Best possible solution:

Land the narrow test-only listener-ordering fix after required CI finishes, keeping production static server behavior unchanged.

Do we have a high-confidence way to reproduce the issue?

Yes for source-level reproduction: current main awaits server shutdown before registering the client close listener, and the PR body links a Linux Node 24 CI failure. This read-only review did not rerun the flaky test locally.

Is this the best way to solve the issue?

Yes. Creating the close promise before server.close() is the narrowest maintainable fix, matches a sibling socket-cleanup test pattern, and avoids increasing timeouts or changing production code.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 5361e5a0b455.

Label changes:

• add P3: This is a low-risk test/CI flake fix with no user-facing runtime behavior change.
• add rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The external-contributor proof gate does not apply to this maintainer-labeled PR, and the body still includes local, Linux Node 24 Testbox, stress, and changed-gate terminal evidence.

Label justifications:

• P3: This is a low-risk test/CI flake fix with no user-facing runtime behavior change.
• rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The external-contributor proof gate does not apply to this maintainer-labeled PR, and the body still includes local, Linux Node 24 Testbox, stress, and changed-gate terminal evidence.

PR surface:

Tests +3. Total +3 across 1 file.

What I checked:

• Live PR state: Live GitHub data shows this is an open, mergeable maintainer-labeled PR by a repository member, with one test file changed and no review comments. (039beec125d8)
• Patch shape: The diff moves socket close subscription ahead of server.close() and reuses the already-created promise in the later timeout race. (test/scripts/openclaw-cross-os-release-checks.test.ts:974, 039beec125d8)
• Current-main race: Current main writes the request, awaits server.close(), and only then registers socket.once("close"), so a close event emitted during shutdown can be missed by the test. (test/scripts/openclaw-cross-os-release-checks.test.ts:977, 5361e5a0b455)
• Server shutdown behavior: The static file server destroys tracked sockets before and after calling server.close(), which supports the PR's ordering concern without requiring production code changes. (scripts/openclaw-cross-os-release-checks.ts:4131, 5361e5a0b455)
• Sibling test pattern: A nearby socket-cleanup test in the QA OTEL suite creates the socket close promise before calling the receiver close method, matching this PR's safer listener ordering. (test/e2e/qa-lab/runtime/qa-otel-smoke.e2e.test.ts:350, 5361e5a0b455)
• Canonical search: Targeted GitHub searches did not find a duplicate PR or issue for the socket-close race; related cross-OS release-check results were adjacent but different causes.

Likely related people:

• onutc: Authored and merged the native cross-OS release validation PR that added the central script and test files. (role: introduced behavior; confidence: high; commits: 900e291f31fd, f89437825361; files: scripts/openclaw-cross-os-release-checks.ts, test/scripts/openclaw-cross-os-release-checks.test.ts)
• vincentkoc: Recently merged release-smoke changes touching the same cross-OS release-check script and test file. (role: recent area contributor; confidence: medium; commits: 3a8ab36310fd; files: scripts/openclaw-cross-os-release-checks.ts, test/scripts/openclaw-cross-os-release-checks.test.ts)
• RomneyDa: Besides authoring this PR, previously authored merged release workflow matrix work in the same release-validation area. (role: adjacent release CI contributor; confidence: medium; commits: bc965c03c06b, 039beec125d8; files: .github/workflows/openclaw-live-and-e2e-checks-reusable.yml, test/scripts/openclaw-cross-os-release-checks.test.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.