JR-041 is a requirement to *not* do something, so like JR-021 it can only be verified by absence. Mirrors the server's UR-012, which is preserved the same way. The check looks for any *parse* of gallery data — a field name, a property, a type — not merely for network calls: an embedding arriving here would mean SR-005 had already been breached upstream. TRACES: JR-041 | SR-005