claude-dev-env 8.26.5 → 8.27.0

package/bin/install.mjs

@@ -2038,6 +2038,7 @@ function mergeHooksAtPath(
     pythonCommand,
     selectHooksConfig = hooksConfig => hooksConfig,
     pluginRootDir = CLAUDE_HOME,
+    shouldPruneSourceHooks = false,
 ) {
     const hooksSource = resolvePackageManagedDirectory(
         hooksSourceRoot,
@@ -2045,8 +2046,17 @@ function mergeHooksAtPath(
     );
     const hooksJsonPath = join(hooksSource, 'hooks.json');
     if (!existsSync(hooksJsonPath)) return 0;
-    const hooksConfig = selectHooksConfig(JSON.parse(readFileSync(hooksJsonPath, 'utf8')));
+    const sourceHooksConfig = JSON.parse(readFileSync(hooksJsonPath, 'utf8'));
     const settings = loadClaudeSettingsObject(settingsPath);
+    if (shouldPruneSourceHooks && settings.hooks && typeof settings.hooks === 'object') {
+        stripRetiredHookEntries(
+            settings,
+            managedHookScriptRelativePaths(sourceHooksConfig),
+            retiredHookOwnership(),
+        );
+        pruneManagedHooksFromSettings(settings, new Set());
+    }
+    const hooksConfig = selectHooksConfig(sourceHooksConfig);
     const groupCount = mergeHooksIntoSettings(settings, hooksConfig, pluginRootDir, pythonCommand);
     writeFileSync(settingsPath, JSON.stringify(settings, null, indentation) + '\n');
     return groupCount;
@@ -2081,6 +2091,7 @@ function mergeCodexHooks(hooksSourceRoot, pythonCommand) {
         pythonCommand,
         selectCodexNativeHooksConfig,
         dirname(CODEX_HOOKS_CONFIGURATION_PATH),
+        true,
     );
 }
 

package/bin/install.prune.test.mjs

@@ -16,7 +16,7 @@ import { fileURLToPath } from 'node:url';
 import { detectPython } from './install.mjs';
 const THIS_DIRECTORY = dirname(fileURLToPath(import.meta.url));
 const INSTALLER_PATH = join(THIS_DIRECTORY, 'install.mjs');
-const INSTALLER_PROCESS_TIMEOUT_MS = 60_000;
+const INSTALLER_PROCESS_TIMEOUT_MS = 120_000;
 const EXCLUDED_PACKAGE_COPY_DIRECTORY = 'node_modules';
 
 const RETIRED_SKILL_DIRECTORIES = [

package/bin/install.transaction.test.mjs

@@ -373,7 +373,13 @@ test('installer fault after_settings_write restores prior settings and files', (
         const { claudeDirectory, rulesFile } = seedPriorInstall(homeDirectory);
         const priorSettings = readFileSync(join(claudeDirectory, 'settings.json'), 'utf8');
         const codexHooksPath = join(homeDirectory, '.codex', 'hooks.json');
-        writeFileWithParents(codexHooksPath, '{"hooks":{"PreToolUse":[{"matcher":"custom"}]}}\n');
+        writeFileWithParents(codexHooksPath, JSON.stringify({
+            enabled: false,
+            hooks: {
+                PreToolUse: [{ matcher: 'custom' }],
+                SessionEnd: [{ hooks: [{ type: 'command', command: `python "${join(homeDirectory, '.codex', 'hooks', 'lifecycle', 'session_end_cleanup.py')}"` }] }],
+            },
+        }) + '\n');
         const priorCodexHooks = readFileSync(codexHooksPath, 'utf8');
 
         const failedRun = runInstaller(homeDirectory, [], {

package/docs/codex-compatibility.md

@@ -26,8 +26,17 @@ Run `codex-compat bridge --surface <name> --payload '<json-object>'`. The bridge
 
 The package installer seeds `subagent-model-policy.json` in the agents-home
 `rules/` directory when the file is absent. It registers one `PreToolUse` group
-for `multi_agent_v1__spawn_agent` in `$CODEX_HOME/hooks.json`. Existing Codex
-hook groups stay in place. Claude-only hook groups do not enter the Codex file.
+for `multi_agent_v1__spawn_agent` and one for `Agent|Task` in `$CODEX_HOME/hooks.json`.
+Before adding these groups, the installer removes obsolete package-owned hook
+registrations from every event. Custom hook entries and Codex's enabled or
+disabled hook settings stay unchanged. Claude-only hook groups do not enter the
+Codex file.
+
+A detached Windows Codex daemon can open a console for each background command.
+If this happens, run local interactive sessions with `codex --no-daemon` and keep
+`codex exec` commands unchanged. [Codex issue #44768](https://github.com/openai/codex/issues/44768)
+describes the symptom. [PR #49164](https://github.com/openai/codex/pull/49164)
+adds the upstream console fix.
 
 Edit the installed policy file to change the next routing decision. The resolver
 loads that path for each invocation.

package/hooks/hooks_constants/orchestrator_auto_starter_constants.py

@@ -16,7 +16,8 @@ ALL_ORCHESTRATOR_STARTER_ENABLED_ENV_VALUES: frozenset[str] = frozenset(
 ORCHESTRATOR_STARTER_TIMEOUT_MILLISECONDS: int = 50
 
 ORCHESTRATOR_SESSION_START_DIRECTIVE: str = (
-    "SessionStart orchestrator opt-in is active. Load the orchestrator skill "
-    "and run in executor-advisor mode for this session's multi-step work. "
-    "Do not invent a second orchestrator path; follow the skill."
+    "SessionStart orchestrator opt-in is active. Load the orchestrator skill. "
+    "Track this session's goals across inline and delegated work. "
+    "Recover saved state at startup, resume, and after compaction. "
+    "Keep context small by delegating bulky work when useful."
 )

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.26.5",
+    "version": "8.27.0",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {

package/scripts/dev_env_scripts_constants/grok_run_ledger_constants.py

@@ -20,6 +20,9 @@ TASK_STATUS_IN_PROGRESS: str = "in_progress"
 TASK_STATUS_COMPLETED: str = "completed"
 """Task reached a successful terminal state."""
 
+TASK_STATUS_CANCELLED: str = "cancelled"
+"""Task stopped after caller-authorized cancellation and owner termination."""
+
 TASK_STATUS_ADVISOR_BLOCKED: str = "advisor_blocked"
 """Task stopped because the advisor bind or verdict failed closed."""
 
@@ -31,12 +34,23 @@ ALL_LEGAL_TASK_STATUSES: frozenset[str] = frozenset(
         TASK_STATUS_PENDING,
         TASK_STATUS_IN_PROGRESS,
         TASK_STATUS_COMPLETED,
+        TASK_STATUS_CANCELLED,
         TASK_STATUS_ADVISOR_BLOCKED,
         TASK_STATUS_PENDING_REVIEW,
     }
 )
 """Every legal task status the ledger accepts."""
 
+ALL_CANCELLABLE_TASK_STATUSES: frozenset[str] = frozenset(
+    {
+        TASK_STATUS_PENDING,
+        TASK_STATUS_IN_PROGRESS,
+        TASK_STATUS_ADVISOR_BLOCKED,
+        TASK_STATUS_PENDING_REVIEW,
+    }
+)
+"""Task states that permit terminal cancellation."""
+
 UTF8_ENCODING: str = "utf-8"
 """Text encoding for ledger and patch-manifest files."""
 

package/scripts/grok_run_ledger.py

@@ -27,11 +27,13 @@ from dataclasses import asdict, dataclass, field
 from pathlib import Path
 
 from dev_env_scripts_constants.grok_run_ledger_constants import (
+    ALL_CANCELLABLE_TASK_STATUSES,
     ALL_LEGAL_TASK_STATUSES,
     JSON_INDENT,
     LEDGER_FILENAME,
     LEDGER_SCHEMA_VERSION,
     TASK_STATUS_ADVISOR_BLOCKED,
+    TASK_STATUS_CANCELLED,
     TASK_STATUS_COMPLETED,
     TASK_STATUS_IN_PROGRESS,
     TASK_STATUS_PENDING,
@@ -41,7 +43,6 @@ from dev_env_scripts_constants.grok_run_ledger_constants import (
     UTF8_ENCODING,
 )
 
-
 @dataclass
 class LedgerTaskRecord:
     """One delegated unit tracked in the run ledger."""
@@ -163,15 +164,17 @@ class GrokRunLedger:
         return self._task_by_id[task_id]
 
     def can_dispatch(self, task_id: str) -> bool:
-        """Return whether every dependency has completed successfully.
+        """Return whether an uncancelled task has completed dependencies.
 
         Args:
             task_id: Task to evaluate.
 
         Returns:
-            True when every dependency is ``completed``.
+            Whether the task is uncancelled and every dependency is completed.
         """
         record = self.get_task(task_id)
+        if record.status == TASK_STATUS_CANCELLED:
+            return False
         for each_dependency in record.dependencies:
             dependency_record = self._task_by_id.get(each_dependency)
             if dependency_record is None:
@@ -229,6 +232,92 @@ class GrokRunLedger:
         self._atomic_write()
         return record
 
+    def release_terminated_owner(
+        self,
+        *,
+        task_id: str,
+        expected_owner_id: str,
+        expected_advisor_session_id: str,
+    ) -> LedgerTaskRecord:
+        """Release after caller verifies death and saves assignment/artifact history.
+        Args:
+            task_id: Task to release under freshly loaded single-writer ownership.
+            expected_owner_id: Nonempty owner identity from the assignment.
+            expected_advisor_session_id: Nonempty session from the assignment.
+        Returns:
+            Pending-review task retaining its base, session, and evidence.
+        Raises:
+            ValueError: When status or either current identity does not match.
+        """
+        record = self.get_task(task_id)
+        if record.status != TASK_STATUS_IN_PROGRESS:
+            raise ValueError(f"cannot release task from status {record.status}")
+        if not expected_owner_id or record.owner_id != expected_owner_id:
+            raise ValueError(f"owner identity changed for {task_id}")
+        session_matches = record.advisor_session_id == expected_advisor_session_id
+        if not expected_advisor_session_id or not session_matches:
+            raise ValueError(f"advisor session changed for {task_id}")
+        record.status = TASK_STATUS_PENDING_REVIEW
+        record.owner_id = None
+        self._atomic_write()
+        return record
+
+    def mark_cancelled(
+        self,
+        *,
+        task_id: str,
+        expected_owner_id: str | None,
+        expected_advisor_session_id: str | None,
+        reason: str,
+    ) -> LedgerTaskRecord:
+        """Cancel after the caller saves authorization and confirms owner termination.
+        Args:
+            task_id: Task under freshly loaded single-writer ownership.
+            expected_owner_id: Current owner, or None for an unassigned task.
+            expected_advisor_session_id: Current advisor session, or None.
+            reason: Nonempty cancellation evidence to append.
+        Returns:
+            Cancelled record retaining evidence and session; retries do not write.
+        """
+        record = self.get_task(task_id)
+        self._require_cancellation_request(
+            record, expected_owner_id, expected_advisor_session_id, reason
+        )
+        if record.status == TASK_STATUS_CANCELLED:
+            return record
+        record.status = TASK_STATUS_CANCELLED
+        record.owner_id = None
+        record.test_evidence.append(reason)
+        self._atomic_write()
+        return record
+
+    def _require_cancellation_request(
+        self,
+        record: LedgerTaskRecord,
+        expected_owner_id: str | None,
+        expected_advisor_session_id: str | None,
+        reason: str,
+    ) -> None:
+        """Compare both identities before changing cancellation state."""
+        if expected_owner_id == "" or record.owner_id != expected_owner_id:
+            raise ValueError(f"owner identity changed for {record.task_id}")
+        if (
+            expected_advisor_session_id == ""
+            or record.advisor_session_id != expected_advisor_session_id
+        ):
+            raise ValueError(f"advisor session changed for {record.task_id}")
+        if record.status == TASK_STATUS_IN_PROGRESS and (
+            expected_owner_id is None or expected_advisor_session_id is None
+        ):
+            raise ValueError("in-progress cancellation requires owner and session")
+        if not reason.strip():
+            raise ValueError("cancellation reason must be nonempty")
+        if (
+            record.status != TASK_STATUS_CANCELLED
+            and record.status not in ALL_CANCELLABLE_TASK_STATUSES
+        ):
+            raise ValueError(f"cannot cancel task from status {record.status}")
+
     def mark_completed(
         self,
         *,
@@ -278,6 +367,8 @@ class GrokRunLedger:
             The blocked task record.
         """
         record = self.get_task(task_id)
+        if record.status == TASK_STATUS_CANCELLED:
+            raise ValueError(f"cannot block task from status {record.status}")
         record.status = TASK_STATUS_ADVISOR_BLOCKED
         record.test_evidence = [reason]
         self._atomic_write()
@@ -299,6 +390,8 @@ class GrokRunLedger:
             The updated task record (unchanged when SHAs match).
         """
         record = self.get_task(task_id)
+        if record.status == TASK_STATUS_CANCELLED:
+            return record
         if record.base_sha is None or record.base_sha == current_sha:
             return record
         record.status = TASK_STATUS_PENDING_REVIEW

package/scripts/test_grok_run_ledger.py

@@ -114,3 +114,376 @@ def test_completed_records_acceptance_and_head(tmp_path: Path) -> None:
     assert record.status == TASK_STATUS_COMPLETED
     assert record.reviewed_head == "head"
     assert record.changed_paths == ("a.py",)
+
+
+def test_release_terminated_owner_allows_same_base_reassignment_after_reload(
+    tmp_path: Path,
+) -> None:
+    ledger = GrokRunLedger(tmp_path)
+    ledger.register_task(task_id="task", all_dependencies=())
+    ledger.mark_in_progress(
+        task_id="task",
+        owner_id="old-owner",
+        advisor_session_id="old-session",
+        base_sha="base",
+    )
+
+    released_record = ledger.release_terminated_owner(
+        task_id="task",
+        expected_owner_id="old-owner",
+        expected_advisor_session_id="old-session",
+    )
+
+    assert released_record.status == TASK_STATUS_PENDING_REVIEW
+    assert released_record.owner_id is None
+    assert released_record.advisor_session_id == "old-session"
+    assert released_record.base_sha == "base"
+
+    reloaded_ledger = GrokRunLedger(tmp_path)
+    replacement_record = reloaded_ledger.mark_in_progress(
+        task_id="task",
+        owner_id="new-owner",
+        advisor_session_id="new-session",
+        base_sha="base",
+    )
+    persisted_record = GrokRunLedger(tmp_path).get_task("task")
+
+    assert replacement_record.base_sha == "base"
+    assert persisted_record.status == "in_progress"
+    assert persisted_record.owner_id == "new-owner"
+    assert persisted_record.advisor_session_id == "new-session"
+    assert persisted_record.base_sha == "base"
+
+
+@pytest.mark.parametrize(
+    (
+        "expected_owner_id",
+        "expected_advisor_session_id",
+        "persisted_owner_id",
+        "persisted_advisor_session_id",
+        "should_complete",
+    ),
+    [
+        ("different-owner", "session", "owner", "session", False),
+        ("owner", "different-session", "owner", "session", False),
+        ("", "session", "", "session", False),
+        ("owner", "", "owner", "", False),
+        ("owner", "session", "owner", "session", True),
+    ],
+)
+def test_release_terminated_owner_rejects_stale_identity_and_illegal_status(
+    tmp_path: Path,
+    expected_owner_id: str,
+    expected_advisor_session_id: str,
+    persisted_owner_id: str,
+    persisted_advisor_session_id: str,
+    should_complete: bool,
+) -> None:
+    ledger = GrokRunLedger(tmp_path)
+    ledger.register_task(task_id="task", all_dependencies=())
+    ledger.mark_in_progress(
+        task_id="task",
+        owner_id=persisted_owner_id,
+        advisor_session_id=persisted_advisor_session_id,
+        base_sha="base",
+    )
+    ledger_path = tmp_path / "grok-run-ledger.json"
+    if should_complete:
+        ledger.mark_completed(
+            task_id="task",
+            reviewed_head="head",
+            all_changed_paths=(),
+            advisor_verdict="ENDORSE",
+            all_acceptance_mapping={},
+            all_test_evidence=["pytest -q"],
+        )
+
+    task_before = ledger.get_task("task")
+    task_state_before = (
+        task_before.status,
+        task_before.owner_id,
+        task_before.advisor_session_id,
+        task_before.base_sha,
+    )
+    persisted_bytes_before = ledger_path.read_bytes()
+
+    with pytest.raises(ValueError):
+        ledger.release_terminated_owner(
+            task_id="task",
+            expected_owner_id=expected_owner_id,
+            expected_advisor_session_id=expected_advisor_session_id,
+        )
+
+    task_after = ledger.get_task("task")
+    assert ledger_path.read_bytes() == persisted_bytes_before
+    assert (
+        task_after.status,
+        task_after.owner_id,
+        task_after.advisor_session_id,
+        task_after.base_sha,
+    ) == task_state_before
+
+
+def test_release_terminated_owner_preserves_dependencies_and_evidence(
+    tmp_path: Path,
+) -> None:
+    ledger = GrokRunLedger(tmp_path)
+    ledger.register_task(task_id="dependency", all_dependencies=())
+    ledger.mark_in_progress(
+        task_id="dependency",
+        owner_id="dependency-owner",
+        advisor_session_id="dependency-session",
+        base_sha="base",
+    )
+    ledger.mark_completed(
+        task_id="dependency",
+        reviewed_head="dependency-head",
+        all_changed_paths=(),
+        advisor_verdict="ENDORSE",
+        all_acceptance_mapping={},
+        all_test_evidence=["dependency passed"],
+    )
+    ledger.register_task(task_id="task", all_dependencies=("dependency",))
+    ledger.mark_in_progress(
+        task_id="task",
+        owner_id="owner",
+        advisor_session_id="session",
+        base_sha="base",
+    )
+    ledger_path = tmp_path / "grok-run-ledger.json"
+    ledger_document = json.loads(ledger_path.read_text(encoding="utf-8"))
+    target_task = next(
+        each_task
+        for each_task in ledger_document["tasks"]
+        if each_task["task_id"] == "task"
+    )
+    target_task["advisor_verdict"] = "ENDORSE"
+    target_task["reviewed_head"] = "reviewed-head"
+    target_task["changed_paths"] = ["source.py"]
+    target_task["acceptance_mapping"] = {"criterion": "evidence"}
+    target_task["test_evidence"] = ["pytest -q"]
+    ledger_path.write_text(
+        json.dumps(ledger_document, indent=2) + "\n",
+        encoding="utf-8",
+    )
+
+    reloaded_ledger = GrokRunLedger(tmp_path)
+    reloaded_ledger.release_terminated_owner(
+        task_id="task",
+        expected_owner_id="owner",
+        expected_advisor_session_id="session",
+    )
+    persisted_record = GrokRunLedger(tmp_path).get_task("task")
+
+    assert persisted_record.dependencies == ("dependency",)
+    assert persisted_record.advisor_session_id == "session"
+    assert persisted_record.base_sha == "base"
+    assert persisted_record.advisor_verdict == "ENDORSE"
+    assert persisted_record.reviewed_head == "reviewed-head"
+    assert persisted_record.changed_paths == ("source.py",)
+    assert persisted_record.acceptance_mapping == {"criterion": "evidence"}
+    assert persisted_record.test_evidence == ["pytest -q"]
+    assert reloaded_ledger.can_dispatch("task") is True
+
+
+def _seed_cancellation_ledger(tmp_path: Path, status: str) -> GrokRunLedger:
+    ledger = GrokRunLedger(tmp_path)
+    ledger.register_task(task_id="task", all_dependencies=("dependency",))
+    ledger_path = tmp_path / "grok-run-ledger.json"
+    ledger_document = json.loads(ledger_path.read_text(encoding="utf-8"))
+    ledger_document["tasks"][0].update(
+        status=status,
+        owner_id="owner",
+        advisor_session_id="session",
+        base_sha="base",
+        reviewed_head="head",
+        changed_paths=["source.py"],
+        advisor_verdict="ENDORSE",
+        acceptance_mapping={"criterion": "proof"},
+        test_evidence=["pytest passed"],
+    )
+    ledger_path.write_text(json.dumps(ledger_document), encoding="utf-8")
+    return GrokRunLedger(tmp_path)
+
+
+@pytest.mark.parametrize(
+    "status", ["pending", "pending_review", "advisor_blocked", "in_progress"]
+)
+def test_mark_cancelled_preserves_assignment_and_evidence(
+    tmp_path: Path, status: str
+) -> None:
+    ledger = _seed_cancellation_ledger(tmp_path, status)
+    previous_document = json.loads(ledger.ledger_path.read_text(encoding="utf-8"))
+    ledger.mark_cancelled(
+        task_id="task",
+        expected_owner_id="owner",
+        expected_advisor_session_id="session",
+        reason="User cancelled; owner stopped",
+    )
+    expected_document = previous_document
+    expected_document["tasks"][0].update(
+        status="cancelled",
+        owner_id=None,
+        test_evidence=["pytest passed", "User cancelled; owner stopped"],
+    )
+    assert (
+        json.loads(ledger.ledger_path.read_text(encoding="utf-8")) == expected_document
+    )
+    reloaded = GrokRunLedger(tmp_path)
+    assert reloaded.get_task("task").status == "cancelled"
+    assert is_legal_status(reloaded.get_task("task").status)
+    assert reloaded.can_dispatch("task") is False
+
+
+@pytest.mark.parametrize(
+    "expected_owner_id,expected_session,reason",
+    [
+        ("other", "session", "cancel"),
+        ("owner", "other", "cancel"),
+        ("", "session", "cancel"),
+        ("owner", "", "cancel"),
+        (None, "session", "cancel"),
+        ("owner", None, "cancel"),
+        ("owner", "session", ""),
+        ("owner", "session", "   "),
+    ],
+)
+def test_mark_cancelled_rejects_invalid_request_without_changes(
+    tmp_path: Path,
+    expected_owner_id: str | None,
+    expected_session: str | None,
+    reason: str,
+) -> None:
+    ledger = _seed_cancellation_ledger(tmp_path, "in_progress")
+    previous_bytes = ledger.ledger_path.read_bytes()
+    with pytest.raises(ValueError):
+        ledger.mark_cancelled(
+            task_id="task",
+            expected_owner_id=expected_owner_id,
+            expected_advisor_session_id=expected_session,
+            reason=reason,
+        )
+    assert ledger.ledger_path.read_bytes() == previous_bytes
+    assert ledger.get_task("task").status == "in_progress"
+    assert ledger.get_task("task").owner_id == "owner"
+
+
+def test_mark_cancelled_rejects_completed_task(tmp_path: Path) -> None:
+    ledger = _seed_cancellation_ledger(tmp_path, "completed")
+    previous_bytes = ledger.ledger_path.read_bytes()
+    with pytest.raises(ValueError):
+        ledger.mark_cancelled(
+            task_id="task",
+            expected_owner_id="owner",
+            expected_advisor_session_id="session",
+            reason="cancel",
+        )
+    assert ledger.ledger_path.read_bytes() == previous_bytes
+
+
+@pytest.mark.parametrize(
+    "owner_id,session_id",
+    [(None, None), (None, "session"), ("owner", None), ("", "session"), ("owner", "")],
+)
+def test_mark_cancelled_rejects_incomplete_live_assignment(
+    tmp_path: Path,
+    owner_id: str | None,
+    session_id: str | None,
+) -> None:
+    ledger = _seed_cancellation_ledger(tmp_path, "in_progress")
+    ledger_document = json.loads(ledger.ledger_path.read_text(encoding="utf-8"))
+    ledger_document["tasks"][0].update(owner_id=owner_id, advisor_session_id=session_id)
+    ledger.ledger_path.write_text(json.dumps(ledger_document), encoding="utf-8")
+    previous_bytes = ledger.ledger_path.read_bytes()
+    reloaded = GrokRunLedger(tmp_path)
+    with pytest.raises(ValueError):
+        reloaded.mark_cancelled(
+            task_id="task",
+            expected_owner_id=owner_id,
+            expected_advisor_session_id=session_id,
+            reason="cancel",
+        )
+    assert ledger.ledger_path.read_bytes() == previous_bytes
+    assert reloaded.get_task("task").status == "in_progress"
+
+
+def test_mark_cancelled_accepts_unassigned_task_and_blocks_dependents(
+    tmp_path: Path,
+) -> None:
+    ledger = GrokRunLedger(tmp_path)
+    ledger.register_task(task_id="task")
+    ledger.register_task(task_id="child", all_dependencies=("task",))
+    ledger.mark_cancelled(
+        task_id="task",
+        expected_owner_id=None,
+        expected_advisor_session_id=None,
+        reason="User cancelled before dispatch",
+    )
+    assert ledger.get_task("task").status == "cancelled"
+    assert ledger.get_task("task").owner_id is None
+    assert ledger.can_dispatch("task") is False
+    assert ledger.can_dispatch("child") is False
+
+
+def test_mark_cancelled_retry_requires_current_identity_and_leaves_bytes_unchanged(
+    tmp_path: Path,
+) -> None:
+    ledger = _seed_cancellation_ledger(tmp_path, "in_progress")
+    ledger.mark_cancelled(
+        task_id="task",
+        expected_owner_id="owner",
+        expected_advisor_session_id="session",
+        reason="User cancelled; owner stopped",
+    )
+    previous_bytes = ledger.ledger_path.read_bytes()
+    previous_modified = ledger.ledger_path.stat().st_mtime_ns
+    reloaded = GrokRunLedger(tmp_path)
+    with pytest.raises(ValueError):
+        reloaded.mark_cancelled(
+            task_id="task",
+            expected_owner_id="owner",
+            expected_advisor_session_id="session",
+            reason="retry",
+        )
+    reloaded.mark_cancelled(
+        task_id="task",
+        expected_owner_id=None,
+        expected_advisor_session_id="session",
+        reason="retry after readback",
+    )
+    assert ledger.ledger_path.read_bytes() == previous_bytes
+    assert ledger.ledger_path.stat().st_mtime_ns == previous_modified
+
+
+def test_cancelled_task_stays_terminal_across_other_mutations(tmp_path: Path) -> None:
+    ledger = _seed_cancellation_ledger(tmp_path, "in_progress")
+    ledger.mark_cancelled(
+        task_id="task",
+        expected_owner_id="owner",
+        expected_advisor_session_id="session",
+        reason="User cancelled; owner stopped",
+    )
+    previous_bytes = ledger.ledger_path.read_bytes()
+    assert (
+        ledger.invalidate_on_snapshot_drift(task_id="task", current_sha="new").status
+        == "cancelled"
+    )
+    with pytest.raises(ValueError):
+        ledger.mark_advisor_blocked(task_id="task", reason="advisor unavailable")
+    with pytest.raises(ValueError):
+        ledger.mark_in_progress(
+            task_id="task",
+            owner_id="new-owner",
+            advisor_session_id="new-session",
+            base_sha="base",
+        )
+    with pytest.raises(ValueError):
+        ledger.mark_completed(
+            task_id="task",
+            reviewed_head="head",
+            all_changed_paths=(),
+            advisor_verdict="ENDORSE",
+            all_acceptance_mapping={},
+            all_test_evidence=[],
+        )
+    assert ledger.ledger_path.read_bytes() == previous_bytes