diff --git a/.openclaw-sync/source.json b/.openclaw-sync/source.json
index c4a0e30bd..45ea5b0fd 100644
--- a/.openclaw-sync/source.json
+++ b/.openclaw-sync/source.json
@@ -1,5 +1,5 @@
 {
   "repository": "openclaw/openclaw",
-  "sha": "03cf97a33e01746695e52c47eb41d676cd5ed158",
-  "syncedAt": "2026-04-22T16:50:02.325Z"
+  "sha": "8b8df813d07bffd26f24fdb9601ef1ff2d3c48f1",
+  "syncedAt": "2026-04-22T16:54:43.633Z"
 }
diff --git a/docs/ci.md b/docs/ci.md
index 081cbaf3f..731e47d2b 100644
--- a/docs/ci.md
+++ b/docs/ci.md
@@ -45,6 +45,7 @@ Jobs are ordered so cheap checks fail before expensive ones run:
 4. Heavier platform and runtime lanes fan out after that: `checks-fast-core`, `checks-fast-contracts-channels`, `checks-node-extensions`, `checks-node-core-test`, `extension-fast`, `checks`, `checks-windows`, `macos-node`, `macos-swift`, and `android`.
 
 Scope logic lives in `scripts/ci-changed-scope.mjs` and is covered by unit tests in `src/scripts/ci-changed-scope.test.ts`.
+CI workflow edits validate the Node and Windows CI graph plus workflow linting, but do not force Android or macOS native builds by themselves; those platform lanes stay scoped to native source changes.
 The separate `install-smoke` workflow reuses the same scope script through its own `preflight` job. It computes `run_install_smoke` from the narrower changed-smoke signal, so Docker/install smoke only runs for install, packaging, and container-relevant changes.
 
 Local changed-lane logic lives in `scripts/changed-lanes.mjs` and is executed by `scripts/check-changed.mjs`. That local gate is stricter about architecture boundaries than the broad CI platform scope: core production changes run core prod typecheck plus core tests, core test-only changes run only core test typecheck/tests, extension production changes run extension prod typecheck plus extension tests, and extension test-only changes run only extension test typecheck/tests. Public Plugin SDK or plugin-contract changes expand to extension validation because extensions depend on those core contracts. Release metadata-only version bumps run targeted version/config/root-dependency checks. Unknown root/config changes fail safe to all lanes.