fix(docs)!: rewrite the two pages that documented the retired openclaw box

src/content/docs/recipes/automation/openclaw-deploy.md

@@ -1,6 +1,6 @@
 ---
 title: "openclaw-deploy"
-description: "OpenClaw gateway configuration, model auth, browser integration, channel setup, or any box composing `openclaw-*` candies (`openclaw`, `openclaw-full`, or a custom box composing openclaw + sway-desktop)."
+description: "OpenClaw gateway configuration, model auth, browser integration, channel setup, or any box composing the `openclaw` candy family (the gateway candy `openclaw`, `openclaw`, or a custom box composing openclaw + sway-desktop)."
 ---
 
 <!-- DO-NOT-EDIT — generated by `charly docs generate`; the opencharly/docs repo's deploy workflow regenerates this tree against its pinned charly checkout. -->
@@ -13,7 +13,7 @@ description: "OpenClaw gateway configuration, model auth, browser integration, c
 
 OpenClaw is an AI gateway that connects LLM agents to messaging channels (WhatsApp, Telegram, Discord, Slack, Signal, iMessage, IRC, Teams) and exposes them via a WebSocket API, CLI, and web Control UI. It runs as a Node.js process with an embedded agent runtime, model failover, browser automation, and multi-agent routing.
 
-In OpenCharly, OpenClaw runs as a supervisord service inside containers. The `openclaw` candy provides the npm package; compose it with the `sway-desktop` metalayer (full Sway desktop + Chrome browser + VNC) for browser-based workflows like OAuth and web automation. For a desktop+browser box, compose your own from the candies (shown below); for non-browser channels use the headless `openclaw` / `openclaw-full` boxes.
+In OpenCharly, OpenClaw runs as a supervisord service inside containers. The `openclaw` candy provides the npm package; the family's box composes it with `sway-desktop` metalayer (full Sway desktop + Chrome browser + VNC) for browser-based workflows like OAuth and web automation. For a desktop+browser box, compose your own from the candies (shown below); for non-browser channels use the headless `openclaw` / `openclaw` boxes.
 
 The gateway listens on port 18789 (WebSocket + HTTP). All CLI commands (`openclaw *`) connect to the gateway WebSocket. The Control UI is served at the gateway root URL. Config is stored in `~/.openclaw/openclaw.json` (JSON5 format).
 
@@ -54,19 +54,7 @@ The gateway binds to loopback only (no `--bind lan`). External access is handled
 
 ### Box
 
-Compose your own desktop+browser box — e.g. an `openclaw-desktop` entry in `charly.yml` combining `openclaw-full` + `sway-desktop` on a Fedora base:
-
-```yaml
-openclaw-desktop:
-  candy:
-    base: fedora
-    candy:
-      - '@github.com/opencharly/layer-agent-forwarding'
-      - '@github.com/opencharly/layer-openclaw-full'
-      - '@github.com/opencharly/layer-sway-desktop'
-      - '@github.com/opencharly/pod-dbus'
-      - charly
-```
+The OpenClaw family owns this box: `opencharly/layer-openclaw` provides `box/openclaw` (gateway plus desktop composition) and the R10 witness for it. Import the family under the `openclaw` namespace and deploy its box rather than hand-assembling candies.
 
 A box declares no ports of its own — the composed candies publish them (openclaw
 18789, wayvnc 5900, chrome 9222/9224) and `charly config -p` remaps them at deploy
@@ -83,19 +71,19 @@ Tunnel config exposes all ports via Tailscale (`ports: all`). Platform: linux/am
 ### Host Alias
 
 ```bash
-charly alias add openclaw openclaw-desktop
+charly alias add openclaw openclaw.openclaw
 # Now: openclaw --help  (runs inside the container)
 ```
 
 ### Lifecycle
 
 ```bash
-charly box build openclaw-desktop         # Build image
-charly config openclaw-desktop        # Generate quadlet, daemon-reload
-charly start openclaw-desktop         # Start via systemd
-charly stop openclaw-desktop          # Stop
-charly status openclaw-desktop        # Check systemd status
-charly logs openclaw-desktop -f       # Follow container logs
+charly box build openclaw.openclaw         # Build image
+charly config openclaw.openclaw        # Generate quadlet, daemon-reload
+charly start openclaw.openclaw         # Start via systemd
+charly stop openclaw.openclaw          # Stop
+charly status openclaw.openclaw        # Check systemd status
+charly logs openclaw.openclaw -f       # Follow container logs
 ```
 
 ## Gateway Configuration
@@ -249,7 +237,7 @@ models: {
 
 ### Connecting to Existing Chrome
 
-In a composed openclaw desktop box (e.g. `openclaw-desktop`), Chrome already runs as a supervisord service on port 9222. OpenClaw must connect to it rather than launching a new instance:
+In a composed openclaw box (e.g. `openclaw.openclaw`), Chrome already runs as a supervisord service on port 9222. OpenClaw must connect to it rather than launching a new instance:
 
 ```bash
 openclaw config set browser.cdpUrl "http://127.0.0.1:9222"

src/content/docs/recipes/distros/container-nesting.md

@@ -303,7 +303,7 @@ The resolved OCI label then unions to
 `cap_add:[ALL] + security_opt:[unmask=/proc/*, label=disable, seccomp=unconfined]`,
 which matches their historical posture.
 
-Rootless boxes like [`/charly-openclaw:openclaw-desktop`](/recipes/openclaw/openclaw-desktop/) don't add a
+Rootless boxes like `/charly-distros:charly-fedora` don't add a
 box-level `security:` block, so the resolved posture stays at
 `security_opt:[unmask=/proc/*]` only — zero capability escalation.
 
@@ -315,11 +315,10 @@ box-level `security:` block, so the resolved posture stays at
 
 ```yaml
 # charly.yml
-openclaw-desktop:
+charly-fedora:
   base: cachyos.cachyos
   candy:
     - selkies-desktop
-    - openclaw-full
     - ollama
     - charly
     - container-nesting   # donates unmask + devices + config + env
@@ -353,16 +352,16 @@ Both paths work; they just resolve to different OCI security labels.
 ## Verification
 
 ```bash
-# Rootless posture on openclaw-desktop
-charly box inspect openclaw-desktop | jq '.HostConfig? // .Config.Labels."ai.opencharly.security"'
+# Rootless posture on charly-fedora
+charly box inspect charly-fedora | jq '.HostConfig? // .Config.Labels."ai.opencharly.security"'
 # → cap_add:[], security_opt:[unmask=/proc/*], devices:[/dev/fuse,/dev/net/tun]
 
 # Nested podman smoke (inside the running container)
-charly shell openclaw-desktop -c 'podman run --rm quay.io/libpod/alpine:latest true'
+charly shell charly-fedora -c 'podman run --rm quay.io/libpod/alpine:latest true'
 # → exit 0, NO "mount proc to proc: Operation not permitted"
 
 # Diagnostic: inspect the OCI spec generated for a nested container
-charly shell openclaw-desktop -c '
+charly shell charly-fedora -c '
   podman create --name t quay.io/libpod/alpine:latest /bin/true >/dev/null
   sf=$(find ~/.local/share/containers -name config.json -path "*/userdata/*" | head -1)
   jq ".linux.maskedPaths" "$sf"'
@@ -379,7 +378,7 @@ this order:
 
 ## Used In Boxes
 
-- [`/charly-openclaw:openclaw-desktop`](/recipes/openclaw/openclaw-desktop/) — rootless path; box-level adds nothing
+- `/charly-distros:charly-fedora` — rootless path; box-level adds nothing
 - [`/charly-distros:charly-fedora`](/recipes/distros/charly-fedora/) — root path; box-level adds `cap_add:[ALL] + security_opt:[label=disable, seccomp=unconfined]`
 - [`/charly-coder:charly-arch`](/recipes/coder/charly-arch/) — same root path as charly-fedora
 - [`/charly-distros:githubrunner`](/recipes/distros/githubrunner/) — same root path; doesn't compose the full charly toolchain but keeps nested podman for CI workloads
@@ -404,7 +403,7 @@ this order:
 - Authoring or debugging any candy/box that needs nested podman, buildah, or skopeo.
 - Chasing `mount_too_revealing` / `mount proc to proc: Operation not permitted` errors — this is the authoritative RCA.
 - Choosing between `--privileged`, `cap_add: ALL`, and `unmask=/proc/*` — this skill documents why the surgical `unmask` fix is the minimum-privilege path and the others are hammers.
-- Evaluating the security posture of [`/charly-openclaw:openclaw-desktop`](/recipes/openclaw/openclaw-desktop/), [`/charly-distros:charly-fedora`](/recipes/distros/charly-fedora/), [`/charly-coder:charly-arch`](/recipes/coder/charly-arch/), or [`/charly-distros:githubrunner`](/recipes/distros/githubrunner/).
+- Evaluating the security posture of `/charly-distros:charly-fedora`, [`/charly-distros:charly-fedora`](/recipes/distros/charly-fedora/), [`/charly-coder:charly-arch`](/recipes/coder/charly-arch/), or [`/charly-distros:githubrunner`](/recipes/distros/githubrunner/).
 
 ## Related
 

src/content/docs/recipes/tools/gifgrep.md

@@ -40,7 +40,6 @@ my-box:
 ## Related Candies
 - [`/charly-coder:golang`](/recipes/coder/golang/) — required Go toolchain dependency
 - [`/charly-openclaw:openclaw-full`](/recipes/openclaw/openclaw-full/) — metalayer that includes gifgrep
-- [`/charly-tools:goplaces`](/recipes/tools/goplaces/) — sibling Go-based CLI in openclaw-full
 
 ## Related Commands
 - [`/charly-build:build`](/recipes/build/build/) — compiles gifgrep via the Go builder during image build

src/content/docs/recipes/tools/gogcli.md

@@ -40,7 +40,6 @@ my-box:
 ## Related Candies
 - [`/charly-coder:golang`](/recipes/coder/golang/) — required Go toolchain dependency
 - [`/charly-openclaw:openclaw-full`](/recipes/openclaw/openclaw-full/) — metalayer that includes gogcli
-- [`/charly-tools:goplaces`](/recipes/tools/goplaces/) — sibling Google API CLI in openclaw-full
 
 ## Related Commands
 - [`/charly-build:secrets`](/recipes/build/secrets/) — provision Google OAuth credentials for gogcli

src/content/docs/recipes/tools/goplaces.md

@@ -40,7 +40,6 @@ my-box:
 ## Related Candies
 - [`/charly-coder:golang`](/recipes/coder/golang/) — required Go toolchain dependency
 - [`/charly-openclaw:openclaw-full`](/recipes/openclaw/openclaw-full/) — metalayer that includes goplaces
-- [`/charly-tools:gogcli`](/recipes/tools/gogcli/) — sibling Google API CLI in openclaw-full
 
 ## Related Commands
 - [`/charly-build:secrets`](/recipes/build/secrets/) — provision Google Places API key for the CLI

src/content/docs/recipes/tools/nano-pdf.md

@@ -33,7 +33,6 @@ my-box:
 ## Related Candies
 - [`/charly-languages:python`](/recipes/languages/python/) — required Python runtime dependency
 - [`/charly-openclaw:openclaw-full`](/recipes/openclaw/openclaw-full/) — metalayer that includes nano-pdf
-- [`/charly-coder:uv`](/recipes/coder/uv/) — sibling Python tooling in openclaw-full
 
 ## Related Commands
 - [`/charly-build:build`](/recipes/build/build/) — installs nano-pdf via the pixi builder during image build