title: Docker update managed restart auth

scenario:
  id: docker-update-restart-auth
  surface: cli-install-update-onboard-doctor
  category: cli-install-update-onboard-doctor.updates-and-upgrades
  coverage:
    primary:
      - cli.managed-gateway-restart
    secondary:
      - cli.update-status-and-rpc
  objective: Verify update-owned Gateway restart works when the caller lacks service-owned auth environment.
  successCriteria:
    - The lane starts a managed token-auth Gateway.
    - "`openclaw update --yes --json` runs without inherited caller Gateway auth."
    - The update command restarts the Gateway and the normal health, ready, and RPC status probes pass afterward.
  docsRefs:
    - docs/cli/update.md
    - docs/install/updating.md
    - docs/help/testing-updates-plugins.md
  codeRefs:
    - scripts/e2e/upgrade-survivor-docker.sh
    - scripts/e2e/lib/upgrade-survivor/run.sh
    - scripts/e2e/lib/upgrade-survivor/update-restart-auth.sh
  execution:
    kind: script
    path: test/e2e/qa-lab/runtime/docker-e2e-lane.ts
    summary: Runs the existing update-restart-auth Docker E2E lane and records QA Lab evidence for managed Gateway restart coverage.
    args:
      - --lane
      - update-restart-auth