## Summary
- Add the missing `v0.0.57` release-notes section with links to the
detailed docs pages for command, inference, onboarding, messaging,
status, installer, and policy changes.
- Remove public references to docs-skip terms from source docs and
regenerate the NemoClaw user skills from the current Fern MDX docs.
- Carry forward generated references for the per-agent documentation
split, including Hermes-specific reference files.

## Source summary
- #4615 and #4653 -> `docs/about/release-notes.mdx`,
`docs/reference/commands.mdx`: Release notes now cover host-side
`sessions` and `agents` commands plus `NEMOCLAW_EXTRA_AGENTS_JSON`
secondary-agent baking.
- #4163, #4204, #4611, #4619, and #4676 ->
`docs/about/release-notes.mdx`,
`docs/inference/use-local-inference.mdx`: Release notes now cover
managed vLLM progress/readiness, DGX Spark model default changes, local
Ollama streaming usage, and inference route divergence warnings.
- #4267, #4601, #4609, #4642, #4645, and #4661 ->
`docs/about/release-notes.mdx`, `docs/reference/commands.mdx`: Release
notes now cover UFW auto-remediation, local-inference reachability
gates, gateway reuse/binding, cancel rollback, and policy selection
persistence.
- #4577, #4582, #4607, and #4660 -> `docs/about/release-notes.mdx`,
`docs/manage-sandboxes/messaging-channels.mdx`: Release notes now cover
Slack validation, atomic `channels add`, WhatsApp QR diagnostics, and
Slack placeholder normalization.
- #4388, #4600, #4646, and #4647 -> `docs/about/release-notes.mdx`,
`docs/reference/commands.mdx`: Release notes now cover status failure
layers, paused-container hints, Docker-driver doctor behavior, and
non-destructive stale-registry recovery.
- #4569, #4579, and #4678 -> `docs/about/release-notes.mdx`,
`docs/manage-sandboxes/lifecycle.mdx`,
`docs/network-policy/integration-policy-examples.mdx`: Release notes now
cover installer tag pinning, PyPI `uv` policy access, and observable
Jira validation.
- #4632 -> `.agents/skills/`: Regenerated user skills from the current
per-agent docs source, including newly generated Hermes reference files.

## Verification
- `python3 scripts/docs-to-skills.py docs/ .agents/skills/ --prefix
nemoclaw-user --doc-platform fern-mdx`
- `rg "permissive mode|shields down|shields up|shields status|config
rotate-token|rotate-token" docs --glob "*.mdx"`
- `rg "permissive mode|shields down|shields up|shields status|config
rotate-token|rotate-token" .agents/skills --glob "*.md"`
- `npm run docs`
- `npm run build:cli`
- Commit hooks: markdownlint, docs-to-skills verification, gitleaks,
skills YAML, commitlint

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
* Restructured documentation to clearly distinguish OpenClaw and Hermes
agent variants throughout user guides.
* Enhanced security, credential storage, and deployment guidance with
clearer setup flows.
  * Added Hermes plugin installation and ecosystem documentation.
* Improved workspace, messaging, and policy management references with
variant-specific command examples.
  * Refined troubleshooting and CLI reference sections for clarity.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

…NVIDIA#4497)

PR NVIDIA#4647 stopped `connect` from deleting the registry entry of a sandbox
that is registered locally but absent from a healthy gateway, so the
`rebuild --yes` hint `status` prints would have something to recover. But
`rebuild` still dead-ended: its backup step aborted with "Sandbox '<name>'
is not running. Cannot back up state." whenever the live sandbox was
missing — exactly the stale state — so the recommended recovery path stayed
broken and the issue reopened.

Treat a registered-but-not-live sandbox as a recovery rebuild: there is no
live workspace state to back up, so skip the backup/restore steps and
recreate from the preserved registry + onboard-session metadata. Guard the
no-backup path so it never destroys live state:

- Confirm absence authoritatively against the NAMED nemoclaw gateway
  (getReconciledSandboxGatewayState runs `sandbox get`), and only treat
  `present` as live when nemoclaw is the active healthy gateway — a foreign
  active gateway (multi-gateway, NVIDIA#4645) or a list/get inconsistency must not
  trigger a destructive recreate.
- Refuse the destructive path for a sandbox recorded on a non-default
  per-port gateway; point the operator at `openshell gateway select`.
- On recreate failure, restore the captured registry entry verbatim (under
  the registry lock, target-only) so `rebuild`/`connect` stay retryable
  without clobbering concurrent changes; reclaim the default pointer.
- Reset the gone sandbox's stale shields seal only after a successful
  recreate, and tell the operator to re-apply `shields up` if it was locked.

Add a focused regression suite (rebuild-stale-recovery.test.ts) covering the
recover, control, multi-gateway, per-port, and failed-recreate cases; update
the NVIDIA#2276/NVIDIA#4497 reconcile Scenario 14 and the gateway-drift retry test to
assert recovery instead of the dead-end; and strengthen the double-onboard
E2E so the exact reporter workflow (status -> connect -> rebuild --yes) must
recreate a live sandbox — the old probe only checked for "does not exist"
and would have passed against this bug.

Signed-off-by: Yimo Jiang <yimoj@nvidia.com>