Exact-head proof for 63af2257534003799f7275ae8a711086f70c4926:

SHARE_ATTACHMENT_SUMMARY_PROOF=PASS
Only 3 of 6 images can be sent. Remove omitted items and share again.
OpenClaw Share cannot send 1 video(s), 2 file(s), 1 unsupported item(s) yet. Remove omitted items and share again.

Validation run on this head:

swiftc /tmp/.../ShareAttachmentSummary.swift /tmp/.../main.swift -o /tmp/.../share-proof && /tmp/.../share-proof
git diff HEAD^ HEAD --check

What this proves:

• A share with all selected images accepted has no omission warning.
• A share with 6 selected images and the current 3-image accepted limit surfaces an explicit blocked message before send.
• A share containing unsupported videos/files/unknown attachments surfaces an explicit blocked message before send.
• The current gateway media contract is unchanged; this PR prevents silent partial delivery instead of attempting new video/PDF/file transport.

Host limitation for simulator proof: this macOS 12 host only has Apple Command Line Tools. xcodebuild requires full Xcode, simctl is unavailable, and Homebrew cannot install current xcodegen here because it requires Xcode 15.3. I did not fabricate UI screenshots from this environment.

@clawsweeper re-review

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The targeted re-review published an exact durable review comment and queued an executing target-wide serialized router scan.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29174756682
• Updated: 2026-07-12T01:12:50.217Z

Codex review: needs real behavior proof before merge. Reviewed July 13, 2026, 6:53 AM ET / 10:53 UTC.

Summary
Blocks iOS Share Extension sends when selected attachments would be omitted, adds localized omission summaries and logic tests, and also relaxes two unrelated macOS test waits.

PR surface: Other +162. Total +162 across 6 files.

Reproducibility: yes. at source level: current main deterministically caps accepted images at three and discards the attachment-class counters. A before-fix native run on current main was not supplied, so this is source-reproducible rather than a fully executed current-main reproduction.

Review metrics: none identified.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #103363
Summary: This PR is the candidate fix for the linked canonical issue describing the same silent image truncation and unsupported attachment loss.

Members:

• canonical: [Bug]: iOS Share Extension silently truncates shares to 3 images and discards videos/files #103363 - The issue defines the existing broken behavior and the PR explicitly implements its requested fail-visible boundary.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🦐 gold shrimp
Proof: 🦐 gold shrimp
Patch quality: 🐚 platinum hermit
Result: blocked until stronger real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• Rebase or otherwise resolve the dirty merge state and remove the unrelated macOS timeout change unless a maintainer explicitly owns it.
• [P1] Add redacted exact-head simulator screenshots, recording, or XCTest output for excess images and an unsupported video or file share.

Proof guidance:

• [P1] Needs stronger real behavior proof before merge: Native screenshots and XCTest results convincingly show the old 5dda904 six-image and control flows, but the current 94b0be6 head and unsupported video/file path need redacted real proof; update the PR body afterward to trigger review, or ask a maintainer to comment @clawsweeper re-review.

Risk before merge

• [P1] The change intentionally replaces partial delivery with fail-closed behavior, so shares that previously sent text or a subset of images will now stop until unsupported or excess items are removed.
• [P1] The native screenshots prove only an older head's six-image and one-image flows; current-head behavior and the video/file rejection path remain unproven in a real share sheet.
• [P1] The dirty merge state prevents confident review of the final merged result until the branch is rebased or conflicts are resolved.
• [P2] The unrelated macOS timeout relaxation broadens the landing scope and could mask slow restart behavior without contributing to the iOS fix.

Maintainer options:

1. Prepare a clean exact-head iOS fix (recommended)
   Rebase, split the macOS timeout change, and add native current-head proof for excess images plus an unsupported video or file before merge.
2. Explicitly accept fail-closed upgrade behavior
   Maintain the combined scope only with maintainer ownership of the new blocked-send behavior, resolved conflicts, and complete exact-head proof.
3. Pause until native proof is available
   Leave the PR open rather than merging an unproven head if the unsupported attachment path cannot currently be exercised in a real share extension.

Next step before merge

• [P1] A maintainer should resolve the dirty branch and scope choice, then require current-head native proof; there is no discrete code defect suitable for automated repair.

Maintainer decision needed

• Question: Should the unrelated macOS timeout relaxation remain in this iOS delivery fix, or should the PR be reduced to the clean iOS-only change before final proof and merge?
• Rationale: The timeout change is independently meaningful test behavior, while the iOS fix already has a coherent narrow boundary; choosing whether to combine them is a maintainer scope and merge-risk decision.
• Likely owner: steipete — They authored the current enforcement and timeout commits and are best positioned to decide the intended landing scope.
• Options:
  • Split and rebase the iOS fix (recommended): Remove the macOS timeout change, resolve the dirty base, and collect exact-head native proof for both excess-image and unsupported-attachment blocking.
  • Keep the combined branch: Explicitly accept the macOS timeout change as part of this landing, resolve conflicts, and provide proof and review covering both surfaces.

Security
Cleared: The Swift product, test, project, and i18n changes introduce no concrete credential, authorization, dependency, downloaded-code, workflow-permission, or supply-chain concern.

Updated exact-head proof for ee6c879333f1164ef3ca56bc113b8bdd1c53671f after SwiftFormat repair:

SHARE_ATTACHMENT_SUMMARY_PROOF=PASS

Validation run on this head:

swiftc /tmp/.../ShareAttachmentSummary.swift /tmp/.../main.swift -o /tmp/.../share-proof && /tmp/.../share-proof
git diff --check

CI failure follow-up from the previous head:

• ios-build failed in SwiftFormat on the && condition chain in ShareViewController.swift.
• Scan iOS dead code failed because Periphery's xcodebuild step hit that same SwiftFormat failure before producing findings.
• Current head replaces that condition chain with Swift comma conditions.

@clawsweeper re-review

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The targeted re-review published an exact durable review comment and queued an executing target-wide serialized router scan.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/29176304414
• Updated: 2026-07-12T02:14:04.363Z

Updated exact-head proof for 5dda9040ac66350805428609bca660dd5373e6f6:

SHARE_ATTACHMENT_SUMMARY_PROOF=PASS
IMAGE_PROCESSING_PRECEDENCE_PROOF=PASS

Validation run on this head:

swiftc /tmp/.../ShareAttachmentSummary.swift /tmp/.../main.swift -o /tmp/.../share-proof && /tmp/.../share-proof
git diff --check

Fix since the prior review:

• Moved block-reason resolution into ShareAttachmentBlockReason.resolve(...).
• Image-processing failures are now authoritative before omission warnings.
• Added focused logic coverage for both branches: processing-failure precedence and omission-only blocking.

Remaining known proof gap: this host still cannot run simulator/device UI proof because it lacks full Xcode and simctl. The PR now has green hosted iOS build/dead-code checks on the previous head; waiting for this head's hosted checks and ClawSweeper re-review.

@clawsweeper re-review

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Exact-head native simulator proof for 5dda9040ac66350805428609bca660dd5373e6f6:

Environment: iPhone 17 Pro simulator, iOS 26.2 (23C54), Xcode 27.0. The installed app's OpenClawGitCommit is the exact PR head above. Both scenarios used the real Photos → Share Sheet → OpenClaw Share Extension path.

Six-image omission path

• Selected 6 photos in Photos.
• The extension rendered: Only 3 of 6 images can be sent. Remove omitted items and share again.
• Send was disabled.
• After entering Compare all six images, Send remained disabled.
• XCTest result: Passed (39.91s).

Normal one-image control

• Selected 1 photo in Photos.
• After entering Describe this image, Send enabled normally.
• XCTest result: Passed (27.65s).

Focused commands:

xcodebuild ... -only-testing:OpenClawUITests/ShareExtensionUITests/testSixSelectedImagesShowOmissionWarningAndKeepSendDisabled test
xcodebuild ... -only-testing:OpenClawUITests/ShareExtensionUITests/testOneSelectedImageStillEnablesSendAfterDraftText test

The UI-test additions were a local proof harness only; no test or product files were pushed to the contributor branch.

@clawsweeper re-review

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Closing this PR under my current contribution standard: it is still missing current-head native proof, has a dirty/uncertain merge state, and includes unrelated macOS timeout scope alongside the iOS share fix. I am going to avoid spending more review/CI cycles on a branch that is unlikely to merge in this form.

Superseded by #106513 and landed as 6e8df6c0457fc347e9b68a2f7505b953af52082b. Contributor credit preserved. Thanks @jincheng-xydt.