fix(onboard): preserve tier-default brave/tavily on re-onboard reuse

src/lib/onboard/policy-preset-reconciliation.ts

@@ -13,6 +13,7 @@ import {
   mergeRequiredObservabilityPolicyPresets,
 } from "./observability-policy-presets";
 import { mergeRequiredOpenclawOtelPolicyPresets } from "./openclaw-otel-policy-presets";
+import { classifyPresetProvenance } from "../policy/preset-provenance";
 import { filterSuppressedAgentRequiredPresets } from "./policy-tier-suppression";
 
 export type RequiredSetupPolicyPresetOptions = {
@@ -84,6 +85,8 @@ export function isStaleBuiltinBravePolicyPreset(
   options: {
     webSearchConfig?: WebSearchConfig | null;
     customPresetNames?: ReadonlySet<string> | null;
+    tierName?: string | null;
+    agentName?: string | null;
   } = {},
 ): boolean {
   return isStaleBuiltinWebSearchPolicyPreset(name, options);
@@ -94,9 +97,28 @@ export function isStaleBuiltinWebSearchPolicyPreset(
   options: {
     webSearchConfig?: WebSearchConfig | null;
     customPresetNames?: ReadonlySet<string> | null;
+    tierName?: string | null;
+    agentName?: string | null;
   } = {},
 ): boolean {
   if (options.customPresetNames?.has(name)) return false;
+  // brave/tavily double as a tier's default egress preset (e.g. Brave Search API
+  // host access on the Balanced/Open tiers) AND the built-in web-search provider
+  // preset. When the preset is a default of the applied tier it is a tier egress
+  // default, not a stale web-search leftover — keep it regardless of the web-search
+  // provider choice. Reuse the single provenance classifier so pruning and the
+  // policy-list display agree on WHY a preset is present, and so the exemption is
+  // scoped exactly to the applied tier (Restricted lists no such default → still
+  // pruned). classifyPresetProvenance's getTier() returns null for an unknown /
+  // non-canonical tier, so this fails safe (unknown → not "tier" → not exempt). (#6844)
+  if (
+    classifyPresetProvenance(name, {
+      tierName: options.tierName,
+      agentName: options.agentName,
+    }).source === "tier"
+  ) {
+    return false;
+  }
   if (name === "nous-web") {
     return Boolean(
       options.webSearchConfig && webSearchProviderForConfig(options.webSearchConfig) === "tavily",
@@ -114,14 +136,25 @@ export function createUnavailablePolicyPresetPruner(options: {
   webSearchConfig?: WebSearchConfig | null;
   customPresetNames?: ReadonlySet<string> | null;
   customOwnsObservability?: boolean;
-}): (presetNames: string[], pruning?: { preserveExplicitWebSearch?: boolean }) => string[] {
+}): (
+  presetNames: string[],
+  pruning?: {
+    preserveExplicitWebSearch?: boolean;
+    tierName?: string | null;
+  },
+) => string[] {
   // Custom and interactive selections may explicitly opt into a built-in web-search
   // preset without storing provider config. Inactive observability remains ineligible.
   return (presetNames, pruning = {}) =>
     pruneDisabledMessagingPolicyPresets(presetNames, options.disabledChannels).filter(
       (name) =>
         (pruning.preserveExplicitWebSearch ||
-          !isStaleBuiltinWebSearchPolicyPreset(name, options)) &&
+          !isStaleBuiltinWebSearchPolicyPreset(name, {
+            webSearchConfig: options.webSearchConfig,
+            customPresetNames: options.customPresetNames,
+            tierName: pruning.tierName,
+            agentName: options.agent,
+          })) &&
         !isInactiveObservabilityPolicyPreset(name, options),
     );
 }

src/lib/onboard/policy-resume-selection.test.ts

@@ -87,6 +87,69 @@ describe("preparePolicyPresetResumeSelection web search reconciliation", () => {
   });
 });
 
+describe("preparePolicyPresetResumeSelection tier-default preservation (#6844)", () => {
+  // These exercise the real tiers.yaml through classifyPresetProvenance (no tier
+  // stub): `brave` is a Balanced default, and Restricted lists no such default.
+
+  it("preserves brave on reuse when it is a Balanced-tier default and web search is off", () => {
+    const result = preparePolicyPresetResumeSelection({ policies: policies() }, "alpha", {
+      recordedPolicyPresets: ["npm", "brave"],
+      agent: "openclaw",
+      webSearchConfig: null,
+      webSearchSupported: true,
+      tierName: "balanced",
+    });
+
+    // brave is a Balanced default (an egress preset), not a stale web-search
+    // leftover — it must survive reuse just like npm, and no reconcile is needed.
+    expect(result.policyPresets).toEqual(["npm", "brave"]);
+    expect(result.recordedPolicyPresetsNeedReconcile).toBe(false);
+  });
+
+  it("still prunes a stale brave on the Restricted tier (no brave default)", () => {
+    const result = preparePolicyPresetResumeSelection({ policies: policies() }, "alpha", {
+      recordedPolicyPresets: ["npm", "brave"],
+      agent: "openclaw",
+      webSearchConfig: null,
+      webSearchSupported: true,
+      tierName: "restricted",
+    });
+
+    expect(result.policyPresets).toEqual(["npm"]);
+    expect(result.recordedPolicyPresetsNeedReconcile).toBe(true);
+  });
+
+  it("keeps brave on Balanced even when web search is set to a different provider", () => {
+    const result = preparePolicyPresetResumeSelection({ policies: policies() }, "alpha", {
+      recordedPolicyPresets: ["npm", "brave"],
+      agent: "openclaw",
+      webSearchConfig: { fetchEnabled: true, provider: "tavily" },
+      webSearchConfigChanged: true,
+      webSearchSupported: true,
+      tierName: "balanced",
+    });
+
+    // brave stays as the tier egress default; tavily is added as the active provider.
+    expect(result.policyPresets).toEqual(["npm", "brave", "tavily"]);
+  });
+
+  it("still prunes tavily on Balanced when it is not a tier default and web search is off", () => {
+    // Boundary: the exemption is scoped to real tier defaults. tavily is NOT a
+    // Balanced default (brave is), so a leftover tavily with no matching provider
+    // is still a stale web-search preset and must be pruned.
+    const result = preparePolicyPresetResumeSelection({ policies: policies() }, "alpha", {
+      recordedPolicyPresets: ["npm", "tavily"],
+      agent: "openclaw",
+      webSearchConfig: null,
+      webSearchSupported: true,
+      tierName: "balanced",
+    });
+
+    expect(result.policyPresets).toEqual(["npm"]);
+    expect(result.recordedPolicyPresetsNeedReconcile).toBe(true);
+  });
+});
+
 describe("preparePolicyPresetResumeSelection observability reconciliation", () => {
   it("adds the local OTLP preset only while Deep Agents Code observability is enabled", () => {
     const enabled = preparePolicyPresetResumeSelection({ policies: policies() }, "alpha", {

src/lib/onboard/policy-resume-selection.ts

@@ -100,10 +100,16 @@ export function preparePolicyPresetResumeSelection(
     supportOptions,
     customPolicyPresetNames,
   );
+  // Defaults of the recorded/active tier (e.g. `brave` on Balanced) are tier
+  // egress presets, not stale web-search leftovers — pass the recorded tier +
+  // agent so the shared predicate exempts them via provenance and re-onboard
+  // reuse preserves them. (#6844)
   const isStaleBuiltinWebSearch = (name: string) =>
     isStaleBuiltinWebSearchPolicyPreset(name, {
       webSearchConfig: options.webSearchConfig,
       customPresetNames: customPolicyPresetNames,
+      tierName: options.tierName,
+      agentName: options.agent,
     });
   const isInactiveObservability = (name: string) =>
     isInactiveObservabilityPolicyPreset(name, {

src/lib/onboard/policy-selection.ts

@@ -334,7 +334,10 @@ async function setupPoliciesWithSelectionInner(
       customPresetNames,
       customOwnsObservability,
     });
-    chosen = pruneUnavailablePresets(chosen);
+    // Pass the recorded tier so the pruner exempts that tier's egress defaults
+    // (e.g. `brave` on Balanced) via provenance — a reconcile-triggered reuse
+    // reapply must not narrow an applied tier default. (#6844)
+    chosen = pruneUnavailablePresets(chosen, { tierName: recordedTierName });
   }
 
   if (selectedPresets !== null) {

test/policy-tiers-onboard.test.ts

@@ -483,6 +483,31 @@ describe("policy tier setup", () => {
     assert.deepEqual(result.appliedCalls, ["brave", "npm"]);
   });
 
+  it("preserves a recorded Balanced tier default during resumed reapply (#6844)", async () => {
+    const result = await runPolicySetup(
+      {
+        tierName: "restricted",
+        currentApplied: ["npm", "brave"],
+        recordedPolicyTier: "balanced",
+      },
+      {
+        selectedPresets: ["npm", "brave"],
+        webSearchConfig: null,
+        webSearchSupported: true,
+      },
+    );
+
+    assert.deepEqual(result.applied, ["npm", "brave"]);
+    assert.deepEqual(result.syncCalls, [
+      {
+        sandboxName: "test-sb",
+        current: ["npm", "brave"],
+        selected: ["npm", "brave"],
+      },
+    ]);
+    assert.deepEqual(result.removedCalls, []);
+  });
+
   it("clamps resumed policy presets to web-search-supported presets", async () => {
     const result = await runPolicySetup(
       {