Best possible solution:

Land the scheduler-level isolation after final PR or merge-result QA checks, keeping Docker lane behavior unchanged and preventing package-mutating scripts from overlapping flow Gateways.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main includes the script-backed Docker scenario and still schedules test-file work alongside flow partitions, while the linked issue and Actions evidence show missing shared dist files under that mixed selection; I did not rerun the expensive smoke path locally.

Is this the best way to solve the issue?

Yes. The scheduler is the best layer because the failure comes from package-mutating script scenarios overlapping flow Gateway processes, not from a specific Docker lane implementation.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against ab9e233d02a8.

Label changes:

• add P2: This fixes a normal-priority QA Smoke orchestration bug that blocks maintainer validation for mixed flow plus Docker script selections without directly breaking released user runtime behavior.
• add merge-risk: 🚨 automation: The diff changes QA suite scheduling, so merge safety depends on accepting the CI/proof-runtime tradeoff beyond ordinary unit correctness.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The external-contributor proof gate does not apply to this maintainer-labeled MEMBER PR; the PR body still provides failure evidence, focused test output, Testbox proof, and linked Actions runs for maintainer review.

Label justifications:

• P2: This fixes a normal-priority QA Smoke orchestration bug that blocks maintainer validation for mixed flow plus Docker script selections without directly breaking released user runtime behavior.
• merge-risk: 🚨 automation: The diff changes QA suite scheduling, so merge safety depends on accepting the CI/proof-runtime tradeoff beyond ordinary unit correctness.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The external-contributor proof gate does not apply to this maintainer-labeled MEMBER PR; the PR body still provides failure evidence, focused test output, Testbox proof, and linked Actions runs for maintainer review.

PR surface:

Source +19, Tests +72. Total +91 across 2 files.

What I checked:

• Repository policy read: Root AGENTS.md and scoped extensions/AGENTS.md were read; their deep PR review, protected maintainer item, and plugin-boundary guidance apply to this QA Lab PR. (AGENTS.md:1, ab9e233d02a8)
• Current main still overlaps flow and test-file work: Current main builds one test-file partition from all execution kinds and schedules it together with shared and isolated flow partitions in the weighted runner, so script scenarios can overlap flow Gateways. (extensions/qa-lab/src/suite-launch.runtime.ts:538, ab9e233d02a8)
• Merged Docker script scenario exposes the race on main: Current main includes docker-npm-onboard-channel-agent as execution.kind script, and the Docker package helper can run package-openclaw-for-docker when no reusable tarball is supplied. (qa/scenarios/runtime/docker-npm-onboard-channel-agent.yaml:26, ab9e233d02a8)
• PR isolates script scenarios after flow work: On the PR head, non-script test-file scenarios are filtered into concurrent partitions while script scenarios are kept for a second serial weighted run after all concurrent flow work completes. (extensions/qa-lab/src/suite-launch.runtime.ts:573, eb48efc7294a)
• Regression test covers the scheduling invariant: The added test blocks a flow run, verifies the Playwright scenario starts while flow is active, then verifies the script scenario runs only after the flow is released. (extensions/qa-lab/src/suite-launch.runtime.test.ts:377, eb48efc7294a)
• Linked issue and merged exposing PR: Live GitHub context shows this PR closes [Bug]: QA Smoke scripts can invalidate dist used by flow Gateways #99734, and improve(qa): execute runtime scenarios through Docker #99705 has merged, making the script-backed Docker scenarios part of current main.

Likely related people:

• RomneyDa: GitHub path history shows repeated merged work introducing and refining unified QA suite execution, test-file routing, and smoke-profile scheduling in the files touched by this PR. (role: recent QA Lab scheduler contributor; confidence: high; commits: 561b293c7a96, 438f208a7666, f29dbd3ebd1c; files: extensions/qa-lab/src/suite-launch.runtime.ts, extensions/qa-lab/src/suite-launch.runtime.test.ts, extensions/qa-lab/src/test-file-scenario-runner.ts)
• Solvely-Colin: Commit 4ae0a5d added the QA smoke profile CI workflow path and guard tests where the shared-dist race is observed. (role: CI smoke profile introducer; confidence: medium; commits: 4ae0a5d958a0; files: .github/workflows/ci.yml, docs/ci.md, test/scripts/ci-workflow-guards.test.ts)
• vincentkoc: Recent history on the test-file scenario runner includes script timeout and process-tree handling, which is adjacent to the script execution path isolated by this PR. (role: test-file runner adjacent contributor; confidence: medium; commits: 405e5072fd51, a6e41a0cc1b8, fd66b44f5e2c; files: extensions/qa-lab/src/test-file-scenario-runner.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.