From 33c3bd21ed669cc9a1b298ec57291ad0c2f929f3 Mon Sep 17 00:00:00 2001
From: Chengjie Wang <chengjiew@nvidia.com>
Date: Fri, 10 Jul 2026 03:52:16 +0800
Subject: [PATCH 01/45] fix(destroy): release final gateway on macOS

Signed-off-by: Chengjie Wang <chengjiew@nvidia.com>
---
 docs/reference/commands.mdx                  |   8 +-
 src/commands/sandbox/destroy.ts              |   2 +-
 src/lib/actions/sandbox/destroy-flow.test.ts |  23 ++
 src/lib/actions/sandbox/destroy.ts           |  13 +-
 src/lib/domain/lifecycle/options.ts          |   4 +-
 test/cli/destroy-gateway-cleanup.test.ts     | 294 ++++++++++---------
 6 files changed, 195 insertions(+), 149 deletions(-)

diff --git a/docs/reference/commands.mdx b/docs/reference/commands.mdx
index dfd0a166d64..d23f25e4b5c 100644
--- a/docs/reference/commands.mdx
+++ b/docs/reference/commands.mdx
@@ -1498,10 +1498,10 @@ It restores and verifies lockdown and revokes the active timer before deletion.
 It clears the remaining local shields state only after deletion succeeds.
 If hardening fails, the command refuses deletion and leaves the timer authority available to retry lockdown.
 If deletion fails after hardening, the command keeps the surviving sandbox's locked shields state instead of cleaning it up as though deletion succeeded.
-By default, `destroy` preserves the shared NemoClaw gateway.
-Pass `--cleanup-gateway` to remove the shared gateway when destroying the last sandbox, or `--no-cleanup-gateway` to force preservation when environment defaults request cleanup.
+By default, unattended final-sandbox destroys (`--yes`, `--force`, or `NEMOCLAW_NON_INTERACTIVE=1`) remove the shared NemoClaw gateway on macOS so the host listener is released, while Linux preserves it for reuse.
+Pass `--cleanup-gateway` to force removal, or `--no-cleanup-gateway` to force preservation.
 If the pre-delete workspace wipe cannot run, use a different sandbox name for a clean start.
-When this is the last sandbox, pass `--cleanup-gateway` to purge the shared cluster volume that retains the per-name persistent volume.
+Cleaning up the gateway after the last sandbox also purges the shared cluster volume that retains the per-name persistent volume.
 If the OpenShell gateway is unreachable and the sandbox has no managed MCP ownership state, `--force` removes only NemoClaw's local registry entry and local artifacts.
 Gateway-side deletion remains unconfirmed, shared host-service and gateway teardown are skipped, and the sandbox and retained volume may still exist if the gateway returns.
 Start the gateway with `$$nemoclaw <name> status` and retry destroy when you need a confirmed deletion.
@@ -3462,7 +3462,7 @@ The following flags change defaults for commands that manage existing sandboxes.
 
 | Variable | Format | Effect |
 |----------|--------|--------|
-| `NEMOCLAW_CLEANUP_GATEWAY` | `1`, `true`, or `yes` to enable; `0`, `false`, or `no` to disable | Sets the default for whether `$$nemoclaw <name> destroy` removes the shared gateway when destroying the last sandbox. Command-line `--cleanup-gateway` and `--no-cleanup-gateway` still take precedence. |
+| `NEMOCLAW_CLEANUP_GATEWAY` | `1`, `true`, or `yes` to enable; `0`, `false`, or `no` to disable | Overrides the platform default for whether `$$nemoclaw <name> destroy` removes the shared gateway when destroying the last sandbox. Command-line `--cleanup-gateway` and `--no-cleanup-gateway` still take precedence. |
 | `NEMOCLAW_CONFIRM_LEGACY_MANAGED_RECREATE` | Exact JSON array of sandbox names | Confirms to the installer that the exact listed set of pre-fingerprint OpenClaw or Hermes sandboxes used NemoClaw-managed images, allowing recovery onto the current managed image. The normalized names must exactly match the installer's printed array. Set it only after verifying every named sandbox. Recorded custom-image evidence remains blocked. |
 | `NEMOCLAW_DISABLE_INFERENCE_ROUTE_REPAIR` | `1` to enable | Skips the automatic DNS-proxy repair for stale `inference.local` routes during `$$nemoclaw <name> connect` and `$$nemoclaw <name> connect --probe-only`. Use only as a troubleshooting escape hatch. |
 | `NEMOCLAW_SHIELDS_ACCEPT_LEGACY_BASELINE` | `1` to opt in | Allows advanced immutable-config verification to trust the current on-disk bytes for older or partial content baselines. Use only after you have rebuilt or manually inspected the sandbox state and accepted that the baseline is operator-approved. |
diff --git a/src/commands/sandbox/destroy.ts b/src/commands/sandbox/destroy.ts
index 1522a11fa83..2de6df1ca46 100644
--- a/src/commands/sandbox/destroy.ts
+++ b/src/commands/sandbox/destroy.ts
@@ -26,7 +26,7 @@ export default class DestroyCliCommand extends NemoClawCommand {
     force: forceFlag(),
     "cleanup-gateway": Flags.boolean({
       description:
-        "When destroying the last sandbox, also tear down the shared NemoClaw gateway. Default: preserve. NEMOCLAW_CLEANUP_GATEWAY=1 sets the same default.",
+        "When destroying the last sandbox, also tear down the shared NemoClaw gateway. Default: preserve on Linux; cleanup for unattended macOS destroys. NEMOCLAW_CLEANUP_GATEWAY overrides the platform default.",
       allowNo: true,
     }),
   };
diff --git a/src/lib/actions/sandbox/destroy-flow.test.ts b/src/lib/actions/sandbox/destroy-flow.test.ts
index 3e3ce11d0c7..e5128418dba 100644
--- a/src/lib/actions/sandbox/destroy-flow.test.ts
+++ b/src/lib/actions/sandbox/destroy-flow.test.ts
@@ -54,6 +54,29 @@ describe("destroySandbox flow", () => {
     expectSuccessfulLiveDestroy(harness, exitSpy);
   });
 
+  it("cleans the final gateway for unattended macOS destroys (#4662)", async () => {
+    vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
+    const harness = createDestroyHarness();
+
+    await expect(harness.destroySandbox("alpha", { yes: true })).resolves.toBeUndefined();
+
+    expect(harness.cleanupGatewaySpy).toHaveBeenCalledWith(
+      "nemoclaw-19080",
+      harness.runOpenshellSpy,
+    );
+  });
+
+  it("honors an explicit gateway-preservation override on macOS (#4662)", async () => {
+    vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
+    const harness = createDestroyHarness();
+
+    await expect(
+      harness.destroySandbox("alpha", { yes: true, cleanupGateway: false }),
+    ).resolves.toBeUndefined();
+
+    expect(harness.cleanupGatewaySpy).not.toHaveBeenCalled();
+  });
+
   it("stops before local cleanup when OpenShell fails to delete the live sandbox", async () => {
     const harness = createDestroyHarness({
       deleteStatus: 7,
diff --git a/src/lib/actions/sandbox/destroy.ts b/src/lib/actions/sandbox/destroy.ts
index e182902699b..b95b6257505 100644
--- a/src/lib/actions/sandbox/destroy.ts
+++ b/src/lib/actions/sandbox/destroy.ts
@@ -89,20 +89,21 @@ function isNonInteractive(): boolean {
 
 /**
  * Decide whether to tear down the shared NemoClaw gateway after destroying
- * the last sandbox. Default is to preserve it (#2166); explicit opt-in via
- * `cleanupGateway: true` (which `normalizeDestroySandboxOptions` also reads
- * from `--cleanup-gateway` / `NEMOCLAW_CLEANUP_GATEWAY`).
+ * the last sandbox. Linux preserves it by default for reuse (#2166), while
+ * unattended macOS destroys clean it up so the host listener is released
+ * (#4662). Explicit cleanup options always take precedence.
  *
  * Prompt rules:
  *   - explicit `cleanupGateway` set         → honour it without prompting
- *   - non-interactive or `--yes` / `--force` → preserve gateway (safe default)
+ *   - non-interactive or `--yes` / `--force` → use the platform default
  *   - interactive without `--yes`           → prompt the user
  */
 async function resolveCleanupGatewayDecision(options: DestroySandboxOptions): Promise<boolean> {
   if (options.cleanupGateway === true) return true;
   if (options.cleanupGateway === false) return false;
-  if (options.yes === true || options.force === true) return false;
-  if (isNonInteractive()) return false;
+  if (options.yes === true || options.force === true || isNonInteractive()) {
+    return process.platform === "darwin";
+  }
   console.log(`  ${YW}This was the last sandbox.${R}`);
   console.log(
     "  Also destroy the shared NemoClaw gateway (port forward, gateway pod, cluster volumes)?",
diff --git a/src/lib/domain/lifecycle/options.ts b/src/lib/domain/lifecycle/options.ts
index b5b7cd3e891..2a8e6059c62 100644
--- a/src/lib/domain/lifecycle/options.ts
+++ b/src/lib/domain/lifecycle/options.ts
@@ -18,8 +18,8 @@ export interface DestroySandboxOptions {
   /**
    * When the sandbox being destroyed is the last one, also tear down the
    * shared NemoClaw gateway (port forward, gateway pod, cluster volumes).
-   * Default `false` — gateway is preserved so the next `nemoclaw onboard`
-   * can reuse it without a full re-bootstrap. See #2166.
+   * Unattended macOS destroys default to cleanup so the host listener is
+   * released; Linux preserves the gateway for reuse. See #4662 and #2166.
    *
    * Resolution order during normalization: explicit option, then
    * `--cleanup-gateway` argv flag, then `NEMOCLAW_CLEANUP_GATEWAY=1` env
diff --git a/test/cli/destroy-gateway-cleanup.test.ts b/test/cli/destroy-gateway-cleanup.test.ts
index 52efbe29453..16892f247ac 100644
--- a/test/cli/destroy-gateway-cleanup.test.ts
+++ b/test/cli/destroy-gateway-cleanup.test.ts
@@ -9,76 +9,85 @@ import { describe, expect, it } from "vitest";
 import { runWithEnv, testTimeoutOptions } from "./helpers";
 
 describe("CLI dispatch", () => {
-  it("preserves the gateway runtime by default when the last sandbox is destroyed (#2166)", () => {
-    const home = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-cli-destroy-last-"));
-    const localBin = path.join(home, "bin");
-    const registryDir = path.join(home, ".nemoclaw");
-    const openshellLog = path.join(home, "openshell.log");
-    const bashLog = path.join(home, "docker.log");
-    fs.mkdirSync(localBin, { recursive: true });
-    fs.mkdirSync(registryDir, { recursive: true });
-    fs.writeFileSync(
-      path.join(registryDir, "sandboxes.json"),
-      JSON.stringify({
-        sandboxes: {
-          alpha: {
-            name: "alpha",
-            model: "test-model",
-            provider: "nvidia-prod",
-            gpuEnabled: false,
-            policies: [],
+  it(
+    "uses the platform gateway default when the last sandbox is destroyed (#2166, #4662)",
+    testTimeoutOptions(30_000),
+    () => {
+      const home = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-cli-destroy-last-"));
+      const localBin = path.join(home, "bin");
+      const registryDir = path.join(home, ".nemoclaw");
+      const openshellLog = path.join(home, "openshell.log");
+      const bashLog = path.join(home, "docker.log");
+      fs.mkdirSync(localBin, { recursive: true });
+      fs.mkdirSync(registryDir, { recursive: true });
+      fs.writeFileSync(
+        path.join(registryDir, "sandboxes.json"),
+        JSON.stringify({
+          sandboxes: {
+            alpha: {
+              name: "alpha",
+              model: "test-model",
+              provider: "nvidia-prod",
+              gpuEnabled: false,
+              policies: [],
+            },
           },
-        },
-        defaultSandbox: "alpha",
-      }),
-      { mode: 0o600 },
-    );
-    fs.writeFileSync(
-      path.join(localBin, "openshell"),
-      [
-        "#!/bin/sh",
-        `log_file=${JSON.stringify(openshellLog)}`,
-        'if [ "$1" = "sandbox" ] && [ "$2" = "list" ]; then',
-        '  printf "NAME STATUS\\n" >> "$log_file"',
-        "  exit 0",
-        "fi",
-        'printf \'%s\\n\' "$*" >> "$log_file"',
-        "exit 0",
-      ].join("\n"),
-      { mode: 0o755 },
-    );
-    fs.writeFileSync(
-      path.join(localBin, "docker"),
-      [
-        "#!/bin/sh",
-        `log_file=${JSON.stringify(bashLog)}`,
-        'printf \'%s\\n\' "$*" >> "$log_file"',
-        "exit 0",
-      ].join("\n"),
-      { mode: 0o755 },
-    );
+          defaultSandbox: "alpha",
+        }),
+        { mode: 0o600 },
+      );
+      fs.writeFileSync(
+        path.join(localBin, "openshell"),
+        [
+          "#!/bin/sh",
+          `log_file=${JSON.stringify(openshellLog)}`,
+          'if [ "$1" = "sandbox" ] && [ "$2" = "list" ]; then',
+          '  printf "NAME STATUS\\n" >> "$log_file"',
+          "  exit 0",
+          "fi",
+          'printf \'%s\\n\' "$*" >> "$log_file"',
+          "exit 0",
+        ].join("\n"),
+        { mode: 0o755 },
+      );
+      fs.writeFileSync(
+        path.join(localBin, "docker"),
+        [
+          "#!/bin/sh",
+          `log_file=${JSON.stringify(bashLog)}`,
+          'printf \'%s\\n\' "$*" >> "$log_file"',
+          "exit 0",
+        ].join("\n"),
+        { mode: 0o755 },
+      );
 
-    const r = runWithEnv("alpha destroy -y", {
-      HOME: home,
-      PATH: `${localBin}:${process.env.PATH || ""}`,
-    });
+      const r = runWithEnv("alpha destroy -y", {
+        HOME: home,
+        PATH: `${localBin}:${process.env.PATH || ""}`,
+      });
 
-    expect(r.code).toBe(0);
-    const openshellOutput = fs.readFileSync(openshellLog, "utf8");
-    expect(openshellOutput).toContain("sandbox delete alpha");
-    expect(openshellOutput).toContain("NAME STATUS");
-    // Gateway preservation is now the default. `--yes` confirms only the
-    // sandbox; the shared NemoClaw gateway must stay up so the next
-    // `nemoclaw onboard` reuses it.
-    expect(openshellOutput).not.toContain("forward stop 18789");
-    expect(openshellOutput).not.toContain("gateway destroy -g nemoclaw");
-    expect(openshellOutput).not.toContain("gateway remove nemoclaw");
-    expect(fs.readFileSync(bashLog, "utf8")).not.toContain("volume ls -q --filter");
-    // The preserved-gateway hint must recommend the real subcommand
-    // (`gateway remove`), never the nonexistent `gateway destroy` (#6569).
-    expect(r.out).toContain("openshell gateway remove nemoclaw");
-    expect(r.out).not.toContain("gateway destroy");
-  });
+      expect(r.code).toBe(0);
+      const openshellOutput = fs.readFileSync(openshellLog, "utf8");
+      expect(openshellOutput).toContain("sandbox delete alpha");
+      expect(openshellOutput).toContain("NAME STATUS");
+      if (process.platform === "darwin") {
+        expect(openshellOutput).toContain("forward stop 18789");
+        expect(openshellOutput).toContain("gateway remove nemoclaw");
+        expect(fs.readFileSync(bashLog, "utf8")).toContain(
+          "volume ls -q --filter name=openshell-cluster-nemoclaw",
+        );
+      } else {
+        expect(openshellOutput).not.toContain("forward stop 18789");
+        expect(openshellOutput).not.toContain("gateway destroy -g nemoclaw");
+        expect(openshellOutput).not.toContain("gateway remove nemoclaw");
+        expect(fs.readFileSync(bashLog, "utf8")).not.toContain("volume ls -q --filter");
+        // The preserved-gateway hint must recommend the real subcommand
+        // (`gateway remove`), never the nonexistent `gateway destroy` (#6569).
+        expect(r.out).toContain("openshell gateway remove nemoclaw");
+        expect(r.out).not.toContain("gateway destroy");
+      }
+    },
+  );
 
   it(
     "falls back to legacy gateway destroy and still cleans volumes when remove fails (#6569)",
@@ -675,79 +684,92 @@ describe("CLI dispatch", () => {
     expect(fs.readFileSync(openshellLog, "utf8")).not.toContain("gateway remove nemoclaw");
   });
 
-  it("treats an already-missing sandbox as destroyed and clears the stale registry entry", () => {
-    const home = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-cli-destroy-missing-"));
-    const localBin = path.join(home, "bin");
-    const registryDir = path.join(home, ".nemoclaw");
-    const openshellLog = path.join(home, "openshell.log");
-    const bashLog = path.join(home, "docker.log");
-    fs.mkdirSync(localBin, { recursive: true });
-    fs.mkdirSync(registryDir, { recursive: true });
-    fs.writeFileSync(
-      path.join(registryDir, "sandboxes.json"),
-      JSON.stringify({
-        sandboxes: {
-          alpha: {
-            name: "alpha",
-            model: "test-model",
-            provider: "nvidia-prod",
-            gpuEnabled: false,
-            policies: [],
+  it(
+    "treats an already-missing sandbox as destroyed using the platform gateway default (#4662)",
+    testTimeoutOptions(30_000),
+    () => {
+      const home = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-cli-destroy-missing-"));
+      const localBin = path.join(home, "bin");
+      const registryDir = path.join(home, ".nemoclaw");
+      const openshellLog = path.join(home, "openshell.log");
+      const bashLog = path.join(home, "docker.log");
+      fs.mkdirSync(localBin, { recursive: true });
+      fs.mkdirSync(registryDir, { recursive: true });
+      fs.writeFileSync(
+        path.join(registryDir, "sandboxes.json"),
+        JSON.stringify({
+          sandboxes: {
+            alpha: {
+              name: "alpha",
+              model: "test-model",
+              provider: "nvidia-prod",
+              gpuEnabled: false,
+              policies: [],
+            },
           },
-        },
-        defaultSandbox: "alpha",
-      }),
-      { mode: 0o600 },
-    );
-    fs.writeFileSync(
-      path.join(localBin, "openshell"),
-      [
-        "#!/bin/sh",
-        `log_file=${JSON.stringify(openshellLog)}`,
-        'if [ "$1" = "sandbox" ] && [ "$2" = "delete" ]; then',
-        '  printf \'%s\\n\' "$*" >> "$log_file"',
-        '  echo "Error: status: Not Found, message: \\"sandbox not found\\"" >&2',
-        "  exit 1",
-        "fi",
-        'if [ "$1" = "sandbox" ] && [ "$2" = "list" ]; then',
-        '  printf "NAME STATUS\\n" >> "$log_file"',
-        '  printf "NAME STATUS\\n"',
-        "  exit 0",
-        "fi",
-        'printf \'%s\\n\' "$*" >> "$log_file"',
-        "exit 0",
-      ].join("\n"),
-      { mode: 0o755 },
-    );
-    fs.writeFileSync(
-      path.join(localBin, "docker"),
-      [
-        "#!/bin/sh",
-        `log_file=${JSON.stringify(bashLog)}`,
-        'printf \'%s\\n\' "$*" >> "$log_file"',
-        "exit 0",
-      ].join("\n"),
-      { mode: 0o755 },
-    );
+          defaultSandbox: "alpha",
+        }),
+        { mode: 0o600 },
+      );
+      fs.writeFileSync(
+        path.join(localBin, "openshell"),
+        [
+          "#!/bin/sh",
+          `log_file=${JSON.stringify(openshellLog)}`,
+          'if [ "$1" = "sandbox" ] && [ "$2" = "delete" ]; then',
+          '  printf \'%s\\n\' "$*" >> "$log_file"',
+          '  echo "Error: status: Not Found, message: \\"sandbox not found\\"" >&2',
+          "  exit 1",
+          "fi",
+          'if [ "$1" = "sandbox" ] && [ "$2" = "list" ]; then',
+          '  printf "NAME STATUS\\n" >> "$log_file"',
+          '  printf "NAME STATUS\\n"',
+          "  exit 0",
+          "fi",
+          'printf \'%s\\n\' "$*" >> "$log_file"',
+          "exit 0",
+        ].join("\n"),
+        { mode: 0o755 },
+      );
+      fs.writeFileSync(
+        path.join(localBin, "docker"),
+        [
+          "#!/bin/sh",
+          `log_file=${JSON.stringify(bashLog)}`,
+          'printf \'%s\\n\' "$*" >> "$log_file"',
+          "exit 0",
+        ].join("\n"),
+        { mode: 0o755 },
+      );
 
-    const r = runWithEnv("alpha destroy --yes", {
-      HOME: home,
-      PATH: `${localBin}:${process.env.PATH || ""}`,
-    });
+      const r = runWithEnv("alpha destroy --yes", {
+        HOME: home,
+        PATH: `${localBin}:${process.env.PATH || ""}`,
+      });
 
-    expect(r.code).toBe(0);
-    expect(r.out).toContain("already absent from the live gateway");
-    expect(r.out).toContain("Sandbox 'alpha' destroyed");
+      expect(r.code).toBe(0);
+      expect(r.out).toContain("already absent from the live gateway");
+      expect(r.out).toContain("Sandbox 'alpha' destroyed");
 
-    const registryAfter = JSON.parse(
-      fs.readFileSync(path.join(registryDir, "sandboxes.json"), "utf8"),
-    );
-    expect(registryAfter.sandboxes.alpha).toBeFalsy();
-    expect(fs.readFileSync(openshellLog, "utf8")).toContain("sandbox delete alpha");
-    expect(fs.readFileSync(openshellLog, "utf8")).not.toContain("forward stop 18789");
-    expect(fs.readFileSync(openshellLog, "utf8")).not.toContain("gateway destroy -g nemoclaw");
-    expect(fs.readFileSync(bashLog, "utf8")).not.toContain("volume ls -q --filter");
-  });
+      const registryAfter = JSON.parse(
+        fs.readFileSync(path.join(registryDir, "sandboxes.json"), "utf8"),
+      );
+      expect(registryAfter.sandboxes.alpha).toBeFalsy();
+      expect(fs.readFileSync(openshellLog, "utf8")).toContain("sandbox delete alpha");
+      const openshellOutput = fs.readFileSync(openshellLog, "utf8");
+      const dockerOutput = fs.readFileSync(bashLog, "utf8");
+      if (process.platform === "darwin") {
+        expect(openshellOutput).toContain("forward stop 18789");
+        expect(openshellOutput).toContain("gateway remove nemoclaw");
+        expect(dockerOutput).toContain("volume ls -q --filter name=openshell-cluster-nemoclaw");
+      } else {
+        expect(openshellOutput).not.toContain("forward stop 18789");
+        expect(openshellOutput).not.toContain("gateway destroy -g nemoclaw");
+        expect(openshellOutput).not.toContain("gateway remove nemoclaw");
+        expect(dockerOutput).not.toContain("volume ls -q --filter");
+      }
+    },
+  );
 
   it("deletes messaging providers when destroying a sandbox", () => {
     const home = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-cli-destroy-providers-"));

From cb2305236a642d50ac5c9f474201829223dc7e2c Mon Sep 17 00:00:00 2001
From: Chengjie Wang <chengjiew@nvidia.com>
Date: Fri, 10 Jul 2026 04:01:39 +0800
Subject: [PATCH 02/45] test(destroy): avoid platform assertion branches

Signed-off-by: Chengjie Wang <chengjiew@nvidia.com>
---
 test/cli/destroy-gateway-cleanup.test.ts | 42 +++++++++---------------
 1 file changed, 16 insertions(+), 26 deletions(-)

diff --git a/test/cli/destroy-gateway-cleanup.test.ts b/test/cli/destroy-gateway-cleanup.test.ts
index 16892f247ac..f923c24aa93 100644
--- a/test/cli/destroy-gateway-cleanup.test.ts
+++ b/test/cli/destroy-gateway-cleanup.test.ts
@@ -68,24 +68,17 @@ describe("CLI dispatch", () => {
 
       expect(r.code).toBe(0);
       const openshellOutput = fs.readFileSync(openshellLog, "utf8");
+      const dockerOutput = fs.readFileSync(bashLog, "utf8");
+      const shouldCleanupGateway = process.platform === "darwin";
       expect(openshellOutput).toContain("sandbox delete alpha");
       expect(openshellOutput).toContain("NAME STATUS");
-      if (process.platform === "darwin") {
-        expect(openshellOutput).toContain("forward stop 18789");
-        expect(openshellOutput).toContain("gateway remove nemoclaw");
-        expect(fs.readFileSync(bashLog, "utf8")).toContain(
-          "volume ls -q --filter name=openshell-cluster-nemoclaw",
-        );
-      } else {
-        expect(openshellOutput).not.toContain("forward stop 18789");
-        expect(openshellOutput).not.toContain("gateway destroy -g nemoclaw");
-        expect(openshellOutput).not.toContain("gateway remove nemoclaw");
-        expect(fs.readFileSync(bashLog, "utf8")).not.toContain("volume ls -q --filter");
-        // The preserved-gateway hint must recommend the real subcommand
-        // (`gateway remove`), never the nonexistent `gateway destroy` (#6569).
-        expect(r.out).toContain("openshell gateway remove nemoclaw");
-        expect(r.out).not.toContain("gateway destroy");
-      }
+      expect(openshellOutput.includes("forward stop 18789")).toBe(shouldCleanupGateway);
+      expect(openshellOutput.includes("gateway remove nemoclaw")).toBe(shouldCleanupGateway);
+      expect(dockerOutput.includes("volume ls -q --filter name=openshell-cluster-nemoclaw")).toBe(
+        shouldCleanupGateway,
+      );
+      expect(r.out.includes("openshell gateway remove nemoclaw")).toBe(!shouldCleanupGateway);
+      expect(r.out).not.toContain("gateway destroy");
     },
   );
 
@@ -758,16 +751,13 @@ describe("CLI dispatch", () => {
       expect(fs.readFileSync(openshellLog, "utf8")).toContain("sandbox delete alpha");
       const openshellOutput = fs.readFileSync(openshellLog, "utf8");
       const dockerOutput = fs.readFileSync(bashLog, "utf8");
-      if (process.platform === "darwin") {
-        expect(openshellOutput).toContain("forward stop 18789");
-        expect(openshellOutput).toContain("gateway remove nemoclaw");
-        expect(dockerOutput).toContain("volume ls -q --filter name=openshell-cluster-nemoclaw");
-      } else {
-        expect(openshellOutput).not.toContain("forward stop 18789");
-        expect(openshellOutput).not.toContain("gateway destroy -g nemoclaw");
-        expect(openshellOutput).not.toContain("gateway remove nemoclaw");
-        expect(dockerOutput).not.toContain("volume ls -q --filter");
-      }
+      const shouldCleanupGateway = process.platform === "darwin";
+      expect(openshellOutput.includes("forward stop 18789")).toBe(shouldCleanupGateway);
+      expect(openshellOutput.includes("gateway remove nemoclaw")).toBe(shouldCleanupGateway);
+      expect(dockerOutput.includes("volume ls -q --filter name=openshell-cluster-nemoclaw")).toBe(
+        shouldCleanupGateway,
+      );
+      expect(openshellOutput).not.toContain("gateway destroy -g nemoclaw");
     },
   );
 

From cf54c98bae3a35b81f6ec2ae177d72a69022a032 Mon Sep 17 00:00:00 2001
From: Chengjie Wang <chengjiew@nvidia.com>
Date: Fri, 10 Jul 2026 04:05:18 +0800
Subject: [PATCH 03/45] test(destroy): cover unattended macOS triggers

Signed-off-by: Chengjie Wang <chengjiew@nvidia.com>
---
 src/lib/actions/sandbox/destroy-flow.test.ts | 26 ++++++++++++++++++++
 test/helpers/destroy-flow-test-harness.ts    |  2 ++
 2 files changed, 28 insertions(+)

diff --git a/src/lib/actions/sandbox/destroy-flow.test.ts b/src/lib/actions/sandbox/destroy-flow.test.ts
index e5128418dba..77a8a4e9cde 100644
--- a/src/lib/actions/sandbox/destroy-flow.test.ts
+++ b/src/lib/actions/sandbox/destroy-flow.test.ts
@@ -37,6 +37,7 @@ describe("destroySandbox flow", () => {
       ? delete process.env.OPENSHELL_GATEWAY
       : (process.env.OPENSHELL_GATEWAY = originalGatewayEnv);
     vi.restoreAllMocks();
+    vi.unstubAllEnvs();
     resetDestroyModuleCache();
   });
 
@@ -66,6 +67,31 @@ describe("destroySandbox flow", () => {
     );
   });
 
+  it("cleans the final gateway for forced macOS destroys (#4662)", async () => {
+    vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
+    const harness = createDestroyHarness();
+
+    await expect(harness.destroySandbox("alpha", { force: true })).resolves.toBeUndefined();
+
+    expect(harness.cleanupGatewaySpy).toHaveBeenCalledWith(
+      "nemoclaw-19080",
+      harness.runOpenshellSpy,
+    );
+  });
+
+  it("cleans the final gateway for environment-driven non-interactive macOS destroys (#4662)", async () => {
+    vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
+    vi.stubEnv("NEMOCLAW_NON_INTERACTIVE", "1");
+    const harness = createDestroyHarness();
+
+    await expect(harness.destroySandbox("alpha", {})).resolves.toBeUndefined();
+
+    expect(harness.cleanupGatewaySpy).toHaveBeenCalledWith(
+      "nemoclaw-19080",
+      harness.runOpenshellSpy,
+    );
+  });
+
   it("honors an explicit gateway-preservation override on macOS (#4662)", async () => {
     vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
     const harness = createDestroyHarness();
diff --git a/test/helpers/destroy-flow-test-harness.ts b/test/helpers/destroy-flow-test-harness.ts
index 0f107ea7e0e..4e5b2f12d68 100644
--- a/test/helpers/destroy-flow-test-harness.ts
+++ b/test/helpers/destroy-flow-test-harness.ts
@@ -103,6 +103,7 @@ export function createDestroyHarness(options: DestroyHarnessOptions = {}): Destr
   const resolve = requireDist("../../adapters/openshell/resolve.js");
   const runtime = requireDist("../../adapters/openshell/runtime.js");
   const destroyGateway = requireDist("./destroy-gateway.js");
+  const credentialStore = requireDist("../../credentials/store.js");
   const sandboxProviderCleanup = requireDist("../../onboard/sandbox-provider-cleanup.js");
   const nim = requireDist("../../inference/nim.js");
   const ollamaProxy = requireDist("../../inference/ollama/proxy.js");
@@ -115,6 +116,7 @@ export function createDestroyHarness(options: DestroyHarnessOptions = {}): Destr
   const mcpBridge = requireDist("./mcp-bridge.js");
 
   vi.spyOn(resolve, "resolveOpenshell").mockReturnValue("/usr/bin/openshell");
+  vi.spyOn(credentialStore, "prompt").mockResolvedValue("yes");
   vi.spyOn(sandboxSession, "getActiveSandboxSessions").mockReturnValue({
     detected: true,
     sessions: [{ pid: 1 }],

From 66ddd11990a0e6c1f3ca1abeef3584b47a62d8cf Mon Sep 17 00:00:00 2001
From: Chengjie Wang <chengjiew@nvidia.com>
Date: Fri, 10 Jul 2026 04:23:10 +0800
Subject: [PATCH 04/45] test(destroy): cover Linux non-interactive default

Signed-off-by: Chengjie Wang <chengjiew@nvidia.com>
---
 src/lib/actions/sandbox/destroy-flow.test.ts | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/lib/actions/sandbox/destroy-flow.test.ts b/src/lib/actions/sandbox/destroy-flow.test.ts
index 77a8a4e9cde..5bb577f3dcb 100644
--- a/src/lib/actions/sandbox/destroy-flow.test.ts
+++ b/src/lib/actions/sandbox/destroy-flow.test.ts
@@ -92,6 +92,16 @@ describe("destroySandbox flow", () => {
     );
   });
 
+  it("preserves the final gateway for environment-driven non-interactive Linux destroys (#2166)", async () => {
+    vi.spyOn(process, "platform", "get").mockReturnValue("linux");
+    vi.stubEnv("NEMOCLAW_NON_INTERACTIVE", "1");
+    const harness = createDestroyHarness();
+
+    await expect(harness.destroySandbox("alpha", {})).resolves.toBeUndefined();
+
+    expect(harness.cleanupGatewaySpy).not.toHaveBeenCalled();
+  });
+
   it("honors an explicit gateway-preservation override on macOS (#4662)", async () => {
     vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
     const harness = createDestroyHarness();

From d4e2608200737605929495258a36a30d861eaf1a Mon Sep 17 00:00:00 2001
From: Apurv Kumaria <akumaria@nvidia.com>
Date: Thu, 9 Jul 2026 13:35:46 -0700
Subject: [PATCH 05/45] test(destroy): cover declined gateway cleanup

Co-authored-by: Chengjie Wang <chengjiew@nvidia.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
---
 src/lib/actions/sandbox/destroy-flow.test.ts | 13 +++++++++++++
 test/helpers/destroy-flow-test-harness.ts    |  8 +++++++-
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/src/lib/actions/sandbox/destroy-flow.test.ts b/src/lib/actions/sandbox/destroy-flow.test.ts
index 5bb577f3dcb..f2a30f66014 100644
--- a/src/lib/actions/sandbox/destroy-flow.test.ts
+++ b/src/lib/actions/sandbox/destroy-flow.test.ts
@@ -102,6 +102,19 @@ describe("destroySandbox flow", () => {
     expect(harness.cleanupGatewaySpy).not.toHaveBeenCalled();
   });
 
+  it("preserves the final gateway when an interactive user declines cleanup (#2166)", async () => {
+    vi.stubEnv("NEMOCLAW_NON_INTERACTIVE", "");
+    const harness = createDestroyHarness({ promptResponses: ["yes", ""] });
+
+    await expect(harness.destroySandbox("alpha", {})).resolves.toBeUndefined();
+
+    expect(harness.promptSpy).toHaveBeenNthCalledWith(
+      2,
+      expect.stringContaining("destroy the gateway"),
+    );
+    expect(harness.cleanupGatewaySpy).not.toHaveBeenCalled();
+  });
+
   it("honors an explicit gateway-preservation override on macOS (#4662)", async () => {
     vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
     const harness = createDestroyHarness();
diff --git a/test/helpers/destroy-flow-test-harness.ts b/test/helpers/destroy-flow-test-harness.ts
index 4e5b2f12d68..f0fb66bf4f4 100644
--- a/test/helpers/destroy-flow-test-harness.ts
+++ b/test/helpers/destroy-flow-test-harness.ts
@@ -25,6 +25,7 @@ export type DestroyHarness = {
   logSpy: MockInstance;
   prepareMcpBridgesForAbsentSandboxDestroySpy: MockInstance;
   prepareMcpBridgesForDestroySpy: MockInstance;
+  promptSpy: MockInstance;
   removeSandboxSpy: MockInstance;
   restoreMcpBridgesAfterDestroyAbortSpy: MockInstance;
   runOpenshellSpy: MockInstance;
@@ -43,6 +44,7 @@ type DestroyHarnessOptions = {
   finalizeMcpError?: string;
   mcpAddState?: "prepared";
   mcpServers?: string[];
+  promptResponses?: string[];
   registeredSandboxCount?: number;
   restoreMcpError?: string;
   sandboxPresent?: boolean;
@@ -116,7 +118,10 @@ export function createDestroyHarness(options: DestroyHarnessOptions = {}): Destr
   const mcpBridge = requireDist("./mcp-bridge.js");
 
   vi.spyOn(resolve, "resolveOpenshell").mockReturnValue("/usr/bin/openshell");
-  vi.spyOn(credentialStore, "prompt").mockResolvedValue("yes");
+  const promptSpy = vi.spyOn(credentialStore, "prompt").mockResolvedValue("yes");
+  for (const response of options.promptResponses ?? []) {
+    promptSpy.mockResolvedValueOnce(response);
+  }
   vi.spyOn(sandboxSession, "getActiveSandboxSessions").mockReturnValue({
     detected: true,
     sessions: [{ pid: 1 }],
@@ -291,6 +296,7 @@ export function createDestroyHarness(options: DestroyHarnessOptions = {}): Destr
     logSpy,
     prepareMcpBridgesForAbsentSandboxDestroySpy,
     prepareMcpBridgesForDestroySpy,
+    promptSpy,
     removeSandboxSpy,
     restoreMcpBridgesAfterDestroyAbortSpy,
     runOpenshellSpy,

From 36ea1262edc778fe6988c3f72d9f476b7c6bcd21 Mon Sep 17 00:00:00 2001
From: Apurv Kumaria <akumaria@nvidia.com>
Date: Thu, 9 Jul 2026 13:51:22 -0700
Subject: [PATCH 06/45] test(destroy): cover native Windows gateway
 preservation

Co-authored-by: Chengjie Wang <chengjiew@nvidia.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
---
 src/lib/actions/sandbox/destroy-flow.test.ts | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/src/lib/actions/sandbox/destroy-flow.test.ts b/src/lib/actions/sandbox/destroy-flow.test.ts
index f2a30f66014..8c35d371564 100644
--- a/src/lib/actions/sandbox/destroy-flow.test.ts
+++ b/src/lib/actions/sandbox/destroy-flow.test.ts
@@ -102,6 +102,17 @@ describe("destroySandbox flow", () => {
     expect(harness.cleanupGatewaySpy).not.toHaveBeenCalled();
   });
 
+  it("preserves the final gateway for native Windows unattended destroys (#4662)", async () => {
+    // Supported Windows execution uses WSL2, which reports `linux`. Keep an
+    // unexpected native `win32` host on the conservative non-macOS default.
+    vi.spyOn(process, "platform", "get").mockReturnValue("win32");
+    const harness = createDestroyHarness();
+
+    await expect(harness.destroySandbox("alpha", { yes: true })).resolves.toBeUndefined();
+
+    expect(harness.cleanupGatewaySpy).not.toHaveBeenCalled();
+  });
+
   it("preserves the final gateway when an interactive user declines cleanup (#2166)", async () => {
     vi.stubEnv("NEMOCLAW_NON_INTERACTIVE", "");
     const harness = createDestroyHarness({ promptResponses: ["yes", ""] });

From 55e21783db82d608cf247a898780bce55c83dc1b Mon Sep 17 00:00:00 2001
From: Apurv Kumaria <akumaria@nvidia.com>
Date: Thu, 9 Jul 2026 13:59:22 -0700
Subject: [PATCH 07/45] test(destroy): cover gateway cleanup precedence

Co-authored-by: Chengjie Wang <chengjiew@nvidia.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
---
 src/lib/actions/sandbox/destroy-flow.test.ts | 39 ++++++++++++++++++++
 src/lib/actions/sandbox/destroy.ts           |  3 ++
 2 files changed, 42 insertions(+)

diff --git a/src/lib/actions/sandbox/destroy-flow.test.ts b/src/lib/actions/sandbox/destroy-flow.test.ts
index 8c35d371564..ce2b6b886de 100644
--- a/src/lib/actions/sandbox/destroy-flow.test.ts
+++ b/src/lib/actions/sandbox/destroy-flow.test.ts
@@ -113,6 +113,45 @@ describe("destroySandbox flow", () => {
     expect(harness.cleanupGatewaySpy).not.toHaveBeenCalled();
   });
 
+  it("honors the gateway cleanup environment override on macOS (#4662)", async () => {
+    vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
+    vi.stubEnv("NEMOCLAW_CLEANUP_GATEWAY", "1");
+    const harness = createDestroyHarness();
+
+    await expect(harness.destroySandbox("alpha", { yes: true })).resolves.toBeUndefined();
+
+    expect(harness.cleanupGatewaySpy).toHaveBeenCalledWith(
+      "nemoclaw-19080",
+      harness.runOpenshellSpy,
+    );
+  });
+
+  it("honors the gateway preservation environment override on macOS (#4662)", async () => {
+    vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
+    vi.stubEnv("NEMOCLAW_CLEANUP_GATEWAY", "0");
+    const harness = createDestroyHarness();
+
+    await expect(harness.destroySandbox("alpha", { yes: true })).resolves.toBeUndefined();
+
+    expect(harness.cleanupGatewaySpy).not.toHaveBeenCalled();
+  });
+
+  it("cleans the final gateway when an interactive macOS user accepts (#4662)", async () => {
+    vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
+    const harness = createDestroyHarness({ promptResponses: ["yes", "yes"] });
+
+    await expect(harness.destroySandbox("alpha", {})).resolves.toBeUndefined();
+
+    expect(harness.promptSpy).toHaveBeenNthCalledWith(
+      2,
+      expect.stringContaining("destroy the gateway"),
+    );
+    expect(harness.cleanupGatewaySpy).toHaveBeenCalledWith(
+      "nemoclaw-19080",
+      harness.runOpenshellSpy,
+    );
+  });
+
   it("preserves the final gateway when an interactive user declines cleanup (#2166)", async () => {
     vi.stubEnv("NEMOCLAW_NON_INTERACTIVE", "");
     const harness = createDestroyHarness({ promptResponses: ["yes", ""] });
diff --git a/src/lib/actions/sandbox/destroy.ts b/src/lib/actions/sandbox/destroy.ts
index b95b6257505..36484ea8099 100644
--- a/src/lib/actions/sandbox/destroy.ts
+++ b/src/lib/actions/sandbox/destroy.ts
@@ -102,6 +102,9 @@ async function resolveCleanupGatewayDecision(options: DestroySandboxOptions): Pr
   if (options.cleanupGateway === true) return true;
   if (options.cleanupGateway === false) return false;
   if (options.yes === true || options.force === true || isNonInteractive()) {
+    // macOS must release the leaked gateway listener after final destroy (#4662).
+    // Supported Windows runs use WSL2 (`linux`); unexpected `win32` hosts keep
+    // the conservative non-macOS gateway-preservation default.
     return process.platform === "darwin";
   }
   console.log(`  ${YW}This was the last sandbox.${R}`);

From b799c8a3e05d6dc1c17b2f80c1938a2b83f8ec62 Mon Sep 17 00:00:00 2001
From: Prekshi Vyas <prekshiv@nvidia.com>
Date: Fri, 10 Jul 2026 08:34:38 -0700
Subject: [PATCH 08/45] fix(destroy): document macOS gateway cleanup removal

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
---
 src/lib/actions/sandbox/destroy.ts        | 24 +++++++++++------------
 src/lib/actions/sandbox/policy-channel.ts | 13 +++++-------
 src/lib/core/non-interactive.test.ts      | 17 ++++++++++++++++
 src/lib/core/non-interactive.ts           |  6 ++++++
 src/lib/inference/ollama/proxy.ts         |  4 +++-
 src/lib/onboard.ts                        |  6 ++++--
 6 files changed, 46 insertions(+), 24 deletions(-)
 create mode 100644 src/lib/core/non-interactive.test.ts
 create mode 100644 src/lib/core/non-interactive.ts

diff --git a/src/lib/actions/sandbox/destroy.ts b/src/lib/actions/sandbox/destroy.ts
index 36484ea8099..ab9c50deed2 100644
--- a/src/lib/actions/sandbox/destroy.ts
+++ b/src/lib/actions/sandbox/destroy.ts
@@ -7,6 +7,7 @@ import path from "node:path";
 import { OPENSHELL_PROBE_TIMEOUT_MS } from "../../adapters/openshell/timeouts";
 import { CLI_NAME } from "../../cli/branding";
 import { G, R, YW } from "../../cli/terminal-style";
+import { isNonInteractiveEnv } from "../../core/non-interactive";
 import { prompt as askPrompt } from "../../credentials/store";
 import {
   type DestroySandboxOptions,
@@ -79,19 +80,14 @@ type RemoveShieldsStateDeps = {
   warn?: (message: string) => void;
 };
 
-// Mirrors the body of `isNonInteractive()` in src/lib/onboard.ts. Duplicated
-// here to avoid an awkward sibling-action -> onboard import; the canonical
-// helper should be lifted to src/lib/core/ so this and the lazy requires in
-// policy-channel.ts and inference/ollama/proxy.ts can all share one source.
-function isNonInteractive(): boolean {
-  return process.env.NEMOCLAW_NON_INTERACTIVE === "1";
-}
-
 /**
  * Decide whether to tear down the shared NemoClaw gateway after destroying
  * the last sandbox. Linux preserves it by default for reuse (#2166), while
  * unattended macOS destroys clean it up so the host listener is released
- * (#4662). Explicit cleanup options always take precedence.
+ * (#4662). Track removal in #6639: drop this macOS default only after live
+ * macOS final destroys release the gateway listener without forced gateway
+ * cleanup and Linux reuse semantics remain covered. Explicit cleanup options
+ * always take precedence.
  *
  * Prompt rules:
  *   - explicit `cleanupGateway` set         → honour it without prompting
@@ -101,10 +97,12 @@ function isNonInteractive(): boolean {
 async function resolveCleanupGatewayDecision(options: DestroySandboxOptions): Promise<boolean> {
   if (options.cleanupGateway === true) return true;
   if (options.cleanupGateway === false) return false;
-  if (options.yes === true || options.force === true || isNonInteractive()) {
-    // macOS must release the leaked gateway listener after final destroy (#4662).
-    // Supported Windows runs use WSL2 (`linux`); unexpected `win32` hosts keep
-    // the conservative non-macOS gateway-preservation default.
+  if (options.yes === true || options.force === true || isNonInteractiveEnv()) {
+    // Workaround for #4662, tracked for removal by #6639. macOS must release
+    // the leaked gateway listener after final destroy until OpenShell final
+    // destroy proves the listener is released without forcing shared gateway
+    // cleanup. Supported Windows runs use WSL2 (`linux`); unexpected `win32`
+    // hosts keep the conservative non-macOS gateway-preservation default.
     return process.platform === "darwin";
   }
   console.log(`  ${YW}This was the last sandbox.${R}`);
diff --git a/src/lib/actions/sandbox/policy-channel.ts b/src/lib/actions/sandbox/policy-channel.ts
index 0762679a99c..99bb7809047 100644
--- a/src/lib/actions/sandbox/policy-channel.ts
+++ b/src/lib/actions/sandbox/policy-channel.ts
@@ -6,6 +6,7 @@ import path from "node:path";
 import { runOpenshell } from "../../adapters/openshell/runtime";
 import { type AgentDefinition, loadAgent } from "../../agent/defs";
 import { CLI_DISPLAY_NAME, CLI_NAME } from "../../cli/branding";
+import { isNonInteractiveEnv } from "../../core/non-interactive";
 import { prompt as askPrompt, getCredential } from "../../credentials/store";
 import {
   type PolicyAddOptions,
@@ -60,9 +61,7 @@ import { policyChannelDependencies } from "./policy-channel-dependencies";
 import { refreshSandboxPolicyContextFile } from "./policy-context-refresh";
 import { executeSandboxCommand, executeSandboxExecCommand } from "./process-recovery";
 
-function isNonInteractive(): boolean {
-  return process.env.NEMOCLAW_NON_INTERACTIVE === "1";
-}
+const isNonInteractive = isNonInteractiveEnv;
 
 type ChannelMutationOptions = {
   channel?: string;
@@ -166,7 +165,7 @@ async function addSandboxPolicyUnlocked(
     }
     answer = preset.name;
   } else {
-    if (process.env.NEMOCLAW_NON_INTERACTIVE === "1") {
+    if (isNonInteractive()) {
       console.error("  Non-interactive mode requires a preset name.");
       console.error(`  Usage: ${CLI_NAME} <sandbox> policy-add <preset> [--yes] [--dry-run]`);
       process.exit(1);
@@ -1504,9 +1503,7 @@ async function removeSandboxPolicyUnlocked(
   options: PolicyRemoveOptions,
 ): Promise<void> {
   const dryRun = Boolean(options.dryRun);
-  const skipConfirm = Boolean(
-    options.yes || options.force || process.env.NEMOCLAW_NON_INTERACTIVE === "1",
-  );
+  const skipConfirm = Boolean(options.yes || options.force || isNonInteractive());
 
   // Remove-able presets = built-in presets + custom presets applied via
   // --from-file / --from-dir (tracked in registry.customPolicies).
@@ -1533,7 +1530,7 @@ async function removeSandboxPolicyUnlocked(
     }
     answer = preset.name;
   } else {
-    if (process.env.NEMOCLAW_NON_INTERACTIVE === "1") {
+    if (isNonInteractive()) {
       console.error("  Non-interactive mode requires a preset name.");
       console.error(`  Usage: ${CLI_NAME} <sandbox> policy-remove <preset> [--yes] [--dry-run]`);
       process.exit(1);
diff --git a/src/lib/core/non-interactive.test.ts b/src/lib/core/non-interactive.test.ts
new file mode 100644
index 00000000000..8febe34c524
--- /dev/null
+++ b/src/lib/core/non-interactive.test.ts
@@ -0,0 +1,17 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { describe, expect, it } from "vitest";
+
+import { isNonInteractiveEnv } from "./non-interactive";
+
+describe("non-interactive environment detection", () => {
+  it("treats only the canonical value as non-interactive", () => {
+    expect(isNonInteractiveEnv({ NEMOCLAW_NON_INTERACTIVE: "1" } as NodeJS.ProcessEnv)).toBe(true);
+    expect(isNonInteractiveEnv({ NEMOCLAW_NON_INTERACTIVE: "true" } as NodeJS.ProcessEnv)).toBe(
+      false,
+    );
+    expect(isNonInteractiveEnv({ NEMOCLAW_NON_INTERACTIVE: "" } as NodeJS.ProcessEnv)).toBe(false);
+    expect(isNonInteractiveEnv({} as NodeJS.ProcessEnv)).toBe(false);
+  });
+});
diff --git a/src/lib/core/non-interactive.ts b/src/lib/core/non-interactive.ts
new file mode 100644
index 00000000000..72f71c4a876
--- /dev/null
+++ b/src/lib/core/non-interactive.ts
@@ -0,0 +1,6 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+export function isNonInteractiveEnv(env: NodeJS.ProcessEnv = process.env): boolean {
+  return env.NEMOCLAW_NON_INTERACTIVE === "1";
+}
diff --git a/src/lib/inference/ollama/proxy.ts b/src/lib/inference/ollama/proxy.ts
index 4258e48427e..3f84e6a1ecc 100644
--- a/src/lib/inference/ollama/proxy.ts
+++ b/src/lib/inference/ollama/proxy.ts
@@ -11,6 +11,8 @@ const path = require("path");
 const { spawn, spawnSync } = require("child_process");
 const { ROOT, SCRIPTS, redact, run, runCapture, shellQuote } = require("../../runner");
 const { OLLAMA_PORT, OLLAMA_PROXY_PORT } = require("../../core/ports");
+const { isNonInteractiveEnv }: typeof import("../../core/non-interactive") =
+  require("../../core/non-interactive");
 const { waitForPort } = require("../../core/wait");
 const { ensurePulledOllamaModel }: typeof import("./model-discovery") =
   require("./model-discovery");
@@ -793,7 +795,7 @@ async function promptProxyYesNo(question: string, defaultIsYes: boolean): Promis
 }
 
 const defaultOllamaToolCapabilityInteraction: OllamaToolCapabilityInteraction = {
-  isNonInteractive: () => process.env.NEMOCLAW_NON_INTERACTIVE === "1",
+  isNonInteractive: isNonInteractiveEnv,
   isAutoYes: () => process.env.NEMOCLAW_YES === "1",
   confirm: promptProxyYesNo,
 };
diff --git a/src/lib/onboard.ts b/src/lib/onboard.ts
index 68403a1dc2c..42143eabd82 100644
--- a/src/lib/onboard.ts
+++ b/src/lib/onboard.ts
@@ -9,6 +9,8 @@ const {
   envInt,
   LOCAL_INFERENCE_TIMEOUT_SECS,
 }: typeof import("./onboard/env") = require("./onboard/env");
+const { isNonInteractiveEnv }: typeof import("./core/non-interactive") =
+  require("./core/non-interactive");
 const {
   agentProductName,
   cliDisplayName,
@@ -693,7 +695,7 @@ function getOnboardDashboardPort(): number {
 }
 
 function isNonInteractive(): boolean {
-  return NON_INTERACTIVE || process.env.NEMOCLAW_NON_INTERACTIVE === "1";
+  return NON_INTERACTIVE || isNonInteractiveEnv();
 }
 
 function isRecreateSandbox(requested = false): boolean {
@@ -4076,7 +4078,7 @@ async function runOnboard(opts: OnboardOptions = {}): Promise<void> {
     authoritativeGateway?.name ?? GATEWAY_NAME,
   );
   setOnboardBrandingAgent(opts.agent || process.env.NEMOCLAW_AGENT || null);
-  NON_INTERACTIVE = opts.nonInteractive || process.env.NEMOCLAW_NON_INTERACTIVE === "1";
+  NON_INTERACTIVE = opts.nonInteractive || isNonInteractiveEnv();
   RECREATE_SANDBOX = opts.recreateSandbox || process.env.NEMOCLAW_RECREATE_SANDBOX === "1";
   AUTO_YES = opts.autoYes === true || process.env.NEMOCLAW_YES === "1";
   _preflightDashboardPort =

From a363d67d5a508bfd1234288972a6a72bb878b4ba Mon Sep 17 00:00:00 2001
From: Prekshi Vyas <prekshiv@nvidia.com>
Date: Fri, 10 Jul 2026 09:09:10 -0700
Subject: [PATCH 09/45] fix(onboard): keep noninteractive helper line neutral

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
---
 src/lib/onboard.ts | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/src/lib/onboard.ts b/src/lib/onboard.ts
index 42143eabd82..8c77130d422 100644
--- a/src/lib/onboard.ts
+++ b/src/lib/onboard.ts
@@ -694,9 +694,7 @@ function getOnboardDashboardPort(): number {
   return _preflightDashboardPort ?? DASHBOARD_PORT;
 }
 
-function isNonInteractive(): boolean {
-  return NON_INTERACTIVE || isNonInteractiveEnv();
-}
+const isNonInteractive = (): boolean => NON_INTERACTIVE || isNonInteractiveEnv();
 
 function isRecreateSandbox(requested = false): boolean {
   return requested || RECREATE_SANDBOX || process.env.NEMOCLAW_RECREATE_SANDBOX === "1";

From 985968ed2811c25e39c1f6bcc7d8f4b0429f76b5 Mon Sep 17 00:00:00 2001
From: Prekshi Vyas <prekshiv@nvidia.com>
Date: Fri, 10 Jul 2026 09:14:24 -0700
Subject: [PATCH 10/45] fix(onboard): keep noninteractive helper hoisted

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
---
 src/lib/onboard.ts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/lib/onboard.ts b/src/lib/onboard.ts
index 8c77130d422..eb4cc8a3061 100644
--- a/src/lib/onboard.ts
+++ b/src/lib/onboard.ts
@@ -2,8 +2,6 @@
 // SPDX-License-Identifier: Apache-2.0
 //
 // Interactive onboarding wizard — 8 steps from zero to running sandbox.
-// Supports non-interactive mode via --non-interactive flag or
-// NEMOCLAW_NON_INTERACTIVE=1 env var for CI/CD pipelines.
 
 const {
   envInt,
@@ -694,7 +692,9 @@ function getOnboardDashboardPort(): number {
   return _preflightDashboardPort ?? DASHBOARD_PORT;
 }
 
-const isNonInteractive = (): boolean => NON_INTERACTIVE || isNonInteractiveEnv();
+function isNonInteractive(): boolean {
+  return NON_INTERACTIVE || isNonInteractiveEnv();
+}
 
 function isRecreateSandbox(requested = false): boolean {
   return requested || RECREATE_SANDBOX || process.env.NEMOCLAW_RECREATE_SANDBOX === "1";

From 746046c3525e836a12fdef325baf955fa7d6350d Mon Sep 17 00:00:00 2001
From: Prekshi Vyas <prekshiv@nvidia.com>
Date: Fri, 10 Jul 2026 10:18:07 -0700
Subject: [PATCH 11/45] fix(destroy): release macos gateway after final sandbox

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
---
 src/lib/actions/sandbox/destroy-flow.test.ts  | 29 +++++++
 .../actions/sandbox/destroy-gateway.test.ts   | 81 +++++++++++++++++++
 src/lib/actions/sandbox/destroy-gateway.ts    |  9 +--
 src/lib/actions/sandbox/destroy.ts            | 38 ++++++++-
 src/lib/onboard/gateway-process-identity.ts   |  8 ++
 src/lib/onboard/host-gateway-process.test.ts  | 28 +++++++
 test/helpers/destroy-flow-test-harness.ts     |  9 ++-
 7 files changed, 194 insertions(+), 8 deletions(-)
 create mode 100644 src/lib/actions/sandbox/destroy-gateway.test.ts

diff --git a/src/lib/actions/sandbox/destroy-flow.test.ts b/src/lib/actions/sandbox/destroy-flow.test.ts
index ce2b6b886de..6c4c3f1911e 100644
--- a/src/lib/actions/sandbox/destroy-flow.test.ts
+++ b/src/lib/actions/sandbox/destroy-flow.test.ts
@@ -126,6 +126,35 @@ describe("destroySandbox flow", () => {
     );
   });
 
+  it("cleans the final macOS gateway when sandbox list only has exited terminal rows (#4662)", async () => {
+    vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
+    const harness = createDestroyHarness({
+      dockerPsOutput: "",
+      liveListOutput:
+        "NAME              CREATED              PHASE\nnpmtest           2026-06-01 00:00:00  Error\n",
+    });
+
+    await expect(harness.destroySandbox("alpha", { yes: true })).resolves.toBeUndefined();
+
+    expect(harness.cleanupGatewaySpy).toHaveBeenCalledWith(
+      "nemoclaw-19080",
+      harness.runOpenshellSpy,
+    );
+  });
+
+  it("preserves the final macOS gateway when a terminal row still has a running Docker sandbox container (#4662)", async () => {
+    vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
+    const harness = createDestroyHarness({
+      dockerPsOutput: "openshell-npmtest-e487d1bd\n",
+      liveListOutput:
+        "NAME              CREATED              PHASE\nnpmtest           2026-06-01 00:00:00  Error\n",
+    });
+
+    await expect(harness.destroySandbox("alpha", { yes: true })).resolves.toBeUndefined();
+
+    expect(harness.cleanupGatewaySpy).not.toHaveBeenCalled();
+  });
+
   it("honors the gateway preservation environment override on macOS (#4662)", async () => {
     vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
     vi.stubEnv("NEMOCLAW_CLEANUP_GATEWAY", "0");
diff --git a/src/lib/actions/sandbox/destroy-gateway.test.ts b/src/lib/actions/sandbox/destroy-gateway.test.ts
new file mode 100644
index 00000000000..6999082625a
--- /dev/null
+++ b/src/lib/actions/sandbox/destroy-gateway.test.ts
@@ -0,0 +1,81 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import os from "node:os";
+import path from "node:path";
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  dockerRemoveVolumesByPrefix: vi.fn(),
+  stopHostGatewayProcesses: vi.fn(),
+  stopStaleDashboardListeners: vi.fn(),
+}));
+
+vi.mock("../../adapters/docker/volume", () => ({
+  dockerRemoveVolumesByPrefix: mocks.dockerRemoveVolumesByPrefix,
+}));
+vi.mock("../../onboard/host-gateway-process", () => ({
+  stopHostGatewayProcesses: mocks.stopHostGatewayProcesses,
+}));
+vi.mock("../../onboard/stale-gateway-cleanup", () => ({
+  stopStaleDashboardListeners: mocks.stopStaleDashboardListeners,
+}));
+
+import { cleanupGatewayAfterLastSandbox } from "./destroy-gateway";
+
+describe("cleanupGatewayAfterLastSandbox", () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+    vi.clearAllMocks();
+    delete process.env.NEMOCLAW_OPENSHELL_GATEWAY_STATE_DIR;
+  });
+
+  it("uses the PID-file-scoped host gateway reaper for macOS final destroy (#4662)", () => {
+    vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
+    vi.spyOn(os, "homedir").mockReturnValue("/home/tester");
+    const runOpenshell = vi.fn(() => ({ status: 0, stdout: "", stderr: "" }));
+    const stateDir = path.join(
+      "/home/tester",
+      ".local",
+      "state",
+      "nemoclaw",
+      "openshell-docker-gateway-8081",
+    );
+
+    cleanupGatewayAfterLastSandbox("nemoclaw-8081", runOpenshell);
+
+    expect(mocks.stopStaleDashboardListeners).toHaveBeenCalledOnce();
+    expect(mocks.stopHostGatewayProcesses).toHaveBeenCalledWith(
+      {},
+      {
+        usePgrepFallback: false,
+        stateDir,
+        pidFile: path.join(stateDir, "openshell-gateway.pid"),
+      },
+    );
+    expect(runOpenshell).toHaveBeenCalledWith(["gateway", "remove", "nemoclaw-8081"], {
+      ignoreError: true,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    expect(mocks.dockerRemoveVolumesByPrefix).toHaveBeenCalledWith(
+      "openshell-cluster-nemoclaw-8081",
+      {
+        ignoreError: true,
+      },
+    );
+  });
+
+  it("keeps host gateway reaping disabled for non-Docker-driver platforms", () => {
+    vi.spyOn(process, "platform", "get").mockReturnValue("win32");
+    const runOpenshell = vi.fn(() => ({ status: 0, stdout: "", stderr: "" }));
+
+    cleanupGatewayAfterLastSandbox("nemoclaw", runOpenshell);
+
+    expect(mocks.stopHostGatewayProcesses).not.toHaveBeenCalled();
+    expect(runOpenshell).toHaveBeenCalledWith(["gateway", "remove", "nemoclaw"], {
+      ignoreError: true,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+  });
+});
diff --git a/src/lib/actions/sandbox/destroy-gateway.ts b/src/lib/actions/sandbox/destroy-gateway.ts
index 267abae86a3..b8e5955b89b 100644
--- a/src/lib/actions/sandbox/destroy-gateway.ts
+++ b/src/lib/actions/sandbox/destroy-gateway.ts
@@ -4,6 +4,7 @@
 import os from "node:os";
 import path from "node:path";
 
+import { dockerRemoveVolumesByPrefix } from "../../adapters/docker/volume";
 import { OPENSHELL_OPERATION_TIMEOUT_MS } from "../../adapters/openshell/timeouts";
 import { DASHBOARD_PORT } from "../../core/ports";
 import {
@@ -66,9 +67,6 @@ export function cleanupGatewayAfterLastSandbox(
     runOpenshell ??
     (require("../../adapters/openshell/runtime") as { runOpenshell: DestroyRunOpenshell })
       .runOpenshell;
-  const { dockerRemoveVolumesByPrefix } = require("../../adapters/docker") as {
-    dockerRemoveVolumesByPrefix: (prefix: string, opts?: { ignoreError?: boolean }) => void;
-  };
 
   openshell(["forward", "stop", DASHBOARD_FORWARD_PORT], {
     ignoreError: true,
@@ -79,7 +77,7 @@ export function cleanupGatewayAfterLastSandbox(
   // ports the live openshell tracks; this catches orphans whose openshell
   // record was lost across upgrades or failed onboards.
   stopStaleDashboardListeners();
-  if (process.platform === "linux") {
+  if (process.platform === "linux" || process.platform === "darwin") {
     // Sandbox destroy is conservative: only stop the host gateway whose PID
     // file we wrote during onboard. Disable the pgrep sweep so a stray
     // openshell-gateway under another user/project on the same host (rare but
@@ -112,7 +110,8 @@ export function cleanupGatewayAfterLastSandbox(
    *
    * macOS previously ran only `gateway destroy`, which current OpenShell
    * rejects as an unrecognized subcommand (#6569). The host-process stop above
-   * remains Linux-only.
+   * now uses the same PID-file-scoped reaper as Linux so final unattended
+   * macOS destroys release the Docker-driver gateway listener (#4662).
    */
   const removeResult = openshell(["gateway", "remove", gatewayName], {
     ignoreError: true,
diff --git a/src/lib/actions/sandbox/destroy.ts b/src/lib/actions/sandbox/destroy.ts
index ab9c50deed2..14b7cd4c2ac 100644
--- a/src/lib/actions/sandbox/destroy.ts
+++ b/src/lib/actions/sandbox/destroy.ts
@@ -22,7 +22,7 @@ import {
   SANDBOX_PROVIDER_SUFFIXES,
 } from "../../onboard/sandbox-provider-cleanup";
 import { validateName } from "../../runner";
-import { parseLiveSandboxNames } from "../../runtime-recovery";
+import { parseLiveSandboxEntries } from "../../runtime-recovery";
 import { killTimer as defaultKillShieldsTimer } from "../../shields/timer-control";
 import { withMcpLifecycleLock } from "../../state/mcp-lifecycle-lock";
 import type { Session } from "../../state/onboard-session";
@@ -117,6 +117,37 @@ async function resolveCleanupGatewayDecision(options: DestroySandboxOptions): Pr
   return trimmed === "y" || trimmed === "yes";
 }
 
+const TERMINAL_OPEN_SHELL_SANDBOX_PHASES = new Set(["Error", "Failed"]);
+
+function escapeDockerNameRegex(value: string): string {
+  return value.replace(/[\\^$.*+?()[\]{}|]/g, "\\$&");
+}
+
+function hasRunningDockerSandboxContainer(sandboxName: string): boolean {
+  const { dockerCapture } = require("../../adapters/docker/run") as {
+    dockerCapture: (args: string[], opts?: Record<string, unknown>) => string;
+  };
+  try {
+    const output = dockerCapture(
+      [
+        "ps",
+        "--filter",
+        `name=^/openshell-${escapeDockerNameRegex(sandboxName)}-`,
+        "--format",
+        "{{.Names}}",
+      ],
+      {
+        ignoreError: true,
+        suppressOutput: true,
+        timeout: OPENSHELL_PROBE_TIMEOUT_MS,
+      },
+    );
+    return output.trim().length > 0;
+  } catch {
+    return true;
+  }
+}
+
 function hasNoLiveSandboxes(): boolean {
   const { captureOpenshell } = require("../../adapters/openshell/runtime") as {
     captureOpenshell: (
@@ -131,7 +162,10 @@ function hasNoLiveSandboxes(): boolean {
   if (liveList.status !== 0) {
     return false;
   }
-  return parseLiveSandboxNames(liveList.output).size === 0;
+  return parseLiveSandboxEntries(liveList.output).every((entry) => {
+    if (!TERMINAL_OPEN_SHELL_SANDBOX_PHASES.has(entry.phase ?? "")) return false;
+    return !hasRunningDockerSandboxContainer(entry.name);
+  });
 }
 
 export function cleanupSandboxServices(
diff --git a/src/lib/onboard/gateway-process-identity.ts b/src/lib/onboard/gateway-process-identity.ts
index d2c03262e63..139e9ea54c2 100644
--- a/src/lib/onboard/gateway-process-identity.ts
+++ b/src/lib/onboard/gateway-process-identity.ts
@@ -39,6 +39,14 @@ export function gatewayProcessCmdlineMatches(
   const processNames = opts.processNames ?? HOST_GATEWAY_PROCESS_NAMES;
   const base = path.basename(argv0);
   if (processNames.has(base)) return true;
+  if (
+    processNames.has("openshell-gateway") &&
+    base === "openshell" &&
+    tokens[1] === "gateway" &&
+    tokens[2] === "start"
+  ) {
+    return true;
+  }
 
   if (typeof gatewayBin === "string" && gatewayBin.length > 0) {
     const normalize = opts.resolveExecutablePath ?? ((value: string) => path.resolve(value));
diff --git a/src/lib/onboard/host-gateway-process.test.ts b/src/lib/onboard/host-gateway-process.test.ts
index 1fb74cce07b..f23a3c2ef01 100644
--- a/src/lib/onboard/host-gateway-process.test.ts
+++ b/src/lib/onboard/host-gateway-process.test.ts
@@ -152,6 +152,34 @@ describe("stopHostGatewayProcesses", () => {
     expect(fs.existsSync(pidFile)).toBe(false);
   });
 
+  it("accepts the OpenShell CLI gateway-start process recorded in the PID file", () => {
+    const stateDir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-host-gateway-"));
+    const pidFile = path.join(stateDir, "openshell-gateway.pid");
+    fs.writeFileSync(pidFile, "9999552\n");
+    const exited = new Set<number>();
+    const responses = new Map<string, RunResult | ((args: string[]) => RunResult)>([
+      ["pgrep -f ^(/[^ ]*/)?openshell-gateway( |$)", notFound()],
+      ...psResponses(9999552, {
+        cmdline: "/Users/test/.local/bin/openshell gateway start --name nemoclaw --port 8080\n",
+        exited,
+      }),
+    ]);
+    const { run } = makeRun(responses);
+    const kill = vi.fn<HostGatewayProcessDeps["kill"]>((pid, signal) => {
+      if (signal === "SIGTERM") exited.add(pid);
+      return true;
+    });
+
+    const result = stopHostGatewayProcesses(
+      { run, kill, env: { USER: "tester" }, commandExists: () => true, log: vi.fn() },
+      { stateDir },
+    );
+
+    expect(result.stopped).toEqual([9999552]);
+    expect(kill).toHaveBeenCalledWith(9999552, "SIGTERM");
+    expect(fs.existsSync(pidFile)).toBe(false);
+  });
+
   it("rejects a PID whose argv0 is not docker even if it touches the mount path", () => {
     const stateDir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-host-gateway-"));
     const pidFile = path.join(stateDir, "openshell-gateway.pid");
diff --git a/test/helpers/destroy-flow-test-harness.ts b/test/helpers/destroy-flow-test-harness.ts
index f0fb66bf4f4..ad746dcbe87 100644
--- a/test/helpers/destroy-flow-test-harness.ts
+++ b/test/helpers/destroy-flow-test-harness.ts
@@ -41,7 +41,9 @@ type DestroyHarnessOptions = {
   agent?: "openclaw" | "hermes";
   deleteOutput?: string;
   deleteStatus?: number;
+  dockerPsOutput?: string;
   finalizeMcpError?: string;
+  liveListOutput?: string;
   mcpAddState?: "prepared";
   mcpServers?: string[];
   promptResponses?: string[];
@@ -116,6 +118,7 @@ export function createDestroyHarness(options: DestroyHarnessOptions = {}): Destr
   const shields = requireDist("../../shields/index.js");
   const timerControl = requireDist("../../shields/timer-control.js");
   const mcpBridge = requireDist("./mcp-bridge.js");
+  const dockerRun = requireDist("../../adapters/docker/run.js");
 
   vi.spyOn(resolve, "resolveOpenshell").mockReturnValue("/usr/bin/openshell");
   const promptSpy = vi.spyOn(credentialStore, "prompt").mockResolvedValue("yes");
@@ -191,7 +194,11 @@ export function createDestroyHarness(options: DestroyHarnessOptions = {}): Destr
   });
   vi.spyOn(runtime, "captureOpenshell").mockReturnValue({
     status: 0,
-    output: "",
+    output: options.liveListOutput ?? "",
+  });
+  vi.spyOn(dockerRun, "dockerCapture").mockImplementation((args: unknown) => {
+    const argv = Array.isArray(args) ? args.map(String) : [];
+    return argv[0] === "ps" ? (options.dockerPsOutput ?? "") : "";
   });
   const selectGatewaySpy = vi
     .spyOn(destroyGateway, "selectGatewayForSandboxDestroy")

From d5b2a7f1bf62a9f458532d51890ab33540abd578 Mon Sep 17 00:00:00 2001
From: Prekshi Vyas <prekshiv@nvidia.com>
Date: Fri, 10 Jul 2026 10:24:41 -0700
Subject: [PATCH 12/45] test(onboard): keep gateway process test branchless

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
---
 src/lib/onboard/host-gateway-process.test.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/lib/onboard/host-gateway-process.test.ts b/src/lib/onboard/host-gateway-process.test.ts
index f23a3c2ef01..78ab1da63ad 100644
--- a/src/lib/onboard/host-gateway-process.test.ts
+++ b/src/lib/onboard/host-gateway-process.test.ts
@@ -71,8 +71,8 @@ describe("stopHostGatewayProcesses", () => {
       ...psResponses(9999887, { exited }),
     ]);
     const { run } = makeRun(responses);
-    const kill = vi.fn<HostGatewayProcessDeps["kill"]>((pid, signal) => {
-      if (signal === "SIGTERM") exited.add(pid);
+    const kill = vi.fn<HostGatewayProcessDeps["kill"]>((pid) => {
+      exited.add(pid);
       return true;
     });
     const log = vi.fn();

From d9764585bdbf3e972602b649c616f73671ea9f0e Mon Sep 17 00:00:00 2001
From: Prekshi Vyas <prekshiv@nvidia.com>
Date: Fri, 10 Jul 2026 10:53:14 -0700
Subject: [PATCH 13/45] refactor(destroy): extract gateway cleanup probes

---
 src/lib/actions/sandbox/destroy.ts     | 103 +++++++------------------
 src/lib/domain/sandbox/destroy.test.ts |  91 ++++++++++++++++++++++
 src/lib/domain/sandbox/destroy.ts      | 101 ++++++++++++++++++++++++
 3 files changed, 218 insertions(+), 77 deletions(-)

diff --git a/src/lib/actions/sandbox/destroy.ts b/src/lib/actions/sandbox/destroy.ts
index 14b7cd4c2ac..ca7f40cd6eb 100644
--- a/src/lib/actions/sandbox/destroy.ts
+++ b/src/lib/actions/sandbox/destroy.ts
@@ -14,6 +14,10 @@ import {
   normalizeDestroySandboxOptions,
 } from "../../domain/lifecycle/options";
 import {
+  type DockerCaptureProbe,
+  hasNoLiveSandboxes,
+  type LiveSandboxListProbe,
+  resolveDestroyGatewayCleanupDecision,
   shouldCleanupGatewayAfterDestroy,
   shouldStopHostServicesAfterDestroy,
 } from "../../domain/sandbox/destroy";
@@ -22,7 +26,6 @@ import {
   SANDBOX_PROVIDER_SUFFIXES,
 } from "../../onboard/sandbox-provider-cleanup";
 import { validateName } from "../../runner";
-import { parseLiveSandboxEntries } from "../../runtime-recovery";
 import { killTimer as defaultKillShieldsTimer } from "../../shields/timer-control";
 import { withMcpLifecycleLock } from "../../state/mcp-lifecycle-lock";
 import type { Session } from "../../state/onboard-session";
@@ -80,31 +83,14 @@ type RemoveShieldsStateDeps = {
   warn?: (message: string) => void;
 };
 
-/**
- * Decide whether to tear down the shared NemoClaw gateway after destroying
- * the last sandbox. Linux preserves it by default for reuse (#2166), while
- * unattended macOS destroys clean it up so the host listener is released
- * (#4662). Track removal in #6639: drop this macOS default only after live
- * macOS final destroys release the gateway listener without forced gateway
- * cleanup and Linux reuse semantics remain covered. Explicit cleanup options
- * always take precedence.
- *
- * Prompt rules:
- *   - explicit `cleanupGateway` set         → honour it without prompting
- *   - non-interactive or `--yes` / `--force` → use the platform default
- *   - interactive without `--yes`           → prompt the user
- */
 async function resolveCleanupGatewayDecision(options: DestroySandboxOptions): Promise<boolean> {
-  if (options.cleanupGateway === true) return true;
-  if (options.cleanupGateway === false) return false;
-  if (options.yes === true || options.force === true || isNonInteractiveEnv()) {
-    // Workaround for #4662, tracked for removal by #6639. macOS must release
-    // the leaked gateway listener after final destroy until OpenShell final
-    // destroy proves the listener is released without forcing shared gateway
-    // cleanup. Supported Windows runs use WSL2 (`linux`); unexpected `win32`
-    // hosts keep the conservative non-macOS gateway-preservation default.
-    return process.platform === "darwin";
-  }
+  const decision = resolveDestroyGatewayCleanupDecision(options, {
+    nonInteractive: isNonInteractiveEnv(),
+    platform: process.platform,
+  });
+  if (decision === "cleanup") return true;
+  if (decision === "preserve") return false;
+
   console.log(`  ${YW}This was the last sandbox.${R}`);
   console.log(
     "  Also destroy the shared NemoClaw gateway (port forward, gateway pod, cluster volumes)?",
@@ -117,57 +103,6 @@ async function resolveCleanupGatewayDecision(options: DestroySandboxOptions): Pr
   return trimmed === "y" || trimmed === "yes";
 }
 
-const TERMINAL_OPEN_SHELL_SANDBOX_PHASES = new Set(["Error", "Failed"]);
-
-function escapeDockerNameRegex(value: string): string {
-  return value.replace(/[\\^$.*+?()[\]{}|]/g, "\\$&");
-}
-
-function hasRunningDockerSandboxContainer(sandboxName: string): boolean {
-  const { dockerCapture } = require("../../adapters/docker/run") as {
-    dockerCapture: (args: string[], opts?: Record<string, unknown>) => string;
-  };
-  try {
-    const output = dockerCapture(
-      [
-        "ps",
-        "--filter",
-        `name=^/openshell-${escapeDockerNameRegex(sandboxName)}-`,
-        "--format",
-        "{{.Names}}",
-      ],
-      {
-        ignoreError: true,
-        suppressOutput: true,
-        timeout: OPENSHELL_PROBE_TIMEOUT_MS,
-      },
-    );
-    return output.trim().length > 0;
-  } catch {
-    return true;
-  }
-}
-
-function hasNoLiveSandboxes(): boolean {
-  const { captureOpenshell } = require("../../adapters/openshell/runtime") as {
-    captureOpenshell: (
-      args: string[],
-      opts?: { ignoreError?: boolean; timeout?: number },
-    ) => { status: number | null; output: string };
-  };
-  const liveList = captureOpenshell(["sandbox", "list"], {
-    ignoreError: true,
-    timeout: OPENSHELL_PROBE_TIMEOUT_MS,
-  });
-  if (liveList.status !== 0) {
-    return false;
-  }
-  return parseLiveSandboxEntries(liveList.output).every((entry) => {
-    if (!TERMINAL_OPEN_SHELL_SANDBOX_PHASES.has(entry.phase ?? "")) return false;
-    return !hasRunningDockerSandboxContainer(entry.name);
-  });
-}
-
 export function cleanupSandboxServices(
   sandboxName: string,
   { stopHostServices = false }: { stopHostServices?: boolean } = {},
@@ -468,7 +403,21 @@ async function destroySandboxUnlocked(
       deleteSucceededOrAlreadyGone,
       removedRegistryEntry: removed,
       noRegisteredSandboxes: registry.listSandboxes().sandboxes.length === 0,
-      noLiveSandboxes: hasNoLiveSandboxes(),
+      noLiveSandboxes: hasNoLiveSandboxes({
+        captureOpenshell: (...args) => {
+          const { captureOpenshell } = require("../../adapters/openshell/runtime") as {
+            captureOpenshell: LiveSandboxListProbe;
+          };
+          return captureOpenshell(...args);
+        },
+        dockerCapture: (...args) => {
+          const { dockerCapture } = require("../../adapters/docker/run") as {
+            dockerCapture: DockerCaptureProbe;
+          };
+          return dockerCapture(...args);
+        },
+        timeoutMs: OPENSHELL_PROBE_TIMEOUT_MS,
+      }),
     })
   ) {
     const shouldCleanupGateway = await resolveCleanupGatewayDecision(normalized);
diff --git a/src/lib/domain/sandbox/destroy.test.ts b/src/lib/domain/sandbox/destroy.test.ts
index c6852727615..6e770d17a93 100644
--- a/src/lib/domain/sandbox/destroy.test.ts
+++ b/src/lib/domain/sandbox/destroy.test.ts
@@ -5,8 +5,11 @@ import { describe, expect, it } from "vitest";
 
 import {
   getSandboxDeleteOutcome,
+  hasNoLiveSandboxes,
+  hasRunningDockerSandboxContainer,
   isGatewayUnreachableDeleteOutput,
   isMissingSandboxDeleteOutput,
+  resolveDestroyGatewayCleanupDecision,
   shouldCleanupGatewayAfterDestroy,
   shouldStopHostServicesAfterDestroy,
 } from "./destroy";
@@ -90,4 +93,92 @@ describe("sandbox destroy helpers", () => {
       }),
     ).toBe(false);
   });
+
+  it("resolves final-gateway cleanup defaults without prompting when unattended (#4662)", () => {
+    expect(
+      resolveDestroyGatewayCleanupDecision(
+        { cleanupGateway: true },
+        { nonInteractive: false, platform: "linux" },
+      ),
+    ).toBe("cleanup");
+    expect(
+      resolveDestroyGatewayCleanupDecision(
+        { cleanupGateway: false },
+        { nonInteractive: true, platform: "darwin" },
+      ),
+    ).toBe("preserve");
+    expect(
+      resolveDestroyGatewayCleanupDecision(
+        { yes: true },
+        { nonInteractive: false, platform: "darwin" },
+      ),
+    ).toBe("cleanup");
+    expect(
+      resolveDestroyGatewayCleanupDecision(
+        { force: true },
+        { nonInteractive: false, platform: "linux" },
+      ),
+    ).toBe("preserve");
+    expect(
+      resolveDestroyGatewayCleanupDecision({}, { nonInteractive: true, platform: "win32" }),
+    ).toBe("preserve");
+    expect(
+      resolveDestroyGatewayCleanupDecision({}, { nonInteractive: false, platform: "darwin" }),
+    ).toBe("prompt");
+  });
+
+  it("treats only terminal OpenShell rows without Docker containers as no live sandboxes (#4662)", () => {
+    const liveListOutput =
+      "NAME              CREATED              PHASE\nnpmtest           2026-06-01 00:00:00  Error\n";
+    expect(
+      hasNoLiveSandboxes({
+        captureOpenshell: () => ({ status: 0, output: liveListOutput }),
+        dockerCapture: () => "",
+        timeoutMs: 1_000,
+      }),
+    ).toBe(true);
+    expect(
+      hasNoLiveSandboxes({
+        captureOpenshell: () => ({ status: 0, output: liveListOutput }),
+        dockerCapture: () => "openshell-npmtest-e487d1bd\n",
+        timeoutMs: 1_000,
+      }),
+    ).toBe(false);
+    expect(
+      hasNoLiveSandboxes({
+        captureOpenshell: () => ({
+          status: 0,
+          output:
+            "NAME              CREATED              PHASE\nnpmtest           now                  Ready\n",
+        }),
+        dockerCapture: () => "",
+        timeoutMs: 1_000,
+      }),
+    ).toBe(false);
+  });
+
+  it("fails closed when the Docker live-container probe cannot run (#4662)", () => {
+    expect(
+      hasRunningDockerSandboxContainer(
+        "npmtest",
+        () => {
+          throw new Error("docker unavailable");
+        },
+        1_000,
+      ),
+    ).toBe(true);
+    expect(
+      hasNoLiveSandboxes({
+        captureOpenshell: () => ({
+          status: 0,
+          output:
+            "NAME              CREATED              PHASE\nnpmtest           now                  Failed\n",
+        }),
+        dockerCapture: () => {
+          throw new Error("docker unavailable");
+        },
+        timeoutMs: 1_000,
+      }),
+    ).toBe(false);
+  });
 });
diff --git a/src/lib/domain/sandbox/destroy.ts b/src/lib/domain/sandbox/destroy.ts
index 1dfd35cc1c7..8e36bf2fdc8 100644
--- a/src/lib/domain/sandbox/destroy.ts
+++ b/src/lib/domain/sandbox/destroy.ts
@@ -1,7 +1,10 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
+import { parseLiveSandboxEntries } from "../../runtime-recovery";
+
 const ANSI_RE = /\x1b\[[0-9;]*m/g;
+const TERMINAL_OPEN_SHELL_SANDBOX_PHASES = new Set(["Error", "Failed"]);
 
 function stripAnsi(value = ""): string {
   return String(value).replace(ANSI_RE, "");
@@ -13,6 +16,32 @@ export type SpawnLikeResult = {
   stderr?: string;
 };
 
+export type DestroyGatewayCleanupDecision = "cleanup" | "preserve" | "prompt";
+
+export type DestroyGatewayCleanupOptions = {
+  cleanupGateway?: boolean;
+  yes?: boolean;
+  force?: boolean;
+};
+
+export type DestroyGatewayCleanupContext = {
+  nonInteractive: boolean;
+  platform: NodeJS.Platform;
+};
+
+export type LiveSandboxListProbe = (
+  args: string[],
+  opts?: { ignoreError?: boolean; timeout?: number },
+) => { status: number | null; output: string };
+
+export type DockerCaptureProbe = (args: string[], opts?: Record<string, unknown>) => string;
+
+export type LiveSandboxProbeDeps = {
+  captureOpenshell: LiveSandboxListProbe;
+  dockerCapture: DockerCaptureProbe;
+  timeoutMs: number;
+};
+
 export function isMissingSandboxDeleteOutput(output = ""): boolean {
   return /\bNotFound\b|\bNot Found\b|sandbox not found|sandbox .* not found|sandbox .* not present|sandbox does not exist|no such sandbox/i.test(
     stripAnsi(output),
@@ -72,3 +101,75 @@ export function shouldCleanupGatewayAfterDestroy(input: {
     input.noLiveSandboxes
   );
 }
+
+/**
+ * Decide the non-UI gateway cleanup path for a final sandbox destroy.
+ *
+ * Linux preserves the shared gateway by default for reuse (#2166), while
+ * unattended macOS destroys clean it up so the leaked host listener is released
+ * (#4662). Track removal in #6639: drop the macOS default only after live
+ * macOS final destroys release the listener without forced gateway cleanup.
+ * Native win32 hosts keep the conservative non-macOS default because supported
+ * Windows runs go through WSL2 and report `linux`.
+ */
+export function resolveDestroyGatewayCleanupDecision(
+  options: DestroyGatewayCleanupOptions,
+  context: DestroyGatewayCleanupContext,
+): DestroyGatewayCleanupDecision {
+  if (options.cleanupGateway === true) return "cleanup";
+  if (options.cleanupGateway === false) return "preserve";
+  if (options.yes === true || options.force === true || context.nonInteractive) {
+    return context.platform === "darwin" ? "cleanup" : "preserve";
+  }
+  return "prompt";
+}
+
+function escapeDockerNameRegex(value: string): string {
+  return value.replace(/[\\^$.*+?()[\]{}|]/g, "\\$&");
+}
+
+export function hasRunningDockerSandboxContainer(
+  sandboxName: string,
+  dockerCapture: DockerCaptureProbe,
+  timeoutMs: number,
+): boolean {
+  try {
+    const output = dockerCapture(
+      [
+        "ps",
+        "--filter",
+        `name=^/openshell-${escapeDockerNameRegex(sandboxName)}-`,
+        "--format",
+        "{{.Names}}",
+      ],
+      {
+        ignoreError: true,
+        suppressOutput: true,
+        timeout: timeoutMs,
+      },
+    );
+    return output.trim().length > 0;
+  } catch {
+    // Fail closed: if Docker cannot be probed, preserve the shared gateway so
+    // a still-running sandbox does not lose its listener on final destroy.
+    return true;
+  }
+}
+
+export function hasNoLiveSandboxes({
+  captureOpenshell,
+  dockerCapture,
+  timeoutMs,
+}: LiveSandboxProbeDeps): boolean {
+  const liveList = captureOpenshell(["sandbox", "list"], {
+    ignoreError: true,
+    timeout: timeoutMs,
+  });
+  if (liveList.status !== 0) {
+    return false;
+  }
+  return parseLiveSandboxEntries(liveList.output).every((entry) => {
+    if (!TERMINAL_OPEN_SHELL_SANDBOX_PHASES.has(entry.phase ?? "")) return false;
+    return !hasRunningDockerSandboxContainer(entry.name, dockerCapture, timeoutMs);
+  });
+}

From 961a6af2e986daec11581c1a218ed98c2bf0e46c Mon Sep 17 00:00:00 2001
From: Prekshi Vyas <prekshiv@nvidia.com>
Date: Fri, 10 Jul 2026 11:08:27 -0700
Subject: [PATCH 14/45] test(destroy): wire macos final gateway cleanup
 coverage

---
 .github/workflows/macos-e2e.yaml              | 28 +++++++++++-
 .../actions/sandbox/destroy-gateway.test.ts   | 34 ++++++++++++++
 src/lib/core/non-interactive.test.ts          | 14 +++++-
 src/lib/domain/sandbox/destroy.ts             | 10 ++++-
 test/e2e/live/sandbox-operations.test.ts      | 44 +++++++++++++++++++
 test/helpers/destroy-flow-test-harness.ts     | 10 ++++-
 6 files changed, 134 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/macos-e2e.yaml b/.github/workflows/macos-e2e.yaml
index 56f7f1e8931..d75efd3271b 100644
--- a/.github/workflows/macos-e2e.yaml
+++ b/.github/workflows/macos-e2e.yaml
@@ -37,7 +37,7 @@ concurrency:
 jobs:
   macos-e2e:
     runs-on: macos-26
-    timeout-minutes: 30
+    timeout-minutes: 90
     steps:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -100,10 +100,34 @@ jobs:
         run: |
           NEMOCLAW_RUN_LIVE_E2E=1 npx vitest run --project e2e-live test/e2e/live/full-e2e.test.ts --silent=false --reporter=default
 
+      - name: Install OpenShell CLI for macOS sandbox operations
+        if: steps.docker.outputs.docker_ok == 'true'
+        run: bash scripts/install-openshell.sh
+
+      - name: Run macOS final-destroy gateway cleanup E2E
+        if: steps.docker.outputs.docker_ok == 'true'
+        env:
+          E2E_TARGET_ID: "sandbox-operations"
+          E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/macos-sandbox-operations
+          NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
+          NEMOCLAW_RUN_LIVE_E2E: "1"
+          NEMOCLAW_E2E_USE_HOSTED_INFERENCE: "1"
+          NEMOCLAW_NON_INTERACTIVE: "1"
+          NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
+          NEMOCLAW_POLICY_TIER: "open"
+          NVIDIA_INFERENCE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}
+          OPENSHELL_GATEWAY: "nemoclaw"
+        run: |
+          set -euo pipefail
+          export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:$PATH"
+          npx vitest run --project e2e-live \
+            test/e2e/live/sandbox-operations.test.ts \
+            --silent=false --reporter=default
+
       - name: Explain skipped full E2E
         if: steps.docker.outputs.docker_ok != 'true'
         run: |
-          echo 'Skipping macOS full E2E because Docker is unavailable on this runner.'
+          echo 'Skipping macOS live E2E because Docker is unavailable on this runner.'
           echo 'The workflow still validated the NemoClaw build on macOS (Apple Silicon).'
 
       - name: Upload logs on failure
diff --git a/src/lib/actions/sandbox/destroy-gateway.test.ts b/src/lib/actions/sandbox/destroy-gateway.test.ts
index 6999082625a..6f033eaccd3 100644
--- a/src/lib/actions/sandbox/destroy-gateway.test.ts
+++ b/src/lib/actions/sandbox/destroy-gateway.test.ts
@@ -66,6 +66,40 @@ describe("cleanupGatewayAfterLastSandbox", () => {
     );
   });
 
+  it("keeps the PID-file-scoped host gateway reaper active for Linux final destroy", () => {
+    vi.spyOn(process, "platform", "get").mockReturnValue("linux");
+    vi.spyOn(os, "homedir").mockReturnValue("/home/tester");
+    const runOpenshell = vi.fn(() => ({ status: 0, stdout: "", stderr: "" }));
+    const stateDir = path.join(
+      "/home/tester",
+      ".local",
+      "state",
+      "nemoclaw",
+      "openshell-docker-gateway-8081",
+    );
+
+    cleanupGatewayAfterLastSandbox("nemoclaw-8081", runOpenshell);
+
+    expect(mocks.stopHostGatewayProcesses).toHaveBeenCalledWith(
+      {},
+      {
+        usePgrepFallback: false,
+        stateDir,
+        pidFile: path.join(stateDir, "openshell-gateway.pid"),
+      },
+    );
+    expect(runOpenshell).toHaveBeenCalledWith(["gateway", "remove", "nemoclaw-8081"], {
+      ignoreError: true,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    expect(mocks.dockerRemoveVolumesByPrefix).toHaveBeenCalledWith(
+      "openshell-cluster-nemoclaw-8081",
+      {
+        ignoreError: true,
+      },
+    );
+  });
+
   it("keeps host gateway reaping disabled for non-Docker-driver platforms", () => {
     vi.spyOn(process, "platform", "get").mockReturnValue("win32");
     const runOpenshell = vi.fn(() => ({ status: 0, stdout: "", stderr: "" }));
diff --git a/src/lib/core/non-interactive.test.ts b/src/lib/core/non-interactive.test.ts
index 8febe34c524..2da282fe2d8 100644
--- a/src/lib/core/non-interactive.test.ts
+++ b/src/lib/core/non-interactive.test.ts
@@ -1,10 +1,14 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-import { describe, expect, it } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
 
 import { isNonInteractiveEnv } from "./non-interactive";
 
+afterEach(() => {
+  vi.unstubAllEnvs();
+});
+
 describe("non-interactive environment detection", () => {
   it("treats only the canonical value as non-interactive", () => {
     expect(isNonInteractiveEnv({ NEMOCLAW_NON_INTERACTIVE: "1" } as NodeJS.ProcessEnv)).toBe(true);
@@ -14,4 +18,12 @@ describe("non-interactive environment detection", () => {
     expect(isNonInteractiveEnv({ NEMOCLAW_NON_INTERACTIVE: "" } as NodeJS.ProcessEnv)).toBe(false);
     expect(isNonInteractiveEnv({} as NodeJS.ProcessEnv)).toBe(false);
   });
+
+  it("reads process.env when called without an argument", () => {
+    vi.stubEnv("NEMOCLAW_NON_INTERACTIVE", "1");
+    expect(isNonInteractiveEnv()).toBe(true);
+
+    vi.stubEnv("NEMOCLAW_NON_INTERACTIVE", "true");
+    expect(isNonInteractiveEnv()).toBe(false);
+  });
 });
diff --git a/src/lib/domain/sandbox/destroy.ts b/src/lib/domain/sandbox/destroy.ts
index 8e36bf2fdc8..cc5d15f8d8b 100644
--- a/src/lib/domain/sandbox/destroy.ts
+++ b/src/lib/domain/sandbox/destroy.ts
@@ -150,8 +150,14 @@ export function hasRunningDockerSandboxContainer(
     );
     return output.trim().length > 0;
   } catch {
-    // Fail closed: if Docker cannot be probed, preserve the shared gateway so
-    // a still-running sandbox does not lose its listener on final destroy.
+    // Fail closed for the #4662 invalid-state boundary: OpenShell may report a
+    // terminal sandbox row while the Docker sandbox container is still running.
+    // Docker is the authoritative source for that live-container check, and the
+    // OpenShell false terminal state cannot be fixed from this destroy path. If
+    // the Docker probe itself fails, preserve the shared gateway so a live
+    // sandbox does not lose its listener on final destroy. Covered by
+    // destroy.test.ts; remove this fallback with the terminal-row workaround
+    // after OpenShell no longer emits false terminal rows and #6639 is closed.
     return true;
   }
 }
diff --git a/test/e2e/live/sandbox-operations.test.ts b/test/e2e/live/sandbox-operations.test.ts
index 446228c5fbd..cceddd91574 100644
--- a/test/e2e/live/sandbox-operations.test.ts
+++ b/test/e2e/live/sandbox-operations.test.ts
@@ -34,6 +34,11 @@ const SANDBOX_A = "e2e-sbx-a";
 const SANDBOX_B = "e2e-sbx-b";
 const REGISTRY_FILE = path.join(process.env.HOME ?? os.homedir(), ".nemoclaw", "sandboxes.json");
 const GATEWAY_CONTAINER = "openshell-cluster-nemoclaw";
+const GATEWAY_PORT = process.env.NEMOCLAW_GATEWAY_PORT ?? "8080";
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
 
 async function onboardSandbox(
   host: HostCliClient,
@@ -526,6 +531,39 @@ async function assertDestroyRemovesSandbox(
   expect(outputContainsSandbox(openshellList, sandboxName), resultText(openshellList)).toBe(false);
 }
 
+async function expectHostPortFree(
+  host: HostCliClient,
+  port: string,
+  artifactName: string,
+  timeoutMs = 90_000,
+): Promise<void> {
+  const startedAt = Date.now();
+  let lastProbe: ShellProbeResult | undefined;
+  for (let attempt = 1; Date.now() - startedAt < timeoutMs; attempt += 1) {
+    const probe = await host.command(
+      "node",
+      [
+        "-e",
+        'const net=require("node:net"); const server=net.createServer(); server.once("error", error => { console.error(error.code || "bind failed"); process.exit(1); }); server.listen(Number(process.argv[1]), "127.0.0.1", () => server.close(error => { if (error) { console.error(error.message); process.exit(1); } console.log("available"); }));',
+        port,
+      ],
+      {
+        artifactName: `${artifactName}-attempt-${attempt}`,
+        env: buildAvailabilityProbeEnv(),
+        timeoutMs: 30_000,
+      },
+    );
+    if (probe.exitCode === 0) return;
+    lastProbe = probe;
+    await sleep(2_000);
+  }
+  throw new Error(
+    `gateway port ${port} remained occupied after final destroy: ${
+      lastProbe ? resultText(lastProbe) : "no probe completed"
+    }`,
+  );
+}
+
 type GatewayRecoveryOutcome =
   | "recovered-before-status"
   | "recovered-by-status"
@@ -609,6 +647,7 @@ test(
         "TC-SBX-09 tmux and PTY lifecycle work inside sandbox",
         "TC-SBX-10 two sandboxes list with model/provider metadata",
         "TC-SBX-11 sandboxes cannot reach each other by hostname",
+        "TC-SBX-12 destroying the non-final sandbox preserves the survivor and final destroy releases the gateway port",
       ],
     });
 
@@ -643,12 +682,17 @@ test(
     await assertNetworkIsolation(sandbox, SANDBOX_A, SANDBOX_B, "tc-sbx-11-a-cannot-reach-b");
     await assertNetworkIsolation(sandbox, SANDBOX_B, SANDBOX_A, "tc-sbx-11-b-cannot-reach-a");
     await assertDestroyRemovesSandbox(host, sandbox, SANDBOX_B);
+    await expectListed(host, SANDBOX_A, "tc-sbx-12-survivor-listed-after-destroy-b");
+    await assertAgentCanAnswer(host, SANDBOX_A, "tc-sbx-12-survivor-agent-after-destroy-b");
 
     const gatewayRecovery = await assertGatewayRecovery(host, SANDBOX_A);
+    await assertDestroyRemovesSandbox(host, sandbox, SANDBOX_A);
+    await expectHostPortFree(host, GATEWAY_PORT, "tc-sbx-12-final-destroy-gateway-port-free");
 
     await artifacts.target.complete({
       id: "sandbox-operations",
       status: "passed",
+      finalGatewayPortReleased: true,
       gatewayRecovery,
       legacySource: "test/e2e/test-sandbox-operations.sh",
     });
diff --git a/test/helpers/destroy-flow-test-harness.ts b/test/helpers/destroy-flow-test-harness.ts
index ad746dcbe87..2356eb2bff4 100644
--- a/test/helpers/destroy-flow-test-harness.ts
+++ b/test/helpers/destroy-flow-test-harness.ts
@@ -198,7 +198,15 @@ export function createDestroyHarness(options: DestroyHarnessOptions = {}): Destr
   });
   vi.spyOn(dockerRun, "dockerCapture").mockImplementation((args: unknown) => {
     const argv = Array.isArray(args) ? args.map(String) : [];
-    return argv[0] === "ps" ? (options.dockerPsOutput ?? "") : "";
+    if (argv[0] !== "ps") return "";
+    const filterIndex = argv.indexOf("--filter");
+    const filterValue = filterIndex >= 0 ? argv[filterIndex + 1] : undefined;
+    const nameFilter = filterValue?.startsWith("name=") ? filterValue.slice(5) : undefined;
+    const names = (options.dockerPsOutput ?? "").split("\n").filter(Boolean);
+    const matchedNames = nameFilter
+      ? names.filter((name) => new RegExp(nameFilter).test(`/${name}`))
+      : names;
+    return matchedNames.length > 0 ? `${matchedNames.join("\n")}\n` : "";
   });
   const selectGatewaySpy = vi
     .spyOn(destroyGateway, "selectGatewayForSandboxDestroy")

From a254dbe3b36be24d1441192a8b70290edb5c039c Mon Sep 17 00:00:00 2001
From: Prekshi Vyas <prekshiv@nvidia.com>
Date: Fri, 10 Jul 2026 11:13:46 -0700
Subject: [PATCH 15/45] test(e2e): record sandbox operations live parity

---
 test/e2e/live/sandbox-operations.test.ts | 42 ++++++++----------------
 test/e2e/mock-parity.json                | 10 ++++++
 2 files changed, 24 insertions(+), 28 deletions(-)
 create mode 100644 test/e2e/mock-parity.json

diff --git a/test/e2e/live/sandbox-operations.test.ts b/test/e2e/live/sandbox-operations.test.ts
index cceddd91574..b4bcf72b8d0 100644
--- a/test/e2e/live/sandbox-operations.test.ts
+++ b/test/e2e/live/sandbox-operations.test.ts
@@ -36,10 +36,6 @@ const REGISTRY_FILE = path.join(process.env.HOME ?? os.homedir(), ".nemoclaw", "
 const GATEWAY_CONTAINER = "openshell-cluster-nemoclaw";
 const GATEWAY_PORT = process.env.NEMOCLAW_GATEWAY_PORT ?? "8080";
 
-function sleep(ms: number): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
 async function onboardSandbox(
   host: HostCliClient,
   cleanup: CleanupRegistry,
@@ -537,31 +533,21 @@ async function expectHostPortFree(
   artifactName: string,
   timeoutMs = 90_000,
 ): Promise<void> {
-  const startedAt = Date.now();
-  let lastProbe: ShellProbeResult | undefined;
-  for (let attempt = 1; Date.now() - startedAt < timeoutMs; attempt += 1) {
-    const probe = await host.command(
-      "node",
-      [
-        "-e",
-        'const net=require("node:net"); const server=net.createServer(); server.once("error", error => { console.error(error.code || "bind failed"); process.exit(1); }); server.listen(Number(process.argv[1]), "127.0.0.1", () => server.close(error => { if (error) { console.error(error.message); process.exit(1); } console.log("available"); }));',
-        port,
-      ],
-      {
-        artifactName: `${artifactName}-attempt-${attempt}`,
-        env: buildAvailabilityProbeEnv(),
-        timeoutMs: 30_000,
-      },
-    );
-    if (probe.exitCode === 0) return;
-    lastProbe = probe;
-    await sleep(2_000);
-  }
-  throw new Error(
-    `gateway port ${port} remained occupied after final destroy: ${
-      lastProbe ? resultText(lastProbe) : "no probe completed"
-    }`,
+  const probe = await host.command(
+    "node",
+    [
+      "-e",
+      'const net=require("node:net"); const port=Number(process.argv[1]); const deadline=Date.now()+Number(process.argv[2]); const attempt=()=>{ const server=net.createServer(); server.once("error", error => { if (Date.now() >= deadline) { console.error(error.code || "bind failed"); process.exit(1); } setTimeout(attempt, 2000); }); server.listen(port, "127.0.0.1", () => server.close(error => { if (error) { console.error(error.message); process.exit(1); } console.log("available"); })); }; attempt();',
+      port,
+      String(timeoutMs),
+    ],
+    {
+      artifactName,
+      env: buildAvailabilityProbeEnv(),
+      timeoutMs: timeoutMs + 30_000,
+    },
   );
+  expectExitZero(probe, `gateway port ${port} remained occupied after final destroy`);
 }
 
 type GatewayRecoveryOutcome =
diff --git a/test/e2e/mock-parity.json b/test/e2e/mock-parity.json
new file mode 100644
index 00000000000..ad2fe1eb77f
--- /dev/null
+++ b/test/e2e/mock-parity.json
@@ -0,0 +1,10 @@
+{
+  "$comment": "SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.\nSPDX-License-Identifier: Apache-2.0",
+  "version": 1,
+  "entries": [
+    {
+      "live": "test/e2e/live/sandbox-operations.test.ts",
+      "liveOnlyReason": "The final-destroy gateway release contract needs two real Docker/OpenShell sandboxes plus host 127.0.0.1 port binding; a fast mock cannot prove the shared-gateway ownership boundary."
+    }
+  ]
+}

From 3ae27f5d682b82aa088078605c9980ca4dc22987 Mon Sep 17 00:00:00 2001
From: Prekshi Vyas <prekshiv@nvidia.com>
Date: Fri, 10 Jul 2026 11:44:32 -0700
Subject: [PATCH 16/45] fix(ci): gate macos live e2e to trusted runs

---
 .github/workflows/macos-e2e.yaml             | 48 +++++++++----
 src/lib/actions/sandbox/destroy-flow.test.ts | 11 +++
 src/lib/actions/sandbox/destroy-gateway.ts   |  5 ++
 src/lib/actions/sandbox/destroy.ts           | 37 +++++-----
 src/lib/domain/sandbox/destroy.ts            | 10 +--
 test/helpers/destroy-flow-test-harness.ts    | 32 +++++----
 test/macos-e2e-workflow-boundary.test.ts     | 75 ++++++++++++++++++++
 7 files changed, 173 insertions(+), 45 deletions(-)
 create mode 100644 test/macos-e2e-workflow-boundary.test.ts

diff --git a/.github/workflows/macos-e2e.yaml b/.github/workflows/macos-e2e.yaml
index d75efd3271b..75074431669 100644
--- a/.github/workflows/macos-e2e.yaml
+++ b/.github/workflows/macos-e2e.yaml
@@ -37,7 +37,7 @@ concurrency:
 jobs:
   macos-e2e:
     runs-on: macos-26
-    timeout-minutes: 90
+    timeout-minutes: 150
     steps:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -76,22 +76,42 @@ jobs:
           test/tunnel-gateway-port-release-runtime.test.ts
           test/onboard-gateway-prelaunch-cutover.test.ts
 
-      - name: Detect Docker availability
+      - name: Prepare Docker availability
         id: docker
+        env:
+          TRUSTED_MACOS_LIVE: ${{ github.event_name != 'pull_request' && '1' || '0' }}
         run: |
+          set -euo pipefail
           if docker info >/dev/null 2>&1; then
             echo "docker_ok=true" >> "$GITHUB_OUTPUT"
             echo "Docker is available"
             docker version
-          else
+            exit 0
+          fi
+
+          if [ "$TRUSTED_MACOS_LIVE" != "1" ]; then
             echo "docker_ok=false" >> "$GITHUB_OUTPUT"
-            echo "Docker is not available on this runner"
+            echo "Docker is unavailable; pull_request macOS runs skip secret-bearing live E2E."
+            exit 0
           fi
 
+          echo "Docker is unavailable; starting Colima for trusted macOS live E2E."
+          install_formula() {
+            if ! brew list --formula "$1" >/dev/null 2>&1; then
+              brew install "$1"
+            fi
+          }
+          install_formula colima
+          install_formula docker
+          colima start --cpu 4 --memory 8 --disk 80 --vm-type vz --mount-type virtiofs
+          docker info
+          echo "docker_ok=true" >> "$GITHUB_OUTPUT"
+          docker version
+
       - name: Run macOS full E2E
-        if: steps.docker.outputs.docker_ok == 'true'
+        if: steps.docker.outputs.docker_ok == 'true' && github.event_name != 'pull_request'
         env:
-          NVIDIA_INFERENCE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}
+          NVIDIA_INFERENCE_API_KEY: ${{ github.event_name != 'pull_request' && secrets.NVIDIA_INFERENCE_API_KEY || '' }}
           GITHUB_TOKEN: ${{ github.token }}
           NEMOCLAW_NON_INTERACTIVE: "1"
           NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
@@ -101,11 +121,11 @@ jobs:
           NEMOCLAW_RUN_LIVE_E2E=1 npx vitest run --project e2e-live test/e2e/live/full-e2e.test.ts --silent=false --reporter=default
 
       - name: Install OpenShell CLI for macOS sandbox operations
-        if: steps.docker.outputs.docker_ok == 'true'
+        if: steps.docker.outputs.docker_ok == 'true' && github.event_name != 'pull_request'
         run: bash scripts/install-openshell.sh
 
       - name: Run macOS final-destroy gateway cleanup E2E
-        if: steps.docker.outputs.docker_ok == 'true'
+        if: steps.docker.outputs.docker_ok == 'true' && github.event_name != 'pull_request'
         env:
           E2E_TARGET_ID: "sandbox-operations"
           E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/macos-sandbox-operations
@@ -115,7 +135,7 @@ jobs:
           NEMOCLAW_NON_INTERACTIVE: "1"
           NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
           NEMOCLAW_POLICY_TIER: "open"
-          NVIDIA_INFERENCE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}
+          NVIDIA_INFERENCE_API_KEY: ${{ github.event_name != 'pull_request' && secrets.NVIDIA_INFERENCE_API_KEY || '' }}
           OPENSHELL_GATEWAY: "nemoclaw"
         run: |
           set -euo pipefail
@@ -124,10 +144,14 @@ jobs:
             test/e2e/live/sandbox-operations.test.ts \
             --silent=false --reporter=default
 
-      - name: Explain skipped full E2E
-        if: steps.docker.outputs.docker_ok != 'true'
+      - name: Explain skipped macOS live E2E
+        if: steps.docker.outputs.docker_ok != 'true' || github.event_name == 'pull_request'
         run: |
-          echo 'Skipping macOS live E2E because Docker is unavailable on this runner.'
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            echo 'Skipping secret-bearing macOS live E2E on pull_request; use trusted workflow_dispatch/push evidence for live validation.'
+          elif [ "${{ steps.docker.outputs.docker_ok }}" != "true" ]; then
+            echo 'Skipping macOS live E2E because Docker is unavailable on this runner.'
+          fi
           echo 'The workflow still validated the NemoClaw build on macOS (Apple Silicon).'
 
       - name: Upload logs on failure
diff --git a/src/lib/actions/sandbox/destroy-flow.test.ts b/src/lib/actions/sandbox/destroy-flow.test.ts
index 6c4c3f1911e..5e7fed05339 100644
--- a/src/lib/actions/sandbox/destroy-flow.test.ts
+++ b/src/lib/actions/sandbox/destroy-flow.test.ts
@@ -102,6 +102,17 @@ describe("destroySandbox flow", () => {
     expect(harness.cleanupGatewaySpy).not.toHaveBeenCalled();
   });
 
+  it("does not probe live sandboxes when registered sandboxes remain (#4662)", async () => {
+    vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
+    const harness = createDestroyHarness({ registeredSandboxCount: 2 });
+
+    await expect(harness.destroySandbox("alpha", { yes: true })).resolves.toBeUndefined();
+
+    expect(harness.captureOpenshellSpy).not.toHaveBeenCalled();
+    expect(harness.dockerCaptureSpy).not.toHaveBeenCalled();
+    expect(harness.cleanupGatewaySpy).not.toHaveBeenCalled();
+  });
+
   it("preserves the final gateway for native Windows unattended destroys (#4662)", async () => {
     // Supported Windows execution uses WSL2, which reports `linux`. Keep an
     // unexpected native `win32` host on the conservative non-macOS default.
diff --git a/src/lib/actions/sandbox/destroy-gateway.ts b/src/lib/actions/sandbox/destroy-gateway.ts
index b8e5955b89b..15a8e991d6d 100644
--- a/src/lib/actions/sandbox/destroy-gateway.ts
+++ b/src/lib/actions/sandbox/destroy-gateway.ts
@@ -112,6 +112,11 @@ export function cleanupGatewayAfterLastSandbox(
    * rejects as an unrecognized subcommand (#6569). The host-process stop above
    * now uses the same PID-file-scoped reaper as Linux so final unattended
    * macOS destroys release the Docker-driver gateway listener (#4662).
+   * Removal tracker: #6652. Remove the macOS reliance on this host-process
+   * fallback after OpenShell releases the Docker-driver listener fix, NemoClaw
+   * raises its supported OpenShell floor to that fixed build, and a real macOS
+   * Docker-driver sandbox-operations run proves final unattended destroy
+   * releases the gateway port without this fallback.
    */
   const removeResult = openshell(["gateway", "remove", gatewayName], {
     ignoreError: true,
diff --git a/src/lib/actions/sandbox/destroy.ts b/src/lib/actions/sandbox/destroy.ts
index ca7f40cd6eb..28d751eaeaf 100644
--- a/src/lib/actions/sandbox/destroy.ts
+++ b/src/lib/actions/sandbox/destroy.ts
@@ -398,26 +398,31 @@ async function destroySandboxUnlocked(
       return s;
     });
   }
+  const noRegisteredSandboxes = registry.listSandboxes().sandboxes.length === 0;
+  const shouldProbeLiveSandboxes = deleteSucceededOrAlreadyGone && removed && noRegisteredSandboxes;
+  const noLiveSandboxes =
+    shouldProbeLiveSandboxes &&
+    hasNoLiveSandboxes({
+      captureOpenshell: (...args) => {
+        const { captureOpenshell } = require("../../adapters/openshell/runtime") as {
+          captureOpenshell: LiveSandboxListProbe;
+        };
+        return captureOpenshell(...args);
+      },
+      dockerCapture: (...args) => {
+        const { dockerCapture } = require("../../adapters/docker/run") as {
+          dockerCapture: DockerCaptureProbe;
+        };
+        return dockerCapture(...args);
+      },
+      timeoutMs: OPENSHELL_PROBE_TIMEOUT_MS,
+    });
   if (
     shouldCleanupGatewayAfterDestroy({
       deleteSucceededOrAlreadyGone,
       removedRegistryEntry: removed,
-      noRegisteredSandboxes: registry.listSandboxes().sandboxes.length === 0,
-      noLiveSandboxes: hasNoLiveSandboxes({
-        captureOpenshell: (...args) => {
-          const { captureOpenshell } = require("../../adapters/openshell/runtime") as {
-            captureOpenshell: LiveSandboxListProbe;
-          };
-          return captureOpenshell(...args);
-        },
-        dockerCapture: (...args) => {
-          const { dockerCapture } = require("../../adapters/docker/run") as {
-            dockerCapture: DockerCaptureProbe;
-          };
-          return dockerCapture(...args);
-        },
-        timeoutMs: OPENSHELL_PROBE_TIMEOUT_MS,
-      }),
+      noRegisteredSandboxes,
+      noLiveSandboxes,
     })
   ) {
     const shouldCleanupGateway = await resolveCleanupGatewayDecision(normalized);
diff --git a/src/lib/domain/sandbox/destroy.ts b/src/lib/domain/sandbox/destroy.ts
index cc5d15f8d8b..06fa6a89d6a 100644
--- a/src/lib/domain/sandbox/destroy.ts
+++ b/src/lib/domain/sandbox/destroy.ts
@@ -107,8 +107,10 @@ export function shouldCleanupGatewayAfterDestroy(input: {
  *
  * Linux preserves the shared gateway by default for reuse (#2166), while
  * unattended macOS destroys clean it up so the leaked host listener is released
- * (#4662). Track removal in #6639: drop the macOS default only after live
- * macOS final destroys release the listener without forced gateway cleanup.
+ * (#4662). Track removal in #6652: drop the macOS default after OpenShell
+ * releases the Docker-driver listener fix, NemoClaw raises its supported
+ * OpenShell floor to that fixed version, and live macOS final destroys release
+ * the listener without forced gateway cleanup.
  * Native win32 hosts keep the conservative non-macOS default because supported
  * Windows runs go through WSL2 and report `linux`.
  */
@@ -156,8 +158,8 @@ export function hasRunningDockerSandboxContainer(
     // OpenShell false terminal state cannot be fixed from this destroy path. If
     // the Docker probe itself fails, preserve the shared gateway so a live
     // sandbox does not lose its listener on final destroy. Covered by
-    // destroy.test.ts; remove this fallback with the terminal-row workaround
-    // after OpenShell no longer emits false terminal rows and #6639 is closed.
+    // destroy.test.ts; remove this fallback after OpenShell no longer emits
+    // false terminal rows and #6652 is closed.
     return true;
   }
 }
diff --git a/test/helpers/destroy-flow-test-harness.ts b/test/helpers/destroy-flow-test-harness.ts
index 2356eb2bff4..ec87dfa1107 100644
--- a/test/helpers/destroy-flow-test-harness.ts
+++ b/test/helpers/destroy-flow-test-harness.ts
@@ -14,7 +14,9 @@ const destroyModulePath = "./destroy.js";
 
 export type DestroyHarness = {
   cleanupGatewaySpy: MockInstance;
+  captureOpenshellSpy: MockInstance;
   destroySandbox: DestroySandbox;
+  dockerCaptureSpy: MockInstance;
   errorSpy: MockInstance;
   events: string[];
   finalizeMcpBridgesAfterSandboxDeleteSpy: MockInstance;
@@ -192,22 +194,24 @@ export function createDestroyHarness(options: DestroyHarnessOptions = {}): Destr
         return { status: 0, stdout: "", stderr: "" };
     }
   });
-  vi.spyOn(runtime, "captureOpenshell").mockReturnValue({
+  const captureOpenshellSpy = vi.spyOn(runtime, "captureOpenshell").mockReturnValue({
     status: 0,
     output: options.liveListOutput ?? "",
   });
-  vi.spyOn(dockerRun, "dockerCapture").mockImplementation((args: unknown) => {
-    const argv = Array.isArray(args) ? args.map(String) : [];
-    if (argv[0] !== "ps") return "";
-    const filterIndex = argv.indexOf("--filter");
-    const filterValue = filterIndex >= 0 ? argv[filterIndex + 1] : undefined;
-    const nameFilter = filterValue?.startsWith("name=") ? filterValue.slice(5) : undefined;
-    const names = (options.dockerPsOutput ?? "").split("\n").filter(Boolean);
-    const matchedNames = nameFilter
-      ? names.filter((name) => new RegExp(nameFilter).test(`/${name}`))
-      : names;
-    return matchedNames.length > 0 ? `${matchedNames.join("\n")}\n` : "";
-  });
+  const dockerCaptureSpy = vi
+    .spyOn(dockerRun, "dockerCapture")
+    .mockImplementation((args: unknown) => {
+      const argv = Array.isArray(args) ? args.map(String) : [];
+      if (argv[0] !== "ps") return "";
+      const filterIndex = argv.indexOf("--filter");
+      const filterValue = filterIndex >= 0 ? argv[filterIndex + 1] : undefined;
+      const nameFilter = filterValue?.startsWith("name=") ? filterValue.slice(5) : undefined;
+      const names = (options.dockerPsOutput ?? "").split("\n").filter(Boolean);
+      const matchedNames = nameFilter
+        ? names.filter((name) => new RegExp(nameFilter).test(`/${name}`))
+        : names;
+      return matchedNames.length > 0 ? `${matchedNames.join("\n")}\n` : "";
+    });
   const selectGatewaySpy = vi
     .spyOn(destroyGateway, "selectGatewayForSandboxDestroy")
     .mockImplementation(() => undefined);
@@ -300,6 +304,8 @@ export function createDestroyHarness(options: DestroyHarnessOptions = {}): Destr
 
   return {
     cleanupGatewaySpy,
+    captureOpenshellSpy,
+    dockerCaptureSpy,
     destroySandbox: requireDist(destroyModulePath).destroySandbox,
     errorSpy,
     events,
diff --git a/test/macos-e2e-workflow-boundary.test.ts b/test/macos-e2e-workflow-boundary.test.ts
new file mode 100644
index 00000000000..4c1cd47d1f7
--- /dev/null
+++ b/test/macos-e2e-workflow-boundary.test.ts
@@ -0,0 +1,75 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import fs from "node:fs";
+import path from "node:path";
+
+import { describe, expect, it } from "vitest";
+import YAML from "yaml";
+
+type WorkflowStep = {
+  name?: string;
+  if?: string;
+  env?: Record<string, unknown>;
+  run?: string;
+};
+
+type WorkflowJob = {
+  "timeout-minutes"?: number;
+  steps?: WorkflowStep[];
+};
+
+type Workflow = {
+  jobs?: Record<string, WorkflowJob>;
+  on?: Record<string, unknown>;
+};
+
+function readMacosWorkflow(): Workflow {
+  return YAML.parse(
+    fs.readFileSync(path.join(process.cwd(), ".github", "workflows", "macos-e2e.yaml"), "utf8"),
+  ) as Workflow;
+}
+
+function macosJob(): WorkflowJob {
+  const job = readMacosWorkflow().jobs?.["macos-e2e"];
+  expect(job).toBeDefined();
+  return job!;
+}
+
+function stepNamed(name: string): WorkflowStep {
+  const step = macosJob().steps?.find((candidate) => candidate.name === name);
+  expect(step).toBeDefined();
+  return step!;
+}
+
+describe("macOS E2E workflow boundary", () => {
+  it("keeps secret-bearing live E2E off pull_request runs", () => {
+    expect(readMacosWorkflow().on?.pull_request).toBeDefined();
+
+    for (const name of [
+      "Run macOS full E2E",
+      "Install OpenShell CLI for macOS sandbox operations",
+      "Run macOS final-destroy gateway cleanup E2E",
+    ]) {
+      expect(stepNamed(name).if).toContain("github.event_name != 'pull_request'");
+    }
+
+    for (const name of ["Run macOS full E2E", "Run macOS final-destroy gateway cleanup E2E"]) {
+      expect(String(stepNamed(name).env?.NVIDIA_INFERENCE_API_KEY)).toContain(
+        "github.event_name != 'pull_request'",
+      );
+    }
+  });
+
+  it("starts Docker with Colima only for trusted macOS live runs", () => {
+    const docker = stepNamed("Prepare Docker availability");
+    expect(String(docker.env?.TRUSTED_MACOS_LIVE)).toContain("github.event_name != 'pull_request'");
+    expect(docker.run).toContain('TRUSTED_MACOS_LIVE" != "1"');
+    expect(docker.run).toContain("colima start");
+    expect(docker.run).toContain("docker info");
+  });
+
+  it("keeps the job timeout outside the combined live test budgets", () => {
+    expect(macosJob()["timeout-minutes"]).toBeGreaterThanOrEqual(150);
+  });
+});

From d63f124a5a01b4d41ebbe3f2f1244df2ae71d270 Mon Sep 17 00:00:00 2001
From: Prekshi Vyas <prekshiv@nvidia.com>
Date: Fri, 10 Jul 2026 11:57:23 -0700
Subject: [PATCH 17/45] fix(e2e): make final sandbox cleanup explicit

---
 .github/workflows/macos-e2e.yaml         | 13 +++++++++++--
 test/e2e/live/sandbox-operations.test.ts |  9 ++++++---
 test/macos-e2e-workflow-boundary.test.ts |  2 ++
 3 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/macos-e2e.yaml b/.github/workflows/macos-e2e.yaml
index 75074431669..f7d1d4848f4 100644
--- a/.github/workflows/macos-e2e.yaml
+++ b/.github/workflows/macos-e2e.yaml
@@ -103,8 +103,17 @@ jobs:
           }
           install_formula colima
           install_formula docker
-          colima start --cpu 4 --memory 8 --disk 80 --vm-type vz --mount-type virtiofs
-          docker info
+          if ! colima start --cpu 4 --memory 8 --disk 80 --vm-type vz --mount-type virtiofs; then
+            echo "::warning::Colima could not start Docker on this macOS runner; skipping live E2E."
+            echo "docker_ok=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          if ! docker info; then
+            echo "::warning::Docker remained unavailable after Colima startup; skipping live E2E."
+            echo "docker_ok=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
           echo "docker_ok=true" >> "$GITHUB_OUTPUT"
           docker version
 
diff --git a/test/e2e/live/sandbox-operations.test.ts b/test/e2e/live/sandbox-operations.test.ts
index b4bcf72b8d0..1547b4b6012 100644
--- a/test/e2e/live/sandbox-operations.test.ts
+++ b/test/e2e/live/sandbox-operations.test.ts
@@ -504,13 +504,16 @@ async function assertDestroyRemovesSandbox(
   host: HostCliClient,
   sandbox: SandboxClient,
   sandboxName: string,
+  options: { cleanupGateway?: boolean } = {},
 ): Promise<void> {
-  const destroy = await host.nemoclaw([sandboxName, "destroy", "--yes"], {
+  const destroyArgs = [sandboxName, "destroy", "--yes"];
+  if (options.cleanupGateway) destroyArgs.push("--cleanup-gateway");
+  const destroy = await host.nemoclaw(destroyArgs, {
     artifactName: `tc-sbx-05-destroy-${sandboxName}`,
     env: buildAvailabilityProbeEnv(),
     timeoutMs: 15 * 60_000,
   });
-  expectExitZero(destroy, `nemoclaw ${sandboxName} destroy --yes`);
+  expectExitZero(destroy, `nemoclaw ${destroyArgs.join(" ")}`);
 
   const list = await host.nemoclaw(["list"], {
     artifactName: `tc-sbx-05-nemoclaw-list-after-destroy-${sandboxName}`,
@@ -672,7 +675,7 @@ test(
     await assertAgentCanAnswer(host, SANDBOX_A, "tc-sbx-12-survivor-agent-after-destroy-b");
 
     const gatewayRecovery = await assertGatewayRecovery(host, SANDBOX_A);
-    await assertDestroyRemovesSandbox(host, sandbox, SANDBOX_A);
+    await assertDestroyRemovesSandbox(host, sandbox, SANDBOX_A, { cleanupGateway: true });
     await expectHostPortFree(host, GATEWAY_PORT, "tc-sbx-12-final-destroy-gateway-port-free");
 
     await artifacts.target.complete({
diff --git a/test/macos-e2e-workflow-boundary.test.ts b/test/macos-e2e-workflow-boundary.test.ts
index 4c1cd47d1f7..2398b0ffa86 100644
--- a/test/macos-e2e-workflow-boundary.test.ts
+++ b/test/macos-e2e-workflow-boundary.test.ts
@@ -66,6 +66,8 @@ describe("macOS E2E workflow boundary", () => {
     expect(String(docker.env?.TRUSTED_MACOS_LIVE)).toContain("github.event_name != 'pull_request'");
     expect(docker.run).toContain('TRUSTED_MACOS_LIVE" != "1"');
     expect(docker.run).toContain("colima start");
+    expect(docker.run).toContain("Colima could not start Docker");
+    expect(docker.run).toContain("docker_ok=false");
     expect(docker.run).toContain("docker info");
   });
 

From 57bfbf1bc33e8d50549d7e320f59de28408c6bcd Mon Sep 17 00:00:00 2001
From: Prekshi Vyas <prekshiv@nvidia.com>
Date: Fri, 10 Jul 2026 11:59:33 -0700
Subject: [PATCH 18/45] test(e2e): avoid growing sandbox conditional count

---
 test/e2e/live/sandbox-operations.test.ts | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/test/e2e/live/sandbox-operations.test.ts b/test/e2e/live/sandbox-operations.test.ts
index 1547b4b6012..d2ff4b3812d 100644
--- a/test/e2e/live/sandbox-operations.test.ts
+++ b/test/e2e/live/sandbox-operations.test.ts
@@ -506,8 +506,12 @@ async function assertDestroyRemovesSandbox(
   sandboxName: string,
   options: { cleanupGateway?: boolean } = {},
 ): Promise<void> {
-  const destroyArgs = [sandboxName, "destroy", "--yes"];
-  if (options.cleanupGateway) destroyArgs.push("--cleanup-gateway");
+  const destroyArgs = [
+    sandboxName,
+    "destroy",
+    "--yes",
+    ...(options.cleanupGateway ? ["--cleanup-gateway"] : []),
+  ];
   const destroy = await host.nemoclaw(destroyArgs, {
     artifactName: `tc-sbx-05-destroy-${sandboxName}`,
     env: buildAvailabilityProbeEnv(),

From b9ca8ab0e01868527d7240e6f2592c73ed0d960d Mon Sep 17 00:00:00 2001
From: Prekshi Vyas <prekshiv@nvidia.com>
Date: Fri, 10 Jul 2026 12:15:02 -0700
Subject: [PATCH 19/45] fix(destroy): isolate final gateway cleanup probe

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
---
 .github/workflows/macos-e2e.yaml              | 16 ++---
 src/lib/actions/sandbox/destroy-flow.test.ts  | 13 ++++
 .../sandbox/destroy-gateway-cleanup.test.ts   | 54 +++++++++++++++
 .../sandbox/destroy-gateway-cleanup.ts        | 66 +++++++++++++++++++
 src/lib/actions/sandbox/destroy-gateway.ts    |  2 +-
 src/lib/actions/sandbox/destroy.ts            | 29 +-------
 src/lib/domain/sandbox/destroy.test.ts        | 29 +++++++-
 src/lib/domain/sandbox/destroy.ts             | 53 +++++++++++----
 test/helpers/destroy-flow-test-harness.ts     |  2 +-
 test/macos-e2e-workflow-boundary.test.ts      | 16 ++++-
 10 files changed, 227 insertions(+), 53 deletions(-)
 create mode 100644 src/lib/actions/sandbox/destroy-gateway-cleanup.test.ts
 create mode 100644 src/lib/actions/sandbox/destroy-gateway-cleanup.ts

diff --git a/.github/workflows/macos-e2e.yaml b/.github/workflows/macos-e2e.yaml
index f7d1d4848f4..91d79b03b46 100644
--- a/.github/workflows/macos-e2e.yaml
+++ b/.github/workflows/macos-e2e.yaml
@@ -95,14 +95,13 @@ jobs:
             exit 0
           fi
 
-          echo "Docker is unavailable; starting Colima for trusted macOS live E2E."
-          install_formula() {
-            if ! brew list --formula "$1" >/dev/null 2>&1; then
-              brew install "$1"
-            fi
-          }
-          install_formula colima
-          install_formula docker
+          if ! command -v docker >/dev/null 2>&1 || ! command -v colima >/dev/null 2>&1; then
+            echo "::warning::Docker/Colima is not preinstalled on this macOS runner; skipping live E2E instead of bootstrapping floating Homebrew packages before credentialed steps."
+            echo "docker_ok=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "Docker is unavailable; starting preinstalled Colima for trusted macOS live E2E."
           if ! colima start --cpu 4 --memory 8 --disk 80 --vm-type vz --mount-type virtiofs; then
             echo "::warning::Colima could not start Docker on this macOS runner; skipping live E2E."
             echo "docker_ok=false" >> "$GITHUB_OUTPUT"
@@ -170,4 +169,5 @@ jobs:
           name: macos-e2e-logs
           path: |
             /tmp/nemoclaw-e2e-*.log
+            ${{ github.workspace }}/e2e-artifacts/live
           if-no-files-found: ignore
diff --git a/src/lib/actions/sandbox/destroy-flow.test.ts b/src/lib/actions/sandbox/destroy-flow.test.ts
index 5e7fed05339..1c15bd47734 100644
--- a/src/lib/actions/sandbox/destroy-flow.test.ts
+++ b/src/lib/actions/sandbox/destroy-flow.test.ts
@@ -166,6 +166,19 @@ describe("destroySandbox flow", () => {
     expect(harness.cleanupGatewaySpy).not.toHaveBeenCalled();
   });
 
+  it("treats Docker name filters as literal substring matches in cleanup probes (#4662)", async () => {
+    vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
+    const harness = createDestroyHarness({
+      dockerPsOutput: "openshell-npmtest[-e487d1bd\n",
+      liveListOutput:
+        "NAME              CREATED              PHASE\nnpmtest[          2026-06-01 00:00:00  Error\n",
+    });
+
+    await expect(harness.destroySandbox("alpha", { yes: true })).resolves.toBeUndefined();
+
+    expect(harness.cleanupGatewaySpy).not.toHaveBeenCalled();
+  });
+
   it("honors the gateway preservation environment override on macOS (#4662)", async () => {
     vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
     vi.stubEnv("NEMOCLAW_CLEANUP_GATEWAY", "0");
diff --git a/src/lib/actions/sandbox/destroy-gateway-cleanup.test.ts b/src/lib/actions/sandbox/destroy-gateway-cleanup.test.ts
new file mode 100644
index 00000000000..29446f7c266
--- /dev/null
+++ b/src/lib/actions/sandbox/destroy-gateway-cleanup.test.ts
@@ -0,0 +1,54 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { describe, expect, it, vi } from "vitest";
+
+import { shouldCleanupGatewayAfterConfirmedFinalDestroy } from "./destroy-gateway-cleanup";
+
+describe("shouldCleanupGatewayAfterConfirmedFinalDestroy", () => {
+  it("defers live probes until the local registry is empty", () => {
+    const liveSandboxProbe = vi.fn(() => true);
+
+    expect(
+      shouldCleanupGatewayAfterConfirmedFinalDestroy(
+        {
+          deleteSucceededOrAlreadyGone: true,
+          removedRegistryEntry: true,
+        },
+        {
+          listSandboxes: () => ({ sandboxes: [{}] }),
+          liveSandboxProbe,
+        },
+      ),
+    ).toBe(false);
+    expect(liveSandboxProbe).not.toHaveBeenCalled();
+  });
+
+  it("requires confirmed delete, registry removal, and no live sandboxes", () => {
+    expect(
+      shouldCleanupGatewayAfterConfirmedFinalDestroy(
+        {
+          deleteSucceededOrAlreadyGone: true,
+          removedRegistryEntry: true,
+        },
+        {
+          listSandboxes: () => ({ sandboxes: [] }),
+          liveSandboxProbe: () => true,
+        },
+      ),
+    ).toBe(true);
+
+    expect(
+      shouldCleanupGatewayAfterConfirmedFinalDestroy(
+        {
+          deleteSucceededOrAlreadyGone: true,
+          removedRegistryEntry: true,
+        },
+        {
+          listSandboxes: () => ({ sandboxes: [] }),
+          liveSandboxProbe: () => false,
+        },
+      ),
+    ).toBe(false);
+  });
+});
diff --git a/src/lib/actions/sandbox/destroy-gateway-cleanup.ts b/src/lib/actions/sandbox/destroy-gateway-cleanup.ts
new file mode 100644
index 00000000000..f6d9a04b936
--- /dev/null
+++ b/src/lib/actions/sandbox/destroy-gateway-cleanup.ts
@@ -0,0 +1,66 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { OPENSHELL_PROBE_TIMEOUT_MS } from "../../adapters/openshell/timeouts";
+import {
+  type DockerCaptureProbe,
+  hasNoLiveSandboxes,
+  type LiveSandboxListProbe,
+  shouldCleanupGatewayAfterDestroy,
+} from "../../domain/sandbox/destroy";
+import * as registry from "../../state/registry";
+
+type SandboxListProvider = () => { sandboxes: unknown[] };
+
+type LiveSandboxProbe = typeof hasNoLiveSandboxes;
+
+type FinalDestroyGatewayCleanupInput = {
+  deleteSucceededOrAlreadyGone: boolean;
+  removedRegistryEntry: boolean;
+};
+
+type FinalDestroyGatewayCleanupDeps = {
+  listSandboxes?: SandboxListProvider;
+  liveSandboxProbe?: LiveSandboxProbe;
+  timeoutMs?: number;
+};
+
+function captureLiveSandboxes(...args: Parameters<LiveSandboxListProbe>) {
+  const { captureOpenshell } = require("../../adapters/openshell/runtime") as {
+    captureOpenshell: LiveSandboxListProbe;
+  };
+  return captureOpenshell(...args);
+}
+
+function captureDockerContainers(...args: Parameters<DockerCaptureProbe>) {
+  const { dockerCapture } = require("../../adapters/docker/run") as {
+    dockerCapture: DockerCaptureProbe;
+  };
+  return dockerCapture(...args);
+}
+
+export function shouldCleanupGatewayAfterConfirmedFinalDestroy(
+  input: FinalDestroyGatewayCleanupInput,
+  deps: FinalDestroyGatewayCleanupDeps = {},
+): boolean {
+  const listSandboxes = deps.listSandboxes ?? registry.listSandboxes;
+  const liveSandboxProbe = deps.liveSandboxProbe ?? hasNoLiveSandboxes;
+  const timeoutMs = deps.timeoutMs ?? OPENSHELL_PROBE_TIMEOUT_MS;
+  const noRegisteredSandboxes = listSandboxes().sandboxes.length === 0;
+  const noLiveSandboxes =
+    input.deleteSucceededOrAlreadyGone &&
+    input.removedRegistryEntry &&
+    noRegisteredSandboxes &&
+    liveSandboxProbe({
+      captureOpenshell: captureLiveSandboxes,
+      dockerCapture: captureDockerContainers,
+      timeoutMs,
+    });
+
+  return shouldCleanupGatewayAfterDestroy({
+    deleteSucceededOrAlreadyGone: input.deleteSucceededOrAlreadyGone,
+    removedRegistryEntry: input.removedRegistryEntry,
+    noRegisteredSandboxes,
+    noLiveSandboxes,
+  });
+}
diff --git a/src/lib/actions/sandbox/destroy-gateway.ts b/src/lib/actions/sandbox/destroy-gateway.ts
index 15a8e991d6d..eb90ddb16d8 100644
--- a/src/lib/actions/sandbox/destroy-gateway.ts
+++ b/src/lib/actions/sandbox/destroy-gateway.ts
@@ -112,7 +112,7 @@ export function cleanupGatewayAfterLastSandbox(
    * rejects as an unrecognized subcommand (#6569). The host-process stop above
    * now uses the same PID-file-scoped reaper as Linux so final unattended
    * macOS destroys release the Docker-driver gateway listener (#4662).
-   * Removal tracker: #6652. Remove the macOS reliance on this host-process
+   * Removal tracker: #6639. Remove the macOS reliance on this host-process
    * fallback after OpenShell releases the Docker-driver listener fix, NemoClaw
    * raises its supported OpenShell floor to that fixed build, and a real macOS
    * Docker-driver sandbox-operations run proves final unattended destroy
diff --git a/src/lib/actions/sandbox/destroy.ts b/src/lib/actions/sandbox/destroy.ts
index 28d751eaeaf..071b8605e87 100644
--- a/src/lib/actions/sandbox/destroy.ts
+++ b/src/lib/actions/sandbox/destroy.ts
@@ -4,7 +4,6 @@
 import fs from "node:fs";
 import path from "node:path";
 
-import { OPENSHELL_PROBE_TIMEOUT_MS } from "../../adapters/openshell/timeouts";
 import { CLI_NAME } from "../../cli/branding";
 import { G, R, YW } from "../../cli/terminal-style";
 import { isNonInteractiveEnv } from "../../core/non-interactive";
@@ -14,11 +13,7 @@ import {
   normalizeDestroySandboxOptions,
 } from "../../domain/lifecycle/options";
 import {
-  type DockerCaptureProbe,
-  hasNoLiveSandboxes,
-  type LiveSandboxListProbe,
   resolveDestroyGatewayCleanupDecision,
-  shouldCleanupGatewayAfterDestroy,
   shouldStopHostServicesAfterDestroy,
 } from "../../domain/sandbox/destroy";
 import {
@@ -34,6 +29,7 @@ import { resolveNemoclawStateDir } from "../../state/paths";
 import * as registry from "../../state/registry";
 import { confirmSandboxDestroy } from "./destroy-confirmation";
 import { executeSandboxDestroy } from "./destroy-execution";
+import { shouldCleanupGatewayAfterConfirmedFinalDestroy } from "./destroy-gateway-cleanup";
 import { cleanupGatewayAfterLastSandbox } from "./destroy-gateway";
 import { prepareSandboxDestroy } from "./destroy-preflight";
 import { type WipeSandboxStateDeps, wipeSandboxState } from "./wipe-state";
@@ -398,31 +394,10 @@ async function destroySandboxUnlocked(
       return s;
     });
   }
-  const noRegisteredSandboxes = registry.listSandboxes().sandboxes.length === 0;
-  const shouldProbeLiveSandboxes = deleteSucceededOrAlreadyGone && removed && noRegisteredSandboxes;
-  const noLiveSandboxes =
-    shouldProbeLiveSandboxes &&
-    hasNoLiveSandboxes({
-      captureOpenshell: (...args) => {
-        const { captureOpenshell } = require("../../adapters/openshell/runtime") as {
-          captureOpenshell: LiveSandboxListProbe;
-        };
-        return captureOpenshell(...args);
-      },
-      dockerCapture: (...args) => {
-        const { dockerCapture } = require("../../adapters/docker/run") as {
-          dockerCapture: DockerCaptureProbe;
-        };
-        return dockerCapture(...args);
-      },
-      timeoutMs: OPENSHELL_PROBE_TIMEOUT_MS,
-    });
   if (
-    shouldCleanupGatewayAfterDestroy({
+    shouldCleanupGatewayAfterConfirmedFinalDestroy({
       deleteSucceededOrAlreadyGone,
       removedRegistryEntry: removed,
-      noRegisteredSandboxes,
-      noLiveSandboxes,
     })
   ) {
     const shouldCleanupGateway = await resolveCleanupGatewayDecision(normalized);
diff --git a/src/lib/domain/sandbox/destroy.test.ts b/src/lib/domain/sandbox/destroy.test.ts
index 6e770d17a93..b0f9e5f58df 100644
--- a/src/lib/domain/sandbox/destroy.test.ts
+++ b/src/lib/domain/sandbox/destroy.test.ts
@@ -1,7 +1,7 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-import { describe, expect, it } from "vitest";
+import { describe, expect, it, vi } from "vitest";
 
 import {
   getSandboxDeleteOutcome,
@@ -181,4 +181,31 @@ describe("sandbox destroy helpers", () => {
       }),
     ).toBe(false);
   });
+
+  it("matches Docker sandbox containers with a literal name prefix (#4662)", () => {
+    const dockerCapture = vi.fn(
+      () => "prefix-openshell-npmtest-e487d1bd\nopenshell-npmtest-e487d1bd\n",
+    );
+
+    expect(hasRunningDockerSandboxContainer("npmtest", dockerCapture, 1_000)).toBe(true);
+    expect(dockerCapture).toHaveBeenCalledWith(
+      ["ps", "--filter", "name=openshell-npmtest-", "--format", "{{.Names}}"],
+      {
+        ignoreError: true,
+        suppressOutput: true,
+        timeout: 1_000,
+      },
+    );
+    expect(
+      hasRunningDockerSandboxContainer("npmtest[", () => "openshell-npmtest[-e487d1bd\n", 1_000),
+    ).toBe(true);
+    expect(
+      hasRunningDockerSandboxContainer(
+        "npmtest",
+        () => "prefix-openshell-npmtest-e487d1bd\nopenshell-npmtest-extra-e487d1bd\n",
+        1_000,
+        ["npmtest", "npmtest-extra"],
+      ),
+    ).toBe(false);
+  });
 });
diff --git a/src/lib/domain/sandbox/destroy.ts b/src/lib/domain/sandbox/destroy.ts
index 06fa6a89d6a..53e99c8c40c 100644
--- a/src/lib/domain/sandbox/destroy.ts
+++ b/src/lib/domain/sandbox/destroy.ts
@@ -107,7 +107,7 @@ export function shouldCleanupGatewayAfterDestroy(input: {
  *
  * Linux preserves the shared gateway by default for reuse (#2166), while
  * unattended macOS destroys clean it up so the leaked host listener is released
- * (#4662). Track removal in #6652: drop the macOS default after OpenShell
+ * (#4662). Track removal in #6639: drop the macOS default after OpenShell
  * releases the Docker-driver listener fix, NemoClaw raises its supported
  * OpenShell floor to that fixed version, and live macOS final destroys release
  * the listener without forced gateway cleanup.
@@ -126,31 +126,54 @@ export function resolveDestroyGatewayCleanupDecision(
   return "prompt";
 }
 
-function escapeDockerNameRegex(value: string): string {
-  return value.replace(/[\\^$.*+?()[\]{}|]/g, "\\$&");
+function dockerSandboxContainerNamePrefix(sandboxName: string): string {
+  return `openshell-${sandboxName}-`;
+}
+
+function dockerContainerNames(output: string): string[] {
+  return output
+    .split(/\r?\n/u)
+    .map((name) => name.trim())
+    .filter(Boolean);
+}
+
+function ownsDockerSandboxContainer(
+  containerName: string,
+  sandboxName: string,
+  knownSandboxNames: Iterable<string>,
+): boolean {
+  const exactName = `openshell-${sandboxName}`;
+  const containerNamePrefix = `${exactName}-`;
+  if (containerName === exactName) return true;
+  if (!containerName.startsWith(containerNamePrefix)) return false;
+  const known = new Set(knownSandboxNames);
+  known.add(sandboxName);
+  const stripped = containerName.replace(/^openshell-/, "");
+  const owner = [...known]
+    .filter((name) => stripped === name || stripped.startsWith(`${name}-`))
+    .sort((a, b) => b.length - a.length)[0];
+  return owner === sandboxName;
 }
 
 export function hasRunningDockerSandboxContainer(
   sandboxName: string,
   dockerCapture: DockerCaptureProbe,
   timeoutMs: number,
+  knownSandboxNames: Iterable<string> = [sandboxName],
 ): boolean {
+  const containerNamePrefix = dockerSandboxContainerNamePrefix(sandboxName);
   try {
     const output = dockerCapture(
-      [
-        "ps",
-        "--filter",
-        `name=^/openshell-${escapeDockerNameRegex(sandboxName)}-`,
-        "--format",
-        "{{.Names}}",
-      ],
+      ["ps", "--filter", `name=${containerNamePrefix}`, "--format", "{{.Names}}"],
       {
         ignoreError: true,
         suppressOutput: true,
         timeout: timeoutMs,
       },
     );
-    return output.trim().length > 0;
+    return dockerContainerNames(output).some((name) =>
+      ownsDockerSandboxContainer(name, sandboxName, knownSandboxNames),
+    );
   } catch {
     // Fail closed for the #4662 invalid-state boundary: OpenShell may report a
     // terminal sandbox row while the Docker sandbox container is still running.
@@ -159,7 +182,7 @@ export function hasRunningDockerSandboxContainer(
     // the Docker probe itself fails, preserve the shared gateway so a live
     // sandbox does not lose its listener on final destroy. Covered by
     // destroy.test.ts; remove this fallback after OpenShell no longer emits
-    // false terminal rows and #6652 is closed.
+    // false terminal rows and #6639 is closed.
     return true;
   }
 }
@@ -176,8 +199,10 @@ export function hasNoLiveSandboxes({
   if (liveList.status !== 0) {
     return false;
   }
-  return parseLiveSandboxEntries(liveList.output).every((entry) => {
+  const entries = parseLiveSandboxEntries(liveList.output);
+  const sandboxNames = entries.map((entry) => entry.name);
+  return entries.every((entry) => {
     if (!TERMINAL_OPEN_SHELL_SANDBOX_PHASES.has(entry.phase ?? "")) return false;
-    return !hasRunningDockerSandboxContainer(entry.name, dockerCapture, timeoutMs);
+    return !hasRunningDockerSandboxContainer(entry.name, dockerCapture, timeoutMs, sandboxNames);
   });
 }
diff --git a/test/helpers/destroy-flow-test-harness.ts b/test/helpers/destroy-flow-test-harness.ts
index ec87dfa1107..d8a1c43c4ae 100644
--- a/test/helpers/destroy-flow-test-harness.ts
+++ b/test/helpers/destroy-flow-test-harness.ts
@@ -208,7 +208,7 @@ export function createDestroyHarness(options: DestroyHarnessOptions = {}): Destr
       const nameFilter = filterValue?.startsWith("name=") ? filterValue.slice(5) : undefined;
       const names = (options.dockerPsOutput ?? "").split("\n").filter(Boolean);
       const matchedNames = nameFilter
-        ? names.filter((name) => new RegExp(nameFilter).test(`/${name}`))
+        ? names.filter((name) => `/${name}`.includes(nameFilter))
         : names;
       return matchedNames.length > 0 ? `${matchedNames.join("\n")}\n` : "";
     });
diff --git a/test/macos-e2e-workflow-boundary.test.ts b/test/macos-e2e-workflow-boundary.test.ts
index 2398b0ffa86..4ae0f01c3e2 100644
--- a/test/macos-e2e-workflow-boundary.test.ts
+++ b/test/macos-e2e-workflow-boundary.test.ts
@@ -12,6 +12,7 @@ type WorkflowStep = {
   if?: string;
   env?: Record<string, unknown>;
   run?: string;
+  with?: Record<string, unknown>;
 };
 
 type WorkflowJob = {
@@ -61,16 +62,29 @@ describe("macOS E2E workflow boundary", () => {
     }
   });
 
-  it("starts Docker with Colima only for trusted macOS live runs", () => {
+  it("starts Docker with preinstalled Colima only for trusted macOS live runs", () => {
     const docker = stepNamed("Prepare Docker availability");
     expect(String(docker.env?.TRUSTED_MACOS_LIVE)).toContain("github.event_name != 'pull_request'");
     expect(docker.run).toContain('TRUSTED_MACOS_LIVE" != "1"');
+    expect(docker.run).toContain("command -v docker");
+    expect(docker.run).toContain("command -v colima");
+    expect(docker.run).toContain(
+      "skipping live E2E instead of bootstrapping floating Homebrew packages",
+    );
+    expect(docker.run).not.toContain("brew install");
     expect(docker.run).toContain("colima start");
     expect(docker.run).toContain("Colima could not start Docker");
     expect(docker.run).toContain("docker_ok=false");
     expect(docker.run).toContain("docker info");
   });
 
+  it("uploads live macOS E2E artifacts when the workflow fails", () => {
+    const upload = stepNamed("Upload logs on failure");
+    expect(upload.if).toBe("failure()");
+    expect(String(upload.with?.path)).toContain("/tmp/nemoclaw-e2e-*.log");
+    expect(String(upload.with?.path)).toContain("${{ github.workspace }}/e2e-artifacts/live");
+  });
+
   it("keeps the job timeout outside the combined live test budgets", () => {
     expect(macosJob()["timeout-minutes"]).toBeGreaterThanOrEqual(150);
   });

From 714810a387e1dbb4236ef616d1acf7a9ea01dff6 Mon Sep 17 00:00:00 2001
From: Prekshi Vyas <prekshiv@nvidia.com>
Date: Fri, 10 Jul 2026 13:53:48 -0700
Subject: [PATCH 20/45] fix(destroy): keep live probes out of domain

---
 .../sandbox/destroy-gateway-cleanup.test.ts   | 55 +++++++++++++-
 .../sandbox/destroy-gateway-cleanup.ts        | 70 +++++++++++++++--
 src/lib/domain/sandbox/destroy.test.ts        | 70 +++++++----------
 src/lib/domain/sandbox/destroy.ts             | 75 ++++++++-----------
 4 files changed, 178 insertions(+), 92 deletions(-)

diff --git a/src/lib/actions/sandbox/destroy-gateway-cleanup.test.ts b/src/lib/actions/sandbox/destroy-gateway-cleanup.test.ts
index 29446f7c266..aa8189fbd3a 100644
--- a/src/lib/actions/sandbox/destroy-gateway-cleanup.test.ts
+++ b/src/lib/actions/sandbox/destroy-gateway-cleanup.test.ts
@@ -3,7 +3,11 @@
 
 import { describe, expect, it, vi } from "vitest";
 
-import { shouldCleanupGatewayAfterConfirmedFinalDestroy } from "./destroy-gateway-cleanup";
+import { hasNoLiveSandboxes } from "../../domain/sandbox/destroy";
+import {
+  collectLiveSandboxProbeSnapshot,
+  shouldCleanupGatewayAfterConfirmedFinalDestroy,
+} from "./destroy-gateway-cleanup";
 
 describe("shouldCleanupGatewayAfterConfirmedFinalDestroy", () => {
   it("defers live probes until the local registry is empty", () => {
@@ -51,4 +55,53 @@ describe("shouldCleanupGatewayAfterConfirmedFinalDestroy", () => {
       ),
     ).toBe(false);
   });
+
+  it("collects OpenShell and Docker live-sandbox snapshots in the action layer", () => {
+    const captureOpenshell = vi.fn(() => ({
+      status: 0,
+      output:
+        "NAME              CREATED              PHASE\nnpmtest           now                  Error\n",
+    }));
+    const dockerCapture = vi.fn(() => "openshell-npmtest-e487d1bd\n");
+
+    const snapshot = collectLiveSandboxProbeSnapshot({
+      captureOpenshell,
+      dockerCapture,
+      timeoutMs: 1_000,
+    });
+
+    expect(captureOpenshell).toHaveBeenCalledWith(["sandbox", "list"], {
+      ignoreError: true,
+      timeout: 1_000,
+    });
+    expect(dockerCapture).toHaveBeenCalledWith(
+      ["ps", "--filter", "name=openshell-npmtest-", "--format", "{{.Names}}"],
+      {
+        ignoreError: true,
+        suppressOutput: true,
+        timeout: 1_000,
+      },
+    );
+    expect(hasNoLiveSandboxes(snapshot)).toBe(false);
+  });
+
+  it("records failed Docker probes as fail-closed snapshots", () => {
+    const snapshot = collectLiveSandboxProbeSnapshot({
+      captureOpenshell: () => ({
+        status: 0,
+        output:
+          "NAME              CREATED              PHASE\nnpmtest           now                  Failed\n",
+      }),
+      dockerCapture: () => {
+        throw new Error("docker unavailable");
+      },
+      timeoutMs: 1_000,
+    });
+
+    expect(hasNoLiveSandboxes(snapshot)).toBe(false);
+    expect(snapshot.dockerContainersBySandboxName.get("npmtest")).toEqual({
+      output: "",
+      probeFailed: true,
+    });
+  });
 });
diff --git a/src/lib/actions/sandbox/destroy-gateway-cleanup.ts b/src/lib/actions/sandbox/destroy-gateway-cleanup.ts
index f6d9a04b936..e67de84b34a 100644
--- a/src/lib/actions/sandbox/destroy-gateway-cleanup.ts
+++ b/src/lib/actions/sandbox/destroy-gateway-cleanup.ts
@@ -3,16 +3,29 @@
 
 import { OPENSHELL_PROBE_TIMEOUT_MS } from "../../adapters/openshell/timeouts";
 import {
-  type DockerCaptureProbe,
+  type DockerSandboxContainerSnapshot,
+  dockerSandboxContainerNamePrefix,
+  getLiveSandboxNames,
   hasNoLiveSandboxes,
-  type LiveSandboxListProbe,
+  type LiveSandboxListSnapshot,
   shouldCleanupGatewayAfterDestroy,
 } from "../../domain/sandbox/destroy";
 import * as registry from "../../state/registry";
 
 type SandboxListProvider = () => { sandboxes: unknown[] };
 
-type LiveSandboxProbe = typeof hasNoLiveSandboxes;
+type LiveSandboxListProbe = (
+  args: string[],
+  opts?: { ignoreError?: boolean; timeout?: number },
+) => LiveSandboxListSnapshot;
+
+type DockerCaptureProbe = (args: string[], opts?: Record<string, unknown>) => string;
+
+type LiveSandboxProbe = (deps?: {
+  captureOpenshell?: LiveSandboxListProbe;
+  dockerCapture?: DockerCaptureProbe;
+  timeoutMs?: number;
+}) => boolean;
 
 type FinalDestroyGatewayCleanupInput = {
   deleteSucceededOrAlreadyGone: boolean;
@@ -39,12 +52,59 @@ function captureDockerContainers(...args: Parameters<DockerCaptureProbe>) {
   return dockerCapture(...args);
 }
 
+export function collectLiveSandboxProbeSnapshot(
+  deps: {
+    captureOpenshell?: LiveSandboxListProbe;
+    dockerCapture?: DockerCaptureProbe;
+    timeoutMs?: number;
+  } = {},
+): Parameters<typeof hasNoLiveSandboxes>[0] {
+  const captureOpenshell = deps.captureOpenshell ?? captureLiveSandboxes;
+  const dockerCapture = deps.dockerCapture ?? captureDockerContainers;
+  const timeoutMs = deps.timeoutMs ?? OPENSHELL_PROBE_TIMEOUT_MS;
+  const liveList = captureOpenshell(["sandbox", "list"], {
+    ignoreError: true,
+    timeout: timeoutMs,
+  });
+  const dockerContainersBySandboxName = new Map<string, DockerSandboxContainerSnapshot>();
+  for (const sandboxName of getLiveSandboxNames(liveList)) {
+    try {
+      dockerContainersBySandboxName.set(sandboxName, {
+        output: dockerCapture(
+          [
+            "ps",
+            "--filter",
+            `name=${dockerSandboxContainerNamePrefix(sandboxName)}`,
+            "--format",
+            "{{.Names}}",
+          ],
+          {
+            ignoreError: true,
+            suppressOutput: true,
+            timeout: timeoutMs,
+          },
+        ),
+      });
+    } catch {
+      // Fail closed for the #4662 invalid-state boundary. If Docker cannot
+      // confirm the terminal OpenShell row has no backing container, keep the
+      // shared gateway so a live sandbox does not lose its listener.
+      dockerContainersBySandboxName.set(sandboxName, { output: "", probeFailed: true });
+    }
+  }
+  return { liveList, dockerContainersBySandboxName };
+}
+
+function hasNoLiveSandboxesFromHost(deps?: Parameters<LiveSandboxProbe>[0]): boolean {
+  return hasNoLiveSandboxes(collectLiveSandboxProbeSnapshot(deps));
+}
+
 export function shouldCleanupGatewayAfterConfirmedFinalDestroy(
   input: FinalDestroyGatewayCleanupInput,
   deps: FinalDestroyGatewayCleanupDeps = {},
 ): boolean {
   const listSandboxes = deps.listSandboxes ?? registry.listSandboxes;
-  const liveSandboxProbe = deps.liveSandboxProbe ?? hasNoLiveSandboxes;
+  const liveSandboxProbe = deps.liveSandboxProbe ?? hasNoLiveSandboxesFromHost;
   const timeoutMs = deps.timeoutMs ?? OPENSHELL_PROBE_TIMEOUT_MS;
   const noRegisteredSandboxes = listSandboxes().sandboxes.length === 0;
   const noLiveSandboxes =
@@ -52,8 +112,6 @@ export function shouldCleanupGatewayAfterConfirmedFinalDestroy(
     input.removedRegistryEntry &&
     noRegisteredSandboxes &&
     liveSandboxProbe({
-      captureOpenshell: captureLiveSandboxes,
-      dockerCapture: captureDockerContainers,
       timeoutMs,
     });
 
diff --git a/src/lib/domain/sandbox/destroy.test.ts b/src/lib/domain/sandbox/destroy.test.ts
index b0f9e5f58df..98c8b3f01d3 100644
--- a/src/lib/domain/sandbox/destroy.test.ts
+++ b/src/lib/domain/sandbox/destroy.test.ts
@@ -1,9 +1,10 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-import { describe, expect, it, vi } from "vitest";
+import { describe, expect, it } from "vitest";
 
 import {
+  dockerSandboxContainerNamePrefix,
   getSandboxDeleteOutcome,
   hasNoLiveSandboxes,
   hasRunningDockerSandboxContainer,
@@ -132,78 +133,63 @@ describe("sandbox destroy helpers", () => {
       "NAME              CREATED              PHASE\nnpmtest           2026-06-01 00:00:00  Error\n";
     expect(
       hasNoLiveSandboxes({
-        captureOpenshell: () => ({ status: 0, output: liveListOutput }),
-        dockerCapture: () => "",
-        timeoutMs: 1_000,
+        liveList: { status: 0, output: liveListOutput },
+        dockerContainersBySandboxName: new Map([["npmtest", { output: "" }]]),
       }),
     ).toBe(true);
     expect(
       hasNoLiveSandboxes({
-        captureOpenshell: () => ({ status: 0, output: liveListOutput }),
-        dockerCapture: () => "openshell-npmtest-e487d1bd\n",
-        timeoutMs: 1_000,
+        liveList: { status: 0, output: liveListOutput },
+        dockerContainersBySandboxName: new Map([
+          ["npmtest", { output: "openshell-npmtest-e487d1bd\n" }],
+        ]),
       }),
     ).toBe(false);
     expect(
       hasNoLiveSandboxes({
-        captureOpenshell: () => ({
+        liveList: {
           status: 0,
           output:
             "NAME              CREATED              PHASE\nnpmtest           now                  Ready\n",
-        }),
-        dockerCapture: () => "",
-        timeoutMs: 1_000,
+        },
+        dockerContainersBySandboxName: new Map([["npmtest", { output: "" }]]),
       }),
     ).toBe(false);
   });
 
-  it("fails closed when the Docker live-container probe cannot run (#4662)", () => {
-    expect(
-      hasRunningDockerSandboxContainer(
-        "npmtest",
-        () => {
-          throw new Error("docker unavailable");
-        },
-        1_000,
-      ),
-    ).toBe(true);
+  it("fails closed when a Docker live-container probe snapshot is missing or failed (#4662)", () => {
+    expect(hasRunningDockerSandboxContainer("npmtest", undefined)).toBe(true);
+    expect(hasRunningDockerSandboxContainer("npmtest", { output: "", probeFailed: true })).toBe(
+      true,
+    );
     expect(
       hasNoLiveSandboxes({
-        captureOpenshell: () => ({
+        liveList: {
           status: 0,
           output:
             "NAME              CREATED              PHASE\nnpmtest           now                  Failed\n",
-        }),
-        dockerCapture: () => {
-          throw new Error("docker unavailable");
         },
-        timeoutMs: 1_000,
+        dockerContainersBySandboxName: new Map([["npmtest", { output: "", probeFailed: true }]]),
       }),
     ).toBe(false);
   });
 
   it("matches Docker sandbox containers with a literal name prefix (#4662)", () => {
-    const dockerCapture = vi.fn(
-      () => "prefix-openshell-npmtest-e487d1bd\nopenshell-npmtest-e487d1bd\n",
-    );
-
-    expect(hasRunningDockerSandboxContainer("npmtest", dockerCapture, 1_000)).toBe(true);
-    expect(dockerCapture).toHaveBeenCalledWith(
-      ["ps", "--filter", "name=openshell-npmtest-", "--format", "{{.Names}}"],
-      {
-        ignoreError: true,
-        suppressOutput: true,
-        timeout: 1_000,
-      },
-    );
+    expect(dockerSandboxContainerNamePrefix("npmtest")).toBe("openshell-npmtest-");
     expect(
-      hasRunningDockerSandboxContainer("npmtest[", () => "openshell-npmtest[-e487d1bd\n", 1_000),
+      hasRunningDockerSandboxContainer("npmtest", {
+        output: "prefix-openshell-npmtest-e487d1bd\nopenshell-npmtest-e487d1bd\n",
+      }),
+    ).toBe(true);
+    expect(
+      hasRunningDockerSandboxContainer("npmtest[", {
+        output: "openshell-npmtest[-e487d1bd\n",
+      }),
     ).toBe(true);
     expect(
       hasRunningDockerSandboxContainer(
         "npmtest",
-        () => "prefix-openshell-npmtest-e487d1bd\nopenshell-npmtest-extra-e487d1bd\n",
-        1_000,
+        { output: "prefix-openshell-npmtest-e487d1bd\nopenshell-npmtest-extra-e487d1bd\n" },
         ["npmtest", "npmtest-extra"],
       ),
     ).toBe(false);
diff --git a/src/lib/domain/sandbox/destroy.ts b/src/lib/domain/sandbox/destroy.ts
index 53e99c8c40c..12354b94585 100644
--- a/src/lib/domain/sandbox/destroy.ts
+++ b/src/lib/domain/sandbox/destroy.ts
@@ -29,17 +29,19 @@ export type DestroyGatewayCleanupContext = {
   platform: NodeJS.Platform;
 };
 
-export type LiveSandboxListProbe = (
-  args: string[],
-  opts?: { ignoreError?: boolean; timeout?: number },
-) => { status: number | null; output: string };
+export type LiveSandboxListSnapshot = {
+  status: number | null;
+  output: string;
+};
 
-export type DockerCaptureProbe = (args: string[], opts?: Record<string, unknown>) => string;
+export type DockerSandboxContainerSnapshot = {
+  output: string;
+  probeFailed?: boolean;
+};
 
-export type LiveSandboxProbeDeps = {
-  captureOpenshell: LiveSandboxListProbe;
-  dockerCapture: DockerCaptureProbe;
-  timeoutMs: number;
+export type LiveSandboxProbeSnapshot = {
+  liveList: LiveSandboxListSnapshot;
+  dockerContainersBySandboxName: ReadonlyMap<string, DockerSandboxContainerSnapshot>;
 };
 
 export function isMissingSandboxDeleteOutput(output = ""): boolean {
@@ -126,7 +128,7 @@ export function resolveDestroyGatewayCleanupDecision(
   return "prompt";
 }
 
-function dockerSandboxContainerNamePrefix(sandboxName: string): string {
+export function dockerSandboxContainerNamePrefix(sandboxName: string): string {
   return `openshell-${sandboxName}-`;
 }
 
@@ -157,45 +159,28 @@ function ownsDockerSandboxContainer(
 
 export function hasRunningDockerSandboxContainer(
   sandboxName: string,
-  dockerCapture: DockerCaptureProbe,
-  timeoutMs: number,
+  snapshot: DockerSandboxContainerSnapshot | undefined,
   knownSandboxNames: Iterable<string> = [sandboxName],
 ): boolean {
-  const containerNamePrefix = dockerSandboxContainerNamePrefix(sandboxName);
-  try {
-    const output = dockerCapture(
-      ["ps", "--filter", `name=${containerNamePrefix}`, "--format", "{{.Names}}"],
-      {
-        ignoreError: true,
-        suppressOutput: true,
-        timeout: timeoutMs,
-      },
-    );
-    return dockerContainerNames(output).some((name) =>
-      ownsDockerSandboxContainer(name, sandboxName, knownSandboxNames),
-    );
-  } catch {
-    // Fail closed for the #4662 invalid-state boundary: OpenShell may report a
-    // terminal sandbox row while the Docker sandbox container is still running.
-    // Docker is the authoritative source for that live-container check, and the
-    // OpenShell false terminal state cannot be fixed from this destroy path. If
-    // the Docker probe itself fails, preserve the shared gateway so a live
-    // sandbox does not lose its listener on final destroy. Covered by
-    // destroy.test.ts; remove this fallback after OpenShell no longer emits
-    // false terminal rows and #6639 is closed.
+  if (!snapshot || snapshot.probeFailed) {
     return true;
   }
+  return dockerContainerNames(snapshot.output).some((name) =>
+    ownsDockerSandboxContainer(name, sandboxName, knownSandboxNames),
+  );
+}
+
+export function getLiveSandboxNames(liveList: LiveSandboxListSnapshot): string[] {
+  if (liveList.status !== 0) {
+    return [];
+  }
+  return parseLiveSandboxEntries(liveList.output).map((entry) => entry.name);
 }
 
 export function hasNoLiveSandboxes({
-  captureOpenshell,
-  dockerCapture,
-  timeoutMs,
-}: LiveSandboxProbeDeps): boolean {
-  const liveList = captureOpenshell(["sandbox", "list"], {
-    ignoreError: true,
-    timeout: timeoutMs,
-  });
+  liveList,
+  dockerContainersBySandboxName,
+}: LiveSandboxProbeSnapshot): boolean {
   if (liveList.status !== 0) {
     return false;
   }
@@ -203,6 +188,10 @@ export function hasNoLiveSandboxes({
   const sandboxNames = entries.map((entry) => entry.name);
   return entries.every((entry) => {
     if (!TERMINAL_OPEN_SHELL_SANDBOX_PHASES.has(entry.phase ?? "")) return false;
-    return !hasRunningDockerSandboxContainer(entry.name, dockerCapture, timeoutMs, sandboxNames);
+    return !hasRunningDockerSandboxContainer(
+      entry.name,
+      dockerContainersBySandboxName.get(entry.name),
+      sandboxNames,
+    );
   });
 }

From 312da1f7a8405f71461ab10348ee8af78a23e39a Mon Sep 17 00:00:00 2001
From: Prekshi Vyas <prekshiv@nvidia.com>
Date: Fri, 10 Jul 2026 13:59:28 -0700
Subject: [PATCH 21/45] test(e2e): prove macos default gateway cleanup

---
 test/e2e/live/sandbox-operations.test.ts | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/test/e2e/live/sandbox-operations.test.ts b/test/e2e/live/sandbox-operations.test.ts
index d2ff4b3812d..523f58ebe7a 100644
--- a/test/e2e/live/sandbox-operations.test.ts
+++ b/test/e2e/live/sandbox-operations.test.ts
@@ -640,7 +640,7 @@ test(
         "TC-SBX-09 tmux and PTY lifecycle work inside sandbox",
         "TC-SBX-10 two sandboxes list with model/provider metadata",
         "TC-SBX-11 sandboxes cannot reach each other by hostname",
-        "TC-SBX-12 destroying the non-final sandbox preserves the survivor and final destroy releases the gateway port",
+        "TC-SBX-12 destroying the non-final sandbox preserves the survivor and final destroy releases the gateway port through the macOS default or explicit non-macOS cleanup",
       ],
     });
 
@@ -679,12 +679,17 @@ test(
     await assertAgentCanAnswer(host, SANDBOX_A, "tc-sbx-12-survivor-agent-after-destroy-b");
 
     const gatewayRecovery = await assertGatewayRecovery(host, SANDBOX_A);
-    await assertDestroyRemovesSandbox(host, sandbox, SANDBOX_A, { cleanupGateway: true });
+    const finalDestroyCleanupMode =
+      process.platform === "darwin" ? "macos-default" : "explicit-non-macos";
+    await assertDestroyRemovesSandbox(host, sandbox, SANDBOX_A, {
+      cleanupGateway: finalDestroyCleanupMode === "explicit-non-macos",
+    });
     await expectHostPortFree(host, GATEWAY_PORT, "tc-sbx-12-final-destroy-gateway-port-free");
 
     await artifacts.target.complete({
       id: "sandbox-operations",
       status: "passed",
+      finalDestroyCleanupMode,
       finalGatewayPortReleased: true,
       gatewayRecovery,
       legacySource: "test/e2e/test-sandbox-operations.sh",

From 81d4a69e453049c79f94e2a4f03c0c47161294ad Mon Sep 17 00:00:00 2001
From: Prekshi Vyas <prekshiv@nvidia.com>
Date: Fri, 10 Jul 2026 14:18:15 -0700
Subject: [PATCH 22/45] fix(destroy): scope host gateway pid cleanup

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
---
 src/lib/actions/sandbox/destroy-flow.test.ts  | 151 ------------------
 .../actions/sandbox/destroy-gateway.test.ts   |   4 +
 src/lib/actions/sandbox/destroy-gateway.ts    |  37 +++--
 src/lib/onboard/gateway-process-identity.ts   |  49 +++++-
 src/lib/onboard/host-gateway-process.test.ts  |  61 +++++++
 src/lib/onboard/host-gateway-process.ts       |  30 +++-
 6 files changed, 167 insertions(+), 165 deletions(-)

diff --git a/src/lib/actions/sandbox/destroy-flow.test.ts b/src/lib/actions/sandbox/destroy-flow.test.ts
index 1c15bd47734..349737a58b8 100644
--- a/src/lib/actions/sandbox/destroy-flow.test.ts
+++ b/src/lib/actions/sandbox/destroy-flow.test.ts
@@ -67,157 +67,6 @@ describe("destroySandbox flow", () => {
     );
   });
 
-  it("cleans the final gateway for forced macOS destroys (#4662)", async () => {
-    vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
-    const harness = createDestroyHarness();
-
-    await expect(harness.destroySandbox("alpha", { force: true })).resolves.toBeUndefined();
-
-    expect(harness.cleanupGatewaySpy).toHaveBeenCalledWith(
-      "nemoclaw-19080",
-      harness.runOpenshellSpy,
-    );
-  });
-
-  it("cleans the final gateway for environment-driven non-interactive macOS destroys (#4662)", async () => {
-    vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
-    vi.stubEnv("NEMOCLAW_NON_INTERACTIVE", "1");
-    const harness = createDestroyHarness();
-
-    await expect(harness.destroySandbox("alpha", {})).resolves.toBeUndefined();
-
-    expect(harness.cleanupGatewaySpy).toHaveBeenCalledWith(
-      "nemoclaw-19080",
-      harness.runOpenshellSpy,
-    );
-  });
-
-  it("preserves the final gateway for environment-driven non-interactive Linux destroys (#2166)", async () => {
-    vi.spyOn(process, "platform", "get").mockReturnValue("linux");
-    vi.stubEnv("NEMOCLAW_NON_INTERACTIVE", "1");
-    const harness = createDestroyHarness();
-
-    await expect(harness.destroySandbox("alpha", {})).resolves.toBeUndefined();
-
-    expect(harness.cleanupGatewaySpy).not.toHaveBeenCalled();
-  });
-
-  it("does not probe live sandboxes when registered sandboxes remain (#4662)", async () => {
-    vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
-    const harness = createDestroyHarness({ registeredSandboxCount: 2 });
-
-    await expect(harness.destroySandbox("alpha", { yes: true })).resolves.toBeUndefined();
-
-    expect(harness.captureOpenshellSpy).not.toHaveBeenCalled();
-    expect(harness.dockerCaptureSpy).not.toHaveBeenCalled();
-    expect(harness.cleanupGatewaySpy).not.toHaveBeenCalled();
-  });
-
-  it("preserves the final gateway for native Windows unattended destroys (#4662)", async () => {
-    // Supported Windows execution uses WSL2, which reports `linux`. Keep an
-    // unexpected native `win32` host on the conservative non-macOS default.
-    vi.spyOn(process, "platform", "get").mockReturnValue("win32");
-    const harness = createDestroyHarness();
-
-    await expect(harness.destroySandbox("alpha", { yes: true })).resolves.toBeUndefined();
-
-    expect(harness.cleanupGatewaySpy).not.toHaveBeenCalled();
-  });
-
-  it("honors the gateway cleanup environment override on macOS (#4662)", async () => {
-    vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
-    vi.stubEnv("NEMOCLAW_CLEANUP_GATEWAY", "1");
-    const harness = createDestroyHarness();
-
-    await expect(harness.destroySandbox("alpha", { yes: true })).resolves.toBeUndefined();
-
-    expect(harness.cleanupGatewaySpy).toHaveBeenCalledWith(
-      "nemoclaw-19080",
-      harness.runOpenshellSpy,
-    );
-  });
-
-  it("cleans the final macOS gateway when sandbox list only has exited terminal rows (#4662)", async () => {
-    vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
-    const harness = createDestroyHarness({
-      dockerPsOutput: "",
-      liveListOutput:
-        "NAME              CREATED              PHASE\nnpmtest           2026-06-01 00:00:00  Error\n",
-    });
-
-    await expect(harness.destroySandbox("alpha", { yes: true })).resolves.toBeUndefined();
-
-    expect(harness.cleanupGatewaySpy).toHaveBeenCalledWith(
-      "nemoclaw-19080",
-      harness.runOpenshellSpy,
-    );
-  });
-
-  it("preserves the final macOS gateway when a terminal row still has a running Docker sandbox container (#4662)", async () => {
-    vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
-    const harness = createDestroyHarness({
-      dockerPsOutput: "openshell-npmtest-e487d1bd\n",
-      liveListOutput:
-        "NAME              CREATED              PHASE\nnpmtest           2026-06-01 00:00:00  Error\n",
-    });
-
-    await expect(harness.destroySandbox("alpha", { yes: true })).resolves.toBeUndefined();
-
-    expect(harness.cleanupGatewaySpy).not.toHaveBeenCalled();
-  });
-
-  it("treats Docker name filters as literal substring matches in cleanup probes (#4662)", async () => {
-    vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
-    const harness = createDestroyHarness({
-      dockerPsOutput: "openshell-npmtest[-e487d1bd\n",
-      liveListOutput:
-        "NAME              CREATED              PHASE\nnpmtest[          2026-06-01 00:00:00  Error\n",
-    });
-
-    await expect(harness.destroySandbox("alpha", { yes: true })).resolves.toBeUndefined();
-
-    expect(harness.cleanupGatewaySpy).not.toHaveBeenCalled();
-  });
-
-  it("honors the gateway preservation environment override on macOS (#4662)", async () => {
-    vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
-    vi.stubEnv("NEMOCLAW_CLEANUP_GATEWAY", "0");
-    const harness = createDestroyHarness();
-
-    await expect(harness.destroySandbox("alpha", { yes: true })).resolves.toBeUndefined();
-
-    expect(harness.cleanupGatewaySpy).not.toHaveBeenCalled();
-  });
-
-  it("cleans the final gateway when an interactive macOS user accepts (#4662)", async () => {
-    vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
-    const harness = createDestroyHarness({ promptResponses: ["yes", "yes"] });
-
-    await expect(harness.destroySandbox("alpha", {})).resolves.toBeUndefined();
-
-    expect(harness.promptSpy).toHaveBeenNthCalledWith(
-      2,
-      expect.stringContaining("destroy the gateway"),
-    );
-    expect(harness.cleanupGatewaySpy).toHaveBeenCalledWith(
-      "nemoclaw-19080",
-      harness.runOpenshellSpy,
-    );
-  });
-
-  it("preserves the final gateway when an interactive user declines cleanup (#2166)", async () => {
-    vi.stubEnv("NEMOCLAW_NON_INTERACTIVE", "");
-    const harness = createDestroyHarness({ promptResponses: ["yes", ""] });
-
-    await expect(harness.destroySandbox("alpha", {})).resolves.toBeUndefined();
-
-    expect(harness.promptSpy).toHaveBeenNthCalledWith(
-      2,
-      expect.stringContaining("destroy the gateway"),
-    );
-    expect(harness.cleanupGatewaySpy).not.toHaveBeenCalled();
-  });
-
   it("honors an explicit gateway-preservation override on macOS (#4662)", async () => {
     vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
     const harness = createDestroyHarness();
diff --git a/src/lib/actions/sandbox/destroy-gateway.test.ts b/src/lib/actions/sandbox/destroy-gateway.test.ts
index 6f033eaccd3..7f5bf482c09 100644
--- a/src/lib/actions/sandbox/destroy-gateway.test.ts
+++ b/src/lib/actions/sandbox/destroy-gateway.test.ts
@@ -52,6 +52,8 @@ describe("cleanupGatewayAfterLastSandbox", () => {
         usePgrepFallback: false,
         stateDir,
         pidFile: path.join(stateDir, "openshell-gateway.pid"),
+        openShellGatewayName: "nemoclaw-8081",
+        openShellGatewayPort: 8081,
       },
     );
     expect(runOpenshell).toHaveBeenCalledWith(["gateway", "remove", "nemoclaw-8081"], {
@@ -86,6 +88,8 @@ describe("cleanupGatewayAfterLastSandbox", () => {
         usePgrepFallback: false,
         stateDir,
         pidFile: path.join(stateDir, "openshell-gateway.pid"),
+        openShellGatewayName: "nemoclaw-8081",
+        openShellGatewayPort: 8081,
       },
     );
     expect(runOpenshell).toHaveBeenCalledWith(["gateway", "remove", "nemoclaw-8081"], {
diff --git a/src/lib/actions/sandbox/destroy-gateway.ts b/src/lib/actions/sandbox/destroy-gateway.ts
index eb90ddb16d8..0381d8788f2 100644
--- a/src/lib/actions/sandbox/destroy-gateway.ts
+++ b/src/lib/actions/sandbox/destroy-gateway.ts
@@ -27,14 +27,23 @@ const DASHBOARD_FORWARD_PORT = String(DASHBOARD_PORT);
 // `nemoclaw-<port>` sandbox would read the default instance's pid file and
 // stop the wrong host gateway process. Returns null when the gateway name is
 // outside the NemoClaw namespace (the caller then keeps the defaults).
-function resolvePerGatewayStateDir(gatewayName: string): string | null {
+function resolvePerGatewayState(gatewayName: string): { port: number; stateDir: string } | null {
   const port = resolveGatewayPortFromName(gatewayName);
   if (port === null) return null;
   const configured = process.env.NEMOCLAW_OPENSHELL_GATEWAY_STATE_DIR;
   if (configured && configured.trim()) {
-    return path.resolve(configured.trim());
+    return { port, stateDir: path.resolve(configured.trim()) };
   }
-  return path.join(os.homedir(), ".local", "state", "nemoclaw", resolveGatewayStateDirName(port));
+  return {
+    port,
+    stateDir: path.join(
+      os.homedir(),
+      ".local",
+      "state",
+      "nemoclaw",
+      resolveGatewayStateDirName(port),
+    ),
+  };
 }
 
 export function selectGatewayForSandboxDestroy(
@@ -84,14 +93,24 @@ export function cleanupGatewayAfterLastSandbox(
     // possible on shared hosts) is not torn down by a NemoClaw `destroy`.
     // The uninstall path keeps the broader sweep on (run-plan.ts). The state
     // dir is per-gateway-name so a destroy of `nemoclaw-<port>` reads the
-    // per-port pid file rather than defaulting to the bare instance's.
-    const perGatewayStateDir = resolvePerGatewayStateDir(gatewayName);
-    const stopOptions: { usePgrepFallback: false; stateDir?: string; pidFile?: string } = {
+    // per-port pid file rather than defaulting to the bare instance's. The
+    // expected gateway name and port also gate `openshell gateway start`
+    // cmdlines so a stale pid file cannot kill another gateway instance.
+    const perGatewayState = resolvePerGatewayState(gatewayName);
+    const stopOptions: {
+      openShellGatewayName?: string;
+      openShellGatewayPort?: number;
+      usePgrepFallback: false;
+      stateDir?: string;
+      pidFile?: string;
+    } = {
       usePgrepFallback: false,
     };
-    if (perGatewayStateDir) {
-      stopOptions.stateDir = perGatewayStateDir;
-      stopOptions.pidFile = path.join(perGatewayStateDir, "openshell-gateway.pid");
+    if (perGatewayState) {
+      stopOptions.stateDir = perGatewayState.stateDir;
+      stopOptions.pidFile = path.join(perGatewayState.stateDir, "openshell-gateway.pid");
+      stopOptions.openShellGatewayName = gatewayName;
+      stopOptions.openShellGatewayPort = perGatewayState.port;
     }
     stopHostGatewayProcesses({}, stopOptions);
   }
diff --git a/src/lib/onboard/gateway-process-identity.ts b/src/lib/onboard/gateway-process-identity.ts
index 139e9ea54c2..16c9bb83086 100644
--- a/src/lib/onboard/gateway-process-identity.ts
+++ b/src/lib/onboard/gateway-process-identity.ts
@@ -20,14 +20,56 @@ export const DOCKER_DRIVER_GATEWAY_COMPAT_MOUNT_PATH = "/opt/nemoclaw/openshell-
 
 type ResolveExecutablePath = (value: string) => string | null;
 
+export interface OpenShellGatewayProcessTarget {
+  name?: string | null;
+  port?: number | string | null;
+}
+
 export function cleanGatewayProcessToken(token: string): string {
   return token.replace(/^['"]|['"]$/g, "").replace(/ \(deleted\)$/, "");
 }
 
+function cliFlagValue(tokens: string[], names: string[]): string | null {
+  for (let index = 0; index < tokens.length; index += 1) {
+    const token = tokens[index];
+    for (const name of names) {
+      if (token === name) {
+        return tokens[index + 1] ?? null;
+      }
+      if (token.startsWith(`${name}=`)) {
+        return token.slice(name.length + 1);
+      }
+    }
+  }
+  return null;
+}
+
+function openShellGatewayStartMatchesTarget(
+  tokens: string[],
+  target: OpenShellGatewayProcessTarget | undefined,
+): boolean {
+  if (!target || (!target.name && (target.port === undefined || target.port === null))) {
+    return true;
+  }
+
+  if (target.name) {
+    const actualName = cliFlagValue(tokens, ["--name"]);
+    if (actualName !== target.name) return false;
+  }
+
+  if (target.port !== undefined && target.port !== null) {
+    const actualPort = cliFlagValue(tokens, ["--port"]);
+    if (actualPort !== String(target.port)) return false;
+  }
+
+  return true;
+}
+
 export function gatewayProcessCmdlineMatches(
   cmdline: string,
   gatewayBin: string | null | undefined,
   opts: {
+    expectedOpenShellGateway?: OpenShellGatewayProcessTarget;
     processNames?: ReadonlySet<string>;
     resolveExecutablePath?: ResolveExecutablePath;
   } = {},
@@ -45,7 +87,7 @@ export function gatewayProcessCmdlineMatches(
     tokens[1] === "gateway" &&
     tokens[2] === "start"
   ) {
-    return true;
+    return openShellGatewayStartMatchesTarget(tokens, opts.expectedOpenShellGateway);
   }
 
   if (typeof gatewayBin === "string" && gatewayBin.length > 0) {
@@ -71,6 +113,9 @@ export function gatewayProcessCmdlineMatches(
 export function hostGatewayCmdlineMatches(
   cmdline: string,
   gatewayBin: string | null | undefined,
+  expectedOpenShellGateway?: OpenShellGatewayProcessTarget,
 ): boolean {
-  return gatewayProcessCmdlineMatches(cmdline, gatewayBin);
+  return gatewayProcessCmdlineMatches(cmdline, gatewayBin, {
+    expectedOpenShellGateway,
+  });
 }
diff --git a/src/lib/onboard/host-gateway-process.test.ts b/src/lib/onboard/host-gateway-process.test.ts
index 78ab1da63ad..ba901ff0d22 100644
--- a/src/lib/onboard/host-gateway-process.test.ts
+++ b/src/lib/onboard/host-gateway-process.test.ts
@@ -180,6 +180,67 @@ describe("stopHostGatewayProcesses", () => {
     expect(fs.existsSync(pidFile)).toBe(false);
   });
 
+  it("accepts a matching OpenShell CLI gateway-start process for the cleanup target", () => {
+    const stateDir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-host-gateway-"));
+    const pidFile = path.join(stateDir, "openshell-gateway.pid");
+    fs.writeFileSync(pidFile, "9999553\n");
+    const exited = new Set<number>();
+    const responses = new Map<string, RunResult | ((args: string[]) => RunResult)>([
+      ["pgrep -f ^(/[^ ]*/)?openshell-gateway( |$)", notFound()],
+      ...psResponses(9999553, {
+        cmdline:
+          "/Users/test/.local/bin/openshell gateway start --name nemoclaw-8081 --port 8081\n",
+        exited,
+      }),
+    ]);
+    const { run } = makeRun(responses);
+    const kill = vi.fn<HostGatewayProcessDeps["kill"]>((pid, signal) => {
+      if (signal === "SIGTERM") exited.add(pid);
+      return true;
+    });
+
+    const result = stopHostGatewayProcesses(
+      { run, kill, env: { USER: "tester" }, commandExists: () => true, log: vi.fn() },
+      {
+        openShellGatewayName: "nemoclaw-8081",
+        openShellGatewayPort: 8081,
+        stateDir,
+      },
+    );
+
+    expect(result.stopped).toEqual([9999553]);
+    expect(kill).toHaveBeenCalledWith(9999553, "SIGTERM");
+    expect(fs.existsSync(pidFile)).toBe(false);
+  });
+
+  it("skips a stale PID-file OpenShell CLI gateway-start process for another gateway", () => {
+    const stateDir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-host-gateway-"));
+    const pidFile = path.join(stateDir, "openshell-gateway.pid");
+    fs.writeFileSync(pidFile, "9999554\n");
+    const responses = new Map<string, RunResult | ((args: string[]) => RunResult)>([
+      ["pgrep -f ^(/[^ ]*/)?openshell-gateway( |$)", notFound()],
+      ...psResponses(9999554, {
+        cmdline: "/Users/test/.local/bin/openshell gateway start --name other --port 9999\n",
+        exited: new Set(),
+      }),
+    ]);
+    const { run } = makeRun(responses);
+    const kill = vi.fn<HostGatewayProcessDeps["kill"]>(() => true);
+
+    const result = stopHostGatewayProcesses(
+      { run, kill, env: { USER: "tester" }, commandExists: () => true, log: vi.fn() },
+      {
+        openShellGatewayName: "nemoclaw-8081",
+        openShellGatewayPort: 8081,
+        stateDir,
+      },
+    );
+
+    expect(result.skippedNonMatchingPids).toEqual([9999554]);
+    expect(kill).not.toHaveBeenCalled();
+    expect(fs.existsSync(pidFile)).toBe(false);
+  });
+
   it("rejects a PID whose argv0 is not docker even if it touches the mount path", () => {
     const stateDir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-host-gateway-"));
     const pidFile = path.join(stateDir, "openshell-gateway.pid");
diff --git a/src/lib/onboard/host-gateway-process.ts b/src/lib/onboard/host-gateway-process.ts
index d0bb226d6be..92b7a2dfe69 100644
--- a/src/lib/onboard/host-gateway-process.ts
+++ b/src/lib/onboard/host-gateway-process.ts
@@ -8,7 +8,10 @@ import path from "node:path";
 
 import { waitUntil } from "../core/wait";
 import { clearDockerDriverGatewayRuntimeMarker } from "./docker-driver-gateway-runtime-marker";
-import { hostGatewayCmdlineMatches as sharedHostGatewayCmdlineMatches } from "./gateway-process-identity";
+import {
+  hostGatewayCmdlineMatches as sharedHostGatewayCmdlineMatches,
+  type OpenShellGatewayProcessTarget,
+} from "./gateway-process-identity";
 
 export interface RunResult {
   status: number | null;
@@ -31,6 +34,8 @@ export interface StopHostGatewayOptions {
   gatewayBin?: string | null;
   killWaitMs?: number;
   logNoProcesses?: boolean;
+  openShellGatewayName?: string;
+  openShellGatewayPort?: number | string;
   pids?: Iterable<number>;
   pidFile?: string;
   pollIntervalMs?: number;
@@ -161,7 +166,13 @@ function pidOwner(pid: number, deps: HostGatewayProcessDeps): string | null {
   return result.stdout.trim() || null;
 }
 
-export const hostGatewayCmdlineMatches = sharedHostGatewayCmdlineMatches;
+export function hostGatewayCmdlineMatches(
+  cmdline: string,
+  gatewayBin: string | null | undefined,
+  expectedOpenShellGateway?: OpenShellGatewayProcessTarget,
+): boolean {
+  return sharedHostGatewayCmdlineMatches(cmdline, gatewayBin, expectedOpenShellGateway);
+}
 
 function waitForExit(
   pid: number,
@@ -287,6 +298,13 @@ export function stopHostGatewayProcesses(
     pollIntervalMs: options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS,
     termWaitMs: options.termWaitMs ?? DEFAULT_TERM_WAIT_MS,
   };
+  const expectedOpenShellGateway =
+    options.openShellGatewayName || options.openShellGatewayPort !== undefined
+      ? {
+          name: options.openShellGatewayName,
+          port: options.openShellGatewayPort,
+        }
+      : undefined;
   let clearedRuntimeFiles = false;
   for (const [pid, sources] of candidates) {
     if (!pidExists(pid, deps)) {
@@ -297,7 +315,13 @@ export function stopHostGatewayProcesses(
       }
       continue;
     }
-    if (!hostGatewayCmdlineMatches(processArgs(pid, deps), options.gatewayBin)) {
+    if (
+      !hostGatewayCmdlineMatches(
+        processArgs(pid, deps),
+        options.gatewayBin,
+        expectedOpenShellGateway,
+      )
+    ) {
       result.skippedNonMatchingPids.push(pid);
       if (clearRuntimeState && sources.has("pid-file") && !clearedRuntimeFiles) {
         clearRuntimeFiles(pidFile, stateDir);

From 63da39c276396fc6680a9bd2cea79374ba9b4237 Mon Sep 17 00:00:00 2001
From: Prekshi Vyas <prekshiv@nvidia.com>
Date: Fri, 10 Jul 2026 14:21:31 -0700
Subject: [PATCH 23/45] test(destroy): keep gateway process mocks linear

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
---
 src/lib/onboard/host-gateway-process.test.ts | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/src/lib/onboard/host-gateway-process.test.ts b/src/lib/onboard/host-gateway-process.test.ts
index ba901ff0d22..3ed43fe0065 100644
--- a/src/lib/onboard/host-gateway-process.test.ts
+++ b/src/lib/onboard/host-gateway-process.test.ts
@@ -138,7 +138,11 @@ describe("stopHostGatewayProcesses", () => {
     ]);
     const { run } = makeRun(responses);
     const kill = vi.fn<HostGatewayProcessDeps["kill"]>((pid, signal) => {
-      if (signal === "SIGTERM") exited.add(pid);
+      switch (signal) {
+        case "SIGTERM":
+          exited.add(pid);
+          break;
+      }
       return true;
     });
 
@@ -166,7 +170,11 @@ describe("stopHostGatewayProcesses", () => {
     ]);
     const { run } = makeRun(responses);
     const kill = vi.fn<HostGatewayProcessDeps["kill"]>((pid, signal) => {
-      if (signal === "SIGTERM") exited.add(pid);
+      switch (signal) {
+        case "SIGTERM":
+          exited.add(pid);
+          break;
+      }
       return true;
     });
 
@@ -195,7 +203,11 @@ describe("stopHostGatewayProcesses", () => {
     ]);
     const { run } = makeRun(responses);
     const kill = vi.fn<HostGatewayProcessDeps["kill"]>((pid, signal) => {
-      if (signal === "SIGTERM") exited.add(pid);
+      switch (signal) {
+        case "SIGTERM":
+          exited.add(pid);
+          break;
+      }
       return true;
     });
 

From 7f1ef5f7c55d7b27fb6aca38fd7b83e4c054c1f2 Mon Sep 17 00:00:00 2001
From: Prekshi Vyas <prekshiv@nvidia.com>
Date: Fri, 10 Jul 2026 14:25:17 -0700
Subject: [PATCH 24/45] fix(destroy): fail closed on gateway docker probe
 errors

---
 src/lib/actions/sandbox/destroy-gateway-cleanup.test.ts | 2 --
 src/lib/actions/sandbox/destroy-gateway-cleanup.ts      | 2 --
 2 files changed, 4 deletions(-)

diff --git a/src/lib/actions/sandbox/destroy-gateway-cleanup.test.ts b/src/lib/actions/sandbox/destroy-gateway-cleanup.test.ts
index aa8189fbd3a..1d86fe259ad 100644
--- a/src/lib/actions/sandbox/destroy-gateway-cleanup.test.ts
+++ b/src/lib/actions/sandbox/destroy-gateway-cleanup.test.ts
@@ -77,8 +77,6 @@ describe("shouldCleanupGatewayAfterConfirmedFinalDestroy", () => {
     expect(dockerCapture).toHaveBeenCalledWith(
       ["ps", "--filter", "name=openshell-npmtest-", "--format", "{{.Names}}"],
       {
-        ignoreError: true,
-        suppressOutput: true,
         timeout: 1_000,
       },
     );
diff --git a/src/lib/actions/sandbox/destroy-gateway-cleanup.ts b/src/lib/actions/sandbox/destroy-gateway-cleanup.ts
index e67de84b34a..b4b0c20b10f 100644
--- a/src/lib/actions/sandbox/destroy-gateway-cleanup.ts
+++ b/src/lib/actions/sandbox/destroy-gateway-cleanup.ts
@@ -79,8 +79,6 @@ export function collectLiveSandboxProbeSnapshot(
             "{{.Names}}",
           ],
           {
-            ignoreError: true,
-            suppressOutput: true,
             timeout: timeoutMs,
           },
         ),

From b523514ca6bc3efa20eda44f8cd5db3b3f38189e Mon Sep 17 00:00:00 2001
From: Prekshi Vyas <prekshiv@nvidia.com>
Date: Fri, 10 Jul 2026 14:37:45 -0700
Subject: [PATCH 25/45] fix(destroy): scope direct gateway pid cleanup

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
---
 src/lib/onboard/gateway-process-identity.ts   |  34 ++++-
 .../host-gateway-process-target.test.ts       | 133 ++++++++++++++++++
 src/lib/onboard/host-gateway-process.test.ts  |  65 ---------
 3 files changed, 161 insertions(+), 71 deletions(-)
 create mode 100644 src/lib/onboard/host-gateway-process-target.test.ts

diff --git a/src/lib/onboard/gateway-process-identity.ts b/src/lib/onboard/gateway-process-identity.ts
index 16c9bb83086..d318f3c8f82 100644
--- a/src/lib/onboard/gateway-process-identity.ts
+++ b/src/lib/onboard/gateway-process-identity.ts
@@ -44,25 +44,38 @@ function cliFlagValue(tokens: string[], names: string[]): string | null {
   return null;
 }
 
-function openShellGatewayStartMatchesTarget(
+function openShellGatewayMatchesTarget(
   tokens: string[],
   target: OpenShellGatewayProcessTarget | undefined,
+  opts: { requireExpectedFlags: boolean },
 ): boolean {
   if (!target || (!target.name && (target.port === undefined || target.port === null))) {
     return true;
   }
 
+  let matchedComparableFlag = false;
+
   if (target.name) {
     const actualName = cliFlagValue(tokens, ["--name"]);
-    if (actualName !== target.name) return false;
+    if (actualName === null) {
+      if (opts.requireExpectedFlags) return false;
+    } else {
+      if (actualName !== target.name) return false;
+      matchedComparableFlag = true;
+    }
   }
 
   if (target.port !== undefined && target.port !== null) {
     const actualPort = cliFlagValue(tokens, ["--port"]);
-    if (actualPort !== String(target.port)) return false;
+    if (actualPort === null) {
+      if (opts.requireExpectedFlags) return false;
+    } else {
+      if (actualPort !== String(target.port)) return false;
+      matchedComparableFlag = true;
+    }
   }
 
-  return true;
+  return matchedComparableFlag;
 }
 
 export function gatewayProcessCmdlineMatches(
@@ -80,14 +93,23 @@ export function gatewayProcessCmdlineMatches(
 
   const processNames = opts.processNames ?? HOST_GATEWAY_PROCESS_NAMES;
   const base = path.basename(argv0);
-  if (processNames.has(base)) return true;
+  if (processNames.has(base)) {
+    if (processNames.has("openshell-gateway") && base === "openshell-gateway") {
+      return openShellGatewayMatchesTarget(tokens, opts.expectedOpenShellGateway, {
+        requireExpectedFlags: false,
+      });
+    }
+    return true;
+  }
   if (
     processNames.has("openshell-gateway") &&
     base === "openshell" &&
     tokens[1] === "gateway" &&
     tokens[2] === "start"
   ) {
-    return openShellGatewayStartMatchesTarget(tokens, opts.expectedOpenShellGateway);
+    return openShellGatewayMatchesTarget(tokens, opts.expectedOpenShellGateway, {
+      requireExpectedFlags: true,
+    });
   }
 
   if (typeof gatewayBin === "string" && gatewayBin.length > 0) {
diff --git a/src/lib/onboard/host-gateway-process-target.test.ts b/src/lib/onboard/host-gateway-process-target.test.ts
new file mode 100644
index 00000000000..54488691ba3
--- /dev/null
+++ b/src/lib/onboard/host-gateway-process-target.test.ts
@@ -0,0 +1,133 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import { describe, expect, it, vi } from "vitest";
+
+import {
+  type HostGatewayProcessDeps,
+  type RunResult,
+  stopHostGatewayProcesses,
+} from "./host-gateway-process";
+
+type RunResponse = (args: string[]) => RunResult;
+
+function ok(stdout = ""): RunResult {
+  return { status: 0, stdout, stderr: "" };
+}
+
+function notFound(): RunResult {
+  return { status: 1, stdout: "", stderr: "" };
+}
+
+function staticResponse(result: RunResult): RunResponse {
+  return () => result;
+}
+
+function commandKey(command: string, args: string[]): string {
+  return `${command} ${args.join(" ")}`;
+}
+
+function makeRun(responses: Map<string, RunResponse>): HostGatewayProcessDeps["run"] {
+  const fallback = staticResponse(notFound());
+  return (command, args) => (responses.get(commandKey(command, args)) ?? fallback)(args);
+}
+
+function psResponses(
+  pid: number,
+  opts: {
+    cmdline: string;
+    exited: Set<number>;
+  },
+): [string, RunResponse][] {
+  return [
+    [`ps -p ${pid} -o pid=`, () => (opts.exited.has(pid) ? notFound() : ok(`${pid}\n`))],
+    [`ps -p ${pid} -o user=`, staticResponse(ok("tester\n"))],
+    [`ps -p ${pid} -o args=`, staticResponse(ok(opts.cmdline))],
+  ];
+}
+
+function stopTargetedPid(pid: number, cmdline: string) {
+  const stateDir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-host-gateway-target-"));
+  const pidFile = path.join(stateDir, "openshell-gateway.pid");
+  fs.writeFileSync(pidFile, `${pid}\n`);
+  const exited = new Set<number>();
+  const responses = new Map<string, RunResponse>([
+    ["pgrep -f ^(/[^ ]*/)?openshell-gateway( |$)", staticResponse(notFound())],
+    ...psResponses(pid, { cmdline, exited }),
+  ]);
+  const kill = vi.fn<HostGatewayProcessDeps["kill"]>((killedPid, signal) => {
+    switch (signal) {
+      case "SIGTERM":
+        exited.add(killedPid);
+        break;
+    }
+    return true;
+  });
+
+  const result = stopHostGatewayProcesses(
+    {
+      run: makeRun(responses),
+      kill,
+      env: { USER: "tester" },
+      commandExists: () => true,
+      log: vi.fn(),
+    },
+    {
+      openShellGatewayName: "nemoclaw-8081",
+      openShellGatewayPort: 8081,
+      stateDir,
+    },
+  );
+
+  return { kill, pidFile, result };
+}
+
+describe("stopHostGatewayProcesses target filtering", () => {
+  it("accepts a matching OpenShell CLI gateway-start process for the cleanup target", () => {
+    const { kill, pidFile, result } = stopTargetedPid(
+      9999553,
+      "/Users/test/.local/bin/openshell gateway start --name nemoclaw-8081 --port 8081\n",
+    );
+
+    expect(result.stopped).toEqual([9999553]);
+    expect(kill).toHaveBeenCalledWith(9999553, "SIGTERM");
+    expect(fs.existsSync(pidFile)).toBe(false);
+  });
+
+  it("skips a stale PID-file OpenShell CLI gateway-start process for another gateway", () => {
+    const { kill, pidFile, result } = stopTargetedPid(
+      9999554,
+      "/Users/test/.local/bin/openshell gateway start --name other --port 9999\n",
+    );
+
+    expect(result.skippedNonMatchingPids).toEqual([9999554]);
+    expect(kill).not.toHaveBeenCalled();
+    expect(fs.existsSync(pidFile)).toBe(false);
+  });
+
+  it("accepts a direct openshell-gateway process with the cleanup target port", () => {
+    const { kill, pidFile, result } = stopTargetedPid(
+      9999555,
+      "/Users/test/.local/bin/openshell-gateway --port 8081\n",
+    );
+
+    expect(result.stopped).toEqual([9999555]);
+    expect(kill).toHaveBeenCalledWith(9999555, "SIGTERM");
+    expect(fs.existsSync(pidFile)).toBe(false);
+  });
+
+  it("skips a stale PID-file direct openshell-gateway process for another port", () => {
+    const { kill, pidFile, result } = stopTargetedPid(
+      9999556,
+      "/Users/test/.local/bin/openshell-gateway --port 8080\n",
+    );
+
+    expect(result.skippedNonMatchingPids).toEqual([9999556]);
+    expect(kill).not.toHaveBeenCalled();
+    expect(fs.existsSync(pidFile)).toBe(false);
+  });
+});
diff --git a/src/lib/onboard/host-gateway-process.test.ts b/src/lib/onboard/host-gateway-process.test.ts
index 3ed43fe0065..7b77fd1d41b 100644
--- a/src/lib/onboard/host-gateway-process.test.ts
+++ b/src/lib/onboard/host-gateway-process.test.ts
@@ -188,71 +188,6 @@ describe("stopHostGatewayProcesses", () => {
     expect(fs.existsSync(pidFile)).toBe(false);
   });
 
-  it("accepts a matching OpenShell CLI gateway-start process for the cleanup target", () => {
-    const stateDir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-host-gateway-"));
-    const pidFile = path.join(stateDir, "openshell-gateway.pid");
-    fs.writeFileSync(pidFile, "9999553\n");
-    const exited = new Set<number>();
-    const responses = new Map<string, RunResult | ((args: string[]) => RunResult)>([
-      ["pgrep -f ^(/[^ ]*/)?openshell-gateway( |$)", notFound()],
-      ...psResponses(9999553, {
-        cmdline:
-          "/Users/test/.local/bin/openshell gateway start --name nemoclaw-8081 --port 8081\n",
-        exited,
-      }),
-    ]);
-    const { run } = makeRun(responses);
-    const kill = vi.fn<HostGatewayProcessDeps["kill"]>((pid, signal) => {
-      switch (signal) {
-        case "SIGTERM":
-          exited.add(pid);
-          break;
-      }
-      return true;
-    });
-
-    const result = stopHostGatewayProcesses(
-      { run, kill, env: { USER: "tester" }, commandExists: () => true, log: vi.fn() },
-      {
-        openShellGatewayName: "nemoclaw-8081",
-        openShellGatewayPort: 8081,
-        stateDir,
-      },
-    );
-
-    expect(result.stopped).toEqual([9999553]);
-    expect(kill).toHaveBeenCalledWith(9999553, "SIGTERM");
-    expect(fs.existsSync(pidFile)).toBe(false);
-  });
-
-  it("skips a stale PID-file OpenShell CLI gateway-start process for another gateway", () => {
-    const stateDir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-host-gateway-"));
-    const pidFile = path.join(stateDir, "openshell-gateway.pid");
-    fs.writeFileSync(pidFile, "9999554\n");
-    const responses = new Map<string, RunResult | ((args: string[]) => RunResult)>([
-      ["pgrep -f ^(/[^ ]*/)?openshell-gateway( |$)", notFound()],
-      ...psResponses(9999554, {
-        cmdline: "/Users/test/.local/bin/openshell gateway start --name other --port 9999\n",
-        exited: new Set(),
-      }),
-    ]);
-    const { run } = makeRun(responses);
-    const kill = vi.fn<HostGatewayProcessDeps["kill"]>(() => true);
-
-    const result = stopHostGatewayProcesses(
-      { run, kill, env: { USER: "tester" }, commandExists: () => true, log: vi.fn() },
-      {
-        openShellGatewayName: "nemoclaw-8081",
-        openShellGatewayPort: 8081,
-        stateDir,
-      },
-    );
-
-    expect(result.skippedNonMatchingPids).toEqual([9999554]);
-    expect(kill).not.toHaveBeenCalled();
-    expect(fs.existsSync(pidFile)).toBe(false);
-  });
-
   it("rejects a PID whose argv0 is not docker even if it touches the mount path", () => {
     const stateDir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-host-gateway-"));
     const pidFile = path.join(stateDir, "openshell-gateway.pid");

From b97f572d30415b8543d92a110193148da8cf3918 Mon Sep 17 00:00:00 2001
From: Prekshi Vyas <prekshiv@nvidia.com>
Date: Fri, 10 Jul 2026 14:52:59 -0700
Subject: [PATCH 26/45] fix(destroy): verify compat gateway cleanup target

---
 src/lib/onboard/gateway-process-identity.ts   | 26 +++++++++++++++++--
 .../host-gateway-process-target.test.ts       | 22 ++++++++++++++++
 2 files changed, 46 insertions(+), 2 deletions(-)

diff --git a/src/lib/onboard/gateway-process-identity.ts b/src/lib/onboard/gateway-process-identity.ts
index d318f3c8f82..3955d368c36 100644
--- a/src/lib/onboard/gateway-process-identity.ts
+++ b/src/lib/onboard/gateway-process-identity.ts
@@ -3,6 +3,8 @@
 
 import path from "node:path";
 
+import { resolveGatewayCompatContainerName, resolveGatewayName } from "./gateway-binding";
+
 export const HOST_GATEWAY_PROCESS_NAMES = new Set(["openshell-gateway", "openclaw-gateway"]);
 export const OPENSHELL_GATEWAY_PROCESS_NAMES = new Set(["openshell-gateway"]);
 
@@ -78,6 +80,22 @@ function openShellGatewayMatchesTarget(
   return matchedComparableFlag;
 }
 
+function dockerCompatGatewayMatchesTarget(
+  tokens: string[],
+  target: OpenShellGatewayProcessTarget | undefined,
+): boolean {
+  if (!target || (!target.name && (target.port === undefined || target.port === null))) {
+    return true;
+  }
+  if (target.port === undefined || target.port === null) return false;
+
+  const port = Number(target.port);
+  if (!Number.isInteger(port) || port < 1 || port > 65535) return false;
+  if (target.name && target.name !== resolveGatewayName(port)) return false;
+
+  return cliFlagValue(tokens, ["--name"]) === resolveGatewayCompatContainerName(port);
+}
+
 export function gatewayProcessCmdlineMatches(
   cmdline: string,
   gatewayBin: string | null | undefined,
@@ -116,7 +134,11 @@ export function gatewayProcessCmdlineMatches(
     const normalize = opts.resolveExecutablePath ?? ((value: string) => path.resolve(value));
     const actual = normalize(argv0);
     const expected = normalize(gatewayBin);
-    if (actual && expected && actual === expected) return true;
+    if (actual && expected && actual === expected) {
+      return openShellGatewayMatchesTarget(tokens, opts.expectedOpenShellGateway, {
+        requireExpectedFlags: false,
+      });
+    }
   }
 
   // Docker compatibility mode: argv0 basename must be a known container
@@ -126,7 +148,7 @@ export function gatewayProcessCmdlineMatches(
     DOCKER_DRIVER_GATEWAY_CONTAINER_RUNTIME_NAMES.has(base) &&
     tokens.slice(1).includes(DOCKER_DRIVER_GATEWAY_COMPAT_MOUNT_PATH)
   ) {
-    return true;
+    return dockerCompatGatewayMatchesTarget(tokens, opts.expectedOpenShellGateway);
   }
 
   return false;
diff --git a/src/lib/onboard/host-gateway-process-target.test.ts b/src/lib/onboard/host-gateway-process-target.test.ts
index 54488691ba3..8dc37c4c887 100644
--- a/src/lib/onboard/host-gateway-process-target.test.ts
+++ b/src/lib/onboard/host-gateway-process-target.test.ts
@@ -130,4 +130,26 @@ describe("stopHostGatewayProcesses target filtering", () => {
     expect(kill).not.toHaveBeenCalled();
     expect(fs.existsSync(pidFile)).toBe(false);
   });
+
+  it("accepts a Docker compatibility gateway with the cleanup target container name", () => {
+    const { kill, pidFile, result } = stopTargetedPid(
+      9999557,
+      "docker run --rm --name nemoclaw-openshell-gateway-8081 ubuntu:24.04 /opt/nemoclaw/openshell-gateway\n",
+    );
+
+    expect(result.stopped).toEqual([9999557]);
+    expect(kill).toHaveBeenCalledWith(9999557, "SIGTERM");
+    expect(fs.existsSync(pidFile)).toBe(false);
+  });
+
+  it("skips a stale PID-file Docker compatibility gateway for another port", () => {
+    const { kill, pidFile, result } = stopTargetedPid(
+      9999558,
+      "docker run --rm --name nemoclaw-openshell-gateway ubuntu:24.04 /opt/nemoclaw/openshell-gateway\n",
+    );
+
+    expect(result.skippedNonMatchingPids).toEqual([9999558]);
+    expect(kill).not.toHaveBeenCalled();
+    expect(fs.existsSync(pidFile)).toBe(false);
+  });
 });

From 890c63ba22bdf9557af7b494c29687cb641c9bd4 Mon Sep 17 00:00:00 2001
From: Prekshi Vyas <prekshiv@nvidia.com>
Date: Fri, 10 Jul 2026 14:55:30 -0700
Subject: [PATCH 27/45] chore(onboard): keep entrypoint net-neutral

---
 src/lib/onboard.ts | 2 --
 1 file changed, 2 deletions(-)

diff --git a/src/lib/onboard.ts b/src/lib/onboard.ts
index c04a06ef781..96dbd656854 100644
--- a/src/lib/onboard.ts
+++ b/src/lib/onboard.ts
@@ -2,8 +2,6 @@
 // SPDX-License-Identifier: Apache-2.0
 //
 // Interactive onboarding wizard — 8 steps from zero to running sandbox.
-// Supports non-interactive mode via --non-interactive flag or
-// NEMOCLAW_NON_INTERACTIVE=1 env var for CI/CD pipelines.
 const {
   envInt,
   LOCAL_INFERENCE_TIMEOUT_SECS,

From 3a0293f7b9176de8ddf77cd57b2af2bf47587520 Mon Sep 17 00:00:00 2001
From: Prekshi Vyas <prekshiv@nvidia.com>
Date: Fri, 10 Jul 2026 15:16:31 -0700
Subject: [PATCH 28/45] fix(destroy): bind host gateway launch identity

---
 src/lib/onboard.ts                            | 12 ++----
 .../docker-driver-gateway-launch.test.ts      | 33 ++++++++++++++
 .../onboard/docker-driver-gateway-launch.ts   |  4 ++
 src/lib/onboard/gateway-process-identity.ts   | 43 ++++++++++++++++++-
 .../host-gateway-process-target.test.ts       | 13 +++---
 src/lib/onboard/host-gateway-process.test.ts  | 19 ++++----
 src/lib/onboard/host-gateway-process.ts       |  3 +-
 test/cli/doctor-gateway-token.test.ts         |  4 +-
 8 files changed, 107 insertions(+), 24 deletions(-)

diff --git a/src/lib/onboard.ts b/src/lib/onboard.ts
index 96dbd656854..2d733aa16f8 100644
--- a/src/lib/onboard.ts
+++ b/src/lib/onboard.ts
@@ -2087,20 +2087,16 @@ async function startDockerDriverGateway({
     },
   );
   if (cutover === "reused") return;
-  if (!gatewayBin) throw new Error("OpenShell gateway binary missing after cutover");
+  if (!gatewayBin || !gatewayLaunch) {
+    throw new Error("OpenShell gateway launch missing after cutover");
+  }
 
   fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 });
   const logPath = path.join(stateDir, "openshell-gateway.log");
   const logFd = dockerDriverGatewayLaunch.openDockerDriverGatewayLog(logPath, { exitOnFailure });
   console.log("  Starting OpenShell Docker-driver gateway...");
   console.log(`  Gateway log: ${logPath}`);
-  const launch = gatewayLaunch ?? {
-    command: gatewayBin,
-    args: [],
-    env: { ...process.env, ...gatewayEnv },
-    mode: "host" as const,
-    processGatewayBin: gatewayBin,
-  };
+  const launch = gatewayLaunch;
   dockerDriverGatewayLaunch.prepareAndLogDockerDriverGatewayLaunch(launch);
   const child = dockerDriverGatewayLaunch.spawnDockerDriverGateway(launch, logFd);
   const childExit = trackChildExit(child); // #3111 zombie-safe liveness
diff --git a/src/lib/onboard/docker-driver-gateway-launch.test.ts b/src/lib/onboard/docker-driver-gateway-launch.test.ts
index 2c5eec75327..0938f654d8f 100644
--- a/src/lib/onboard/docker-driver-gateway-launch.test.ts
+++ b/src/lib/onboard/docker-driver-gateway-launch.test.ts
@@ -15,6 +15,7 @@ import {
   resolveDriftGatewayBin,
   shouldUseContainerizedGateway,
 } from "./docker-driver-gateway-launch";
+import { gatewayProcessCmdlineMatches } from "./gateway-process-identity";
 
 function withTempBinaries<T>(
   fn: (paths: { dir: string; gatewayBin: string; sandboxBin: string }) => T,
@@ -177,6 +178,38 @@ describe("docker-driver-gateway-launch", () => {
     });
   });
 
+  it("binds the real no-argument host launch identity to its gateway target", () => {
+    withTempBinaries(({ dir, gatewayBin }) => {
+      const launch = buildDockerDriverGatewayLaunch({
+        gatewayBin,
+        gatewayName: "nemoclaw-8081",
+        stateDir: dir,
+        platform: "linux",
+        env: {},
+        hostGlibcVersion: "2.39",
+        requiredGlibcVersions: ["2.39"],
+        gatewayEnv: {
+          OPENSHELL_DRIVERS: "docker",
+          OPENSHELL_GRPC_ENDPOINT: "https://127.0.0.1:8081",
+        },
+      });
+      const cmdline = [launch.argv0, ...launch.args].filter(Boolean).join(" ");
+
+      expect(launch.args).toEqual([]);
+      expect(launch.argv0).toBe("openshell-gateway[nemoclaw=nemoclaw-8081;port=8081]");
+      expect(
+        gatewayProcessCmdlineMatches(cmdline, gatewayBin, {
+          expectedOpenShellGateway: { name: "nemoclaw-8081", port: 8081 },
+        }),
+      ).toBe(true);
+      expect(
+        gatewayProcessCmdlineMatches(cmdline, gatewayBin, {
+          expectedOpenShellGateway: { name: "nemoclaw", port: 8080 },
+        }),
+      ).toBe(false);
+    });
+  });
+
   it("scrubs stale auth-disable env from direct host gateway launches", () => {
     withTempBinaries(({ dir, gatewayBin }) => {
       const launch = buildDockerDriverGatewayLaunch({
diff --git a/src/lib/onboard/docker-driver-gateway-launch.ts b/src/lib/onboard/docker-driver-gateway-launch.ts
index 1564d1ec982..271875c8ee2 100644
--- a/src/lib/onboard/docker-driver-gateway-launch.ts
+++ b/src/lib/onboard/docker-driver-gateway-launch.ts
@@ -22,6 +22,7 @@ import {
   buildDockerDriverGatewayLocalTlsEnv,
   ensureDockerDriverGatewayLocalTlsBundle,
 } from "./docker-driver-gateway-local-tls";
+import { buildOwnedHostGatewayArgv0 } from "./gateway-process-identity";
 
 export {
   compareDottedVersions,
@@ -37,6 +38,7 @@ export { buildDockerDriverGatewayConfigToml };
 export type DockerDriverGatewayLaunch = {
   command: string;
   args: string[];
+  argv0?: string;
   env: NodeJS.ProcessEnv;
   mode: "host" | "container";
   processGatewayBin: string | null;
@@ -74,6 +76,7 @@ export function spawnDockerDriverGateway(
 ): ChildProcess {
   try {
     return spawn(launch.command, launch.args, {
+      argv0: launch.argv0,
       detached: true,
       stdio: ["ignore", logFd, logFd],
       env: launch.env,
@@ -144,6 +147,7 @@ export function buildDockerDriverGatewayLaunch(
     return {
       command: options.gatewayBin,
       args: [],
+      argv0: buildOwnedHostGatewayArgv0(options.gatewayName) ?? undefined,
       env,
       mode: "host",
       processGatewayBin: options.gatewayBin,
diff --git a/src/lib/onboard/gateway-process-identity.ts b/src/lib/onboard/gateway-process-identity.ts
index 3955d368c36..db52f978f1e 100644
--- a/src/lib/onboard/gateway-process-identity.ts
+++ b/src/lib/onboard/gateway-process-identity.ts
@@ -3,7 +3,11 @@
 
 import path from "node:path";
 
-import { resolveGatewayCompatContainerName, resolveGatewayName } from "./gateway-binding";
+import {
+  resolveGatewayCompatContainerName,
+  resolveGatewayName,
+  resolveGatewayPortFromName,
+} from "./gateway-binding";
 
 export const HOST_GATEWAY_PROCESS_NAMES = new Set(["openshell-gateway", "openclaw-gateway"]);
 export const OPENSHELL_GATEWAY_PROCESS_NAMES = new Set(["openshell-gateway"]);
@@ -27,6 +31,39 @@ export interface OpenShellGatewayProcessTarget {
   port?: number | string | null;
 }
 
+const OWNED_HOST_GATEWAY_ARGV0_RE =
+  /^openshell-gateway\[nemoclaw=(nemoclaw(?:-\d+)?);port=(\d+)\]$/;
+
+export function buildOwnedHostGatewayArgv0(gatewayName: string | null | undefined): string | null {
+  if (!gatewayName) return null;
+  const port = resolveGatewayPortFromName(gatewayName);
+  if (port === null) return null;
+  return `openshell-gateway[nemoclaw=${gatewayName};port=${port}]`;
+}
+
+function ownedHostGatewayTarget(argv0: string): { name: string; port: number } | null {
+  const match = OWNED_HOST_GATEWAY_ARGV0_RE.exec(argv0);
+  if (!match) return null;
+  const name = match[1];
+  const port = Number(match[2]);
+  if (resolveGatewayPortFromName(name) !== port || resolveGatewayName(port) !== name) return null;
+  return { name, port };
+}
+
+function gatewayTargetMatches(
+  actual: { name: string; port: number },
+  expected: OpenShellGatewayProcessTarget | undefined,
+): boolean {
+  if (!expected || (!expected.name && (expected.port === undefined || expected.port === null))) {
+    return true;
+  }
+  if (expected.name && expected.name !== actual.name) return false;
+  if (expected.port !== undefined && expected.port !== null) {
+    return String(expected.port) === String(actual.port);
+  }
+  return true;
+}
+
 export function cleanGatewayProcessToken(token: string): string {
   return token.replace(/^['"]|['"]$/g, "").replace(/ \(deleted\)$/, "");
 }
@@ -111,6 +148,10 @@ export function gatewayProcessCmdlineMatches(
 
   const processNames = opts.processNames ?? HOST_GATEWAY_PROCESS_NAMES;
   const base = path.basename(argv0);
+  const ownedTarget = ownedHostGatewayTarget(base);
+  if (ownedTarget && processNames.has("openshell-gateway")) {
+    return gatewayTargetMatches(ownedTarget, opts.expectedOpenShellGateway);
+  }
   if (processNames.has(base)) {
     if (processNames.has("openshell-gateway") && base === "openshell-gateway") {
       return openShellGatewayMatchesTarget(tokens, opts.expectedOpenShellGateway, {
diff --git a/src/lib/onboard/host-gateway-process-target.test.ts b/src/lib/onboard/host-gateway-process-target.test.ts
index 8dc37c4c887..97248b23848 100644
--- a/src/lib/onboard/host-gateway-process-target.test.ts
+++ b/src/lib/onboard/host-gateway-process-target.test.ts
@@ -8,11 +8,14 @@ import path from "node:path";
 import { describe, expect, it, vi } from "vitest";
 
 import {
+  HOST_GATEWAY_PGREP_PATTERN,
   type HostGatewayProcessDeps,
   type RunResult,
   stopHostGatewayProcesses,
 } from "./host-gateway-process";
 
+const PGREP_KEY = `pgrep -f ${HOST_GATEWAY_PGREP_PATTERN}`;
+
 type RunResponse = (args: string[]) => RunResult;
 
 function ok(stdout = ""): RunResult {
@@ -56,7 +59,7 @@ function stopTargetedPid(pid: number, cmdline: string) {
   fs.writeFileSync(pidFile, `${pid}\n`);
   const exited = new Set<number>();
   const responses = new Map<string, RunResponse>([
-    ["pgrep -f ^(/[^ ]*/)?openshell-gateway( |$)", staticResponse(notFound())],
+    [PGREP_KEY, staticResponse(notFound())],
     ...psResponses(pid, { cmdline, exited }),
   ]);
   const kill = vi.fn<HostGatewayProcessDeps["kill"]>((killedPid, signal) => {
@@ -109,10 +112,10 @@ describe("stopHostGatewayProcesses target filtering", () => {
     expect(fs.existsSync(pidFile)).toBe(false);
   });
 
-  it("accepts a direct openshell-gateway process with the cleanup target port", () => {
+  it("accepts the owned no-argument host launch for the cleanup target", () => {
     const { kill, pidFile, result } = stopTargetedPid(
       9999555,
-      "/Users/test/.local/bin/openshell-gateway --port 8081\n",
+      "openshell-gateway[nemoclaw=nemoclaw-8081;port=8081]\n",
     );
 
     expect(result.stopped).toEqual([9999555]);
@@ -120,10 +123,10 @@ describe("stopHostGatewayProcesses target filtering", () => {
     expect(fs.existsSync(pidFile)).toBe(false);
   });
 
-  it("skips a stale PID-file direct openshell-gateway process for another port", () => {
+  it("skips an owned no-argument host launch for another port", () => {
     const { kill, pidFile, result } = stopTargetedPid(
       9999556,
-      "/Users/test/.local/bin/openshell-gateway --port 8080\n",
+      "openshell-gateway[nemoclaw=nemoclaw;port=8080]\n",
     );
 
     expect(result.skippedNonMatchingPids).toEqual([9999556]);
diff --git a/src/lib/onboard/host-gateway-process.test.ts b/src/lib/onboard/host-gateway-process.test.ts
index 7b77fd1d41b..29c87ca9ffd 100644
--- a/src/lib/onboard/host-gateway-process.test.ts
+++ b/src/lib/onboard/host-gateway-process.test.ts
@@ -8,11 +8,14 @@ import path from "node:path";
 import { describe, expect, it, vi } from "vitest";
 
 import {
+  HOST_GATEWAY_PGREP_PATTERN,
   type HostGatewayProcessDeps,
   type RunResult,
   stopHostGatewayProcesses,
 } from "./host-gateway-process";
 
+const PGREP_KEY = `pgrep -f ${HOST_GATEWAY_PGREP_PATTERN}`;
+
 interface RunArgs {
   args: string[];
   command: string;
@@ -67,7 +70,7 @@ describe("stopHostGatewayProcesses", () => {
   it("uses pgrep fallback when the Docker-driver gateway PID file is missing", () => {
     const exited = new Set<number>();
     const responses = new Map<string, RunResult | ((args: string[]) => RunResult)>([
-      ["pgrep -f ^(/[^ ]*/)?openshell-gateway( |$)", ok("9999887\n")],
+      [PGREP_KEY, ok("9999887\n")],
       ...psResponses(9999887, { exited }),
     ]);
     const { run } = makeRun(responses);
@@ -92,7 +95,7 @@ describe("stopHostGatewayProcesses", () => {
     const signals: Array<NodeJS.Signals | number | undefined> = [];
     let pidChecks = 0;
     const responses = new Map<string, RunResult | ((args: string[]) => RunResult)>([
-      ["pgrep -f ^(/[^ ]*/)?openshell-gateway( |$)", ok(`${pid}\n`)],
+      [PGREP_KEY, ok(`${pid}\n`)],
       [`ps -p ${pid} -o user=`, ok("tester\n")],
       [`ps -p ${pid} -o args=`, ok("/home/test/.local/bin/openshell-gateway --port 8080\n")],
       [
@@ -129,7 +132,7 @@ describe("stopHostGatewayProcesses", () => {
     fs.writeFileSync(pidFile, "9999551\n");
     const exited = new Set<number>();
     const responses = new Map<string, RunResult | ((args: string[]) => RunResult)>([
-      ["pgrep -f ^(/[^ ]*/)?openshell-gateway( |$)", notFound()],
+      [PGREP_KEY, notFound()],
       ...psResponses(9999551, {
         cmdline:
           "/usr/bin/docker run --rm --name nemoclaw-openshell-gateway --network host /opt/nemoclaw/openshell-gateway\n",
@@ -162,7 +165,7 @@ describe("stopHostGatewayProcesses", () => {
     fs.writeFileSync(pidFile, "9999552\n");
     const exited = new Set<number>();
     const responses = new Map<string, RunResult | ((args: string[]) => RunResult)>([
-      ["pgrep -f ^(/[^ ]*/)?openshell-gateway( |$)", notFound()],
+      [PGREP_KEY, notFound()],
       ...psResponses(9999552, {
         cmdline: "/Users/test/.local/bin/openshell gateway start --name nemoclaw --port 8080\n",
         exited,
@@ -193,7 +196,7 @@ describe("stopHostGatewayProcesses", () => {
     const pidFile = path.join(stateDir, "openshell-gateway.pid");
     fs.writeFileSync(pidFile, "9999662\n");
     const responses = new Map<string, RunResult | ((args: string[]) => RunResult)>([
-      ["pgrep -f ^(/[^ ]*/)?openshell-gateway( |$)", notFound()],
+      [PGREP_KEY, notFound()],
       ...psResponses(9999662, {
         cmdline: "/usr/bin/vim /opt/nemoclaw/openshell-gateway\n",
         exited: new Set(),
@@ -240,7 +243,7 @@ describe("stopHostGatewayProcesses", () => {
   it("ignores unrelated command lines that merely mention openshell-gateway", () => {
     const exited = new Set<number>();
     const responses = new Map<string, RunResult | ((args: string[]) => RunResult)>([
-      ["pgrep -f ^(/[^ ]*/)?openshell-gateway( |$)", ok("9999111\n9999222\n")],
+      [PGREP_KEY, ok("9999111\n9999222\n")],
       ...psResponses(9999111, { exited }),
       ...psResponses(9999222, {
         cmdline: "node /home/test/.npm-global/bin/codex issue text mentions openshell-gateway\n",
@@ -265,7 +268,7 @@ describe("stopHostGatewayProcesses", () => {
 
   it("prints sudo remediation when a privileged host gateway cannot be killed", () => {
     const responses = new Map<string, RunResult | ((args: string[]) => RunResult)>([
-      ["pgrep -f ^(/[^ ]*/)?openshell-gateway( |$)", ok("9999042\n")],
+      [PGREP_KEY, ok("9999042\n")],
       ...psResponses(9999042, { exited: new Set(), owner: "root" }),
     ]);
     const { run } = makeRun(responses);
@@ -335,7 +338,7 @@ describe("stopHostGatewayProcesses", () => {
     fs.writeFileSync(pidFile, "9999123\n");
     const exited = new Set<number>();
     const responses = new Map<string, RunResult | ((args: string[]) => RunResult)>([
-      ["pgrep -f ^(/[^ ]*/)?openshell-gateway( |$)", ok("9999456\n")],
+      [PGREP_KEY, ok("9999456\n")],
       ...(psResponses(9999123, { exited: new Set() }).map(([key, value]) =>
         key === "ps -p 9999123 -o pid=" ? [key, notFound()] : [key, value],
       ) as [string, RunResult | ((args: string[]) => RunResult)][]),
diff --git a/src/lib/onboard/host-gateway-process.ts b/src/lib/onboard/host-gateway-process.ts
index 92b7a2dfe69..611217c5d8e 100644
--- a/src/lib/onboard/host-gateway-process.ts
+++ b/src/lib/onboard/host-gateway-process.ts
@@ -60,7 +60,8 @@ export interface StopHostGatewayResult {
 // path could match unrelated commands. The compat parent is rediscovered via
 // the PID file written at launch time.
 /** Anchored pgrep pattern for direct host openshell-gateway processes. */
-export const HOST_GATEWAY_PGREP_PATTERN = "^(/[^ ]*/)?openshell-gateway( |$)";
+export const HOST_GATEWAY_PGREP_PATTERN =
+  "^(/[^ ]*/)?openshell-gateway(\\[nemoclaw=nemoclaw(-[0-9]+)?;port=[0-9]+\\]| |$)";
 const DEFAULT_TERM_WAIT_MS = 1000;
 const DEFAULT_KILL_WAIT_MS = 1000;
 const DEFAULT_POLL_INTERVAL_MS = 50;
diff --git a/test/cli/doctor-gateway-token.test.ts b/test/cli/doctor-gateway-token.test.ts
index fc975da3f4f..26a539286c8 100644
--- a/test/cli/doctor-gateway-token.test.ts
+++ b/test/cli/doctor-gateway-token.test.ts
@@ -299,7 +299,9 @@ describe("CLI dispatch", () => {
       expect(report.status).toBe("ok");
 
       const calls = fs.readFileSync(hostCalls, "utf8");
-      expect(calls).toContain("pgrep:-f ^(/[^ ]*/)?openshell-gateway( |$)");
+      expect(calls).toContain(
+        "pgrep:-f ^(/[^ ]*/)?openshell-gateway(\\[nemoclaw=nemoclaw(-[0-9]+)?;port=[0-9]+\\]| |$)",
+      );
       expect(calls).not.toContain("pgrep:-af openshell-gateway");
       expect(calls).not.toContain("docker:port");
     },

From f854fe479567de57896d5b54af088cbcdc222789 Mon Sep 17 00:00:00 2001
From: Prekshi Vyas <prekshiv@nvidia.com>
Date: Fri, 10 Jul 2026 15:39:59 -0700
Subject: [PATCH 29/45] fix(onboard): migrate legacy gateway identity

---
 .../docker-driver-gateway-runtime.test.ts     |  45 ++-
 .../onboard/docker-driver-gateway-runtime.ts  |  50 +++-
 ...ay-legacy-identity-upgrade-runtime.test.ts | 275 ++++++++++++++++++
 3 files changed, 354 insertions(+), 16 deletions(-)
 create mode 100644 test/onboard-gateway-legacy-identity-upgrade-runtime.test.ts

diff --git a/src/lib/onboard/docker-driver-gateway-runtime.test.ts b/src/lib/onboard/docker-driver-gateway-runtime.test.ts
index 8d656385481..e7297215012 100644
--- a/src/lib/onboard/docker-driver-gateway-runtime.test.ts
+++ b/src/lib/onboard/docker-driver-gateway-runtime.test.ts
@@ -200,14 +200,17 @@ describe("docker-driver gateway runtime helpers", () => {
         },
         () => {
           const { helpers, runCapture } = makeHelpers({
-            runCapture: vi.fn((args) =>
-              args.join(" ") === "ps -axo pid=,ppid=,command="
+            runCapture: vi.fn((args) => {
+              if (args.join(" ") === `ps -p ${pid} -o args=`) {
+                return "openshell-gateway[nemoclaw=nemoclaw-18080;port=18080]\n";
+              }
+              return args.join(" ") === "ps -axo pid=,ppid=,command="
                 ? [
                     `${pid} 1 ${gatewayBin}`,
                     `${pid + 1} ${pid} /usr/local/bin/openshell-driver-vm --bind-socket /tmp/vm.sock`,
                   ].join("\n")
-                : "",
-            ),
+                : "";
+            }),
           });
           const desiredEnv = helpers.getDockerDriverGatewayEnv(null, "darwin");
           writeDockerDriverGatewayRuntimeMarkerForStateDir(stateDir, {
@@ -357,7 +360,9 @@ describe("docker-driver gateway runtime helpers", () => {
     const identityGatewayBin = "/opt/openshell/openshell-gateway";
     const replacementGatewayBin = "/opt/openshell/replaced/openshell-gateway";
     const desiredEnv = { OPENSHELL_DRIVERS: "docker" };
-    const { helpers } = makeHelpers();
+    const { helpers } = makeHelpers({
+      runCapture: vi.fn(() => "openshell-gateway[nemoclaw=nemoclaw-18080;port=18080]\n"),
+    });
     const originalExistsSync = fs.existsSync.bind(fs);
     const originalReadFileSync = fs.readFileSync.bind(fs);
     const originalReadlinkSync = fs.readlinkSync.bind(fs);
@@ -385,4 +390,34 @@ describe("docker-driver gateway runtime helpers", () => {
         ?.reason,
     ).toBe(`executable=${replacementGatewayBin} (expected ${identityGatewayBin})`);
   });
+
+  it("forces a legacy no-argument host gateway through replacement before reuse", () => {
+    const stateDir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-gateway-runtime-"));
+    const pid = 87_654;
+    const gatewayBin = path.join(stateDir, "openshell-gateway");
+    try {
+      withEnv({ NEMOCLAW_OPENSHELL_GATEWAY_STATE_DIR: stateDir }, () => {
+        const { helpers } = makeHelpers({
+          runCapture: vi.fn((args) =>
+            args.join(" ") === `ps -p ${pid} -o args=` ? `${gatewayBin}\n` : "",
+          ),
+        });
+        const desiredEnv = helpers.getDockerDriverGatewayEnv(null, "darwin");
+        writeDockerDriverGatewayRuntimeMarkerForStateDir(stateDir, {
+          pid,
+          desiredEnv,
+          endpoint: desiredEnv.OPENSHELL_GRPC_ENDPOINT,
+          gatewayBin,
+          platform: "darwin",
+          arch: process.arch,
+        });
+
+        expect(
+          helpers.getDockerDriverGatewayRuntimeDrift(pid, desiredEnv, gatewayBin, "darwin")?.reason,
+        ).toContain("lacks target-bound cleanup identity");
+      });
+    } finally {
+      fs.rmSync(stateDir, { recursive: true, force: true });
+    }
+  });
 });
diff --git a/src/lib/onboard/docker-driver-gateway-runtime.ts b/src/lib/onboard/docker-driver-gateway-runtime.ts
index 8daddc9eb6f..757b0a40fb9 100644
--- a/src/lib/onboard/docker-driver-gateway-runtime.ts
+++ b/src/lib/onboard/docker-driver-gateway-runtime.ts
@@ -290,6 +290,21 @@ export function createDockerDriverGatewayRuntimeHelpers(deps: DockerDriverGatewa
     });
   }
 
+  function processIdentityMatchesGatewayTarget(
+    identity: string,
+    gatewayBin?: string | null,
+  ): boolean {
+    const port = currentGatewayPort();
+    return gatewayProcessCmdlineMatches(identity, gatewayBin, {
+      expectedOpenShellGateway: {
+        name: gatewayBinding.resolveGatewayName(port),
+        port,
+      },
+      processNames: OPENSHELL_GATEWAY_PROCESS_NAMES,
+      resolveExecutablePath: normalizeGatewayExecutablePath,
+    });
+  }
+
   function shouldRequireDockerDriverEnv(platform: NodeJS.Platform = process.platform): boolean {
     return platform === "linux";
   }
@@ -337,6 +352,17 @@ export function createDockerDriverGatewayRuntimeHelpers(deps: DockerDriverGatewa
     gatewayBin?: string | null,
     platform: NodeJS.Platform = process.platform,
   ): DockerDriverGatewayRuntimeDrift | null {
+    // Released host gateways used the real binary with no argv target. They
+    // cannot be cleaned up safely by a later sandbox destroy, so a port-scoped
+    // cutover must retire them instead of adopting them as reusable.
+    if (!processIdentityMatchesGatewayTarget(readProcessIdentity(pid), gatewayBin)) {
+      const port = currentGatewayPort();
+      return {
+        reason:
+          "gateway process lacks target-bound cleanup identity for " +
+          `${gatewayBinding.resolveGatewayName(port)} on port ${port}`,
+      };
+    }
     if (platform === "darwin" && desiredEnv.OPENSHELL_DRIVERS === "docker") {
       const markerDrift =
         dockerDriverGatewayRuntimeMarker.getDockerDriverGatewayRuntimeMarkerDriftForStateDir(
@@ -377,23 +403,25 @@ export function createDockerDriverGatewayRuntimeHelpers(deps: DockerDriverGatewa
       .trim();
   }
 
-  function isDockerDriverGatewayProcess(
-    pid: number,
-    gatewayBin?: string | null,
-    opts: { requireDockerDriverEnv?: boolean } = {},
-  ): boolean {
+  function readProcessIdentity(pid: number): string {
     const procCmdlinePath = `/proc/${pid}/cmdline`;
-    let identity = "";
     try {
       if (fs.existsSync(procCmdlinePath)) {
-        identity = fs.readFileSync(procCmdlinePath, "utf-8").replace(/\0/g, " ").trim();
+        const identity = fs.readFileSync(procCmdlinePath, "utf-8").replace(/\0/g, " ").trim();
+        if (identity) return identity;
       }
     } catch {
-      identity = "";
-    }
-    if (!identity) {
-      identity = captureProcessArgs(pid);
+      // Fall through to ps on hosts without readable procfs.
     }
+    return captureProcessArgs(pid);
+  }
+
+  function isDockerDriverGatewayProcess(
+    pid: number,
+    gatewayBin?: string | null,
+    opts: { requireDockerDriverEnv?: boolean } = {},
+  ): boolean {
+    const identity = readProcessIdentity(pid);
     if (!identity) return false;
     const matchesGatewayBinary = processIdentityMatchesGatewayBinary(identity, gatewayBin);
     if (!matchesGatewayBinary) return false;
diff --git a/test/onboard-gateway-legacy-identity-upgrade-runtime.test.ts b/test/onboard-gateway-legacy-identity-upgrade-runtime.test.ts
new file mode 100644
index 00000000000..53e0611104e
--- /dev/null
+++ b/test/onboard-gateway-legacy-identity-upgrade-runtime.test.ts
@@ -0,0 +1,275 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { spawn, spawnSync } from "node:child_process";
+import fs from "node:fs";
+import net from "node:net";
+import os from "node:os";
+import path from "node:path";
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { waitUntil } from "../src/lib/core/wait";
+import {
+  type DockerDriverGatewayCutoverDeps,
+  type DockerDriverGatewayCutoverInput,
+  runDockerDriverGatewayCutover,
+} from "../src/lib/onboard/docker-driver-gateway-cutover";
+import { reapHostGatewayBeforeLaunchOrFail } from "../src/lib/onboard/docker-driver-gateway-prelaunch";
+import { createDockerDriverGatewayRuntimeHelpers } from "../src/lib/onboard/docker-driver-gateway-runtime";
+import { resolveGatewayName, resolveGatewayStateDirName } from "../src/lib/onboard/gateway-binding";
+import { buildOwnedHostGatewayArgv0 } from "../src/lib/onboard/gateway-process-identity";
+import { stopHostGatewayProcesses } from "../src/lib/onboard/host-gateway-process";
+
+const posix = process.platform !== "win32";
+const hasLsof = posix && !spawnSync("lsof", ["-v"], { stdio: "ignore" }).error;
+
+const livePids = new Set<number>();
+let tmpHome: string | null = null;
+let scriptSequence = 0;
+
+function killQuietly(pid: number): void {
+  try {
+    process.kill(pid, "SIGKILL");
+  } catch {
+    // Already stopped.
+  }
+}
+
+function isAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+afterEach(() => {
+  for (const pid of livePids) killQuietly(pid);
+  livePids.clear();
+  if (tmpHome) fs.rmSync(tmpHome, { recursive: true, force: true });
+  tmpHome = null;
+});
+
+function reserveFreePort(): Promise<number> {
+  return new Promise((resolve, reject) => {
+    const probe = net.createServer();
+    probe.once("error", reject);
+    probe.listen(0, "127.0.0.1", () => {
+      const address = probe.address();
+      const port = typeof address === "object" && address ? address.port : 0;
+      probe.close(() => resolve(port));
+    });
+  });
+}
+
+function canBind(port: number): Promise<boolean> {
+  return new Promise((resolve) => {
+    const server = net.createServer();
+    server.once("error", () => resolve(false));
+    server.listen(port, "127.0.0.1", () => server.close(() => resolve(true)));
+  });
+}
+
+function readPid(pidFile: string): number {
+  try {
+    return Number.parseInt(fs.readFileSync(pidFile, "utf-8").trim(), 10) || 0;
+  } catch {
+    return 0;
+  }
+}
+
+function launchOrphanGateway(options: {
+  argv0: string;
+  env: NodeJS.ProcessEnv;
+  pidFile: string;
+  port: number;
+}): number {
+  if (!tmpHome) throw new Error("temporary home is not initialized");
+  scriptSequence += 1;
+  const gatewayFile = path.join(tmpHome, `gateway-${scriptSequence}.cjs`);
+  fs.writeFileSync(
+    gatewayFile,
+    `const net=require("node:net");const fs=require("node:fs");` +
+      `const server=net.createServer();` +
+      `server.listen(${String(options.port)},"127.0.0.1",()=>fs.writeFileSync(${JSON.stringify(options.pidFile)},String(process.pid)));` +
+      `process.on("SIGTERM",()=>process.exit(0));`,
+  );
+  const launcherScript =
+    `const {spawn}=require("node:child_process");` +
+    `spawn(process.argv[1],[process.argv[2]],{argv0:process.argv[3],detached:true,stdio:"ignore",env:JSON.parse(process.argv[4])}).unref();`;
+  spawn(
+    process.execPath,
+    [
+      "-e",
+      launcherScript,
+      process.execPath,
+      gatewayFile,
+      options.argv0,
+      JSON.stringify(options.env),
+    ],
+    { stdio: "ignore" },
+  );
+
+  let pid = 0;
+  const started = waitUntil(
+    () => {
+      pid = readPid(options.pidFile);
+      return pid > 0 && isAlive(pid);
+    },
+    {
+      deadlineMs: Date.now() + 10_000,
+      initialIntervalMs: 25,
+      maxIntervalMs: 25,
+      backoffFactor: 1,
+    },
+  );
+  if (!started) throw new Error("gateway fixture did not start");
+  livePids.add(pid);
+  return pid;
+}
+
+function runCapture(args: string[]): string {
+  const result = spawnSync(args[0], args.slice(1), { encoding: "utf-8" });
+  return result.status === 0 ? result.stdout : "";
+}
+
+function runCaptureEx(args: readonly string[]): {
+  stdout: string;
+  exitCode: number | null;
+  timedOut: boolean;
+} {
+  const result = spawnSync(args[0], args.slice(1), { encoding: "utf-8", timeout: 5000 });
+  return {
+    stdout: result.stdout ?? "",
+    exitCode: result.status,
+    timedOut: Boolean(result.error && "code" in result.error && result.error.code === "ETIMEDOUT"),
+  };
+}
+
+describe("legacy Docker-driver gateway identity upgrade", () => {
+  it.skipIf(!posix || !hasLsof)(
+    "retires a reused legacy process, launches target-bound identity, and releases its port",
+    async () => {
+      const port = await reserveFreePort();
+      const gatewayName = resolveGatewayName(port);
+      tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-gateway-upgrade-"));
+      const stateDir = path.join(
+        tmpHome,
+        ".local",
+        "state",
+        "nemoclaw",
+        resolveGatewayStateDirName(port),
+      );
+      fs.mkdirSync(stateDir, { recursive: true });
+      const pidFile = path.join(stateDir, "openshell-gateway.pid");
+      const gatewayBin = path.join(tmpHome, "openshell-gateway");
+      const driftEnv = { OPENSHELL_DRIVERS: "docker" };
+      const childEnv = { ...process.env, ...driftEnv };
+
+      const legacyPid = launchOrphanGateway({
+        argv0: gatewayBin,
+        env: childEnv,
+        pidFile,
+        port,
+      });
+      await expect(canBind(port)).resolves.toBe(false);
+
+      const runtime = createDockerDriverGatewayRuntimeHelpers({
+        gatewayPort: port,
+        getCachedOpenshellBinary: () => null,
+        getBlueprintMaxOpenshellVersion: () => null,
+        getInstalledOpenshellVersion: () => "0.0.72",
+        isOpenshellDevVersion: () => false,
+        runCapture,
+        runCaptureEx,
+        shouldUseOpenshellDevChannel: () => false,
+        supportedOpenshellFallbackVersion: "0.0.72",
+      });
+      const listenerScan = runtime.getDockerDriverGatewayPortListenerScan(
+        { ok: false, process: "openshell-gateway", pid: legacyPid },
+        { gatewayBin, platform: process.platform },
+      );
+      expect(listenerScan).toEqual({ complete: true, pids: [legacyPid] });
+
+      const restartReasons: string[] = [];
+      const verifyBridge = vi.fn(async () => undefined);
+      const input: DockerDriverGatewayCutoverInput = {
+        gatewayBin,
+        identityGatewayBin: gatewayBin,
+        driftGatewayBin: gatewayBin,
+        driftGatewayEnv: driftEnv,
+        exitOnFailure: false,
+        skipSandboxBridgeReachability: false,
+        stateDir,
+        portListenerScan: listenerScan,
+        pidFileGatewayPid: legacyPid,
+        initialHealth: {
+          status: "Gateway: active",
+          namedInfo: `Gateway: ${gatewayName}`,
+          activeInfo: `Gateway: ${gatewayName}`,
+        },
+      };
+      const deps: DockerDriverGatewayCutoverDeps = {
+        isDockerDriverGatewayProcessAlive: () => isAlive(legacyPid),
+        isGatewayHealthy: () => true,
+        getDockerDriverGatewayRuntimeDrift: (pid, env, binary) =>
+          runtime.getDockerDriverGatewayRuntimeDrift(pid, env, binary, process.platform),
+        logDockerDriverGatewayRestart: (reason) => restartReasons.push(reason),
+        registerDockerDriverGatewayEndpoint: () => true,
+        isDockerDriverGatewayHttpReady: async () => true,
+        verifySandboxBridgeGatewayReachableOrExit: verifyBridge,
+        readGatewayHealth: () => input.initialHealth,
+        rememberDockerDriverGatewayPid: runtime.rememberDockerDriverGatewayPid,
+        reapDuplicateHostGatewaysExceptOrFail: () => undefined,
+        reapHostGatewayBeforeLaunchOrFail: (options) => reapHostGatewayBeforeLaunchOrFail(options),
+        isGatewayPortAvailable: () => canBind(port),
+        reportUntrustedGatewayPort: (message) => {
+          throw new Error(message);
+        },
+        reportMissingGatewayBinary: () => {
+          throw new Error("gateway binary missing");
+        },
+        log: () => undefined,
+      };
+
+      await expect(runDockerDriverGatewayCutover(input, deps)).resolves.toBe("launch");
+      livePids.delete(legacyPid);
+      expect(restartReasons).toContainEqual(
+        expect.stringContaining("target-bound cleanup identity"),
+      );
+      expect(verifyBridge).not.toHaveBeenCalled();
+      expect(isAlive(legacyPid)).toBe(false);
+      await expect(canBind(port)).resolves.toBe(true);
+
+      const argv0 = buildOwnedHostGatewayArgv0(gatewayName);
+      expect(argv0).not.toBeNull();
+      const freshPid = launchOrphanGateway({
+        argv0: argv0 as string,
+        env: childEnv,
+        pidFile,
+        port,
+      });
+      const stopped = stopHostGatewayProcesses(
+        { env: { ...process.env, HOME: tmpHome } },
+        {
+          gatewayBin,
+          openShellGatewayName: gatewayName,
+          openShellGatewayPort: port,
+          pidFile,
+          stateDir,
+          usePgrepFallback: false,
+        },
+      );
+      livePids.delete(freshPid);
+
+      expect(stopped.stopped).toContain(freshPid);
+      expect(stopped.skippedNonMatchingPids).toEqual([]);
+      expect(isAlive(freshPid)).toBe(false);
+      expect(fs.existsSync(pidFile)).toBe(false);
+      await expect(canBind(port)).resolves.toBe(true);
+    },
+    30000,
+  );
+});

From afdcd1343fe211ba36005502406ca2f0f08af51e Mon Sep 17 00:00:00 2001
From: Prekshi Vyas <prekshiv@nvidia.com>
Date: Fri, 10 Jul 2026 15:43:20 -0700
Subject: [PATCH 30/45] test(destroy): lock fail-closed cleanup paths

---
 .github/workflows/macos-e2e.yaml              |  5 ++++
 src/lib/actions/sandbox/destroy-flow.test.ts  | 25 +++++++----------
 .../sandbox/destroy-gateway-cleanup.test.ts   | 27 +++++++++++++++++++
 .../sandbox/destroy-gateway-cleanup.ts        |  9 ++++---
 src/lib/domain/sandbox/destroy.test.ts        | 15 +++++++++++
 src/lib/domain/sandbox/destroy.ts             |  2 ++
 6 files changed, 64 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/macos-e2e.yaml b/.github/workflows/macos-e2e.yaml
index 91d79b03b46..1d84b7dbb3d 100644
--- a/.github/workflows/macos-e2e.yaml
+++ b/.github/workflows/macos-e2e.yaml
@@ -75,6 +75,7 @@ jobs:
           npx vitest run --project integration
           test/tunnel-gateway-port-release-runtime.test.ts
           test/onboard-gateway-prelaunch-cutover.test.ts
+          test/onboard-gateway-legacy-identity-upgrade-runtime.test.ts
 
       - name: Prepare Docker availability
         id: docker
@@ -101,6 +102,10 @@ jobs:
             exit 0
           fi
 
+          # Do not install floating Homebrew packages before credentialed steps.
+          # The hosted runner image is the Colima dependency boundary; record
+          # its exact preinstalled version in every trusted run that uses it.
+          colima version
           echo "Docker is unavailable; starting preinstalled Colima for trusted macOS live E2E."
           if ! colima start --cpu 4 --memory 8 --disk 80 --vm-type vz --mount-type virtiofs; then
             echo "::warning::Colima could not start Docker on this macOS runner; skipping live E2E."
diff --git a/src/lib/actions/sandbox/destroy-flow.test.ts b/src/lib/actions/sandbox/destroy-flow.test.ts
index 349737a58b8..4865ea810d6 100644
--- a/src/lib/actions/sandbox/destroy-flow.test.ts
+++ b/src/lib/actions/sandbox/destroy-flow.test.ts
@@ -55,29 +55,22 @@ describe("destroySandbox flow", () => {
     expectSuccessfulLiveDestroy(harness, exitSpy);
   });
 
-  it("cleans the final gateway for unattended macOS destroys (#4662)", async () => {
+  it.each([
+    ["--yes", { yes: true }, undefined, true],
+    ["NEMOCLAW_NON_INTERACTIVE=1", {}, "1", true],
+    ["an explicit preservation override", { yes: true, cleanupGateway: false }, undefined, false],
+  ] as const)("applies the macOS final-gateway default for %s (#4662)", async (_scenario, options, nonInteractive, cleanupExpected) => {
     vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
+    vi.stubEnv("NEMOCLAW_NON_INTERACTIVE", nonInteractive ?? "");
     const harness = createDestroyHarness();
 
-    await expect(harness.destroySandbox("alpha", { yes: true })).resolves.toBeUndefined();
+    await expect(harness.destroySandbox("alpha", options)).resolves.toBeUndefined();
 
-    expect(harness.cleanupGatewaySpy).toHaveBeenCalledWith(
-      "nemoclaw-19080",
-      harness.runOpenshellSpy,
+    expect(harness.cleanupGatewaySpy.mock.calls).toEqual(
+      cleanupExpected ? [["nemoclaw-19080", harness.runOpenshellSpy]] : [],
     );
   });
 
-  it("honors an explicit gateway-preservation override on macOS (#4662)", async () => {
-    vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
-    const harness = createDestroyHarness();
-
-    await expect(
-      harness.destroySandbox("alpha", { yes: true, cleanupGateway: false }),
-    ).resolves.toBeUndefined();
-
-    expect(harness.cleanupGatewaySpy).not.toHaveBeenCalled();
-  });
-
   it("stops before local cleanup when OpenShell fails to delete the live sandbox", async () => {
     const harness = createDestroyHarness({
       deleteStatus: 7,
diff --git a/src/lib/actions/sandbox/destroy-gateway-cleanup.test.ts b/src/lib/actions/sandbox/destroy-gateway-cleanup.test.ts
index 1d86fe259ad..33d38603b87 100644
--- a/src/lib/actions/sandbox/destroy-gateway-cleanup.test.ts
+++ b/src/lib/actions/sandbox/destroy-gateway-cleanup.test.ts
@@ -56,6 +56,29 @@ describe("shouldCleanupGatewayAfterConfirmedFinalDestroy", () => {
     ).toBe(false);
   });
 
+  it("rechecks live state after observing an empty registry", () => {
+    const events: string[] = [];
+    expect(
+      shouldCleanupGatewayAfterConfirmedFinalDestroy(
+        {
+          deleteSucceededOrAlreadyGone: true,
+          removedRegistryEntry: true,
+        },
+        {
+          listSandboxes: () => {
+            events.push("registry-empty");
+            return { sandboxes: [] };
+          },
+          liveSandboxProbe: () => {
+            events.push("live-sandbox-observed");
+            return false;
+          },
+        },
+      ),
+    ).toBe(false);
+    expect(events).toEqual(["registry-empty", "live-sandbox-observed"]);
+  });
+
   it("collects OpenShell and Docker live-sandbox snapshots in the action layer", () => {
     const captureOpenshell = vi.fn(() => ({
       status: 0,
@@ -84,6 +107,7 @@ describe("shouldCleanupGatewayAfterConfirmedFinalDestroy", () => {
   });
 
   it("records failed Docker probes as fail-closed snapshots", () => {
+    const debug = vi.spyOn(console, "debug").mockImplementation(() => undefined);
     const snapshot = collectLiveSandboxProbeSnapshot({
       captureOpenshell: () => ({
         status: 0,
@@ -101,5 +125,8 @@ describe("shouldCleanupGatewayAfterConfirmedFinalDestroy", () => {
       output: "",
       probeFailed: true,
     });
+    expect(debug).toHaveBeenCalledWith(
+      "Docker container probe failed for sandbox 'npmtest'; preserving shared gateway.",
+    );
   });
 });
diff --git a/src/lib/actions/sandbox/destroy-gateway-cleanup.ts b/src/lib/actions/sandbox/destroy-gateway-cleanup.ts
index b4b0c20b10f..b0154f1d207 100644
--- a/src/lib/actions/sandbox/destroy-gateway-cleanup.ts
+++ b/src/lib/actions/sandbox/destroy-gateway-cleanup.ts
@@ -84,9 +84,12 @@ export function collectLiveSandboxProbeSnapshot(
         ),
       });
     } catch {
-      // Fail closed for the #4662 invalid-state boundary. If Docker cannot
-      // confirm the terminal OpenShell row has no backing container, keep the
-      // shared gateway so a live sandbox does not lose its listener.
+      // Fail closed for the #4662 invalid-state boundary and the lifecycle
+      // invariant documented in destroy-gateway.ts (#6639). If Docker cannot
+      // confirm the row has no backing container, preserve the shared gateway.
+      console.debug(
+        `Docker container probe failed for sandbox '${sandboxName}'; preserving shared gateway.`,
+      );
       dockerContainersBySandboxName.set(sandboxName, { output: "", probeFailed: true });
     }
   }
diff --git a/src/lib/domain/sandbox/destroy.test.ts b/src/lib/domain/sandbox/destroy.test.ts
index 98c8b3f01d3..da887b51d91 100644
--- a/src/lib/domain/sandbox/destroy.test.ts
+++ b/src/lib/domain/sandbox/destroy.test.ts
@@ -120,6 +120,12 @@ describe("sandbox destroy helpers", () => {
         { nonInteractive: false, platform: "linux" },
       ),
     ).toBe("preserve");
+    expect(
+      resolveDestroyGatewayCleanupDecision({}, { nonInteractive: true, platform: "darwin" }),
+    ).toBe("cleanup");
+    expect(
+      resolveDestroyGatewayCleanupDecision({}, { nonInteractive: true, platform: "linux" }),
+    ).toBe("preserve");
     expect(
       resolveDestroyGatewayCleanupDecision({}, { nonInteractive: true, platform: "win32" }),
     ).toBe("preserve");
@@ -174,6 +180,15 @@ describe("sandbox destroy helpers", () => {
     ).toBe(false);
   });
 
+  it("fails closed when OpenShell cannot report live sandbox state (#4662)", () => {
+    expect(
+      hasNoLiveSandboxes({
+        liveList: { status: 1, output: "" },
+        dockerContainersBySandboxName: new Map(),
+      }),
+    ).toBe(false);
+  });
+
   it("matches Docker sandbox containers with a literal name prefix (#4662)", () => {
     expect(dockerSandboxContainerNamePrefix("npmtest")).toBe("openshell-npmtest-");
     expect(
diff --git a/src/lib/domain/sandbox/destroy.ts b/src/lib/domain/sandbox/destroy.ts
index 12354b94585..4f02020c7ef 100644
--- a/src/lib/domain/sandbox/destroy.ts
+++ b/src/lib/domain/sandbox/destroy.ts
@@ -181,6 +181,8 @@ export function hasNoLiveSandboxes({
   liveList,
   dockerContainersBySandboxName,
 }: LiveSandboxProbeSnapshot): boolean {
+  // Fail closed: if OpenShell cannot report authoritative sandbox state,
+  // preserve the shared gateway so a sandbox never loses its listener.
   if (liveList.status !== 0) {
     return false;
   }

From c38fff0693411a855189b0756677f39d4818817c Mon Sep 17 00:00:00 2001
From: Prekshi Vyas <prekshiv@nvidia.com>
Date: Fri, 10 Jul 2026 15:56:20 -0700
Subject: [PATCH 31/45] test(gateway): keep runtime regressions linear

---
 .../docker-driver-gateway-runtime.test.ts     | 22 +++++++++----------
 ...ay-legacy-identity-upgrade-runtime.test.ts |  7 +++---
 2 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/src/lib/onboard/docker-driver-gateway-runtime.test.ts b/src/lib/onboard/docker-driver-gateway-runtime.test.ts
index e7297215012..9a45855f617 100644
--- a/src/lib/onboard/docker-driver-gateway-runtime.test.ts
+++ b/src/lib/onboard/docker-driver-gateway-runtime.test.ts
@@ -199,18 +199,18 @@ describe("docker-driver gateway runtime helpers", () => {
           NEMOCLAW_OPENSHELL_GATEWAY_STATE_DIR: stateDir,
         },
         () => {
+          const processOutput = new Map([
+            [`ps -p ${pid} -o args=`, "openshell-gateway[nemoclaw=nemoclaw-18080;port=18080]\n"],
+            [
+              "ps -axo pid=,ppid=,command=",
+              [
+                `${pid} 1 ${gatewayBin}`,
+                `${pid + 1} ${pid} /usr/local/bin/openshell-driver-vm --bind-socket /tmp/vm.sock`,
+              ].join("\n"),
+            ],
+          ]);
           const { helpers, runCapture } = makeHelpers({
-            runCapture: vi.fn((args) => {
-              if (args.join(" ") === `ps -p ${pid} -o args=`) {
-                return "openshell-gateway[nemoclaw=nemoclaw-18080;port=18080]\n";
-              }
-              return args.join(" ") === "ps -axo pid=,ppid=,command="
-                ? [
-                    `${pid} 1 ${gatewayBin}`,
-                    `${pid + 1} ${pid} /usr/local/bin/openshell-driver-vm --bind-socket /tmp/vm.sock`,
-                  ].join("\n")
-                : "";
-            }),
+            runCapture: vi.fn((args) => processOutput.get(args.join(" ")) ?? ""),
           });
           const desiredEnv = helpers.getDockerDriverGatewayEnv(null, "darwin");
           writeDockerDriverGatewayRuntimeMarkerForStateDir(stateDir, {
diff --git a/test/onboard-gateway-legacy-identity-upgrade-runtime.test.ts b/test/onboard-gateway-legacy-identity-upgrade-runtime.test.ts
index 53e0611104e..2d9486f77bb 100644
--- a/test/onboard-gateway-legacy-identity-upgrade-runtime.test.ts
+++ b/test/onboard-gateway-legacy-identity-upgrade-runtime.test.ts
@@ -1,6 +1,7 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
+import assert from "node:assert/strict";
 import { spawn, spawnSync } from "node:child_process";
 import fs from "node:fs";
 import net from "node:net";
@@ -48,7 +49,7 @@ function isAlive(pid: number): boolean {
 afterEach(() => {
   for (const pid of livePids) killQuietly(pid);
   livePids.clear();
-  if (tmpHome) fs.rmSync(tmpHome, { recursive: true, force: true });
+  tmpHome && fs.rmSync(tmpHome, { recursive: true, force: true });
   tmpHome = null;
 });
 
@@ -86,7 +87,7 @@ function launchOrphanGateway(options: {
   pidFile: string;
   port: number;
 }): number {
-  if (!tmpHome) throw new Error("temporary home is not initialized");
+  assert.ok(tmpHome, "temporary home is not initialized");
   scriptSequence += 1;
   const gatewayFile = path.join(tmpHome, `gateway-${scriptSequence}.cjs`);
   fs.writeFileSync(
@@ -125,7 +126,7 @@ function launchOrphanGateway(options: {
       backoffFactor: 1,
     },
   );
-  if (!started) throw new Error("gateway fixture did not start");
+  assert.ok(started, "gateway fixture did not start");
   livePids.add(pid);
   return pid;
 }

From 1958a26dc88196ed7aef6f4d4301ee7a9aa1c388 Mon Sep 17 00:00:00 2001
From: Prekshi Vyas <prekshiv@nvidia.com>
Date: Fri, 10 Jul 2026 16:05:57 -0700
Subject: [PATCH 32/45] refactor(gateway): isolate upgrade identity checks

---
 .github/workflows/macos-e2e.yaml              | 111 ++++++++++--------
 src/lib/actions/sandbox/destroy-flow.test.ts  |  15 ++-
 .../sandbox/destroy-gateway-cleanup.test.ts   |   5 +-
 .../sandbox/destroy-gateway-cleanup.ts        |   8 +-
 src/lib/actions/sandbox/destroy-gateway.ts    |   4 +-
 ...er-driver-gateway-process-identity.test.ts |  32 +++++
 .../docker-driver-gateway-process-identity.ts |  50 ++++++++
 .../docker-driver-gateway-runtime.test.ts     |  30 -----
 .../onboard/docker-driver-gateway-runtime.ts  |  52 ++------
 .../host-gateway-process-target.test.ts       |  11 ++
 test/macos-e2e-workflow-boundary.test.ts      |  58 +++++----
 11 files changed, 212 insertions(+), 164 deletions(-)
 create mode 100644 src/lib/onboard/docker-driver-gateway-process-identity.test.ts
 create mode 100644 src/lib/onboard/docker-driver-gateway-process-identity.ts

diff --git a/.github/workflows/macos-e2e.yaml b/.github/workflows/macos-e2e.yaml
index 1d84b7dbb3d..092c85cb26c 100644
--- a/.github/workflows/macos-e2e.yaml
+++ b/.github/workflows/macos-e2e.yaml
@@ -77,10 +77,8 @@ jobs:
           test/onboard-gateway-prelaunch-cutover.test.ts
           test/onboard-gateway-legacy-identity-upgrade-runtime.test.ts
 
-      - name: Prepare Docker availability
+      - name: Detect Docker availability
         id: docker
-        env:
-          TRUSTED_MACOS_LIVE: ${{ github.event_name != 'pull_request' && '1' || '0' }}
         run: |
           set -euo pipefail
           if docker info >/dev/null 2>&1; then
@@ -89,37 +87,8 @@ jobs:
             docker version
             exit 0
           fi
-
-          if [ "$TRUSTED_MACOS_LIVE" != "1" ]; then
-            echo "docker_ok=false" >> "$GITHUB_OUTPUT"
-            echo "Docker is unavailable; pull_request macOS runs skip secret-bearing live E2E."
-            exit 0
-          fi
-
-          if ! command -v docker >/dev/null 2>&1 || ! command -v colima >/dev/null 2>&1; then
-            echo "::warning::Docker/Colima is not preinstalled on this macOS runner; skipping live E2E instead of bootstrapping floating Homebrew packages before credentialed steps."
-            echo "docker_ok=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          # Do not install floating Homebrew packages before credentialed steps.
-          # The hosted runner image is the Colima dependency boundary; record
-          # its exact preinstalled version in every trusted run that uses it.
-          colima version
-          echo "Docker is unavailable; starting preinstalled Colima for trusted macOS live E2E."
-          if ! colima start --cpu 4 --memory 8 --disk 80 --vm-type vz --mount-type virtiofs; then
-            echo "::warning::Colima could not start Docker on this macOS runner; skipping live E2E."
-            echo "docker_ok=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          if ! docker info; then
-            echo "::warning::Docker remained unavailable after Colima startup; skipping live E2E."
-            echo "docker_ok=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          echo "docker_ok=true" >> "$GITHUB_OUTPUT"
-          docker version
+          echo "docker_ok=false" >> "$GITHUB_OUTPUT"
+          echo "Docker is unavailable on the Apple Silicon runner."
 
       - name: Run macOS full E2E
         if: steps.docker.outputs.docker_ok == 'true' && github.event_name != 'pull_request'
@@ -133,12 +102,64 @@ jobs:
         run: |
           NEMOCLAW_RUN_LIVE_E2E=1 npx vitest run --project e2e-live test/e2e/live/full-e2e.test.ts --silent=false --reporter=default
 
-      - name: Install OpenShell CLI for macOS sandbox operations
-        if: steps.docker.outputs.docker_ok == 'true' && github.event_name != 'pull_request'
+      - name: Explain skipped macOS live E2E
+        if: steps.docker.outputs.docker_ok != 'true' || github.event_name == 'pull_request'
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            echo 'Skipping secret-bearing macOS live E2E on pull_request; use trusted workflow_dispatch/push evidence for live validation.'
+          elif [ "${{ steps.docker.outputs.docker_ok }}" != "true" ]; then
+            echo 'Skipping macOS live E2E because Docker is unavailable on this runner.'
+          fi
+          echo 'The workflow still validated the NemoClaw build on macOS (Apple Silicon).'
+
+      - name: Upload logs on failure
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: macos-e2e-logs
+          path: |
+            /tmp/nemoclaw-e2e-*.log
+            ${{ github.workspace }}/e2e-artifacts/live
+          if-no-files-found: ignore
+
+  macos-docker-final-destroy:
+    if: github.event_name != 'pull_request'
+    runs-on: macos-15-intel
+    timeout-minutes: 150
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Setup Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: "22"
+          cache: npm
+
+      - name: Set up pinned Docker Engine
+        uses: docker/setup-docker-action@6d7cfa65f60a9dda7b46e5513fa982536f3c9877 # v5.3.0
+        with:
+          version: v27.4.0
+        env:
+          LIMA_START_ARGS: --cpus 4 --memory 8
+
+      - name: Install root dependencies
+        run: npm ci --ignore-scripts
+
+      - name: Build CLI TypeScript modules
+        run: npm run build:cli
+
+      - name: Install and build plugin
+        run: |
+          set -euo pipefail
+          cd nemoclaw
+          npm ci --ignore-scripts
+          npm run build
+
+      - name: Install OpenShell CLI
         run: bash scripts/install-openshell.sh
 
-      - name: Run macOS final-destroy gateway cleanup E2E
-        if: steps.docker.outputs.docker_ok == 'true' && github.event_name != 'pull_request'
+      - name: Run macOS Docker final-destroy E2E
         env:
           E2E_TARGET_ID: "sandbox-operations"
           E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/live/macos-sandbox-operations
@@ -148,7 +169,7 @@ jobs:
           NEMOCLAW_NON_INTERACTIVE: "1"
           NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
           NEMOCLAW_POLICY_TIER: "open"
-          NVIDIA_INFERENCE_API_KEY: ${{ github.event_name != 'pull_request' && secrets.NVIDIA_INFERENCE_API_KEY || '' }}
+          NVIDIA_INFERENCE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}
           OPENSHELL_GATEWAY: "nemoclaw"
         run: |
           set -euo pipefail
@@ -157,21 +178,11 @@ jobs:
             test/e2e/live/sandbox-operations.test.ts \
             --silent=false --reporter=default
 
-      - name: Explain skipped macOS live E2E
-        if: steps.docker.outputs.docker_ok != 'true' || github.event_name == 'pull_request'
-        run: |
-          if [ "${{ github.event_name }}" = "pull_request" ]; then
-            echo 'Skipping secret-bearing macOS live E2E on pull_request; use trusted workflow_dispatch/push evidence for live validation.'
-          elif [ "${{ steps.docker.outputs.docker_ok }}" != "true" ]; then
-            echo 'Skipping macOS live E2E because Docker is unavailable on this runner.'
-          fi
-          echo 'The workflow still validated the NemoClaw build on macOS (Apple Silicon).'
-
       - name: Upload logs on failure
         if: failure()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: macos-e2e-logs
+          name: macos-docker-final-destroy-logs
           path: |
             /tmp/nemoclaw-e2e-*.log
             ${{ github.workspace }}/e2e-artifacts/live
diff --git a/src/lib/actions/sandbox/destroy-flow.test.ts b/src/lib/actions/sandbox/destroy-flow.test.ts
index 4865ea810d6..4518aa96ad6 100644
--- a/src/lib/actions/sandbox/destroy-flow.test.ts
+++ b/src/lib/actions/sandbox/destroy-flow.test.ts
@@ -56,12 +56,17 @@ describe("destroySandbox flow", () => {
   });
 
   it.each([
-    ["--yes", { yes: true }, undefined, true],
-    ["NEMOCLAW_NON_INTERACTIVE=1", {}, "1", true],
-    ["an explicit preservation override", { yes: true, cleanupGateway: false }, undefined, false],
-  ] as const)("applies the macOS final-gateway default for %s (#4662)", async (_scenario, options, nonInteractive, cleanupExpected) => {
+    ["--yes", { yes: true }, () => vi.stubEnv("NEMOCLAW_NON_INTERACTIVE", ""), true],
+    ["NEMOCLAW_NON_INTERACTIVE=1", {}, () => vi.stubEnv("NEMOCLAW_NON_INTERACTIVE", "1"), true],
+    [
+      "an explicit preservation override",
+      { yes: true, cleanupGateway: false },
+      () => vi.stubEnv("NEMOCLAW_NON_INTERACTIVE", ""),
+      false,
+    ],
+  ] as const)("applies the macOS final-gateway default for %s (#4662)", async (_scenario, options, configureEnvironment, cleanupExpected) => {
     vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
-    vi.stubEnv("NEMOCLAW_NON_INTERACTIVE", nonInteractive ?? "");
+    configureEnvironment();
     const harness = createDestroyHarness();
 
     await expect(harness.destroySandbox("alpha", options)).resolves.toBeUndefined();
diff --git a/src/lib/actions/sandbox/destroy-gateway-cleanup.test.ts b/src/lib/actions/sandbox/destroy-gateway-cleanup.test.ts
index 33d38603b87..6b7096117be 100644
--- a/src/lib/actions/sandbox/destroy-gateway-cleanup.test.ts
+++ b/src/lib/actions/sandbox/destroy-gateway-cleanup.test.ts
@@ -56,7 +56,7 @@ describe("shouldCleanupGatewayAfterConfirmedFinalDestroy", () => {
     ).toBe(false);
   });
 
-  it("rechecks live state after observing an empty registry", () => {
+  it("preserves the gateway when a live sandbox appears after the empty-registry check", () => {
     const events: string[] = [];
     expect(
       shouldCleanupGatewayAfterConfirmedFinalDestroy(
@@ -71,6 +71,7 @@ describe("shouldCleanupGatewayAfterConfirmedFinalDestroy", () => {
           },
           liveSandboxProbe: () => {
             events.push("live-sandbox-observed");
+            // False means the host probe observed a sandbox during the TOCTOU window.
             return false;
           },
         },
@@ -126,7 +127,7 @@ describe("shouldCleanupGatewayAfterConfirmedFinalDestroy", () => {
       probeFailed: true,
     });
     expect(debug).toHaveBeenCalledWith(
-      "Docker container probe failed for sandbox 'npmtest'; preserving shared gateway.",
+      "Docker container probe failed for sandbox 'npmtest'; preserving shared gateway: Error: docker unavailable",
     );
   });
 });
diff --git a/src/lib/actions/sandbox/destroy-gateway-cleanup.ts b/src/lib/actions/sandbox/destroy-gateway-cleanup.ts
index b0154f1d207..8a17a0a34c2 100644
--- a/src/lib/actions/sandbox/destroy-gateway-cleanup.ts
+++ b/src/lib/actions/sandbox/destroy-gateway-cleanup.ts
@@ -83,12 +83,12 @@ export function collectLiveSandboxProbeSnapshot(
           },
         ),
       });
-    } catch {
-      // Fail closed for the #4662 invalid-state boundary and the lifecycle
-      // invariant documented in destroy-gateway.ts (#6639). If Docker cannot
+    } catch (error) {
+      // SOURCE_OF_TRUTH: preserve unrelated sandboxes and owned resources only;
+      // see the #6639 removal boundary in destroy-gateway.ts. If Docker cannot
       // confirm the row has no backing container, preserve the shared gateway.
       console.debug(
-        `Docker container probe failed for sandbox '${sandboxName}'; preserving shared gateway.`,
+        `Docker container probe failed for sandbox '${sandboxName}'; preserving shared gateway: ${String(error)}`,
       );
       dockerContainersBySandboxName.set(sandboxName, { output: "", probeFailed: true });
     }
diff --git a/src/lib/actions/sandbox/destroy-gateway.ts b/src/lib/actions/sandbox/destroy-gateway.ts
index 0381d8788f2..dbfe1e80773 100644
--- a/src/lib/actions/sandbox/destroy-gateway.ts
+++ b/src/lib/actions/sandbox/destroy-gateway.ts
@@ -121,8 +121,8 @@ export function cleanupGatewayAfterLastSandbox(
    * an existing installation is being recovered or removed.
    * Source-fix constraint: NemoClaw cannot add the modern verb to historical
    * OpenShell builds, so cleanup tries their legacy verb best-effort.
-   * Regression proof: destroy-gateway-cleanup.test.ts covers successful remove
-   * and remove-nonzero fallback while preserving Docker-volume cleanup.
+   * Regression proof: test/cli/destroy-gateway-cleanup.test.ts covers successful
+   * remove and remove-nonzero fallback while preserving Docker-volume cleanup.
    * Removal condition: remove the fallback when every supported recovery and
    * teardown entry point upgrades OpenShell to the blueprint minimum (currently
    * 0.0.72) before this function can run.
diff --git a/src/lib/onboard/docker-driver-gateway-process-identity.test.ts b/src/lib/onboard/docker-driver-gateway-process-identity.test.ts
new file mode 100644
index 00000000000..1a4cf6418fb
--- /dev/null
+++ b/src/lib/onboard/docker-driver-gateway-process-identity.test.ts
@@ -0,0 +1,32 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { describe, expect, it } from "vitest";
+
+import { getDockerDriverGatewayTargetIdentityDrift } from "./docker-driver-gateway-process-identity";
+
+const normalizeGatewayExecutablePath = (value: string | null | undefined) => value ?? null;
+
+describe("Docker-driver gateway target identity", () => {
+  it("requires replacement of a legacy untagged gateway before reuse", () => {
+    expect(
+      getDockerDriverGatewayTargetIdentityDrift({
+        gatewayBin: "/opt/openshell/openshell-gateway",
+        gatewayPort: 8081,
+        identity: "/opt/openshell/openshell-gateway",
+        normalizeGatewayExecutablePath,
+      })?.reason,
+    ).toContain("lacks target-bound cleanup identity for nemoclaw-8081 on port 8081");
+  });
+
+  it("accepts the owned target-bound gateway launched after cutover", () => {
+    expect(
+      getDockerDriverGatewayTargetIdentityDrift({
+        gatewayBin: "/opt/openshell/openshell-gateway",
+        gatewayPort: 8081,
+        identity: "openshell-gateway[nemoclaw=nemoclaw-8081;port=8081]",
+        normalizeGatewayExecutablePath,
+      }),
+    ).toBeNull();
+  });
+});
diff --git a/src/lib/onboard/docker-driver-gateway-process-identity.ts b/src/lib/onboard/docker-driver-gateway-process-identity.ts
new file mode 100644
index 00000000000..ca8ce3e2dc2
--- /dev/null
+++ b/src/lib/onboard/docker-driver-gateway-process-identity.ts
@@ -0,0 +1,50 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import fs from "node:fs";
+
+import { resolveGatewayName } from "./gateway-binding";
+import {
+  gatewayProcessCmdlineMatches,
+  OPENSHELL_GATEWAY_PROCESS_NAMES,
+} from "./gateway-process-identity";
+
+type NormalizeGatewayExecutablePath = (value: string | null | undefined) => string | null;
+
+export function readDockerDriverGatewayProcessIdentity(
+  pid: number,
+  captureProcessArgs: (pid: number) => string,
+): string {
+  const procCmdlinePath = `/proc/${pid}/cmdline`;
+  try {
+    if (fs.existsSync(procCmdlinePath)) {
+      const identity = fs.readFileSync(procCmdlinePath, "utf-8").replace(/\0/g, " ").trim();
+      if (identity) return identity;
+    }
+  } catch {
+    // Fall through to ps on hosts without readable procfs.
+  }
+  return captureProcessArgs(pid);
+}
+
+export function getDockerDriverGatewayTargetIdentityDrift(input: {
+  gatewayBin?: string | null;
+  gatewayPort: number;
+  identity: string;
+  normalizeGatewayExecutablePath: NormalizeGatewayExecutablePath;
+}): { reason: string } | null {
+  const gatewayName = resolveGatewayName(input.gatewayPort);
+  const matchesTarget = gatewayProcessCmdlineMatches(input.identity, input.gatewayBin, {
+    expectedOpenShellGateway: { name: gatewayName, port: input.gatewayPort },
+    processNames: OPENSHELL_GATEWAY_PROCESS_NAMES,
+    resolveExecutablePath: input.normalizeGatewayExecutablePath,
+  });
+  if (matchesTarget) return null;
+
+  // Legacy untagged launches cannot prove which gateway they own. Onboarding
+  // treats this drift as a mandatory cutover before reuse; targeted destroy
+  // remains fail-closed instead of guessing from a stale PID file.
+  return {
+    reason: `gateway process lacks target-bound cleanup identity for ${gatewayName} on port ${input.gatewayPort}`,
+  };
+}
diff --git a/src/lib/onboard/docker-driver-gateway-runtime.test.ts b/src/lib/onboard/docker-driver-gateway-runtime.test.ts
index 9a45855f617..f5ae8357322 100644
--- a/src/lib/onboard/docker-driver-gateway-runtime.test.ts
+++ b/src/lib/onboard/docker-driver-gateway-runtime.test.ts
@@ -390,34 +390,4 @@ describe("docker-driver gateway runtime helpers", () => {
         ?.reason,
     ).toBe(`executable=${replacementGatewayBin} (expected ${identityGatewayBin})`);
   });
-
-  it("forces a legacy no-argument host gateway through replacement before reuse", () => {
-    const stateDir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-gateway-runtime-"));
-    const pid = 87_654;
-    const gatewayBin = path.join(stateDir, "openshell-gateway");
-    try {
-      withEnv({ NEMOCLAW_OPENSHELL_GATEWAY_STATE_DIR: stateDir }, () => {
-        const { helpers } = makeHelpers({
-          runCapture: vi.fn((args) =>
-            args.join(" ") === `ps -p ${pid} -o args=` ? `${gatewayBin}\n` : "",
-          ),
-        });
-        const desiredEnv = helpers.getDockerDriverGatewayEnv(null, "darwin");
-        writeDockerDriverGatewayRuntimeMarkerForStateDir(stateDir, {
-          pid,
-          desiredEnv,
-          endpoint: desiredEnv.OPENSHELL_GRPC_ENDPOINT,
-          gatewayBin,
-          platform: "darwin",
-          arch: process.arch,
-        });
-
-        expect(
-          helpers.getDockerDriverGatewayRuntimeDrift(pid, desiredEnv, gatewayBin, "darwin")?.reason,
-        ).toContain("lacks target-bound cleanup identity");
-      });
-    } finally {
-      fs.rmSync(stateDir, { recursive: true, force: true });
-    }
-  });
 });
diff --git a/src/lib/onboard/docker-driver-gateway-runtime.ts b/src/lib/onboard/docker-driver-gateway-runtime.ts
index 757b0a40fb9..ece61d0c1b1 100644
--- a/src/lib/onboard/docker-driver-gateway-runtime.ts
+++ b/src/lib/onboard/docker-driver-gateway-runtime.ts
@@ -12,6 +12,10 @@ import {
   type DockerDriverGatewayPortListenerOptions,
   type DockerDriverGatewayPortListenerScan,
 } from "./docker-driver-gateway-port-listener";
+import {
+  getDockerDriverGatewayTargetIdentityDrift,
+  readDockerDriverGatewayProcessIdentity,
+} from "./docker-driver-gateway-process-identity";
 import * as dockerDriverGatewayRuntimeMarker from "./docker-driver-gateway-runtime-marker";
 import * as gatewayBinding from "./gateway-binding";
 import {
@@ -290,21 +294,6 @@ export function createDockerDriverGatewayRuntimeHelpers(deps: DockerDriverGatewa
     });
   }
 
-  function processIdentityMatchesGatewayTarget(
-    identity: string,
-    gatewayBin?: string | null,
-  ): boolean {
-    const port = currentGatewayPort();
-    return gatewayProcessCmdlineMatches(identity, gatewayBin, {
-      expectedOpenShellGateway: {
-        name: gatewayBinding.resolveGatewayName(port),
-        port,
-      },
-      processNames: OPENSHELL_GATEWAY_PROCESS_NAMES,
-      resolveExecutablePath: normalizeGatewayExecutablePath,
-    });
-  }
-
   function shouldRequireDockerDriverEnv(platform: NodeJS.Platform = process.platform): boolean {
     return platform === "linux";
   }
@@ -352,17 +341,13 @@ export function createDockerDriverGatewayRuntimeHelpers(deps: DockerDriverGatewa
     gatewayBin?: string | null,
     platform: NodeJS.Platform = process.platform,
   ): DockerDriverGatewayRuntimeDrift | null {
-    // Released host gateways used the real binary with no argv target. They
-    // cannot be cleaned up safely by a later sandbox destroy, so a port-scoped
-    // cutover must retire them instead of adopting them as reusable.
-    if (!processIdentityMatchesGatewayTarget(readProcessIdentity(pid), gatewayBin)) {
-      const port = currentGatewayPort();
-      return {
-        reason:
-          "gateway process lacks target-bound cleanup identity for " +
-          `${gatewayBinding.resolveGatewayName(port)} on port ${port}`,
-      };
-    }
+    const identityDrift = getDockerDriverGatewayTargetIdentityDrift({
+      gatewayBin,
+      gatewayPort: currentGatewayPort(),
+      identity: readDockerDriverGatewayProcessIdentity(pid, captureProcessArgs),
+      normalizeGatewayExecutablePath,
+    });
+    if (identityDrift) return identityDrift;
     if (platform === "darwin" && desiredEnv.OPENSHELL_DRIVERS === "docker") {
       const markerDrift =
         dockerDriverGatewayRuntimeMarker.getDockerDriverGatewayRuntimeMarkerDriftForStateDir(
@@ -403,25 +388,12 @@ export function createDockerDriverGatewayRuntimeHelpers(deps: DockerDriverGatewa
       .trim();
   }
 
-  function readProcessIdentity(pid: number): string {
-    const procCmdlinePath = `/proc/${pid}/cmdline`;
-    try {
-      if (fs.existsSync(procCmdlinePath)) {
-        const identity = fs.readFileSync(procCmdlinePath, "utf-8").replace(/\0/g, " ").trim();
-        if (identity) return identity;
-      }
-    } catch {
-      // Fall through to ps on hosts without readable procfs.
-    }
-    return captureProcessArgs(pid);
-  }
-
   function isDockerDriverGatewayProcess(
     pid: number,
     gatewayBin?: string | null,
     opts: { requireDockerDriverEnv?: boolean } = {},
   ): boolean {
-    const identity = readProcessIdentity(pid);
+    const identity = readDockerDriverGatewayProcessIdentity(pid, captureProcessArgs);
     if (!identity) return false;
     const matchesGatewayBinary = processIdentityMatchesGatewayBinary(identity, gatewayBin);
     if (!matchesGatewayBinary) return false;
diff --git a/src/lib/onboard/host-gateway-process-target.test.ts b/src/lib/onboard/host-gateway-process-target.test.ts
index 97248b23848..c7d3b2a3828 100644
--- a/src/lib/onboard/host-gateway-process-target.test.ts
+++ b/src/lib/onboard/host-gateway-process-target.test.ts
@@ -123,6 +123,17 @@ describe("stopHostGatewayProcesses target filtering", () => {
     expect(fs.existsSync(pidFile)).toBe(false);
   });
 
+  it("skips an untagged legacy no-argument launch until onboarding migrates it", () => {
+    const { kill, pidFile, result } = stopTargetedPid(
+      9999559,
+      "/opt/openshell/openshell-gateway\n",
+    );
+
+    expect(result.skippedNonMatchingPids).toEqual([9999559]);
+    expect(kill).not.toHaveBeenCalled();
+    expect(fs.existsSync(pidFile)).toBe(false);
+  });
+
   it("skips an owned no-argument host launch for another port", () => {
     const { kill, pidFile, result } = stopTargetedPid(
       9999556,
diff --git a/test/macos-e2e-workflow-boundary.test.ts b/test/macos-e2e-workflow-boundary.test.ts
index 4ae0f01c3e2..582b0c06a4a 100644
--- a/test/macos-e2e-workflow-boundary.test.ts
+++ b/test/macos-e2e-workflow-boundary.test.ts
@@ -12,10 +12,13 @@ type WorkflowStep = {
   if?: string;
   env?: Record<string, unknown>;
   run?: string;
+  uses?: string;
   with?: Record<string, unknown>;
 };
 
 type WorkflowJob = {
+  if?: string;
+  "runs-on"?: string;
   "timeout-minutes"?: number;
   steps?: WorkflowStep[];
 };
@@ -31,14 +34,14 @@ function readMacosWorkflow(): Workflow {
   ) as Workflow;
 }
 
-function macosJob(): WorkflowJob {
-  const job = readMacosWorkflow().jobs?.["macos-e2e"];
+function jobNamed(name: string): WorkflowJob {
+  const job = readMacosWorkflow().jobs?.[name];
   expect(job).toBeDefined();
   return job!;
 }
 
-function stepNamed(name: string): WorkflowStep {
-  const step = macosJob().steps?.find((candidate) => candidate.name === name);
+function stepNamed(name: string, jobName = "macos-e2e"): WorkflowStep {
+  const step = jobNamed(jobName).steps?.find((candidate) => candidate.name === name);
   expect(step).toBeDefined();
   return step!;
 }
@@ -47,35 +50,27 @@ describe("macOS E2E workflow boundary", () => {
   it("keeps secret-bearing live E2E off pull_request runs", () => {
     expect(readMacosWorkflow().on?.pull_request).toBeDefined();
 
-    for (const name of [
-      "Run macOS full E2E",
-      "Install OpenShell CLI for macOS sandbox operations",
-      "Run macOS final-destroy gateway cleanup E2E",
-    ]) {
-      expect(stepNamed(name).if).toContain("github.event_name != 'pull_request'");
-    }
+    expect(stepNamed("Run macOS full E2E").if).toContain("github.event_name != 'pull_request'");
 
-    for (const name of ["Run macOS full E2E", "Run macOS final-destroy gateway cleanup E2E"]) {
-      expect(String(stepNamed(name).env?.NVIDIA_INFERENCE_API_KEY)).toContain(
-        "github.event_name != 'pull_request'",
-      );
-    }
+    expect(String(stepNamed("Run macOS full E2E").env?.NVIDIA_INFERENCE_API_KEY)).toContain(
+      "github.event_name != 'pull_request'",
+    );
+    expect(jobNamed("macos-docker-final-destroy").if).toContain(
+      "github.event_name != 'pull_request'",
+    );
   });
 
-  it("starts Docker with preinstalled Colima only for trusted macOS live runs", () => {
-    const docker = stepNamed("Prepare Docker availability");
-    expect(String(docker.env?.TRUSTED_MACOS_LIVE)).toContain("github.event_name != 'pull_request'");
-    expect(docker.run).toContain('TRUSTED_MACOS_LIVE" != "1"');
-    expect(docker.run).toContain("command -v docker");
-    expect(docker.run).toContain("command -v colima");
-    expect(docker.run).toContain(
-      "skipping live E2E instead of bootstrapping floating Homebrew packages",
-    );
-    expect(docker.run).not.toContain("brew install");
-    expect(docker.run).toContain("colima start");
-    expect(docker.run).toContain("Colima could not start Docker");
-    expect(docker.run).toContain("docker_ok=false");
-    expect(docker.run).toContain("docker info");
+  it("runs final-destroy against a commit-pinned Docker setup on trusted Intel macOS", () => {
+    const job = jobNamed("macos-docker-final-destroy");
+    const docker = stepNamed("Set up pinned Docker Engine", "macos-docker-final-destroy");
+    const live = stepNamed("Run macOS Docker final-destroy E2E", "macos-docker-final-destroy");
+
+    expect(job["runs-on"]).toBe("macos-15-intel");
+    expect(docker.uses).toBe("docker/setup-docker-action@6d7cfa65f60a9dda7b46e5513fa982536f3c9877");
+    expect(docker.with?.version).toBe("v27.4.0");
+    expect(String(docker.env?.LIMA_START_ARGS)).toContain("--cpus 4 --memory 8");
+    expect(live.run).toContain("test/e2e/live/sandbox-operations.test.ts");
+    expect(live.env?.NEMOCLAW_NON_INTERACTIVE).toBe("1");
   });
 
   it("uploads live macOS E2E artifacts when the workflow fails", () => {
@@ -86,6 +81,7 @@ describe("macOS E2E workflow boundary", () => {
   });
 
   it("keeps the job timeout outside the combined live test budgets", () => {
-    expect(macosJob()["timeout-minutes"]).toBeGreaterThanOrEqual(150);
+    expect(jobNamed("macos-e2e")["timeout-minutes"]).toBeGreaterThanOrEqual(150);
+    expect(jobNamed("macos-docker-final-destroy")["timeout-minutes"]).toBeGreaterThanOrEqual(150);
   });
 });

From 6489653037f5637b301711b13f02c9dac7d340b1 Mon Sep 17 00:00:00 2001
From: Prekshi Vyas <prekshiv@nvidia.com>
Date: Fri, 10 Jul 2026 16:21:48 -0700
Subject: [PATCH 33/45] fix(gateway): close final destroy review gaps

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
---
 .github/workflows/macos-e2e.yaml              |  29 ++---
 docs/reference/commands.mdx                   |   3 +-
 src/lib/actions/sandbox/destroy-flow.test.ts  |  15 +--
 .../sandbox/destroy-gateway-cleanup.ts        |  12 +-
 .../actions/sandbox/destroy-gateway.test.ts   |  38 ++++++
 src/lib/onboard/gateway-process-identity.ts   | 118 ++----------------
 .../gateway-process-target-identity.ts        | 103 +++++++++++++++
 test/macos-e2e-workflow-boundary.test.ts      |  18 ++-
 8 files changed, 193 insertions(+), 143 deletions(-)
 create mode 100644 src/lib/onboard/gateway-process-target-identity.ts

diff --git a/.github/workflows/macos-e2e.yaml b/.github/workflows/macos-e2e.yaml
index 092c85cb26c..853cec26380 100644
--- a/.github/workflows/macos-e2e.yaml
+++ b/.github/workflows/macos-e2e.yaml
@@ -37,7 +37,7 @@ concurrency:
 jobs:
   macos-e2e:
     runs-on: macos-26
-    timeout-minutes: 150
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -91,9 +91,9 @@ jobs:
           echo "Docker is unavailable on the Apple Silicon runner."
 
       - name: Run macOS full E2E
-        if: steps.docker.outputs.docker_ok == 'true' && github.event_name != 'pull_request'
+        if: steps.docker.outputs.docker_ok == 'true' && github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
         env:
-          NVIDIA_INFERENCE_API_KEY: ${{ github.event_name != 'pull_request' && secrets.NVIDIA_INFERENCE_API_KEY || '' }}
+          NVIDIA_INFERENCE_API_KEY: ${{ github.ref == 'refs/heads/main' && github.event_name != 'pull_request' && secrets.NVIDIA_INFERENCE_API_KEY || '' }}
           GITHUB_TOKEN: ${{ github.token }}
           NEMOCLAW_NON_INTERACTIVE: "1"
           NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
@@ -103,17 +103,19 @@ jobs:
           NEMOCLAW_RUN_LIVE_E2E=1 npx vitest run --project e2e-live test/e2e/live/full-e2e.test.ts --silent=false --reporter=default
 
       - name: Explain skipped macOS live E2E
-        if: steps.docker.outputs.docker_ok != 'true' || github.event_name == 'pull_request'
+        if: steps.docker.outputs.docker_ok != 'true' || github.ref != 'refs/heads/main' || github.event_name == 'pull_request'
         run: |
           if [ "${{ github.event_name }}" = "pull_request" ]; then
             echo 'Skipping secret-bearing macOS live E2E on pull_request; use trusted workflow_dispatch/push evidence for live validation.'
+          elif [ "${{ github.ref }}" != "refs/heads/main" ]; then
+            echo 'Skipping secret-bearing macOS live E2E outside the trusted main branch.'
           elif [ "${{ steps.docker.outputs.docker_ok }}" != "true" ]; then
             echo 'Skipping macOS live E2E because Docker is unavailable on this runner.'
           fi
           echo 'The workflow still validated the NemoClaw build on macOS (Apple Silicon).'
 
       - name: Upload logs on failure
-        if: failure()
+        if: failure() && github.event_name == 'pull_request'
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: macos-e2e-logs
@@ -122,10 +124,13 @@ jobs:
             ${{ github.workspace }}/e2e-artifacts/live
           if-no-files-found: ignore
 
+  # docker/setup-docker-action supports Intel macOS, while the primary Apple
+  # Silicon job validates the same gateway lifecycle regressions without Docker.
+  # Keep the secret-bearing real Docker proof on reviewed main-branch code only.
   macos-docker-final-destroy:
-    if: github.event_name != 'pull_request'
+    if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
     runs-on: macos-15-intel
-    timeout-minutes: 150
+    timeout-minutes: 90
     steps:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -177,13 +182,3 @@ jobs:
           npx vitest run --project e2e-live \
             test/e2e/live/sandbox-operations.test.ts \
             --silent=false --reporter=default
-
-      - name: Upload logs on failure
-        if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: macos-docker-final-destroy-logs
-          path: |
-            /tmp/nemoclaw-e2e-*.log
-            ${{ github.workspace }}/e2e-artifacts/live
-          if-no-files-found: ignore
diff --git a/docs/reference/commands.mdx b/docs/reference/commands.mdx
index 03af0133a2c..fc6591159ff 100644
--- a/docs/reference/commands.mdx
+++ b/docs/reference/commands.mdx
@@ -1523,6 +1523,7 @@ If hardening fails, the command refuses deletion and leaves the timer authority
 If deletion fails after hardening, the command keeps the surviving sandbox's locked shields state instead of cleaning it up as though deletion succeeded.
 By default, unattended final-sandbox destroys (`--yes`, `--force`, or `NEMOCLAW_NON_INTERACTIVE=1`) remove the shared NemoClaw gateway on macOS so the host listener is released, while Linux preserves it for reuse.
 Pass `--cleanup-gateway` to force removal, or `--no-cleanup-gateway` to force preservation.
+These flags always override both `NEMOCLAW_CLEANUP_GATEWAY` and the platform default.
 If the pre-delete workspace wipe cannot run, use a different sandbox name for a clean start.
 Cleaning up the gateway after the last sandbox also purges the shared cluster volume that retains the per-name persistent volume.
 If the OpenShell gateway is unreachable and the sandbox has no managed MCP ownership state, `--force` removes only NemoClaw's local registry entry and local artifacts.
@@ -3501,7 +3502,7 @@ The following flags change defaults for commands that manage existing sandboxes.
 
 | Variable | Format | Effect |
 |----------|--------|--------|
-| `NEMOCLAW_CLEANUP_GATEWAY` | `1`, `true`, or `yes` to enable; `0`, `false`, or `no` to disable | Overrides the platform default for whether `$$nemoclaw <name> destroy` removes the shared gateway when destroying the last sandbox. Command-line `--cleanup-gateway` and `--no-cleanup-gateway` still take precedence. |
+| `NEMOCLAW_CLEANUP_GATEWAY` | `1`, `true`, or `yes` to enable; `0`, `false`, or `no` to disable | Overrides the platform default (macOS unattended: cleanup; Linux/Windows: preserve) for whether `$$nemoclaw <name> destroy` removes the shared gateway when destroying the last sandbox. Command-line `--cleanup-gateway` and `--no-cleanup-gateway` still take precedence. |
 | `NEMOCLAW_CONFIRM_LEGACY_MANAGED_RECREATE` | Exact JSON array of sandbox names | Confirms to the installer that the exact listed set of pre-fingerprint OpenClaw or Hermes sandboxes used NemoClaw-managed images, allowing recovery onto the current managed image. The normalized names must exactly match the installer's printed array. Set it only after verifying every named sandbox. Recorded custom-image evidence remains blocked. |
 | `NEMOCLAW_DISABLE_INFERENCE_ROUTE_REPAIR` | `1` to enable | Skips the automatic DNS-proxy repair for stale `inference.local` routes during `$$nemoclaw <name> connect` and `$$nemoclaw <name> connect --probe-only`. Use only as a troubleshooting escape hatch. |
 | `NEMOCLAW_SHIELDS_ACCEPT_LEGACY_BASELINE` | `1` to opt in | Allows advanced immutable-config verification to trust the current on-disk bytes for older or partial content baselines. Use only after you have rebuilt or manually inspected the sandbox state and accepted that the baseline is operator-approved. |
diff --git a/src/lib/actions/sandbox/destroy-flow.test.ts b/src/lib/actions/sandbox/destroy-flow.test.ts
index 4518aa96ad6..03c39abe45e 100644
--- a/src/lib/actions/sandbox/destroy-flow.test.ts
+++ b/src/lib/actions/sandbox/destroy-flow.test.ts
@@ -56,17 +56,12 @@ describe("destroySandbox flow", () => {
   });
 
   it.each([
-    ["--yes", { yes: true }, () => vi.stubEnv("NEMOCLAW_NON_INTERACTIVE", ""), true],
-    ["NEMOCLAW_NON_INTERACTIVE=1", {}, () => vi.stubEnv("NEMOCLAW_NON_INTERACTIVE", "1"), true],
-    [
-      "an explicit preservation override",
-      { yes: true, cleanupGateway: false },
-      () => vi.stubEnv("NEMOCLAW_NON_INTERACTIVE", ""),
-      false,
-    ],
-  ] as const)("applies the macOS final-gateway default for %s (#4662)", async (_scenario, options, configureEnvironment, cleanupExpected) => {
+    ["--yes", { yes: true }, "", true],
+    ["NEMOCLAW_NON_INTERACTIVE=1", {}, "1", true],
+    ["an explicit preservation override", { yes: true, cleanupGateway: false }, "", false],
+  ] as const)("applies the macOS final-gateway default for %s (#4662)", async (_scenario, options, nonInteractive, cleanupExpected) => {
     vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
-    configureEnvironment();
+    vi.stubEnv("NEMOCLAW_NON_INTERACTIVE", nonInteractive);
     const harness = createDestroyHarness();
 
     await expect(harness.destroySandbox("alpha", options)).resolves.toBeUndefined();
diff --git a/src/lib/actions/sandbox/destroy-gateway-cleanup.ts b/src/lib/actions/sandbox/destroy-gateway-cleanup.ts
index 8a17a0a34c2..431d68e0ed8 100644
--- a/src/lib/actions/sandbox/destroy-gateway-cleanup.ts
+++ b/src/lib/actions/sandbox/destroy-gateway-cleanup.ts
@@ -59,6 +59,8 @@ export function collectLiveSandboxProbeSnapshot(
     timeoutMs?: number;
   } = {},
 ): Parameters<typeof hasNoLiveSandboxes>[0] {
+  // Both host probes are synchronous so this produces one ordered snapshot
+  // after the registry check and before the cleanup decision.
   const captureOpenshell = deps.captureOpenshell ?? captureLiveSandboxes;
   const dockerCapture = deps.dockerCapture ?? captureDockerContainers;
   const timeoutMs = deps.timeoutMs ?? OPENSHELL_PROBE_TIMEOUT_MS;
@@ -84,9 +86,13 @@ export function collectLiveSandboxProbeSnapshot(
         ),
       });
     } catch (error) {
-      // SOURCE_OF_TRUTH: preserve unrelated sandboxes and owned resources only;
-      // see the #6639 removal boundary in destroy-gateway.ts. If Docker cannot
-      // confirm the row has no backing container, preserve the shared gateway.
+      // SOURCE_OF_TRUTH: this host Docker CLI probe follows a terminal OpenShell
+      // row and must attest that its backing container is absent. An exception
+      // leaves live-sandbox state unknown, so preserve the shared gateway.
+      // NemoClaw cannot manufacture that container-runtime attestation here;
+      // destroy-gateway-cleanup.test.ts locks this fail-closed behavior. Remove
+      // it only when final cleanup has one authoritative sandbox/container state
+      // source; see the OpenShell listener-removal boundary tracked in #6639.
       console.debug(
         `Docker container probe failed for sandbox '${sandboxName}'; preserving shared gateway: ${String(error)}`,
       );
diff --git a/src/lib/actions/sandbox/destroy-gateway.test.ts b/src/lib/actions/sandbox/destroy-gateway.test.ts
index 7f5bf482c09..0c6cb8ca829 100644
--- a/src/lib/actions/sandbox/destroy-gateway.test.ts
+++ b/src/lib/actions/sandbox/destroy-gateway.test.ts
@@ -116,4 +116,42 @@ describe("cleanupGatewayAfterLastSandbox", () => {
       stdio: ["ignore", "pipe", "pipe"],
     });
   });
+
+  it.each([
+    "host reaper",
+    "gateway remove",
+    "volume cleanup",
+  ] as const)("converges on retry after a partial %s failure (#4662)", (failureStage) => {
+    vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
+    vi.spyOn(os, "homedir").mockReturnValue("/home/tester");
+    if (failureStage === "host reaper") {
+      mocks.stopHostGatewayProcesses.mockImplementationOnce(() => {
+        throw new Error("injected host reaper failure");
+      });
+    }
+    if (failureStage === "volume cleanup") {
+      mocks.dockerRemoveVolumesByPrefix.mockImplementationOnce(() => {
+        throw new Error("injected volume cleanup failure");
+      });
+    }
+    let removeFailed = false;
+    const runOpenshell = vi.fn((args: string[]) => {
+      if (failureStage === "gateway remove" && args[0] === "gateway" && !removeFailed) {
+        removeFailed = true;
+        throw new Error("injected gateway remove failure");
+      }
+      return { status: 0, stdout: "", stderr: "" };
+    });
+
+    expect(() => cleanupGatewayAfterLastSandbox("nemoclaw-8081", runOpenshell)).toThrow();
+    expect(() => cleanupGatewayAfterLastSandbox("nemoclaw-8081", runOpenshell)).not.toThrow();
+    expect(runOpenshell).toHaveBeenCalledWith(["gateway", "remove", "nemoclaw-8081"], {
+      ignoreError: true,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    expect(mocks.dockerRemoveVolumesByPrefix).toHaveBeenCalledWith(
+      "openshell-cluster-nemoclaw-8081",
+      { ignoreError: true },
+    );
+  });
 });
diff --git a/src/lib/onboard/gateway-process-identity.ts b/src/lib/onboard/gateway-process-identity.ts
index db52f978f1e..05553284765 100644
--- a/src/lib/onboard/gateway-process-identity.ts
+++ b/src/lib/onboard/gateway-process-identity.ts
@@ -4,10 +4,17 @@
 import path from "node:path";
 
 import {
-  resolveGatewayCompatContainerName,
-  resolveGatewayName,
-  resolveGatewayPortFromName,
-} from "./gateway-binding";
+  dockerCompatGatewayMatchesTarget,
+  gatewayTargetMatches,
+  type OpenShellGatewayProcessTarget,
+  openShellGatewayMatchesTarget,
+  ownedHostGatewayTarget,
+} from "./gateway-process-target-identity";
+
+export {
+  buildOwnedHostGatewayArgv0,
+  type OpenShellGatewayProcessTarget,
+} from "./gateway-process-target-identity";
 
 export const HOST_GATEWAY_PROCESS_NAMES = new Set(["openshell-gateway", "openclaw-gateway"]);
 export const OPENSHELL_GATEWAY_PROCESS_NAMES = new Set(["openshell-gateway"]);
@@ -26,113 +33,10 @@ export const DOCKER_DRIVER_GATEWAY_COMPAT_MOUNT_PATH = "/opt/nemoclaw/openshell-
 
 type ResolveExecutablePath = (value: string) => string | null;
 
-export interface OpenShellGatewayProcessTarget {
-  name?: string | null;
-  port?: number | string | null;
-}
-
-const OWNED_HOST_GATEWAY_ARGV0_RE =
-  /^openshell-gateway\[nemoclaw=(nemoclaw(?:-\d+)?);port=(\d+)\]$/;
-
-export function buildOwnedHostGatewayArgv0(gatewayName: string | null | undefined): string | null {
-  if (!gatewayName) return null;
-  const port = resolveGatewayPortFromName(gatewayName);
-  if (port === null) return null;
-  return `openshell-gateway[nemoclaw=${gatewayName};port=${port}]`;
-}
-
-function ownedHostGatewayTarget(argv0: string): { name: string; port: number } | null {
-  const match = OWNED_HOST_GATEWAY_ARGV0_RE.exec(argv0);
-  if (!match) return null;
-  const name = match[1];
-  const port = Number(match[2]);
-  if (resolveGatewayPortFromName(name) !== port || resolveGatewayName(port) !== name) return null;
-  return { name, port };
-}
-
-function gatewayTargetMatches(
-  actual: { name: string; port: number },
-  expected: OpenShellGatewayProcessTarget | undefined,
-): boolean {
-  if (!expected || (!expected.name && (expected.port === undefined || expected.port === null))) {
-    return true;
-  }
-  if (expected.name && expected.name !== actual.name) return false;
-  if (expected.port !== undefined && expected.port !== null) {
-    return String(expected.port) === String(actual.port);
-  }
-  return true;
-}
-
 export function cleanGatewayProcessToken(token: string): string {
   return token.replace(/^['"]|['"]$/g, "").replace(/ \(deleted\)$/, "");
 }
 
-function cliFlagValue(tokens: string[], names: string[]): string | null {
-  for (let index = 0; index < tokens.length; index += 1) {
-    const token = tokens[index];
-    for (const name of names) {
-      if (token === name) {
-        return tokens[index + 1] ?? null;
-      }
-      if (token.startsWith(`${name}=`)) {
-        return token.slice(name.length + 1);
-      }
-    }
-  }
-  return null;
-}
-
-function openShellGatewayMatchesTarget(
-  tokens: string[],
-  target: OpenShellGatewayProcessTarget | undefined,
-  opts: { requireExpectedFlags: boolean },
-): boolean {
-  if (!target || (!target.name && (target.port === undefined || target.port === null))) {
-    return true;
-  }
-
-  let matchedComparableFlag = false;
-
-  if (target.name) {
-    const actualName = cliFlagValue(tokens, ["--name"]);
-    if (actualName === null) {
-      if (opts.requireExpectedFlags) return false;
-    } else {
-      if (actualName !== target.name) return false;
-      matchedComparableFlag = true;
-    }
-  }
-
-  if (target.port !== undefined && target.port !== null) {
-    const actualPort = cliFlagValue(tokens, ["--port"]);
-    if (actualPort === null) {
-      if (opts.requireExpectedFlags) return false;
-    } else {
-      if (actualPort !== String(target.port)) return false;
-      matchedComparableFlag = true;
-    }
-  }
-
-  return matchedComparableFlag;
-}
-
-function dockerCompatGatewayMatchesTarget(
-  tokens: string[],
-  target: OpenShellGatewayProcessTarget | undefined,
-): boolean {
-  if (!target || (!target.name && (target.port === undefined || target.port === null))) {
-    return true;
-  }
-  if (target.port === undefined || target.port === null) return false;
-
-  const port = Number(target.port);
-  if (!Number.isInteger(port) || port < 1 || port > 65535) return false;
-  if (target.name && target.name !== resolveGatewayName(port)) return false;
-
-  return cliFlagValue(tokens, ["--name"]) === resolveGatewayCompatContainerName(port);
-}
-
 export function gatewayProcessCmdlineMatches(
   cmdline: string,
   gatewayBin: string | null | undefined,
diff --git a/src/lib/onboard/gateway-process-target-identity.ts b/src/lib/onboard/gateway-process-target-identity.ts
new file mode 100644
index 00000000000..e446c6be2b8
--- /dev/null
+++ b/src/lib/onboard/gateway-process-target-identity.ts
@@ -0,0 +1,103 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import {
+  resolveGatewayCompatContainerName,
+  resolveGatewayName,
+  resolveGatewayPortFromName,
+} from "./gateway-binding";
+
+export interface OpenShellGatewayProcessTarget {
+  name?: string | null;
+  port?: number | string | null;
+}
+
+const OWNED_HOST_GATEWAY_ARGV0_RE =
+  /^openshell-gateway\[nemoclaw=(nemoclaw(?:-\d+)?);port=(\d+)\]$/;
+
+export function buildOwnedHostGatewayArgv0(gatewayName: string | null | undefined): string | null {
+  if (!gatewayName) return null;
+  const port = resolveGatewayPortFromName(gatewayName);
+  if (port === null) return null;
+  return `openshell-gateway[nemoclaw=${gatewayName};port=${port}]`;
+}
+
+export function ownedHostGatewayTarget(argv0: string): { name: string; port: number } | null {
+  const match = OWNED_HOST_GATEWAY_ARGV0_RE.exec(argv0);
+  if (!match) return null;
+  const name = match[1];
+  const port = Number(match[2]);
+  if (resolveGatewayPortFromName(name) !== port || resolveGatewayName(port) !== name) return null;
+  return { name, port };
+}
+
+export function gatewayTargetMatches(
+  actual: { name: string; port: number },
+  expected: OpenShellGatewayProcessTarget | undefined,
+): boolean {
+  if (!expected || (!expected.name && (expected.port === undefined || expected.port === null))) {
+    return true;
+  }
+  if (expected.name && expected.name !== actual.name) return false;
+  if (expected.port !== undefined && expected.port !== null) {
+    return String(expected.port) === String(actual.port);
+  }
+  return true;
+}
+
+function cliFlagValue(tokens: string[], names: string[]): string | null {
+  for (let index = 0; index < tokens.length; index += 1) {
+    const token = tokens[index];
+    for (const name of names) {
+      if (token === name) return tokens[index + 1] ?? null;
+      if (token.startsWith(`${name}=`)) return token.slice(name.length + 1);
+    }
+  }
+  return null;
+}
+
+export function openShellGatewayMatchesTarget(
+  tokens: string[],
+  target: OpenShellGatewayProcessTarget | undefined,
+  opts: { requireExpectedFlags: boolean },
+): boolean {
+  if (!target || (!target.name && (target.port === undefined || target.port === null))) {
+    return true;
+  }
+
+  let matchedComparableFlag = false;
+  if (target.name) {
+    const actualName = cliFlagValue(tokens, ["--name"]);
+    if (actualName === null) {
+      if (opts.requireExpectedFlags) return false;
+    } else {
+      if (actualName !== target.name) return false;
+      matchedComparableFlag = true;
+    }
+  }
+  if (target.port !== undefined && target.port !== null) {
+    const actualPort = cliFlagValue(tokens, ["--port"]);
+    if (actualPort === null) {
+      if (opts.requireExpectedFlags) return false;
+    } else {
+      if (actualPort !== String(target.port)) return false;
+      matchedComparableFlag = true;
+    }
+  }
+  return matchedComparableFlag;
+}
+
+export function dockerCompatGatewayMatchesTarget(
+  tokens: string[],
+  target: OpenShellGatewayProcessTarget | undefined,
+): boolean {
+  if (!target || (!target.name && (target.port === undefined || target.port === null))) {
+    return true;
+  }
+  if (target.port === undefined || target.port === null) return false;
+
+  const port = Number(target.port);
+  if (!Number.isInteger(port) || port < 1 || port > 65535) return false;
+  if (target.name && target.name !== resolveGatewayName(port)) return false;
+  return cliFlagValue(tokens, ["--name"]) === resolveGatewayCompatContainerName(port);
+}
diff --git a/test/macos-e2e-workflow-boundary.test.ts b/test/macos-e2e-workflow-boundary.test.ts
index 582b0c06a4a..57780cc27ad 100644
--- a/test/macos-e2e-workflow-boundary.test.ts
+++ b/test/macos-e2e-workflow-boundary.test.ts
@@ -47,17 +47,22 @@ function stepNamed(name: string, jobName = "macos-e2e"): WorkflowStep {
 }
 
 describe("macOS E2E workflow boundary", () => {
-  it("keeps secret-bearing live E2E off pull_request runs", () => {
+  it("keeps secret-bearing live E2E on trusted main-branch code", () => {
     expect(readMacosWorkflow().on?.pull_request).toBeDefined();
 
     expect(stepNamed("Run macOS full E2E").if).toContain("github.event_name != 'pull_request'");
+    expect(stepNamed("Run macOS full E2E").if).toContain("github.ref == 'refs/heads/main'");
 
     expect(String(stepNamed("Run macOS full E2E").env?.NVIDIA_INFERENCE_API_KEY)).toContain(
       "github.event_name != 'pull_request'",
     );
+    expect(String(stepNamed("Run macOS full E2E").env?.NVIDIA_INFERENCE_API_KEY)).toContain(
+      "github.ref == 'refs/heads/main'",
+    );
     expect(jobNamed("macos-docker-final-destroy").if).toContain(
       "github.event_name != 'pull_request'",
     );
+    expect(jobNamed("macos-docker-final-destroy").if).toContain("github.ref == 'refs/heads/main'");
   });
 
   it("runs final-destroy against a commit-pinned Docker setup on trusted Intel macOS", () => {
@@ -71,17 +76,20 @@ describe("macOS E2E workflow boundary", () => {
     expect(String(docker.env?.LIMA_START_ARGS)).toContain("--cpus 4 --memory 8");
     expect(live.run).toContain("test/e2e/live/sandbox-operations.test.ts");
     expect(live.env?.NEMOCLAW_NON_INTERACTIVE).toBe("1");
+    expect(job.steps?.some((step) => step.uses?.startsWith("actions/upload-artifact@"))).toBe(
+      false,
+    );
   });
 
   it("uploads live macOS E2E artifacts when the workflow fails", () => {
     const upload = stepNamed("Upload logs on failure");
-    expect(upload.if).toBe("failure()");
+    expect(upload.if).toBe("failure() && github.event_name == 'pull_request'");
     expect(String(upload.with?.path)).toContain("/tmp/nemoclaw-e2e-*.log");
     expect(String(upload.with?.path)).toContain("${{ github.workspace }}/e2e-artifacts/live");
   });
 
-  it("keeps the job timeout outside the combined live test budgets", () => {
-    expect(jobNamed("macos-e2e")["timeout-minutes"]).toBeGreaterThanOrEqual(150);
-    expect(jobNamed("macos-docker-final-destroy")["timeout-minutes"]).toBeGreaterThanOrEqual(150);
+  it("bounds the fast and real-Docker macOS jobs independently", () => {
+    expect(jobNamed("macos-e2e")["timeout-minutes"]).toBe(30);
+    expect(jobNamed("macos-docker-final-destroy")["timeout-minutes"]).toBe(90);
   });
 });

From 95cdb0b7fc3a4cbec595aed31b31aba1fc35204d Mon Sep 17 00:00:00 2001
From: Prekshi Vyas <prekshiv@nvidia.com>
Date: Fri, 10 Jul 2026 16:25:15 -0700
Subject: [PATCH 34/45] test(gateway): keep retry scenarios branchless

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
---
 .../actions/sandbox/destroy-gateway.test.ts   | 48 ++++++++++---------
 1 file changed, 26 insertions(+), 22 deletions(-)

diff --git a/src/lib/actions/sandbox/destroy-gateway.test.ts b/src/lib/actions/sandbox/destroy-gateway.test.ts
index 0c6cb8ca829..f91a0d4cbcd 100644
--- a/src/lib/actions/sandbox/destroy-gateway.test.ts
+++ b/src/lib/actions/sandbox/destroy-gateway.test.ts
@@ -118,30 +118,34 @@ describe("cleanupGatewayAfterLastSandbox", () => {
   });
 
   it.each([
-    "host reaper",
-    "gateway remove",
-    "volume cleanup",
-  ] as const)("converges on retry after a partial %s failure (#4662)", (failureStage) => {
+    [
+      "host reaper",
+      () =>
+        mocks.stopHostGatewayProcesses.mockImplementationOnce(() => {
+          throw new Error("injected host reaper failure");
+        }),
+    ],
+    [
+      "gateway remove",
+      (runOpenshell: ReturnType<typeof vi.fn>) =>
+        runOpenshell
+          .mockImplementationOnce(() => ({ status: 0, stdout: "", stderr: "" }))
+          .mockImplementationOnce(() => {
+            throw new Error("injected gateway remove failure");
+          }),
+    ],
+    [
+      "volume cleanup",
+      () =>
+        mocks.dockerRemoveVolumesByPrefix.mockImplementationOnce(() => {
+          throw new Error("injected volume cleanup failure");
+        }),
+    ],
+  ] as const)("converges on retry after a partial %s failure (#4662)", (_stage, injectFailure) => {
     vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
     vi.spyOn(os, "homedir").mockReturnValue("/home/tester");
-    if (failureStage === "host reaper") {
-      mocks.stopHostGatewayProcesses.mockImplementationOnce(() => {
-        throw new Error("injected host reaper failure");
-      });
-    }
-    if (failureStage === "volume cleanup") {
-      mocks.dockerRemoveVolumesByPrefix.mockImplementationOnce(() => {
-        throw new Error("injected volume cleanup failure");
-      });
-    }
-    let removeFailed = false;
-    const runOpenshell = vi.fn((args: string[]) => {
-      if (failureStage === "gateway remove" && args[0] === "gateway" && !removeFailed) {
-        removeFailed = true;
-        throw new Error("injected gateway remove failure");
-      }
-      return { status: 0, stdout: "", stderr: "" };
-    });
+    const runOpenshell = vi.fn(() => ({ status: 0, stdout: "", stderr: "" }));
+    injectFailure(runOpenshell);
 
     expect(() => cleanupGatewayAfterLastSandbox("nemoclaw-8081", runOpenshell)).toThrow();
     expect(() => cleanupGatewayAfterLastSandbox("nemoclaw-8081", runOpenshell)).not.toThrow();

From 45177720c10d5fc55de44cdb7e42e24a6cd8022b Mon Sep 17 00:00:00 2001
From: Prekshi Vyas <prekshiv@nvidia.com>
Date: Fri, 10 Jul 2026 16:47:33 -0700
Subject: [PATCH 35/45] fix(onboard): preserve authoritative rebuild provider

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
---
 .../machine/handlers/provider-inference.test.ts       | 11 +++++++++++
 .../onboard/machine/handlers/provider-inference.ts    |  2 +-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/src/lib/onboard/machine/handlers/provider-inference.test.ts b/src/lib/onboard/machine/handlers/provider-inference.test.ts
index 16eb98a5a84..3f09384ff58 100644
--- a/src/lib/onboard/machine/handlers/provider-inference.test.ts
+++ b/src/lib/onboard/machine/handlers/provider-inference.test.ts
@@ -823,10 +823,21 @@ describe("handleProviderInferenceState", () => {
     await handleProviderInferenceState({
       ...baseOptions(deps, session),
       resume: true,
+      authoritativeResumeConfig: true,
       sandboxName: "my-assistant",
     });
 
     expect(setupNim).toHaveBeenCalledOnce();
+    expect(setupNim).toHaveBeenCalledWith(
+      { type: "nvidia" },
+      "my-assistant",
+      null,
+      true,
+      "nemoclaw",
+      expect.any(Function),
+      expect.any(Function),
+      session.sessionId,
+    );
     expect(calls.setupInference).toHaveBeenCalledWith(
       "my-assistant",
       "nvidia/nemotron",
diff --git a/src/lib/onboard/machine/handlers/provider-inference.ts b/src/lib/onboard/machine/handlers/provider-inference.ts
index 254304e9e5c..7d67a91defc 100644
--- a/src/lib/onboard/machine/handlers/provider-inference.ts
+++ b/src/lib/onboard/machine/handlers/provider-inference.ts
@@ -453,7 +453,7 @@ export async function handleProviderInferenceState<Gpu, Agent, Host>({
       }
     } else {
       await deps.startRecordedStep("provider_selection");
-      const recoverRecordedProvider = providerRecovery.shouldRecover();
+      const recoverRecordedProvider = authoritativeResumeConfig || providerRecovery.shouldRecover();
       const selection = await withProviderSelectionTrace(
         sandboxName,
         (agent as { name?: string } | null)?.name,

From 723321184b88dc2d1c9b321a041705254cfb8a13 Mon Sep 17 00:00:00 2001
From: Prekshi Vyas <prekshiv@nvidia.com>
Date: Fri, 10 Jul 2026 16:59:19 -0700
Subject: [PATCH 36/45] fix(gateway): fail final destroy on reaper errors

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
---
 .github/workflows/macos-e2e.yaml              |  2 ++
 .../actions/sandbox/destroy-gateway.test.ts   | 34 ++++++++++++++++++-
 src/lib/actions/sandbox/destroy-gateway.ts    | 12 ++++++-
 test/macos-e2e-workflow-boundary.test.ts      |  2 ++
 4 files changed, 48 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/macos-e2e.yaml b/.github/workflows/macos-e2e.yaml
index 853cec26380..5f22cffb6f1 100644
--- a/.github/workflows/macos-e2e.yaml
+++ b/.github/workflows/macos-e2e.yaml
@@ -129,6 +129,8 @@ jobs:
   # Keep the secret-bearing real Docker proof on reviewed main-branch code only.
   macos-docker-final-destroy:
     if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
+    permissions:
+      contents: read
     runs-on: macos-15-intel
     timeout-minutes: 90
     steps:
diff --git a/src/lib/actions/sandbox/destroy-gateway.test.ts b/src/lib/actions/sandbox/destroy-gateway.test.ts
index f91a0d4cbcd..2b3d0023e65 100644
--- a/src/lib/actions/sandbox/destroy-gateway.test.ts
+++ b/src/lib/actions/sandbox/destroy-gateway.test.ts
@@ -4,7 +4,7 @@
 import os from "node:os";
 import path from "node:path";
 
-import { afterEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 const mocks = vi.hoisted(() => ({
   dockerRemoveVolumesByPrefix: vi.fn(),
@@ -25,6 +25,16 @@ vi.mock("../../onboard/stale-gateway-cleanup", () => ({
 import { cleanupGatewayAfterLastSandbox } from "./destroy-gateway";
 
 describe("cleanupGatewayAfterLastSandbox", () => {
+  beforeEach(() => {
+    mocks.stopHostGatewayProcesses.mockReturnValue({
+      failed: [],
+      skippedDeadPids: [],
+      skippedNonMatchingPids: [],
+      stopped: [],
+      sudoRemediationPids: [],
+    });
+  });
+
   afterEach(() => {
     vi.restoreAllMocks();
     vi.clearAllMocks();
@@ -117,6 +127,28 @@ describe("cleanupGatewayAfterLastSandbox", () => {
     });
   });
 
+  it("fails before gateway and volume removal when the owned host listener survives (#4662)", () => {
+    vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
+    vi.spyOn(os, "homedir").mockReturnValue("/home/tester");
+    mocks.stopHostGatewayProcesses.mockReturnValue({
+      failed: [123],
+      skippedDeadPids: [],
+      skippedNonMatchingPids: [],
+      stopped: [],
+      sudoRemediationPids: [123],
+    });
+    const runOpenshell = vi.fn(() => ({ status: 0, stdout: "", stderr: "" }));
+
+    expect(() => cleanupGatewayAfterLastSandbox("nemoclaw-8081", runOpenshell)).toThrow(
+      /PID\(s\) 123.*rerun destroy/,
+    );
+    expect(runOpenshell).not.toHaveBeenCalledWith(
+      ["gateway", "remove", "nemoclaw-8081"],
+      expect.anything(),
+    );
+    expect(mocks.dockerRemoveVolumesByPrefix).not.toHaveBeenCalled();
+  });
+
   it.each([
     [
       "host reaper",
diff --git a/src/lib/actions/sandbox/destroy-gateway.ts b/src/lib/actions/sandbox/destroy-gateway.ts
index dbfe1e80773..0dc053f8bcf 100644
--- a/src/lib/actions/sandbox/destroy-gateway.ts
+++ b/src/lib/actions/sandbox/destroy-gateway.ts
@@ -112,7 +112,17 @@ export function cleanupGatewayAfterLastSandbox(
       stopOptions.openShellGatewayName = gatewayName;
       stopOptions.openShellGatewayPort = perGatewayState.port;
     }
-    stopHostGatewayProcesses({}, stopOptions);
+    const stopResult = stopHostGatewayProcesses({}, stopOptions);
+    const failedPids = [...new Set([...stopResult.failed, ...stopResult.sudoRemediationPids])];
+    if (failedPids.length > 0) {
+      const remediation =
+        stopResult.sudoRemediationPids.length > 0
+          ? ` Retry with sufficient permissions for PID(s) ${stopResult.sudoRemediationPids.join(", ")}, then rerun destroy.`
+          : " Retry destroy after stopping the listed process(es).";
+      throw new Error(
+        `Failed to stop the owned host gateway process(es) for '${gatewayName}': ${failedPids.join(", ")}.${remediation}`,
+      );
+    }
   }
   /**
    * SOURCE_OF_TRUTH
diff --git a/test/macos-e2e-workflow-boundary.test.ts b/test/macos-e2e-workflow-boundary.test.ts
index 57780cc27ad..bdd60cc2393 100644
--- a/test/macos-e2e-workflow-boundary.test.ts
+++ b/test/macos-e2e-workflow-boundary.test.ts
@@ -18,6 +18,7 @@ type WorkflowStep = {
 
 type WorkflowJob = {
   if?: string;
+  permissions?: Record<string, string>;
   "runs-on"?: string;
   "timeout-minutes"?: number;
   steps?: WorkflowStep[];
@@ -71,6 +72,7 @@ describe("macOS E2E workflow boundary", () => {
     const live = stepNamed("Run macOS Docker final-destroy E2E", "macos-docker-final-destroy");
 
     expect(job["runs-on"]).toBe("macos-15-intel");
+    expect(job.permissions).toEqual({ contents: "read" });
     expect(docker.uses).toBe("docker/setup-docker-action@6d7cfa65f60a9dda7b46e5513fa982536f3c9877");
     expect(docker.with?.version).toBe("v27.4.0");
     expect(String(docker.env?.LIMA_START_ARGS)).toContain("--cpus 4 --memory 8");

From 337ab2d269240ff02e412dc1e07459fa0016cb15 Mon Sep 17 00:00:00 2001
From: Carlos Villela <cvillela@nvidia.com>
Date: Sat, 11 Jul 2026 09:36:50 -0700
Subject: [PATCH 37/45] fix(onboard): restore scoped provider recovery

---
 src/lib/onboard/machine/handlers/provider-inference.test.ts | 1 +
 src/lib/onboard/machine/handlers/provider-inference.ts      | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/lib/onboard/machine/handlers/provider-inference.test.ts b/src/lib/onboard/machine/handlers/provider-inference.test.ts
index 3f09384ff58..5536a97b535 100644
--- a/src/lib/onboard/machine/handlers/provider-inference.test.ts
+++ b/src/lib/onboard/machine/handlers/provider-inference.test.ts
@@ -771,6 +771,7 @@ describe("handleProviderInferenceState", () => {
 
   it("revalidates recovered identity before reusing a gateway credential on messaging resume", async () => {
     const session = createSession({
+      sandboxName: "my-assistant",
       provider: "compatible-endpoint",
       model: "nvidia/nemotron",
       endpointUrl: "https://integrate.api.nvidia.com/v1",
diff --git a/src/lib/onboard/machine/handlers/provider-inference.ts b/src/lib/onboard/machine/handlers/provider-inference.ts
index 081eb755b28..db794d2d0c3 100644
--- a/src/lib/onboard/machine/handlers/provider-inference.ts
+++ b/src/lib/onboard/machine/handlers/provider-inference.ts
@@ -455,7 +455,7 @@ export async function handleProviderInferenceState<Gpu, Agent, Host>({
       }
     } else {
       await deps.startRecordedStep("provider_selection");
-      const recoverRecordedProvider = authoritativeResumeConfig || providerRecovery.shouldRecover();
+      const recoverRecordedProvider = providerRecovery.shouldRecover();
       const selection = await withProviderSelectionTrace(
         sandboxName,
         (agent as { name?: string } | null)?.name,

From ce28822b09cecfb743619449ca2654ffcca62dc2 Mon Sep 17 00:00:00 2001
From: Carlos Villela <cvillela@nvidia.com>
Date: Sat, 11 Jul 2026 09:47:03 -0700
Subject: [PATCH 38/45] fix(destroy): reject unverifiable gateway pid

---
 .../actions/sandbox/destroy-gateway.test.ts   | 22 +++++++++++++++++++
 src/lib/actions/sandbox/destroy-gateway.ts    |  6 +++++
 2 files changed, 28 insertions(+)

diff --git a/src/lib/actions/sandbox/destroy-gateway.test.ts b/src/lib/actions/sandbox/destroy-gateway.test.ts
index 2b3d0023e65..51e562eb2ae 100644
--- a/src/lib/actions/sandbox/destroy-gateway.test.ts
+++ b/src/lib/actions/sandbox/destroy-gateway.test.ts
@@ -149,6 +149,28 @@ describe("cleanupGatewayAfterLastSandbox", () => {
     expect(mocks.dockerRemoveVolumesByPrefix).not.toHaveBeenCalled();
   });
 
+  it("fails before gateway and volume removal when PID-file ownership is unverifiable (#4662)", () => {
+    vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
+    vi.spyOn(os, "homedir").mockReturnValue("/home/tester");
+    mocks.stopHostGatewayProcesses.mockReturnValue({
+      failed: [],
+      skippedDeadPids: [],
+      skippedNonMatchingPids: [456],
+      stopped: [],
+      sudoRemediationPids: [],
+    });
+    const runOpenshell = vi.fn(() => ({ status: 0, stdout: "", stderr: "" }));
+
+    expect(() => cleanupGatewayAfterLastSandbox("nemoclaw-8081", runOpenshell)).toThrow(
+      /PID-file process\(es\) 456.*do not prove ownership.*rerun destroy/,
+    );
+    expect(runOpenshell).not.toHaveBeenCalledWith(
+      ["gateway", "remove", "nemoclaw-8081"],
+      expect.anything(),
+    );
+    expect(mocks.dockerRemoveVolumesByPrefix).not.toHaveBeenCalled();
+  });
+
   it.each([
     [
       "host reaper",
diff --git a/src/lib/actions/sandbox/destroy-gateway.ts b/src/lib/actions/sandbox/destroy-gateway.ts
index 0dc053f8bcf..cdfe46bba8b 100644
--- a/src/lib/actions/sandbox/destroy-gateway.ts
+++ b/src/lib/actions/sandbox/destroy-gateway.ts
@@ -113,6 +113,12 @@ export function cleanupGatewayAfterLastSandbox(
       stopOptions.openShellGatewayPort = perGatewayState.port;
     }
     const stopResult = stopHostGatewayProcesses({}, stopOptions);
+    const unverifiablePids = [...new Set(stopResult.skippedNonMatchingPids)];
+    if (unverifiablePids.length > 0) {
+      throw new Error(
+        `Refusing cleanup because PID-file process(es) ${unverifiablePids.join(", ")} do not prove ownership of gateway '${gatewayName}'. Inspect the process and per-gateway PID file, stop only the matching gateway listener, then rerun destroy.`,
+      );
+    }
     const failedPids = [...new Set([...stopResult.failed, ...stopResult.sudoRemediationPids])];
     if (failedPids.length > 0) {
       const remediation =

From 8ba894e8ad0e912d14421c4a110aafea740cdc29 Mon Sep 17 00:00:00 2001
From: Carlos Villela <cvillela@nvidia.com>
Date: Sat, 11 Jul 2026 10:07:15 -0700
Subject: [PATCH 39/45] fix(destroy): preserve gateway runtime evidence

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
---
 .../destroy-gateway-runtime-evidence.test.ts  | 90 +++++++++++++++++++
 .../actions/sandbox/destroy-gateway.test.ts   |  2 +
 src/lib/actions/sandbox/destroy-gateway.ts    |  2 +
 src/lib/onboard/host-gateway-process.ts       |  9 +-
 4 files changed, 102 insertions(+), 1 deletion(-)
 create mode 100644 src/lib/actions/sandbox/destroy-gateway-runtime-evidence.test.ts

diff --git a/src/lib/actions/sandbox/destroy-gateway-runtime-evidence.test.ts b/src/lib/actions/sandbox/destroy-gateway-runtime-evidence.test.ts
new file mode 100644
index 00000000000..923290970e7
--- /dev/null
+++ b/src/lib/actions/sandbox/destroy-gateway-runtime-evidence.test.ts
@@ -0,0 +1,90 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  dockerRemoveVolumesByPrefix: vi.fn(),
+  spawnSync: vi.fn(),
+  stopStaleDashboardListeners: vi.fn(),
+}));
+
+vi.mock("node:child_process", () => ({
+  spawnSync: mocks.spawnSync,
+}));
+vi.mock("../../adapters/docker/volume", () => ({
+  dockerRemoveVolumesByPrefix: mocks.dockerRemoveVolumesByPrefix,
+}));
+vi.mock("../../onboard/stale-gateway-cleanup", () => ({
+  stopStaleDashboardListeners: mocks.stopStaleDashboardListeners,
+}));
+
+import { cleanupGatewayAfterLastSandbox } from "./destroy-gateway";
+
+describe("cleanupGatewayAfterLastSandbox runtime evidence", () => {
+  const originalStateDir = process.env.NEMOCLAW_OPENSHELL_GATEWAY_STATE_DIR;
+  let stateDir: string | undefined;
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+    vi.clearAllMocks();
+    if (stateDir) fs.rmSync(stateDir, { force: true, recursive: true });
+    stateDir = undefined;
+    if (originalStateDir === undefined) {
+      delete process.env.NEMOCLAW_OPENSHELL_GATEWAY_STATE_DIR;
+    } else {
+      process.env.NEMOCLAW_OPENSHELL_GATEWAY_STATE_DIR = originalStateDir;
+    }
+  });
+
+  it("preserves unverifiable PID evidence so final cleanup can converge on retry (#4662)", () => {
+    const pid = 456;
+    let pidIsAlive = true;
+    stateDir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-destroy-gateway-evidence-"));
+    const pidFile = path.join(stateDir, "openshell-gateway.pid");
+    const runtimeMarker = path.join(stateDir, "runtime.json");
+    fs.writeFileSync(pidFile, `${pid}\n`);
+    fs.writeFileSync(runtimeMarker, '{"evidence":"keep-until-safe"}\n');
+    process.env.NEMOCLAW_OPENSHELL_GATEWAY_STATE_DIR = stateDir;
+    vi.spyOn(process, "platform", "get").mockReturnValue("linux");
+    mocks.spawnSync.mockImplementation((command: string, args: string[]) => {
+      const argv = args.map(String);
+      if (command === "ps" && argv.join(" ") === `-p ${pid} -o pid=`) {
+        return {
+          status: pidIsAlive ? 0 : 1,
+          stdout: pidIsAlive ? `${pid}\n` : "",
+          stderr: "",
+        };
+      }
+      if (command === "ps" && argv.join(" ") === `-p ${pid} -o args=`) {
+        return { status: 0, stdout: "unrelated process\n", stderr: "" };
+      }
+      return { status: 1, stdout: "", stderr: "" };
+    });
+    const runOpenshell = vi.fn(() => ({ status: 0, stdout: "", stderr: "" }));
+
+    expect(() => cleanupGatewayAfterLastSandbox("nemoclaw-8081", runOpenshell)).toThrow(
+      /PID-file process\(es\) 456.*do not prove ownership/,
+    );
+    expect(fs.readFileSync(pidFile, "utf-8")).toBe(`${pid}\n`);
+    expect(fs.readFileSync(runtimeMarker, "utf-8")).toContain("keep-until-safe");
+    expect(mocks.dockerRemoveVolumesByPrefix).not.toHaveBeenCalled();
+
+    pidIsAlive = false;
+    expect(() => cleanupGatewayAfterLastSandbox("nemoclaw-8081", runOpenshell)).not.toThrow();
+    expect(fs.existsSync(pidFile)).toBe(false);
+    expect(fs.existsSync(runtimeMarker)).toBe(false);
+    expect(runOpenshell).toHaveBeenCalledWith(["gateway", "remove", "nemoclaw-8081"], {
+      ignoreError: true,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    expect(mocks.dockerRemoveVolumesByPrefix).toHaveBeenCalledWith(
+      "openshell-cluster-nemoclaw-8081",
+      { ignoreError: true },
+    );
+  });
+});
diff --git a/src/lib/actions/sandbox/destroy-gateway.test.ts b/src/lib/actions/sandbox/destroy-gateway.test.ts
index 51e562eb2ae..ac47fe5d7fd 100644
--- a/src/lib/actions/sandbox/destroy-gateway.test.ts
+++ b/src/lib/actions/sandbox/destroy-gateway.test.ts
@@ -64,6 +64,7 @@ describe("cleanupGatewayAfterLastSandbox", () => {
         pidFile: path.join(stateDir, "openshell-gateway.pid"),
         openShellGatewayName: "nemoclaw-8081",
         openShellGatewayPort: 8081,
+        preserveRuntimeFilesOnNonMatching: true,
       },
     );
     expect(runOpenshell).toHaveBeenCalledWith(["gateway", "remove", "nemoclaw-8081"], {
@@ -100,6 +101,7 @@ describe("cleanupGatewayAfterLastSandbox", () => {
         pidFile: path.join(stateDir, "openshell-gateway.pid"),
         openShellGatewayName: "nemoclaw-8081",
         openShellGatewayPort: 8081,
+        preserveRuntimeFilesOnNonMatching: true,
       },
     );
     expect(runOpenshell).toHaveBeenCalledWith(["gateway", "remove", "nemoclaw-8081"], {
diff --git a/src/lib/actions/sandbox/destroy-gateway.ts b/src/lib/actions/sandbox/destroy-gateway.ts
index cdfe46bba8b..f5d2b02efcc 100644
--- a/src/lib/actions/sandbox/destroy-gateway.ts
+++ b/src/lib/actions/sandbox/destroy-gateway.ts
@@ -100,10 +100,12 @@ export function cleanupGatewayAfterLastSandbox(
     const stopOptions: {
       openShellGatewayName?: string;
       openShellGatewayPort?: number;
+      preserveRuntimeFilesOnNonMatching: true;
       usePgrepFallback: false;
       stateDir?: string;
       pidFile?: string;
     } = {
+      preserveRuntimeFilesOnNonMatching: true,
       usePgrepFallback: false,
     };
     if (perGatewayState) {
diff --git a/src/lib/onboard/host-gateway-process.ts b/src/lib/onboard/host-gateway-process.ts
index 611217c5d8e..af72f53fdde 100644
--- a/src/lib/onboard/host-gateway-process.ts
+++ b/src/lib/onboard/host-gateway-process.ts
@@ -39,6 +39,8 @@ export interface StopHostGatewayOptions {
   pids?: Iterable<number>;
   pidFile?: string;
   pollIntervalMs?: number;
+  /** Keep PID/runtime evidence when a PID-file process does not match the cleanup target. */
+  preserveRuntimeFilesOnNonMatching?: boolean;
   stateDir?: string;
   termWaitMs?: number;
   /** Whether to read and act on the resolved pid file. */
@@ -324,7 +326,12 @@ export function stopHostGatewayProcesses(
       )
     ) {
       result.skippedNonMatchingPids.push(pid);
-      if (clearRuntimeState && sources.has("pid-file") && !clearedRuntimeFiles) {
+      if (
+        clearRuntimeState &&
+        !options.preserveRuntimeFilesOnNonMatching &&
+        sources.has("pid-file") &&
+        !clearedRuntimeFiles
+      ) {
         clearRuntimeFiles(pidFile, stateDir);
         clearedRuntimeFiles = true;
       }

From 3174d610576dbeaed4ff19a5befa6bf04850d538 Mon Sep 17 00:00:00 2001
From: Carlos Villela <cvillela@nvidia.com>
Date: Sat, 11 Jul 2026 10:11:12 -0700
Subject: [PATCH 40/45] test(destroy): keep gateway retry fixture linear

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
---
 .../destroy-gateway-runtime-evidence.test.ts  | 44 +++++++++----------
 1 file changed, 21 insertions(+), 23 deletions(-)

diff --git a/src/lib/actions/sandbox/destroy-gateway-runtime-evidence.test.ts b/src/lib/actions/sandbox/destroy-gateway-runtime-evidence.test.ts
index 923290970e7..75704a12a63 100644
--- a/src/lib/actions/sandbox/destroy-gateway-runtime-evidence.test.ts
+++ b/src/lib/actions/sandbox/destroy-gateway-runtime-evidence.test.ts
@@ -5,7 +5,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
-import { afterEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 const mocks = vi.hoisted(() => ({
   dockerRemoveVolumesByPrefix: vi.fn(),
@@ -26,45 +26,43 @@ vi.mock("../../onboard/stale-gateway-cleanup", () => ({
 import { cleanupGatewayAfterLastSandbox } from "./destroy-gateway";
 
 describe("cleanupGatewayAfterLastSandbox runtime evidence", () => {
-  const originalStateDir = process.env.NEMOCLAW_OPENSHELL_GATEWAY_STATE_DIR;
-  let stateDir: string | undefined;
+  let stateDir: string;
+
+  beforeEach(() => {
+    stateDir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-destroy-gateway-evidence-"));
+    vi.stubEnv("NEMOCLAW_OPENSHELL_GATEWAY_STATE_DIR", stateDir);
+  });
 
   afterEach(() => {
     vi.restoreAllMocks();
     vi.clearAllMocks();
-    if (stateDir) fs.rmSync(stateDir, { force: true, recursive: true });
-    stateDir = undefined;
-    if (originalStateDir === undefined) {
-      delete process.env.NEMOCLAW_OPENSHELL_GATEWAY_STATE_DIR;
-    } else {
-      process.env.NEMOCLAW_OPENSHELL_GATEWAY_STATE_DIR = originalStateDir;
-    }
+    vi.unstubAllEnvs();
+    fs.rmSync(stateDir, { force: true, recursive: true });
   });
 
   it("preserves unverifiable PID evidence so final cleanup can converge on retry (#4662)", () => {
     const pid = 456;
     let pidIsAlive = true;
-    stateDir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-destroy-gateway-evidence-"));
     const pidFile = path.join(stateDir, "openshell-gateway.pid");
     const runtimeMarker = path.join(stateDir, "runtime.json");
     fs.writeFileSync(pidFile, `${pid}\n`);
     fs.writeFileSync(runtimeMarker, '{"evidence":"keep-until-safe"}\n');
-    process.env.NEMOCLAW_OPENSHELL_GATEWAY_STATE_DIR = stateDir;
     vi.spyOn(process, "platform", "get").mockReturnValue("linux");
-    mocks.spawnSync.mockImplementation((command: string, args: string[]) => {
-      const argv = args.map(String);
-      if (command === "ps" && argv.join(" ") === `-p ${pid} -o pid=`) {
-        return {
+    const missingProcess = () => ({ status: 1, stdout: "", stderr: "" });
+    const processResponses = new Map([
+      [
+        `ps -p ${pid} -o pid=`,
+        () => ({
           status: pidIsAlive ? 0 : 1,
           stdout: pidIsAlive ? `${pid}\n` : "",
           stderr: "",
-        };
-      }
-      if (command === "ps" && argv.join(" ") === `-p ${pid} -o args=`) {
-        return { status: 0, stdout: "unrelated process\n", stderr: "" };
-      }
-      return { status: 1, stdout: "", stderr: "" };
-    });
+        }),
+      ],
+      [`ps -p ${pid} -o args=`, () => ({ status: 0, stdout: "unrelated process\n", stderr: "" })],
+    ]);
+    mocks.spawnSync.mockImplementation((command: string, args: string[]) =>
+      (processResponses.get(`${command} ${args.map(String).join(" ")}`) ?? missingProcess)(),
+    );
     const runOpenshell = vi.fn(() => ({ status: 0, stdout: "", stderr: "" }));
 
     expect(() => cleanupGatewayAfterLastSandbox("nemoclaw-8081", runOpenshell)).toThrow(

From 31627852ff89c9fb531ab2b0eac78014caf06d78 Mon Sep 17 00:00:00 2001
From: Carlos Villela <cvillela@nvidia.com>
Date: Sat, 11 Jul 2026 10:19:30 -0700
Subject: [PATCH 41/45] fix(destroy): honor non-interactive confirmation

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
---
 src/lib/actions/sandbox/destroy-flow.test.ts |  1 +
 src/lib/domain/lifecycle/options.test.ts     | 17 ++++++++++++++++-
 src/lib/domain/lifecycle/options.ts          |  5 ++++-
 3 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/src/lib/actions/sandbox/destroy-flow.test.ts b/src/lib/actions/sandbox/destroy-flow.test.ts
index 03c39abe45e..bec01254404 100644
--- a/src/lib/actions/sandbox/destroy-flow.test.ts
+++ b/src/lib/actions/sandbox/destroy-flow.test.ts
@@ -66,6 +66,7 @@ describe("destroySandbox flow", () => {
 
     await expect(harness.destroySandbox("alpha", options)).resolves.toBeUndefined();
 
+    expect(harness.promptSpy).not.toHaveBeenCalled();
     expect(harness.cleanupGatewaySpy.mock.calls).toEqual(
       cleanupExpected ? [["nemoclaw-19080", harness.runOpenshellSpy]] : [],
     );
diff --git a/src/lib/domain/lifecycle/options.test.ts b/src/lib/domain/lifecycle/options.test.ts
index a58fcd489ad..8bb7b530952 100644
--- a/src/lib/domain/lifecycle/options.test.ts
+++ b/src/lib/domain/lifecycle/options.test.ts
@@ -1,7 +1,7 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 import {
   normalizeDestroySandboxOptions,
@@ -11,6 +11,14 @@ import {
 } from "./options";
 
 describe("lifecycle option normalization", () => {
+  beforeEach(() => {
+    vi.stubEnv("NEMOCLAW_NON_INTERACTIVE", "");
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
   it("preserves typed destroy options and still accepts compatibility argv", () => {
     expect(normalizeDestroySandboxOptions({ yes: true })).toEqual({ yes: true });
     expect(normalizeDestroySandboxOptions(["--yes", "--force"])).toEqual({
@@ -19,6 +27,13 @@ describe("lifecycle option normalization", () => {
     });
   });
 
+  it("normalizes the shared non-interactive environment into destroy confirmation", () => {
+    vi.stubEnv("NEMOCLAW_NON_INTERACTIVE", "1");
+
+    expect(normalizeDestroySandboxOptions([])).toEqual({ force: false, yes: true });
+    expect(normalizeDestroySandboxOptions({})).toEqual({ yes: true });
+  });
+
   describe("destroy cleanupGateway resolution (#2166)", () => {
     const ENV_KEY = "NEMOCLAW_CLEANUP_GATEWAY";
     let original: string | undefined;
diff --git a/src/lib/domain/lifecycle/options.ts b/src/lib/domain/lifecycle/options.ts
index 2a8e6059c62..93572fa0da4 100644
--- a/src/lib/domain/lifecycle/options.ts
+++ b/src/lib/domain/lifecycle/options.ts
@@ -1,6 +1,7 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
+import { isNonInteractiveEnv } from "../../core/non-interactive";
 import {
   DCODE_AUTO_APPROVAL_MODES,
   type DcodeAutoApprovalMode,
@@ -61,6 +62,7 @@ export function normalizeDestroySandboxOptions(
   options: string[] | DestroySandboxOptions = {},
 ): DestroySandboxOptions {
   const envCleanupGateway = readCleanupGatewayEnv();
+  const nonInteractive = isNonInteractiveEnv();
   if (Array.isArray(options)) {
     const yesIdx = options.lastIndexOf("--cleanup-gateway");
     const noIdx = options.lastIndexOf("--no-cleanup-gateway");
@@ -68,12 +70,13 @@ export function normalizeDestroySandboxOptions(
       yesIdx === -1 && noIdx === -1 ? envCleanupGateway : yesIdx > noIdx;
     return {
       force: options.includes("--force"),
-      yes: options.includes("--yes"),
+      yes: options.includes("--yes") || nonInteractive,
       ...(cleanupGateway === undefined ? {} : { cleanupGateway }),
     };
   }
   return {
     ...options,
+    ...(nonInteractive ? { yes: true } : {}),
     ...(options.cleanupGateway === undefined && envCleanupGateway !== undefined
       ? { cleanupGateway: envCleanupGateway }
       : {}),

From 3d4e84b2d702258809132b371854221223af4b41 Mon Sep 17 00:00:00 2001
From: Carlos Villela <cvillela@nvidia.com>
Date: Sat, 11 Jul 2026 10:21:39 -0700
Subject: [PATCH 42/45] fix(destroy): surface Docker cleanup probe failures

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
---
 src/lib/actions/sandbox/destroy-gateway-cleanup.test.ts | 4 ++--
 src/lib/actions/sandbox/destroy-gateway-cleanup.ts      | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/lib/actions/sandbox/destroy-gateway-cleanup.test.ts b/src/lib/actions/sandbox/destroy-gateway-cleanup.test.ts
index 6b7096117be..85e69d9d10b 100644
--- a/src/lib/actions/sandbox/destroy-gateway-cleanup.test.ts
+++ b/src/lib/actions/sandbox/destroy-gateway-cleanup.test.ts
@@ -108,7 +108,7 @@ describe("shouldCleanupGatewayAfterConfirmedFinalDestroy", () => {
   });
 
   it("records failed Docker probes as fail-closed snapshots", () => {
-    const debug = vi.spyOn(console, "debug").mockImplementation(() => undefined);
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => undefined);
     const snapshot = collectLiveSandboxProbeSnapshot({
       captureOpenshell: () => ({
         status: 0,
@@ -126,7 +126,7 @@ describe("shouldCleanupGatewayAfterConfirmedFinalDestroy", () => {
       output: "",
       probeFailed: true,
     });
-    expect(debug).toHaveBeenCalledWith(
+    expect(warn).toHaveBeenCalledWith(
       "Docker container probe failed for sandbox 'npmtest'; preserving shared gateway: Error: docker unavailable",
     );
   });
diff --git a/src/lib/actions/sandbox/destroy-gateway-cleanup.ts b/src/lib/actions/sandbox/destroy-gateway-cleanup.ts
index 431d68e0ed8..d6d2fc7ed4e 100644
--- a/src/lib/actions/sandbox/destroy-gateway-cleanup.ts
+++ b/src/lib/actions/sandbox/destroy-gateway-cleanup.ts
@@ -93,7 +93,7 @@ export function collectLiveSandboxProbeSnapshot(
       // destroy-gateway-cleanup.test.ts locks this fail-closed behavior. Remove
       // it only when final cleanup has one authoritative sandbox/container state
       // source; see the OpenShell listener-removal boundary tracked in #6639.
-      console.debug(
+      console.warn(
         `Docker container probe failed for sandbox '${sandboxName}'; preserving shared gateway: ${String(error)}`,
       );
       dockerContainersBySandboxName.set(sandboxName, { output: "", probeFailed: true });

From d8a443781eba475a5a6d9fc8a318346fa1af5135 Mon Sep 17 00:00:00 2001
From: Carlos Villela <cvillela@nvidia.com>
Date: Sat, 11 Jul 2026 10:25:17 -0700
Subject: [PATCH 43/45] docs(destroy): document unattended cleanup failures

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
---
 docs/reference/commands.mdx | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/docs/reference/commands.mdx b/docs/reference/commands.mdx
index 75cdab030be..416260dce42 100644
--- a/docs/reference/commands.mdx
+++ b/docs/reference/commands.mdx
@@ -1506,7 +1506,7 @@ If you want to upgrade the sandbox while preserving state, use `$$nemoclaw <name
 </Warning>
 
 If another terminal has an active SSH session to the sandbox, `destroy` prints an active-session warning and requires a second confirmation before it proceeds.
-Pass `--yes`, `-y`, or `--force` to skip the prompt in scripted workflows.
+Pass `--yes`, `-y`, or `--force`, or set `NEMOCLAW_NON_INTERACTIVE=1`, to authorize deletion without prompting in scripted workflows.
 
 <AgentOnly variant="hermes">
 
@@ -1526,6 +1526,9 @@ Pass `--cleanup-gateway` to force removal, or `--no-cleanup-gateway` to force pr
 These flags always override both `NEMOCLAW_CLEANUP_GATEWAY` and the platform default.
 If the pre-delete workspace wipe cannot run, use a different sandbox name for a clean start.
 Cleaning up the gateway after the last sandbox also purges the shared cluster volume that retains the per-name persistent volume.
+If final gateway cleanup finds a live PID-file process whose command line does not prove it owns the target gateway, `destroy` exits non-zero after sandbox and registry deletion and skips gateway and volume removal.
+NemoClaw preserves the per-gateway PID file and runtime marker so you can inspect the process.
+Stop only the listener that matches the target gateway, then rerun `destroy` to converge cleanup.
 If the OpenShell gateway is unreachable and the sandbox has no managed MCP ownership state, `--force` removes only NemoClaw's local registry entry and local artifacts.
 Gateway-side deletion remains unconfirmed, shared host-service and gateway teardown are skipped, and the sandbox and retained volume may still exist if the gateway returns.
 Start the gateway with `$$nemoclaw <name> status` and retry destroy when you need a confirmed deletion.

From 934c50679c5825b5c2b48e244ae726043da0ad8f Mon Sep 17 00:00:00 2001
From: Carlos Villela <cvillela@nvidia.com>
Date: Sat, 11 Jul 2026 10:28:35 -0700
Subject: [PATCH 44/45] fix(destroy): reject untargeted gateway process
 identity

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
---
 .../destroy-gateway-runtime-evidence.test.ts  |  6 +++++-
 src/lib/onboard/gateway-process-identity.ts   |  5 +++++
 .../host-gateway-process-target.test.ts       | 21 ++++++++++++++++---
 3 files changed, 28 insertions(+), 4 deletions(-)

diff --git a/src/lib/actions/sandbox/destroy-gateway-runtime-evidence.test.ts b/src/lib/actions/sandbox/destroy-gateway-runtime-evidence.test.ts
index 75704a12a63..4639f645cee 100644
--- a/src/lib/actions/sandbox/destroy-gateway-runtime-evidence.test.ts
+++ b/src/lib/actions/sandbox/destroy-gateway-runtime-evidence.test.ts
@@ -58,7 +58,7 @@ describe("cleanupGatewayAfterLastSandbox runtime evidence", () => {
           stderr: "",
         }),
       ],
-      [`ps -p ${pid} -o args=`, () => ({ status: 0, stdout: "unrelated process\n", stderr: "" })],
+      [`ps -p ${pid} -o args=`, () => ({ status: 0, stdout: "openclaw-gateway\n", stderr: "" })],
     ]);
     mocks.spawnSync.mockImplementation((command: string, args: string[]) =>
       (processResponses.get(`${command} ${args.map(String).join(" ")}`) ?? missingProcess)(),
@@ -70,6 +70,10 @@ describe("cleanupGatewayAfterLastSandbox runtime evidence", () => {
     );
     expect(fs.readFileSync(pidFile, "utf-8")).toBe(`${pid}\n`);
     expect(fs.readFileSync(runtimeMarker, "utf-8")).toContain("keep-until-safe");
+    expect(runOpenshell).not.toHaveBeenCalledWith(
+      ["gateway", "remove", "nemoclaw-8081"],
+      expect.anything(),
+    );
     expect(mocks.dockerRemoveVolumesByPrefix).not.toHaveBeenCalled();
 
     pidIsAlive = false;
diff --git a/src/lib/onboard/gateway-process-identity.ts b/src/lib/onboard/gateway-process-identity.ts
index 05553284765..4f221fe186c 100644
--- a/src/lib/onboard/gateway-process-identity.ts
+++ b/src/lib/onboard/gateway-process-identity.ts
@@ -62,6 +62,11 @@ export function gatewayProcessCmdlineMatches(
         requireExpectedFlags: false,
       });
     }
+    if (base === "openclaw-gateway") {
+      return openShellGatewayMatchesTarget(tokens, opts.expectedOpenShellGateway, {
+        requireExpectedFlags: true,
+      });
+    }
     return true;
   }
   if (
diff --git a/src/lib/onboard/host-gateway-process-target.test.ts b/src/lib/onboard/host-gateway-process-target.test.ts
index c7d3b2a3828..80d23009608 100644
--- a/src/lib/onboard/host-gateway-process-target.test.ts
+++ b/src/lib/onboard/host-gateway-process-target.test.ts
@@ -53,7 +53,7 @@ function psResponses(
   ];
 }
 
-function stopTargetedPid(pid: number, cmdline: string) {
+function stopTargetedPid(pid: number, cmdline: string, targeted = true) {
   const stateDir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-host-gateway-target-"));
   const pidFile = path.join(stateDir, "openshell-gateway.pid");
   fs.writeFileSync(pidFile, `${pid}\n`);
@@ -80,8 +80,7 @@ function stopTargetedPid(pid: number, cmdline: string) {
       log: vi.fn(),
     },
     {
-      openShellGatewayName: "nemoclaw-8081",
-      openShellGatewayPort: 8081,
+      ...(targeted ? { openShellGatewayName: "nemoclaw-8081", openShellGatewayPort: 8081 } : {}),
       stateDir,
     },
   );
@@ -112,6 +111,22 @@ describe("stopHostGatewayProcesses target filtering", () => {
     expect(fs.existsSync(pidFile)).toBe(false);
   });
 
+  it("skips a bare openclaw-gateway process when cleanup supplies a target", () => {
+    const { kill, pidFile, result } = stopTargetedPid(9999560, "openclaw-gateway\n");
+
+    expect(result.skippedNonMatchingPids).toEqual([9999560]);
+    expect(kill).not.toHaveBeenCalled();
+    expect(fs.existsSync(pidFile)).toBe(false);
+  });
+
+  it("keeps legacy openclaw-gateway matching when cleanup has no target", () => {
+    const { kill, pidFile, result } = stopTargetedPid(9999561, "openclaw-gateway\n", false);
+
+    expect(result.stopped).toEqual([9999561]);
+    expect(kill).toHaveBeenCalledWith(9999561, "SIGTERM");
+    expect(fs.existsSync(pidFile)).toBe(false);
+  });
+
   it("accepts the owned no-argument host launch for the cleanup target", () => {
     const { kill, pidFile, result } = stopTargetedPid(
       9999555,

From f88f8c04c794aceff5ccc61bb16d09a5ab527bcd Mon Sep 17 00:00:00 2001
From: Carlos Villela <cvillela@nvidia.com>
Date: Sat, 11 Jul 2026 10:50:19 -0700
Subject: [PATCH 45/45] ci(macos): preserve final-destroy diagnostics

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
---
 .github/workflows/macos-e2e.yaml             | 10 ++++++++++
 src/lib/actions/sandbox/destroy-flow.test.ts | 17 ++++++++++++-----
 test/macos-e2e-workflow-boundary.test.ts     | 15 ++++++++++++---
 3 files changed, 34 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/macos-e2e.yaml b/.github/workflows/macos-e2e.yaml
index 5f22cffb6f1..55f9b741b00 100644
--- a/.github/workflows/macos-e2e.yaml
+++ b/.github/workflows/macos-e2e.yaml
@@ -184,3 +184,13 @@ jobs:
           npx vitest run --project e2e-live \
             test/e2e/live/sandbox-operations.test.ts \
             --silent=false --reporter=default
+
+      - name: Upload macOS Docker logs on failure
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: macos-docker-final-destroy-logs
+          path: |
+            /tmp/nemoclaw-e2e-*.log
+            ${{ github.workspace }}/e2e-artifacts/live
+          if-no-files-found: ignore
diff --git a/src/lib/actions/sandbox/destroy-flow.test.ts b/src/lib/actions/sandbox/destroy-flow.test.ts
index bec01254404..7e3c1694d13 100644
--- a/src/lib/actions/sandbox/destroy-flow.test.ts
+++ b/src/lib/actions/sandbox/destroy-flow.test.ts
@@ -56,11 +56,18 @@ describe("destroySandbox flow", () => {
   });
 
   it.each([
-    ["--yes", { yes: true }, "", true],
-    ["NEMOCLAW_NON_INTERACTIVE=1", {}, "1", true],
-    ["an explicit preservation override", { yes: true, cleanupGateway: false }, "", false],
-  ] as const)("applies the macOS final-gateway default for %s (#4662)", async (_scenario, options, nonInteractive, cleanupExpected) => {
-    vi.spyOn(process, "platform", "get").mockReturnValue("darwin");
+    ["--yes", "darwin", { yes: true }, "", true],
+    ["NEMOCLAW_NON_INTERACTIVE=1", "darwin", {}, "1", true],
+    [
+      "an explicit preservation override",
+      "darwin",
+      { yes: true, cleanupGateway: false },
+      "",
+      false,
+    ],
+    ["NEMOCLAW_NON_INTERACTIVE=1", "linux", {}, "1", false],
+  ] as const)("applies the final-gateway default for %s on %s (#4662)", async (_scenario, platform, options, nonInteractive, cleanupExpected) => {
+    vi.spyOn(process, "platform", "get").mockReturnValue(platform);
     vi.stubEnv("NEMOCLAW_NON_INTERACTIVE", nonInteractive);
     const harness = createDestroyHarness();
 
diff --git a/test/macos-e2e-workflow-boundary.test.ts b/test/macos-e2e-workflow-boundary.test.ts
index bdd60cc2393..c030f129977 100644
--- a/test/macos-e2e-workflow-boundary.test.ts
+++ b/test/macos-e2e-workflow-boundary.test.ts
@@ -78,16 +78,25 @@ describe("macOS E2E workflow boundary", () => {
     expect(String(docker.env?.LIMA_START_ARGS)).toContain("--cpus 4 --memory 8");
     expect(live.run).toContain("test/e2e/live/sandbox-operations.test.ts");
     expect(live.env?.NEMOCLAW_NON_INTERACTIVE).toBe("1");
-    expect(job.steps?.some((step) => step.uses?.startsWith("actions/upload-artifact@"))).toBe(
-      false,
-    );
   });
 
   it("uploads live macOS E2E artifacts when the workflow fails", () => {
     const upload = stepNamed("Upload logs on failure");
+    const dockerUpload = stepNamed(
+      "Upload macOS Docker logs on failure",
+      "macos-docker-final-destroy",
+    );
+
     expect(upload.if).toBe("failure() && github.event_name == 'pull_request'");
     expect(String(upload.with?.path)).toContain("/tmp/nemoclaw-e2e-*.log");
     expect(String(upload.with?.path)).toContain("${{ github.workspace }}/e2e-artifacts/live");
+
+    expect(dockerUpload.if).toBe("failure()");
+    expect(dockerUpload.uses).toBe(
+      "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a",
+    );
+    expect(String(dockerUpload.with?.path)).toContain("/tmp/nemoclaw-e2e-*.log");
+    expect(String(dockerUpload.with?.path)).toContain("${{ github.workspace }}/e2e-artifacts/live");
   });
 
   it("bounds the fast and real-Docker macOS jobs independently", () => {