After updating to 2026.4.1, the OpenClawX Node component hammers the gateway with unauthenticated connections at near-350ms intervals, flooding logs with reason=token_missing warnings from client=OpenClawX Node remote=127.0.0.1.

Two independent bugs compound to cause this:

1. Token resolution misses the config file (root cause of token_missing)

NodeService._readGatewayToken() only checked prefs.nodeGatewayToken and prefs.dashboardUrl. GatewayService.start() nulls out dashboardUrl before restarting the gateway — so any Node connect attempt during startup finds no token and sends an unauthenticated frame.

Added openclaw.json as a third fallback, consistent with GatewayService._readTokenFromConfig() which already treats it as the source of truth:

// 3. Read directly from openclaw.json — the source of truth (#94).
final raw = await NativeBridge.readRootfsFile('root/.openclaw/openclaw.json');
if (raw != null) {
  final config = jsonDecode(raw) as Map<String, dynamic>;
  final token = config['gateway']?['auth']?['token'];
  if (token is String && token.isNotEmpty) return token;
}

2. Reconnect backoff always restarted from base delay (keeps the storm alive)

NodeWsService._doConnect() reset _reconnectAttempt = 0 on every successful TCP handshake. Since the gateway accepts the TCP connection then rejects auth and closes the socket, the attempt counter never grew — the exponential backoff (base 350ms, cap 8s) was permanently stuck at 350ms.

Removed the reset from _doConnect(). Added resetReconnectAttempt() and call it only from NodeService._onConnected() — after the gateway has accepted the full authenticated handshake. Fresh explicit connect() calls still reset to 0.