Bug report draft: Telegram botToken SecretRef unresolved in openclaw status (v2026.3.2)

Summary

Using channels.telegram.botToken as a SecretRef validates successfully, gateway runs, but openclaw status fails with unresolved secret in active runtime snapshot.

Environment

• OpenClaw: 2026.3.2
• OS: Linux (Ubuntu)
• Gateway mode: local loopback
• Telegram channel enabled

Expected

openclaw status should succeed when channels.telegram.botToken uses a valid SecretRef (file provider).

Actual

openclaw status fails with unresolved secret error.

Error sample:

status: channels.telegram.botToken is unresolved in the active runtime snapshot.

And in other runs:

channels.telegram.botToken: unresolved SecretRef "file:filemain:/channels/telegram/botToken"

Reproduction

1. Configure secrets provider:

"secrets": {
  "providers": {
    "default": { "source": "env" },
    "filemain": {
      "source": "file",
      "path": "~/.openclaw/secrets.json",
      "mode": "json"
    }
  },
  "defaults": { "env": "default", "file": "filemain" }
}

2. Put telegram token in ~/.openclaw/secrets.json:

{
  "channels": {
    "telegram": {
      "botToken": "<token>"
    }
  }
}

3. Set channel token as SecretRef:

"channels": {
  "telegram": {
    "enabled": true,
    "botToken": {
      "source": "file",
      "provider": "filemain",
      "id": "/channels/telegram/botToken"
    }
  }
}

4. Run:

• openclaw config validate ✅ pass
• openclaw status ❌ fails with unresolved secret

Notes

• Gateway itself can still run.
• Workaround: use channels.telegram.tokenFile instead of botToken SecretRef.
• Other SecretRefs (e.g. model provider apiKey) work as expected.

Impact

• Blocks full migration to SecretRef for Telegram token in production.
• Causes confusion because validate passes but status/audit path fails.