavior or constructor shape.

Invariants

• Manager lifecycle generation and coordinator node generation remain singular and independently owned.
• Superseded attempts cannot write snapshots, clear tokens, approve stale requests, or schedule reconnect.
• Pairing workflows reacquire and revalidate the current operator client.
• Bootstrap clears only after canonical operator and node role tokens are durably readable.
• Credential precedence remains solely in CredentialResolver; paired identities are never downgraded.
• Managed-local provenance/repair, SSH recovery, BrowserProxy ordering, setup, and App/window owners remain unchanged.
• Existing telemetry signal names/tags/categories are byte-identical.

Validation

Exact latest-main stacked head 2467fbc4 on B0 2a5fafb8 and main cdcb74f4:

• Build: all 5 projects
• Shared: 3,469 passed
• Connection: 562 passed
• Tray: 2,116 passed
• WinNode CLI: 126 passed
• B0/ledger/OpenClawGatewayClient focused: 236 passed
• B1 owners/formatter/telemetry focused: 27 passed
• Preserve native tool identity in chat #1078 native-tool focused: 519 passed
• Preserve native tool identity in chat #1078 UI screenshot proof: 1 passed
• Complete stack hygiene: clean

Real behavior proof

• Setup/connect E2E: 16 passed
• Device revocation/recovery: 1 passed
• Network recovery: 2 passed
• winnode --list-tools: 51 tools, including 3 camera tools
• app.connection.status: Idle, LocalMcpOnly, MCP running
• Raw tools/list and tools/call succeeded
• Source-blind UI Automation confirmed Connection selected, disconnected, no gateway, and the dynamic MCP endpoint

Review

• GPT-5.6 Sol found stale node-token clearing and a leaked node start guard; both were fixed with lifecycle leases/guard propagation and regressions.
• Final Claude Opus 4.8: clean
• Final GPT-5.6 Sol: clean
• Final rubber-duck: clean
• Latest-main integration review found no Preserve native tool identity in chat #1078/B0/B1 protocol, telemetry, credential, or generation regression.
• Bundled autoreview failed closed before model invocation on credential-oriented filenames/content. No bypass or truncated result was accepted.

Architecture

Adds authoritative and closed ledger rows for node connection, bootstrap lifecycle, and device-pair approval. Source guards prevent reintroducing node generations/CTS/start/telemetry, bootstrap timing flags, pairing reconnect fields, or duplicate credential failure formatting into the manager.

Stack

Position 2 of native Connection stack #1102, directly based on B0 protocol-core PR #1095. B2 ConnectionPage ownership will append after A0 settings reconciliation.

ClawSweeper P1 follow-up (head 95a88b12)

Addresses the ClawSweeper P1 on this PR: node token recovery ran on the connector's lifecycle-lock-holding callback stack.

Root cause: NodeConnector raises ConnectionFailure while holding _clientLifecycleLock and requires subscribers to return promptly. HandleConnectionFailure called TrackBackground(HandleDeviceTokenMismatchAsync(attempt)), which evaluated the recovery's synchronous prefix (attempt-lease acquire, endpoint trust check, DeviceIdentity node-token clearing) on the lock-holding stack whenever awaits completed synchronously, risking blocked lifecycle and deadlock. Base B0 2a5fafb8 dispatched this via Task.Run; the extraction dropped that boundary.

Owner fix (one line): TrackBackground(Task.Run(() => HandleDeviceTokenMismatchAsync(attempt))) in NodeConnectionCoordinator.HandleConnectionFailure. Recovery runs off the callback stack; the unwrapped proxy task is still tracked in _backgroundTasks and drained on shutdown; generation and credential fencing are byte-for-byte unchanged.

Deterministic proof (revert fails): with the fix reverted, ConnectionFailureRecovery_DetachesFromConnectorCallbackThread fails (callback stays blocked while recovery is suspended at the gated trust check) and ConnectionFailureRecovery_SupersededNodeGeneration_PreservesNodeToken fails (token cleared inline before the supersession lands). With the fix both pass; the two ordering tests were re-run 3x green.

Validation (head 95a88b12):

• Build: all 5 projects
• Connection: 567 passed
• Shared: 3,437 passed / 32 skipped
• Tray: 2,116 passed
• WinNode CLI: 126 passed

Review: rubber-duck, Claude Opus 4.8, and GPT-5.6 Sol all confirmed the fix correct and complete (fault propagation and background-task draining intact, credential/generation fencing preserved, no deadlock, discriminator tests deterministic). The production comment and the barrier assertion message were tightened per review.

Non-blocking follow-up: two sibling callbacks forwarded under the same connector lock share the inline-async shape but do not clear credentials: NodeConnectionCoordinator.HandleStatusChanged and HandleDeviceTokenReceived. Out of scope for this P1; noted for a future pass.

[clawsweeper]

Codex review: needs changes before merge. Reviewed August 17, 2026, 2:44 PM ET / 18:44 UTC.

ClawSweeper review

What this changes

This PR moves Windows-node lifecycle, credential-handoff, and device-pair approval workflows into internal coordinators behind the existing gateway connection facade.

Merge readiness

⛔ Blocked by patch quality or review findings - 11 items remain

Keep open. Two previously reported P1 callback-detachment defects remain on the current head, and four user-facing diagnostic strings still violate repository copy policy. The supplied behavior claims are not tied to the current head.

Priority: P1
Reviewed head: eb4add3c8470537915fca4705f6c7301ded6b4ee

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	PR readiness rating was derived from proof quality, review findings, security review, and reviewer confidence.
Proof confidence	🌊 off-meta tidepool	Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.
Patch quality	🧂 unranked krab (1/6)	6 actionable review findings remain.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.
Evidence reviewed	6 items	Connector callbacks hold the lifecycle lock: NodeConnector invokes subscribers inside its client lifecycle lock and requires prompt return, so callback work must not enter asynchronous workflows inline. Status callback remains inline: The status handler passes an already-started async method to TrackBackground; its synchronous prefix can acquire the transition semaphore and publish state before the connector callback returns. Device-token callback remains inline: The durable bootstrap-clear workflow is started before TrackBackground receives its task, so lease acquisition and subsequent synchronous work can run under the connector callback lock.
Findings	6 actionable findings	[P1] Detach status work before returning from the connector callback [P1] Detach device-token work before durable clearing [P3] Replace the node credential diagnostic em dash
Security	None	None.

How this fits together

The connection layer takes gateway settings, credentials, and transport events and produces operator and Windows-node connection state for the tray and local MCP service. This PR separates node lifecycle, bootstrap-token handling, and device-pair approval from the public connection manager.

flowchart LR
A[Gateway settings and credentials] --> B[Connection manager facade]
B --> C[Node connection coordinator]
B --> D[Bootstrap token lifecycle]
B --> E[Device-pair approval coordinator]
C --> F[Gateway and node connections]
D --> F
E --> F
F --> G[Tray and local MCP status]

Loading

Before merge

• Detach status work before returning from the connector callback (P1) - ForwardIfCurrent invokes this handler under NodeConnector's lifecycle lock. Passing an already-started HandleStatusChangedAsync task means its synchronous prefix can enter PublishNodeStatusAsync, acquire the transition semaphore, and emit state while that lock is held. Schedule the whole workflow before tracking it and add the corresponding gated callback regression.
• Detach device-token work before durable clearing (P1) - This task starts TryClearAfterDurablePairingAsync inline under the connector callback lock. The method can acquire the current-attempt lease and perform registry or identity work before it yields, so the callback can block lifecycle progress. Dispatch the workflow before tracking it and cover the gated path.
• Replace the node credential diagnostic em dash (P3) - This newly moved diagnostic still uses an em dash, contrary to the repository policy for user-facing error and diagnostic copy. Use a colon, period, or simple hyphen.
• Replace the bootstrap-clear diagnostic em dash (P3) - This ConnectionDiagnostics message is user-visible diagnostic copy and still contains an em dash prohibited by repository policy.
• Replace the bootstrap-handoff diagnostic em dash (P3) - This ConnectionDiagnostics message is user-visible diagnostic copy and still contains an em dash prohibited by repository policy.
• Replace the device-pair diagnostic em dash (P3) - This ConnectionDiagnostics message is user-visible diagnostic copy and still contains an em dash prohibited by repository policy.
• Resolve merge risk (P1) - A status callback can hold the connector lifecycle lock while publishing state, which can stall connection lifecycle work or deadlock with a reentrant subscriber.
• Resolve merge risk (P1) - A device-token callback can hold the same lock while acquiring the gateway attempt lease and clearing durable bootstrap state.
• Resolve merge risk (P1) - The current proof claims stop at an older head, while the prepared screenshot is native-chat proof from Preserve native tool identity in chat #1078 rather than this connection change.
• Complete next step (P2) - The two P1 fixes and four copy replacements are narrow and mechanical, but a contributor must still refresh real behavior proof on the resulting head.
• Improve patch quality - Address the highest-priority review finding and re-run the changed-surface validation.

Findings

• [P1] Detach status work before returning from the connector callback — src/OpenClaw.Connection/NodeConnectionCoordinator.cs:695
• [P1] Detach device-token work before durable clearing — src/OpenClaw.Connection/NodeConnectionCoordinator.cs:779-781
• [P3] Replace the node credential diagnostic em dash — src/OpenClaw.Connection/NodeConnectionCoordinator.cs:527

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Changed surface	19 files affected	The refactor spans connection ownership, diagnostics, architecture docs, and regression coverage.
Production versus test delta	production +1,290 net, tests +1,435 net, docs +44 net	The large ownership transfer has substantial focused test growth, but its lifecycle paths still need the two missing callback regressions.

Merge-risk options

Maintainer options:

1. Detach both connector callbacks (recommended)
   Wrap status and device-token workflows in Task.Run before tracking them, add lock-boundary regressions, and refresh current-head proof before merge.
2. Pause the refactor
   Do not accept the lifecycle-lock risk if the callback ordering fixes cannot be demonstrated on the current head.

Technical review

Best possible solution:

Preserve the coordinator split, but detach both remaining connector callbacks before their async methods start, add deterministic lock-boundary regressions, replace the diagnostic punctuation, and publish redacted current-head connection proof.

Do we have a high-confidence way to reproduce the issue?

Yes, source-reproducible: invoke either forwarded NodeConnector callback while a transition or durable-clear operation is gated, and the current task construction can run that work before the lock-holding callback returns.

Is this the best way to solve the issue?

No. The extraction is viable, but the remaining callbacks must be dispatched before their async synchronous prefixes execute, with regressions that prove prompt callback return.

Full review comments:

• [P1] Detach status work before returning from the connector callback — src/OpenClaw.Connection/NodeConnectionCoordinator.cs:695
ForwardIfCurrent invokes this handler under NodeConnector's lifecycle lock. Passing an already-started HandleStatusChangedAsync task means its synchronous prefix can enter PublishNodeStatusAsync, acquire the transition semaphore, and emit state while that lock is held. Schedule the whole workflow before tracking it and add the corresponding gated callback regression.
  Confidence: 0.99
• [P1] Detach device-token work before durable clearing — src/OpenClaw.Connection/NodeConnectionCoordinator.cs:779-781
  This task starts TryClearAfterDurablePairingAsync inline under the connector callback lock. The method can acquire the current-attempt lease and perform registry or identity work before it yields, so the callback can block lifecycle progress. Dispatch the workflow before tracking it and cover the gated path.
  Confidence: 0.99
• [P3] Replace the node credential diagnostic em dash — src/OpenClaw.Connection/NodeConnectionCoordinator.cs:527
  This newly moved diagnostic still uses an em dash, contrary to the repository policy for user-facing error and diagnostic copy. Use a colon, period, or simple hyphen.
  Confidence: 0.99
• [P3] Replace the bootstrap-clear diagnostic em dash — src/OpenClaw.Connection/BootstrapTokenLifecycle.cs:465
  This ConnectionDiagnostics message is user-visible diagnostic copy and still contains an em dash prohibited by repository policy.
  Confidence: 0.99
• [P3] Replace the bootstrap-handoff diagnostic em dash — src/OpenClaw.Connection/BootstrapTokenLifecycle.cs:536
  This ConnectionDiagnostics message is user-visible diagnostic copy and still contains an em dash prohibited by repository policy.
  Confidence: 0.99
• [P3] Replace the device-pair diagnostic em dash — src/OpenClaw.Connection/DevicePairApprovalCoordinator.cs:395
  This ConnectionDiagnostics message is user-visible diagnostic copy and still contains an em dash prohibited by repository policy.
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.98

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against fc9add75eda7.

Labels

Label changes:

• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🌊 off-meta tidepool and patch quality is 🧂 unranked krab.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.
• remove status: 👀 ready for maintainer look: Current PR status label is status: ⏳ waiting on author.
• remove rating: 🦐 gold shrimp: Current PR rating is rating: 🧂 unranked krab, so this older rating label is no longer current.

Label justifications:

• P1: The remaining inline callback paths can block the active gateway and Windows-node connection lifecycle.
• merge-risk: 🚨 session-state: The refactor changes generation fencing, state publication, and reconnect sequencing.
• merge-risk: 🚨 auth-provider: The device-token callback triggers durable bootstrap credential handling.
• merge-risk: 🚨 availability: Connector callbacks run under a lifecycle lock and can stall the connection path.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🌊 off-meta tidepool and patch quality is 🧂 unranked krab.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.

Evidence

Acceptance criteria:

• [P1] ./build.ps1.
• [P1] dotnet test ./tests/OpenClaw.Shared.Tests/OpenClaw.Shared.Tests.csproj --no-restore.
• [P1] dotnet test ./tests/OpenClaw.Tray.Tests/OpenClaw.Tray.Tests.csproj --no-restore.
• [P1] dotnet test ./tests/OpenClaw.Connection.Tests/OpenClaw.Connection.Tests.csproj --no-restore.
• [P1] Focused gated regressions for status and device-token callback detachment.

What I checked:

• Connector callbacks hold the lifecycle lock: NodeConnector invokes subscribers inside its client lifecycle lock and requires prompt return, so callback work must not enter asynchronous workflows inline. (src/OpenClaw.Connection/NodeConnector.cs:245, eb4add3c8470)
• Status callback remains inline: The status handler passes an already-started async method to TrackBackground; its synchronous prefix can acquire the transition semaphore and publish state before the connector callback returns. (src/OpenClaw.Connection/NodeConnectionCoordinator.cs:695, eb4add3c8470)
• Device-token callback remains inline: The durable bootstrap-clear workflow is started before TrackBackground receives its task, so lease acquisition and subsequent synchronous work can run under the connector callback lock. (src/OpenClaw.Connection/NodeConnectionCoordinator.cs:779, eb4add3c8470)
• Existing regression only covers connection failure: The added detachment test verifies the connection-failure recovery path, but no equivalent test covers the status or device-token callback paths. (tests/OpenClaw.Connection.Tests/NodeConnectionCoordinatorTests.cs:197, eb4add3c8470)
• Repository copy policy applies: The repository prohibits em dashes in user-facing prose and diagnostics; four new connection diagnostic strings still contain them. (AGENTS.md:62, eb4add3c8470)
• The central refactor is not on current main: Current main does not contain any of the three new coordinator source files, so the PR is not obsolete or implemented on main. (src/OpenClaw.Connection/NodeConnectionCoordinator.cs:113, eb4add3c8470)

Likely related people:

• karkarl: Authored the current-head recovery and fencing follow-up, and the timeline records active landing ownership. (role: current-head lifecycle follow-up author; confidence: medium; commits: eb4add3c8470; files: src/OpenClaw.Connection/NodeConnectionCoordinator.cs, src/OpenClaw.Connection/NodeConnector.cs)
• bkudiess: Authored the central coordinator-extraction commit and the earlier callback-recovery follow-up in this connection area. (role: connection coordinator extraction author; confidence: medium; commits: d900095e7672, 54da567538b2; files: src/OpenClaw.Connection/GatewayConnectionManager.cs, src/OpenClaw.Connection/NodeConnectionCoordinator.cs, src/OpenClaw.Connection/BootstrapTokenLifecycle.cs)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (25 earlier review cycles; latest 8 shown)

• reviewed 2026-08-09T09:27:51.826Z sha 95a88b1 :: needs changes before merge. :: [P1] Dispatch the remaining connector callbacks | [P3] Replace em dashes in connection diagnostics
• reviewed 2026-08-09T15:55:07.705Z sha 95a88b1 :: needs changes before merge. :: [P1] Dispatch status callbacks before starting async work | [P1] Dispatch device-token callbacks before durable clearing | [P3] Replace em dashes in bootstrap diagnostics
• reviewed 2026-08-09T17:00:29.422Z sha 95a88b1 :: found issues before merge. :: [P1] Dispatch status callbacks before starting async work | [P1] Dispatch device-token callbacks before durable clearing | [P3] Replace the bootstrap diagnostic em dash | [P3] Replace the bootstrap-handoff diagnostic em dash | [P3] Replace the device-pair diagnostic em dash | [P3] Replace the node credential-warning em dash
• reviewed 2026-08-09T22:30:11.817Z sha 95a88b1 :: needs changes before merge. :: [P1] Dispatch status callbacks before starting async work | [P1] Dispatch device-token callbacks before durable clearing | [P3] Replace the bootstrap-clear diagnostic em dash | [P3] Replace the bootstrap-handoff diagnostic em dash | [P3] Replace the device-pair diagnostic em dash | [P3] Replace the node credential-warning em dash
• reviewed 2026-08-14T19:00:14.128Z sha 95a88b1 :: needs changes before merge. :: [P1] Detach the status callback before starting work | [P1] Detach the device-token callback before durable clearing | [P3] Replace the node credential diagnostic em dash | [P3] Replace the bootstrap-clear diagnostic em dash | [P3] Replace the bootstrap-handoff diagnostic em dash | [P3] Replace the device-pair diagnostic em dash
• reviewed 2026-08-14T20:28:50.338Z sha 63419ce :: needs changes before merge. :: [P1] Detach status work before the connector callback returns | [P1] Detach device-token work before durable clearing | [P3] Replace the node credential diagnostic em dash | [P3] Replace the bootstrap-clear diagnostic em dash | [P3] Replace the bootstrap-handoff diagnostic em dash | [P3] Replace the device-pair diagnostic em dash
• reviewed 2026-08-14T20:35:38.035Z sha e69b5cd :: needs changes before merge. :: [P1] Detach status work before the connector callback returns | [P1] Detach device-token work before durable clearing | [P3] Replace the node credential diagnostic em dash | [P3] Replace the bootstrap-clear diagnostic em dash | [P3] Replace the bootstrap-handoff diagnostic em dash | [P3] Replace the device-pair diagnostic em dash
• reviewed 2026-08-14T20:42:08.824Z sha 797136b :: needs maintainer review before merge. :: none

[bkudiess]

Rebased unchanged B1 layer onto latest B0/main at head 2467fbc4. Exact stack validation is green: Shared 3469, Connection 562, Tray 2116, CLI 126, B0 focused 236, B1 focused 27, #1078 focused 519, setup 16, revocation 1, network 2, raw MCP and UI AX. @clawsweeper re-review

[bkudiess]

Pushed 95a88b12 (fast-forward from 2467fbc4, no parent rewrite/rebase; base bkudiess-gateway-protocol-core unchanged, B0 #1095 head still 2a5fafb8).

P1 addressed: node token recovery no longer runs on the connector's lifecycle-lock-holding callback stack. HandleConnectionFailure now schedules the whole recovery with Task.Run(() => HandleDeviceTokenMismatchAsync(attempt)); the unwrapped proxy task stays tracked in _backgroundTasks and drains on shutdown. Generation/credential fencing byte-for-byte unchanged.

Deterministic proof (current head): reverting the one-line owner fix makes ConnectionFailureRecovery_DetachesFromConnectorCallbackThread and ConnectionFailureRecovery_SupersededNodeGeneration_PreservesNodeToken fail; with the fix both pass (ordering tests re-run 3x green).

Validation (head 95a88b12): build all 5 projects; Connection 567; Shared 3,437 / 32 skipped; Tray 2,116; WinNode CLI 126.

Review: rubber-duck + Claude Opus 4.8 + GPT-5.6 Sol all clean (fault propagation and background-task draining intact, fencing preserved, no deadlock, discriminators deterministic).

Non-blocking follow-up: sibling lock-forwarded callbacks HandleStatusChanged and HandleDeviceTokenReceived share the inline-async shape but do not clear credentials; out of scope for this P1.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[karkarl]

E2E proof plan and results

Current PR head: eb4add3c8470537915fca4705f6c7301ded6b4ee

The proof matrix targets the behavior boundaries moved by this refactor: operator/node readiness, reconnect, credential recovery and preservation, revocation recovery, and fail-closed credential handoff.

Scenario	Harness	Result
Initial setup connects operator and node	Real WSL gateway	Pass
Gateway restart reconnects operator and node	Real WSL gateway	Pass
QR setup code reconnects through tray MCP	Real WSL gateway	Pass
Reused setup code is idempotent for the same device	Real WSL gateway	Pass
Bad shared token does not destroy existing pairing	Real WSL gateway	Pass
Invalid setup code does not destroy existing pairing	Real WSL gateway	Pass
Device removal recovers through shared-token reconnect	Real WSL gateway	Pass
Operator listener replacement withholds credential frame	Synthetic adversarial WebSocket/tunnel harness	Pass
Node listener replacement withholds credential frame	Synthetic adversarial WebSocket/tunnel harness	Pass

Targeted run: 9 passed, 0 failed, 0 skipped in 4m 46s.

$env:OPENCLAW_REPO_ROOT = (Get-Location).Path
$env:OPENCLAW_RUN_E2E = '1'
dotnet test .\tests\OpenClaw.E2ETests\OpenClaw.E2ETests.csproj --no-restore --filter '<nine scenarios above>'

Real behavior proof

The screenshots were captured from isolated current-head E2E fixtures. The workstation name was replaced with isolated E2E host; no token value is displayed. The small capture helpers were test-only and were removed after capture, so the PR diff remains unchanged.

Healthy real-gateway state: device-token pairing, operator active, node active with 9 capabilities, and two connected clients.

Recovered after a real WSL gateway restart: the fixture restarted the gateway, waited for operator and node readiness, then captured the recovered state. Capture assertion: 1 passed, 0 failed.

Screenshots cannot prove credential withholding or concurrency fencing. Those claims are covered by current-head automated assertions. The fresh adversarial artifacts stamped head=eb4add3c8470537915fca4705f6c7301ded6b4ee and recorded:

Assertion	Operator	Node
Listener owned when tunnel started	true	true
Listener owned at credential handoff	false	false
Credential-bearing connect frames received	0	0
Ownership checks before/after challenge	1 / 2	2 / 3
Final role state	Error	Error

For the node case, withholding is established by zero credential-bearing frames plus the ownership recheck, not by the generic node error text alone.

Review: Rubber-duck review found no privacy leak in the published screenshots and required the harness distinction and node-proof limitation above. Required PR CI is green; the only failing check shown is the non-required ClawSweeper Dispatch workflow. Parent PR #1095 merged as 323f46d3ded7be478c4844469f729c9bcf35342b, and #1101 is mergeable at the head above.