Best possible solution:

Make service audit/doctor treat boolean KeepAlive=true as stale or noncanonical, keep the generated SuccessfulExit=true policy, then run targeted tests plus live macOS launchd smoke before landing and resolving the linked issue/older PR.

Do we have a high-confidence way to reproduce the issue?

Yes, source-backed rather than live: current main writes boolean KeepAlive=true, launchd docs say that keeps the job alive unconditionally, and the linked issue reports the resulting startup-failure restart loop on macOS 15.4.

Is this the best way to solve the issue?

No, not as currently patched. SuccessfulExit=true is a maintainable generator policy, but the audit path should not keep accepting legacy KeepAlive=true plists as healthy if existing installs need to move off the crash-loop policy.

Full review comments:

• [P2] Flag legacy KeepAlive=true as noncanonical — src/daemon/service-audit.ts:190
  This still treats existing LaunchAgents with <key>KeepAlive</key><true/> as healthy. Those plists are the crash-looping policy this PR replaces, so doctor/status audit will not recommend rewriting an already-installed agent and affected users can keep looping after upgrading. Drop the boolean-true branch or report it as a repair issue, and add a regression test with the old plist.
  Confidence: 0.87

Overall correctness: patch is incorrect
Overall confidence: 0.86

Acceptance criteria:

• node scripts/run-vitest.mjs src/daemon/service-audit.test.ts src/daemon/launchd.test.ts
• pnpm exec oxfmt --check --threads=1 src/daemon/service-audit.ts src/daemon/service-audit.test.ts src/daemon/launchd-plist.ts src/daemon/launchd.test.ts
• git diff --check
• Before merge, run a live macOS LaunchAgent smoke or equivalent Crabbox/Testbox proof for non-zero startup failure staying stopped and clean-exit restart handoff relaunching.

What I checked:

• current-main launchd policy: Current main renders generated LaunchAgents with boolean KeepAlive=true, plus RunAtLoad, ExitTimeOut, ProcessType, ThrottleInterval, and Umask. (src/daemon/launchd-plist.ts:183, 11017c93cf14)
• current-main audit policy: Current main's audit accepts only boolean KeepAlive=true as the launchd keepalive policy before this PR. (src/daemon/service-audit.ts:189, 11017c93cf14)
• PR diff: The PR changes generated plists to <key>KeepAlive</key><dict><key>SuccessfulExit</key><true/></dict> and changes audit to accept either that dictionary or the legacy boolean form. (src/daemon/service-audit.ts:190, 68bf98c40700)
• launchd contract: The launchd.plist man page states SuccessfulExit=true restarts a job when it exits with status zero, while KeepAlive=true unconditionally keeps the job alive.
• related issue context: The linked issue remains open and prior ClawSweeper review kept it open because current main still emits boolean KeepAlive=true; it also noted older fix(daemon): use KeepAlive SuccessfulExit=false to prevent launchd crash-loop #73849 as an open conflicting attempt rather than a merged fix.
• history provenance: Line blame ties the current launchd plist and audit implementation in this checkout to commit c04bbd3, while GitHub commit metadata shows recent adjacent launchd lifecycle work by BunsDev and vincentkoc. (src/daemon/launchd-plist.ts:183, c04bbd3cbb9d)

Likely related people:

• BunsDev: Authored recent merged macOS update restart lifecycle hardening that touched src/daemon/launchd-plist.ts, src/daemon/launchd.test.ts, and gateway restart-loop behavior before this PR. (role: recent area contributor; confidence: high; commits: fa79e9754ecc; files: src/daemon/launchd-plist.ts, src/daemon/launchd.test.ts, src/cli/gateway-cli/run-loop.ts)
• vincentkoc: Local blame points current launchd/audit lines at Vincent Koc in this checkout, and recent merged work hardened the launchd restart handoff path. (role: recent adjacent contributor; confidence: medium; commits: c04bbd3cbb9d, 57f5b3b201b4; files: src/daemon/launchd-plist.ts, src/daemon/service-audit.ts, src/daemon/launchd-restart-handoff.ts)
• steipete: Sampled shortlog shows the heaviest contribution count across the central launchd/audit files, and recent history includes restart-loop changelog/landing coordination around LaunchAgent KeepAlive semantics. (role: area steward; confidence: medium; commits: 7f863e22b06f; files: src/daemon/launchd.ts, src/daemon/launchd-plist.ts, src/daemon/service-audit.ts)

Remaining risk / open question:

• No live macOS LaunchAgent smoke was run in this read-only review; the behavior assessment is source-backed plus launchd contract-backed.
• The older open replacement attempt at fix(daemon): use KeepAlive SuccessfulExit=false to prevent launchd crash-loop #73849 still references the same issue and should be explicitly superseded or closed once the chosen fix lands.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 11017c93cf14.