Function force_cancel_in 

pub fn force_cancel_in(run_dir: &Path, now: i64) -> ForceCancelOutcome

Force the run in run_dir to Cancelled, stamping updated_at with now.

This is the floor under every kill path: it needs nothing but the filesystem, so it works for a run the daemon can’t rebuild (blueprint deleted, metadata corrupt, died mid-spawn) and for a run whose daemon is gone entirely. Both the daemon’s force-terminator seam and lev cancel --force route here so there is one definition of “terminated on disk”.

A directory whose meta.json is missing or unparseable still gets a minimal Cancelled record written: such a run is otherwise skipped by list_runs, which makes it invisible and permanent.