feat: vendor the public read contract, and give it its own source switch

The public surface — 17 of the 28 registered routes — reads from a 29KB
TypeScript fixture and never touches the backend. `TECH_LOG_STUDIO_SOURCE`
only ever switched the Studio gateways; `publicContent` was wired to the
static adapter unconditionally, so no configuration could make the public
site show published content. This is the first half of closing that: the
contract and the switch, with the adapter still to come.

The generator now vendors both canonical contracts instead of one. They are
independent — different services on different schedules — so each carries
its own digest and operation list, and updating one leaves the other's drift
gate quiet.

`TECH_LOG_PUBLIC_SOURCE` is deliberately a second flag rather than a rename
of the Studio one. The combination that matters right now is exactly the one
a single flag cannot express: the authoring backend is live while the public
read API does not exist yet. production stays on MOCK for that reason —
pointing it at HTTP today would empty the live site — and moves when the
backend serves /api/v1/public.

Also records the compatibility evidence the registry gate wanted for the
Studio access change in fff5e6f. That gate has been failing since, which is
on me: the change was real and breaking, and it shipped without the note
explaining that route ids and schemas are untouched and only the access
classification moves.

src/bootstrap/runtime-adapters.ts

@@ -599,6 +599,7 @@ export async function createRuntimeAdapters(
   const featureInputs = createInstalledFeatureInputs({
     contractOperations,
     studioSource: config.TECH_LOG_STUDIO_SOURCE,
+    publicSource: config.TECH_LOG_PUBLIC_SOURCE,
     apiBaseUrl: config.API_BASE_URL,
     requestTimeoutMs: config.REQUEST_TIMEOUT_MS,
     csrf: techLogCsrf,

src/bootstrap/runtime-config-schema.ts

@@ -56,6 +56,12 @@ export type RuntimeConfig = Readonly<{
    * MOCK.
    */
   TECH_LOG_STUDIO_SOURCE: "MOCK" | "HTTP";
+  /**
+   * §3.5-adjacent runtime switch: which public-read adapter this build talks
+   * to. Independent of the Studio switch — the two surfaces are separate
+   * services. A V1 document predates the key and normalizes to MOCK.
+   */
+  TECH_LOG_PUBLIC_SOURCE: "MOCK" | "HTTP";
   /** Present only while a V1 document is still accepted. */
   LEGACY_API_CONTRACT_VERSION?: string;
 }>;
@@ -143,6 +149,10 @@ export function validateRuntimeConfig(value: unknown): RuntimeConfigValidation {
     TECH_LOG_STUDIO_SOURCE: isV2
       ? (parsed as RuntimeConfigV2).TECH_LOG_STUDIO_SOURCE
       : "MOCK",
+    // Same treatment for the public-read switch.
+    TECH_LOG_PUBLIC_SOURCE: isV2
+      ? (parsed as RuntimeConfigV2).TECH_LOG_PUBLIC_SOURCE
+      : "MOCK",
     ...(isV2
       ? {}
       : {

src/contracts/env.ts

@@ -52,6 +52,11 @@ export const ENV_REGISTRY = Object.freeze({
   // TechLog Studio gateway adapter selection. Defaults to MOCK while the
   // backend does not exist yet.
   TECH_LOG_STUDIO_SOURCE: runtime("public", false, "MOCK"),
+  // TechLog public-read adapter selection. Separate from the Studio switch on
+  // purpose: the two surfaces are different services on different schedules,
+  // and the combination that matters right now — an authoring backend that is
+  // live while the public read API is not — is unreachable with one flag.
+  TECH_LOG_PUBLIC_SOURCE: runtime("public", false, "MOCK"),
   // §3.5: build-time narrowing of the product manifest. A feature left out
   // here is not imported by any registry and never reaches the bundle.
   VITE_PRODUCT_FEATURES: build("compile-time", false, null),

src/contracts/release-artifacts.ts

@@ -159,6 +159,10 @@ export const runtimeConfigV2ArtifactSchema = z
     // TechLog Studio adapter selection. Backend is not live yet, so the
     // default is the in-memory mock; a document may opt a build into HTTP.
     TECH_LOG_STUDIO_SOURCE: z.enum(["MOCK", "HTTP"]).default("MOCK"),
+    // TechLog public-read adapter selection, defaulted the same way and for
+    // the same reason. Held apart from the Studio switch so one surface can
+    // move to HTTP without dragging the other with it.
+    TECH_LOG_PUBLIC_SOURCE: z.enum(["MOCK", "HTTP"]).default("MOCK"),
   })
   .strict()
   .superRefine(runtimeConfigArtifactInvariants);

src/features/installed-feature-adapters.ts

@@ -23,6 +23,7 @@ export function createInstalledFeatureInputs(
   context: Parameters<typeof createReferenceFeatureInstalledInput>[0] &
     Readonly<{
       studioSource: "MOCK" | "HTTP";
+      publicSource: "MOCK" | "HTTP";
       apiBaseUrl: string;
       requestTimeoutMs: number;
       csrf: CsrfTokenProvider;

src/features/tech-log/adapters/create-tech-log-feature-input.ts

@@ -27,6 +27,7 @@ import { publicContentQueries } from "./static/public-query.ts";
  */
 export type TechLogInstallContext = Readonly<{
   studioSource: "MOCK" | "HTTP";
+  publicSource: "MOCK" | "HTTP";
   contractOperations: StudioOperationExecutor;
   apiBaseUrl: string;
   requestTimeoutMs: number;

src/features/tech-log/contracts/public/canonical-source.json

@@ -0,0 +1,26 @@
+{
+  "packageId": "@tech-log/public-contract",
+  "version": "2.0.0",
+  "digest": "sha256:8ac71425b38658f34641102b4c2e6e21288c811efebdb92c0a46fb9d4790e23e",
+  "sourceRevision": "55a9599",
+  "operationIds": [
+    "getPublicSite",
+    "getPublicHome",
+    "exploreKnowledge",
+    "exploreQuestions",
+    "listPublicTopics",
+    "getPublicTopic",
+    "getPublicCase",
+    "getPublicReference",
+    "getPublicQuestion",
+    "listPublicProjects",
+    "getPublicProject",
+    "listPublicProjectDecisions",
+    "listPublicProjectRecords",
+    "listPublicProjectActivities",
+    "listPublicReleases",
+    "getPublicRelease",
+    "getPublicProfile",
+    "searchPublicResources"
+  ]
+}

src/features/tech-log/contracts/studio/canonical-source.json

@@ -2,7 +2,7 @@
   "packageId": "@tech-log/studio-contract",
   "version": "3.0.0",
   "digest": "sha256:6cae9924403d0761f401643a022980b8e04183eea0d890c143c9fbbbbc7431e4",
-  "sourceRevision": "b20d7a2",
+  "sourceRevision": "55a9599",
   "operationIds": [
     "getStudioSession",
     "getStudioDashboard",