diff --git a/.openclaw-sync/source.json b/.openclaw-sync/source.json
index 96eb7ba30..72817d61c 100644
--- a/.openclaw-sync/source.json
+++ b/.openclaw-sync/source.json
@@ -1,5 +1,5 @@
 {
   "repository": "openclaw/openclaw",
-  "sha": "8989ceee50abd77c33352e36468b341f40591a5e",
-  "syncedAt": "2026-05-01T02:53:33.752Z"
+  "sha": "5d1ba08e3c97afa3f90b065d293ceff2bfa9b767",
+  "syncedAt": "2026-05-01T04:36:19.760Z"
 }
diff --git a/docs/gateway/doctor.md b/docs/gateway/doctor.md
index d3c0a6a1a..71659e9ee 100644
--- a/docs/gateway/doctor.md
+++ b/docs/gateway/doctor.md
@@ -83,6 +83,7 @@ cat ~/.openclaw/openclaw.json
     - OpenCode provider override warnings (`models.providers.opencode` / `models.providers.opencode-go`).
     - Codex OAuth shadowing warnings (`models.providers.openai-codex`).
     - OAuth TLS prerequisites check for OpenAI Codex OAuth profiles.
+    - Plugin/tool allowlist warnings when `plugins.allow` is restrictive but tool policy still asks for wildcard or plugin-owned tools.
     - Legacy on-disk state migration (sessions/agent dir/WhatsApp auth).
     - Legacy plugin manifest contract key migration (`speechProviders`, `realtimeTranscriptionProviders`, `realtimeVoiceProviders`, `mediaUnderstandingProviders`, `imageGenerationProviders`, `videoGenerationProviders`, `webFetchProviders`, `webSearchProviders` → `contracts`).
     - Legacy cron store migration (`jobId`, `schedule.cron`, top-level delivery/payload fields, payload `provider`, simple `notify: true` webhook fallback jobs).
@@ -164,6 +165,11 @@ That stages grounded durable candidates into the short-term dreaming store while
 
     That includes legacy Talk flat fields. Current public Talk config is `talk.provider` + `talk.providers.<provider>`. Doctor rewrites old `talk.voiceId` / `talk.voiceAliases` / `talk.modelId` / `talk.outputFormat` / `talk.apiKey` shapes into the provider map.
 
+    Doctor also warns when `plugins.allow` is non-empty and tool policy uses
+    wildcard or plugin-owned tool entries. `tools.allow: ["*"]` only matches tools
+    from plugins that actually load; it does not bypass the exclusive plugin
+    allowlist.
+
   </Accordion>
   <Accordion title="2. Legacy config key migrations">
     When the config contains deprecated keys, other commands refuse to run and ask you to run `openclaw doctor`.
diff --git a/docs/tools/plugin.md b/docs/tools/plugin.md
index edece4b83..c0dfbbe43 100644
--- a/docs/tools/plugin.md
+++ b/docs/tools/plugin.md
@@ -218,6 +218,12 @@ Looking for third-party plugins? See [Community Plugins](/plugins/community).
 | `slots`          | Exclusive slot selectors (e.g. `memory`, `contextEngine`) |
 | `entries.\<id\>` | Per-plugin toggles + config                               |
 
+`plugins.allow` is exclusive. When it is non-empty, only listed plugins can load
+or expose tools, even if `tools.allow` contains `"*"` or a specific plugin-owned
+tool name. If a tool allowlist references plugin tools, add the owning plugin ids
+to `plugins.allow` or remove `plugins.allow`; `openclaw doctor` warns about this
+shape.
+
 Config changes **require a gateway restart**. If the Gateway is running with config
 watch + in-process restart enabled (the default `openclaw gateway` path), that
 restart is usually performed automatically a moment after the config write lands.