Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

Android gateway TLS fingerprint verification times out on reachable but slow/stalled Tailnet TLS handshakes and reports the endpoint as unreachable.

Steps to reproduce

1. Build current main Android APK.
2. Start a Tailnet-reachable TCP endpoint that accepts a connection on a TLS port, receives the ClientHello, and delays or withholds TLS handshake response.
3. Configure the Android app manual gateway to the Tailnet IP and that TLS port.
4. Launch the app or use Gateway > Reconnect.
5. Observe the gateway status after fingerprint verification.

Expected behavior

If TCP connects but TLS fingerprint capture stalls, Android should keep the connection attempt bounded and report that TLS fingerprint verification timed out. If the endpoint completes TLS within a reasonable handshake budget, Android should capture the fingerprint and show the gateway trust prompt.

Actual behavior

Current main uses one 3 second timeout for both TCP connect and TLS handshake in the Android fingerprint probe. A reachable Tailnet endpoint that sends no TLS response is mapped to generic endpoint unreachable, and a delayed-but-valid TLS handshake can fail before fingerprint capture.

OpenClaw version

main at 4ac5cf863673a07ea5230c5be320bd8e4775814a initially reproduced; fix branch rebased from fa3c9de4596578cd5510d9e0e563b9095c139e5c.

Operating system

Android 15 / API 35 emulator for app repro; macOS host with Tailscale for Tailnet-reachable synthetic endpoints.

Install method

Source checkout, Android Play debug APK.

Model

NOT_ENOUGH_INFO

Provider / routing chain

Android app -> manual gateway endpoint over Tailnet -> TLS fingerprint probe.

Additional provider/model setup details

No model/provider request is involved. This is an Android gateway connection setup failure before any model traffic.

Logs

Initial live repro: synthetic endpoint accepted Android TLS ClientHello bytes and Android closed after ~3.25s, while the app showed generic Cannot reach gateway.

Fix proof: delayed TLS endpoint wrapped TLS after ~6001ms and Android reached the Trust this gateway? fingerprint dialog.

Regression proof: stalled TLS endpoint accepted Android connections, received 233 ClientHello bytes on each socket, and Android closed after ~10.4s while the app showed TLS timed out.

Screenshots, recordings, and evidence

• Android API 35 UI tree proof before fix: Gateway status collapsed to Cannot reach gateway after the stalled TLS probe.
• Android API 35 UI tree proof after fix: delayed TLS produced Trust this gateway? with the certificate fingerprint.
• Android API 35 UI tree proof after fix: stalled TLS produced TLS timed out.
• Focused unit tests cover probe classification and NodeRuntime timeout guidance.

Impact and severity

Affected: Android users connecting to remote/Tailnet gateways that require TLS fingerprint verification.
Severity: Medium to high; this can block Android pairing/connection to otherwise reachable secure endpoints.
Frequency: Reproducible with delayed or stalled TLS handshakes.
Consequence: Users receive misleading unreachable guidance instead of actionable TLS timeout guidance, and slow-but-valid TLS endpoints can fail before fingerprint capture.

Additional information

This is not a request to weaken Android remote gateway TLS policy. Remote/manual and Tailnet-style endpoints should continue requiring TLS and fingerprint trust. The fix should make the TLS probe distinguish TCP reachability from TLS handshake progress.