Treat intentional cancellation as a non-failure terminal

crates/protocol/src/lib.rs

@@ -991,6 +991,9 @@ pub enum SessionSnapshotEntryData {
         source: RunResumeSource,
         active_run_turn_count: usize,
     },
+    /// Durable terminal for an intentional cancellation. Consumers must not
+    /// present this lifecycle result as an execution failure.
+    RunCancelled,
     RunError {
         message: String,
         #[serde(default, skip_serializing_if = "Option::is_none")]
@@ -1737,6 +1740,9 @@ pub enum RunResult {
     Finished,
     Paused,
     LimitReached,
+    /// The logical Run ended because the user intentionally cancelled it after
+    /// observable work. Unlike `RolledBack`, committed history is retained.
+    Cancelled,
     /// The accepted Method::Submit produced no assistant/tool output before
     /// user interruption, so the Worker rolled the submit-time turn state back
     /// to its pre-submit snapshot. Clients should treat the Worker as Idle and