test(e2e): document platform parity coverage for WSL GPU Spark

src/lib/onboard/docker-gpu-patch-mode-selection.test.ts

@@ -42,6 +42,40 @@ function inspectFixture(): DockerContainerInspect {
 }
 
 describe("docker-gpu-patch CDI-first mode selection (#4948)", () => {
+  it("keeps Docker Desktop WSL on the compatibility selector path instead of trusting host-visible CDI", () => {
+    // #5512: Docker Desktop WSL may expose CDI spec directories while the WSL
+    // distro cannot resolve a usable nvidia.com/gpu spec. The patch must stay
+    // enabled, the OpenShell create --gpu flag must stay suppressed, and mode
+    // probing must still fall back to Docker's --gpus compatibility path if a
+    // speculative CDI probe fails.
+    expect(buildDockerGpuModeCandidates("all", { cdiAvailable: true }).map((m) => m.kind)).toEqual([
+      "cdi",
+      "gpus",
+      "nvidia-runtime",
+    ]);
+
+    const dockerRun = vi.fn((args: readonly string[]) =>
+      args.includes("--device")
+        ? {
+            status: 1,
+            stderr: "CDI device injection failed: unresolvable CDI devices nvidia.com/gpu=all",
+          }
+        : { status: 0, stdout: "probe-id" },
+    );
+    const selected = selectDockerGpuPatchMode(
+      { image: "openshell/sandbox:abc" },
+      { ...cdiHostDeps(), dockerRun },
+    );
+
+    expect(selected.mode?.kind).toBe("gpus");
+    expect(selected.mode?.label).toBe("--gpus all");
+    expect(selected.attempts.map((attempt) => [attempt.mode.kind, attempt.ok])).toEqual([
+      ["cdi", false],
+      ["gpus", true],
+    ]);
+    expect(selected.attempts[0]?.error).toContain("unresolvable CDI devices");
+  });
+
   it("prefers CDI over --gpus when the host advertises an NVIDIA CDI spec", () => {
     // Repro for #4948: on a Docker-CDI GPU host (e.g. Ubuntu 24.04 with
     // /etc/cdi/nvidia.yaml), `docker create --gpus all` is *accepted* so the

src/lib/onboard/docker-gpu-patch.test.ts

@@ -794,6 +794,37 @@ describe("docker-gpu-patch sandbox DNS fallback (#3579)", () => {
     expect(args).not.toEqual(expect.arrayContaining(["--network", "host"]));
     expect(args).toEqual(expect.arrayContaining(["--dns", "8.8.8.8"]));
   });
+
+  it("keeps the DGX Spark DNS workaround diagnostic-only unless the host exposes an upstream resolver", () => {
+    const loopbackFiles: Record<string, string> = {
+      "/etc/resolv.conf": "nameserver 127.0.0.53\n",
+      "/run/systemd/resolve/resolv.conf": "nameserver 8.8.8.8\n",
+    };
+    const sparkFiles: Record<string, string> = {
+      "/etc/resolv.conf": "nameserver 10.18.1.96\n",
+    };
+    const loopbackOnly = detectSandboxFallbackDns({
+      readFile: (p: string): string | null => loopbackFiles[p] ?? null,
+    });
+    const sparkManagedDns = detectSandboxFallbackDns({
+      readFile: (p: string): string | null => sparkFiles[p] ?? null,
+    });
+
+    expect(loopbackOnly).toBe("8.8.8.8");
+    expect(sparkManagedDns).toBeNull();
+
+    const inspect = inspectFixture();
+    const preservedArgs = buildDockerGpuCloneRunArgs(inspect, buildDockerGpuMode("gpus"), {
+      sandboxFallbackDns: sparkManagedDns,
+    });
+    expect(preservedArgs).not.toEqual(expect.arrayContaining(["--dns"]));
+    expect(preservedArgs).not.toEqual(expect.arrayContaining(["--network", "host"]));
+
+    const patchedArgs = buildDockerGpuCloneRunArgs(inspect, buildDockerGpuMode("gpus"), {
+      sandboxFallbackDns: loopbackOnly,
+    });
+    expect(patchedArgs).toEqual(expect.arrayContaining(["--dns", "8.8.8.8"]));
+  });
 });
 
 // Jetson `/dev/nvmap` group-permission propagation (#4231). The reporter's

src/lib/onboard/gateway-sandbox-reachability.test.ts

@@ -467,6 +467,26 @@ describe("formatSandboxBridgeUnreachableMessage", () => {
     expect(msg).toContain("host-gateway");
     expect(msg).not.toContain("ufw allow");
   });
+
+  it("keeps Docker Desktop WSL host-gateway failures retryable instead of suggesting UFW", () => {
+    const msg = formatSandboxBridgeUnreachableMessage(
+      {
+        ok: false,
+        reason: "tcp_failed",
+        routeKind: "host_gateway",
+        networkName: "openshell-docker",
+        subnet: "172.19.0.0/16",
+        detail: "sandbox container could not reach host.openshell.internal:8080",
+      },
+      8080,
+      { isWsl: true },
+    );
+
+    expect(msg).toContain("host-gateway");
+    expect(msg).toContain("Restart Docker and the OpenShell gateway");
+    expect(msg).not.toContain("ufw allow");
+    expect(msg).not.toContain("127.0.0.1");
+  });
 });
 
 describe("tryAutoApplyUfwRule (#4265)", () => {

src/lib/onboard/preflight-cdi.test.ts

@@ -340,4 +340,22 @@ describe("planHostRemediation — CDI", () => {
       ),
     ).toBe(true);
   });
+
+  it("still blocks with install_nvidia_container_toolkit when nvidia-smi is unavailable but PCI GPU context exists", () => {
+    const actions = planHostRemediation(
+      baseAssessment({
+        cdiNvidiaGpuSpecMissing: true,
+        hasNvidiaGpu: true,
+        nvidiaContainerToolkitInstalled: false,
+      }),
+    );
+
+    const actionIds = actions.map((entry) => entry.id);
+    expect(actionIds.indexOf("install_nvidia_container_toolkit")).toBeGreaterThanOrEqual(0);
+    expect(actionIds).not.toContain("generate_nvidia_cdi_spec");
+    const toolkitAction = actions.find((entry) => entry.id === "install_nvidia_container_toolkit");
+    expect(toolkitAction?.blocking).toBe(true);
+    expect(toolkitAction?.commands.join("\n")).toContain("nvidia-container-toolkit");
+    expect(toolkitAction?.commands.join("\n")).toContain("nvidia-ctk cdi generate");
+  });
 });

test/e2e-scenario/support-tests/platform-parity-workflow-boundary.test.ts

@@ -0,0 +1,83 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { describe, expect, it } from "vitest";
+
+import {
+  evaluateE2eVitestWorkflowDispatchSelectors,
+  readFreeStandingJobsInventory,
+  validateE2eVitestScenariosWorkflowBoundary,
+} from "../../../tools/e2e-scenarios/workflow-boundary.mts";
+import { canonicalScenarios } from "../scenarios/scenarios/baseline.ts";
+
+describe("P0-E platform parity workflow coverage", () => {
+  it("keeps the WSL platform scenario on a Windows WSL runner boundary", () => {
+    const wsl = canonicalScenarios().find((entry) => entry.id === "wsl-repo-cloud-openclaw");
+    expect(wsl).toBeDefined();
+
+    expect(wsl.environment).toMatchObject({
+      platform: "wsl-local",
+      runtime: "docker-running",
+      onboarding: "cloud-openclaw",
+    });
+    expect(wsl.runnerRequirements).toEqual(expect.arrayContaining(["windows-latest", "wsl2"]));
+    expect(wsl.suiteIds).toContain("platform-wsl");
+    expect(wsl.requiredSecrets).toContain("NVIDIA_INFERENCE_API_KEY");
+
+    expect(
+      evaluateE2eVitestWorkflowDispatchSelectors({ scenarios: "wsl-repo-cloud-openclaw" }),
+    ).toMatchObject({
+      valid: true,
+      liveScenariosRuns: true,
+      registryScenarios: ["wsl-repo-cloud-openclaw"],
+      selectedFreeStandingJobs: [],
+    });
+  });
+
+  it("keeps GPU, Spark, and Jetson platform selectors explicit and routable", () => {
+    expect(validateE2eVitestScenariosWorkflowBoundary()).toEqual([]);
+
+    const inventory = readFreeStandingJobsInventory();
+    expect(inventory.scenarioToJob.get("gpu-e2e")).toBe("gpu-e2e-vitest");
+    expect(inventory.scenarioToJob.get("gpu-double-onboard")).toBe("gpu-double-onboard-vitest");
+    expect(inventory.scenarioToJob.get("spark-install")).toBe("spark-install-vitest");
+    expect(inventory.scenarioToJob.get("jetson-nvmap-gpu")).toBe("jetson-nvmap-gpu-vitest");
+
+    expect(evaluateE2eVitestWorkflowDispatchSelectors({ scenarios: "gpu-e2e" })).toMatchObject({
+      valid: true,
+      liveScenariosRuns: false,
+      selectedFreeStandingJobs: ["gpu-e2e-vitest"],
+      registryScenarios: [],
+    });
+    expect(
+      evaluateE2eVitestWorkflowDispatchSelectors({ scenarios: "gpu-double-onboard" }),
+    ).toMatchObject({
+      valid: true,
+      liveScenariosRuns: false,
+      selectedFreeStandingJobs: ["gpu-double-onboard-vitest"],
+      registryScenarios: [],
+    });
+    expect(
+      evaluateE2eVitestWorkflowDispatchSelectors({ scenarios: "spark-install" }),
+    ).toMatchObject({
+      valid: true,
+      liveScenariosRuns: false,
+      selectedFreeStandingJobs: ["spark-install-vitest"],
+      registryScenarios: [],
+    });
+
+    // Jetson/Tegra hardware is still an explicit-only route; do not imply the
+    // default full-suite dispatch proved /dev/nvmap group behavior.
+    expect(evaluateE2eVitestWorkflowDispatchSelectors({}).selectedFreeStandingJobs).not.toContain(
+      "jetson-nvmap-gpu-vitest",
+    );
+    expect(
+      evaluateE2eVitestWorkflowDispatchSelectors({ scenarios: "jetson-nvmap-gpu" }),
+    ).toMatchObject({
+      valid: true,
+      liveScenariosRuns: false,
+      selectedFreeStandingJobs: ["jetson-nvmap-gpu-vitest"],
+      registryScenarios: [],
+    });
+  });
+});