Terminalize handled invocation failures

docs/internal/manifest.md

@@ -98,6 +98,12 @@ session manifest must agree on campaign and session identity before execution;
 the current projection is refreshed for every invocation while stage progress,
 inputs, and durable artifacts remain session history.
 
+For handled failures after an invocation record is created, the runner records
+the failure on the session ledger and persists it before persisting the failed
+run audit record. This preserves the resume authority while making a partial
+persistence disagreement visible. Abrupt process death remains an accepted case
+where a durable running record can require operator interpretation.
+
 ## Invariants
 
 - stage resume/skip decisions are session-manifest driven.

docs/roadmap/implementation.md

@@ -27,7 +27,7 @@ All stages are pending when this plan is created.
 | 9 | Redact and cap subprocess diagnostics | RSK-012 | Completed |
 | 10 | Confine publish archive reads | COR-005 | Completed |
 | 11 | Make manifest and run identity singular | COR-001, TST-006 | Completed |
-| 12 | Centralize handled terminal-failure persistence | RSK-001, TST-002, SIM-001, COM-001 | Pending |
+| 12 | Centralize handled terminal-failure persistence | RSK-001, TST-002, SIM-001, COM-001 | Completed |
 | 13 | Introduce the immutable remote-commit model and legacy boundary | ARC-003 | Pending |
 | 14 | Publish through immutable commits and canonical mappings | COR-004, COR-011, DUP-002, TST-004 | Pending |
 | 15 | Make remote locks generation-safe and harden pagination | RSK-005, RSK-014 | Pending |