[shipmill-romamo]

Summary

Since agent investigate streams (#39), a reader that closes stdout mid-run (cloudfall agent investigate ... | head -2) left the decisions the model proposed without the investigation that made them, and the command exited 0. This implements D-3: the record is saved with a new status stopped, and the command exits non-zero.

Where the broken pipe surfaces: treaty's stream writer (emit_stream, under contextlib.closing) gets the BrokenPipeError, closes the stream, and the handler's generator gets GeneratorExit at its yield. treaty then ends the run in output_closed(): exit 0 when an event was already delivered, 141 before any, with no hook for the handler.

• investigation_events (sdk/src/cloudfall/investigation.py) catches GeneratorExit and returns the investigation so far, ended stopped (Python 3.13+ close() returns it): steps, turns, tokens, trace, empty answer, no finding, as model-unavailable does
• agent_investigate (sdk/src/cloudfall/app.py) catches only GeneratorExit, closes the events, saves the record, sets cloudfall.app.stream_stopped, and re-raises; nothing more is written to the dead stdout
• New exit code 94 INVESTIGATION_STOPPED (after 92 MODEL_UNAVAILABLE and 93 INVESTIGATION_INCOMPLETE), declared on the command. Because treaty gives the handler no say in a closed output's exit code, cloudfall.cli.main/run turn treaty's 0 or 141 into 94 when stream_stopped is set. A stream closed by SIGINT/SIGTERM or a timeout is also recorded stopped but keeps treaty's exit code (130, 143, timeout)
• agent-investigation.schema.json: stopped added to the status enum (additive)
• --no-stream is unchanged: the stream is drained before anything is written. The Record the investigation when the model endpoint fails partway #32 path (endpoint fails partway) keeps model-unavailable and exit 92
• Nothing in cloudfall why or elsewhere matches on the investigation status (only evaluations/nemotron-incident/run.py passes it through), so nothing else needed to describe stopped

Test plan

• New test_a_reader_closing_stdout_mid_run_leaves_the_record_stopped: runs the real CLI (cloudfall.cli:run) in a subprocess against a local fake model endpoint; the reader takes the first turn and its call, then closes stdout, and only then does the endpoint answer turn 2. Checks exit 94, a saved record with status stopped, turns 2, the step and its decision on disk, and a stderr with no BrokenPipe or traceback (only treaty's JSON UNTRUSTED_CONTENT warning line). It fails on main with exit 0
• New test_closing_the_events_returns_the_investigation_so_far_stopped: unit test of the generator's close() return
• uv run ruff check ., uv run mypy, uv run pytest (438 passed), uv run cloudfall config validate --project config/examples, cloudfall-engine inventory render all pass locally
• The Ansible syntax checks and ansible-lint could not run in the local session (Ansible refuses non-blocking stdio there); this PR touches no Ansible file, and CI runs them

Fixes #44

🤖 Generated with Claude Code