Stream a file through the API: original, normalized, mask, cutout, or thumb (a small WebP of the current cutout, made on first request and cached in storage — grids must not pull 400 kB PNGs). photo makes the thumb the photo's, whatever cut-out the picture has: the sorting view judges what a picture shows, not its cut-out (decision 265).

Object storage is internal; the browser reaches it only through here. Public URLs for channels are the /public/media routes.

A file that never changes — the original, or a derivative named by its id — is cached for a day. Any other — the thumbnail, "the cutout", "the mask" — is the current one of the moment, and is checked each time: an approval or an upload changed it, and the grid showed the old one for an hour (decision 209). The check is answered 304 while it has not changed.