docs(release): add v0.0.82 release notes

docs/about/release-notes.mdx

@@ -16,6 +16,48 @@ NVIDIA NemoClaw is available in early preview starting March 16, 2026.
 Use this page to track the highlights of the latest release.
 For more detailed release notes, refer to the [NemoClaw GitHub announcements](https://github.com/NVIDIA/NemoClaw/discussions/categories/announcements?discussions_q=is%3Aopen+category%3AAnnouncements).
 
+## v0.0.82
+
+NemoClaw v0.0.82 adds non-destructive sandbox stop and start commands, protects managed vLLM downloads with storage checks, strengthens custom policy and dependency validation, and improves onboarding, backup, snapshot, and contributor guidance.
+
+- Sandbox lifecycle controls can now free host resources without deleting a workspace.
+  `$$nemoclaw <name> stop` stops managed channels and the sandbox's Docker containers while leaving the workspace, registry entry, OpenShell record, credentials, shared gateway, and inference services intact.
+  `$$nemoclaw <name> start` starts or unpauses the container, then checks runtime health and repairs the gateway and host forwards where applicable.
+  For more information, refer to [Manage Sandbox Lifecycle](../manage-sandboxes/lifecycle) and [NemoClaw CLI Commands Reference](../reference/commands).
+- Backup and snapshot recovery handle stopped and cloned sandboxes more safely.
+  `backup-all` can temporarily start an eligible stopped Docker sandbox, capture its backup, and return it to the stopped state, while strict mode still fails when identity, startup, backup, or cleanup cannot be proven.
+  Snapshot clones receive a destination-owned dashboard port so their dashboard URL and later rebuilds do not conflict with the source sandbox.
+  Installer upgrades also ignore route-only placeholders left by interrupted onboarding instead of treating them as backupable sandboxes.
+  For more information, refer to [Backup and Restore](../manage-sandboxes/backup-restore) and [Manage Sandbox Lifecycle](../manage-sandboxes/lifecycle).
+- Managed vLLM setup checks storage before large downloads begin.
+  NemoClaw verifies Docker image storage and the Hugging Face model cache before an uncached image pull or model download, rechecks model capacity after the image pull, and stops when capacity or filesystem identity cannot be established unless the operator explicitly accepts the warning.
+  Managed profiles use immutable platform digests, and the model download and serving containers use `--pull=never` so an implicit pull cannot bypass the storage gate.
+  For more information, refer to [Set Up vLLM](../inference/local-inference/set-up-vllm) and [Choose an Inference Provider](../inference/learn-and-choose/choose-inference-provider).
+- Onboarding reports local inference and gateway conflicts more accurately.
+  An identifiable foreign listener on the OpenShell gateway port now fails fast with process details and recovery guidance, interactive setup continues to detect running Ollama and vLLM services when another registry route exists, and an installed but stopped Ollama daemon appears as a start action instead of a running status.
+  Loopback readiness checks bypass host proxies, compatible endpoint validation recommends an OpenAI-compatible endpoint or switching to OpenClaw when a Chat-Completions-only agent selects an Anthropic-compatible endpoint that does not serve `/v1/chat/completions`, and an eligible matching successful check can satisfy the immediately following smoke probe without a duplicate request.
+  For more information, refer to [Troubleshooting](../reference/troubleshooting), [Choose a Local Inference Server](../inference/local-inference/choose-local-inference-server), and [Understand Provider Validation](../inference/validate-inference/understand-provider-validation).
+- Interrupted onboarding preserves more of the selected route and sandbox intent.
+  Resume repairs a missing pending route reservation when inference setup is already complete, and sandbox creation resolves its secret-free policy, messaging, provider, resource, and cleanup intent before destructive state changes begin.
+  These protections keep resumed setup and stale-provider cleanup aligned with the choices made before the interruption.
+  For more information, refer to [NemoClaw Quickstart](../get-started/quickstart) and [NemoClaw CLI Commands Reference](../reference/commands).
+- Managed Deep Agents headless sessions now use the bounded session supervisor, so completed sessions reap their DCode and LangGraph descendants without affecting other sessions or leaving the sandbox unusable.
+  For more information, refer to [Quickstart with LangChain Deep Agents Code](/user-guide/deepagents/get-started/quickstart).
+- Custom policy application rejects catch-all destinations before widening sandbox egress.
+  Runtime custom presets now reject `*`, `0.0.0.0`, `0.0.0.0/0`, `::`, and `::/0` while continuing to allow scoped subdomain wildcards such as `*.example.com`.
+  The same semantic check protects repository validation, `policy-add --from-file`, and in-memory custom preset application.
+  For more information, refer to [Customize the Network Policy](../network-policy/customize-network-policy).
+- NemoClaw now requires Node.js 22.19 or later for host installs and contributor tooling, matching current OpenClaw runtime and advisor SDK requirements.
+  Ubuntu 26.04 has a digest-pinned userspace contract lane for CLI, preflight, installer, and platform checks, while Docker-host, AppArmor, Landlock, and live onboarding validation remain pending.
+  For more information, refer to [Prerequisites](../get-started/prerequisites) and [Platform Support and Launch Claims](../reference/platform-support).
+- Contributor guidance now routes independent integrations, custom images, recipes, and complete workflows through Community Solutions while reserving canonical NemoClaw documentation for approved, maintained product surfaces.
+  The contributor skill catalog also adds evidence-driven workflows for semantic dependency upgrades and route-safe documentation refactors.
+  For more information, refer to [Community Solutions](../resources/community-contributions) and the [Documentation Contributor Guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md).
+- Build and dependency trust boundaries cover more of the sandbox image path.
+  Reviewed npm archives now share one production dependency audit, OpenClaw's managed WeChat runtime installs from a NemoClaw-owned offline lock, and the messaging build plan no longer persists in final OpenClaw or Hermes image environments.
+  Source and blueprint rebuilds also reuse cached plugin dependency layers.
+  For more information, refer to the [OpenClaw 2026.6.10 Dependency Review](https://github.com/NVIDIA/NemoClaw/blob/main/docs/security/openclaw-2026.6.10-dependency-review.md).
+
 ## v0.0.81
 
 NemoClaw v0.0.81 strengthens rebuild and snapshot state preservation, repairs local compatible inference and WhatsApp setup, improves Docker restart recovery, and makes onboarding, backup, and security diagnostics easier to act on.

docs/inference/set-up-ollama.mdx

@@ -70,7 +70,8 @@ Run the onboard wizard.
 $$nemoclaw onboard
 ```
 
-Select **Local Ollama**.
+Select the Ollama entry for your host.
+The menu identifies a reachable daemon as running and labels an installed but stopped daemon **Start local Ollama**.
 NemoClaw lists installed models or offers starter models when none are installed.
 
 The starter list includes `qwen3.6:35b` and selects it by default when current GPU memory can accommodate it.

docs/manage-sandboxes/backup-restore.mdx

@@ -102,6 +102,9 @@ $$nemoclaw my-assistant snapshot restore before-upgrade --to my-assistant-clone
 $$nemoclaw my-assistant snapshot restore before-upgrade --to my-assistant-clone --force --yes
 ```
 
+For dashboard-enabled agents, NemoClaw allocates the destination sandbox its own dashboard port instead of reusing the source port.
+If no port is available, restore stops before deleting an existing `--force` destination.
+
 The force-overwrite path restores and verifies lockdown on a destination with an active shields timer, then revokes that timer before it deletes the destination.
 It clears the remaining local shields state only after deletion succeeds, before a same-name replacement is created.
 
@@ -267,7 +270,7 @@ Use this host-installed command before broad maintenance such as `$$nemoclaw upd
 $$nemoclaw backup-all
 ```
 
-`backup-all` walks the sandboxes registered on the host, creates a snapshot for each running sandbox, and stores the snapshot bundles under `~/.nemoclaw/rebuild-backups/<name>/`.
+`backup-all` walks the sandboxes registered on the host, creates a snapshot for each eligible running or temporarily started sandbox, and stores the snapshot bundles under `~/.nemoclaw/rebuild-backups/<name>/`.
 If a registered docker-driver sandbox's container is stopped, `backup-all` starts the container for the duration of the backup and returns it to its stopped state afterward.
 If the container cannot be returned to the stopped state, the backup run fails and reports that the container was left running.
 If a sandbox is not running and its container cannot be started this way, start the sandbox or its container and rerun `$$nemoclaw backup-all` so NemoClaw can capture a fresh snapshot before maintenance.

docs/network-policy/customize-network-policy.mdx

@@ -356,6 +356,8 @@ network_policies:
 
 The top-level `preset.name` must be a lowercase RFC 1123 label (letters, digits, hyphens) and must not collide with a built-in preset name such as `slack` or `pypi`.
 Rename `preset.name` if NemoClaw refuses to apply the file because of a collision.
+Each endpoint must name a specific host or a scoped subdomain wildcard such as `*.example.com`.
+NemoClaw rejects catch-all destinations including `*`, `0.0.0.0`, `0.0.0.0/0`, `::`, and `::/0` before it applies a custom preset.
 Rule matchers must match the endpoint protocol.
 REST and WebSocket rules require `method` and `path`; REST accepts standard HTTP methods or `*`, while WebSocket accepts `GET`, `WEBSOCKET_TEXT`, or `*`.
 JSON-RPC rules accept only `method`, and MCP rules accept `method` plus optional `tool` or `params.name` matchers.

docs/reference/commands.mdx

@@ -2533,7 +2533,7 @@ A custom OpenClaw sandbox is recoverable only when the selected backup independe
 
 ### `$$nemoclaw backup-all`
 
-Back up all registered running sandboxes to `~/.nemoclaw/rebuild-backups/`.
+Back up registered sandboxes that are running or have an eligible stopped Docker-driver container to `~/.nemoclaw/rebuild-backups/`.
 A registered docker-driver sandbox whose container is stopped is started for the duration of the backup and returned to its stopped state afterward.
 If the container cannot be returned to the stopped state, the command fails and reports that the container was left running.
 Sandboxes that are not running and cannot be started this way are skipped with remediation guidance.