feat(desktop): complete Runtime Host opt-in parity

[M4n5ter]

English

Summary

• add an explicit, single-owner Runtime Host Desktop boot path while keeping the Embedded Runtime as the default
• complete the Electron-main Host adapter for Desktop sessions, turns, configuration, connections, OAuth, artifacts, voice, web search, usage, memory, skills, permissions, inspection, planning, research, Graph, and other existing product domains
• connect Desktop Browser, Computer Use, and MCP implementations through the open-world Client Capability protocol
• preserve canonical transcript continuity across startup, reconnect, mid-turn attachment, concurrent readers, Host restart, and shutdown
• keep the renderer-facing Electron IPC contract stable while moving Runtime authority behind typed Host operations

The Host-backed path is opt-in through MAKA_DESKTOP_RUNTIME_OWNER=runtime-host. Startup selects exactly one boot graph; an invalid selection is fatal and the Host path never falls back to an Embedded owner.

Existing shared / Embedded Runtime issues fixed

Full parity testing exposed several issues that were not introduced by the Host adapter and also affected the existing shared or Embedded path:

• user attachments had presentation metadata but no exact, model-readable resource reference; session attachments now use a session-scoped opaque reference that the Read tool resolves without exposing storage paths
• a persisted partial assistant row could overlap its live projection during streaming and render duplicate content; the shared materializer now replaces the matching persisted row with the live projection
• a voice-only submission with no transcript text could produce an empty user input; both boot paths now persist a stable voice-input marker
• MCP tool wrappers could silently follow a reconfigured same-ID server; wrappers now stay bound to the connection generation that advertised them and fail explicitly after that generation retires

Validation

• full repository test suite
• Biome format and lint checks
• full workspace typecheck
• production Desktop build and third-party notice verification
• 83 of 84 Desktop Electron E2E tests pass; the remaining prompt-rail geometry failure reproduces unchanged on origin/main with the same dependencies and a clean rebuild
• production-shaped Host-backed Desktop journeys covering cold start and restart, provider configuration, real turns, attachments and artifacts, voice, web search, native capabilities, inspector/Plan/Research/Graph, multi-client mid-turn attachment, concurrent transcript reads, unread persistence, and Host recovery

Part of #2010.

简体中文

摘要

• 新增显式、单 owner 的 Runtime Host Desktop 启动路径，同时继续以 Embedded Runtime 作为默认路径
• 补齐 Electron main 中面向 Desktop Session、Turn、配置、连接、OAuth、Artifact、语音、Web Search、Usage、Memory、Skill、Permission、Inspector、Plan、Research、Graph 等现有产品域的 Host adapter
• 通过开放世界 Client Capability 协议连接 Desktop Browser、Computer Use 与 MCP 实现
• 在启动、重连、Turn 中途加入、并发读取、Host 重启与关闭期间保持 canonical transcript continuity
• 保持 renderer-facing Electron IPC contract 稳定，同时把 Runtime authority 移到 typed Host operation 之后

Host-backed 路径通过 MAKA_DESKTOP_RUNTIME_OWNER=runtime-host 显式启用。启动时只会选择一个 boot graph；非法配置会直接失败，Host 路径不会回退到 Embedded owner。

一并修复的既有 shared / Embedded Runtime 问题

完整 parity 测试发现了若干并非由 Host adapter 引入、同样影响既有 shared 或 Embedded 路径的问题：

• 用户附件此前只有展示元数据，没有精确且可供模型读取的资源引用；现在 Session 附件使用 Session-scoped opaque reference，由 Read tool 解析，同时不暴露底层存储路径
• 流式过程中，已持久化的 partial assistant row 可能与 live projection 重叠并重复渲染；shared materializer 现在会用对应 live projection 替换该持久化 row
• 没有 transcript text 的纯语音提交可能产生空 user input；两个 boot path 现在都会持久化稳定的 voice-input marker
• MCP tool wrapper 此前可能在同 ID server 重配置后静默切换到新 endpoint；现在 wrapper 会绑定到发布它的 connection generation，并在该 generation 退出后显式失败

验证

• 全仓测试套件
• Biome format 与 lint 检查
• 全 workspace typecheck
• Desktop production build 与 third-party notice 校验
• 84 项 Desktop Electron E2E 中 83 项通过；剩余 prompt-rail geometry 失败在相同依赖和完整重建下可在 origin/main 原样复现
• production-shaped Host-backed Desktop journey，覆盖冷启动与重启、Provider 配置、真实 Turn、附件与 Artifact、语音、Web Search、native capability、Inspector/Plan/Research/Graph、多 Client 在 Turn 中途加入、并发 transcript 读取、未读状态持久化与 Host 恢复

#2010 的一部分。