Images v0.2.27

• Archive books now offer a persisted continuous vertical-reading mode for webtoons and long strips; the virtualized reader lazily decodes nearby pages, recycles offscreen pixels, preserves per-book position, exposes calm retry states, and remains mutually exclusive with two-page spreads.
• Diagnostics, About provenance, and startup logs now report the loaded MagickNET.Version, native ImageMagick version, and SELECT sqlite_version() result; versions below ImageMagick 7.1.2-2 or SQLite 3.53.2 raise an explicit warning instead of letting native payload drift stay invisible.
• Archive pages now independently verify advertised ZIP/RAR/7z CRCs before returning decoded bytes; a corrupt-entry regression proves damaged page data fails as an archive error instead of silently reaching the image decoder.
• Focus peaking and exposure-clipping overlays now provide bounded, cancellable RAW/photo culling analysis directly on the transformed image surface; both are localized, persisted, rebindable, command-palette discoverable, and use a text legend alongside green/red/blue markers.
• Active-monitor DXGI diagnostics now report HDR/SDR color space and peak/full-frame luminance; when HDR-class content is tonemapped for the WPF SDR surface on an HDR desktop, the Details panel shows an explicit localized status badge.
• Exif 3.1 learning-use preferences, development provenance, and correction/noise-reduction state now appear as localized read-only metadata; strict TIFF parsing preserves the new UTF-8 fields, labels reserved values explicitly, and rejects legacy Samsung/GE tag collisions without modifying the image.
• Settings can now export and transactionally import a bounded, versioned JSON allowlist of portable preferences and custom shortcuts; previews report applied/ignored counts, while private paths, window placement, history, and update-check consent never leave the local database.
• Service-generated metadata, color analysis, diagnostics, OCR, content-credential, model-management, network-export, and asynchronous loading/error copy now follows the active UI culture; the pseudo-locale test covers real service outputs instead of XAML alone.
• Native SQLite is pinned to 3.53.3, every app-owned database disables and verifies trusted-schema execution on open, and release readiness rejects runtimes below the reviewed 3.53.2 security floor.
• Macro and batch folder collection now shares one reparse-aware traversal that skips nested junctions/symbolic links, inaccessible paths, unsupported files, and duplicate sources instead of walking outside the selected tree.
• User-selected macro and batch-preset JSON imports are now capped at 1 MiB and 128 operations, reject null action arrays cleanly, and read through replacement-friendly bounded streams. App-owned collection, tag, model-manifest, tile, and update-state JSON is likewise size-bounded so damaged local state cannot cause unbounded memory use.
• Background thumbnail, metadata, catalog, and paged-image decoders now open source images with delete sharing, so navigation-time reads no longer intermittently block Recycle Bin deletes or atomic replacements.

Added

• Refined viewer design target - A new image-generated concept at assets/mockups/premium-viewer-v0.3-concept.png captures the intended hierarchy for the contextual file bar, inset image stage, progressive Details inspector, filmstrip, and transport dock.
• Monitor-aware legacy ICC output - The opt-in color-managed display path now resolves the active monitor profile with Windows ICM, verifies Advanced Color state, converts tagged images to a non-sRGB monitor profile only in legacy SDR mode, and safely falls back to sRGB otherwise. Moving the window between monitors invalidates preloads and re-decodes the current image; About diagnostics report the active destination and fallback reason.
• Resource-bounded adversarial codec corpus - A dedicated child-process probe now exercises corrupt/truncated PNG, JPEG, WebP, TIFF, GIF, and SVG inputs, declared-dimension bombs, and archive entry/compression floods under a 20-second wall timeout and 768 MiB Windows Job Object ceiling. Hash- and license-verified upstream fixtures prove AVIF, HEIC, JXL, DNG RAW, and PSD decoding without risking the xUnit host.
• Screen-reader announcements for asynchronous status changes - Every dynamic status surface across all 20 WPF windows now raises coalesced LiveRegionChanged events with polite semantics, including scans, imports, exports, recovery, model work, background activity, and errors. Static contracts cover every named status surface, while the opt-in rendered matrix now constructs every secondary window under Dark, Latte, High Contrast, and the pseudo-locale.
• HDRI decode-time tonemapping - EXR, Radiance HDR, RAW, AVIF/HEIC/JXL, and high-bit-depth PNG/TIFF content now retains floating-point highlights until Reinhard, Hable, or ACES maps them into the SDR display range. Reinhard is the default, Settings exposes the operator, and decoder provenance identifies when tonemapping was applied.
• Authoritative local-data registry and privacy reset - Settings, --system-info, and support bundles now share one inventory covering the real catalog and semantic-index files, caches, models, diagnostics, histories, drafts, backups, and temporary media. A confirmed reset clears registered rebuildable/diagnostic stores while preserving imported models and user-owned content.
• Adjustable loupe magnification - Appearance settings now offer a loupe magnification choice (2×, 3×, 4×, 6×) so the middle-button magnifier can zoom in further than the previous fixed 2×.
• Keyboard-invocable loupe - A new "Toggle loupe magnifier" command (default L, rebindable, in the command palette) shows a viewport-centered magnifier with no mouse needed; pan the image to move it beneath the lens. Holding the middle button still temporarily overrides the lens to follow the cursor.

Fixed

• Concurrent diagnostics and recovery logs are lossless - Recovery Center instances now serialize append/compaction/read operations so overlapping destructive workflows cannot drop durable records, and deferred network-log collection mutations now honor the same lock used by snapshot readers.
• XMP/XML imports are resource-bounded - Sidecar, catalog, tag, edit-stack, inbox, and Picasa XML readers now reject documents over 16 MiB, prohibit DTD/entity expansion, and use replacement-friendly file sharing before parsing user-controlled metadata.
• Atomic exports tolerate brief file locks - Final temp-file swaps now retry a bounded number of times when an image reader, thumbnailer, or security scanner briefly locks the destination, preventing intermittent crop/writeback failures without hiding permanent permission errors.
• Optional tools cannot exhaust memory through process output - ExifTool, c2patool, jpegtran, and Ghostscript now share a concurrent bounded process runner: version probes retain at most 256 KiB per stream, operations retain at most 4 MiB, and exceeding either limit terminates the child process tree with a distinct failure from timeout or nonzero exit.
• Secondary failures no longer expose exception internals - Rename, delete, rotate, crop, copy, export, repair, wallpaper, Explorer, transfer, save, print, metadata, email, clipboard, and edit-stack failures now show stable localized recovery copy; full exception and service-result details remain in diagnostics logs.
• ImageMagick now denies unadvertised native decoders - Startup injects a deny-all-then-permit coder policy, disables filters and @ path indirection, and default-denies delegates except the four Ghostscript raster-preview paths when that approved runtime is present. SVG/SVGZ use the in-process MSVG pipeline; hazardous MNG, TIM, MSL, and direct MVG inputs are no longer advertised.
• Inline rename is transactional and restart-recoverable - Image and XMP moves now succeed as one unit or roll back together, successful renames persist their complete sidecar map in Recovery Center, and an incomplete rollback creates an explicit partial-state record instead of silently orphaning metadata.
• Support bundles remove all rooted paths - Every textual ZIP entry now passes one sanitizer that replaces drive-rooted, UNC/device, file-URI, mixed-separator, quoted, and POSIX absolute paths with %PATH%, including exception text and bundle failure details.
• Archive books enforce aggregate safety budgets - Archive enumeration now stops at 10,000 entries, 4 MiB of entry-name metadata, 4 GiB of declared image data, or a known compression ratio above 1000:1, before page names are materialized or image data is decoded.
• Malformed image dimensions now fail closed - Raster loads classify dimension preflight as small, large, rejected, or unknown; rejected and inconclusive probes are refused before WPF or managed full-frame decode can allocate from untrusted headers.
• Session restore no longer reopens a broken or peeked file - A file that exists but fails to decode, or a transient --peek target, is no longer saved as the "last image", so opt-in session restore won't reopen a known-bad file or promote a peek into a full session.
• Large archive spreads fail cleanly - A two-page spread whose combined width overflowed a 32-bit integer produced an opaque render error; it now reports the same "too large to render" message as other decode paths.
• Animated WebP/APNG frame delays can't overflow - Very large per-frame delay fields (32-bit for WebP/APNG) no longer overflow into a negative value and silently reset to 100 ms; delays are computed in 64-bit and capped at 60 s.
• Batch preview shows the real output names - When several source files rename to the same stem, the batch preview now reports the distinct destinations the run will actually write instead of repeating one identical path.
• No crash if a command faults during shutdown - An async command that faulted after its view model was disposed could rethrow on a background continuation and terminate the app; the fault is now logged instead.
• Calmer decode-failure message - The "couldn't be displayed" card no longer appends raw decoder exception text; it shows a clear localized sentence and logs the technical detail for diagnostics.

Changed

• Viewer workspace has a clearer visual hierarchy - The active file now gets a quiet breadcrumb/action bar and inset stage, the Details panel leads with four scannable facts and collapses duplicate metadata, the filmstrip prioritizes larger image previews, and navigation/view/file actions sit in three coherent transport groups that wrap intact on narrow windows. Peek and fullscreen modes remain edge-to-edge.
• Deterministic image-runtime tests - Test collection parallelism now has a fixed four-worker ceiling, WPF/settings tests that share process-wide theme and decoder state are serialized together, and async writeback assertions wait for operation completion before checking terminal state.
• Reproducible local and release builds - global.json pins the .NET 10.0.3xx feature band with patch-only roll-forward, app/test NuGet graphs are committed as lock files, and release readiness restores in locked mode. CycloneDX 6.2.0 is a repo-local tool restored explicitly before SBOM generation, removing dependence on machine-global tools.
• Primary windows are fully localization-backed - MainWindow menus, tooltips, empty/error states, gallery, inspector, controls, shortcuts help, and AboutWindow visible copy now resolve from resources. The localization gate rejects new literal visible text in either window and missing XAML resource keys; the pseudo-locale covers every addition.
• Consistent microcopy - "Auto enhance" menu casing, and the duplicate-cleanup buttons read "Quarantine extras"/"Recycle extras" instead of the awkward "extra(s)".

Performance

• Transient sidecar failures no longer re-hash unchanged images - Incremental catalog scans retain the cached row and retry an inaccessible XMP metadata probe on the next scan, avoiding repeated SHA-256 work while still applying a real sidecar change once it becomes readable.
• Navigation no longer waits on dispatcher-thread disk probes - Edit-sidecar reads and file-size checks now run alongside decode, while neighbour preload size/dimension/staleness probes stay entirely on workers. RAW embedded previews update only the pixels, so folder thumbnails and metadata, color, and C2PA analysis start once for the final decode instead of being canceled and restarted.
• Gallery workbench stays responsive on large folders - Its wrapping tile grid now recycles only the visible rows plus a small scroll cache instead of constructing every thumbnail card and context menu at once.
• Faster folder sort by date/size - Sorting a large folder by modified/created/size now stats each file once instead of repeatedly inside the comparator, removing multi-second stalls on big or network folders.