Display captured attachments locally before upload

[RCmerci]

Capture attachments now display their local original in the saved Timeline before upload, and continue to use the ordinary cache after restart and publication instead of downloading their own upload.

Publish verified staged originals into the scoped asset cache using the existing durable upload intent. Admit current Capture receipts, hand temporary previews to normal file leases after the final open-preview owner closes, refresh pending metadata demands, and clean up matching cancellation. Private lookup/fetch tickets keep remote Fetch dependent on an explicit remote version. The two spec changes were explicitly approved; no new durable state, worker callback API, dependency, or Dune changes are introduced.

Validation

• Full remote Journal CI passed for exact head ac42df90f7de684b894ce9c6a23220a4797ed181, including all targets/native embed and the full regression suite.
• Rebased without conflicts onto main / PR82 c49728e; all four Capture patches are unchanged by range-diff.
• Compatibility with main / PR84 1e38f64644cdd49081004722cd9dd43759b2aaaf was checked without rewriting this head: conflict-free synthetic merge tree 7aff10eca7b91519c45bec7c14592d02cdf58679, with Application 115, graph runtime 140, routes, adaptive, media/runtime and source-boundary checks passing. No product change, rebase, new full CI or Simulator run was needed; the full remote CI above remains scoped to the PR82 base.
• Incremental @all plus app/native_embed.exe.o build and complete dune runtest passed on the PR82 base: 861 Alcotest cases plus media/runtime and source-boundary checks, including Application 111. Five new preview-lifetime cases were verified RED then GREEN. The worker lifecycle test uses the public Transfer.Lookup wrapper for the split lookup ticket. The decision document validates; the repository-wide document check retains three pre-existing missing-section failures.
• A separate read-only session reviewed exact head ac42df90f7de684b894ce9c6a23220a4797ed181 and found no evidence-backed issue. It independently reran Application 111, worker reducer 16, worker runner 25, transfer 20, cache 11, media/runtime and source-boundary checks; it reused matching binaries without a fresh build or GUI run.
• Isolated AE5 Simulator: saved Timeline originals display before PUT, both encrypted PUTs and full metadata acknowledgements complete against a loopback synthetic service, both intents reach Complete and staging is removed. Cold restart after cleanup acquires both normal cached originals. Asset GET count across all trials: 0.
• The controlled service applies received graph transactions through public Database APIs and computes acknowledgement checksums through public snapshot activation. It does not inject product completion events or persisted Complete states. Early fixture hold/configuration trials and their timeout retry are retained in the evidence.

Acceptance limits

The full Simulator run covered the pre-preview-fix implementation (72c5e76, identical business bytes at initial rebased head 2176592). The final narrow preview-lifetime fix is covered by public runtime regressions; no additional Simulator build was run. The Simulator run uses an experimental host ARM64 OCaml restamp (cross_abi_validated=false), with a test-only memory-secret host and controlled loopback service. It does not establish full iOS cross-compilation/ABI or real cloud-service acceptance. No phone or private graph was used. The existing warm-start authentication reconnect issue was worked around through ordinary product graph switching and is outside this change.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T07:53:32.795399Z	2176592	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.