diff --git a/.openclaw-sync/source.json b/.openclaw-sync/source.json
index 8176d13df..3504bedd9 100644
--- a/.openclaw-sync/source.json
+++ b/.openclaw-sync/source.json
@@ -1,5 +1,5 @@
 {
   "repository": "openclaw/openclaw",
-  "sha": "1a2f60c0a16b9b5400fcae9aacb528a62a824dd4",
-  "syncedAt": "2026-04-28T04:23:06.529Z"
+  "sha": "35c9dd06b2da9a25ba779a3ef5b92b2b95422a35",
+  "syncedAt": "2026-04-28T04:27:29.875Z"
 }
diff --git a/docs/concepts/models.md b/docs/concepts/models.md
index ab4e70f01..74508728a 100644
--- a/docs/concepts/models.md
+++ b/docs/concepts/models.md
@@ -61,6 +61,7 @@ The same `provider/model` can mean different things depending on where it came f
 - Auto fallback selections are temporary recovery state. They are stored with `modelOverrideSource: "auto"` so later turns can keep using the fallback chain without probing a known-bad primary first.
 - User session selections are exact. `/model`, the model picker, `session_status(model=...)`, and `sessions.patch` store `modelOverrideSource: "user"`; if that selected provider/model is unreachable, OpenClaw fails visibly instead of falling through to another configured model.
 - Cron `--model` / payload `model` is a per-job primary. It still uses configured fallbacks unless the job supplies explicit payload `fallbacks` (use `fallbacks: []` for a strict cron run).
+- CLI default-model and allowlist pickers respect `models.mode: "replace"` by listing explicit `models.providers.*.models` instead of loading the full built-in catalog.
 - The Control UI model picker asks the Gateway for its configured model view: `agents.defaults.models` when present, otherwise explicit `models.providers.*.models`, otherwise the full catalog so fresh installs are not blank.
 
 ## Quick model policy