fix: handle merged dependencies and preserve research review context

README.md

@@ -128,7 +128,7 @@ Foreman can generate a Planner-drafted PR title and body via `POST /api/runs/:id
 
 When the workspace bridge is configured and the harness is Claude Code or Codex, Planner and Orchestrator receive a read-only snapshot of the repository in their working directory. They can use Read, Grep, and Glob to inspect code before proposing tasks or work. The snapshot is seeded via the same bridge used for Worker workspaces, with no write access granted.
 
-If the snapshot cannot be seeded (bridge unavailable, or Antigravity CLI selected), Foreman falls back to a deterministic repository digest: the file tree at the relevant commit, a `package.json` summary, the first 60 lines of README, and rarity-weighted keyword hits from the task description. The digest is sized from the prompt budget that remains after the mandatory parts of the prompt (the instructions and your full message for the Planner; the instructions, operator note, and task title for the Orchestrator), capped at 12 KB. Foreman trims its own context to make room and truncates the file tree and other digest sections to fit. If less than about 1.5 KB remains, the digest is omitted, the prompt says so, and the `repoAccess` reason records it. The digest therefore never pushes a turn over the 15,000-byte prompt limit.
+If the snapshot cannot be seeded (bridge unavailable, or Antigravity CLI selected), Foreman falls back to a deterministic repository digest: the file tree at the relevant commit, a `package.json` summary, the first 60 lines of README, and rarity-weighted keyword hits from the task description. The digest is sized from the UTF-8 prompt budget that remains after mandatory instructions, the immutable task contract, operator guidance, and any captured source evidence. It is omitted with an explicit reason when it cannot fit; prompts never silently truncate the frozen task goal or acceptance criteria.
 
 A `repoAccess` badge on each assignment shows whether the role used a live snapshot or a digest.
 
@@ -163,6 +163,14 @@ The standard local flow requires no environment variables. The following setting
 
 Planner and Orchestrator turn timeouts are fixed at 300 seconds and are not configurable via environment variable. The optional configuration shape is recorded in `config.schema.json`.
 
+### Public research and handoff limits
+
+The Orchestrator can request bounded, read-only HTTPS GET research. Foreman pins public DNS results, rejects private addresses, follows only validated HTTPS redirects, and stores dated excerpts plus response digests; raw response bodies remain in a bounded in-memory cache and are not written to `.foreman-data`. Repeated requests for the same URL can produce new term-specific excerpts from that cached capture without another network request. The Orchestrator must distinguish source documentation, observed responses, and unresolved behavior. If the saved budget is exhausted, use **Resume with guidance** to add research requests or Orchestrator turns without changing the task contract.
+
+New runs default to 12 Orchestrator turns and 24 uncached URL retrieval attempts (six per batch), 8 MiB per response, 64 MiB total captured response bytes, 16 KiB per excerpt, and a 15-second request timeout. A term refinement served from the in-memory URL cache does not consume another retrieval attempt. Maximums are 128 retrieval attempts per run, six per batch, 64 MiB per response, 1 GiB total bytes, 64 KiB per excerpt, and 60 seconds. The shared handoff limits are 128 KiB for a prompt, 96 KiB for research context, 1 MiB for the Reviewer package, 256 KiB for the verified diff, 4 MiB for an API request body, and 512 KiB for CLI output. Legacy runs without a saved budget retain their historical six-request, three-per-batch accounting; extending their budget keeps the frozen task contract and applies current response-size limits.
+
+Set these optional environment variables to configure installation defaults within the documented bounds: `FOREMAN_RESEARCH_REQUESTS`, `FOREMAN_RESEARCH_BATCH`, `FOREMAN_RESEARCH_RESPONSE_BYTES`, `FOREMAN_RESEARCH_BYTES`, `FOREMAN_RESEARCH_EXCERPT_BYTES`, `FOREMAN_RESEARCH_TIMEOUT_MS`, `FOREMAN_PROMPT_BYTES`, `FOREMAN_WORKER_RESEARCH_BYTES`, `FOREMAN_REVIEW_PACKAGE_BYTES`, `FOREMAN_REVIEW_DIFF_BYTES`, `FOREMAN_UHP_BODY_BYTES`, `FOREMAN_UHP_OUTPUT_BYTES`, and `FOREMAN_PROPOSAL_BYTES`. New runs snapshot the effective research budget when created; a blocked run can be resumed with `additionalResearchRequests` and `additionalOrchestratorTurns` up to the configured maximums.
+
 ## Local bridge
 
 In the standard flow Foreman runs one bridge per project, `investigations/local-cli-uhp/server.mjs`, on a random `127.0.0.1` port. The bridge drives your signed-in Claude Code, Codex and Antigravity CLIs and holds full copies of the repository, so Foreman protects and supervises it: