Description
On macOS, hydranode installs as a **LaunchAgent** in the console user's GUI session (`internal/cli/body/install_darwin.go:108-129`) and explicitly removes the system-wide LaunchDaemon if one exists (`:95-100`).
LaunchAgents only load inside a logged-in user's GUI session. **If a Mac mini is power-cycled and boots to the loginwindow with nobody logged in, hydranode never loads at all.** The machine is powered on and on the network, but the agent is dead and nothing will ever restart it.
Observed in the wild: `turbo-pancake-76` (cloud-seven, `node-adf19775`). hydraneck diagnoses it `agent-down` (DHCP lease bound on mikrotik-cloud7, agent silent). It is stuck on agent v1.10.23 while the rest of the Mac mini fleet runs v1.10.33 — consistent with an agent that stopped running several auto-updates ago.
### Why it never self-heals
1. `ensureInstall()` is a **no-op on darwin** (`pkg/body/selfinstall_darwin.go:5-6`). Windows re-registers its scheduled-task XML on **every** startup (`selfinstall_windows.go:13-38`), so a broken registration self-heals there. macOS has no equivalent: a deleted or unloaded plist is never recreated.
2. `installService()` **hard-fails when nobody is logged in** — `getConsoleUser()` returns `"no interactive user logged in"` (`install_darwin.go:22-24`). A Mac sitting at the loginwindow cannot be repaired remotely even if you had a shell.
3. There is **no out-of-band recovery path**: exec and shell are agent-pull (the agent dials out to hydracluster), so a dead agent means zero remote reach. No BMC, no Wake-on-LAN, no watchdog independent of the agent.
4. The recovery escalation ladder (`pkg/body/recovery.go:9-15`) lives *inside* the agent process, so it cannot help. Separately, its macOS levels 5/8/12 are no-ops anyway (`recovery_darwin.go:11-27`).
`hydracluster/docs/runbooks/body-recovery.md:173` claims operator-on-site is needed only in a rare catastrophic case. That rests on the Windows 1-minute scheduled-task retrigger and **does not hold on macOS**.
### Suggested fix
Install as a **LaunchDaemon** (loads at boot, no login required), or add a boot-time watchdog independent of the GUI session. If a GUI session is genuinely required (the kiosk and Moonlight need a display session), then **auto-login must become a hard, documented requirement for every Mac mini head** — `hydranode/docs/node-provisioning.md:154-164` currently documents auto-login for **Windows only**.