fix: close task3 qdrant and config validation gaps

harness/tests/test_registry_evidence_config.py

@@ -360,6 +360,9 @@ def _render_registry_runtime_config(tmp_path) -> str:
     """Render the production schema-v3 runtime rather than duplicating its YAML."""
     tmp_path.mkdir(parents=True, exist_ok=True)
     backend = Path(__file__).resolve().parents[2] / "backend"
+    tsx = backend / "node_modules/.bin/tsx"
+    if not tsx.exists():
+        pytest.skip("cross-runtime integration requires backend/node_modules/.bin/tsx")
     password_file = tmp_path / "dwh-password"
     password_file.write_text("not-a-canary")
     script = r"""
@@ -407,7 +410,7 @@ process.stdout.write(renderRuntimeConfig(workspace, bindings, {
     script_path = tmp_path / "render-runtime.mts"
     script_path.write_text(script)
     result = subprocess.run(
-        [str(backend / "node_modules/.bin/tsx"), str(script_path), str(password_file)],
+        [str(tsx), str(script_path), str(password_file)],
         cwd=backend, check=True, capture_output=True, text=True,
     )
     return result.stdout
@@ -446,8 +449,9 @@ def _qdrant_config_yaml(tmp_path, *, registry: bool) -> dict:
     return value
 
 
+@pytest.mark.integration
 @pytest.mark.parametrize("collection_state", ["missing", "incompatible"])
-def test_registry_rendered_session_and_maintenance_configs_require_existing_qdrant_collection(
+def test_registry_render_chain_produces_require_existing_qdrant_configs(
     tmp_path, monkeypatch, collection_state,
 ):
     session_path, maintenance_path = _render_registry_runtime_configs(tmp_path)
@@ -498,6 +502,49 @@ def test_loader_rejects_split_brain_qdrant_compatibility_resources(tmp_path):
         load_config(path)
 
 
+@pytest.mark.parametrize(
+    ("field", "value"),
+    [
+        ("base_url", {}),
+        ("base_url", []),
+        ("base_url", None),
+        ("base_url", 6333),
+        ("collection", {}),
+        ("collection", []),
+        ("collection", None),
+        ("collection", 7),
+    ],
+)
+def test_raw_qdrant_consistency_rejects_untrusted_top_level_values(tmp_path, field, value):
+    values = _qdrant_config_yaml(tmp_path, registry=True)
+    values["vectors"][field] = value
+    values["resources"] = {
+        "vector": {
+            "engine": "qdrant",
+            "base_url": "http://localhost:6333",
+            "collection": "workspace-semantic",
+        }
+    }
+    path = tmp_path / "invalid-qdrant.yaml"
+    path.write_text(yaml.safe_dump(values))
+
+    with pytest.raises(ConfigError):
+        load_config(path)
+
+    config_result = CliRunner().invoke(app, ["config", "check", "--config", str(path)])
+    assert config_result.exit_code == 1
+    assert "Traceback" not in config_result.stderr
+
+    vector_result = CliRunner().invoke(
+        app, ["vector", "index-schema", "--json", "-c", str(path)]
+    )
+    assert vector_result.exit_code == 1
+    assert vector_result.stderr == ""
+    assert json.loads(vector_result.stdout) == {
+        "status": "failed", "code": "invalid_configuration"
+    }
+
+
 def test_loader_rejects_lifecycle_policy_in_compatibility_resource(tmp_path):
     values = _qdrant_config_yaml(tmp_path, registry=True)
     values["resources"] = {