feat: P4 qdrant collection lifecycle (self-heal + guarded rebuild)

- shared TS collection manager: self-heal creates missing collection (1024/cosine)
  and missing keyword payload indexes; never mutates incompatible contracts
  (semantic_index_incompatible); async index visibility polled with bounded deadline
- session admission (qdrantEnsure) uses the manager in self-heal mode; operator path
  keeps require_existing semantics
- runtime lease exposes semanticQdrantUrl to the operator
- operator commands vector-inspect/vector-rebuild with exact confirmation guards
- thothctl workspace vector inspect|rebuild (Go) with --collection/--confirm/--destroy
- p4 acceptance runner: real Qdrant (v1.18.2) lifecycle checks, 11/11 PASS
- docs: CLI contract, manual walkthrough P4 (PENDING), PROJECT_STATE

docs/contracts/workspace-preprocessing-cli.md

@@ -29,6 +29,32 @@ thothctl --installation <absolute>/thothii-installation.yaml workspace preproces
 
 thothctl --installation <absolute>/thothii-installation.yaml workspace preprocess run
   --workspace <id> [--resume <32hex>] [--json]
+
+thothctl --installation <absolute>/thothii-installation.yaml workspace vector inspect
+  --workspace <id> [--json]
+
+thothctl --installation <absolute>/thothii-installation.yaml workspace vector rebuild
+  --workspace <id> --collection <name> --confirm <name> --destroy [--json]
+```
+
+## Qdrant collection lifecycle (P4)
+
+- `workspace vector inspect` reports the descriptor-owned Qdrant collection contract
+  (name, dimensions, distance, keyword indexes) **without mutation**.
+- `workspace vector rebuild` deletes and recreates the descriptor-owned collection
+  with the exact contract (1024 dimensions, cosine distance, the 8 required keyword
+  payload indexes) under guards:
+  - `--collection <name>` must equal the descriptor's `semantic_index.vector_store.collection`;
+  - `--confirm <name>` must equal `--collection` (exact repetition);
+  - `--destroy` is required to confirm the destructive operation;
+  - the operator refuses any other combination with exit code 2 (usage).
+- Self-heal at session admission: a missing collection is created and missing
+  keyword indexes are added by the shared collection manager; incompatible
+  dimensions/distance/index types are never mutated (`semantic_index_incompatible`).
+- The operator path (`workspace-maintenance.js vector-inspect|vector-rebuild`)
+  performs the guarded rebuild; rebuild state is written before deletion and the
+  collection is verified after recreation. No prefix matching or global Qdrant
+  mutation is performed.
 ```
 
 ## Validation

docs/testing/p2-p6-manual-verification.md

@@ -102,6 +102,28 @@ Checks to fill during P4:
 
 Decision: **PENDING**.
 
+
+## P4 Qdrant collection lifecycle
+
+Manual goal: verify admission self-heal and the guarded rebuild through the real product surface.
+
+Checks to complete during P4 manual acceptance (decision: **PENDING**):
+
+1. On a fresh installation with no Qdrant collection, a session admission creates the
+   descriptor collection with exactly 1024 dimensions, cosine distance, and the 8 required
+   keyword payload indexes (`content_hash`, `document_id`, `kind`, `record_key`,
+   `record_kind`, `vector_generation`, `workspace_id`, `workspace_revision`).
+2. A pre-existing collection with incompatible dimensions/distance (e.g. 768-dim or dot)
+   is refused with `semantic_index_incompatible` and is never mutated.
+3. `thothctl ... workspace vector inspect --workspace <id> --json` reports the collection
+   contract without mutation (pristine JSON, exit 0).
+4. `thothctl ... workspace vector rebuild --workspace <id> --collection <name>
+   --confirm <name> --destroy` deletes and recreates the descriptor-owned collection and
+   verifies the recreated contract; a mismatched `--confirm` or a missing `--destroy` is
+   refused (exit 2) without touching the collection.
+5. Rebuild writes durable state before deletion, deletes only the descriptor collection,
+   and the recreated collection preserves the P3 revision-scoped payload contract.
+
 ## P5 — Curated FK annotations in Git
 
 **Status:** instructions to be finalized by P5 implementation; not yet runnable.