fix(sandbox): retain llama.cpp cleanup authority

docs/inference/set-up-llama-cpp.mdx

@@ -295,9 +295,73 @@ Run:
 $$nemoclaw my-assistant destroy
 ```
 
+Although the setup steps above target DGX Spark, this removal and recovery behavior also applies to other experimental managed llama.cpp profiles on Linux.
+NemoClaw qualifies the Docker operation authority recorded during managed llama.cpp onboarding.
+It completes this qualification before it requests sandbox deletion or reconciles an already-absent sandbox.
+This authority includes Docker endpoint selection and identity, Docker executable identity, and command environment.
+When cleanup relies on private managed llama.cpp state, NemoClaw proves Docker availability and the exact container and network before OpenShell sandbox deletion.
+It retains the identity of that private lifecycle state across sandbox deletion and rejects cleanup if the identity changes.
+If any pre-delete proof fails, NemoClaw reports the error and stops the destroy operation.
+
+If the reported Docker operation authority mismatch involves endpoint selection, inspect the current Docker configuration and selectors:
+
+```bash
+docker context show
+printf 'DOCKER_CONFIG=%s\n' "${DOCKER_CONFIG:-<unset>}"
+printf 'DOCKER_CONTEXT=%s\n' "${DOCKER_CONTEXT:-<unset>}"
+printf 'DOCKER_HOST=%s\n' "${DOCKER_HOST:-<unset>}"
+printf 'DOCKER_TLS=%s\n' "${DOCKER_TLS:-<unset>}"
+printf 'DOCKER_TLS_VERIFY=%s\n' "${DOCKER_TLS_VERIFY:-<unset>}"
+printf 'DOCKER_CERT_PATH=%s\n' "${DOCKER_CERT_PATH:-<unset>}"
+```
+
+Compare this output with the shell or automation that ran onboarding.
+Restore the configuration and selection used during onboarding with the matching path:
+
+- If onboarding used a custom `DOCKER_CONFIG` directory, restore it first:
+
+  ```bash
+  export DOCKER_CONFIG="<onboarding-docker-config>"
+  ```
+
+  If onboarding used Docker's default configuration directory, unset `DOCKER_CONFIG`.
+
+- If onboarding used `DOCKER_CONTEXT` or Docker's persisted current context, select the original context explicitly:
+
+  ```bash
+  unset DOCKER_HOST
+  export DOCKER_CONTEXT="<onboarding-context>"
+  ```
+
+- If onboarding used `DOCKER_HOST`, restore that selection:
+
+  ```bash
+  unset DOCKER_CONTEXT
+  export DOCKER_HOST="<onboarding-docker-host>"
+  ```
+
+For either selection path, restore `DOCKER_TLS`, `DOCKER_TLS_VERIFY`, and `DOCKER_CERT_PATH` to their onboarding state.
+Unset each TLS variable that was unset or empty during onboarding.
+These variables are part of the endpoint-selection tuple for both Docker contexts and `DOCKER_HOST`.
+
+After restoring the recorded Docker configuration and selector, run `docker info`.
+Confirm that it reports the Docker daemon used during onboarding.
+Rerun the earlier `destroy` command.
+
+NemoClaw stores opaque authority identity and binding data, not the original Docker executable or command environment values.
+For any other authority mismatch, do not guess Docker selector values.
+Retry the earlier `destroy` command from the same shell or automation environment that ran onboarding.
 After OpenShell confirms sandbox deletion, the command removes the exact managed llama.cpp container, internal network, API key, and gateway-scoped ownership state.
 It preserves `~/.cache/huggingface/` because other applications can use that cache.
-If exact cleanup fails, NemoClaw preserves the sandbox registry entry and ownership state for a retry.
+If exact cleanup fails, NemoClaw preserves the ownership state and any existing sandbox registry entry for a retry.
+
+After `destroy` succeeds, run:
+
+```bash
+$$nemoclaw list
+```
+
+Confirm that `my-assistant` no longer appears.
 
 For full NemoClaw removal, run `$$nemoclaw uninstall`.
 Full uninstall applies the same exact-ownership checks and preserves the shared Hugging Face cache by default.

src/lib/actions/sandbox/destroy-execution.ts

@@ -597,7 +597,6 @@ export async function executeSandboxDestroy({
           current,
           hostLocalInferenceAuthority,
           listSandboxes!().sandboxes,
-          deps.hostLocalInferenceLifecycleOptions,
         );
         commonLlamaCppAuthorityRetired =
           hostLocalInferenceAuthority.receipt.service === "llama-cpp";