diff --git a/.openclaw-sync/source.json b/.openclaw-sync/source.json
index 685f18d10..fc84d0e00 100644
--- a/.openclaw-sync/source.json
+++ b/.openclaw-sync/source.json
@@ -1,5 +1,5 @@
 {
   "repository": "openclaw/openclaw",
-  "sha": "016a0b4de945196c75c8a790d8d41aafc6488171",
-  "syncedAt": "2026-04-27T14:12:09.219Z"
+  "sha": "9090457da742159d95306e0b4f5eb686abe103ba",
+  "syncedAt": "2026-04-27T14:15:13.478Z"
 }
diff --git a/docs/plugins/sdk-migration.md b/docs/plugins/sdk-migration.md
index 4d735f752..2fcc4e2a7 100644
--- a/docs/plugins/sdk-migration.md
+++ b/docs/plugins/sdk-migration.md
@@ -145,8 +145,10 @@ releases.
     | Secret input resolution | `openclaw/plugin-sdk/secret-input-runtime` |
     | Model/session overrides | `openclaw/plugin-sdk/model-session-runtime` |
 
-    Bundled production plugins are scanner-guarded against the broad barrel so
-    imports stay local to the behavior they need.
+    Bundled plugins and their tests are scanner-guarded against the broad
+    barrel so imports and mocks stay local to the behavior they need. The broad
+    barrel still exists for external compatibility, but new code should not
+    depend on it.
 
   </Step>
 
@@ -233,6 +235,7 @@ releases.
 
     ```bash
     grep -r "plugin-sdk/compat" my-plugin/
+    grep -r "plugin-sdk/config-runtime" my-plugin/
     grep -r "openclaw/extension-api" my-plugin/
     ```
 
diff --git a/docs/plugins/sdk-runtime.md b/docs/plugins/sdk-runtime.md
index 3414d3a63..20a3ee065 100644
--- a/docs/plugins/sdk-runtime.md
+++ b/docs/plugins/sdk-runtime.md
@@ -41,13 +41,14 @@ Persist changes with `api.runtime.config.mutateConfigFile(...)` or `api.runtime.
 
 The mutation helpers return `afterWrite` plus a typed `followUp` summary so callers can log or test whether they requested a restart. The gateway still owns when that restart actually happens.
 
-`api.runtime.config.loadConfig()` and `api.runtime.config.writeConfigFile(...)` are deprecated compatibility helpers under `runtime-config-load-write`. They warn once at runtime, and bundled plugins must not use them; the config boundary guards fail if production plugin code calls them or imports those helpers from plugin SDK subpaths.
+`api.runtime.config.loadConfig()` and `api.runtime.config.writeConfigFile(...)` are deprecated compatibility helpers under `runtime-config-load-write`. They warn once at runtime, and remain available for old external plugins during the migration window. Bundled plugins must not use them; the config boundary guards fail if plugin code calls them or imports those helpers from plugin SDK subpaths.
 
 For direct SDK imports, use the focused config subpaths instead of the broad
 `openclaw/plugin-sdk/config-runtime` compatibility barrel: `config-types` for
 types, `plugin-config-runtime` for already-loaded config assertions and plugin
 entry lookup, `runtime-config-snapshot` for current process snapshots, and
-`config-mutation` for writes.
+`config-mutation` for writes. Bundled plugin tests should mock these focused
+subpaths directly instead of mocking the broad compatibility barrel.
 
 Internal OpenClaw runtime code has the same direction: load config once at the CLI, gateway, or process boundary, then pass that value through. Successful mutation writes refresh the process runtime snapshot and advance its internal revision; long-lived caches should key off the runtime-owned cache key instead of serializing config locally. Long-lived runtime modules have a zero-tolerance scanner for ambient `loadConfig()` calls; use a passed `cfg`, a request `context.getRuntimeConfig()`, or `getRuntimeConfig()` at an explicit process boundary.