refactor(runtime): remove unused tool reconciliation writer

apps/desktop/src/main/client-settings-tools.ts

@@ -70,7 +70,6 @@ export function buildClientSettingsTools(
       'Runtime behavior, credentials, model configuration, network settings, and Bot settings are excluded.',
     parameters: z.object({}).strict(),
     categoryHint: 'read',
-    recoveryMode: 'replay_safe',
     impl: async () => project(await authority.read()),
   };
   const updateTool: MakaTool<ClientSettingsPatch, ClientSettingsUpdateResult> = {

docs/architecture/runtime-recovery-resolver-adr.zh-CN.md

@@ -19,6 +19,9 @@
 
 # ADR：RuntimeEvent 唯一事实源与 RecoveryResolver 唯一判定权威
 
+> **2026-10-16 退役说明：** 本文涉及工具专属 reconciliation、recovery bundle 写入及其后续 PR 的内容保留为历史设计，不再是当前实施要求。没有生产工具提供完整的 reconciliation 合同，公开 bundle writer 和预设工具恢复能力已清理。已有 recovery facts 仍保留读取、复制与投影重建兼容。当前合同是结束旧执行、保留未知事实、禁止自动重放，由新的明确用户轮检查现状；详见[当前恢复架构](./runtime-resume-architecture.zh-CN.md#未知结果与历史-recovery-bundle)。
+
+
 - 状态：Accepted，Phase 2.5 开始实施
 - 日期：2026-07-17
 - 范围：Runtime Resume Phase 2.5–3

docs/architecture/runtime-resume-extraction-ledger.zh-CN.md

@@ -19,6 +19,9 @@
 
 # Runtime Resume #1346 拆分与提取账本
 
+> **2026-10-16 退役说明：** 本文涉及工具专属 reconciliation、recovery bundle 写入及其后续 PR 的内容保留为历史设计，不再是当前实施要求。没有生产工具提供完整的 reconciliation 合同，公开 bundle writer 和预设工具恢复能力已清理。已有 recovery facts 仍保留读取、复制与投影重建兼容。当前合同是结束旧执行、保留未知事实、禁止自动重放，由新的明确用户轮检查现状；详见[当前恢复架构](./runtime-resume-architecture.zh-CN.md#未知结果与历史-recovery-bundle)。
+
+
 - 状态：Active
 - 更新日期：2026-07-28
 - 集成实验来源：`origin/codex/runtime-resume-phase3a@24bb5f33`

docs/architecture/runtime-resume-phase3-phase4-workspace-checkpoint-design.zh-CN.md

@@ -19,6 +19,9 @@
 
 # Runtime Resume Phase 3–4 实施路线
 
+> **2026-10-16 退役说明：** 本文涉及工具专属 reconciliation、recovery bundle 写入及其后续 PR 的内容保留为历史设计，不再是当前实施要求。没有生产工具提供完整的 reconciliation 合同，公开 bundle writer 和预设工具恢复能力已清理。已有 recovery facts 仍保留读取、复制与投影重建兼容。当前合同是结束旧执行、保留未知事实、禁止自动重放，由新的明确用户轮检查现状；详见[当前恢复架构](./runtime-resume-architecture.zh-CN.md#未知结果与历史-recovery-bundle)。
+
+
 > 路线更新（2026-08-29）：旧 Git executable managed-workspace path 已删除，后续 workspace 主线从
 > **Gitoxide data plane** 重新建立 production admission。本文保留 Recovery/Continuation 已落地协议与旧路线的历史论证；
 > 新实现不再以通用 per-file checkpoint、native manifest、CAS object store 或旧 Git CLI owner 为前置。

packages/core/src/runtime-event-store.ts

@@ -36,16 +36,8 @@ import type {
 } from './workspace-version-authority.js';
 import { WORKSPACE_VERSION_AUTHORITY_CAPABILITY_V1 } from './workspace-version-authority.js';
 
-export const TOOL_RECOVERY_BUNDLE_CAPABILITY_V1 = 'tool_recovery_bundle_v1' as const;
 export const RUNTIME_CONTINUATION_AUTHORITY_V1 = 'runtime_continuation_authority_v1' as const;
 
-export interface RuntimeRecoveryBundleCommit {
-  operationId: string;
-  reconcileRuntimeEvent: RuntimeEvent;
-  outcomeRuntimeEvent?: RuntimeEvent;
-  decisionRuntimeEvent: RuntimeEvent;
-}
-
 export interface RuntimeInvocationRecoveryInventoryEntry {
   readonly sessionId: string;
   readonly invocationId: string;
@@ -277,11 +269,6 @@ export async function readRunInvocation(
   );
 }
 
-export interface RuntimeRecoveryBundleStore extends RuntimeEventStore {
-  readonly recoveryBundleCapability: typeof TOOL_RECOVERY_BUNDLE_CAPABILITY_V1;
-  commitToolRecoveryBundle(input: RuntimeRecoveryBundleCommit): Promise<void>;
-}
-
 export type ContinuationClaimResult =
   | { kind: 'acquired'; claim: ContinuationClaimV1 }
   | { kind: 'existing'; claim: ContinuationClaimV1 }

packages/core/src/runtime-event.ts

@@ -633,7 +633,10 @@ export interface RuntimeEventRefs {
   sourceRuntimeEventHighWater?: number;
 }
 
-/** Tool-owned contract for deciding what a later recovery phase may do. */
+/** Current tools only choose how to report an unknown result; neither mode retries an effect. */
+export type ToolOutcomeRecoveryMode = 'never_auto_retry' | 'outcome_unknown';
+
+/** Persisted dispatch metadata, including legacy modes; never authorizes recovery by itself. */
 export type ToolRecoveryMode =
   | 'replay_safe'
   | 'idempotent'

packages/core/src/tool-ledger-scanner.ts

@@ -141,11 +141,7 @@ export type GenericToolLedgerAppendValidation =
       eventId: string;
     };
 
-export type ToolLedgerTransitionKind =
-  | 'generic_append'
-  | 't1_prepare'
-  | 't2_outcome'
-  | 'recovery_bundle';
+export type ToolLedgerTransitionKind = 'generic_append' | 't1_prepare' | 't2_outcome';
 
 /** Every reason the ledger has for refusing a candidate event. */
 export type ToolLedgerRejectionCode =
@@ -708,15 +704,7 @@ function validateTransitionShape(
     (expectedTransition === 't2_outcome' &&
       actual.length === 1 &&
       actual[0] === 'function_response' &&
-      events[0]?.refs?.operationId !== undefined) ||
-    (expectedTransition === 'recovery_bundle' &&
-      ((actual.length === 2 &&
-        actual[0] === 'reconcile_result' &&
-        actual[1] === 'recovery_decision') ||
-        (actual.length === 3 &&
-          actual[0] === 'reconcile_result' &&
-          actual[1] === 'function_response' &&
-          actual[2] === 'recovery_decision')));
+      events[0]?.refs?.operationId !== undefined);
   if (valid) return { ok: true };
   return {
     ok: false,

packages/core/src/tool-recovery-bundle.ts

@@ -91,17 +91,6 @@ export type ScannedToolRecoveryInterpretation =
       message: string;
     };
 
-export class ToolRecoveryBundleValidationError extends Error {
-  readonly name = 'ToolRecoveryBundleValidationError';
-
-  constructor(
-    readonly code: ToolRecoveryBundleValidationCode,
-    message: string,
-  ) {
-    super(message);
-  }
-}
-
 export function validateToolRecoveryEventBundle(
   input: ToolRecoveryEventBundle,
 ): ToolRecoveryBundleValidationResult {
@@ -275,16 +264,8 @@ export function validateToolRecoveryEventBundle(
   return { ok: true, reconcile, decision };
 }
 
-export function assertToolRecoveryEventBundle(input: ToolRecoveryEventBundle): {
-  reconcile: ToolReconcileResultFact;
-  decision: ToolRecoveryDecisionFact;
-} {
-  const result = validateToolRecoveryEventBundle(input);
-  if (!result.ok) throw new ToolRecoveryBundleValidationError(result.code, result.message);
-  return { reconcile: result.reconcile, decision: result.decision };
-}
-
 /**
+ * Read compatibility for historical recovery bundles. Current tools never produce these facts.
  * Interprets the recovery tail of one scanner-owned operation. Resolver and
  * projection rebuild must consume this result instead of independently
  * assembling facts or defining their own causal-order rules.

packages/runtime-host/src/__tests__/execution-model-composition.test.ts

@@ -1016,7 +1016,7 @@ test('Host reopens one projected image from its ArtifactStore authority', async
             name: 'ProjectedImage',
             description: 'Return one inline image.',
             parameters: z.object({}),
-            recoveryMode: 'replay_safe',
+            recoveryMode: 'never_auto_retry',
             impl: async () => ({ private: 'raw execution fact' }),
             toModelOutput: () => ({
               type: 'content',

packages/runtime-host/src/server/agent-settings-tools.ts

@@ -101,7 +101,6 @@ export function buildHostAgentSettingsTools(
       'This never returns credentials, network proxy details, native client settings, or Bot settings.',
     parameters: z.object({}).strict(),
     categoryHint: 'read',
-    recoveryMode: 'replay_safe',
     impl: async () => projectSettings((await authority.read()).policy),
   };
   const updateTool: MakaTool<AgentSettingsPatch, AgentSettingsUpdateResult> = {