Bug Description

sessions_spawn fails with error gateway closed (1008): pairing required when trying to spawn a subagent.

Steps to Reproduce

1. Have a running OpenClaw gateway with Telegram channel configured
2. Try to spawn a subagent using the sessions_spawn tool with runtime=subagent
3. Gateway rejects the connection with pairing required error

Expected Behavior

Subagent should spawn successfully, or at least get a more descriptive error message.

Actual Error

gateway closed (1008): pairing required
Gateway target: ws://127.0.0.1:18789
Source: local loopback
Config: /root/.openclaw/openclaw.json
Bind: loopback

Gateway Log Entry

{
  "security audit": "device access upgrade requested reason=scope-upgrade device=... ip=unknown-ip auth=token roleFrom=operator roleTo=operator scopesFrom=operator.read scopesTo=operator.admin client=cli",
  "handshake": "failed",
  "cause": "pairing-required",
  "reason": "scope-upgrade"
}

The internal RPC client created during subagent spawn requests operator.admin scope, but gateway requires pairing for scope upgrades.

Environment

• OpenClaw version: 2026.4.14
• Node version: v22.22.2
• OS: Linux 6.8.0
• Gateway bind: loopback
• Auth mode: token
• Config: subagents.allowAgents: ["*"]

Workaround

None found. Spawning subagents is completely broken.

Additional Context

• Regular Telegram DM communication works fine
• Gateway RPC probe works (curl http://127.0.0.1:18789/ returns 200)
• Agents can send messages via Telegram
• Tried clearing pairing credentials, no effect
• Same issue across multiple OpenClaw versions (observed on 2026.4.11 and 2026.4.14)