fix: harden task2 preprocessing and vector guards

harness/tests/test_schema_fk_annotations.py

@@ -228,6 +228,24 @@ def test_suggest_fks_reports_staged_file_without_mined_joins(tmp_path):
     assert "Minati 0 equi-join da 1 file SQL" in response.output
 
 
+def test_suggest_fks_human_write_reads_one_annotation_snapshot(tmp_path, monkeypatch):
+    cfg = _write_workspace(tmp_path)
+    ann_path = tmp_path / "artifacts" / "mschema" / "annotations.yaml"
+    Annotations().to_yaml(ann_path)
+    reads = []
+    original = Annotations.from_yaml
+
+    def tracked(path):
+        reads.append(path)
+        return original(path)
+
+    monkeypatch.setattr(Annotations, "from_yaml", tracked)
+    response = CliRunner().invoke(app, ["schema", "suggest-fks", "-c", str(cfg), "--write"])
+
+    assert response.exit_code == 0, response.output
+    assert reads == [ann_path]
+
+
 def test_suggest_fks_write_merges_and_is_idempotent(tmp_path):
     cfg = _write_workspace(tmp_path)
     ann_path = tmp_path / "artifacts" / "mschema" / "annotations.yaml"
@@ -601,3 +619,27 @@ def test_fresh_process_human_warning_cardinality_is_one_across_failure_and_write
         check=True, capture_output=True, text=True,
     )
     assert json.loads(response.stdout)["warnings"] == 0
+
+
+def test_schema_check_json_unexpected_failure_has_no_stderr_secret(monkeypatch, tmp_path):
+    import tht.cli.schema_cmd as command
+
+    cfg = _write_workspace(tmp_path)
+    monkeypatch.setattr(command, "_physical_or_error", lambda cfg: (_ for _ in ()).throw(Exception("secret schema adapter")))
+    response = CliRunner().invoke(app, ["schema", "check", "--json", "-c", str(cfg)])
+
+    assert response.exit_code == 1
+    assert json.loads(response.stdout) == {"status": "failed", "code": "schema_check_failed"}
+    assert response.stderr == ""
+
+
+def test_schema_suggest_json_unexpected_failure_has_no_stderr_secret(monkeypatch, tmp_path):
+    import tht.cli.schema_cmd as command
+
+    cfg = _write_workspace(tmp_path)
+    monkeypatch.setattr(command, "_physical_or_error", lambda cfg: (_ for _ in ()).throw(Exception("secret schema adapter")))
+    response = CliRunner().invoke(app, ["schema", "suggest-fks", "--json", "-c", str(cfg)])
+
+    assert response.exit_code == 1
+    assert json.loads(response.stdout) == {"status": "failed", "code": "schema_suggestion_failed"}
+    assert response.stderr == ""