[Bl0ck154]

Upstream-first fork migration, customer-specific preservation — NOT a release

Stacked on draft #60 documentation stabilization and its ancestors through #51. Do not merge/deploy to production. No customer image data, active credentials, or production database content included.

Included

• Copy the fork's existing orderForgeImageArtifactSink.ts, with bounded PNG/JPEG/WEBP base64 validation (25 MiB maximum), atomic 0600 files, private metadata with hashes (not prompts or raw request text), 72h / 2 GiB cleanup, and a tee-drain helper.
• Preserve the original standalone sink tests, including capability gating and no-scope/no-header behavior, invalid IDs, private writes, retention cleanup, OpenAI-style image payloads, and client-stream cancellation.
• Port narrow direct /v1/images/generations hook to current official upstream after enforceClientApiRouteAuth, policy enforcement and allowed-connection scope. A caller must possess the authenticated API key's special image_artifact_retention scope and present a validated artifact ID; otherwise no persistence. No change to the image response, quota accounting or connection selection; storage exceptions do not break a successful provider response.
• Add an off-host source-order/authorization regression and include both sink suites in the manual GitHub Actions API route gate.
• Document unfinished routes and operational file retention assumptions in docs/maintenance/ORDER_FORGE_IMAGE_RETENTION_PORT_20261025.md.

Must finish before release

• Full streamed/nonstreamed Responses image_generation_call capture and safe client-disconnect tee handling in current upstream chatCore.ts.
• All /v1/images/edits direct, combo and custom-provider paths; dedicated generation combo path (this PR covers direct generations only).
• Independent Codex image quota telemetry/account fallback preservation.
• Hosted focused tests on exact SHA, full build/packaged smoke, app-level production-data migration rehearsal, security checks and a verified canary+rollback.

This patch is fork-specific; it is not proposed as a generic upstream PR. Initial core commit 2d009a9662, composed branch 361ca60923.

[Bl0ck154]

2026-10-25 fork image preservation progress (parallel branches reconciled, no production deployment): base #61 scope-gated storage + direct generations passed hosted run 40165254621; #64 implements direct/custom/combo image edits; #67 adds the previously missing Firefly edit callback (hosted run 40171833029 GREEN); #68 adds normalized successful Responses API nonstream + SSE capture at the new upstream split modules (hosted run 40172264744 GREEN); #69 handles winning-target image generation combo payload only, with real SQLite/fake-provider success/fallback/failed-storage tests (hosted run 40172657329, in progress at comment time). Overlapping draft #65 intentionally CLOSED as duplicate of #64 + #67 to avoid divergent same-feature implementations. Independent #66 ports module-only Codex image quota telemetry (hosted run 40171767874 GREEN) and still requires final-account, actual-route wiring. ALL PRs are Draft; don't merge them out-of-order or deploy. Full CI/security/typecheck, copied old-SQLite upgrade/rollback, end-to-end provider mocks and canary remain blocked.