diff --git a/.openclaw-sync/source.json b/.openclaw-sync/source.json
index e947c4ac5..ba9cfd666 100644
--- a/.openclaw-sync/source.json
+++ b/.openclaw-sync/source.json
@@ -1,5 +1,5 @@
 {
   "repository": "openclaw/openclaw",
-  "sha": "a580db58cafa0bf8fff8d7323eeb83b277508bff",
-  "syncedAt": "2026-04-25T00:07:06.294Z"
+  "sha": "61ee67aecc3f539dc09fae76dc9098af4adebeda",
+  "syncedAt": "2026-04-25T00:12:44.542Z"
 }
diff --git a/docs/tools/index.md b/docs/tools/index.md
index 07f53cc18..16c154fe3 100644
--- a/docs/tools/index.md
+++ b/docs/tools/index.md
@@ -125,6 +125,12 @@ config. Deny always wins over allow.
 }
 ```
 
+OpenClaw fails closed when an explicit allowlist resolves to no callable tools.
+For example, `tools.allow: ["query_db"]` only works if a loaded plugin actually
+registers `query_db`. If no built-in, plugin, or bundled MCP tool matches the
+allowlist, the run stops before the model call instead of continuing as a
+text-only run that could hallucinate tool results.
+
 ### Tool profiles
 
 `tools.profile` sets a base allowlist before `allow`/`deny` is applied.
diff --git a/docs/tools/multi-agent-sandbox-tools.md b/docs/tools/multi-agent-sandbox-tools.md
index 1995fab65..a3711ed32 100644
--- a/docs/tools/multi-agent-sandbox-tools.md
+++ b/docs/tools/multi-agent-sandbox-tools.md
@@ -207,6 +207,12 @@ If `agents.list[].tools.sandbox.tools` is set, it replaces `tools.sandbox.tools`
 If `agents.list[].tools.profile` is set, it overrides `tools.profile` for that agent.
 Provider tool keys accept either `provider` (e.g. `google-antigravity`) or `provider/model` (e.g. `openai/gpt-5.4`).
 
+If any explicit allowlist in that chain leaves the run with no callable tools,
+OpenClaw stops before submitting the prompt to the model. This is intentional:
+an agent configured with a missing tool such as
+`agents.list[].tools.allow: ["query_db"]` should fail loudly until the plugin
+that registers `query_db` is enabled, not continue as a text-only agent.
+
 Tool policies support `group:*` shorthands that expand to multiple tools. See [Tool groups](/gateway/sandbox-vs-tool-policy-vs-elevated#tool-groups-shorthands) for the full list.
 
 Per-agent elevated overrides (`agents.list[].tools.elevated`) can further restrict elevated exec for specific agents. See [Elevated Mode](/tools/elevated) for details.