Add queued chat message UI

[calebeden]

Summary

• Adds native queued-message UI and client-side queue parity with the web UI: follow-up prompts stay local until the active turn is ready for the next user message.
• Reconciles optimistic, live, and history rows using exact local IDs plus gateway message IDs/session sequences, preventing duplicate or misordered bubbles.
• Hardens one-at-a-time dispatch across abort, final-only completion, delayed lifecycle events, retransmits, reconnect, shutdown, and session reset.
• Fixes Bug: user chat messages may render double #914.

Validation

• Windows 11 ARM64 VM: build.ps1 -Project WinUI passed.
• Windows 11 ARM64 VM: 197/197 OpenClawChatDataProviderTests passed.
• Windows 11 ARM64 VM, interactive-user context: 96/96 native WinUI/accessibility tests passed.
• Focused AutoReview: clean, no accepted/actionable findings (0.98).
• Exact-head GitHub Actions: run 28771378728.

Behavior covered

• Follow-ups queue visibly but are not sent while another run is active.
• Confirmed terminal events and assistant-final fallback advance exactly one queued prompt.
• Abort/reset never overlaps the next prompt with a still-running prior run.
• Gateway retransmits cannot terminate or attach to the following turn.
• Late pre-reset send acknowledgements are aborted and suppressed.
• History refresh prefers gateway identity/sequence and never deletes a fresh same-text local prompt by text alone.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed July 6, 2026, 2:16 AM ET / 06:16 UTC.

Summary
The branch adds native queued-message cards, in-memory follow-up queueing, gateway identity/sequence reconciliation, lifecycle hardening, localization strings, and shared/tray regression tests for tray chat.

Reproducibility: no. The linked issue has screenshots and a rapid-send clue, but this read-only Linux review did not run the WinUI app or establish a deterministic current-main reproduction path.

Review metrics: 2 noteworthy metrics.

• Changed surface: 19 files, +3445/-293. The PR spans shared gateway parsing, chat provider state, WinUI rendering, localization, and tests, so message-delivery review cannot be reduced to one file.
• Provider test expansion: 1 file, +1568/-110. Most validation is provider-level coverage, which is useful but still leaves visible tray proof as a separate merge gate.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #914
Summary: This PR is the candidate implementation for the open duplicate user-message rendering issue; the older closed report is related chat-rendering context but not the canonical remaining item.

Members:

• canonical: Bug: user chat messages may render double #914 - The PR body links this open issue with closing syntax, and GitHub lists it as a closing issue for this PR.
• partial_overlap: Bug: user chat bubble rendering #899 - The closed report describes a similar native chat bubble rendering symptom, but it was closed earlier and does not own the remaining queued-message work.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🐚 platinum hermit
Result: blocked until real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P1] Add a current-head Windows tray screenshot or recording showing rapid queued sends above the composer and later transcript confirmation without duplicate user bubbles.
• Update the PR body after adding proof; ClawSweeper should re-review automatically, or a maintainer can comment @clawsweeper re-review if it does not.
• Redact private details such as IP addresses, API keys, phone numbers, and non-public endpoints from posted proof.

Proof guidance:

• [P1] Needs real behavior proof before merge: The PR body still marks Windows tray proof as WIP and says final current-head screenshots are not verified; add a screenshot, recording, copied live output, or redacted logs showing the queued-send flow before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

• [P1] The PR changes queued sends, optimistic transcript promotion, echo suppression, terminal-event handling, and history/live reconciliation, so a subtle mistake could duplicate, suppress, or reorder user-visible chat messages.
• [P1] The visible Windows tray behavior is still unproven on the current PR head; provider tests cannot show whether the queued cards render, scroll, and collapse correctly in the actual WinUI surface.
• [P1] The branch is large for a message-delivery path, so maintainer review should focus on reconnect, reset, abort, shutdown, and late assistant retransmit behavior even with green provider tests.

Maintainer options:

1. Require current-head tray proof (recommended)
   Ask for a screenshot or short recording from this head showing rapid follow-up sends entering the queue and later confirming into the transcript without duplicates.
2. Accept maintainer-owned proof
   A maintainer could supply equivalent local WinUI proof and then continue normal code review without waiting on the contributor.
3. Pause if proof stays absent
   If no one can provide visible tray proof, keep the PR unmerged because the central user-visible behavior remains unverified.

Next step before merge

• [P1] Human review should wait for current-head tray proof and focused message-delivery review; there is no narrow ClawSweeper code repair to queue from this pass.

Security
Cleared: No concrete security or supply-chain concern was found; the diff is confined to chat models, gateway parsing, tray UI/provider logic, localization resources, and tests.

Review details

Best possible solution:

Land this as the candidate fix only after current-head tray proof shows rapid follow-up sends queue above the composer and then reconcile into the transcript without duplicate user bubbles.

Do we have a high-confidence way to reproduce the issue?

No. The linked issue has screenshots and a rapid-send clue, but this read-only Linux review did not run the WinUI app or establish a deterministic current-main reproduction path.

Is this the best way to solve the issue?

Unclear until visible proof lands. The queue plus identity reconciliation design is plausible and well covered at provider level, but the actual tray UI behavior still needs current-head proof.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 43d40ed60acc.

Label changes

Label justifications:

• P2: This is a normal-priority user-visible tray chat reliability and UI improvement with limited blast radius but meaningful message-rendering impact.
• merge-risk: 🚨 message-delivery: The diff changes queued sends, local/live/history reconciliation, duplicate suppression, and terminal-event dispatch on the chat message path.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body still marks Windows tray proof as WIP and says final current-head screenshots are not verified; add a screenshot, recording, copied live output, or redacted logs showing the queued-send flow before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence reviewed

What I checked:

• Repository proof policy applies: AGENTS.md requires current-head visible proof for UI claims, and this PR changes visible tray chat behavior. (AGENTS.md:57, 43d40ed60acc)
• PR body still lacks real tray proof: The PR body lists validation and a web-dashboard reference image, but the Windows tray implementation screenshot is still marked WIP and the real behavior proof section says final current-head screenshots are not verified. (807aa554397f)
• Current main does not already contain the queued-message surface: Searching current main found no ChatQueuedMessage, QueuedMessagesByThread, RenderQueuedMessages, _queuedMessages, LocalQueuedMessageId, or BeginLocalUserTurn symbols. (43d40ed60acc)
• Queued provider state added: The PR head adds queued-message, queued-send-request, run-id mapping, and assistant-frame deferral state to the tray chat provider. (src/OpenClaw.Tray.WinUI/Chat/OpenClawChatDataProvider.cs:140, 807aa554397f)
• Visible queued composer UI added: The PR head renders queued cards above the composer with count text, automation names, failure state, and bounded scrolling. (src/OpenClaw.Tray.WinUI/Chat/OpenClawComposer.cs:915, 807aa554397f)
• Provider regression coverage added: The PR head includes provider tests for active-turn follow-up queueing, one-at-a-time dispatch, and promotion into the transcript after lifecycle start. (tests/OpenClaw.Tray.Tests/OpenClawChatDataProviderTests.cs:263, 807aa554397f)

Likely related people:

• steipete: Authored the current head and recent queued-chat hardening commits that changed provider/test behavior after the force-push. (role: recent PR hardening contributor; confidence: high; commits: 807aa554397f, 3769ce5c7551, 03a44a684926; files: src/OpenClaw.Tray.WinUI/Chat/OpenClawChatDataProvider.cs, tests/OpenClaw.Tray.Tests/OpenClawChatDataProviderTests.cs)
• calebeden: Authored the first queued-message commits and also recently landed adjacent current-main chat timeline identity work. (role: recent area contributor; confidence: high; commits: f89a88a6baf4, d0c2eea72e16, 044a2e2c419a; files: src/OpenClaw.Chat/ChatModels.cs, src/OpenClaw.Tray.WinUI/Chat/OpenClawChatDataProvider.cs, src/OpenClaw.Tray.WinUI/Chat/OpenClawChatRoot.cs)
• shanselman: Current-main blame points the existing optimistic-send path and user-bubble rendering surface to recent chat work by Scott Hanselman. (role: current-main chat surface contributor; confidence: high; commits: 4166e0fd63f8; files: src/OpenClaw.Tray.WinUI/Chat/OpenClawChatDataProvider.cs, src/OpenClaw.Tray.WinUI/Chat/OpenClawChatTimeline.cs)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (2 earlier review cycles)

• reviewed 2026-07-03T00:28:07.669Z sha d87ce66 :: needs real behavior proof before merge. :: none
• reviewed 2026-07-06T06:10:47.511Z sha 807aa55 :: needs real behavior proof before merge. :: none

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 807aa55439

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Defer queued dispatch until the assistant final is applied

When lifecycle.end/job.done is delivered before the corresponding final chat.message (a sequence this provider already tolerates for late assistant messages), this drains the next queued prompt immediately. The late final then arrives while a single queued prompt is in Sending, so PromoteOldestQueuedMessageBeforeAssistantIfNeeded promotes that next user message before rendering the previous assistant answer, corrupting transcript order and sending the follow-up before the prior final is applied. Please gate terminal-event queue draining on having rendered the final assistant frame, or otherwise correlate the terminal event to a completed assistant message first.

Useful? React with 👍 / 👎.