[DGX Station][Policy&Network] recover reports a port-forward failure when the forward is already active

[mercl-lau]

Description

nemohermes recover starts the Hermes agent gateway but reports that the managed port forward could not be restored. Independent checks show that the relevant ports are listening, and attempting to start the forward again reports that it is already forwarded.

Platform scope: Reproduced on DGX Station only; other platforms not tested.
Regression: Unknown — earlier versions not tested.

Environment

Device:        DGX Station
OS:            Ubuntu 24.04
Architecture:  aarch64
Docker:        29.2.1
OpenShell CLI: 0.0.72
NemoClaw:      v0.0.84
Hermes Agent:  v0.18.0 (2026.7.1)

Steps to Reproduce

1. Rebuild a Hermes sandbox whose agent gateway is not running after rebuild.
2. Run the supported Hermes recovery command:

   nemohermes <sandbox> recover

3. Observe the forward-restoration result.
4. Verify that ports 18791 and 8642 are listening on loopback.
5. Query the managed forward state and try to start the same forward again.

Expected Result

Recovery should reconcile existing forward state idempotently. If the required forward is already active and healthy, it should report success or an explicit no-op instead of a restoration failure.

Actual Result

The agent gateway starts, but recovery reports that the forward on port 18791 could not be restored. Both 18791 and 8642 are listening, and a subsequent forward-start attempt reports that the port is already forwarded. The CLI therefore reports failure for an active state and makes recovery status ambiguous.

Logs

Not captured

---

NVB#6470507