Thanks for the context here. I swept through the related work, and this is now duplicate or superseded.

Keep open: current main still warns on the initial missing-lsof stale-PID scan, and this PR is the linked candidate fix, but it is not merge-ready because proof is missing, the branch is conflicting, and the patch broadens silent handling to permission failures without enough justification.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #76352
Summary: The open issue is the canonical tracker for the missing-lsof initial stale-PID warning; this PR is the open candidate fix, while other lsof/gateway items overlap only by broader restart or lsof surfaces.

Members:

• canonical: fix(restart): silently skip lsof stale-pid scan when lsof not installed #76352 - The PR body uses closing syntax for this issue and changes the exact initial stale-PID lsof error classification it reports.
• partial_overlap: openclaw gateway stop returns 'Gateway service disabled' without killing a foreground-launched gateway #72948 - This issue includes the same warning in logs, but its central bug is foreground gateway stop/process verification rather than warning suppression.
• partial_overlap: fix gateway restart outside systemd #72224 - This open PR targets broader gateway restart behavior outside systemd and native process discovery, not this exact initial-warning fix.
• adjacent_distinct: openclaw gateway restart hangs on macOS with SMB-mounted volumes (lsof stat() timeout) #75767 - This issue concerns macOS lsof stat() hangs on mounted volumes, sharing the lsof tool surface but not the missing-binary startup warning root cause.
• adjacent_distinct: macOS: per-port lsof port-health polling can saturate launchservicesd and trigger a WindowServer watchdog reboot #90548 - This issue concerns repeated macOS lsof polling pressure and availability, sharing the lsof tool surface but not the missing-binary startup warning root cause.
• 1 more in the report.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Canonical path: Close this stale PR. The latest review rated it F, the branch still lacks merge-ready proof, and there has been no human follow-up after the durable review.

So I’m closing this here because the remaining work is already tracked in the canonical issue.

Heads up: this PR needs to be updated against current main before the new required Dependency Guard check can pass.

Land-ready proof for 651427363b7d2f1470d1db491ca2e4106311c683:

• Rewrote the stale branch on current main. The initial Unix scan now suppresses only Node's exact missing-command ENOENT at src/infra/restart-stale-pids.ts:367; EACCES, EPERM, ETIMEDOUT, unknown spawn errors, and unexpected nonzero exits still warn.
• Kept the post-kill polling classifier separate because that branch owns retry termination, not startup diagnostics.
• Added focused regression coverage at src/infra/restart-stale-pids.test.ts:261 for silent ENOENT and warning-preserving EACCES/ETIMEDOUT.

Validation:

• Direct Node 24 probe: nonexistent command → ENOENT, non-executable command → EACCES, timeout → ETIMEDOUT; each returned null status. This matches the official child-process contract.
• Testbox negative control: new tests against pre-fix production code failed exactly the silent-ENOENT assertion; 56 sibling tests passed.
• pnpm test src/infra/restart-stale-pids.test.ts src/infra/ports-lsof.test.ts → 60/60 passed.
• OPENCLAW_CHECK_CHANGED_REMOTE_CHILD=1 OPENCLAW_CHANGED_LANES_RAW_SYNC=1 pnpm check:changed → passed (core, coreTests) in 3m01s.
• pnpm build → passed in 114.6s.
• Digest-pinned node:24-bookworm-slim live proof: asserted lsof absent and OPENCLAW_SERVICE_MARKER present, started the real Gateway, reached /healthz in about 3.1s, and observed no lsof failed during initial stale-pid scan warning.
• Testbox tbx_01kx5742mgqja5kjc423m7qyq2 (golden-barnacle) was stopped after proof.
• Fresh structured autoreview: clean, confidence 0.84.
• Exact-head CI: run 29070246531, 43 successful jobs, no failures.
• Required real-behavior proof check passed after the body refresh: run 29070646102.

Known proof gap: no separate Alpine Gateway build was run. The live proof covers the reporter's Debian/Ubuntu environment and the same OS-independent Node ENOENT spawn boundary used on Alpine.

No blocking findings. This is the smallest correct owner-boundary fix, and contributor credit is preserved in the commit trailer.

Merged via squash.

• Prepared head SHA: 651427363b7d2f1470d1db491ca2e4106311c683
• Landed commit: dc783bbde86a7ee350c137b32152a2c5010d4a26