fix: wait for completed evidence before forced cleanup

Launcher.Next.App/PilotCli.cs

@@ -129,18 +129,27 @@ internal static class PilotCli
             var exit = WaitForExitAsync(execution.ProcessId.Value);
             if (!config.ForceAfterEvidence) { await exit; gracefulExit = true; }
             else
+            {
+                // The graceful-exit timeout is deliberately measured only after
+                // terminal evidence is durable.  Killing an active AutoCAD
+                // command before that boundary would turn ForceAfterEvidence
+                // into an unsafe general process killer.
+                while (!exit.IsCompleted && !HasCompletedEvidence(evidencePath))
+                    await Task.Delay(TimeSpan.FromSeconds(1));
+                if (exit.IsCompleted) gracefulExit = true;
+                else
                 {
                     var timeout = Task.Delay(TimeSpan.FromSeconds(Math.Clamp(config.GracefulExitTimeoutSeconds, 1, 120)));
                     if (await Task.WhenAny(exit, timeout) == exit) gracefulExit = true;
                     else
                     {
-                    if (!HasCompletedEvidence(evidencePath)) return new(true, false, false, false, false);
                         using var process = Process.GetProcessById(execution.ProcessId.Value);
                         if (!process.HasExited) { process.Kill(entireProcessTree: true); forcedCleanup = true; }
                         await exit;
                     }
                 }
             }
+        }
         finally { await service.RollbackAsync(new(options.PilotRoot, manifest.PackageId, manifest.Version, execution.StartupScriptPath!, null, execution.SessionId, execution.ActivationSnapshotPath), CancellationToken.None); }
         var evidenceCompleted = HasCompletedEvidence(evidencePath);
         return new(true, gracefulExit, forcedCleanup, await IsRolledBack(options.PilotRoot), evidenceCompleted);