fix(shields): recover a locked sandbox whose startup never completed

docs/manage-sandboxes/recover-rebuild-sandboxes.mdx

@@ -25,6 +25,18 @@ This path preserves the sandbox workspace and repairs the agent runtime and host
 If the container is paused, follow the printed `docker unpause` guidance instead.
 If the container is missing or OpenShell reports another terminal phase such as `Failed`, follow the printed `rebuild --yes` guidance so NemoClaw can recreate the sandbox from its recorded metadata.
 
+<AgentOnly variant="openclaw">
+When the sandbox has shields up and the OpenClaw gateway does not come back after the container restarts, lower shields before reaching for a rebuild:
+
+```bash
+$$nemoclaw <sandbox-name> shields down
+```
+
+NemoClaw accepts `shields down` once it confirms, while holding the config mutation lock, that no startup process is running and no readiness lease was published.
+Other locked-config operations still require the lease.
+Start the sandbox again after shields are down, then re-run `shields up` when it is healthy.
+</AgentOnly>
+
 ## Recover the Agent Runtime
 
 <AgentOnly variant="openclaw">