Environment

• OpenClaw: 2026.3.13 (61d171a)
• OS: macOS 26.3.1 (arm64)
• Node: 25.8.1
• Gateway: local loopback, port 18798

Issue

openclaw status overview line shows:

Gateway │ local · ws://127.0.0.1:18798 (local loopback) · unreachable (missing scope: operator.read)

However:

• openclaw status --deep shows Gateway │ reachable │ 2ms
• openclaw gateway probe shows Connect: ok (22ms) · RPC: limited - missing scope: operator.read
• openclaw doctor runs fine and connects to the gateway successfully
• The CLI device identity (a8cbec01...) is paired with full scopes including operator.read and operator.write
• ~/.openclaw/identity/device-auth.json confirms the operator token has operator.read in its scopes

Steps to reproduce

1. Pair CLI device with operator.read scope via openclaw devices rotate
2. Confirm scopes are present in devices list --json and device-auth.json
3. Run openclaw status — overview shows missing scope: operator.read
4. Run openclaw status --deep — deep probe shows gateway reachable
5. Run openclaw doctor — succeeds

Expected behavior

openclaw status overview should show reachable when the device has the required scopes.

Gateway probe output

Reachable: yes
Warning:
- Probe diagnostics are limited by gateway scopes (missing operator.read).
  Connection succeeded, but status details may be incomplete.
  Hint: pair device identity or use credentials with operator.read.

Local loopback ws://127.0.0.1:18798
  Connect: ok (22ms) · RPC: limited - missing scope: operator.read

Hypothesis

The overview probe in openclaw status may use a lighter auth path (shared token only) that doesn't complete the full device challenge handshake, whereas --deep and doctor do complete device auth and get the scopes.