fix: preserve research state at the web budget limit

[ital0]

When research hit its web budget, the Pi adapter disabled every tool, which could produce an invalid empty tools payload. An automatic replay could then discard the partial answer and its gathered evidence. Keep non-web tools available after the first denied web call, steer the running model toward supported findings and disclosed gaps, and prevent exhausted automatic replay while retaining manual Retry.

The logical turn's web budget now owns cached citation metadata, so permitted retries preserve existing source labels. Structured param: "tools" errors remain nonretryable and no longer trigger attachment conversion. Research instructions defer their minimums to explicit exhaustion; the 2/12/30 caps are unchanged, and the skill default version/snapshot is bumped to 7.

Validation:

• Isolated PR: 256 focused tests and 231 agent-core tests pass; bun run check passes (0 lint errors, 397 warnings).
• Isolated frontend seed 2341271006: 4,924 pass, 3 skip; shared/script phase: 266 pass. Randomized full-script runs were not uniformly green: seed 2791290889 reproduces the same two indexedDB is undefined sync-retry failures on both pristine main (913171eb) and this PR. An initial mobile-drawer failure did not recur in its isolated or same-seed full replay. These baseline test-isolation issues are unchanged.
• The combined reviewed tree passed 5,212 frontend/shared tests, 231 agent-core tests, and the full check. Seven deterministic Chromium scenarios passed using the real app/SDK with simulated provider responses, including cached citations, exhausted partial-answer preservation, actual UI manual Retry renewing its budget, and a tools-schema 400 with a generated PDF.

Real-provider validation on the combined reviewed tree used the original project credentials and actual EXA search, with no attestation or encryption bypass:

Model	Five-search prompt: web calls / provider requests	Twelve-controller research: web calls / provider requests
Managed Opus 5	2 / 2	30 / 17
Current confidential DeepSeek V4 Flash	2 / 2	30 / 11

All requests in these latest completed cases returned HTTP 200. Both models synthesized after exhaustion with tools reduced from 8 to 6, without an empty-tools 400. The isolated PR's files match the live-validated file hashes.

Limits: this verifies the scoped regressions, not exhaustive answer quality. An initial DeepSeek answer omitted the requested table; a later run included it, and research still contained unverified warranty estimates. The unchanged 200-source registry cap left some references above 200 unlinked. A previous 28-call DeepSeek attempt was invalidated by unexpected navigation, not proven to be an upstream-only failure; the final isolated run with development HMR disabled completed without manual Retry. User-button Retry is covered by deterministic real-UI testing, not claimed for that successful live run. The known open-SSE Stop failure is explicitly excluded because another PR owns it; no Stop changes are included.

This PR and the streaming-display PR target main independently.

[github-actions]

Semgrep Security Scan

No security issues found.

[github-actions]

Preview environment destroyed 🧹

Stack preview-pr-1265 and its Cloudflare subdomain have been cleaned up.

[github-actions]

PR Metrics

Metric	Value
Lines changed (prod code)	+75 / -30
JS bundle size (gzipped)	🟢 639.9 KB → 640.2 KB (+306 B, +0.0%)
Test coverage	🟢 80.32% → 81.35% (+1.0%)
Performance (preview)	Preview not ready — Render deploy may have timed out
Accessibility	—
Best Practices	—
SEO	—

Updated Sat, 05 Sep 2026 00:11:00 GMT · run #2947

[github-actions]

🔭 thunder-deep-review (advisory)

Reviewed the diff — no issues to report. ✅ Never approves, never requests changes, never gates merge.
_{head: 830b1b35afb9 · mode: deep · deferred 0 item(s) already reported by other bots (best-effort dedup)}