Human login sessions run profile chains that extend PATH, HOME, and whatever you export during troubleshooting. Agents and daemons launched by launchd start from a minimal environment and do not source ~/.zshrc. When OpenClaw resolves the Gateway token it combines configuration files, environment variables, and state directories; any mismatch under supervision surfaces as token_missing_config or adjacent log signatures while the process exits in seconds. Dedicated cloud hosts help because you can freeze the variable set that supervision actually sees and attach it to change tickets instead of relying on a laptop export history.

If you are also chasing split brain or renamed auth keys after upgrades, read the migration section in upgrade and remote access. If you are unsure which command to run first, return to diagnostic ladder. This article intentionally avoids repeating that ladder verbatim and only adds launchd specific forks.

After you close those myths, whether to move regions belongs in the always on baseline story persistent setup; here we only fix supervised configuration reads.

SSH multiplexing adds another noise layer: engineers reach the Dashboard through forwarded ports in an interactive session while the daemon binds another loopback view or user, so humans see green while monitors stay red. Document listener addresses, bind modes, and token checks on one runbook page and mark temporary forwards versus production plist topology.

If the same host also runs self hosted CI or heavy Archives, CPU spikes and log rotation can drown the critical lines during the same window even when tokens are fine. Carve a quieter logging window or lower unrelated verbosity during incident windows.

When finance asks whether to buy another core SKU, answer with environment evidence first: attach the supervised env diff and the plist path stamp next to the ticket so approvers see that the incident was supervision drift rather than raw compute starvation. That single habit prevents expensive silicon purchases that never touch the real bottleneck.

Single source of truth means postmortems can state who read which path in one sentence. A practical compromise keeps secrets inside permission guarded openclaw.json while the plist injects only non secret locators such as the state root or profile name, avoiding long token duplication across fragments. When CLI and daemon read different file copies the logs resemble split brain, so compare openclaw doctor path stamps before reinstalling.

Pair with unattended probes by aligning probe shell env keys with plist keys so midnight scripts stay green while launchd stays red only when it should.

When gateway.mode remote mixes with local residents, add a second table for client env versus server plist env because remote clients read different token paths than cloud daemons; paste both logs into one ticket without labeling roles and you will misfile client misses as server misses.

Twice yearly audits should spot plists still pointing at retired home directories after contractors leave; drift like that rarely breaks builds yet can resurrect token loops after silent restarts.

Before touching production plists, schedule a disposable LaunchAgent that runs /bin/sh -lc 'env | sort' to capture the real supervised key set, then swap in real openclaw gateway arguments. On leased nodes the usual gap is PATH missing Homebrew or npm global prefixes, yielding doctor success but daemon failure. Freeze a minimal PATH in the ticket instead of inheriting dozens of prefixes from a laptop.

<key>EnvironmentVariables</key>
<dict>
  <key>PATH</key>
  <string>/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
  <key>OPENCLAW_STATE_DIR</key>
  <string>/Users/ocagent/.openclaw</string>
</dict>

After edits use launchctl bootout then bootstrap, or your domain equivalent kickstart -k, so stale processes do not keep stale env caches. If Gateway still reads an old token, suspect a second plist duplicate in the same user domain and dedupe with launchctl list | grep -i openclaw.

For nvm or fnm managed Node, pin absolute node and openclaw paths in plist instead of whatever which resolves in a shell; minor image bumps otherwise produce doctor pass daemon fail skew.

If you created a dedicated system user for Gateway, align WorkingDirectory and implicit HOME with that user home so relative paths never resolve into empty transient folders that bounce back into token missing signatures.

Keeping tokens only in shell history or temporary exports demos well yet makes seven by twenty four postmortems irreproducible. Aligning plist environments with a single protected openclaw.json on dedicated Apple Silicon cloud nodes turns Gateway into an auditable production component. For teams that need stable Dashboards and probe paths across Singapore, US East, or other regions, KVMNODE Mac mini cloud rental is usually the better fit: bare metal isolation, transparent regions, configuration ladder, elastic rental periods, and finance readable fields for supervised environment sets. Continue with pricing and Help Center for SKUs and connectivity.

After go live append last successful kickstart timestamp, plist Label, and OpenClaw version stamp beside CMDB or cost tags so finance can tell whether the node still owns Gateway duty instead of guessing from hostnames alone.

If you plan multiple experimental Gateways on one leased host, give each instance its own state directory and port range and whitelist at the firewall so accidental port collisions are not misread as token faults.