feat(mindspace): gate published page delivery

db.mjs

@@ -125,6 +125,27 @@ export async function ensureAssetGatewaySchema(pool) {
   `);
 }
 
+/** Additive only: does not read, move, or mutate user page/data records. */
+export async function ensurePageDeliveryContractSchema(pool) {
+  await pool.query(`
+    CREATE TABLE IF NOT EXISTS h5_page_delivery_contracts (
+      id CHAR(36) PRIMARY KEY,
+      user_id CHAR(36) NOT NULL,
+      request_id VARCHAR(128) NOT NULL,
+      workspace_relative_path VARCHAR(512) NOT NULL,
+      data_mode ENUM('static', 'pg_required') NOT NULL DEFAULT 'static',
+      status ENUM('preparing', 'ready', 'failed') NOT NULL DEFAULT 'preparing',
+      failure_reason VARCHAR(1000) NULL,
+      created_at BIGINT NOT NULL,
+      ready_at BIGINT NULL,
+      updated_at BIGINT NOT NULL,
+      UNIQUE KEY uq_h5_delivery_contract_request_path (user_id, request_id, workspace_relative_path),
+      KEY idx_h5_delivery_contract_route (user_id, workspace_relative_path, updated_at),
+      CONSTRAINT fk_h5_delivery_contract_user FOREIGN KEY (user_id) REFERENCES h5_users(id) ON DELETE CASCADE
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+  `);
+}
+
 export async function migrateSchema(pool) {
   const renames = [
     ['h5_user_sessions', 'goose_session_id', 'agent_session_id'],
@@ -249,6 +270,7 @@ export async function migrateSchema(pool) {
   // Optional asset capability control plane. These rows configure no runtime
   // worker by themselves; the existing chat/page path remains independent.
   await ensureAssetGatewaySchema(pool);
+  await ensurePageDeliveryContractSchema(pool);
 
   // Shared experience store (etat C). Keep in sync with schema.sql.
   await pool.query(`