fix(tui): refuse a worker cancel the runtime acknowledger cannot answer

[drewstone]

Follow-up from the adversarial review of #854 (the value audit that could not run at merge time).

Defect

The cancel acknowledger (DriverAgentOptions.controlDir) resolves references against the root manager's DIRECT children only (scope.view.nodes is direct children — scope.ts:2145; nested drivers receive no controlDir). The TUI worker table lists EVERY spawned journal node, including nested descendants, and offered 'c' on all of them. A cancel on a nested worker queued a request no acknowledger will ever read:

• the operation stays unknown forever;
• the worker runs on;
• the notice implied a cancel was in progress.

Repro is now pinned as a kernel test: a request naming a live nested descendant (run-deep:s0:s0) crosses multiple acknowledger passes plus the post-drain pass and is never acknowledged, never applied.

Change

• workerCancelRoute (top-model, pure, tested): resolve a worker id to its routable target — direct child, or the top-level lead of a nested descendant.
• The TUI refuses a nested worker's cancel and names the lead to cancel instead of writing a dead request (writing an unread request file is the exact anti-pattern feat(supervisor): export acknowledged worker cancellation #758 banned).
• The queued notice says "awaiting runtime acknowledgement" instead of printing the raw unknown effect.
• canonical-api.md names the direct-children-only boundary.

Proof

pnpm typecheck                                    clean
vitest tests/kernel/worker-cancellation.test.ts   7 passed (6 shipped + 1 boundary)
vitest tests/tui/top-model.test.ts                8 passed
biome check (4 touched files)                     clean
git merge-tree --write-tree origin/main HEAD      clean

[tangletools]

✅ Auto-approved drewstone PR — f981eeb8

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

This approval is provisional. It rests on the audit running. If the audit cannot run — for example the CLI bridge rejects it — this approval is dismissed rather than left standing, so an unrun check never reads as a passing one.

_{tangletools · auto-approval · reason: drewstone_author · 2026-08-15T05:37:28Z}