fix: prevent P2 from owning Qdrant lifecycle

harness/tests/test_qdrant_vector_store.py

@@ -33,6 +33,7 @@ class FakeQdrantHttp:
         self.distance = distance
         self.collection = None
         self.payload_indexes: set[str] = set()
+        self.payload_index_types: dict[str, str] = {}
         self.points: dict[str, dict] = {}
         self.calls: list[tuple[str, str, dict | None]] = []
         self.fail_request: Exception | None = None
@@ -59,7 +60,7 @@ class FakeQdrantHttp:
                         }
                     },
                     "payload_schema": {
-                        field: {"data_type": "keyword"} for field in sorted(self.payload_indexes)
+                        field: {"data_type": self.payload_index_types.get(field, "keyword")} for field in sorted(self.payload_indexes)
                     },
                 }
             })
@@ -75,6 +76,8 @@ class FakeQdrantHttp:
             return FakeResponse(200, {"status": "ok"})
 
         if method == "PUT" and path == "/collections/workspace-semantic/points":
+            if self.collection is None:
+                return FakeResponse(404, {"status": "error"})
             for point in json["points"]:
                 self.points[point["id"]] = point
             return FakeResponse(200, {"result": {"status": "acknowledged"}})
@@ -161,13 +164,14 @@ def _write_record(record_id: str, kind: str, *, metadata=None):
     )
 
 
-def _store(fake: FakeQdrantHttp) -> QdrantVectorStore:
+def _store(fake: FakeQdrantHttp, *, collection_lifecycle="create_if_missing") -> QdrantVectorStore:
     return QdrantVectorStore(
         base_url="http://qdrant:6333",
         collection="workspace-semantic",
         workspace_id="demo",
         workspace_revision="a" * 40,
         expected_dimension=1024,
+        collection_lifecycle=collection_lifecycle,
         request=fake.request,
     )
 
@@ -178,6 +182,84 @@ def test_point_id_is_deterministic_uuidv5():
     )
 
 
+
+def test_require_existing_refuses_missing_collection_without_mutations():
+    fake = FakeQdrantHttp()
+    store = _store(fake, collection_lifecycle="require_existing")
+
+    with pytest.raises(VectorStoreError, match="semantic_index_incompatible"):
+        store.upsert("memory", [_write_record("memory:1", "memory")])
+
+    assert [call for call in fake.calls if call[0] == "PUT"] == []
+
+
+@pytest.mark.parametrize(
+    ("dimension", "distance", "indexes", "index_types"),
+    [(384, "Cosine", set(), {}),
+     (1024, "Dot", set(), {}),
+     (1024, "Cosine", {"content_hash"}, {}),
+     (1024, "Cosine", {
+         "content_hash", "document_id", "kind", "record_key", "record_kind",
+         "vector_generation", "workspace_id", "workspace_revision",
+     }, {"kind": "integer"})],
+)
+def test_require_existing_refuses_incompatible_collection_without_mutations(
+    dimension, distance, indexes, index_types
+):
+    fake = FakeQdrantHttp(dimension=dimension, distance=distance)
+    fake.collection = {"vectors": {"size": dimension, "distance": distance}}
+    fake.payload_indexes = indexes
+    fake.payload_index_types = index_types
+    store = _store(fake, collection_lifecycle="require_existing")
+
+    with pytest.raises(VectorStoreError, match="semantic_index_incompatible"):
+        store.upsert("memory", [_write_record("memory:1", "memory")])
+
+    assert [call for call in fake.calls if call[0] == "PUT"] == []
+
+
+def test_require_existing_writes_compatible_collection_without_lifecycle_mutations():
+    fake = FakeQdrantHttp()
+    fake.collection = {"vectors": {"size": 1024, "distance": "Cosine"}}
+    fake.payload_indexes = {
+        "content_hash", "document_id", "kind", "record_key", "record_kind",
+        "vector_generation", "workspace_id", "workspace_revision",
+    }
+    store = _store(fake, collection_lifecycle="require_existing")
+
+    assert store.upsert("memory", [_write_record("memory:1", "memory")]) == 1
+    assert not [call for call in fake.calls if call[0] == "PUT" and call[1].endswith("/index")]
+
+
+def test_require_existing_write_fails_after_collection_is_deleted_without_recreating():
+    fake = FakeQdrantHttp()
+    fake.collection = {"vectors": {"size": 1024, "distance": "Cosine"}}
+    fake.payload_indexes = {
+        "content_hash", "document_id", "kind", "record_key", "record_kind",
+        "vector_generation", "workspace_id", "workspace_revision",
+    }
+    original_request = fake.request
+    deleted = False
+
+    def request(method, url, **kwargs):
+        nonlocal deleted
+        response = original_request(method, url, **kwargs)
+        if method == "GET" and url.endswith("/collections/workspace-semantic") and not deleted:
+            deleted = True
+            fake.collection = None
+        return response
+
+    store = QdrantVectorStore(
+        base_url="http://qdrant:6333", collection="workspace-semantic", workspace_id="demo",
+        workspace_revision="a" * 40, expected_dimension=1024,
+        collection_lifecycle="require_existing", request=request,
+    )
+
+    with pytest.raises(VectorStoreError):
+        store.upsert("memory", [_write_record("memory:1", "memory")])
+    assert not [call for call in fake.calls if call[0] == "PUT" and call[1].endswith("/collections/workspace-semantic")]
+
+
 def test_upsert_creates_collection_and_keyword_indexes_idempotently():
     fake = FakeQdrantHttp()
     store = _store(fake)

harness/tests/test_registry_evidence_config.py

@@ -10,6 +10,7 @@ from tht.adapters.evidence import HttpManifestEvidenceSource
 from tht.adapters.factory import build_evidence_sources
 from tht.cli import app
 from tht.config import ConfigError, load_config
+from tht.jobs.dwh_pipeline import config_dwh_binding
 
 SIGNED_CANARY = "SIGNED-CANARY-QUERY"
 ACCESS_CANARY = "ACCESS-CANARY"
@@ -350,3 +351,59 @@ def test_validation_repr_cli_and_exception_output_never_disclose_transport_secre
     assert result.exit_code == 0
     assert_no_canaries(result.stdout)
     assert_no_canaries(result.stderr)
+
+
+def _qdrant_config_yaml(tmp_path, *, registry: bool) -> dict:
+    value = {
+        "dwh": {
+            "type": "postgres_direct",
+            "connection": {
+                "database": "analytics", "schema": "public", "user": "reader",
+                "password": "not-a-canary",
+            },
+        },
+        "vectors": {
+            "type": "qdrant", "base_url": "http://localhost:6333",
+            "collection": "workspace-semantic",
+        },
+        "embeddings": {
+            "base_url": "http://localhost:11434", "model": "qwen3-embedding:0.6b", "dim": 1024,
+        },
+        "evidence": {"source_root": str(tmp_path / "evidence")},
+    }
+    if registry:
+        value["runtime_identity"] = {
+            "workspace_id": "demo-workspace", "workspace_revision": "a" * 40,
+        }
+    return value
+
+
+@pytest.mark.parametrize("mode", ["session", "maintenance"])
+def test_registry_runtime_configs_require_existing_qdrant_collection(tmp_path, mode):
+    path = tmp_path / f"{mode}.yaml"
+    path.write_text(yaml.safe_dump(_qdrant_config_yaml(tmp_path, registry=True)))
+
+    cfg = load_config(path)
+
+    assert cfg.vectors.collection_lifecycle == "require_existing"
+
+
+def test_legacy_runtime_config_keeps_create_capable_qdrant_default(tmp_path):
+    path = tmp_path / "legacy.yaml"
+    path.write_text(yaml.safe_dump(_qdrant_config_yaml(tmp_path, registry=False)))
+
+    cfg = load_config(path)
+
+    assert cfg.vectors.collection_lifecycle == "create_if_missing"
+
+
+def test_registry_session_and_maintenance_bindings_are_equal(tmp_path):
+    values = _qdrant_config_yaml(tmp_path, registry=True)
+    session_path = tmp_path / "session.yaml"
+    maintenance_path = tmp_path / "maintenance.yaml"
+    session_path.write_text(yaml.safe_dump(values))
+    maintenance_path.write_text(yaml.safe_dump(values))
+
+    assert config_dwh_binding(load_config(session_path)) == config_dwh_binding(
+        load_config(maintenance_path)
+    )