fix(android): preserve chat sends across reconnect recovery by steipete · Pull Request #100551 · openclaw/openclaw

steipete · 2026-07-06T02:03:33Z

Follow-up to #100384.

What Problem This Solves

Fixes an issue where Android chat users could lose a sent-message row, duplicate it, or have a stale run take over the composer after reconnects, sequence gaps, lost acknowledgements, or delayed transcript persistence.

Why This Change Was Made

The controller now keeps one bounded ownership path from optimistic send through gateway acknowledgement, reconnect recovery, terminal delivery, and authoritative history reconciliation. It distinguishes definitive request rejection from unknown transport outcome, orders same-generation history responses, preserves the gateway's persisted idempotency identity, and keeps assistant auto-send ownership in the view model so UI effect restarts cannot dispatch twice.

User Impact

Sent messages remain visible while recovery catches up, active replies resume after reconnect, stale or cross-client terminal events cannot steal local streaming UI, and chat stays disabled until reconnect history has safely applied. Unknown-outcome sends retry reconciliation without creating duplicate turns.

Evidence

Blacksmith Testbox lease tbx_01kwtcpdgbex21fsw4mdv2jk2f (coral-crab), warmup run: https://github.com/openclaw/openclaw/actions/runs/28760001708
Passed on the rebased head:
- ./gradlew :app:testPlayDebugUnitTest --tests ai.openclaw.app.chat.* --tests ai.openclaw.app.ui.chat.ChatSheetContentTest --tests ai.openclaw.app.gateway.GatewaySessionInvokeTest.disconnectFailsPendingRpcWithUnknownOutcomeWithoutWaitingForTimeout --tests ai.openclaw.app.gateway.GatewaySessionInvokeTest.disconnectReportsUnknownOutcomeForFireAndForgetRpc --rerun-tasks
Fresh Codex autoreview: no accepted/actionable findings after the final reconnect-tick retry.
ktlintMainSourceSetCheck and every touched test file are clean. The repository-wide test-source ktlint task still reports only pre-existing violations in ChatControllerCommandControlsTest, InvokeErrorParserTest, and GatewayConfigResolverTest.
Live Android UI proof unavailable: the only attached ADB target was unauthorized; no device interaction is claimed.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f6299ab100

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-07-06T02:10:39Z

 - **Android microphone capture:** treat negative `AudioRecord.read` results as fatal shared-session errors so both transcription and Talk capture stop cleanly after device loss. (#100028) Thanks @NianJiuZst.
 - **Lean local-model tools:** trim media generation, TTS, and PDF tools from lean agent surfaces while preserving explicit config and runtime opt-ins. (#88881) Thanks @vincentkoc.
 - **iOS development app identity:** keep the development app labeled OpenClaw while using its distinct debug icon to differentiate it from release builds.
+- **Android chat recovery:** preserve optimistic user messages and locally owned runs while reconnect and sequence-gap history snapshots catch up, preventing sent messages from disappearing or stale runs from taking ownership. (#100197)


Remove the normal-fix changelog entry

This Android fix adds a CHANGELOG.md entry even though the root AGENTS.md Docs / Changelog rule says CHANGELOG.md is release-only and must not be edited for normal PRs or direct fixes because release generation owns it. Leaving this manual entry can make generated release notes duplicate or conflict with the release workflow; keep the release-note context in the commit/PR text instead and let the release process update the changelog.

Useful? React with 👍 / 👎.

clawsweeper · 2026-07-06T02:20:22Z

Codex review: needs real behavior proof before merge. Reviewed July 5, 2026, 10:48 PM ET / 02:48 UTC.

Summary
The PR rewrites Android chat reconnect recovery so optimistic sends, pending runs, lost acknowledgements, terminal events, assistant auto-send ownership, and native i18n inventory are reconciled across reconnect/history refreshes.

PR surface: Docs +1, Other +1716. Total +1717 across 14 files.

Reproducibility: yes. for the source path: current main clears pending run state on disconnect and seqGap, while the PR adds focused tests for reconnect recovery, lost acknowledgements, and terminal/history reconciliation. I did not run a live Android repro in this read-only review.

Review metrics: 1 noteworthy metric.

Release-owned changelog entry: 1 manual CHANGELOG.md entry added. OpenClaw release generation owns changelog entries, so this normal PR should keep release-note context in the PR body or squash message instead.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #100197
Summary: This PR is an Android-specific candidate/follow-up for the closed mobile reconnect recovery workstream, while the maintainer decision on that issue explicitly chose existing chat.history/inFlightRun contracts over the original afterSeq cursor design.

Members:

canonical: Resume chat after reconnect via sequence cursor (gateway + mobile clients) #100197 - The PR body uses closing syntax for this reconnect recovery issue, and the issue was closed with a maintainer comment naming the existing Gateway recovery contracts and this Android follow-up.
same_root_cause: feat(android): restore in-flight runs after reconnect #100384 - The merged predecessor restored Android in-flight run adoption from chat.history; this PR extends the same reconnect recovery ownership path to optimistic sends and lost acknowledgements.
partial_overlap: fix(ios): restore in-flight runs after reconnect #100277 - The merged Apple PR restored active ownership on iOS/macOS using the same existing recovery contract, but it is a separate platform implementation.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🦪 silver shellfish
Proof: 🦪 silver shellfish
Patch quality: 🦐 gold shrimp
Result: blocked until real behavior proof from a real setup is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P1] Fix the raw assistant auto-send prompt claim so whitespace-padded prompts dispatch or clear correctly.
Remove the normal-PR CHANGELOG.md entry and keep release-note context in the PR body or squash message.
[P1] Add redacted exact-head Android emulator/device or ADB proof for reconnect recovery preserving the sent row and active reply.

Proof guidance:

[P1] Needs real behavior proof before merge: The PR provides unit/Testbox proof only and explicitly says live Android UI proof was unavailable; before merge, add redacted device/emulator recording, ADB/log transcript, terminal output, or linked artifact showing sends survive reconnect recovery. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

[P1] Real Android device or emulator proof is still absent, so the unit/Testbox coverage does not show the lifecycle/background reconnect UI path preserving a sent row and run ownership.
[P1] The changed path is session-state and message-delivery sensitive: regressions would appear as duplicate rows, lost optimistic sends, stale terminal ownership, or chat staying disabled after reconnect.
[P1] A PR-introduced assistant auto-send edge case remains: whitespace-padded auto-send prompts get stuck before dispatch because the view model claims a trimmed value against raw pending state.

Maintainer options:

Fix and prove Android recovery (recommended)
Fix the raw-prompt claim bug, remove the release-owned changelog entry, and attach exact-head Android reconnect proof before maintainer approval.
Merge with maintainer-owned risk
A maintainer may override real-behavior proof after the code findings are addressed, accepting the remaining session/message-delivery lifecycle risk.
Pause if the workstream changed
If the existing-contract recovery direction is no longer accepted, pause this PR and reopen a focused gateway/mobile recovery discussion instead of landing more Android-specific state code.

Next step before merge

[P1] Manual review/proof follow-up is needed because the PR has a protected maintainer label, lacks real Android behavior proof, and still has a concrete P2 prompt-ownership bug.

Maintainer decision needed

Question: After the raw-prompt regression and changelog entry are fixed, should this stateful Android reconnect PR require live Android reconnect proof before merge, or should maintainers explicitly override that proof gate?
Rationale: The source direction is plausible and well covered by focused tests, but this is an external contributor PR touching message delivery/session state and the body explicitly says real Android UI proof is unavailable.
Likely owner: steipete — steipete has the strongest recent history on the Android chat recovery follow-up and closed the linked reconnect workstream with the existing-contract direction.
Options:
- Require fixes and live proof (recommended): Ask for the prompt-claim fix, changelog removal, and a redacted emulator/device or ADB transcript showing sends survive reconnect recovery before merge.
- Accept a proof override: A maintainer can explicitly accept the unit/Testbox evidence and own the remaining Android lifecycle risk after the code findings are fixed.
- Pause the branch: Hold this PR if maintainers want the closed reconnect workstream reopened or narrowed before landing more Android recovery code.

Security
Cleared: No concrete security or supply-chain concern was found; the diff changes Android chat/gateway runtime code, tests, generated i18n inventory, and changelog text without dependency, workflow, secret, or permission changes.

Review findings

[P2] Claim the raw assistant auto-send prompt — apps/android/app/src/main/java/ai/openclaw/app/MainViewModel.kt:441-443
[P3] Remove the manual changelog entry — CHANGELOG.md:52

Review details

Best possible solution:

Land the Android snapshot/lost-ACK recovery only after fixing the raw-prompt ownership bug, removing the manual changelog entry, and adding exact-head Android emulator/device or redacted ADB proof.

Do we have a high-confidence way to reproduce the issue?

Yes for the source path: current main clears pending run state on disconnect and seqGap, while the PR adds focused tests for reconnect recovery, lost acknowledgements, and terminal/history reconciliation. I did not run a live Android repro in this read-only review.

Is this the best way to solve the issue?

No as submitted: the Android snapshot/lost-ACK direction is a plausible maintainable fix, but the raw assistant auto-send prompt claim and release-owned changelog edit need repair before this is the best mergeable version.

Full review comments:

[P2] Claim the raw assistant auto-send prompt — apps/android/app/src/main/java/ai/openclaw/app/MainViewModel.kt:441-443
Late ClawSweeper finding: this code was unchanged since the previous reviewed head. handleAssistantLaunch stores the raw prompt, but both Compose callers pass the trimmed value from resolvePendingAssistantAutoSend; with leading or trailing whitespace this comparison fails, flips the in-flight flag back, and returns before sending or clearing the queued assistant prompt.
Confidence: 0.94
Late finding: first raised on code an earlier review cycle already covered.
[P3] Remove the manual changelog entry — CHANGELOG.md:52
Late ClawSweeper finding: the Android entry was already present at the previous reviewed head. Root policy makes CHANGELOG.md release-owned for normal PRs, so this manual entry can conflict with generated release notes; keep this context in the PR body or squash message instead.
Confidence: 0.91
Late finding: first raised on code an earlier review cycle already covered.

Overall correctness: patch is incorrect
Overall confidence: 0.9

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 75c8753a2cb5.

Label changes

Label justifications:

P1: The PR targets an urgent Android chat reconnect workflow where users can lose or duplicate sent-message state during real mobile network recovery.
merge-risk: 🚨 message-delivery: The diff changes optimistic send, lost-ACK, terminal, and history reconciliation paths where a bad merge could drop or duplicate chat rows.
merge-risk: 🚨 session-state: The diff rewrites pending-run ownership across disconnect, reconnect recovery, and history snapshots, which can stale or mis-associate active chat state.
rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🦐 gold shrimp.
status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR provides unit/Testbox proof only and explicitly says live Android UI proof was unavailable; before merge, add redacted device/emulator recording, ADB/log transcript, terminal output, or linked artifact showing sends survive reconnect recovery. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence reviewed

PR surface:

Docs +1, Other +1716. Total +1717 across 14 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	0	0	0	0
Tests	0	0	0	0
Docs	1	1	0	+1
Config	0	0	0	0
Generated	0	0	0	0
Other	13	1939	223	+1716
Total	14	1940	223	+1717

What I checked:

Repository policy read and applied: Read the full root AGENTS.md and apps/android/AGENTS.md; the review-depth, Android proof, protected-label, and release-owned changelog guidance affected this keep-open review. (AGENTS.md:1, 75c8753a2cb5)
Current main drops transient run ownership on disconnect and seqGap: On current main, Android ChatController clears pending runs on disconnect and seqGap, matching the source-level recovery problem this PR targets. (apps/android/app/src/main/java/ai/openclaw/app/chat/ChatController.kt:140, 75c8753a2cb5)
PR implements reconnect recovery ownership: At PR head, ChatController keeps disconnected run ids, preserves optimistic/unresolved messages, refreshes history for recovery, and completes reconnect health only after the owned history snapshot applies. (apps/android/app/src/main/java/ai/openclaw/app/chat/ChatController.kt:550, 0a74e1d1f00f)
Assistant auto-send regression remains at PR head: The Compose callers pass the trimmed prompt returned by resolvePendingAssistantAutoSend, but MainViewModel compares that value to the raw pending prompt stored by handleAssistantLaunch, so prompts with surrounding whitespace never send or clear. (apps/android/app/src/main/java/ai/openclaw/app/MainViewModel.kt:441, 0a74e1d1f00f)
Late-finding check for assistant prompt path: The MainViewModel, ChatScreen, and ChatSheetContent code involved in the prompt claim path did not change between the previous ClawSweeper-reviewed SHA and the current head, so this is a late ClawSweeper finding. (apps/android/app/src/main/java/ai/openclaw/app/MainViewModel.kt:441, 0a74e1d1f00f)
Manual changelog entry conflicts with release-owned policy: The PR adds a normal-fix entry to CHANGELOG.md even though root policy says CHANGELOG.md is release-only and release generation owns entries. (CHANGELOG.md:52, 0a74e1d1f00f)

Likely related people:

steipete: Peter Steinberger authored recent current-main Android chat/gateway lifecycle hardening and the merged predecessor reconnect PR that this follow-up extends. (role: recent Android chat recovery contributor; confidence: high; commits: d6f0747f69d3, f1641571f119; files: apps/android/app/src/main/java/ai/openclaw/app/chat/ChatController.kt, apps/android/app/src/main/java/ai/openclaw/app/gateway/GatewaySession.kt, apps/android/app/src/main/java/ai/openclaw/app/NodeRuntime.kt)
scoootscooob: git blame and git log show the checked-out Android ChatController, GatewaySession, NodeRuntime, and inFlightRun snapshot baseline were introduced in commit 7e7fc00. (role: introduced current baseline; confidence: high; commits: 7e7fc0075e3c; files: apps/android/app/src/main/java/ai/openclaw/app/chat/ChatController.kt, apps/android/app/src/main/java/ai/openclaw/app/gateway/GatewaySession.kt, apps/android/app/src/main/java/ai/openclaw/app/NodeRuntime.kt)
William Liu AI: Commit 8eeb930 is the earlier history object for restoring in-flight TUI run switch-back, which is adjacent to the inFlightRun contract this Android path consumes. (role: snapshot contract contributor; confidence: medium; commits: 8eeb9300df40; files: src/gateway/chat-abort.ts, src/gateway/server-methods/chat.ts, src/tui/tui-session-actions.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (1 earlier review cycle)

reviewed 2026-07-06T02:25:59.899Z sha a3d183d :: needs real behavior proof before merge. :: none

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a3d183dffa

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-07-06T02:21:03Z

+    if (_pendingAssistantAutoSend.value != pendingPrompt) {
+      _assistantAutoSendInFlight.value = false
+      return


Claim the raw assistant prompt

When an assistant auto-send prompt contains leading/trailing whitespace, the Compose callers pass the trimmed value returned by resolvePendingAssistantAutoSend, while _pendingAssistantAutoSend still holds the raw value from handleAssistantLaunch. This comparison then fails, flips assistantAutoSendInFlight back to false, and returns before either sending or clearing the pending prompt, leaving the auto-send stuck and the chat UI treating it as still queued.

Useful? React with 👍 / 👎.

steipete · 2026-07-06T02:49:48Z

Land-ready on 0a74e1d1f00f1a42188c4f756e44c276c2d16587.

What was rewritten:

reconnect keeps optimistic rows and pending-run ownership until authoritative history resolves them;
same-generation history responses are ordered, reconnect health follows the winning response, and reconnect ticks retry recovery without bypassing the recovery gate;
lost-ACK, delayed-history, message-less terminal, cross-client terminal, and timeout states have explicit ownership and cleanup;
gateway request failures distinguish definitive rejection from unknown outcome, preserving idempotent writes when the server may already have accepted them;
assistant auto-send is view-model owned, preventing Compose restarts from duplicating a send.

Proof:

exact-head hosted CI: https://github.com/openclaw/openclaw/actions/runs/28764165560
Blacksmith Testbox lease tbx_01kwtcpdgbex21fsw4mdv2jk2f: focused Android chat/controller, assistant auto-send, and gateway disconnect-outcome tests passed (125 tests);
node --import tsx scripts/native-app-i18n.ts check passed after refreshing the generated native inventory;
fresh Codex autoreview plus final focused review: no actionable findings;
Android build, Android unit tests, native-i18n, lint, types, security, and QA smoke all pass on the exact head.

Proof gap: live Android UI validation remains unavailable because the only attached ADB target was unauthorized. Deterministic controller tests cover reconnect, lost-ACK, terminal, timeout, and duplicate-send state transitions.

steipete · 2026-07-06T02:50:12Z

Merged via squash.

Prepared head SHA: 0a74e1d1f00f1a42188c4f756e44c276c2d16587
Landed commit: 2b48e98148405441b3aa7812ca643a114228dace

…#100551) * fix(android): preserve chat recovery ownership * fix(android): retry reconnect recovery on ticks * chore(android): refresh native i18n inventory

openclaw-barnacle Bot added app: android App: android size: XL maintainer Maintainer-authored PR labels Jul 6, 2026

steipete force-pushed the codex/android-recovery-optimistic branch from f6299ab to 09893c7 Compare July 6, 2026 02:05

chatgpt-codex-connector Bot reviewed Jul 6, 2026

View reviewed changes

steipete force-pushed the codex/android-recovery-optimistic branch from 09893c7 to a3d183d Compare July 6, 2026 02:13

chatgpt-codex-connector Bot reviewed Jul 6, 2026

View reviewed changes

github-actions Bot mentioned this pull request Jul 6, 2026

🦞 OpenClaw 生态日报 2026-07-06 zx0828/big_model_radar#221

Open

steipete added 3 commits July 5, 2026 22:36

fix(android): preserve chat recovery ownership

19101e9

fix(android): retry reconnect recovery on ticks

b2b9bdc

chore(android): refresh native i18n inventory

0a74e1d

steipete force-pushed the codex/android-recovery-optimistic branch from a3d183d to 0a74e1d Compare July 6, 2026 02:36

steipete merged commit 2b48e98 into main Jul 6, 2026
75 checks passed

steipete deleted the codex/android-recovery-optimistic branch July 6, 2026 02:50

steipete mentioned this pull request Jul 6, 2026

style(android): apply ktlint to landed changes #100304

Merged

Solvely-Colin mentioned this pull request Jul 6, 2026

fix(android): stabilize chat refresh loading #100966

Merged

steipete mentioned this pull request Jul 16, 2026

fix(android): stop killing long chat runs with hardcoded timeouts (#106863) #106864

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(android): preserve chat sends across reconnect recovery#100551

fix(android): preserve chat sends across reconnect recovery#100551
steipete merged 3 commits into
mainfrom
codex/android-recovery-optimistic

steipete commented Jul 6, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Jul 6, 2026

Uh oh!

clawsweeper Bot commented Jul 6, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Jul 6, 2026

Uh oh!

steipete commented Jul 6, 2026

Uh oh!

Uh oh!

steipete commented Jul 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

steipete commented Jul 6, 2026

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

clawsweeper Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

steipete commented Jul 6, 2026

Uh oh!

Uh oh!

steipete commented Jul 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

clawsweeper Bot commented Jul 6, 2026 •

edited

Loading