@stigmer/react 3.3.0 → 3.4.0

package/src/cursor-accounts/__tests__/cursor-account-coverage.test.ts

@@ -0,0 +1,73 @@
+import { describe, it, expect } from "vitest";
+import { create } from "@bufbuild/protobuf";
+import {
+  CursorAccountSyncSnapshotSchema,
+  CursorMemberKeySchema,
+  CursorMemberSpendSchema,
+  CursorTeamMemberSchema,
+} from "@stigmer/protos/ai/stigmer/platform/cursoraccount/v1/cursor_account_pb";
+import {
+  CursorAccountViewSchema,
+  CursorMemberKeyState,
+  CursorMemberKeyViewSchema,
+  CursorTeamMemberViewSchema,
+} from "@stigmer/protos/ai/stigmer/platform/cursoraccount/v1/io_pb";
+import { deriveCoverage } from "../cursor-account-coverage";
+
+function keyView(keyId: string, state: CursorMemberKeyState) {
+  return create(CursorMemberKeyViewSchema, {
+    key: create(CursorMemberKeySchema, { keyId, boundEmail: `${keyId}@x.ai` }),
+    state,
+  });
+}
+
+describe("deriveCoverage", () => {
+  it("groups keys by server-computed state and passes coverage-gap rows through", () => {
+    const active = keyView("k-active", CursorMemberKeyState.member_key_active);
+    const removed = keyView("k-removed", CursorMemberKeyState.member_key_owner_removed);
+    const stranger = keyView("k-stranger", CursorMemberKeyState.member_key_owner_unknown);
+    const gap = create(CursorTeamMemberViewSchema, {
+      member: create(CursorTeamMemberSchema, { email: "uncovered@x.ai", role: "member" }),
+      spend: create(CursorMemberSpendSchema, { includedSpendUsdMicros: BigInt(42_000) }),
+    });
+
+    const coverage = deriveCoverage(
+      create(CursorAccountViewSchema, {
+        snapshot: create(CursorAccountSyncSnapshotSchema, { accountId: "acc-1" }),
+        keyViews: [active, removed, stranger],
+        membersWithoutKeysViews: [gap],
+      }),
+    );
+
+    expect(coverage.hasRoster).toBe(true);
+    expect(coverage.onTeamWithKey).toEqual([active]);
+    expect(coverage.onTeamWithoutKey).toEqual([gap]);
+    // Both "left the team" and "never on it" resolve the same way (a
+    // Cursor dashboard invite), so they share the category; the per-key
+    // state still distinguishes their labels.
+    expect(coverage.offTeamWithKey).toEqual([removed, stranger]);
+    expect(coverage.unclassified).toEqual([]);
+  });
+
+  it("withholds classification before the first sync — owner-unknown is missing data, not off-team", () => {
+    const key = keyView("k-1", CursorMemberKeyState.member_key_owner_unknown);
+
+    const coverage = deriveCoverage(
+      create(CursorAccountViewSchema, { keyViews: [key] }),
+    );
+
+    expect(coverage.hasRoster).toBe(false);
+    expect(coverage.unclassified).toEqual([key]);
+    expect(coverage.onTeamWithKey).toEqual([]);
+    expect(coverage.onTeamWithoutKey).toEqual([]);
+    expect(coverage.offTeamWithKey).toEqual([]);
+  });
+
+  it("handles the empty account (no keys, no roster) without inventing rows", () => {
+    const coverage = deriveCoverage(create(CursorAccountViewSchema, {}));
+
+    expect(coverage.hasRoster).toBe(false);
+    expect(coverage.unclassified).toEqual([]);
+    expect(coverage.onTeamWithKey).toEqual([]);
+  });
+});

package/src/cursor-accounts/badges.tsx

@@ -0,0 +1,26 @@
+import { cn } from "@stigmer/theme";
+
+/**
+ * Small tonal status badge shared by the cursor-accounts surfaces
+ * (account rows, coverage table cells). Internal to the module.
+ */
+export function StateBadge({
+  tone,
+  label,
+}: {
+  readonly tone: "ok" | "warn" | "muted";
+  readonly label: string;
+}) {
+  return (
+    <span
+      className={cn(
+        "inline-block rounded px-1.5 py-0.5 text-[10px] font-medium",
+        tone === "ok" && "bg-accent text-primary",
+        tone === "warn" && "bg-muted-subtle text-destructive",
+        tone === "muted" && "bg-muted-subtle text-muted-foreground",
+      )}
+    >
+      {label}
+    </span>
+  );
+}

package/src/cursor-accounts/cursor-account-coverage.ts

@@ -0,0 +1,71 @@
+import {
+  CursorMemberKeyState,
+  type CursorAccountView,
+  type CursorMemberKeyView,
+  type CursorTeamMemberView,
+} from "@stigmer/protos/ai/stigmer/platform/cursoraccount/v1/io_pb";
+
+/**
+ * The account's roster coverage, grouped for the operator table. Pure
+ * regrouping of server-computed facts — the membership classification
+ * (`CursorMemberKeyState`) and the spend joins are computed by the
+ * backend on read (the same email rule key selection uses); this module
+ * must never re-derive them from emails or role strings.
+ */
+export interface CursorAccountCoverage {
+  /**
+   * Whether a roster snapshot backs the classification. Before the first
+   * sync every key reports "owner unknown" — that is missing data, not
+   * "not on the team", so classification is withheld (`unclassified`)
+   * until a sync has run.
+   */
+  readonly hasRoster: boolean;
+  /** On the team, execution key held — the account's routable capacity. */
+  readonly onTeamWithKey: readonly CursorMemberKeyView[];
+  /**
+   * On the team, no execution key — the coverage gap. Sessions can never
+   * run under these members' identities or included quotas. Spend comes
+   * server-joined so the operator can prioritize whose key to import.
+   */
+  readonly onTeamWithoutKey: readonly CursorTeamMemberView[];
+  /**
+   * Key held, owner not on the team: either left it (roster role
+   * "removed") or never appeared in the roster — the per-key state
+   * distinguishes the two. Resolving this category means inviting the
+   * owner on the Cursor dashboard; the next sync reclassifies.
+   */
+  readonly offTeamWithKey: readonly CursorMemberKeyView[];
+  /** Every key, only while no roster snapshot exists (empty otherwise). */
+  readonly unclassified: readonly CursorMemberKeyView[];
+}
+
+/**
+ * Group one account view into the three coverage categories (plus the
+ * pre-first-sync "unclassified" holding state). Server order is
+ * preserved within each group.
+ */
+export function deriveCoverage(view: CursorAccountView): CursorAccountCoverage {
+  const hasRoster = view.snapshot !== undefined;
+
+  if (!hasRoster) {
+    return {
+      hasRoster,
+      onTeamWithKey: [],
+      onTeamWithoutKey: [],
+      offTeamWithKey: [],
+      unclassified: view.keyViews,
+    };
+  }
+
+  return {
+    hasRoster,
+    onTeamWithKey: view.keyViews.filter(
+      (kv) => kv.state === CursorMemberKeyState.member_key_active,
+    ),
+    onTeamWithoutKey: view.membersWithoutKeysViews,
+    offTeamWithKey: view.keyViews.filter(
+      (kv) => kv.state !== CursorMemberKeyState.member_key_active,
+    ),
+    unclassified: [],
+  };
+}

package/src/cursor-accounts/cursor-account-format.ts

@@ -2,7 +2,7 @@ import type { Timestamp } from "@bufbuild/protobuf/wkt";
 
 // BigInt literals (0n) require an ES2020 target, which not every consuming
 // app's tsconfig guarantees — the constructor form is target-agnostic (the
-// billing pricing-format precedent).
+// pricing-governance pricing-format precedent).
 const ZERO = BigInt(0);
 
 /**
@@ -27,3 +27,19 @@ export function formatSyncTime(ts: Timestamp | undefined): string {
     minute: "2-digit",
   });
 }
+
+/**
+ * Cursor's pool-usage percent (0–100, live-verified) to a display string
+ * (`26.97` → `"27%"`, `0` → `"0%"`).
+ *
+ * Zero renders as "0%", matching Cursor's own Members page. An earlier
+ * revision suppressed it on the theory that Cursor only omits percent
+ * fields on non-tiered teams (so a stored 0 meant "unreported") — live
+ * data falsified that: Cursor also omits them for zero-usage members on
+ * tiered Team plans, where its dashboard shows "0%". The "unreported"
+ * signal is the absence of the member's whole spend row (the caller's
+ * em-dash case), not a zero field inside one.
+ */
+export function formatPoolPercent(percent: number): string {
+  return `${Math.round(percent)}%`;
+}

package/src/datastore/CollectionRecordsBrowser.tsx

@@ -209,10 +209,22 @@ function RecordsPane({
   const canUpdate = verbs.has(DatastoreVerb.update);
   const canDelete = verbs.has(DatastoreVerb.delete);
 
+  // The caller's column-level read access (empty means every field): a
+  // field-restricted read grant returns only these fields, so the grid
+  // and the filter builder narrow to them — no permanently-empty
+  // columns, no filter the server would refuse (DD-008 invariant 2).
+  const readableFields = useMemo(
+    () => access?.access.find((a) => a.verb === DatastoreVerb.read)?.readableFields ?? [],
+    [access],
+  );
+
   const scope = { org, datastore: datastoreSlug, collection: collection.name, partition };
 
   const filter = useMemo(() => buildRecordFilter(conditions), [conditions]);
-  const columns = useMemo(() => buildRecordColumns(collection), [collection]);
+  const columns = useMemo(
+    () => buildRecordColumns(collection, readableFields),
+    [collection, readableFields],
+  );
 
   // Fetch only once read access is confirmed — the denied panel is the
   // primary render for deny-by-default, not a failed query.
@@ -297,6 +309,7 @@ function RecordsPane({
       <div className="flex flex-wrap items-center gap-2">
         <RecordFilterBuilder
           collection={collection}
+          readableFields={readableFields}
           conditions={conditions}
           onChange={onConditionsChange}
           className="min-w-0 flex-1"
@@ -435,9 +448,22 @@ function DeniedPanel({ message }: { readonly message: string }) {
  * (`id`, `updated_at`, `created_by`) stay out of the default grid —
  * they are shown in the record form's read-only summary; a column
  * toggle is recorded growth.
+ *
+ * `readableFields` narrows the declared columns to the caller's
+ * column-level read access (empty means every field): a hidden field's
+ * cells would be permanently empty, which reads as missing data rather
+ * than restricted access.
  */
-function buildRecordColumns(collection: CollectionDeclaration): RecordColumnDef[] {
-  const fieldColumns: RecordColumnDef[] = collection.fields.map((field) => ({
+function buildRecordColumns(
+  collection: CollectionDeclaration,
+  readableFields: readonly string[],
+): RecordColumnDef[] {
+  const readable = readableFields.length > 0 ? new Set(readableFields) : null;
+  const declaredColumns =
+    readable === null
+      ? collection.fields
+      : collection.fields.filter((field) => readable.has(field.name));
+  const fieldColumns: RecordColumnDef[] = declaredColumns.map((field) => ({
     id: field.name,
     header: field.name,
     sortable: isSortableField(field),

package/src/datastore/RecordFilterBuilder.tsx

@@ -29,6 +29,13 @@ import {
 export interface RecordFilterBuilderProps {
   /** The collection whose declared schema drives fields and operators. */
   readonly collection: CollectionDeclaration;
+  /**
+   * The caller's readable fields from `describeDatastore` (the read
+   * verb's `readable_fields`). Empty or omitted means every field.
+   * When restricted, unreadable fields are not offered — the server
+   * refuses conditions on them.
+   */
+  readonly readableFields?: readonly string[];
   /** Active conditions (AND-combined, per the DD-005 grammar). */
   readonly conditions: readonly RecordConditionDraft[];
   /** Called with the full condition set on add/remove/clear. */
@@ -54,11 +61,15 @@ export interface RecordFilterBuilderProps {
  */
 export function RecordFilterBuilder({
   collection,
+  readableFields,
   conditions,
   onChange,
   className,
 }: RecordFilterBuilderProps) {
-  const fields = useMemo(() => filterableFields(collection), [collection]);
+  const fields = useMemo(
+    () => filterableFields(collection, readableFields),
+    [collection, readableFields],
+  );
 
   const removeCondition = useCallback(
     (index: number) => onChange(conditions.filter((_, i) => i !== index)),

package/src/datastore/__tests__/CollectionRecordsBrowser.test.tsx

@@ -204,4 +204,42 @@ describe("CollectionRecordsBrowser — grid and affordances", () => {
       expect(screen.getByText(/No records in “bookings” yet/)).toBeTruthy(),
     );
   });
+
+  it("narrows the grid and filter builder to the caller's readable fields", async () => {
+    // A field-restricted read grant (readable_fields on the read verb):
+    // the server projects hidden fields out of every envelope and
+    // refuses conditions on them, so the grid must not show a
+    // permanently-empty column and the builder must not offer an
+    // unservable filter (DD-008 invariant 2).
+    const describeDatastore = vi.fn().mockResolvedValue(
+      create(DatastoreDescriptionSchema, {
+        datastore: "clinic",
+        collections: [
+          {
+            name: "bookings",
+            access: [{ verb: DatastoreVerb.read, readableFields: ["slot_date"] }],
+          },
+        ],
+      }),
+    );
+    const findRecords = vi.fn().mockResolvedValue(
+      create(RecordListSchema, {
+        records: [
+          create(RecordEnvelopeSchema, {
+            id: "dsr_1",
+            fields: { slot_date: "2026-07-22" } as never,
+          }),
+        ],
+        total: 1,
+      }),
+    );
+    renderBrowser({ describeDatastore, findRecords });
+
+    await waitFor(() => expect(screen.getByText("2026-07-22")).toBeTruthy());
+    expect(screen.getByRole("columnheader", { name: "slot_date" })).toBeTruthy();
+    expect(screen.queryByRole("columnheader", { name: "status" })).toBeNull();
+    // The filter builder's field narrowing under the same prop is
+    // pinned in RecordFilterBuilder.test.tsx (its harness mounts the
+    // provider the popover portal needs).
+  });
 });

package/src/datastore/__tests__/RecordFilterBuilder.test.tsx

@@ -27,11 +27,13 @@ const COLLECTION = create(CollectionDeclarationSchema, {
 function renderBuilder(
   conditions: readonly RecordConditionDraft[],
   onChange = vi.fn(),
+  readableFields?: readonly string[],
 ) {
   render(
     <StigmerProvider client={{} as never}>
       <RecordFilterBuilder
         collection={COLLECTION}
+        readableFields={readableFields}
         conditions={conditions}
         onChange={onChange}
       />
@@ -92,6 +94,18 @@ describe("RecordFilterBuilder — draft-then-apply popover", () => {
     expect(ops).toEqual(["=", "≠", ">", "≥", "<", "≤"]);
   });
 
+  it("narrows to the caller's readable fields; system fields stay offered", async () => {
+    // A field-restricted read grant (readable_fields on the read verb):
+    // the server refuses conditions on unreadable fields, so the
+    // builder must not offer them (DD-008 invariant 2).
+    renderBuilder([], vi.fn(), ["status"]);
+    fireEvent.click(screen.getByRole("button", { name: /Add filter/ }));
+
+    const fieldSelect = (await screen.findByLabelText(/Field/)) as HTMLSelectElement;
+    const fieldNames = Array.from(fieldSelect.options).map((o) => o.value);
+    expect(fieldNames).toEqual(["", "status", "id", "created_at", "updated_at"]);
+  });
+
   it("applies a complete draft and closes; incomplete drafts cannot apply", async () => {
     const onChange = renderBuilder([]);
     fireEvent.click(screen.getByRole("button", { name: /Add filter/ }));

package/src/datastore/__tests__/recordFilter.test.ts

@@ -56,6 +56,19 @@ describe("filterableFields", () => {
     const status = fields.find((f) => f.name === "status")!;
     expect(status.operators).toContain(RecordConditionOp.is_null);
   });
+
+  it("narrows to the caller's readable fields; system fields stay offered", () => {
+    // A field-restricted read grant: the server refuses conditions on
+    // unreadable fields, so the builder must not offer them.
+    const names = filterableFields(COLLECTION, ["status"]).map((f) => f.name);
+    expect(names).toEqual(["status", "id", "created_at", "updated_at"]);
+  });
+
+  it("empty readable_fields means unrestricted (the proto contract)", () => {
+    expect(filterableFields(COLLECTION, []).map((f) => f.name)).toEqual(
+      filterableFields(COLLECTION).map((f) => f.name),
+    );
+  });
 });
 
 describe("isConditionComplete", () => {

package/src/datastore/recordFilter.ts

@@ -66,12 +66,26 @@ export interface FilterableField {
  * fields. `id` conditions take string values; the audit timestamps take
  * RFC 3339 timestamps — both ride the `timestamp`/`string` value
  * controls.
+ *
+ * `readableFields` is the caller's column-level read access from
+ * `describeDatastore` (the read verb's `readable_fields`; empty means
+ * every field). When restricted, unreadable declared fields are not
+ * offered — the server refuses conditions on them (the existence-oracle
+ * guard), and the builder must stay structurally unable to express an
+ * unservable filter (DD-008 invariant 2). System fields are always
+ * readable and always offered.
  */
-export function filterableFields(collection: CollectionDeclaration): FilterableField[] {
+export function filterableFields(
+  collection: CollectionDeclaration,
+  readableFields?: readonly string[],
+): FilterableField[] {
+  const readable =
+    readableFields !== undefined && readableFields.length > 0 ? new Set(readableFields) : null;
   const declared: FilterableField[] = [];
   for (const field of collection.fields) {
     const operators = operatorsForField(field);
     if (operators.length === 0) continue; // json — not filterable
+    if (readable !== null && !readable.has(field.name)) continue; // not readable under the grant
     declared.push({ name: field.name, declaration: field, type: field.type, operators });
   }
   return [

package/src/execution/ExecutionProgress.tsx

@@ -1,6 +1,7 @@
 "use client";
 
 import type { AgentExecution } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import { ExecutionPhase } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import { cn } from "@stigmer/theme";
 import { ExecutionPhaseBadge } from "./ExecutionPhaseBadge.js";
 import { TodoList } from "./TodoList.js";
@@ -47,10 +48,19 @@ export function ExecutionProgress({
   if (phase === undefined) return null;
 
   const todos = execution.status?.todos;
-  // Populated by the server only on EXECUTION_FAILED — surface it next to the
-  // badge so this widget explains a failure rather than showing a bare phase
-  // (consistent with the failure reason in the message thread).
-  const error = execution.status?.error;
+  // Populated by the server on EXECUTION_FAILED and EXECUTION_TERMINATED —
+  // surface it next to the badge so this widget explains a failure rather
+  // than showing a bare phase (consistent with the message thread).
+  //
+  // CANCELLED is carved out: cancel is a quiet terminal state, not a failure
+  // (stigmer#282). A CANCELLED execution can still carry a non-empty error —
+  // cancel preserves a preexisting error by design, and an older server may
+  // have written a cancellation sentinel — so the phase, not the error field,
+  // decides whether to render the alert. The muted Cancelled badge suffices.
+  const error =
+    phase === ExecutionPhase.EXECUTION_CANCELLED
+      ? undefined
+      : execution.status?.error;
 
   return (
     <div

package/src/execution/MessageThread.tsx

@@ -941,12 +941,20 @@ export function buildThreadItems(
       key: `phase-${lastPhase}`,
     });
 
-    // The server populates `status.error` only on EXECUTION_FAILED. Surface it
+    // The server populates `status.error` on EXECUTION_FAILED and
+    // EXECUTION_TERMINATED — never on a user-initiated cancel. Surface it
     // beside the badge so a failure that produced no messages still explains
     // itself (the CLI shows this reason; the chat previously showed nothing).
     // Kept as its own item so the badge component stays presentational.
+    //
+    // CANCELLED is carved out: cancel is a quiet terminal state, not a failure
+    // (stigmer#282). A CANCELLED execution can still carry a non-empty error —
+    // cancel preserves a preexisting error by design (merge semantics), and an
+    // older server may have written a "Execution cancelled" sentinel — so the
+    // phase, not the error field, decides whether to render the loud banner.
+    // The muted Cancelled phase badge above remains the visible state.
     const reason = lastExec?.status?.error;
-    if (reason) {
+    if (reason && lastPhase !== ExecutionPhase.EXECUTION_CANCELLED) {
       const specMessage = lastExec?.spec?.message;
       // A failed build turn offers no inline Retry: resending its label as an
       // ordinary message would drop the buildFromPlan flag (no runner

package/src/execution/__tests__/ExecutionProgress.test.tsx

@@ -0,0 +1,67 @@
+import { describe, it, expect, afterEach } from "vitest";
+import { render, screen, cleanup } from "@testing-library/react";
+import { create } from "@bufbuild/protobuf";
+import {
+  AgentExecutionSchema,
+  AgentExecutionStatusSchema,
+  type AgentExecution,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import { ExecutionPhase } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+
+import { ExecutionProgress } from "../ExecutionProgress";
+
+afterEach(() => {
+  cleanup();
+});
+
+function makeExecution(phase: ExecutionPhase, error?: string): AgentExecution {
+  const exec = create(AgentExecutionSchema);
+  const status = create(AgentExecutionStatusSchema);
+  status.phase = phase;
+  if (error !== undefined) {
+    status.error = error;
+  }
+  exec.status = status;
+  return exec;
+}
+
+describe("ExecutionProgress", () => {
+  it("renders nothing without an execution", () => {
+    const { container } = render(<ExecutionProgress execution={null} />);
+    expect(container.innerHTML).toBe("");
+  });
+
+  it("surfaces the server error as an alert for a FAILED execution", () => {
+    render(
+      <ExecutionProgress
+        execution={makeExecution(
+          ExecutionPhase.EXECUTION_FAILED,
+          "Activity task timed out",
+        )}
+      />,
+    );
+
+    expect(screen.getByRole("alert").textContent).toContain(
+      "Activity task timed out",
+    );
+  });
+
+  // Cancelled is a quiet terminal state (stigmer#282): a CANCELLED execution
+  // can legitimately carry a non-empty status.error (preserved prior error, or
+  // a pre-fix server's "Execution cancelled" sentinel), so the phase — not the
+  // error field — decides whether the alert renders.
+  it("renders a CANCELLED execution quietly even when it carries an error", () => {
+    render(
+      <ExecutionProgress
+        execution={makeExecution(
+          ExecutionPhase.EXECUTION_CANCELLED,
+          "Execution cancelled",
+        )}
+      />,
+    );
+
+    expect(screen.getByText(/cancelled/i)).toBeTruthy();
+    expect(screen.queryByRole("alert")).toBeNull();
+    expect(screen.queryByText("Execution cancelled")).toBeNull();
+  });
+});

package/src/execution/__tests__/MessageThread.test.tsx

@@ -604,6 +604,50 @@ describe("MessageThread", () => {
     expect(screen.queryByText(/stale error/i)).toBeNull();
   });
 
+  // Cancelled is a quiet terminal state (stigmer#282): a user-initiated Stop
+  // must never render as a failure. A CANCELLED execution can legitimately
+  // carry a non-empty status.error — cancel preserves a preexisting error by
+  // design, and pre-fix servers wrote an "Execution cancelled" sentinel — so
+  // the phase, not the error field, decides whether the loud banner renders.
+  it("renders a CANCELLED execution quietly even when it carries a legacy error sentinel", () => {
+    const exec = makeExecution({
+      id: "exec-cancelled",
+      specMessage: "do the thing",
+      phase: ExecutionPhase.EXECUTION_CANCELLED,
+      error: "Execution cancelled",
+    });
+    const onRetryExecution = vi.fn();
+
+    render(
+      <MessageThread executions={[exec]} onRetryExecution={onRetryExecution} />,
+    );
+
+    // The muted phase badge is the visible cancelled state.
+    expect(screen.getByText(/cancelled/i)).toBeTruthy();
+
+    // No destructive banner, no error text, no Retry.
+    expect(screen.queryByRole("alert")).toBeNull();
+    expect(screen.queryByText("Execution cancelled")).toBeNull();
+    expect(screen.queryByRole("button", { name: /retry/i })).toBeNull();
+  });
+
+  it("renders a CANCELLED execution with a preserved prior error quietly", () => {
+    const exec = makeExecution({
+      id: "exec-cancelled-preserved",
+      phase: ExecutionPhase.EXECUTION_CANCELLED,
+      error: "Execution interrupted: agent was unresponsive. Retry or resume.",
+    });
+
+    render(<MessageThread executions={[exec]} />);
+
+    expect(screen.getByText(/cancelled/i)).toBeTruthy();
+    // Neither the loud alert framing nor the neutral interrupted/Resume
+    // framing may appear — the preserved error stays out of the transcript.
+    expect(screen.queryByText(/Execution interrupted/i)).toBeNull();
+    expect(screen.queryByRole("alert")).toBeNull();
+    expect(screen.queryByRole("button", { name: /resume/i })).toBeNull();
+  });
+
   it("offers a Retry that resends the originating message on failure", () => {
     const exec = makeExecution({
       id: "exec-retry",