@stigmer/runner 3.15.3-dev.20260914100347 → 3.15.3-dev.20260916211208

package/src/activities/execute-cursor/__tests__/hitl-ledger.test.ts

@@ -1,5 +1,9 @@
 /**
- * @regression file-hitl-phase0 — pins file-edit HITL fixes #1, #2, #3, #5 (see _projects/2026-06/20260630.01.file-change-hitl-redesign/tasks/T01_3_regression-manifest.md)
+ * @regression file-hitl-phase0 — pins four rules of the file-edit gate: one
+ * approval gate per turn (a distinct co-pending sibling defers to SKIPPED);
+ * decisions bind to the active turn's ledger, never a stale one; the executed
+ * capture supersedes the model's proposal; the hook-captured input is
+ * authoritative over the streamed snapshot.
  *
  * Unit tests for the Cursor-harness HITL denial-ledger flow.
  *
@@ -61,11 +65,12 @@ import {
   reconcileDeniedToolCalls,
   clearProvisionalPostDenialNarration,
   collapseRedundantToolCallTwins,
-  toolCallIdentityToken,
   detectUnattributedHookBlocks,
   stampUnattendedSkippedToolCalls,
   HOOK_BLOCK_ERROR_MARKERS,
-} from "../message-translator.js";
+} from "../boundary-rows.js";
+import { builderOver } from "../__test-utils__/fold.js";
+import { toolCallIdentityToken } from "../approval-state.js";
 import { mockWorkspaceBackend } from "../../../__test-utils__/mock-workspace.js";
 import type { WorkspaceBackend } from "../../../shared/workspace/types.js";
 import { generateHookScript } from "../hook-script.js";
@@ -240,7 +245,7 @@ describe("reconcileDeniedToolCalls", () => {
     });
     const messages = [aiMessageWith([tc])];
 
-    const reconciled = await reconcileDeniedToolCalls(messages, [
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages), [
       { toolName: "Write", token: grantToken("write", "gated.txt") },
     ]);
 
@@ -279,7 +284,7 @@ describe("reconcileDeniedToolCalls", () => {
     ]);
 
     // MCP tools are keyed name-only (their name is consistent across layers).
-    await reconcileDeniedToolCalls(messages, [
+    await reconcileDeniedToolCalls(messages, builderOver(messages), [
       { toolName: "apply_x", token: grantToken("apply_x", "") },
     ], policies);
 
@@ -302,7 +307,7 @@ describe("reconcileDeniedToolCalls", () => {
     });
     const messages = [aiMessageWith([denied, allowed])];
 
-    const reconciled = await reconcileDeniedToolCalls(messages, [
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages), [
       { toolName: "Write", token: grantToken("write", "gated.txt") },
     ]);
 
@@ -323,7 +328,7 @@ describe("reconcileDeniedToolCalls", () => {
     const second = toolCall({ id: "c2", name: "edit", args: { path: "gated.txt" } });
     const messages = [aiMessageWith([first, second])];
 
-    const reconciled = await reconcileDeniedToolCalls(messages, [
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages), [
       { toolName: "Write", token: grantToken("write", "gated.txt") },
     ]);
 
@@ -344,7 +349,7 @@ describe("reconcileDeniedToolCalls", () => {
   it("synthesizes a WAITING_APPROVAL tool call when a denial produced no stream event", async () => {
     const messages = [aiMessageWith([])];
 
-    const reconciled = await reconcileDeniedToolCalls(messages, [
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages), [
       { toolName: "Shell", token: grantToken("shell", "rm -rf build") },
     ]);
 
@@ -363,7 +368,7 @@ describe("reconcileDeniedToolCalls", () => {
   it("is a no-op when the ledger is empty", async () => {
     const tc = toolCall({ id: "c1", status: ToolCallStatus.TOOL_CALL_COMPLETED });
     const messages = [aiMessageWith([tc])];
-    expect(await reconcileDeniedToolCalls(messages, [])).toEqual([]);
+    expect(await reconcileDeniedToolCalls(messages, builderOver(messages), [])).toEqual([]);
     expect(tc.status).toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
   });
 });
@@ -391,8 +396,7 @@ describe("reconcileDeniedToolCalls — duplicate denial-twin collapse", () => {
     });
     const messages = [aiMessageWith([gate, twin])];
 
-    const reconciled = await reconcileDeniedToolCalls(
-      messages,
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{ toolName: "Write", token: grantToken("write", "notes.md") }],
       undefined,
       rootBackend(),
@@ -432,8 +436,7 @@ describe("reconcileDeniedToolCalls — duplicate denial-twin collapse", () => {
     });
     const messages = [aiMessageWith([gate, twin])];
 
-    const reconciled = await reconcileDeniedToolCalls(
-      messages,
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{ toolName: "Shell", token: grantToken("shell", "rm -rf build") }],
       undefined,
       rootBackend(),
@@ -470,8 +473,7 @@ describe("reconcileDeniedToolCalls — duplicate denial-twin collapse", () => {
     });
     const messages = [aiMessageWith([gateA, gateB])];
 
-    const reconciled = await reconcileDeniedToolCalls(
-      messages,
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages),
       [
         // The hook records the content-exact token for an edit (its primary token).
         { toolName: "Write", token: toolCallIdentityToken(gateA) },
@@ -508,8 +510,7 @@ describe("reconcileDeniedToolCalls — duplicate denial-twin collapse", () => {
     });
     const messages = [aiMessageWith([gate, twin])];
 
-    await reconcileDeniedToolCalls(
-      messages,
+    await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{ toolName: "Write", token: grantToken("write", "notes.md") }],
       undefined,
       rootBackend(),
@@ -552,8 +553,7 @@ describe("reconcileDeniedToolCalls — one gate per turn (deny-only workaround)"
     });
     const messages = [aiMessageWith([edit, shell])];
 
-    const reconciled = await reconcileDeniedToolCalls(
-      messages,
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages),
       [
         { toolName: "Write", token: grantToken("write", "notes.md") },
         { toolName: "Shell", token: grantToken("shell", "cat > notes.md") },
@@ -595,8 +595,7 @@ describe("reconcileDeniedToolCalls — one gate per turn (deny-only workaround)"
     });
     const messages = [aiMessageWith([edit]), aiMessageWith([shell])];
 
-    const reconciled = await reconcileDeniedToolCalls(
-      messages,
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages),
       [
         { toolName: "Write", token: grantToken("write", "notes.md") },
         { toolName: "Shell", token: grantToken("shell", "cat > notes.md") },
@@ -631,8 +630,7 @@ describe("reconcileDeniedToolCalls — one gate per turn (deny-only workaround)"
     });
     const messages = [aiMessageWith([shell, edit])];
 
-    const reconciled = await reconcileDeniedToolCalls(
-      messages,
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages),
       [
         { toolName: "Shell", token: toolCallIdentityToken(shell) },
         { toolName: "Write", token: toolCallIdentityToken(edit) },
@@ -666,8 +664,7 @@ describe("reconcileDeniedToolCalls — one gate per turn (deny-only workaround)"
     });
     const messages = [aiMessageWith([mcp, edit])];
 
-    const reconciled = await reconcileDeniedToolCalls(
-      messages,
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages),
       [
         { toolName: "fetch", token: toolCallIdentityToken(mcp) },
         { toolName: "Write", token: toolCallIdentityToken(edit) },
@@ -692,8 +689,7 @@ describe("reconcileDeniedToolCalls — one gate per turn (deny-only workaround)"
     });
     const messages = [aiMessageWith([edit])];
 
-    const reconciled = await reconcileDeniedToolCalls(
-      messages,
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{ toolName: "Write", token: grantToken("write", "notes.md") }],
       undefined,
       rootBackend(),
@@ -725,8 +721,7 @@ describe("reconcileDeniedToolCalls — one gate per turn (deny-only workaround)"
     });
     const messages = [aiMessageWith([edit, shell])];
 
-    const reconciled = await reconcileDeniedToolCalls(
-      messages,
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages),
       [
         { toolName: "Write", token: grantToken("write", "notes.md") },
         { toolName: "Shell", token: grantToken("shell", "cat > notes.md") },
@@ -801,8 +796,7 @@ describe("reconcileDeniedToolCalls — interrupted non-terminal rows (raced work
     ];
 
     // Only the anchor's denial is in the ledger — the workaround's raced it.
-    const reconciled = await reconcileDeniedToolCalls(
-      messages,
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{ toolName: "Shell", token: toolCallIdentityToken(anchor) }],
       undefined,
       rootBackend(),
@@ -848,8 +842,7 @@ describe("reconcileDeniedToolCalls — interrupted non-terminal rows (raced work
       create(AgentMessageSchema, { type: MessageType.MESSAGE_AI, content: "trailing reaction" }),
     ];
 
-    const reconciled = await reconcileDeniedToolCalls(
-      messages,
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{ toolName: "Shell", token: toolCallIdentityToken(anchor) }],
       undefined,
       rootBackend(),
@@ -1066,8 +1059,7 @@ describe("reconcileDeniedToolCalls — authoritative hook input overlay", () =>
     });
     const messages = [aiMessageWith([tc])];
 
-    await reconcileDeniedToolCalls(
-      messages,
+    await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{
         toolName: "Write",
         token: grantToken("write", "src/new.ts"),
@@ -1097,8 +1089,7 @@ describe("reconcileDeniedToolCalls — authoritative hook input overlay", () =>
     });
     const messages = [aiMessageWith([tc])];
 
-    await reconcileDeniedToolCalls(
-      messages,
+    await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{
         toolName: "Write",
         token: grantToken("write", ".env"),
@@ -1122,8 +1113,7 @@ describe("reconcileDeniedToolCalls — authoritative hook input overlay", () =>
     });
     const messages = [aiMessageWith([tc])];
 
-    await reconcileDeniedToolCalls(
-      messages,
+    await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{
         toolName: "StrReplace",
         token: grantToken("write", "src/app.ts"),
@@ -1147,8 +1137,7 @@ describe("reconcileDeniedToolCalls — authoritative hook input overlay", () =>
     });
     const messages = [aiMessageWith([tc])];
 
-    await reconcileDeniedToolCalls(
-      messages,
+    await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{
         toolName: "EditNotebook",
         token: grantToken("write", "nb.ipynb"),
@@ -1170,8 +1159,7 @@ describe("reconcileDeniedToolCalls — authoritative hook input overlay", () =>
     });
     const messages = [aiMessageWith([tc])];
 
-    await reconcileDeniedToolCalls(
-      messages,
+    await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{
         toolName: "Shell",
         token: grantToken("shell", "rm -rf build"),
@@ -1190,8 +1178,7 @@ describe("reconcileDeniedToolCalls — authoritative hook input overlay", () =>
     // proposed content from the captured input, not a bare {path}.
     const messages = [aiMessageWith([])];
 
-    const reconciled = await reconcileDeniedToolCalls(
-      messages,
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{
         toolName: "Write",
         token: grantToken("write", "ghost.md"),
@@ -1217,8 +1204,7 @@ describe("reconcileDeniedToolCalls — authoritative hook input overlay", () =>
     });
     const messages = [aiMessageWith([tc])];
 
-    await reconcileDeniedToolCalls(
-      messages,
+    await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{
         toolName: "Write",
         token: grantToken("write", "big.ts"),
@@ -1259,8 +1245,7 @@ describe("reconcileDeniedToolCalls — normalized-path fallback (abs/rel drift)"
     });
     const messages = [aiMessageWith([streamed])];
 
-    const reconciled = await reconcileDeniedToolCalls(
-      messages,
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{ toolName: "Write", token: grantToken("write", "/root/notes.md") }],
       undefined,
       rootBackend(),
@@ -1288,8 +1273,7 @@ describe("reconcileDeniedToolCalls — normalized-path fallback (abs/rel drift)"
     });
     const messages = [aiMessageWith([streamed])];
 
-    await reconcileDeniedToolCalls(
-      messages,
+    await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{ toolName: "Write", token: grantToken("write", "/root/src/app.ts") }],
       undefined,
       rootBackend(),
@@ -1304,8 +1288,7 @@ describe("reconcileDeniedToolCalls — normalized-path fallback (abs/rel drift)"
     // The genuine no-stream-event denial (rare) must still surface a gate.
     const messages = [aiMessageWith([])];
 
-    const reconciled = await reconcileDeniedToolCalls(
-      messages,
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{ toolName: "Write", token: grantToken("write", "/root/ghost.md") }],
       undefined,
       rootBackend(),
@@ -1327,8 +1310,7 @@ describe("reconcileDeniedToolCalls — normalized-path fallback (abs/rel drift)"
     });
     const messages = [aiMessageWith([streamed])];
 
-    const reconciled = await reconcileDeniedToolCalls(
-      messages,
+    const reconciled = await reconcileDeniedToolCalls(messages, builderOver(messages),
       [{ toolName: "Write", token: grantToken("write", "/root/notes.md") }],
       undefined,
       rootBackend(),
@@ -1566,7 +1548,7 @@ describe("first-denial stop contract", () => {
     expect(messages.some((m) => m.content.includes("try the shell"))).toBe(false);
 
     // Phase 12 reconcile + redact on the stopped transcript yields the clean shape.
-    const denied = await reconcileDeniedToolCalls(messages, await readDenialLedger(ws));
+    const denied = await reconcileDeniedToolCalls(messages, builderOver(messages), await readDenialLedger(ws));
     expect(denied).toHaveLength(1);
     expect(edit.status).toBe(ToolCallStatus.TOOL_CALL_WAITING_APPROVAL);
     const redacted = clearProvisionalPostDenialNarration(messages, denied);
@@ -1610,7 +1592,8 @@ describe("first-denial stop contract", () => {
     expect(cancelled).toBe(false);
     expect(consumed).toBe(3); // the whole turn is consumed
     // And the boundary reconcile manufactures no gate from it either.
-    const denied = await reconcileDeniedToolCalls([], await readDenialLedger(ws));
+    const messages: AgentMessage[] = [];
+    const denied = await reconcileDeniedToolCalls(messages, builderOver(messages), await readDenialLedger(ws));
     expect(denied).toEqual([]);
   });
 
@@ -1641,7 +1624,7 @@ describe("first-denial stop contract", () => {
 
     // Phase 12 on the stopped transcript: the anchor gates, and the one raced
     // reaction message is blanked by the trim backstop.
-    const denied = await reconcileDeniedToolCalls(messages, await readDenialLedger(ws), undefined, rootBackend());
+    const denied = await reconcileDeniedToolCalls(messages, builderOver(messages), await readDenialLedger(ws), undefined, rootBackend());
     expect(denied).toHaveLength(1);
     expect(shell.status).toBe(ToolCallStatus.TOOL_CALL_WAITING_APPROVAL);
     const redacted = clearProvisionalPostDenialNarration(messages, denied);
@@ -1812,7 +1795,7 @@ describe("reconcileDeniedToolCalls — non-approval kinds never gate", () => {
       error: "blocked by a hook", args: { path: ".env" },
     });
     const messages = [aiMessageWith([secretRow])];
-    const denied = await reconcileDeniedToolCalls(messages, [
+    const denied = await reconcileDeniedToolCalls(messages, builderOver(messages), [
       { toolName: "Write", token: toolCallIdentityToken(secretRow), kind: "secret" },
       { toolName: "Write", token: grantToken("write", "app.log"), kind: "capture-error" },
       { toolName: "Shell", token: grantToken("shell", "make"), kind: "fail-closed" },
@@ -1834,7 +1817,7 @@ describe("reconcileDeniedToolCalls — non-approval kinds never gate", () => {
       error: "blocked by a hook", args: { path: ".env" },
     });
     const messages = [aiMessageWith([gated, secretRow])];
-    const denied = await reconcileDeniedToolCalls(messages, [
+    const denied = await reconcileDeniedToolCalls(messages, builderOver(messages), [
       // Ledger order puts the secret FIRST: the anchor must still be the first
       // APPROVAL entry, never a non-approval kind.
       { toolName: "Write", token: toolCallIdentityToken(secretRow), kind: "secret" },

package/src/activities/execute-cursor/__tests__/hitl-resume-history.test.ts

@@ -19,7 +19,7 @@
  *      watchdog failed the run ("approval propagation is broken").
  *
  * The fix (seed the transcript on resume + reconcile re-runs by canonical
- * identity in MessageAccumulator) makes the resume status a strict superset:
+ * identity in the Cursor translator) makes the resume status a strict superset:
  * the committed ids survive, the re-runs reconcile in place, and the genuinely
  * new gated tool is appended. The guard then accepts it.
  *
@@ -27,13 +27,14 @@
  * (nonTerminalTranscriptRegression): a from-empty rebuild is REJECTED (the bug),
  * a seeded rebuild is ACCEPTED (the fix).
  *
- * This exercises the MessageAccumulator + denial-reconciliation directly — the
+ * This exercises the translator + builder + denial-reconciliation directly — the
  * unit that owns the resume emitter — rather than the full Temporal activity,
  * keeping the reproduction hermetic and pinned to the exact code under change.
  */
 
 import { describe, it, expect } from "vitest";
 import { create, clone } from "@bufbuild/protobuf";
+import { AgentExecutionStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import {
   AgentMessageSchema,
   ToolCallSchema,
@@ -47,12 +48,9 @@ import {
   ToolCallStatus,
 } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import type { SDKMessage } from "@cursor/sdk";
-import {
-  MessageAccumulator,
-  reconcileDeniedToolCalls,
-  clearProvisionalPostDenialNarration,
-  buildToolCallProto,
-} from "../message-translator.js";
+import { reconcileDeniedToolCalls, clearProvisionalPostDenialNarration } from "../boundary-rows.js";
+import { CursorFold, builderOver } from "../__test-utils__/fold.js";
+import { TranscriptBuilder } from "../../../harness/transcript/builder.js";
 import {
   grantToken,
   buildApprovalGrants,
@@ -213,11 +211,9 @@ describe("Cursor HITL resume — append-only transcript", () => {
     const committed = persistedRunOneMessages();
 
     // Pre-fix behavior: status.messages starts empty on resume, so the
-    // accumulator can never reconcile onto the committed calls.
+    // translator can never reconcile onto the committed calls.
     const fromEmpty: AgentMessage[] = [];
-    const acc = new MessageAccumulator(fromEmpty, {});
-    for (const event of resumeEvents()) acc.processEvent(event);
-    acc.finalize();
+    new CursorFold({ messages: fromEmpty }).events(...resumeEvents()).finalize();
 
     // The committed ids are absent — exactly what trips the backend guard.
     const ids = new Set(allToolCalls(fromEmpty).map((tc) => tc.id));
@@ -233,15 +229,13 @@ describe("Cursor HITL resume — append-only transcript", () => {
     const committed = persistedRunOneMessages();
 
     // Post-fix behavior: index.ts seeds status.messages from the persisted
-    // execution (cloned) before constructing the accumulator.
+    // execution (cloned) before constructing the translator and the builder.
     const seeded = committed.map((m) => clone(AgentMessageSchema, m));
-    const acc = new MessageAccumulator(seeded, {});
-    for (const event of resumeEvents()) acc.processEvent(event);
-    acc.finalize();
+    new CursorFold({ messages: seeded }).events(...resumeEvents()).finalize();
 
     // Post-stream denial overlay (the activity's Phase 12): only `click` is in
     // the ledger, so only it flips to WAITING_APPROVAL.
-    const denied = await reconcileDeniedToolCalls(seeded, clickDenialLedger());
+    const denied = await reconcileDeniedToolCalls(seeded, builderOver(seeded), clickDenialLedger());
     const redacted = clearProvisionalPostDenialNarration(seeded, denied);
 
     const tools = allToolCalls(seeded);
@@ -282,9 +276,11 @@ describe("Cursor HITL resume — append-only transcript", () => {
 
   it("FIX: a sub-agent's gated tool also survives resume (the seeded sub-agent rows are wrapped by reference and indexed)", () => {
     // Sub-agent parity: the runtime seeds `status.subAgentExecutions` on a
-    // resume (`seedFromPersistedStatus`) and the accumulator wraps that very
-    // array, exactly as it wraps `status.messages`, so the seeded row is
-    // retained, indexed by id, and a resumed update lands on it in place.
+    // resume (`seedFromPersistedStatus`, through the builder's `seed()`) and
+    // the builder holds that very array, exactly as it holds
+    // `status.messages`, so the seeded row is retained, indexed by id, and a
+    // resumed update lands on it in place. This arm hands the seeded status
+    // to the constructor, which indexes by the same routine `seed()` does.
     const seededSub = create(SubAgentExecutionSchema, {
       id: "sub_1",
       name: "researcher",
@@ -292,11 +288,12 @@ describe("Cursor HITL resume — append-only transcript", () => {
     });
     const statusRows = [seededSub];
 
-    const acc = new MessageAccumulator([], { subAgentExecutions: statusRows });
-    acc.finalize();
+    const status = create(AgentExecutionStatusSchema, {});
+    status.subAgentExecutions = statusRows;
+    new TranscriptBuilder("exec-resume", status).finalize();
 
-    expect(acc.subAgentExecutions, "the status's own array, not a copy").toBe(statusRows);
-    expect(acc.subAgentExecutions.some((s) => s.id === "sub_1")).toBe(true);
+    expect(status.subAgentExecutions, "the status's own array, not a copy").toBe(statusRows);
+    expect(status.subAgentExecutions.some((s) => s.id === "sub_1")).toBe(true);
   });
 
   it("FIX: the approved tools are ALLOWED by the hook on resume — not re-denied (the loop's source)", () => {
@@ -404,12 +401,10 @@ describe("Cursor HITL resume — two approvals then clean completion (no loop)",
     const committed = committedBuiltInApprovals();
     const seeded = committed.map((m) => clone(AgentMessageSchema, m));
 
-    const acc = new MessageAccumulator(seeded, {});
-    for (const event of builtInResumeEvents()) acc.processEvent(event);
-    acc.finalize();
+    new CursorFold({ messages: seeded }).events(...builtInResumeEvents()).finalize();
 
     // The hook allowed both (no denials this turn), so the overlay adds nothing.
-    const denied = await reconcileDeniedToolCalls(seeded, []);
+    const denied = await reconcileDeniedToolCalls(seeded, builderOver(seeded), []);
     expect(denied).toHaveLength(0);
 
     const tools = allToolCalls(seeded);

package/src/activities/execute-cursor/__tests__/hook-script.test.ts

@@ -1,5 +1,6 @@
 /**
- * @regression file-hitl-phase0 — pins file-edit HITL fix #2 (see _projects/2026-06/20260630.01.file-change-hitl-redesign/tasks/T01_3_regression-manifest.md)
+ * @regression file-hitl-phase0 — pins that decisions bind to the active turn's
+ * denial ledger, never a stale one, and that a resume respects its order.
  *
  * Behavior tests for the generated preToolUse bash hook.
  *

package/src/activities/execute-cursor/__tests__/http2-interceptor.test.ts

@@ -312,7 +312,7 @@ describe("http2-interceptor", () => {
     });
   });
 
-  describe("the token ref is read per request (the root rotates it in place; Q-S2-7)", () => {
+  describe("the token ref is read per request (the root rotates it in place)", () => {
     let mock: ReturnType<typeof createMockConnect>;
     let proxyTokenRef: { current: string | null };
 

package/src/activities/execute-cursor/__tests__/prompt-goldens.test.ts

@@ -2,12 +2,12 @@
  * The Cursor prompt, whole, as goldens — one per shape `buildPrompt` selects.
  *
  * `build-prompt.test.ts` pins every branch with `toContain`; the hermetic
- * goldens are status JSON and never see a prompt. So until S3 M5 no test
+ * goldens are status JSON and never see a prompt. So until #1096 no test
  * pinned a rendered Cursor prompt byte for byte. These goldens are the
  * photograph taken BEFORE the shared prompt glue moved into
- * `shared/prompt-sections.ts` (S3 M5, Q-M5-1), so the move could be proven
+ * `shared/prompt-sections.ts` (#1096), so the move could be proven
  * byte-identical except where a ruling says otherwise — the same discipline
- * M0 applied to the activity's status.
+ * the hermetic net applied to the activity's status (#1048).
  *
  * The shapes (`buildPrompt`'s four, plus the two per-execution directives):
  * the enhanced prompt on a first execution with every section populated
@@ -22,7 +22,7 @@
  * and the HITL recovery on a fresh agent mid-HITL.
  *
  * Rulings that moved a golden are quoted here:
- *  - Q-M5-3 (2026-09-14, owner: A). Every `<input_files>` bullet gained the
+ *  - 2026-09-14 (#1096). Every `<input_files>` bullet gained the
  *    file's size — `- \`.stigmer/inputs/spec.pdf\`` became
  *    `- \`.stigmer/inputs/spec.pdf\` (204800 bytes)` — in the four goldens
  *    that carry attachments (`enhanced.everything`, `enhanced.plan-mode`,
@@ -176,7 +176,7 @@ function everything(reason: AgentResolutionReason, overrides: Partial<BuildPromp
 // Goldens
 // ---------------------------------------------------------------------------
 
-describe("Cursor prompt goldens (S3 M5, Q-M5-1)", () => {
+describe("Cursor prompt goldens", () => {
   it("the enhanced prompt on a first execution, every section populated", async () => {
     const prompt = buildPrompt(everything("created_first_execution"));
     await expect(prompt).toMatchFileSnapshot("./goldens/prompt.enhanced.everything.prompt.md");

package/src/activities/execute-cursor/__tests__/same-identity-reproposal.test.ts

@@ -1,6 +1,6 @@
 /**
  * A later, same-identity proposal is a NEW act: it never lands on a row the
- * user already decided (S2 M4 finding F9).
+ * user already decided (found by the contract kit in #1070).
  *
  * The defect the harness contract kit found against this adapter: within one
  * execution, after the user APPROVED `edit a.txt` and the resumed agent ran
@@ -11,11 +11,11 @@
  * one — flipped it back to WAITING_APPROVAL with its APPROVE still on it and
  * wiped its result; the actual streamed call was hidden as a twin. On the next
  * invocation `approvalDecisionsOf` read that row as a decision and the new,
- * never-approved proposal ran under the old approval. The accumulator had the
+ * never-approved proposal ran under the old approval. The stream fold had the
  * sibling flaw: a re-issue after a SKIP or REJECT was reconciled onto the
  * declined row by identity, inheriting its decision.
  *
- * The rule, in `message-translator.ts`: a row the server has adjudicated
+ * The rule, in `boundary-rows.ts` and the translator's seeded-row match: a row the server has adjudicated
  * (`isAdjudicatedRow`) is never the home of THIS turn's denial and never a
  * twin to collapse; a row the user DECLINED (`isDeclinedRow`) is never the
  * home of a later same-identity call. The approved re-issue (the
@@ -36,7 +36,9 @@ import { ApprovalAction, MessageType, ToolCallStatus } from "@stigmer/protos/ai/
 import type { SDKMessage } from "@cursor/sdk";
 
 import { approvalDecisionsOf } from "../../../harness/approval-decisions.js";
-import { MessageAccumulator, reconcileDeniedToolCalls, toolCallIdentityToken } from "../message-translator.js";
+import { reconcileDeniedToolCalls } from "../boundary-rows.js";
+import { CursorFold, builderOver } from "../__test-utils__/fold.js";
+import { toolCallIdentityToken } from "../approval-state.js";
 import type { DeniedLedgerEntry } from "../approval-state.js";
 
 const PATH = "/work/a.txt";
@@ -83,12 +85,9 @@ function allToolCalls(messages: AgentMessage[]): ToolCall[] {
 
 /** The later turn: the model proposes the same edit under a fresh id, the hook denies it, the turn boundary reconciles. */
 async function laterTurnProposesSameEdit(seeded: AgentMessage[]): Promise<ToolCall[]> {
-  const acc = new MessageAccumulator(seeded, {});
-  acc.processEvent(toolCallEvent(LATER_ID, "running"));
-  acc.processEvent(toolCallEvent(LATER_ID, "error", "Blocked by hook"));
-  acc.finalize();
+  new CursorFold({ messages: seeded }).events(toolCallEvent(LATER_ID, "running"), toolCallEvent(LATER_ID, "error", "Blocked by hook")).finalize();
   const ledger: DeniedLedgerEntry[] = [{ toolName: "Write", token: toolCallIdentityToken(allToolCalls(seeded).find((tc) => tc.id === LATER_ID)!) }];
-  return reconcileDeniedToolCalls(seeded, ledger);
+  return reconcileDeniedToolCalls(seeded, builderOver(seeded), ledger);
 }
 
 function decisionsTheRuntimeWouldRead(messages: AgentMessage[]): ReadonlyMap<string, ApprovalAction> {
@@ -158,10 +157,9 @@ describe("a later same-identity proposal never lands on a decided row (F9)", ()
       }),
     ];
 
-    const acc = new MessageAccumulator(seeded, {});
-    acc.processEvent(toolCallEvent(`${FIRST_ID}_RESUME`, "running"));
-    acc.processEvent(toolCallEvent(`${FIRST_ID}_RESUME`, "completed", RESULT_OF_FIRST));
-    acc.finalize();
+    new CursorFold({ messages: seeded })
+      .events(toolCallEvent(`${FIRST_ID}_RESUME`, "running"), toolCallEvent(`${FIRST_ID}_RESUME`, "completed", RESULT_OF_FIRST))
+      .finalize();
 
     const tools = allToolCalls(seeded);
     expect(tools.map((tc) => tc.id), "one row, the committed id").toEqual([FIRST_ID]);

package/src/activities/execute-cursor/__tests__/sequential-gate-resume.test.ts

@@ -1,5 +1,6 @@
 /**
- * @regression file-hitl-phase0 — pins file-edit HITL fix #2 (see _projects/2026-06/20260630.01.file-change-hitl-redesign/tasks/T01_3_regression-manifest.md)
+ * @regression file-hitl-phase0 — pins that decisions bind to the active turn's
+ * denial ledger, never a stale one, and that a resume respects its order.
  *
  * Cursor analog of execute-deep-agent/__tests__/hermetic/hitl-sequential-gates.test.ts:
  * two SEQUENTIAL approval gates across a resume, on the Cursor deny-and-reconcile
@@ -21,7 +22,7 @@
  *    for the first time — and the REAL bash hook must ALLOW A's re-issue while
  *    DENYING B, the out-of-process half the native gate has no equivalent for.
  *
- * Exercises the MessageAccumulator + denial reconciliation (the unit that owns
+ * Exercises the translator + builder + denial reconciliation (the units that own
  * the Cursor resume emitter) plus the generated hook, keeping the reproduction
  * hermetic and pinned to the exact code under change.
  */
@@ -40,11 +41,9 @@ import {
 } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import type { SDKMessage } from "@cursor/sdk";
 
-import {
-  MessageAccumulator,
-  reconcileDeniedToolCalls,
-  toolCallIdentityToken,
-} from "../message-translator.js";
+import { reconcileDeniedToolCalls } from "../boundary-rows.js";
+import { CursorFold, builderOver } from "../__test-utils__/fold.js";
+import { toolCallIdentityToken } from "../approval-state.js";
 import {
   buildApprovalGrants,
   buildApprovalState,
@@ -139,16 +138,14 @@ describe("Cursor sequential gates A->B across resume", () => {
     const committed = approvedGateA();
     const seeded = committed.map((m) => clone(AgentMessageSchema, m));
 
-    const acc = new MessageAccumulator(seeded, {});
-    for (const event of resumeIntoGateB()) acc.processEvent(event);
-    acc.finalize();
+    new CursorFold({ messages: seeded }).events(...resumeIntoGateB()).finalize();
 
     // Gate B was denied this turn; its identity comes off the reconciled call.
     const bCall = allToolCalls(seeded).find((tc) => tc.name === "shell")!;
     const ledger: DeniedLedgerEntry[] = [
       { toolName: "shell", token: toolCallIdentityToken(bCall) },
     ];
-    await reconcileDeniedToolCalls(seeded, ledger);
+    await reconcileDeniedToolCalls(seeded, builderOver(seeded), ledger);
 
     const tools = allToolCalls(seeded);
     const byId = new Map(tools.map((tc) => [tc.id, tc]));