A go-server registers the SCHEMAS it implements, keyed by their own hash. Called only when a hello_ok returned schemas_needed:true, so it is rare despite tunnel churn.

Why this exists at all, and why it is not folded into /tunnel/catalog: that endpoint keys on the NAMES hash, which two servers with the same tool names and different parameters share exactly. Serving schemas out of a names-keyed entry would hand one server's contract to the other — the HIGH review's P1 on this PR.

Same auth argument as /tunnel/catalog, and it is what makes 'no auth' safe here too: the hash is validated against the content, so a caller can only register a (hash, schemas) pair that is internally consistent. A hash no hello ever declares is inert, and an unknown hash substitutes NOTHING rather than falling open.

The payload is the artifact's own shape, validated by the artifact's own validator — one contract, two transports (file for CI, wire for production).