@gram 2
doc blog-viewer-architecture
t An ephemeral viewer: request, Core worker, escaped HTML
d Architecture and privacy boundaries of the existing web renderer, including the branded checkout and its limits.
tag architecture
view document

::rich
# A viewer, not a hosted document library

The existing web renderer solves a narrow problem: let a person inspect a submitted .gram file in a browser without requiring an account or storing a document collection. The `brand-monochrome` checkout at 254a49d is a local worktree of this same renderer repository, not an independent repository or separate product. The API accepts a multipart POST containing source bytes or text, sends it through Core, and returns render data. The `/view` path returns a page. Since a later GET cannot recover an earlier submission, the browser must submit the file again when it asks for another revision. This is a distinct product shape from Vault, which owns identity and storage APIs.

The separation is important for both product expectations and privacy. There is no document ID registry, account session, sync service, database, or saved sharing link in this viewer contract. The server handles submitted bytes in request memory and forgets them after responding. Request logs are documented as a fixed schema without query, header, or body values. That reduces persistence surfaces, but it does not mean the server never receives the document: the user explicitly submits bytes to the service.

## Request path

A browser or command-line client sends a `multipart/form-data` POST to `/api/v1/render`, `/api/v1/search`, or `/view`. A field chooses one input representation (`file` or `source`) and optional selectors such as `revision`, `at`, `history`, `history_offset`, or `html`. The service validates field cardinality and size, then invokes Core in a fresh worker process. The worker receives document input on stdin and returns structured results on stdout. Time, memory and concurrency limits bound the work; failures are explicit errors such as `E_LIMIT`, `E_STALE`, `E_BUSY`, or `E_TIMEOUT`.

Core history and replay supply the selected source and projections. The HTML renderer escapes document values, restricts links to safe schemes, and does not emit document-provided scripts, styles, or images. Unsupported blocks are retained as source with an unsupported-content indication. The browser keeps a selected file in tab memory and posts it again for state changes; the documented implementation avoids browser Storage APIs, service workers, and putting document text in the URL. A content security policy and `no-store` responses further constrain page behavior.

## Example: render one selected historical state

For a local file named `plan.gram`, a client can submit `file=@plan.gram` and `revision=2` to `/api/v1/render`; to ask for an HTML fragment, include `html=1`. A caller should handle a 422 Core history error, a 413 size cap, and temporary 503 worker saturation rather than claiming every source produces a complete view. The renderer may return summary metadata for old states while some detailed change projections are bounded by a source-byte budget. A rendered view is a projection, not a rewrite of the original document.

## The branded worktree is not a separate service

The local `brand-monochrome` git worktree is based on thegram-web-render at earlier commit 254a49d. Its remote is the same renderer repository; it is not a separate product repository or independent service. The difference is a local snapshot, not evidence of another identity store, deployment, or retention model.

## Tradeoffs and limits

A stateless renderer avoids account friction and server-side document libraries, but it requires sending the bytes on every interaction and does not create a durable share URL. HTML output is safe by default and may omit unsupported rich content or show raw source; this is not a full fidelity promise for every format construct. Resource caps protect service availability but mean a large file or busy worker pool can fail. Public access and ephemeral handling do not equal confidentiality guarantees beyond the described processing and logging boundary. A user handling sensitive data should decide whether the service is appropriate before submitting it.

Read `docs/api.md` for the exact multipart contract and error codes, `README.md` for browser behavior and fidelity, and `deploy/README.md` for deployment controls recorded by that checkout. Do not infer current deployment status from source configuration alone.

## Sources

Implementation claims use both renderer checkouts' README, API and deployment documentation.
::end

SRC renderer-readme
d Internal source reviewed at revision 971a0474fb4b97c3d23d6687be80664461f43a2f (main: README.md); not publicly available.
t Renderer README and browser flow
SRC renderer-api
d Internal source reviewed at revision 971a0474fb4b97c3d23d6687be80664461f43a2f (main: docs/api.md); not publicly available.
t Renderer HTTP API contract
SRC renderer-deploy
d Internal source reviewed at revision 971a0474fb4b97c3d23d6687be80664461f43a2f (main: deploy/README.md); not publicly available.
t Renderer deployment configuration documentation
SRC brand-readme
d Internal source reviewed at revision 254a49d8adb6ccb98675a0511283f511914394c9 on branch brand-monochrome (README.md); not publicly available.
t Branded renderer README
SRC brand-api
d Internal source reviewed at revision 254a49d8adb6ccb98675a0511283f511914394c9 on branch brand-monochrome (docs/api.md); not publicly available.
t Branded renderer API contract
SRC brand-deploy
d Internal source reviewed at revision 254a49d8adb6ccb98675a0511283f511914394c9 on branch brand-monochrome (deploy/README.md); not publicly available.
t Branded renderer deployment documentation
K ephemeral
t Renderer processes submitted documents ephemerally
d The request path uses worker processes and in-memory document processing without a persistent document store in the documented contract.
source renderer-readme
source renderer-api
supports worker-path
K worker-path
t A bounded worker turns Core output into HTML
d Fresh workers, resource limits, escaping and restricted browser behavior constrain untrusted document rendering.
source renderer-readme
source renderer-api
supports renderer-boundary
K renderer-boundary
t The branded checkout is not proof of a separate service
d Similar API and deployment docs describe a checkout distinction; operational independence requires separate evidence.
source brand-readme
source brand-api
source brand-deploy

K disclosure-risk
d No storage does not mean no transmission; a user must decide whether the chosen document is appropriate to submit.
source renderer-api
t A stateless viewer still receives document bytes
supports ephemeral

@gram-history 6
@rev 0 2026-10-12T08:08:28.895Z - d3ad17f9c109b1e3cb37740792a4c71fcd5dd04cb43b51fe4535178d17d15daa
@rev 1 2026-10-12T08:14:42.249Z - req=blog-editorial-knowledge-viewer-architecture-20261012 dig=43c25abbe0a120ec 0916a8aeaf6c8e35f578e293f49d2281709ed9856242824823f49a9c17690879
@@ 69 0 5
X disclosure-risk
t A stateless viewer still receives document bytes
d No storage does not mean no transmission; a user must decide whether the chosen document is appropriate to submit.
source renderer-api
supports ephemeral
@@ 75 6 0
@rev 2 2026-10-12T08:16:27.768Z - req=blog-public-source-links-viewer-architecture-20261012 dig=2f6e603fb55d9d29 0503beaf5910b5b82f62bc3fea75409343ccae858fd24d08f1523738b3a466ed
@@ 49 1 0
@@ 51 0 1
ref https://github.com/clab-one/thegram-web-render-brand/blob/main/README.md
@@ 52 1 0
@@ 54 0 1
ref https://github.com/clab-one/thegram-web-render-brand/blob/main/docs/api.md
@@ 55 1 0
@@ 57 0 1
ref https://github.com/clab-one/thegram-web-render-brand/blob/main/deploy/README.md
@rev 3 2026-10-12T08:40:15.845Z - req=platform-corrections-viewer-architecture-20261012 dig=bd2ebc6247d7b810 kind=SourceImported 9d742e1f2c6914a3cb31828d30be87bc5b1f1ad48c13b0a204d6fcd83513ef08
@@ 10 1 1
The existing web renderer solves a narrow problem: let a person inspect a submitted .gram file in a browser without requiring an account or storing a document collection. The API accepts a multipart POST containing source bytes or text, sends it through Core, and returns render data. The `/view` path returns a page. Since a later GET cannot recover an earlier submission, the browser must submit the file again when it asks for another revision. This is a distinct product shape from Vault, which owns identity and storage APIs.
@@ 24 1 1
## The brand checkout is not a second service claim
@@ 26 1 1
`thegram-web-render-brand` contains the same documented API contract and deployment README currently examined for `thegram-web-render`; its README also describes the branded viewer surface. This repository evidence does not establish an independent identity store, separately operating deployment, or different retention model. The existence of a brand-oriented fork is a source-code distinction, not proof of a second public product. Compare actual code, pinned Core and deployment configuration before describing it as an independent service.
@@ 40 1 0
@@ 42 0 1
ref https://github.com/clab-one/thegram-web-render/blob/main/README.md
@@ 43 1 0
@@ 45 0 1
ref https://github.com/clab-one/thegram-web-render/blob/main/docs/api.md
@@ 46 1 0
@@ 48 0 1
ref https://github.com/clab-one/thegram-web-render/blob/main/deploy/README.md
@@ 75 0 1
supports ephemeral
@rev 4 2026-10-12T08:46:16.071Z - req=platform-source-notes-viewer-architecture-20261012 dig=117f3a13a68b4c06 kind=SourceImported 43b9a15d499d78daaaf7a5b09f242d698ba6b1fde5d05e3812c93d2de9a71540
@@ 49 1 1
d Internal source reviewed at revision 254a49d8adb6ccb98675a0511283f511914394c9 (README.md); not publicly available.
@@ 52 1 1
d Internal source reviewed at revision 254a49d8adb6ccb98675a0511283f511914394c9 (docs/api.md); not publicly available.
@@ 55 1 1
d Internal source reviewed at revision 254a49d8adb6ccb98675a0511283f511914394c9 (deploy/README.md); not publicly available.