Summary

A newly created OpenShell sandbox can be reported Ready before its labeled Podman-backed container is visible to NemoClaw's privileged Docker control path. Hermes post-onboarding then exhausts the current 30-second managed-control settlement window with PRIVILEGED_CONTROL_UNAVAILABLE, even though the sandbox becomes healthy shortly afterward.

Evidence

• Reproduced by GFN Build 346 with candidate e6d435819bc7c4a5c07860665c5712173f6e47a9.
• Sandbox creation, authenticated Hermes health, dashboard, and inference-route checks succeeded.
• The immediate privileged secret-boundary recovery returned only the exact sanitized PRIVILEGED_CONTROL_UNAVAILABLE startup marker.
• A later explicit probe found and reused the same healthy container; no Podman restart or container recreation was required.
• Forward recovery then could not establish the required host forwards, including port 8642, because onboarding had advanced past the unsettled privileged-control phase.

Required behavior

1. Keep the happy path unchanged.
2. Treat only the exact, sanitized PRIVILEGED_CONTROL_UNAVAILABLE result as a transient startup observation.
3. Extend the bounded post-create settlement window enough for the observed OpenShell Ready-to-container-discovery handoff.
4. Continue to fail immediately on identity, integrity, malformed-output, ambiguous-container, or diagnostic-bearing failures.
5. Add regression coverage proving settlement can succeed after the former bound and that diagnostic-bearing failures remain terminal.
6. Run focused managed-startup/process-recovery tests and PR validation.

Security constraints

• Do not accept process presence as proof of sandbox identity.
• Do not relax immutable container identity pinning.
• Do not retry diagnostics that contain anything beyond the exact approved startup marker.
• Do not emit credentials or unsanitized runtime output.