diff --git a/.openclaw-sync/source.json b/.openclaw-sync/source.json
index 29c23f2aa..9f25cdfc9 100644
--- a/.openclaw-sync/source.json
+++ b/.openclaw-sync/source.json
@@ -1,5 +1,5 @@
 {
   "repository": "openclaw/openclaw",
-  "sha": "5b80d0c15e873d099305edc1ad2d29c723bd3b62",
-  "syncedAt": "2026-04-26T00:43:45.495Z"
+  "sha": "1fe0e6fc4aaa1fcb47ab4c0f9d0f390dd11bb086",
+  "syncedAt": "2026-04-26T00:48:44.446Z"
 }
diff --git a/docs/gateway/tailscale.md b/docs/gateway/tailscale.md
index 54fe66e5b..6b11d71f7 100644
--- a/docs/gateway/tailscale.md
+++ b/docs/gateway/tailscale.md
@@ -16,6 +16,10 @@ Tailscale provides HTTPS, routing, and (for Serve) identity headers.
 - `funnel`: Public HTTPS via `tailscale funnel`. OpenClaw requires a shared password.
 - `off`: Default (no Tailscale automation).
 
+Status and audit output use **Tailscale exposure** for this OpenClaw Serve/Funnel
+mode. `off` means OpenClaw is not managing Serve or Funnel; it does not mean the
+local Tailscale daemon is stopped or logged out.
+
 ## Auth
 
 Set `gateway.auth.mode` to control the handshake: