feat(assets): item pictures on the marketplace and the character sheet (Phase 5)

Both places this site already knew an item's (ItemID, hue) and could only print
it as text now show the picture, hued the way the client would draw it. The
shard does the hueing: whether a hue repaints every pixel or only the grey ones
is a flag in `tiledata.mul`, which a browser has no way to read.

**Ingest warms; the route only serves** (org lead, 2026-09-11). A page never
waits on the shard and never causes a fetch -- it renders what is stored and
leaves out what is not, which is the state every install was in before this
phase. Fetching happens behind that, on a timer, from the keys the site's own
rows name. The alternative, fetching on first request, was rejected on one
number: the shard's asset plane serves ONE request at a time, so a URL that
fetched would let any visitor walk 49,152 ids times 3,000 hues through that slot
and park an operator's own import behind it.

The wanted set is DERIVED (`SELECT DISTINCT item_id, hue`) rather than queued, so
it is self-healing: a restart loses nothing, and a key stops being wanted the
moment the vendor row naming it is deleted. The in-memory hint set on top is only
for the character sheet, which is fetched live from the shard and stored nowhere
-- nothing on disk would ever name those keys.

Staleness without a manifest (§7): every row records the shard's `catalog` id, a
hash of the files that decide its bytes. A client patch changes it and a restart
does not, so "is this out of date?" is a per-row question -- and pictures nobody
looks at any more are simply never re-fetched, which is why this is lazy rather
than a sweep. `shard_asset_meta` is deliberately NOT written here: it is the body
catalogue's singleton, and a warm pass touching it would tell the body import
that a client it never looked at is unchanged.

A key the shard has no art for writes no row at all. An empty row would make the
key held and it would never be asked again -- including after the operator
patches in the graphic that was missing.

`assets.sources` now reports which families an overlay serves, so an overlay
older than phase 5 is one reported state with a sentence naming the fix, instead
of a refusal per pass forever with no picture ever appearing.

688 server tests pass (14 new); client builds; the frozen manifest regenerates
with one added route, all documented, no core URL moved.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016wDDVXWMDz82WqE1i969r4

server/utils/assetBridge.js

@@ -238,6 +238,13 @@ async function sourceFingerprint() {
     hashing: Boolean(res.data?.hashing),
     complete: Boolean(res.data?.complete),
     imaging: res.data?.imaging ?? null,
+    // Which §5 key families this overlay can be asked for (phase 5). Absent on a
+    // phase-3 or phase-4 overlay, which served bodies and nothing else — so the
+    // fallback is `['body']` rather than `[]`: an older shard is not a shard with
+    // no assets, and treating it as one would turn a working bestiary off.
+    families: Array.isArray(res.data?.families) && res.data.families.length > 0
+      ? res.data.families.map(String)
+      : [FAMILY],
   }
 }
 
@@ -382,10 +389,16 @@ async function fetchAssets({ keys, catalog } = {}) {
 
   const list = Array.isArray(keys) ? keys.filter((k) => typeof k === 'string' && k !== '') : []
 
-  if (list.length === 0) return { assets: out, missing, pages: 0 }
+  if (list.length === 0) return { assets: out, missing, pages: 0, catalog: catalog ?? null }
 
   let pages = 0
 
+  // The catalogue the shard actually answered under. The body import already knows
+  // it from the manifest, but the on-demand families have no manifest to learn it
+  // from (§11) — so it is read back off the reply and stored with the rows, which
+  // is what makes a later "is this stale?" answerable per key.
+  let answered = catalog ?? null
+
   for (let i = 0; i < list.length; i += FETCH_CHUNK) {
     const chunk = list.slice(i, i + FETCH_CHUNK)
 
@@ -401,6 +414,20 @@ async function fetchAssets({ keys, catalog } = {}) {
       pages++
       walked++
 
+      if (typeof page.catalog === 'string' && page.catalog !== '') {
+        if (answered !== null && page.catalog !== answered) {
+          // Two pages of one walk describing two different clients. The shard
+          // refuses this when it is told what to expect; when it was not told —
+          // the first fetch of a warm pass — this is where it is caught.
+          throw new AssetBridgeError(
+            `The shard's client files changed mid-fetch (catalog ${answered} became ${page.catalog})`,
+            'UNAVAILABLE',
+          )
+        }
+
+        answered = page.catalog
+      }
+
       for (const row of page.rows ?? []) {
         const key = String(row?.key ?? '')
         if (key === '') continue
@@ -423,6 +450,11 @@ async function fetchAssets({ keys, catalog } = {}) {
           height: Number(row.height) || 0,
           body: Number.isFinite(Number(row.body)) ? Number(row.body) : null,
           direction: Number.isFinite(Number(row.direction)) ? Number(row.direction) : null,
+          // Phase 5's art families carry these; the body catalogue does not, and a
+          // consumer that wants neither is unaffected by either.
+          hue: Number.isFinite(Number(row.hue)) ? Number(row.hue) : null,
+          partialHue: typeof row.partialHue === 'boolean' ? row.partialHue : null,
+          source: typeof row.source === 'string' ? row.source : null,
           png: Buffer.from(row.png, 'base64'),
         })
       }
@@ -446,6 +478,7 @@ async function fetchAssets({ keys, catalog } = {}) {
   }
 
   log.info('asset content fetched from the shard', {
+    catalog: answered,
     asked: list.length,
     got: out.size,
     absent: missing.absent,
@@ -454,7 +487,7 @@ async function fetchAssets({ keys, catalog } = {}) {
     ms: Date.now() - started,
   })
 
-  return { assets: out, missing, pages }
+  return { assets: out, missing, pages, catalog: answered }
 }
 
 /**