[AnthonyRonning]

What changes

Agent attachments make stable, session-owned copies on the execution computer. Documents, source files and ZIPs can be attached alongside images through the picker or drag/drop. The model receives an execution-side path for ordinary files; native vision and read_image continue to work. Archives are not extracted automatically.

Payloads live in one file store beside the database. SQLite retains metadata, ownership and references. Session/account deletion and store reset revoke access and retry filesystem cleanup; compaction preserves attachments. Controller drafts have separate bounded staging and cleanup. Files and images are plaintext at rest, including when the conversation database is password-protected.

Remote uploads use dedicated bounded Iroh streams, operation IDs and status/cancel requests. Sends retain the durable receipt/no-replay contract. Generic files are capped at 30 MiB, uploaded images at 10 MiB, and each send at ten attachments. Upload progress is separate from prompt admission: Stop and text steering remain usable, completed uploads wait for outstanding receipts/history recovery, and failed preparation retains accepted input in order.

Names normalize idempotently before persistence, pending quotas are per account, and cleanup uses ownership/IDs independently of display metadata. Ordinary owned read-only directories/files are handled without following links or changing external targets. Failed cleanup candidates cannot starve other sessions. Exceptional ACL, immutable-file or ownership failures remain explicit; incomplete erasure is never reported as successful.

Compatibility and existing data

• Remote wire 7 / minimum 7 is required. No legacy image-send adapter or cross-version management bridge. Update the execution computer first while the pair is compatible, then update the controller locally. Controller-first upgrades require direct access to update the old execution computer. Pairing records remain intact.
• The new controller preserves a terminal update-required refusal and requires an explicit retry after the peer is updated. Released wire-6 controllers retain their shipped retry/offline behavior. Local updates remain available.
• A restartable schema migration discards historical image payloads stored in SQLite, preserving text, existing descriptions, IDs, relationships, timestamps and tool history. Old history is rebuilt on demand before opening, ACP replay or continuation. Missing historical images remain usable as unavailable markers, including cold side questions; new outgoing image preparation stays strict.
• Verified corrupt source data uses the existing damaged-store/reset path. This does not add general database salvage or arbitrary OS-permission repair. Old binaries cannot reopen the migrated format; restoring an older app alone is not a database rollback.
• Stopped-store backups include both database and attachment tree. Deleted SQL payloads do not immediately shrink the database or erase backups. Pasted attachment-looking text grants no authority to another task's files.

Validation

The latest focused follow-up fixes the Windows migration fixture's absolute path, the ACP first-load/history-notification race, brief history-preparation contention, and cleanup of owned attachment roots whose modes were widened by archive extraction. No attachment protocol or product-scope change.

Further draft-recovery UX is explicitly deferred: restoring a cancelled upload into an occupied composer, preserving drafts across terminal reconnect/view replacement, and making pending-send status easier to retry are not addressed by this follow-up. Durable receipts still prevent automatic prompt replay.

Current candidate: d5244d23; rebase baseline remains master 9f185101.

• Full pinned macOS MAPLE_HOOK_FULL=1 pre-commit just ci passed: 758 runtime/store, 1,009 desktop and 307 headless tests, remaining workspace suites, all four Clippy configurations, formatting, documentation and Git-metadata checks. Existing ignores remain.
• Regressions exercise plain/keyed migration and reset, on-demand history, filename normalization, fair/read-only cleanup, account quotas, cold side questions, retained queued/steered messages, draft reimport/status recovery, actual upload receiver publication/account/grant races, combined stream/header saturation and urgent controls, plus frozen wire/refusal frames.
• Fresh fe495f12 Local/forced-public-relay probes passed six filename/retry cases per path, read-only cleanup with external symlink targets preserved, a 19,922,960-byte round trip, status/cancellation/session isolation, original-receipt recovery with one user row, and actual model text/ZIP/image access. A cold vision side question read its saved image after daemon restart and before opening task history. Pending deletion drained on normal startup. The runtime, storage, transport and upload-state paths tested by those probes are unchanged by the rebase.
• Prior native macOS smoke of the rebased cddf1c03 source tree passed cold reopen, TXT/ZIP/PNG selection together through the OS picker, draft/transcript rendering, a new attachment send with Stop available, and explicit plaintext-storage wording. Its isolated application and daemon were quit afterward.
• Fresh native apps built from exact commit d5244d23 passed new pairing, local and forced-public-relay TXT/ZIP/PNG upload/readback, actual GLM-5.3 Flash text/ZIP/image access, and original-receipt recovery with one user row. A further native OS-picker send selected all three file types and rendered the acknowledgment in both controller and executor windows. The isolated pair is left running for the owner's manual test.
• Hosted CI is pending on this candidate. Native Windows read-only deletion and other platform paths require those results. The existing store benchmark evaluator reports a pending runner baseline; successful collection is not a runner-relative latency pass.

All live checks are same-machine Local development evidence. Installed production applications and user sessions are untouched. Physical-device testing and a genuine signed wire-6-to-wire-7 upgrade rehearsal remain separate release work. No release or production installation is part of this PR.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}