docs(readme): explain validate_state self-heal + add FAQ for 'all skipped'

When state markers say done but artifacts vanished, the previous wording
('check state_has KEY, skip if done; delete a line to retry') hid the
trap users actually hit: install reports [skip] for everything while the
clone or .env or sandbox overlay is missing, and the final summary
keeps warning about an unset sandbox.

- Idempotency section: add 'Artifact verification (validate_state)'
  subsection with a table of detection conditions and the markers that
  get auto-cleared. Note the SANDBOX_DEFERRED follow-up that prevents
  the original 'docker.sock not ready on first install' stuck-marker
  regression. Reframe the contract as 'counts as done only while the
  artifact still exists', not 'ran once and forgot'.
- FAQ: new entry 'install keeps printing [skip] but nothing works' with
  the typical causes (manual delete · Docker Desktop still booting on
  first install) and the one-line recovery (git pull → install →
  doctor).
- Sync KO + EN.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: GoGoComputer

README.en.md

@@ -460,6 +460,26 @@ Easiest: `openclaw models add <name>` (auto-edits `.env` + pulls). To see what y
 Just rerun `./openclaw install`. Already-completed steps are marked `[skip]` and only the rest runs. State file: `~/.openclaw-mgr/state`.
 </details>
 
+<details>
+<summary><b>Install keeps printing <code>[skip]</code> for every step and ends with a "sandbox not configured" warning</b></summary>
+
+The state file claims "done" but the actual artifacts (clone dir / `.env` / sandbox compose overlay) have disappeared. Common causes:
+
+- You manually deleted `~/DEV/openclaw`
+- The very first install ran while Docker Desktop was still booting; `docker.sock` wasn't ready, so `step_sandbox` exited early and the marker got stuck at `done`
+
+**Auto-recovery:** `./openclaw install` runs `validate_state` at startup and clears stale markers whose artifacts are missing — so just rerun:
+
+```bash
+cd ~/DEV/openclawAgent/openclaw-workspace
+git pull --ff-only origin main   # pull in the validate_state patch
+./openclaw install               # re-runs only the steps that were faked
+./openclaw doctor                # verify
+```
+
+To wipe and start clean: `rm ~/.openclaw-mgr/state && ./openclaw install`.
+</details>
+
 <details>
 <summary><b>My Mac feels slow / memory is full</b></summary>
 
@@ -599,6 +619,20 @@ openclaw-mgr/
 
 `~/.openclaw-mgr/state` accumulates `KEY=done` lines per completed step. `./openclaw install` checks each key and skips done steps. To rerun a single step, delete its line.
 
+#### 🔄 Artifact verification (`validate_state`)
+
+If the state file claims "done" but the **actual artifacts have vanished**, install clears those markers at startup. This prevents the classic trap: user deletes a folder or cleans up containers → reruns install → it forever reports `[skip]` because the markers say "done" without checking reality.
+
+| Detected condition | Markers auto-cleared |
+|---|---|
+| `OPENCLAW_DIR/.git` missing (clone gone) | `repo_clone` · `compose_scan` · `env_merge` · `compose_up` · `health` · `lockdown` · `sandbox` |
+| `OPENCLAW_DIR/.env` missing | `env_merge` · `compose_up` · `health` · `lockdown` · `sandbox` |
+| `docker-compose.sandbox.yml` missing while `docker.sock` is ready | `sandbox` |
+
+Additionally, when `step_sandbox` is deferred because `docker.sock` wasn't ready (`SANDBOX_DEFERRED=1`), the marker is cleared after `run_step` so the next install retries — preventing the previous bug where a marker got stuck at `done` if Docker Desktop was still booting on the first install.
+
+The real idempotency contract is **"counts as done only while the artifact still exists"**, not "ran it once and forgot".
+
 ### Static checks
 
 ```bash

README.md

@@ -653,6 +653,26 @@ brew services restart ollama
 `./openclaw install` 을 다시 실행하세요. 이미 끝난 단계는 `[skip]` 로 표시되고 남은 단계만 진행합니다. (상태 파일: `~/.openclaw-mgr/state`)
 </details>
 
+<details>
+<summary><b>install 이 자꾸 <code>[skip]</code> 만 뜨고 마지막에 "샌드박스 미설정" 경고가 떠요</b></summary>
+
+state 파일이 "다 됐다"고 주장하는데 실제 산출물(클론·.env·sandbox compose 오버레이)이 사라진 케이스입니다. 대표적인 발생 경로:
+
+- `~/DEV/openclaw` 를 수동으로 지웠음
+- Docker Desktop 부팅 직후 install 했을 때 `docker.sock` 이 잠깐 안 잡혀서 `step_sandbox` 가 일찍 빠졌고, 그 사이 마커가 박힘
+
+**자동 복구:** `./openclaw install` 진입 직후 `validate_state` 가 산출물 부재를 감지해 관련 마커를 자동으로 해제합니다 — 그냥 다시 install 한 번이면 됩니다.
+
+```bash
+cd ~/DEV/openclawAgent/openclaw-workspace
+git pull --ff-only origin main   # validate_state 패치 받기
+./openclaw install               # 자동으로 빠진 단계만 다시 실행
+./openclaw doctor                # 검증
+```
+
+수동으로 처음부터 다시 깨끗이 하고 싶으면 `rm ~/.openclaw-mgr/state` 후 `./openclaw install`.
+</details>
+
 <details>
 <summary><b>맥북이 느려졌어요 / 메모리가 가득 찼어요</b></summary>
 
@@ -820,10 +840,26 @@ compose_scan=done
 env_merge=done
 compose_up=done
 health=done
+lockdown=done
+sandbox=done
 ```
 
 `./openclaw install` 은 `state_has KEY` 검사 후 `done` 이면 단계를 건너뜁니다. 특정 단계만 다시 돌리려면 그 줄을 지우면 됩니다.
 
+#### 🔄 산출물 자동 검증 (`validate_state`)
+
+state 파일이 "다 됐다"고 말하는데 **실제 산출물이 사라졌으면** install 시작 직후 마커를 자동으로 해제합니다. "사용자가 폴더를 지우거나 컨테이너를 정리한 뒤 다시 install 했더니 영원히 `[skip]` 만 뜨더라" 같은 함정을 방지합니다.
+
+| 발견 조건 | 자동 해제되는 마커 |
+|---|---|
+| `OPENCLAW_DIR/.git` 부재 (클론이 사라짐) | `repo_clone` · `compose_scan` · `env_merge` · `compose_up` · `health` · `lockdown` · `sandbox` |
+| `OPENCLAW_DIR/.env` 부재 | `env_merge` · `compose_up` · `health` · `lockdown` · `sandbox` |
+| `docker-compose.sandbox.yml` 부재 + `docker.sock` 가용 | `sandbox` |
+
+추가로 `step_sandbox` 가 `docker.sock` 부재로 보류된 경우(`SANDBOX_DEFERRED=1`) `run_step` 후에 마커를 다시 풀어, 다음 install 에서 자동 재시도되도록 합니다. 한 번 `done` 으로 박혀 영영 스킵되는 과거 버그(Docker Desktop 부팅 직후 install 했을 때 흔히 발생) 재발 방지.
+
+요약: **"한 번 한 건 안 다시 한다"가 아니라 "산출물이 아직 있을 때만 한 걸로 친다"** 가 진짜 멱등 계약.
+
 ### 정적 검사
 
 ```bash