<!-- markdownlint-disable MD041 -->
## Summary

Add the canonical dated changelog entry required before planning the
v0.0.110 release. The entry summarizes user-facing changes merged since
v0.0.109 and links each change to its published documentation route and
source PR.

## Changes

- Add `docs/changelog/2026-08-17.mdx` with the exact `## v0.0.110`
release heading.
- Cover managed local inference, endpoint validation, onboarding and
recovery, explicit experimental Portable OpenClaw, messaging and policy
cleanup, backup and security hardening, and release qualification.
- Preserve the documentation skip list and the current supported-agent
matrix; test-only refactors, dormant activation work, and Pi-only
changes are intentionally excluded.

### Source-to-doc mapping

- #8711 -> `docs/changelog/2026-08-17.mdx`: Add the Muse Glimmer
llama.cpp profile.
- #9099 -> `docs/changelog/2026-08-17.mdx`: Update the Muse Glimmer vLLM
runtime.
- #9319 -> `docs/changelog/2026-08-17.mdx`: Select the provider required
by an explicit serving profile.
- #9311 -> `docs/changelog/2026-08-17.mdx`: Report probe-image pull
failures separately.
- #9345 -> `docs/changelog/2026-08-17.mdx`: Reuse mirrored Windows
Ollama.
- #9284 -> `docs/changelog/2026-08-17.mdx`: Complete the required Ollama
upgrade.
- #9320 -> `docs/changelog/2026-08-17.mdx`: Reject unsafe custom
endpoint URLs before mutation.
- #9119 -> `docs/changelog/2026-08-17.mdx`: Reject unsupported custom
endpoint URL components.
- #9236 -> `docs/changelog/2026-08-17.mdx`: Require native Anthropic
tool-use evidence.
- #9347 -> `docs/changelog/2026-08-17.mdx`: Distinguish Gemini runtime
404 diagnostics.
- #9307 -> `docs/changelog/2026-08-17.mdx`: Preserve the recorded API
family when only the model drifts.
- #9233 -> `docs/changelog/2026-08-17.mdx`: Fail incomplete Hermes route
synchronization.
- #9185 -> `docs/changelog/2026-08-17.mdx`: Serialize Model Router
lifecycle work across gateways.
- #9112 -> `docs/changelog/2026-08-17.mdx`: Stop Model Router after the
last routed sandbox is destroyed.
- #9229 -> `docs/changelog/2026-08-17.mdx`: Verify fresh sandbox
execution readiness.
- #9299 -> `docs/changelog/2026-08-17.mdx`: Verify a separate agent API
host forward before reporting ready.
- #9318 -> `docs/changelog/2026-08-17.mdx`: Honor explicit sandbox
recreation.
- #9325 -> `docs/changelog/2026-08-17.mdx`: Measure readiness reuse
windows from collection completion.
- #9352 -> `docs/changelog/2026-08-17.mdx`: Guide users away from the
deprecated global start command.
- #9370 -> `docs/changelog/2026-08-17.mdx`: Persist managed OpenClaw
agent identity.
- #9366 -> `docs/changelog/2026-08-17.mdx`: Pass messaging dependencies
during reused onboarding.
- #9321 -> `docs/changelog/2026-08-17.mdx`: Detect proxied connect
sessions.
- #9285 -> `docs/changelog/2026-08-17.mdx`: Run probe-only recovery when
absent authority cannot be created.
- #9282 -> `docs/changelog/2026-08-17.mdx`: Complete probe-only recovery
without platform evidence.
- #8920 -> `docs/changelog/2026-08-17.mdx`: Preserve legacy gateway
identity.
- #9198 -> `docs/changelog/2026-08-17.mdx`: Report sandbox config-read
failures.
- #9201 -> `docs/changelog/2026-08-17.mdx`: Remove only the exact Docker
orphan on destroy.
- #9176 -> `docs/changelog/2026-08-17.mdx`: Use rootless Podman for
Portable lifecycle operations.
- #9197 -> `docs/changelog/2026-08-17.mdx`: Preflight Portable CPU
delegation.
- #9289 -> `docs/changelog/2026-08-17.mdx`: Narrow Portable policy
defaults.
- #9270 -> `docs/changelog/2026-08-17.mdx`: Preserve Portable model
intent.
- #9339 -> `docs/changelog/2026-08-17.mdx`: Reconcile timed-out Portable
stop state.
- #9209 -> `docs/changelog/2026-08-17.mdx`: Clean receipt-owned Portable
Podman resources.
- #9186 -> `docs/changelog/2026-08-17.mdx`: Separate Podman activation
readiness.
- #9376 -> `docs/changelog/2026-08-17.mdx`: Settle Portable OpenClaw
pairing before readiness.
- #9296 -> `docs/changelog/2026-08-17.mdx`: Retire messaging channel
presets the host no longer configures.
- #9327 -> `docs/changelog/2026-08-17.mdx`: Drop retired channels from
reused messaging selections.
- #9306 -> `docs/changelog/2026-08-17.mdx`: Remove gateway-enforced
presets without a local record.
- #9248 -> `docs/changelog/2026-08-17.mdx`: Activate Google Chat pairing
approval.
- #9374 -> `docs/changelog/2026-08-17.mdx`: Accept schema-owned
messaging plan fields.
- #9317 -> `docs/changelog/2026-08-17.mdx`: Accept safe hard-linked
package files during backup.
- #9288 -> `docs/changelog/2026-08-17.mdx`: Remove managed CLI shims
with destroyed user data.
- #9239 -> `docs/changelog/2026-08-17.mdx`: Read voice credentials from
fixed descriptors.
- #9269 -> `docs/changelog/2026-08-17.mdx`: Accept bounded native
OpenClaw device modes.
- #9371 -> `docs/changelog/2026-08-17.mdx`: Isolate OpenClaw
startup-guard output.
- #9351 -> `docs/changelog/2026-08-17.mdx`: Restore staging Launchable
validation.
- #9350 -> `docs/changelog/2026-08-17.mdx`: Retry transient
collaborator-permission reads.
- #9353 -> `docs/changelog/2026-08-17.mdx`: Retry transient
exact-artifact downloads.
- #9226 -> `docs/changelog/2026-08-17.mdx`: Add bounded Brev readiness
diagnostics.
- #9237 -> `docs/changelog/2026-08-17.mdx`: Report same-commit E2E
reliability.
- #9232 -> `docs/changelog/2026-08-17.mdx`: Execute native-runtime
qualification.
- #9275 -> `docs/changelog/2026-08-17.mdx`: Define E2E selection and
retry guidance.
- #9234 -> `docs/changelog/2026-08-17.mdx`: Move documentation review
after merge.
- #9365 -> `docs/changelog/2026-08-17.mdx`: Mount documentation reviewer
inputs before startup.

## Type of Change

- [ ] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [x] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates

- [ ] Tests added or updated for changed behavior
- [x] Existing tests cover changed behavior — justification:
`test/changelog-docs.test.ts` validates the dated release-entry
contract.
- [ ] Tests not applicable — justification:
- [ ] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [ ] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification:
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## DGX Station Hardware Evidence

- [ ] Tested on DGX Station
- Tested commit: Not applicable; documentation-only change.
- Station profile/scenario: Not applicable.
- Result: Not applicable.
- Supporting evidence: Not applicable.

## Verification

- [x] PR description includes a `Signed-off-by:` line and every commit
appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run validate:pr` passed after refreshing `origin/main` when hooks
were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — `npx vitest run
test/changelog-docs.test.ts` (7 passed)
- [x] Applicable broad gate passed — `npm test` for broad
runtime/test-harness changes; `npm run check` for repo-wide
validation/coverage changes — command/result: Not applicable to one
prose-only changelog page; `npm run docs` passed the repository's strict
documentation gate.
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only) — passed
with 0 errors and the 2 existing Fern warnings.
- [x] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)
— the SPDX header is present; dated changelog pages intentionally do not
use frontmatter.

---
Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
  * Added release notes for v0.0.110.
* Documented experimental managed llama.cpp and Portable OpenClaw
profiles.
* Covered inference validation, onboarding and recovery improvements,
rootless lifecycle handling, messaging and policy updates, backups,
credential handling, filesystem protections, and release qualification
updates.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

… forward

`scripts/install.sh` plants a managed forward watcher after an install-driven
Hermes onboard. The watcher probes the sandbox's API port every 10 seconds and
restarts the port forward when the probe fails. It reaps the previous watcher
only inside its own post-onboard restore step, which runs after `run_onboard`,
so a watcher from an earlier cycle stays live for the whole of the next onboard.
It then races onboarding's own forward stop and start, and each side can tear
down the other's still-settling ssh listener, which leaves the API port refused
across retries.

Onboarding now stops the watcher recorded for a sandbox and port before it
starts that port's forward, and `nemoclaw <name> destroy` stops every watcher
recorded for the destroyed sandbox so one cannot outlive a name the next onboard
reuses. The destroy-side reap only runs once the caller has confirmed the
delete succeeded or the sandbox was already gone; a failed delete leaves the
sandbox registered and still running, and the watcher a premature reap would
stop is that live sandbox's own forward self-healing, not an orphan's.

Both reuse the identity contract `nemoclaw uninstall` already applies: the
process is signaled only when it runs as the current user and its command line
is exactly `node <pidFile>.js <openshell> <port> <sandbox>`. That is stricter
than the installer's own argv-substring check (below). A process that fails
the check is left alone, and an inconclusive inspection never signals. The
state directory backing this reap is always an explicit, caller-supplied path
(defaulting to `resolveNemoclawStateDir()`, which redirects to an isolated
directory under `npm test`) rather than resolved from `$HOME` inside the
watcher-lookup code itself, so a caller that forgets to wire it up reads an
empty directory instead of the invoking user's real `~/.nemoclaw/state`.

When a watcher survives the reap and the forward still fails to open its
listener, the existing failure warning now names the surviving pid and script
path, so the next occurrence is diagnosable without git archaeology.

Trade-off: a plain `nemoclaw onboard` on an already-healthy sandbox now stops
that sandbox's own watcher before restarting its forward, and nothing replants
it afterward. This is deliberate — it's the same reap that closes the race —
but it means the sandbox loses its port-forward self-healing until its next
destroy/onboard cycle or `nemoclaw uninstall`.

This does not extend NemoClaw's forward-start retry budget. The reported
"within 10000ms" window belongs to the OpenShell CLI, not NemoClaw, and NVIDIA#9290
showed that repeated manual retries do not clear the condition. It also does not
weaken the host-side API forward verification added by NVIDIA#9299; onboarding still
fails when the forward is unreachable.

Confidence: the lifecycle gap is verified in the source and is worth closing on
its own. Whether it is the whole cause of NVIDIA#10385 is not established. The
mechanism described here needs a prior watcher to race against, so it cannot by
itself explain a first-ever install's failure — `restore_onboard_forward_after_post_checks`
only runs once, after `run_onboard` completes, so there is no earlier watcher on
that path. The reported failure is specific to Ubuntu 24.04 with an NVIDIA GPU,
and this change does not explain that platform specificity. Confirming either
needs a run on the affected host.

Pre-existing, unrelated hazards noted for the record, not fixed here (all in
`scripts/install.sh`, all weaker than the identity contract this change reuses):
- Its own post-onboard reap (~line 564) matches an old watcher by substring
  (`old_args == *"$expected_watcher_script"*`) rather than the exact command
  line the TypeScript side now requires.
- That same reap unconditionally removes the pid file (~line 568) even when
  the identity check fails, regardless of whether the process it points at
  was actually this watcher.
- Its retry loop signals the watcher it just spawned (~line 716) with no
  identity check at all before falling back to a fresh attempt.

`src/lib/core/shell-quote.ts` fan-in moves from 28 to 29 and
`src/lib/state/paths.ts` from 20 to 22 for the new consumers added here.
`src/lib/state/state-root.ts`'s budget is lowered from the stale 22 to its
current measured 21: this change no longer imports it directly (the watcher
adapter takes its state directory as a parameter instead), so that edge is
gone rather than added to.

Refs NVIDIA#10385

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Signed-off-by: harjoth <harjoth.khara@gmail.com>

… forward

`scripts/install.sh` plants a managed forward watcher after an install-driven
Hermes onboard. The watcher probes the sandbox's API port every 10 seconds and
restarts the port forward when the probe fails. It reaps the previous watcher
only inside its own post-onboard restore step, which runs after `run_onboard`,
so a watcher from an earlier cycle stays live for the whole of the next onboard.
It then races onboarding's own forward stop and start, and each side can tear
down the other's still-settling ssh listener, which leaves the API port refused
across retries.

Onboarding now stops the watcher recorded for a sandbox and port before it
starts that port's forward, and `nemoclaw <name> destroy` stops every watcher
recorded for the destroyed sandbox so one cannot outlive a name the next onboard
reuses. The destroy-side reap runs as soon as the delete is confirmed succeeded
or the sandbox was already gone — before any later, independently-retryable
cleanup step (currently: the managed Hermes state-volume removal) can exit the
command early and skip it. A failed delete itself still leaves the reap
untouched: the sandbox is registered and still running, and the watcher a
premature reap would stop is that live sandbox's own forward self-healing, not
an orphan's.

Both reuse the identity contract `nemoclaw uninstall` already applies: the
process is signaled only when it runs as the current user and its command line
is exactly `node <pidFile>.js <openshell> <port> <sandbox>`. That is stricter
than the installer's own argv-substring check (below). A process that fails
the check is left alone, and an inconclusive inspection never signals. The
state directory backing this reap is always an explicit, caller-supplied path
(defaulting to `resolveNemoclawStateDir()`, which redirects to an isolated
directory under `npm test`) rather than resolved from `$HOME` inside the
watcher-lookup code itself, so a caller that forgets to wire it up reads an
empty directory instead of the invoking user's real `~/.nemoclaw/state`.

When a watcher survives the reap and the forward still fails to open its
listener, the existing failure warning now names the surviving pid and script
path, so the next occurrence is diagnosable without git archaeology.

Trade-off: a plain `nemoclaw onboard` on an already-healthy sandbox now stops
that sandbox's own watcher before restarting its forward, and nothing replants
it afterward — only the installer creates a watcher, and onboarding/destroy
never do, including a `destroy` followed by a fresh `onboard`. This is
deliberate; it's the same reap that closes the race. The sandbox keeps
working, but its forward stops auto-recovering from a dropped listener until
the next full install.

This does not extend NemoClaw's forward-start retry budget. The reported
"within 10000ms" window belongs to the OpenShell CLI, not NemoClaw, and NVIDIA#9290
showed that repeated manual retries do not clear the condition. It also does not
weaken the host-side API forward verification added by NVIDIA#9299; onboarding still
fails when the forward is unreachable.

Confidence: the lifecycle gap is verified in the source and is worth closing on
its own. Whether it is the whole cause of NVIDIA#10385 is not established. The
mechanism described here needs a prior watcher to race against, so it cannot by
itself explain a first-ever install's failure — `restore_onboard_forward_after_post_checks`
only runs once, after `run_onboard` completes, so there is no earlier watcher on
that path. The reported failure is specific to Ubuntu 24.04 with an NVIDIA GPU,
and this change does not explain that platform specificity. Confirming either
needs a run on the affected host.

Pre-existing, unrelated hazards noted for the record, not fixed here (all in
`scripts/install.sh`, all weaker than the identity contract this change reuses):
- Its own post-onboard reap (~line 564) matches an old watcher by substring
  (`old_args == *"$expected_watcher_script"*`) rather than the exact command
  line the TypeScript side now requires.
- That same reap unconditionally removes the pid file (~line 568) even when
  the identity check fails, regardless of whether the process it points at
  was actually this watcher.
- Its retry loop signals the watcher it just spawned (~line 716) with no
  identity check at all before falling back to a fresh attempt.

Known limitations disclosed, not addressed here (each is a design or scope
decision beyond this bug fix, not a defect introduced by it):
- The identity check and the signal it authorizes are not atomic: the PID
  could theoretically exit and be reused by an unrelated process in the
  interval between the check and `host.kill(pid)`. This is the same
  check-then-kill pattern `nemoclaw uninstall` already ships; closing it for
  real would mean binding identity to the signal itself (e.g. a Linux pidfd),
  which is a larger, cross-cutting change to that existing contract, not
  something this PR's watcher-lifecycle fix should take on unreviewed.
- Nothing replants a watcher after a successful onboarding forward start, so
  a sandbox that recovers from this race loses its self-healing until the
  next full install (see the Trade-off paragraph above). Adding a replant is
  new behavior, not a bug fix, and needs its own design decision.
- `HermesForwardWatcherState`, `HermesForwardWatcherCommandLine`, and
  `isManagedHermesForwardWatcherProcess` still live under `domain/uninstall/`
  even though onboarding and destroy are now consumers too. Moving them to a
  lifecycle-neutral owner is a clean, low-risk follow-up, but it's a pure
  organizational change with no behavior difference, so it's left for a
  separate PR rather than bundled into this fix.

`src/lib/core/shell-quote.ts` fan-in moves from 28 to 29 and
`src/lib/state/paths.ts` from 20 to 22 for the new consumers added here.
`src/lib/state/state-root.ts`'s budget is lowered from the stale 22 to its
current measured 21: this change no longer imports it directly (the watcher
adapter takes its state directory as a parameter instead), so that edge is
gone rather than added to.

Refs NVIDIA#10385

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Signed-off-by: harjoth <harjoth.khara@gmail.com>