fix(onboard): persist OpenClaw startup command

src/lib/actions/sandbox/process-recovery.test.ts

@@ -135,6 +135,62 @@ describe("recreated sandbox OpenShell readiness", () => {
     expect(sleeps).toEqual([3]);
   });
 
+  it("retries repeated blank OpenShell failures after an exact re-registration state", () => {
+    const captureOpenshellImpl = vi
+      .fn()
+      .mockReturnValueOnce({
+        status: 1,
+        output: OPENSHELL_TRANSIENT_ERROR_PHASE_STDERR.trim(),
+        stdout: "",
+        stderr: OPENSHELL_TRANSIENT_ERROR_PHASE_STDERR,
+      })
+      .mockReturnValueOnce({ status: 1, output: "", stdout: "", stderr: "" })
+      .mockReturnValueOnce({ status: 1, output: "", stdout: "", stderr: "" })
+      .mockReturnValueOnce({ status: 0, output: "", stdout: "", stderr: "" });
+    const beforeProbe = vi.fn(() => true);
+    const sleeps: number[] = [];
+    let nowMs = 0;
+
+    expect(
+      waitForRecreatedSandboxOpenShellReady("recreated-box", {
+        beforeProbe,
+        captureOpenshellImpl,
+        intervalSeconds: 3,
+        nowImpl: () => nowMs,
+        sleepImpl: (seconds) => {
+          sleeps.push(seconds);
+          nowMs += seconds * 1000;
+        },
+        timeoutSeconds: 10,
+      }),
+    ).toBe(true);
+    expect(beforeProbe).toHaveBeenCalledTimes(4);
+    expect(captureOpenshellImpl).toHaveBeenCalledTimes(4);
+    expect(sleeps).toEqual([3, 3, 3]);
+  });
+
+  it("keeps an isolated blank OpenShell failure terminal", () => {
+    const captureOpenshellImpl = vi.fn(() => ({
+      status: 1,
+      output: "",
+      stdout: "",
+      stderr: "",
+    }));
+    const sleeps: number[] = [];
+
+    expect(
+      waitForRecreatedSandboxOpenShellReady("recreated-box", {
+        beforeProbe: () => true,
+        captureOpenshellImpl,
+        intervalSeconds: 3,
+        sleepImpl: (seconds) => sleeps.push(seconds),
+        timeoutSeconds: 30,
+      }),
+    ).toBe(false);
+    expect(captureOpenshellImpl).toHaveBeenCalledOnce();
+    expect(sleeps).toEqual([]);
+  });
+
   it("rides out a transient Error phase past the old 30s budget by default (#7227)", () => {
     // No timeoutSeconds option and no env override: the default recovery budget
     // must be large enough (120s, aligned with connect's readiness wait) to keep

src/lib/actions/sandbox/process-recovery.ts

@@ -742,6 +742,7 @@ function waitForRecreatedSandboxOpenShellReadyResult(
       ? Math.max(1, Math.floor(timeoutSeconds / intervalSeconds) + 1)
       : Math.max(1, Math.floor(timeoutSeconds) + 1);
   let lastOpenshellError: string | undefined;
+  let sawRetryableReRegistrationState = false;
 
   for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
     const preGuardRemainingMs = deadlineMs - now();
@@ -785,10 +786,26 @@ function waitForRecreatedSandboxOpenShellReadyResult(
     // mutation outcome to reconcile. Treat that exact timeout as inconclusive
     // and retry behind the pinned managed-health guard on the next iteration.
     // All other unexpected OpenShell failures remain definitive.
-    if (
-      !isRetryableOpenshellReRegistrationState(result, sandboxName) &&
-      !isCommandTimeout(result)
-    ) {
+    const retryableReRegistrationState = isRetryableOpenshellReRegistrationState(
+      result,
+      sandboxName,
+    );
+    if (retryableReRegistrationState) {
+      sawRetryableReRegistrationState = true;
+    }
+    // OpenShell 0.0.85 can follow its exact phase/session transition response
+    // with one or more blank exit-1 results while the replacement registration
+    // settles. A blank failure is inconclusive only after this loop observed a
+    // known retryable state and while the pinned managed-health guard continues
+    // to pass. Remove this follow-up when supported OpenShell versions keep
+    // returning a structured transition response until exec is available.
+    const retryableEmptyFollowUp =
+      sawRetryableReRegistrationState &&
+      result.status === 1 &&
+      !result.error &&
+      String(result.stdout ?? "").trim() === "" &&
+      String(result.stderr ?? "").trim() === "";
+    if (!retryableReRegistrationState && !retryableEmptyFollowUp && !isCommandTimeout(result)) {
       return {
         failure: "openshell-readiness-failure",
         openshellError: lastOpenshellError,

test/e2e/live/sandbox-survival.test.ts

@@ -5,8 +5,8 @@
  *
  * Preserves the real boundaries: install.sh/onboard, Docker, OpenShell
  * gateway stop/start, NemoClaw registry/list/status, sandbox SSH/exec, durable
- * /sandbox/.openclaw state markers, and inference.local chat completion before
- * and after gateway restart.
+ * /sandbox/.openclaw state markers, OpenClaw gateway health after restart, and
+ * inference.local chat completion before and after gateway restart.
  */
 
 import fs from "node:fs";
@@ -115,6 +115,7 @@ test(
         "NemoClaw registry, nemoclaw list/status, and openshell sandbox list discover the sandbox",
         "OpenShell version supports gateway resume and state persistence",
         "sandbox exec/SSH-equivalent access works before and after gateway restart",
+        "OpenClaw gateway health is restored after the OpenShell gateway restart",
         "inference.local returns a live PONG before and after gateway restart",
         "markers under /sandbox/.openclaw survive the gateway stop/start cycle",
         "final destroy removes the sandbox from NemoClaw registry/list state",
@@ -324,6 +325,7 @@ test(
       artifactName: "post-restart-nemoclaw-status",
       timeoutMs: 120_000,
     });
+    await stateValidation.from("cloud-openclaw-ready", instance);
     await expectSandboxExecAlive(SANDBOX_NAME, execShell, "post-restart-sandbox-exec-alive");
     await stateValidation.expectSandboxMarkers(instance, markers, "post-restart-marker-read");
     await stateValidation.expectSandboxDirectoryPopulated(
@@ -360,6 +362,7 @@ test(
       assertions: {
         installCompleted: install.exitCode === 0,
         registryListedBeforeRestart: true,
+        openClawGatewayHealthyAfterRestart: true,
         inferenceLocalBeforeRestart: true,
         markersPersistedAfterRestart: true,
         inferenceLocalAfterRestart: true,