Summary

• Fixes [Bug]: iOS LAN gateway connects are forced to wss, and bootstrap-only setup codes fail onboarding #47887 by allowing explicit private LAN and .local ws:// setup/manual iOS connects while keeping public, .ts.net, and 100.64.0.0/10 plaintext fail-closed.
• Aligns Swift and TypeScript setup-code/gateway clients so explicit passwords win over stale bootstrap tokens.
• Updates device-pair/setup-code validation, pairing docs, QR docs, and the changelog with source credit for fix(ios): allow plaintext ws:// for LAN/Tailscale hosts; prefer password over bootstrap token (#47887) #65185.

Verification

• pnpm install
• git diff --check origin/main..HEAD
• pnpm exec oxfmt --check --threads=1 src/gateway/client.ts src/gateway/client.test.ts src/pairing/setup-code.ts src/pairing/setup-code.test.ts extensions/device-pair/index.ts extensions/device-pair/index.test.ts
• pnpm format:docs:check
• pnpm test src/gateway/client.test.ts src/pairing/setup-code.test.ts extensions/device-pair/index.test.ts
• (cd apps/shared/OpenClawKit && swift test --filter 'DeepLinksSecurityTests|GatewayNodeSessionTests')
• pnpm lint:swift passed with the existing apps/macos/Sources/OpenClaw/TalkModeRuntime.swift type-body-length warning.

Blocked local validation

• iOS app-target xcodebuild test still cannot run locally because the generated OpenClaw scheme requires the watchOS 26.4 runtime, which is not installed here.
• Testbox pnpm check:changed previously failed in the app lint lane because that image lacks swiftlint; the local SwiftLint wrapper passes on this head.

Source: carries forward and narrows the useful pieces from #65185.