Two routes built the same payload, and only one of them signed

The file preview was text by construction. A NUL byte in the first 4 KiB was a 415 in the payload and in the availability probe, so a .png the agent had just written never became a clickable chip: the reader was not told the file existed.

A signed route serves those bytes now, and the type comes from the bytes rather than the file name. Images and PDFs go inline, everything else downloads.

Then the tree reported that it could not serve the image at all.

Two callers, one of them patched

Two routes build a preview payload. The chat’s route signs the asset URL. The explorer’s route reuses the same payload builder with its own scope, and did not — so it answered kind: "image" with no URL, and the panel said what it was told.

One function does it now, called by both. And the test scans ws_http.py for the call sites rather than listing them, because a list is what missed the second one. That is the second time this month: the socket-group fix had a test named test_every_executor_socket_applies_it that named three files, and the fetcher and the MCP host were not among them.