The beta requirement applies to catalogue content and assets as well as prices. One compatible mobile release must establish the contracts; subsequent compatible server changes should not require an Apple review just to update a logo or price.

Catalogue implementation: backend #638 and mobile #1001. Tracking: mobile #1000.

Supported server changes

Area	Contract / operational rule
Valuation sources, amounts, validity, wording	Versioned price presentation, backend #637 and mobile #999
Set names, abbreviations and block names	Additive /sets and /sets/:id display v1, with backend corrections and optional _snag display metadata
Set/block logos	Backend-provided references and revisions; no new filename whitelist or revision constant in the upgraded client
Sealed images	Existing thumbnail_url and detail_image_url take precedence over legacy paths, so storage promotion follows API references
Sealed names and subtitles	Existing server label and subtitle; original tags and product IDs remain unchanged
Scan recognition	Existing backend scan contract; engine/ranking changes remain server work

Publishing an asset correction

1. Preserve the stable Snag catalogue ID and source provenance.
2. Prepare and verify the public asset. Publish changed bytes under a new immutable key or change the server's revision. Do not rely on overwriting a cached URL.
3. Change the backend association, including the relevant translation when used. Any production mutation still follows the project's authorization/backup rules.
4. Check the actual API response, public image and both appearances. Block masks keep their existing theme tinting. A missing asset stays missing.
5. Refresh catalogue data in the app. The current set-list transport cache is five minutes; active screens are not automatically pushed new metadata. No app-store update is needed for compatible references after the initial build ships.

The rule is already recorded in the backend-authority instruction PRs (mobile #997, backend #636, admin #113, agent-workflows #1, documentation #367). It does not mean every historical client rule has already been migrated. In particular, existing catalogue grouping, bootstrap UI assets and native integrations are not made remotely programmable by this change.

Reversible activation

Follow-up: backend #641, tracking #640. The initial pricing/catalogue PRs merged while this follow-up was prepared; the switches were reapplied and tested together on staging 1b3f545 (1,673 API tests passed, 42 skipped; build and JavaScript-layer typecheck passed).

Independent API deployment switches provide the rollback path:

Switch set to false	Effect
BETA_GATE_ENABLED	Disable beta admission and return to the ordinary email/password or Apple flow; keep accounts and recorded admissions
VALUATION_PRESENTATION_ENABLED	Omit new quote presentation so upgraded clients use their legacy price parser; keep price data and market identity protections
CATALOGUE_PRESENTATION_ENABLED	Omit set display v1 and return legacy sealed image URLs; keep labels, tags, IDs, associations and files

The beta gate defaults off. The presentation switches default on; explicitly set them off when preparing a conservative deployment, then enable each separately. Changing a deployment variable requires recreating the API container (or rolling the Kubernetes API workload), not merely restarting an existing Compose container. The backend runbooks provide the Compose command and verification requests.

Fully close and reopen the app after a presentation rollback. Some authoritative price caches outlive the ordinary one-minute transport cache within the app process; waiting one minute is not enough to guarantee a legacy quote replaces them. No sign out, reinstall or storage reset is required. There is no instant push to open screens.

No reverse migration or database restore is part of this rollback. Preserve the legacy image files and previous verified API image before rollout. A flag does not undo a database naming edit, restore deleted assets or repair a non-starting API. Rollback route tests exercise disable/re-enable, stable legacy values, missing presentation, legacy sealed paths and retained market-mismatch rejection.

Scope and release limits

This work adds data contracts and consumes existing media fields; no downloaded executable code or remote replacement of app behavior is introduced. New screens, native capabilities, permissions, SDKs and breaking contracts still require an app release. Keep the API additive and compatible with already installed beta versions. Deploy backend first, then one updated app build.

Prepared as PRs targeting staging. No production asset upload, database update, migration, deployment, account change or emulator restart was performed.

Validation

Mobile lint/typecheck pass, with 3,345 passing tests and 11 skipped. API build and JavaScript-layer typecheck pass, with 1,650 passing tests and 42 skipped. Backend integration produces 86 passes, 15 failures and 11 skips, with identical failures on unmodified staging bf84cce; these are existing authentication expectations. Documentation builds successfully. No device-rendering or production test is claimed.