#12048 [Ubuntu 24.04][CLI&UX][Regression] policy remove exits nonzero after successfully removing a preset

[!WARNING] Regression — the applied-preset add, list, and remove lifecycle worked in v0.0.110 after #9295 was fixed, but the post-removal verification fails in v0.0.126.

Description

NemoClaw removes an applied network-policy preset from the live sandbox, but then reports that the resulting base policy does not match the requested policy and exits with status 1. A fresh policy readback confirms that the preset is already absent, so the command reports failure after completing the requested mutation.

Platform scope: Reproduced on Ubuntu 24.04 x86_64 only; other platforms not tested.

Regression: Yes — the applied-preset add, list, and remove lifecycle exited successfully in v0.0.110 after GitHub issue #9295 was fixed; this post-removal verification failure reproduces in v0.0.126.

OpenShell issue: No — the failing product surface is NemoClaw's result verification and exit status after the live policy was successfully changed.

Environment

Device:        Ubuntu 24.04 x86_64 test VM
OS:            Ubuntu 24.04 LTS
Architecture:  x86_64
Node.js:       v22.23.2
npm:           Not captured
Docker:        Docker Engine 29.8.1
OpenShell CLI: openshell 0.0.116
NemoClaw:      v0.0.126
OpenClaw:      2026.7.1

Steps to Reproduce

Onboard an OpenClaw sandbox and wait for it to reach Ready.
Confirm that the Outlook preset is not applied:
```
nemoclaw {sandbox} policy list
```

Preview and apply the preset:

nemoclaw {sandbox} policy add outlook --dry-run
nemoclaw {sandbox} policy add outlook --yes

Remove the applied preset:

nemoclaw {sandbox} policy remove outlook --yes

Read the live policy again:
```
nemoclaw {sandbox} policy list
```

Retry the removal:

nemoclaw {sandbox} policy remove outlook --yes

Expected Result

The first policy remove command removes the Outlook preset, prints a successful removal result, and exits 0. The following policy list shows Outlook as not applied. A later removal attempt may exit nonzero with a clear already-absent message.

Actual Result

The first policy remove command changes the live policy but exits 1:

NemoClaw applied the sandbox policy for '{sandbox}', but the resulting base policy did not match the requested policy. The policy update is incomplete.

The following policy list confirms that Outlook is absent. Retrying policy remove exits 1 with:

Preset 'outlook' is not applied.

Logs

$ nemoclaw {sandbox} policy add outlook --yes
Applied preset: outlook
EXIT:0

$ nemoclaw {sandbox} policy remove outlook --yes
NemoClaw applied the sandbox policy for '{sandbox}', but the resulting base policy did not match the requested policy. The policy update is incomplete.
EXIT:1

$ nemoclaw {sandbox} policy list
Outlook is not applied.
EXIT:0

$ nemoclaw {sandbox} policy remove outlook --yes
Preset 'outlook' is not applied.
EXIT:1