claude-dev-env 8.26.6 → 8.28.0

package/bin/export-pstack-skills.test.mjs

@@ -0,0 +1,64 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createHash } from 'node:crypto';
+import { exportPstackSkills } from './export-pstack-skills.mjs';
+
+function fixture(context) {
+    const root = mkdtempSync(join(tmpdir(), 'pstack-export-test-'));
+    context.after(() => rmSync(root, { recursive: true, force: true }));
+    const plugin = join(root, 'plugin');
+    const target = join(root, 'repo', '.agents', 'skills');
+    mkdirSync(join(plugin, '.codex-plugin'), { recursive: true });
+    writeFileSync(join(plugin, '.codex-plugin', 'plugin.json'), JSON.stringify({
+        name: 'pstack', version: '0.9.53', repository: 'https://github.com/michael-denyer/pstack-claude', skills: './skills/',
+    }));
+    mkdirSync(join(plugin, 'skills', 'poteto-mode', 'references'), { recursive: true });
+    mkdirSync(join(plugin, 'skills', 'unslop'), { recursive: true });
+    writeFileSync(join(plugin, 'skills', 'poteto-mode', 'SKILL.md'), '---\nname: poteto-mode\n---\nUpstream body\n');
+    writeFileSync(join(plugin, 'skills', 'poteto-mode', 'references', 'codex-tools.md'), 'Tool mapping\n');
+    writeFileSync(join(plugin, 'skills', 'unslop', 'SKILL.md'), 'Sibling dependency\n');
+    mkdirSync(join(plugin, 'skills', 'poteto-mode', 'references', 'licenses'));
+    writeFileSync(join(plugin, 'skills', 'poteto-mode', 'references', 'licenses', 'LICENSE'), 'Upstream license\n');
+    return { root, plugin, target };
+}
+
+test('exports upstream bodies and dependencies unchanged with verifiable provenance', context => {
+    const { plugin, target } = fixture(context);
+    const receipt = exportPstackSkills(plugin, target);
+    assert.equal(receipt.skillCount, 2);
+    assert.equal(receipt.cloudInvocation, 'unverified');
+    assert.equal(receipt.expectedRepositorySkillName, 'poteto-mode');
+    for (const [path, hash] of Object.entries(receipt.files)) {
+        const exported = readFileSync(join(target, path));
+        assert.deepEqual(exported, readFileSync(join(plugin, 'skills', path)));
+        assert.equal(createHash('sha256').update(exported).digest('hex'), hash);
+    }
+    assert.deepEqual(JSON.parse(readFileSync(join(target, 'pstack-export.json'))), receipt);
+    assert.equal(readFileSync(join(target, 'PSTACK-LICENSE'), 'utf8'), 'Upstream license\n');
+});
+
+test('existing custom skills survive a rejected repeat export', context => {
+    const { plugin, target } = fixture(context);
+    exportPstackSkills(plugin, target);
+    const customPath = join(target, 'poteto-mode', 'SKILL.md');
+    writeFileSync(customPath, 'Custom instructions\n');
+    assert.throws(() => exportPstackSkills(plugin, target), /already exists/);
+    assert.equal(readFileSync(customPath, 'utf8'), 'Custom instructions\n');
+});
+
+test('a source symlink is rejected before creating the destination', context => {
+    const { plugin, target } = fixture(context);
+    symlinkSync(join(plugin, 'skills', 'poteto-mode', 'SKILL.md'), join(plugin, 'skills', 'linked-skill'));
+    assert.throws(() => exportPstackSkills(plugin, target), /Unsupported source entry/);
+    assert.equal(existsSync(target), false);
+});
+
+test('a plugin without the required poteto entry cannot produce a partial export', context => {
+    const { plugin, target } = fixture(context);
+    rmSync(join(plugin, 'skills', 'poteto-mode', 'SKILL.md'));
+    assert.throws(() => exportPstackSkills(plugin, target), /ENOENT/);
+    assert.equal(existsSync(target), false);
+});

package/hooks/hooks_constants/orchestrator_auto_starter_constants.py

@@ -16,7 +16,8 @@ ALL_ORCHESTRATOR_STARTER_ENABLED_ENV_VALUES: frozenset[str] = frozenset(
 ORCHESTRATOR_STARTER_TIMEOUT_MILLISECONDS: int = 50
 
 ORCHESTRATOR_SESSION_START_DIRECTIVE: str = (
-    "SessionStart orchestrator opt-in is active. Load the orchestrator skill "
-    "and run in executor-advisor mode for this session's multi-step work. "
-    "Do not invent a second orchestrator path; follow the skill."
+    "SessionStart orchestrator opt-in is active. Load the orchestrator skill. "
+    "Track this session's goals across inline and delegated work. "
+    "Recover saved state at startup, resume, and after compaction. "
+    "Keep context small by delegating bulky work when useful."
 )

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.26.6",
+    "version": "8.28.0",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {

package/scripts/dev_env_scripts_constants/grok_run_ledger_constants.py

@@ -20,6 +20,9 @@ TASK_STATUS_IN_PROGRESS: str = "in_progress"
 TASK_STATUS_COMPLETED: str = "completed"
 """Task reached a successful terminal state."""
 
+TASK_STATUS_CANCELLED: str = "cancelled"
+"""Task stopped after caller-authorized cancellation and owner termination."""
+
 TASK_STATUS_ADVISOR_BLOCKED: str = "advisor_blocked"
 """Task stopped because the advisor bind or verdict failed closed."""
 
@@ -31,12 +34,23 @@ ALL_LEGAL_TASK_STATUSES: frozenset[str] = frozenset(
         TASK_STATUS_PENDING,
         TASK_STATUS_IN_PROGRESS,
         TASK_STATUS_COMPLETED,
+        TASK_STATUS_CANCELLED,
         TASK_STATUS_ADVISOR_BLOCKED,
         TASK_STATUS_PENDING_REVIEW,
     }
 )
 """Every legal task status the ledger accepts."""
 
+ALL_CANCELLABLE_TASK_STATUSES: frozenset[str] = frozenset(
+    {
+        TASK_STATUS_PENDING,
+        TASK_STATUS_IN_PROGRESS,
+        TASK_STATUS_ADVISOR_BLOCKED,
+        TASK_STATUS_PENDING_REVIEW,
+    }
+)
+"""Task states that permit terminal cancellation."""
+
 UTF8_ENCODING: str = "utf-8"
 """Text encoding for ledger and patch-manifest files."""
 

package/scripts/grok_run_ledger.py

@@ -27,11 +27,13 @@ from dataclasses import asdict, dataclass, field
 from pathlib import Path
 
 from dev_env_scripts_constants.grok_run_ledger_constants import (
+    ALL_CANCELLABLE_TASK_STATUSES,
     ALL_LEGAL_TASK_STATUSES,
     JSON_INDENT,
     LEDGER_FILENAME,
     LEDGER_SCHEMA_VERSION,
     TASK_STATUS_ADVISOR_BLOCKED,
+    TASK_STATUS_CANCELLED,
     TASK_STATUS_COMPLETED,
     TASK_STATUS_IN_PROGRESS,
     TASK_STATUS_PENDING,
@@ -41,7 +43,6 @@ from dev_env_scripts_constants.grok_run_ledger_constants import (
     UTF8_ENCODING,
 )
 
-
 @dataclass
 class LedgerTaskRecord:
     """One delegated unit tracked in the run ledger."""
@@ -163,15 +164,17 @@ class GrokRunLedger:
         return self._task_by_id[task_id]
 
     def can_dispatch(self, task_id: str) -> bool:
-        """Return whether every dependency has completed successfully.
+        """Return whether an uncancelled task has completed dependencies.
 
         Args:
             task_id: Task to evaluate.
 
         Returns:
-            True when every dependency is ``completed``.
+            Whether the task is uncancelled and every dependency is completed.
         """
         record = self.get_task(task_id)
+        if record.status == TASK_STATUS_CANCELLED:
+            return False
         for each_dependency in record.dependencies:
             dependency_record = self._task_by_id.get(each_dependency)
             if dependency_record is None:
@@ -229,6 +232,92 @@ class GrokRunLedger:
         self._atomic_write()
         return record
 
+    def release_terminated_owner(
+        self,
+        *,
+        task_id: str,
+        expected_owner_id: str,
+        expected_advisor_session_id: str,
+    ) -> LedgerTaskRecord:
+        """Release after caller verifies death and saves assignment/artifact history.
+        Args:
+            task_id: Task to release under freshly loaded single-writer ownership.
+            expected_owner_id: Nonempty owner identity from the assignment.
+            expected_advisor_session_id: Nonempty session from the assignment.
+        Returns:
+            Pending-review task retaining its base, session, and evidence.
+        Raises:
+            ValueError: When status or either current identity does not match.
+        """
+        record = self.get_task(task_id)
+        if record.status != TASK_STATUS_IN_PROGRESS:
+            raise ValueError(f"cannot release task from status {record.status}")
+        if not expected_owner_id or record.owner_id != expected_owner_id:
+            raise ValueError(f"owner identity changed for {task_id}")
+        session_matches = record.advisor_session_id == expected_advisor_session_id
+        if not expected_advisor_session_id or not session_matches:
+            raise ValueError(f"advisor session changed for {task_id}")
+        record.status = TASK_STATUS_PENDING_REVIEW
+        record.owner_id = None
+        self._atomic_write()
+        return record
+
+    def mark_cancelled(
+        self,
+        *,
+        task_id: str,
+        expected_owner_id: str | None,
+        expected_advisor_session_id: str | None,
+        reason: str,
+    ) -> LedgerTaskRecord:
+        """Cancel after the caller saves authorization and confirms owner termination.
+        Args:
+            task_id: Task under freshly loaded single-writer ownership.
+            expected_owner_id: Current owner, or None for an unassigned task.
+            expected_advisor_session_id: Current advisor session, or None.
+            reason: Nonempty cancellation evidence to append.
+        Returns:
+            Cancelled record retaining evidence and session; retries do not write.
+        """
+        record = self.get_task(task_id)
+        self._require_cancellation_request(
+            record, expected_owner_id, expected_advisor_session_id, reason
+        )
+        if record.status == TASK_STATUS_CANCELLED:
+            return record
+        record.status = TASK_STATUS_CANCELLED
+        record.owner_id = None
+        record.test_evidence.append(reason)
+        self._atomic_write()
+        return record
+
+    def _require_cancellation_request(
+        self,
+        record: LedgerTaskRecord,
+        expected_owner_id: str | None,
+        expected_advisor_session_id: str | None,
+        reason: str,
+    ) -> None:
+        """Compare both identities before changing cancellation state."""
+        if expected_owner_id == "" or record.owner_id != expected_owner_id:
+            raise ValueError(f"owner identity changed for {record.task_id}")
+        if (
+            expected_advisor_session_id == ""
+            or record.advisor_session_id != expected_advisor_session_id
+        ):
+            raise ValueError(f"advisor session changed for {record.task_id}")
+        if record.status == TASK_STATUS_IN_PROGRESS and (
+            expected_owner_id is None or expected_advisor_session_id is None
+        ):
+            raise ValueError("in-progress cancellation requires owner and session")
+        if not reason.strip():
+            raise ValueError("cancellation reason must be nonempty")
+        if (
+            record.status != TASK_STATUS_CANCELLED
+            and record.status not in ALL_CANCELLABLE_TASK_STATUSES
+        ):
+            raise ValueError(f"cannot cancel task from status {record.status}")
+
     def mark_completed(
         self,
         *,
@@ -278,6 +367,8 @@ class GrokRunLedger:
             The blocked task record.
         """
         record = self.get_task(task_id)
+        if record.status == TASK_STATUS_CANCELLED:
+            raise ValueError(f"cannot block task from status {record.status}")
         record.status = TASK_STATUS_ADVISOR_BLOCKED
         record.test_evidence = [reason]
         self._atomic_write()
@@ -299,6 +390,8 @@ class GrokRunLedger:
             The updated task record (unchanged when SHAs match).
         """
         record = self.get_task(task_id)
+        if record.status == TASK_STATUS_CANCELLED:
+            return record
         if record.base_sha is None or record.base_sha == current_sha:
             return record
         record.status = TASK_STATUS_PENDING_REVIEW

package/scripts/test_grok_run_ledger.py

@@ -114,3 +114,376 @@ def test_completed_records_acceptance_and_head(tmp_path: Path) -> None:
     assert record.status == TASK_STATUS_COMPLETED
     assert record.reviewed_head == "head"
     assert record.changed_paths == ("a.py",)
+
+
+def test_release_terminated_owner_allows_same_base_reassignment_after_reload(
+    tmp_path: Path,
+) -> None:
+    ledger = GrokRunLedger(tmp_path)
+    ledger.register_task(task_id="task", all_dependencies=())
+    ledger.mark_in_progress(
+        task_id="task",
+        owner_id="old-owner",
+        advisor_session_id="old-session",
+        base_sha="base",
+    )
+
+    released_record = ledger.release_terminated_owner(
+        task_id="task",
+        expected_owner_id="old-owner",
+        expected_advisor_session_id="old-session",
+    )
+
+    assert released_record.status == TASK_STATUS_PENDING_REVIEW
+    assert released_record.owner_id is None
+    assert released_record.advisor_session_id == "old-session"
+    assert released_record.base_sha == "base"
+
+    reloaded_ledger = GrokRunLedger(tmp_path)
+    replacement_record = reloaded_ledger.mark_in_progress(
+        task_id="task",
+        owner_id="new-owner",
+        advisor_session_id="new-session",
+        base_sha="base",
+    )
+    persisted_record = GrokRunLedger(tmp_path).get_task("task")
+
+    assert replacement_record.base_sha == "base"
+    assert persisted_record.status == "in_progress"
+    assert persisted_record.owner_id == "new-owner"
+    assert persisted_record.advisor_session_id == "new-session"
+    assert persisted_record.base_sha == "base"
+
+
+@pytest.mark.parametrize(
+    (
+        "expected_owner_id",
+        "expected_advisor_session_id",
+        "persisted_owner_id",
+        "persisted_advisor_session_id",
+        "should_complete",
+    ),
+    [
+        ("different-owner", "session", "owner", "session", False),
+        ("owner", "different-session", "owner", "session", False),
+        ("", "session", "", "session", False),
+        ("owner", "", "owner", "", False),
+        ("owner", "session", "owner", "session", True),
+    ],
+)
+def test_release_terminated_owner_rejects_stale_identity_and_illegal_status(
+    tmp_path: Path,
+    expected_owner_id: str,
+    expected_advisor_session_id: str,
+    persisted_owner_id: str,
+    persisted_advisor_session_id: str,
+    should_complete: bool,
+) -> None:
+    ledger = GrokRunLedger(tmp_path)
+    ledger.register_task(task_id="task", all_dependencies=())
+    ledger.mark_in_progress(
+        task_id="task",
+        owner_id=persisted_owner_id,
+        advisor_session_id=persisted_advisor_session_id,
+        base_sha="base",
+    )
+    ledger_path = tmp_path / "grok-run-ledger.json"
+    if should_complete:
+        ledger.mark_completed(
+            task_id="task",
+            reviewed_head="head",
+            all_changed_paths=(),
+            advisor_verdict="ENDORSE",
+            all_acceptance_mapping={},
+            all_test_evidence=["pytest -q"],
+        )
+
+    task_before = ledger.get_task("task")
+    task_state_before = (
+        task_before.status,
+        task_before.owner_id,
+        task_before.advisor_session_id,
+        task_before.base_sha,
+    )
+    persisted_bytes_before = ledger_path.read_bytes()
+
+    with pytest.raises(ValueError):
+        ledger.release_terminated_owner(
+            task_id="task",
+            expected_owner_id=expected_owner_id,
+            expected_advisor_session_id=expected_advisor_session_id,
+        )
+
+    task_after = ledger.get_task("task")
+    assert ledger_path.read_bytes() == persisted_bytes_before
+    assert (
+        task_after.status,
+        task_after.owner_id,
+        task_after.advisor_session_id,
+        task_after.base_sha,
+    ) == task_state_before
+
+
+def test_release_terminated_owner_preserves_dependencies_and_evidence(
+    tmp_path: Path,
+) -> None:
+    ledger = GrokRunLedger(tmp_path)
+    ledger.register_task(task_id="dependency", all_dependencies=())
+    ledger.mark_in_progress(
+        task_id="dependency",
+        owner_id="dependency-owner",
+        advisor_session_id="dependency-session",
+        base_sha="base",
+    )
+    ledger.mark_completed(
+        task_id="dependency",
+        reviewed_head="dependency-head",
+        all_changed_paths=(),
+        advisor_verdict="ENDORSE",
+        all_acceptance_mapping={},
+        all_test_evidence=["dependency passed"],
+    )
+    ledger.register_task(task_id="task", all_dependencies=("dependency",))
+    ledger.mark_in_progress(
+        task_id="task",
+        owner_id="owner",
+        advisor_session_id="session",
+        base_sha="base",
+    )
+    ledger_path = tmp_path / "grok-run-ledger.json"
+    ledger_document = json.loads(ledger_path.read_text(encoding="utf-8"))
+    target_task = next(
+        each_task
+        for each_task in ledger_document["tasks"]
+        if each_task["task_id"] == "task"
+    )
+    target_task["advisor_verdict"] = "ENDORSE"
+    target_task["reviewed_head"] = "reviewed-head"
+    target_task["changed_paths"] = ["source.py"]
+    target_task["acceptance_mapping"] = {"criterion": "evidence"}
+    target_task["test_evidence"] = ["pytest -q"]
+    ledger_path.write_text(
+        json.dumps(ledger_document, indent=2) + "\n",
+        encoding="utf-8",
+    )
+
+    reloaded_ledger = GrokRunLedger(tmp_path)
+    reloaded_ledger.release_terminated_owner(
+        task_id="task",
+        expected_owner_id="owner",
+        expected_advisor_session_id="session",
+    )
+    persisted_record = GrokRunLedger(tmp_path).get_task("task")
+
+    assert persisted_record.dependencies == ("dependency",)
+    assert persisted_record.advisor_session_id == "session"
+    assert persisted_record.base_sha == "base"
+    assert persisted_record.advisor_verdict == "ENDORSE"
+    assert persisted_record.reviewed_head == "reviewed-head"
+    assert persisted_record.changed_paths == ("source.py",)
+    assert persisted_record.acceptance_mapping == {"criterion": "evidence"}
+    assert persisted_record.test_evidence == ["pytest -q"]
+    assert reloaded_ledger.can_dispatch("task") is True
+
+
+def _seed_cancellation_ledger(tmp_path: Path, status: str) -> GrokRunLedger:
+    ledger = GrokRunLedger(tmp_path)
+    ledger.register_task(task_id="task", all_dependencies=("dependency",))
+    ledger_path = tmp_path / "grok-run-ledger.json"
+    ledger_document = json.loads(ledger_path.read_text(encoding="utf-8"))
+    ledger_document["tasks"][0].update(
+        status=status,
+        owner_id="owner",
+        advisor_session_id="session",
+        base_sha="base",
+        reviewed_head="head",
+        changed_paths=["source.py"],
+        advisor_verdict="ENDORSE",
+        acceptance_mapping={"criterion": "proof"},
+        test_evidence=["pytest passed"],
+    )
+    ledger_path.write_text(json.dumps(ledger_document), encoding="utf-8")
+    return GrokRunLedger(tmp_path)
+
+
+@pytest.mark.parametrize(
+    "status", ["pending", "pending_review", "advisor_blocked", "in_progress"]
+)
+def test_mark_cancelled_preserves_assignment_and_evidence(
+    tmp_path: Path, status: str
+) -> None:
+    ledger = _seed_cancellation_ledger(tmp_path, status)
+    previous_document = json.loads(ledger.ledger_path.read_text(encoding="utf-8"))
+    ledger.mark_cancelled(
+        task_id="task",
+        expected_owner_id="owner",
+        expected_advisor_session_id="session",
+        reason="User cancelled; owner stopped",
+    )
+    expected_document = previous_document
+    expected_document["tasks"][0].update(
+        status="cancelled",
+        owner_id=None,
+        test_evidence=["pytest passed", "User cancelled; owner stopped"],
+    )
+    assert (
+        json.loads(ledger.ledger_path.read_text(encoding="utf-8")) == expected_document
+    )
+    reloaded = GrokRunLedger(tmp_path)
+    assert reloaded.get_task("task").status == "cancelled"
+    assert is_legal_status(reloaded.get_task("task").status)
+    assert reloaded.can_dispatch("task") is False
+
+
+@pytest.mark.parametrize(
+    "expected_owner_id,expected_session,reason",
+    [
+        ("other", "session", "cancel"),
+        ("owner", "other", "cancel"),
+        ("", "session", "cancel"),
+        ("owner", "", "cancel"),
+        (None, "session", "cancel"),
+        ("owner", None, "cancel"),
+        ("owner", "session", ""),
+        ("owner", "session", "   "),
+    ],
+)
+def test_mark_cancelled_rejects_invalid_request_without_changes(
+    tmp_path: Path,
+    expected_owner_id: str | None,
+    expected_session: str | None,
+    reason: str,
+) -> None:
+    ledger = _seed_cancellation_ledger(tmp_path, "in_progress")
+    previous_bytes = ledger.ledger_path.read_bytes()
+    with pytest.raises(ValueError):
+        ledger.mark_cancelled(
+            task_id="task",
+            expected_owner_id=expected_owner_id,
+            expected_advisor_session_id=expected_session,
+            reason=reason,
+        )
+    assert ledger.ledger_path.read_bytes() == previous_bytes
+    assert ledger.get_task("task").status == "in_progress"
+    assert ledger.get_task("task").owner_id == "owner"
+
+
+def test_mark_cancelled_rejects_completed_task(tmp_path: Path) -> None:
+    ledger = _seed_cancellation_ledger(tmp_path, "completed")
+    previous_bytes = ledger.ledger_path.read_bytes()
+    with pytest.raises(ValueError):
+        ledger.mark_cancelled(
+            task_id="task",
+            expected_owner_id="owner",
+            expected_advisor_session_id="session",
+            reason="cancel",
+        )
+    assert ledger.ledger_path.read_bytes() == previous_bytes
+
+
+@pytest.mark.parametrize(
+    "owner_id,session_id",
+    [(None, None), (None, "session"), ("owner", None), ("", "session"), ("owner", "")],
+)
+def test_mark_cancelled_rejects_incomplete_live_assignment(
+    tmp_path: Path,
+    owner_id: str | None,
+    session_id: str | None,
+) -> None:
+    ledger = _seed_cancellation_ledger(tmp_path, "in_progress")
+    ledger_document = json.loads(ledger.ledger_path.read_text(encoding="utf-8"))
+    ledger_document["tasks"][0].update(owner_id=owner_id, advisor_session_id=session_id)
+    ledger.ledger_path.write_text(json.dumps(ledger_document), encoding="utf-8")
+    previous_bytes = ledger.ledger_path.read_bytes()
+    reloaded = GrokRunLedger(tmp_path)
+    with pytest.raises(ValueError):
+        reloaded.mark_cancelled(
+            task_id="task",
+            expected_owner_id=owner_id,
+            expected_advisor_session_id=session_id,
+            reason="cancel",
+        )
+    assert ledger.ledger_path.read_bytes() == previous_bytes
+    assert reloaded.get_task("task").status == "in_progress"
+
+
+def test_mark_cancelled_accepts_unassigned_task_and_blocks_dependents(
+    tmp_path: Path,
+) -> None:
+    ledger = GrokRunLedger(tmp_path)
+    ledger.register_task(task_id="task")
+    ledger.register_task(task_id="child", all_dependencies=("task",))
+    ledger.mark_cancelled(
+        task_id="task",
+        expected_owner_id=None,
+        expected_advisor_session_id=None,
+        reason="User cancelled before dispatch",
+    )
+    assert ledger.get_task("task").status == "cancelled"
+    assert ledger.get_task("task").owner_id is None
+    assert ledger.can_dispatch("task") is False
+    assert ledger.can_dispatch("child") is False
+
+
+def test_mark_cancelled_retry_requires_current_identity_and_leaves_bytes_unchanged(
+    tmp_path: Path,
+) -> None:
+    ledger = _seed_cancellation_ledger(tmp_path, "in_progress")
+    ledger.mark_cancelled(
+        task_id="task",
+        expected_owner_id="owner",
+        expected_advisor_session_id="session",
+        reason="User cancelled; owner stopped",
+    )
+    previous_bytes = ledger.ledger_path.read_bytes()
+    previous_modified = ledger.ledger_path.stat().st_mtime_ns
+    reloaded = GrokRunLedger(tmp_path)
+    with pytest.raises(ValueError):
+        reloaded.mark_cancelled(
+            task_id="task",
+            expected_owner_id="owner",
+            expected_advisor_session_id="session",
+            reason="retry",
+        )
+    reloaded.mark_cancelled(
+        task_id="task",
+        expected_owner_id=None,
+        expected_advisor_session_id="session",
+        reason="retry after readback",
+    )
+    assert ledger.ledger_path.read_bytes() == previous_bytes
+    assert ledger.ledger_path.stat().st_mtime_ns == previous_modified
+
+
+def test_cancelled_task_stays_terminal_across_other_mutations(tmp_path: Path) -> None:
+    ledger = _seed_cancellation_ledger(tmp_path, "in_progress")
+    ledger.mark_cancelled(
+        task_id="task",
+        expected_owner_id="owner",
+        expected_advisor_session_id="session",
+        reason="User cancelled; owner stopped",
+    )
+    previous_bytes = ledger.ledger_path.read_bytes()
+    assert (
+        ledger.invalidate_on_snapshot_drift(task_id="task", current_sha="new").status
+        == "cancelled"
+    )
+    with pytest.raises(ValueError):
+        ledger.mark_advisor_blocked(task_id="task", reason="advisor unavailable")
+    with pytest.raises(ValueError):
+        ledger.mark_in_progress(
+            task_id="task",
+            owner_id="new-owner",
+            advisor_session_id="new-session",
+            base_sha="base",
+        )
+    with pytest.raises(ValueError):
+        ledger.mark_completed(
+            task_id="task",
+            reviewed_head="head",
+            all_changed_paths=(),
+            advisor_verdict="ENDORSE",
+            all_acceptance_mapping={},
+            all_test_evidence=[],
+        )
+    assert ledger.ledger_path.read_bytes() == previous_bytes