perf(mobile): keep image bytes outside draft JSON

[t3dotgg]

Important

Hold for a new native runtime on each platform. Its embedded JavaScript must include the storage guards from PR #9710 and the readers from PR #9713. A rebuild with the old runtime fingerprint is not enough. Do not merge into the current OTA baseline.

Mobile image drafts repeatedly write image bytes into JSON. One 8 MiB pasted PNG produces 22,369,919 bytes of draft JSON.

New images now use app-owned files. Drafts, queued messages, and incoming shares store metadata. The same PNG needs 587 bytes of draft JSON, and its restored bytes match. Older inline images still work. PNG and GIF originals and the HEIC JPEG fallback remain supported.

Review-sheet cleanup now handles late picker results and closes before React commits an attachment update. Oversized JPEG exports are rejected before a file write. Both file writers sanitize stored filenames. Shared images require the stored copy's measured size.

Based on Wout Stiens' mobile work in PR #9049. The inherited source history and writer import retain contributor credit. Corrections are separate commits.

Verified with 257 focused tests, mobile typecheck, and targeted lint. Headless React checks cover both review-sheet cleanup races. Real-file checks preserve read leases and confirm that the merged readers decode new drafts and v4 queues. Measurements use source functions and a Node filesystem adapter, not a device. No native build, device, or browser verification ran.

Created with GPT-6 Astra (preview) in Codex.

Note

Keep mobile image attachment bytes outside draft JSON as owned files

• Picked, pasted, and shared images are now copied into app-owned storage and represented as file-backed attachments instead of inline base64 data URLs in draft JSON
• pickComposerMedia detects JPEG magic bytes to normalize silently transcoded images, accepts valid JPEG exports for unsupported HEIC-family metadata, and rejects non-JPEG unsupported exports
• buildIncomingShareDraft uses a persistFile path when the reader supports it, validating persisted copy size and cleaning up invalid or oversized copies; readers without persistence keep the legacy inline shape
• ReviewCommentComposerSheet now tracks attachments via refs, releases files on unmount and removal, drops images arriving after unmount, and reads the ref-backed list at submission
• Bumps thread-outbox schema version from 3 to 4; queued message validation still accepts versions 1–4
• Risk: existing drafts with inline image bytes still load, but newly created attachments are file-backed; ownedComposerImageAttachment deletes the owned file when stored size is empty or over the limit, and persistComposerImageBase64 removes partial destination files on write failure

^{Macroscope summarized ffefa00.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.6 KiB	13.8 KiB	+165 B (+1.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.0 KiB	7.0 KiB	0 B (0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.6 KiB	6.7 KiB	+165 B (+2.5%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	57.1 KiB	58.5 KiB	+1.4 KiB (+2.5%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	13.6 KiB	13.7 KiB	+191 B (+1.4%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.0 KiB	7.0 KiB	+6 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.7 KiB	+185 B (+2.8%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.8 KiB	59.3 KiB	+1.5 KiB (+2.5%)	66.4 KiB	✅
Claude	Live turn messages	9	10	+1 (+11.1%)	21	✅

Baseline: c4353bc · PR result: ffefa00 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.8 KiB
• Claude decoded thread snapshot: 114.5 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0d7d117. Configure here.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This is a cross-cutting mobile storage migration that changes how all newly created image attachments are persisted, previewed, uploaded, cleaned up, and queued, while adding JPEG/HEIC handling and outbox-version changes. The runtime and persistence surface is broader than a narrowly isolated performance tweak.

^{You can add or adjust custom eligibility rules. Learn more.}