NVIDIA
diff --git a/‎src/lib/onboard.ts‎
Lines changed: 2 additions & 2 deletions b/‎src/lib/onboard.ts‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎src/lib/onboard/gateway-reuse.test.ts‎
Lines changed: 150 additions & 7 deletions b/‎src/lib/onboard/gateway-reuse.test.ts‎
Lines changed: 150 additions & 7 deletions
@@ -742,8 +742,7 @@ const { getGatewayReuseSnapshot, selectNamedGatewayForReuseIfNeeded } =
 const { refreshDockerDriverGatewayReuseState } =
   gatewayReuse.createDockerDriverGatewayReuseApplication({
     gatewayName: () => GATEWAY_NAME,
-    getGatewayCompatContainerName: () =>
-      gatewayBinding.resolveGatewayCompatContainerName(GATEWAY_PORT),
+    getGatewayCompatContainerName: () => gatewayBinding.resolveGatewayCompatContainerName(GATEWAY_PORT),
     isDockerDriverGatewayEnabled: isLinuxDockerDriverGatewayEnabled,
     resolveOpenShellGatewayBinary,
     getDockerDriverGatewayEnv,
@@ -756,6 +755,7 @@ const { refreshDockerDriverGatewayReuseState } =
     checkGatewayPortAvailable,
     getDockerDriverGatewayPortListenerPid,
     rememberDockerDriverGatewayPid,
+    runDockerNetworkInspect: docker.dockerRun,
   });
 
 const { getSandboxReuseState, getSandboxRecreateObservation, waitForSandboxRecreateDeleteAbsence } =
 
@@ -5,11 +5,77 @@ import { describe, expect, it, vi } from "vitest";
 
 import { OPENSHELL_PROBE_TIMEOUT_MS } from "../adapters/openshell/timeouts";
 import {
+  classifyDockerDriverNetworkInspection,
   createDockerDriverGatewayReuseApplication,
   type DockerDriverGatewayReuseApplicationDeps,
   createGatewayReuseHelpers,
+  inspectDockerDriverNetwork,
 } from "./gateway-reuse";
 
+function dockerNetworkInspectResult(
+  status: number | null,
+  stdout = "",
+  stderr = "",
+  error?: Error,
+) {
+  return { error, status, stderr, stdout };
+}
+
+describe("Docker-driver network inspection", () => {
+  it("inspects the exact configured Docker network with a bounded command", () => {
+    const runDocker = vi.fn(() => dockerNetworkInspectResult(0, "openshell-docker"));
+
+    expect(inspectDockerDriverNetwork("openshell-docker", runDocker)).toEqual({
+      kind: "present",
+    });
+    expect(runDocker).toHaveBeenCalledWith(
+      ["network", "inspect", "--format", "{{.Name}}", "openshell-docker"],
+      {
+        ignoreError: true,
+        suppressOutput: true,
+        timeout: OPENSHELL_PROBE_TIMEOUT_MS,
+      },
+    );
+  });
+
+  it("accepts the exact configured Docker network", () => {
+    expect(
+      classifyDockerDriverNetworkInspection(
+        "openshell-docker",
+        dockerNetworkInspectResult(0, "openshell-docker\n"),
+      ),
+    ).toEqual({ kind: "present" });
+  });
+
+  it.each([
+    "Error response from daemon: No such network: openshell-docker",
+    "network openshell-docker not found",
+  ])("classifies an exact missing configured network as absent: %s (#9594)", (stderr) => {
+    expect(
+      classifyDockerDriverNetworkInspection(
+        "openshell-docker",
+        dockerNetworkInspectResult(1, "", stderr),
+      ),
+    ).toEqual({ kind: "absent" });
+  });
+
+  it.each([
+    dockerNetworkInspectResult(1, "", "No such network: unrelated-network"),
+    dockerNetworkInspectResult(1, "", "registry metadata not found"),
+    dockerNetworkInspectResult(0, "another-network"),
+    dockerNetworkInspectResult(
+      1,
+      "",
+      "No such network: openshell-docker",
+      new Error("Docker transport failed"),
+    ),
+  ])("keeps ambiguous Docker network inspection inconclusive [case %#] (#9594)", (result) => {
+    expect(classifyDockerDriverNetworkInspection("openshell-docker", result)).toEqual({
+      kind: "inconclusive",
+    });
+  });
+});
+
 describe("gateway reuse snapshot", () => {
   it("bounds OpenShell gateway inspection probes (#6752)", () => {
     const runCaptureOpenshell = vi.fn(() => "");
@@ -96,7 +162,10 @@ function createDockerDriverReuseApplication(
     getGatewayCompatContainerName: () => "openshell-gateway-nemoclaw",
     isDockerDriverGatewayEnabled: () => true,
     resolveOpenShellGatewayBinary: () => "/opt/openshell-gateway",
-    getDockerDriverGatewayEnv: () => ({ OPENSHELL_DRIVERS: "docker" }),
+    getDockerDriverGatewayEnv: () => ({
+      OPENSHELL_DRIVERS: "docker",
+      OPENSHELL_DOCKER_NETWORK_NAME: "openshell-docker",
+    }),
     runCaptureOpenshell: vi.fn(() => "openshell 0.0.99"),
     getDockerDriverGatewayStateDir: () => "/tmp/nemoclaw-gateway",
     resolveOpenShellSandboxBinary: () => "/opt/openshell-sandbox",
@@ -108,14 +177,19 @@ function createDockerDriverReuseApplication(
     rememberDockerDriverGatewayPid: vi.fn(),
     buildDockerDriverGatewayRuntimeIdentity: vi.fn(() => ({
       launch: null,
-      desiredEnv: { OPENSHELL_DRIVERS: "docker" },
+      desiredEnv: {
+        OPENSHELL_DRIVERS: "docker",
+        OPENSHELL_DOCKER_NETWORK_NAME: "openshell-docker",
+      },
       driftGatewayBin: "/opt/openshell-gateway",
       identityGatewayBin: "/opt/openshell-gateway",
     })),
     resolveDriftGatewayBin: vi.fn((runtimeIdentity, gatewayBin) =>
       runtimeIdentity ? runtimeIdentity.driftGatewayBin : gatewayBin,
     ),
     getTrustedActiveOpenShellGatewayUserServicePid: vi.fn(() => null),
+    runDockerNetworkInspect: vi.fn(() => dockerNetworkInspectResult(0, "openshell-docker")),
+    inspectDockerDriverNetwork: vi.fn(() => ({ kind: "present" as const })),
     log: vi.fn(),
     ...overrides,
   });
@@ -158,7 +232,32 @@ describe("Docker-driver gateway reuse application", () => {
     );
   });
 
-  it("adopts a matching gateway port listener when the PID file is absent", async () => {
+  it("marks a reused NemoClaw-managed gateway stale when its Docker network is absent (#9594)", async () => {
+    const log = vi.fn();
+    const application = createDockerDriverReuseApplication({
+      inspectDockerDriverNetwork: vi.fn(() => ({ kind: "absent" as const })),
+      log,
+    });
+
+    await expect(application.refreshDockerDriverGatewayReuseState("healthy")).resolves.toBe(
+      "stale",
+    );
+    expect(log).toHaveBeenCalledWith(
+      '  Existing NemoClaw-managed OpenShell gateway network "openshell-docker" is absent; the gateway will be recreated.',
+    );
+  });
+
+  it("stops before reuse when Docker network inspection is inconclusive (#9594)", async () => {
+    const application = createDockerDriverReuseApplication({
+      inspectDockerDriverNetwork: vi.fn(() => ({ kind: "inconclusive" as const })),
+    });
+
+    await expect(application.refreshDockerDriverGatewayReuseState("healthy")).rejects.toThrow(
+      'NemoClaw could not verify Docker network "openshell-docker" before reusing the NemoClaw-managed OpenShell gateway. Check Docker daemon access and the configured network, then rerun `nemoclaw onboard`.',
+    );
+  });
+
+  it("reuses the trusted gateway port listener when the PID file is absent (#9594)", async () => {
     const rememberDockerDriverGatewayPid = vi.fn();
     const getDockerDriverGatewayReuseDrift = vi.fn(() => null);
     const application = createDockerDriverReuseApplication({
@@ -167,7 +266,7 @@ describe("Docker-driver gateway reuse application", () => {
       checkGatewayPortAvailable: vi.fn(async () => ({ ok: false, pid: 731 })),
       getDockerDriverGatewayPortListenerPid: vi.fn(() => 731),
       getDockerDriverGatewayReuseDrift,
-      getTrustedActiveOpenShellGatewayUserServicePid: vi.fn(() => 900),
+      getTrustedActiveOpenShellGatewayUserServicePid: vi.fn(() => 731),
       rememberDockerDriverGatewayPid,
     });
 
@@ -176,26 +275,70 @@ describe("Docker-driver gateway reuse application", () => {
     );
     expect(getDockerDriverGatewayReuseDrift).toHaveBeenCalledWith(
       731,
-      { OPENSHELL_DRIVERS: "docker" },
+      {
+        OPENSHELL_DRIVERS: "docker",
+        OPENSHELL_DOCKER_NETWORK_NAME: "openshell-docker",
+      },
       "/opt/openshell-gateway",
-      900,
+      731,
+    );
+    expect(rememberDockerDriverGatewayPid).not.toHaveBeenCalled();
+  });
+
+  it("stops before recording a mismatched gateway port listener when the Docker network is absent (#9594)", async () => {
+    const rememberDockerDriverGatewayPid = vi.fn();
+    const getDockerDriverGatewayReuseDrift = vi.fn(() => null);
+    const application = createDockerDriverReuseApplication({
+      getDockerDriverGatewayPid: () => null,
+      isDockerDriverGatewayProcessAlive: () => false,
+      checkGatewayPortAvailable: vi.fn(async () => ({ ok: false, pid: 731 })),
+      getDockerDriverGatewayPortListenerPid: vi.fn(() => 731),
+      getDockerDriverGatewayReuseDrift,
+      getTrustedActiveOpenShellGatewayUserServicePid: vi.fn(() => 900),
+      inspectDockerDriverNetwork: vi.fn(() => ({ kind: "absent" as const })),
+      rememberDockerDriverGatewayPid,
+    });
+
+    await expect(application.refreshDockerDriverGatewayReuseState("healthy")).rejects.toThrow(
+      'Docker network "openshell-docker" is absent, but NemoClaw could not verify the running gateway\'s lifecycle authority. Restart the gateway through its lifecycle authority, then rerun `nemoclaw onboard`.',
     );
-    expect(rememberDockerDriverGatewayPid).toHaveBeenCalledWith(731);
+    expect(getDockerDriverGatewayReuseDrift).not.toHaveBeenCalled();
+    expect(rememberDockerDriverGatewayPid).not.toHaveBeenCalled();
   });
 
   it("preserves a reachable selected gateway when the port owner is ambiguous", async () => {
     const rememberDockerDriverGatewayPid = vi.fn();
+    const inspectDockerDriverNetwork = vi.fn(() => ({ kind: "present" as const }));
     const application = createDockerDriverReuseApplication({
       getDockerDriverGatewayPid: () => null,
       isDockerDriverGatewayProcessAlive: () => false,
       checkGatewayPortAvailable: vi.fn(async () => ({ ok: false, pid: null })),
       getDockerDriverGatewayPortListenerPid: vi.fn(() => null),
+      inspectDockerDriverNetwork,
       rememberDockerDriverGatewayPid,
     });
 
     await expect(application.refreshDockerDriverGatewayReuseState("healthy")).resolves.toBe(
       "healthy",
     );
+    expect(inspectDockerDriverNetwork).toHaveBeenCalledWith("openshell-docker");
+    expect(rememberDockerDriverGatewayPid).not.toHaveBeenCalled();
+  });
+
+  it("does not recreate a gateway with unproven lifecycle authority when its network is absent (#9594)", async () => {
+    const rememberDockerDriverGatewayPid = vi.fn();
+    const application = createDockerDriverReuseApplication({
+      getDockerDriverGatewayPid: () => null,
+      isDockerDriverGatewayProcessAlive: () => false,
+      checkGatewayPortAvailable: vi.fn(async () => ({ ok: false, pid: null })),
+      getDockerDriverGatewayPortListenerPid: vi.fn(() => null),
+      inspectDockerDriverNetwork: vi.fn(() => ({ kind: "absent" as const })),
+      rememberDockerDriverGatewayPid,
+    });
+
+    await expect(application.refreshDockerDriverGatewayReuseState("healthy")).rejects.toThrow(
+      'Docker network "openshell-docker" is absent, but NemoClaw could not verify the running gateway\'s lifecycle authority. Restart the gateway through its lifecycle authority, then rerun `nemoclaw onboard`.',
+    );
     expect(rememberDockerDriverGatewayPid).not.toHaveBeenCalled();
   });