Problem

PR #2472 deleted the entire cloud-experimental-e2e job definition (106 lines) from nightly-e2e.yaml. This was the only E2E job that tested:

• Landlock read-only enforcement (04-landlock-readonly.sh) — 8 assertions on .bashrc, .profile, .openclaw, .openclaw-data, /tmp
• API key leak detection (03-security-checks.sh) — verifies key not in ps output
• openclaw tui smoke (Phase 5e) — expect-driven TUI launch inside sandbox
• Live chat via openclaw agent (Phase 5b) — inference through the sandbox
• Skill injection + agent verification (Phase 5d)
• inference.local HTTPS (02-inference-local-http.sh)

Impact of Removal

Bug 2 of the weekend regression (gateway token externalization, #2482) broke openclaw tui in both root and non-root modes. Phase 5e would have caught this within hours of #2378 merging — before it compounded with the other two bugs.

What Changed

Previously cloud-experimental-e2e was disabled via a repo variable (CLOUD_EXPERIMENTAL_E2E_ENABLED). All four original blockers from #2104 are resolved. Instead of re-enabling, #2472 removed the job definition entirely.

The test scripts still exist:

• test/e2e/test-e2e-cloud-experimental.sh
• test/e2e/e2e-cloud-experimental/checks/*.sh
• test/e2e/e2e-cloud-experimental/openclaw-tui-in-sandbox.sh

Action

1. Restore the cloud-experimental-e2e job to nightly-e2e.yaml (the deleted YAML from fix(sandbox): fix non-root gateway startup and add crash safety net #2472 is the template)
2. Remove the feature-flag gate — run unconditionally like all other nightly jobs
3. If Phase 5f (check-docs) is flaky, skip it via E2E_CLOUD_EXPERIMENTAL_SKIP_TAGS=phase5f — do NOT disable the entire job
4. Add to notify-on-failure needs list
5. Move test/e2e/e2e-cloud-experimental/skip/04-nemoclaw-openshell-status-parity.sh from skip/ to checks/ — this test calls nemoclaw <sandbox> status which is the exact command that hung in the refactor(cli): extract dashboard delivery chain into contract/health/recover modules #2398 regression. Promoting it to an active check ensures the status/recovery path is exercised every nightly run.

Context

• Removed in: fix(sandbox): fix non-root gateway startup and add crash safety net #2472
• Original triage: Nightly E2E: triage & fix plan for 3 consistent failures on main #2104 (all 4 blockers resolved)
• Strategy doc gap: GAP 1 (non-root / Landlock), GAP 7 (coupling security to cosmetic checks)
• Weekend regression analysis: Bug 2 would have been caught by Phase 5e