Function cancel_node_unlocked 

pub fn cancel_node_unlocked(
    lock: &LockedRun<'_>,
    paths: &RunPaths,
    node_id: &NodeId,
    note: Option<&str>,
) -> Result<NodeCancelOutcome>

The locked body of cancel_node. The lock: &LockedRun witness proves the caller already holds the run’s exclusive RunLock, so the manifest read, the log replay, the convergence read, the single report append, AND the optional last-node roll-up all share one critical section (it calls append_and_apply_unlocked, never crate::append_and_apply_event, which would deadlock by re-locking).