You run openclaw config get and see one value. Then you check the running gateway and it is clearly using something different. The channel that should be active is quiet. The model you set is not the one answering. Restarts do not help because nothing is crashing; the CLI and the gateway service are simply reading from two different realities.
This is a split-brain config: the CLI and the gateway service disagree about which binary, which config file, or which state directory is authoritative. The good news is that every cause has a visible signature and a mechanical fix. This guide shows you how to read those signatures and get both sides back in sync in about five minutes.
Why the two sides drift apart
OpenClaw stores config in a state directory, typically ~/.openclaw/openclaw.json. The CLI reads that file when you run commands. The gateway service is different: it is a wrapper (LaunchAgent on macOS, a systemd unit on Linux) that was installed at some point in the past, and it remembers the binary path, state directory, and environment of that moment.
Three situations create a mismatch, and they often overlap:
- Two installs on one machine. Homebrew, an npm global install, and a git checkout each put an
openclawbinary somewhere. The CLI resolves to whichever comes first in your PATH; the service runs whichever binary was current when it was installed. They can be different versions reading different state directories. - The newer-config guard. OpenClaw stamps every config write with
meta.lastTouchedVersion. If the config was last written by a newer OpenClaw than the binary you are invoking, read-only commands still work, but process and service mutations are refused: gateway start, stop, restart, uninstall, forced reinstall, service-mode startup, and--forceport cleanup all block with a message telling you the binary is older than the config. The gateway keeps running fine on its newer version while your older CLI appears to do nothing. - A stale service pin. The service wrapper can point at an old state directory, an old port, or an old binary from when it was installed. The service env block in
openclaw gateway status(for exampleOPENCLAW_GATEWAY_PORT=19999) shows what it is pinned to. The doctor flags this as a service port or config mismatch.
Step 1: Check what each side actually reads
Run the status command and look at the two config lines plus the two version lines:
Read it line by line:
Config (cli)is the file your shell commands edit.Config (service)is the file the running gateway loaded at startup.CLI versionandGateway versionname the binary each side runs.
When the two config paths match and the two versions match, you are in sync, as in this capture. When any of those four values differ, you have found the split. The deep variant adds the service command line, working directory, service file, and established clients, which is useful when you suspect the service was installed from a different install:
user@host:~$ openclaw gateway status --deep # Shows: Service file, Command, Working dir, Service env, # Config (cli), Config (service), versions, Established clients.
The Command line is gold: it shows the exact binary and arguments the service launches, for example /usr/local/bin/node .../openclaw/dist/index.js gateway --port 19999. Compare it with which openclaw. If the paths point at different installs, that is your first cause.
Step 2: Compare binaries and the config guard
Check which binary the CLI resolves to and which version wrote the config:
Two things to understand about this output. First, meta.lastTouchedVersion is a stamp, not a setting: it records the version that last wrote the config, and read-only commands report it so you can compare against openclaw --version. Second, the guard it feeds is strict in one direction only. A newer CLI talking to an older config is fine. An older CLI talking to a newer config gets its service mutations refused, which surfaces as confusing failures right after an update, especially if your shell still resolves an old binary (a stale PATH entry, an old wrapper, or a leftover Homebrew cell).
After a rollback you can also see the related protocol mismatch signature: an older gateway keeps running while newer client processes reconnect and fail. The Established clients section of openclaw gateway status --deep (and openclaw doctor --deep) lists connected client PIDs and command lines so you can find and stop the stale processes. That cleanup is part of the same one-binary discipline.
Step 3: Align binary, service, and state
The fix has three moves: pick the canonical install, re-point the service at it, and verify. The diagram puts the whole ladder on one page:
Concretely:
- Fix PATH first. Decide which install you are keeping (usually the package manager you update with). Make sure
which openclawresolves to it andopenclaw --versionmatches the version that wrote your config. Remove stale wrapper entries or old package installs that shadow it. - Reinstall the service wrapper from that binary.
openclaw gateway install --forcerewrites the LaunchAgent or systemd unit so the service uses the same binary, state directory, and port as your CLI. This does not touch your config, agents, or workspace. Then restart:openclaw gateway restart. - Clear the port mismatch if the doctor flags one. When the installed supervisor still pins an old
--port, the doctor reportsGateway service port does not match current gateway config. Runopenclaw doctor --fixor repeat the forced reinstall, then restart the service.
One warning label for the guard override: for an intentional downgrade or emergency recovery you can set OPENCLAW_ALLOW_OLDER_BINARY_DESTRUCTIVE_ACTIONS=1 for a single command. Leave it unset for normal operation; the guard exists to stop an old binary from mangling a newer config.
Step 4: Verify they are in sync
After the restart, run the same status command from step 1. You want to see identical Config (cli) and Config (service) paths, matching CLI and gateway versions, and Runtime: running with Connectivity probe: ok. Then pick a value you know, like your model or a channel setting, and confirm the gateway actually behaves the way the config describes. A quiet openclaw doctor is the final signal: it checks version consistency, service port match, and duplicate service installs, and it suggests repairs when something is still off.
Preventing it going forward
Split-brain configs are a self-inflicted wound, so the prevention is simple: run one install method per machine. If you switch package managers, uninstall the old install cleanly before installing the new one. And make openclaw doctor part of your post-update ritual; it takes seconds and it is the fastest way to catch a version or path conflict before it becomes a confusing afternoon.
Quick reference
# Compare both sides openclaw gateway status --deep which openclaw && openclaw --version openclaw config get meta.lastTouchedVersion # Align them openclaw gateway install --force openclaw gateway restart # Confirm and stay clean openclaw gateway status openclaw doctor
Related fixes
Version skew usually arrives via an update, so rolling back a broken update safely is the natural companion guide. If the gateway will not start after the realignment, see the local mode fix and the EADDRINUSE fix; if approvals or channel replies go quiet, the exec approval fix and the Telegram identity fix cover those. New to OpenClaw? Start with The Complete OpenClaw Guide.
Not Ready to Self-Host? Try ClawTrust
Building agents locally is powerful, but managing infrastructure, security, and scaling takes effort. ClawTrust provides managed OpenClaw hosting: your agents run securely in the cloud with automatic scaling, no DevOps overhead, and 24/7 monitoring.
This post contains affiliate links. If you buy through them, I may earn a small commission at no extra cost to you.
About The Author
