Best possible solution:

Rebase onto current main, preserve the mainline Swift/TypeScript behavior, land the remaining Android/docs/protocol alignment, and merge only after maintainer sign-off plus live mobile pairing proof.

Do we have a high-confidence way to reproduce the issue?

Yes, by source inspection. Current Android main still rejects private-LAN cleartext manual/scanned endpoints and persists bootstrap handoff tokens only on loopback or TLS; I did not establish a live-device repro.

Is this the best way to solve the issue?

Mostly yes, but not merge-ready. The narrow code direction matches the remaining Android/docs gap while preserving public and tailnet plaintext rejection, but the stale draft branch needs rebase, conflict review, and live pairing proof.

Acceptance criteria:

• pnpm test src/gateway/client.test.ts extensions/device-pair/index.test.ts src/pairing/setup-code.test.ts src/cli/qr-cli.test.ts
• cd apps/android && ./gradlew :app:testPlayDebugUnitTest --tests ai.openclaw.app.gateway.GatewaySessionInvokeTest --tests ai.openclaw.app.ui.GatewayConfigResolverTest --tests ai.openclaw.app.node.ConnectionManagerTest
• swift test --package-path apps/shared/OpenClawKit --filter 'DeepLinksSecurityTests|GatewayNodeSessionTests'
• pnpm check:changed in Testbox after rebase/conflict resolution
• Live iOS and Android private-LAN setup-code/manual pairing proof

What I checked:

• Protected PR state: Provided GitHub context shows authorAssociation MEMBER, label maintainer, draft true, mergeable false, head fbd0c6afdb111b0f5703b28dc5930a8cd7476f8f, and a Fixes #47887 link. (fbd0c6afdb11)
• Current Android manual TLS gate remains loopback-only: On current main, Android manual/discovery TLS resolution computes cleartextAllowedHost with isLoopbackGatewayHost(endpoint.host), so private LAN cleartext endpoints are still forced to TLS. (apps/android/app/src/main/java/ai/openclaw/app/node/ConnectionManager.kt:37, 60171e863882)
• Current Android endpoint parser remains loopback-only: Current Android setup/manual URL parsing rejects non-TLS endpoints unless isLoopbackGatewayHost(host) is true, which excludes the private LAN and .local endpoints this PR targets. (apps/android/app/src/main/java/ai/openclaw/app/ui/GatewayConfigResolver.kt:152, 60171e863882)
• Current Android bootstrap handoff persistence is narrower than policy: Current Android persists bootstrap handoff tokens only for bootstrap auth over loopback or TLS; the PR adds private/local cleartext persistence coverage. (apps/android/app/src/main/java/ai/openclaw/app/gateway/GatewaySession.kt:527, 60171e863882)
• Main already has Swift and TypeScript policy work: Current main already uses LoopbackHost.isLocalNetworkHost for iOS manual TLS and suppresses bootstrap auth when an explicit password is present in the TypeScript client, so the PR must be rebased carefully around mainline work from 36df0d93b93a. (apps/ios/Sources/Gateway/GatewayConnectionController.swift:691, 36df0d93b93a)
• Documentation is currently inconsistent across pages: Pairing/QR docs say private LAN and .local ws:// remain supported, while the gateway security doc still says Android/mobile private-LAN, link-local, and .local must use TLS unless opted into break-glass. Public docs: docs/gateway/security/index.md. (docs/gateway/security/index.md:879, 60171e863882)

Likely related people:

• Val Alexander: Authored 36df0d93b93a (fix: repair iOS LAN pairing) and blame shows this commit on the central Swift and TypeScript private/local pairing helpers. (role: recent mainline policy maintainer; confidence: high; commits: 36df0d93b93a; files: apps/shared/OpenClawKit/Sources/OpenClawKit/LoopbackHost.swift, apps/ios/Sources/Gateway/GatewayConnectionController.swift, src/pairing/setup-code.ts)
• Peter Steinberger: Blame on the current Android gateway, session, node connection, and config resolver paths points to 24853ced114a; adjacent native node work also appears in 466f7183207d. (role: adjacent Android/gateway owner; confidence: medium; commits: 24853ced114a, 466f7183207d; files: apps/android/app/src/main/java/ai/openclaw/app/gateway/GatewayHostSecurity.kt, apps/android/app/src/main/java/ai/openclaw/app/gateway/GatewaySession.kt, apps/android/app/src/main/java/ai/openclaw/app/node/ConnectionManager.kt)

Remaining risk / open question:

• The PR body says live iOS/Android pairing proof is still pending, so device-runtime behavior is not proven end to end.
• The branch is a draft and reported mergeable false; rebasing over current main could change the Swift/TypeScript policy overlap.
• The plaintext exception is security-sensitive even though the diff keeps public and tailnet cleartext blocked.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 60171e863882.