chore(release): 1.6.0

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -4,10 +4,40 @@
 
 Format based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow SemVer.
 
+## [1.6.0] - 2026-11-04
+
+### Changed
+- Recovery report redesigned. The HTML is now an A4 paginated document (Paged.js embedded, still a single offline file) with a full-bleed deep teal cover where the Guará logo is the hero, a sector-map motif drawn from the findings (one cell per file, colored by confidence), headline numbers, a meta grid and the TLP:AMBER badge, plus a table of contents, running headers and page counters. The PDF gets the same cover (logo embedded as JPEG) and restyled inner pages. All forensic content is unchanged.
+- Documentation brought up to date (ROADMAP version table, platform matrix, version stamps) and rewritten without em dashes. The interface screenshots were retaken from the current build, and `scripts/screenshots.sh` now regenerates them.
+
+## [1.5.0] - 2026-11-03
+
+### Added
+- **Update progress bar.** The in-app update shows a real download percentage bar followed by the verify/install/restart phases.
+- **Delete saved sessions.** Each autosaved session in the sidebar has a delete button, plus a "delete all" button. Settings gained "Delete autosaved sessions after" (never, 7, 30 or 90 days), applied on startup. Sessions open in the app are never removed automatically.
+
+### Fixed
+- **Updating no longer freezes the app.** The update check and install ran on the UI thread; they now run in the background.
+- **Pause and Stop respond right away.** The signature scan only checked for the request once per 8 MiB block; it now checks continuously, and the UI shows "Pausing…" immediately.
+
+## [1.4.0] - 2026-11-03
+
+### Added
+- **Browse by folder.** A Folders view next to grid and list shows what was found one folder at a time, like a file manager: subfolders first with their file count and size, then the files, under a clickable breadcrumb. The sidebar folder tree navigates in this view, and filters still apply.
+- **Recover whole folders or parts of them.** Folders and files are ticked with tri-state boxes that persist while navigating; a ticked folder takes everything inside it, and unticked subfolders or files stay out. Each ticked folder is recreated in the destination from itself down (`Documents/Clients/Project` → `Project/...`), with the usual hash manifest.
+
+## [1.3.5] - 2026-10-31
+
+### Added
+- **One-click desktop update.** The "Update now" button actually downloads, verifies (SHA-256) and installs the new version now, instead of only linking to the Releases page. Works for all three desktop packages: AppImage (atomic self-replace), `.deb` (`dpkg -i`, no new password prompt, the app is already running as root/administrator by the time you click it), and the Windows installer (silent `/S` install). On Linux, the app restarts itself automatically; on Windows, the installer runs silently but the app does not reopen on its own yet, start it again once the install finishes.
+
+### Changed
+- **The repository moved to the Ciberfauna organization** (`ciberfauna/guara`, was `lucasrguerra/guara`). **Important notice for existing installations:** versions up to 1.3.4 have the old location baked into their update check; they will not find this release automatically. Download 1.3.5 once manually from the new Releases page, and future update checks will work through the new location.
+
 ## [1.3.4] - 2026-10-31
 
 ### Fixed
-- **Desktop app: only one window on startup.** The main window used to be visible from launch, so the unprivileged instance's normal window would show, flash while the system asked for the administrator password, and only then get replaced by the elevated relaunch's window a moment later. The window now stays hidden until elevation is resolved — either already elevated, elevation failed (the window then shows the warning), or this is the already-elevated relaunched instance — so only one window ever appears, matching Sabiá.
+- **Desktop app: only one window on startup.** The main window used to be visible from launch, so the unprivileged instance's normal window would show, flash while the system asked for the administrator password, and only then get replaced by the elevated relaunch's window a moment later. The window now stays hidden until elevation is resolved (either already elevated, elevation failed (the window then shows the warning), or this is the already-elevated relaunched instance) so only one window ever appears, matching Sabiá.
 
 ## [1.3.3] - 2026-10-30
 

CHANGELOG.pt-BR.md

@@ -4,10 +4,40 @@
 
 Formato baseado em [Keep a Changelog](https://keepachangelog.com/pt-BR/1.1.0/); versões seguem SemVer.
 
+## [1.6.0] - 2026-11-04
+
+### Alterado
+- Relatório de recuperação redesenhado. O HTML agora é um documento A4 paginado (Paged.js embutido, continua um único arquivo offline) com capa de página inteira em verde-petróleo escuro onde o logo do Guará é o destaque, um mapa de setores desenhado a partir dos achados (uma célula por arquivo, colorida pela confiança), números principais, grade de metadados e o selo TLP:AMBER, além de sumário, cabeçalhos corridos e numeração de páginas. O PDF ganhou a mesma capa (logo embutido como JPEG) e páginas internas com novo visual. Todo o conteúdo forense continua igual.
+- Documentação atualizada (tabela de versões do ROADMAP, matriz de plataformas, versões citadas) e reescrita sem travessões. As capturas de tela da interface foram refeitas a partir da versão atual, e o `scripts/screenshots.sh` agora as regera.
+
+## [1.5.0] - 2026-11-03
+
+### Adicionado
+- **Barra de progresso da atualização.** A atualização dentro do app mostra uma barra com a porcentagem real do download, seguida das fases de verificação, instalação e reinício.
+- **Apagar sessões salvas.** Cada sessão salva sozinha na lateral tem um botão de apagar, além de um botão "apagar todas". As configurações ganharam "Apagar sessões salvas sozinhas após" (nunca, 7, 30 ou 90 dias), aplicado ao abrir. Sessões abertas no app nunca são removidas automaticamente.
+
+### Corrigido
+- **Atualizar não trava mais o app.** A verificação e a instalação rodavam na thread da interface; agora rodam em segundo plano.
+- **Pausar e Parar respondem na hora.** A varredura por assinatura só checava o pedido a cada bloco de 8 MiB; agora checa continuamente, e a interface mostra "Pausando…" imediatamente.
+
+## [1.4.0] - 2026-11-03
+
+### Adicionado
+- **Navegação por pastas.** Uma visualização Pastas, ao lado de grade e lista, mostra o que foi encontrado uma pasta por vez, como num gerenciador de arquivos: primeiro as subpastas, com número de arquivos e tamanho, depois os arquivos, sob um caminho clicável. A árvore de pastas da barra lateral navega nessa visualização, e os filtros continuam valendo.
+- **Recuperar pastas inteiras ou partes delas.** Pastas e arquivos são marcados por caixas de três estados que continuam ao navegar; uma pasta marcada leva tudo o que está dentro dela, e subpastas ou arquivos desmarcados ficam de fora. Cada pasta marcada é recriada no destino a partir dela mesma (`Documentos/Clientes/Projeto` → `Projeto/...`), com o manifesto de hashes de sempre.
+
+## [1.3.5] - 2026-10-31
+
+### Adicionado
+- **Atualização do app desktop em um clique.** O botão "Atualizar agora" agora baixa, confere (SHA-256) e instala a versão nova de verdade, em vez de só linkar pra página de Releases. Funciona nos três pacotes do desktop: AppImage (substituição atômica), `.deb` (`dpkg -i`, sem pedir senha de novo, o app já roda como root/administrador quando você clica), e o instalador do Windows (instalação silenciosa `/S`). No Linux o app reabre sozinho; no Windows o instalador roda silencioso mas o app ainda não reabre por conta própria, abra de novo depois que a instalação terminar.
+
+### Alterado
+- **O repositório se mudou pra organização Ciberfauna** (`ciberfauna/guara`, era `lucasrguerra/guara`). **Aviso importante pra instalações existentes:** versões até a 1.3.4 têm o endereço antigo fixo na checagem de atualização e não vão encontrar esta versão sozinhas. Baixe a 1.3.5 manualmente uma vez na nova página de Releases, e as próximas verificações voltam a funcionar pelo novo endereço.
+
 ## [1.3.4] - 2026-10-31
 
 ### Corrigido
-- **App desktop: só uma janela na abertura.** A janela principal ficava visível desde o lançamento, então a instância sem privilégio mostrava a janela normal, piscava enquanto o sistema pedia a senha de administrador, e só depois era substituída pela janela da instância já elevada. Agora a janela fica escondida até a elevação ser resolvida — já elevada, falhou (a janela aí mostra o aviso), ou é a própria instância já relançada como administrador — então só uma janela aparece, igual ao Sabiá.
+- **App desktop: só uma janela na abertura.** A janela principal ficava visível desde o lançamento, então a instância sem privilégio mostrava a janela normal, piscava enquanto o sistema pedia a senha de administrador, e só depois era substituída pela janela da instância já elevada. Agora a janela fica escondida até a elevação ser resolvida (já elevada, falhou (a janela aí mostra o aviso), ou é a própria instância já relançada como administrador) então só uma janela aparece, igual ao Sabiá.
 
 ## [1.3.3] - 2026-10-30
 

CONTRIBUTING.md

@@ -47,6 +47,8 @@ Create the reader in `crates/guara-core/src/fs/`, register it in `fs/mod.rs` and
 
 The main version is in English and every file has a Portuguese translation (`*.pt-BR.md`, `docs/pt-BR/`). No em dashes or en dashes. When you change a feature, update both versions (English and Portuguese) of [docs/support.md](docs/support.md), the [CHANGELOG](CHANGELOG.md) and, if applicable, the [ROADMAP](ROADMAP.md).
 
+The screenshots in `docs/img` are generated: run `scripts/screenshots.sh` to retake them from the current build (synthetic photo image, real scan). Run it again whenever the interface or the version shown on screen changes.
+
 ## Commits
 
 Commits must follow **Conventional Commits 1.0.0** in English (`feat:`, `fix:`, `chore:`, `ci:`, `docs:`, `refactor:`, `test:`, `perf:`, `build:`), e.g. `fix(ntfs): handle sparse data runs correctly`. One logical change per PR. Enforced automatically by `.githooks/commit-msg`.

CONTRIBUTING.pt-BR.md

@@ -47,6 +47,8 @@ Crie o leitor em `crates/guara-core/src/fs/`, registre-o em `fs/mod.rs` e traga
 
 A versão principal é em inglês e cada arquivo tem uma tradução em português (`*.pt-BR.md`, `docs/pt-BR/`). Sem travessões. Ao mudar um recurso, atualize as duas versões (inglês e português) de [docs/support.md](docs/support.md), do [CHANGELOG](CHANGELOG.md) e, se for o caso, do [ROADMAP](ROADMAP.md).
 
+As capturas de tela em `docs/img` são geradas: rode `scripts/screenshots.sh` para refazê-las a partir da versão atual (imagem de fotos sintética, varredura de verdade). Rode de novo sempre que a interface ou a versão exibida na tela mudar.
+
 ## Commits
 
 Os commits devem seguir **Conventional Commits 1.0.0** em inglês (`feat:`, `fix:`, `chore:`, `ci:`, `docs:`, `refactor:`, `test:`, `perf:`, `build:`), ex.: `fix(ntfs): handle sparse data runs correctly`. Uma mudança lógica por PR. Validado automaticamente por `.githooks/commit-msg`.

Cargo.lock

@@ -416,7 +416,7 @@ dependencies = [
 
 [[package]]
 name = "guara-cli"
-version = "1.3.4"
+version = "1.6.0"
 dependencies = [
  "clap",
  "ctrlc",
@@ -429,7 +429,7 @@ dependencies = [
 
 [[package]]
 name = "guara-core"
-version = "1.3.4"
+version = "1.6.0"
 dependencies = [
  "aes",
  "argon2",

Cargo.toml

@@ -3,10 +3,10 @@ resolver = "2"
 members = ["crates/guara-core", "crates/guara-cli"]
 
 [workspace.package]
-version = "1.3.4"
+version = "1.6.0"
 edition = "2021"
 license = "MIT OR Apache-2.0"
-repository = "https://git.lucasrguerra.dev.br/lucasrguerra/guara"
+repository = "https://git.lucasrguerra.dev.br/ciberfauna/guara"
 authors = ["Guará contributors"]
 rust-version = "1.80"
 

README.md

@@ -38,14 +38,14 @@ Download the package for your system from **[Releases](../../releases)**:
 
 | | CLI | Graphical app |
 |---|---|---|
-| Windows | — | `.msi` / `.exe` installer |
+| Windows | none | `.msi` / `.exe` installer |
 | Linux | `guara-*-linux-{x86_64,aarch64}.tar.gz` | `.AppImage` / `.deb` |
 
 The CLI is Linux-only; the desktop app ships for Linux and Windows. Every CLI
 package has a `.sha256` next to it. To build from source: `cargo build
 --release -p guara-cli` (Rust 1.80+, Linux).
 
-**Updates:** the desktop app checks Gitea on startup; when a new version exists, a notice offers the release link. The CLI updates the same way (`guara update`); it downloads the right binary for your platform, verifies the **SHA-256** and swaps the running executable — no manual download. The check is a single request to the releases API and sends nothing of yours.
+**Updates:** the desktop app checks Gitea on startup; when a new version exists, a notice offers the release link. The CLI updates the same way (`guara update`); it downloads the right binary for your platform, verifies the **SHA-256** and swaps the running executable, no manual download. The check is a single request to the releases API and sends nothing of yours.
 
 > The binaries are **not signed yet**: Windows SmartScreen will warn you. Check the SHA-256.
 
@@ -77,6 +77,10 @@ A desktop app (Tauri) in the style of a file manager, designed for when Guará f
 <p align="center"><img src="docs/img/explorer-dark-en.png" width="640" alt="The explorer in the dark theme"> <img src="docs/img/settings-language-en.png" width="250" alt="Settings with the language selector"></p>
 
 - **Thumbnail grid** or **list**, grouping by day or month and virtual scrolling for tens of thousands of files.
+- **Folder browsing:** open what was found one folder at a time, like a file manager, and recover whole folders or only some subfolders and files, recreated from the ticked folder down.
+
+<p align="center"><img src="docs/img/folders-light-en.png" width="720" alt="The Folders view: the root of the recovered files with DCIM ticked, Viagens partly ticked and the folder details on the right"></p>
+
 - **Sidebar navigation** by type, real photo date (EXIF), folder, camera, confidence and GPS, with an option to hide duplicates.
 - **Finder or Explorer style selection** and full-screen **quick look** (Space, Enter or double click).
 - **Details panel** with preview, dates and metadata.
@@ -91,7 +95,7 @@ A desktop app (Tauri) in the style of a file manager, designed for when Guará f
 - **Timeline:** creation, modification and access dates from NTFS, FAT and exFAT.
 - **Text search across the whole disk**, including free space, in UTF-8 and UTF-16.
 - **CSV** (opens in Excel) and a printable **HTML report** with case, examiner, source, partitions, summary and hashes.
-- **Automatic sessions** and reconnection: Guará recognizes the same disk coming back under another name.
+- **Automatic sessions** and reconnection: Guará recognizes the same disk coming back under another name. Saved sessions can be deleted one by one or by age.
 - **Duplicate detection** by content signature.
 
 > **Warning:** Guará has **not been externally validated** yet (for example, in the NIST CFTT tests) and has no trusted timestamp (RFC 3161) on its signatures. It is well suited to recovery and triage; for use in court, check the results by other means. The path to get there is in the [ROADMAP](ROADMAP.md).
@@ -116,7 +120,7 @@ Summary of the [ROADMAP](ROADMAP.md):
 |---|---|
 | **Done** | Metadata from 8 file systems, BitLocker, LUKS, FileVault 2, RAID, LVM, E01, Ex01, AFF4, fragmented JPEG, MP4 without an index, SQLite reader, SMART, QCOW2/VMDK/VHD/VHDX/DMG, hash-chained audit trail, PDF report, Ed25519 signatures, APFS free map |
 | **Next** | Trusted timestamps (RFC 3161), more tests on Windows |
-| **Not planned** | A macOS build — see [Known limits](#known-limits) |
+| **Not planned** | A macOS build, see [Known limits](#known-limits) |
 | **Later** | NSRL and hash lists, content search, unified timeline, browser interpretation, Windows registry and messaging apps, dictionary and brute-force attacks on encrypted volumes |
 | **No reference image** | ReFS and Storage Spaces: they only land with validation |
 | **Long term** | iOS and Android backups (iTunes, ADB), OCR, NIST CFTT validation, physical phone access through bootloader/chip exploits |

README.pt-BR.md

@@ -38,14 +38,14 @@ Baixe o pacote do seu sistema em **[Releases](../../releases)**:
 
 | | CLI | App gráfico |
 |---|---|---|
-| Windows | — | instalador `.msi` / `.exe` |
+| Windows | nenhum | instalador `.msi` / `.exe` |
 | Linux | `guara-*-linux-{x86_64,aarch64}.tar.gz` | `.AppImage` / `.deb` |
 
 O CLI é só para Linux; o app desktop sai para Linux e Windows. Cada pacote do
 CLI tem um `.sha256` ao lado. Compilar do código: `cargo build --release -p
 guara-cli` (Rust 1.80+, Linux).
 
-**Atualizações:** o app desktop consulta o Gitea ao abrir; havendo versão nova, um aviso oferece o link da release. O CLI atualiza do mesmo jeito (`guara update`); ele baixa o binário certo para a plataforma, confere o **SHA-256** e troca o executável em uso — você não precisa baixar nada na mão. A consulta é uma única requisição à API de releases e nada seu é enviado.
+**Atualizações:** o app desktop consulta o Gitea ao abrir; havendo versão nova, um aviso oferece o link da release. O CLI atualiza do mesmo jeito (`guara update`); ele baixa o binário certo para a plataforma, confere o **SHA-256** e troca o executável em uso, você não precisa baixar nada na mão. A consulta é uma única requisição à API de releases e nada seu é enviado.
 
 > Os binários ainda **não são assinados**: o Windows SmartScreen vai avisar. Confira o SHA-256.
 
@@ -77,6 +77,10 @@ App desktop (Tauri) no estilo de um gerenciador de arquivos, pensado para quando
 <p align="center"><img src="docs/img/explorer-dark-pt.png" width="640" alt="O explorador no tema escuro"> <img src="docs/img/settings-language-pt.png" width="250" alt="Configurações com o seletor de idioma"></p>
 
 - **Grade de miniaturas** ou **lista**, agrupamento por dia ou mês e rolagem virtual para dezenas de milhares de arquivos.
+- **Navegação por pastas:** abra o que foi encontrado uma pasta por vez, como num gerenciador de arquivos, e recupere pastas inteiras ou só algumas subpastas e arquivos, recriados a partir da pasta marcada.
+
+<p align="center"><img src="docs/img/folders-light-pt.png" width="720" alt="A visualização Pastas: a raiz dos arquivos encontrados com DCIM marcada, Viagens parcialmente marcada e os detalhes da pasta à direita"></p>
+
 - **Navegação lateral** por tipo, data real da foto (EXIF), pasta, câmera, confiança e GPS, com opção de ocultar duplicadas.
 - **Seleção como no Finder ou Explorer** e **visualização rápida** em tela cheia (Espaço, Enter ou duplo clique).
 - **Painel de detalhes** com pré-visualização, datas e metadados.
@@ -91,7 +95,7 @@ App desktop (Tauri) no estilo de um gerenciador de arquivos, pensado para quando
 - **Linha do tempo:** datas de criação, modificação e acesso do NTFS, FAT e exFAT.
 - **Busca de texto no disco inteiro**, inclusive espaço livre, em UTF-8 e UTF-16.
 - **CSV** (abre no Excel) e **relatório HTML** imprimível com caso, examinador, origem, partições, resumo e hashes.
-- **Sessões automáticas** e reconexão: o Guará reconhece o mesmo disco que volta com outro nome.
+- **Sessões automáticas** e reconexão: o Guará reconhece o mesmo disco que volta com outro nome. As sessões salvas podem ser apagadas uma a uma ou por idade.
 - **Detecção de duplicadas** por assinatura de conteúdo.
 
 > **Atenção:** o Guará ainda **não foi validado externamente** (por exemplo, nos testes do NIST CFTT) e suas assinaturas não têm carimbo de tempo de terceiros (RFC 3161). Serve bem para recuperação e triagem; para uso em juízo, confira os resultados por outro meio. O caminho para isso está no [ROADMAP](ROADMAP.pt-BR.md).
@@ -116,7 +120,7 @@ Resumo do [ROADMAP](ROADMAP.pt-BR.md):
 |---|---|
 | **Feito** | Metadados de 8 sistemas de arquivos, BitLocker, LUKS, FileVault 2, RAID, LVM, E01, Ex01, AFF4, JPEG fragmentado, MP4 sem índice, leitor de SQLite, SMART, QCOW2/VMDK/VHD/VHDX/DMG, trilha de auditoria encadeada por hash, relatório em PDF, assinaturas Ed25519, mapa livre do APFS |
 | **Próximo** | Carimbo de tempo de terceiros (RFC 3161), mais testes em Windows |
-| **Fora de plano** | Um build para macOS — veja [Limites conhecidos](#limites-conhecidos) |
+| **Fora de plano** | Um build para macOS, veja [Limites conhecidos](#limites-conhecidos) |
 | **Depois** | NSRL e listas de hashes, busca em conteúdo, linha do tempo unificada, interpretação de navegadores, registro do Windows e apps de mensagem, ataque de dicionário e força bruta a volumes cifrados |
 | **Sem imagem de referência** | ReFS e Storage Spaces: só entram com validação |
 | **Longo prazo** | Backups de iOS e Android (iTunes, ADB), OCR, validação NIST CFTT, acesso físico a celulares por exploit de bootloader/chip |

ROADMAP.md

@@ -8,7 +8,7 @@ Legend: ✅ done · 🟡 partial · 🔜 planned · 🔭 long-term idea · ⛔ o
 
 > Items marked done for macOS reflect what the GitHub CI used to build and test,
 > before the move to Gitea. The Gitea CI has one Linux runner; it builds and
-> tests Linux and Windows. macOS is not built or tested any more — see the
+> tests Linux and Windows. macOS is not built or tested any more, see the
 > README's [Known limits](README.md#known-limits).
 
 ## Principles that do not change
@@ -34,10 +34,16 @@ Legend: ✅ done · 🟡 partial · 🔜 planned · 🔭 long-term idea · ⛔ o
 | 1.2.0 | 2026-10-22 | QCOW2, VMDK, VHD, VHDX and DMG virtual disks, hash-chained audit trail, PDF report, APFS free-space map |
 | 1.3.0 | 2026-10-23 | Update from inside the app, Ed25519 signatures, differencing QCOW2/VMDK and LZFSE DMG, reference images tested on Linux, macOS and Windows, XFS real-deletion test |
 | 1.3.1 | 2026-10-23 | New official logo |
+| 1.3.2 | 2026-10-30 | Updates come from Gitea |
+| 1.3.3 | 2026-10-30 | New update mechanism (same model as Sabiá), `guara update` for the CLI |
+| 1.3.4 | 2026-10-31 | Desktop app opens a single window at startup |
+| 1.3.5 | 2026-10-31 | One-click desktop update, repository moved to the Ciberfauna organization |
+| 1.4.0 | 2026-11-03 | Browse by folder, recover whole folders or parts of them |
+| 1.5.0 | 2026-11-03 | Update progress bar and no more freezing, instant Pause/Stop, delete saved sessions manually or by age |
 
 Details of each version in the [CHANGELOG](CHANGELOG.md).
 
-## Current status (1.3.1) against what is expected from a forensic suite
+## Current status (1.5.0) against what is expected from a forensic suite
 
 ### 1. File systems with metadata
 

ROADMAP.pt-BR.md

@@ -8,7 +8,7 @@ Legenda: ✅ feito · 🟡 parcial · 🔜 planejado · 🔭 ideia a longo prazo
 
 > Itens marcados como feitos para macOS refletem o que o CI do GitHub compilava e
 > testava, antes da mudança para o Gitea. O CI do Gitea tem um único runner Linux;
-> ele compila e testa Linux e Windows. O macOS deixou de ser compilado e testado —
+> ele compila e testa Linux e Windows. O macOS deixou de ser compilado e testado,
 > veja os [Limites conhecidos](README.pt-BR.md#limites-conhecidos) do README.
 
 ## Princípios que não mudam
@@ -34,10 +34,16 @@ Legenda: ✅ feito · 🟡 parcial · 🔜 planejado · 🔭 ideia a longo prazo
 | 1.2.0 | 2026-10-22 | Discos virtuais QCOW2, VMDK, VHD, VHDX e DMG, trilha de auditoria encadeada por hash, relatório em PDF, mapa de espaço livre do APFS |
 | 1.3.0 | 2026-10-23 | Atualização pelo próprio app, assinaturas Ed25519, QCOW2/VMDK diferenciais e DMG com LZFSE, imagens de referência testadas em Linux, macOS e Windows, teste de exclusão real do XFS |
 | 1.3.1 | 2026-10-23 | Nova logo oficial |
+| 1.3.2 | 2026-10-30 | As atualizações passam a vir do Gitea |
+| 1.3.3 | 2026-10-30 | Novo mecanismo de atualização (mesmo modelo do Sabiá), `guara update` no CLI |
+| 1.3.4 | 2026-10-31 | O app desktop abre uma única janela ao iniciar |
+| 1.3.5 | 2026-10-31 | Atualização do app desktop em um clique, repositório movido para a organização Ciberfauna |
+| 1.4.0 | 2026-11-03 | Navegação por pastas, recuperação de pastas inteiras ou de partes delas |
+| 1.5.0 | 2026-11-03 | Barra de progresso da atualização sem travar o app, Pausar/Parar imediatos, apagar sessões salvas à mão ou por idade |
 
 Detalhes de cada versão no [CHANGELOG](CHANGELOG.pt-BR.md).
 
-## Situação atual (1.3.1) contra o que se espera de uma suíte forense
+## Situação atual (1.5.0) contra o que se espera de uma suíte forense
 
 ### 1. Sistemas de arquivos com metadados
 

apps/gui/src-tauri/Cargo.lock

@@ -1342,7 +1342,7 @@ dependencies = [
 
 [[package]]
 name = "guara-core"
-version = "1.3.4"
+version = "1.6.0"
 dependencies = [
  "aes",
  "argon2",
@@ -1373,7 +1373,7 @@ dependencies = [
 
 [[package]]
 name = "guara-gui"
-version = "1.3.4"
+version = "1.6.0"
 dependencies = [
  "guara-core",
  "libc",

apps/gui/src-tauri/Cargo.toml

@@ -3,11 +3,11 @@
 [package]
 name = "guara-gui"
 description = "Guará: graphical file recovery interface"
-version = "1.3.4"
+version = "1.6.0"
 edition = "2021"
 license = "MIT OR Apache-2.0"
 authors = ["Guará contributors"]
-repository = "https://git.lucasrguerra.dev.br/lucasrguerra/guara"
+repository = "https://git.lucasrguerra.dev.br/ciberfauna/guara"
 rust-version = "1.80"
 
 [workspace]

apps/gui/src-tauri/src/main.rs

@@ -22,14 +22,41 @@ async fn rpc(
 }
 
 #[tauri::command]
-fn update_check(state: tauri::State<'_, State>) -> Result<serde_json::Value, String> {
+async fn update_check(state: tauri::State<'_, State>) -> Result<serde_json::Value, String> {
-    let status = state.0.update_check().map_err(|e| e.to_string())?;
+    let eng = state.0.clone();
+    tauri::async_runtime::spawn_blocking(move || {
+        let status = eng.update_check().map_err(|e| e.to_string())?;
         serde_json::to_value(status).map_err(|e| e.to_string())
+    })
+    .await
+    .map_err(|e| e.to_string())?
 }
 
 #[tauri::command]
-fn update_apply(state: tauri::State<'_, State>) -> Result<String, String> {
+async fn update_apply(app: tauri::AppHandle, state: tauri::State<'_, State>) -> Result<String, String> {
-    state.0.update_apply().map_err(|e| e.to_string())
+    use tauri::Emitter;
+    #[cfg(any(target_os = "linux", target_os = "macos"))]
+    let exe = elevated_exe().unwrap_or_else(|_| std::env::current_exe().unwrap_or_default());
+    #[cfg(not(any(target_os = "linux", target_os = "macos")))]
+    let exe = std::env::current_exe().unwrap_or_default();
+
+    // Blocking download/install must not run on the UI thread, or the window freezes.
+    let eng = state.0.clone();
+    tauri::async_runtime::spawn_blocking(move || {
+        eng.update_apply_desktop(&exe, move |phase| {
+            let (name, pct) = match phase.split_once(':') {
+                Some((n, p)) => (n, p.parse::<u8>().ok()),
+                None => (phase, None),
+            };
+            let _ = app.emit(
+                "update-progress",
+                serde_json::json!({ "phase": name, "percent": pct }),
+            );
+        })
+        .map_err(|e| e.to_string())
+    })
+    .await
+    .map_err(|e| e.to_string())?
 }
 
 /// `true` when the process already has sufficient privileges to read raw disks.

apps/gui/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Guará",
-  "version": "1.3.4",
+  "version": "1.6.0",
   "identifier": "dev.guara.app",
   "build": {
     "frontendDist": "../ui"

apps/gui/ui/app.css

@@ -422,6 +422,21 @@ dialog.lightbox[open] { display: grid; }
 .xp-insp .viewer { max-height: 38vh; min-height: 150px; }
 .xp-ititle { display: flex; gap: 8px; align-items: flex-start; justify-content: space-between; } .xp-ititle b { overflow-wrap: anywhere; font-size: 15px; }
 .xp-meta h5 { margin: 6px 0 6px; font-size: 12px; color: var(--text-3); font-weight: 600; }
+/* folder browsing */
+.xp-path { display: flex; align-items: center; gap: 2px; min-width: 0; overflow: hidden; }
+.xp-cpart { border: 0; background: none; color: var(--text-2); font: inherit; font-size: 14px; padding: 4px 6px; border-radius: 6px; cursor: pointer; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; max-width: 220px; }
+.xp-cpart:hover { background: var(--surface-2); color: var(--text); }
+.xp-cpart:last-child { color: var(--text); font-weight: 600; }
+.xp-csep { color: var(--text-3); }
+.xp-lth .xp-fico { color: var(--accent); background: var(--accent-soft); border-radius: 8px; }
+.xp-dir .xp-lnm b { font-weight: 600; }
+.xp-dir[data-state="mixed"] .xp-chk { opacity: 1; background: var(--accent) url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='none' stroke='white' stroke-width='3.2' stroke-linecap='round'%3E%3Cpath d='M7 12h10'/%3E%3C/svg%3E") center / 14px no-repeat; }
+.xp-lrow[data-cur="1"] { box-shadow: inset 0 0 0 2px var(--accent); }
+.xp-folder-insp { display: grid; gap: 14px; padding: 20px 4px; }
+.xp-folder-insp h3 { margin: 0; font-size: 18px; overflow-wrap: anywhere; }
+.xp-fbig { width: 64px; height: 64px; display: grid; place-items: center; border-radius: 16px; color: var(--accent); background: var(--accent-soft); }
+.xp-fbig svg { width: 34px; height: 34px; }
+.xp-folder-insp .row { display: flex; gap: 8px; flex-wrap: wrap; }
 .xp-multi { display: grid; gap: 12px; padding: 20px 4px; text-align: center; } .xp-multi b { font-size: 18px; }
 .xp-insp-x { display: none; align-self: flex-end; }
 .xp-veil { display: none; }
@@ -527,3 +542,8 @@ dialog.lightbox[open] { display: grid; }
 .update-card .upd-actions { display: flex; gap: 8px; flex-wrap: wrap; }
 .update-card .sub { margin: 0; }
 pre.upd-notes { max-height: 50vh; overflow: auto; white-space: pre-wrap; font-size: 13px; }
+.update-card .upd-bar { margin-top: 10px; }
+
+.list li.has-del { position: relative; }
+.list li.has-del .del { position: absolute; right: 6px; top: 50%; transform: translateY(-50%); opacity: 0; }
+.list li.has-del:hover .del, .list li.has-del .del:focus-visible { opacity: 1; }

apps/gui/ui/app.js

@@ -53,7 +53,7 @@ document.querySelectorAll('[data-theme-pick]').forEach((b) => (b.onclick = async
 
 // ------------------------------------------------------------------ settings
 // (declared before use: `S` is defined further below, so the object lives here)
-const SETTINGS = { theme: 'auto', lang: 'auto', ui_lang: null, notify: true, maps: false, updates: true };
+const SETTINGS = { theme: 'auto', lang: 'auto', ui_lang: null, notify: true, maps: false, updates: true, session_retention_days: 0 };
 async function saveSettings(patch) {
   Object.assign(SETTINGS, patch);
   try { await rpc('settings_set', SETTINGS); } catch { /* continue with local storage only */ }
@@ -201,11 +201,36 @@ function renderSide() {
   const rl = $('#recentList');
   rl.dataset.empty = 'Nada salvo ainda';
   rl.innerHTML = (S.recent || []).map((r, i) => `
-    <li><button class="dev" data-r="${i}" title="${esc(r.path)}"><span class="ico">${icon('default')}</span>
+    <li class="has-del"><button class="dev" data-r="${i}" title="${esc(r.path)}"><span class="ico">${icon('default')}</span>
-      <span><span class="t">${esc((r.target || '').split(/[\\/]/).pop() || 'Sessão')}</span><span class="s">${r.found.toLocaleString(LOC())} arquivos · ${esc(r.status)} · ${new Date(r.saved_at * 1000).toLocaleString(LOC(), { dateStyle: 'short', timeStyle: 'short' })}</span></span></button></li>`).join('');
+      <span><span class="t">${esc((r.target || '').split(/[\\/]/).pop() || 'Sessão')}</span><span class="s">${r.found.toLocaleString(LOC())} arquivos · ${esc(r.status)} · ${new Date(r.saved_at * 1000).toLocaleString(LOC(), { dateStyle: 'short', timeStyle: 'short' })}</span></span></button><button class="icon-btn small del" data-del="${i}" title="Apagar esta sessão" aria-label="Apagar esta sessão"><svg viewBox="0 0 24 24" width="14" height="14"><path d="M6 6l12 12M18 6L6 18" stroke="currentColor" stroke-width="2" fill="none" stroke-linecap="round"/></svg></button></li>`).join('');
   rl.querySelectorAll('.dev').forEach((b) => (b.onclick = () => openRecent(S.recent[+b.dataset.r])));
+  rl.querySelectorAll('.del').forEach((b) => (b.onclick = (e) => { e.stopPropagation(); deleteRecent(S.recent[+b.dataset.del]); }));
 }
 
+function confirmDlg({ title, text, ok }) {
+  return new Promise((resolve) => {
+    const d = $('#dlg');
+    d.innerHTML = `<form method="dialog"><h2>${esc(title)}</h2><p>${text}</p><menu><button class="btn" value="cancel">Cancelar</button><button class="btn danger" value="ok">${esc(ok)}</button></menu></form>`;
+    d.onclose = () => resolve(d.returnValue === 'ok');
+    d.showModal();
+  });
+}
+
+async function deleteRecent(r) {
+  if (!r) return;
+  const name = (r.target || '').split(/[\\/]/).pop() || 'Sessão';
+  if (!await confirmDlg({ title: 'Apagar sessão salva', text: `A sessão de <code>${esc(name)}</code> será apagada de vez. Os arquivos do disco não são afetados.`, ok: 'Apagar' })) return;
+  try { await rpc('session_delete', { path: r.path }); toast('Sessão apagada'); } catch (e) { toast(e.message); }
+  loadRecent();
+}
+
+$('#clearRecentBtn')?.addEventListener('click', async () => {
+  if (!(S.recent || []).length) { toast('Nada para apagar'); return; }
+  if (!await confirmDlg({ title: 'Apagar todas as sessões salvas', text: 'Todas as sessões salvas sozinhas serão apagadas de vez. Sessões abertas agora são mantidas.', ok: 'Apagar tudo' })) return;
+  try { const r = await rpc('sessions_prune', { all: true }); toast(`Sessões apagadas: ${r.removed}`); } catch (e) { toast(e.message); }
+  loadRecent();
+});
+
 async function loadRecent() {
   try { S.recent = await rpc('sessions_list'); } catch { S.recent = []; }
   renderSide();
@@ -590,7 +615,9 @@ function paintStatus() {
   const rate = p.total && st.elapsed > 1 && p.done ? p.done / st.elapsed : 0;
   const eta = rate && running ? dur((p.total - p.done) / rate) : null;
   const enr = st.enriching ? `<span class="sub">Lendo datas e metadados das fotos… ${st.enriching.done.toLocaleString(LOC())}/${st.enriching.total.toLocaleString(LOC())}</span>` : '';
-  const buttons = running ? '<button class="btn sm" data-act="pause">Pausar</button><button class="btn sm danger" data-act="stop">Parar</button>'
+  const stopping = running && st.stopping;
+  const buttons = stopping ? '<button class="btn sm" disabled>Pausando…</button>'
+    : running ? '<button class="btn sm" data-act="pause">Pausar</button><button class="btn sm danger" data-act="stop">Parar</button>'
     : st.status === 'paused' ? `<button class="btn sm primary" data-act="${st.source === false ? 'reconnect' : 'resume'}">${st.source === false ? 'Reconectar o disco' : 'Continuar'}</button><button class="btn sm" data-act="relink">Escolher a origem…</button>` : '';
   const relink = st.source === false ? '<button class="btn sm primary" data-act="relink">Escolher a origem…</button>' : '';
   const tools = relink + (!running && st.found ? '<button class="btn sm" data-act="csv">Exportar CSV</button><button class="btn sm" data-act="report">Relatório</button><button class="btn sm" data-act="save">Salvar sessão…</button>' : '');
@@ -651,8 +678,8 @@ async function chooseSource() {
 async function onProgressClick(e) {
   const act = e.target.closest('[data-act]')?.dataset.act;
   if (!act) return;
-  if (act === 'pause') { await rpc('scan_pause', { job: S.job }); toast('Pausando…'); }
+  if (act === 'pause') { await rpc('scan_pause', { job: S.job }); toast('Pausando…'); tick(); }
-  else if (act === 'stop') await rpc('scan_stop', { job: S.job });
+  else if (act === 'stop') { await rpc('scan_stop', { job: S.job }); tick(); }
   else if (act === 'resume') {
     try { await rpc('scan_resume', { job: S.job }); stopPoll(); S.poll = setInterval(tick, 500); tick(); }
     catch (err) { toast(err.message); chooseSource(); }
@@ -687,19 +714,25 @@ async function onProgressClick(e) {
 }
 
 async function recover(sel) {
+  // From folder browsing: each marked folder is recreated from itself down
+  // (a/b/Projeto -> Projeto/...), so there is no layout to choose.
+  const bySelection = !!sel.selection;
   const f = await askForm({
     title: 'Recuperar para…',
-    text: 'Escolha uma pasta em <b>outro disco</b>. O Guará nunca grava no disco de origem, para não sobrescrever o que ainda dá para salvar. <span class="sub">Se a recuperação for interrompida, escolha a mesma pasta de novo: o Guará pula o que já foi conferido.</span>',
+    text: 'Escolha uma pasta em <b>outro disco</b>. O Guará nunca grava no disco de origem, para não sobrescrever o que ainda dá para salvar. <span class="sub">Se a recuperação for interrompida, escolha a mesma pasta de novo: o Guará pula o que já foi conferido.</span>'
+      + (bySelection ? ' <span class="sub">Cada pasta marcada é recriada no destino a partir dela mesma, com todas as subpastas. Arquivos marcados soltos vão para a raiz do destino.</span>' : '')
+      + (bySelection && sel.filtered ? ' <span class="sub"><b>Atenção:</b> pastas marcadas são recuperadas inteiras; os filtros ativos não se aplicam a elas.</span>' : ''),
     ok: 'Recuperar',
     fields: [
       { name: 'dest', label: 'Pasta de destino', value: (S.defaults.home || '') + (S.defaults.sep || '/') + 'Guara-Recuperados', pick: { directory: true, multiple: false } },
-      { name: 'layout', label: 'Organizar os arquivos', value: 'folders', options: [['folders', 'Pastas originais (e por tipo quando não há pasta)'], ['type', 'Por tipo (Fotos, Documentos, Vídeos...)'], ['date', 'Por data (ano e mês)'], ['flat', 'Tudo na mesma pasta']] },
+      ...(bySelection ? [] : [{ name: 'layout', label: 'Organizar os arquivos', value: 'folders', options: [['folders', 'Pastas originais (e por tipo quando não há pasta)'], ['type', 'Por tipo (Fotos, Documentos, Vídeos...)'], ['date', 'Por data (ano e mês)'], ['flat', 'Tudo na mesma pasta']] }]),
     ],
   });
   if (!f || !f.dest) return;
   const dest = f.dest;
+  const { filtered, ...target } = sel;
   try {
-    const { job } = await rpc('recover_start', { job: S.job, dest, layout: f.layout, ...sel });
+    const { job } = await rpc('recover_start', { job: S.job, dest, layout: f.layout || 'folders', ...target });
     watchAux(job, 'Recuperando arquivos', (st) => {
       const r = st.report || {};
       const ok = (r.recovered || []).length, bad = (r.failed || []).length;
@@ -747,17 +780,23 @@ $('#settingsBtn')?.addEventListener('click', () => {
     <label class="fld"><span>Idioma</span><select class="select" name="lang"><option value="auto">Auto</option><option value="pt">Português</option><option value="en">English</option></select></label>
     <label class="check"><input type="checkbox" name="notify" ${SETTINGS.notify ? 'checked' : ''}><span><b>Notificações</b><br><span class="sub">Avisar quando uma tarefa longa terminar</span></span></label>
     <label class="check"><input type="checkbox" name="maps" ${SETTINGS.maps ? 'checked' : ''}><span><b>Mapas online</b><br><span class="sub">Mostrar mapas das fotos com GPS (usa a internet: baixa blocos do OpenStreetMap)</span></span></label>
+    <label class="fld"><span>Apagar sessões salvas sozinhas após</span><select class="select" name="retention"><option value="0">Nunca</option><option value="7">7 dias</option><option value="30">30 dias</option><option value="90">90 dias</option></select></label>
     ${tauri?.core?.invoke ? `<label class="check"><input type="checkbox" name="updates" ${SETTINGS.updates ? 'checked' : ''}><span><b>Atualizações automáticas</b><br><span class="sub">Ao abrir, consulta o Gitea para ver se há versão nova (uma consulta, sem enviar dados seus)</span><br><button type="button" class="btn sm" id="updNow">Verificar agora</button></span></label>` : ''}
     <menu><button class="btn" value="cancel">Cancelar</button><button class="btn primary" value="ok">Salvar</button></menu></form>`;
   d.querySelector('[name=lang]').value = SETTINGS.lang;
-  d.querySelector('#updNow')?.addEventListener('click', (e) => { e.preventDefault(); checkUpdate(true); });
+  d.querySelector('[name=retention]').value = String([0, 7, 30, 90].includes(SETTINGS.session_retention_days) ? SETTINGS.session_retention_days : 0);
+  d.querySelector('#updNow')?.addEventListener('click', (e) => {
+    e.preventDefault();
+    if (UPD) applyUpdate();
+    else checkUpdate(true);
+  });
   d.onclose = () => {
     if (d.returnValue !== 'ok') return;
-    const patch = { lang: d.querySelector('[name=lang]').value, notify: d.querySelector('[name=notify]').checked, maps: d.querySelector('[name=maps]').checked };
+    const patch = { lang: d.querySelector('[name=lang]').value, notify: d.querySelector('[name=notify]').checked, maps: d.querySelector('[name=maps]').checked, session_retention_days: +d.querySelector('[name=retention]').value };
     if (d.querySelector('[name=updates]')) patch.updates = d.querySelector('[name=updates]').checked;
     setLang(patch.lang);
     patch.ui_lang = currentLang();
-    saveSettings(patch);
+    saveSettings(patch).then(() => rpc('sessions_prune', {}).then(loadRecent).catch(() => {}));
     EX?.relang?.();
     toast('Salvo');
   };
@@ -768,6 +807,54 @@ $('#settingsBtn')?.addEventListener('click', () => {
 // The desktop shell (Tauri) queries Gitea Releases API and notifies the user.
 // No-op in browser mode (`guara ui`).
 let UPD = null;
+let updating = false;
+
+async function applyUpdate() {
+  if (updating || !tauri?.core?.invoke) return;
+  updating = true;
+  const updApply = $('#updApply');
+  const updNow = $('#updNow');
+  const setPhase = (txt, pct) => {
+    const card = $('#updateCard');
+    if (card) {
+      let bar = card.querySelector('.upd-bar');
+      if (!bar) { bar = document.createElement('div'); bar.className = 'bar upd-bar'; bar.innerHTML = '<i></i>'; card.appendChild(bar); }
+      bar.classList.toggle('indet', pct == null);
+      bar.firstChild.style.width = pct == null ? '35%' : `${pct}%`;
+    }
+    if (pct != null) txt = `${txt} ${pct}%`;
+    if (updApply) { updApply.disabled = true; updApply.textContent = txt; }
+    if (updNow) { updNow.disabled = true; updNow.textContent = txt; }
+  };
+  setPhase('Baixando a atualização…');
+
+  let unlisten = null;
+  if (tauri?.event?.listen) {
+    try {
+      unlisten = await tauri.event.listen('update-progress', (event) => {
+        const phase = event.payload?.phase;
+        const pct = event.payload?.percent;
+        if (phase === 'downloading') setPhase('Baixando a atualização…', pct);
+        else if (phase === 'verifying') setPhase('Verificando integridade…');
+        else if (phase === 'installing') setPhase('Instalando a atualização…');
+        else if (phase === 'restarting') setPhase('Reiniciando…');
+      });
+    } catch (_) {}
+  }
+
+  try {
+    await tauri.core.invoke('update_apply');
+    setPhase('Atualização concluída');
+  } catch (e) {
+    updating = false;
+    $('#updateCard .upd-bar')?.remove();
+    if (updApply) { updApply.disabled = false; updApply.textContent = 'Atualizar agora'; }
+    if (updNow) { updNow.disabled = false; updNow.textContent = UPD?.version ? `atualizar para ${UPD.version}` : 'Verificar agora'; }
+    toast(`Falha na atualização: ${e}`);
+  } finally {
+    if (unlisten) unlisten();
+  }
+}
 
 async function checkUpdate(manual) {
   if (!tauri?.core?.invoke) return;
@@ -801,11 +888,13 @@ function renderUpdateCard() {
   if (!UPD) { el?.remove(); return; }
   if (!el) { el = document.createElement('div'); el.id = 'updateCard'; el.className = 'update-card'; el.setAttribute('role', 'status'); document.body.appendChild(el); }
   el.innerHTML = `<div class="upd-head"><b>Nova versão do Guará disponível</b><span class="mono upd-ver">v${esc(UPD.current)} → v${esc(UPD.version)}</span></div>
-    <p class="sub">Esta instalação vem de um pacote do sistema e não se atualiza sozinha. Baixe a versão nova na página da release:</p><p class="mono upd-url">${esc(UPD.url)}</p>
+    <p class="sub">Instalação automática da nova versão com um clique:</p>
     <div class="upd-actions">
+      <button class="btn primary sm" id="updApply">Atualizar agora</button>
       <button class="btn sm" id="updLater">Depois</button>
     </div>`;
   $('#updLater')?.addEventListener('click', () => { UPD = null; el.remove(); });
+  $('#updApply')?.addEventListener('click', () => applyUpdate());
 }
 
 // ------------------------------------------------------------------ close while scan is running
@@ -864,6 +953,7 @@ function watchClose() {
     return;
   }
   await loadDevices();
+  try { await rpc('sessions_prune', {}); } catch { /* retention is best-effort */ }
   await loadRecent();
   renderHome();
 })();

apps/gui/ui/explorer.js

@@ -4,7 +4,7 @@
 // fullscreen quick look.
 
 import { renderPreview, kindOf, KIND_LABEL } from './preview.js';
-import { LOC } from './i18n.js';
+import { LOC, tr } from './i18n.js';
 
 const CAT = {
   image: ['Fotos', '🖼'], document: ['Documentos', '📄'], video: ['Vídeos', '🎞'], audio: ['Áudio', '🎵'],
@@ -28,6 +28,8 @@ const I = {
   pin: svg('<path d="M12 21s-6-5.3-6-10a6 6 0 1 1 12 0c0 4.7-6 10-6 10z"/><circle cx="12" cy="11" r="2"/>', 14),
   warn: svg('<path d="M12 3l10 18H2z"/><path d="M12 10v5M12 18v.01"/>', 22),
   close: svg('<path d="M6 6l12 12M18 6L6 18"/>', 20),
+  folder: svg('<path d="M3 7a2 2 0 0 1 2-2h4l2 2h8a2 2 0 0 1 2 2v8a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/>'),
+  folderBig: svg('<path d="M3 7a2 2 0 0 1 2-2h4l2 2h8a2 2 0 0 1 2 2v8a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z"/>', 22),
 };
 
 export function createExplorer(deps) {
@@ -62,6 +64,14 @@ export function createExplorer(deps) {
     lastFound: -1,
     wasEnriching: false,
     status: null,
+    // folder browsing: current folder ('' = root, '@carved' = found by
+    // signature), its subfolders, and a selection of its own that keeps
+    // marked and unmarked folders and files across levels
+    path: '',
+    dirs: [],
+    curDir: null,
+    fs: { folders: new Set(), xfolders: new Set(), files: new Map(), xfiles: new Map() },
+    fsCount: null,
   };
   try {
     E.view = localStorage.getItem('guara-view') || 'grid';
@@ -74,7 +84,7 @@ export function createExplorer(deps) {
       <div class="xp-crumb" id="xpCrumb"></div>
       <input class="input xp-q" id="xpQ" type="search" placeholder="Buscar por nome, pasta ou câmera" aria-label="Buscar">
       <select class="select" id="xpSort" aria-label="Ordenar">${SORTS.map(([k, n]) => `<option value="${k}">${n}</option>`).join('')}</select>
-      <div class="theme-switch" role="group" aria-label="Modo de exibição"><button data-view="grid" aria-label="Grade" title="Grade de miniaturas">${I.grid}</button><button data-view="list" aria-label="Lista" title="Lista">${I.list}</button></div>
+      <div class="theme-switch" role="group" aria-label="Modo de exibição"><button data-view="grid" aria-label="Grade" title="Grade de miniaturas">${I.grid}</button><button data-view="list" aria-label="Lista" title="Lista">${I.list}</button><button data-view="folders" aria-label="Pastas" title="Navegar pelas pastas">${I.folder}</button></div>
       <input type="range" id="xpSize" min="100" max="300" step="4" aria-label="Tamanho das miniaturas">
     </div>
     <aside class="xp-nav" id="xpNav" aria-label="Navegação"></aside>
@@ -112,7 +122,10 @@ export function createExplorer(deps) {
   };
   const anyFilter = () => Object.entries(E.filters).some(([k, v]) => (k === 'query' ? !!v : !!v));
 
+  const folderMode = () => E.view === 'folders';
+
   async function reload() {
+    if (folderMode()) return reloadFolder();
     const token = ++E.reloadToken;
     E.lastReload = Date.now();
     const base = { ...toQuery(), sort: E.sort };
@@ -132,6 +145,29 @@ export function createExplorer(deps) {
     paintAll();
   }
 
+  async function reloadFolder() {
+    const token = ++E.reloadToken;
+    E.lastReload = Date.now();
+    const { folder, ...filters } = toQuery();
+    const base = { ...filters, sort: E.sort === 'date' || E.sort === 'date_asc' ? E.sort : E.sort || 'name' };
+    let items = [], total = 0, dirs = null;
+    for (;;) {
+      let r;
+      try { r = await rpc('browse', { job, path: E.path, query: { ...base, offset: items.length, limit: 2000 } }); } catch (e) { toast(e.message); return; }
+      if (token !== E.reloadToken) return;
+      if (!dirs) dirs = r.folders;
+      items = items.concat(r.files);
+      total = r.total_files;
+      if (!r.files.length || items.length >= total || items.length >= 30000) break;
+    }
+    E.dirs = dirs || [];
+    E.items = items;
+    E.total = total;
+    paintCrumb();
+    relayout();
+    paintAll();
+  }
+
   async function loadFacets() {
     try { E.facets = await rpc('facets', { job }); } catch { return; }
     paintNav();
@@ -157,7 +193,7 @@ export function createExplorer(deps) {
 
   function geometry() {
     const W = Math.max(200, scroll.clientWidth - PAD * 2);
-    if (E.view === 'list') return { W, cols: 1, tw: W, cap: 0, rowH: 54 };
+    if (E.view === 'list' || E.view === 'folders') return { W, cols: 1, tw: W, cap: 0, rowH: 54 };
     const T = E.tile;
     const cols = Math.max(1, Math.floor((W + GAP) / (T + GAP)));
     const tw = Math.floor((W - GAP * (cols - 1)) / cols);
@@ -176,6 +212,9 @@ export function createExplorer(deps) {
     }
     const rows = [];
     let y = PAD;
+    if (folderMode()) {
+      E.dirs.forEach((_, d) => { rows.push({ t: 'dir', y, h: G.rowH, d }); y += G.rowH; });
+    }
     let cur = null, rowItems = [];
     const flush = () => {
       if (rowItems.length) { rows.push({ t: 'row', y, h: G.rowH, idx: rowItems }); y += G.rowH; rowItems = []; }
@@ -238,7 +277,7 @@ export function createExplorer(deps) {
       el.style.top = `${row.y}px`;
       el.style.height = `${row.h}px`;
       el.dataset.ri = ri;
-      el.innerHTML = row.t === 'head' ? headHtml(row) : row.idx.map((i) => (E.view === 'list' ? listHtml(i) : tileHtml(i))).join('');
+      el.innerHTML = row.t === 'head' ? headHtml(row) : row.t === 'dir' ? dirHtml(row.d) : row.idx.map((i) => (E.view === 'grid' ? tileHtml(i) : listHtml(i))).join('');
       E.rendered.set(ri, el);
       frag.appendChild(el);
     }
@@ -246,7 +285,82 @@ export function createExplorer(deps) {
   }
 
   // ------------------------------------------------------------ items
-  const isSel = (id) => E.allFiltered || E.sel.has(id);
+  // `p` is inside `d` (or is `d`); '' holds everything, '@carved' only itself.
+  const under = (p, d) => d === '' || p === d || (d !== '@carved' && p.startsWith(d + '/'));
+  // Deepest marked/unmarked folder holding `p` decides, as in the core.
+  const covered = (p) => {
+    let best = null;
+    for (const d of E.fs.folders) if (under(p, d) && (best == null || d.length > best[0].length)) best = [d, true];
+    for (const d of E.fs.xfolders) if (under(p, d) && (best == null || d.length >= best[0].length)) best = [d, false];
+    return !!best && best[1];
+  };
+  const dirOf = (it) => (it.origin === 'carved' ? '@carved' : (it.dir || '').replace(/^\/+|\/+$/g, ''));
+  const fileOn = (it) => !E.fs.xfiles.has(it.id) && (E.fs.files.has(it.id) || covered(dirOf(it)));
+  // 'on', 'off' or 'mixed' for a folder row
+  const dirState = (d) => {
+    const on = covered(d);
+    const inside = (p) => p !== d && under(p, d);
+    const marks = on
+      ? [...E.fs.xfolders].some(inside) || [...E.fs.xfiles.values()].some((p) => under(p, d)) || [...E.fs.folders].some(inside)
+      : [...E.fs.folders].some(inside) || [...E.fs.files.values()].some((p) => under(p, d));
+    return marks ? 'mixed' : on ? 'on' : 'off';
+  };
+  const fsEmpty = () => !E.fs.folders.size && !E.fs.files.size;
+  const dropInside = (d) => {
+    for (const k of [...E.fs.folders]) if (under(k, d)) E.fs.folders.delete(k);
+    for (const k of [...E.fs.xfolders]) if (under(k, d)) E.fs.xfolders.delete(k);
+    for (const [id, p] of [...E.fs.files]) if (under(p, d)) E.fs.files.delete(id);
+    for (const [id, p] of [...E.fs.xfiles]) if (under(p, d)) E.fs.xfiles.delete(id);
+  };
+  // Like a file manager's tri-state box: a fully marked folder is unmarked;
+  // an unmarked or partly marked one becomes fully marked.
+  function toggleDir(d) {
+    const unmark = dirState(d) === 'on';
+    dropInside(d);
+    if (unmark) { if (covered(d)) E.fs.xfolders.add(d); } else if (!covered(d)) E.fs.folders.add(d);
+    fsChanged();
+  }
+  function toggleFile(it) {
+    const p = dirOf(it);
+    if (fileOn(it)) { E.fs.files.delete(it.id); if (covered(p)) E.fs.xfiles.set(it.id, p); } else { E.fs.xfiles.delete(it.id); if (!covered(p)) E.fs.files.set(it.id, p); }
+    fsChanged();
+  }
+  const fsSelection = () => ({
+    folders: [...E.fs.folders], ids: [...E.fs.files.keys()], exclude: [...E.fs.xfiles.keys()], exclude_folders: [...E.fs.xfolders],
+  });
+  let countT;
+  function fsChanged() {
+    paintSel();
+    clearTimeout(countT);
+    if (fsEmpty()) { E.fsCount = null; paintActions(); return; }
+    countT = setTimeout(async () => {
+      try { E.fsCount = await rpc('selection_count', { job, selection: fsSelection() }); } catch { E.fsCount = null; }
+      paintActions();
+    }, 120);
+  }
+  function goTo(path) {
+    E.path = path; E.curDir = null; E.curId = null;
+    scroll.scrollTop = 0;
+    paintInspector();
+    reload();
+  }
+  const parentOf = (p) => (p === '@carved' || !p.includes('/') ? '' : p.slice(0, p.lastIndexOf('/')));
+  const dirLabel = (p) => (p === '' ? 'Raiz' : p === '@carved' ? 'Por assinatura' : p.split('/').pop());
+
+  function dirHtml(d) {
+    const it = E.dirs[d];
+    const st = dirState(it.path);
+    return `<div class="xp-lrow xp-dir" role="option" data-dir="${d}" aria-selected="${st === 'on'}" data-state="${st}" ${E.curDir === it.path ? 'data-cur="1"' : ''} title="${esc(it.path === '@carved' ? 'Arquivos encontrados por assinatura, sem pasta conhecida' : it.path)}">
+      <span class="xp-chk" data-chk="1" aria-hidden="true"></span><div class="xp-lth"><span class="xp-lico xp-fico">${I.folderBig}</span></div>
+      <div class="xp-lnm"><b>${esc(it.name)}</b><small>${it.files.toLocaleString(LOC())} ${tr(it.files === 1 ? 'arquivo' : 'arquivos')}</small></div>
+      <span class="xp-lcol"></span><span class="xp-lcol num">${human(it.bytes)}</span><span></span>
+    </div>`;
+  }
+
+  const isSel = (id) => {
+    if (folderMode()) { const it = E.items[idxOf(id)]; return !!it && fileOn(it); }
+    return E.allFiltered || E.sel.has(id);
+  };
 
   function headHtml(row) {
     return `<div class="xp-head"><b>${esc(dayLabel(row.key))}</b><small>${row.count} ${row.count === 1 ? 'item' : 'itens'}</small><button class="xp-hsel" data-hsel="${row.start}" data-n="${row.count}" aria-label="Selecionar este grupo">Selecionar grupo</button></div>`;
@@ -310,7 +424,15 @@ export function createExplorer(deps) {
       el.setAttribute('aria-selected', String(isSel(id)));
       if (E.curId === id) el.dataset.cur = '1'; else delete el.dataset.cur;
     };
-    scroll.querySelectorAll('.xp-tile, .xp-lrow').forEach(set);
+    scroll.querySelectorAll('.xp-tile, .xp-lrow:not(.xp-dir)').forEach(set);
+    scroll.querySelectorAll('.xp-dir').forEach((el) => {
+      const d = E.dirs[+el.dataset.dir];
+      if (!d) return;
+      const st = dirState(d.path);
+      el.dataset.state = st;
+      el.setAttribute('aria-selected', String(st === 'on'));
+      if (E.curDir === d.path) el.dataset.cur = '1'; else delete el.dataset.cur;
+    });
     paintActions();
   }
 
@@ -353,6 +475,21 @@ export function createExplorer(deps) {
   new ResizeObserver(() => { if (Math.abs(geometry().W - G.W) > 1 || geometry().cols !== G.cols) relayout(); else renderWindow(); }).observe(scroll);
 
   scroll.addEventListener('click', (e) => {
+    const dr = e.target.closest('.xp-dir');
+    if (dr) {
+      const d = E.dirs[+dr.dataset.dir];
+      if (e.target.closest('[data-chk]') || e.ctrlKey || e.metaKey) toggleDir(d.path);
+      else { E.curDir = d.path; E.curId = null; paintSel(); paintInspector(); }
+      return;
+    }
+    if (folderMode()) {
+      const el = e.target.closest('.xp-lrow');
+      if (!el) return;
+      const it = E.items[+el.dataset.i];
+      if (e.target.closest('[data-chk]') || e.ctrlKey || e.metaKey) toggleFile(it);
+      else { E.curDir = null; E.curId = it.id; paintSel(); schedInspector(); }
+      return;
+    }
     const hs = e.target.closest('[data-hsel]');
     if (hs) {
       const start = +hs.dataset.hsel, n = +hs.dataset.n;
@@ -368,10 +505,24 @@ export function createExplorer(deps) {
     else setCursor(i, { extend: e.shiftKey, toggle: e.ctrlKey || e.metaKey });
   });
   scroll.addEventListener('dblclick', (e) => {
+    const dr = e.target.closest('.xp-dir');
+    if (dr) { if (!e.target.closest('[data-chk]')) goTo(E.dirs[+dr.dataset.dir].path); return; }
+    if (folderMode()) {
+      const el = e.target.closest('.xp-lrow');
+      if (el && !e.target.closest('[data-chk]')) openLightbox(+el.dataset.i);
+      return;
+    }
     const el = e.target.closest('.xp-tile, .xp-lrow');
     if (el) { setCursor(+el.dataset.i); openLightbox(+el.dataset.i); }
   });
   scroll.addEventListener('keydown', (e) => {
+    if (folderMode()) {
+      if ((e.key === 'Backspace' || (e.altKey && e.key === 'ArrowUp')) && E.path !== '') { e.preventDefault(); goTo(parentOf(E.path)); return; }
+      if (e.key === 'Enter' && E.curDir != null) { e.preventDefault(); goTo(E.curDir); return; }
+      if (e.key === ' ' && E.curDir != null) { e.preventDefault(); toggleDir(E.curDir); return; }
+      if ((e.ctrlKey || e.metaKey) && e.key.toLowerCase() === 'a') { e.preventDefault(); toggleDir(E.path); return; }
+      if (e.key === 'Escape') { E.fs = { folders: new Set(), xfolders: new Set(), files: new Map(), xfiles: new Map() }; fsChanged(); return; }
+    }
     if (!E.items.length) return;
     let i = idxOf(E.curId);
     if (i < 0) i = 0;
@@ -389,6 +540,19 @@ export function createExplorer(deps) {
 
   // ------------------------------------------------------------ action bar
   function paintActions() {
+    if (folderMode()) {
+      const c = E.fsCount;
+      const here = dirState(E.path);
+      const html = !fsEmpty()
+        ? `<span class="info">${c ? `<b>${c.files.toLocaleString(LOC())}</b> ${tr(c.files === 1 ? 'arquivo' : 'arquivos')} · ${human(c.bytes)}` : 'Calculando seleção…'}</span>
+           <button class="btn sm" data-a="clear">Limpar seleção</button>
+           ${here !== 'on' ? `<button class="btn sm" data-a="here">Marcar esta pasta</button>` : ''}
+           <button class="btn primary" data-a="frec" ${c && c.files ? '' : 'disabled'}>Recuperar seleção</button>`
+        : `<span class="info">${E.dirs.length.toLocaleString(LOC())} ${E.dirs.length === 1 ? 'pasta' : 'pastas'} · ${E.total.toLocaleString(LOC())} ${E.total === 1 ? 'arquivo' : 'arquivos'} aqui</span>
+           ${E.dirs.length || E.total ? '<button class="btn primary" data-a="here">Marcar esta pasta</button>' : ''}`;
+      if (actions._h !== html) { actions._h = html; actions.innerHTML = html; }
+      return;
+    }
     const n = selCount();
     const html = n
       ? `<span class="info"><b>${n.toLocaleString(LOC())}</b> selecionado${n === 1 ? '' : 's'}${E.allFiltered ? ' (todos desta vista)' : ''}</span>
@@ -401,6 +565,9 @@ export function createExplorer(deps) {
   }
   actions.addEventListener('click', (e) => {
     const a = e.target.closest('[data-a]')?.dataset.a;
+    if (folderMode() && a === 'clear') { E.fs = { folders: new Set(), xfolders: new Set(), files: new Map(), xfiles: new Map() }; fsChanged(); return; }
+    if (a === 'here') { if (dirState(E.path) !== 'on') { dropInside(E.path); if (!covered(E.path)) E.fs.folders.add(E.path); fsChanged(); } return; }
+    if (a === 'frec') { onRecover({ selection: fsSelection(), filtered: anyFilter() }); return; }
     if (a === 'clear') { E.sel = new Set(); E.allFiltered = false; paintSel(); }
     else if (a === 'all') { E.allFiltered = true; paintSel(); }
     else if (a === 'rec') onRecover(E.allFiltered ? { filter: toQuery() } : { ids: [...E.sel] });
@@ -461,6 +628,12 @@ export function createExplorer(deps) {
     if (!b) return;
     const F = E.filters;
     const f = b.dataset.f, v = b.dataset.v;
+    if (folderMode() && f === 'folder') {
+      if (!v.startsWith('@')) E.expanded.add('d' + v);
+      nav._h = null; paintNav();
+      root.classList.remove('show-nav');
+      return goTo(v === '@raiz' ? '' : v);
+    }
     if (f === 'all') clearFilters(false);
     else if (f === 'year') { const same = F.year === +v && !F.month; F.year = same ? null : +v; F.month = null; F.undated = false; E.expanded.add('y' + v); }
     else if (f === 'month') { const same = F.year === +b.dataset.y && F.month === +v; F.year = same ? null : +b.dataset.y; F.month = same ? null : +v; F.undated = false; }
@@ -490,6 +663,12 @@ export function createExplorer(deps) {
   }
 
   function paintCrumb() {
+    if (folderMode()) {
+      const parts = E.path === '' ? [] : E.path === '@carved' ? ['@carved'] : E.path.split('/').map((_, i, a) => a.slice(0, i + 1).join('/'));
+      const link = (p, label) => `<button class="xp-cpart" data-go="${esc(p)}">${esc(label)}</button>`;
+      $('#xpCrumb').innerHTML = `<nav class="xp-path" aria-label="Pasta atual">${[link('', 'Raiz'), ...parts.map((p) => link(p, dirLabel(p)))].join('<span class="xp-csep">›</span>')}</nav>`;
+      return;
+    }
     const F = E.filters, parts = [];
     if (F.category) parts.push(CAT[F.category][0]);
     if (F.year) parts.push(String(F.year));
@@ -528,6 +707,11 @@ export function createExplorer(deps) {
     changed();
   });
 
+  $('#xpCrumb').addEventListener('click', (e) => {
+    const b = e.target.closest('[data-go]');
+    if (b && folderMode()) goTo(b.dataset.go);
+  });
+
   // ------------------------------------------------------------ top bar
   let qt;
   $('#xpQ').addEventListener('input', (e) => { clearTimeout(qt); qt = setTimeout(() => { E.filters.query = e.target.value.trim(); changed(); }, 250); });
@@ -538,9 +722,11 @@ export function createExplorer(deps) {
     $('#xpSize').style.display = E.view === 'grid' ? '' : 'none';
   };
   host.querySelectorAll('button[data-view]').forEach((b) => (b.onclick = () => {
+    const was = folderMode();
     E.view = b.dataset.view;
     try { localStorage.setItem('guara-view', E.view); } catch { /* */ }
-    paintView(); relayout();
+    paintView();
+    if (was !== folderMode()) { E.curId = null; E.curDir = null; E.dirs = []; paintCrumb(); paintInspector(); actions._h = null; reload(); } else relayout();
   }));
   $('#xpSize').addEventListener('input', (e) => {
     E.tile = +e.target.value;
@@ -561,7 +747,17 @@ export function createExplorer(deps) {
 
   function paintInspector() {
     stopPv?.(); stopPv = null;
-    const n = selCount();
+    if (folderMode() && E.curDir != null) {
+      const d = E.dirs.find((x) => x.path === E.curDir);
+      const close = `<button class="icon-btn xp-insp-x" data-i="close" aria-label="Fechar">${I.close}</button>`;
+      if (d) {
+        insp.innerHTML = `${close}<div class="xp-folder-insp"><div class="xp-fbig">${I.folderBig}</div><h3>${esc(d.name)}</h3>
+          <dl class="kv"><dt>Caminho</dt><dd>${esc(d.path === '@carved' ? 'Encontrados por assinatura (sem pasta conhecida)' : d.path)}</dd><dt>Arquivos</dt><dd>${d.files.toLocaleString(LOC())}</dd><dt>Tamanho</dt><dd>${human(d.bytes)}</dd></dl>
+          <div class="row"><button class="btn" data-i="open">Abrir pasta</button><button class="btn primary" data-i="mark">${dirState(d.path) === 'on' ? 'Desmarcar pasta' : 'Marcar pasta inteira'}</button></div></div>`;
+        return;
+      }
+    }
+    const n = folderMode() ? 0 : selCount();
     const it = E.items[idxOf(E.curId)];
     const close = `<button class="icon-btn xp-insp-x" data-i="close" aria-label="Fechar">${I.close}</button>`;
     if (n > 1) {
@@ -623,6 +819,8 @@ export function createExplorer(deps) {
     else if (a === 'rec') onRecover(E.allFiltered ? { filter: toQuery() } : { ids: [...E.sel] });
     else if (a === 'clear') { E.sel = new Set(); E.allFiltered = false; paintSel(); paintInspector(); }
     else if (a === 'close') root.classList.remove('show-insp');
+    else if (a === 'open' && E.curDir != null) goTo(E.curDir);
+    else if (a === 'mark' && E.curDir != null) { toggleDir(E.curDir); paintInspector(); }
   });
 
   // ------------------------------------------------------------ fullscreen

apps/gui/ui/i18n-en.js

@@ -582,7 +582,7 @@ export const EN = {
   'Atualizando o Guará…': 'Updating Guará…',
   'Baixando a atualização…': 'Downloading the update…',
   'Baixando… {n}%': 'Downloading… {n}%',
-  'Instalando… o Guará vai reabrir sozinho.': 'Installing… Guará will reopen by itself.',
+  'Instalando a atualização…': 'Installing the update…',
   'Esta instalação vem de um pacote do sistema e não se atualiza sozinha. Baixe a versão nova na página da release:': 'This install comes from a system package and cannot update itself. Download the new version from the release page:',
   'Atualizações automáticas': 'Automatic updates',
   'Ao abrir, consulta o Gitea para ver se há versão nova (uma consulta, sem enviar dados seus)': 'On startup, checks Gitea for a new version (one request, nothing of yours is sent)',
@@ -593,4 +593,46 @@ export const EN = {
   'Nova versão {n} disponível': 'New version {n} available',
   'Você já está na versão mais recente': 'You are already on the latest version',
   'Não foi possível verificar atualizações: {n}': 'Could not check for updates: {n}',
+  'Instalação automática da nova versão com um clique:': 'One-click automatic installation of the new version:',
+  'Verificando integridade…': 'Verifying checksum…',
+  'Reiniciando…': 'Restarting…',
+  'Atualização concluída': 'Update completed',
+  'Falha na atualização: {n}': 'Update failed: {n}',
+  'Cada pasta marcada é recriada no destino a partir dela mesma, com todas as subpastas. Arquivos marcados soltos vão para a raiz do destino.': 'Each marked folder is recreated in the destination from itself down, with all its subfolders. Files marked on their own go to the root of the destination.',
+  'Atenção:': 'Note:',
+  'pastas marcadas são recuperadas inteiras; os filtros ativos não se aplicam a elas.': 'marked folders are recovered whole; the active filters do not apply to them.',
+  'Navegar pelas pastas': 'Browse folders',
+  'Arquivos encontrados por assinatura, sem pasta conhecida': 'Files found by signature, with no known folder',
+  'Calculando seleção…': 'Counting the selection…',
+  'Marcar esta pasta': 'Mark this folder',
+  '{n} {n} · {n} {n} aqui': '{n} {n} · {n} {n} here',
+  'Pasta atual': 'Current folder',
+  'Encontrados por assinatura (sem pasta conhecida)': 'Found by signature (no known folder)',
+  'Desmarcar pasta': 'Unmark folder',
+  'Marcar pasta inteira': 'Mark whole folder',
+  'Abrir pasta': 'Open folder',
+  'Recuperar seleção': 'Recover selection',
+  'Caminho': 'Path',
+  'Arquivos': 'Files',
+  'arquivo': 'file',
+  'pastas': 'folders',
+  '{n} arquivo': '{n} file',
+  '{n} arquivos': '{n} files',
+  '{n} {n} · {n}': '{n} {n} · {n}',
+  'Apagar esta sessão': 'Delete this session',
+  'Apagar todas as sessões salvas sozinhas': 'Delete all autosaved sessions',
+  'Apagar sessão salva': 'Delete saved session',
+  'Apagar': 'Delete',
+  'Apagar tudo': 'Delete all',
+  'Apagar todas as sessões salvas': 'Delete all saved sessions',
+  'Todas as sessões salvas sozinhas serão apagadas de vez. Sessões abertas agora são mantidas.': 'All autosaved sessions will be permanently deleted. Sessions currently open are kept.',
+  'Sessão apagada': 'Session deleted',
+  'Nada para apagar': 'Nothing to delete',
+  'Apagar sessões salvas sozinhas após': 'Delete autosaved sessions after',
+  'Nunca': 'Never',
+  '7 dias': '7 days',
+  '30 dias': '30 days',
+  '90 dias': '90 days',
+  'será apagada de vez. Os arquivos do disco não são afetados.': 'will be permanently deleted. Files on the disk are not affected.',
+  'Sessões apagadas: {n}': 'Sessions deleted: {n}',
 };

apps/gui/ui/index.html

@@ -24,7 +24,7 @@
         <button class="side-action" id="openImageBtn"><svg viewBox="0 0 24 24" width="18" height="18"><path d="M4 7a2 2 0 0 1 2-2h4l2 2h6a2 2 0 0 1 2 2v8a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2z" stroke="currentColor" stroke-width="1.8" fill="none"/></svg>Abrir arquivo de imagem…</button>
         <div class="side-title">Sessões</div>
         <ul id="sessionList" class="list"></ul>
-        <div class="side-title">Recentes <small style="font-weight:400;text-transform:none;letter-spacing:0">(salvas sozinhas)</small></div>
+        <div class="side-title">Recentes <small style="font-weight:400;text-transform:none;letter-spacing:0">(salvas sozinhas)</small> <button class="icon-btn small" id="clearRecentBtn" title="Apagar todas as sessões salvas sozinhas" aria-label="Apagar todas as sessões salvas sozinhas"><svg viewBox="0 0 24 24" width="16" height="16"><path d="M5 7h14M10 7V5h4v2m-6 0l1 12h6l1-12" stroke="currentColor" stroke-width="2" fill="none" stroke-linecap="round" stroke-linejoin="round"/></svg></button></div>
         <ul id="recentList" class="list"></ul>
         <button class="side-action" id="loadSessionBtn"><svg viewBox="0 0 24 24" width="18" height="18"><path d="M12 4v11m0 0l-4-4m4 4l4-4M5 20h14" stroke="currentColor" stroke-width="1.8" fill="none" stroke-linecap="round" stroke-linejoin="round"/></svg>Abrir sessão salva…</button>
       </nav>

crates/guara-cli/src/main.rs

@@ -812,7 +812,7 @@ fn recover_job(
         filter.organize
     ))?;
     let rj = eng
-        .start_recover(scan_job, ids, Some(q), dest, layout)
+        .start_recover(scan_job, ids, Some(q), None, dest, layout)
         .map_err(s)?;
     let st = wait(eng, &rj, None)?;
     eprintln!();

crates/guara-core/assets/paged.polyfill.min.js

@@ -0,0 +1,4 @@
+/**
+ * @license Paged.js v0.4.3 | MIT | https://gitlab.coko.foundation/pagedjs/pagedjs
+ */
+!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:e||self).PagedPolyfill=t()}(this,(function(){"use strict";function e(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}var t,n,r={exports:{}},a={exports:{}};var i,o,s,l,d=function(){},p=d(),c=function(e){return e!==p&&null!==e};function u(){return l||(l=1,s=(n?t:(n=1,t=function(){try{return Object.keys("primitive"),!0}catch(e){return!1}}))()?Object.keys:function(){if(o)return i;o=1;var e=c,t=Object.keys;return i=function(n){return t(e(n)?Object(n):n)}}()),s}var m,h,g=c,f=function(e){if(!g(e))throw new TypeError("Cannot use null or undefined");return e};var y,b,S=function(){var e,t=Object.assign;return"function"==typeof t&&(t(e={foo:"raz"},{bar:"dwa"},{trzy:"trzy"}),e.foo+e.bar+e.trzy==="razdwatrzy")}()?Object.assign:function(){if(h)return m;h=1;var e=u(),t=f,n=Math.max;return m=function(r,a){var i,o,s,l=n(arguments.length,2);for(r=Object(t(r)),s=function(e){try{r[e]=a[e]}catch(e){i||(i=e)}},o=1;o<l;++o)e(a=arguments[o]).forEach(s);if(void 0!==i)throw i;return r},m}(),v=c,x=Array.prototype.forEach,k=Object.create,w="razdwatrzy";var C,T="function"==typeof w.contains&&!0===w.contains("dwa")&&!1===w.contains("foo")?String.prototype.contains:function(){if(b)return y;b=1;var e=String.prototype.indexOf;return y=function(t){return e.call(this,t,arguments[1])>-1},y}(),_=S,z=function(e){var t=k(null);return x.call(arguments,(function(e){v(e)&&function(e,t){var n;for(n in e)t[n]=e[n]}(Object(e),t)})),t},O=function(e){return"function"==typeof e},A=T;C=a.exports=function(e,t){var n,r,a,i,o;return arguments.length<2||"string"!=typeof e?(i=t,t=e,e=null):i=arguments[2],null==e?(n=a=!0,r=!1):(n=A.call(e,"c"),r=A.call(e,"e"),a=A.call(e,"w")),o={value:t,configurable:n,enumerable:r,writable:a},i?_(z(i),o):o},C.gs=function(e,t,n){var r,a,i,o;return"string"!=typeof e?(i=n,n=t,t=e,e=null):i=arguments[3],null==t?t=void 0:O(t)?null==n?n=void 0:O(n)||(i=n,n=void 0):(i=t,t=n=void 0),null==e?(r=!0,a=!1):(r=A.call(e,"c"),a=A.call(e,"e")),o={get:t,set:n,configurable:r,enumerable:a},i?_(z(i),o):o};var E=a.exports,j=function(e){if("function"!=typeof e)throw new TypeError(e+" is not a function");return e};!function(e,t){var n,r,a,i,o,s,l,d=E,p=j,c=Function.prototype.apply,u=Function.prototype.call,m=Object.create,h=Object.defineProperty,g=Object.defineProperties,f=Object.prototype.hasOwnProperty,y={configurable:!0,enumerable:!1,writable:!0};n=function(e,t){var n;return p(t),f.call(this,"__ee__")?n=this.__ee__:(n=y.value=m(null),h(this,"__ee__",y),y.value=null),n[e]?"object"==typeof n[e]?n[e].push(t):n[e]=[n[e],t]:n[e]=t,this},r=function(e,t){var r,i;return p(t),i=this,n.call(this,e,r=function(){a.call(i,e,r),c.call(t,this,arguments)}),r.__eeOnceListener__=t,this},a=function(e,t){var n,r,a,i;if(p(t),!f.call(this,"__ee__"))return this;if(!(n=this.__ee__)[e])return this;if("object"==typeof(r=n[e]))for(i=0;a=r[i];++i)a!==t&&a.__eeOnceListener__!==t||(2===r.length?n[e]=r[i?0:1]:r.splice(i,1));else r!==t&&r.__eeOnceListener__!==t||delete n[e];return this},i=function(e){var t,n,r,a,i;if(f.call(this,"__ee__")&&(a=this.__ee__[e]))if("object"==typeof a){for(n=arguments.length,i=new Array(n-1),t=1;t<n;++t)i[t-1]=arguments[t];for(a=a.slice(),t=0;r=a[t];++t)c.call(r,this,i)}else switch(arguments.length){case 1:u.call(a,this);break;case 2:u.call(a,this,arguments[1]);break;case 3:u.call(a,this,arguments[1],arguments[2]);break;default:for(n=arguments.length,i=new Array(n-1),t=1;t<n;++t)i[t-1]=arguments[t];c.call(a,this,i)}},o={on:n,once:r,off:a,emit:i},s={on:d(n),once:d(r),off:d(a),emit:d(i)},l=g({},s),e.exports=t=function(e){return null==e?m(l):g(Object(e),s)},t.methods=o}(r,r.exports);var W=r.exports,L=e(W);class B{constructor(e){this.context=e||this,this.hooks=[]}register(){for(var e=0;e<arguments.length;++e)if("function"==typeof arguments[e])this.hooks.push(arguments[e]);else for(var t=0;t<arguments[e].length;++t)this.hooks.push(arguments[e][t])}trigger(){var e=arguments,t=this.context,n=[];return this.hooks.forEach((function(r){var a=r.apply(t,e);a&&"function"==typeof a.then?n.push(a):n.push(new Promise(((e,t)=>{e(a)})))})),Promise.all(n)}triggerSync(){var e=arguments,t=this.context,n=[];return this.hooks.forEach((function(r){var a=r.apply(t,e);n.push(a)})),n}list(){return this.hooks}clear(){return this.hooks=[]}}function P(e){if(!e)return;let t;if(void 0!==e.getBoundingClientRect)t=e.getBoundingClientRect();else{let n=document.createRange();n.selectNode(e),t=n.getBoundingClientRect()}return t}function q(e){if(!e)return;let t;if(void 0!==e.getClientRects)t=e.getClientRects();else{let n=document.createRange();n.selectNode(e),t=n.getClientRects()}return t}function M(){var e=(new Date).getTime();return"undefined"!=typeof performance&&"function"==typeof performance.now&&(e+=performance.now()),"xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replaceLine truncated

crates/guara-core/src/carve.rs

@@ -64,7 +64,19 @@ pub fn carve_range(
         let scan_len = got.min(CHUNK).min((end - pos) as usize);
         ev.chunk(pos, &buf[..scan_len]);
         let mut i = 0usize;
+        let mut since_check = 0u32;
         while i < scan_len {
+            // Pause/stop must take effect within a fraction of a second even on slow media,
+            // not only at 8 MiB chunk boundaries. The chunk is reprocessed on resume (hits at
+            // offsets already found are skipped by the caller).
+            since_check += 1;
+            if since_check >= 2048 {
+                since_check = 0;
+                if cancelled() {
+                    *next = pos;
+                    return CarveEnd::Cancelled;
+                }
+            }
             let abs = pos + i as u64;
             if abs < skip_until {
                 i += SECTOR as usize;
@@ -78,6 +90,10 @@ pub fn carve_range(
                     let allowed = cfg.categories.is_empty()
                         || cfg.categories.contains(&category_for_ext(hit.ext));
                     if hit.len >= MIN_LEN && allowed {
+                        if cancelled() {
+                            *next = pos;
+                            return CarveEnd::Cancelled;
+                        }
                         let action = ev.hit(abs, &hit);
                         match action {
                             HitAction::Skip if hit.confidence != crate::types::Confidence::Low => {

crates/guara-core/src/explorer.rs

@@ -170,6 +170,140 @@ pub fn item_json(f: &Found) -> Value {
     })
 }
 
+/// Folder a file belongs to for browsing: `None` for signature-carved files,
+/// `""` for the volume root.
+fn browse_dir(f: &Found) -> Option<&str> {
+    if f.origin == Origin::Carved {
+        return None;
+    }
+    Some(f.dir.as_deref().unwrap_or("").trim_matches('/'))
+}
+
+/// One level of the folder tree: the direct subfolders of `path` (with file and
+/// byte totals over everything below them) and the files directly inside it,
+/// paginated. `path` is `""` for the root or `"@carved"` for files found by
+/// signature, which have no folder. Filters in `q` apply; its `folder` is ignored.
+pub fn browse(found: &[Found], path: &str, q: &Query) -> Value {
+    let path = path.trim_matches('/');
+    let q = Query {
+        folder: None,
+        ..q.clone()
+    };
+    let selected = q.select(found);
+    let mut folders: BTreeMap<&str, (u64, u64)> = BTreeMap::new();
+    let mut files: Vec<&Found> = Vec::new();
+    let mut carved = (0u64, 0u64);
+    for f in selected {
+        let Some(dir) = browse_dir(f) else {
+            if path == "@carved" {
+                files.push(f);
+            } else if path.is_empty() {
+                carved.0 += 1;
+                carved.1 += f.size;
+            }
+            continue;
+        };
+        if dir == path {
+            files.push(f);
+            continue;
+        }
+        let rest = if path.is_empty() {
+            dir
+        } else if let Some(rest) = dir.strip_prefix(path).and_then(|r| r.strip_prefix('/')) {
+            rest
+        } else {
+            continue;
+        };
+        let child = rest.split('/').next().unwrap_or(rest);
+        let child_path = &dir[..dir.len() - rest.len() + child.len()];
+        let entry = folders.entry(child_path).or_default();
+        entry.0 += 1;
+        entry.1 += f.size;
+    }
+    let mut out: Vec<Value> = folders
+        .iter()
+        .map(|(p, (n, bytes))| {
+            json!({ "name": p.rsplit('/').next().unwrap_or(p), "path": p, "files": n, "bytes": bytes })
+        })
+        .collect();
+    if carved.0 > 0 {
+        out.push(json!({ "name": "Por assinatura", "path": "@carved", "files": carved.0, "bytes": carved.1 }));
+    }
+    sort_items(&mut files, Some(q.sort.as_deref().unwrap_or("name")));
+    let total = files.len();
+    let page: Vec<Value> = files
+        .into_iter()
+        .skip(q.offset)
+        .take(q.limit.clamp(1, 5000))
+        .map(item_json)
+        .collect();
+    json!({ "path": path, "folders": out, "files": page, "total_files": total })
+}
+
+/// What the user marked in folder browsing: whole folders (recursive; `""` is
+/// everything, `"@carved"` the files found by signature), single files, and
+/// files or subfolders unmarked inside a marked folder.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct Selection {
+    #[serde(default)]
+    pub folders: Vec<String>,
+    #[serde(default)]
+    pub ids: Vec<u64>,
+    #[serde(default)]
+    pub exclude: Vec<u64>,
+    #[serde(default)]
+    pub exclude_folders: Vec<String>,
+}
+
+/// Whether `f` is inside the browsing folder `folder` (recursively).
+pub fn in_folder(f: &Found, folder: &str) -> bool {
+    let folder = folder.trim_matches('/');
+    if folder.is_empty() {
+        return true;
+    }
+    match browse_dir(f) {
+        None => folder == "@carved",
+        Some(dir) => dir == folder || dir.strip_prefix(folder).is_some_and(|r| r.starts_with('/')),
+    }
+}
+
+/// Files a selection resolves to, in discovery order. For each file the
+/// deepest marked or unmarked folder holding it decides; marked folders take
+/// everything inside them, whatever filters the view had. A file marked on its
+/// own is in, and an excluded id always wins.
+pub fn resolve_selection<'a>(found: &'a [Found], sel: &Selection) -> Vec<&'a Found> {
+    let ids: std::collections::HashSet<u64> = sel.ids.iter().copied().collect();
+    let exclude: std::collections::HashSet<u64> = sel.exclude.iter().copied().collect();
+    let marks: Vec<(&str, bool)> = sel
+        .folders
+        .iter()
+        .map(|d| (d.trim_matches('/'), true))
+        .chain(
+            sel.exclude_folders
+                .iter()
+                .map(|d| (d.trim_matches('/'), false)),
+        )
+        .collect();
+    found
+        .iter()
+        .filter(|f| !exclude.contains(&f.id))
+        .filter(|f| {
+            ids.contains(&f.id)
+                || marks
+                    .iter()
+                    .filter(|(d, _)| in_folder(f, d))
+                    .max_by_key(|(d, included)| (d.len(), !included))
+                    .is_some_and(|(_, included)| *included)
+        })
+        .collect()
+}
+
+/// Files and bytes a selection resolves to.
+pub fn selection_count(found: &[Found], sel: &Selection) -> Value {
+    let files = resolve_selection(found, sel);
+    json!({ "files": files.len(), "bytes": files.iter().map(|f| f.size).sum::<u64>() })
+}
+
 /// Facet counts for sidebar navigation.
 pub fn facets(found: &[Found]) -> Value {
     let mut cats: HashMap<&'static str, usize> = HashMap::new();
@@ -375,3 +509,180 @@ pub fn quick_sig(src: &dyn crate::source::Source, f: &Found) -> Option<u64> {
     }
     Some(h)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn sample() -> Vec<Found> {
+        vec![
+            Found::test_file(1, "DCIM/100CANON", "a.jpg", 100),
+            Found::test_file(2, "DCIM", "b.jpg", 10),
+            Found::test_file(3, "", "x.txt", 5),
+            Found::test_carved(4, "c.jpg", 7),
+            Found::test_file(5, "DCIM/100CANON", "notes.txt", 1),
+        ]
+    }
+
+    fn folders(v: &Value) -> Vec<(String, u64, u64)> {
+        v["folders"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .map(|f| {
+                (
+                    f["path"].as_str().unwrap().to_string(),
+                    f["files"].as_u64().unwrap(),
+                    f["bytes"].as_u64().unwrap(),
+                )
+            })
+            .collect()
+    }
+
+    fn names(v: &Value) -> Vec<String> {
+        v["files"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .map(|f| f["name"].as_str().unwrap().to_string())
+            .collect()
+    }
+
+    #[test]
+    fn browse_lists_direct_children() {
+        let v = browse(&sample(), "", &Query::default());
+        assert_eq!(
+            folders(&v),
+            vec![("DCIM".to_string(), 3, 111), ("@carved".to_string(), 1, 7)]
+        );
+        assert_eq!(v["folders"][1]["name"], "Por assinatura");
+        assert_eq!(names(&v), vec!["x.txt"]);
+        assert_eq!(v["total_files"], 1);
+    }
+
+    #[test]
+    fn browse_inside_folder() {
+        let v = browse(&sample(), "DCIM", &Query::default());
+        assert_eq!(folders(&v), vec![("DCIM/100CANON".to_string(), 2, 101)]);
+        assert_eq!(v["folders"][0]["name"], "100CANON");
+        assert_eq!(names(&v), vec!["b.jpg"]);
+        let carved = browse(&sample(), "@carved", &Query::default());
+        assert!(folders(&carved).is_empty());
+        assert_eq!(names(&carved), vec!["c.jpg"]);
+    }
+
+    #[test]
+    fn browse_applies_filters() {
+        let q = Query {
+            category: Some(Category::Image),
+            ..Query::default()
+        };
+        let v = browse(&sample(), "", &q);
+        assert_eq!(
+            folders(&v),
+            vec![("DCIM".to_string(), 2, 110), ("@carved".to_string(), 1, 7)]
+        );
+        assert!(names(&v).is_empty());
+    }
+
+    #[test]
+    fn prefix_is_not_parent() {
+        let found = vec![
+            Found::test_file(1, "Foto", "a.jpg", 1),
+            Found::test_file(2, "Fotos", "b.jpg", 1),
+        ];
+        let v = browse(&found, "Foto", &Query::default());
+        assert_eq!(names(&v), vec!["a.jpg"]);
+        assert!(folders(&v).is_empty());
+    }
+
+    fn ids(v: Vec<&Found>) -> Vec<u64> {
+        v.into_iter().map(|f| f.id).collect()
+    }
+
+    #[test]
+    fn resolve_selection_folder_and_ids() {
+        let found = sample();
+        let sel = Selection {
+            folders: vec!["DCIM/100CANON".into()],
+            ids: vec![3],
+            exclude: vec![],
+            exclude_folders: vec![],
+        };
+        assert_eq!(ids(resolve_selection(&found, &sel)), vec![1, 3, 5]);
+        let all = Selection {
+            folders: vec!["".into()],
+            ..Selection::default()
+        };
+        assert_eq!(ids(resolve_selection(&found, &all)), vec![1, 2, 3, 4, 5]);
+    }
+
+    #[test]
+    fn exclude_wins_over_ids() {
+        let found = sample();
+        let sel = Selection {
+            folders: vec!["DCIM".into()],
+            ids: vec![5],
+            exclude: vec![5, 2],
+            exclude_folders: vec![],
+        };
+        assert_eq!(ids(resolve_selection(&found, &sel)), vec![1]);
+    }
+
+    #[test]
+    fn excluded_subfolder_is_left_out() {
+        let found = sample();
+        let sel = Selection {
+            folders: vec!["DCIM".into()],
+            exclude_folders: vec!["DCIM/100CANON".into()],
+            ..Selection::default()
+        };
+        assert_eq!(ids(resolve_selection(&found, &sel)), vec![2]);
+        // a folder marked again inside the excluded one comes back
+        let sel = Selection {
+            folders: vec!["".into(), "DCIM/100CANON".into()],
+            exclude_folders: vec!["DCIM".into()],
+            ..Selection::default()
+        };
+        assert_eq!(ids(resolve_selection(&found, &sel)), vec![1, 3, 4, 5]);
+        assert_eq!(
+            selection_count(&found, &sel),
+            json!({ "files": 4, "bytes": 113 })
+        );
+    }
+
+    #[test]
+    fn selection_carved_folder() {
+        let found = sample();
+        let sel = Selection {
+            folders: vec!["@carved".into()],
+            ..Selection::default()
+        };
+        assert_eq!(ids(resolve_selection(&found, &sel)), vec![4]);
+        let prefix = vec![
+            Found::test_file(1, "Foto", "a.jpg", 1),
+            Found::test_file(2, "Fotos", "b.jpg", 1),
+        ];
+        let sel = Selection {
+            folders: vec!["Foto".into()],
+            ..Selection::default()
+        };
+        assert_eq!(ids(resolve_selection(&prefix, &sel)), vec![1]);
+    }
+
+    #[test]
+    fn browse_paginates_files() {
+        let found: Vec<Found> = (0..250)
+            .map(|i| Found::test_file(i, "big", &format!("f{i:03}.txt"), 1))
+            .collect();
+        let q = Query {
+            limit: 100,
+            offset: 200,
+            ..Query::default()
+        };
+        let v = browse(&found, "big", &q);
+        assert_eq!(v["total_files"], 250);
+        assert_eq!(names(&v).len(), 50);
+        assert_eq!(names(&v)[0], "f200.txt");
+    }
+}

crates/guara-core/src/pdf.rs

@@ -11,6 +11,8 @@ use std::io::Write;
 const W: f64 = 595.28;
 const H: f64 = 841.89;
 const MARGIN: f64 = 40.0;
+/// Top of the text area on inner pages (leaves room for the running header).
+const TOP: f64 = H - 60.0;
 
 #[derive(Clone, Copy, PartialEq)]
 pub enum Font {
@@ -179,12 +181,22 @@ pub struct Pdf {
     pages: Vec<String>,
     cur: String,
     y: f64,
+    /// Running header (left text, right TLP label) drawn on every inner page.
+    header: Option<(String, String)>,
+    /// Leading full-bleed pages that get no running header/footer.
+    covers: usize,
+    /// Baseline JPEG (`/DCTDecode`): bytes, pixel width, pixel height.
+    image: Option<(&'static [u8], u32, u32)>,
 }
 
 type Rgb = (f64, f64, f64);
 pub const TEAL: Rgb = (0.059, 0.463, 0.431);
 pub const GRAY: Rgb = (0.36, 0.43, 0.42);
 pub const BLACK: Rgb = (0.06, 0.12, 0.12);
+pub const DEEP: Rgb = (0.027, 0.212, 0.200);
+pub const AMBER: Rgb = (0.70, 0.42, 0.0);
+const ZEBRA: Rgb = (0.953, 0.976, 0.973);
+const HAIR: Rgb = (0.86, 0.91, 0.90);
 
 impl Pdf {
     pub fn new(title: &str, footer: &str) -> Self {
@@ -193,7 +205,10 @@ impl Pdf {
             footer: footer.into(),
             pages: vec![],
             cur: String::new(),
-            y: H - MARGIN,
+            y: TOP,
+            header: None,
+            covers: 0,
+            image: None,
         }
     }
 
@@ -202,10 +217,10 @@ impl Pdf {
     }
 
     fn new_page(&mut self) {
-        if !self.cur.is_empty() || self.y != H - MARGIN {
+        if !self.cur.is_empty() || self.y != TOP {
             self.pages.push(std::mem::take(&mut self.cur));
         }
-        self.y = H - MARGIN;
+        self.y = TOP;
     }
 
     fn ensure(&mut self, h: f64) {
@@ -214,7 +229,7 @@ impl Pdf {
         }
     }
 
-    fn put(&mut self, x: f64, y: f64, s: &str, size: f64, f: Font, c: Rgb) {
+    pub fn put(&mut self, x: f64, y: f64, s: &str, size: f64, f: Font, c: Rgb) {
         if s.is_empty() {
             return;
         }
@@ -228,20 +243,80 @@ impl Pdf {
         ));
     }
 
-    fn rect(&mut self, x: f64, y: f64, w: f64, h: f64, c: Rgb) {
+    pub fn rect(&mut self, x: f64, y: f64, w: f64, h: f64, c: Rgb) {
         self.cur.push_str(&format!(
             "{:.3} {:.3} {:.3} rg {x:.2} {y:.2} {w:.2} {h:.2} re f\n",
             c.0, c.1, c.2
         ));
     }
 
-    fn line(&mut self, x1: f64, x2: f64, y: f64, c: Rgb, w: f64) {
+    pub fn line(&mut self, x1: f64, x2: f64, y: f64, c: Rgb, w: f64) {
         self.cur.push_str(&format!(
             "{:.3} {:.3} {:.3} RG {w} w {x1:.2} {y:.2} m {x2:.2} {y:.2} l S\n",
             c.0, c.1, c.2
         ));
     }
 
+    /// Page size in points (A4).
+    pub const SIZE: (f64, f64) = (W, H);
+
+    /// Sets the running header shown on inner pages: `left` in muted caps, `tlp` in amber.
+    pub fn running_header(&mut self, left: &str, tlp: &str) {
+        self.header = Some((left.into(), tlp.into()));
+    }
+
+    /// Registers the single JPEG image (drawn with [`Pdf::image`]); must be baseline DCT.
+    pub fn set_image(&mut self, jpeg: &'static [u8], w: u32, h: u32) {
+        self.image = Some((jpeg, w, h));
+    }
+
+    /// Draws the registered image at `(x, y)` (bottom-left) scaled to `w` x `h` points.
+    pub fn image(&mut self, x: f64, y: f64, w: f64, h: f64) {
+        self.cur
+            .push_str(&format!("q {w:.2} 0 0 {h:.2} {x:.2} {y:.2} cm /Im1 Do Q\n"));
+    }
+
+    /// Closes the current page as a full-bleed cover (no running header or footer).
+    /// Must be called before any inner content is laid out.
+    pub fn end_cover(&mut self) {
+        self.pages.push(std::mem::take(&mut self.cur));
+        self.covers = self.pages.len();
+        self.y = TOP;
+    }
+
+    /// Starts a fresh page unless the current one is still empty.
+    pub fn page_break(&mut self) {
+        if !self.cur.is_empty() {
+            self.new_page();
+        }
+    }
+
+    /// Row of KPI tiles: (label, value, detail). Value colored by `accent`.
+    pub fn kpis(&mut self, items: &[(&str, String, String, Rgb)]) {
+        let gap = 8.0;
+        let n = items.len().max(1) as f64;
+        let w = (Self::content_width() - gap * (n - 1.0)) / n;
+        let h = 58.0;
+        self.ensure(h + 8.0);
+        let top = self.y;
+        for (i, (l, v, d, c)) in items.iter().enumerate() {
+            let x = MARGIN + i as f64 * (w + gap);
+            self.rect(x, top - h, w, h, ZEBRA);
+            self.rect(x, top - 2.5, w, 2.5, *c);
+            self.put(
+                x + 8.0,
+                top - 15.0,
+                &l.to_uppercase(),
+                6.5,
+                Font::Mono,
+                GRAY,
+            );
+            self.put(x + 8.0, top - 38.0, v, 20.0, Font::Bold, *c);
+            self.put(x + 8.0, top - 51.0, d, 7.5, Font::Regular, GRAY);
+        }
+        self.y -= h + 10.0;
+    }
+
     pub fn space(&mut self, h: f64) {
         self.y -= h;
     }
@@ -255,10 +330,13 @@ impl Pdf {
     }
 
     pub fn heading(&mut self, s: &str) {
-        self.ensure(50.0);
+        self.ensure(70.0);
-        self.y -= 14.0;
+        if self.y < TOP {
-        self.put(MARGIN, self.y - 11.0, s, 12.0, Font::Bold, TEAL);
+            self.y -= 16.0;
-        self.y -= 20.0;
+        }
+        self.rect(MARGIN, self.y - 3.0, 22.0, 3.0, TEAL);
+        self.put(MARGIN, self.y - 21.0, s, 15.0, Font::Bold, DEEP);
+        self.y -= 32.0;
     }
 
     pub fn paragraph(&mut self, s: &str, size: f64, f: Font, c: Rgb) {
@@ -326,13 +404,7 @@ impl Pdf {
             let h = size * 1.4 + 2.0 * pad;
             p.ensure(h + 2.0 * size * 1.4);
             let top = p.y;
-            p.rect(
+            p.rect(MARGIN, top - h, Self::content_width(), h, DEEP);
-                MARGIN,
-                top - h,
-                Self::content_width(),
-                h,
-                (0.906, 0.953, 0.949),
-            );
             let mut x = MARGIN;
             for c in cols {
                 let tx = if c.right {
@@ -346,14 +418,14 @@ impl Pdf {
                     c.title,
                     size,
                     Font::Bold,
-                    (0.043, 0.31, 0.29),
+                    (1.0, 1.0, 1.0),
                 );
                 x += c.width;
             }
             p.y -= h;
         };
         header(self);
-        for row in rows {
+        for (ri, row) in rows.iter().enumerate() {
             let cells: Vec<Vec<String>> = cols
                 .iter()
                 .zip(row)
@@ -366,6 +438,9 @@ impl Pdf {
                 header(self);
             }
             let top = self.y;
+            if ri % 2 == 1 {
+                self.rect(MARGIN, top - h, Self::content_width(), h, ZEBRA);
+            }
             let mut x = MARGIN;
             for (c, lines) in cols.iter().zip(&cells) {
                 for (i, l) in lines.iter().enumerate() {
@@ -385,10 +460,10 @@ impl Pdf {
                 }
                 x += c.width;
             }
-            self.line(MARGIN, W - MARGIN, top - h, (0.89, 0.93, 0.93), 0.5);
+            self.line(MARGIN, W - MARGIN, top - h, HAIR, 0.4);
             self.y -= h;
         }
-        self.y -= 6.0;
+        self.y -= 8.0;
     }
 
     /// Finalizes and serializes the PDF document. `date` is the UTC creation timestamp (`YYYYMMDDHHMMSS`).
@@ -397,16 +472,51 @@ impl Pdf {
             self.pages.push(std::mem::take(&mut self.cur));
         }
         let total = self.pages.len();
-        for (i, p) in self.pages.iter_mut().enumerate() {
+        for (i, p) in self.pages.iter_mut().enumerate().skip(self.covers) {
-            let label = format!("{}  ·  página {} de {total}", self.footer, i + 1);
+            let mut extra = String::new();
-            let x = W - MARGIN - text_width(&label, 8.0, Font::Regular);
+            let mut put = |x: f64, y: f64, s: &str, size: f64, f: Font, c: Rgb| {
-            p.push_str(&format!(
+                extra.push_str(&format!(
-                "BT /F1 8 Tf {:.3} {:.3} {:.3} rg {x:.2} 24 Td ({}) Tj ET\n",
+                    "BT /{} {size:.1} Tf {:.3} {:.3} {:.3} rg {x:.2} {y:.2} Td ({}) Tj ET\n",
-                GRAY.0,
+                    f.res(),
-                GRAY.1,
+                    c.0,
-                GRAY.2,
+                    c.1,
-                escape(&label)
+                    c.2,
+                    escape(s)
                 ));
+            };
+            if let Some((left, tlp)) = &self.header {
+                put(MARGIN + 20.0, H - 34.0, left, 7.0, Font::Mono, GRAY);
+                let tw = text_width(tlp, 7.5, Font::Bold);
+                put(W - MARGIN - tw, H - 34.0, tlp, 7.5, Font::Bold, AMBER);
+            }
+            put(MARGIN, 24.0, &self.footer, 7.5, Font::Mono, GRAY);
+            let label = format!("página {} de {total}", i + 1);
+            let x = W - MARGIN - text_width(&label, 8.0, Font::Bold);
+            put(x, 24.0, &label, 8.0, Font::Bold, DEEP);
+            if self.header.is_some() {
+                if self.image.is_some() {
+                    extra.push_str(&format!(
+                        "q 15 0 0 15 {MARGIN:.2} {:.2} cm /Im1 Do Q\n",
+                        H - 38.5
+                    ));
+                }
+                extra.push_str(&format!(
+                    "{:.3} {:.3} {:.3} RG 0.4 w {MARGIN:.2} {y:.2} m {:.2} {y:.2} l S\n",
+                    HAIR.0,
+                    HAIR.1,
+                    HAIR.2,
+                    W - MARGIN,
+                    y = H - 44.0
+                ));
+            }
+            extra.push_str(&format!(
+                "{:.3} {:.3} {:.3} RG 0.4 w {MARGIN:.2} 36 m {:.2} 36 l S\n",
+                HAIR.0,
+                HAIR.1,
+                HAIR.2,
+                W - MARGIN
+            ));
+            p.push_str(&extra);
         }
         let mut out: Vec<u8> = b"%PDF-1.4\n%\xe2\xe3\xcf\xd3\n".to_vec();
         let mut offsets: Vec<usize> = vec![];
@@ -447,11 +557,18 @@ impl Pdf {
             )
             .as_bytes(),
         );
+        // optional image XObject goes right after the last (page, content) pair
+        let img_obj = 7 + 2 * total;
+        let xobj = if self.image.is_some() {
+            format!(" /XObject << /Im1 {img_obj} 0 R >>")
+        } else {
+            String::new()
+        };
         for (i, p) in self.pages.iter().enumerate() {
             obj(
                 &mut out,
                 format!(
-                    "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 {W} {H}] /Resources << /Font << /F1 3 0 R /F2 4 0 R /F3 5 0 R >> >> /Contents {} 0 R >>",
+                    "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 {W} {H}] /Resources << /Font << /F1 3 0 R /F2 4 0 R /F3 5 0 R >>{xobj} >> /Contents {} 0 R >>",
                     8 + 2 * i
                 )
                 .as_bytes(),
@@ -465,6 +582,16 @@ impl Pdf {
             body.extend_from_slice(b"\nendstream");
             obj(&mut out, &body);
         }
+        if let Some((jpeg, w, h)) = self.image {
+            let mut body = format!(
+                "<< /Type /XObject /Subtype /Image /Width {w} /Height {h} /ColorSpace /DeviceRGB /BitsPerComponent 8 /Filter /DCTDecode /Length {} >>\nstream\n",
+                jpeg.len()
+            )
+            .into_bytes();
+            body.extend_from_slice(jpeg);
+            body.extend_from_slice(b"\nendstream");
+            obj(&mut out, &body);
+        }
         let xref = out.len();
         out.extend_from_slice(
             format!("xref\n0 {}\n0000000000 65535 f \n", offsets.len() + 1).as_bytes(),

crates/guara-core/src/recover.rs

@@ -169,6 +169,25 @@ pub fn recover_resumable(
     resume: bool,
     cancelled: &(dyn Fn() -> bool + Sync),
     progress: &mut dyn FnMut(usize, usize, u64),
+) -> Result<RecoverReport> {
+    recover_resumable_with(
+        src, files, dest, layout, None, source_key, resume, cancelled, progress,
+    )
+}
+
+/// [`recover_resumable`] for a folder-browsing selection: with `roots`, each
+/// file lands relative to its marked folder and `layout` is ignored.
+#[allow(clippy::too_many_arguments)]
+pub fn recover_resumable_with(
+    src: &dyn Source,
+    files: &[&Found],
+    dest: &Path,
+    layout: RecoverLayout,
+    roots: Option<&SelectionRoots>,
+    source_key: &str,
+    resume: bool,
+    cancelled: &(dyn Fn() -> bool + Sync),
+    progress: &mut dyn FnMut(usize, usize, u64),
 ) -> Result<RecoverReport> {
     use std::io::Write;
     crate::owner::create_dir_all_owned(dest)?;
@@ -219,7 +238,7 @@ pub fn recover_resumable(
                 let _ = std::fs::remove_file(&p);
             }
         }
-        let rel = target_rel(f, layout);
+        let rel = target_rel_in(f, layout, roots);
         let mut path = dest.join(&rel);
         if let Some(parent) = path.parent() {
             if let Err(e) = crate::owner::create_dir_all_owned(parent) {
@@ -292,6 +311,97 @@ pub fn recover_resumable(
     Ok(report)
 }
 
+/// Marked folders of a folder-browsing recovery and the name each one gets in
+/// the destination: `a/b/Projeto` is recreated as `Projeto/...`.
+#[derive(Debug, Clone, Default)]
+pub struct SelectionRoots {
+    /// `(folder path, destination name)`; a nested marked folder is dropped
+    /// because the outermost one already covers it.
+    roots: Vec<(String, String)>,
+}
+
+impl SelectionRoots {
+    pub fn new(folders: &[String]) -> Self {
+        let mut paths: Vec<String> = folders
+            .iter()
+            .map(|f| f.trim_matches('/').to_string())
+            .collect();
+        paths.sort();
+        paths.dedup();
+        let covered = |p: &str, by: &str| {
+            p != by
+                && p != "@carved"
+                && (by.is_empty() || p.strip_prefix(by).is_some_and(|r| r.starts_with('/')))
+        };
+        let kept: Vec<String> = paths
+            .iter()
+            .filter(|p| !paths.iter().any(|q| covered(p, q)))
+            .cloned()
+            .collect();
+        let mut used: HashSet<String> = HashSet::new();
+        let roots = kept
+            .into_iter()
+            .map(|path| {
+                let base = match path.as_str() {
+                    "" => String::new(),
+                    "@carved" => "Por assinatura".to_string(),
+                    p => sanitize_name(p.rsplit('/').next().unwrap_or(p)),
+                };
+                let mut name = base.clone();
+                let mut n = 2;
+                while !base.is_empty() && !used.insert(name.clone()) {
+                    name = format!("{base} ({n})");
+                    n += 1;
+                }
+                (path, name)
+            })
+            .collect();
+        Self { roots }
+    }
+
+    /// Destination folder for `f`, or `None` when no marked folder holds it
+    /// (a file marked on its own goes to the destination root).
+    fn rel_dir(&self, f: &Found) -> Option<PathBuf> {
+        let (path, name) = self
+            .roots
+            .iter()
+            .find(|(path, _)| crate::explorer::in_folder(f, path))?;
+        let mut out = PathBuf::new();
+        if !name.is_empty() {
+            out.push(name);
+        }
+        if f.origin == Origin::Carved {
+            if path.is_empty() {
+                out.push("Por assinatura");
+            }
+            return Some(out);
+        }
+        let dir = f.dir.as_deref().unwrap_or("").trim_matches('/');
+        let rest = if path.is_empty() {
+            dir
+        } else {
+            dir[path.len()..].trim_start_matches('/')
+        };
+        for part in rest.split('/').filter(|p| !p.is_empty()) {
+            out.push(sanitize_name(part));
+        }
+        Some(out)
+    }
+}
+
+/// Destination path of `f`: relative to its marked folder when recovering a
+/// selection, otherwise by `layout`.
+fn target_rel_in(f: &Found, layout: RecoverLayout, roots: Option<&SelectionRoots>) -> PathBuf {
+    match roots {
+        Some(roots) => {
+            let mut p = roots.rel_dir(f).unwrap_or_default();
+            p.push(sanitize_name(&f.name));
+            p
+        }
+        None => target_rel(f, layout),
+    }
+}
+
 fn target_rel(f: &Found, layout: RecoverLayout) -> PathBuf {
     let mut p = PathBuf::new();
     match layout {
@@ -524,3 +634,65 @@ impl Source for FoundSource<'_> {
         read_found_at(self.src, self.found, offset, buf)
     }
 }
+
+#[cfg(test)]
+mod selection_tests {
+    use super::*;
+
+    fn rel(roots: &[&str], f: &Found) -> String {
+        let roots = SelectionRoots::new(&roots.iter().map(|r| r.to_string()).collect::<Vec<_>>());
+        target_rel_in(f, RecoverLayout::Folders, Some(&roots))
+            .to_string_lossy()
+            .replace('\\', "/")
+    }
+
+    #[test]
+    fn selection_target_relative() {
+        let f = Found::test_file(1, "a/b/Projeto/sub", "x.jpg", 1);
+        assert_eq!(rel(&["a/b/Projeto"], &f), "Projeto/sub/x.jpg");
+        let top = Found::test_file(2, "a/b/Projeto", "y.txt", 1);
+        assert_eq!(rel(&["a/b/Projeto"], &top), "Projeto/y.txt");
+    }
+
+    #[test]
+    fn selection_nested_uses_outermost() {
+        let f = Found::test_file(1, "a/Projeto/sub", "x.jpg", 1);
+        assert_eq!(
+            rel(&["a/Projeto/sub", "a/Projeto"], &f),
+            "Projeto/sub/x.jpg"
+        );
+    }
+
+    #[test]
+    fn selection_same_name_suffix() {
+        let roots = ["b/Projeto", "a/Projeto"];
+        assert_eq!(
+            rel(&roots, &Found::test_file(1, "a/Projeto", "x.jpg", 1)),
+            "Projeto/x.jpg"
+        );
+        assert_eq!(
+            rel(&roots, &Found::test_file(2, "b/Projeto", "y.jpg", 1)),
+            "Projeto (2)/y.jpg"
+        );
+    }
+
+    #[test]
+    fn selection_loose_file_at_root() {
+        let f = Found::test_file(1, "Documentos", "solto.pdf", 1);
+        assert_eq!(rel(&["Outra"], &f), "solto.pdf");
+        assert_eq!(
+            rel(&["@carved"], &Found::test_carved(2, "c.jpg", 1)),
+            "Por assinatura/c.jpg"
+        );
+        assert_eq!(
+            rel(&[""], &Found::test_file(3, "a/b", "z.txt", 1)),
+            "a/b/z.txt"
+        );
+    }
+
+    #[test]
+    fn selection_target_sanitizes() {
+        let f = Found::test_file(1, "x/Proj:e?to/sub*", "a.jpg", 1);
+        assert_eq!(rel(&["x/Proj:e?to"], &f), "Proj_e_to/sub_/a.jpg");
+    }
+}

crates/guara-core/src/report.rs

@@ -101,6 +101,20 @@ pub fn csv(found: &[&Found]) -> String {
     out
 }
 
+/// The Guará logo, embedded so the report renders identically as a
+/// standalone, offline HTML/PDF export (same reasoning as
+/// `Sabiá/crates/sabia-core/src/report.rs`, which this mirrors): a
+/// `src="/logo.png"` reference would 404 once the file is saved outside the
+/// app's own server, and a forensic report that only half-renders without
+/// network access defeats its purpose as a portable piece of evidence.
+const LOGO_PNG: &[u8] = include_bytes!("../../../logo.png");
+const B64: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+
+/// Encodes the embedded logo as a `data:image/png;base64,...` URI.
+fn logo_data_uri() -> String {
+    format!("data:image/png;base64,{}", b64(LOGO_PNG))
+}
+
 fn esc(s: &str) -> String {
     s.replace('&', "&")
         .replace('<', "&lt;")
@@ -125,40 +139,356 @@ fn human(n: u64) -> String {
 
 const MAX_ROWS: usize = 20_000;
 
-pub fn html(r: &ReportInput) -> String {
+/// Paged.js (MIT, v0.4.3), inlined so the HTML report paginates to A4 with
-    let now = std::time::SystemTime::now()
+/// running headers and a table of contents while staying a single offline file.
+const PAGED_JS: &str = include_str!("../assets/paged.polyfill.min.js");
+/// 96 px logo for the running header of inner pages (the full logo is used on the cover).
+const LOGO_MARK_PNG: &[u8] = include_bytes!("../assets/logo-mark.png");
+/// Logo composited on the PDF cover background with the orange glow baked in
+/// (baseline JPEG, embedded as-is through `/DCTDecode`). Regenerate with PIL if
+/// the logo or the cover color changes.
+const LOGO_COVER_JPG: &[u8] = include_bytes!("../assets/logo-cover.jpg");
+const LOGO_COVER_PX: u32 = 900;
+
+/// Traffic Light Protocol label printed on every report (Ciberfauna default).
+pub const TLP: &str = "TLP:AMBER";
+
+const MAP_COLS: usize = 30;
+const MAP_ROWS: usize = 20;
+
+fn b64(data: &[u8]) -> String {
+    let mut out = String::with_capacity(data.len().div_ceil(3) * 4);
+    for chunk in data.chunks(3) {
+        let b0 = chunk[0];
+        let b1 = chunk.get(1).copied();
+        let b2 = chunk.get(2).copied();
+        out.push(B64[(b0 >> 2) as usize] as char);
+        out.push(B64[(((b0 & 0b11) << 4) | (b1.unwrap_or(0) >> 4)) as usize] as char);
+        out.push(match b1 {
+            Some(b1) => B64[(((b1 & 0b1111) << 2) | (b2.unwrap_or(0) >> 6)) as usize] as char,
+            None => '=',
+        });
+        out.push(match b2 {
+            Some(b2) => B64[(b2 & 0b111111) as usize] as char,
+            None => '=',
+        });
+    }
+    out
+}
+
+/// Aggregates shared by the HTML and PDF renderers.
+struct Summary {
+    by_cat: std::collections::BTreeMap<&'static str, usize>,
+    /// Counts by confidence: `[low, medium, high]`.
+    conf: [usize; 3],
+    bytes: u64,
+    recovered: usize,
+    recovered_bytes: u64,
+    /// Disk "sector map": files in disk order, one cell each (or a bucket of
+    /// files), holding the best confidence (0 = empty, 1 low, 2 medium, 3 high).
+    cells: Vec<u8>,
+}
+
+fn summarize(r: &ReportInput) -> Summary {
+    let mut by_cat = std::collections::BTreeMap::new();
+    let mut conf = [0usize; 3];
+    let mut bytes = 0u64;
+    let n = MAP_COLS * MAP_ROWS;
+    let mut cells = vec![0u8; n];
+    // one cell per file in disk order (bucketed when there are more files than
+    // cells), spread over the whole map like a defragmenter view
+    let mut order: Vec<(u64, u64, u8)> = Vec::with_capacity(r.found.len());
+    for f in r.found {
+        *by_cat.entry(f.category.label_pt()).or_insert(0usize) += 1;
+        conf[f.confidence as usize] += 1;
+        bytes += f.size;
+        order.push((
+            f.first_offset().unwrap_or(u64::MAX),
+            f.id,
+            f.confidence as u8 + 1,
+        ));
+    }
+    order.sort_unstable();
+    let count = order.len().max(1);
+    for (rank, (_, _, c)) in order.iter().enumerate() {
+        let idx = (rank * n / count).min(n - 1);
+        cells[idx] = cells[idx].max(*c);
+    }
+    Summary {
+        by_cat,
+        conf,
+        bytes,
+        recovered: r.recoveries.iter().map(|x| x.recovered.len()).sum(),
+        recovered_bytes: r.recoveries.iter().map(|x| x.total_bytes).sum(),
+        cells,
+    }
+}
+
+fn now_unix() -> i64 {
+    std::time::SystemTime::now()
         .duration_since(std::time::UNIX_EPOCH)
         .map(|d| d.as_secs() as i64)
-        .unwrap_or(0);
+        .unwrap_or(0)
-    let mut o = String::new();
+}
-    o.push_str(
-        r#"<!doctype html><html lang="pt-BR"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Guará: relatório de recuperação</title><style>
-:root{color-scheme:light}*{box-sizing:border-box}body{margin:0;font:14px/1.5 -apple-system,"Segoe UI",Inter,Roboto,sans-serif;color:#10201f;background:#f3f7f7}
-main{max-width:1100px;margin:0 auto;padding:36px 28px 60px}header{border-bottom:3px solid #0f766e;padding-bottom:14px;margin-bottom:22px}
-h1{margin:0;font-size:28px;letter-spacing:-.02em}h2{margin:30px 0 10px;font-size:17px;color:#0f766e}small,.mut{color:#5b6f6d}
-table{width:100%;border-collapse:collapse;background:#fff;border-radius:10px;overflow:hidden;box-shadow:0 1px 3px rgba(0,0,0,.08)}
-th,td{padding:7px 10px;text-align:left;border-bottom:1px solid #e4eded;vertical-align:top;font-size:13px}th{background:#e7f3f2;color:#0b4f4a;font-weight:600}
-td.n{text-align:right;font-variant-numeric:tabular-nums}.mono{font-family:ui-monospace,Menlo,Consolas,monospace;font-size:12px;word-break:break-all}
-.kv td:first-child{width:230px;color:#5b6f6d}.pill{display:inline-block;padding:1px 8px;border-radius:99px;font-size:12px;font-weight:600}
-.alta{background:#d7f5e0;color:#146c2e}.media{background:#fff0cf;color:#8a5a00}.baixa{background:#fde0e0;color:#a32121}
-.note{background:#fff7e0;border-left:4px solid #e0a100;padding:10px 14px;border-radius:6px;margin:8px 0}
-footer{margin-top:34px;color:#5b6f6d;font-size:12px}@media print{body{background:#fff}main{padding:0}table{box-shadow:none}h2{break-after:avoid}tr{break-inside:avoid}}
-</style></head><body><main>"#,
-    );
-    o.push_str("<header><h1>Relatório de recuperação de arquivos</h1><div class=\"mut\">Gerado pelo Guará ");
-    o.push_str(env!("CARGO_PKG_VERSION"));
-    o.push_str(&format!(" em {}</div></header>", fmt_unix(now)));
 
-    o.push_str("<h2>Identificação do caso</h2><table class=\"kv\">");
+fn mode_label(o: &ScanOptions) -> String {
+    format!(
+        "{}{}",
+        if o.mode == ScanMode::Deep {
+            "profunda (metadados + assinatura)"
+        } else {
+            "rápida (metadados)"
+        },
+        if o.include_allocated {
+            ", incluindo áreas em uso"
+        } else {
+            ""
+        }
+    )
+}
+
+fn partition_obs(p: &PartInfo) -> String {
+    [
+        p.lost.then_some("encontrada por varredura".to_string()),
+        p.encrypted
+            .as_ref()
+            .map(|e| format!("cifrada ({e}), não examinada")),
+    ]
+    .into_iter()
+    .flatten()
+    .collect::<Vec<_>>()
+    .join("; ")
+}
+
+const CLOSING: &str = "Este relatório descreve o que o Guará encontrou e recuperou. Arquivos de confiança baixa podem estar incompletos ou sobrescritos. Datas dos metadados do sistema de arquivos estão em UTC. Guará é software livre, sem garantias.";
+
+const CSS: &str = r#"
+:root{color-scheme:light;--deep:#073633;--teal:#0f766e;--aqua:#2dd4bf;--ink:#10201f;--muted:#5b6f6d;--faint:#8aa09d;--line:#dce8e6;--mist:#f1f7f6;--amber:#b36b00;--orange:#f97316;
+--body:Inter,system-ui,"Segoe UI",Roboto,sans-serif;--mono:ui-monospace,"JetBrains Mono","IBM Plex Mono",Menlo,Consolas,monospace}
+*{box-sizing:border-box}html{-webkit-print-color-adjust:exact;print-color-adjust:exact}
+body{margin:0;font:10px/1.5 var(--body);color:var(--ink);background:#fff}
+@page{size:A4;margin:24mm 16mm 20mm;
+  @top-left{content:url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='22' height='22'%3E%3Cimage href='data:image/png;base64,{{MARK}}' width='22' height='22'/%3E%3C/svg%3E");vertical-align:bottom;padding-bottom:4mm;width:25%}
+  @top-center{content:"Guará · relatório de recuperação";font:500 8px var(--mono);letter-spacing:.1em;text-transform:uppercase;color:var(--faint);vertical-align:bottom;padding-bottom:5mm;width:50%;text-align:center;white-space:nowrap}
+  @top-right{content:"\25CF  {{TLP}}";width:25%;text-align:right;white-space:nowrap;font:700 7.5px var(--mono);letter-spacing:.12em;color:var(--amber);vertical-align:bottom;padding-bottom:5mm}
+  @bottom-left{content:"{{FOOT}}";font:400 7.5px var(--mono);color:var(--faint);vertical-align:top;padding-top:5mm;width:75%}
+  @bottom-right{content:counter(page) " / " counter(pages);font:600 8px var(--mono);color:var(--ink);vertical-align:top;padding-top:5mm}
+}
+@page cover{margin:0;@top-left{content:none}@top-center{content:none}@top-right{content:none}@bottom-left{content:none}@bottom-right{content:none}}
+.cover{page:cover;break-after:page;width:210mm;height:297mm;position:relative;overflow:hidden;color:#fff;
+  background:radial-gradient(120mm 120mm at 150mm 110mm,rgba(249,115,22,.16),transparent 70%),linear-gradient(165deg,#0b2b28 0%,#061a18 55%,#03100f 100%)}
+.cover .map{position:absolute;left:0;bottom:0;width:210mm;height:140mm;opacity:.9}
+.cover .map svg{display:block;width:100%;height:100%}
+.cover .glow{position:absolute;right:-40mm;top:30mm;width:180mm;height:180mm;border-radius:50%;background:radial-gradient(circle,rgba(251,146,60,.42) 0%,rgba(249,115,22,.16) 38%,transparent 68%)}
+.cover .hero{position:absolute;right:-24mm;top:42mm;width:150mm;height:150mm;object-fit:contain;filter:drop-shadow(0 6mm 14mm rgba(0,0,0,.45))}
+.cover .top{position:relative;padding:16mm 18mm 0;display:flex;justify-content:space-between;align-items:center}
+.cover .word{font:700 11px var(--mono);letter-spacing:.42em;color:#fff}
+.cover .chips{display:flex;gap:6px}
+.chip{font:700 8.5px var(--mono);letter-spacing:.16em;padding:3px 8px;border-radius:2px;border:1px solid currentColor;text-transform:uppercase}
+.cover .tlp{color:#ffc000}.cover .auth{color:#9fd8d0}
+.cover .eyebrow{position:relative;font:500 8.5px var(--mono);letter-spacing:.22em;text-transform:uppercase;color:var(--aqua);margin:44mm 18mm 0;max-width:100mm}
+.cover h1{position:relative;font:800 44px/1.03 var(--body);letter-spacing:-.025em;margin:5mm 18mm 0;max-width:98mm;color:#fff;text-shadow:0 2px 12px rgba(0,0,0,.4)}
+.cover .sub{position:relative;font:400 12.5px/1.55 var(--body);color:#c3dcd8;margin:6mm 18mm 0;max-width:88mm}
+.cover .strip{position:absolute;left:18mm;right:18mm;bottom:52mm;display:grid;grid-template-columns:repeat(4,1fr);gap:4mm}
+.cover .strip div{border-top:2px solid var(--aqua);padding-top:2.5mm;background:linear-gradient(rgba(3,16,15,.72),rgba(3,16,15,.35));padding:2.5mm 3mm 3mm}
+.cover .strip div.o{border-top-color:var(--orange)}
+.cover .strip b{display:block;font:800 24px/1.1 var(--body);letter-spacing:-.02em;color:#fff}
+.cover .strip span{font:500 7px/1.3 var(--mono);letter-spacing:.14em;text-transform:uppercase;color:#9fc4bf}
+.cover .cap{position:absolute;left:18mm;bottom:40mm;font:400 7px var(--mono);letter-spacing:.1em;text-transform:uppercase;color:#7fa9a3;margin:0}
+.cover .cap i{display:inline-block;width:7px;height:7px;margin:0 4px 0 10px;vertical-align:-1px;border-radius:1px}
+.cover .meta{position:absolute;left:18mm;right:18mm;bottom:13mm;display:grid;grid-template-columns:1.1fr 1.6fr 1.1fr .9fr;gap:6mm;padding-top:4mm;border-top:1px solid rgba(159,216,208,.35);margin:0}
+.cover .meta dt{font:500 7px var(--mono);letter-spacing:.16em;text-transform:uppercase;color:#7fa9a3;margin-bottom:2px}
+.cover .meta dd{margin:0;font:500 9.5px/1.45 var(--body);color:#fff;word-break:break-all}
+.toc{break-after:page}
+.toc ol{list-style:none;margin:6mm 0 0;padding:0}
+.toc a{display:flex;align-items:baseline;gap:8px;color:var(--ink);text-decoration:none;padding:7px 0;border-bottom:1px solid var(--line);font:500 11.5px var(--body)}
+.toc a .k{font:600 9px var(--mono);color:var(--teal);width:22px}
+.toc a::after{content:target-counter(attr(href),page);font:600 10px var(--mono);color:var(--teal);margin-left:auto}
+section{margin:0 0 9mm}
+h2{font:700 19px/1.15 var(--body);letter-spacing:-.01em;color:var(--deep);margin:0 0 3.5mm;break-after:avoid}
+h2::before{content:"";display:block;width:26px;height:4px;background:var(--teal);margin-bottom:3mm;border-radius:2px}
+h3{font:600 11px var(--body);color:var(--deep);margin:4mm 0 2mm;break-after:avoid}
+p{margin:0 0 2.5mm}.mut{color:var(--muted)}
+.lead{font-size:11px;color:var(--muted);max-width:150mm;margin-bottom:4mm}
+.kpis{display:grid;grid-template-columns:repeat(4,1fr);gap:3.5mm;margin:0 0 5mm}
+.kpi{border-top:3px solid var(--teal);background:var(--mist);padding:3mm 3.5mm 3.5mm;break-inside:avoid}
+.kpi .l{font:500 7px/1.3 var(--mono);letter-spacing:.12em;text-transform:uppercase;color:var(--muted)}
+.kpi .v{font:800 24px/1.1 var(--body);letter-spacing:-.02em;margin:1.5mm 0 1mm;color:var(--deep)}
+.kpi .d{font-size:8.5px;color:var(--muted)}
+.kpi.hi{border-top-color:#16a34a}.kpi.or{border-top-color:var(--orange)}
+.bar{display:flex;height:9px;border-radius:2px;overflow:hidden;background:var(--line);margin:1mm 0 2mm}
+.bar i{display:block;height:100%}
+.legend{display:flex;gap:12px;font:500 8px var(--mono);color:var(--muted);text-transform:uppercase;letter-spacing:.08em}
+.legend i{display:inline-block;width:8px;height:8px;border-radius:1px;margin-right:4px;vertical-align:-1px}
+.c-alta{background:#16a34a}.c-media{background:#d97706}.c-baixa{background:#dc2626}
+table{width:100%;border-collapse:collapse;margin:0 0 3mm}
+th,td{padding:4.5px 7px;text-align:left;vertical-align:top;font-size:8.8px;border-bottom:1px solid var(--line)}
+thead th{background:var(--deep);color:#fff;font:600 7.5px var(--mono);letter-spacing:.08em;text-transform:uppercase}
+tbody tr:nth-child(even) td{background:var(--mist)}
+tr{break-inside:avoid}
+td.n{text-align:right;font-variant-numeric:tabular-nums;white-space:nowrap}
+.mono{font-family:var(--mono);font-size:8px;word-break:break-all}
+.kv td:first-child{width:46mm;color:var(--muted);font:500 7.5px var(--mono);letter-spacing:.1em;text-transform:uppercase;padding-top:6px}
+.kv td{font-size:9.5px}
+.hashes div{white-space:nowrap}.hashes b{display:inline-block;width:46px;font:600 7px var(--mono);color:var(--muted);letter-spacing:.06em}
+.pill{display:inline-block;padding:0 7px;border-radius:99px;font-size:8px;font-weight:700;white-space:nowrap}
+.alta{background:#d7f5e0;color:#146c2e}.media{background:#fff0cf;color:#8a5a00}.baixa{background:#fde0e0;color:#a32121}
+.note{border-left:3px solid #d97706;background:#fff8e8;padding:3mm 4mm;margin:0 0 3mm;break-inside:avoid}
+.note b{display:block;font:600 7px var(--mono);letter-spacing:.14em;text-transform:uppercase;color:#8a5a00;margin-bottom:1mm}
+.note.info{border-left-color:var(--teal);background:var(--mist)}.note.info b{color:var(--teal)}
+.note.bad{border-left-color:#dc2626;background:#fdecec}.note.bad b{color:#a32121}
+@media screen{body{background:#4a5b59}.pagedjs_pages{padding:8mm 0}.pagedjs_page{background:#fff;margin:0 auto 8mm;box-shadow:0 4px 24px rgba(0,0,0,.35)}}
+@media print{body{background:#fff}}
+"#;
+
+pub fn html(r: &ReportInput) -> String {
+    let now = now_unix();
+    let s = summarize(r);
+    let version = env!("CARGO_PKG_VERSION");
+    let nf = |v: &str| {
+        if v.is_empty() {
+            "não informado".to_string()
+        } else {
+            esc(v)
+        }
+    };
+    let case_label = if r.case.case_id.is_empty() {
+        "sem número".to_string()
+    } else {
+        r.case.case_id.clone()
+    };
+    let foot = format!(
+        "Guará {version} · caso {} · gerado em {}",
+        case_label,
+        fmt_unix(now)
+    )
+    .replace(['"', '\\', '\n', '\r'], " ");
+    let mut o = String::with_capacity(PAGED_JS.len() + LOGO_PNG.len() * 2 + 64 * 1024);
+    o.push_str("<!doctype html><html lang=\"pt-BR\"><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\"><title>Guará: relatório de recuperação</title><style>");
+    o.push_str(
+        &CSS.replace("{{MARK}}", &b64(LOGO_MARK_PNG))
+            .replace("{{TLP}}", TLP)
+            .replace("{{FOOT}}", &foot),
+    );
+    o.push_str("</style></head><body>");
+
+    // ---------------------------------------------------------------- cover
+    let total = r.found.len();
+    o.push_str("<section class=\"cover\"><div class=\"map\">");
+    o.push_str(&sector_map_svg(&s.cells));
+    o.push_str("</div><div class=\"glow\"></div><img class=\"hero\" alt=\"Guará\" src=\"");
+    o.push_str(&logo_data_uri());
+    o.push_str("\"><div class=\"top\"><div class=\"word\">GUARÁ</div><div class=\"chips\"><span class=\"chip auth\">Uso autorizado</span><span class=\"chip tlp\">");
+    o.push_str(TLP);
+    o.push_str("</span></div></div><div class=\"eyebrow\">Ciberfauna · Recuperação forense de arquivos</div><h1>Relatório de recuperação de arquivos</h1>");
+    o.push_str(&format!(
+        "<p class=\"sub\">Exame somente leitura de <b>{}</b>: o que foi encontrado, o que foi recuperado e os hashes que provam a integridade de cada arquivo.</p>",
+        esc(short_target(r.target))
+    ));
+    o.push_str(&format!(
+        "<div class=\"strip\"><div><b>{total}</b><span>arquivos encontrados</span></div><div><b>{}</b><span>confiança alta</span></div><div class=\"o\"><b>{}</b><span>recuperados com hash</span></div><div class=\"o\"><b>{}</b><span>volume encontrado</span></div></div>",
+        s.conf[2],
+        s.recovered,
+        human(s.bytes)
+    ));
+    o.push_str("<p class=\"cap\">Mapa da origem: arquivos em ordem de posição no disco<i style=\"background:#2dd4bf\"></i>alta<i style=\"background:#f59e0b\"></i>média<i style=\"background:#f87171\"></i>baixa</p>");
+    o.push_str(&format!(
+        "<dl class=\"meta\"><div><dt>Emissão</dt><dd>{}</dd></div><div><dt>Origem</dt><dd>{}</dd></div><div><dt>Caso · Perito</dt><dd>{} · {}</dd></div><div><dt>Classificação</dt><dd>{TLP}</dd></div></dl></section>",
+        fmt_unix(now),
+        esc(short_target(r.target)),
+        esc(&case_label),
+        nf(&r.case.examiner)
+    ));
+
+    // ---------------------------------------------------------------- TOC
+    let mut toc: Vec<(&str, &str)> = vec![
+        ("resumo", "Resumo dos achados"),
+        ("caso", "Identificação do caso"),
+        ("origem", "Origem examinada"),
+    ];
+    if r.audit.is_some() {
+        toc.push(("auditoria", "Trilha de auditoria"));
+    }
+    if r.layout.is_some() {
+        toc.push(("particoes", "Partições"));
+    }
+    if !r.recoveries.is_empty() {
+        toc.push(("recuperados", "Arquivos recuperados (integridade)"));
+    }
+    toc.push(("relacao", "Relação de arquivos encontrados"));
+    o.push_str("<section class=\"toc\"><h2>Sumário</h2><ol>");
+    for (i, (id, t)) in toc.iter().enumerate() {
+        o.push_str(&format!(
+            "<li><a href=\"#{id}\"><span class=\"k\">{:02}</span>{t}</a></li>",
+            i + 1
+        ));
+    }
+    o.push_str(&format!(
+        "</ol><p class=\"mut\" style=\"margin-top:8mm\">Gerado pelo Guará {version} em {}. {CLOSING}</p></section>",
+        fmt_unix(now)
+    ));
+
+    // ---------------------------------------------------------------- summary
+    let pct = |n: usize| {
+        if total == 0 {
+            0.0
+        } else {
+            n as f64 * 100.0 / total as f64
+        }
+    };
+    o.push_str("<section id=\"resumo\"><h2>Resumo dos achados</h2>");
+    o.push_str(&format!(
+        "<p class=\"lead\">Arquivos encontrados: <b>{total}</b> ({}). A confiança indica a chance de o conteúdo estar íntegro.</p>",
+        human(s.bytes)
+    ));
+    o.push_str(&format!(
+        "<div class=\"kpis\"><div class=\"kpi\"><div class=\"l\">Encontrados</div><div class=\"v\">{total}</div><div class=\"d\">{}</div></div><div class=\"kpi hi\"><div class=\"l\">Confiança alta</div><div class=\"v\">{}</div><div class=\"d\">{:.0}% do total</div></div><div class=\"kpi or\"><div class=\"l\">Recuperados</div><div class=\"v\">{}</div><div class=\"d\">{} com hash</div></div><div class=\"kpi\"><div class=\"l\">Duração</div><div class=\"v\">{:.1} s</div><div class=\"d\">varredura {}</div></div></div>",
+        human(s.bytes),
+        s.conf[2],
+        pct(s.conf[2]),
+        s.recovered,
+        human(s.recovered_bytes),
+        r.elapsed,
+        if r.options.mode == ScanMode::Deep { "profunda" } else { "rápida" }
+    ));
+    o.push_str("<h3>Confiança</h3><div class=\"bar\">");
+    for (n, c) in [
+        (s.conf[2], "c-alta"),
+        (s.conf[1], "c-media"),
+        (s.conf[0], "c-baixa"),
+    ] {
+        if n > 0 {
+            o.push_str(&format!(
+                "<i class=\"{c}\" style=\"width:{:.2}%\"></i>",
+                pct(n)
+            ));
+        }
+    }
+    o.push_str(&format!(
+        "</div><div class=\"legend\"><span><i class=\"c-alta\"></i>alta {}</span><span><i class=\"c-media\"></i>média {}</span><span><i class=\"c-baixa\"></i>baixa {}</span></div>",
+        s.conf[2], s.conf[1], s.conf[0]
+    ));
+    o.push_str("<h3>Por tipo</h3><table><thead><tr><th>Tipo</th><th style=\"text-align:right\">Arquivos</th><th style=\"text-align:right\">Proporção</th></tr></thead><tbody>");
+    for (k, v) in &s.by_cat {
+        o.push_str(&format!(
+            "<tr><td>{k}</td><td class=\"n\">{v}</td><td class=\"n\">{:.1}%</td></tr>",
+            pct(*v)
+        ));
+    }
+    o.push_str("</tbody></table>");
+    for w in r.warnings {
+        o.push_str(&format!("<div class=\"note\"><b>Aviso</b>{}</div>", esc(w)));
+    }
+    o.push_str("</section>");
+
+    // ---------------------------------------------------------------- case
+    o.push_str("<section id=\"caso\"><h2>Identificação do caso</h2><table class=\"kv\"><tbody>");
     for (k, v) in [
         ("Número do caso", &r.case.case_id),
         ("Responsável pelo exame", &r.case.examiner),
         ("Organização", &r.case.organization),
     ] {
-        o.push_str(&format!(
+        o.push_str(&format!("<tr><td>{k}</td><td>{}</td></tr>", nf(v)));
-            "<tr><td>{k}</td><td>{}</td></tr>",
-            esc(if v.is_empty() { "não informado" } else { v })
-        ));
     }
     if !r.case.notes.is_empty() {
         o.push_str(&format!(
@@ -166,9 +496,12 @@ footer{margin-top:34px;color:#5b6f6d;font-size:12px}@media print{body{background
             esc(&r.case.notes).replace('\n', "<br>")
         ));
     }
-    o.push_str("</table>");
+    o.push_str(&format!(
+        "<tr><td>Classificação</td><td><span class=\"pill media\">{TLP}</span> uso autorizado; compartilhe só com quem precisa conhecer o caso</td></tr></tbody></table></section>"
+    ));
 
-    o.push_str("<h2>Origem examinada</h2><table class=\"kv\">");
+    // ---------------------------------------------------------------- source
+    o.push_str("<section id=\"origem\"><h2>Origem examinada</h2><table class=\"kv\"><tbody>");
     o.push_str(&format!(
         "<tr><td>Dispositivo / imagem</td><td class=\"mono\">{}</td></tr>",
         esc(r.target)
@@ -178,7 +511,7 @@ footer{margin-top:34px;color:#5b6f6d;font-size:12px}@media print{body{background
     }
     if let Some(h) = r.source_hashes {
         o.push_str(&format!(
-            "<tr><td>Hash da origem</td><td class=\"mono\">MD5 {}<br>SHA-1 {}<br>SHA-256 {}</td></tr>",
+            "<tr><td>Hash da origem</td><td class=\"mono hashes\"><div><b>MD5</b>{}</div><div><b>SHA-1</b>{}</div><div><b>SHA-256</b>{}</div></td></tr>",
             esc(&h.md5),
             esc(&h.sha1),
             esc(&h.sha256)
@@ -193,34 +526,26 @@ footer{margin-top:34px;color:#5b6f6d;font-size:12px}@media print{body{background
         ));
     }
     o.push_str(&format!(
-        "<tr><td>Duração da varredura</td><td>{:.1} s</td></tr><tr><td>Modo</td><td>{}{}</td></tr><tr><td>Garantia de leitura</td><td>A origem foi aberta somente para leitura; nenhuma escrita foi feita nela.</td></tr></table>",
+        "<tr><td>Duração da varredura</td><td>{:.1} s</td></tr><tr><td>Modo</td><td>{}</td></tr></tbody></table><div class=\"note info\"><b>Garantia de leitura</b>A origem foi aberta somente para leitura; nenhuma escrita foi feita nela.</div></section>",
         r.elapsed,
-        if r.options.mode == ScanMode::Deep { "profunda (metadados + assinatura)" } else { "rápida (metadados)" },
+        mode_label(r.options)
-        if r.options.include_allocated { ", incluindo áreas em uso" } else { "" }
     ));
 
+    // ---------------------------------------------------------------- audit
     if let Some(a) = &r.audit {
         o.push_str(&format!(
-            "<h2>Trilha de auditoria</h2><table class=\"kv\"><tr><td>Entradas</td><td>{}</td></tr><tr><td>Encadeamento</td><td>{}</td></tr><tr><td>Hash da última entrada</td><td class=\"mono\">{}</td></tr></table>",
+            "<section id=\"auditoria\"><h2>Trilha de auditoria</h2><table class=\"kv\"><tbody><tr><td>Entradas</td><td>{}</td></tr><tr><td>Encadeamento</td><td>{}</td></tr><tr><td>Hash da última entrada</td><td class=\"mono\">{}</td></tr></tbody></table>",
             a.entries,
-            if a.ok { "íntegro" } else { "QUEBRADO: confira com guara audit --verify" },
+            if a.ok { "<span class=\"pill alta\">íntegro</span>" } else { "<span class=\"pill baixa\">QUEBRADO: confira com guara audit --verify</span>" },
             esc(&a.head)
         ));
+        o.push_str("<div class=\"note info\"><b>Cadeia de custódia</b>Arquive o hash da última entrada fora desta máquina: ele permite provar depois que a trilha não foi alterada.</div></section>");
     }
 
+    // ---------------------------------------------------------------- partitions
     if let Some(l) = r.layout {
-        o.push_str("<h2>Partições</h2><table><tr><th>#</th><th>Sistema</th><th>Início (bytes)</th><th>Tamanho</th><th>Rótulo</th><th>Observação</th></tr>");
+        o.push_str("<section id=\"particoes\"><h2>Partições</h2><table><thead><tr><th>#</th><th>Sistema</th><th style=\"text-align:right\">Início (bytes)</th><th style=\"text-align:right\">Tamanho</th><th>Rótulo</th><th>Observação</th></tr></thead><tbody>");
         for p in &l.partitions {
-            let obs = [
-                p.lost.then_some("encontrada por varredura".to_string()),
-                p.encrypted
-                    .as_ref()
-                    .map(|e| format!("cifrada ({e}), não examinada")),
-            ]
-            .into_iter()
-            .flatten()
-            .collect::<Vec<_>>()
-            .join("; ");
             o.push_str(&format!(
                 "<tr><td>{}</td><td>{}</td><td class=\"n\">{}</td><td class=\"n\">{}</td><td>{}</td><td>{}</td></tr>",
                 p.index + 1,
@@ -228,43 +553,18 @@ footer{margin-top:34px;color:#5b6f6d;font-size:12px}@media print{body{background
                 p.start,
                 human(p.len),
                 esc(p.label.as_deref().unwrap_or("")),
-                esc(&obs)
+                esc(&partition_obs(p))
             ));
         }
         for g in &l.gaps {
             o.push_str(&format!("<tr><td>-</td><td>espaço não particionado</td><td class=\"n\">{}</td><td class=\"n\">{}</td><td></td><td></td></tr>", g.start, human(g.len)));
         }
-        o.push_str("</table>");
+        o.push_str("</tbody></table></section>");
-    }
-
-    // Summary
-    let mut by_cat = std::collections::BTreeMap::new();
-    let mut conf = [0usize; 3];
-    let mut bytes = 0u64;
-    for f in r.found {
-        *by_cat.entry(f.category.label_pt()).or_insert(0usize) += 1;
-        conf[f.confidence as usize] += 1;
-        bytes += f.size;
-    }
-    o.push_str(&format!("<h2>Resumo dos achados</h2><table class=\"kv\"><tr><td>Arquivos encontrados</td><td><b>{}</b> ({})</td></tr>", r.found.len(), human(bytes)));
-    o.push_str(&format!(
-        "<tr><td>Confiança</td><td><span class=\"pill alta\">alta {}</span> <span class=\"pill media\">média {}</span> <span class=\"pill baixa\">baixa {}</span></td></tr>",
-        conf[2], conf[1], conf[0]
-    ));
-    o.push_str(&format!(
-        "<tr><td>Por tipo</td><td>{}</td></tr></table>",
-        by_cat
-            .iter()
-            .map(|(k, v)| format!("{k}: {v}"))
-            .collect::<Vec<_>>()
-            .join(" · ")
-    ));
-    for w in r.warnings {
-        o.push_str(&format!("<div class=\"note\">{}</div>", esc(w)));
     }
 
+    // ---------------------------------------------------------------- recoveries
     if !r.recoveries.is_empty() {
-        o.push_str("<h2>Arquivos recuperados (integridade)</h2>");
+        o.push_str("<section id=\"recuperados\"><h2>Arquivos recuperados (integridade)</h2>");
         for rec in r.recoveries {
             o.push_str(&format!(
                 "<p>Destino: <span class=\"mono\">{}</span>, {} arquivo(s), {}{}</p>",
@@ -277,10 +577,10 @@ footer{margin-top:34px;color:#5b6f6d;font-size:12px}@media print{body{background
                     format!(", {} falha(s)", rec.failed.len())
                 }
             ));
-            o.push_str("<table><tr><th>Arquivo</th><th>Tamanho</th><th>Hashes</th></tr>");
+            o.push_str("<table><thead><tr><th>Arquivo</th><th style=\"text-align:right\">Tamanho</th><th>Hashes</th></tr></thead><tbody>");
             for f in rec.recovered.iter().take(MAX_ROWS) {
                 o.push_str(&format!(
-                    "<tr><td class=\"mono\">{}</td><td class=\"n\">{}</td><td class=\"mono\">MD5 {}<br>SHA-1 {}<br>SHA-256 {}</td></tr>",
+                    "<tr><td class=\"mono\">{}</td><td class=\"n\">{}</td><td class=\"mono hashes\"><div><b>MD5</b>{}</div><div><b>SHA-1</b>{}</div><div><b>SHA-256</b>{}</div></td></tr>",
                     esc(&f.path),
                     human(f.size),
                     f.md5,
@@ -288,15 +588,17 @@ footer{margin-top:34px;color:#5b6f6d;font-size:12px}@media print{body{background
                     f.sha256
                 ));
             }
-            o.push_str("</table>");
+            o.push_str("</tbody></table>");
         }
+        o.push_str("</section>");
     }
 
-    o.push_str("<h2>Relação de arquivos encontrados</h2>");
+    // ---------------------------------------------------------------- findings
+    o.push_str("<section id=\"relacao\"><h2>Relação de arquivos encontrados</h2>");
     if r.found.len() > MAX_ROWS {
-        o.push_str(&format!("<div class=\"note\">Mostrando os primeiros {MAX_ROWS} de {}. Use a exportação CSV para a lista completa.</div>", r.found.len()));
+        o.push_str(&format!("<div class=\"note\"><b>Lista truncada</b>Mostrando os primeiros {MAX_ROWS} de {}. Use a exportação CSV para a lista completa.</div>", r.found.len()));
     }
-    o.push_str("<table><tr><th>Nome</th><th>Pasta</th><th>Tamanho</th><th>Modificado (UTC)</th><th>Criado (UTC)</th><th>Origem</th><th>Confiança</th><th>Posição no disco</th></tr>");
+    o.push_str("<table><thead><tr><th>Nome</th><th>Pasta</th><th style=\"text-align:right\">Tamanho</th><th>Modificado (UTC)</th><th>Criado (UTC)</th><th>Origem</th><th>Confiança</th><th style=\"text-align:right\">Posição no disco</th></tr></thead><tbody>");
     for f in r.found.iter().take(MAX_ROWS) {
         let (cl, cc) = match f.confidence {
             Confidence::High => ("alta", "alta"),
@@ -314,27 +616,134 @@ footer{margin-top:34px;color:#5b6f6d;font-size:12px}@media print{body{background
             f.first_offset().map(|o| o.to_string()).unwrap_or_default()
         ));
     }
-    o.push_str("</table><footer>Este relatório descreve o que o Guará encontrou e recuperou. Arquivos de confiança baixa podem estar incompletos ou sobrescritos. Datas dos metadados do sistema de arquivos estão em UTC. Guará é software livre, sem garantias.</footer></main></body></html>");
+    o.push_str(&format!(
+        "</tbody></table><div class=\"note info\"><b>Leitura</b>{CLOSING}</div></section>"
+    ));
+    o.push_str("<script>");
+    o.push_str(PAGED_JS);
+    o.push_str("</script></body></html>");
+    o
+}
+
+/// Last path component of the target (for the cover subtitle).
+fn short_target(t: &str) -> &str {
+    t.rsplit(['/', '\\']).find(|p| !p.is_empty()).unwrap_or(t)
+}
+
+/// Cover motif: a defrag-style map where each lit cell is a found file (in disk
+/// order), colored by confidence. It shows as a band between the subtitle and the
+/// headline strip and fades out before the numbers and the meta grid.
+fn sector_map_svg(cells: &[u8]) -> String {
+    let mut o = format!(
+        "<svg viewBox=\"0 0 {} {}\" preserveAspectRatio=\"none\" xmlns=\"http://www.w3.org/2000/svg\"><defs><linearGradient id=\"fade\" x1=\"0\" y1=\"0\" x2=\"0\" y2=\"1\"><stop offset=\"0\" stop-color=\"#fff\" stop-opacity=\"0\"/><stop offset=\".3\" stop-color=\"#fff\" stop-opacity=\"1\"/><stop offset=\".42\" stop-color=\"#fff\" stop-opacity=\"1\"/><stop offset=\".55\" stop-color=\"#fff\" stop-opacity=\"0\"/><stop offset=\"1\" stop-color=\"#fff\" stop-opacity=\"0\"/></linearGradient><mask id=\"m\"><rect width=\"100%\" height=\"100%\" fill=\"url(#fade)\"/></mask></defs><g mask=\"url(#m)\">",
+        MAP_COLS * 7,
+        MAP_ROWS * 7
+    );
+    for (i, c) in cells.iter().enumerate() {
+        // the map shows as a band above the headline strip and fades out before the
+        // numbers and the meta grid, so the white text stays legible
+        let (x, y) = ((i % MAP_COLS) * 7, (MAP_ROWS - 1 - i / MAP_COLS) * 7);
+        let fill = match c {
+            3 => "#2dd4bf\" fill-opacity=\".9",
+            2 => "#f59e0b\" fill-opacity=\".9",
+            1 => "#f87171\" fill-opacity=\".9",
+            _ => "#2dd4bf\" fill-opacity=\".07",
+        };
+        o.push_str(&format!(
+            "<rect x=\"{x}.5\" y=\"{y}.5\" width=\"6\" height=\"6\" rx=\".6\" fill=\"{fill}\"/>"
+        ));
+    }
+    o.push_str("</g></svg>");
     o
 }
 
 /// Generates an A4 PDF recovery report containing the same sections as the HTML report.
 pub fn pdf(r: &ReportInput) -> Vec<u8> {
-    use crate::pdf::{Col, Font, Pdf, BLACK, GRAY};
+    use crate::pdf::{Col, Font, Pdf, BLACK, GRAY, TEAL};
-    let now = std::time::SystemTime::now()
+    let now = now_unix();
-        .duration_since(std::time::UNIX_EPOCH)
-        .map(|d| d.as_secs() as i64)
-        .unwrap_or(0);
     let stamp = crate::audit::utc_iso(now);
     let version = env!("CARGO_PKG_VERSION");
+    let s = summarize(r);
+    let case_label = if r.case.case_id.is_empty() {
+        "sem número".to_string()
+    } else {
+        r.case.case_id.clone()
+    };
     let mut d = Pdf::new(
         "Guará: relatório de recuperação",
-        &format!("Guará {version}"),
+        &format!(
-    );
+            "Guará {version}  ·  caso {case_label}  ·  gerado em {}",
-    d.title(
+            fmt_unix(now)
-        "Relatório de recuperação de arquivos",
+        ),
-        &format!("Gerado pelo Guará {version} em {}", fmt_unix(now)),
     );
+    d.set_image(LOGO_COVER_JPG, LOGO_COVER_PX, LOGO_COVER_PX);
+    pdf_cover(&mut d, r, &s, &case_label, now);
+    d.running_header("GUARÁ  ·  RELATÓRIO DE RECUPERAÇÃO", &format!("• {TLP}"));
+
+    let total = r.found.len();
+    let pct = |n: usize| {
+        if total == 0 {
+            0.0
+        } else {
+            n as f64 * 100.0 / total as f64
+        }
+    };
+    d.heading("Resumo dos achados");
+    d.kpis(&[
+        ("Encontrados", total.to_string(), human(s.bytes), TEAL),
+        (
+            "Confiança alta",
+            s.conf[2].to_string(),
+            format!("{:.0}% do total", pct(s.conf[2])),
+            (0.086, 0.639, 0.290),
+        ),
+        (
+            "Recuperados",
+            s.recovered.to_string(),
+            format!("{} com hash", human(s.recovered_bytes)),
+            (0.976, 0.451, 0.086),
+        ),
+        (
+            "Duração",
+            format!("{:.1} s", r.elapsed),
+            format!(
+                "varredura {}",
+                if r.options.mode == ScanMode::Deep {
+                    "profunda"
+                } else {
+                    "rápida"
+                }
+            ),
+            TEAL,
+        ),
+    ]);
+    d.kv(&[
+        (
+            "Arquivos encontrados",
+            &format!("{} ({})", total, human(s.bytes)),
+            Font::Bold,
+        ),
+        (
+            "Confiança",
+            &format!(
+                "alta {}  ·  média {}  ·  baixa {}",
+                s.conf[2], s.conf[1], s.conf[0]
+            ),
+            Font::Regular,
+        ),
+        (
+            "Por tipo",
+            &s.by_cat
+                .iter()
+                .map(|(k, v)| format!("{k}: {v}"))
+                .collect::<Vec<_>>()
+                .join("  ·  "),
+            Font::Regular,
+        ),
+    ]);
+    for w in r.warnings {
+        d.note(w);
+    }
 
     let nf = |v: &str| {
         if v.is_empty() {
@@ -356,6 +765,11 @@ pub fn pdf(r: &ReportInput) -> Vec<u8> {
     if !r.case.notes.is_empty() {
         rows.push(("Observações", r.case.notes.clone(), Font::Regular));
     }
+    rows.push((
+        "Classificação",
+        format!("{TLP} (uso autorizado)"),
+        Font::Bold,
+    ));
     let rows: Vec<(&str, &str, Font)> = rows.iter().map(|(k, v, f)| (*k, v.as_str(), *f)).collect();
     d.kv(&rows);
 
@@ -390,23 +804,7 @@ pub fn pdf(r: &ReportInput) -> Vec<u8> {
         format!("{:.1} s", r.elapsed),
         Font::Regular,
     ));
-    rows.push((
+    rows.push(("Modo", mode_label(r.options), Font::Regular));
-        "Modo",
-        format!(
-            "{}{}",
-            if r.options.mode == ScanMode::Deep {
-                "profunda (metadados + assinatura)"
-            } else {
-                "rápida (metadados)"
-            },
-            if r.options.include_allocated {
-                ", incluindo áreas em uso"
-            } else {
-                ""
-            }
-        ),
-        Font::Regular,
-    ));
     rows.push((
         "Garantia de leitura",
         "A origem foi aberta somente para leitura; nenhuma escrita foi feita nela.".into(),
@@ -506,43 +904,6 @@ pub fn pdf(r: &ReportInput) -> Vec<u8> {
         d.table(&cols, &rows);
     }
 
-    let mut by_cat = std::collections::BTreeMap::new();
-    let mut conf = [0usize; 3];
-    let mut bytes = 0u64;
-    for f in r.found {
-        *by_cat.entry(f.category.label_pt()).or_insert(0usize) += 1;
-        conf[f.confidence as usize] += 1;
-        bytes += f.size;
-    }
-    d.heading("Resumo dos achados");
-    d.kv(&[
-        (
-            "Arquivos encontrados",
-            &format!("{} ({})", r.found.len(), human(bytes)),
-            Font::Bold,
-        ),
-        (
-            "Confiança",
-            &format!(
-                "alta {}  ·  média {}  ·  baixa {}",
-                conf[2], conf[1], conf[0]
-            ),
-            Font::Regular,
-        ),
-        (
-            "Por tipo",
-            &by_cat
-                .iter()
-                .map(|(k, v)| format!("{k}: {v}"))
-                .collect::<Vec<_>>()
-                .join("  ·  "),
-            Font::Regular,
-        ),
-    ]);
-    for w in r.warnings {
-        d.note(w);
-    }
-
     if !r.recoveries.is_empty() {
         d.heading("Arquivos recuperados (integridade)");
         for rec in r.recoveries {
@@ -667,11 +1028,169 @@ pub fn pdf(r: &ReportInput) -> Vec<u8> {
         })
         .collect();
     d.table(&cols, &rows);
-    d.paragraph(
+    d.paragraph(CLOSING, 8.0, Font::Regular, GRAY);
-        "Este relatório descreve o que o Guará encontrou e recuperou. Arquivos de confiança baixa podem estar incompletos ou sobrescritos. Datas dos metadados do sistema de arquivos estão em UTC. Guará é software livre, sem garantias.",
-        8.0,
-        Font::Regular,
-        GRAY,
-    );
     d.finish(&stamp.replace(['-', ':', 'T', 'Z'], ""))
 }
+
+/// Full-bleed PDF cover: deep teal page, glowing logo bleeding off the right
+/// edge, sector-map motif, headline strip and meta grid (mirrors the HTML cover).
+fn pdf_cover(d: &mut crate::pdf::Pdf, r: &ReportInput, s: &Summary, case: &str, now: i64) {
+    use crate::pdf::{Font, Pdf};
+    let (w, h) = Pdf::SIZE;
+    let mm = 72.0 / 25.4;
+    // background must equal the JPEG's flat background so the logo blends in
+    let bg = (7.0 / 255.0, 26.0 / 255.0, 25.0 / 255.0);
+    let mix = |c: (f64, f64, f64), a: f64| {
+        (
+            bg.0 + (c.0 - bg.0) * a,
+            bg.1 + (c.1 - bg.1) * a,
+            bg.2 + (c.2 - bg.2) * a,
+        )
+    };
+    d.rect(0.0, 0.0, w, h, bg);
+    // sector map: bottom 140 mm, fading toward the top
+    let cell = w / MAP_COLS as f64;
+    for (i, c) in s.cells.iter().enumerate() {
+        let (col, row) = (i % MAP_COLS, i / MAP_COLS);
+        // a band above the headline strip, gone behind the text. Unlike the HTML, it
+        // starts below the logo: the cover JPEG is opaque and would cut the map with a
+        // hard edge
+        let t = 1.0 - (row as f64 + 0.5) / MAP_ROWS as f64;
+        let fade = if t < 0.345 {
+            0.0
+        } else if t < 0.45 {
+            1.0
+        } else if t < 0.55 {
+            ((0.55 - t) / 0.1).sqrt()
+        } else {
+            0.0
+        };
+        let (color, a) = match c {
+            3 => ((0.176, 0.831, 0.749), 0.85),
+            2 => ((0.961, 0.620, 0.043), 0.85),
+            1 => ((0.973, 0.443, 0.443), 0.85),
+            _ => ((0.176, 0.831, 0.749), 0.08),
+        };
+        let y = row as f64 * cell;
+        d.rect(
+            col as f64 * cell + 0.6,
+            y + 0.6,
+            cell - 1.2,
+            cell - 1.2,
+            mix(color, a * fade * fade),
+        );
+    }
+    // hero logo, bleeding off the right edge
+    let lw = 165.0 * mm;
+    d.image(w - lw + 26.0 * mm, h - 40.0 * mm - lw, lw, lw);
+    let white = (1.0, 1.0, 1.0);
+    let aqua = (0.176, 0.831, 0.749);
+    let soft = (0.62, 0.77, 0.75);
+    let x0 = 18.0 * mm;
+    // top bar: wordmark + chips
+    d.put(x0, h - 20.0 * mm, "G U A R Á", 11.0, Font::Bold, white);
+    let tlp_w = crate::pdf::text_width(TLP, 8.0, Font::Mono) + 12.0;
+    let tx = w - x0 - tlp_w;
+    let chip = |d: &mut Pdf, x: f64, wd: f64, label: &str, c: (f64, f64, f64)| {
+        let y = h - 21.5 * mm;
+        d.rect(x, y, wd, 0.8, c);
+        d.rect(x, y + 14.0, wd, 0.8, c);
+        d.rect(x, y, 0.8, 14.8, c);
+        d.rect(x + wd - 0.8, y, 0.8, 14.8, c);
+        d.put(x + 6.0, y + 4.5, label, 8.0, Font::Mono, c);
+    };
+    chip(d, tx, tlp_w, TLP, (1.0, 0.753, 0.0));
+    let auth = "USO AUTORIZADO";
+    let aw = crate::pdf::text_width(auth, 8.0, Font::Mono) + 12.0;
+    chip(d, tx - aw - 6.0, aw, auth, (0.62, 0.85, 0.82));
+    // eyebrow, title, subtitle
+    d.put(
+        x0,
+        h - 72.0 * mm,
+        "CIBERFAUNA  ·  RECUPERAÇÃO FORENSE DE ARQUIVOS",
+        8.0,
+        Font::Mono,
+        aqua,
+    );
+    for (i, l) in ["Relatório de", "recuperação", "de arquivos"]
+        .iter()
+        .enumerate()
+    {
+        d.put(
+            x0,
+            h - 88.0 * mm - i as f64 * 38.0,
+            l,
+            36.0,
+            Font::Bold,
+            white,
+        );
+    }
+    let sub = format!(
+        "Exame somente leitura de {}: o que foi encontrado, o que foi recuperado e os hashes que provam a integridade de cada arquivo.",
+        short_target(r.target)
+    );
+    for (i, l) in crate::pdf::wrap(&sub, 11.0, Font::Regular, 88.0 * mm)
+        .iter()
+        .enumerate()
+    {
+        d.put(
+            x0,
+            h - 136.0 * mm - i as f64 * 16.0,
+            l,
+            11.0,
+            Font::Regular,
+            soft,
+        );
+    }
+    // headline strip
+    let sw = (w - 2.0 * x0 - 3.0 * 4.0 * mm) / 4.0;
+    let sy = 52.0 * mm;
+    let orange = (0.976, 0.451, 0.086);
+    for (i, (v, l, c)) in [
+        (r.found.len().to_string(), "ARQUIVOS ENCONTRADOS", aqua),
+        (s.conf[2].to_string(), "CONFIANÇA ALTA", aqua),
+        (s.recovered.to_string(), "RECUPERADOS COM HASH", orange),
+        (human(s.bytes), "VOLUME ENCONTRADO", orange),
+    ]
+    .iter()
+    .enumerate()
+    {
+        let x = x0 + i as f64 * (sw + 4.0 * mm);
+        d.rect(x, sy, sw, 50.0, (0.012, 0.063, 0.059));
+        d.rect(x, sy + 48.5, sw, 1.5, *c);
+        d.put(x + 8.0, sy + 22.0, v, 20.0, Font::Bold, white);
+        d.put(x + 8.0, sy + 9.0, l, 6.5, Font::Mono, soft);
+    }
+    // meta grid over a hairline
+    let my = 16.0 * mm;
+    d.rect(x0, my + 28.0, w - 2.0 * x0, 0.6, (0.33, 0.48, 0.46));
+    let cols = [
+        ("EMISSÃO", fmt_unix(now), 0.0),
+        ("ORIGEM", short_target(r.target).to_string(), 0.22),
+        (
+            "CASO  ·  PERITO",
+            format!(
+                "{case}  ·  {}",
+                if r.case.examiner.is_empty() {
+                    "não informado"
+                } else {
+                    &r.case.examiner
+                }
+            ),
+            0.55,
+        ),
+        ("CLASSIFICAÇÃO", TLP.to_string(), 0.82),
+    ];
+    let span = w - 2.0 * x0;
+    for (i, (k, v, f)) in cols.iter().enumerate() {
+        let x = x0 + span * f;
+        let next = cols.get(i + 1).map(|c| c.2).unwrap_or(1.0);
+        let cw = span * (next - f) - 10.0;
+        d.put(x, my + 16.0, k, 6.5, Font::Mono, (0.50, 0.66, 0.64));
+        let line = crate::pdf::wrap(v, 8.5, Font::Regular, cw);
+        for (j, l) in line.iter().take(2).enumerate() {
+            d.put(x, my + 4.0 - j as f64 * 11.0, l, 8.5, Font::Regular, white);
+        }
+    }
+    d.end_cover();
+}

crates/guara-core/src/scan.rs

@@ -235,7 +235,12 @@ pub fn run(
             return Outcome::Interrupted(cp);
         }
     }
-    handler.rebuild_pending();
+    if !handler.rebuild_pending(cancelled) {
+        // Paused/stopped during reassembly: the truncated candidates were already reported,
+        // and on resume (all ranges done) the scan finishes without redoing them.
+        cp.next_id = next_id.load(std::sync::atomic::Ordering::Relaxed);
+        return Outcome::Interrupted(cp);
+    }
     Outcome::Completed
 }
 
@@ -306,9 +311,13 @@ impl Handler<'_> {
         self.sink.replace(f);
     }
 
-    fn rebuild_pending(&mut self) {
+    /// Reassembles queued fragmented files. Returns `false` if cancelled part-way.
+    fn rebuild_pending(&mut self, cancelled: &(dyn Fn() -> bool + Sync)) -> bool {
         let pend = std::mem::take(&mut self.pending);
         for p in pend {
+            if cancelled() {
+                return false;
+            }
             let off = p.found.first_offset().unwrap_or(0);
             if p.mp4 {
                 self.rebuild_mp4(p, off);
@@ -339,6 +348,7 @@ impl Handler<'_> {
                 self.sink.replace(f);
             }
         }
+        true
     }
 }
 

crates/guara-core/src/service.rs

@@ -336,6 +336,7 @@ impl Engine {
             "error": s.error,
             "report": s.report,
             "elapsed": elapsed,
+            "stopping": s.status == Status::Running && j.cancelled(),
             "source": j.source().is_some(),
             "source_path": j.src_path.lock().unwrap().clone(),
             "session_file": j.session_file.lock().unwrap().as_ref().map(|p| p.to_string_lossy().to_string()),
@@ -359,6 +360,13 @@ impl Engine {
         Ok(json!({ "total": total, "items": page }))
     }
 
+    /// One level of the folder tree (see [`crate::explorer::browse`]).
+    pub fn browse(&self, id: &str, path: &str, q: &Query) -> Result<Value> {
+        let j = self.job(id)?;
+        let s = j.st.lock().unwrap();
+        Ok(crate::explorer::browse(&s.found, path, q))
+    }
+
     /// Sidebar navigation facet counts (categories, dates, folders, cameras).
     pub fn facets(&self, id: &str) -> Result<Value> {
         let j = self.job(id)?;
@@ -463,6 +471,7 @@ impl Engine {
         scan_id: &str,
         ids: Option<Vec<u64>>,
         filter: Option<Query>,
+        selection: Option<crate::explorer::Selection>,
         dest: &str,
         layout: recover::RecoverLayout,
     ) -> Result<String> {
@@ -470,6 +479,12 @@ impl Engine {
         let src = sj.source().ok_or_else(no_source)?;
         let files: Vec<Found> = {
             let s = sj.st.lock().unwrap();
+            if let Some(sel) = &selection {
+                crate::explorer::resolve_selection(&s.found, sel)
+                    .into_iter()
+                    .cloned()
+                    .collect()
+            } else {
                 match (&ids, &filter) {
                     (Some(ids), _) => ids
                         .iter()
@@ -478,7 +493,11 @@ impl Engine {
                     (None, Some(q)) => q.select(&s.found).into_iter().cloned().collect(),
                     (None, None) => s.found.clone(),
                 }
+            }
         };
+        let roots = selection
+            .as_ref()
+            .map(|sel| recover::SelectionRoots::new(&sel.folders));
         if files.is_empty() {
             return Err(Error::msg("nenhum arquivo selecionado"));
         }
@@ -526,11 +545,12 @@ impl Engine {
                 };
             };
             let refs: Vec<&Found> = files.iter().collect();
-            let res = recover::recover_resumable(
+            let res = recover::recover_resumable_with(
                 src.as_ref(),
                 &refs,
                 &dest_path,
                 layout,
+                roots.as_ref(),
                 &source_key,
                 true,
                 &cancelled,
@@ -1079,11 +1099,78 @@ impl Engine {
                 "só sessões automáticas podem ser apagadas por aqui",
             ));
         }
+        let running = self.jobs.lock().unwrap().values().any(|j| {
+            j.session_file.lock().unwrap().as_deref() == Some(p)
+                && j.st.lock().unwrap().status == Status::Running
+        });
+        if running {
+            return Err(Error::msg(
+                "esta varredura ainda está em andamento; pause ou pare antes de apagar a sessão",
+            ));
+        }
         let _ = std::fs::remove_file(p.with_extension("meta.json"));
         std::fs::remove_file(p)?;
         Ok(())
     }
 
+    /// `true` if an open job (scanning, paused, or loaded) still autosaves to this file.
+    fn session_in_use(&self, p: &Path) -> bool {
+        self.jobs
+            .lock()
+            .unwrap()
+            .values()
+            .any(|j| j.session_file.lock().unwrap().as_deref() == Some(p))
+    }
+
+    /// Deletes autosaved sessions older than `days` (`None` = the configured retention;
+    /// `Some(0)` = all of them). Sessions held by open jobs are always kept.
+    /// Returns how many were removed.
+    pub fn sessions_prune(&self, days: Option<u32>) -> usize {
+        let days = match days {
+            Some(d) => d,
+            None => match crate::settings::load().session_retention_days {
+                0 => return 0, // retention disabled: keep everything
+                d => d,
+            },
+        };
+        let dir = sessions_dir();
+        let now = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .map(|d| d.as_secs() as i64)
+            .unwrap_or(0);
+        let cutoff = now - days as i64 * 86_400;
+        let mut removed = 0;
+        let Ok(rd) = std::fs::read_dir(&dir) else {
+            return 0;
+        };
+        for e in rd.flatten() {
+            let path = e.path();
+            let name = e.file_name().to_string_lossy().to_string();
+            if !name.ends_with(".json") || name.ends_with(".meta.json") {
+                continue;
+            }
+            let saved_at = std::fs::read(path.with_extension("meta.json"))
+                .ok()
+                .and_then(|b| serde_json::from_slice::<Value>(&b).ok())
+                .and_then(|v| v["saved_at"].as_i64())
+                .or_else(|| {
+                    e.metadata()
+                        .and_then(|m| m.modified())
+                        .ok()
+                        .and_then(|t| t.duration_since(std::time::UNIX_EPOCH).ok())
+                        .map(|d| d.as_secs() as i64)
+                })
+                .unwrap_or(now);
+            if saved_at <= cutoff && !self.session_in_use(&path) {
+                let _ = std::fs::remove_file(path.with_extension("meta.json"));
+                if std::fs::remove_file(&path).is_ok() {
+                    removed += 1;
+                }
+            }
+        }
+        removed
+    }
+
     // ---------------------------------------------------------------- RPC
 
     pub fn rpc(&self, method: &str, p: Value) -> Result<Value> {
@@ -1232,6 +1319,28 @@ impl Engine {
                     .and_then(|v| v.as_u64())
                     .ok_or_else(|| Error::msg("id ausente"))?
             )?),
+            "browse" => {
+                let q: Query = p
+                    .get("query")
+                    .cloned()
+                    .filter(|v| !v.is_null())
+                    .map(serde_json::from_value)
+                    .transpose()?
+                    .unwrap_or_default();
+                let path = p.get("path").and_then(|v| v.as_str()).unwrap_or("");
+                self.browse(&s("job")?, path, &q)?
+            }
+            "selection_count" => {
+                let sel: crate::explorer::Selection = p
+                    .get("selection")
+                    .cloned()
+                    .map(serde_json::from_value)
+                    .transpose()?
+                    .unwrap_or_default();
+                let j = self.job(&s("job")?)?;
+                let st = j.st.lock().unwrap();
+                crate::explorer::selection_count(&st.found, &sel)
+            }
             "results" => {
                 let q: Query = p
                     .get("query")
@@ -1265,7 +1374,13 @@ impl Engine {
                     .and_then(|v| v.as_str())
                     .and_then(recover::RecoverLayout::parse)
                     .unwrap_or_default();
-                json!({ "job": self.start_recover(&s("job")?, ids, filter, &s("dest")?, layout)? })
+                let selection: Option<crate::explorer::Selection> = p
+                    .get("selection")
+                    .cloned()
+                    .filter(|v| !v.is_null())
+                    .map(serde_json::from_value)
+                    .transpose()?;
+                json!({ "job": self.start_recover(&s("job")?, ids, filter, selection, &s("dest")?, layout)? })
             }
             "image_start" => {
                 let format: image::ImageFormat = p
@@ -1295,6 +1410,10 @@ impl Engine {
                 self.session_delete(&s("path")?)?;
                 json!({})
             }
+            "sessions_prune" => {
+                let all = p.get("all").and_then(|v| v.as_bool()) == Some(true);
+                json!({ "removed": self.sessions_prune(if all { Some(0) } else { None }) })
+            }
             "session_load" => json!({ "job": self.load_session(&s("path")?)? }),
             "defaults" => {
                 let home = crate::owner::user_home().to_string_lossy().to_string();
@@ -1323,6 +1442,17 @@ impl Engine {
         let exe = std::env::current_exe()?;
         crate::update::apply(&exe)
     }
+
+    pub fn update_apply_desktop<F>(
+        &self,
+        current_exe: &std::path::Path,
+        on_progress: F,
+    ) -> Result<String>
+    where
+        F: Fn(&str),
+    {
+        crate::update::apply_desktop_with_progress(current_exe, on_progress)
+    }
 }
 
 pub use crate::explorer::Query;

crates/guara-core/src/settings.rs

@@ -27,6 +27,9 @@ pub struct Settings {
     /// without sending any telemetry).
     #[serde(default = "yes")]
     pub updates: bool,
+    /// Autosaved sessions older than this many days are deleted on startup (`0` = keep forever).
+    #[serde(default)]
+    pub session_retention_days: u32,
 }
 
 fn auto() -> String {
@@ -46,6 +49,7 @@ impl Default for Settings {
             notify: true,
             maps: false,
             updates: true,
+            session_retention_days: 0,
         }
     }
 }

crates/guara-core/src/types.rs

@@ -510,3 +510,40 @@ impl Default for ScanOptions {
         }
     }
 }
+
+#[cfg(test)]
+impl Found {
+    /// Minimal resident file for unit tests: `dir` `""` means the volume root.
+    pub(crate) fn test_file(id: u64, dir: &str, name: &str, size: u64) -> Self {
+        let ext = name.rsplit('.').next().unwrap_or("").to_lowercase();
+        Found {
+            id,
+            name: name.into(),
+            dir: Some(dir.into()),
+            category: crate::signatures::category_for_ext(&ext),
+            ext,
+            size,
+            origin: Origin::Fat,
+            confidence: Confidence::High,
+            data: DataLoc::Resident { bytes: Vec::new() },
+            modified: None,
+            created: None,
+            accessed: None,
+            taken: None,
+            camera: None,
+            px: None,
+            gps: false,
+            sig: None,
+            note: None,
+        }
+    }
+
+    /// The same, found by signature (no folder).
+    pub(crate) fn test_carved(id: u64, name: &str, size: u64) -> Self {
+        Found {
+            dir: None,
+            origin: Origin::Carved,
+            ..Self::test_file(id, "", name, size)
+        }
+    }
+}

crates/guara-core/src/update.rs

@@ -9,15 +9,15 @@ use crate::error::{Error, Result};
 use serde::Deserialize;
 use sha2::{Digest, Sha256};
 use std::fs;
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
 use std::process::Command;
 
 /// Gitea `releases/latest` API endpoint (`tag_name`, `assets[].name`, `assets[].browser_download_url`).
 const LATEST_RELEASE_URL: &str =
-    "https://git.lucasrguerra.dev.br/api/v1/repos/lucasrguerra/guara/releases/latest";
+    "https://git.lucasrguerra.dev.br/api/v1/repos/ciberfauna/guara/releases/latest";
 
 /// Human-facing Gitea Releases page for desktop GUI users.
-const RELEASES_PAGE_URL: &str = "https://git.lucasrguerra.dev.br/lucasrguerra/guara/releases";
+const RELEASES_PAGE_URL: &str = "https://git.lucasrguerra.dev.br/ciberfauna/guara/releases";
 
 #[derive(Debug, Deserialize)]
 struct Release {
@@ -29,6 +29,8 @@ struct Release {
 struct Asset {
     name: String,
     browser_download_url: String,
+    #[serde(default)]
+    size: u64,
 }
 
 #[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
@@ -52,13 +54,25 @@ fn curl_text(url: &str) -> Result<String> {
     Ok(String::from_utf8_lossy(&out.stdout).into_owned())
 }
 
-fn curl_download(url: &str, dest: &PathBuf) -> Result<()> {
+/// Downloads `url` to `dest`, polling the file size to report `percent` (0-100) through
-    let status = Command::new("curl")
+/// `on_pct` while curl runs (no stderr parsing; `total` comes from the release asset size).
+fn curl_download(url: &str, dest: &Path, total: u64, on_pct: &dyn Fn(u8)) -> Result<()> {
+    let mut child = Command::new("curl")
         .args(["-fsSL", "-H", "User-Agent: guara-updater", "-o"])
         .arg(dest)
         .arg(url)
-        .status()
+        .spawn()
         .map_err(|e| Error::msg(format!("curl {url}: {e}")))?;
+    let status = loop {
+        if let Some(st) = child.try_wait().map_err(|e| Error::msg(e.to_string()))? {
+            break st;
+        }
+        let got = fs::metadata(dest).map(|m| m.len()).unwrap_or(0);
+        if let Some(pct) = got.saturating_mul(100).checked_div(total) {
+            on_pct(pct.min(100) as u8);
+        }
+        std::thread::sleep(std::time::Duration::from_millis(150));
+    };
     if !status.success() {
         return Err(Error::msg(format!("curl {url}: download falhou")));
     }
@@ -145,7 +159,7 @@ pub fn apply(current_exe: &PathBuf) -> Result<String> {
     let tmp_dir = std::env::temp_dir().join("guara-update");
     fs::create_dir_all(&tmp_dir)?;
     let archive_path = tmp_dir.join(&asset.name);
-    curl_download(&asset.browser_download_url, &archive_path)?;
+    curl_download(&asset.browser_download_url, &archive_path, 0, &|_| {})?;
 
     if let Some(checksum_asset) = checksum_asset {
         let expected = curl_text(&checksum_asset.browser_download_url)?;
@@ -223,6 +237,278 @@ fn find_binary(dir: &PathBuf) -> Result<PathBuf> {
     Err(Error::msg("binário não encontrado no pacote baixado"))
 }
 
+/// Desktop GUI installation type detected at runtime.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum DesktopInstall {
+    /// Linux AppImage: real filesystem path of the .AppImage file (from APPIMAGE env var).
+    AppImage(PathBuf),
+    /// Linux Debian package installed via dpkg: `current_exe` is reliable here.
+    Deb,
+    /// Windows NSIS installer: downloaded setup executable run with `/S`
+    /// (silent). Does not relaunch the app on its own — see the comment on
+    /// the `WindowsInstaller` apply path.
+    WindowsInstaller,
+}
+
+/// Detects the desktop installation type given an optional `APPIMAGE` environment
+/// variable value and the current executable path.
+pub fn detect_desktop_install_from(
+    appimage_env: Option<&std::ffi::OsStr>,
+    current_exe: &Path,
+) -> Result<DesktopInstall> {
+    #[cfg(windows)]
+    {
+        let _ = (appimage_env, current_exe);
+        Ok(DesktopInstall::WindowsInstaller)
+    }
+    #[cfg(target_os = "linux")]
+    {
+        if let Some(val) = appimage_env {
+            let path = PathBuf::from(val);
+            if path.is_file() {
+                return Ok(DesktopInstall::AppImage(path));
+            }
+        }
+        if current_exe.is_file()
+            && current_exe
+                .extension()
+                .and_then(|e| e.to_str())
+                .map(|e| e.eq_ignore_ascii_case("appimage"))
+                .unwrap_or(false)
+        {
+            return Ok(DesktopInstall::AppImage(current_exe.to_path_buf()));
+        }
+        Ok(DesktopInstall::Deb)
+    }
+    #[cfg(not(any(windows, target_os = "linux")))]
+    {
+        let _ = (appimage_env, current_exe);
+        Err(Error::msg(format!(
+            "automatic self-update is not supported on this platform; please download manually from {RELEASES_PAGE_URL}"
+        )))
+    }
+}
+
+/// Detects the desktop installation type using the live environment.
+pub fn detect_desktop_install() -> Result<DesktopInstall> {
+    let exe = std::env::current_exe()?;
+    detect_desktop_install_from(std::env::var_os("APPIMAGE").as_deref(), &exe)
+}
+
+/// Returns the expected release asset suffix for a desktop installation and CPU architecture.
+pub fn gui_asset_suffix_for(install: &DesktopInstall, arch: &str) -> Result<&'static str> {
+    match install {
+        DesktopInstall::AppImage(_) => match arch {
+            "x86_64" => Ok("_amd64.AppImage"),
+            "aarch64" => Ok("_aarch64.AppImage"),
+            other => Err(Error::msg(format!(
+                "unsupported architecture for AppImage: {other}"
+            ))),
+        },
+        DesktopInstall::Deb => match arch {
+            "x86_64" => Ok("_amd64.deb"),
+            "aarch64" => Ok("_arm64.deb"),
+            other => Err(Error::msg(format!(
+                "unsupported architecture for deb package: {other}"
+            ))),
+        },
+        DesktopInstall::WindowsInstaller => match arch {
+            "x86_64" => Ok("_x64-setup.exe"),
+            other => Err(Error::msg(format!(
+                "unsupported architecture for Windows installer: {other}"
+            ))),
+        },
+    }
+}
+
+/// Returns the expected release asset suffix for the current architecture.
+pub fn gui_asset_suffix(install: &DesktopInstall) -> Result<&'static str> {
+    gui_asset_suffix_for(install, std::env::consts::ARCH)
+}
+
+/// Downloads, verifies, and installs the latest desktop GUI release in place.
+pub fn apply_desktop(current_exe: &Path) -> Result<String> {
+    apply_desktop_with_progress(current_exe, |_| {})
+}
+
+/// Downloads, verifies, and installs the latest desktop GUI release in place,
+/// notifying the progress callback of phase transitions (`"downloading"`,
+/// `"verifying"`, `"installing"`, `"restarting"`).
+pub fn apply_desktop_with_progress<F>(current_exe: &Path, on_progress: F) -> Result<String>
+where
+    F: Fn(&str),
+{
+    let install =
+        detect_desktop_install_from(std::env::var_os("APPIMAGE").as_deref(), current_exe)?;
+    let body = curl_text(LATEST_RELEASE_URL)?;
+    let release: Release = serde_json::from_str(&body)?;
+
+    let suffix = gui_asset_suffix(&install)?;
+    let asset = release
+        .assets
+        .iter()
+        .find(|a| a.name.ends_with(suffix))
+        .ok_or_else(|| {
+            Error::msg(format!(
+                "no asset ending with `{suffix}` in release {}",
+                release.tag_name
+            ))
+        })?;
+    let checksum_asset = release
+        .assets
+        .iter()
+        .find(|a| a.name == format!("{}.sha256", asset.name));
+
+    let tmp_dir = std::env::temp_dir().join("guara-desktop-update");
+    fs::create_dir_all(&tmp_dir)?;
+    let download_path = tmp_dir.join(&asset.name);
+
+    on_progress("downloading");
+    curl_download(
+        &asset.browser_download_url,
+        &download_path,
+        asset.size,
+        &|pct| on_progress(&format!("downloading:{pct}")),
+    )?;
+
+    if let Some(checksum_asset) = checksum_asset {
+        on_progress("verifying");
+        let expected = curl_text(&checksum_asset.browser_download_url)?;
+        let expected_hash = expected
+            .split_whitespace()
+            .next()
+            .unwrap_or("")
+            .to_lowercase();
+        let data = fs::read(&download_path)?;
+        let mut hasher = Sha256::new();
+        hasher.update(&data);
+        let actual_hash: String = hasher
+            .finalize()
+            .iter()
+            .map(|b| format!("{b:02x}"))
+            .collect();
+        if actual_hash != expected_hash {
+            return Err(Error::msg(
+                "checksum SHA-256 não confere — atualização descartada",
+            ));
+        }
+    }
+
+    on_progress("installing");
+    match install {
+        DesktopInstall::AppImage(target_appimage) => {
+            #[cfg(target_os = "linux")]
+            {
+                let parent_dir = target_appimage.parent().unwrap_or_else(|| Path::new("."));
+                let temp_name = format!(
+                    ".{}.tmp-{}",
+                    target_appimage
+                        .file_name()
+                        .and_then(|n| n.to_str())
+                        .unwrap_or("appimage"),
+                    std::process::id()
+                );
+                let temp_file = parent_dir.join(temp_name);
+                fs::copy(&download_path, &temp_file)?;
+                #[cfg(unix)]
+                {
+                    use std::os::unix::fs::PermissionsExt;
+                    let mut perms = fs::metadata(&temp_file)?.permissions();
+                    perms.set_mode(0o755);
+                    fs::set_permissions(&temp_file, perms)?;
+                }
+                fs::rename(&temp_file, &target_appimage)?;
+                let _ = fs::remove_file(&download_path);
+
+                on_progress("restarting");
+                #[cfg(unix)]
+                {
+                    use std::os::unix::process::CommandExt;
+                    let err = Command::new(&target_appimage)
+                        .args(std::env::args().skip(1))
+                        .exec();
+                    return Err(Error::msg(format!("failed to relaunch AppImage: {err}")));
+                }
+            }
+            #[cfg(not(target_os = "linux"))]
+            {
+                let _ = (&target_appimage, &download_path);
+                return Err(Error::msg("AppImage updates are only supported on Linux"));
+            }
+        }
+        DesktopInstall::Deb => {
+            #[cfg(target_os = "linux")]
+            {
+                let status = Command::new("dpkg")
+                    .args(["-i"])
+                    .arg(&download_path)
+                    .status()
+                    .map_err(|e| Error::msg(format!("dpkg -i: {e}")))?;
+                if !status.success() {
+                    return Err(Error::msg(format!(
+                        "dpkg -i failed with exit code {:?}",
+                        status.code()
+                    )));
+                }
+                let _ = fs::remove_file(&download_path);
+
+                on_progress("restarting");
+                #[cfg(unix)]
+                {
+                    use std::os::unix::process::CommandExt;
+                    let err = Command::new(current_exe)
+                        .args(std::env::args().skip(1))
+                        .exec();
+                    return Err(Error::msg(format!("failed to relaunch updated app: {err}")));
+                }
+            }
+            #[cfg(not(target_os = "linux"))]
+            {
+                let _ = (&download_path, current_exe);
+                return Err(Error::msg("deb updates are only supported on Linux"));
+            }
+        }
+        DesktopInstall::WindowsInstaller => {
+            #[cfg(windows)]
+            {
+                // `/S` is the one NSIS silent-install switch with a documented,
+                // stable meaning. There is no standard NSIS or Tauri flag that
+                // makes a silent install relaunch the app afterwards — that was
+                // claimed in an earlier draft of this code and could not be
+                // verified against NSIS's or Tauri's documentation; passing an
+                // invented flag to a stock NSIS installer is silently ignored,
+                // not harmful, but also not a relaunch mechanism. Spawning
+                // detached and exiting immediately (instead of waiting on the
+                // child) also avoids a self-deadlock: if the installer's script
+                // waits for this process to close before it can overwrite the
+                // running .exe, blocking here on the installer's exit status
+                // would hang forever. The practical effect: the update installs
+                // silently, but the app does not reopen itself — the user needs
+                // to start it again. This needs real-world confirmation on
+                // Windows before relying on it; if testing shows the bundled
+                // NSIS template does support an explicit relaunch flag or step,
+                // wire it in here instead of this comment.
+                on_progress("restarting");
+                Command::new(&download_path)
+                    .arg("/S")
+                    .spawn()
+                    .map_err(|e| Error::msg(format!("failed to launch installer: {e}")))?;
+                std::process::exit(0);
+            }
+            #[cfg(not(windows))]
+            {
+                let _ = &download_path;
+                return Err(Error::msg(
+                    "Windows installer updates are only supported on Windows",
+                ));
+            }
+        }
+    }
+
+    #[allow(unreachable_code)]
+    Ok(release.tag_name)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -234,4 +520,70 @@ mod tests {
         let err = apply(&PathBuf::from("C:/Program Files/Guara/guara-gui.exe")).unwrap_err();
         assert!(err.to_string().contains(RELEASES_PAGE_URL), "{err}");
     }
+
+    #[test]
+    fn detect_desktop_install_variants() {
+        #[cfg(target_os = "linux")]
+        {
+            let temp_appimage =
+                std::env::temp_dir().join(format!("test-{}.AppImage", std::process::id()));
+            let _ = fs::write(&temp_appimage, b"dummy appimage");
+
+            let res = detect_desktop_install_from(
+                Some(temp_appimage.as_os_str()),
+                Path::new("/usr/bin/guara-gui"),
+            )
+            .unwrap();
+            assert_eq!(res, DesktopInstall::AppImage(temp_appimage.clone()));
+
+            let res_fallback = detect_desktop_install_from(None, &temp_appimage).unwrap();
+            assert_eq!(
+                res_fallback,
+                DesktopInstall::AppImage(temp_appimage.clone())
+            );
+
+            let _ = fs::remove_file(&temp_appimage);
+
+            let res_deb =
+                detect_desktop_install_from(None, Path::new("/usr/bin/guara-gui")).unwrap();
+            assert_eq!(res_deb, DesktopInstall::Deb);
+        }
+
+        #[cfg(windows)]
+        {
+            let res = detect_desktop_install_from(
+                None,
+                Path::new("C:/Program Files/Guara/guara-gui.exe"),
+            )
+            .unwrap();
+            assert_eq!(res, DesktopInstall::WindowsInstaller);
+        }
+    }
+
+    #[test]
+    fn gui_asset_suffix_matches_known_release_naming() {
+        let appimage = DesktopInstall::AppImage(PathBuf::from("/tmp/Guara.AppImage"));
+        assert_eq!(
+            gui_asset_suffix_for(&appimage, "x86_64").unwrap(),
+            "_amd64.AppImage"
+        );
+        assert_eq!(
+            gui_asset_suffix_for(&appimage, "aarch64").unwrap(),
+            "_aarch64.AppImage"
+        );
+
+        let deb = DesktopInstall::Deb;
+        assert_eq!(gui_asset_suffix_for(&deb, "x86_64").unwrap(), "_amd64.deb");
+        assert_eq!(gui_asset_suffix_for(&deb, "aarch64").unwrap(), "_arm64.deb");
+
+        let win = DesktopInstall::WindowsInstaller;
+        assert_eq!(
+            gui_asset_suffix_for(&win, "x86_64").unwrap(),
+            "_x64-setup.exe"
+        );
+
+        assert!(gui_asset_suffix_for(&appimage, "mips").is_err());
+        assert!(gui_asset_suffix_for(&deb, "riscv64").is_err());
+        assert!(gui_asset_suffix_for(&win, "arm").is_err());
+    }
 }

crates/guara-core/tests/disk.rs

@@ -381,6 +381,7 @@ fn sessao_da_v0_1_0_abre_e_funciona() {
             &job,
             None,
             Some(service::Query::default()),
+            None,
             out.path().to_str().unwrap(),
             recover::RecoverLayout::Folders,
         )
@@ -437,6 +438,7 @@ fn sessao_abre_sem_a_origem_e_pode_ser_reconectada() {
             &job,
             None,
             None,
+            None,
             out.path().to_str().unwrap(),
             recover::RecoverLayout::Folders,
         )
@@ -452,6 +454,7 @@ fn sessao_abre_sem_a_origem_e_pode_ser_reconectada() {
             &job,
             None,
             None,
+            None,
             out.path().to_str().unwrap(),
             recover::RecoverLayout::Folders,
         )
@@ -712,6 +715,7 @@ fn espaco_insuficiente_no_destino_e_avisado_antes_de_copiar() {
             &job,
             None,
             None,
+            None,
             out.path().to_str().unwrap(),
             recover::RecoverLayout::Folders,
         )
@@ -719,3 +723,121 @@ fn espaco_insuficiente_no_destino_e_avisado_antes_de_copiar() {
     assert!(e.to_string().contains("Espaço insuficiente"), "{e}");
     assert!(recover::free_space(out.path()).unwrap_or(0) > 0);
 }
+
+/// Folder browsing on FAT32 (deleted short names lose their first character,
+/// hence `_raia.jpg`): one level at a time, and recovering a marked folder
+/// recreates only that folder (plus single marked files at the root, minus the
+/// unmarked ones).
+#[test]
+fn navegacao_por_pastas_e_recuperacao_da_selecao() {
+    init();
+    let Some(dir) = fixtures() else { return };
+    let img = dir.join("fat32.img");
+    let eng = service::Engine::new();
+    let job = eng
+        .start_scan(img.to_str().unwrap(), ScanOptions::default())
+        .unwrap();
+    wait_done(&eng, &job);
+
+    let root = eng.browse(&job, "", &service::Query::default()).unwrap();
+    let folders: Vec<(String, u64)> = root["folders"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .filter(|f| f["path"] != "@carved")
+        .map(|f| {
+            (
+                f["path"].as_str().unwrap().to_string(),
+                f["files"].as_u64().unwrap(),
+            )
+        })
+        .collect();
+    assert!(folders.contains(&("Documentos".into(), 5)), "{folders:?}");
+    assert!(folders.contains(&("Fotos".into(), 2)), "{folders:?}");
+    let docs = eng
+        .browse(&job, "Documentos", &service::Query::default())
+        .unwrap();
+    assert_eq!(docs["folders"][0]["path"], "Documentos/Trabalho");
+    assert_eq!(docs["folders"][0]["files"], 3);
+
+    let all = eng
+        .results(
+            &job,
+            &service::Query {
+                limit: 5000,
+                ..Default::default()
+            },
+        )
+        .unwrap();
+    let id_of = |name: &str| {
+        all["items"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .find(|i| i["name"] == name && i["origin"] == "fat")
+            .unwrap_or_else(|| panic!("{name} not found"))["id"]
+            .as_u64()
+            .unwrap()
+    };
+    let selection = explorer::Selection {
+        folders: vec!["Documentos/Trabalho".into()],
+        ids: vec![id_of("_raia.jpg")],
+        exclude: vec![id_of("tese.docx")],
+        exclude_folders: vec![],
+    };
+    let out = tempfile::tempdir().unwrap();
+    let rj = eng
+        .start_recover(
+            &job,
+            None,
+            None,
+            Some(selection),
+            out.path().to_str().unwrap(),
+            recover::RecoverLayout::Folders,
+        )
+        .unwrap();
+    wait_done(&eng, &rj);
+    let got = hashes_in(out.path());
+    let mut paths: Vec<String> = got
+        .values()
+        .map(|p| {
+            p.strip_prefix(out.path())
+                .unwrap()
+                .to_string_lossy()
+                .replace('\\', "/")
+        })
+        .collect();
+    paths.sort();
+    assert_eq!(
+        paths,
+        vec!["Trabalho/_otas.txt", "Trabalho/relatorio.pdf", "_raia.jpg"]
+    );
+    let expected = expected(&dir, "fat32");
+    for (hash, original) in &expected {
+        let wanted = [
+            "Documentos/Trabalho/notas.txt",
+            "Documentos/Trabalho/relatorio.pdf",
+            "Fotos/praia.jpg",
+        ];
+        if wanted.contains(&original.as_str()) {
+            assert!(got.contains_key(hash), "content of {original} differs");
+        }
+    }
+    assert!(out.path().join("guara-manifesto.json").is_file());
+
+    let empty = explorer::Selection {
+        folders: vec!["Nada/Aqui".into()],
+        ..Default::default()
+    };
+    let e = eng
+        .start_recover(
+            &job,
+            None,
+            None,
+            Some(empty),
+            out.path().to_str().unwrap(),
+            recover::RecoverLayout::Folders,
+        )
+        .unwrap_err();
+    assert!(e.to_string().contains("nenhum arquivo selecionado"), "{e}");
+}

crates/guara-core/tests/extras.rs

@@ -143,6 +143,7 @@ fn configuracoes_antigas_ganham_os_valores_padrao_novos() {
         notify: false,
         maps: true,
         updates: false,
+        ..Default::default()
     })
     .unwrap();
     let s = settings::load();

crates/guara-core/tests/pdf.rs

@@ -88,6 +88,12 @@ fn streams(pdf: &[u8]) -> Vec<String> {
     while let Some(s) = find(pdf, b">>\nstream\n", at) {
         let start = s + 10;
         let end = find(pdf, b"\nendstream", start).unwrap();
+        // the cover logo is a raw JPEG (`/DCTDecode`), not a content stream
+        let dict_start = pdf[..s].windows(2).rposition(|w| w == b"<<").unwrap();
+        if find(&pdf[..s], b"/DCTDecode", dict_start).is_some() {
+            at = end;
+            continue;
+        }
         let mut text = String::new();
         flate2::read::ZlibDecoder::new(&pdf[start..end])
             .read_to_string(&mut text)
@@ -146,7 +152,11 @@ fn long_lists_paginate_with_numbered_footers() {
     assert!(pages.len() >= 5, "{} páginas", pages.len());
     let last = pages.len();
     assert!(pages[last - 1].contains(&format!("p\\341gina {last} de {last}")));
-    assert!(pages[0].contains(&format!("p\\341gina 1 de {last}")));
+    // page 1 is the full-bleed cover (no footer); numbering continues on page 2
+    assert!(!pages[0].contains("p\\341gina 1 de"));
+    assert!(pages[1].contains(&format!("p\\341gina 2 de {last}")));
+    assert!(pages[0].contains("/Im1 Do"), "logo da capa ausente");
+    assert!(pages[1].contains("TLP:AMBER"));
     // the table header row is repeated at the top of each continuation page
     assert!(pages[2].contains("Modificado \\(UTC\\)"));
     // every table row appears exactly once across all pages

docs/cli.md

@@ -148,9 +148,9 @@ Searches in UTF-8 and UTF-16 (`--no-utf16` turns it off), including free space a
 guara report s.json report.html --case 2026-001 --examiner "Name" --hash-source
 ```
 
-Includes case identification, source, partitions, summary, hashes, the audit trail status and the list of files. `--hash-source` adds the hash of the whole source. The format follows the extension: `report.pdf` writes an A4 PDF (standard fonts, nothing external), anything else writes HTML.
+Includes case identification, source, partitions, summary, hashes, the audit trail status and the list of files. `--hash-source` adds the hash of the whole source. The format follows the extension: `report.pdf` writes an A4 PDF (standard fonts, nothing external), anything else writes HTML. Both open with a full-page cover (logo, headline numbers, TLP:AMBER classification); the HTML is a self-contained A4 document that paginates in the browser and prints as is.
 
-## `update` — updating
+## `update`: updating
 
 ```bash
 guara update           # check for a new version

docs/interface.md

@@ -11,12 +11,22 @@ Guará has a desktop app (Tauri) and the same front end in the browser with `gua
 After a scan, results open in a file-manager style explorer built for thousands of items:
 
 - **Left:** navigation by type, real photo date (EXIF, by year and month), folder, camera, confidence and GPS, with an option to hide small files and duplicates.
-- **Center:** thumbnail grid or list, grouped by day or month, with virtual scrolling. A filter chip shows what is active and clears it in one click.
+- **Center:** thumbnail grid or list, grouped by day or month, with virtual scrolling, or the **Folders** view (below) to browse one folder at a time. A filter chip shows what is active and clears it in one click.
 - **Right:** details panel with the preview, folder, dates (taken, modified, created, accessed), camera, resolution and the file metadata. The badge shows the **confidence** of the file (high, medium or low).
 - **Bottom bar:** selection count and the recovery buttons. Recovery always goes to another folder and writes a manifest with MD5, SHA-1 and SHA-256.
 
 Arrow keys move through the files, and Space opens the full-screen quick look. Selection works like Finder or Explorer (Ctrl, Shift, keyboard).
 
+### Browsing by folder
+
+<p align="center"><img src="img/folders-light-en.png" width="900" alt="The Folders view: the root of the recovered files with DCIM ticked, Viagens partly ticked, the selection total at the bottom and the folder details on the right"></p>
+
+The third view button (the folder icon, next to grid and list) turns the explorer into a file manager over what was found. The center shows **one folder at a time**: its subfolders first, each with how many files and how much space it holds counting everything below it, then the files directly inside. A breadcrumb at the top (`Root › Documents › Project`) goes back up; double-click or Enter opens a folder, Backspace or Alt+↑ goes up, and clicking a folder in the sidebar tree jumps to it. Files found only by signature, which have no known folder, sit in **By signature** at the root. Filters (type, date, confidence…) still apply and change the counts.
+
+To recover, tick folders and files with their boxes; the selection survives navigation. Ticking a folder takes **everything inside it**, at any depth, even what the active filters hide. Unticking a subfolder or a file inside a ticked folder leaves the folder half-ticked and keeps that item out. The bottom bar shows the exact total, and **Recover selection** recreates each ticked folder in the destination **from itself down**: recovering `Documents/Clients/Project` writes `Project/...` with all its subfolders. Files ticked on their own go to the root of the destination, and two ticked folders with the same name become `Project` and `Project (2)`. The manifest with MD5, SHA-1 and SHA-256 is written as always.
+
+Only folders that hold at least one recovered file appear: Guará knows folders through the paths of the files it finds.
+
 ## Themes
 
 The switch at the bottom of the sidebar offers **Auto** (follows the system), **Light** and **Dark**. The choice is saved.
@@ -27,9 +37,13 @@ The switch at the bottom of the sidebar offers **Auto** (follows the system), **
 
 **Settings** (the gear at the bottom of the sidebar) has a **Language** selector: **Auto** follows the system language, or you can pick **Português** or **English**. The change applies right away. The same dialog controls automatic updates (below), notifications for long tasks and online maps for photos with GPS (off by default, because it downloads OpenStreetMap tiles).
 
+## Saved sessions
+
+Sessions are autosaved and listed under **Recent** in the sidebar. Hover one and click the ✕ to delete it, or use the trash button in the section title to delete them all; sessions open in the app are kept. **Settings > Delete autosaved sessions after** removes old ones on startup (never by default; 7, 30 or 90 days).
+
 ## Updates
 
-When the desktop app opens it asks Gitea for the latest release. If a newer version exists, a card appears at the bottom right with the versions and the release address. For the CLI, `guara update` checks for and installs updates with SHA-256 verification. **Settings > Automatic updates** turns the startup check off and has a **Check now** button. The check sends nothing besides what any browser sends to Gitea. `guara ui` in the browser does not update itself.
+When the desktop app opens it asks Gitea for the latest release. If a newer version exists, a card appears at the bottom right with the versions and the release address. For the CLI, `guara update` checks for and installs updates with SHA-256 verification. **Settings > Automatic updates** turns the startup check off and has a **Check now** button. Clicking **Update now** shows a progress bar with the download percentage, then the verify, install and restart steps; the app stays responsive meanwhile. The check sends nothing besides what any browser sends to Gitea. `guara ui` in the browser does not update itself.
 
 <p align="center"><img src="img/settings-language-en.png" width="420" alt="The Settings dialog with the Language selector set to English"></p>
 
@@ -37,4 +51,4 @@ Error messages that come from the core, and the terminal output, are still in Po
 
 ## About these screenshots
 
-They show the real interface, not a mock-up, running on a synthetic test image: 72 generated JPEGs with fake EXIF (cameras, dates, GPS) that were deleted from a FAT32 image by `scripts/make-photo-fixture.py` and found by a normal `guara scan`. No real data appears. The device name in the sidebar was replaced with a generic one.
+They show the real interface, not a mock-up, running on a synthetic test image: 72 generated JPEGs with fake EXIF (cameras, dates, GPS) that were deleted from a FAT32 image by `scripts/make-photo-fixture.py` and found by a normal `guara scan`. No real data appears. The device name in the sidebar was replaced with a generic one. They are regenerated by `scripts/screenshots.sh` (see [CONTRIBUTING.md](../CONTRIBUTING.md)).

docs/pt-BR/cli.md

@@ -148,9 +148,9 @@ Procura em UTF-8 e UTF-16 (`--no-utf16` desliga), inclusive no espaço livre e f
 guara report s.json relatorio.html --case 2026-001 --examiner "Nome" --hash-source
 ```
 
-Traz identificação do caso, origem, partições, resumo, hashes, a situação da trilha de auditoria e a lista dos arquivos. `--hash-source` inclui o hash da origem inteira. O formato segue a extensão: `relatorio.pdf` gera um PDF A4 (fontes padrão, nada externo); qualquer outra gera HTML.
+Traz identificação do caso, origem, partições, resumo, hashes, a situação da trilha de auditoria e a lista dos arquivos. `--hash-source` inclui o hash da origem inteira. O formato segue a extensão: `relatorio.pdf` gera um PDF A4 (fontes padrão, nada externo); qualquer outra gera HTML. Os dois abrem com uma capa de página inteira (logo, números principais, classificação TLP:AMBER); o HTML é um documento A4 autocontido que pagina no navegador e imprime como está.
 
-## `update` — atualizações
+## `update`: atualizações
 
 ```bash
 guara update           # verifica se há versão nova

docs/pt-BR/interface.md

@@ -11,12 +11,22 @@ O Guará tem um app desktop (Tauri) e o mesmo front-end no navegador com `guara
 Depois da varredura, os resultados abrem num explorador no estilo de um gerenciador de arquivos, pensado para milhares de itens:
 
 - **Esquerda:** navegação por tipo, data real da foto (EXIF, por ano e mês), pasta, câmera, confiança e GPS, com opção de ocultar arquivos pequenos e duplicadas.
-- **Centro:** grade de miniaturas ou lista, agrupadas por dia ou mês, com rolagem virtual. Uma etiqueta mostra o filtro ativo e o remove com um clique.
+- **Centro:** grade de miniaturas ou lista, agrupadas por dia ou mês, com rolagem virtual, ou a visualização **Pastas** (abaixo) para navegar uma pasta por vez. Uma etiqueta mostra o filtro ativo e o remove com um clique.
 - **Direita:** painel de detalhes com a pré-visualização, pasta, datas (tirada, modificada, criada, acessada), câmera, resolução e os metadados do arquivo. O selo mostra a **confiança** do arquivo (alta, média ou baixa).
 - **Barra inferior:** quantidade selecionada e os botões de recuperação. A recuperação sempre vai para outra pasta e grava um manifesto com MD5, SHA-1 e SHA-256.
 
 As setas navegam pelos arquivos e a barra de espaço abre a visualização rápida em tela cheia. A seleção funciona como no Finder ou no Explorer (Ctrl, Shift e teclado).
 
+### Navegando por pastas
+
+<p align="center"><img src="../img/folders-light-pt.png" width="900" alt="A visualização Pastas: a raiz dos arquivos encontrados com DCIM marcada, Viagens parcialmente marcada, o total da seleção embaixo e os detalhes da pasta à direita"></p>
+
+O terceiro botão de visualização (o ícone de pasta, ao lado de grade e lista) transforma o explorador num gerenciador de arquivos sobre o que foi encontrado. O centro mostra **uma pasta por vez**: primeiro as subpastas, cada uma com quantos arquivos e quanto espaço contém somando tudo abaixo dela, depois os arquivos que estão diretamente nela. Um caminho no topo (`Raiz › Documentos › Projeto`) volta para cima; duplo clique ou Enter abre uma pasta, Backspace ou Alt+↑ sobe, e clicar numa pasta da árvore lateral vai direto até ela. Arquivos achados só por assinatura, que não têm pasta conhecida, ficam em **Por assinatura** na raiz. Os filtros (tipo, data, confiança…) continuam valendo e mudam as contagens.
+
+Para recuperar, marque pastas e arquivos pelas caixas; a seleção continua ao navegar. Marcar uma pasta leva **tudo o que está dentro dela**, em qualquer profundidade, inclusive o que os filtros ativos escondem. Desmarcar uma subpasta ou um arquivo dentro de uma pasta marcada deixa a pasta parcialmente marcada e mantém aquele item de fora. A barra de baixo mostra o total exato, e **Recuperar seleção** recria cada pasta marcada no destino **a partir dela mesma**: recuperar `Documentos/Clientes/Projeto` grava `Projeto/...` com todas as subpastas. Arquivos marcados soltos vão para a raiz do destino, e duas pastas marcadas com o mesmo nome viram `Projeto` e `Projeto (2)`. O manifesto com MD5, SHA-1 e SHA-256 é gravado como sempre.
+
+Só aparecem pastas que contêm pelo menos um arquivo recuperado: o Guará conhece as pastas pelos caminhos dos arquivos que encontra.
+
 ## Temas
 
 O seletor no fim da barra lateral oferece **Auto** (acompanha o sistema), **Claro** e **Escuro**. A escolha fica salva.
@@ -27,9 +37,13 @@ O seletor no fim da barra lateral oferece **Auto** (acompanha o sistema), **Clar
 
 Em **Configurações** (a engrenagem no fim da barra lateral) há o seletor **Idioma**: **Auto** acompanha o idioma do sistema, ou você escolhe **Português** ou **English**. A troca vale na hora. A mesma janela controla as atualizações automáticas (abaixo), as notificações de tarefas longas e os mapas online das fotos com GPS (desligados por padrão, porque baixam blocos do OpenStreetMap).
 
+## Sessões salvas
+
+As sessões são salvas sozinhas e listadas em **Recentes** na barra lateral. Passe o mouse sobre uma e clique no ✕ para apagá-la, ou use o botão de lixeira no título da seção para apagar todas; sessões abertas no app são mantidas. **Configurações > Apagar sessões salvas sozinhas após** remove as antigas ao abrir (nunca, por padrão; 7, 30 ou 90 dias).
+
 ## Atualizações
 
-Ao abrir, o app desktop consulta o Gitea para verificar se há uma versão mais nova. Havendo versão nova, aparece um cartão no canto inferior direito com as versões e o endereço da release. Para o CLI, `guara update` verifica e instala atualizações com conferência de SHA-256. **Configurações > Atualizações automáticas** desliga a verificação ao abrir e tem o botão **Verificar agora**. A consulta não envia nada além do que qualquer navegador envia ao Gitea. O `guara ui` no navegador não se atualiza sozinho.
+Ao abrir, o app desktop consulta o Gitea para verificar se há uma versão mais nova. Havendo versão nova, aparece um cartão no canto inferior direito com as versões e o endereço da release. Para o CLI, `guara update` verifica e instala atualizações com conferência de SHA-256. **Configurações > Atualizações automáticas** desliga a verificação ao abrir e tem o botão **Verificar agora**. Ao clicar em **Atualizar agora**, aparece uma barra de progresso com a porcentagem do download e depois as etapas de verificação, instalação e reinício; o app continua responsivo. A consulta não envia nada além do que qualquer navegador envia ao Gitea. O `guara ui` no navegador não se atualiza sozinho.
 
 <p align="center"><img src="../img/settings-language-pt.png" width="420" alt="A janela de Configurações com o seletor de Idioma"></p>
 
@@ -37,4 +51,4 @@ As mensagens de erro que vêm do núcleo e a saída do terminal continuam em por
 
 ## Sobre estas telas
 
-Mostram a interface de verdade, não uma maquete, rodando sobre uma imagem de teste sintética: 72 JPEGs gerados com EXIF falso (câmeras, datas, GPS), apagados de uma imagem FAT32 por `scripts/make-photo-fixture.py` e encontrados por um `guara scan` normal. Nenhum dado real aparece. O nome do dispositivo na barra lateral foi trocado por um genérico.
+Mostram a interface de verdade, não uma maquete, rodando sobre uma imagem de teste sintética: 72 JPEGs gerados com EXIF falso (câmeras, datas, GPS), apagados de uma imagem FAT32 por `scripts/make-photo-fixture.py` e encontrados por um `guara scan` normal. Nenhum dado real aparece. O nome do dispositivo na barra lateral foi trocado por um genérico. Elas são regeradas por `scripts/screenshots.sh` (veja [CONTRIBUTING.pt-BR.md](../../CONTRIBUTING.pt-BR.md)).

docs/pt-BR/suporte.md

@@ -2,7 +2,7 @@
 
 [English](../support.md) · **Português**
 
-Matriz do que existe hoje (versão 1.3.2). Para o que vem a seguir, veja o [ROADMAP](../../ROADMAP.pt-BR.md).
+Matriz do que existe hoje (versão 1.5.0). Para o que vem a seguir, veja o [ROADMAP](../../ROADMAP.pt-BR.md).
 
 ## Tabelas de partição
 
@@ -99,8 +99,8 @@ A pré-visualização é lida direto do disco, sem gravar nada: imagem, vídeo,
 | | CLI | Interface | Testes com imagens reais |
 |---|---|---|---|
 | Linux | ✅ | ✅ AppImage e deb | ✅ |
-| Windows | ✅ | ✅ msi e exe | só compilação e testes sintéticos |
+| Windows | ❌ sem binário na release | ✅ instalador exe | só compilação e testes sintéticos |
-| macOS | ✅ | ✅ dmg | só compilação e testes sintéticos |
+| macOS | ❌ não compilado nem testado | ❌ sem build | ❌ |
 
 ## O que o Guará não faz
 

docs/support.md

@@ -2,7 +2,7 @@
 
 [English](support.md) · [Português](pt-BR/suporte.md)
 
-Matrix of what exists today (version 1.3.2). For what comes next, see the [ROADMAP](../ROADMAP.md).
+Matrix of what exists today (version 1.5.0). For what comes next, see the [ROADMAP](../ROADMAP.md).
 
 ## Partition tables
 
@@ -99,8 +99,8 @@ The preview is read straight from the disk, without writing anything: image, vid
 | | CLI | Interface | Tests with real images |
 |---|---|---|---|
 | Linux | ✅ | ✅ AppImage and deb | ✅ |
-| Windows | ✅ | ✅ msi and exe | build and synthetic tests only |
+| Windows | ❌ no release binary | ✅ exe installer | build and synthetic tests only |
-| macOS | ✅ | ✅ dmg | build and synthetic tests only |
+| macOS | ❌ not built or tested | ❌ no build | ❌ |
 
 ## What Guará does not do
 

scripts/build-gui.sh

@@ -167,4 +167,17 @@ EOF
   *) echo "unknown platform: $platform" >&2; exit 2 ;;
 esac
 
+(
+  cd ../../../dist-gui
+  for asset in *; do
+    [ -f "$asset" ] || continue
+    case "$asset" in
+      *.sha256) ;;
+      *)
+        sha256sum "$asset" > "$asset.sha256"
+        ;;
+    esac
+  done
+)
+
 ls -1 ../../../dist-gui

scripts/screenshots.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# Regera as capturas de tela de docs/img a partir da interface real do Guará.
+#
+# Dados: uma imagem FAT32 sintética com 72 fotos JPEG apagadas (EXIF falso de câmera, data e
+# GPS), gerada por scripts/make-photo-fixture.py e encontrada por uma varredura de verdade. A
+# lista de dispositivos do computador é substituída por um nome genérico. Nenhum dado real.
+#
+#   scripts/screenshots.sh                 # grava em docs/img
+#   OUT=/tmp/img scripts/screenshots.sh    # grava em outro diretório
+#
+# Gera explorer-{dark,light}-{pt,en}, folders-light-{pt,en} e settings-language-{pt,en}.
+# Variáveis: OUT, GUARA_BIN (padrão target/release/guara; sempre recompilado se não for dado,
+# porque a interface vai embutida no binário), CHROME, PUPPETEER_CORE (padrões: Chrome do cache
+# do puppeteer e puppeteer-core em ~/.claude/tools/node_modules).
+# Requer: python3, ImageMagick (convert), mkfs.vfat e mtools (mmd, mcopy, mdel), node e Chrome.
+# Usa /tmp/test-photos.img (a imagem aparece com esse caminho na barra lateral das capturas).
+set -euo pipefail
+
+root=$(cd "$(dirname "$0")/.." && pwd)
+out=${OUT:-$root/docs/img}
+image=/tmp/test-photos.img
+
+if [ -z "${GUARA_BIN:-}" ]; then
+  (cd "$root" && cargo build --release -p guara-cli)
+  GUARA_BIN=$root/target/release/guara
+fi
+mkdir -p "$out"
+python3 "$root/scripts/make-photo-fixture.py" "$image" 72
+trap 'rm -f "$image"' EXIT
+
+node "$root/scripts/screenshots/shots.mjs" "$GUARA_BIN" "$image" "$out"
+echo "capturas gravadas em $out"

scripts/screenshots/shots.mjs

@@ -0,0 +1,129 @@
+// Captura a interface do Guará (explorer, vista de pastas e configurações) nos temas
+// claro/escuro e nos idiomas pt/en. Chamado por scripts/screenshots.sh:
+//   node shots.mjs <binário guara> <imagem de teste> <dir-saída>
+import { execFileSync, spawn } from "node:child_process";
+import { homedir } from "node:os";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const [bin, image, out] = process.argv.slice(2);
+const core = process.env.PUPPETEER_CORE || `${homedir()}/.claude/tools/node_modules/puppeteer-core/lib/esm/puppeteer/puppeteer-core.js`;
+const { default: puppeteer } = await import(core);
+const chrome = process.env.CHROME || execFileSync("bash", ["-c", `ls -1d "$HOME"/.cache/puppeteer/chrome/*/chrome-linux64/chrome | sort -V | tail -1`], { encoding: "utf8" }).trim();
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+// Dispositivo fictício: a lista real do computador não deve aparecer nas capturas.
+const FAKE_DEVICES = [{ path: "/dev/nvme0n1", name: "SSD interno", kind: "NVMe", size: 954 * 1024 ** 3, readable: false, mounted_at: [], removable: false }];
+const LABEL = "Pendrive 64 GB";
+
+const variants = [
+  { theme: "dark", lang: "pt" }, { theme: "dark", lang: "en" },
+  { theme: "light", lang: "pt" }, { theme: "light", lang: "en" },
+];
+
+// Sobe `guara ui` com config isolada (sessões e ajustes próprios) e devolve a URL com o token.
+async function startServer(theme, lang) {
+  const cfg = mkdtempSync(join(tmpdir(), "guara-shots-"));
+  mkdirSync(cfg, { recursive: true });
+  writeFileSync(join(cfg, "settings.json"), JSON.stringify({ theme, lang, notify: true, maps: false, updates: false }));
+  const child = spawn(bin, ["ui", "--no-open", "--port", "0"], { env: { ...process.env, GUARA_CONFIG_DIR: cfg }, stdio: ["ignore", "ignore", "pipe"] });
+  const url = await new Promise((resolve, reject) => {
+    let buf = "";
+    child.stderr.on("data", (d) => { buf += d; const m = buf.match(/http:\/\/\S+/); if (m) resolve(m[0]); });
+    child.on("exit", () => reject(new Error("guara ui saiu antes de subir")));
+    setTimeout(() => reject(new Error("timeout subindo guara ui")), 20000);
+  });
+  return { url, stop: () => { child.kill(); rmSync(cfg, { recursive: true, force: true }); } };
+}
+
+async function newPage(browser, url, w = 1600, h = 940) {
+  const page = await browser.newPage();
+  await page.setViewport({ width: w, height: h, deviceScaleFactor: 1 });
+  await page.setRequestInterception(true);
+  page.on("request", (req) => {
+    if (req.url().includes("/rpc/devices")) {
+      req.respond({ status: 200, contentType: "application/json", body: JSON.stringify(FAKE_DEVICES) });
+    } else req.continue();
+  });
+  await page.goto(url, { waitUntil: "networkidle0" });
+  await sleep(1200);
+  return page;
+}
+
+// Abre a imagem de teste, faz a varredura profunda e espera terminar.
+async function scanImage(page) {
+  await page.click("#openImageBtn");
+  await sleep(400);
+  await page.type("#dlg input[name=v]", image);
+  await page.click("#dlg button[value=ok]");
+  await sleep(1200);
+  await page.click("#goDeep");
+  await page.waitForFunction(() => document.querySelector(".xp-tile, .xp-lrow"), { timeout: 120000 });
+  await page.waitForFunction(() => !document.querySelector("#progressArea .progress-card"), { timeout: 120000 });
+  await sleep(2500); // miniaturas e autosave da sessão
+}
+
+const relabel = (page) => page.evaluate((t) => {
+  const sub = document.querySelector("#scanSub"); if (sub) sub.innerHTML = `<span class="mono">${t}</span>`;
+}, LABEL);
+
+const browser = await puppeteer.launch({ executablePath: chrome, args: ["--no-sandbox"] });
+try {
+  for (const { theme, lang } of variants) {
+    const srv = await startServer(theme, lang);
+    try {
+      // 1ª rodada: só para deixar uma sessão salva em "Recentes" (a 2ª rodada cria a outra).
+      let page = await newPage(browser, srv.url);
+      await scanImage(page);
+      await page.close();
+
+      page = await newPage(browser, srv.url);
+      await page.evaluate(() => { try { localStorage.setItem("guara-view", "grid"); } catch {} });
+      await page.reload({ waitUntil: "networkidle0" });
+      await sleep(1000);
+      await scanImage(page);
+      await relabel(page);
+
+      // Explorador em grade, com a primeira foto marcada.
+      const chk = await page.$(".xp-tile .xp-chk");
+      if (chk) await chk.click(); else await (await page.$(".xp-tile")).click();
+      await sleep(800);
+      await page.screenshot({ path: `${out}/explorer-${theme}-${lang}.png` });
+      console.log("ok", `explorer-${theme}-${lang}`);
+
+      if (theme === "light") {
+        // Vista de pastas: pasta DCIM marcada e selecionada.
+        await page.click('button[data-view="folders"]');
+        await sleep(1000);
+        const dcim = await page.$('.xp-lrow.xp-dir[data-dir="0"]');
+        await (await dcim.$(".xp-chk")).click();
+        await sleep(400);
+        await dcim.click({ offset: { x: 200, y: 20 } });
+        await sleep(800);
+        await relabel(page);
+        await page.screenshot({ path: `${out}/folders-${theme}-${lang}.png` });
+        console.log("ok", `folders-${theme}-${lang}`);
+        await page.click('button[data-view="grid"]');
+        await sleep(500);
+      }
+
+      if (theme === "light") {
+        // Diálogo de configurações, recortado com a moldura borrada ao redor.
+        await page.click("#settingsBtn");
+        await sleep(900);
+        const box = await (await page.$("#dlg")).boundingBox();
+        const pad = 24;
+        await page.screenshot({
+          path: `${out}/settings-language-${lang}.png`,
+          clip: { x: Math.max(0, box.x - pad), y: Math.max(0, box.y - pad), width: box.width + 2 * pad, height: box.height + 2 * pad },
+        });
+        console.log("ok", `settings-language-${lang}`);
+      }
+    } finally {
+      srv.stop();
+    }
+  }
+} finally {
+  await browser.close();
+}