fix(s31): close 1 review BLOCKER — EmbedderConfig registry + --embedder-config, never an import path

tests/test_run_cli.py

@@ -10,6 +10,7 @@ content so the dry-run reaches its offline return.
 from __future__ import annotations
 
 import json
+import sys
 from pathlib import Path
 
 import pytest
@@ -604,6 +605,92 @@ def test_semantic_retrieval_with_both_dirs_is_not_refused(tmp_path, capsys) -> N
     assert "--semantic-retrieval" not in out.err
 
 
+def test_embedder_config_valid_file_parses_offline(tmp_path, capsys) -> None:
+    """``--embedder-config <valid>`` is accepted and the run still stops offline — the registry is
+    reachable from the CLI, not merely importable."""
+    cfg = tmp_path / "embedder.json"
+    cfg.write_text('{"type": "fake"}', encoding="utf-8")
+    rc = run.main(
+        [
+            _PID,
+            "--docs-dir",
+            str(BUNDLE_DIR),
+            "--bundle-dir",
+            str(BUNDLE_DIR),
+            "--verdict-dir",
+            str(tmp_path / "inbox"),
+            "--semantic-retrieval",
+            "--embedder-config",
+            str(cfg),
+            "--live-dry-run",
+        ]
+    )
+    assert rc == 0
+    assert "LIVE-DRY-RUN OK" in capsys.readouterr().out
+
+
+def test_embedder_config_missing_file_refuses(tmp_path, capsys) -> None:
+    """Fail-fast startup config: a missing file refuses the run (rc 1, no traceback), surfacing
+    through the existing structured-refusal handler."""
+    rc = run.main(
+        [
+            _PID,
+            "--docs-dir",
+            str(BUNDLE_DIR),
+            "--bundle-dir",
+            str(BUNDLE_DIR),
+            "--verdict-dir",
+            str(tmp_path / "inbox"),
+            "--semantic-retrieval",
+            "--embedder-config",
+            "/nonexistent-embedder-config.json",
+            "--live-dry-run",
+        ]
+    )
+    err = capsys.readouterr().err
+    assert rc == 1
+    assert "refused" in err.lower()
+    assert "Traceback" not in err
+
+
+def test_embedder_config_unknown_type_refuses(tmp_path, capsys) -> None:
+    """A config naming an embedder outside the closed registry is REFUSED, never resolved — this
+    is the CLI-level face of the no-import-path rule."""
+    cfg = tmp_path / "embedder.json"
+    cfg.write_text('{"type": "my_pkg.mod:NetworkEmbedder"}', encoding="utf-8")
+    rc = run.main(
+        [
+            _PID,
+            "--docs-dir",
+            str(BUNDLE_DIR),
+            "--bundle-dir",
+            str(BUNDLE_DIR),
+            "--verdict-dir",
+            str(tmp_path / "inbox"),
+            "--semantic-retrieval",
+            "--embedder-config",
+            str(cfg),
+            "--live-dry-run",
+        ]
+    )
+    err = capsys.readouterr().err
+    assert rc == 1
+    assert "refused" in err.lower()
+    assert "my_pkg" not in sys.modules
+
+
+def test_report_with_embedder_config_is_refused(tmp_path, capsys) -> None:
+    """--report stays an ALLOWLIST: a new config flag must be refused there like every other one,
+    else it would be silently dropped."""
+    cfg = tmp_path / "embedder.json"
+    cfg.write_text('{"type": "fake"}', encoding="utf-8")
+    ledger_file = tmp_path / "ledger.json"
+    SavingsLedger(entries=[]).save(str(ledger_file))
+    rc = run.main(["--report", "--ledger", str(ledger_file), "--embedder-config", str(cfg)])
+    assert rc == 1
+    assert "refused" in capsys.readouterr().err.lower()
+
+
 def test_semantic_retrieval_is_not_refused_in_portfolio_mode(capsys) -> None:
     """The flag is valid in BOTH modes (like --dimension-config), so the portfolio partition must
     not name it. Probed via a run that IS refused for a different flag: the refusal lists