Gallery and Asset Review

Gallery browses a model's existing Files and attaches review metadata to exact asset byte versions. Load its visual contact sheet, search or filter the files, select an image to open its verified preview, then review that version. Other files open on request. PNG/JPEG/static WebP previews use only verified local object URLs. Gallery does not import external URLs, rename or replace files, publish reviews or send notifications.

Start with the canonical Gallery model. Upload its companion grid-icon.png README.txt and the two-page review-notes.pdf through Files into a folder named review-assets. The icon is an unchanged copy of Grid's existing application icon. Add the companion grid-icon-small.png to compare the existing 64-pixel icon with the larger copy. The model begins with empty review metadata; actual byte hashes are recorded after verification, never supplied as fabricated example results.

Freeze a collection for review

Choose Capture frozen collection, then Apply Gallery setup to select the acknowledged catalog. Capture retains exact asset bytes and a complete catalog in the model's existing immutable artifact store. The resulting catalog_id in Gallery configuration selects that version. Later live edits, moves and removal do not change its previews or review identities. Reopening reads the same retained catalog. Signed review attribution also checks those retained bytes.

Capture admits at most 256 files, 16 MiB per file, 64 MiB total and a 512 KiB catalog, with paths bounded to 1024 characters and a cooperative 15-second deadline. It rechecks enumeration and bytes before publishing the catalog; changing collections are refused. This is not a filesystem-wide instantaneous snapshot. Failed captures can leave unpinned child artifacts; they do not publish a complete catalog. A complete catalog is pinned through the existing artifact owner and retains its children.

Stop waiting for capture stops the browser request. The native capture may finish: inspect retained catalog artifacts before another explicit capture. Stopping never selects a partial result. No automatic retry occurs. Folder and recursive settings stay fixed for the selected catalog; Use live collection prepares an explicit setup change back to live Files. Frozen mode supports individual review, bounded paging, search and status filters. Contact-sheet thumbnails and bulk review remain live-collection workflows.

Choose a collection

Gallery!type = "gallery"
Gallery!config = <toml>
  version = 1
  kind = "gallery"
  title = "Review retained assets"
  folder = "review-assets"
  recursive = false
</toml>

Gallery!data = <json>
  { "version": 1, "reviews": [] }
</json>

Set up Gallery chooses the model-relative folder and whether to include subfolders. Empty folder means the model Files root. Paths cannot contain absolute paths, schemes or traversal. Configuration saves require an exact, advancing, ready native revision receipt; failed setup retains the draft.

Load collection and Refresh collection read native Files metadata and admit bounded thumbnails for the current page. Before explicit load, Gallery performs no listing or thumbnail work. Gallery requests a bounded native batch of up to 200 files, then displays 24 cards at a time within that batch. Next assets / Previous assets move between card pages without a request; Next file batch / Previous file batch request another native metadata page. Batch navigation retains selected files for the existing bounded bulk review. No complete listing is materialized and no quota-wide byte scan is performed by the paged endpoint. Existing Files callers keep their legacy complete-list API.

Enter a filename or path fragment in Search collection, then choose Search to find matches across the configured native collection, including subfolders only when configured. You can search before loading an unfiltered batch. Typing issues no request and keeps the prior results until the new query is explicitly applied. Query changes abandon a pending old-query response. Clear search explicitly returns to the first unfiltered native batch. Selected files remain selected across search changes; open review/setup drafts protect against changing query scope.

Search is case-insensitive substring matching on model-relative names/paths, not file contents; it admits at most 256 UTF-8 bytes and performs no accent folding. The native owner normalizes it once and matches before selecting up to 200 results. Subsequent native batches carry the same query and cursor. A host that does not acknowledge the requested query refuses the result rather than silently filtering an incomplete listing in the browser.

Choose Images, Other files or All files under Show, and Path, Newest first or Largest first under Sort. Choose Apply view to request that view across the native collection. Changing either control issues no request and leaves the displayed batch unchanged until applied. Search applies the current query and view together. Clear search retains the applied sort and file type. Applying a view starts at the first batch and keeps selected files for bulk review. Open review/setup drafts prevent view changes.

The native owner filters before selecting a page. Images are classified using its filename-inferred media types; this is not a byte inspection or a promise that every image format has a preview. Newest and Largest use native metadata, descending, with model-relative path as the ascending tie-break. Path uses UTF-8 path order. Cursor tokens preserve exact native metadata values and the requested folder, recursion, query, sort and file type; a cursor for a different view is refused. Gallery never sorts an incomplete batch into a claim about the whole collection.

File changes between requests can add, move, remove or repeat entries; continuation is a live listing, not a catalog snapshot or byte identity. Refresh starts at the first batch of the applied view. Selected review saves still reread and verify the exact file bytes.

A page scan admits at most 100,000 visited directory entries, 64 levels and a five-second deadline checked during the scan. Larger, deeper, unreadable or slow scopes refuse rather than silently truncate their listing; choose a narrower folder. Page history is bounded to 1000 batches. Stop loading abandons a pending listing locally and fences late responses; it does not promise to cancel an already-running native filesystem call. Newest/Largest read metadata for each matching file within the same scan budget, retaining at most 201 candidates; they do not read file contents or compute total quota usage.

Choose Review status and Apply view to show unreviewed bytes, Keep, Reject, Pending or any saved review across the collection, before native pagination. Next unreviewed starts directly from the header; after selecting an asset it finds the next unreviewed file in the chosen folder, search, file type and ordering of the applied view. Unapplied search, sort and file-type edits stay available for Search or Apply view; saving a review does not apply them. At the end, First unreviewed explicitly starts over. Pending is a saved review, separate from unreviewed.

The selected native operation reads the Gallery's current saved review document through native formula and compares it with the displayed history. It hashes matching files with history to compare their actual SHA-256 against saved byte versions. A changed file becomes unreviewed while older reviews remain intact. Files without any saved history require no byte read for membership. Each selected request admits at most 500 saved records, 512 KiB of review JSON, 16 MiB per history file, 64 MiB of hashed bytes and 15 seconds, plus the existing native scan limits. Isolated calculation-worker deployments currently refuse this selected review-data inspection lane. Malformed or unavailable history, a changed model, unsafe files or exhausted budgets refuse the entire result; they never infer unreviewed from unchecked history. Narrow the folder or search when a request exceeds a bound. Saved timestamps must be RFC3339. Status cursors retain history identity and refuse changed saved reviews. The view marks changed review data and requires Apply view before continuing its old batches.

This remains a live Files view: statuses describe bytes observed during that request, rather than a frozen collection snapshot. Selected downloads enforce any observed history-file hash, and saving verifies the selected bytes again. No status scan or polling runs on ordinary opening, All files browsing, or each keystroke. View options contains thumbnail visibility and keyboard shortcuts. Directory records are omitted; change the configured folder to browse another directory. Cards show filenames, sizes and available review history. After load, up to 12 PNG/JPEG/static WebP thumbnails on the current page download and verify sequentially. Each source uses the same 8 MiB and image-dimension limits as selected previews, then is downsampled to at most 256 pixels per side. Only small thumbnail blobs are retained; full source bitmaps close after drawing. Hiding thumbnails, leaving the page or changing collection ownership releases that page's cache. Images exceeding the admitted bounds keep a file card and can be inspected explicitly.

Inspect exact asset bytes

Selecting a PNG/JPEG/static WebP card opens one verified image preview. Previous file and Next file move through the filtered native collection, opening only the newly selected file. At a batch edge, the buttons or arrow keys explicitly request one adjacent native batch and select its first or last file. Query, order, type and review filters stay applied; empty batches stop navigation without automatic skipping or prefetching. Other formats use Verify selected file. If an image cannot be previewed, Verify selected file can still inspect its bytes within the file limit. Fit image starts with the complete image visible. 100% shows one decoded image pixel per CSS pixel; use +/− to zoom and drag or scroll to pan. Focus the image for arrow-key panning, 0 to fit, and 1 for 100%. These keys stay inside the image instead of selecting another file. Image view options holds sharp-pixel display and keyboard help. Zoom is bounded to 12.5–400%; it changes presentation only, using the same verified bytes and review identity.

Expand File details and identity for its exact path, media type and hash. The selected native download has an explicit byte limit and must match the observed Files size and media type. Gallery computes SHA-256 over those bytes.

PNG, JPEG and static WebP previews admit at most 8 MiB, 4096 pixels on either side and 16 million pixels total. Signature and header dimensions are checked before browser image decoding. Other file formats can be verified and downloaded explicitly, within a 16 MiB limit. Verified MP4/WebM video and MP3, MP4, WAV, Ogg, WebM or FLAC audio show local playback controls after Verify selected file. They preload metadata and never autoplay. Video previews admit up to 4096 pixels per side and 16 million pixels total. Playback depends on the browser's installed codec support; unsupported media retains its verified download. Selecting a video/audio card alone performs no download, and no remote source, playlist or background media scan is introduced. Playback pauses when Gallery is hidden or loses focus. Changing files, a playback error or closing Gallery releases the previous player. Returning keeps the current position and requires Play to resume. An image decoding failure is reported without replacing the source.

For a PDF, select its card and choose Open verified PDF. This checks the same native Files bytes and SHA-256 identity before starting the packaged local PDF renderer. Previous page, Next page, the page chooser and PDF zoom inspect one page at a time. Focus the preview to use left/right arrows or Page Up/Down; +/− changes zoom. Page text and keyboard help exposes selectable page text for accessible inspection only when opened. Scanned pages may have no text; this does not perform OCR. Close PDF preview stops its worker and releases its canvas; reopening uses the same verified bytes without a download.

PDF previews admit at most 16 MiB and 500 pages, with one retained page canvas of at most 4 million pixels and 4096 pixels per side. Embedded images above that pixel bound refuse the selected page. Opening, rendering and page-text requests have a 30-second deadline. Page text is streamed and retained up to 20,000 characters. These are selected-operation bounds, not a hard process heap limit on a PDF decoder. Password-protected, unsupported or corrupt documents keep the verified download and byte-version review controls available.

PDF.js is exact-pinned and loaded only after an explicit verified PDF open; its dedicated local module worker exists only while that preview is open. Ordinary Gallery loading, other surfaces and non-PDF files start no PDF worker, timer, document decode or resource request. The optional Node canvas backend is excluded from product dependencies. No URL document source, document scripts, interactive annotation/link layer, XFA forms, remote fonts, CMaps or Wasm resources are admitted. PDFs needing unavailable encoding resources may refuse a page instead of fetching them. This is a page viewer, not a PDF editor. Download verified copy downloads the exact bytes already inspected, which may differ from a later replacement at the same path.

Files metadata does not provide an independent content hash. The displayed identity means “these downloaded native bytes at this path”; it is not a signed catalog assertion. A changed size, media type or hash refuses the operation. No arbitrary media URL, idle thumbnail crawler or polling is installed.

Compare verified images

Choose Compare with another image on an open raster preview, then select another PNG, JPEG or static WebP. Gallery keeps one reference copy and shows the two verified images side by side. Browse further images to keep comparing against that reference. Use selected image as reference replaces it; Clear comparison releases its retained bytes and preview URL.

Fit images fits each pane independently. 100% and shared zoom use the same decoded-pixel scale in both panes, preserving different image dimensions. Equal decoded dimensions enable linked panning while zoomed; unequal dimensions keep pan offsets independent. Link panning and sharp-pixel enlargement live under Comparison options and byte identities, alongside both exact SHA-256 identities. Focus either pane for arrows, +/−, 0 to fit or 1 for original size. Narrow screens stack the panes.

The reference is the previously verified copy, not a live reread of its path. Comparison does not register images, derive pixel differences, resample data or establish physical alignment. Reviews and downloads continue to address the selected byte version. The reference survives browsing and metadata searches; collection or model/binding-owner changes clear it. No reference file is read again; selecting a second image performs its normal exact-byte verification. At most two admitted raster copies are retained, each under the existing 8 MiB, 4096-side and 16-million-pixel limits. Browser decoder resource limits remain unchanged. Reference pinning is session-local and adds no model write.

Review a selection

Select multiple files reveals selection checkboxes. Choose files across pages, or use Select this page, then Review selected files. The batch admits up to 24 files and 64 MiB total, with the existing 16 MiB limit per file. A shared Keep/Reject/Pending label, note and optional reviewer apply to this selection.

Verify selected files captures each exact byte identity in sequence without retaining full source blobs. Where a thumbnail was already viewed, its hash must match. Save reviews rereads every selected file against those captured hashes and saves the entire set through one guarded native review-document write. A changed file prevents the whole write; older reviewed versions remain separate. There is no partial per-file publication.

The selection and batch draft protect navigation. A failed verification retains the metadata for correction. A missing save acknowledgement prevents replay; Keep batch and stop waiting retains the draft and Observe saved batch reviews checks the native document. An exact observed document confirms the save; a different document requires downloading the draft and reopening. Discard batch draft clears selection. No bulk work is admitted before this explicit workflow, and Run keeps its browsing-only behavior.

Save a review

Review file (or Edit review for an already-reviewed version) opens a label (pending, keep or reject), a note and optional unverified reviewer label under Reviewer and byte identity. Saving rereads only that selected asset and checks that its hash still matches, then writes the complete guarded review document through the native surface-data owner. Acceptance requires the exact requested document, matching data symbol, advancing request revision and ready resolved revision. It does not accept an optimistic echo or a void response.

With Gallery focused, K prepares Keep and R prepares Reject. These keys only change the draft. Enter explicitly saves through the same byte/hash checks and native receipt, then finds the next collection-wide unreviewed file. Save and next unreviewed provides the same action with a button. It advances only after acknowledgement; failed or uncertain writes retain the draft and require observing saved data before retrying. Shortcuts ignore text fields and can be disabled in View options. Buttons remain available.

The review key is (model, partition, Gallery namespace, asset path, SHA-256). A changed byte version retains previous reviews separately. Duplicate reviews for the same path/hash are refused; updating that version preserves other records. Review documents admit 500 records and 512 KiB JSON; paths are at most 1024 characters, reviewer labels 100 and notes 2000. Native signed account IDs admit 256 printable ASCII characters. Expand Saved reviews to inspect the history in 24-row views; hashes and reviewer labels remain available under each version's details. Download review CSV exports the entire saved history, including all byte versions, notes, authored times and unverified reviewer labels, rather than just the visible page. It quotes multiline text and makes formula-like text literal for spreadsheet import. Download review JSON preserves the original saved review document exactly. Both exports read metadata already in the surface; they do not fetch file bytes or include unsaved drafts. Unsupported or malformed saved data is preserved for recovery in Code and cannot be overwritten through the review form.

A failed save keeps the local draft, and refresh/selection/navigation cannot silently discard it. Download review draft, under reviewer details, retains a local JSON copy; a failed save also exposes Save a copy of this draft alongside the error. Discard review draft releases the navigation guard. A missing or ambiguous receipt locks retry against that observed revision. Keep review and stop waiting retains pending work; Observe saved reviews reads the owner and requires an advancing resolved revision before reopening against current data. Setup has the corresponding stop-waiting and observation actions. Observation remains available after discarding a review draft or cancelling setup when its save outcome is still unknown. Collection changes during a pending review save release the waiting state and retain the draft and recovery action. Observation compares against the revision at dispatch, including when refreshed data arrived before the receipt. Neither recovery action repeats a write, and late abandoned receipts cannot clear a draft. Account, backend or model changes clear session-owned previews and ignore their late replies. Source/owner changes while verification or a review receipt is pending retain the draft and refuse success. A scope change clears the collection preview and requires an explicit new listing.

Reviewer labels, review statuses and times are authored metadata, not authenticated attribution or approval. They do not authorize publication or another product operation. Accepted review metadata belongs to the existing model-owned Gallery data slot. Unsaved drafts are session-local unless downloaded; no new local storage or durable draft service is introduced.

Run mode permits selected browsing/verification/download but hides setup and review mutations. Print fetches no asset bytes and includes the complete admitted collection of at most 500 saved reviews. This workflow has no external gallery connection.

Review with a signed account

Select Use signed account in an individual review to confirm the account through the native owner. The editable reviewer label then becomes read only. Saving requests a native attestation over the selected file's exact bytes, decision, note, account, native time, model and Gallery data slot. The native owner rereads at most 16 MiB of selected bytes with a 15-second budget. Changed bytes or an account change refuse the save. The existing acknowledged review document remains the durable save owner; attestation alone does not save it.

Saved history says Signed reviewer only after native verification of that exact review proof. Historical labels remain Reviewer (unverified). Editing a signed review through the label-only workflow removes its previous proof. JSON exports preserve proofs, but copies to another model/data slot, tampered reviews, another host authority or a rotated authority key remain unverified. CSV contains metadata and cannot independently authenticate a reviewer. Print may verify retained metadata but fetches no asset bytes. Shared server signing authority is required; unavailable authority never falls back to a signed claim.

Find and revisit saved decisions

In the authoring workspace, Saved reviews shows the number of saved pending records. A pending row offers Resume review: Gallery searches the current configured collection for the exact path, verifies its saved SHA-256, then restores the decision, note and unverified reviewer label as an editable draft. Resumption does not save anything. Save review retains the existing byte recheck, expected-review revision and acknowledged native receipt requirements. If the source owner, saved-review revision or document changes while opening, Gallery refuses to restore an outdated draft. Changed bytes, missing paths, verification failures and collection search limits keep the saved history intact; use Open current file to inspect a new byte version or narrow the collection. Resumption is unavailable in Run/print and while an earlier write is uncertain. There is no automatic queue, collection scan or background polling.

Saved reviews can be searched by file path, note, reviewer label or byte identity, and filtered by Keep, Reject or Pending. Search covers the whole retained history, including records on later pages. This is authored review history; it does not establish the status of current file bytes. Printing still includes every retained byte version.

Choose Open current file to find the exact path in the configured collection using a bounded native metadata search. The current file is verified separately before reviewing it. Changed bytes retain the older decision as history and can receive a new review. If the path moved, was removed or falls outside the bounded search, narrow the collection; no saved decision is discarded. Open review and setup drafts prevent history navigation.

Import a review history

Choose Import review history and select a Gallery review JSON export. The preview counts new byte versions, identical reviews and conflicting decisions. Conflicts default to keeping the current decision; choose Use imported decisions to replace only matching path/hash records. Earlier byte versions remain separate. Importing does not read the asset files, establish their current byte identity or authenticate the reviewer labels.

The merged history must still fit 500 records and 512 KiB; excess data refuses the import instead of truncating it. Import saves one acknowledged review document and prevents navigation while its preview is open. If acknowledgement is lost, Observe imported history reads the saved document and accepts only the matching merged history at an advancing revision; it never repeats the write. Save the Grid document to retain imported history in its archive.

Left and right arrow keys browse the current native file batch and reveal the selected card page. Typing in an input or editing a review keeps those keys local to that control.

Static WebP preview supports simple lossy VP8 , lossless VP8L, and extended VP8X files, including transparency. Selected bytes retain their native SHA-256 identity; optional thumbnails use the same verified source and existing bounded PNG derivative. WebP headers undergo bounded RIFF size/chunk, bitstream/canvas size and dimension admission before browser decoding. Animation flags or ANIM / ANMF chunks refuse preview explicitly, with download and exact-byte review still available. Scaled VP8 frame headers, unsupported versions, conflicting frames and malformed/truncated containers refuse as well. The existing 8 MiB, 4096-pixel side and 16-million-pixel limits remain unchanged; at most 512 chunks are scanned. This header check does not certify compressed payload validity or provide a browser decoder heap/time cap; decode failures remain visible.

Admission follows the official WebP container specification, lossless bitstream specification and VP8 header format. No new image codec dependency, native image computation or external resource fetch is introduced.

Remove a saved review

In Saved reviews, expand a record’s Identity and reviewer details and choose Remove saved review…. Review the exact path, byte identity, decision and note, then choose Remove saved review or Cancel removal. This removes only that authored metadata record; the asset file and other byte-version reviews stay intact. Missing or moved files require no file lookup or byte verification. Export Download review JSON first to retain the original history. There is no automatic pruning: explicit removal can free a slot when the 500-record history is full. Removing its only record saves an empty review document.

The preview blocks other edits and collection navigation. Saving uses the captured document identity, source owner and expected revision, and accepts only a matching ready receipt. After an uncertain save, Observe saved history checks an advancing saved document without repeating removal. A matching document completes the operation; a different newer history is displayed for cancellation and reopening. Save the Grid document to retain the change in its archive.

If a source or setup change prevents observation within the removal preview, choose Close preview and recover in Gallery. This is a recovery exit, not cancellation of the possible save. Gallery retains the original record for download and blocks new individual, batch, import and removal writes until Observe saved reviews accepts a newer ready revision. Collection browsing becomes available again. The pending removal is never replayed.

Recover a batch or history import

When a batch or imported-history save has an unknown outcome, closing its preview returns to Gallery recovery. Download pending review history retains the exact document sent for that save. You can browse the collection while further review writes wait for Observe saved reviews to read a newer ready history. Late responses cannot replay the closed action. The recovery copy is released after that observation.

While verifying a selected file or opening saved review history, Stop opening file cancels that wait and keeps the selected path and history. Choose Verify/Open explicitly to retry. Late byte-verification responses cannot restore an old review draft or replace the current preview; review-write recovery remains separate.

Opening a current file or resuming a pending review from saved history offers Back to collection. It restores the original applied search, order, file type and review status using a fresh first native batch, while retaining any unapplied filter drafts. Unsaved reviews and pending writes must be resolved before returning; old file bytes and cursors are never replayed.

Collection cards show Saved: Keep, Saved: Reject or Saved: Pending when an already available verified byte identity exactly matches a retained review. Unknown or different file versions retain the neutral Review history label. Badges add no downloads, hashing or collection scans.

Saved review history accepts complete retained paths and notes in its existing search field (up to 2000 characters), so pasting a long identifier no longer truncates the distinguishing suffix. Search still covers the complete admitted history before paging.