[WSL2][Onboard] OpenClaw sandbox enters Error phase during onboarding after Ready is observed without durable create identity

[lyral-commits]

Description

On WSL2 ARM with Docker Desktop integration, OpenClaw onboarding can report that a sandbox reached Ready before OpenShell returned exactly one durable create identity, then the sandbox enters Error phase before onboarding completes. The command exits nonzero during setup, so downstream sandbox lifecycle assertions cannot run.

Platform scope: Reproduced on WSL2 ARM release-validation runner. The current evidence is OpenClaw-specific; NemoHermes has a similar but separate open issue in GitHub #10412.
Regression: Unknown — earlier versions were not retested for this exact OpenClaw WSL2 ARM durable-create-identity path.
OpenShell issue: Unknown — the user-facing failure is NemoClaw OpenClaw onboarding, while the failing phase is managed OpenShell sandbox creation / durable identity handoff.

Environment

Device:        WSL2 ARM release-validation runner with Docker Desktop integration
OS:            Ubuntu under WSL2 on Windows ARM64
Architecture:  aarch64
Node.js:       v22.23.2
npm:           10.9.x
Docker:        Docker Desktop integration, docker-desktop runtime
OpenShell CLI: openshell 0.0.106
NemoClaw:      v0.0.116
OpenClaw:      N/A; onboarding did not complete

Steps to Reproduce

1. On a WSL2 ARM host with Docker Desktop integration, install NemoClaw v0.0.116.
2. Start OpenClaw onboarding non-interactively for a named sandbox with a valid provider route and sandbox GPU disabled.
3. Wait for the sandbox creation step.
4. Observe the durable create identity / readiness handoff before onboarding completes.

Expected Result

OpenClaw onboarding should either complete successfully and return one durable sandbox identity for the created Ready sandbox, or fail with a clear actionable reason before reporting a Ready sandbox.

Actual Result

The sandbox reaches Ready before OpenShell returns one exact durable create identity. Shortly afterward the same sandbox enters Error phase before onboarding completes. NemoClaw exits nonzero and no test-level OpenClaw lifecycle behavior can execute.

Logs

Sanitized representative excerpts:

Create-attempt label reported that sandbox reached Ready before OpenShell returned one exact durable create identity. The message stated that OpenShell did not return one durable identity for the sandbox and gateway.

Then onboarding failed with:
  Error: Sandbox entered Error phase before it became ready.

The same pattern reproduced for multiple OpenClaw sandbox names in the same WSL2 ARM validation run, including the default sandbox path and named lifecycle test sandboxes.