refactor(runtime): make the tool-result archive capability indivisible

[Astro-Han]

Summary

The tool-result archive was three optional fields spread across two configuration surfaces. The writer (archiveToolResult) and the replay reader (readToolResultArchive) went to the backend; the ref-addressed reader (archiveResources) went to the tool builder. Nothing tied them together, so "this session archives but has no way to decode a placeholder" was a spellable state at all four hosts that assemble the capability — embedded desktop, runtime-host server, CLI, and headless/Harbor.

It shipped twice. #2025 was the headless surface. The child-agent path was the second instance, and CHILD_RECOVERY_TOOL_NAMES did not fix it: every child surface is re-narrowed by buildToolsForAgentDefinition against definition.tools, no built-in definition lists ArchiveRead, and durable snapshots record [...definition.tools]. The pass-through was undone by the very next step every time.

The fix is not a stricter assertion at the assembly points. It is noticing what the decoder actually is. When the context budget prunes a large tool result, the placeholder that replaces it is a runtime-generated protocol value naming ArchiveRead as the way back. Which tool decodes a value the runtime itself wrote is not a host configuration question and not an agent permission. So:

• ToolResultArchiveCapability bundles the writer, both readers, and the decoder tool. It is constructible only through createToolResultArchiveCapability, so a half-built capability has no spelling.
• Hosts supply storage and nothing else. The single AiSdkBackendInput field replaces the two backend options, and the backend binds the decoder itself at the one place input.tools is consumed.
• archiveResources, the hand-wired desktop and runtime-host ArchiveRead registrations, and the separate headless resource-reader builder are deleted. So are CHILD_RECOVERY_TOOL_NAMES and the ArchiveRead entry in the deep-research allowlist — both were pool-level pass-throughs that later narrowing undid.
• The CLI's legitimate "archives nothing at all" state stays expressible with no escape hatch: it simply passes no capability, and gets no decoder.

Closes #2026. Refs #2025, #2036, #2028.

Breaking change

BackendFactoryContext.tools is now documented as a ceiling on agent-permission tools, not on everything the provider sees. A child receives its exact allowlist plus the archive decoder. That is the point of the change: withholding the decoder grants no safety — it only strands content the model was explicitly instructed to retrieve, using a ref the runtime minted from the parent's own tool output. The contract comment at packages/runtime/src/session-manager.ts says so explicitly rather than leaving the carve-out implicit.

The product tool surface identity no longer lists ArchiveRead, for the same reason: it records the host's product binding, and the decoder is not part of it. Nothing consumes that identity as "what the model will see" — the benchmark arm classifiers compare connection slug, model, reasoning effort, agentTools, prompt hash and pricing profile, never productToolNames, and validateHarborCellExecutionIdentity only checks catalog membership. So the under-report has no reader.

Review

Reviewed by four independent passes (correctness/completeness, first-principles design, test quality, leftovers). No P0/P1. The one finding worth acting on was that every test observed advertisement and none observed execution, leaving half the invariant unpinned — a tool can reach the provider's list and still be unreachable at dispatch. Fixed with an end-to-end test that drives a real turn (prune → placeholder → model calls ArchiveRead with the ref → body returns), verified by mutation: deleting the binding fails it. Also cleaned three second-sources-of-truth the move left behind (a type cycle, a duplicated tool-name literal, a dead import) and corrected docblocks whose prose outlived the migration they described.

Declined: extracting the two 6-line desktop test helpers into a new test-only package export — a public-surface change costing more than the duplication it removes. Deferred: a second round-trip test for the runtime-host ref reader, which is literally the same readArchive function the replay reader already covers.

Verification

• npm run lint, npm run format:check, npm run build — clean.
• @maka/runtime — 3195 pass, 0 fail (9 skipped).
• @maka/runtime-host — 699 pass, 0 fail. The child-ceiling assertions moved from ['Glob','Grep','Read'] to ['ArchiveRead','Glob','Grep','Read'] against a real provider wire, which is the observable proof that a narrowed child now keeps its decoder.
• @maka/headless — 1409 pass, 0 fail. Includes the fix(headless): register ArchiveRead when Harbor enables tool-result archiving #2025 round trip, now driven end to end from one capability.
• @maka/core — 784 pass, 0 fail.
• @maka/desktop — 13 failures, all pre-existing: the same set fails on main (33 failures there, a strict superset), and they are macOS temp-path and project-root resolution tests untouched by this change.
• @maka/storage — 15 failures, 16 on main; Git-worktree tests, and packages/storage does not depend on @maka/runtime.
• Not run: the Playwright E2E suite. This change is main-process and runtime wiring with no renderer surface, and the E2E suite runs the fake backend, which archives nothing.

New tests pin both halves of the contract at the provider-visible boundary — a session that archives advertises the tool its placeholders name, a session that archives nothing does not, the decoder reads back exactly what the writer stored, and it reads as the invoking session.