diff --git a/docs/web-ui.md b/docs/web-ui.md
index 9a840e47..034370de 100644
--- a/docs/web-ui.md
+++ b/docs/web-ui.md
@@ -58,7 +58,18 @@ and the per-agent UIs (manager on :8000, sub-agents on a hashed
   page re-subscribes (gets a synthetic `open` event immediately
   if the upstream is already connected). Falls back gracefully
   when `SharedWorker` is unavailable (e.g. some private-mode
-  browsers).
+  browsers). **Worker-death self-heal** (#515): Firefox kills
+  "idle" SharedWorkers under memory pressure with no client-side
+  signal — the port silently goes no-op. The worker now pings
+  every connected port every 30s; the client bumps a
+  last-activity timestamp on every message (incl. pings, which
+  carry no URL — bumped before the URL filter). A
+  visibility-gated watchdog polls every 15s and, if the page is
+  visible AND has active subs AND hasn't heard from the worker
+  in >90s (three missed pings), presumes the worker dead and
+  re-subscribes on a fresh `SharedWorker` port (same code path
+  bfcache-restore uses). Recovery is per-tab; pings are
+  invisible on the healthy path.
 
 The JS app handles all `form[data-async]` submissions via a delegated
 listener: read `data-confirm`, swap the button to a spinner, POST