Address code review findings from the subprocess enhancements

docs/integrations/run-result.md

@@ -38,7 +38,7 @@ For another output module, its absence does not indicate a failed run.
   "normalized_output_count": 6,
   "rejected_output_count": 2,
   "warning_count": 1,
-  "validation_status": "approved"
+  "validation_status": "rejected"
 }
 ```
 

docs/internal/cli.md

@@ -88,10 +88,12 @@ For `run --json`, the CLI constructs and encodes its private run-result receipt
 after a successful runner result is available, before it publishes logical
 output files. It writes the prepared receipt to standard output only after
 output publication and requested debug terminalization succeed. A receipt-write
-failure is a runtime command failure; output may be partial, the CLI reports a
-bounded command-owned error, and it does not repeat terminal reporting. The
-receipt remains a CLI reporting concern rather than a framework or output-module
-responsibility; its public contract is the
+failure exits with runtime status 1 and may leave partial standard-output bytes,
+but the already-published output bundle remains complete and requested debug
+reporting remains successfully terminalized. The CLI reports a bounded
+command-owned error and does not repeat terminal reporting. The receipt remains
+a CLI reporting concern rather than a framework or output-module responsibility;
+its public contract is the
 [run-result receipt](../integrations/run-result.md).
 
 ## Failure Mapping And Terminal Reporting

internal/cli/run_result.go

@@ -53,7 +53,7 @@ func newRunResult(resolved pipeline.ResolvedPipeline, output pipeline.RunOutput,
 	result := runResult{
 		SchemaVersion:         runResultSchemaVersion,
 		RunID:                 output.Manifest.RunID,
-		PipelineID:            resolved.ID,
+		PipelineID:            output.Manifest.PipelineID,
 		OutputDirectory:       absOutputDirectory,
 		NormalizedOutputCount: len(output.NormalizeOutputs),
 		RejectedOutputCount:   len(output.Rejected),