feat(goal): make Goal the sole long-task runtime / Goal 成为唯一长任务状态机 - #7959

Problem: the latest main-v2 governor merge adds three baselined function and file lines after the Goal PR sync.\n\nRoot cause: the governor commit did not update repository standards budgets before becoming the PR base.\n\nFix: record only the exact e2ebench and agent.go growth reported by repolint.\n\nVerification: go run ./tools/repolint; git diff --check.

Problem:
Workflow-only tools could remain model-visible outside their executable context, mixed batches did not repair every unavailable call, and legacy AutoResearch recovery could lose retry state or reactivate after downgrade.

Root cause:
Tool schemas and child metadata were assembled from static registries, parent runtime services leaked through inherited contexts, and legacy task IDs were cleared before migration persistence was known to succeed.

Fix:
Filter schemas through ContextualTool, bound mixed-batch repair, isolate child Goal/Jobs/memory state, compute contextual metadata, and make legacy sidecar migration retryable, fail-closed, and downgrade-safe with budgetClass as the authority.

Verification:
go test ./... -count=1
go test -race ./internal/control ./internal/agent ./internal/jobs ./internal/tool ./internal/tool/builtin ./internal/memory ./internal/autoresearch -count=1
go vet ./...
golangci-lint run --timeout=5m
cd desktop && go test ./... -count=1
pnpm typecheck; pnpm test:all; pnpm build
scripts/cache-guard.sh
go run ./tools/repolint
git diff --check

Problem: the Goal-only runtime still had provider-context schema filtering assumptions, and an explicit legacy archive could lose its recovery token after a Controller restart.\n\nRoot cause: execution isolation was coupled to provider-visible tool removal, while explicit archive identity lived only in memory and was not distinguished from a sidecar Goal text.\n\nFix: keep stable Registry schemas and enforce Goal, Jobs, and memory boundaries at execution time; add epoch-fenced read-only archive recovery with explicit-path restart handling; preserve unknown Finding kinds and add focused regression coverage.\n\nVerification: go test ./...; go test -race ./internal/control ./internal/agent; cd desktop/frontend && pnpm typecheck && pnpm test:all && pnpm build; scripts/cache-guard.sh; scripts/check-cache-impact.sh; go run ./tools/repolint; git diff --check.

…runtime

Problem
The PR branch received a concurrent sibling fix while the local branch also integrated the latest main-v2 and completed the Goal-only runtime hardening.

Root cause
The sibling implementation reintroduced context-dependent provider tool schemas and a pending legacy task field, conflicting with the PR's cache-stability and Goal-state ownership requirements.

Fix
Merge the remote branch without force-push, retain static provider schemas with execution-time isolation, keep epoch-fenced legacy restoration outside the active Goal machine, and document the reconciled behavior.

Verification
- go test ./... -count=1
- go test -race ./internal/control ./internal/agent -count=1
- cd desktop && go test ./... -count=1
- desktop/frontend pnpm typecheck, test:all, build
- scripts/cache-guard.sh
- scripts/check-cache-impact.sh
- go run ./tools/repolint
- git diff --check

…e-runtime' into feature/goal-sole-runtime

Problem:
A concurrent branch reconciliation kept static provider schemas and moved legacy recovery state outside the Goal machine, diverging from the approved esengine#7959 behavior after the latest-base merge.

Root cause:
The merge resolved overlapping Goal, Jobs, child-context, and tool-registry owner files in favor of an alternative execution-only isolation design.

Fix:
Restore ContextualTool provider visibility, bounded mixed-call repair, transactional retryable legacy migration, downgrade fencing, contextual metadata, and child Goal/Jobs/memory isolation on top of the merged base. Keep the portable Windows archive-read fixture.

Verification:
go test ./... -count=1
go test -race ./internal/control ./internal/agent ./internal/jobs ./internal/tool ./internal/tool/builtin ./internal/memory ./internal/autoresearch -count=1
go vet ./...
golangci-lint run --timeout=5m
cd desktop && go test ./... -count=1
scripts/cache-guard.sh
scripts/check-cache-impact.sh
go run ./tools/repolint
git diff --check

Problem:
The PR head had fallen behind main-v2 and GitHub reported a merge conflict after the Skills settings consistency work landed.

Root cause:
Both branches updated the repository lint baseline while the latest base also changed desktop settings, config loading, and runtime rebuild paths.

Fix:
Merge main-v2 without rewriting history and regenerate the repolint baseline from the semantically combined tree.

Verification:
- go test ./... -count=1
- go test -race ./internal/control ./internal/agent -count=1
- go vet ./...
- golangci-lint run --timeout=5m
- cd desktop && go test ./... -count=1
- cd desktop/frontend && pnpm test:all
- cd desktop/frontend && pnpm build
- scripts/cache-guard.sh
- scripts/check-cache-impact.sh
- go run ./tools/repolint
- git diff --check

Problem
Legacy archive retry identity lived inside the active Goal machine, and the removed AutoResearch readiness reader still carried a second completion contract.

Root cause
Archive failures depended on a Goal-owned task token that was written back into new sidecars and could be mistaken for an active AutoResearch runtime.

Fix
Keep archive identity only in the Controller-owned read-only recovery boundary, fence ordinary Goal resume for legacy failures, omit deprecated sidecar fields, and fold finding compatibility checks into the read-only summary path.

Verification
Focused legacy restore, finding compatibility, control, agent, boot, and autoresearch tests pass; git diff --check passes.

…runtime-fix

# Conflicts:
#	desktop/frontend/src/__tests__/stream-delta-batch.test.ts
#	tools/repolint/baseline.json

Problem: The Goal/runtime fixes added lines and complexity to several files already at their repolint debt ceilings, causing the repository gate to fail after merging the latest baseline.

Root cause: Contextual tool visibility, legacy durability helpers, and their tests were implemented inline in large owner files instead of dedicated modules.

Fix: Extract workflow context, planner registry, subagent identity, Goal durability, Jobs context, CLI Goal handling, and focused tests into scoped files. Keep provider behavior unchanged and add the new schema-bearing files to cache-impact coverage.

Verification: go test ./internal/agent ./internal/boot ./internal/control ./internal/jobs ./internal/tool/builtin -count=1; go run ./tools/repolint; git diff --check

…runtime-fix

Problem: The PR made provider-visible schemas conditional on Goal, Plan, and Jobs context, removing update_goal from ordinary and economy requests and violating the required byte-stable tool contract.

Root cause: A broad contextual-tool mechanism was added while hardening Goal recorder isolation, coupling an execution boundary to provider schema selection.

Fix: Restore static Schemas() requests and the main-v2 tool order, remove contextual schema APIs and phase-specific visibility, and keep only execution-time Goal recorder isolation for planners and child agents. Correct the changelog and cache-impact coverage.

Verification: go test ./internal/agent ./internal/boot ./internal/control ./internal/tool ./internal/tool/builtin -count=1; go run ./tools/repolint; git diff --exit-code origin/main-v2 -- internal/agent/extensions.go internal/agent/run_loop.go internal/agent/sampling_request.go internal/tool/tool.go internal/tool/builtin/bgjobs.go internal/tool/builtin/completestep.go internal/tool/builtin/updategoal.go internal/jobs/jobs.go internal/memory/queue.go; git diff --check

Problem
The Goal-only migration still exposed a stale Desktop AutoResearch mock, retained a removed variadic setup shape, and reopened a legacy archive after it had already been validated.

Root cause
Compatibility cleanup stopped short of the final source-level boundary, and the archive goal loader performed redundant validation after LoadTask had bound and verified the archive snapshot.

Fix
Remove the stale Desktop mock and variadic argument, document the evidence sanitizer as display-only, and use the single validated LoadTask result for legacy goal recovery.

Verification
- go test ./internal/control ./internal/autoresearch ./internal/agent ./internal/taskintent ./internal/boot ./internal/tool -count=1
- go test -race ./internal/control ./internal/agent ./internal/jobs ./internal/tool ./internal/tool/builtin ./internal/memory ./internal/autoresearch -count=1
- go test ./... -count=1
- cd desktop && go test ./... -count=1
- cd desktop/frontend && pnpm typecheck && pnpm test:all && pnpm build
- go vet ./...
- golangci-lint run --timeout=5m
- scripts/cache-guard.sh
- go run ./tools/repolint
- git diff --check