The myTeamSpeak badge catalog (91 entries, ~17 KB of protobuf) and every
fetched icon lived in module memory, so each boot threw them away: the
catalog came back from badges-content.teamspeak.com and every icon variant
was re-downloaded on first use. Between boot and that refresh, every client's
badges rendered nameless.

Core ships `ctx.storage` now, so both are persisted. The catalog goes under
one key with the time it was fetched and is rehydrated before anything can
ask for a badge name; icons go one key per guid and variant, base64 because
that store holds JSON. Encoding is chunked — `String.fromCharCode(...bytes)`
on a 512 KB icon spreads half a million arguments and overflows the stack.

Everything read back is validated rather than cast: what some earlier version
of this module wrote is not necessarily what this one expects, and a row it
cannot use reads as "nothing stored", which is a state this code already
handled. That covers a value that is not base64, one that is empty, and one
over a cap the module has since lowered — all of them mean refetch. The
promise the icon map caches can no longer reject, either: a cached rejection
would replay to every later request for that badge for the life of the
process, and failures here are meant to be retried, not remembered.

`register` is async now, because whether the catalog needs fetching at boot
is a question only the persisted copy can answer, and the host awaits it.

The refresh schedule's `firstRun` drops from "immediate" to "scheduled".
Core already computes `nextRunMs = now` for a newly declared interval
schedule, so "immediate" fired a second run on the first boot — measured:
two runs, two fetches of the same 91 entries. One now. Later boots are
covered by the stored catalog plus the window core carries in the schedule
row: fresh enough to serve, or already due and fired without being asked.

Verified against a real host over four boots: a cold start fetches once and
writes 19,916 bytes of catalog; a restart logs "badge catalog restored" with
91 entries and starts no run; an icon whose stored bytes were replaced with a
marker came back AS the marker, proving the read never reached the network,
while an unstored variant still fetched; and a row corrupted to invalid
base64 refetched and re-stored rather than failing the request.

Closes #1

@@ -142,0 +149,4 @@
+
+Nothing expires these rows — the catalog is a full replacement on each
+refresh, and an icon URL names immutable content. To drop them, use the
+module storage section on OpsDeck's `/system` page; the next refresh

@@ -124,0 +192,4 @@
+  const badges = c.badges.filter((b): b is BadgeInfo =>
+    !!b && typeof b === "object" &&
+    typeof (b as BadgeInfo).guid === "string" &&
+    GUID_RE.test((b as BadgeInfo).guid) &&

@@ -124,0 +206,4 @@
+  if (typeof i.contentType !== "string" || typeof i.data !== "string") {
+    return null;
+  }
+  return { contentType: i.contentType, data: i.data };

@@ -136,0 +233,4 @@
+   * Load the persisted catalog, if there is one, and say when it was
+   * fetched. Null means there is nothing usable stored and the caller should
+   * arrange a refresh — a cold start, a layout this version no longer reads,
+   * or an operator having cleared the module's storage from /system.

@@ -167,0 +303,4 @@
+    info: BadgeInfo,
+    variant: BadgeVariant,
+  ): Promise<Icon | null> {
+    const key = iconKey(info.guid, variant);

@@ -565,0 +570,4 @@
+  // badge name — a boot that starts empty renders every client's badges
+  // nameless until the next refresh lands, which with a 12 h cadence is most
+  // of a day
+  const catalogFetchedAtMs = await badges.hydrate();

@@ -835,0 +854,4 @@
+      // change exists to remove. Every later boot is covered by the stored
+      // catalog plus the window core carries in the schedule row: fresh
+      // enough to serve, or already due and fired without being asked.
+      firstRun: "scheduled",

@@ -136,0 +276,4 @@
+    // The read above queues behind whatever the metrics flush is doing, so a
+    // refresh can land while it waits. What came off disk is then the older
+    // of the two and must not replace what is already being served.
+    if (this.byGuid.size === 0) {

@@ -156,0 +312,4 @@
+    // stored row carries one: a catalog that moves a badge's art would
+    // otherwise be overruled by whatever the last one put in this map, for
+    // the life of a process that outlives several refreshes
+    const key = info.url + VARIANT_SUFFIX[variant];

@@ -565,0 +605,4 @@
+      });
+      // onSelfConflict is drop, so a run core started meanwhile wins and this
+      // one is recorded skipped rather than queued behind it
+      await ctx.tasks.start("badge-catalog");