> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.nvidia.com/nemoclaw/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/nemoclaw/_mcp/server. # Recover and Rebuild Sandboxes > Recover a stopped agent runtime or rebuild a sandbox while preserving supported state. Use the lightest recovery operation that repairs the sandbox while preserving its supported state. ## Restart a Stopped Sandbox Container If NemoClaw reports that a Docker-driver sandbox is stopped, restart the existing container: ```bash nemohermes start ``` This path preserves the sandbox workspace and repairs the agent runtime and host-side forwards after the container starts. If the container is paused, follow the printed `docker unpause` guidance instead. If Docker no longer has the container, destroy the stale NemoClaw entry and onboard a clean replacement. Restore a separately created snapshot afterward if one is available; rebuild cannot recover a workspace or live OpenShell policy that no longer exists. The `start` command returns success only after it authenticates the recovered agent runtime, OpenShell reports the sandbox ready, and host-side port forwards pass their checks. If a check fails, the command exits nonzero, identifies the failure, and prints recovery guidance before you retry `start`. ## Recover the Agent Runtime `recover` can start an existing stopped Docker-driver container before it repairs the agent runtime. It starts only a non-paused container that Docker still associates with the registered sandbox. It leaves a running or paused container unchanged. If Docker cannot start the container, recovery continues to the OpenShell readiness check and reports the resulting failure. If `nemohermes status` reports the sandbox container or Hermes gateway is not running, run the recover command instead of opening a shell. ```bash nemohermes recover ``` The command repairs a stopped in-sandbox gateway and re-establishes the dashboard port-forward in one step. It is idempotent and safe to script. If the gateway is already healthy, `recover` does not restart it. If the host forward is already active, recovery accepts it only after OpenShell ownership is reconciled and the local endpoint is reachable. Before it repairs the gateway, `recover` checks for a NemoClaw cron restore gate or release recovery record left by an interrupted rebuild. The gate continues to block new Hermes turns and cron dispatch across gateway and container restarts in the same sandbox. If release rollback could not restore the gate, `recover` uses the root-owned recovery record to reacquire it before gateway repair can start dispatch. After gateway repair, `recover` waits for active agent work to finish and validates the restored cron jobs and scripts. It clears NemoClaw-owned gate and release recovery state only after validation succeeds. If no independent operator drain exists, successful recovery prints `Hermes cron dispatch resumed after restored jobs and scripts were validated.` If an operator drain exists, recovery prints `Hermes cron restore gate cleared; the independent operator drain remains active.` The command does not own or clear the Hermes operator drain, so new Hermes turns and cron dispatch remain blocked while that drain is active. If gate reacquisition or cron validation fails, `recover` exits nonzero and retains the recovery state for another attempt. Portable Hermes recovery follows the exact receipt-bound start, authenticated-health, and rollback contract in the [`recover` command reference](../../reference/commands#nemoclaw-name-recover). ### Recover Portable Published Ollama When an active Portable Hermes sandbox uses a published receipt-owned Ollama runner, use one of these commands to recover it: ```bash nemohermes recover nemohermes connect --probe-only ``` These commands verify the published inference receipt, sandbox registry, provider and lifecycle authority, recovery journal, and exact Podman runtime identity. They verify and reuse an already-running exact runner without restarting it. When the exact runner is stopped, they resume only that runner; they do not select another runtime, model, network, or provider. Missing authority, a same-name replacement, or other drift stops recovery before NemoClaw treats another resource as the runner. Success requires a final route proof from inside the sandbox. Ordinary `connect` and direct `launch` do not resume the runner. If a check fails after recovery starts a stopped runner, NemoClaw restores the runner and registry to their prior states or reports that restoration could not be proved. #### Unproved Rollback If the output says that restoration could not be proved, save the complete recovery output. Run these read-only checks: ```bash nemohermes status nemohermes doctor ``` Save both results. The expected status line is `Portable lifecycle phase: active`. The expected doctor line is `Portable lifecycle: agent=Hermes; phase=active`. These results prove only that the lifecycle receipt and sandbox registry agree. They do not prove that the Podman runner returned to stopped. Preserve the applicable sandbox registry and `~/.nemoclaw/portable-inference//` directory described in [Host Files and State](../../reference/host-files-and-state). Do not edit that state, change the Podman runtime directly, or run `connect --probe-only`, `recover`, or `launch`. Ask a NemoClaw maintainer to inspect the retained runtime and registry authority before you take another recovery action. Use `gateway restart` when you intentionally need a supported Hermes gateway to reload runtime configuration or plugins. ```bash nemohermes gateway restart ``` The restart command asks the topology-specific controller to stop the tracked gateway child, wait for the entrypoint to launch a replacement, and prove listener and HTTP health. The host then checks or recovers host-side dashboard, messaging, and agent forwards. For Hermes, the entrypoint supervisor owns the gateway, dashboard process, internal API relay, dashboard relay, and gateway log stream. The nonroot managed supervisor repairs those processes continuously, stops an alive but deaf gateway after four consecutive failed health checks, and quarantines relaunch after five exits within 60 seconds until sandbox recreation. The host does not start the in-sandbox processes independently. Refer to [`nemohermes recover`](../../reference/commands#nemohermes-name-recover) and [`nemohermes gateway restart`](../../reference/commands#nemohermes-name-gateway-restart) for details. Recovery uses registry-scoped privileged direct-container control and does not fall back to ordinary `openshell sandbox exec` or a manual in-sandbox relaunch. For a local Docker-driver sandbox whose container still uses the legacy keepalive startup, `recover` can transactionally recreate the registered container with a credential-free managed startup command. NemoClaw keeps the previous container available throughout the replacement health, OpenShell readiness, state restoration, gateway restart, and settle checks. Before recreation, NemoClaw backs up the state directories and files declared by the agent manifest. NemoClaw waits for OpenShell to re-register the exact replacement before it restores state. After state restoration, it restarts the gateway in that replacement and reruns the managed health and settle checks. It commits only after the replacement identity, state restoration, gateway restart, and settle check pass. NemoClaw removes the temporary state backup after a successful restore or rollback. If state restoration and rollback both fail, it retains the backup and prints host recovery guidance. Mounted state remains available, but a committed swap does not retain other writable-layer changes. After a transactional recreation, NemoClaw waits 120 seconds for OpenShell to re-register the sandbox before state restoration and replacement commit. Set `NEMOCLAW_GATEWAY_RECOVERY_WAIT_SECONDS` before the recovery command to change this budget. A definitive managed-health failure still stops immediately. If re-registration, state restoration, or a later gateway check fails, NemoClaw attempts to roll back the replacement and leaves the primary dashboard or API host forward stopped. If NemoClaw cannot confirm rollback to the previous container, inspect Docker state before you retry recovery. For the controller topology, trust boundary, and fail-closed conditions, refer to [Understand Gateway Lifecycle Control](../configure-sandboxes/understand-gateway-lifecycle-control). If recovery cannot repair a sandbox that needs credentials or a current controller contract, rebuild it. ### Understand Launch Readiness Leases A successful complete preflight for `nemohermes launch ` can publish a credential-free launch-readiness lease on Linux. Linux infrastructure can publish the same evidence with `nemohermes connect --probe-only`. The lease has a fixed 24-hour lifetime that repeated launches do not extend. Leaving the agent with `/exit` does not revoke it, and users do not refresh it manually. During the lease, `launch` still verifies the owning OpenShell gateway, exact live sandbox identity, registry and agent configuration, effective policy, inference route, required forwards, and semantic runtime health. Configured inference must return HTTP 2xx from the semantic `inference.local` probe, which is stricter than the HTTP 200–499 reachability diagnostic used by ordinary `connect`. Hermes and LangChain Deep Agents Code retain their existing session setup on the lease-accepted path. When those checks pass, it can skip duplicate recovery, readiness polling, and inference-route repair. The lease is not a health guarantee or repair authority. For missing, unsafe, malformed, expired, mismatched, changed, or unhealthy evidence, NemoClaw fences any prior acceptable evidence before it runs the complete preflight. Ordinary launch continues only when NemoClaw proves that no old authority or evidence can exist, or durably rotates the runtime epoch. If an old epoch might exist and cannot be durably rotated, `launch` and `connect --probe-only` stop before complete preflight or recovery. Their redacted guidance asks you to repair the current user's secure OS runtime authority and NemoClaw state permissions, then retry. If NemoClaw securely proves that both the authority and receipt are absent but cannot create new authority, ordinary `launch` can run the complete preflight without optimization; on Linux, `connect --probe-only` exits nonzero because it could not publish evidence. If that preflight succeeds before the lease expires, replacement evidence keeps the original start and expiry time. After expiry, a successful complete preflight starts a new 24-hour lease only when publication succeeds. Before the first mutation in the complete preflight, the producer revalidates its sandbox-global runtime epoch under the sandbox lifecycle lock followed by the owning gateway lock. It holds both locks through all mutations in the complete preflight, final state capture, and publication. A stale producer makes no changes and re-inspects the newer lease. If unsafe or malformed authority history makes the prior lease timeline untrustworthy, NemoClaw durably invalidates the old epoch and starts one conservative 24-hour quarantine. Publication remains disabled until both wall time and monotonic uptime span the full quarantine. Repeated attempts do not extend it. After it elapses, the next successful complete preflight can publish a new fixed 24-hour lease. Lease acceptance and publication are currently Linux-only and require a secure, independently writable OS per-user runtime authority under `/run/user/`. It never uses caller-provided environment variables to select this authority. On macOS, `launch` runs the complete preflight every time and does not publish a launch-readiness lease. `connect --probe-only` also runs the complete preflight, including recovery and probes. After a successful probe and recovery, it prints a note that launch-readiness evidence is unavailable on this platform and exits zero. On Linux, the publication-failure diagnostic is redacted and does not print filesystem paths or environment values. Infrastructure must run `connect --probe-only` as the same final numeric user that later runs `launch`. Run it after the final durable home and state volume is mounted and after policy and network provisioning is complete. On completion, `connect --probe-only` writes one credential-free `Probe timing:` line with elapsed milliseconds for readiness, authority, lifecycle, gateway, processes, forward, inference, pairing, and publication stages. The line also reports the lifecycle and forward actions, the result, and the failed stage when the probe fails. Timing output is diagnostic only and does not change probe success or failure. NemoClaw rejects evidence after a bound sandbox, configuration, policy, or network identity changes. Deployment ordering remains responsible for external changes that OpenShell and NemoClaw cannot observe. ### Host OpenShell Gateway Versus In-Sandbox Agent Recovery `recover` and `start` repair the in-sandbox agent gateway and the host-side port forwards for one named sandbox. `connect --probe-only` waits for that sandbox to become ready, rechecks it on its recorded gateway, and then verifies or repairs the same sandbox-scoped processes and forwards. These commands do not restart, replace, or reap the shared host OpenShell gateway process. If the host gateway RPC returns an error while these sandbox-scoped commands run, they surface the error with explicit next-step guidance and exit rather than swapping the shared gateway out from under other sandboxes. The OpenShell CLI has no command that starts a gateway, and `openshell status` only reports the gateway state. If NemoClaw starts the gateway on your host, run `nemohermes onboard` again to repair the host gateway itself. If a deployment outside NemoClaw owns the gateway process, start the gateway with that deployment, then run `openshell gateway select `. NemoClaw prints the applicable recovery guidance when a sandbox-scoped command reports that the host gateway is down. Other workflows, including onboarding, rebuild, and `doctor --fix`, can explicitly recover the named host gateway when their operation requires it. `nemohermes gateway restart` instead restarts only the supported agent gateway inside the named sandbox. ## Rebuild While Preserving State If you changed the underlying Dockerfile, upgraded Hermes, or want to pick up a new base image without losing your sandbox's state files, use `rebuild` instead of destroying and recreating. #### Legacy Upgrade Recovery Scope When the installer offers prepared backup recovery for a legacy sandbox, the recreate restores only the managed state directory recorded in the validated backup manifest, such as `/sandbox/.openclaw` or `/sandbox/.hermes`. It does not preserve files outside that recorded path, including `/sandbox/user-data`. Back up those paths outside the sandbox before you approve legacy recovery. ```bash nemohermes rebuild ``` On WSL with Docker Desktop, a generated replacement image build uses a temporary credential-free Docker configuration when the configured Docker Desktop credential helper is unavailable. NemoClaw removes the temporary configuration after the build and does not modify your Docker configuration. An explicit custom Dockerfile continues to use your configured Docker credentials because its base image or build steps might require a private registry. If that custom rebuild cannot reach the credential helper, restore the Docker Desktop session or credential-helper access before retrying. ### Resolve Rebuild Preflight Stops Before it backs up or deletes the existing sandbox, `rebuild` validates the recorded sandbox, gateway, inference route, policy, MCP, agent, and operation-lock state. When one of these checks fails, NemoClaw prints `Rebuild preflight failed`, explains how to recover, and ends with `Aborting rebuild`. At this boundary, the existing sandbox is unchanged and no sandbox data has been removed. Use the recovery guidance that matches the reported check: * Verify the sandbox name when its registry entry is missing. * Follow the printed OpenShell gateway recovery steps when the gateway schema is incompatible. * Restore access to the current OpenShell policy when rebuild reports that the live policy cannot be read, then rerun `rebuild`. NemoClaw does not reconstruct policy from registry state. * Replace literal policy credentials with supported OpenShell credential bindings or resolver placeholders when rebuild refuses the policy handoff. NemoClaw stops before it creates the handoff or changes sandbox resources. * Resolve an incomplete MCP destroy transaction before retrying. * Back up the sandbox state and recreate it with `nemohermes onboard` when the record contains multiple agents. Transactional multi-agent rebuild is not supported. * Wait for another onboarding or rebuild operation to finish before retrying. If verified stale-lock cleanup is still in progress, wait briefly and rerun the command. Do not delete the lock manually. * Set the live OpenShell inference route to the sandbox's recorded provider and model when rebuild reports route drift. A gateway that reports no live inference route does not stop the rebuild. Replacement onboarding configures and verifies the recorded route before it recreates the sandbox. The rebuild command preserves Hermes state, the complete current OpenShell policy, and managed MCP configuration while recreating the container. For that one replacement create, NemoClaw adds baseline fields required by the current replacement image when they are absent from the live policy. Existing values, network keys, and same-name live network entries win, so host changes are not overwritten. NemoClaw does not save a desired-policy copy or enforce that handoff after OpenShell creates the sandbox. It reuses a messaging provider only when its exact type and credential keys match the recorded channel binding. A stopped channel remains inactive and contributes no token upsert, rendered runtime configuration, channel startup effect, or inactive built-in messaging preset. Custom and host-edited policy entries are preserved as part of that one OpenShell policy handoff, not by a separate replay system. A policy-required provider attachment is the narrow exception: when a preserved custom policy still credential-binds stopped Hermes Discord, rebuild attaches its exact validated static provider without starting Discord. If that required provider is missing or incompatible, restore or re-add the channel credentials, then rerun the rebuild. A rebuild creates a new sandbox home and a new Hermes API bearer token. After the rebuild succeeds, retrieve the replacement token before reconnecting API clients: ```bash nemohermes gateway-token --quiet ``` Before post-restore repairs, NemoClaw verifies that the recreated sandbox still identifies as Hermes and exits nonzero if its identity does not match the rebuild target. After state restore, NemoClaw restarts the Hermes gateway so it reads the restored durable state, then restores managed MCP configuration through the normal lifecycle. MCP restoration performs an acknowledged gateway reload, so NemoClaw finishes by verifying the final running gateway and its managed MCP state without replacing that verified process again. The gateway starts during recreation and reads its durable state before the restore replaces it, which is why the first post-restore restart must happen before managed MCP restoration. `rebuild` exits nonzero instead of reporting success when it cannot verify final gateway health or managed MCP state. Follow the printed recovery guidance, using `nemohermes gateway restart` first for gateway health, `nemohermes recover` when the restart does not restore verified health, and `nemohermes mcp restart` for incomplete managed MCP restoration. When the rebuild backup contains active Hermes cron jobs that reference scripts, NemoClaw validates those script references before it deletes the existing sandbox. The check covers the default profile and named profiles. Each referenced script must exist, be readable, be a regular file, and remain inside its profile's `scripts` directory. Disabled and paused jobs do not require their referenced scripts. If this validation fails, the rebuild keeps the existing sandbox and reports the preserved backup path. After NemoClaw creates the replacement, it acquires an independent root-owned gate that blocks new Hermes turns and cron dispatch. The gate remains active across gateway and container restarts in the replacement sandbox. NemoClaw waits for active agent work to finish before restoring state. It validates the restored jobs and scripts before the gateway replacement, then keeps dispatch blocked while it restarts and verifies that replacement. It records the replacement process identity around managed health verification and clears the gate only if that same live process completes the final cron validation. If an operator already drained the gateway, NemoClaw clears its gate and release recovery record while leaving the operator drain active. If state restore, managed MCP restoration, gateway replacement, or cron validation fails after gate acquisition, the command exits nonzero and preserves the backup. Those failures retain the NemoClaw gate unless the output explicitly reports that release rollback could not restore its marker. In that exceptional case, NemoClaw preserves a root-owned release recovery record, but you must not assume dispatch is blocked. Run `nemohermes recover` immediately so it can reacquire the gate before validating the restored cron state. If gate reacquisition fails, recovery exits nonzero and leaves the recovery record in place for another attempt. Failures before gate acquisition do not create a new gate. Do not manually remove the root-owned cron restore marker or release recovery record because removal bypasses restored cron validation. If managed MCP restoration failed, correct the reported cause and run `nemohermes mcp restart` first. Then run `nemohermes recover` to repair and probe the gateway, validate the restored cron tree, and clear NemoClaw-owned cron restore recovery state. ### Continue an Interrupted Replacement Before `rebuild` deletes the existing sandbox, NemoClaw records a replacement journal in the onboarding session. The journal binds the operation to the sandbox name, recorded OpenShell gateway, source identity, and replacement settings. It stores fingerprints instead of credential values or raw OpenShell sandbox IDs. If `rebuild` stops after recording the journal, rerun the command with the same replacement settings. The rerun takes one of these actions: * It continues deletion when the live sandbox still has the journaled source identity. * It continues creation when the recorded OpenShell gateway explicitly reports the source sandbox as absent. * It accepts an existing replacement only when its live identity and sandbox registry generation match the journal. * It starts a new replacement when the journaled replacement provably never took effect. NemoClaw treats a journaled replacement as void when the sandbox registry row and the live same-name sandbox report the same OpenShell identity on the journaled gateway, and that identity is not the journaled replacement. A registry row or a live sandbox on any other gateway leaves the journal in place, because that journal may still own an unregistered replacement on its own gateway. The rerun atomically replaces the void journal with a fresh journal against that live source, without leaving an unjournaled interval. It then reports `Replaced the void replacement journal for ''; its source sandbox is registered and live.` A journal whose replacement never took therefore stops blocking `rebuild` for the rest of the session. The journal binds the durable source registry row, so it does not resume after a command that rewrites that row. Messaging channel state is exempt: `channels add`, `channels stop`, `channels start`, and `channels remove` rewrite the recorded messaging plan, and the journal ignores that field. #### Recover an Unsafe Retained Policy Handoff Do not retry rebuild when a retained policy handoff contains a literal credential. Recover any required data from the backup before deletion, and keep the backup and handoff until that recovery is complete. Restore or select the recorded gateway and confirm `openshell status` is healthy. Only then use the ordinary fail-closed destroy flow and confirm OpenShell reports the sandbox deleted: ```bash openshell gateway select openshell status nemohermes destroy --yes ``` Do not use `--force` for this recovery. If deletion is unconfirmed, preserve the local recovery state and restore gateway access. After confirmed deletion, run `nemohermes onboard --name ` and recover any required data from the retained backup. Use a new sandbox name: recovery retirement refuses while the failed sandbox name is still present on its recorded gateway. Only after the old sandbox is confirmed absent and required data recovery is complete, retire the exact failed transaction printed by rebuild: ```bash nemohermes rebuild --retire-recovery --yes ``` `--yes` confirms that required data recovery is complete. The command rechecks the old sandbox on the transaction's recorded gateway, binds cleanup to the exact sandbox and transaction, and removes that transaction's retained policy handoff and recovery marker. It cannot retire another sandbox or transaction. On failure, it prints the exact backup path that remains retained; preserve that path and retry only after correcting the reported condition. Keep the remaining backup until it is no longer needed. If retirement reports that the recovery marker is invalid or unreadable, preserve the printed backup path, marker, and policy handoff. Do not edit the marker JSON or delete either recovery file. If only the marker's mode or ownership changed, restore mode `0600` and ownership by the current NemoClaw user. Otherwise, restore the exact marker from a trusted backup of the same backup directory. Then rerun the same retirement command; it rechecks deletion on the recorded gateway before removing the handoff. If no trusted marker is available, preserve the backup and ask a NemoClaw maintainer to inspect it. A mount-free journal written before NemoClaw bound host-mount identity remains resumable. An older journal for a rebuild with one or more host mounts stops as incompatible, even when the visible mount settings are unchanged, because it cannot prove the original host source identity. Preserve the live sandbox, onboarding session, printed backup, exact error, and the sandbox name, gateway, and journal phase from the `Journaled replacement` diagnostic. Do not change the target settings, edit the session, or delete the same-name sandbox. Ask a NemoClaw maintainer to review that retained recovery state before taking another recovery action. An accepted replacement is not deleted again. A rerun that accepts a journaled Hermes replacement checks for any retained NemoClaw gate before it retires the replacement journal. When the gate exists, the rerun validates the restored cron tree and releases the gate first. If validation or gate release fails, NemoClaw preserves the accepted replacement, state backup, and replacement journal. New Hermes turns and cron dispatch remain blocked. Correct the reported restore problem, then run `nemohermes recover`. After recovery succeeds, rerun `rebuild` with the same replacement settings so NemoClaw can retire the journal. The command reports `Sandbox '' already holds the replacement from the interrupted rebuild.` and preserves the state backup path when one exists. Pass `--verbose` to include the replacement identifier, OpenShell gateway, and journal phase in rebuild diagnostics. After the sandbox registry proves the journaled replacement identity and generation, NemoClaw removes an obsolete source image that it owns. It retains the image when the source is shared or the registered replacement reuses it. If image removal fails, NemoClaw keeps the accepted replacement and tells you to run `nemohermes gc` for cleanup. NemoClaw fails closed when the selected gateway, replacement settings, durable source registry fields, or live source or target identity no longer matches the journal. The error names the sandbox and the mismatch that stopped recovery. Do not delete a same-name sandbox to bypass this check. Inspect the named OpenShell gateway and sandbox, correct the reported drift, and rerun the original command. Visible settings cannot correct the legacy host-mount journal case described above. A same-name recreation started by `nemohermes onboard` uses the same replacement journal. If that recreation is interrupted after the `Journaled replacement` message, rerun the original onboarding command with the same target settings. The active replacement can continue without adding `--resume`. Use `--resume` for interrupted onboarding steps that occur before a replacement journal exists. If any manifest-declared state directory or state file cannot be archived, NemoClaw reports each failed path and stops before deleting the original sandbox. This fail-closed behavior also applies to `rebuild --force`, even when the backup contains other usable entries. When an incomplete snapshot contains captured entries, NemoClaw retains it at the printed path but excludes it from `snapshot list` and snapshot restore selection. The retained snapshot may contain unsanitized credentials. Do not restore, copy, or share it. Do not edit its manifest or try to make it selectable. Repair access to the original sandbox state, then rerun the rebuild. Remove the incomplete host-side snapshot only after you verify that the original sandbox or a later complete snapshot contains every required state item. #### Forced Rebuild Scope `rebuild --force` skips the confirmation prompt. When a sandbox with managed MCP servers cannot run a pre-mutation no-op, NemoClaw can use bounded host-side recovery when you pass `--force`. This path requires complete bridge entries plus exact provider and target identities, and it does not scrub the unreachable in-sandbox adapter. Every bridge entry must record the adapter for the sandbox's recorded agent. NemoClaw rechecks that read-only bridge snapshot immediately before deletion and stops if the target, registry, provider, or recorded gateway changed. Policy is not part of that ownership proof. The independently captured live OpenShell policy is handed to replacement creation unchanged. NemoClaw sends the delete request and every deletion-confirmation lookup to the sandbox's exact recorded gateway. Across every rebuild path, NemoClaw does not attempt to stop the local NVIDIA NIM through the delete attempt. Cleanup is attempted on a best-effort basis only after deletion is positively confirmed. After a nonzero delete, an explicit missing result converges as deleted. A `Ready` or `Running` result triggers an attempt to restore prepared MCP state and any lockdown that rebuild temporarily relaxed. NemoClaw reports any MCP or lockdown restoration failure and does not present the operation as a successful rollback. Any partial or unreachable result remains ambiguous. NemoClaw preserves the MCP ownership and rebuild-recovery records, does not attempt to stop NIM, skips the rebuild process's immediate lockdown restoration, and does not claim that the original sandbox is intact. Inspect the live sandbox and gateway state before retrying recovery. This recovery also stops for incomplete MCP adds or ambiguous ownership. An error after a successful no-op does not fall back to the host-side path. When rebuild starts with shields up, NemoClaw opens a 30-minute shields-down window for backup and recreation. A detached auto-lock timer remains the recovery authority until NemoClaw commits a successful shields-up state, including when the host rebuild process exits unexpectedly. For an older Hermes image that predates sealed shields transitions, only the rebuild workflow may use the descriptor-safe compatibility transition needed to archive and replace the sandbox. That transition verifies the strict and compatibility hashes and publishes fresh config inodes before changing their lock posture, while ordinary `shields up` and `shields down` commands continue to refuse the older protocol. Refer to [`nemohermes rebuild`](../../reference/commands#nemohermes-name-rebuild) for flag details. ## Use the Canonical Configuration Workflows * Use [Switch Inference Providers](../../inference/manage-inference/switch-providers) to change a model or provider. * Use [Credential Rotation](../../security/credential-rotation) to reset or replace a stored provider credential. * Use [Customize the Network Policy](../../network-policy/customize-network-policy) to add or remove policy presets. ## Related Topics * [Create and Restore Snapshots](../state-and-backups/create-and-restore-snapshots) for the state-preservation contract. * [Troubleshooting](../../reference/troubleshooting) for `privileged control unavailable`, stopped sandboxes, and failed rebuilds.