diff --git a/.openclaw-sync/source.json b/.openclaw-sync/source.json
index 5e43e4e87..e3b10a197 100644
--- a/.openclaw-sync/source.json
+++ b/.openclaw-sync/source.json
@@ -1,5 +1,5 @@
 {
   "repository": "openclaw/openclaw",
-  "sha": "cb9955dd5cf2e465c373f1ef99d074cdd0fbb60c",
-  "syncedAt": "2026-04-27T09:18:11.580Z"
+  "sha": "13f9deb619796f128a2bc93b45b9cd6375be2a2a",
+  "syncedAt": "2026-04-27T09:20:58.362Z"
 }
diff --git a/docs/gateway/doctor.md b/docs/gateway/doctor.md
index 5459f5558..f7e5a6b7f 100644
--- a/docs/gateway/doctor.md
+++ b/docs/gateway/doctor.md
@@ -433,7 +433,7 @@ That stages grounded durable candidates into the short-term dreaming store while
     - `openclaw doctor --repair --force` overwrites custom supervisor configs.
     - `OPENCLAW_SERVICE_REPAIR_POLICY=external` keeps doctor read-only for gateway service lifecycle. It still reports service health and runs non-service repairs, but skips service install/start/restart/bootstrap, supervisor config rewrites, and legacy service cleanup because an external supervisor owns that lifecycle.
     - If token auth requires a token and `gateway.auth.token` is SecretRef-managed, doctor service install/repair validates the SecretRef but does not persist resolved plaintext token values into supervisor service environment metadata.
-    - Doctor detects managed `.env`/SecretRef-backed service environment values that older LaunchAgent/systemd installs embedded inline and rewrites the service metadata so those values load from the runtime source instead of the supervisor definition.
+    - Doctor detects managed `.env`/SecretRef-backed service environment values that older LaunchAgent, systemd, or Windows Scheduled Task installs embedded inline and rewrites the service metadata so those values load from the runtime source instead of the supervisor definition.
     - If token auth requires a token and the configured token SecretRef is unresolved, doctor blocks the install/repair path with actionable guidance.
     - If both `gateway.auth.token` and `gateway.auth.password` are configured and `gateway.auth.mode` is unset, doctor blocks install/repair until mode is set explicitly.
     - For Linux user-systemd units, doctor token drift checks now include both `Environment=` and `EnvironmentFile=` sources when comparing service auth metadata.