Save every pinned web_search mode on Agents

[SaladDay]

Saved Agents now accept web_search in every pinned mode and project it the way the official service does. Core used to reject every mode except disabled when saving. Execution qualification is unchanged: enabled search still cannot run, and Session admission rejects it before any write. The pinned baseline is unchanged (SDK 3.13.0 / d7c41ef / agents=v1).

Behavior

• Agent create and update: web_search with mode live, cached, null or omitted is saved.
  • An omitted or null mode becomes live, and an omitted or null context_size becomes medium.
  • allowed_domains keeps null distinct from [].
  • A present location projects all four keys (city, country, region, timezone), with null for missing ones; {} gives all four as null.
  • Retrieve and list return the saved form. Explicit disabled rows read the same bytes as before.
• Protocol errors: unchanged (the configuration validation from PR Validate Agent configuration with official error fields #61).
• Session admission:
  • A saved Agent whose tools include enabled search gets 400 unsupported_or_invalid_configuration, "Only disabled web_search is qualified for execution.". This applies to plain, streamed, self_hosted and hosted creation, and nothing is written.
  • The order is unchanged: protocol errors, then the input requirement, then execution admission.
  • A per-Session tools replacement that drops the saved search is admitted.
  • Inline enabled or omitted-mode search is rejected as before; explicit disabled search is admitted as before.
  • Same-key retries of Sessions with a recorded creation-request hash return the original Session. Older rows fall through to admission.
• Defense in depth: the Worker's executionTools guard and dispatch request building still refuse anything but disabled search. A new test pins this for all three harnesses.
• Client and Core Web:
  • The client types the saved web_search mode union.
  • Core Web now starts Sessions from Agents with one well-formed disabled search. It blocks enabled or omitted modes with a message saying Core does not run enabled search.

Evidence

• TV-05 (campaign scan 3).
• Owned official probes on 2026-09-23: 6 Agents, all deleted and checked with a 404 afterwards. Request IDs include req_c7fffbd2…, req_65ca3c64…, req_c8117c91…, req_71997e17…, req_ed0b686a…, req_e11eeaa2…, req_51fc9650…, req_db41d2f6261b4abfb69465eafe719ab5 (partial location) and req_165d53b88445490b9146d8272c54134d (location: {}).
• Recorded in tool-policy.md, execution-tools.md, official-semantics-alignment.md and operation-evidence.md (register SW, rows 1 and 3).

Validation

• Independent acceptance, written from the requirements only: real Core with PostgreSQL, raw HTTP and the pinned SDK, no official or model calls.

  Row	main	candidate
  W1 create projection	FAIL (every enabled mode 400)	PASS 120
  W2 update projection	FAIL	PASS 70
  W3 protocol errors	PASS	PASS 189
  W4 admission rejection, no write (plain, stream, self_hosted, self_hosted+stream, self_hosted with input, hosted)	not reachable	PASS 122
  W5 per-Session tools replacement	not reachable	PASS 27
  W6 inline enabled search	PASS	PASS 122
  W7 explicit disabled	PASS	PASS 65
  W8 tenant isolation (byte-identical 404, lists, cursors)	PASS	PASS 240

  The script was unchanged between runs (same sha256). The acceptance ran on the first candidate head. The later commits change only docs, tests and Core Web, so Core behavior is identical.

• Tests:

  • Go API unit tests with exact-byte projection tables.
  • A real-PostgreSQL public test covering create, update, retrieve and list bytes, no-write admission rejection across every creation mode, retries, the per-Session replacement and tenant B.
  • The new Worker/dispatch test.
  • The pinned-SDK official_client.py suite.
  • TS client and Core Web tests.

• Server gate on the final head: all make check targets, plus Web typecheck, core-doctor, unit tests and build, pass. The Playwright browser cases were not run on the server (no Google Chrome; the user approved the skip). make openapi is byte-identical.

• Independent blind review by a fresh Claude Code subagent (the user-approved replacement for GPT-6 Astra). It found no blockers and confirmed three independent guards against executing enabled search. Its five follow-ups are fixed in the last three commits:

  • location evidence now observed;
  • Core Web wording and disabled admission;
  • the retry-doc qualifier;
  • stronger tests;
  • a doc re-wrap.

  These were verified by focused tests and the gate, without a new review, per the user's rule.

No full protocol compatibility is claimed; enabled search execution remains unqualified.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}