### ✨ New Features

- Research steps in chat mode now expand to show the actual tool output (search results, fetched page content — capped at 4,000 chars) when clicked, and the agent's "selecting next action from …" heartbeat lists every enabled tool instead of sampling 3 with "+N more". ([#5051](https://github.com/LearningCircuit/local-deep-research/pull/5051))

### 🐛 Bug Fixes

- Fix the Language Model dropdown frequently coming up empty on the New Research page (requiring a manual click of the refresh button). Three root causes are addressed: the page fired two concurrent `/available-models` requests on every load, which contended against a cold Ollama; Ollama's model-list query used a too-tight 2-second timeout (raised to 5s) whose failure was silently turned into an empty list; and a transient empty result could linger in the client cache. The list now loads once per page and self-heals from a transient empty response.
- Fixed numbers in exported PDFs rendering as wide, spaced-out emoji glyphs ("2 0 2 6" instead of "2026"). Digits 0-9 carry the Unicode Emoji property, so listing "Noto Color Emoji" in the PDF font stacks (#4730) made Pango draw every digit with the emoji font. Emoji families are removed from the stacks; emoji still render via fontconfig per-character fallback to the installed emoji font.
- Validate that a language model is selected before starting a research from the New Research page. Submitting with an empty model now shows an inline "Please select or enter a model." error and focuses the model field instead of kicking off a run that would fail downstream.

### 📝 Other Changes

- Fixed cross-test state leaks from tests that reload or evict production modules: the rate-limiter tests restored a fake config, the history-routes fixture leaked auth-bypassed blueprints, the office-format tests could leak a blocked-dependency loader registry, the settings-logger tests leaked the log level, the security import-fallback helper re-created the whole security tree (stacking permanent audit hooks), and four sibling sites (thread-local-session eviction, auth-db reload, env-definitions re-import, loader-registry import guards) now restore the exact pre-test modules.