docs(link): the guide an integrator reads stopped at protocol 6 (Phase 9a)

The Asset Bridge's docs pass, and the acceptance walk that shaped it (v8.md §16
row 9a, §17.13-14). Phase 9 is three legs now: this one, the edge->main cutover,
and the site.

## INTEGRATION.md had stopped at 6 and contradicted itself

Its §2 said "the current version is 6" above examples already carrying
`X-UOLink-Version: 8`, there was no protocol-7 paragraph, and `assets.` appeared
zero times in 1,306 lines. It is the only document an integrator outside this org
has, so it is carried the whole way: the version block corrected, v7 (the event
plane's command half) and v8 (the asset plane) written, a §5 section for the five
routes, 425/422 in the status table, and a caveat that the asset plane is a
working set rather than a stream.

Protocol 7's absence is the Events workstream's debt rather than this one's, but
it cannot be stepped over on the way to 8.

## The operator-facing half

`UPGRADE_NOTES.md` gains the entry an operator reads when this ships: what
changed, the one required action on a Linux host, and the thing that will not
announce itself -- nothing here happens on a restart, so a patched client keeps
serving the old pictures until somebody presses a button.

`installer/INSTALL.md` gains libgdiplus as a prerequisite row and the `doctor`
row that checks it. The index rows for SPAWN_ATLAS and CLILOCS described the
workflows this protocol deleted; v8.md now has an index row of its own, and v7 is
marked as the released protocol.

## The walk

Wiped every asset row and every imported sprite, then walked it as a new
operator: 1,095 portraits in 3.18 s, 67,496 names in 1.42 s, 313 item pictures in
1.38 s, the atlas over the bridge in ~2.0 s, an Update with no drift answered in
0.99 s. Bestiary portraits are the right animals by eye; the marketplace shows
hued item art with cliloc names.

It found two defects (§17.14) and one cutover hazard: module-uo's `edge` is
behind its `main`, missing #35, so the walk measured 0 of 6,455 spawners carrying
a UniqueId. 9b's row says to sync before merging or the cutover ships a
regression.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016wDDVXWMDz82WqE1i969r4

link/v8.md

@@ -1678,10 +1678,10 @@ disagree, so a split bump means the next bundle silently fails to compose.
 | `link/` | Six command families forwarded, the REST surface, **the inbound line cap (§3.3)**, `PROTOCOL_VERSION`. **Nothing in phases 4 or 5** — `assets_call` forwards a request body verbatim and `respond_assets` returns the reply verbatim, so a new key family and a new reply field both pass through untouched |
 | `module-uo/` | Client calls, asset store, the atlas source backend (§10), cliloc ingest, admin surface. Phase 7 also bumped `PARSER_VERSION` 4 → 5 (§10.4) |
 | `website/` | Almost none — `ctx.uploads` already suffices (§12). Phase 2 deleted `server/tools/cliloc-export/`, the converter this protocol retires |
-| `docs/` | This file; rewrite `CLILOCS.md` §Converting and `SPAWN_ATLAS.md` §Artwork + §Configuring; **delete `UOFIDDLER.md`**; add the libgdiplus prerequisite to `SHARD_PREREQS.md` (§4.4) |
-| `installer/` | A `doctor` check for libgdiplus on Linux hosts (§4.4). Bundle pairing already enforces §15 |
+| `docs/` | This file; rewrite `CLILOCS.md` §Converting and `SPAWN_ATLAS.md` §Artwork + §Configuring; **delete `UOFIDDLER.md`**; add the libgdiplus prerequisite to `SHARD_PREREQS.md` (§4.4). Phase 9a added the rest: `INTEGRATION.md` to protocol 8, an operator entry in `UPGRADE_NOTES.md`, the index rows, and the prerequisite + `doctor` row in `installer/INSTALL.md` |
+| `installer/` | A `doctor` check for libgdiplus on Linux hosts (§4.4) — **built in phase 9a**, Linux-only (a Windows host has nothing to check, so there is no row rather than a row saying "not applicable") and a `⚠` rather than a `✗`, because names and the spawn atlas have no pixels in them. Bundle pairing already enforces §15 |
 | `android-app/` | Consumes images by URL; no parity gate expected until a screen shows one |
-| `integration-kit/` | A chapter note only — this is UO-specific and teaches nothing about the module contract |
+| `integration-kit/` | A chapter note only — this is UO-specific and teaches nothing about the module contract. **Built in phase 9a** as chapter 3 §2b: the *pattern* (the game host already has the files; route them over the channel you already have; request/reply, one at a time, two stages, version your derivation, never on boot) with no contract re-specified |
 
 ---
 
@@ -1698,7 +1698,9 @@ disagree, so a split bump means the next bundle silently fails to compose.
 | 6 | **DONE 2026-09-11, and not what this row said.** The measurement came first and changed the phase: a complete one-direction animation set is **174,453 frames / 281.5 MB**, not the ~119,000 estimated, and **the site displays still pictures** — so the deep keys and the bulk-fill switch were **not built** (§11.2, org lead 2026-09-11). What shipped is what the still-picture site was missing: the **73 bodies with no art at action 0 and real art deeper** (a horse at `body/820/a23`), the catalogue key carrying its action, the atlas join that reads it, and §4.10's per-body **action ceiling** — without which the fallback walk itself would serve **452 validated pictures of the next body**. Catalogue **1,022 → 1,095**; `EXTRACTOR_VERSION` 2 → 3; protocol stays 8 | servuo-plugins, module-uo |
 | 7 | **DONE 2026-09-14.** The atlas over the sidecar (§10); shared-filesystem requirement retired. The measurement came first again and changed the shape: `tree/<label>` → bytes **cannot work** — `Spawns/trammel.xml` is 4.03 MB against a 1 MiB line cap — so a file crosses as **512 KiB chunks, each gzipped**, which is §5's depth scheme paying for itself a second time (§10.1). It is a `tree` **family** on `assets.fetch` rather than §14's separate commands, with `assets.manifest` generalised to match and its **own consent, `Bridge.TreeEnabled`** (§10.2) — so `link` needed nothing for the third phase running. **141 files / 11.9 MB / 158 chunks / 3 pages / 1.33 MB on the wire / 512 ms**, and the atlas built over the bridge is identical to the one built off the disk. Two defects, each found by a different harness: an empty `catalog` refusing every fetch, and `GZipStream` emitting **nothing** for the two empty files stock ServUO ships (§10.3). `PARSER_VERSION` 4 → 5 for one canonical read order (§10.4); protocol stays 8; `EXTRACTOR_VERSION` stays 3 | servuo-plugins, module-uo |
 | 8 | **DONE 2026-09-14.** The admin surface (§12.2): `Admin → Client Files` — one page over all three planes, because they come off one client and change on one event. The cliloc pair had had no UI since phase 2, which on a bridge install meant `curl` was the only way to import 67,496 names. §14's "activity view" is the **last import's own summary** rather than a filtered feed, which kept the phase to one repo (org lead, 2026-09-14). The walk imported **1,095 portraits in 3.5 s, warmed 313 item pictures in 0.6 s and reloaded 67,496 cliloc rows in 1.7 s** against a real shard — and found **two deletions nobody could see before a screen put the numbers together**: the body import diffing its manifest against *every* family's rows, which staged all 313 item pictures for deletion, and an approved vanish that unlinked the sprite and kept the row, so the key came back for review forever. Both fixed here; `EXTRACTOR_VERSION` and the protocol are untouched | module-uo |
-| 9 | Docs pass across five repos; live walk on the real rig | docs |
+| 9a | **DONE 2026-09-14.** The docs pass and the acceptance walk (§17.13). `INTEGRATION.md` carried to protocol 8 — it had stopped at **6**, contradicted itself, and documented none of this plane; the operator-facing upgrade note; the index rows; the installer's `libgdiplus` `doctor` check and the kit's chapter note, both promised by §15 and built by no phase. The walk wiped every asset row and every imported sprite and went through it as a new operator: **1,095 portraits in 3.18 s, 67,496 names in 1.42 s, 313 item pictures in 1.38 s, the atlas over the bridge in ~2.0 s, and an Update with no drift answered in 0.99 s**. Two defects (§17.14), the larger of them **not ours and released** — Events phase 12b's `unique_id` has been failing every spawn-atlas import on every upgraded install since v1.2.0, which only a walk on a rig whose tables predate it could see | docs, module-uo, installer, integration-kit |
+| 9b | The `edge → main` cutover: `link`, `servuo-plugins`, `module-uo`, `website`, in dependency order. **`module-uo`'s `edge` is behind its `main`** — it is missing #35, the fix that keeps the atlas's `UniqueId`, so the walk measured 0 of 6,455 spawners carrying one. Sync `main` into `edge` first or the cutover ships a regression | link, servuo-plugins, module-uo, website |
+| 9c | runicgateway.com: `platform.json`'s protocol 7 → 8 and the bundle triple, and any prose the bridge changed. Must follow 9b — `checkFacts.mjs` reads the protocol from `link`'s `main` | runicgateway.com |
 
 Phase 0 exists because §4 chose to call code that can take the shard down if it is wrong, and the
 honest way to hold that choice is to try to break it on purpose — in the real host process, against
@@ -1872,3 +1874,42 @@ in the document.
       was declined in favour of consistency. The panel and the CLI say so in as many words, and the
       skip is logged rather than silent.
 
+13. **Phase 9's shape and its two inherited obligations — settled 2026-09-14.** Put to the org lead
+    at the start of the phase, because §16 described phase 9 as a docs pass in one repo and three
+    things it did not cover had fallen between the phases:
+
+    - **Phase 9 is three legs, not one** — `9a` the docs pass plus the acceptance walk on the real
+      rig, `9b` the `edge → main` cutover across the four code repos, `9c` the runicgateway.com
+      facts. The cutover was in no phase row at all, and the site cannot move until `link`'s
+      `main` carries protocol 8 — `runicgateway.com`'s `checkFacts.mjs` reads it from there and goes
+      red the moment it changes. The Events and Engagement workstreams split their last phase the
+      same way, for the same reason.
+    - **The two §15 obligations nobody built are built here**, rather than dropped: the installer's
+      `doctor` check for `libgdiplus` and the integration kit's chapter note. The doctor check was
+      the third of the three answers §17.2 took, and `SHARD_PREREQS.md` had been *claiming* it
+      existed since phase 1.
+    - **`INTEGRATION.md` is repaired the whole way to 8, protocol 7 included.** It had stopped at 6
+      and contradicted itself — prose saying "the current version is 6" above examples already
+      carrying `X-UOLink-Version: 8` — with no protocol-7 paragraph and not one mention of
+      `assets.*`. Protocol 7's absence is the Events workstream's debt rather than this one's, but
+      it cannot be stepped over on the way to 8, and the file is the only thing an integrator
+      outside this org has.
+
+14. **The two defects the phase-9 walk found, and where they ship — settled 2026-09-14.** Both were
+    put to the org lead with the walk's evidence:
+
+    - **A busy shard gets its own sentence, and the panel re-reads once.** The status call exhausts
+      its 425 backoff whenever something else holds the single slot — an import, or the item-art
+      warm pass refilling itself — and phase 8's panel rendered that as *"The shard is not answering
+      for client files"*, the same banner as a shard that is down or switched off, and left it
+      standing because the page never re-reads. On the rig that banner was up for a quarter of an
+      hour over a perfectly healthy shard. `BUSY` now says what it is, and one automatic re-read
+      four seconds later clears the ordinary case; the panel still does not poll.
+    - **`shard_spawn_points.unique_id` ships on `edge` with this phase** rather than as a hotfix to
+      `main` (org lead, weighing that it is already released). Events phase 12b added the column to
+      the `CREATE TABLE` and nowhere else, so it reached fresh installs and no existing one —
+      `CREATE TABLE IF NOT EXISTS` does not add a column, which is what the twenty-odd
+      `ADD COLUMN IF NOT EXISTS` lines in that same file exist to do. Every spawn-atlas import on an
+      upgraded install has failed outright since **v1.2.0** with `Unknown column 'unique_id'`: no
+      bestiary refresh, no spawn map, no champion altars. The cost of the decision is that operators
+      on a released v1.2.x keep that until the Asset Bridge cuts over.