fix(mobile): read file-backed image drafts before enabling them

[t3dotgg]

An OTA rollback can run older JavaScript against the same saved drafts. File-backed image writers need compatible readers in the native baseline first.

The app can now load, preview, and send inline or file-backed image drafts. Cleanup retains their files through queued messages, signed-out archives, and active previews. New attachments still use inline bytes, and outbox writes remain v3.

The later file-backed writer change must stay held until a compatible native baseline includes these readers and the storage guards from PR #9710. No native or dependency changes here.

Based on Wout Stiens' mobile work in PR #9049. Original Git authorship and co-author credit are preserved. Reader-only corrections are separate commits.

Verified with 240 focused tests, mobile typecheck, and targeted lint. Real-source checks confirm that old decoders can read newly saved inline drafts and v3 queues, while new readers accept future file-backed drafts and v4 queues. No device or native build ran.

Created with GPT-6 Astra (preview) in Codex.

---

Note

Medium Risk
Changes composer attachment persistence validation, send/upload paths, and file retention around queued messages and previews; regressions could drop images or fail sends after iOS container moves, though coverage is extensive.

Overview
Prepares the mobile composer to read file-backed image drafts (optional fileUri plus optional dataUrl) before writers switch away from inline bytes. Image schema now requires at least one of those sources; persisted images with only previewUri fail decode.

Preview and send paths resolve owned attachment paths against the current iOS document container, lazily read base64 for legacy inline startTurn when uploads are off, and upload from disk when uploads are on—without staging cache files for file-backed images. Thumbnails and file preview use retention leases and attachment-based preview sources for file-backed images.

Lifecycle treats any attachment with fileUri like other owned files for cleanup, upload-queue retention, and share MIME handling. Thread start and outbox drain pass only prepareTurnAttachments wire payloads, not raw drafts. Outbox decoding accepts schema v4 file-backed images while writes stay on v3.

^{Reviewed by Cursor Bugbot for commit 572bdfb. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Fix file-backed image drafts by reading files before enabling them in mobile composer

• Adds FileBackedComposerAttachment type and isFileBackedComposerAttachment guard so composer images can store bytes in the app-owned attachment directory rather than only inline
• composerImageAttachmentDataUrl lazily reads file-backed image bytes, rebasing the URI against the current iOS document container, and throws an explicit attachment-unavailable error when neither inline nor file data exists
• uploadFileBytes uploads file-backed images directly from their owned file without base64 staging or temp-file cleanup, while legacy inline images still use a temp upload file
• prepareTurnAttachments makes legacy image conversion async and cancellation-aware; a canceled read now returns an abandoned result instead of surfacing an error
• Ownership scans and cleanup scheduling in use-composer-drafts.ts and composer-attachment-uploads.ts now cover any attachment with a fileUri, retaining file-backed images referenced by drafts, queued messages, or active leases
• QueuedThreadMessageSchema accepts version 4 records so the outbox reader can decode queued messages containing file-backed images
• Risk: DraftComposerImageAttachmentSchema now requires at least one of fileUri or dataUrl; persisted records with neither field will fail decoding. Reviewers should check composer-image-schema.ts and outbox migration paths for older drafts.

^{Macroscope summarized 572bdfb.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.6 KiB	13.7 KiB	+171 B (+1.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.0 KiB	7.0 KiB	+3 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.6 KiB	6.7 KiB	+168 B (+2.5%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	57.1 KiB	58.5 KiB	+1.4 KiB (+2.5%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	13.6 KiB	13.4 KiB	−111 B (−0.8%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.0 KiB	7.0 KiB	−4 B (−0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−107 B (−1.6%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.8 KiB	57.0 KiB	−884 B (−1.5%)	66.4 KiB	✅
Claude	Live turn messages	9	8	−1 (−11.1%)	21	✅

Baseline: 7839140 · PR result: 572bdfb · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.8 KiB
• Claude decoded thread snapshot: 114.5 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Approved at 572bdfb

Macroscope's review found this PR approvable — This is a contained mobile attachment-lifecycle fix that adds file-backed image reading, URI rebasing, retention, and cancellation handling while preserving existing inline writers and outbox writes. The compatibility paths and cleanup behavior are covered by focused tests, with no production-default, infrastructure, security, billing, or static-analysis changes.

^{You can add or adjust custom eligibility rules. Learn more.}