HydraIssues

On macOS, hydranode installs as a LaunchAgent in the console user's GUI session (internal/cli/body/install_darwin.go:108-129) and explicitly removes the system-wide LaunchDaemon if one exists (:95-100).

LaunchAgents only load inside a logged-in user's GUI session. If a Mac mini is power-cycled and boots to the loginwindow with nobody logged in, hydranode never loads at all. The machine is powered on and on the network, but the agent is dead and nothing will ever restart it.

Observed in the wild: turbo-pancake-76 (cloud-seven, node-adf19775). hydraneck diagnoses it agent-down (DHCP lease bound on mikrotik-cloud7, agent silent). It is stuck on agent v1.10.23 while the rest of the Mac mini fleet runs v1.10.33 — consistent with an agent that stopped running several auto-updates ago.

Why it never self-heals

1. ensureInstall() is a no-op on darwin (pkg/body/selfinstall_darwin.go:5-6). Windows re-registers its scheduled-task XML on every startup (selfinstall_windows.go:13-38), so a broken registration self-heals there. macOS has no equivalent: a deleted or unloaded plist is never recreated.
2. installService() hard-fails when nobody is logged in — getConsoleUser() returns "no interactive user logged in" (install_darwin.go:22-24). A Mac sitting at the loginwindow cannot be repaired remotely even if you had a shell.
3. There is no out-of-band recovery path: exec and shell are agent-pull (the agent dials out to hydracluster), so a dead agent means zero remote reach. No BMC, no Wake-on-LAN, no watchdog independent of the agent.
4. The recovery escalation ladder (pkg/body/recovery.go:9-15) lives inside the agent process, so it cannot help. Separately, its macOS levels 5/8/12 are no-ops anyway (recovery_darwin.go:11-27).

hydracluster/docs/runbooks/body-recovery.md:173 claims operator-on-site is needed only in a rare catastrophic case. That rests on the Windows 1-minute scheduled-task retrigger and does not hold on macOS.

Suggested fix

Install as a LaunchDaemon (loads at boot, no login required), or add a boot-time watchdog independent of the GUI session. If a GUI session is genuinely required (the kiosk and Moonlight need a display session), then auto-login must become a hard, documented requirement for every Mac mini head — hydranode/docs/node-provisioning.md:154-164 currently documents auto-login for Windows only.