Restored snapshot pairing can fail while pending device state is published

[prekshivyas]

Investigation Summary

• Trusted E2E run 30648708768 passed issue-4462-scope-upgrade-approval but failed snapshot-commands on the same PR head.
• The restored clone reported list-failed; the later authenticated verifier reported scope-upgrade-pending with approval=list-failed.
• The failure occurs after the restored gateway warm-up, while devices/pending.json can be published concurrently.
• Focused reproduction confirms a partial JSON observation can make restored-clone approval exit before selecting the exact local request.
• Unsafe filesystem shapes and persistently malformed state must continue to fail closed.

Description

Restoring a snapshot can leave the clone in restored-pairing-unverified even though the fresh-onboard scope-upgrade path passes. The one-shot restored-clone approval reads devices/pending.json immediately after gateway warm-up. If it observes the file before publication completes, it returns list-failed; the pending scope upgrade remains unapproved and authenticated verification fails.

Expected behavior: the restored clone should tolerate only bounded publication-in-progress observations, approve the same exact local scope-upgrade request through the canonical OpenClaw command, and preserve every existing fail-closed check for unsafe or persistently malformed state.

Evidence: https://github.com/NVIDIA/NemoClaw/actions/runs/30648708768/job/91216677526

Reproduction Steps

1. Use the trusted PR E2E gate on the head of PR fix(snapshot): isolate pairing modes and bound recovery #8015.
2. Select both issue-4462-scope-upgrade-approval and snapshot-commands.
3. Observe that the fresh-onboard scope-upgrade target passes.
4. Observe that snapshot restore can return restored-pairing-unverified with scope-upgrade-pending; approval=list-failed.

Environment

• NemoClaw: PR fix(snapshot): isolate pairing modes and bound recovery #8015 head 5be51ee8ac26c9e7522e2d607972915de9e1c43e
• Runner: repository trusted E2E workflow on an ephemeral Brev instance
• Target: snapshot-commands
• Related target: issue-4462-scope-upgrade-approval

Debug Output

The trusted artifact e2e-snapshot-commands records:

the authenticated gateway verification run failed (scope-upgrade-pending; approval=list-failed)

No credentials or raw device-state records are included here.

Checklist

• I confirmed this bug is reproducible
• I searched existing issues and this is not a duplicate

[wscurran]

✨ Thanks for the detailed investigation. The race condition in restored-clone approval reading pending.json before publication completes is clear. Maintainers will review the fix in PR #8015 and the stabilization in PR #8021.

---

Related open PRs:

• #8015 fix(snapshot): isolate pairing modes and bound recovery