chore: prepare platform preview 0.3.5-preview.1

.github/workflows/ci.yml

@@ -63,5 +63,7 @@ jobs:
           NODE_ENV: test
           ELECTRON_RUN_AS_NODE: "1"
       - run: npm run build
+      # Check the fresh trace before any static copying/curation.
+      - run: node scripts/smoke-provider-runtime.mjs
       - run: node scripts/build-server.mjs
       - run: node scripts/smoke-server.mjs --electron

.github/workflows/release.yml

@@ -129,6 +129,8 @@ jobs:
           NODE_ENV: test
           ELECTRON_RUN_AS_NODE: "1"
       - run: npm run build
+      # Check the fresh trace before any static copying/curation.
+      - run: node scripts/smoke-provider-runtime.mjs
       - run: node scripts/build-server.mjs
       - run: node scripts/smoke-server.mjs --electron
       - name: Validate macOS release secrets
@@ -169,6 +171,25 @@ jobs:
       - name: Windows/Linux rehearsal (no publish)
         if: github.event_name == 'workflow_dispatch' && runner.os != 'macOS'
         run: npx electron-builder ${{ matrix.builder_args }} --publish never
+      - name: Initialize packaged providers offline (host and packaged Electron Node)
+        run: |
+          case "$RUNNER_OS" in
+            macOS)
+              app="dist/mac-arm64/LearnHarness.app/Contents"
+              payload="$app/Resources/server/standalone"
+              runtime="$app/MacOS/LearnHarness"
+              ;;
+            Windows)
+              payload="dist/win-unpacked/resources/server/standalone"
+              runtime="dist/win-unpacked/LearnHarness.exe"
+              ;;
+            Linux)
+              payload="dist/linux-unpacked/resources/server/standalone"
+              runtime="dist/linux-unpacked/learnharness"
+              ;;
+          esac
+          node scripts/smoke-provider-runtime.mjs --standalone "$payload"
+          node scripts/smoke-provider-runtime.mjs --standalone "$payload" --runtime "$runtime"
       - name: Exercise packaged demo runtime (own Electron, no system Chrome)
         run: |
           case "$RUNNER_OS" in

components/settings/agent-section.tsx

@@ -131,19 +131,6 @@ export function composeGraphTools(agent: AgentSettings | undefined, on: boolean)
 	return { ...agent, graphTools: { enabled: on } };
 }
 
-/** The research tool runs on the search port — the teacher registry DROPS
- *  it when no engine is live (chat-handler's searchAvailable, the same
- *  /api/search signal the section fetches). Pure — exported for tests.
- *  Teacher-stream flag 2026-09-22: the settings row grays on the SAME
- *  signal, so the row and the actual registry availability can never
- *  disagree. `search === null` (loading/failed) grays NOTHING. */
-export function researchToolUnavailable(
-	toolId: string,
-	search: { available: boolean } | null,
-): boolean {
-	return toolId === "research" && search !== null && !search.available;
-}
-
 /** Compose: one slot's model/thinking override. Empty model = absent
  *  override (Default — falls to the factory pin); empty thinking = the
  *  tier keeps its resolved thinking budget. Per-field independence, same
@@ -792,28 +779,19 @@ export function AgentSection({
 						</SettingsRow>
 					);
 				})()}
-				{TOGGLE_TOOLS.map((id) => {
+				{TOGGLE_TOOLS.map((id) => (
-					// Research needs a live search engine; the row + toggle gray
+					<SettingsRow
-					// on the same signal the registry drops the tool on (see
+						key={id}
-					// researchToolUnavailable). The reason rides as the hint.
+						label={`Tool · ${id}`}
-					const searchDown = researchToolUnavailable(id, search);
+						testid={`tool-row-${id}`}
-					return (
+					>
-						<SettingsRow
+						<Toggle
-							key={id}
+							checked={agent?.tools?.[id] ?? true}
-							label={`Tool · ${id}`}
+							label={`tool ${id}`}
-							hint={searchDown ? search?.reason : undefined}
+							onChange={(on) => onSectionChange(composeTool(agent, id, on))}
-							testid={`tool-row-${id}`}
+						/>
-							dimmed={searchDown}
+					</SettingsRow>
-						>
+				))}
-							<Toggle
-								checked={agent?.tools?.[id] ?? true}
-								disabled={searchDown}
-								label={`tool ${id}`}
-								onChange={(on) => onSectionChange(composeTool(agent, id, on))}
-							/>
-						</SettingsRow>
-					);
-				})}
 				{(() => {
 					const engine = agent?.search?.engine ?? null;
 					const anyKey = engineKeys.tavily === true || engineKeys.brave === true;

next.config.ts

@@ -17,7 +17,8 @@ const nextConfig: NextConfig = {
 	// into the DMG (the packaged app never reads it: the shell passes
 	// LH_AUTH_FILE → userData). Excluded here; build-server.mjs also REFUSES
 	// to package any standalone still containing it. .env* belt-and-braces
-	// the same class (not observed swept, same seam).
+	// the same class. Next also copies loaded bare .env after tracing;
+	// the build-server refusal remains required even with these excludes.
 	//
 	// ⚠ EXCLUDE PATTERNS ARE LOAD-BEARING IN WAYS THE DOCS DON'T DESCRIBE
 	// (empirically established 2026-10-08): adding dir excludes like
@@ -26,8 +27,11 @@ const nextConfig: NextConfig = {
 	// under their dist/ — the traced copy collapsed to a bare package.json
 	// and the packaged server died on ERR_MODULE_NOT_FOUND; openai/
 	// @anthropic-ai — pi-ai's deps — vanished from the trace entirely).
-	// Anchored "./"-prefixed forms behave the same. Only the three entries
+	// Anchored "./"-prefixed forms behave the same. **/data/**/* fixes
-	// below are verified safe (complete externals trace + clean payload).
+	// suffix matching in Next's JavaScript collector, but NOT its native
+	// Turbopack tracer: that still prunes gcp-metadata and its private deps.
+	// Keep the narrow closure workaround below AND the native runtime gate.
+	// Real SDK data/ directories still need their explicit includes too.
 	// The recursive-DMG payload (repo dist/ swept into the bundle, shipping
 	// the previous build inside the next) is instead prevented by the
 	// desktop:dist clean step AND targeted post-trace curation in
@@ -37,7 +41,7 @@ const nextConfig: NextConfig = {
 	// stay intact, and the script guards against leaked data/keys.
 	outputFileTracingExcludes: {
 		"*": [
-			"data/**/*",
+			"**/data/**/*",
 			"auth.json",
 			".env*",
 		],
@@ -71,6 +75,14 @@ const nextConfig: NextConfig = {
 			"node_modules/@resvg/resvg-js-*/**/*",
 			"node_modules/@earendil-works/pi-ai/dist/providers/data/**/*",
 			"node_modules/@earendil-works/pi-agent-core/dist/**/*.json",
+			// Next 16.3.2 native Turbopack applies unanchored excludes while
+			// traversing modules; **/data/**/* still prunes gcp-metadata and
+			// its private runtime chain. Includes are applied after traversal.
+			// This is the verified GoogleAuth closure, not a general dep copy;
+			// the offline native Pi gate must catch future SDK closure changes.
+			"node_modules/gcp-metadata/**/*",
+			"node_modules/json-bigint/**/*",
+			"node_modules/bignumber.js/**/*",
 		],
 	},
 	// Framework-free core lives in src/ (plain TS, imported by routes and CLI alike).

package-lock.json

@@ -1,12 +1,12 @@
 {
 	"name": "learnharness",
-	"version": "0.3.4",
+	"version": "0.3.5-preview.1",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "learnharness",
-			"version": "0.3.4",
+			"version": "0.3.5-preview.1",
 			"license": "AGPL-3.0-only",
 			"dependencies": {
 				"@earendil-works/pi-agent-core": "1.4.0",

package.json

@@ -1,6 +1,6 @@
 {
 	"name": "learnharness",
-	"version": "0.3.4",
+	"version": "0.3.5-preview.1",
 	"license": "AGPL-3.0-only",
 	"author": {
 		"name": "Amos Blomqvist",
@@ -21,7 +21,7 @@
 		"typecheck": "tsc --noEmit",
 		"desktop:dev": "concurrently -k \"next dev\" \"LH_DEV_URL=http://localhost:3000 electron .\"",
 		"dev:fresh": "bash scripts/dev-fresh.sh",
-		"desktop:dist": "rm -rf dist .next/standalone && next build && node scripts/build-server.mjs && node scripts/smoke-server.mjs && DEVELOPER_DIR=${DEVELOPER_DIR:-/Applications/Xcode.app/Contents/Developer} APPLE_KEYCHAIN_PROFILE=LH_NOTARY APPLE_TEAM_ID=JS6XN22HY6 electron-builder --mac --arm64"
+		"desktop:dist": "rm -rf dist .next/standalone && next build && node scripts/smoke-provider-runtime.mjs && node scripts/build-server.mjs && node scripts/smoke-server.mjs && DEVELOPER_DIR=${DEVELOPER_DIR:-/Applications/Xcode.app/Contents/Developer} APPLE_KEYCHAIN_PROFILE=LH_NOTARY APPLE_TEAM_ID=JS6XN22HY6 electron-builder --mac --arm64"
 	},
 	"dependencies": {
 		"@earendil-works/pi-agent-core": "1.4.0",

scripts/smoke-provider-runtime.mjs

@@ -0,0 +1,130 @@
+/**
+ * OFFLINE native Pi Google initialization gate (no generation or provider calls).
+ * Unlike /api/models, this traverses Pi's lazy adapter and constructs GoogleGenAI.
+ * The real onPayload hook throws a unique sentinel BEFORE generateContentStream.
+ * All file modules must resolve inside the payload, including nested dependencies.
+ *
+ * node scripts/smoke-provider-runtime.mjs [--standalone <dir>] [--runtime <Node/Electron>]
+ */
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+import { createRequire, registerHooks, syncBuiltinESMExports } from "node:module";
+import * as os from "node:os";
+import * as path from "node:path";
+import { randomUUID } from "node:crypto";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { formatProbeError, probeEnv } from "./smoke-demo-runtime.mjs";
+
+export function verifyProviderRuntime(standalone, runtime = process.execPath) {
+	const home = fs.mkdtempSync(path.join(os.tmpdir(), "lh-provider-runtime-"));
+	try {
+		fs.writeFileSync(path.join(home, "auth.json"), "{}\n", { mode: 0o600 });
+		const result = spawnSync(runtime, [fileURLToPath(import.meta.url), "--probe", path.resolve(standalone)], {
+			cwd: home,
+			env: { ...probeEnv(process.env, home), ELECTRON_RUN_AS_NODE: "1" },
+			encoding: "utf8", timeout: 30_000, maxBuffer: 128 * 1024,
+		});
+		if (result.status !== 0 || result.error) {
+			throw new Error(`provider runtime probe failed (${result.error?.message ?? result.status}):\n${result.stdout ?? ""}${result.stderr ?? ""}`);
+		}
+		assert.match(result.stdout, /native Pi Google initialization passed/, "probe exited without success marker");
+		process.stdout.write(result.stdout);
+	} finally { fs.rmSync(home, { recursive: true, force: true }); }
+}
+
+// Dedicated child only: nothing delegates to a live transport, even if the SDK
+// changes its fetch path. Count attempts as well: a swallowed guard error fails.
+function closeNetwork() {
+	let attempts = 0;
+	const deny = () => { attempts++; throw new Error("OFFLINE provider gate: network forbidden"); };
+	globalThis.fetch = deny;
+	globalThis.WebSocket = class { constructor() { deny(); } };
+	const require = createRequire(import.meta.url);
+	for (const [name, methods] of [
+		["http", ["request", "get"]], ["https", ["request", "get"]],
+		["net", ["connect", "createConnection"]], ["tls", ["connect"]],
+		["dgram", ["createSocket"]],
+		["dns", ["lookup", "resolve", "resolve4", "resolve6", "resolveAny", "reverse"]],
+		["dns/promises", ["lookup", "resolve", "resolve4", "resolve6", "resolveAny", "reverse"]],
+	]) {
+		const module = require(`node:${name}`);
+		for (const method of methods) module[method] = deny;
+	}
+	require("node:net").Socket.prototype.connect = deny;
+	syncBuiltinESMExports();
+	return () => assert.equal(attempts, 0, "SDK attempted network access");
+}
+
+async function probe(standalone) {
+	const noNetwork = closeNetwork();
+	const root = fs.realpathSync(standalone);
+	const inside = (file) => {
+		const relative = path.relative(root, fs.realpathSync(file));
+		assert.ok(relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative),
+			`dependency escaped standalone payload: ${file}`);
+	};
+	const loaded = new Set();
+	const hooks = registerHooks({
+		resolve(specifier, context, nextResolve) {
+			const result = nextResolve(specifier, context);
+			if (result.url.startsWith("file:")) {
+				inside(fileURLToPath(result.url));
+				loaded.add(fileURLToPath(result.url));
+			} else assert.ok(result.url.startsWith("node:"), `unexpected dependency URL: ${result.url}`);
+			return result;
+		},
+	});
+	try {
+		// Pi is an explicit server external. Import its shipped public entry and
+		// factories, never the checkout's module or a direct/fake Google adapter.
+		const entry = pathToFileURL(path.join(root, "node_modules/@earendil-works/pi-ai/dist/index.js"));
+		const { createModels } = await import(entry.href);
+		const models = createModels();
+		for (const [name, factory] of [["google", "googleProvider"], ["opencode", "opencodeProvider"], ["opencode-go", "opencodeGoProvider"]]) {
+			const provider = (await import(new URL(`providers/${name}.js`, entry).href))[factory]();
+			models.setProvider(provider);
+			const model = provider.getModels().find((candidate) => candidate.api === "google-generative-ai");
+			assert.ok(model, `${name}: missing Google-backed catalog model`);
+			const sentinel = `LH_OFFLINE_ON_PAYLOAD_${randomUUID()}`;
+			let reached = 0;
+			const result = await models.streamSimple(model, { messages: [{ role: "user", content: "Offline initialization only", timestamp: 0 }] }, {
+				apiKey: "dummy-offline-provider-gate-not-a-key",
+				onPayload(payload, selected) {
+					assert.equal(selected.api, "google-generative-ai");
+					assert.ok(payload && typeof payload === "object");
+					reached++;
+					throw new Error(sentinel);
+				},
+			}).result();
+			assert.equal(reached, 1, `${name}: did not reach onPayload: ${result.errorMessage}`);
+			assert.equal(result.stopReason, "error");
+			assert.equal(result.errorMessage, sentinel, `${name}: unexpected initialization error`);
+			noNetwork();
+			console.log(`[smoke-provider-runtime] ${name}: native lazy Google adapter reached onPayload; generation stopped`);
+		}
+		// Resolution/evaluation, not folder-exists checks. This also covers the
+		// previously missing transitive edge and permits legitimate nested deps.
+		for (const name of ["@google/genai", "google-auth-library", "gcp-metadata", "json-bigint", "bignumber.js"]) {
+			assert.ok([...loaded].some((file) => file.includes(`${path.sep}node_modules${path.sep}${name.replaceAll("/", path.sep)}${path.sep}`)),
+				`Google runtime chain was not loaded: ${name}`);
+		}
+		console.log(`[smoke-provider-runtime] native Pi Google initialization passed; ${loaded.size} modules confined to ${root}; zero network attempts`);
+	} finally { hooks.deregister(); }
+}
+
+async function main() {
+	const args = process.argv.slice(2);
+	if (args[0] === "--probe") return probe(args[1]);
+	const value = (name, fallback) => {
+		const index = args.indexOf(name);
+		if (index < 0) return fallback;
+		assert.ok(args[index + 1] && !args[index + 1].startsWith("--"), `${name} requires a path`);
+		return path.resolve(args[index + 1]);
+	};
+	verifyProviderRuntime(value("--standalone", path.resolve(import.meta.dirname, "../.next/standalone")), value("--runtime", process.execPath));
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+	main().catch((error) => { console.error(`[smoke-provider-runtime] FAIL: ${formatProbeError(error)}`); process.exitCode = 1; });
+}

scripts/smoke-server.mjs

@@ -26,6 +26,7 @@
  */
 import { spawn } from "node:child_process";
 import { probeEnv, verifyDemoRuntime } from "./smoke-demo-runtime.mjs";
+import { verifyProviderRuntime } from "./smoke-provider-runtime.mjs";
 import { createRequire } from "node:module";
 import * as fs from "node:fs";
 import * as http from "node:http";
@@ -80,6 +81,8 @@ async function main() {
 	// HTTP boot alone never imports the dynamically loaded demo engine.
 	// Fail before packaging if its standalone dependency graph is incomplete.
 	verifyDemoRuntime(STANDALONE, RUNTIME);
+	// /api/models only reads catalogs; initialize the real lazy SDK offline too.
+	verifyProviderRuntime(STANDALONE, RUNTIME);
 	const port = await freePort();
 	const url = `http://127.0.0.1:${port}`;
 	const home = fs.mkdtempSync(path.join(os.tmpdir(), "lh-smoke-"));

src/agent/subagents/researcher.ts

@@ -49,6 +49,8 @@ Tool outputs may be error strings (e.g. search unconfigured, a page that failed
 Adapt: try another URL or another search angle; if research is genuinely impossible, say so
 in the brief instead of inventing facts.
 
+If web_search reports that search is unavailable because credentials are missing, do not retry it with different queries. Use web_fetch when you have source URLs, and continue with any other available sources. If the missing search capability materially limits your work, state the limitation and the missing-key setup needed in your brief. Never invent search results or sources.
+
 Your FINAL assistant message is your entire deliverable — it must stand alone, using this format:
 
 ## Summary
@@ -70,8 +72,7 @@ export interface ResearcherRunOptions {
 	/** The search seam (search port wave, 2026-09-20): resolves the LIVE
 	 *  provider per call, null = honestly unavailable (the web_search tool
 	 *  reports that in its output — no crash, no silent fallback). Absent
-	 *  seam reads as unavailable: the server wiring always injects one; the
+	 *  seam reads as unavailable; web_fetch remains usable without it. */
-	 *  dispatch-level drop (jobTools) keeps doomed jobs from even starting. */
 	search?: () => SearchProvider | null;
 	/** The researcher's PDF dir (PDF wave, 2026-10-07): when present, the
 	 *  toolset gains web_fetch_pdf + pdf_info/pdf_extract/pdf_search scoped

src/agent/subagents/runner.ts

@@ -82,9 +82,8 @@ export interface JobRunnerDeps {
 	/** The search seam (search port wave, 2026-09-20): resolves the LIVE
 	 *  provider fresh per job — server/search.ts composition injected by
 	 *  the wiring; null = honestly unavailable (the researcher's web_search
-	 *  reports it). Absent seam (tests) reads the same. The dispatch-level
+	 *  reports it as recoverable text). Absent seam (tests) reads the same;
-	 *  drop (jobTools' searchAvailable) uses the same signal — jobs already
+	 *  research dispatch and web_fetch do not require search credentials. */
-	 *  in flight when a key disappears still fail honestly, never crash. */
 	searchProvider?: () => SearchProvider | null;
 	/** Key-presence gate (provider-key interlude, 2026-09-25): given the
 	 *  resolved engine's provider + the kind's slot tier, return the

src/agent/tools.ts

@@ -268,8 +268,7 @@ export interface ProberToolContext extends ProbeDoneContext {
 	jobStore: JobStore;
 	/** Fire the background runner for a freshly created job. */
 	spawn: (job: JobRecord, input: ResearchInput | DemoInput | VisualInput | PdfInput) => void;
-	/** Search availability — the research dispatch tool's honest-disable
+	/** Retained search-status seam; research dispatch is available keylessly. */
-	 *  signal (same gate as the teacher's). Absent = available. */
 	searchAvailable?: () => boolean;
 	/** The prober's graph-map reader (wave 7): present = the two map tools
 	 *  (list_sessions / list_propositions) are registered. The composition
@@ -331,13 +330,12 @@ export function createProberTools(
 				// research + pdf are ALWAYS available in every phase — the
 				// prober can verify facts or read learner PDFs while assessing.
 				// demo/visual stay teach-phase-only (they need the lesson's plan
-				// context). Same gating as the teacher: toggle-filtered here,
+				// context). Same user-toggle filtering as the teacher; research
-				// research subject to the searchAvailable gate (honestly absent
+				// remains available without a search-provider key.
-				// when no engine is live).
 				...(jobs.research ? { research: jobs.research } : {}),
 				pdf: jobs.pdf!,
 				// The map reader (wave 7): present only when the settings gate
-				// opened — same registration-time drop as the search gate.
+				// opened.
 				...(ctx.graphStore
 					? proberGraphTools({ chatStore: ctx.chatStore, graphStore: ctx.graphStore })
 					: {}),
@@ -400,9 +398,7 @@ export interface TeacherToolContext extends PlanToolContext {
 	 *  rides along — the spawn fires mid-stream, before the tool part is
 	 *  persisted to the transcript (a transcript scan would race it). */
 	spawn: (job: JobRecord, input: ResearchInput | DemoInput | VisualInput | PdfInput) => void;
-	/** Search availability (search port wave, 2026-09-20): the research
+	/** Retained search-status seam; research dispatch is available keylessly. */
-	 *  dispatch tool's honest-disable signal — no live engine = the tool
-	 *  drops from this registry (JobToolContext.searchAvailable). */
 	searchAvailable?: () => boolean;
 }
 
@@ -462,10 +458,6 @@ export function createTeacherTools(
 			find: findTool,
 			grep: grepTool,
 			...planTools(ctx),
-			// Fix wave (2026-09-20): searchAvailable was RECEIVED here but
-			// DROPPED when building the inner JobToolContext — the drop-gate
-			// always took its ?? true default. Threaded now: the live signal
-			// reaches jobTools' research gate.
 			...jobTools({ chatId: ctx.chatId, jobStore: ctx.jobStore, spawn: ctx.spawn, searchAvailable: ctx.searchAvailable }),
 		},
 		withoutMechanics(enabled),

src/agent/tools/jobs.ts

@@ -23,11 +23,9 @@ export interface JobToolContext {
 	 *  input rides along because the spawn happens MID-STREAM, before
 	 *  onFinish persists the tool part — a transcript scan would race it. */
 	spawn: (job: JobRecord, input: ResearchInput | DemoInput | VisualInput | PdfInput) => void;
-	/** Search availability (search port wave, 2026-09-20): the honest
+	/** Search-provider availability, retained for existing composition seams.
-	 *  disable signal for the research dispatch tool — no live engine
+	 *  Research dispatch does not depend on it: web_fetch is keyless and
-	 *  means NO research tool in the registry (owner decision: registry-
+	 *  web_search reports a missing provider as a recoverable tool result. */
-	 *  level drop, no doomed dispatch, no silent fallback). Absent =
-	 *  available (tests + any seam without search wiring). */
 	searchAvailable?: () => boolean;
 }
 
@@ -127,25 +125,20 @@ const PDF_DESCRIPTION =
  * context (chatId + jobStore + the spawn seam), so concurrent chats never
  * share state. chat-handler wires it each turn; tests wire their own.
  *
- * The research tool drops from the registry when ctx.searchAvailable reports
+ * Research remains available without a search-provider key; the role's
- * no live engine (2026-09-20) — the teacher never sees it, so a keyless
+ * existing user-toggle filtering still applies outside this registry.
- * server can't dispatch doomed research jobs. Jobs ALREADY in flight when
- * a key disappears still run to their honest failure (runner backstop).
  */
 export function jobTools(ctx: JobToolContext): Record<string, AgentTool<any>> {
-	const searchOn = ctx.searchAvailable?.() ?? true;
 	return {
-		...(searchOn && {
+		research: {
-			research: {
+			name: "research",
-				name: "research",
+			label: "research",
-				label: "research",
+			description: RESEARCH_DESCRIPTION,
-				description: RESEARCH_DESCRIPTION,
+			parameters: researchInputSchema,
-				parameters: researchInputSchema,
+			execute: serverExecute("research", researchInputSchema, (input, { toolCallId }) =>
-				execute: serverExecute("research", researchInputSchema, (input, { toolCallId }) =>
+				dispatch(ctx, "research", toolCallId, RESEARCH_ACK, input),
-					dispatch(ctx, "research", toolCallId, RESEARCH_ACK, input),
+			),
-				),
+		},
-			},
-		}),
 		demo: {
 			name: "demo",
 			label: "demo",

src/agent/tools/practice.ts

@@ -40,8 +40,8 @@ export interface PracticeToolContext {
 	graphNodes?: () => ReadonlyArray<Pick<import("../../core/contracts/graph.ts").GraphNode, "id" | "name">>;
 	/** THE RARELY-NEEDED SET (owner round 10, 2026-10-05): the map readers
 	 *  behind the SAME settings gate as the prober's (graphToolsEnabled at
-	 *  the composition root); the research + pdf jobs with the honest
+	 *  the composition root); the research + pdf jobs (both keyless).
-	 *  searchAvailable drop. Each absent (tests) = absent from the registry. */
+	 *  Each absent context (tests) = absent from the registry. */
 	graph?: GraphToolContext;
 	jobs?: JobToolContext;
 }
@@ -225,8 +225,8 @@ export function practiceTools(ctx: PracticeToolContext): Record<string, AgentToo
 	const gate = createPracticeGate(ctx);
 	// THE RARELY-NEEDED SET (owner round 10): read/ls/find/grep over the
 	// learner's files (always — the same read-only set the teacher and
-	// prober carry), the research + pdf jobs (research honestly absent
+	// prober carry), the research + pdf jobs (available without search
-	// when no search engine is live; demo/visual stay teach-only), and
+	// keys; demo/visual stay teach-only), and
 	// the prober's map readers when the settings gate opened. None are
 	// toggle-filtered: problem/conclude are the session; these are
 	// exceptions the doctrine says to reach for rarely.

tests/jobs.test.ts

@@ -610,6 +610,43 @@ describe("research runner (async protocol §3)", () => {
 		assert.deepEqual(search.queries, ["sigma.js latest version (5)"]);
 	});
 
+	it("a keyless fetch-only researcher still completes and delivers a sourced job result", async () => {
+		const url = "https://example.com/supplied-source";
+		const brief = `## Summary\nVerified supplied source. [Source](${url})\n\n## Sources\n- Source (${url})`;
+		const input = { question: `Verify ${url}` };
+		const chat = chatStore.createChat("Test: keyless fetch-only research");
+		trackChat(chat.id);
+		chatStore.saveMessages(chat.id, nativeToolMessages("verify supplied URL", "research", "call-keyless", input));
+		const job = jobStore.createJob({ kind: "research", chatId: chat.id, toolCallId: "call-keyless" });
+		trackJob(job.id);
+		const delivery = fakeDeliver();
+		const runner = createJobRunner({ chatStore, jobStore, deliver: delivery.deliver, searchProvider: () => null });
+		const fetched: string[] = [];
+		const realFetch = globalThis.fetch;
+		globalThis.fetch = (async (source) => {
+			fetched.push(String(source));
+			assert.equal(String(source), url);
+			return new Response("Synthetic verified source content", { headers: { "content-type": "text/plain" } });
+		}) as typeof fetch;
+		researchModelOverride.current = fauxEngine([
+			fauxAssistantMessage([fauxToolCall("web_fetch", { url }, { id: "keyless-fetch" })], { stopReason: "toolUse" }),
+			fauxAssistantMessage([fauxText(brief)]),
+		]);
+		try {
+			await runner.runJob(job.id);
+		} finally {
+			researchModelOverride.current = undefined;
+			globalThis.fetch = realFetch;
+		}
+		assert.deepEqual(fetched, [url]);
+		const done = jobStore.getJob(job.id)!;
+		assert.equal(done.status, "done");
+		assert.equal((done.result as ResearchResult).brief, brief);
+		assert.ok((done.result as ResearchResult).sources.some((s) => s.url === url));
+		assert.equal(delivery.steers.length, 1);
+		assert.equal(isSubagentFailure("research", done.result as ResearchResult), false);
+	});
+
 	it("a failing runner still steers (the teacher learns the outcome) and the job lands error", async () => {
 		const chat = chatStore.createChat("Test: runner failure");
 		trackChat(chat.id);

tests/practice-agents.test.ts

@@ -208,14 +208,15 @@ describe("the practice agent", () => {
 		const jobs = { chatId: "c1", jobStore: null as never, spawn: (() => {}) as never, searchAvailable: () => false };
 		const graph = { chatStore: null as never, graphStore: null as never };
 		const tools = practiceTools({ ...ctxOf([]), jobs, graph });
-		// research honestly absent (no search engine live); pdf always; the
+		// Both jobs remain available keylessly; the prober's two map
-		// prober's two map readers behind the settings gate.
+		// readers stay behind their existing settings gate. Practice does
+		// not apply the teacher/prober user tool-toggle filter.
 		assert.deepEqual(
 			Object.keys(tools).sort(),
-			["conclude", "find", "grep", "list_propositions", "list_sessions", "ls", "pdf", "problem", "read"],
+			["conclude", "find", "grep", "list_propositions", "list_sessions", "ls", "pdf", "problem", "read", "research"],
 		);
 		const withSearch = practiceTools({ ...ctxOf([]), jobs: { ...jobs, searchAvailable: () => true }, graph });
-		assert.ok(withSearch.research, "a live engine adds research");
+		assert.ok(withSearch.research, "a live engine also keeps research");
 	});
 
 	it("constructs with exactly the two practice tools", () => {

tests/provider-runtime-payload.test.ts

@@ -0,0 +1,42 @@
+/** Real installed Pi/Google SDK only; no provider stubs, keys, or generation. */
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { describe, it } from "node:test";
+import { fileURLToPath } from "node:url";
+
+const script = fileURLToPath(new URL("../scripts/smoke-provider-runtime.mjs", import.meta.url));
+const checkout = fileURLToPath(new URL("..", import.meta.url));
+const run = (payload: string) => spawnSync(process.execPath, [script, "--standalone", payload], { encoding: "utf8", timeout: 40_000 });
+
+describe("offline native Pi Google initialization gate", () => {
+	it("reaches the sentinel for direct Google and Google-backed OpenCode adapters using the real SDK", () => {
+		// This is an unbundled positive control, NOT proof of standalone completeness.
+		const result = run(checkout);
+		assert.equal(result.status, 0, String(result.stderr));
+		for (const provider of ["google", "opencode", "opencode-go"]) assert.ok(String(result.stdout).includes(`${provider}: native lazy Google adapter reached onPayload`));
+		assert.match(String(result.stdout), /zero network attempts/);
+	});
+	it("rejects a missing Pi entry instead of treating any error as success", () => {
+		const root = fs.mkdtempSync(path.join(os.tmpdir(), "lh-provider-missing-"));
+		try {
+			const result = run(root);
+			assert.equal(result.status, 1);
+			assert.doesNotMatch(String(result.stdout), /initialization passed/);
+			assert.match(String(result.stderr), /MODULE_NOT_FOUND|ENOENT/);
+			assert.deepEqual(fs.readdirSync(root), [], "gate modified the payload");
+		} finally { fs.rmSync(root, { recursive: true, force: true }); }
+	});
+	it("rejects an otherwise complete SDK outside the payload (no host fallback)", () => {
+		const root = fs.mkdtempSync(path.join(os.tmpdir(), "lh-provider-escape-"));
+		try {
+			fs.symlinkSync(path.join(checkout, "node_modules"), path.join(root, "node_modules"), process.platform === "win32" ? "junction" : "dir");
+			const result = run(root);
+			assert.equal(result.status, 1);
+			assert.match(String(result.stderr), /dependency escaped standalone payload/);
+			assert.doesNotMatch(String(result.stdout), /initialization passed/);
+		} finally { fs.rmSync(root, { recursive: true, force: true }); }
+	});
+});

tests/provider-tracing.test.ts

@@ -0,0 +1,62 @@
+/** JS matcher + config-policy regressions; native Turbopack needs the real payload gate. */
+import assert from "node:assert/strict";
+import { createRequire } from "node:module";
+import { describe, it } from "node:test";
+import nextConfig from "../next.config.ts";
+
+const require = createRequire(import.meta.url);
+// Use Next's actual bundled matcher, not a different glob implementation.
+const picomatch = require("next/dist/compiled/picomatch");
+const { makeIgnoreFn } = require("next/dist/build/collect-build-traces");
+const patterns = nextConfig.outputFileTracingExcludes!["*"];
+
+describe("standalone JavaScript tracing exclusions and native workaround policy", () => {
+	for (const windows of [false, true]) {
+		const root = windows ? "C:\\build\\learnharness" : "/build/learnharness";
+		const file = (relative: string) => root + (windows ? "\\" : "/") + (windows ? relative.replaceAll("/", "\\") : relative);
+		const ignored = picomatch(patterns, { contains: true, dot: true, windows });
+		it(`excludes genuine data directories and secrets (${windows ? "Windows" : "POSIX"})`, () => {
+			for (const relative of ["data/canary.json", "nested/data/private.json", "auth.json", ".env", ".env.local"]) {
+				assert.equal(ignored(file(relative)), true, relative);
+			}
+			// The explicit includes remain necessary: this raw ignore still matches SDK data.
+			assert.equal(ignored(file("node_modules/@earendil-works/pi-ai/dist/providers/data/models.json")), true);
+			assert.ok(nextConfig.outputFileTracingIncludes!["*"]!.includes("node_modules/@earendil-works/pi-ai/dist/providers/data/**/*"));
+		});
+		it(`does not confuse dependency suffixes with data directories (${windows ? "Windows" : "POSIX"})`, () => {
+			for (const relative of ["node_modules/gcp-metadata/build/src/index.js", "node_modules/form-data/lib/form_data.js", "node_modules/@swc/helpers/_/_ts_metadata.js", "node_modules/@swc/helpers/_/_ts_metadata/index.js", "node_modules/somedata/runtime.js"]) {
+				assert.equal(ignored(file(relative)), false, relative);
+				assert.equal(picomatch("data/**/*", { contains: true, dot: true, windows })(file("node_modules/gcp-metadata/build/src/index.js")), true, "old pattern must reproduce the bug");
+			}
+		});
+	}
+	it("uses the installed Next JavaScript early-ignore function on the host platform", () => {
+		const root = process.cwd();
+		const ignore = makeIgnoreFn(root, patterns);
+		assert.equal(ignore(`${root}/data/private.json`), true);
+		assert.equal(ignore(`${root}/node_modules/gcp-metadata/build/src/index.js`), false);
+	});
+	it("preserves all secret exclusions exactly", () => {
+		assert.deepEqual(patterns, ["**/data/**/*", "auth.json", ".env*"]);
+	});
+	it("retains exactly the narrow native-Turbopack closure workaround and existing runtime includes", () => {
+		assert.deepEqual(nextConfig.outputFileTracingIncludes!["*"], [
+			"node_modules/@puppeteer/browsers/lib/browser-data/**/*.js",
+			"node_modules/pdfjs-dist/legacy/**/*",
+			"node_modules/pdfjs-dist/standard_fonts/**/*",
+			"node_modules/@napi-rs/canvas-*/**/*",
+			"node_modules/@resvg/resvg-js-*/**/*",
+			"node_modules/@earendil-works/pi-ai/dist/providers/data/**/*",
+			"node_modules/@earendil-works/pi-agent-core/dist/**/*.json",
+			"node_modules/gcp-metadata/**/*",
+			"node_modules/json-bigint/**/*",
+			"node_modules/bignumber.js/**/*",
+		]);
+	});
+	it("limits the workaround to its three packages, never learner data or unrelated dependencies", () => {
+		const closure = nextConfig.outputFileTracingIncludes!["*"]!.slice(-3);
+		const included = picomatch(closure, { dot: true });
+		for (const file of ["node_modules/gcp-metadata/build/src/index.js", "node_modules/json-bigint/lib/parse.js", "node_modules/bignumber.js/bignumber.js"]) assert.equal(included(file), true, file);
+		for (const file of ["data/private.json", "nested/data/private.json", "auth.json", ".env.local", "node_modules/unrelated/runtime.js", "node_modules/gcp-metadata-lookalike/index.js"]) assert.equal(included(file), false, file);
+	});
+});

tests/research-settings.test.tsx

@@ -0,0 +1,70 @@
+import React, { act } from "react";
+(globalThis as Record<string, unknown>).React = React;
+import assert from "node:assert/strict";
+import { it } from "node:test";
+import { parseHTML } from "linkedom";
+import { AgentSection } from "../components/settings/agent-section.tsx";
+import type { AgentSettings } from "../src/core/index.ts";
+
+it("keyless settings keep Research interactive while search-engine setup retains its own disabled state", async () => {
+	const dom = parseHTML("<html><body><div id='root'></div></body></html>");
+	const globals = globalThis as Record<string, unknown>;
+	const previous = new Map<string, PropertyDescriptor | undefined>();
+	const reason = "No search engine is configured.";
+	const bodies: Record<string, unknown> = {
+		"/api/search": { available: false, engine: null, reason },
+		"/api/keys": { keys: [{ id: "TAVILY_API_KEY", present: false }, { id: "BRAVE_API_KEY", present: false }] },
+		"/api/models": { models: [], slots: { strong: null, cheap: null, vision: null } },
+		"/api/settings/prompts": { prober: [], teacher: [] },
+	};
+	for (const [key, value] of Object.entries({
+		window: dom.window,
+		document: dom.document,
+		navigator: globals.navigator ?? { userAgent: "", platform: "" },
+		HTMLElement: dom.window.HTMLElement,
+		IS_REACT_ACT_ENVIRONMENT: true,
+		fetch: async (url: string) => {
+			assert.ok(url in bodies, `unexpected request: ${url}`);
+			return new Response(JSON.stringify(bodies[url]));
+		},
+	})) {
+		previous.set(key, Object.getOwnPropertyDescriptor(globalThis, key));
+		Object.defineProperty(globalThis, key, { configurable: true, writable: true, value });
+	}
+	const { createRoot } = await import("react-dom/client");
+	const root = createRoot(document.getElementById("root")!);
+	let written: AgentSettings | undefined;
+	try {
+		await act(async () => {
+			root.render(<AgentSection
+				agent={{ tools: { research: true } }}
+				models={undefined}
+				graph={undefined}
+				compaction={undefined}
+				onSectionChange={(next) => { written = next; }}
+				onModelsChange={() => {}}
+				onCompactionChange={() => {}}
+			/>);
+		});
+		const row = document.querySelector<HTMLElement>('[data-testid="tool-row-research"]')!;
+		const toggle = row.querySelector<HTMLButtonElement>('[data-testid="toggle-tool-research"]')!;
+		assert.ok(toggle);
+		assert.equal(toggle.hasAttribute("disabled"), false);
+		assert.equal(toggle.getAttribute("aria-checked"), "true");
+		assert.ok(!row.className.includes("opacity-40"));
+		assert.ok(!row.textContent?.includes(reason), "search setup hint is no longer a research-disable hint");
+		act(() => { toggle.click(); });
+		assert.equal(written?.tools?.research, false, "the keyless toggle emits the same stored boolean");
+		const engine = document.querySelector<HTMLButtonElement>('[data-testid="search-engine-trigger"]')!;
+		assert.ok(engine.className.includes("cursor-not-allowed"), "search engine preference retains its own key gate");
+		act(() => { engine.click(); });
+		assert.equal(document.querySelector('[data-testid="search-engine-menu"]'), null, "keyless engine preference does not open");
+		assert.ok(document.querySelector('[data-testid="search-engine-row"]')?.textContent?.includes(reason));
+	} finally {
+		act(() => { root.unmount(); });
+		for (const [key, descriptor] of previous) {
+			if (descriptor) Object.defineProperty(globalThis, key, descriptor);
+			else delete globals[key];
+		}
+	}
+});

tests/settings-pure.test.ts

@@ -15,7 +15,6 @@ import {
 	composeSlotModel,
 	composeTool,
 	composeQuizMechanics,
-	researchToolUnavailable,
 	sectionedSegments,
 } from "../components/settings/agent-section.tsx";
 import { nextOverrides } from "../components/settings/keyboard-section.tsx";
@@ -328,21 +327,6 @@ describe("first-run gate — slotsConfigured + setupStage (model-slots wave)", (
 	});
 });
 
-describe("researchToolUnavailable — the row grays on the registry's own signal", () => {
-	it("research grays exactly when the live search status says unavailable", () => {
-		// the SAME /api/search signal chat-handler's searchAvailable uses —
-		// the row and the registry can never disagree (Teacher flag 2026-09-22)
-		assert.equal(researchToolUnavailable("research", { available: false }), true);
-		assert.equal(researchToolUnavailable("research", { available: true }), false);
-		// loading/failed fetch grays nothing (never a false-negative row)
-		assert.equal(researchToolUnavailable("research", null), false);
-		// only research — the other tools never touch the search port
-		for (const id of ["demo", "visual", "pdf"]) {
-			assert.equal(researchToolUnavailable(id, { available: false }), false);
-		}
-	});
-});
-
 describe("sectionedSegments — the prompts overhaul (2026-09-26)", () => {
 	// The server contract: BOTH per-agent lists include the shared
 	// segments (same paths) — the view must list them ONCE.

tests/web-search.test.ts

@@ -1,20 +1,14 @@
-/**
+/** Keyless research availability + the injected search port.
- * Search rewiring (search port wave, 2026-09-20) — the web_search tool's
- * port injection + the research dispatch tool's registry-level drop.
- *
- * Google CSE is dead: the tool runs on the injected search port
- * (core/search.ts), the runner threads the seam (searchProvider — covered
- * end-to-end in jobs.test.ts), and jobTools drops the research tool when
- * ctx.searchAvailable reports no live engine (owner decision: registry
- * drop, no doomed dispatch, no silent fallback).
- *
  * No network, no shared data files — the jobStore fake below is in-memory.
+ * A missing search key is a recoverable tool result, not a dispatch gate.
  */
 
 import assert from "node:assert/strict";
 import { describe, it } from "node:test";
 import { createWebTools } from "../src/agent/tools/web.ts";
 import { jobTools } from "../src/agent/tools/jobs.ts";
+import { runResearcherAgent } from "../src/agent/subagents/researcher.ts";
+import { createFauxCore, fauxAssistantMessage, fauxText, fauxToolCall, type FauxResponseStep } from "@earendil-works/pi-ai";
 import type { JobStore } from "../src/core/ports.ts";
 import type { JobRecord } from "../src/core/contracts.ts";
 import type { SearchHit, SearchProvider } from "../src/core/search.ts";
@@ -31,9 +25,13 @@ function stubProvider(hits: SearchHit[] = [{ title: "t", url: "https://e.com/",
 describe("web_search on the injected port (web.ts)", () => {
 	it("null provider → the honest unavailability string, never a crash", async () => {
 		const { web_search } = createWebTools(() => null);
+		assert.ok(web_search, "web_search is still exposed without a provider");
 		const out = await web_search!.execute!("c1", { query: "anything" });
-		assert.match(String(out.details), /not available: no search engine is configured/);
+		const missing = "web_search is not available: no search engine is configured. " +
-		assert.match(String(out.details), /Tavily or Brave/);
+			"Set a Tavily or Brave search API key in settings. Report in your brief that web search is unavailable.";
+		assert.equal(out.details, missing);
+		assert.deepEqual(out.content, [{ type: "text", text: missing }]);
+		assert.notEqual(out.isError, true, "missing keys remain ordinary recoverable text, not a native error");
 	});
 
 	it("a live provider returns its hits (count defaults to 5)", async () => {
@@ -110,11 +108,86 @@ describe("web_search on the injected port (web.ts)", () => {
 	});
 });
 
-/** Minimal in-memory JobStore — the drop tests never touch the fs. */
+describe("keyless researcher loop", () => {
+	it("sends the exact approved missing-credentials guidance in the researcher system prompt", async () => {
+		const approved = "If web_search reports that search is unavailable because credentials are missing, do not retry it with different queries. Use web_fetch when you have source URLs, and continue with any other available sources. If the missing search capability materially limits your work, state the limitation and the missing-key setup needed in your brief. Never invent search results or sources.";
+		const faux = createFauxCore({});
+		faux.setResponses([(context) => {
+			const system = context.messages.find((m) => m.role === "system");
+			assert.ok(system && system.role === "system");
+			assert.equal(typeof system.content, "string");
+			const prompt = system.content as string;
+			assert.ok(prompt.split("\n\n").includes(approved), "approved paragraph is passed verbatim");
+			assert.match(prompt, /Break the question into 2-4 searchable facets/);
+			assert.match(prompt, /## Gaps/);
+			assert.ok(system.toolsAdded?.some((t) => t.name === "web_search"));
+			assert.ok(system.toolsAdded?.some((t) => t.name === "web_fetch"));
+			return fauxAssistantMessage([fauxText("Prompt verified; no model behavior inferred.")]);
+		}]);
+		assert.equal(await runResearcherAgent("Check the prompt only", {
+			engine: { model: faux.getModel(), streamFn: faux.streamSimple },
+		}), "Prompt verified; no model behavior inferred.");
+	});
+
+	// These scripts prove tool/loop mechanics, not real-model compliance.
+	for (const searchFirst of [true, false]) {
+		it(searchFirst ? "recovers from missing search keys by fetching a supplied URL" : "fetch-only research needs no search credentials", async () => {
+			const url = "https://example.com/supplied-source";
+			const brief = `## Summary\nVerified supplied source. [Source](${url})`;
+			const steps: FauxResponseStep[] = [];
+			const fetchCall = () => fauxAssistantMessage(
+				[fauxToolCall("web_fetch", { url }, { id: "fetch1" })], { stopReason: "toolUse" },
+			);
+			if (searchFirst) {
+				steps.push(
+					() => {
+						return fauxAssistantMessage(
+							[fauxToolCall("web_search", { query: "supplied source" }, { id: "search1" })], { stopReason: "toolUse" },
+						);
+					},
+					(context) => {
+						const result = context.messages.find((m) => m.role === "toolResult" && m.toolCallId === "search1");
+						assert.ok(result && result.role === "toolResult");
+						assert.equal(result.isError, false, "missing keys do not abort the native loop");
+						assert.match(JSON.stringify(result.content), /no search engine is configured/);
+						return fetchCall();
+					},
+				);
+			} else steps.push(fetchCall());
+			steps.push((context) => {
+				const result = context.messages.find((m) => m.role === "toolResult" && m.toolCallId === "fetch1");
+				assert.ok(result && result.role === "toolResult");
+				assert.equal(result.isError, false);
+				assert.match(JSON.stringify(result.content), /Synthetic verified source content/);
+				return fauxAssistantMessage([fauxText(brief)]);
+			});
+			const faux = createFauxCore({});
+			faux.setResponses(steps);
+			const realFetch = globalThis.fetch;
+			const fetched: string[] = [];
+			globalThis.fetch = (async (input) => {
+				fetched.push(String(input));
+				assert.equal(String(input), url, "only the supplied URL is fetched");
+				return new Response("Synthetic verified source content", { headers: { "content-type": "text/plain" } });
+			}) as typeof fetch;
+			try {
+				assert.equal(await runResearcherAgent(`Verify ${url}`, {
+					engine: { model: faux.getModel(), streamFn: faux.streamSimple },
+					// No search seam: this is the keyless backstop, not a search stub.
+				}), brief);
+				assert.deepEqual(fetched, [url]);
+			} finally {
+				globalThis.fetch = realFetch;
+			}
+		});
+	}
+});
+
+/** Minimal in-memory JobStore — registry tests never touch the fs. */
 function fakeJobStore(): JobStore {
 	const jobs = new Map<string, JobRecord>();
 	return {
-			createJob(init) {
+		createJob(init) {
 			const job: JobRecord = {
 				id: `job_${jobs.size + 1}`,
 				kind: init.kind,
@@ -149,13 +222,28 @@ function fakeCtx(available?: () => boolean) {
 	};
 }
 
-describe("the research registry drop (jobTools)", () => {
+describe("keyless research dispatch (jobTools)", () => {
-	it("searchUnavailable: false → research drops from the registry (the other job tools stay)", () => {
+	it("searchAvailable: false → research remains in the registry", () => {
 		const tools = jobTools(fakeCtx(() => false));
-		assert.equal("research" in tools, false, "no research tool — no doomed dispatch");
+		assert.ok(tools.research, "research can fetch supplied URLs without a search provider");
 		assert.ok(tools.demo && tools.visual && tools.pdf, "the search-less server keeps its other sub-agents");
 	});
 
+	it("keyless dispatch preserves the async job acknowledgement and spawn contract", async () => {
+		const ctx = fakeCtx(() => false);
+		const spawned: Array<{ job: JobRecord; input: unknown }> = [];
+		const tools = jobTools({ ...ctx, spawn: (job, input) => { spawned.push({ job, input }); } });
+		const input = { question: "Verify the supplied URL", context: "https://example.com/source" };
+		const out = await tools.research!.execute!("keyless-call", input);
+		assert.match(String(out.details), /^Dispatched \(job job_1\)\./);
+		assert.match(String(out.details), /fire-and-forget/);
+		assert.equal(spawned.length, 1);
+		assert.equal(spawned[0]!.job.kind, "research");
+		assert.equal(spawned[0]!.job.toolCallId, "keyless-call");
+		assert.equal(spawned[0]!.job.status, "running");
+		assert.deepEqual(spawned[0]!.input, input);
+	});
+
 	it("searchAvailable: true → research present", () => {
 		const tools = jobTools(fakeCtx(() => true));
 		assert.ok(tools.research, "a keyed server exposes research");
@@ -167,12 +255,8 @@ describe("the research registry drop (jobTools)", () => {
 	});
 });
 
-// ─── the threaded gate (fix wave, 2026-09-20) ────────────────────────────────
+// Exercise live registry factories too: search status must not override
-//
+// the existing per-role/user-toggle policy.
-// The fix: createTeacherTools/createProberTools used to DROP searchAvailable
-// when building the inner JobToolContext, so jobTools' gate always took its
-// ?? true default even when the live wiring said unavailable. These pins
-// hold the THREADED path (the registry factories, not jobTools directly).
 
 import { createProberTools, createTeacherTools } from "../src/agent/tools.ts";
 import type { ChatStore } from "../src/core/ports.ts";
@@ -186,19 +270,19 @@ const fakeChatStore = {
 
 const ctxBase = { chatId: "chat-gate-test", chatStore: fakeChatStore };
 
-describe("the threaded searchAvailable gate (registry factories)", () => {
+describe("keyless role registries", () => {
-	it("createTeacherTools: unavailable drops research on the live wiring path", () => {
+	it("createTeacherTools: unavailable keeps research on the live wiring path", () => {
 		const tools = createTeacherTools({
 			...ctxBase,
 			jobStore: fakeJobStore(),
 			spawn: () => {},
 			searchAvailable: () => false,
 		});
-		assert.equal("research" in tools, false, "the threaded signal reached jobTools' gate");
+		assert.ok(tools.research, "no search key is required to dispatch research");
 		assert.ok(tools.demo && tools.visual && tools.pdf, "the other job tools survive");
 	});
 
-	it("createTeacherTools: available keeps research (the gate reads the signal both ways)", () => {
+	it("createTeacherTools: available keeps research", () => {
 		const tools = createTeacherTools({
 			...ctxBase,
 			jobStore: fakeJobStore(),
@@ -208,7 +292,7 @@ describe("the threaded searchAvailable gate (registry factories)", () => {
 		assert.ok(tools.research, "a keyed server exposes research through the teacher");
 	});
 
-	it("createProberTools: research + pdf are phase-omnipresent; the gate drops research only", () => {
+	it("createProberTools: research + pdf remain phase-omnipresent with or without search keys", () => {
 		const on = createProberTools({
 			...ctxBase,
 			deliver: () => {},
@@ -225,16 +309,25 @@ describe("the threaded searchAvailable gate (registry factories)", () => {
 			spawn: () => {},
 			searchAvailable: () => false,
 		});
-		assert.equal("research" in off, false, "no engine = no research dispatch in the prober either");
+		assert.ok(off.research, "keyless research dispatch is available in the prober too");
 		assert.ok(off.pdf && off.probe_done, "pdf is keyless — it survives; probe_done always-on");
 	});
 
-	it("createProberTools: the user toggle drops research independently of the gate", () => {
+	it("createProberTools: the user toggle still drops research without search keys", () => {
 		const tools = createProberTools(
-			{ ...ctxBase, deliver: () => {}, jobStore: fakeJobStore(), spawn: () => {}, searchAvailable: () => true },
+			{ ...ctxBase, deliver: () => {}, jobStore: fakeJobStore(), spawn: () => {}, searchAvailable: () => false },
 			{ research: false },
 		);
 		assert.equal("research" in tools, false, "toggle-filtered like the teacher side");
 		assert.ok(tools.pdf, "pdf unaffected by a research toggle");
 	});
+
+	it("createTeacherTools: the user toggle still drops research without search keys", () => {
+		const tools = createTeacherTools(
+			{ ...ctxBase, jobStore: fakeJobStore(), spawn: () => {}, searchAvailable: () => false },
+			{ research: false },
+		);
+		assert.equal("research" in tools, false);
+		assert.ok(tools.pdf && tools.demo && tools.visual);
+	});
 });