Catalogue responses expose an explicit display contract instead of raw upstream JSONB. Set/card details and card-list pricing omit import markers, source asset URLs and unknown provider fields, including fields nested inside approved objects. Printed card information, price figures, market links and normalized variants remain available; stored provenance is not deleted or modified.

GET and PATCH card details share the filtered contract. Card ETags now include the projection version and catalogue language, so a validator from the previous raw response cannot retain that response via a 304. Non-One-Piece catalogue rows return image_base: null and use their existing first-party image paths.

One Piece keeps its external French-art fallback until those images have been mirrored. Scan image fallbacks and authenticated administrative recompute/audit are outside this change. Downloaded image bytes, public card IDs and Snag paths remain observable; this reduces unnecessary disclosure, not reverse engineering or scraping. Required credits are not removed. Operational manifests must stay outside the public image tree.

Backend PR: https://github.com/snag-tcg/tcg-collector-backend/pull/447

Node 22.23.3 validation: API 1062 tests passed, ingestion 544 tests passed, targeted routes/projections 39 tests passed, and API typecheck:js passed. Local PostgreSQL E2E was not run because the Docker Desktop daemon was unavailable. All six backend CI jobs subsequently passed, including PostgreSQL E2E, ingestion integration, probe build and the Docker build/API smoke check. No mobile changes, dependencies, migrations or Docker/workflow changes were included in this fix.

After explicit user authorization, backend PR 447 was merged into staging as e214f10 and that exact commit was deployed to the VPS on 2026-10-09. Only the API was rebuilt and recreated; the existing runtime environment, published ports and bind mounts were preserved and checked. The previous image and a private configuration snapshot remain available for rollback. No migration, ingestion, catalogue write, Redis restart or scanner-sidecar restart occurred.

Post-deploy checks passed against both the direct API and public HTTPS entry: health/readiness, projected set/card details and lists, variant arrays, current ETag 304 revalidation and old ETag invalidation. POP1 still has 17 cards and its logo is served as WebP through the configured public image base. Redis answers PING and the API has zero container restarts after recreation. External One Piece/scan image fallbacks remain the documented limitation.