claude-code-session-manager 0.119.1 → 0.121.0

package/src/main/lib/telemetry/auditLog.cjs

@@ -7,6 +7,11 @@
  * state a project's single-writer law needs to arbitrate, and it must
  * survive even if the project's ops root doesn't exist yet.
  *
+ * Rotation: on the first append in a new calendar month (UTC) the live file is
+ * gzipped to audit-log-<YYYY-MM>.jsonl.gz beside it (YYYY-MM = the month of the
+ * file's last write) and a fresh live file starts; the newest `auditLogMonths` rolled
+ * files are kept. The live file stays plain JSONL, so readers are unaffected.
+ *
  * Best-effort only: a logging failure must never block the mint/create it is
  * observing (same posture as rcaReport.cjs / dodDrainHook.cjs).
  *
@@ -17,6 +22,7 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
+const zlib = require('node:zlib');
 
 const { auditLogPath } = require('../scheduler/schedulerPaths.cjs');
 
@@ -36,21 +42,60 @@ function callerContext() {
   };
 }
 
+const DEFAULT_MAX_ROLLED = 6;
+
+/** Rolled-file cap from ops-retention.json (one file read per rotation); 6 if unreadable. */
+function maxRolled() {
+  try {
+    const n = require('../opsRetentionSettings.cjs').read().auditLogMonths;
+    return Number.isFinite(n) && n >= 1 ? n : DEFAULT_MAX_ROLLED;
+  } catch { return DEFAULT_MAX_ROLLED; }
+}
+const ROLLED_RE = /^audit-log-\d{4}-\d{2}\.jsonl\.gz$/;
+
+function monthKey(d) { return d.toISOString().slice(0, 7); }
+
+/** Roll the live file if its last write was in an earlier month than `now`; prune old rolls. */
+function rotateIfNewMonth(target, now) {
+  let st;
+  try { st = fs.statSync(target); } catch { return; }
+  if (!st.isFile() || st.size === 0) return;
+  const oldMonth = monthKey(st.mtime);
+  if (oldMonth === monthKey(now)) return;
+  const dir = path.dirname(target);
+  const base = path.basename(target, path.extname(target));
+  const rolled = path.join(dir, `${base}-${oldMonth}.jsonl.gz`);
+  // appendFileSync: gzip members concatenate, so a pre-existing roll for that month is extended.
+  fs.appendFileSync(rolled, zlib.gzipSync(fs.readFileSync(target)));
+  fs.unlinkSync(target);
+  const rolls = fs.readdirSync(dir).filter((f) => ROLLED_RE.test(f)).sort();
+  for (const f of rolls.slice(0, Math.max(0, rolls.length - maxRolled()))) {
+    try { fs.unlinkSync(path.join(dir, f)); } catch { /* best-effort */ }
+  }
+}
+
 /**
- * appendAuditEvent(kind, fields) — append one JSONL record. `kind` is a short
+ * appendAuditEvent(kind, fields, opts?) — append one JSONL record. `kind` is a short
  * label ('epic_mint' | 'prd_create' | ...); `fields` is event-specific detail
- * (cwd, epicId, status, title, slug, etc). Never throws.
+ * (cwd, epicId, status, title, slug, etc). `opts.now` (Date) / `opts.target` are
+ * test seams. Never throws; a rotation failure never drops the append.
  */
-function appendAuditEvent(kind, fields = {}) {
+function appendAuditEvent(kind, fields = {}, opts = {}) {
   try {
+    const now = opts.now ?? new Date();
     const record = {
-      at: new Date().toISOString(),
+      at: now.toISOString(),
       kind,
       ...fields,
       caller: callerContext(),
     };
-    const target = auditLogPath();
+    const target = opts.target ?? auditLogPath();
     fs.mkdirSync(path.dirname(target), { recursive: true });
+    try {
+      rotateIfNewMonth(target, now);
+    } catch (e) {
+      console.error('[auditLog] rotation failed', e?.message ?? String(e));
+    }
     fs.appendFileSync(target, `${JSON.stringify(record)}\n`);
   } catch (e) {
     console.error('[auditLog] failed to append audit event', e?.message ?? String(e));
@@ -60,7 +105,7 @@ function appendAuditEvent(kind, fields = {}) {
 /**
  * readTail(maxBytes, target?) → string[] — the complete JSONL lines within the
  * last `maxBytes` of the log, oldest first. O(maxBytes), never O(file): the
- * audit log is a never-rotated provenance record and grows without bound. A
+ * live log is a provenance record that rolls monthly but can still be large. A
  * line cut by the window's start is dropped. Missing/unreadable file → [].
  */
 function readTail(maxBytes, target = auditLogPath()) {

package/src/main/lib/telemetry/crashTelemetry.cjs

@@ -34,4 +34,52 @@ function reportCrash({ reason, meta, deps } = {}) {
   }
 }
 
-module.exports = { reportCrash };
+// A 10 s+ main-loop stall means the main thread was wedged (the 2026-10-19
+// hang death showed 23 s stalls at 972 MB, far below any memory pressure), so
+// a stall outranks memory when picking the likely cause.
+const HANG_LOOP_DELAY_MS = 10000;
+const MEMORY_PRESSURE_MB = 3000;
+
+const isNum = (v) => typeof v === 'number' && Number.isFinite(v);
+
+/**
+ * Turns the previous run's last sample into a likely cause. silentGapSec is
+ * accepted for the caller's meta but does not change the verdict.
+ * @param {{ lastLoopDelayMaxMs?: unknown, lastTotalMb?: unknown, silentGapSec?: unknown }} [sample]
+ * @returns {'main-hang' | 'memory-pressure' | 'unknown'}
+ */
+function classifyUncleanShutdown({ lastLoopDelayMaxMs, lastTotalMb } = {}) {
+  if (isNum(lastLoopDelayMaxMs) && lastLoopDelayMaxMs >= HANG_LOOP_DELAY_MS) return 'main-hang';
+  if (isNum(lastTotalMb) && lastTotalMb >= MEMORY_PRESSURE_MB) return 'memory-pressure';
+  return 'unknown';
+}
+
+/**
+ * Routes a Chromium child-process-gone event. Chromium restarts the Utility
+ * 'Network Service' itself, so a non-oom exit there is a warn log line; all
+ * else is a crash error via reportCrash. Fail-inert: never throws.
+ */
+function reportChildProcessGone({ details, lastTotalMb, deps } = {}) {
+  try {
+    const d = details || {};
+    const type = d.type;
+    const name = d.name || d.serviceName;
+    if (type === 'Utility' && name === 'Network Service' && d.reason !== 'oom') {
+      const telemetryClient = (deps && deps.telemetryClient) || require('./telemetryClient.cjs');
+      return telemetryClient.logLine({
+        level: 'warn',
+        msg: 'crash.child-restartable',
+        fields: { type, name, reason: d.reason, exitCode: d.exitCode, lastTotalMb },
+      });
+    }
+    return reportCrash({
+      reason: d.reason || 'unknown',
+      meta: { type, name, exitCode: d.exitCode, lastTotalMb },
+      deps,
+    });
+  } catch {
+    return undefined;
+  }
+}
+
+module.exports = { reportCrash, classifyUncleanShutdown, reportChildProcessGone };

package/src/main/lib/telemetry/opsErrorLog.cjs

@@ -45,7 +45,14 @@ function todayFile(cwd) {
   return path.join(logsDir(cwd), `errors-${yyyy}-${mm}-${dd}.jsonl`);
 }
 
-function writeLocalLine({ cwd, scope, level, tabId, epicId, tags, message, meta }) {
+// Non-PII triage code: short lowercase slug. Anything else is dropped (never thrown).
+const CODE_RE = /^[a-z0-9][a-z0-9:._-]{0,47}$/;
+
+function normalizeCode(code) {
+  return typeof code === 'string' && CODE_RE.test(code) ? code : undefined;
+}
+
+function writeLocalLine({ cwd, scope, level, tabId, epicId, tags, message, meta, safeCode }) {
   const file = todayFile(cwd);
   try {
     assertOpsWrite(file, 'logs');
@@ -58,6 +65,7 @@ function writeLocalLine({ cwd, scope, level, tabId, epicId, tags, message, meta
     `scope:${scope || 'unknown'}`,
     ...(tabId ? [`tab:${tabId}`] : []),
     ...(epicId ? [`epic:${epicId}`] : []),
+    ...(safeCode ? [`code:${safeCode}`] : []),
   ];
   const allTags = Array.from(new Set([...autoTags, ...tags]));
 
@@ -68,6 +76,7 @@ function writeLocalLine({ cwd, scope, level, tabId, epicId, tags, message, meta
     tabId: tabId || null,
     epicId: epicId || null,
     tags: allTags,
+    ...(safeCode ? { code: safeCode } : {}),
     message: String(message ?? ''),
     ...(meta !== undefined ? { meta: sanitizeMeta(meta) } : {}),
   };
@@ -83,9 +92,13 @@ function writeLocalLine({ cwd, scope, level, tabId, epicId, tags, message, meta
 }
 
 /**
- * Mirrors every appendError() line to telemetryClient — the single tap that
+ * Mirrors appendError() lines to telemetryClient — the single tap that
  * covers pty/chatRunner/scheduler/logs.cjs/renderer in one place, since they
- * all already funnel through appendError. Runs AFTER the local write and is
+ * all already funnel through appendError. Level routing: 'error' ships as a
+ * telemetry error, 'warn' as a warn log line, anything else ('info', 'debug')
+ * ships nothing (it is a success/diagnostic, not an error). An optional
+ * validated `code` rides in context/fields and the msg label so host-side
+ * reports are triageable though `message` is always redacted. Runs AFTER the local write and is
  * independently wrapped so a throwing telemetry stub can never prevent or
  * corrupt it. Reported regardless of the local ephemeral-cwd refusal — an
  * Epic/job worktree still has a REAL project behind it, just not one that
@@ -105,7 +118,8 @@ function writeLocalLine({ cwd, scope, level, tabId, epicId, tags, message, meta
  * `scope`, a small closed vocabulary of subsystem names — structural, never
  * free text.
  */
-function reportToTelemetry({ cwd, scope, level, tabId, epicId, tags, message }) {
+function reportToTelemetry({ cwd, scope, level, tabId, epicId, tags, message, safeCode }) {
+  if (level !== 'error' && level !== 'warn') return;
   try {
     const telemetryClient = require('./telemetryClient.cjs');
     const { projectRootOf } = require('../activeSessions.cjs');
@@ -116,8 +130,11 @@ function reportToTelemetry({ cwd, scope, level, tabId, epicId, tags, message })
       ...(epicId ? [`epic:${epicId}`] : []),
     ];
     const allTags = Array.from(new Set([...autoTags, ...(tags || [])]));
-    const label = `opsError:${scope || 'unknown'}`;
-    const context = { scope: scope || 'unknown', tags: allTags, cwd: normalizedCwd, message };
+    const label = safeCode ? `opsError:${scope || 'unknown'}:${safeCode}` : `opsError:${scope || 'unknown'}`;
+    const context = {
+      scope: scope || 'unknown', tags: allTags, cwd: normalizedCwd, message,
+      ...(safeCode ? { code: safeCode } : {}),
+    };
     if (level === 'warn') {
       telemetryClient.logLine({ level: 'warn', msg: label, fields: context });
     } else {
@@ -159,7 +176,8 @@ function isInsideTestScratch(cwd) {
  * @param {{
  *   cwd: string,           // required — which project's ops root owns this line
  *   scope: string,         // subsystem name, e.g. 'pty', 'chatRunner', 'voice'
- *   level?: string,        // default 'error'; 'warn' also accepted
+ *   level?: string,        // default 'error'; telemetry: 'error' -> error, 'warn' -> warn log, else nothing
+ *   code?: string,         // optional non-PII triage slug, /^[a-z0-9][a-z0-9:._-]{0,47}$/; invalid is dropped
  *   tabId?: string,        // claudeSessionId of the tab this error belongs to, if any
  *   epicId?: string,       // Epic id, if this error happened inside an Epic-backed run
  *   tags?: string[],       // extra caller-supplied tags, merged with the auto-derived ones
@@ -167,13 +185,15 @@ function isInsideTestScratch(cwd) {
  *   meta?: unknown,
  * }} entry
  */
-function appendError({ cwd, scope, level = 'error', tabId, epicId, tags = [], message, meta }) {
+function appendError({ cwd, scope, level = 'error', tabId, epicId, tags = [], message, meta, code }) {
   if (!cwd || typeof cwd !== 'string') return; // no project to attribute this line to — skip
 
   // Test-process guard: a vitest fixture passing a real project root must never
   // write to that project's logs/ NOR ship a fake event to production telemetry.
   if (process.env.VITEST && !isInsideTestScratch(cwd)) return;
 
+  const safeCode = normalizeCode(code);
+
   if (isEphemeralCwd(cwd)) {
     // A worktree is torn down when its Epic/job ends and os.tmpdir() is
     // scratch space either way — never materialize logs there. See
@@ -183,10 +203,10 @@ function appendError({ cwd, scope, level = 'error', tabId, epicId, tags = [], me
     // tap below still fires — this refusal is about the LOCAL write only.
     console.warn(`[opsErrorLog] appendError: refusing ephemeral cwd "${cwd}" (scope=${scope || 'unknown'})`);
   } else {
-    writeLocalLine({ cwd, scope, level, tabId, epicId, tags, message, meta });
+    writeLocalLine({ cwd, scope, level, tabId, epicId, tags, message, meta, safeCode });
   }
 
-  reportToTelemetry({ cwd, scope, level, tabId, epicId, tags, message });
+  reportToTelemetry({ cwd, scope, level, tabId, epicId, tags, message, safeCode });
 }
 
 module.exports = { appendError, logsDir, todayFile };

package/src/main/lib/telemetry/telemetryClient.cjs

@@ -137,7 +137,8 @@ function sentPath() {
 }
 
 /**
- * True when running under a test runner (VITEST, NODE_ENV=test) with no
+ * True when running under a test runner (VITEST, NODE_ENV=test, or Playwright
+ * e2e via SM_E2E=1, set by tests/e2e/_helpers/launchApp.ts) with no
  * explicit SM_TELEMETRY_SPOOL override. Gates appendRecord() below so a test
  * that merely exercises epicMint/scheduler/etc. code paths — without itself
  * setting up an isolated spool — can never accumulate fake records into a
@@ -148,7 +149,7 @@ function sentPath() {
  */
 function isTestEnvironment() {
   if (process.env.SM_TELEMETRY_SPOOL) return false;
-  return !!process.env.VITEST || process.env.NODE_ENV === 'test';
+  return !!process.env.VITEST || process.env.NODE_ENV === 'test' || process.env.SM_E2E === '1';
 }
 
 function getBeaconToken() {
@@ -826,4 +827,6 @@ module.exports = {
   _setFetchImpl,
   _setMachineProfileBuilder,
   _setLogger,
+  _currentEnv: currentEnv,
+  _buildInstallWire: buildInstallWire,
 };

package/src/main/scheduler/prdParser.cjs

@@ -325,6 +325,45 @@ async function maxParallelGroupInUse(prdsDir) {
   return max;
 }
 
+/**
+ * Bound the `.reserved-NN` marker pile. Markers far below the highest
+ * reserved NN protect nothing (the O_EXCL race only matters for candidates
+ * near the floor, and `.max-allocated-group` already keeps the allocator
+ * monotonic), so keep the newest `keep` numbers and delete older markers
+ * whose mtime is also older than `minAgeMs`. Returns { removed, kept }.
+ */
+async function pruneStaleReservations(prdsDir, { keep = 100, minAgeMs = 3600000, now = Date.now() } = {}) {
+  let entries;
+  try {
+    entries = await fsp.readdir(prdsDir);
+  } catch {
+    return { removed: 0, kept: 0 };
+  }
+  const markers = [];
+  let max = 0;
+  for (const name of entries) {
+    const m = name.match(RESERVATION_RE);
+    if (!m) continue;
+    const nn = Number(m[1]);
+    markers.push({ name, nn });
+    max = Math.max(max, nn);
+  }
+  const cutoff = max - keep;
+  let removed = 0;
+  for (const { name, nn } of markers) {
+    if (nn > cutoff) continue;
+    try {
+      const st = await fsp.stat(path.join(prdsDir, name));
+      if (now - st.mtimeMs <= minAgeMs) continue;
+      await fsp.unlink(path.join(prdsDir, name));
+      removed += 1;
+    } catch {
+      // raced with another remover, or unreadable — leave it
+    }
+  }
+  return { removed, kept: markers.length - removed };
+}
+
 /**
  * Atomically allocate a brand-new parallel-group number under prdsDir.
  * Returns the reserved NN. Reservation survives a crash mid-allocation
@@ -360,6 +399,16 @@ async function allocateParallelGroup(prdsDir, { extraFloor = 0 } = {}) {
     if (candidate > highWater) {
       await writeHighWaterMark(prdsDir, candidate);
     }
+    try {
+      let keep = 100;
+      try {
+        const k = require('../lib/opsRetentionSettings.cjs').read().reservedMarkersKeep;
+        if (Number.isFinite(k) && k >= 0) keep = k;
+      } catch { /* default */ }
+      await pruneStaleReservations(prdsDir, { keep });
+    } catch {
+      // best-effort; never fail an allocation over housekeeping
+    }
     return candidate;
   }
   throw new Error(`allocateParallelGroup: exhausted ${MAX_RESERVE_ATTEMPTS} reservation attempts starting at ${candidate}`);
@@ -370,6 +419,7 @@ module.exports = {
   parsePrd,
   listPrdFiles,
   allocateParallelGroup,
+  pruneStaleReservations,
   maxParallelGroupInUse,
   PRD_READ_MAX_BYTES,
   _resetCache,

package/src/main/scheduler/prdPaths.cjs

@@ -13,9 +13,10 @@ const schedulerPaths = require('../lib/scheduler/schedulerPaths.cjs');
 const logs = require('../logs.cjs');
 const { SCHEDULE_SLUG_RE } = require('../ipcSchemas.cjs');
 const { DEFAULT_PROJECT_CWD } = require('../lib/scheduler/schedulerBatch.cjs');
-const { resolvePrdsDirs, resolveArchivedPrdsDirs, resolvePrdWriteDir, listEpicPrdDirs, listArchivedPrdDirs, ancestorEpicPrdDirs, ancestorEpicArchivedPrdDirs } = require('../lib/prd/prdLocations.cjs');
+const { resolvePrdsDirs, resolveArchivedPrdsDirs, resolvePrdWriteDir, listEpicPrdDirs, resolveEpicPrdWriteDir, isSafeEpicId, listArchivedPrdDirs, ancestorEpicPrdDirs, ancestorEpicArchivedPrdDirs } = require('../lib/prd/prdLocations.cjs');
 const { migratePrds, consolidateFlatPrds, legacyAdoptExistingPrds } = require('../lib/prd/prdMigration.cjs');
-const { allProjectCwds } = require('../lib/activeSessions.cjs');
+const { opsPath } = require('../lib/opsOwnership.cjs');
+const { allProjectCwds, projectRootOf } = require('../lib/activeSessions.cjs');
 
 /**
  * Every PRD-source directory currently in play: the legacy global dir (still
@@ -145,23 +146,69 @@ async function findPrdDir(slug) {
 }
 
 /**
- * Job-aware widening of findPrdDir: tries the ordinary global candidate
- * search first (unchanged), then a stored absolute PRD path on the row (if
+ * Deterministic, scan-free candidate PRD dirs for a job, derived only from
+ * `job.cwd` (projectRootOf-normalized): the exact `job.epicId` Epic dir (when
+ * the id is safe and the dir exists), then every Epic prds dir of the project,
+ * then the project's own prds dir. Ordered, deduplicated; [] when job.cwd is
+ * missing or not absolute. All paths are built with path.join.
+ */
+async function jobScopedPrdDirs(job) {
+  const cwd = job && job.cwd;
+  if (typeof cwd !== 'string' || !path.isAbsolute(cwd)) return [];
+  const root = projectRootOf(cwd);
+  const out = [];
+  const add = (dir) => { if (dir && !out.includes(dir)) out.push(dir); };
+  if (isSafeEpicId(job.epicId)) {
+    try {
+      const exact = resolveEpicPrdWriteDir(root, job.epicId);
+      if (fs.existsSync(exact)) add(exact);
+    } catch { /* unsafe epicId — skip the exact dir */ }
+  }
+  for (const dir of listEpicPrdDirs(root)) add(dir);
+  add(module.exports.prdDirForCwd(root));
+  return out;
+}
+
+async function dirHasSlug(dir, slug) {
+  try {
+    await fsp.access(path.join(dir, `${slug}.md`));
+    return true;
+  } catch { return false; }
+}
+
+/**
+ * Job-aware widening of findPrdDir: tries the job's exact Epic dir from
+ * jobScopedPrdDirs first, then the ordinary global candidate search, then the
+ * remaining job-scoped dirs, then a stored absolute PRD path on the row (if
  * the queue schema ever carries one — checked defensively), then walks up
  * to 3 ancestor directories above `job.cwd` for that EXACT `job.epicId`'s
  * `prds` dir (prdLocations.ancestorEpicPrdDirs).
  *
- * Fixes the incident where an Epic lives in a non-git PARENT folder P
- * (P/session-manager-operations/scheduler/epics/<epicId>/prds/*.md) but its
- * PRDs' frontmatter `cwd` is the sub-repo P/repo — P is never itself a
- * tracked project cwd, so findPrdDir's candidatePrdsDirs() never visits it
- * and the job was wrongly retired as `prd-missing`. epicId is matched
- * exactly (never a glob); every path is built with path.join, never string
- * concatenation with user input.
+ * The job-scoped lookup is what keeps a live PRD resolvable when its project
+ * has fallen out of allProjectCwds (a transcript-tail heuristic), which would
+ * otherwise hide it from findPrdDir (incident: Rabbits-Game
+ * 41-bunny-run-cycle-art, 2026-10-20, retired as `prd-missing`).
+ *
+ * The ancestor walk fixes the incident where an Epic lives in a non-git
+ * PARENT folder P (P/session-manager-operations/scheduler/epics/<epicId>/
+ * prds/*.md) but its PRDs' frontmatter `cwd` is the sub-repo P/repo — P is
+ * never itself a tracked project cwd, so candidatePrdsDirs() never visits it.
+ * epicId is matched exactly (never a glob); every path is built with
+ * path.join, never string concatenation with user input.
  */
 async function findPrdDirForJob(job) {
-  const viaGlobalSearch = await module.exports.findPrdDir(job && job.slug);
+  const slug = job && job.slug;
+  const scoped = typeof slug === 'string' && slug && path.basename(slug) === slug
+    ? await module.exports.jobScopedPrdDirs(job) : [];
+  const exactDir = scoped.length && isSafeEpicId(job.epicId)
+    ? opsPath(job.cwd, 'scheduler', 'epics', job.epicId, 'prds')
+    : null;
+  if (exactDir && scoped[0] === exactDir && await dirHasSlug(exactDir, slug)) return exactDir;
+  const viaGlobalSearch = await module.exports.findPrdDir(slug);
   if (viaGlobalSearch) return viaGlobalSearch;
+  for (const dir of scoped) {
+    if (await dirHasSlug(dir, slug)) return dir;
+  }
   if (job && typeof job.prdPath === 'string' && job.prdPath) {
     try {
       await fsp.access(job.prdPath);
@@ -170,10 +217,7 @@ async function findPrdDirForJob(job) {
   }
   if (job && job.cwd && job.epicId) {
     for (const dir of ancestorEpicPrdDirs(job.cwd, job.epicId)) {
-      try {
-        await fsp.access(path.join(dir, `${job.slug}.md`));
-        return dir;
-      } catch { /* not here — try the next ancestor */ }
+      if (await dirHasSlug(dir, slug)) return dir;
     }
   }
   return null;
@@ -474,6 +518,7 @@ module.exports = {
   archivedTwinExists,
   findPrdDir,
   findPrdDirForJob,
+  jobScopedPrdDirs,
   safeSlugPathIn,
   realPrdsDir,
   safeSlugPath,

package/src/main/scheduler/reviewLadder.cjs

@@ -507,6 +507,23 @@ function healRefusalReason(job, verdict, committedDuringRun) {
  * gate or a real non-zero-exit error) is excluded — that failure is
  * evidence, not silence, and must never become a heal candidate (PRD 1102).
  */
+// A human cancelled this row (scheduler_cancel_job). Incident 2026-10-19
+// (git-viewer): cancelled jobs were parked as 'failed' (source
+// 'remote:cancelJob'), then selectFailedAutoResetTargets re-queued them 10
+// minutes later and they ran and merged unwanted commits. Marker is
+// `cancelledAt`; the statusHistory source is the fallback for rows cancelled
+// before the marker existed. Every automated selector must skip these; only a
+// human scheduler_reset_job revives one.
+function isCancelledJob(job) {
+  if (!job) return false;
+  if (typeof job.cancelledAt === 'string' && job.cancelledAt) return true;
+  const history = Array.isArray(job.statusHistory) ? job.statusHistory : [];
+  for (let i = history.length - 1; i >= 0; i--) {
+    if (history[i] && history[i].to === job.status) return history[i].source === 'remote:cancelJob';
+  }
+  return false;
+}
+
 function isFailedUnverifiedShaped(job) {
   if (!job || job.status !== 'failed') return false;
   if (job.verifierVerdict && RESCANNABLE_VERDICTS.has(job.verifierVerdict)) return true;
@@ -517,7 +534,7 @@ function isFailedUnverifiedShaped(job) {
 }
 
 function isRescanCandidate(job) {
-  if (!job) return false;
+  if (!job || isCancelledJob(job)) return false;
   // Default-ELIGIBLE: every needs_review row is a heal candidate unless its
   // verdict is in RESCAN_EXCLUDED_VERDICTS. No runId requirement here — a row
   // without one still gets the evidence rung and the unresolvable annotation.
@@ -549,6 +566,7 @@ function isTranscriptRescannable(job) {
 function selectEvidenceScanTargets(jobs, now = Date.now()) {
   const due = [];
   for (const j of jobs ?? []) {
+    if (isCancelledJob(j)) continue;
     if (j.status !== 'needs_review' || !isRescanCandidate(j)) continue;
     if (isTranscriptRescannable(j)) continue;
     if (j.looksDone) continue;
@@ -678,6 +696,7 @@ function failedAutoResetDisabled() {
 function selectFailedAutoResetTargets(jobs, now, thresholdMs) {
   const targets = [];
   for (const j of jobs ?? []) {
+    if (isCancelledJob(j)) continue;
     if (j.status !== 'failed') continue;
     const attempts = j.failedAutoResetAttempts ?? 0;
     if (attempts >= FAILED_AUTORESET_CAP) continue;
@@ -729,6 +748,7 @@ function selectFailedAutoResetTargets(jobs, now, thresholdMs) {
 function findStuckFailedJobs(jobs, now, thresholdMs) {
   const stuck = [];
   for (const j of jobs ?? []) {
+    if (isCancelledJob(j)) continue;
     if (j.status !== 'failed') continue;
     if (j.stuckFailedNotified === true) continue;
     if (!isRescanCandidate(j)) continue;
@@ -797,6 +817,7 @@ function needsReviewAutoResolveDisabled() {
 function selectExhaustedNeedsReviewTargets(jobs, now, thresholdMs) {
   const targets = [];
   for (const j of jobs ?? []) {
+    if (isCancelledJob(j)) continue;
     if (j.status !== 'needs_review') continue;
     if (isNeedsHuman(j)) continue;
     if (!isEligibleForNeedsReviewAutoResolve(j, jobs)) continue;
@@ -840,6 +861,7 @@ function selectExhaustedNeedsReviewTargets(jobs, now, thresholdMs) {
 function selectAutoFixTargets(jobs, { fixSlugExists, resolveJobRunId = resolveRunId }) {
   const slugsInQueue = new Set(jobs.map((j) => j.slug));
   return jobs.filter((job) => {
+    if (isCancelledJob(job)) return false;
     if (job.status !== 'needs_review') return false;
     if (isNeedsHuman(job)) return false;
     // A job parked here because it was blocked by a sibling's foreign WIP
@@ -983,6 +1005,7 @@ function selectGateShadowTarget(jobs, headByCwd, { authorityDisabled = false, ba
 
 module.exports = {
   isNeedsHuman,
+  isCancelledJob,
   selectResumeRecoveryTarget,
   MECHANICALLY_RESOLVABLE_VERDICTS,
   isMechanicalRecoveryFutile,