Settings: Sandbox timeout is not persisted — resets to 30000 on app restart and overwrites settings.json

Summary

The Sandbox → timeout value in OpenClaw Companion is not persisted across app restarts.
The value is applied for the running session, but quitting and relaunching the app resets it to the
built-in default (30000 ms) and immediately overwrites settings.json, discarding the user's value.

Environment

• OpenClaw Companion 2026.9.4 (2026.9.4+3c43751b2bace876de3febe478ebabeca172e3ac), WinUI 3
• App exe: %LOCALAPPDATA%\OpenClawTray\OpenClaw.Tray.WinUI.exe
• App data: %APPDATA%\OpenClawTray\ (settings.json)
• Gateway: OpenClaw 2026.9.2 (Raspberry Pi 5, arm64), node mode over LAN
• Windows node: DESKTOP-1EQRL25

Steps to reproduce

1. Open Companion → Sandbox settings, raise the timeout to a larger value (e.g. 280000).
2. Confirm it is applied: run a command that takes ~45 s. It completes successfully
   (system.run result exitCode=0; durationMs=46038; timedOut=False), and the sandbox log shows
   policy={...,timeoutMs=280000}.
3. Quit Companion completely, then relaunch it.
4. Re-read %APPDATA%\OpenClawTray\settings.json and %LOCALAPPDATA%\OpenClawTray\openclaw-tray.log.

Actual behaviour

• While the app runs, the value is applied correctly
  (sandboxSettings ... timeoutMs=100000 / 280000; long commands succeed).
• After a restart, the app writes SandboxTimeoutMs: 30000 back into settings.json.
  Log sequence:

  Application exiting
  Application started (WinUI 3)
  Settings saved                      x2   -> [SETTINGS] Change impact: UiOnly
  

  and every subsequent sandbox request logs timeoutMs=30000 again.
• default-config.json does not contain SandboxTimeoutMs at all.
• Editing settings.json by hand while the app is running is silently overwritten:
  a manual save was reverted to 30000 immediately afterwards.
• In the UI the slider visibly snaps back to the default after the value is released.

Expected behaviour

The value chosen in Sandbox settings should be saved and reloaded on startup and remain stable across
restarts — or the UI should clearly state that the value is session-only.

Impact

Commands that legitimately run longer than 30 s are killed by the sandbox:

{"error":{"code":"backend_error","message":"script timed out after 30000ms"}}

The only workaround (raising the limit) has to be reapplied after every app restart. The failure is
silent: saving raises no visible error, and there is no settings log to inspect.

Notes

• The log line [SETTINGS] Change impact: UiOnly suggests the timeout field is treated as UI-only
  state — neither loaded on startup nor persisted (Save() also swallows exceptions silently).
• App log: %LOCALAPPDATA%\OpenClawTray\openclaw-tray.log
• Earlier observations showed the same reset with 100000 → 30000, so it is not value-specific.

Start by tracing the Sandbox settings UI, startup loading, and Save() paths that write settings.json; compare their handling with default-config.json. Reproduce the reset using the documented 280000 ms value and inspect openclaw-tray.log. Done means the selected timeout reloads unchanged after restart and is not overwritten with 30000.