mindspace: version runtime contracts and audit packages

docs/mindspace-seamless-migration-runbook.md

@@ -47,6 +47,9 @@ Phase A is complete when:
 - Shared adapter contract
 - Local and remote adapter selection
 - Remote transport with auth token, timeout, and configurable operation path
+- Remote contract fail-fast: Portal rejects a standalone MindSpace service
+  whose `/mindspace/v1/contract` is below the required contract version or
+  missing required authority bindings
 - Remote mode skips Memind-side generated-page workspace sync; background jobs stay on the standalone MindSpace runtime
 
 ### Standalone MindSpace service
@@ -57,7 +60,9 @@ Path:
 Responsibilities:
 - bootstrap DB-backed local MindSpace services
 - expose `POST /mindspace/v1/adapter/:binding/:method`
-- expose `/health` and `/mindspace/v1/contract`
+- expose `/health` and `/mindspace/v1/contract`; both include the service
+  contract version, and `/contract` also includes required capabilities,
+  bindings, `buildId`, `gitSha`, and `builtAt`
 - manage publication cleanup
 - manage optional workspace maintenance
 - manage optional agent worker
@@ -147,6 +152,19 @@ The smoke uses the configured local development database to create a unique
 `split-service-smoke-*` session/package and removes those package/artifact
 rows plus its temporary filesystem root before exit.
 
+Contract and artifact diagnostics:
+
+```bash
+npm run audit:conversation-packages -- --limit 100
+npm run trace:mindspace-artifact -- --package-id cp_20260727_16
+npm run trace:mindspace-artifact -- --public-url http://127.0.0.1:5173/MindSpace/<owner>/public/page.html
+```
+
+`audit:conversation-packages -- --repair` is intentionally narrow: it only
+inserts missing `public_html` artifact records when a `generated_file`
+artifact already points to a `public/*.html` `h5_assets` row. It does not
+rewrite physical files or change publication status.
+
 Current verified local user:
 - `1c99b83b-0454-474f-a5d2-129d34506a32`