Summary

• carry forward fix(gateway): restore KeepAlive recovery and skip repair kickstart on running LaunchAgent #78412's macOS LaunchAgent stop/recovery changes and close the remaining --disable tail
• route openclaw gateway stop --disable through the managed LaunchAgent stop path even when a previous bootout makes launchd report the service as not loaded
• add CLI/lifecycle regression coverage and changelog credit

Bug / Behavior

#78412 changes the default macOS stop path from launchctl disable to launchctl bootout, preserving KeepAlive recovery unless the operator explicitly requests --disable. On the PR head, that explicit stay-down path still failed after a previous bootout: launchctl print returned not-loaded, runServiceStop returned not-loaded, and stopLaunchAgent(..., disable: true) never ran, leaving launchctl print-disabled gui/501 as "ai.openclaw.gateway" => enabled.

This PR keeps the default bootout behavior, but lets macOS stop --disable continue through the service manager even when launchd says the service is not loaded, so the disable bit is actually persisted.

Fixes #77934.
Fixes #77428.
Replaces #78412.

Real behavior proof

• Behavior addressed: macOS openclaw gateway stop --disable must persist the LaunchAgent disable bit even after a prior default stop used launchctl bootout and left the service not loaded.
• Real environment tested: Parallels macOS Tahoe VM, Darwin 25.3.0, uid 501, isolated OPENCLAW_STATE_DIR=$HOME/.openclaw-78412-proof and OPENCLAW_CONFIG_PATH=$HOME/.openclaw-78412-proof/openclaw.json.
• Exact steps or command run after this patch: Installed the patched package, ran openclaw gateway install --force --token proof-token --port 18789 --json, then openclaw gateway stop --json, then openclaw gateway stop --disable --json, then inspected launchctl print-disabled gui/501 and launchctl print gui/501/ai.openclaw.gateway.
• Evidence after fix: Terminal output from the patched package showed default stop preserving the enabled map and explicit disable flipping it:

install: ok=true result=installed
launchctl print-disabled gui/501: "ai.openclaw.gateway" => enabled

openclaw gateway stop --json:
{ "action": "stop", "ok": true, "result": "stopped", "service": { "label": "LaunchAgent", "loaded": false } }
launchctl print-disabled gui/501: "ai.openclaw.gateway" => enabled
launchctl print gui/501/ai.openclaw.gateway: rc=113 Could not find service

openclaw gateway stop --disable --json:
{ "action": "stop", "ok": true, "result": "stopped", "service": { "label": "LaunchAgent", "loaded": false } }
launchctl print-disabled gui/501: "ai.openclaw.gateway" => disabled

• Observed result after fix: The default bootout path still leaves KeepAlive recovery enabled, while the explicit --disable path now persists "ai.openclaw.gateway" => disabled after the service is already not loaded.
• What was not tested: Nothing else.

For comparison, the unpatched #78412 head 2be5de518334ae350422a14fdccfa526603c4376 returned result: "not-loaded" for openclaw gateway stop --disable --json after default stop, and launchctl print-disabled gui/501 stayed "ai.openclaw.gateway" => enabled.

Verification

• pnpm install
• pnpm test src/cli/daemon-cli/lifecycle-core.test.ts src/cli/daemon-cli/lifecycle.test.ts src/daemon/launchd.test.ts
• pnpm exec oxfmt --check --threads=1 CHANGELOG.md src/cli/daemon-cli/lifecycle-core.ts src/cli/daemon-cli/lifecycle.ts src/cli/daemon-cli/lifecycle-core.test.ts src/cli/daemon-cli/lifecycle.test.ts docs/cli/gateway.md docs/gateway/index.md src/daemon/launchd.ts src/daemon/launchd.test.ts src/cli/daemon-cli/register-service-commands.ts src/cli/daemon-cli/types.ts src/daemon/service-types.ts
• git diff --check origin/main...HEAD
• pnpm build
• Parallels macOS Tahoe VM reproduce/fix proof above