fix(shields): unlock idempotently when config already mutable (#7430)

scripts/openclaw-config-guard.py

@@ -3461,6 +3461,19 @@ def _transition(
                 raise GuardError(exc.code, exc.path, detail) from exc
             raise GuardError("transition-failed", opened.config_path, detail) from exc
 
+    if _is_mutable_dir_posture(opened, identity):
+        # Unlock is idempotent, mirroring the already-locked short-circuits in
+        # the lock branch above. A config already in the exact mutable posture
+        # is the unlock target: on some platforms (DGX Spark/Station, macOS) an
+        # in-sandbox OpenClaw reconciler re-permissions the config back to
+        # sandbox-owned mutable *after* a host lock returns, and a freshly
+        # onboarded or snapshot-restored sandbox boots mutable before the lock
+        # settles. Requiring the locked posture there rejected a legitimate
+        # `shields down` with config-not-locked even though the config already
+        # holds the mutable target posture. Verify the exact mutable file
+        # posture and treat the transition as a no-op instead of failing.
+        _verify_mutable_files(opened, _snapshot_raw_pair(opened), identity)
+        return
     pair = _snapshot_pair(opened)
     _verify_locked_posture(opened, pair, identity, allow_blocking_flags=True)
     snapshots: list[FileSnapshot] = []

test/openclaw-config-guard.test.ts

@@ -414,6 +414,14 @@ describe("openclaw-config-guard", () => {
     expect(fs.readFileSync(hashPath)).toEqual(hashBytes);
   });
 
+  it("unlocks idempotently when the config already holds the mutable posture (#7430)", () => {
+    // An in-sandbox reconciler can leave the config mutable before shields-down; unlock must be a no-op.
+    const { configDir, configPath, hashPath } = fixture();
+    const r = runGuard("unlock", configDir);
+    expect(r.status, JSON.stringify(r.lines)).toBe(0);
+    expect([mode(configDir), mode(configPath), mode(hashPath)]).toEqual([0o2770, 0o660, 0o660]);
+  });
+
   it("fresh-replaces both files on lock and unlock while preserving bytes, times, and xattrs", () => {
     const { root, configDir, configPath, hashPath } = fixture();
     const preservedTime = new Date("2025-01-02T03:04:05.000Z");