diff --git a/.openclaw-sync/source.json b/.openclaw-sync/source.json
index 8024f0f21..6490efcea 100644
--- a/.openclaw-sync/source.json
+++ b/.openclaw-sync/source.json
@@ -1,5 +1,5 @@
 {
   "repository": "openclaw/openclaw",
-  "sha": "25ca5cc8dfcd51f494b46089a1cfcf5e50bcced4",
-  "syncedAt": "2026-05-02T16:47:27.035Z"
+  "sha": "03be4bfac57a886fe795b3007aa33db59307a475",
+  "syncedAt": "2026-05-02T16:59:36.650Z"
 }
diff --git a/docs/cli/plugins.md b/docs/cli/plugins.md
index 931733d7c..b8bfbacf7 100644
--- a/docs/cli/plugins.md
+++ b/docs/cli/plugins.md
@@ -172,7 +172,7 @@ openclaw plugins install npm:openclaw-codex-app-server
 openclaw plugins install npm:@scope/plugin-name@1.0.1
 ```
 
-OpenClaw checks the advertised plugin API / minimum gateway compatibility before install. When the selected ClawHub version publishes a ClawPack artifact, OpenClaw downloads the versioned ClawPack, verifies the ClawHub digest header and the artifact digest, then installs it through the normal archive path. Older ClawHub versions without ClawPack metadata still install through the legacy package archive verification path. Recorded installs keep their ClawHub source metadata and ClawPack digest facts for later updates.
+OpenClaw checks the advertised plugin API / minimum gateway compatibility before install. When the selected ClawHub version publishes a ClawPack artifact, OpenClaw downloads the versioned npm-pack `.tgz`, verifies the ClawHub digest header and the artifact digest, then installs it through the normal archive path. Older ClawHub versions without ClawPack metadata still install through the legacy package archive verification path. Recorded installs keep their ClawHub source metadata and ClawPack digest facts for later updates.
 Unversioned ClawHub installs keep an unversioned recorded spec so `openclaw plugins update` can follow newer ClawHub releases; explicit version or tag selectors such as `clawhub:pkg@1.2.3` and `clawhub:pkg@beta` remain pinned to that selector.
 
 #### Marketplace shorthand
diff --git a/docs/tools/clawhub.md b/docs/tools/clawhub.md
index 3ef358d7a..cc025cc1d 100644
--- a/docs/tools/clawhub.md
+++ b/docs/tools/clawhub.md
@@ -84,7 +84,7 @@ Site: [clawhub.ai](https://clawhub.ai)
     `minGatewayVersion` compatibility before archive install runs, so
     incompatible hosts fail closed early instead of partially installing
     the package. When a package version publishes a ClawPack artifact,
-    OpenClaw prefers that artifact, verifies the ClawHub digest header and
+    OpenClaw prefers the exact uploaded npm-pack `.tgz`, verifies the ClawHub digest header and
     downloaded bytes, and records the ClawPack digest metadata for later
     updates. Older package versions without ClawPack metadata still use the
     legacy package archive verification path.