…eload loop

- Revert duplicate openclaw.host.setup.{local,docker,ssh} command
  registrations in the main extension (93953d5). The adapter extensions
  openclaw-{local,docker,ssh} already register them and route to the
  dedicated setup panels; the duplicates were clobbering that and making
  the host-picker cards a no-op.
- Collapse HomePanel picker rendering to a single 3-card view
  (Local / Docker / SSH). Delete the 2-card _getHostsOverviewHtml and
  its _handleCheckHostsStatus helper. Cancel from Docker setup now
  returns to the same 3-card picker the user came from, not a
  different 2-card screen.
- Fuse remove+add into one atomic updateWorkspaceFolders call in
  _applyActiveOpenClawWorkspaceFolder. VS Code rejects concurrent
  update ops, so the old two-step version often dropped the add and
  left folders=[] in the .code-workspace file; openOpenClawFolder then
  rewrote it to [~/.openclaw] on every activate, and the resulting
  external file change triggered a reload loop that flipped the user
  between the home picker and the status page.
- Stop rewriting My OpenClaw Workspace.code-workspace once it exists.
  The status controllers legitimately swap folders per-host; rewriting
  back to a hard-coded ~/.openclaw was half of the loop above.
- Demote the 5 GB Docker data-dir check from a hard error to a soft
  warning. _runValidationChecks now returns { errors, warnings }; the
  data-dir field shows an amber advisory instead of a red blocker and
  the Next button stays enabled. Copy is plain English, no jargon.

Co-Authored-By: Claude Haiku 4.5 <[email protected]>

"Open Web Control" used ConfigPanel.createOrShow to render an iframe at
http://127.0.0.1:<proxyPort>/ inside a webview. When the editor is
served from any host other than `localhost` (the normal case for
code-server, SSH port forwards, or a remote dev box), Chrome's Local
Network Access policy classifies the top-level page as "public" and
blocks the private-network iframe load:

  "The connection is blocked because it was initiated by a public page
   to connect to devices or servers on your local network."

Swap the webview-iframe path for vscode.env.openExternal(dashInfo.url).
A top-level navigation isn't subject to LNA, so it works regardless of
where the editor is hosted. Desktop VS Code gets the same UX (system
browser tab) it already had for external links.

Keep ConfigPanel exported for any future caller and harden its _load()
with asExternalUri() in case it gets wired back in — in VS Code Web
asExternalUri tunnels a loopback URL through the editor origin, which
is the only reliable way to iframe a local port from a public-origin
page.

Add tests/e2e/open-web-control.spec.ts as a regression pin: asserts no
127.0.0.1 iframe is mounted in the editor DOM after the button click.
(Spec runs cleanly against a Playwright-owned browser; in the repo's
CDP-shared-Chrome dev setup it can hit the documented Chrome-tab-state
flake from AGENTS.md.)

Co-Authored-By: Claude Haiku 4.5 <[email protected]>

… + auth gate

- 08-ui-design.md §0: replace noisy ASCII flow with a rendered PlantUML activity
  diagram (monochrome, orthogonal arrows), modelled after the ProcessOn template.
  Added §0a "Status Panel — Offline & Control" covering Start/Stop/Restart
  buttons and the Reconfigure escape hatch. New flow rules codify:
    - auth gate before gateway detection (ticket-052-adjacent work)
    - setup completion re-enters HomePanel._update(), not Status directly
    - persisted host choice beats gateway reachability for view routing (053)
- diagrams/startup-flow.puml + .svg + .png + render.sh: PlantUML source and
  rendered outputs; render.sh uses plantuml/plantuml:latest via docker.
- 01-host-registry.md: clarify that activeHostId alone cannot infer
  "user completed setup" — defer to ticket-053's chosenHostType marker.
- 04-local-adapter.md + 05-docker-adapter.md: document gatewayStart/Stop/Restart
  semantics per adapter (local → openclaw gateway start|stop|restart;
  docker → docker compose -f docker/docker-compose.openclaw.yml up -d|down|restart).
- 12-testing.md: append E2E scenarios for ticket-053 invariants.
- docker-compose.yml: reduce NODE_OPTIONS heap from 7096 MB to 2048 MB to
  match the host's available RAM and stop the OOM-kill restart loop
  (watch-client / watch-extensions exit 137 after clean compile).

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

…e, surface gateway controls

Ticket-052 — flicker on setup completion:
- home.ts:454 picker gate no longer conflates "Docker is running" with
  "user hasn't chosen a host". onDidChangeViewState re-entries now render
  Status instead of snapping back to step 1 of the wizard.
- HomePanel registers a process-global 'openclaw.home.refresh' command in
  its constructor (deliberately not disposed with the panel — survives
  setup-panel lifecycle so DockerSetupPanel can signal completion).
- DockerSetupPanel._handleLaunchGateway replaces the old direct
  _showStatusPanel() swap with 'openclaw.home.refresh' dispatch, honouring
  flow Rules 2/4: setup panels hand control back to the detection node
  (HomePanel._update), which owns the Status-vs-picker decision.
- Buffered webview postMessage during StatusPanelController init to close
  the race window where launchDone could be dropped mid-init.

Ticket-053 — persist host choice + gateway lifecycle control:
- hosts/types.ts: new HOST_CHOICE_TYPES const-union ('local'|'docker'|'ssh')
  and optional chosenHostType on HostsFile. HostsFile.activeHostId alone
  cannot disambiguate "default local seed" from "user completed local setup"
  — chosenHostType is the explicit marker written only on wizard success.
- hosts/registry.ts + manager.ts: markActiveHostChosen / clearActiveHostChoice
  / getChosenHostType with pass-throughs on OpenClawCoreAPI.
- extension.ts: new 'openclaw.host.markChosen' and 'openclaw.host.reconfigure'
  VS Code commands.
- DockerSetupPanel and LocalSetupPanel await markChosen('docker'|'local')
  before dispatching openclaw.home.refresh, so HomePanel._update sees the
  persisted marker on its next tick.
- home.ts readChosenHostType() reads ~/.occ/hosts.json directly; picker
  gate routes on the marker rather than on live gateway reachability. Adds
  a one-time legacy backfill so upgraded installs with a local config but
  no chosenHostType are not kicked back to the picker.
- _handleGatewayAction rewired to call this._host.gatewayStart/Stop/Restart
  (was misrouting to void.openChatWithMessage). statusHtml.ts adds a
  "Pick Different Host" button wired to the new reconfigure command.

Auth gate (adjacent, per docs/plans/multihost/08-ui-design.md §0 Rule 1):
- New authGate.ts: AuthGatePanel webview opens when context.secrets has no
  JWT, presents Sign In / Sign Up that deep-link to occ.mba.sh; resolves
  once the occode:///auth?token=... handler stores the JWT and fires
  onAuthCompleted. HomePanel never opens before auth completes.
- extension.ts activation awaits initAuthGate before routeHome.

Playwright regression coverage:
- docker-to-ide-flow.spec.ts: new @slow tests assert Status page is
  rendered after gateway connect and remains stable across webview
  visibility toggles (no host-picker DOM after completion).
- onboarding-auth.spec.ts: auth-gate-on-unauthenticated-startup coverage
  and post-deep-link handoff back into routeHome.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>