Cancellation history needs explicit audit provenance
When cancellation hides an active child record but preserves its evidence, record a distinct idempotent cancellation audit event containing the parent, child, source, optional reason, and occurrence time. Project cancelled children into a read-only history surface under existing …