Local Gallery

Draft

Every native app is a complete local gallery first and a synced client second. Mechanisms live in Filesystem — Client and Clients; this doc owns the requirements.

Functional Requirements

FR1 — Browse, search, view locally-held assets, and organize with zero connectivity; none of these has a server dependency.
FR2 — Never signing in is a valid mode: import, organize, search, export.
FR3 — Import is local; streaming import is the one server-requiring exception.
FR4 — An unavailable remote representation degrades along the fetch ladder; no offline condition removes an asset, album, or index entry.
FR5 — A damaged index rebuilds from local sidecars (maintenance) without network.

Security Requirements

SR1 — The Recently Deleted and Hidden views require fresh local authentication (biometric, else credential), with a short per-view grace window. This is UX protection, not a cryptographic boundary.
SR2 — At rest, mobile relies on the app sandbox plus file-based encryption; desktop on OS user permissions and full-disk encryption only. Rooted devices void the sandbox guarantee.
SR3 — Decoded previews, caches and temp files stay inside the app-private library root (placement); export applies the privacy strip.

Non-Functional Requirements

NFR1 — Gallery read paths attempt zero network I/O; tested with a socket-refusing harness.
NFR2 — An airplane-mode, never-enrolled import → browse → search → organize → export run is part of the E2E surface.
NFR3 — Offline cold start takes the online code path; no blocking connectivity probe.
NFR4 — Every input responds within one frame and local edits apply within 100 ms, per Clients — Responsiveness.

Validation

Unit tests cover the gated-view policy and cache placement; smoke tests cover NFR1, FR2 and FR5 offline.