fix(update): suppress ordinary Windows updates on extended-stable

[RomneyDa]

Related: openclaw/openclaw#118518

What Problem This Solves

Fixes an issue where Windows Companion users on an extended-stable Gateway would be prompted to install the repository's ordinary latest Windows release.

Why This Change Was Made

The Gateway is the authoritative owner of the installed OpenClaw update track. The companion now waits for an authenticated hello-ok, reads the additive update.status.effectiveChannel field, and suppresses Updatum only for extended-stable. A missing field, old or unauthorized Gateway, connection failure, and no configured operator Gateway retain the existing standalone updater behavior.

The companion PR depends on OpenClaw PR #118518 adding effectiveChannel to update.status; it remains compatible with older Gateways that omit the field.

User Impact

Extended-stable users no longer see ordinary Windows release upgrade prompts. Stable and beta users, and users whose Gateway cannot provide the update track, continue receiving the existing Windows update experience.

Evidence

Production LOC: +159/-15 (net +144). Tests: +123/-1 (net +122). The production growth is the additive typed Gateway contract and the one canonical lifecycle owner for update-track resolution; test growth covers parser policy, real loopback RPC frames, Gateway errors, startup fallback, and handshake ordering.

• git diff --check passed on this exact head.
• Local macOS host has no dotnet, so native build/test commands could not run there (zsh: command not found: dotnet).
• Parallels Windows proof on 7f03dffc2278a6a667812d71798a5f9137bd1438: Debug WinUI build, required shared/tray tests, and active UI verification passed. It demonstrated extended-stable suppression and the visible ordinary update dialog fallback for missing/error Gateway status.

Change Type

• Bug fix
• Feature
• Refactor
• Docs or instructions
• Tests or validation
• Security hardening
• Chore or infrastructure

Scope

• Tray or WinUI UX
• Windows node capability
• Local MCP or winnode
• Gateway, connection, or pairing
• Setup or onboarding
• Permissions, privacy, or security
• Tests, CI, or docs

Validation

• git diff --check (passed)
• Parallels Windows: Debug WinUI build (passed)
• Parallels Windows: required shared tests (passed)
• Parallels Windows: required tray tests (passed)
• Local dotnet commands blocked because the macOS host does not have the .NET SDK.

Real Behavior Proof

• Environment tested: Parallels Windows guest
• PR head or commit tested: 7f03dffc2278a6a667812d71798a5f9137bd1438
• Exact steps or command run: connected the Companion to controlled Gateway responses for update.status.effectiveChannel=extended-stable, then missing/error status responses.
• Evidence after fix: extended-stable did not surface an ordinary Windows update prompt; missing/error status retained the visible normal update dialog.
• Observed result: only the authoritative extended-stable state suppresses the independent Updatum prompt.
• Screenshot or artifact links verified? N/A (guest proof reported directly)
• Not verified or blocked: no local .NET SDK on the macOS implementation host.

Security Impact

• New permissions or capabilities? No
• Secrets or tokens handling changed? No
• New or changed network calls? Yes. The Companion calls authenticated Gateway update.status before its existing GitHub updater check; unavailable/unauthorized calls fall back without exposing credentials.
• Command or tool execution surface changed? No
• Data access scope changed? No

Compatibility and Migration

• Backward compatible? Yes
• Config or environment changes? No
• Migration needed? No

Review Conversations

• I replied to or resolved every bot review conversation addressed by this PR.
• I left unresolved only conversations that still need maintainer judgment.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 12, 2026, 3:19 PM ET / 19:19 UTC.

ClawSweeper review

What this changes

The PR defers the automatic Windows update check until Gateway resolution, then suppresses ordinary updates only when the authenticated Gateway reports the extended-stable channel.

Merge readiness

⚠️ Ready for maintainer review - 3 items remain

Keep open. The current release still runs the companion updater before Gateway initialization, while this PR adds the needed authenticated channel check and preserves fallback paths; merge should wait for the failed Windows x64 build to be diagnosed and rerun.

Priority: P1
Reviewed head: e00bf14bfb7a6558bcca85854a82753c943e6c9f

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	The patch is focused and its reported Windows behavior proof is credible; the failed required Windows build remains the merge gate.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (logs): Current-head Windows Release proof covers pairing and unauthorized fallback, while the linked earlier Windows proof covers extended-stable suppression and missing/error fallback using logs and UI Automation.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (logs): Current-head Windows Release proof covers pairing and unauthorized fallback, while the linked earlier Windows proof covers extended-stable suppression and missing/error fallback using logs and UI Automation.
Evidence reviewed	8 items	Current release lacks channel-aware startup: Current main invokes the companion updater before gateway initialization, so it cannot distinguish an extended-stable Gateway. PR preserves authenticated and fallback paths: The PR subscribes before transport starts, queries update.status after hello-ok, and starts the standalone updater for Error or PairingRequired states. Protocol compatibility is additive: The new interface method has a default null implementation, and the concrete client maps unavailable or failed update.status calls to the existing updater behavior.
Findings	None	None.
Security	None	None.

How this fits together

The tray app connects to an operator Gateway and independently checks GitHub releases for companion updates. This change uses the Gateway’s resolved update channel to decide whether that companion update check should run.

flowchart LR
  A[Tray startup] --> B[Gateway connection]
  B --> C[Authenticated handshake]
  C --> D[Gateway update status]
  D --> E{Extended-stable channel}
  E -->|Yes| F[Skip companion update]
  E -->|No or unavailable| G[Run normal updater]
  G --> H[Update dialog or app launch]

Loading

Before merge

• Resolve merge risk (P1) - The required build (win-x64) check is currently failed, and its underlying failure was not available in this read-only checkout.
• Resolve merge risk (P1) - The extended-stable outcome depends on the related OpenClaw Gateway protocol addition providing update.status.effectiveChannel; older or unavailable Gateways safely fall back to the ordinary updater.
• Complete next step (P2) - This actively landing member PR has no discrete code finding, but its failed required Windows x64 build needs maintainer diagnosis or a successful rerun before merge.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Patch scope	9 files, +288/-16 lines	The change spans Gateway protocol access, tray startup, updater coordination, and focused regression coverage.

Merge-risk options

Maintainer options:

1. Restore the Windows build signal (recommended)
   Diagnose the failed win-x64 check, apply any necessary narrow repair, and rerun it before merging the startup update-flow change.
2. Hold for the Gateway contract
   Keep this PR queued until the related Gateway effectiveChannel contract is confirmed in the target extended-stable release path.

Technical review

Best possible solution:

Land the additive channel query after a successful Windows x64 build rerun and confirmation that the related Gateway protocol field is available for the intended extended-stable release path.

Do we have a high-confidence way to reproduce the issue?

Yes, source reproducible: current main calls the companion updater before Gateway initialization, so no Gateway channel can affect that startup check.

Is this the best way to solve the issue?

Yes. An additive authenticated update.status query with null/error fallback is the narrowest path that preserves older Gateway and standalone behavior.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 4206611f2b2e.

Labels

Label justifications:

• P1: Extended-stable users can be offered an unintended ordinary Windows release until this update-track mismatch is corrected.
• merge-risk: 🚨 compatibility: The PR changes automatic startup update behavior and must retain the established updater path for all unresolved Gateway states.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (logs): Current-head Windows Release proof covers pairing and unauthorized fallback, while the linked earlier Windows proof covers extended-stable suppression and missing/error fallback using logs and UI Automation.
• proof: sufficient: Contributor real behavior proof is sufficient. Current-head Windows Release proof covers pairing and unauthorized fallback, while the linked earlier Windows proof covers extended-stable suppression and missing/error fallback using logs and UI Automation.

Evidence

What I checked:

• Current release lacks channel-aware startup: Current main invokes the companion updater before gateway initialization, so it cannot distinguish an extended-stable Gateway. (src/OpenClaw.Tray.WinUI/App.xaml.cs:709, 4206611f2b2e)
• PR preserves authenticated and fallback paths: The PR subscribes before transport starts, queries update.status after hello-ok, and starts the standalone updater for Error or PairingRequired states. (src/OpenClaw.Tray.WinUI/App.xaml.cs:2152, e00bf14bfb7a)
• Protocol compatibility is additive: The new interface method has a default null implementation, and the concrete client maps unavailable or failed update.status calls to the existing updater behavior. (src/OpenClaw.Shared/IOperatorGatewayClient.cs:141, e00bf14bfb7a)
• Focused lifecycle regression coverage: The tray contract test checks handshake ordering, no-Gateway startup fallback, and Error/PairingRequired fallback. (tests/OpenClaw.Tray.Tests/AppRefactorContractTests.cs:46, e00bf14bfb7a)
• Feature-history provenance: UpdateCoordinator was introduced by the focused update extraction commit, which is the main-history origin for this owner boundary. (src/OpenClaw.Tray.WinUI/Services/UpdateCoordinator.cs:19, d5543b904507)
• Release and branch state: v2026.7.1 contains current main, while no tag or local branch contains the PR head, so this change is not already released. (4206611f2b2e)

Likely related people:

• AlexAlves87: Introduced the extracted update coordinator that owns update checking and installation behavior. (role: feature owner; confidence: high; commits: d5543b904507; files: src/OpenClaw.Tray.WinUI/Services/UpdateCoordinator.cs)
• Scott Hanselman: Current release baseline blame attributes the update coordinator and startup updater path to the current main release commit. (role: recent current-main contributor; confidence: medium; commits: 4206611f2b2e; files: src/OpenClaw.Tray.WinUI/Services/UpdateCoordinator.cs, src/OpenClaw.Tray.WinUI/App.xaml.cs)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Diagnose and rerun the failed build (win-x64) check.
• Confirm the related Gateway effectiveChannel producer is included for the intended extended-stable path.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (8 earlier review cycles)

• reviewed 2026-08-09T09:20:43.894Z sha 7f03dff :: needs maintainer review before merge. :: none
• reviewed 2026-08-09T09:27:42.949Z sha 7f03dff :: needs maintainer review before merge. :: none
• reviewed 2026-08-09T12:00:28.751Z sha 7f03dff :: needs maintainer review before merge. :: none
• reviewed 2026-08-09T14:51:14.440Z sha 7f03dff :: needs maintainer review before merge. :: none
• reviewed 2026-08-10T08:57:14.929Z sha 7f03dff :: needs changes before merge. :: [P1] Preserve the updater while Gateway pairing is pending
• reviewed 2026-08-11T18:04:28.081Z sha e00bf14 :: needs maintainer review before merge. :: none
• reviewed 2026-08-11T18:34:54.818Z sha e00bf14 :: needs maintainer review before merge. :: none
• reviewed 2026-08-12T17:27:42.755Z sha e00bf14 :: needs maintainer review before merge. :: none

[RomneyDa]

Parallels Release-mode proof on exact head 7f03dffc2278a6a667812d71798a5f9137bd1438:

• Fresh guest snapshot, then Release build completed successfully.
• Shared tests: 3,637 passed, 32 skipped. Tray tests: 2,248 passed.
• Authenticated Gateway mock returning update.status.effectiveChannel=extended-stable: guest logs recorded the update.status request followed by the extended-stable skip; no Updatum request or update dialog appeared.
• Missing-field fallback: a guest-only 0.6.10 metadata build with effectiveChannel omitted queried live GitHub v0.6.12; native UI Automation found the ordinary update dialog and its expected buttons.
• Error fallback: an update.status error produced the same ordinary update dialog.

The screenshot framebuffer was black in this guest, so the UI evidence is native UI Automation plus guest logs rather than attached screenshots. Test metadata, mock settings, and temporary guest build state were cleaned up after the run.

[RomneyDa]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/31372445843
• Updated: 2026-08-10T08:58:36.826Z

[RomneyDa]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/31626271046
• Updated: 2026-08-12T18:10:11.821Z

[RomneyDa]

Current-head Parallels Release validation for e00bf14bfb7a6558bcca85854a82753c943e6c9f:

• Signed connect received structured PAIRING_REQUIRED.
• Unauthorized update.status was rejected; the tray fell back to the normal updater (Checking for updates..., then an update was found).
• UI Automation found the update dialog with current 0.6.10, latest v2026.7.1, and all action buttons.
• A normal Release rebuild and cleanup completed afterward.

The earlier detailed Release proof comment covers the omitted effectiveChannel and update.status error fallback paths.

[RomneyDa]

@clawsweeper re-review