@@ -27,27 +27,18 @@ subagent flags, directly.
 - Andy runs Debian ("trixie") on his machines — **beryllium** and
   **niobium**. Default to Debian conventions, not Ubuntu, for anything
   environment/package related, unless told otherwise.
-- Releases are tagged (e.g. `v8.0.0-alpha.1`) on `main`. The exception
-  is a bugfix release made after `main` has moved on to the next minor
-  version: it goes on a `release/X.Y.Z` branch off the previous tag,
-  with the fixes cherry-picked from `main` (8.16.2 and 8.16.3 were made
-  this way while `main` was 8.17.0-dev). One long-lived branch exists by
-  design: `v9` (the code-name for the revamped ECCE; worktree `../ECCE-native`), the **9.x
-  experimental line** (plan on #133). Risky or structural work lands
-  there first: the libssh transport, the server/client package split,
-  STOMP broker access, the Coin3D viewer, retiring csh. `main` is the
-  **8.x stable line**: bug fixes go straight to it, and proven 9.x
-  changes are **backported** as small cherry-picks ("cherry picked
-  from ..."). "Proven" means its test passes on 9.x, it has run there
-  a while, and Andy has seen anything user-visible. Keep 9.x commits
-  backport-sized (one change plus its test), and bring `main` into 9.x
-  regularly so backports stay conflict-free. "v9" is a code-word for
-  the big future features, not a gate: anything from it that is useful
-  now and opt-in on 8.x can ship in an 8.x release, as the split
-  packages did in 8.16.6 (Andy, 2026-09-29). Old branches
-  (`develop`, `modernize-build`, `stable`, `master`, `make`) were
-  consolidated into `main` and renamed to `archive/*` — no reason to
-  branch from or compare against them.
+- Releases are tagged on `main`, which is the **9.x line** (9.0.0-dev
+  from 2026-10-01; the breaking changes — split packages, sh job
+  scripts, no site-defined shells, "killed" only on a user cancel —
+  made it 9.0.0). **8.x gets bug fixes only** (Andy, 2026-10-01): each
+  8.x patch release goes on its own `release/X.Y.Z` branch off the
+  previous tag, with the fix cherry-picked from `main` (`-x`), as
+  8.18.1 and 8.18.2 were. Before tagging, run `tests/teaching` on the
+  release branch. The `v9` branch was merged into `main` and retired
+  (`archive/v9`); work that needs isolation goes on short-lived `wip/*`
+  branches. Old branches (`develop`, `modernize-build`, `stable`,
+  `master`, `make`) were consolidated into `main` and renamed to
+  `archive/*` — no reason to branch from or compare against them.
 - Build directory is `build-cmake` (not `cmake-build`) — `ninja` or
   `cmake --build .` from inside it.
 - **The Gateway window no longer appears** (#93, 2026-09-22). `ecce`
 
@@ -1732,6 +1732,17 @@ if(PYTHON3_EXECUTABLE)
                    ${CMAKE_CURRENT_SOURCE_DIR}/tests/launch/jobwait_test.py --control
            WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/tests/launch)
   set_tests_properties(launch_jobwait PROPERTIES TIMEOUT 120 SKIP_RETURN_CODE 77)
+  add_test(NAME launch_cancel
+           COMMAND ${PYTHON3_EXECUTABLE}
+                   ${CMAKE_CURRENT_SOURCE_DIR}/tests/launch/cancel_test.py
+                   --build ${CMAKE_BINARY_DIR}
+           WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/tests/launch)
+  set_tests_properties(launch_cancel PROPERTIES TIMEOUT 900 SKIP_RETURN_CODE 77)
+  add_test(NAME launch_filewait
+           COMMAND ${PYTHON3_EXECUTABLE}
+                   ${CMAKE_CURRENT_SOURCE_DIR}/tests/launch/filewait_test.py
+           WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/tests/launch)
+  set_tests_properties(launch_filewait PROPERTIES TIMEOUT 120 SKIP_RETURN_CODE 77)
 
   # tests/teaching -- introductory chemistry teaching calculations run end
   # to end through Launch, with NWChem, and checked against known answers.
 
@@ -251,6 +251,10 @@ releases, and why each fix was made, are in `docs/HISTORY.md`.
      releases; drop the oldest minor when a new one is added. Everything
      older is on the releases page. -->
 
+- **v8.18.2** — a job that finishes while its monitor is restarting is no
+  longer stored as killed.
+- **v8.18.1** — a fresh calculation's output file is no longer sometimes
+  named "Outputs", which lost MOPAC's energies and geometries (#207).
 - **v8.18.0** — experimental built-in ssh (Edit > Preferences): commands,
   file copies and job monitoring without a shell session, a host-key
   dialog (#204); telnet, Globus and rsh removed; Machine Registration
 
@@ -1 +1 @@
-8.18.0
+9.0.0
@@ -121,6 +121,12 @@ class TaskJob : public Job,
       virtual bool launchdata(const Launchdata& launchinfo);
       virtual Launchdata launchdata(const bool &useInputProvider = false) const;
 
+      /** The user asked for this job to be cancelled.  eccejobstore reads it
+          to tell a cancelled job from one that vanished.  Cleared by
+          launch and by any reset to created/ready. */
+      virtual bool killRequested(bool requested);
+      virtual bool killRequested() const;
+
       virtual bool joblog(const char* log);
       virtual string joblog(void) const;
 
 
@@ -1503,6 +1503,10 @@ sub FileWait
 
     if ($status == $TRY_TIMEOUT)
     {
+        # The alarm can cut the last pause short just after the file
+        # appeared; look once more before giving up.
+        return undef if (-e $file);
+
         $errMsg = "$what '$file' "
             . "does not exist and have nonzero size within "
             . "$timeLimit seconds";
@@ -1567,6 +1571,10 @@ sub FileWait2
     }
     elsif ($status == $TRY_TIMEOUT)
     {
+        # Same last look as FileWait: the alarm can cut the final pause short.
+        $result = &$function();
+        return ($TRY_OK, $result) if ($result);
+
         $errMsg = "neither $what1 '$file1' nor $what2 '$file2'"
             . "exist and have nonzero size within "
             . "$timeLimit seconds";
@@ -2037,15 +2045,32 @@ sub JobCheck
     }
     elsif ($q eq 'moab')
     {
-        $cmd = "squeue -h -a -j $id -o %T 2>&1";
+        # checkjob, not squeue: a Moab site need not run Slurm, and an
+        # unknown id would read as a finished job at once (#209).
+        $cmd = "checkjob $id 2>&1";
         if (open(QUERY, "$cmd |"))
         {
             while (<QUERY>)
             {
                 LogMsg "JobCheck Moab status:  $_";
 
-                my $state = $_;
-                chomp $state;
+                my $state;
+                if (/^State:\s*(\S+)/)
+                {
+                    $state = uc $1;
+                }
+                elsif (/cannot locate job/)
+                {
+                    if ($gJobCheckState != $JOB_STATE_NONE)
+                    {
+                        $status = $JOB_STATE_DONE;
+                    }
+                    last;
+                }
+                else
+                {
+                    next;
+                }
 
                 my $capq = uc $q;
                 &MsgSendUp("$capq job id '$id' in state '$state'");
 
@@ -138,13 +138,18 @@ string RunMgmt::terminate(const TaskJob *calc)
         // shell config enabled it, there's no reason this internal,
         // ECCE-controlled status write should ever want to fail because
         // of it.
+        // Before the status file: the monitor may report 302 the moment
+        // it appears, and eccejobstore calls that a cancel only with this
+        // set.  Withdrawn below if the request could not be made.
+        const_cast<TaskJob*>(calc)->killRequested(true);
         string fixStatus = "echo 302 > ";
         fixStatus += job.jobpath + "/.ecce.status";
         if (rcmd.exec(fixStatus)) {
           string outstr;
-          if (rcmd.execout(command, outstr))
+          if (rcmd.execout(command, outstr)) {
             ret = "Request to terminate job " + id + " on " +
                   launch.machine + " has been issued";
+          }
           else {
             // If the job has already completed then the kill command
             // will return "No such process" and no $status
@@ -166,6 +171,13 @@ string RunMgmt::terminate(const TaskJob *calc)
     } else
       ret = rcmd.commError();
 
+    // The Shell cancel command ends with a second kill that fails once the
+    // first has worked, so "process not found" still means the user's
+    // request went through.
+    if (ret.find("has been issued") == string::npos &&
+        ret.find("process not found") == string::npos)
+      const_cast<TaskJob*>(calc)->killRequested(false);
+
     delete refMachine;
   } else
     ret = "Request to terminate job not issued--unable to lookup job id";
 
@@ -2391,13 +2391,11 @@ void interactStatus(char* statusData)
   static int lastStatus = -1;
 
   int status = 0;
+  bool emptyStatus = (statusData==NULL || *statusData=='\0');
 
-  if (statusData==NULL || *statusData=='\0') {
+  if (emptyStatus)
     status = 302;
-    logErr("eccejobmonitor",
-           "Status message contained no value--setting calculation to killed "
-           "(possible file system problem on compute server, disk full?)");
-  } else
+  else
     status = atoi(statusData);
 
   if (lastStatus != status) {
@@ -2420,7 +2418,21 @@ void interactStatus(char* statusData)
       }
     } else if (status == 302) {
       gUnsuccessfulStatus = 0;
-      calcUpdateState(ResourceDescriptor::STATE_KILLED);
+      // 302 only means the job is gone.  It is a cancel only if the user
+      // asked for one (RunMgmt::terminate); read it fresh, the request was
+      // made by another process.
+      if (calculation && calculation->killRequested()) {
+        calcUpdateState(ResourceDescriptor::STATE_KILLED);
+      } else {
+        gFailReason = emptyStatus
+          ? "The job monitor sent an empty status (possible file system "
+            "problem on the compute server, disk full?) and the job was "
+            "not cancelled by the user"
+          : "The job ended with neither an output file nor a status file, "
+            "and was not cancelled by the user";
+        logErr("eccejobmonitor", gFailReason);
+        calcUpdateState(ResourceDescriptor::STATE_SYSTEM_FAILURE);
+      }
     } else if (status == 303) {
       gUnsuccessfulStatus = 0;
       calcUpdateState(ResourceDescriptor::STATE_LOADED);
 
@@ -2142,8 +2142,10 @@ void Launch::updateState(void)
   // Also switch "created" calcs because that's what they are for imports
   // Lisong 07/24/06: Not sure if setState sending notification will
   // cause problem or not.
-  if (currentState <= ResourceDescriptor::STATE_READY)
+  if (currentState <= ResourceDescriptor::STATE_READY) {
+    p_taskjob->killRequested(false);
     p_taskjob->setState(ResourceDescriptor::STATE_SUBMITTED);
+  }
 
     // special STTR reaction rate study logic to reset the state of all
     // follow-on tasks to force input file regeneration because it's likely
 
@@ -358,6 +358,24 @@ Jobdata TaskJob::jobdata() const
 }
 
 
+bool TaskJob::killRequested(bool requested)
+{
+  vector<MetaDataResult> results(1);
+  results[0].name = VDoc::getEcceNamespace() + ":killrequested";
+  results[0].value = requested ? "true" : "";
+  return addProps(results);
+}
+
+
+/** Reads from the server, not the property cache: the request is made by
+    another process. */
+bool TaskJob::killRequested() const
+{
+  const_cast<TaskJob*>(this)->updateProps();
+  return getProp(VDoc::getEcceNamespace() + ":killrequested") == "true";
+}
+
+
 /**
  * Sets launch data associated with the task.
  *
@@ -1769,7 +1787,7 @@ bool TaskJob::canChangeState(string & message) const
 bool TaskJob::setState(const ResourceDescriptor::RUNSTATE& state)
 {
   string stateName = ResourceUtils::stateToString(state);
-  vector<MetaDataResult> results((state<=ResourceDescriptor::STATE_READY)?6:2);
+  vector<MetaDataResult> results((state<=ResourceDescriptor::STATE_READY)?7:2);
   results[0].name = VDoc::getEcceNamespace() + ":state";
   results[0].value = stateName;
   results[1].name = VDoc::getEcceNamespace() + ":rerun";
@@ -1783,6 +1801,8 @@ bool TaskJob::setState(const ResourceDescriptor::RUNSTATE& state)
     results[4].value = "false";
     results[5].name = VDoc::getEcceNamespace() + ":reviewedDate";
     results[5].value = "";
+    results[6].name = VDoc::getEcceNamespace() + ":killrequested";
+    results[6].value = "";
   }
 
   bool ret = addProps(results);