diff --git a/.openclaw-sync/source.json b/.openclaw-sync/source.json
index 398303e68..8d181b4c5 100644
--- a/.openclaw-sync/source.json
+++ b/.openclaw-sync/source.json
@@ -1,5 +1,5 @@
 {
   "repository": "openclaw/openclaw",
-  "sha": "ad7fa6c3877472d095927fe09d14aa5de5d0580b",
-  "syncedAt": "2026-04-30T12:39:49.576Z"
+  "sha": "0f120c09ba28e6e9a91a543408e418722b61e07b",
+  "syncedAt": "2026-04-30T13:44:43.009Z"
 }
diff --git a/docs/automation/tasks.md b/docs/automation/tasks.md
index 269043912..c7076ae94 100644
--- a/docs/automation/tasks.md
+++ b/docs/automation/tasks.md
@@ -247,6 +247,7 @@ openclaw tasks notify <lookup> state_changes
     Reconciliation is runtime-aware:
 
     - ACP/subagent tasks check their backing child session.
+    - Subagent tasks whose child session has a restart-recovery tombstone are marked lost instead of being treated as recoverable backing sessions.
     - Cron tasks check whether the cron runtime still owns the job, then recover terminal status from persisted cron run logs/job state before falling back to `lost`. Only the Gateway process is authoritative for the in-memory cron active-job set; offline CLI audit uses durable history but does not mark a cron task lost solely because that local Set is empty.
     - Chat-backed CLI tasks check the owning live run context, not just the chat session row.
 
diff --git a/docs/gateway/doctor.md b/docs/gateway/doctor.md
index 35de3617d..d3c0a6a1a 100644
--- a/docs/gateway/doctor.md
+++ b/docs/gateway/doctor.md
@@ -93,6 +93,7 @@ cat ~/.openclaw/openclaw.json
   <Accordion title="State and integrity">
     - Session lock file inspection and stale lock cleanup.
     - Session transcript repair for duplicated prompt-rewrite branches created by affected 2026.4.24 builds.
+    - Wedged subagent restart-recovery tombstone detection, with `--fix` support for clearing stale aborted recovery flags so startup does not keep treating the child as restart-aborted.
     - State integrity and permissions checks (sessions, transcripts, state dir).
     - Config file permission checks (chmod 600) when running locally.
     - Model auth health: checks OAuth expiry, can refresh expiring tokens, and reports auth-profile cooldown/disabled states.
diff --git a/docs/tools/subagents.md b/docs/tools/subagents.md
index 7bf130338..6c1b45441 100644
--- a/docs/tools/subagents.md
+++ b/docs/tools/subagents.md
@@ -512,6 +512,14 @@ restart-aborted child sessions remain recoverable through the sub-agent
 orphan recovery flow, which sends a synthetic resume message before
 clearing the aborted marker.
 
+Automatic restart recovery is bounded per child session. If the same
+sub-agent child is accepted for orphan recovery repeatedly inside the
+rapid re-wedge window, OpenClaw persists a recovery tombstone on that
+session and stops auto-resuming it on later restarts. Run
+`openclaw tasks maintenance --apply` to reconcile the task record, or
+`openclaw doctor --fix` to clear stale aborted recovery flags on
+tombstoned sessions.
+
 <Note>
 If a sub-agent spawn fails with Gateway `PAIRING_REQUIRED` /
 `scope-upgrade`, check the RPC caller before editing pairing state.