fix(onboard): reconstruct recovery before admission

[sandl99]

Outcome

Onboarding now reconstructs missing recovery evidence before it evaluates recovery-only admission. A retained sandbox remains blocked, while an explicit different sandbox name can continue.

Reason

PR #11124 restored registry-only recovery after locking. A recovery_required session could still fail during the earlier option read because its independent recovery record did not exist yet.

Related issues

Refs #11096
Follow-up to #11124

Changes

• Keep the pre-lock option read free of recovery-only admission.
• Reconstruct only the requested or recovery-owned checkpoint before the locked admission read.
• Clarify that the documented destroy --yes retry requires a durable identity fingerprint.
• Cover recovery-only reconstruction, different-name admission, stale session reads, and lock contention.

Verification

• npm run test:changed — 122 files passed; 1,925 tests passed and 1 skipped.
• npx vitest run --project cli src/lib/onboard/entry-options.test.ts src/lib/onboard/portable-resume-lock-boundary.test.ts — 60 tests passed.
• Focused onboarding FSM admission and session-decision checks — 2 tests passed.
• npm run typecheck:cli — passed.
• npm run docs — passed.
• npm run validate:pr — passed against canonical main at 1c6031569639a8ac2668552da11bc9e9d1ef9cd2.
• The diff contains no secrets, API keys, or credentials.

Review notes

The parent fix completed a physical DGX Station GB300 Express install at 049f3c469, including CUDA proof and the final OpenShell replacement handoff. This follow-up changes only recovery admission ordering.

---

Signed-off-by: San Dang sdang@nvidia.com

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-11168.docs.buildwithfern.com/nemoclaw

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall line coverage in commit 85cffbc in the fix/11096-recovery-a... branch remains at 96%, unchanged from commit 1c60315 in the main branch.

[github-actions]

PR Review Advisor finished for commit 85cffbc. Include the Advisor findings in the complete PR feedback collection. Verify and group valid findings before repair.

All previous runs

[sandl99]

Closing this follow-up because it addresses a non-critical recovery edge case outside the original Express installer blocker. The original fix was completed in #11124 and validated manually on GB300.