Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@bin/lib/onboard.js`:
- Around line 125-130: The destroyGateway function currently calls run(...) with
xargs -r (GNU-only) and swallows all errors via { ignoreError: true } and ||
true; remove the -r flag so xargs is portable on BSD/macOS, and change
destroyGateway (and its two run invocations that reference GATEWAY_NAME) to
propagate success/failure (e.g., return boolean or throw) instead of always
ignoring errors so callers can detect cleanup failures and show the manual
recovery command; update call sites that assume cleanup always succeeded to
check destroyGateway's result and display the manual docker volume rm
instruction when it fails.

In `@scripts/setup.sh`:
- Around line 77-97: The script uses the GNU-only xargs -r flag in the docker
volume removal pipelines (the commands that start with "docker volume ls -q
--filter \"name=openshell-cluster-nemoclaw\" | xargs -r docker volume rm ...")
which breaks on macOS/BSD; remove the -r flag so the pipeline becomes portable,
keeping the surrounding stderr redirection and the existing cleanup flow that
calls openshell gateway destroy -g nemoclaw, docker volume rm, warn and fail
unchanged to preserve behavior when cleanup is needed.
- Around line 80-85: The current check uses the exit of grep on the piped output
to decide success; instead run the openshell gateway start command and capture
both its exit code and output (e.g., capture output into a variable or tee it to
a temp log), then use the actual exit code of openshell (saved into a variable
like start_status or via PIPESTATUS[0]) to decide whether to run the cleanup;
you may still grep the captured output for logging/diagnostics but ensure the
cleanup block (the openshell gateway destroy and docker volume rm calls) is
executed only when the openshell gateway start exit status indicates failure.

In `@test/gateway-cleanup.test.js`:
- Around line 17-62: Tests only check source text and call counts; add an
integration-style test that actually exercises a failed gateway
start/health-check and asserts the cleanup command runs. Create a new test that
launches the real onboarding process (bin/lib/onboard.js or the bin script) via
child_process.spawn or fork with an env var that forces startGateway to fail (or
put a fake docker binary early in PATH that records invocations), wait for the
failure path, and then assert that destroyGateway was invoked by checking
captured stdout/stderr for the docker volume removal command (or that the fake
docker binary was called with "volume rm openshell-cluster") and/or that
remove_related_docker_volumes / uninstall.sh cleanup logic was executed;
reference startGateway, destroyGateway, remove_related_docker_volumes,
onboard.js, uninstall.sh, and scripts/setup.sh so the test locates and exercises
the real cleanup code rather than just matching strings.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@scripts/setup.sh`:
- Around line 117-119: The script currently runs best-effort cleanup commands
(openshell gateway destroy, docker volume rm via docker volume ls | xargs) with
"|| true" then unconditionally calls fail("Stale state removed. Please rerun:
nemoclaw onboard"), which falsely claims success; update the cleanup blocks
around the openshell gateway destroy / docker volume ls | xargs sequences and
the duplicate block later (same pattern) to detect failures instead of
swallowing them: capture each command's exit status (or run them without "||
true"), aggregate any failures, and only emit a success message if all cleanup
steps succeeded — otherwise print a clear "Attempted to remove stale state;
manual recovery steps:" message listing the exact commands that failed (or the
full commands to run manually) and avoid calling fail with the misleading "Stale
state removed..." text.

---

Duplicate comments:
In `@scripts/setup.sh`:
- Around line 115-120: The cleanup branch currently triggers based on the grep
match rather than the actual exit status of the starts command; change the logic
so you run openshell gateway start "${GATEWAY_ARGS[@]}" and check its exit code
(e.g., if ! openshell gateway start ...; then cleanup) instead of relying on the
pipe to grep for "Gateway|✓|Error|error". If you still need to inspect
stdout/stderr for error patterns, capture the command output into a variable (or
a temp file), examine that with grep to log or decide additional actions, but
always use the process exit status of openshell gateway start as the primary
condition for running the cleanup steps that reference openshell gateway destroy
and docker volume rm.
- Line 112: The xargs -r usage in the docker volume cleanup commands (the lines
invoking "docker volume ls -q --filter \"name=openshell-cluster-nemoclaw\" |
xargs -r docker volume rm") is GNU-only and not portable to macOS/BSD; replace
the pipeline with a portability-safe check: capture the output of docker volume
ls -q --filter "...", test if it's non-empty (e.g. ids="$(docker volume ls -q
--filter 'name=...')" and if [ -n "$ids" ]; then echo "$ids" | xargs docker
volume rm; fi) for each occurrence (the three lines that currently use xargs -r)
so you avoid relying on -r and don't attempt to remove when there are no
volumes.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@test/gateway-cleanup.test.js`:
- Around line 24-36: The regex used to extract the async function startGateway
is brittle and can stop at the first unindented closing brace, truncating the
function and missing destroyGateway() calls; replace the regex with a more
robust parser approach (or a balanced-brace search) to reliably capture the
entire startGateway function body when scanning onboard.js, then recount
destroyGateway() occurrences inside that full body; also avoid reading
onboard.js twice by reusing the previously read content variable (content)
instead of calling fs.readFileSync a second time.

---

Nitpick comments:
In `@test/gateway-cleanup.test.js`:
- Around line 17-22: The current test checks for literal strings anywhere in the
file which is too broad; update the test in gateway-cleanup.test.js to assert
those strings appear inside the destroyGateway function body specifically by
extracting that function (e.g., locate the function declaration/assignment for
destroyGateway and capture its source via a regex or an AST parse) and then
assert the captured body contains "docker volume" and "openshell-cluster";
ensure the test fails if the function body does not include both strings.