dominds 1.17.5 → 1.17.6

package/dist/apps/runtime.d.ts

@@ -1,4 +1,15 @@
 import { type AppsHostClient } from '../apps-host/client';
+export type DynamicAppToolAvailabilityResult = Readonly<{
+    status: 'ready';
+    toolsetIds: ReadonlyArray<string>;
+} | {
+    status: 'error';
+    toolsetIds: ReadonlyArray<string>;
+    errorText: string;
+} | {
+    status: 'not_applicable';
+    toolsetIds: ReadonlyArray<string>;
+}>;
 export declare function getAppsHostClient(): AppsHostClient;
 export declare function waitForAppsHostClient(): Promise<AppsHostClient>;
 export declare function shutdownAppsRuntime(): Promise<void>;
@@ -9,7 +20,20 @@ export declare function listDynamicAppToolsetsForMember(_params: {
     rtwsRootAbs: string;
     taskDocPath: string;
     memberId: string;
+    dialogId?: string;
+    rootDialogId?: string;
+    agentId?: string;
+    sessionSlug?: string;
 }): Promise<readonly string[]>;
+export declare function resolveDynamicAppToolAvailabilityForMember(_params: {
+    rtwsRootAbs: string;
+    taskDocPath: string;
+    memberId: string;
+    dialogId?: string;
+    rootDialogId?: string;
+    agentId?: string;
+    sessionSlug?: string;
+}): Promise<DynamicAppToolAvailabilityResult>;
 export declare function initAppsRuntime(params: {
     rtwsRootAbs: string;
     kernel: Readonly<{

package/dist/apps/runtime.js

@@ -8,6 +8,7 @@ exports.waitForAppsHostClient = waitForAppsHostClient;
 exports.shutdownAppsRuntime = shutdownAppsRuntime;
 exports.registerEnabledAppsToolProxies = registerEnabledAppsToolProxies;
 exports.listDynamicAppToolsetsForMember = listDynamicAppToolsetsForMember;
+exports.resolveDynamicAppToolAvailabilityForMember = resolveDynamicAppToolAvailabilityForMember;
 exports.initAppsRuntime = initAppsRuntime;
 const crypto_1 = require("crypto");
 const promises_1 = __importDefault(require("fs/promises"));
@@ -16,6 +17,7 @@ const dialog_1 = require("../dialog");
 const dialog_global_registry_1 = require("../dialog-global-registry");
 const dialog_instance_registry_1 = require("../dialog-instance-registry");
 const log_1 = require("../log");
+const tool_availability_updates_1 = require("../tool-availability-updates");
 const app_reminders_1 = require("../tools/app-reminders");
 const registry_1 = require("../tools/registry");
 const client_1 = require("../apps-host/client");
@@ -352,10 +354,12 @@ function registerAppArtifacts(app) {
     });
 }
 function syncRegisteredAppArtifacts(params) {
+    let changed = false;
     const nextAppIds = new Set(params.enabledApps.map((app) => app.appId));
     for (const appId of registeredAppArtifactsById.keys()) {
         if (!nextAppIds.has(appId)) {
             unregisterRegisteredAppArtifacts(appId);
+            changed = true;
         }
     }
     for (const app of params.enabledApps) {
@@ -368,7 +372,9 @@ function syncRegisteredAppArtifacts(params) {
             unregisterRegisteredAppArtifacts(app.appId);
         }
         registerAppArtifacts(app);
+        changed = true;
     }
+    return changed;
 }
 async function syncAppsHostToEnabledApps(params) {
     const config = appsRuntimeConfig;
@@ -417,7 +423,13 @@ async function refreshEnabledAppsRuntimeNow(params) {
             installJson: app.installJson,
         }),
     })));
-    syncRegisteredAppArtifacts({ enabledApps });
+    const appArtifactsChanged = syncRegisteredAppArtifacts({ enabledApps });
+    if (appArtifactsChanged) {
+        (0, tool_availability_updates_1.notifyToolAvailabilityRegistryMaybeChanged)({
+            reason: 'registry_changed',
+            trigger: 'apps-runtime:tool-proxies-refreshed',
+        });
+    }
     if (params.ensureHost) {
         await syncAppsHostToEnabledApps({ enabledApps });
     }
@@ -431,29 +443,59 @@ async function registerEnabledAppsToolProxies(params) {
     await run;
 }
 async function listDynamicAppToolsetsForMember(_params) {
+    const result = await resolveDynamicAppToolAvailabilityForMember(_params);
+    return result.status === 'ready' ? result.toolsetIds : [];
+}
+async function resolveDynamicAppToolAvailabilityForMember(_params) {
+    if (_params.taskDocPath.trim() === '') {
+        return { status: 'not_applicable', toolsetIds: [] };
+    }
     try {
         await registerEnabledAppsToolProxies({ rtwsRootAbs: _params.rtwsRootAbs });
     }
     catch (error) {
-        log.warn(`Failed to refresh enabled app tool proxies while resolving dynamic toolsets for member '${_params.memberId}'; continuing without dynamic app toolsets.`, asError(error));
-        return [];
+        const err = asError(error);
+        log.warn(`Failed to refresh enabled app tool proxies while resolving dynamic toolsets for member '${_params.memberId}'.`, err);
+        return {
+            status: 'error',
+            toolsetIds: [],
+            errorText: err.message,
+        };
     }
     if (!appsRuntimeConfig && !appsHostClient && !appsHostTransition) {
-        return [];
+        return { status: 'not_applicable', toolsetIds: [] };
     }
     if (!appsHostClient && !appsHostTransition) {
-        return [];
+        return { status: 'not_applicable', toolsetIds: [] };
     }
     try {
         const host = await ensureAppsHostReadyForToolCalls();
-        return await host.listDynamicToolsets({
+        const toolsetIds = await host.listDynamicToolsets({
             memberId: _params.memberId,
             taskDocPath: _params.taskDocPath,
+            ...(typeof _params.dialogId === 'string' && _params.dialogId.trim() !== ''
+                ? { dialogId: _params.dialogId.trim() }
+                : {}),
+            ...(typeof _params.rootDialogId === 'string' && _params.rootDialogId.trim() !== ''
+                ? { rootDialogId: _params.rootDialogId.trim() }
+                : {}),
+            ...(typeof _params.agentId === 'string' && _params.agentId.trim() !== ''
+                ? { agentId: _params.agentId.trim() }
+                : {}),
+            ...(typeof _params.sessionSlug === 'string' && _params.sessionSlug.trim() !== ''
+                ? { sessionSlug: _params.sessionSlug.trim() }
+                : {}),
         });
+        return { status: 'ready', toolsetIds };
     }
     catch (error) {
-        log.warn(`Failed to load dynamic app toolsets for member '${_params.memberId}'; continuing without dynamic app toolsets.`, asError(error));
-        return [];
+        const err = asError(error);
+        log.warn(`Failed to load dynamic app toolsets for member '${_params.memberId}'.`, err);
+        return {
+            status: 'error',
+            toolsetIds: [],
+            errorText: err.message,
+        };
     }
 }
 async function initAppsRuntime(params) {

package/dist/dialog.d.ts

@@ -16,7 +16,7 @@ import type { ContextHealthSnapshot } from '@longrun-ai/kernel/types/context-hea
 import type { DialogEvent, NativeToolCallPayload, ReminderContent, WebSearchCallAction, WebSearchCallSource } from '@longrun-ai/kernel/types/dialog';
 import type { DialogPrompt, DialogRunControlSpec, DialogSubdialogReplyTarget, DriveIntent } from '@longrun-ai/kernel/types/drive-intent';
 import type { LanguageCode } from '@longrun-ai/kernel/types/language';
-import type { CalleeCourseNumber, CalleeGenerationSeqNumber, CallingCourseNumber, DialogMetadataFile, HumanQuestion, ProviderData, ReasoningPayload, TellaskCallRecordName, TellaskReplyDirective } from '@longrun-ai/kernel/types/storage';
+import type { CalleeCourseNumber, CalleeGenerationSeqNumber, CallingCourseNumber, CallingGenerationSeqNumber, DialogMetadataFile, HumanQuestion, ProviderData, ReasoningPayload, TellaskCallRecordName, TellaskReplyDirective } from '@longrun-ai/kernel/types/storage';
 import { ChatMessage, FuncResultMsg, TellaskCarryoverMsg, TellaskResultMsg } from './llm/client';
 import type { ToolResultImageIngest } from './llm/gen';
 import type { JsonValue } from './tool';
@@ -376,13 +376,17 @@ export declare abstract class Dialog {
     receiveFuncResult(result: FuncResultMsg): Promise<void>;
     receiveTellaskResult(result: TellaskResultMsg): Promise<void>;
     receiveTellaskCarryover(result: TellaskCarryoverMsg): Promise<void>;
-    receiveTellaskCallResult(responderId: string, callName: 'tellaskBack' | 'tellask' | 'tellaskSessionless' | 'askHuman' | 'freshBootsReasoning', mentionList: string[] | undefined, tellaskContent: string, result: string, status: 'completed' | 'failed', callId: string): Promise<void>;
+    receiveTellaskCallResult(responderId: string, callName: 'tellaskBack' | 'tellask' | 'tellaskSessionless' | 'askHuman' | 'freshBootsReasoning', mentionList: string[] | undefined, tellaskContent: string, result: string, status: 'completed' | 'failed', callId: string, options?: {
+        originCourse?: CallingCourseNumber;
+        calling_genseq?: CallingGenerationSeqNumber;
+    }): Promise<void>;
     receiveTellaskResponse(responderId: string, callName: 'tellaskBack' | 'tellask' | 'tellaskSessionless' | 'askHuman' | 'freshBootsReasoning', mentionList: string[] | undefined, tellaskContent: string, status: 'completed' | 'failed', subdialogId: DialogID | undefined, options: {
         response: string;
         agentId: string;
         callId: string;
         originMemberId: string;
         originCourse?: CallingCourseNumber;
+        calling_genseq?: CallingGenerationSeqNumber;
         carryoverContent?: string;
         sessionSlug?: string;
         calleeCourse?: CalleeCourseNumber;

package/dist/dialog.js

@@ -936,16 +936,19 @@ class Dialog {
     async receiveTellaskCarryover(result) {
         return await this.dlgStore.receiveTellaskCarryover(this, result);
     }
-    async receiveTellaskCallResult(responderId, callName, mentionList, tellaskContent, result, status, callId) {
+    async receiveTellaskCallResult(responderId, callName, mentionList, tellaskContent, result, status, callId, options) {
         const tellaskResult = callName === 'tellask'
             ? {
                 type: 'tellask_result_msg',
                 role: 'tool',
-                genseq: this.activeGenSeqOrUndefined ?? 1,
                 callId,
                 callName,
                 status,
                 content: result,
+                ...(options?.originCourse !== undefined ? { originCourse: options.originCourse } : {}),
+                ...(options?.calling_genseq !== undefined
+                    ? { calling_genseq: options.calling_genseq }
+                    : {}),
                 call: {
                     tellaskContent,
                     mentionList: mentionList ?? [],
@@ -958,11 +961,16 @@ class Dialog {
                 ? {
                     type: 'tellask_result_msg',
                     role: 'tool',
-                    genseq: this.activeGenSeqOrUndefined ?? 1,
                     callId,
                     callName,
                     status,
                     content: result,
+                    ...(options?.originCourse !== undefined
+                        ? { originCourse: options.originCourse }
+                        : {}),
+                    ...(options?.calling_genseq !== undefined
+                        ? { calling_genseq: options.calling_genseq }
+                        : {}),
                     call: {
                         tellaskContent,
                         mentionList: mentionList ?? [],
@@ -974,11 +982,16 @@ class Dialog {
                 : {
                     type: 'tellask_result_msg',
                     role: 'tool',
-                    genseq: this.activeGenSeqOrUndefined ?? 1,
                     callId,
                     callName,
                     status,
                     content: result,
+                    ...(options?.originCourse !== undefined
+                        ? { originCourse: options.originCourse }
+                        : {}),
+                    ...(options?.calling_genseq !== undefined
+                        ? { calling_genseq: options.calling_genseq }
+                        : {}),
                     call: {
                         tellaskContent,
                     },
@@ -1050,11 +1063,14 @@ class Dialog {
             ? {
                 type: 'tellask_result_msg',
                 role: 'tool',
-                genseq: this.activeGenSeqOrUndefined ?? 1,
                 callId: options.callId,
                 callName,
                 status,
                 content: options.response,
+                ...(options.originCourse !== undefined ? { originCourse: options.originCourse } : {}),
+                ...(options.calling_genseq !== undefined
+                    ? { calling_genseq: options.calling_genseq }
+                    : {}),
                 call: {
                     tellaskContent,
                     mentionList: mentionList ?? [],
@@ -1071,11 +1087,14 @@ class Dialog {
                 ? {
                     type: 'tellask_result_msg',
                     role: 'tool',
-                    genseq: this.activeGenSeqOrUndefined ?? 1,
                     callId: options.callId,
                     callName,
                     status,
                     content: options.response,
+                    ...(options.originCourse !== undefined ? { originCourse: options.originCourse } : {}),
+                    ...(options.calling_genseq !== undefined
+                        ? { calling_genseq: options.calling_genseq }
+                        : {}),
                     call: {
                         tellaskContent,
                         mentionList: mentionList ?? [],
@@ -1090,11 +1109,14 @@ class Dialog {
                 : {
                     type: 'tellask_result_msg',
                     role: 'tool',
-                    genseq: this.activeGenSeqOrUndefined ?? 1,
                     callId: options.callId,
                     callName,
                     status,
                     content: options.response,
+                    ...(options.originCourse !== undefined ? { originCourse: options.originCourse } : {}),
+                    ...(options.calling_genseq !== undefined
+                        ? { calling_genseq: options.calling_genseq }
+                        : {}),
                     call: {
                         tellaskContent,
                     },
@@ -1312,7 +1334,6 @@ class Dialog {
                             status: 'completed',
                             course: this.currentCourse,
                             callId,
-                            genseq: this.activeGenSeqOrUndefined ?? 1,
                             content: rawResponse,
                             responder: {
                                 responderId,
@@ -1334,7 +1355,6 @@ class Dialog {
                             status: 'completed',
                             course: this.currentCourse,
                             callId,
-                            genseq: this.activeGenSeqOrUndefined ?? 1,
                             content: rawResponse,
                             responder: {
                                 responderId,
@@ -1355,7 +1375,6 @@ class Dialog {
                             status: 'completed',
                             course: this.currentCourse,
                             callId,
-                            genseq: this.activeGenSeqOrUndefined ?? 1,
                             content: rawResponse,
                             responder: {
                                 responderId,

package/dist/docs/app-constitution.md

@@ -129,6 +129,17 @@ rtws is the runtime workspace root (`process.cwd()`). The kernel reads/writes:
 - App context: the app-local team (app `.minds/team.yaml` plus its dependency/override composition).
 
 > Target direction: decouple “team visibility” from “tool availability”, but keep both encapsulated and overridable at app boundaries.
+>
+> Design principle: the app mechanism customizes Dominds by registering callbacks at explicit
+> kernel control points. Tool availability is one such control point; it should not be modeled as a
+> hidden side effect of lease/registry/cache behavior.
+>
+> Evolution policy: keep control points explicit and concrete first. Do not rush into a generalized
+> app callback framework before several control points have independently matured.
+>
+> Current-stage note: app-side protocol details are still relatively sparse. This is expected at the
+> current phase and should be read as “direction fixed, surface area still growing”, not as a sign
+> that the app model is undefined.
 
 ## App packages and manifests
 
@@ -485,7 +496,13 @@ Current prototype note (`dominds-apps/@longrun-ai/web-dev`, as of March 8, 2026)
 - `kind: "web"` sessions now create a real Playwright-backed browser/context/page runtime and report live page surfaces via session status/reminders.
 - `kind: "electron"` is **not** at the same completion level yet: it still falls back to the older prototype runtime path and should be treated as unfinished.
 - Reminder UX contract: tool output may summarize reminder-sync actions, but the reminder panel is the authoritative surface for attachment state.
-- Runtime refresh contract: after enabling the app, a full Dominds instance restart should not be required just to discover the toolset; the next minds reload / tools-registry fetch should refresh enabled app tool proxies. This does **not** mean in-flight prompts are rewritten retroactively.
+- Runtime refresh contract: after enabling the app, a full Dominds instance restart should not be required just to discover the toolset; the next minds reload / tool-availability fetch should refresh enabled app tool proxies. This does **not** mean in-flight prompts are rewritten retroactively.
+- Dynamic tool availability protocol note: app-controlled dynamic availability is a protocol layer of
+  its own and must remain semantically orthogonal to MCP registry/lease and member binding. See
+  [tool-availability-protocol.md](./tool-availability-protocol.md).
+- App mechanism note: this dynamic availability is expressed through an app callback registered at a
+  kernel control point, not through an app-owned registry or an implicit coupling to MCP/runtime
+  cache behavior.
 - Remaining gap list for the browser capability layer: screenshot / console / network evidence are not yet exposed as first-class tool outputs, and there is not yet a production-grade browser lifecycle manager.
 - Restart boundary: if the kernel/apps-host process restarts, persisted session records remain but the in-memory browser runtime degrades and must be recreated.
 

package/dist/docs/app-constitution.zh.md

@@ -128,6 +128,12 @@ rtws 是一次运行的工作区根目录（`process.cwd()`）。Kernel 在其
 - App 上下文：该 app 的本地团队（app 的 `.minds/team.yaml`，以及其依赖/覆盖组合之后的结果）。
 
 > 目标：把“团队视野（能看见谁）”从“工具可用性（能调用什么）”中解耦，但都需要以 app 为单位封装与可覆写。
+>
+> 设计原则：app 机制的核心是“在 kernel 的显式 control points 注册 callback 来定制系统行为”。工具可用性只是其中一个 control point，不能被建模成 lease/registry/cache 的隐式副作用。
+>
+> 演进策略：先坚持“显式、具名、具体”的 control points，不要在多个 control point 都还未独立成熟之前，过早抽象成通用 app callback framework。
+>
+> 阶段说明：目前 app 侧协议细节仍然偏少，这是预期中的现状。它表达的是“方向先树稳、表面积后生长”，而不是 app 模型尚未定型。
 
 ## App 包与清单
 
@@ -484,7 +490,9 @@ members:
 - `kind: "web"` 会话现在会创建真实的 Playwright browser/context/page 运行时，并通过 status/reminder 报告实时页面状态。
 - `kind: "electron"` 还没有达到同等完成度：当前仍回落到旧的原型运行时路径，应视为未完成能力。
 - 提醒体验契约：tool 输出可以摘要提示提醒同步动作，但附着状态的权威可见面仍是 reminder 面板本身。
-- 运行时刷新契约：app 启用后，不应再要求为了“看见工具集”而整实例重启；下一次 minds 重新加载 / tools-registry 拉取应刷新已启用 app 的工具代理。但这 **不表示** 已经发出的进行中 prompt 会被追写更新。
+- 运行时刷新契约：app 启用后，不应再要求为了“看见工具集”而整实例重启；下一次 minds 重新加载 / tool-availability 拉取应刷新已启用 app 的工具代理。但这 **不表示** 已经发出的进行中 prompt 会被追写更新。
+- 动态工具可用性协议说明：app 控制的 dynamic availability 是独立协议层，语义上必须与 MCP registry/lease 和成员工具绑定正交；见 [tool-availability-protocol.md](./tool-availability-protocol.md)。
+- app 机制说明：这里的 dynamic availability 应通过注册到 kernel control point 的 app callback 表达，而不是引入 app 自己的 registry，或与 MCP/runtime cache 隐式耦合。
 - 浏览器能力层的剩余缺口：截图 / console / network 证据尚未作为一等 tool output 暴露，也还没有生产级浏览器生命周期管理器。
 - 重启边界：若 kernel/apps-host 进程重启，已持久化的 session record 仍在，但内存态浏览器运行时会退化，需要后续 tool call 重新建立。
 

package/dist/docs/diligence-push.md

@@ -55,6 +55,14 @@ This is the "controlled convergence" path. The diligence-push mechanism should *
   - no pending subdialogs (waiting for backfill).
 - The driver would otherwise stop the generation loop (i.e., no tool/function outputs require another iteration).
 
+### Exception: provider deadlock recovery
+
+Some provider/API quirk handlers may request a one-time Diligence Push recovery after Dominds stops
+same-context retries for a known deadlock pattern. This is not the ordinary "dialog is about to go
+idle" path. In that recovery-only case, pending subdialogs do not veto the single Diligence Push
+injection, because the deadlock may happen in a function-result-driven generation round right after
+the root dialog has already registered an in-flight tellask/subdialog. Q4H remains a hard blocker.
+
 ### Action
 
 The runtime auto-sends a diligence prompt (rendered as a normal user bubble) and runs another
@@ -63,8 +71,8 @@ generation iteration.
 ### Boundedness
 
 To avoid infinite loops, diligence-push has a per-dialog budget (per-member `diligence-push-max`) that controls
-how many auto-continued diligence prompts can be injected for a given dialog before the runtime forces a
-Q4H suspension.
+how many auto-continued diligence prompts can be injected for a given dialog before the runtime stops
+issuing further automatic Diligence Pushes for that budget.
 
 - Default: **3**
 - If `< 1`, diligence-push is effectively disabled for that member
@@ -76,11 +84,10 @@ When a dialog becomes suspended due to a pending Q4H (Questions for Human), the
 counter is reset. This ensures that after the human answers the Q4H and the dialog is resumed, the
 dialog gets a fresh diligence-push budget again.
 
-### Budget exhausted → force Q4H
+### Budget exhausted → stop auto-pushing for that budget
 
-When the diligence-push budget is exhausted, the runtime creates a Q4H entry that asks the human whether
-to continue or stop. This converts "boundedness" into a legitimate suspension point and avoids
-infinite auto-continue loops.
+When the diligence-push budget is exhausted, the runtime emits an informational UI notice and stops
+issuing further automatic Diligence Pushes for that budget. It does not create a Q4H by itself.
 
 ### Disable switch
 
@@ -135,13 +142,17 @@ Rules:
 
 ### Where
 
-Implemented in the LLM driver loop (`dominds/main/llm/driver.ts`) as a small post-iteration check:
+Implemented in the kernel driver loop (`dominds/main/llm/kernel-driver/drive.ts`) as a small
+post-iteration check:
 
-1. If `suspendForHuman` is true, stop (Q4H / subdialog pending).
+1. If the dialog is suspended, stop (Q4H / subdialog pending), except for the deadlock-recovery
+   special case described above where one recovery-only Diligence Push may ignore pending
+   subdialogs.
 2. If there is any tool feedback, continue normally.
 3. Otherwise (root only), attempt diligence-push auto-continue:
    - If disabled → stop normally.
-   - If budget exhausted → create Q4H and stop.
+   - If budget exhausted → emit an informational UI notice and stop further automatic Diligence
+     Pushes for the current budget.
    - Else → auto-send diligence prompt and continue.
 
 ### Message type

package/dist/docs/diligence-push.zh.md

@@ -51,13 +51,20 @@ Dominds 根对话旨在长期运行。根对话"停止"（变为空闲）通常
   - 没有待处理的子对话（等待回填）。
 - 驱动程序即将停止生成循环（即没有工具/函数输出需要另一次迭代）。
 
+### 例外：provider deadlock recovery
+
+某些 provider/API quirk 在识别到已知的 same-context deadlock，并停止沿用同一上下文自动重试后，
+会请求一次性的鞭策恢复。这不是普通的“对话即将空转停止”路径。在这个仅用于恢复的特例里，
+即使根对话已经登记了在途诉请/支线对话，pending subdialog 也不应否决这一次鞭策注入；因为卡死
+可能正发生在函数结果驱动的生成轮次里。Q4H 仍然是硬阻塞条件。
+
 ### 操作
 
 运行时自动发送一个鞭策语（渲染为正常的用户气泡）并运行另一次生成迭代。
 
 ### 有界性
 
-为避免无限循环，diligence-push 有一个按对话的预算（每个成员的 `diligence-push-max`），控制对于给定对话在运行时强制 Q4H 暂停之前可以注入多少个自动继续的鞭策语。
+为避免无限循环，diligence-push 有一个按对话的预算（每个成员的 `diligence-push-max`），控制对于给定对话在当前预算内还能注入多少个自动继续的鞭策语；预算耗尽后，运行时会停止继续自动鞭策。
 
 - 默认值：**3**
 - 如果 `< 1`，则该成员的 diligence-push 有效禁用
@@ -67,9 +74,9 @@ Dominds 根对话旨在长期运行。根对话"停止"（变为空闲）通常
 
 当对话因待处理的 Q4H（Questions for Human）而暂停时，diligence-push 注入计数器会被重置。这确保在人类回答 Q4H 并恢复对话后，对话会获得新的 diligence-push 预算。
 
-### 预算耗尽 → 强制 Q4H
+### 预算耗尽 → 停止继续自动鞭策当前预算
 
-当 diligence-push 预算耗尽时，运行时会创建一个 Q4H 条目，询问人类是否继续或停止。这将"有界性"转换为合法的暂停点，并避免无限自动继续循环。
+当 diligence-push 预算耗尽时，运行时会发出一条仅用于提示的 UI 信息，并停止继续自动鞭策当前预算。它不会仅因预算耗尽而自动创建 Q4H。
 
 ### 禁用开关
 
@@ -121,13 +128,14 @@ members:
 
 ### 位置
 
-在 LLM 驱动程序循环中实现（`dominds/main/llm/driver.ts`），作为迭代后的小检查：
+在 kernel driver 循环中实现（`dominds/main/llm/kernel-driver/drive.ts`），作为迭代后的小检查：
 
-1. 如果 `suspendForHuman` 为 true，则停止（Q4H / 子对话待处理）。
+1. 如果对话处于暂停状态，则停止（Q4H / 子对话待处理）；但上文所述 deadlock-recovery 特例除外，
+   即那一次恢复专用的鞭策可忽略 pending subdialog。
 2. 如果有任何工具反馈，则正常继续。
 3. 否则（仅限根），尝试 diligence-push 自动继续：
    - 如果禁用 → 正常停止。
-   - 如果预算耗尽 → 创建 Q4H 并停止。
+   - 如果预算耗尽 → 发出一条仅用于提示的 UI 信息，并停止继续自动鞭策当前预算。
    - 否则 → 自动发送鞭策语并继续。
 
 ### 消息类型

package/dist/docs/mcp-support.md

@@ -67,6 +67,10 @@ or have global process-scoped caches.
 
 Dominds therefore treats MCP client connections/processes as **leased resources** by default.
 
+Lease semantics are intentionally **orthogonal** to tool visibility. A lease decides runtime
+instance/process ownership only; it does not define the global MCP tool catalog or the final
+member-visible tool set. See [tool-availability-protocol.md](./tool-availability-protocol.md).
+
 ### Server config: `truely-stateless` (default: `false`)
 
 Each MCP server supports an explicit boolean flag:
@@ -81,23 +85,23 @@ implemented config surface.
 ### Default behavior (`truely-stateless: false`)
 
 - The first time any MCP tool from that server’s toolset is used in a given dialog, Dominds creates
-  a **dedicated MCP client instance** (and thus a dedicated MCP server process/connection for that
+  a **dedicated MCP runtime instance** (and thus a dedicated MCP server process/connection for that
   dialog).
-- That client instance remains **leased to that dialog** for future function tool calls from the same
+- That runtime instance remains **leased to that dialog** for future function tool calls from the same
   toolset.
-- If another dialog uses the same MCP toolset concurrently, Dominds creates **another** MCP client
+- If another dialog uses the same MCP toolset concurrently, Dominds creates **another** MCP runtime
   instance for that requesting dialog (no cross-dialog sharing).
 - On first lease, Dominds adds a **sticky owned reminder** to the dialog instructing the agent to
-  release the lease when it is confident the toolset won’t be needed again soon.
+  release the lease when it is confident the runtime instance won’t be needed again soon.
 
 Releasing:
 
 - Agents should call `mcp_release({"serverId":"<serverId>"})` (from `mcp_admin`) to release the
-  leased client instance for the current dialog.
+  leased runtime instance for the current dialog.
 
 ### Shared behavior (`truely-stateless: true`)
 
-- Dominds may share a single MCP client instance across dialogs for that server/toolset.
+- Dominds may share a single MCP runtime instance across dialogs for that server/toolset.
 - No per-dialog lease reminder is required.
 
 ## Goals

package/dist/docs/mcp-support.zh.md

@@ -52,6 +52,10 @@ Dominds 的行为：
 
 因此，Dominds 默认将 MCP 客户端连接/进程视为**租赁资源**。
 
+租约语义与工具可见性是**正交**的。租约只决定某个 HTTP 连接或 stdio 进程实例由谁持有，不决定
+全局 MCP 工具目录，也不决定成员最终可见的工具集合。参见
+[tool-availability-protocol.md](./tool-availability-protocol.md)。
+
 ### 服务器配置：`truely-stateless`（默认值：`false`）
 
 每个 MCP 服务器支持一个显式的布尔标志：
@@ -63,18 +67,18 @@ Dominds 的行为：
 
 ### 默认行为（`truely-stateless: false`）
 
-- 第一次在任何对话中使用来自该服务器工具集的 MCP 工具时，Dominds 为该对话创建一个**专用的 MCP 客户端实例**（因此也是专用的 MCP 服务器进程/连接）。
-- 该客户端实例在来自同一工具集的未来工具调用中保持**租赁给该对话**。
-- 如果另一个对话并发使用相同的 MCP 工具集，Dominds 为请求对话创建**另一个**MCP 客户端实例（不跨对话共享）。
-- 在首次租赁时，Dominds 向对话添加一个**粘性拥有提醒**，指示智能体在确信不再需要该工具集时释放租赁。
+- 第一次在任何对话中使用来自该服务器工具集的 MCP 工具时，Dominds 为该对话创建一个**专用的 MCP 运行时实例**（因此也是专用的 MCP 服务器进程/连接）。
+- 该运行时实例在来自同一工具集的未来工具调用中保持**租赁给该对话**。
+- 如果另一个对话并发使用相同的 MCP 工具集，Dominds 为请求对话创建**另一个**MCP 运行时实例（不跨对话共享）。
+- 在首次租赁时，Dominds 向对话添加一个**粘性拥有提醒**，指示智能体在确信不再需要该运行时实例时释放租赁。
 
 释放：
 
-- 智能体应调用 `mcp_release({"serverId":"<serverId>"})`（来自 `mcp_admin`）来释放当前对话的租赁客户端实例。
+- 智能体应调用 `mcp_release({"serverId":"<serverId>"})`（来自 `mcp_admin`）来释放当前对话持有的租赁运行时实例。
 
 ### 共享行为（`truely-stateless: true`）
 
-- Dominds 可以跨对话共享该服务器/工具集的单个 MCP 客户端实例。
+- Dominds 可以跨对话共享该服务器/工具集的单个 MCP 运行时实例。
 - 不需要每个对话的租赁提醒。
 
 ## 目标