test(evidence): harden generation lifecycle boundaries

harness/tests/l0/test_vector_adapter_parity.py

@@ -264,3 +264,24 @@ def test_http_list_evidence_generations_exact_rpc_and_legacy_fail_closed(monkeyp
     assert client.list_evidence_generations("evidence") == ["gen:" + "a" * 32]
     assert calls[0][0].endswith("/rpc/list_evidence_generations")
     assert calls[0][1] == {"table_name": "evidence", "kind": "evidence"}
+
+
+@pytest.mark.parametrize("generation", ["gen:a", "gen:" + "A" * 32, "gen:" + "a" * 33])
+def test_http_generation_operations_reject_noncanonical_values(monkeypatch, generation):
+    monkeypatch.setattr(
+        "tht.vectorstore.rest_client.requests.post",
+        lambda *args, **kwargs: pytest.fail("invalid generation reached transport"),
+    )
+    client = VectorRestClient(RestConfig(base_url="https://vectors.test", api_key="writer"))
+    with pytest.raises(ValueError, match="canonical"):
+        client.delete_generation("evidence", generation)
+
+
+def test_http_inventory_rejects_malformed_rpc_output(monkeypatch):
+    monkeypatch.setattr(
+        "tht.vectorstore.rest_client.requests.post",
+        lambda *args, **kwargs: Response([{"generation": "gen:../escape"}]),
+    )
+    client = VectorRestClient(RestConfig(base_url="https://vectors.test", api_key="writer"))
+    with pytest.raises(VectorRestError, match="malformed"):
+        client.list_evidence_generations("evidence")