@animalabs/agent-framework 0.18.0 → 0.20.0

package/dist/test/tool-result-guard.test.js

@@ -0,0 +1,1081 @@
+import { afterEach, test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { PassthroughStrategy } from '@animalabs/context-manager';
+import { Membrane as RealMembrane, NativeFormatter } from '@animalabs/membrane';
+import { AgentFramework } from '../src/index.js';
+import { TOOL_RESULT_GUARD_AUDIT_STATE, TOOL_RESULT_GUARD_NOTICE } from '../src/tool-result-guard.js';
+import { MockYieldingStream, createMockResponse } from './helpers/mock-membrane.js';
+const dirs = [];
+afterEach(() => { while (dirs.length)
+    rmSync(dirs.pop(), { recursive: true, force: true }); });
+const answer = () => createMockResponse([{ type: 'text', text: 'continued' }]);
+const refused = () => ({
+    ...createMockResponse([{ type: 'text', text: 'discard-this-partial-output' }], 'refusal'),
+    raw: { request: {}, response: { stop_details: { category: 'test-category' } } },
+});
+const calls = (...ids) => createMockResponse(ids.map((id) => ({
+    type: 'tool_use', id, name: 'test--read', input: {},
+})), 'tool_use');
+class ScriptMembrane {
+    scripts;
+    requests = [];
+    streams = [];
+    retriesAtSubmission = [];
+    onSubmit;
+    constructor(scripts) {
+        this.scripts = scripts;
+    }
+    streamYielding(request, options = {}) {
+        this.requests.push(structuredClone({ ...request, onCacheWireReceipt: undefined }));
+        const script = this.scripts.shift();
+        assert.ok(script, 'unexpected extra inference');
+        const stream = new MockYieldingStream(script);
+        const provide = stream.provideToolResults.bind(stream);
+        stream.provideToolResults = (...args) => {
+            this.retriesAtSubmission.push(options.refusalRetries ?? 0);
+            this.onSubmit?.();
+            provide(...args);
+        };
+        this.streams.push(stream);
+        return stream;
+    }
+    asMembrane() { return this; }
+}
+class ReadModule {
+    results;
+    name = 'test';
+    calls = [];
+    speeches = [];
+    constructor(results = {}) {
+        this.results = results;
+    }
+    async start(ctx) { ctx.registerSpeechHandler('*'); }
+    async stop() { }
+    getTools() {
+        return [
+            { name: 'read', description: 'Read a result', inputSchema: { type: 'object', properties: {} } },
+            { name: 'send_message', description: 'Explicit send', inputSchema: { type: 'object', properties: {} } },
+        ];
+    }
+    async handleToolCall(call) {
+        this.calls.push(call.id);
+        return this.results[call.id] ?? { success: true, data: `payload-${call.id}` };
+    }
+    async onProcess(event, _state) {
+        return event.type === 'external-message'
+            ? { addMessages: [{ participant: 'user', content: [{ type: 'text', text: String(event.content) }] }], requestInference: true }
+            : {};
+    }
+    async onAgentSpeech(_name, content) {
+        this.speeches.push(...content.flatMap((block) => block.type === 'text' ? [block.text] : []));
+    }
+}
+class IngressObserver extends PassthroughStrategy {
+    snapshots = [];
+    async onNewMessage(_message, ctx) {
+        this.snapshots.push(JSON.stringify(ctx.messageStore.getAll()));
+    }
+}
+async function harness(scripts, config = {}, results) {
+    const dir = mkdtempSync(join(tmpdir(), 'af-tool-result-guard-'));
+    dirs.push(dir);
+    const membrane = new ScriptMembrane(scripts);
+    const module = new ReadModule(results);
+    const base = { storePath: join(dir, 'store'), membrane: membrane.asMembrane(),
+        agents: [{ name: 'assistant', model: 'test', systemPrompt: 'system', ...config }], modules: [module], syncIntervalMs: 0 };
+    const framework = await AgentFramework.create(base);
+    const run = async () => {
+        framework.pushEvent({ type: 'external-message', source: 'test', content: 'read', metadata: {} });
+        await framework.runUntilIdle();
+    };
+    return { framework, membrane, module, base, run };
+}
+function extension(framework) {
+    const extensions = framework.collectAgentSettingsExtensions();
+    return [...extensions.values()].find((ext) => ext.keys.includes('tool_result_guard'));
+}
+function toolResults(framework) {
+    return framework.getAgent('assistant').getContextManager().getAllMessages()
+        .flatMap((message) => message.content.filter((block) => block.type === 'tool_result'));
+}
+test('default off retains existing refusal behavior and original tool output', async () => {
+    const h = await harness([[calls('one'), refused()]]);
+    try {
+        await h.run();
+        assert.equal(h.membrane.requests.length, 1);
+        assert.match(JSON.stringify(toolResults(h.framework)), /payload-one/);
+        assert.equal(extension(h.framework).get('assistant').tool_result_guard, false);
+    }
+    finally {
+        await h.framework.stop();
+    }
+});
+test('withholds the entire latest batch, retries inference once, and keeps originals in Chronicle', async () => {
+    const strategy = new IngressObserver();
+    const image = Buffer.from('original-image-bytes').toString('base64');
+    const h = await harness([[calls('text', 'image', 'error'), refused()], [answer()]], { toolResultGuard: true, strategy, refusalHandling: { retries: 3 } }, {
+        text: { success: true, data: 'original-text-payload' },
+        image: { success: true, data: [{ type: 'image', mimeType: 'image/png', data: image }] },
+        error: { success: false, isError: true, error: 'original-error-payload' },
+    });
+    let stagedSequence = 0;
+    let originalStopped = false;
+    h.membrane.onSubmit = () => { stagedSequence = h.framework.getStore().currentSequence(); };
+    try {
+        await h.run();
+        assert.deepEqual(h.module.calls.sort(), ['error', 'image', 'text']);
+        assert.equal(h.membrane.requests.length, 2);
+        assert.deepEqual(h.membrane.retriesAtSubmission, [0], 'first refusal must reach guard before plain retries');
+        const retry = h.membrane.requests[1];
+        assert.equal(retry.config.model, 'test');
+        assert.doesNotMatch(JSON.stringify(retry), /original-text-payload|original-error-payload|discard-this-partial-output|test-category/);
+        assert.ok(!JSON.stringify(retry).includes(image));
+        assert.equal(retry.messages.flatMap((m) => m.content).filter((b) => b.type === 'tool_use').length, 3);
+        const guarded = toolResults(h.framework);
+        assert.equal(guarded.length, 3);
+        assert.ok(guarded.every((block) => block.content === TOOL_RESULT_GUARD_NOTICE));
+        assert.equal(guarded.find((b) => b.toolUseId === 'error')?.isError, true);
+        assert.deepEqual(h.module.speeches, ['continued']);
+        assert.ok(strategy.snapshots.every((s) => !s.includes('original-text-payload') && !s.includes(image)), 'background strategy ingress must never see withheld payloads');
+        const store = h.framework.getStore();
+        const audit = store.getStateJson(TOOL_RESULT_GUARD_AUDIT_STATE);
+        assert.match(JSON.stringify(audit[0]), /original-text-payload|original-error-payload/);
+        assert.ok(JSON.stringify(audit[0]).includes(image));
+        assert.equal(audit.at(-1)?.type, 'withheld');
+        const historical = store.getStateJsonAt(TOOL_RESULT_GUARD_AUDIT_STATE, stagedSequence);
+        assert.deepEqual(audit[0], historical[0], 'redaction only appends; original Chronicle record is unchanged');
+        const original = structuredClone(audit[0]);
+        extension(h.framework).update('assistant', { tool_result_guard: false });
+        assert.ok(toolResults(h.framework).every((block) => block.content === TOOL_RESULT_GUARD_NOTICE));
+        await h.framework.stop();
+        originalStopped = true;
+        const restarted = await AgentFramework.create(h.base);
+        try {
+            assert.equal(extension(restarted).get('assistant').tool_result_guard, false, 'explicit disable persists');
+            assert.ok(toolResults(restarted).every((block) => block.content === TOOL_RESULT_GUARD_NOTICE));
+            assert.deepEqual(restarted.getStore().getStateJson(TOOL_RESULT_GUARD_AUDIT_STATE)[0], original);
+            const preview = await restarted.previewActivation('assistant');
+            assert.doesNotMatch(JSON.stringify(preview), /original-text-payload|original-error-payload/);
+        }
+        finally {
+            await restarted.stop();
+        }
+    }
+    finally {
+        if (!originalStopped)
+            await h.framework.stop();
+    }
+});
+test('successful physical rounds admit results; refusal affects only the newest batch', async () => {
+    const h = await harness([[calls('accepted'), calls('withheld'), refused()], [answer()]], { toolResultGuard: true });
+    try {
+        await h.run();
+        const results = toolResults(h.framework);
+        assert.match(String(results.find((b) => b.toolUseId === 'accepted')?.content), /payload-accepted/);
+        assert.equal(results.find((b) => b.toolUseId === 'withheld')?.content, TOOL_RESULT_GUARD_NOTICE);
+        assert.deepEqual(h.module.calls, ['accepted', 'withheld']);
+        assert.equal(h.framework.getAgent('assistant').toolResultGuard.enabled, true);
+    }
+    finally {
+        await h.framework.stop();
+    }
+});
+test('a second refusal stops recovery without auto-rewinding older or human messages', async () => {
+    const h = await harness([[calls('one'), refused()], [refused()]], { toolResultGuard: true, refusalHandling: { autoRewind: true, retries: 3 } });
+    try {
+        await h.run();
+        assert.equal(h.membrane.requests.length, 2);
+        assert.deepEqual(h.module.calls, ['one']);
+        assert.deepEqual(h.module.speeches, []);
+        const messages = h.framework.getAgent('assistant').getContextManager().getAllMessages();
+        assert.ok(messages.some((m) => m.content.some((b) => b.type === 'text' && b.text === 'read')));
+        assert.doesNotMatch(JSON.stringify(messages), /discard-this-partial-output|refusal-rewind/);
+        assert.equal(toolResults(h.framework)[0].content, TOOL_RESULT_GUARD_NOTICE);
+    }
+    finally {
+        await h.framework.stop();
+    }
+});
+test('durable typed agent setting can be enabled, disabled, and explicitly reset', async () => {
+    const h = await harness([]);
+    let originalStopped = false;
+    try {
+        const ext = extension(h.framework);
+        for (const value of ['true', 1, null, {}]) {
+            assert.throws(() => ext.update('assistant', { tool_result_guard: value }), /must be a boolean/);
+        }
+        ext.update('assistant', { tool_result_guard: true });
+        assert.equal(ext.get('assistant').tool_result_guard, true);
+        await h.framework.stop();
+        originalStopped = true;
+        const restarted = await AgentFramework.create(h.base);
+        try {
+            const restored = extension(restarted);
+            assert.equal(restored.get('assistant').tool_result_guard, true);
+            assert.equal(restored.get('assistant').tool_result_guard_source, 'runtime_override');
+            restored.reset('assistant');
+            assert.equal(restored.get('assistant').tool_result_guard, false);
+            const tool = restarted.getAllTools().find((t) => t.name === 'agent_settings');
+            assert.equal(tool.inputSchema.properties.tool_result_guard.type, 'boolean');
+            assert.doesNotMatch(JSON.stringify(tool), /classifier/i);
+        }
+        finally {
+            await restarted.stop();
+        }
+    }
+    finally {
+        if (!originalStopped)
+            await h.framework.stop();
+    }
+});
+test('a normal successful response releases the pending output into versioned history', async () => {
+    const h = await harness([[calls('one'), answer()]], { toolResultGuard: true });
+    try {
+        await h.run();
+        assert.equal(h.membrane.requests.length, 1);
+        assert.match(String(toolResults(h.framework)[0].content), /payload-one/);
+        const records = h.framework.getStore().getStateJson(TOOL_RESULT_GUARD_AUDIT_STATE);
+        assert.equal(records.at(-1)?.type, 'accepted');
+        assert.equal(h.framework.getAgent('assistant').toolResultGuard.enabled, true);
+    }
+    finally {
+        await h.framework.stop();
+    }
+});
+test('refusal without a new tool result does not invoke tool guard recovery', async () => {
+    const h = await harness([[refused()]], { toolResultGuard: true });
+    try {
+        await h.run();
+        assert.equal(h.membrane.requests.length, 1);
+    }
+    finally {
+        await h.framework.stop();
+    }
+});
+test('budget restart submits staged originals, then recovers without re-executing tools', async () => {
+    const h = await harness([[calls('one')], [refused()], [answer()]], { toolResultGuard: true, maxStreamTokens: 1 });
+    try {
+        await h.run();
+        assert.equal(h.membrane.requests.length, 3);
+        assert.match(JSON.stringify(h.membrane.requests[1]), /payload-one/);
+        assert.doesNotMatch(JSON.stringify(h.membrane.requests[2]), /payload-one/);
+        assert.deepEqual(h.module.calls, ['one']);
+        assert.equal(toolResults(h.framework)[0].content, TOOL_RESULT_GUARD_NOTICE);
+    }
+    finally {
+        await h.framework.stop();
+    }
+});
+test('ephemeral run settles only after recovery and counts each tool once', async () => {
+    const h = await harness([[calls('one'), refused()], [answer()]]);
+    try {
+        const created = await h.framework.createEphemeralAgent({
+            name: 'ephemeral', model: 'test', systemPrompt: 'system', toolResultGuard: true,
+        });
+        created.contextManager.addMessage('user', [{ type: 'text', text: 'read' }]);
+        const completion = h.framework.runEphemeralToCompletion(created.agent, created.contextManager);
+        h.framework.start();
+        const result = await completion;
+        assert.deepEqual(result, { speech: 'continued', toolCallsCount: 1 });
+        assert.deepEqual(h.module.calls, ['one']);
+        assert.equal(h.membrane.requests.length, 2);
+    }
+    finally {
+        await h.framework.stop();
+    }
+});
+test('quiesced scheduler admits a queued guard recovery as a continuation', async () => {
+    const h = await harness([[answer()]], { toolResultGuard: true });
+    try {
+        await h.framework.quiesce();
+        h.framework.getAgent('assistant').getContextManager().addMessage('user', [{
+                type: 'text', text: TOOL_RESULT_GUARD_NOTICE,
+            }]);
+        // A recovery can be requeued while waiting for provider admission. It
+        // must finish the held turn even after the host stops admitting new work.
+        h.framework.pendingRequests.push({
+            agentName: 'assistant', reason: 'tool_result_guard_retry', source: 'framework', timestamp: Date.now(),
+        });
+        await h.framework.runUntilIdle();
+        assert.equal(h.membrane.requests.length, 1);
+        assert.equal(h.framework.getHostModeStatus().quiesced, true);
+    }
+    finally {
+        await h.framework.stop();
+    }
+});
+test('native Membrane observes the first refusal even when guard is enabled by a tool mid-stream', async () => {
+    const h = await harness([]);
+    await h.framework.stop();
+    const requests = [];
+    const adapter = {
+        name: 'test', usageCacheConvention: 'cache-excluded', supportsModel: () => true,
+        complete: async () => { throw new Error('unexpected complete'); },
+        stream: async (request, callbacks) => {
+            requests.push(structuredClone(request));
+            const index = requests.length;
+            assert.ok(index <= 3, 'must not retry unchanged refused input');
+            const content = index === 1 ? [
+                { type: 'tool_use', id: 'enable', name: 'agent_settings', input: { action: 'update', tool_result_guard: true } },
+                { type: 'tool_use', id: 'one', name: 'test--read', input: {} },
+            ] : [{ type: 'text', text: index === 2 ? 'discard-native-partial' : 'continued' }];
+            if (index > 1)
+                callbacks.onChunk?.(index === 2 ? 'discard-native-partial' : 'continued');
+            return {
+                content, stopReason: index === 1 ? 'tool_use' : index === 2 ? 'refusal' : 'end_turn',
+                usage: { inputTokens: 20, outputTokens: 5 }, model: 'test',
+                raw: { response: { stop_details: { category: 'test-category' } } },
+            };
+        },
+    };
+    const framework = await AgentFramework.create({ ...h.base,
+        agents: [{ name: 'assistant', model: 'test', systemPrompt: 'system', refusalHandling: { retries: 4 } }],
+        membrane: new RealMembrane(adapter, { formatter: new NativeFormatter() }),
+    });
+    const routed = [];
+    const outgoing = [];
+    framework.channelRegistry = new Proxy({
+        resolveLocus: () => 'world:test',
+        routeSpeech: async (_agent, speech) => {
+            routed.push(speech);
+            return { delivered: true, channelId: 'world:test' };
+        },
+        sendOutgoingChunk: (_channel, _agent, _id, _index, delta) => { outgoing.push(delta); },
+        getDefaultPublishChannel: () => null, isChannelOpen: () => true,
+        getDescriptor: () => undefined, getChannelTools: () => [],
+    }, { get: (target, key) => key in target ? target[key] : () => undefined });
+    const tokenTraces = [];
+    framework.onTrace((event) => {
+        if (event.type === 'inference:tokens')
+            tokenTraces.push(String(event.content));
+    });
+    try {
+        framework.pushEvent({ type: 'external-message', source: 'test', content: 'read', metadata: {} });
+        await framework.runUntilIdle();
+        assert.equal(requests.length, 3);
+        assert.match(JSON.stringify(requests[1]), /payload-one/);
+        assert.doesNotMatch(JSON.stringify(requests[2]), /payload-one|discard-native-partial|test-category/);
+        assert.match(JSON.stringify(requests[2]), /Tool result withheld by the guard/);
+        assert.deepEqual(h.module.calls, ['one']);
+        assert.equal(extension(framework).get('assistant').tool_result_guard, true);
+        assert.deepEqual(h.module.speeches, ['continued']);
+        assert.deepEqual(routed, ['continued']);
+        assert.doesNotMatch(outgoing.join(''), /discard-native-partial/);
+        assert.match(outgoing.join(''), /continued/, 'accepted answer must reach outgoing-stream consumers');
+        assert.doesNotMatch(tokenTraces.join(''), /discard-native-partial/, 'inference:tokens must not leak refused text');
+        assert.match(tokenTraces.join(''), /continued/);
+    }
+    finally {
+        await framework.stop();
+    }
+});
+test('backward-compatible direct Agent inference also guards tool results', async () => {
+    const h = await harness([], { toolResultGuard: true });
+    const responses = [calls('one'), refused(), answer()];
+    const requests = [];
+    h.membrane.stream = async (request) => {
+        requests.push(structuredClone(request));
+        const response = responses.shift();
+        assert.ok(response);
+        return response;
+    };
+    try {
+        const agent = h.framework.getAgent('assistant');
+        agent.getContextManager().addMessage('user', [{ type: 'text', text: 'read' }]);
+        const first = await agent.runInference(h.framework.getAllTools());
+        assert.equal(first.toolCalls.length, 1);
+        agent.provideToolResult('one', { success: true, data: 'direct-original' });
+        const final = await agent.runInference(h.framework.getAllTools());
+        assert.deepEqual(final.speechContent, [{ type: 'text', text: 'continued' }]);
+        assert.equal(requests.length, 3);
+        assert.equal(final.usage?.inputTokens, 20, 'abandoned refused attempt usage is included');
+        assert.match(JSON.stringify(requests[1]), /direct-original/);
+        assert.doesNotMatch(JSON.stringify(requests[2]), /direct-original|discard-this/);
+        assert.equal(toolResults(h.framework)[0].content, TOOL_RESULT_GUARD_NOTICE);
+    }
+    finally {
+        await h.framework.stop();
+    }
+});
+test('full oversized output survives withholding and reopening as a Chronicle blob', async () => {
+    const original = 'original-large-'.repeat(8_000) + 'end-of-original';
+    const h = await harness([[calls('large'), refused()], [answer()]], { toolResultGuard: true }, {
+        large: { success: true, data: original },
+    });
+    let originalStopped = false;
+    try {
+        await h.run();
+        const audit = h.framework.getStore().getStateJson(TOOL_RESULT_GUARD_AUDIT_STATE);
+        const blobId = audit[0].originals.blobId;
+        assert.equal(typeof blobId, 'string');
+        const blob = h.framework.getStore().getBlob(blobId);
+        assert.equal(JSON.parse(blob.toString())[0].result.data, original, 'keep pre-truncation bytes');
+        await h.framework.stop();
+        originalStopped = true;
+        const restarted = await AgentFramework.create(h.base);
+        try {
+            assert.deepEqual(restarted.getStore().getBlob(blobId), blob);
+            assert.equal(toolResults(restarted)[0].content, TOOL_RESULT_GUARD_NOTICE);
+        }
+        finally {
+            await restarted.stop();
+        }
+    }
+    finally {
+        if (!originalStopped)
+            await h.framework.stop();
+    }
+});
+// ---------------------------------------------------------------------------
+// Review regressions (PR #159): guard effects apply only to a batch that was
+// actually SUBMITTED to the provider in the current turn.
+// ---------------------------------------------------------------------------
+class OmitToolExchange extends PassthroughStrategy {
+    select(...args) {
+        return super.select(...args).filter((entry) => !entry.content.some((block) => block.type === 'tool_use' || block.type === 'tool_result'));
+    }
+}
+test('a staged batch omitted by compilation does not claim the refusal; autoRewind proceeds', async () => {
+    const h = await harness([[calls('one')], [refused()], [answer()]], {
+        toolResultGuard: true, maxStreamTokens: 1, strategy: new OmitToolExchange(),
+        refusalHandling: { autoRewind: true },
+    });
+    try {
+        await h.run();
+        const guard = h.framework.getAgent('assistant').toolResultGuard;
+        assert.equal(guard.hasPending, false, 'unsubmitted batch must be settled, not stranded');
+        assert.equal(guard.recovering, false);
+        assert.doesNotMatch(JSON.stringify(h.membrane.requests[1]), /payload-one/);
+        assert.equal(h.membrane.requests.length, 3, 'ordinary refusal rewind retry must run');
+        const messages = h.framework.getAgent('assistant').getContextManager().getAllMessages();
+        assert.match(JSON.stringify(messages), /\[refusal-rewind\]/);
+        const audit = h.framework.getStore().getStateJson(TOOL_RESULT_GUARD_AUDIT_STATE);
+        assert.ok(audit.some((r) => r.type === 'withheld' && r.reason === 'unsubmitted'));
+    }
+    finally {
+        await h.framework.stop();
+    }
+});
+test('a turn ended by an endTurn tool settles (accepts) its batch', async () => {
+    const h = await harness([[calls('one')]], { toolResultGuard: true }, { one: { success: true, data: 'payload-one', endTurn: true } });
+    try {
+        await h.run();
+        const guard = h.framework.getAgent('assistant').toolResultGuard;
+        assert.equal(guard.hasPending, false);
+        assert.match(String(toolResults(h.framework)[0].content), /payload-one/);
+        const audit = h.framework.getStore().getStateJson(TOOL_RESULT_GUARD_AUDIT_STATE);
+        assert.equal(audit.at(-1)?.type, 'accepted');
+        assert.equal(audit.at(-1)?.reason, 'turn_ended');
+    }
+    finally {
+        await h.framework.stop();
+    }
+});
+test('a refusal on the next turn after endTurn uses ordinary refusal handling', async () => {
+    const h = await harness([[calls('one')], [refused()], [answer()]], {
+        toolResultGuard: true, refusalHandling: { autoRewind: true, retries: 2 },
+    }, { one: { success: true, data: 'payload-one', endTurn: true } });
+    try {
+        await h.run();
+        await h.run();
+        const messages = h.framework.getAgent('assistant').getContextManager().getAllMessages();
+        assert.match(JSON.stringify(messages), /\[refusal-rewind\]/, 'autoRewind must not be suppressed');
+        assert.equal(h.membrane.requests.length, 3);
+    }
+    finally {
+        await h.framework.stop();
+    }
+});
+test('budget restart reserves the real wire cost of the pending batch', async () => {
+    const big = 'x'.repeat(40_000); // ~10k tokens on the wire, notice is ~20
+    const budget = 14_000;
+    const h = await harness([[calls('one')], [answer()]], {
+        toolResultGuard: true, maxStreamTokens: 1, contextBudgetTokens: budget, maxTokens: 1_000,
+    }, { one: { success: true, data: big } });
+    try {
+        const cm = h.framework.getAgent('assistant').getContextManager();
+        for (let i = 0; i < 20; i++) {
+            cm.addMessage('user', [{ type: 'text', text: `filler-${i} ` + 'y'.repeat(2_000) }]);
+        }
+        await h.run();
+        const rebuilt = h.membrane.requests[1];
+        assert.match(JSON.stringify(rebuilt), /xxxxxxxx/, 'pending original still submitted');
+        const chars = rebuilt.messages.flatMap((m) => m.content).reduce((n, b) => n + JSON.stringify(b).length, 0);
+        assert.ok(Math.ceil(chars / 4) <= budget - 1_000, `rebuilt request ~${Math.ceil(chars / 4)} tokens exceeds budget ${budget - 1_000}`);
+    }
+    finally {
+        await h.framework.stop();
+    }
+});
+test('audit is synced before the pending batch is submitted', async () => {
+    const h = await harness([[calls('one'), answer()]], { toolResultGuard: true });
+    const store = h.framework.getStore();
+    const sync = store.sync.bind(store);
+    let syncedWhilePending = false;
+    store.sync = () => {
+        if (h.framework.getAgent('assistant').toolResultGuard.hasPending)
+            syncedWhilePending = true;
+        sync();
+    };
+    let durableAtSubmit = false;
+    h.membrane.onSubmit = () => { durableAtSubmit = syncedWhilePending; };
+    try {
+        await h.run();
+        assert.equal(durableAtSubmit, true);
+    }
+    finally {
+        store.sync = sync;
+        await h.framework.stop();
+    }
+});
+test('direct API: a transient compile failure does not wedge the guard', async () => {
+    const h = await harness([], { toolResultGuard: true });
+    const responses = [calls('one'), answer()];
+    h.membrane.stream =
+        async () => responses.shift();
+    try {
+        const agent = h.framework.getAgent('assistant');
+        agent.getContextManager().addMessage('user', [{ type: 'text', text: 'read' }]);
+        await agent.runInference(h.framework.getAllTools());
+        agent.provideToolResult('one', { success: true, data: 'direct-original' });
+        const compile = agent.compileWithInjections.bind(agent);
+        let failed = false;
+        agent.compileWithInjections = async (...args) => {
+            if (!failed) {
+                failed = true;
+                throw new Error('transient compile failure');
+            }
+            return compile(...args);
+        };
+        await assert.rejects(agent.runInference(h.framework.getAllTools()), /transient compile failure/);
+        const final = await agent.runInference(h.framework.getAllTools());
+        assert.deepEqual(final.speechContent, [{ type: 'text', text: 'continued' }]);
+        assert.equal(toolResults(h.framework).length, 1, 'batch staged exactly once');
+        assert.match(String(toolResults(h.framework)[0].content), /direct-original/);
+    }
+    finally {
+        await h.framework.stop();
+    }
+});
+test('usage of an abandoned guarded round is counted in session totals', async () => {
+    const withUsage = (r, input) => ({ ...r, details: { ...(r.details ?? {}), usage: { inputTokens: input, outputTokens: 1 } } });
+    const h = await harness([[calls('one'), withUsage(refused(), 1_000)], [withUsage(answer(), 7)]], { toolResultGuard: true });
+    try {
+        await h.run();
+        const totals = h.framework.getSessionUsage().totals;
+        assert.ok(totals.inputTokens >= 1_007, `refused round usage missing: ${JSON.stringify(totals)}`);
+    }
+    finally {
+        await h.framework.stop();
+    }
+});
+// ---------------------------------------------------------------------------
+// Greptile review regressions (PR #159, head 647f081).
+// ---------------------------------------------------------------------------
+function fakeRegistry(framework) {
+    const routed = [];
+    framework.channelRegistry = new Proxy({
+        resolveLocus: () => 'world:test',
+        routeSpeech: async (_agent, speech) => {
+            routed.push(speech);
+            return { delivered: true, channelId: 'world:test' };
+        },
+        sendOutgoingChunk: () => { },
+        getDefaultPublishChannel: () => null, isChannelOpen: () => true,
+        getDescriptor: () => undefined, getChannelTools: () => [],
+    }, { get: (target, key) => key in target ? target[key] : () => undefined });
+    return routed;
+}
+test('failed audit sync fails closed: originals are never submitted', async () => {
+    const h = await harness([[calls('one'), answer()]], { toolResultGuard: true });
+    const store = h.framework.getStore();
+    const sync = store.sync.bind(store);
+    store.sync = () => {
+        if (h.framework.getAgent('assistant').toolResultGuard.hasPending)
+            throw new Error('disk full');
+        sync();
+    };
+    try {
+        await h.run();
+        const provided = JSON.stringify(h.membrane.streams[0].receivedToolResults);
+        assert.doesNotMatch(provided, /payload-one/, 'non-durable audit must not release originals');
+        assert.match(provided, /Tool result withheld by the guard/);
+        assert.equal(toolResults(h.framework)[0].content, TOOL_RESULT_GUARD_NOTICE);
+        const guard = h.framework.getAgent('assistant').toolResultGuard;
+        assert.equal(guard.hasPending, false);
+    }
+    finally {
+        store.sync = sync;
+        await h.framework.stop();
+    }
+});
+test('an aborted stream settles its submitted batch; the next turn neither resubmits nor claims it', async () => {
+    const h = await harness([[calls('one')], [refused()], [answer()]], {
+        toolResultGuard: true, refusalHandling: { autoRewind: true },
+    });
+    h.membrane.onSubmit = () => {
+        const stream = h.membrane.streams.at(-1);
+        queueMicrotask(() => stream.cancel());
+    };
+    try {
+        await h.run();
+        const guard = h.framework.getAgent('assistant').toolResultGuard;
+        assert.equal(guard.hasPending, false, 'aborted batch must not stay pending');
+        h.membrane.onSubmit = undefined;
+        await h.run();
+        assert.doesNotMatch(JSON.stringify(h.membrane.requests[1]), /payload-one/, 'old originals must not be resubmitted');
+        const messages = h.framework.getAgent('assistant').getContextManager().getAllMessages();
+        assert.match(JSON.stringify(messages), /\[refusal-rewind\]/, 'ordinary autoRewind must run');
+        const audit = h.framework.getStore().getStateJson(TOOL_RESULT_GUARD_AUDIT_STATE);
+        assert.ok(audit.some((r) => r.type === 'withheld' && r.reason === 'aborted'));
+    }
+    finally {
+        await h.framework.stop();
+    }
+});
+test('guard recovery keeps same-turn explicit-send suppression', async () => {
+    const h = await harness([[createMockResponse([
+                { type: 'tool_use', id: 'send', name: 'test--send_message', input: {} },
+                { type: 'tool_use', id: 'one', name: 'test--read', input: {} },
+            ], 'tool_use'), refused()], [createMockResponse([{ type: 'text', text: 'postscript' }])]], { toolResultGuard: true });
+    const routed = fakeRegistry(h.framework);
+    try {
+        await h.run();
+        assert.equal(h.membrane.requests.length, 2);
+        assert.ok(!routed.some((text) => text.includes('postscript')), `postscript routed: ${JSON.stringify(routed)}`);
+    }
+    finally {
+        await h.framework.stop();
+    }
+});
+test('a failed audit append while settling an aborted batch does not block teardown', async () => {
+    const h = await harness([[calls('one')], [answer()]], { toolResultGuard: true });
+    const store = h.framework.getStore();
+    const append = store.appendToStateJson.bind(store);
+    let failAborted = true;
+    store.appendToStateJson = (id, value) => {
+        if (failAborted && value?.reason === 'aborted')
+            throw new Error('storage down');
+        return append(id, value);
+    };
+    h.membrane.onSubmit = () => {
+        const stream = h.membrane.streams.at(-1);
+        queueMicrotask(() => stream.cancel());
+    };
+    try {
+        await h.run().catch(() => { });
+        assert.equal(h.framework.getAgent('assistant').toolResultGuard.hasPending, false);
+        failAborted = false;
+        h.membrane.onSubmit = undefined;
+        await h.run();
+        assert.equal(h.membrane.requests.length, 2, 'agent must accept a later turn after teardown');
+        assert.deepEqual(h.module.speeches.at(-1), 'continued');
+    }
+    finally {
+        store.appendToStateJson = append;
+        await h.framework.stop();
+    }
+});
+test('an aborted outcome that failed to append is recorded on the next guard write or stop', async () => {
+    const h = await harness([[calls('one')], [calls('two'), answer()]], { toolResultGuard: true });
+    const store = h.framework.getStore();
+    const append = store.appendToStateJson.bind(store);
+    let failAborted = true;
+    store.appendToStateJson = (id, value) => {
+        if (failAborted && value?.reason === 'aborted')
+            throw new Error('storage down');
+        return append(id, value);
+    };
+    h.membrane.onSubmit = () => {
+        const stream = h.membrane.streams.at(-1);
+        queueMicrotask(() => stream.cancel());
+    };
+    try {
+        await h.run().catch(() => { });
+        failAborted = false;
+        h.membrane.onSubmit = undefined;
+        await h.run();
+        const audit = store.getStateJson(TOOL_RESULT_GUARD_AUDIT_STATE);
+        const first = audit[0].batchId;
+        const outcome = audit.findIndex((r) => r.batchId === first && r.type === 'withheld' && r.reason === 'aborted');
+        assert.ok(outcome > 0, 'lost aborted outcome must be retried');
+        const nextStaged = audit.findIndex((r, i) => i > 0 && r.type === 'staged');
+        assert.ok(outcome < nextStaged, 'retried outcome lands before the next batch');
+    }
+    finally {
+        store.appendToStateJson = append;
+        await h.framework.stop();
+    }
+});
+test('a lost aborted outcome is flushed at stop', async () => {
+    const h = await harness([[calls('one')]], { toolResultGuard: true });
+    const store = h.framework.getStore();
+    const append = store.appendToStateJson.bind(store);
+    let failAborted = true;
+    store.appendToStateJson = (id, value) => {
+        if (failAborted && value?.reason === 'aborted')
+            throw new Error('storage down');
+        return append(id, value);
+    };
+    h.membrane.onSubmit = () => {
+        const stream = h.membrane.streams.at(-1);
+        queueMicrotask(() => stream.cancel());
+    };
+    let stopped = false;
+    try {
+        await h.run().catch(() => { });
+        failAborted = false;
+        const written = [];
+        store.appendToStateJson = (id, value) => {
+            if (id === TOOL_RESULT_GUARD_AUDIT_STATE)
+                written.push(value);
+            return append(id, value);
+        };
+        await h.framework.stop();
+        stopped = true;
+        assert.ok(written.some((r) => r.type === 'withheld' && r.reason === 'aborted'), 'outcome flushed at stop');
+    }
+    finally {
+        if (!stopped)
+            await h.framework.stop();
+    }
+});
+// ---------------------------------------------------------------------------
+// Compression holds (CM 0.12): real Autobiographical compression with the
+// guard on (Codex 09-26 P1 repro / review finding #3).
+// ---------------------------------------------------------------------------
+async function compressionRig() {
+    const { ContextManager, AutobiographicalStrategy } = await import('@animalabs/context-manager');
+    const { ToolResultGuard } = await import('../src/tool-result-guard.js');
+    const dir = mkdtempSync(join(tmpdir(), 'af-guard-compression-'));
+    dirs.push(dir);
+    const prompts = [];
+    const strategy = new AutobiographicalStrategy({
+        compressionModel: 'test-compression-model', targetChunkTokens: 50, headWindowTokens: 0,
+        recentWindowTokens: 0, autoTickOnNewMessage: false, minChunkCharsForLLM: 0, l1HoldbackChunks: 0,
+    });
+    const cm = await ContextManager.open({ path: join(dir, 'store'), strategy, membrane: {
+            complete: async (req) => {
+                prompts.push(JSON.stringify(req));
+                return { stopReason: 'end_turn', content: [{ type: 'text', text: `Summary #${prompts.length}` }] };
+            },
+        } });
+    cm.setToolDefinitions([{ name: 'search', description: 'search', inputSchema: { type: 'object', properties: {} } }]);
+    const filler = (n) => 'word '.repeat(n);
+    for (let i = 0; i < 6; i++)
+        cm.addMessage(i % 2 === 0 ? 'User' : 'Claude', [{ type: 'text', text: filler(30) }]);
+    cm.addMessage('Claude', [{ type: 'text', text: filler(20) }, { type: 'tool_use', id: 'tu-1', name: 'search', input: {} }]);
+    const guard = new ToolResultGuard('Claude', cm, true);
+    const REAL = 'REAL-ACCEPTED-TOOL-OUTPUT';
+    const content = [{ type: 'tool_result', toolUseId: 'tu-1', content: REAL }];
+    const messageId = guard.storeResults(content, [{ toolUseId: 'tu-1', content: REAL }], []);
+    // Deferred messages flushed right behind the staged batch push it out of
+    // the protected tail.
+    for (let i = 0; i < 6; i++)
+        cm.addMessage(i % 2 === 0 ? 'Claude' : 'User', [{ type: 'text', text: filler(30) }]);
+    const drain = async () => {
+        const s = strategy;
+        await cm.compile();
+        let n = 0;
+        while (s.compressionQueue.length > 0 && n++ < 50)
+            await cm.tick();
+    };
+    return { cm, guard, prompts, drain, messageId, REAL };
+}
+test('real compression: a pending batch is held; accepted output reaches memory, placeholder never does', async () => {
+    const r = await compressionRig();
+    try {
+        assert.deepEqual([...r.cm.getCompressionHolds()], [r.messageId], 'staged with a compression hold');
+        await r.drain();
+        assert.ok(r.prompts.length > 0, 'history before the hold still compresses');
+        assert.ok(!r.prompts.some((p) => p.includes(TOOL_RESULT_GUARD_NOTICE)), 'placeholder summarized while pending');
+        r.guard.submissionResults([{ toolUseId: 'tu-1', content: r.REAL }]);
+        r.guard.accept();
+        assert.equal(r.cm.getCompressionHolds().size, 0, 'accept releases the hold');
+        await r.drain();
+        assert.ok(r.prompts.some((p) => p.includes(r.REAL)), 'accepted output must reach the compression request');
+        assert.ok(!r.prompts.some((p) => p.includes(TOOL_RESULT_GUARD_NOTICE)), 'placeholder must never be summarized');
+    }
+    finally {
+        r.cm.close();
+    }
+});
+test('real compression: a withheld batch releases its hold and the placeholder compresses normally', async () => {
+    const r = await compressionRig();
+    try {
+        await r.drain();
+        r.guard.submissionResults([{ toolUseId: 'tu-1', content: r.REAL }]);
+        assert.ok(r.guard.withhold('test-category'));
+        assert.equal(r.cm.getCompressionHolds().size, 0, 'withhold releases the hold');
+        await r.drain();
+        assert.ok(r.prompts.some((p) => p.includes(TOOL_RESULT_GUARD_NOTICE)), 'placeholder compresses after release');
+        assert.ok(!r.prompts.some((p) => p.includes(r.REAL)), 'withheld output never reaches memory');
+    }
+    finally {
+        r.cm.close();
+    }
+});
+test('every settlement path releases the hold, even when the audit write fails', async () => {
+    const paths = [
+        ['accept-submitted', (g) => { g.submissionResults([{ toolUseId: 'tu-1', content: 'x' }]); g.accept(); }],
+        ['accept-unsubmitted', (g) => g.accept()],
+        ['withhold', (g) => { g.submissionResults([{ toolUseId: 'tu-1', content: 'x' }]); g.withhold('c'); }],
+        ['turn-ended', (g) => g.settleTurnEnded()],
+        ['unsubmitted', (g) => g.settleUnsubmitted('c')],
+        ['abandon', (g) => g.abandon('aborted')],
+    ];
+    for (const [name, settle] of paths) {
+        const r = await compressionRig();
+        try {
+            const store = r.cm.getStore();
+            store.appendToStateJson = () => { throw new Error('storage down'); };
+            try {
+                settle(r.guard);
+            }
+            catch { /* audit failure surfaces; hold must still go */ }
+            assert.equal(r.guard.hasPending, false, `${name}: batch cleared`);
+            assert.equal(r.cm.getCompressionHolds().size, 0, `${name}: hold released`);
+        }
+        finally {
+            r.cm.close();
+        }
+    }
+});
+for (const failedType of ['staged', 'linked']) {
+    test(`storage recovery: failed ${failedType} append continues with placeholders and releases the hold`, async () => {
+        const h = await harness([[calls('one'), answer()], [answer()]], { toolResultGuard: true });
+        const store = h.framework.getStore();
+        const append = store.appendToStateJson.bind(store);
+        let failing = true;
+        store.appendToStateJson = (id, value) => {
+            if (failing && id === TOOL_RESULT_GUARD_AUDIT_STATE && value?.type === failedType) {
+                throw new Error(`injected ${failedType} append failure`);
+            }
+            return append(id, value);
+        };
+        try {
+            await assert.doesNotReject(h.run(), 'storage failure must not strand the live tool loop');
+            const agent = h.framework.getAgent('assistant');
+            assert.equal(agent.state.status, 'idle');
+            assert.equal(agent.toolResultGuard.hasPending, false);
+            assert.equal(agent.getContextManager().getCompressionHolds().size, 0);
+            assert.match(JSON.stringify(h.membrane.streams[0].receivedToolResults), /Tool result withheld/);
+            assert.doesNotMatch(JSON.stringify(h.membrane.streams[0].receivedToolResults), /payload-one/);
+            failing = false;
+            await h.run(); // A normal activation, with no new tool call, retries the audit.
+            const records = store.getStateJson(TOOL_RESULT_GUARD_AUDIT_STATE);
+            assert.deepEqual(records.map((r) => r.type), ['staged', 'linked', 'withheld']);
+            assert.match(JSON.stringify(records[0]), /payload-one/, 'the original is recoverable after storage returns');
+            assert.doesNotMatch(JSON.stringify(h.membrane.requests[1]), /payload-one/);
+            assert.deepEqual(h.module.calls, ['one']);
+        }
+        finally {
+            store.appendToStateJson = append;
+            for (const stream of h.membrane.streams)
+                stream.cancel();
+            await h.framework.stop();
+        }
+    });
+}
+test('storage recovery: failed accepted edit is retried before the next activation without rerunning tools', async () => {
+    const h = await harness([[calls('one'), answer()], [answer()]], { toolResultGuard: true });
+    const agent = h.framework.getAgent('assistant');
+    const cm = agent.getContextManager();
+    const edit = cm.editMessage.bind(cm);
+    let failing = true;
+    cm.editMessage = (id, content) => {
+        if (failing && JSON.stringify(content).includes('payload-one'))
+            throw new Error('injected edit failure');
+        edit(id, content);
+    };
+    try {
+        await h.run();
+        assert.equal(agent.state.status, 'idle');
+        assert.equal(agent.toolResultGuard.hasPending, false, 'an accepted batch cannot claim another refusal');
+        assert.equal(cm.getCompressionHolds().size, 1, 'keep provisional history out of compression until repaired');
+        assert.equal(toolResults(h.framework)[0].content, TOOL_RESULT_GUARD_NOTICE);
+        assert.throws(() => agent.toolResultGuard.flushUnrecorded(), /injected edit failure/);
+        failing = false;
+        await h.run();
+        assert.match(JSON.stringify(h.membrane.requests[1]), /payload-one/, 'next activation must see the accepted result');
+        assert.equal(cm.getCompressionHolds().size, 0);
+        const records = h.framework.getStore().getStateJson(TOOL_RESULT_GUARD_AUDIT_STATE);
+        assert.equal(records.filter((r) => r.type === 'accepted').length, 1);
+        assert.deepEqual(h.module.calls, ['one']);
+        assert.equal(h.module.speeches.at(-1), 'continued');
+        assert.equal(cm.getAllMessages().filter((message) => message.participant === 'assistant'
+            && message.content.some((block) => block.type === 'text' && block.text === 'continued')).length, 2);
+    }
+    finally {
+        cm.editMessage = edit;
+        await h.framework.stop();
+    }
+});
+test('storage recovery: failed accepted edit stays held until the real compressor can see the original', async () => {
+    const r = await compressionRig();
+    const edit = r.cm.editMessage.bind(r.cm);
+    r.cm.editMessage = () => { throw new Error('injected edit failure'); };
+    try {
+        r.guard.submissionResults([{ toolUseId: 'tu-1', content: r.REAL }]);
+        assert.doesNotThrow(() => r.guard.accept());
+        assert.equal(r.cm.getCompressionHolds().size, 1);
+        await r.drain();
+        assert.ok(!r.prompts.some((p) => p.includes(TOOL_RESULT_GUARD_NOTICE)));
+        r.cm.editMessage = edit;
+        r.guard.flushUnrecorded();
+        assert.equal(r.cm.getCompressionHolds().size, 0);
+        await r.drain();
+        assert.ok(r.prompts.some((p) => p.includes(r.REAL)));
+        assert.ok(!r.prompts.some((p) => p.includes(TOOL_RESULT_GUARD_NOTICE)));
+    }
+    finally {
+        r.cm.editMessage = edit;
+        r.cm.close();
+    }
+});
+test('storage recovery: failed accepted edit and its audit outcome are repaired at stop', async () => {
+    const h = await harness([[calls('one'), answer()]], { toolResultGuard: true });
+    const cm = h.framework.getAgent('assistant').getContextManager();
+    const edit = cm.editMessage.bind(cm);
+    cm.editMessage = () => { throw new Error('injected edit failure'); };
+    let stopped = false;
+    try {
+        await h.run();
+        cm.editMessage = edit;
+        await h.framework.stop();
+        stopped = true;
+        const restarted = await AgentFramework.create(h.base);
+        try {
+            assert.match(String(toolResults(restarted)[0].content), /payload-one/);
+            const records = restarted.getStore().getStateJson(TOOL_RESULT_GUARD_AUDIT_STATE);
+            assert.equal(records.at(-1)?.type, 'accepted');
+        }
+        finally {
+            await restarted.stop();
+        }
+    }
+    finally {
+        cm.editMessage = edit;
+        if (!stopped)
+            await h.framework.stop();
+    }
+});
+test('storage recovery: endTurn never admits a batch whose audit sync failed', async () => {
+    const h = await harness([[calls('one')], [answer()]], { toolResultGuard: true }, {
+        one: { success: true, data: 'payload-one', endTurn: true },
+    });
+    const agent = h.framework.getAgent('assistant');
+    const store = h.framework.getStore();
+    const sync = store.sync.bind(store);
+    store.sync = () => {
+        if (agent.toolResultGuard.hasPending)
+            throw new Error('injected sync failure');
+        sync();
+    };
+    try {
+        await h.run();
+        assert.equal(toolResults(h.framework)[0].content, TOOL_RESULT_GUARD_NOTICE);
+        assert.equal(agent.getContextManager().getCompressionHolds().size, 0);
+        assert.equal(agent.toolResultGuard.hasPending, false);
+        store.sync = sync;
+        await h.run();
+        assert.doesNotMatch(JSON.stringify(h.membrane.requests[1]), /payload-one/);
+        const records = store.getStateJson(TOOL_RESULT_GUARD_AUDIT_STATE);
+        assert.equal(records.at(-1)?.type, 'withheld');
+        assert.match(JSON.stringify(records[0]), /payload-one/, 'the original is still archived');
+    }
+    finally {
+        store.sync = sync;
+        await h.framework.stop();
+    }
+});
+for (const supersedingAction of ['edit', 'branch']) {
+    test(`storage recovery: queued acceptance respects an operator ${supersedingAction}`, async () => {
+        const h = await harness([[calls('one'), answer()]], { toolResultGuard: true });
+        const agent = h.framework.getAgent('assistant');
+        const cm = agent.getContextManager();
+        const edit = cm.editMessage.bind(cm);
+        cm.editMessage = () => { throw new Error('injected edit failure'); };
+        try {
+            await h.run();
+            cm.editMessage = edit;
+            const result = cm.getAllMessages().find((message) => message.content.some((block) => block.type === 'tool_result'));
+            if (supersedingAction === 'edit') {
+                cm.editMessage(result.id, [{ type: 'tool_result', toolUseId: 'one', content: 'operator replacement' }]);
+            }
+            else {
+                await cm.fork('operator-branch');
+            }
+            agent.toolResultGuard.flushUnrecorded();
+            assert.equal(toolResults(h.framework)[0].content, supersedingAction === 'edit' ? 'operator replacement' : TOOL_RESULT_GUARD_NOTICE);
+            assert.equal(cm.getCompressionHolds().size, 0);
+            const records = h.framework.getStore().getStateJson(TOOL_RESULT_GUARD_AUDIT_STATE);
+            assert.equal(records.at(-1)?.historyUpdate, 'superseded');
+            assert.match(JSON.stringify(records[0]), /payload-one/, 'original audit remains intact');
+        }
+        finally {
+            cm.editMessage = edit;
+            await h.framework.stop();
+        }
+    });
+}
+test('storage recovery: idle maintenance retries acceptance without a new activation', async () => {
+    const h = await harness([[calls('one'), answer()]], { toolResultGuard: true });
+    const cm = h.framework.getAgent('assistant').getContextManager();
+    const edit = cm.editMessage.bind(cm);
+    cm.editMessage = () => { throw new Error('injected edit failure'); };
+    try {
+        await h.run();
+        assert.equal(cm.getCompressionHolds().size, 1);
+        cm.editMessage = edit;
+        h.framework.start();
+        await h.framework.maintenanceTick();
+        assert.equal(cm.getCompressionHolds().size, 0);
+        assert.match(String(toolResults(h.framework)[0].content), /payload-one/);
+        assert.equal(h.membrane.requests.length, 1);
+    }
+    finally {
+        cm.editMessage = edit;
+        await h.framework.stop();
+    }
+});
+test('storage recovery: shutdown retries edits queued by its terminating stream', async () => {
+    const h = await harness([[calls('one'), answer()]], { toolResultGuard: true });
+    const cm = h.framework.getAgent('assistant').getContextManager();
+    const edit = cm.editMessage.bind(cm);
+    let failOnce = true;
+    cm.editMessage = (id, content) => {
+        if (failOnce) {
+            failOnce = false;
+            throw new Error('injected edit failure');
+        }
+        edit(id, content);
+    };
+    let stopping;
+    h.membrane.onSubmit = () => { stopping = h.framework.stop(); };
+    try {
+        await h.run();
+        assert.ok(stopping);
+        await stopping;
+        const restarted = await AgentFramework.create(h.base);
+        try {
+            assert.match(String(toolResults(restarted)[0].content), /payload-one/);
+            const records = restarted.getStore().getStateJson(TOOL_RESULT_GUARD_AUDIT_STATE);
+            assert.equal(records.at(-1)?.type, 'accepted');
+        }
+        finally {
+            await restarted.stop();
+        }
+    }
+    finally {
+        cm.editMessage = edit;
+        if (stopping)
+            await stopping;
+        else
+            await h.framework.stop();
+    }
+});
+//# sourceMappingURL=tool-result-guard.test.js.map