fix(config): refuse a legacy placeholder over the native secret mask

src/OpenClaw.Shared/ChannelConfigPatchBuilder.cs

@@ -59,6 +59,19 @@ public static class ChannelConfigPatchBuilder
         "********",
     };
 
+    /// <summary>
+    /// Exact mask <c>config.get</c> substitutes for a stored secret.
+    /// The gateway restores this value before it writes, so a Channels save
+    /// must still send it. It is not a <see cref="IsRedactionSentinel"/> hit.
+    /// </summary>
+    public const string NativeGatewayRedactionMask = "__OPENCLAW_REDACTED__";
+
+    public static bool IsRedactionSentinel(string? value) =>
+        value != null && RedactionSentinels.Contains(value.Trim());
+
+    public static bool IsNativeGatewayRedactionMask(string? value) =>
+        string.Equals(value, NativeGatewayRedactionMask, StringComparison.Ordinal);
+
     /// <summary>
     /// Build a patched full-config from the cached config and a list of
     /// per-field updates for one channel.
@@ -168,8 +181,7 @@ public static ChannelPatchBuildResult BuildPatch(
         }
         else if (el.ValueKind == JsonValueKind.String)
         {
-            var v = el.GetString();
-            if (v != null && RedactionSentinels.Contains(v.Trim()))
+            if (IsRedactionSentinel(el.GetString()))
                 return path;
         }
         return null;

src/OpenClaw.Tray.WinUI/Pages/ConfigPage.xaml.cs

@@ -550,6 +550,24 @@ private async Task OnSaveAsync()
         try
         {
             var updated = ConfigEditorModel.ApplyChanges(saveBase.Root, _pendingChanges);
+            var blockedPath = ConfigEditorModel.FindUneditedRedactionSentinel(
+                updated,
+                _pendingChanges.Keys,
+                saveBase.Root);
+            if (blockedPath != null)
+            {
+                ShowStatus(
+                    L("ConfigPage_StatusSaveFailedTitle"),
+                    Lf("ConfigPage_StatusSaveBlockedSentinelFormat", blockedPath),
+                    InfoBarSeverity.Error);
+                return;
+            }
+
+            updated = ConfigEditorModel.OmitUntouchedRedactionSentinels(
+                updated,
+                _pendingChanges.Keys,
+                saveBase.Root);
+
             var result = await client.PatchConfigDetailedAsync(updated, saveBase.BaseHash);
             if (!result.Ok)
             {