@theoremjs/agents 0.3.0 → 0.3.1

package/esm/src/kernel/engine/runner/steps.js

@@ -1,45 +1,44 @@
+import { requestGivesCanary } from '../../../guardrails/canary.js';
+import { addRequestDestinations, addResultDestinations } from '../../../guardrails/destinations.js';
+import { TURN_REPLY } from '../../../guardrails/detect-reply.js';
 import { addRequestUrls } from '../../../guardrails/egress-urls.js';
 import { isAbortError, throwIfAborted } from '../../../guardrails/error.js';
 import { resolveGuardrailPolicy } from '../../../guardrails/policy.js';
+import { replyIsJudged } from '../../../guardrails/progressive-yield.js';
 import { recordTaint } from '../../../guardrails/tool-result.js';
+import { waitDefault } from '../../../providers/shared/retry.js';
+import { historyToolCalls } from '../../interaction-parts.js';
 import { profileTurnOutputs } from '../../registry/profile-outputs.js';
 import { providerCompleteRequest } from '../../registry/provider-request.js';
 import { injectWouldExceedMaxSteps } from '../../stages.js';
-import { profileAllowsInject, stageAbortStop } from '../../stop.js';
-import { failureEvent, toolCallRequestEvent } from '../../tools/events.js';
-import { executeRegisteredTool } from '../../tools/execute.js';
+import { AUTO_CONTINUE_DELAY_MS, isFailedStopKind, profileAllowsInject, profileTurnResumption, shouldAutoContinue, stageAbortStop, } from '../../stop.js';
+import { failedActivity, failureEvent, toolCallRequestEvent, } from '../../tools/events.js';
+import { executeRegisteredTool, shownToolArguments, } from '../../tools/execute.js';
 import { formatToolFailureForModel, formatToolResult } from '../../tools/model-text.js';
+import { profileToolsParallel } from '../../tools/resolve.js';
 import { findLast } from '../../util/find-last.js';
 import { startToolTrace } from '../tool-trace.js';
 import { startCallTrace } from '../turn-trace.js';
 import { applyStageInjects } from './stages.js';
 import { recordStepEvent } from './state.js';
-import { isWithheldOnBlock, yieldProviderEvents } from './stream.js';
+import { inStep, runSideBySide, stepOrder } from './step-order.js';
+import { isWithheldOnBlock, StructuredDrafts, yieldProviderEvents, } from './stream.js';
 import { callTokensEvent, observeCallEvent, startCallUsage } from './usage.js';
 function isStepLimitReached(step, maxSteps) {
-    if (maxSteps === undefined || maxSteps <= 0) {
-        return false;
-    }
-    return step >= maxSteps;
+    return maxSteps > 0 && step >= maxSteps;
 }
-function generationForProviderStep(generation, state) {
-    if (state.interactionsContinuation) {
-        const { previousInteractionId, messages } = state.interactionsContinuation;
-        state.interactionsContinuation = undefined;
-        return {
-            ...generation,
-            history: [],
-            input: [],
-            previousInteractionId,
-            continuation: [...messages],
-        };
-    }
-    return { ...generation, history: state.currentHistory };
+/** The step's generation: the turn's history so far, and no tools when the step must answer. */
+function generationForProviderStep(generation, state, answerOnly) {
+    const forStep = { ...generation, history: state.currentHistory };
+    if (!answerOnly)
+        return forStep;
+    return { ...forStep, builtins: [], tools: { ...generation.tools, wire: [] } };
 }
-function captureInteractionId(event, state) {
-    if ((event.type === 'tokens' || event.type === 'done') && event.interactionId) {
-        state.lastInteractionId = event.interactionId;
-    }
+/** True on the last step `maxSteps` allows, for a profile whose `atStepLimit` is `'answer'`. */
+function isAnswerOnlyStep(profile, generation, step) {
+    return (profile.type === 'text' &&
+        profile.turnBehaviour?.atStepLimit === 'answer' &&
+        isStepLimitReached(step, generation.maxSteps ?? 0));
 }
 /**
  * Hold the model's calls until its stream ends: a raw call, and a provider's
@@ -51,7 +50,6 @@ function holdModelCall(calls, tool) {
             name: tool.name,
             callId: tool.callId,
             arguments: tool.arguments,
-            ...(tool.thoughtSignature ? { thoughtSignature: tool.thoughtSignature } : {}),
         });
         return true;
     }
@@ -61,18 +59,20 @@ function holdModelCall(calls, tool) {
     call.failure = tool.failure;
     return true;
 }
-async function* executeAutonomousStep(args, state, buffer = {
-    holdLate: false,
-}) {
-    const { generation, system, provider, signal } = args;
-    const continuation = state.interactionsContinuation;
-    const usage = startCallUsage(system.text, continuation && state.lastCall
-        ? { previous: state.lastCall, continuation: continuation.messages }
-        : { history: state.currentHistory, input: generation.input });
+/** The step's request, with what it gives the model noted on `state`, and its call's usage and trace. */
+function startProviderCall(generation, system, state, answerOnly) {
+    const usage = startCallUsage(system.text, {
+        history: state.currentHistory,
+        input: generation.input,
+    });
     state.lastCall = usage;
-    const genForStep = generationForProviderStep(generation, state);
+    const genForStep = generationForProviderStep(generation, state, answerOnly);
     const request = providerCompleteRequest(state.tools, genForStep, system.text);
     addRequestUrls(state.givenUrls, request);
+    addRequestDestinations(state.destinations, request, state.givenUrls.own);
+    if (generation.canary && !state.canaryGiven) {
+        state.canaryGiven = requestGivesCanary(request, generation.canary, state.canaryScanned);
+    }
     state.trace.calls += 1;
     const call = startCallTrace((name, options) => state.trace.root.child(name, options), {
         req: request,
@@ -82,79 +82,202 @@ async function* executeAutonomousStep(args, state, buffer = {
         step: state.stepCount,
         attempt: state.trace.attempt,
     });
-    const calls = [];
-    let latestStructured;
-    // The stop this call ended with after gates: a canary block or provider
-    // error outranks what the provider reported.
-    let stop;
+    return { usage, genForStep, request, call };
+}
+/**
+ * True when the profile itself lists the stop in `turnBehaviour.resumption.autoContinue`.
+ *
+ * why: `DEFAULT_AUTO_CONTINUE` advises a host; a turn spends another model call only where the profile says so.
+ */
+function resendsFailedCall(profile, stop) {
+    const policy = profileTurnResumption(profile);
+    return policy?.autoContinue !== undefined && shouldAutoContinue(stop, policy);
+}
+/** The events that are a model call's reply, as opposed to its thoughts, usage, or failure. */
+const REPLY_EVENTS = new Set([
+    'text',
+    'media',
+    'structured',
+    'citation',
+]);
+/** Takes what an event says about the call itself. True when the event goes no further. */
+function tallyCallEvent(event, tally, call) {
+    if (event.type === 'error') {
+        tally.failures.push(event);
+        return true;
+    }
+    if (event.type === 'tool')
+        return holdModelCall(tally.calls, event.tool);
+    if (event.type === 'guardrail')
+        call.guardrail(event.guardrail);
+    if (event.type === 'structured')
+        tally.latestStructured = event.structured;
+    if (REPLY_EVENTS.has(event.type))
+        tally.replied = true;
+    return false;
+}
+/** Records an event the call gave. True when the host gets it now. */
+function releasesNow(event, control, state, buffer) {
+    recordStepEvent(event, state);
+    if (control.withholdVisible && isWithheldOnBlock(event)) {
+        // why: Progressive-yield blocked this attempt — keep events for egress/repair only.
+        // Record the decision so the attempt gate knows nothing reached the host.
+        state.withheldVisible = true;
+        return false;
+    }
+    if (event.type === 'text')
+        state.released += event.text;
+    // why: Text and media stream via progressive-yield under egress, thoughts
+    // stream unguarded; holdLate only buffers non-visible events (e.g.
+    // structured) for validation.
+    const isUserVisible = event.type === 'thought' || (!buffer.holdVisible && isWithheldOnBlock(event));
+    return !buffer.holdLate || isUserVisible;
+}
+// why: Every other kind is the provider's answer to the request itself (it refused a part, a key, a setting); the same call sent again gets the same answer.
+const PASSING_ERROR_KINDS = new Set([
+    'unavailable',
+    'bad_response',
+    'network',
+    'timeout',
+    'rate_limit',
+]);
+/**
+ * The re-send a finished call is due, if any.
+ *
+ * A failure the same call would meet again is not sent again (`PASSING_ERROR_KINDS`).
+ *
+ * why: A failed call that gave no reply and no tool call left nothing behind, so sending it again repeats
+ * nothing. A reply cut at `length` is not a failure: the same call would be cut at the same place.
+ */
+function resumeOf(mayResume, profile, tally) {
+    const { stop } = tally;
+    if (!mayResume || tally.replied || tally.calls.length > 0 || !stop)
+        return undefined;
+    if (!isFailedStopKind(stop.kind) || !resendsFailedCall(profile, stop))
+        return undefined;
+    const failure = tally.failures[0];
+    if (failure?.errorKind && !PASSING_ERROR_KINDS.has(failure.errorKind))
+        return undefined;
+    return { stop, failure };
+}
+/** Carries what the call's stream guards still hold into the turn's next call. */
+function keepStreamCarry(state, control) {
+    state.canaryCarry = control.canaryCarry;
+    state.thoughtCarry = control.thoughtCarry;
+    if (control.promptLeaks) {
+        state.promptLeaks = [...(state.promptLeaks ?? []), ...control.promptLeaks];
+    }
+}
+async function* executeAutonomousStep(args, state, buffer = {
+    holdLate: false,
+    holdVisible: false,
+}) {
+    const { profile, generation, system, provider, signal } = args;
+    const { usage, genForStep, request, call } = startProviderCall(generation, system, state, isAnswerOnlyStep(profile, generation, state.stepCount));
+    const tally = { calls: [], reasoning: [], failures: [], replied: false };
     const control = {
         withholdVisible: false,
         ...(state.canaryCarry ? { canaryCarry: state.canaryCarry } : {}),
         ...(state.thoughtCarry ? { thoughtCarry: state.thoughtCarry } : {}),
     };
+    const seen = {
+        profile: args.profile,
+        generation: genForStep,
+        privateSystem: system.private,
+        givenUrls: state.givenUrls,
+        canaryGiven: state.canaryGiven,
+        ...(state.ownTools ? { ownTools: state.ownTools } : {}),
+    };
+    const shown = new StructuredDrafts(seen);
     try {
         for await (const event of yieldProviderEvents({
-            profile: args.profile,
-            generation: genForStep,
+            ...seen,
             request,
-            privateSystem: system.private,
             provider,
             call,
             signal,
             control,
-            givenUrls: state.givenUrls,
+            tools: state.tools,
         })) {
-            captureInteractionId(event, state);
-            if (observeCallEvent(usage, event)) {
+            if (observeCallEvent(usage, event))
+                continue;
+            if (event.type === 'reasoning') {
+                const { type: _type, ...part } = event;
+                tally.reasoning.push(part);
                 continue;
-            }
-            if (event.type === 'guardrail') {
-                call.guardrail(event.guardrail);
-            }
-            if (event.type === 'structured') {
-                latestStructured = event.structured;
             }
             if (event.type === 'done') {
-                stop = event.stop;
+                state.providerState = event.providerState;
+                tally.stop = event.stop;
                 state.lastStop = event.stop;
                 continue;
             }
-            if (event.type === 'tool' && holdModelCall(calls, event.tool)) {
+            if (event.type === 'tool_draft') {
+                // why: A preview of the call that follows, which owns the arguments: not the turn's record. It streams
+                // as the reply's text does, through its own gate, and like that text is held only when delivery is buffered.
+                if (!buffer.holdVisible)
+                    yield event;
                 continue;
             }
-            recordStepEvent(event, state);
-            if (control.withholdVisible && isWithheldOnBlock(event)) {
-                // Progressive-yield blocked this attempt — keep events for egress/repair only.
-                // Record the decision so the attempt gate knows nothing reached the host.
-                state.withheldVisible = true;
+            if (tallyCallEvent(event, tally, call))
                 continue;
-            }
-            // Text and media stream via progressive-yield under egress, thoughts
-            // stream unguarded; holdLate only buffers non-visible events (e.g.
-            // structured) for validation.
-            const isUserVisible = event.type === 'thought' || event.type === 'text' || event.type === 'media';
-            const streamNow = !buffer.holdLate || isUserVisible;
-            if (streamNow) {
-                yield event;
-            }
+            if (!releasesNow(event, control, state, buffer))
+                continue;
+            yield* shown.show(event);
         }
     }
     catch (err) {
-        call.end(isAbortError(err) ? { stop: { kind: 'cancelled' } } : { stop, thrown: err });
+        call.end(isAbortError(err) ? { stop: { kind: 'cancelled' } } : { stop: tally.stop, thrown: err });
         throw err;
     }
-    state.canaryCarry = control.canaryCarry;
-    state.thoughtCarry = control.thoughtCarry;
-    if (control.promptLeaks) {
-        state.promptLeaks = [...(state.promptLeaks ?? []), ...control.promptLeaks];
+    yield* shown.end();
+    keepStreamCarry(state, control);
+    const resume = resumeOf(args.mayResume, profile, tally);
+    if (!resume) {
+        for (const failure of tally.failures) {
+            recordStepEvent(failure, state);
+            if (!buffer.holdLate)
+                yield failure;
+        }
     }
-    const tokens = await callTokensEvent(usage, generation, state.mediaFamily);
-    call.end({ tokens: tokens?.tokens, stop });
+    const tokens = await callTokensEvent(usage, generation);
+    call.end({ tokens: tokens?.tokens, stop: tally.stop });
     if (tokens) {
         recordStepEvent(tokens, state);
         yield tokens;
     }
-    return { calls, latestStructured };
+    return {
+        calls: tally.calls,
+        reasoning: tally.reasoning,
+        latestStructured: tally.latestStructured,
+        ...(resume ? { resume } : {}),
+    };
+}
+/**
+ * One step of a text turn. A model call that fails (`provider_error`,
+ * `stream_incomplete`) on a kind the profile's own `turnBehaviour.resumption.autoContinue`
+ * lists, having given no reply and no tool call, is sent again in the same turn
+ * after a pause, up to `maxContinues` times a turn (once when the profile sets
+ * none). The turn's history, its step count, and what it has read stay as they were.
+ */
+async function* executeResumedStep(args, state, buffer) {
+    const limit = profileTurnResumption(args.profile)?.maxContinues ?? 1;
+    for (;;) {
+        const mayResume = args.profile.type === 'text' && state.resumes < limit;
+        const outcome = yield* executeAutonomousStep({ ...args, mayResume }, state, buffer);
+        if (!outcome.resume)
+            return outcome;
+        state.resumes += 1;
+        const detail = outcome.resume.failure?.errorInternal ?? outcome.resume.failure?.error;
+        state.trace.root.event('theorem.step.resume', {
+            step: state.stepCount,
+            resume: state.resumes,
+            stop: outcome.resume.stop.kind,
+            ...(detail ? { error: detail } : {}),
+        });
+        state.lastStop = undefined;
+        await waitDefault(AUTO_CONTINUE_DELAY_MS, args.signal);
+    }
 }
 function toolResultMessage(call, result) {
     return {
@@ -170,41 +293,9 @@ function toolResultMessage(call, result) {
  * Providers read a step's calls together, then their results: Google rejects
  * a call replayed after an earlier call's result (probe 25/09/2026).
  */
-function stepCallsMessage(calls) {
-    return {
-        role: 'assistant',
-        tool_calls: calls.map((call) => ({
-            id: call.callId,
-            type: 'function',
-            function: { name: call.name, arguments: JSON.stringify(call.arguments) },
-            ...(call.thoughtSignature ? { thoughtSignature: call.thoughtSignature } : {}),
-        })),
-    };
-}
-/**
- * The stored interaction a step's results chain on, or `undefined` when they go
- * in history: the turn does not chain, or no interaction id arrived to chain on.
- */
-function chainedInteractionId(generation, state) {
-    return generation.chains
-        ? (state.lastInteractionId ?? generation.previousInteractionId)
-        : undefined;
-}
-function queueInteractionsToolContinuation(state, message, previousInteractionId) {
-    if (state.interactionsContinuation?.previousInteractionId === previousInteractionId) {
-        state.interactionsContinuation.messages.push(message);
-        return;
-    }
-    state.interactionsContinuation = { previousInteractionId, messages: [message] };
-}
-/** A call's result: chained on the stored interaction, else after the step's calls in history. */
-function recordToolModelResult(state, call, modelResult, chainOn) {
-    const message = toolResultMessage(call, modelResult);
-    if (chainOn) {
-        queueInteractionsToolContinuation(state, message, chainOn);
-        return;
-    }
-    state.currentHistory.push(message);
+/** Record the approved read-back in portable history. */
+function recordToolModelResult(state, call, modelResult) {
+    state.currentHistory.push(toolResultMessage(call, modelResult));
 }
 async function* forwardToolEvents(exec, state) {
     let next = await exec.next();
@@ -222,7 +313,7 @@ function toolSpanOpener(state) {
  * Settle a call the provider handed over already failed (malformed arguments,
  * no function name): nothing runs, and the model reads the failure back.
  */
-function recordProviderToolFailure(state, call, failure, chainOn) {
+function recordProviderToolFailure(state, call, failure) {
     const event = failureEvent(call, failure);
     state.allEmittedEvents.push(event);
     const modelResult = formatToolFailureForModel(failure);
@@ -236,10 +327,10 @@ function recordProviderToolFailure(state, call, failure, chainOn) {
         result: { text: formatToolResult(modelResult) },
         failure,
     });
-    recordToolModelResult(state, call, modelResult, chainOn);
+    recordToolModelResult(state, call, modelResult);
     return event;
 }
-function* applyToolSettlement(settlement, state, call, chainOn) {
+function* applyToolSettlement(settlement, state, call) {
     if (settlement.aborted) {
         state.lastStop = stageAbortStop(settlement.aborted);
         return 'stop_cancelled';
@@ -249,10 +340,14 @@ function* applyToolSettlement(settlement, state, call, chainOn) {
     }
     if (settlement.modelResult?.provenance) {
         state.taint = recordTaint(state.taint, settlement.modelResult.provenance, settlement.modelResult.suspicious);
+        addResultDestinations(state.destinations, settlement.modelResult, settlement.modelResult.provenance);
     }
     if (!settlement.modelResult)
         return 'continue';
-    recordToolModelResult(state, call, settlement.modelResult, chainOn);
+    if (!settlement.failure && 'outputRaw' in settlement) {
+        state.toolResults.push({ tool: call.name, output: settlement.outputRaw });
+    }
+    recordToolModelResult(state, call, settlement.modelResult);
     if (settlement.pendingInject) {
         yield* applyStageInjects(state, 'post_tool', settlement.pendingInject, {
             callId: call.callId,
@@ -262,68 +357,125 @@ function* applyToolSettlement(settlement, state, call, chainOn) {
     return 'continue';
 }
 /**
- * Run the model's calls in order. Each reaches the host as its raw call first,
- * then its phases. A call that gates waits for its own approval; the step's
- * other calls still run. After the step, any gate stops the turn.
+ * Run the model's calls. Each reaches the host as its raw call first, all of them before
+ * any runs; their phases then arrive as each tool gives them. With `tools.parallel` they
+ * run side by side; otherwise one at a time, in the order the model made them. A call
+ * whose `pre_tool` answers `waitFor` starts its body once those calls settle
+ * (`step-order.ts`). A call the provider handed over already failed does not run. A call
+ * reads the turn's taint, destinations, and visible tools as they stood when the step
+ * began: the model chose every call in the step before any of their results came back.
+ *
+ * Results are recorded in the order the model made the calls, each followed by its
+ * `post_tool` inject. A call that gates waits for its own approval while the others run.
+ * After the step, any gate stops the turn. A call a stage cancelled stops the turn too,
+ * once every result that did come back is recorded.
  */
-async function* handleModelCalls(calls, generation, profile, state, { onStage, signal, credentials, resolveHost } = {}) {
-    const chainOn = chainedInteractionId(generation, state);
-    if (!chainOn && calls.length > 0) {
-        state.currentHistory.push(stepCallsMessage(calls));
+async function* handleModelCalls({ calls: upstreamCalls, reasoning }, generation, profile, state, system, { onStage, signal, credentials, resolveHost } = {}) {
+    if (upstreamCalls.length > 0) {
+        state.currentHistory.push(historyToolCalls(upstreamCalls.map((call, index) => (index === 0 ? { ...call, reasoning } : call))));
     }
-    // One id for every call this model response made.
     const stepId = crypto.randomUUID();
-    const announce = (call) => {
-        const request = toolCallRequestEvent(call, call.arguments, {
-            thoughtSignature: call.thoughtSignature,
+    const leakScope = {
+        canary: generation.canary,
+        canaryGiven: state.canaryGiven,
+        privateSystem: system.private,
+    };
+    const calls = upstreamCalls.map((call) => ({
+        ...call,
+        operationId: crypto.randomUUID(),
+        // why: The host and every `pre_tool` see the call as its tool gets it; a failed call never reaches a tool.
+        shown: call.failure
+            ? call.arguments
+            : shownToolArguments({
+                tools: state.tools,
+                profile,
+                name: call.name,
+                input: call.arguments,
+                scope: leakScope,
+            }),
+    }));
+    for (const [index, call] of calls.entries()) {
+        const request = toolCallRequestEvent(call, call.shown, {
+            ...(index === 0 && reasoning.length ? { reasoning } : {}),
             stepId,
+            stepCallCount: calls.length,
         });
         state.allEmittedEvents.push(request);
-        return request;
+        yield request;
+    }
+    const order = stepOrder(calls.map((call) => call.callId), profileToolsParallel(profile) === true, signal);
+    const stages = {
+        handlers: onStage ? [onStage] : [],
+        profile,
+        step: state.stepCount,
+        history: () => state.currentHistory,
+        injectAllowed: profileAllowsInject(profile),
+        injectWouldExceedMaxSteps: injectWouldExceedMaxSteps(state.stepCount, generation.maxSteps),
+        host: generation.host,
+        signal,
+        stepCalls: calls.map((call) => ({ callId: call.callId, tool: call.name, input: call.shown })),
+        wait: order.wait,
+        drafts: generation.stream !== false,
     };
-    let gated = false;
+    const turn = {
+        step: state.stepCount,
+        taint: state.taint,
+        destinations: state.destinations,
+        visible: [...generation.tools.visible],
+    };
+    const execute = (call) => forwardToolEvents(executeRegisteredTool({
+        tools: state.tools,
+        execution: generation.execution,
+        invocation: {
+            model: generation.model,
+            input: generation.input,
+            history: generation.history,
+        },
+        ...(state.agents ? { agents: state.agents } : {}),
+        profile,
+        name: call.name,
+        input: call.arguments,
+        callId: call.callId,
+        ctx: {
+            operationId: call.operationId,
+            pageExecution: generation.pageExecution,
+            sessionPermissions: generation.sessionPermissions,
+            path: generation.tools.path,
+            turn,
+            credentials,
+            resolveHost,
+            host: generation.host,
+            resume: undefined,
+            signal,
+        },
+        snapshot: generation.tools,
+        stages,
+        scope: leakScope,
+        openSpan: toolSpanOpener(state),
+    }), state);
     for (const call of calls) {
-        yield announce(call);
+        if (call.failure)
+            order.settle(call.callId);
+    }
+    const settlements = yield* runSideBySide(calls.map((call) => call.failure ? undefined : inStep(order, call.callId, () => execute(call))));
+    let gated = false;
+    let cancelled = false;
+    for (const [index, call] of calls.entries()) {
         if (call.failure) {
-            yield recordProviderToolFailure(state, call, call.failure, chainOn);
+            yield recordProviderToolFailure(state, { ...call, activityFailed: failedActivity(call.name, profile.labels) }, call.failure);
             continue;
         }
-        const stages = {
-            handlers: onStage ? [onStage] : [],
-            profile,
-            step: state.stepCount,
-            history: () => state.currentHistory,
-            injectAllowed: profileAllowsInject(profile),
-            injectWouldExceedMaxSteps: injectWouldExceedMaxSteps(state.stepCount, generation.maxSteps),
-            host: generation.host,
-            signal,
-        };
-        const settlement = yield* forwardToolEvents(executeRegisteredTool({
-            tools: state.tools,
-            profile,
-            name: call.name,
-            input: call.arguments,
-            callId: call.callId,
-            ctx: {
-                sessionPermissions: generation.sessionPermissions,
-                path: generation.tools.path,
-                turn: { step: state.stepCount, taint: state.taint },
-                credentials,
-                resolveHost,
-                host: generation.host,
-                resume: undefined,
-                signal,
-            },
-            snapshot: generation.tools,
-            stages,
-            openSpan: toolSpanOpener(state),
-        }), state);
-        const outcome = yield* applyToolSettlement(settlement, state, call, chainOn);
+        const settlement = settlements[index];
+        if (!settlement)
+            continue;
+        const outcome = yield* applyToolSettlement(settlement, state, call);
         if (outcome === 'stop_cancelled')
-            return false;
+            cancelled = true;
         if (outcome === 'gated')
             gated = true;
     }
+    if (cancelled)
+        return false;
     if (gated) {
         state.lastStop = { kind: 'gate' };
         return false;
@@ -333,27 +485,34 @@ async function* handleModelCalls(calls, generation, profile, state, { onStage, s
 async function* executeAttempt(args) {
     const { profile, generation, system, provider, state } = args;
     let latestStructured;
-    // Text streams via progressive-yield under egress, thoughts unguarded; validation and egress
+    // why: Text streams via progressive-yield under egress, thoughts unguarded; validation and egress
     // both hold non-visible events (structured) until the attempt gate, so a policy
     // sees the structured payload before any of it reaches the host.
-    const holdLate = Boolean(profileTurnOutputs(profile)?.validation ||
-        resolveGuardrailPolicy(profile.guardrails).egress?.enforce);
-    // Ceiling is cumulative `state.stepCount` across before_end inject re-entries
+    const validation = profileTurnOutputs(profile)?.validation;
+    const holdLate = validation !== undefined ||
+        replyIsJudged(resolveGuardrailPolicy(profile.guardrails), TURN_REPLY);
+    // why: Buffered delivery holds each attempt's text and media until it passes; streamed delivery shows them live.
+    const holdVisible = validation !== undefined && generation.stream === false;
+    // why: Ceiling is cumulative `state.stepCount` across before_end inject re-entries
     // within this attempt. Validation/egress repair resets stepCount at the start
     // of each attempt cycle.
     while (!isStepLimitReached(state.stepCount, generation.maxSteps ?? 0)) {
         throwIfAborted(args.safe.signal);
         state.stepCount++;
-        // Mid-loop inject lives on `post_tool` (after tools). Opening inject is `pre_turn`
+        // why: Mid-loop inject lives on `post_tool` (after tools). Opening inject is `pre_turn`
         // outside this loop.
-        const stepResult = yield* executeAutonomousStep({ profile, generation, system, provider, signal: args.safe.signal }, state, { holdLate });
+        const stepResult = yield* executeResumedStep({ profile, generation, system, provider, signal: args.safe.signal }, state, { holdLate, holdVisible });
         if (stepResult.latestStructured !== undefined) {
             latestStructured = stepResult.latestStructured;
         }
-        const executed = yield* handleModelCalls(stepResult.calls, generation, profile, state, args.safe);
+        const executed = yield* handleModelCalls(stepResult, generation, profile, state, system, args.safe);
         if (!executed) {
             break;
         }
+        // why: The tools ran and no step is left to read them, so the turn has no answer.
+        if (isStepLimitReached(state.stepCount, generation.maxSteps ?? 0)) {
+            state.lastStop = { kind: 'step_limit' };
+        }
     }
     return { latestStructured };
 }