test(snapshot): name capture boundaries precisely

Author: cv

src/lib/actions/sandbox/snapshot/backup-authority.test.ts

@@ -191,7 +191,7 @@ describe("managed snapshot backup authority", () => {
     privilegedCaptureMocks.withPrivilegedSandboxExecutionLease.mockClear();
   });
 
-  it("captures the exact OpenClaw config through bounded privileged execution", () => {
+  it("captures the exact OpenClaw configuration with bounded privileged execution", () => {
     const data = Buffer.from('{"models":{"default":"nvidia/test"}}\n');
     privilegedCaptureMocks.dockerSpawnSync.mockReturnValue({
       status: 0,
@@ -247,7 +247,7 @@ describe("managed snapshot backup authority", () => {
     expect(result).toEqual({ outcome: "missing" });
   });
 
-  it("fails closed with a fixed privileged safety reason", () => {
+  it("returns a fixed failure reason when privileged capture rejects unsafe file metadata", () => {
     privilegedCaptureMocks.dockerSpawnSync.mockReturnValue({
       status: 11,
       signal: null,

src/lib/state/sandbox.ts

@@ -176,7 +176,7 @@ export interface BackupOptions {
    */
   validateBeforePublish?: () => void;
   /**
-   * Internal fallback for a declared state file that the sandbox-user SSH
+   * Internal capture path for a declared state file that the sandbox-user SSH
    * transport cannot read. The caller must independently enforce path,
    * identity, and stable-read constraints before returning bytes.
    */

test/openclaw-config-snapshot.test.ts

@@ -121,7 +121,7 @@ function writeOpenClawRegistry(sandboxName: string): void {
 }
 
 describe("OpenClaw durable config file (#5027)", () => {
-  it("falls back to a managed stable capture when SSH cannot read the sealed config", () => {
+  it("uses a supplied state-file capture when SSH cannot read openclaw.json", () => {
     const fixture = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-sealed-config-snapshot-"));
     const oldPath = process.env.PATH;
     const oldOpenshell = process.env.NEMOCLAW_OPENSHELL_BIN;