diff --git a/docs/config-catalog.i18n.yaml b/docs/config-catalog.i18n.yaml
index 70024f4377..ed0b613d41 100644
--- a/docs/config-catalog.i18n.yaml
+++ b/docs/config-catalog.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/config-catalog.md
-config-catalog.md: 08c1c63050aefd9e0fcc7c603ad40ec6405bf6c1
+config-catalog.md: f84fdb17f29f9352cda77fc1901beba79a416c2f
 config-catalog.zh.md: e7cfcff8d69c3a1efbe8426e25415783bc41f864
diff --git a/docs/config-catalog.md b/docs/config-catalog.md
index 08c1c63050..f84fdb17f2 100644
--- a/docs/config-catalog.md
+++ b/docs/config-catalog.md
@@ -2507,7 +2507,7 @@ export interface Config {
 export type ToolPresentationMode = 'native' | 'code' | 'both'
 ```
 
-Source: [`packages/core/tools/src/index.ts:625`](../packages/core/tools/src/index.ts)
+Source: [`packages/core/tools/src/index.ts:629`](../packages/core/tools/src/index.ts)
 
 ## `@deepseek-ai/dsh-typert-loader`
 
diff --git a/docs/subsystems/tools.i18n.yaml b/docs/subsystems/tools.i18n.yaml
index 79fe385cd9..9aaa64d3ac 100644
--- a/docs/subsystems/tools.i18n.yaml
+++ b/docs/subsystems/tools.i18n.yaml
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/subsystems/tools.md
-tools.md: 54d20de3b4d1f2ff6d03a8e89e9356eef403382a
-tools.zh.md: f8a35ffa7121438b0623f2a0972f90df2923ac89
+tools.md: 4f0360f45e7ed4f3537bedeb0f370f8eb3472ab9
+tools.zh.md: aa6c67c6379e4a9b9ab7bdc473f6294d063e3649
diff --git a/docs/subsystems/tools.md b/docs/subsystems/tools.md
index 54d20de3b4..4f0360f45e 100644
--- a/docs/subsystems/tools.md
+++ b/docs/subsystems/tools.md
@@ -156,14 +156,13 @@ Registration is a trusted same-process contract. The registry borrows the typed
 
 ```ts type-equiv
 /**
- * Per-scope filter over the tools a scope INHERITS — the global layer and
- * every ancestor layer on its chain. Restrictions intersect, and do not affect
- * the scope's own registrations or the reserved Code Mode transport.
+ * Per-scope filter over global tools. Restrictions intersect and do not affect
+ * scoped registrations or the reserved Code Mode transport.
  */
 interface ToolRestriction {
-  /** Inherited tool names that stay visible; every other inherited one is removed. */
+  /** Global tool names that stay visible; everything else is removed. */
   readonly allow?: readonly string[]
-  /** Inherited tool names removed from visibility. */
+  /** Global tool names removed from visibility. */
   readonly deny?: readonly string[]
 }
 ```
@@ -198,8 +197,12 @@ interface ToolExecutionInput {
   /**
    * Opaque token of the enclosing transport execution, when one exists. Code
    * Mode sets this on SDK sub-dispatches so commit-style observers can wait for
-  * the outer `run_code` outcome without receiving its live mutable execution.
-  */
+   * the outer `run_code` outcome without receiving its live mutable execution.
+   * The token also marks the call as a transport sub-dispatch rather than a
+   * model-direct call: under `mode: 'code'`, only calls WITH a parent may
+   * execute a native tool name — a model-direct call (no parent) is denied as
+   * `UNKNOWN_TOOL` before the policy pipeline. See {@link ToolRegistry.execute}.
+   */
   readonly parent?: ToolExecutionToken
   /** Required caller-owned cancellation for this invocation. */
   readonly signal: AbortSignal
@@ -568,7 +571,7 @@ async execute(exec: ToolExecutionInput): Promise<ToolExecutionResult>
 
 Types: [ScopeKey](scope.md)
 
-Source: [`packages/core/tools/src/index.ts:761`](../../packages/core/tools/src/index.ts)
+Source: [`packages/core/tools/src/index.ts:764`](../../packages/core/tools/src/index.ts)
 
 <a id="tools-events"></a>
 
diff --git a/docs/subsystems/tools.zh.md b/docs/subsystems/tools.zh.md
index f8a35ffa71..aa6c67c637 100644
--- a/docs/subsystems/tools.zh.md
+++ b/docs/subsystems/tools.zh.md
@@ -156,14 +156,13 @@ type InferArgs<S> = InferProperties<S, []>
 
 ```ts type-equiv
 /**
- * Per-scope filter over the tools a scope INHERITS — the global layer and
- * every ancestor layer on its chain. Restrictions intersect, and do not affect
- * the scope's own registrations or the reserved Code Mode transport.
+ * Per-scope filter over global tools. Restrictions intersect and do not affect
+ * scoped registrations or the reserved Code Mode transport.
  */
 interface ToolRestriction {
-  /** Inherited tool names that stay visible; every other inherited one is removed. */
+  /** Global tool names that stay visible; everything else is removed. */
   readonly allow?: readonly string[]
-  /** Inherited tool names removed from visibility. */
+  /** Global tool names removed from visibility. */
   readonly deny?: readonly string[]
 }
 ```
@@ -198,8 +197,12 @@ interface ToolExecutionInput {
   /**
    * Opaque token of the enclosing transport execution, when one exists. Code
    * Mode sets this on SDK sub-dispatches so commit-style observers can wait for
-  * the outer `run_code` outcome without receiving its live mutable execution.
-  */
+   * the outer `run_code` outcome without receiving its live mutable execution.
+   * The token also marks the call as a transport sub-dispatch rather than a
+   * model-direct call: under `mode: 'code'`, only calls WITH a parent may
+   * execute a native tool name — a model-direct call (no parent) is denied as
+   * `UNKNOWN_TOOL` before the policy pipeline. See {@link ToolRegistry.execute}.
+   */
   readonly parent?: ToolExecutionToken
   /** Required caller-owned cancellation for this invocation. */
   readonly signal: AbortSignal
@@ -568,7 +571,7 @@ async execute(exec: ToolExecutionInput): Promise<ToolExecutionResult>
 
 Types: [ScopeKey](scope.md)
 
-Source: [`packages/core/tools/src/index.ts:761`](../../packages/core/tools/src/index.ts)
+Source: [`packages/core/tools/src/index.ts:764`](../../packages/core/tools/src/index.ts)
 
 <a id="tools-events"></a>
 
diff --git a/packages/core/agent-loop/tests/tool-calls.spec.ts b/packages/core/agent-loop/tests/tool-calls.spec.ts
index 10cbf9f056..e02fc592e4 100644
--- a/packages/core/agent-loop/tests/tool-calls.spec.ts
+++ b/packages/core/agent-loop/tests/tool-calls.spec.ts
@@ -4,7 +4,7 @@
  */
 
 import { describe, expect, it } from 'vitest'
-import { Context } from 'cordis'
+import { Context } from '@deepseek-ai/cordis'
 import { createUserMessage, CallId, StreamChunk  } from '@deepseek-ai/dsh-llm'
 import SessionStore, { SessionEvent, SessionId } from '@deepseek-ai/dsh-session'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
diff --git a/packages/core/tools/src/index.ts b/packages/core/tools/src/index.ts
index b39625705d..124d709c00 100644
--- a/packages/core/tools/src/index.ts
+++ b/packages/core/tools/src/index.ts
@@ -120,7 +120,7 @@ export type {
   WebSource,
 } from './presentation.ts'
 
-declare module 'cordis' {
+declare module '@deepseek-ai/cordis' {
   interface Context {
     tools: ToolRegistry
   }
diff --git a/packages/core/tools/tests/tools.spec.ts b/packages/core/tools/tests/tools.spec.ts
index 03d2d6b75b..b0b20ff8c1 100644
--- a/packages/core/tools/tests/tools.spec.ts
+++ b/packages/core/tools/tests/tools.spec.ts
@@ -1,5 +1,5 @@
 import { describe, expect, expectTypeOf, it } from 'vitest'
-import { Context } from 'cordis'
+import { Context } from '@deepseek-ai/cordis'
 import { createUserMessage, CallId, HarnessError, type ContentBlock  } from '@deepseek-ai/dsh-llm'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
 import type { Agent } from '@deepseek-ai/dsh-agent'