diff --git a/.openclaw-sync/source.json b/.openclaw-sync/source.json
index 68ad97fb8..abdb4fa59 100644
--- a/.openclaw-sync/source.json
+++ b/.openclaw-sync/source.json
@@ -1,5 +1,5 @@
 {
   "repository": "openclaw/openclaw",
-  "sha": "7a63dd3f12b549ce98fb65f1ec88fe10f1e51d1f",
-  "syncedAt": "2026-04-24T17:59:49.350Z"
+  "sha": "7418adf875faec34a1062ff49e8b32e1dcb25def",
+  "syncedAt": "2026-04-24T18:03:28.666Z"
 }
diff --git a/docs/plugins/architecture-internals.md b/docs/plugins/architecture-internals.md
index ec5235200..ba1f4c94d 100644
--- a/docs/plugins/architecture-internals.md
+++ b/docs/plugins/architecture-internals.md
@@ -71,10 +71,12 @@ or fallback behavior without changing runtime loading semantics.
 
 Setup discovery now prefers descriptor-owned ids such as `setup.providers` and
 `setup.cliBackends` to narrow candidate plugins before it falls back to
-`setup-api` for plugins that still need setup-time runtime hooks. If more than
-one discovered plugin claims the same normalized setup provider or CLI backend
-id, setup lookup refuses the ambiguous owner instead of relying on discovery
-order.
+`setup-api` for plugins that still need setup-time runtime hooks. Explicit
+`setup.requiresRuntime: false` is a descriptor-only cutoff; omitted
+`requiresRuntime` keeps the legacy setup-api fallback for compatibility. If more
+than one discovered plugin claims the same normalized setup provider or CLI
+backend id, setup lookup refuses the ambiguous owner instead of relying on
+discovery order.
 
 ### What the loader caches
 
diff --git a/docs/plugins/manifest.md b/docs/plugins/manifest.md
index 8c2050d6f..fbd3712b8 100644
--- a/docs/plugins/manifest.md
+++ b/docs/plugins/manifest.md
@@ -327,6 +327,12 @@ narrows the candidate plugin and setup still needs richer setup-time runtime
 hooks, set `requiresRuntime: true` and keep `setup-api` in place as the
 fallback execution path.
 
+Set `requiresRuntime: false` only when those descriptors are sufficient for the
+setup surface. OpenClaw treats explicit `false` as a descriptor-only contract
+and will not execute `setup-api` for setup lookup. Omitted `requiresRuntime`
+keeps legacy fallback behavior so existing plugins that added descriptors
+without the flag do not break.
+
 Because setup lookup can execute plugin-owned `setup-api` code, normalized
 `setup.providers[].id` and `setup.cliBackends[]` values must stay unique across
 discovered plugins. Ambiguous ownership fails closed instead of picking a