fix: harden task2 preprocessing and vector guards

harness/tests/test_preprocess_cli.py

@@ -2,9 +2,13 @@ import json
 from pathlib import Path
 from types import SimpleNamespace
 
+import pytest
 from typer.testing import CliRunner
 
 from tht.cli import app
+from tht.ports.evidence import EvidenceSourceError, EvidenceSourceErrorCategory
+from tht.ports.vector import VectorStoreError
+from tht.vectorstore.embeddings import EmbeddingsError
 
 
 def test_preprocess_evidence_json_is_pristine(monkeypatch, tmp_path):
@@ -191,3 +195,64 @@ def test_preprocess_gc_uses_runtime_identity_for_dev_fd_config(monkeypatch, tmp_
     command.gc_from_config(Path("/dev/fd/3"), dry_run=True)
     assert captured["dry_run"] is True
     assert captured["workspace_id"] == "runtime-workspace"
+
+
+@pytest.mark.parametrize(
+    "error",
+    [
+        pytest.param(
+            EvidenceSourceError("secret source", category=EvidenceSourceErrorCategory.PERMANENT),
+            id="evidence-source",
+        ),
+        pytest.param(VectorStoreError("secret vector"), id="vector-store"),
+        pytest.param(EmbeddingsError("secret embeddings"), id="embeddings"),
+    ],
+)
+def test_preprocess_evidence_json_catches_domain_failures_without_stderr(monkeypatch, tmp_path, error):
+    import tht.cli.preprocess_cmd as command
+
+    monkeypatch.setattr(command, "run_from_config", lambda *a, **k: (_ for _ in ()).throw(error))
+    response = CliRunner().invoke(
+        app, ["preprocess", "evidence", "--json", "-c", str(tmp_path / "workspace.yaml")]
+    )
+
+    assert response.exit_code == 1
+    assert json.loads(response.stdout) == {"status": "failed", "error": "preprocessing failed"}
+    assert response.stderr == ""
+
+
+@pytest.mark.parametrize(
+    "error",
+    [
+        pytest.param(
+            EvidenceSourceError("secret source", category=EvidenceSourceErrorCategory.PERMANENT),
+            id="evidence-source",
+        ),
+        pytest.param(VectorStoreError("secret vector"), id="vector-store"),
+        pytest.param(EmbeddingsError("secret embeddings"), id="embeddings"),
+    ],
+)
+def test_preprocess_evidence_gc_json_catches_domain_failures_without_stderr(monkeypatch, tmp_path, error):
+    import tht.cli.preprocess_cmd as command
+
+    monkeypatch.setattr(command, "gc_from_config", lambda *a, **k: (_ for _ in ()).throw(error))
+    response = CliRunner().invoke(
+        app, ["preprocess", "evidence", "gc", "--json", "-c", str(tmp_path / "workspace.yaml")]
+    )
+
+    assert response.exit_code == 1
+    assert json.loads(response.stdout) == {"status": "failed", "error": "evidence cleanup failed"}
+    assert response.stderr == ""
+
+
+def test_preprocess_evidence_json_unexpected_failure_has_safe_boundary(monkeypatch, tmp_path):
+    import tht.cli.preprocess_cmd as command
+
+    monkeypatch.setattr(command, "run_from_config", lambda *a, **k: (_ for _ in ()).throw(Exception("secret unexpected")))
+    response = CliRunner().invoke(
+        app, ["preprocess", "evidence", "--json", "-c", str(tmp_path / "workspace.yaml")]
+    )
+
+    assert response.exit_code == 1
+    assert json.loads(response.stdout) == {"status": "failed", "error": "preprocessing failed"}
+    assert response.stderr == ""