docs: audit Tools and capabilities group against implementation

[ggbdpq]

Summary

Audits the Tools and capabilities group (3 documents) from #3522 against the current implementation (22715e8).

• docs/architecture/mcp-runtime-architecture-draft.zh-CN.md — no drift. Load-bearing contracts resolve as written: tool naming mcp__{serverId}__{toolName} with the 64-char hash-suffix rule (mcp-tools.ts:224), the categoryHint: network_send default (mcp-tools.ts:141), the 30s/60s/15s/600s timeout matrix (packages/mcp/src/index.ts:125-128), the stdio env allowlist with LC_*/XDG_* prefixes (index.ts:2422-2433), and the four package boundaries. Its PermissionEngine mention is the one the tracking issue already verified as correct.
• docs/skill-catalog-policy.md — no drift. All named symbols resolve (selectSkillsForContext, SkillSelectionReport decision values, BUNDLED_SKILL_CATALOG, prepareSkillInvocationMessage, SkillInvocationReceipt, too_many_requests, SkillSearch, blocked_path/read_failed, .maka/skills-state.json v2 with needsReview), and the budget constants match the code exactly (skills-context.ts:50-53).
• docs/web-search-provider-capability.md — one drift fixed: the execution-surfaces table still listed the retired Headless Harbor surface and its MAKA_WEB_SEARCH_ENABLED=true opt-in. That env var was introduced by feat(search): add provider-native web search #2152 (2026-08-05) and removed by refactor: replace Headless with minimal Eval kernel #2605 (2026-08-11) when Headless became the minimal Eval kernel; on the current tree it exists only in this document. The row now records the retirement, and the opt-in rationale is reworded to apply to eval subjects. Everything else verifies (routeWebSearchTools, packages/core/src/model-web-search.ts, providerExecuted replay, the DeepSeek V4 Flash anthropic-compatible rule); web_search_20250305 lives in the conformance/backend test suites as described.

All three documents gained the standard frontmatter block with last_verified; none has a bilingual pair (translation_status: source-only).

Verification

Claim	Command / route	Result
MCP contracts	grep mcp-tools.ts, packages/mcp/src/index.ts	all constants and rules match
Skill budget constants	grep packages/runtime/src/skills-context.ts	18000 / 4_000 / 8_000 / 0.02 exact
Retired Harbor opt-in	git log -S MAKA_WEB_SEARCH_ENABLED / repo-wide grep	introduced #2152, removed #2605; only the doc mentions it today
Web-search symbols	grep across packages/*, apps/*	all resolve
Drift greps	tracking-issue patterns on the three docs	zero unexpected matches
Format / headers	npm run format:check / npm run check:asf-headers	exit 0 / changed files pass

AI use

Prepared with ZCode (GLM-5.3-Flash): read the three documents, traced each checkable claim to code, and drafted the corrections. The commit carries the Generated-by trailer.

Checklist

• One subsystem group only (Tools and capabilities, 3 documents)
• Refs #3522 in the commit message
• last_verified set to the audit date (2026-09-04)
• Docs only, no code changes