Function cancel_node 

pub fn cancel_node(
    paths: &RunPaths,
    node_id: &NodeId,
    note: Option<&str>,
) -> Result<NodeCancelOutcome>

Cancel exactly ONE live node of a run, preserving its branch + worktree. Acquires the run’s RunLock once and delegates to cancel_node_unlocked.

This is the fan-out selectivity primitive (design §2.5, issue per-node-run): where cancel_run settles every live node and rolls the run up to Cancelled in one shot, this settles a single named node. While any sibling is still live it appends only that node’s terminal cancel node.report (no run.status) — the run stays live so the batch keeps running. When it settles the last live node it also rolls the run up to a terminal status in the same locked transaction (so a dead supervisor can never strand the run non-terminal — llm-review C1). The synthesized terminal cancel node.report classifies as Cancelled → Teardown::SourceRelative, so invariant 5 preserves the node’s committed work rather than force-deleting it.

Errors

• Error::RunAlreadyTerminal if the run is Done/Failed — refused without mutating state (mirrors cancel_run; an already-Cancelled run is not refused — its live nodes can still be settled).
• Error::NodeNotFound if node_id names no node in the run’s log.
• I/O / corrupt-log errors from reading the manifest, replaying the log, or appending the report.