Summary: nemoclaw rebuild handles the full upgrade lifecycle — it backs up workspace state, strips credentials, destroys and recreates the sandbox, restores the workspace, and runs a health check automatically.

Direct Answer: Use nemoclaw <name> rebuild. It backs up workspace state to ~/.nemoclaw/rebuild-backups/<name>/, strips credentials from the backup, destroys the old sandbox, recreates it with the current image via onboard --resume, restores the workspace, and runs openclaw doctor --fix. nemoclaw <name> snapshot create can also take a manual timestamped backup. Source: Commands: rebuild and snapshot.