diff --git a/.openclaw-sync/source.json b/.openclaw-sync/source.json
index 57fb361da..9c7e8f8dd 100644
--- a/.openclaw-sync/source.json
+++ b/.openclaw-sync/source.json
@@ -1,5 +1,5 @@
 {
   "repository": "openclaw/openclaw",
-  "sha": "6a4c866b6a8b09360f1f51aa99aac9e682b0fef1",
-  "syncedAt": "2026-04-29T06:38:10.193Z"
+  "sha": "13757465ba1b8b4508dedbf0d2b86afbf8deb051",
+  "syncedAt": "2026-04-29T06:53:32.797Z"
 }
diff --git a/docs/concepts/oauth.md b/docs/concepts/oauth.md
index f243c20e7..fb0260a1a 100644
--- a/docs/concepts/oauth.md
+++ b/docs/concepts/oauth.md
@@ -48,6 +48,9 @@ To reduce that, OpenClaw treats `auth-profiles.json` as a **token sink**:
   `openai-codex:default` profile, but once OpenClaw has a local OAuth profile,
   the local refresh token is canonical; other integrations can remain
   externally managed and re-read their CLI auth store
+- status and startup paths that already know the configured provider set scope
+  external CLI discovery to that set, so an unrelated CLI login store is not
+  probed for a single-provider setup
 
 ## Storage (where tokens live)