fix(messaging): activate Google Chat pairing approval

docs/manage-sandboxes/set-up-google-chat.mdx

@@ -172,6 +172,19 @@ The re-add flow prompts for the service-account JSON again when it is not alread
 ## Verify the Channel
 
 After the rebuild, send a direct message from an allowed or paired account and confirm that OpenClaw replies.
+If an unknown sender receives a pairing code, approve it through the registered OpenClaw sandbox that has a selected owning managed gateway:
+
+```bash
+nemoclaw my-assistant exec -- openclaw pairing approve googlechat <code>
+```
+
+After OpenClaw commits the sender to its owner allowlist, NemoClaw verifies the mutable config permissions and automatically restarts that selected gateway.
+An exit status of `0` means activation completed, so the sender's next message should receive a reply without another manual restart.
+If permission cleanup or gateway restart fails after the approval commits, `exec` exits with status `1` and reports that the approval was not rolled back.
+For a selected owning gateway, it prints the managed recovery command; correct any reported permission problem, then run `nemoclaw my-assistant gateway restart` before testing the next message.
+If no owning managed gateway is registered, NemoClaw does not attempt activation or print that command; register and select the sandbox's owning gateway before recovery.
+Do not submit the pairing code again unless OpenClaw reports that it was not accepted.
+
 If the webhook returns an error, verify that the public endpoint still ends in `/googlechat`, the dedicated tunnel and webhook proxy are running, and the Google Chat API configuration contains the exact same URL.
 
 Refer to [Manage Messaging Channels](manage-messaging-channels) to stop, start, or remove Google Chat after setup.

docs/reference/commands.mdx

@@ -1321,6 +1321,11 @@ When cleanup succeeds, `exec` returns the remote command's exit code.
 If cleanup cannot inspect, restore, or verify that contract, it fails closed and prints `OpenClaw permission cleanup failed (...)` to `stderr`.
 In that case, `exec` returns the cleanup failure instead of the remote command's status.
 
+For a registered OpenClaw sandbox with a selected owning managed gateway, a successful direct `openclaw pairing approve googlechat <code>` command also restarts that gateway after cleanup so the new sender allowlist applies to the next message.
+If cleanup or restart fails after the approval commits, `exec` exits with status `1` and reports that the approval was not rolled back.
+When an owning gateway was selected, correct any reported cleanup problem, then run `$$nemoclaw <name> gateway restart` before testing the next message.
+Without an owning managed gateway, NemoClaw does not attempt activation or print a managed restart command; unregistered and non-OpenClaw sandboxes also do not receive the automatic restart.
+
 </AgentOnly>
 <AgentOnly variant="hermes">
 
@@ -2148,6 +2153,11 @@ After the remote command exits, NemoClaw verifies and, when needed, restores the
 When cleanup succeeds, `exec` preserves the remote command's exit code.
 When cleanup fails closed, `exec` returns the cleanup failure and reports both statuses on `stderr`.
 
+A successful direct `openclaw pairing approve googlechat <code>` command in a registered OpenClaw sandbox with a selected owning managed gateway restarts that gateway after cleanup, so the new sender allowlist applies to the next message.
+If the approval commits but cleanup or restart fails, `exec` exits with status `1` and reports that the approval was not rolled back.
+When an owning gateway was selected, it directs you to run `$$nemoclaw <name> gateway restart` after correcting any cleanup problem.
+Without an owning managed gateway, NemoClaw does not attempt activation or print a managed restart command; unregistered and non-OpenClaw sandboxes do not receive the automatic restart.
+
 </AgentOnly>
 <AgentOnly variant="hermes">