Summary

The live updater can fail or restart the wrong Gateway runtime when a managed macOS LaunchAgent points at a clean detached runtime snapshot while the source checkout advances.

Reproduction

1. Run the managed Gateway from ~/.openclaw/runtime/gateway-<commit>/dist/index.js.
2. Advance the canonical source checkout.
3. Run the live updater while the Gateway has active work or while the service wrapper carries its own environment.

Expected behavior

The updater should validate the loaded service and snapshot without executing stale snapshot code, drain the Gateway through a trusted source control build, stop and retarget the exact LaunchAgent atomically, and prove the new process owns the configured port.

Actual behavior

The older updater assumes the active service entrypoint matches the source checkout. Snapshot deployments can therefore be rejected or controlled through the wrong runtime, and restart verification does not prove the loaded LaunchAgent arguments and listener belong to the rebuilt source deployment.

Scope

macOS managed Gateway updates only. No release or version change.