fix(docs)!: consolidate the whole retired-OpenClaw docs sweep into one change

src/content/docs/recipes/coder/arch-coder.md

@@ -162,7 +162,6 @@ Conflicts with [`/charly-coder:fedora-coder`](/recipes/coder/fedora-coder/) / [`
 - [`/charly-coder:debian-coder`](/recipes/coder/debian-coder/) — deb-family sibling on Debian 13.
 - [`/charly-coder:ubuntu-coder`](/recipes/coder/ubuntu-coder/) — deb-family sibling on Ubuntu 24.04 (adopt mode).
 - [`/charly-coder:charly-arch`](/recipes/coder/charly-arch/) — slimmer Arch alternative with just the charly toolchain (no AI CLIs or DevOps tooling).
-- [`/charly-openclaw:openclaw-desktop`](/recipes/openclaw/openclaw-desktop/) — adds a browser-streamed Wayland desktop (plus the openclaw gateway, AI CLIs, and a CPU ollama) with the same rootless charly toolchain.
 
 ## Related layers
 

src/content/docs/recipes/coder/charly-arch.md

@@ -59,10 +59,8 @@ Resolved OCI security label:
 | `devices` | `[/dev/fuse, /dev/net/tun]` (from [`/charly-distros:container-nesting`](/recipes/distros/container-nesting/)) |
 | `privileged` | `false` |
 
-See [`/charly-openclaw:openclaw-desktop`](/recipes/openclaw/openclaw-desktop/) for the sibling rootless-first
-box that proves this posture works under streaming-desktop +
-nested-VM load, and [`/charly-distros:container-nesting`](/recipes/distros/container-nesting/) for the kernel
-`mount_too_revealing()` RCA.
+See [`/charly-distros:container-nesting`](/recipes/distros/container-nesting/) for the kernel
+`mount_too_revealing()` RCA, and `fedora-coder` for a sibling rootless-first box.
 
 ### Network + port publishing
 
@@ -73,8 +71,7 @@ mappings to work with. (That leg also handles host-networked containers
 via `HostConfig.NetworkMode` detection — `ContainerInspection.IsHostNetworked()` in
 `sdk/kit/checkvars.go` — so the bridge isn't strictly required
 — but it remains the portable default.) If host-port 2222 is already taken by
-another running box (canonical conflict: [`/charly-openclaw:openclaw-desktop`](/recipes/openclaw/openclaw-desktop/)
-or any `selkies-desktop-*` variant), remap at config time:
+another running box (canonical conflict: any `selkies-desktop-*` variant), remap at config time:
 `charly config charly-arch -p 2223:2222`.
 
 ### MCP gateway (charly-mcp)
@@ -199,7 +196,6 @@ packages and scripts per distro.
 - [`/charly-distros:arch`](/recipes/distros/arch/) — parent base image
 - [`/charly-distros:charly-fedora`](/recipes/distros/charly-fedora/) — Fedora counterpart, same candies, same rootless posture
 - [`/charly-coder:fedora-coder`](/recipes/coder/fedora-coder/) — kitchen-sink dev sibling (adds coding CLIs + DevOps)
-- [`/charly-openclaw:openclaw-desktop`](/recipes/openclaw/openclaw-desktop/) — streaming-desktop counterpart (charly toolchain + browser-accessible Wayland); shares the rootless-first posture
 - [`/charly-distros:githubrunner`](/recipes/distros/githubrunner/) — self-hosted GitHub Actions runner; same uid=1000 posture
 
 ## Related Commands

src/content/docs/recipes/coder/codex.md

@@ -26,10 +26,6 @@ my-box:
         candy: [codex]
 ```
 
-## Used In Boxes
-
-- `openclaw-full` (via `openclaw-full` metalayer)
-
 ## Related Candies
 - [`/charly-coder:nodejs`](/recipes/coder/nodejs/) — Required Node.js runtime parent dependency
 - [`/charly-coder:claude-code`](/recipes/coder/claude-code/) — Sibling AI coding agent CLI bundled in same metalayers

src/content/docs/recipes/coder/fedora-coder.md

@@ -11,8 +11,7 @@ description: "Kitchen-sink development box: coding + AI-coding CLIs + DevOps too
 
 The everyday-development counterpart to [`/charly-distros:charly-fedora`](/recipes/distros/charly-fedora/): all the
 coding + AI + DevOps tooling a developer needs in one box, no desktop,
-no streaming. Distinct from `openclaw-desktop` (which adds the
-browser-streamed Wayland desktop) — `fedora-coder` is headless and
+no streaming. `fedora-coder` is headless and
 meant to be accessed via `ssh -p 2222` or `charly shell`.
 
 > **Location:** lives in the **`opencharly/distro-fedora`** repo (git submodule at
@@ -85,8 +84,7 @@ normal `-p host:container` remapping (e.g. running `arch-coder` alongside
 
 No `uid:` / `gid:` / `user:` / `security:` override — inherits
 `1000/1000/user` from `defaults` and the candy-level security from
-[`/charly-distros:container-nesting`](/recipes/distros/container-nesting/). Rootless-first by design (shares this
-posture with [`/charly-openclaw:openclaw-desktop`](/recipes/openclaw/openclaw-desktop/)).
+[`/charly-distros:container-nesting`](/recipes/distros/container-nesting/). Rootless-first by design.
 
 ## Resolved security posture (OCI label)
 
@@ -251,7 +249,6 @@ All four produce the same daily-dev surface (sshd on 2222, charly-mcp on 18765,
 
 ## Related Boxes
 
-- [`/charly-openclaw:openclaw-desktop`](/recipes/openclaw/openclaw-desktop/) — sibling rootless-first power-user box; same security posture + container-nesting, but adds the streaming desktop. Prefer when you want browser-accessible GUI + dev tools.
 - [`/charly-distros:charly-fedora`](/recipes/distros/charly-fedora/) — minimal charly toolchain (no coding CLIs, no DevOps), also uid=1000 with sudo.
 - [`/charly-coder:charly-arch`](/recipes/coder/charly-arch/) — Arch Linux counterpart of charly-fedora.
 - [`/charly-distros:githubrunner`](/recipes/distros/githubrunner/) — self-hosted GitHub Actions runner; same uid=1000 posture.
@@ -273,7 +270,7 @@ All four produce the same daily-dev surface (sshd on 2222, charly-mcp on 18765,
 
 - Building, deploying, or troubleshooting the `fedora-coder` box.
 - Picking the right power-user base image for a coding/dev workload (this
-  vs. `charly-fedora` vs. `charly-arch` vs. `openclaw-desktop`).
+  vs. `charly-fedora` vs. `charly-arch`).
 - Understanding the rootless-first architectural pattern shared by the
   four power-user boxes (kernel RCA belongs in
   [`/charly-distros:container-nesting`](/recipes/distros/container-nesting/); the composition that proves it works

src/content/docs/recipes/coder/gemini.md

@@ -26,14 +26,10 @@ my-box:
         candy: [gemini]
 ```
 
-## Used In Boxes
-
-- `openclaw-full` (via `openclaw-full` metalayer)
-
 ## Related Candies
 - [`/charly-coder:nodejs`](/recipes/coder/nodejs/) — required runtime dependency
-- [`/charly-coder:claude-code`](/recipes/coder/claude-code/) — sibling AI CLI in openclaw-full and hermes-full
-- [`/charly-coder:codex`](/recipes/coder/codex/) — sibling AI CLI in openclaw-full and hermes-full
+- [`/charly-coder:claude-code`](/recipes/coder/claude-code/) — sibling AI CLI in hermes-full
+- [`/charly-coder:codex`](/recipes/coder/codex/) — sibling AI CLI in hermes-full
 
 ## Related Commands
 - [`/charly-build:secrets`](/recipes/build/secrets/) — provision Gemini API credentials for the CLI

src/content/docs/recipes/coder/gh.md

@@ -82,7 +82,6 @@ my-box:
 ## Used In Boxes
 
 - [`/charly-coder:charly-arch`](/recipes/coder/charly-arch/), [`/charly-distros:charly-fedora`](/recipes/distros/charly-fedora/), [`/charly-coder:fedora-coder`](/recipes/coder/fedora-coder/) — power-user boxes that compose gh explicitly
-- [`/charly-openclaw:openclaw-desktop`](/recipes/openclaw/openclaw-desktop/) — streaming-desktop sibling
 - Any box composing `hermes-full`
 
 ## Related Candies

src/content/docs/recipes/coder/oracle.md

@@ -26,13 +26,8 @@ my-box:
         candy: [oracle]
 ```
 
-## Used In Boxes
-
-- `openclaw-full` (via `openclaw-full` metalayer)
-
 ## Related Candies
 - [`/charly-coder:nodejs`](/recipes/coder/nodejs/) -- runtime dependency
-- [`/charly-openclaw:openclaw-full`](/recipes/openclaw/openclaw-full/) -- parent metalayer that bundles oracle
 
 ## Related Commands
 - [`/charly-automation:openclaw-deploy`](/recipes/automation/openclaw-deploy/) -- gateway/skill configuration

src/content/docs/recipes/distros/charly-fedora.md

@@ -57,8 +57,7 @@ Resolved OCI security label:
 | `devices` | `[/dev/fuse, /dev/net/tun]` (from [`/charly-distros:container-nesting`](/recipes/distros/container-nesting/)) |
 | `privileged` | `false` |
 
-See [`/charly-openclaw:openclaw-desktop`](/recipes/openclaw/openclaw-desktop/) (streaming-desktop sibling) and
-[`/charly-coder:fedora-coder`](/recipes/coder/fedora-coder/) (kitchen-sink dev sibling) for other boxes
+See [`/charly-coder:fedora-coder`](/recipes/coder/fedora-coder/) (kitchen-sink dev sibling) for another box
 sharing this posture, and [`/charly-distros:container-nesting`](/recipes/distros/container-nesting/) for the
 kernel `mount_too_revealing()` RCA.
 
@@ -168,7 +167,6 @@ and scripts per distro.
 - [`/charly-distros:fedora`](/recipes/distros/fedora/) — parent base image
 - [`/charly-coder:charly-arch`](/recipes/coder/charly-arch/) — Arch counterpart, same layers, same rootless posture
 - [`/charly-coder:fedora-coder`](/recipes/coder/fedora-coder/) — kitchen-sink dev sibling (adds coding CLIs + DevOps)
-- [`/charly-openclaw:openclaw-desktop`](/recipes/openclaw/openclaw-desktop/) — streaming-desktop counterpart (charly toolchain + browser-accessible Wayland); shares the rootless-first posture
 - [`/charly-distros:githubrunner`](/recipes/distros/githubrunner/) — self-hosted GitHub Actions runner; same uid=1000 posture
 
 ## Related Commands

src/content/docs/recipes/distros/container-nesting.md

@@ -303,7 +303,7 @@ The resolved OCI label then unions to
 `cap_add:[ALL] + security_opt:[unmask=/proc/*, label=disable, seccomp=unconfined]`,
 which matches their historical posture.
 
-Rootless boxes like [`/charly-openclaw:openclaw-desktop`](/recipes/openclaw/openclaw-desktop/) don't add a
+A rootless box that composes this candy adds no
 box-level `security:` block, so the resolved posture stays at
 `security_opt:[unmask=/proc/*]` only — zero capability escalation.
 
@@ -315,11 +315,11 @@ box-level `security:` block, so the resolved posture stays at
 
 ```yaml
 # charly.yml
-openclaw-desktop:
+my-rootless-box:
   base: cachyos.cachyos
   candy:
     - selkies-desktop
-    - openclaw-full
+    - my-openclaw-layer
     - ollama
     - charly
     - container-nesting   # donates unmask + devices + config + env
@@ -353,16 +353,16 @@ Both paths work; they just resolve to different OCI security labels.
 ## Verification
 
 ```bash
-# Rootless posture on openclaw-desktop
-charly box inspect openclaw-desktop | jq '.HostConfig? // .Config.Labels."ai.opencharly.security"'
+# Rootless posture on the box
+charly box inspect my-rootless-box | jq '.HostConfig? // .Config.Labels."ai.opencharly.security"'
 # → cap_add:[], security_opt:[unmask=/proc/*], devices:[/dev/fuse,/dev/net/tun]
 
 # Nested podman smoke (inside the running container)
-charly shell openclaw-desktop -c 'podman run --rm quay.io/libpod/alpine:latest true'
+charly shell my-rootless-box -c 'podman run --rm quay.io/libpod/alpine:latest true'
 # → exit 0, NO "mount proc to proc: Operation not permitted"
 
 # Diagnostic: inspect the OCI spec generated for a nested container
-charly shell openclaw-desktop -c '
+charly shell my-rootless-box -c '
   podman create --name t quay.io/libpod/alpine:latest /bin/true >/dev/null
   sf=$(find ~/.local/share/containers -name config.json -path "*/userdata/*" | head -1)
   jq ".linux.maskedPaths" "$sf"'
@@ -379,7 +379,6 @@ this order:
 
 ## Used In Boxes
 
-- [`/charly-openclaw:openclaw-desktop`](/recipes/openclaw/openclaw-desktop/) — rootless path; box-level adds nothing
 - [`/charly-distros:charly-fedora`](/recipes/distros/charly-fedora/) — root path; box-level adds `cap_add:[ALL] + security_opt:[label=disable, seccomp=unconfined]`
 - [`/charly-coder:charly-arch`](/recipes/coder/charly-arch/) — same root path as charly-fedora
 - [`/charly-distros:githubrunner`](/recipes/distros/githubrunner/) — same root path; doesn't compose the full charly toolchain but keeps nested podman for CI workloads
@@ -404,7 +403,7 @@ this order:
 - Authoring or debugging any candy/box that needs nested podman, buildah, or skopeo.
 - Chasing `mount_too_revealing` / `mount proc to proc: Operation not permitted` errors — this is the authoritative RCA.
 - Choosing between `--privileged`, `cap_add: ALL`, and `unmask=/proc/*` — this skill documents why the surgical `unmask` fix is the minimum-privilege path and the others are hammers.
-- Evaluating the security posture of [`/charly-openclaw:openclaw-desktop`](/recipes/openclaw/openclaw-desktop/), [`/charly-distros:charly-fedora`](/recipes/distros/charly-fedora/), [`/charly-coder:charly-arch`](/recipes/coder/charly-arch/), or [`/charly-distros:githubrunner`](/recipes/distros/githubrunner/).
+- Evaluating the security posture of [`/charly-distros:charly-fedora`](/recipes/distros/charly-fedora/), [`/charly-coder:charly-arch`](/recipes/coder/charly-arch/), or [`/charly-distros:githubrunner`](/recipes/distros/githubrunner/).
 
 ## Related
 

src/content/docs/recipes/distros/githubrunner.md

@@ -10,7 +10,7 @@ description: "Self-hosted GitHub Actions runner on CachyOS, fully rootless — r
 # githubrunner
 
 Self-hosted GitHub Actions runner on **CachyOS**, fully rootless. Shares the
-rootless nested-container posture with [`/charly-openclaw:openclaw-desktop`](/recipes/openclaw/openclaw-desktop/) (uid=1000,
+rootless nested-container posture (uid=1000,
 no caps, `unmask=/proc/*` via [`/charly-distros:container-nesting`](/recipes/distros/container-nesting/)).
 
 ## Box Properties
@@ -124,7 +124,6 @@ charly remove githubrunner -e RUNNER_TOKEN=<remove-token>
 ## Related Boxes
 
 - [`/charly-distros:cachyos`](/recipes/distros/cachyos/) — the CachyOS base (parent, via the `cachyos` namespace)
-- [`/charly-openclaw:openclaw-desktop`](/recipes/openclaw/openclaw-desktop/) — same rootless container-nesting posture (uid 1000, no caps)
 - [`/charly-distros:charly-fedora`](/recipes/distros/charly-fedora/), [`/charly-coder:charly-arch`](/recipes/coder/charly-arch/) — the charly-toolchain siblings (root path, box-level full-hammer security)
 
 ## Related Commands

src/content/docs/recipes/hermes/playwright-layer.md

@@ -27,13 +27,8 @@ my-box:
       - '@github.com/opencharly/layer-playwright'
 ```
 
-## Used In Boxes
-
-- `openclaw-full` (via `openclaw-full` metalayer)
-
 ## Related Candies
 - [`/charly-coder:nodejs`](/recipes/coder/nodejs/) -- runtime dependency
-- [`/charly-openclaw:openclaw-full`](/recipes/openclaw/openclaw-full/) -- parent metalayer that bundles playwright
 - [`/charly-selkies:chrome`](/recipes/selkies/chrome/) -- browser commonly driven by playwright
 
 ## Related Commands

src/content/docs/recipes/index.md

@@ -400,14 +400,10 @@ Self-contained skills for running the ollama LLM-server image.
 
 ### charly-openclaw
 
-Self-contained skills for the openclaw image family (CachyOS base): the headless openclaw gateway and the maximal non-browser openclaw-full.
+Self-contained skills for the openclaw image family (CachyOS base): the headless openclaw gateway and its gateway layer.
 
 - [clawhub](/recipes/openclaw/clawhub/)
 - [openclaw](/recipes/openclaw/openclaw/)
-- [openclaw-desktop](/recipes/openclaw/openclaw-desktop/)
-- [openclaw-full](/recipes/openclaw/openclaw-full/)
-- [openclaw-full-layer](/recipes/openclaw/openclaw-full-layer/)
-- [openclaw-full-ml-layer](/recipes/openclaw/openclaw-full-ml-layer/)
 - [openclaw-layer](/recipes/openclaw/openclaw-layer/)
 
 ### charly-openwebui

src/content/docs/recipes/infrastructure/sqlite.md

@@ -31,13 +31,8 @@ my-box:
       - sqlite
 ```
 
-## Used In Boxes
-
-- `openclaw-full` (via `openclaw-full` metalayer)
-
 ## Related Candies
 - [`/charly-coder:dev-tools`](/recipes/coder/dev-tools/) -- common dev CLI bundle that pairs with sqlite
-- [`/charly-openclaw:openclaw-full`](/recipes/openclaw/openclaw-full/) -- parent metalayer that bundles sqlite
 
 ## Related Commands
 - [`/charly-core:shell`](/recipes/core/shell/) -- run sqlite3 inside the container

src/content/docs/recipes/infrastructure/tmux-layer.md

@@ -31,10 +31,6 @@ my-box:
       - '@github.com/opencharly/layer-tmux'
 ```
 
-## Used In Boxes
-
-- `openclaw-full` (via `openclaw-full` metalayer)
-
 ## Related Skills
 
 - [`/charly-automation:tmux`](/recipes/automation/tmux/) — Typed persistent terminals, safe input, snapshots, transcripts, and agent runtimes

src/content/docs/recipes/infrastructure/virtualization.md

@@ -158,8 +158,7 @@ Two deliberate choices:
 - **No `user=` directive.** The supervisord programs inherit the parent
   supervisord's uid. On `charly-fedora`/`charly-arch`/`githubrunner`,
   supervisord runs as uid 0 → daemons run as uid 0 →
-  `qemu:///session` targets root's session. On `openclaw-desktop`,
-  supervisord runs as uid 1000 → daemons run as uid 1000 →
+  `qemu:///session` targets root's session. On a box whose supervisord runs as uid 1000 → daemons run as uid 1000 →
   `qemu:///session` targets user's session. Both work because the
   session URI keys off `$XDG_RUNTIME_DIR` rather than a fixed socket
   path.
@@ -184,7 +183,7 @@ This candy makes that URI actually work inside a container at uid
   gets KVM acceleration.
 - `virsh -c qemu:///session domcapabilities` reports
   `<domain>kvm</domain>` once the daemons are running — verified
-  on `openclaw-desktop` at uid 1000.
+  on a rootless box at uid 1000.
 
 ## Tests baked into the candy
 
@@ -224,7 +223,7 @@ See [`/charly-check:check`](/recipes/check/check/) "`package:` + `package_map:`
 
 ```yaml
 # charly.yml — rootless nested VM image
-openclaw-desktop:
+my-rootless-vm-box:
   candy:
     - ...
     - charly                  # the full toolchain — pulls virtualization
@@ -253,7 +252,6 @@ Drops on deb: `gvisor-tap-vsock`, `podman-machine` (not packaged; VM-mode networ
 
 ## Used In Boxes
 
-- [`/charly-openclaw:openclaw-desktop`](/recipes/openclaw/openclaw-desktop/) — rootless VM host inside a streaming desktop
 - [`/charly-distros:charly-fedora`](/recipes/distros/charly-fedora/) — root VM host (same daemons, uid 0)
 - [`/charly-coder:charly-arch`](/recipes/coder/charly-arch/) — Arch counterpart
 - [`/charly-coder:debian-coder`](/recipes/coder/debian-coder/), [`/charly-coder:ubuntu-coder`](/recipes/coder/ubuntu-coder/) — deb-based consumers (via the `charly` candy)

src/content/docs/recipes/ollama/ollama.md

@@ -79,7 +79,7 @@ and Volumes.)
   such list through the Arch-only rule above, which is the part that does not
   move.
 - A consumer that composes neither pays for neither ON A PACKAGED DISTRO —
-  e.g. [`/charly-openclaw:openclaw-desktop`](/recipes/openclaw/openclaw-desktop/) (cachyos base, no GPU candy). On a
+  e.g. a CachyOS base with no GPU candy. On a
   tarball distro it still carries the bundled CUDA backend.
 
 ## Ports
@@ -177,7 +177,6 @@ composition.
 
 - [`/charly-distros:nvidia`](/recipes/distros/nvidia/) — the GPU base family
 - [`/charly-distros:cachyos`](/recipes/distros/cachyos/) — the CachyOS image family, which carries its own ollama boxes
-- [`/charly-openclaw:openclaw-desktop`](/recipes/openclaw/openclaw-desktop/) — a desktop image that serves a local ollama
 - [`/charly-jupyter:jupyter-ml-notebook`](/recipes/jupyter/jupyter-ml-notebook/) — receives `OLLAMA_HOST` via env_provide when ollama is deployed
 - [`/charly-openwebui:openwebui`](/recipes/openwebui/openwebui/) — receives `OLLAMA_HOST` via env_provide, auto-configures as `OLLAMA_BASE_URL`
 

src/content/docs/recipes/openclaw/clawhub.md

@@ -27,13 +27,8 @@ my-box:
             - clawhub
 ```
 
-## Used In Boxes
-
-- `openclaw-full` (via `openclaw-full` metalayer)
-
 ## Related Candies
 - [`/charly-coder:nodejs`](/recipes/coder/nodejs/) — Required Node.js runtime parent dependency
-- [`/charly-openclaw:openclaw-full`](/recipes/openclaw/openclaw-full/) — Metalayer bundling clawhub with codex/gemini/claude-code
 - [`/charly-openclaw:openclaw`](/recipes/openclaw/openclaw/) — OpenClaw gateway service that consumes installed skills
 
 ## Related Commands