diff --git a/.openclaw-sync/source.json b/.openclaw-sync/source.json
index 47dff9ce1..90ada3fb3 100644
--- a/.openclaw-sync/source.json
+++ b/.openclaw-sync/source.json
@@ -1,5 +1,5 @@
 {
   "repository": "openclaw/openclaw",
-  "sha": "648422a6c1c3906db611d39b52bf7a9be9b9d9e5",
-  "syncedAt": "2026-04-23T19:57:04.902Z"
+  "sha": "956350bb9cebc91fc24067e4b0e59988d82d2391",
+  "syncedAt": "2026-04-23T19:58:26.474Z"
 }
diff --git a/docs/ci.md b/docs/ci.md
index 49b2ea50e..f9abc7acf 100644
--- a/docs/ci.md
+++ b/docs/ci.md
@@ -34,6 +34,8 @@ make only small coverage-preserving test performance fixes, then reruns the
 full-suite report and rejects changes that reduce the passing baseline test
 count. If the baseline has failing tests, Codex may fix only obvious failures
 and the after-agent full-suite report must pass before anything is committed.
+It uses GitHub-hosted Ubuntu so the Codex action can keep the same drop-sudo
+safety posture as the docs agent.
 
 ```bash
 gh workflow run duplicate-after-merge.yml \
diff --git a/docs/help/testing.md b/docs/help/testing.md
index 32818e202..09dc34da1 100644
--- a/docs/help/testing.md
+++ b/docs/help/testing.md
@@ -976,6 +976,7 @@ The live-model Docker runners also bind-mount only the needed CLI auth homes (or
 - Onboarding wizard (TTY, full scaffolding): `pnpm test:docker:onboard` (script: `scripts/e2e/onboard-docker.sh`)
 - Npm tarball onboarding/channel/agent smoke: `pnpm test:docker:npm-onboard-channel-agent` installs the packed OpenClaw tarball globally in Docker, configures OpenAI via env-ref onboarding plus Telegram by default, verifies enabling the plugin installs its runtime deps on demand, runs doctor, and runs one mocked OpenAI agent turn. Reuse a prebuilt tarball with `OPENCLAW_NPM_ONBOARD_PACKAGE_TGZ=/path/to/openclaw-*.tgz`, skip the host rebuild with `OPENCLAW_NPM_ONBOARD_HOST_BUILD=0`, or switch channel with `OPENCLAW_NPM_ONBOARD_CHANNEL=discord`.
 - Bun global install smoke: `bash scripts/e2e/bun-global-install-smoke.sh` packs the current tree, installs it with `bun install -g` in an isolated home, and verifies `openclaw infer image providers --json` returns bundled image providers instead of hanging. Reuse a prebuilt tarball with `OPENCLAW_BUN_GLOBAL_SMOKE_PACKAGE_TGZ=/path/to/openclaw-*.tgz`, skip the host build with `OPENCLAW_BUN_GLOBAL_SMOKE_HOST_BUILD=0`, or copy `dist/` from a built Docker image with `OPENCLAW_BUN_GLOBAL_SMOKE_DIST_IMAGE=openclaw-dockerfile-smoke:local`.
+- Installer Docker smoke: `bash scripts/test-install-sh-docker.sh` shares one npm cache across its root, update, direct-npm, and non-root containers. Set `OPENCLAW_INSTALL_SMOKE_NPM_CACHE_DIR=/path/to/cache` to reuse that cache across local reruns.
 - Gateway networking (two containers, WS auth + health): `pnpm test:docker:gateway-network` (script: `scripts/e2e/gateway-network-docker.sh`)
 - OpenAI Responses web_search minimal reasoning regression: `pnpm test:docker:openai-web-search-minimal` (script: `scripts/e2e/openai-web-search-minimal-docker.sh`) runs a mocked OpenAI server through Gateway, verifies `web_search` raises `reasoning.effort` from `minimal` to `low`, then forces the provider schema reject and checks the raw detail appears in Gateway logs.
 - MCP channel bridge (seeded Gateway + stdio bridge + raw Claude notification-frame smoke): `pnpm test:docker:mcp-channels` (script: `scripts/e2e/mcp-channels-docker.sh`)