Summary

gateway.config.patch (and the underlying protected-paths list) refuses to set diagnostics.cacheTrace.enabled even when the patch also explicitly disables all sensitive content capture (includeMessages: false, includePrompt: false, includeSystem: false).

The schema help text for diagnostics.cacheTrace says:

Enable this temporarily for debugging and disable afterward to reduce sensitive log footprint.

That guidance implies the protection rationale is the sensitive payload capture, not the trace itself. But protection is enforced uniformly across the entire subtree, so users have no way to enable cache-decision observability via the supported tool path even with a safe (decision/stage-only) configuration.

Reproduction

Tested on 2026.4.24:

gateway config.patch '{"diagnostics":{"cacheTrace":{"enabled":true,"includeMessages":false,"includePrompt":false,"includeSystem":false}}}'
→ "gateway config.patch cannot change protected config paths: diagnostics.cacheTrace.enabled, diagnostics.cacheTrace.includeMessages, diagnostics.cacheTrace.includePrompt, diagnostics.cacheTrace.includeSystem"

Suggested fix

Either:

1. Allow diagnostics.cacheTrace.enabled via config.patch when the same patch sets all three include* flags to false, or
2. Permit diagnostics.cacheTrace.enabled unconditionally and keep only the include* flags as protected (since those are the ones with sensitive-data implications), or
3. Add a dedicated gateway diagnostics cache-trace enable --safe CLI/tool action that enables tracing with content capture forced off.

Why it matters

Without this, operators who want real cache hit/miss data to validate their agents.defaults.models.*.params.cacheRetention settings have no path that doesn't require a direct config-file edit + restart, which bypasses the gateway's safety surface entirely.

Environment

• OpenClaw 2026.4.24 (cbcfdf6)
• Darwin 25.3.0 / arm64 / node v25.9.0