fix(evidence): bound reports and fail failed jobs

harness/tests/test_preprocess_cli.py

@@ -32,6 +32,46 @@ def test_preprocess_failure_is_structured_and_nonzero(monkeypatch, tmp_path):
     assert "secret detail" not in response.output
 
 
+def test_preprocess_failed_job_report_is_sanitized_json_and_nonzero(monkeypatch, tmp_path):
+    import tht.cli.preprocess_cmd as command
+
+    result = SimpleNamespace(model_dump=lambda mode=None: {
+        "status": "failed", "run_id": "a" * 32, "published": False,
+        "generation": "gen:" + "b" * 32, "changed": ["fs:one"],
+    })
+    monkeypatch.setattr(command, "run_from_config", lambda *args, **kwargs: result)
+    response = CliRunner().invoke(
+        app, ["preprocess", "evidence", "--json", "-c", str(tmp_path / "workspace.yaml")]
+    )
+    assert response.exit_code == 1
+    payload = json.loads(response.output)
+    assert payload["status"] == "failed"
+    assert payload["error"] == "preprocessing job failed"
+    assert "traceback" not in response.output.lower()
+
+
+def test_preprocess_real_failed_stage_result_exits_nonzero(monkeypatch, tmp_path):
+    import tht.cli.preprocess_cmd as command
+    from test_corpus_pipeline import Source, item, pipeline
+
+    result = pipeline(
+        tmp_path, Source([(item("one", "a"), RuntimeError("SENSITIVE EVIDENCE secret"))])
+    ).run_as_job(
+        workspace_id="demo", workspace_root=tmp_path,
+        config_fingerprint="sha256:" + "1" * 64,
+        input_fingerprint="sha256:" + "2" * 64,
+    )
+    assert result.status == "failed"
+    monkeypatch.setattr(command, "run_from_config", lambda *args, **kwargs: result)
+    response = CliRunner().invoke(
+        app, ["preprocess", "evidence", "--json", "-c", str(tmp_path / "workspace.yaml")]
+    )
+    assert response.exit_code == 1
+    assert json.loads(response.output)["status"] == "failed"
+    assert "SENSITIVE EVIDENCE" not in response.output
+    assert "secret" not in response.output
+
+
 def test_preprocess_resume_rejects_generation_id_before_configuration(monkeypatch, tmp_path):
     import tht.cli.preprocess_cmd as command