Add queued chat message UI

[calebeden]

Summary

• Adds native queued-message UI and client-side in-memory queue parity with the web UI: follow-up prompts remain local until the active agent turn is ready for the next user message.
• Reconciles queued/local/live/history chat messages using gateway identity and sequence metadata so confirmed user messages do not render as duplicate bubbles.
• Hardens queue lifecycle behavior across duplicate terminal events, reconnect, shutdown, abort, and session reset so local-only queued prompts do not opportunistically leak through.
• Fixes Bug: user chat messages may render double #914.

Screenshots

Web dashboard reference UI

Windows tray implementation

WIP

Validation

• dotnet test .\tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --no-restore --filter "FullyQualifiedName~OpenClawChatDataProviderTests" — 190 passed
• .\build.ps1 — passed
• dotnet test .\tests\OpenClaw.Shared.Tests\OpenClaw.Shared.Tests.csproj --no-restore — 2693 passed, 31 skipped
• dotnet test .\tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --no-restore — 1487 passed
• Opus 4.8 rubber-duck/reset review — one bounded echo-suppression edge case found and fixed
• Opus 4.8 code review — no actionable issues found
• Structured autoreview with Claude/Opus was attempted, but local claude CLI was not installed

Real behavior proof

• Provider regressions cover client-only follow-up queueing, one-at-a-time dispatch, duplicate terminal event suppression, shutdown/dispose no-drain behavior, reset abort/suppression, and forced authoritative history reload after pre-reset submitted runs terminate.
• Not verified with final current-head screenshots yet; screenshot slots above are intentionally left for draft PR follow-up.

Draft notes

This remains a draft because additional queue-feature polish is planned in follow-up commits before review-ready publication.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed July 2, 2026, 8:28 PM ET / 00:28 UTC.

Summary
The branch adds in-memory queued chat sends, queued composer cards above the input, gateway identity/sequence reconciliation, queue lifecycle handling, localization strings, and shared/tray regression tests.

Reproducibility: no. The linked issue includes screenshots and a rapid-send clue, but this read-only review did not run the WinUI app or establish a deterministic current-main reproduction path.

Review metrics: 2 noteworthy metrics.

• Changed surface: 19 files, +2760/-162. The PR spans shared gateway parsing, chat provider state, WinUI composer rendering, localization resources, and tests, so review should cover both delivery logic and visible UI.
• Provider test expansion: tests/OpenClaw.Tray.Tests/OpenClawChatDataProviderTests.cs +1185/-32. Most validation is provider-level coverage, which is useful but does not replace current-head visible tray proof.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #914
Summary: This PR is the candidate implementation for the open duplicate user-message rendering issue it closes, while the older closed report is related context rather than the canonical remaining item.

Members:

• canonical: Bug: user chat messages may render double #914 - The PR body links this open issue as the target fix, and the issue discussion identifies quick successive queued sends as a likely duplicate/interleaving trigger.
• partial_overlap: Bug: user chat bubble rendering #899 - The closed report describes a one-off user bubble rendering problem in the same chat UI area, but it was closed before this PR and is not the canonical remaining work.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🐚 platinum hermit
Result: blocked until real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P1] Add a current-head screenshot or recording showing rapid queued sends above the composer and their later confirmation without duplicate transcript bubbles.
• Redact private details such as IP addresses, API keys, phone numbers, non-public endpoints, and other private details before posting proof; after updating the PR body, ClawSweeper should re-review automatically, or a maintainer can comment @clawsweeper re-review.

Proof guidance:

• [P1] Needs real behavior proof before merge: The PR body provides tests but explicitly says final current-head Windows tray screenshots are not verified, so contributor-provided real behavior proof is still missing. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Mantis proof suggestion
A visible Windows tray queued-message flow is the missing proof and would materially help review. A maintainer can ask Mantis to capture proof by posting this exact PR comment:

@openclaw-mantis visual task: verify Windows tray rapid chat sends queue above the composer and later confirm into the transcript without duplicate user bubbles.

Risk before merge

• [P1] The change sits directly on the visible chat delivery path; mistakes in queue promotion, echo suppression, lifecycle reset, or gateway identity reconciliation could duplicate, suppress, or reorder user messages.
• [P1] The PR body explicitly says current-head Windows tray proof is not verified, so the queued-message UI remains unproven outside provider/source-text tests.
• [P1] The PR is still draft and says additional queue-feature polish is planned, so maintainers should wait for the final behavior before merge review.

Maintainer options:

1. Require visible queued-send proof (recommended)
   Ask for a current-head screenshot or recording that shows rapid sends queue above the composer, then confirm into the transcript without duplicate user bubbles.
2. Accept after focused delivery review
   Maintainers could merge after focused chat-provider review if they intentionally accept the remaining visible-proof gap and message-delivery risk.
3. Pause until draft polish lands
   Because the PR says more queue-feature polish is planned, maintainers can leave it draft until the branch represents the final behavior to review.

Next step before merge

• [P1] Human review should wait for the contributor's current-head tray proof and final draft polish; there is no narrow automation repair to apply from this review.

Security
Cleared: No concrete security or supply-chain concern was found; the diff is confined to chat models, gateway response parsing, tray UI/provider logic, localization resources, and tests.

Review details

Best possible solution:

Finish the draft, add current-head tray proof showing rapid follow-up sends queue above the composer and reconcile into the transcript without duplicate bubbles, then land this as the candidate fix for the linked open issue if maintainer review agrees.

Do we have a high-confidence way to reproduce the issue?

No. The linked issue includes screenshots and a rapid-send clue, but this read-only review did not run the WinUI app or establish a deterministic current-main reproduction path.

Is this the best way to solve the issue?

Unclear until visible proof lands. The queued composer state plus gateway identity reconciliation is a plausible narrow direction with broad provider tests, but the PR itself says final current-head tray behavior has not been verified.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 74604aebafef.

Label changes

Label justifications:

• P2: This is a normal-priority chat reliability/UI improvement with limited blast radius but meaningful user-visible behavior.
• merge-risk: 🚨 message-delivery: The PR changes queued sends, local/live/history reconciliation, and duplicate suppression on the chat message path.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body provides tests but explicitly says final current-head Windows tray screenshots are not verified, so contributor-provided real behavior proof is still missing. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence reviewed

What I checked:

• Repository policy read: Full AGENTS.md was read; its tray/chat proof guidance applies because this PR changes visible tray chat UX and chat provider behavior. (AGENTS.md:1, 74604aebafef)
• PR proof gap: The PR body lists tests but leaves the Windows tray implementation screenshot as WIP and says final current-head screenshots are not verified. (d87ce667f02e)
• Current main lacks queued UI state: A search on current main found no ChatQueuedMessage, QueuedMessagesByThread, queuedPanel, RenderQueuedMessages, BeginLocalUserTurn, or _queuedMessages symbols; ChatDataSnapshot on main ends at TimelineGenerations. (src/OpenClaw.Chat/ChatModels.cs:188, 74604aebafef)
• Queued model surface added: The branch adds ChatQueuedMessageSendState, ChatQueuedMessage, and QueuedMessagesByThread to the shared chat snapshot model. (src/OpenClaw.Chat/ChatModels.cs:159, d87ce667f02e)
• Visible queued composer UI added: The branch renders queued messages above the composer input with a live region, automation names, failure labels, and bounded scroll height. (src/OpenClaw.Tray.WinUI/Chat/OpenClawComposer.cs:903, d87ce667f02e)
• Provider queue behavior covered: New provider tests cover idle sends avoiding queue cards, queued follow-ups, duplicate terminal suppression, active-run assistant fallback, and failed/reconnect queue behavior. (tests/OpenClaw.Tray.Tests/OpenClawChatDataProviderTests.cs:263, d87ce667f02e)

Likely related people:

• calebeden: Beyond proposing this PR, calebeden authored the recently merged chat timeline render identity fix adjacent to this duplicate-rendering path. (role: recent area contributor; confidence: high; commits: f89a88a6baf4; files: src/OpenClaw.Tray.WinUI/Chat/OpenClawChatDataProvider.cs, src/OpenClaw.Tray.WinUI/Chat/OpenClawChatRoot.cs, src/OpenClaw.Tray.WinUI/Chat/OpenClawChatTimeline.cs)
• shanselman: History points to shanselman for the earlier user-bubble rendering fix and current shallow blame/log ownership on the checked-out chat surface. (role: recent area contributor; confidence: high; commits: 87dc3dc79d7c, 4166e0fd63f8; files: src/OpenClaw.Tray.WinUI/Chat/OpenClawChatTimeline.cs, src/OpenClaw.Tray.WinUI/Chat/OpenClawChatDataProvider.cs, src/OpenClaw.Tray.WinUI/Chat/OpenClawComposer.cs)
• RBrid: GitHub file history shows substantial prior native chat provider, reset, inline approval, and timeline work that this queue change builds on. (role: feature-history owner; confidence: high; commits: 4e7982bafb86, 3fdfbfad837f, 5505a85da7df; files: src/OpenClaw.Tray.WinUI/Chat/OpenClawChatDataProvider.cs, src/OpenClaw.Tray.WinUI/Chat/OpenClawChatTimeline.cs, src/OpenClaw.Chat/ChatTimelineReducer.cs)
• bkudiess: Recent slash-command and provider-aware composer work touched the same chat provider and composer surfaces extended by this PR. (role: recent adjacent contributor; confidence: medium; commits: a3c5e0bf6fce, 0b8ba41369c8; files: src/OpenClaw.Tray.WinUI/Chat/OpenClawChatDataProvider.cs, src/OpenClaw.Tray.WinUI/Chat/OpenClawComposer.cs)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.