fix(preprocess): verify canonical generations and cleanup

harness/tests/test_corpus_pipeline.py

@@ -431,6 +431,20 @@ def test_unchanged_documents_skip_acquire_normalize_chunk_and_embed(tmp_path):
     assert second_embedder.calls == []
 
 
+def test_unchanged_job_reuses_active_generation_without_new_directory(tmp_path):
+    source = Source([(item("one", "a"), "hello")])
+    candidate = pipeline(tmp_path, source)
+    args = dict(workspace_id="demo", workspace_root=tmp_path,
+                config_fingerprint="sha256:" + "1" * 64,
+                input_fingerprint="sha256:" + "2" * 64)
+    first = candidate.run_as_job(**args)
+    count = len(candidate.store.list_generations())
+    second = candidate.run_as_job(**args)
+    assert second.generation == first.generation
+    assert second.published is False
+    assert len(candidate.store.list_generations()) == count
+
+
 def test_removed_documents_are_marked_and_absent_from_new_manifest(tmp_path):
     one, two = item("one", "a"), item("two", "b")
     pipeline(tmp_path, Source([(one, "one"), (two, "two")])).run()

harness/tests/test_s3_evidence_source.py

@@ -104,6 +104,15 @@ def test_s3_rejects_leading_slash_prefix_empty_and_control_keys():
             list(S3EvidenceSource(bucket="evidence", prefix="clinical/", client=client).discover())
 
 
+@pytest.mark.parametrize("prefix", ["/bad", "x" * 1025, "bad\x00prefix", "bad\x7fprefix"])
+def test_s3_rejects_invalid_prefix_before_client_request(prefix):
+    from tht.adapters.evidence.s3 import S3EvidenceSource
+    client = Client()
+    with pytest.raises(ValueError, match="prefix"):
+        S3EvidenceSource(bucket="evidence", prefix=prefix, client=client)
+    assert client.list_calls == 0
+
+
 def test_s3_hard_page_limit_never_requests_page_max_plus_one():
     from tht.adapters.evidence.s3 import S3EvidenceSource
     client = Client()