cmux NEXT: stream large cloud attachment originals through multipart
Streams arbitrarily large cloud conversation originals from the staged file through the Home multipart Worker. Small derived images retain byte uploads; originals are sent in bounded file-backed parts, with authenticated completion and strict same-origin slot URLs. Failed parts stop immediately and the staged file remains owned by the upload lifetime.
This dependent PR targets lane/attach-multipart-worker and is intentionally stacked on #26674. It also requires #26498's PutBody/file-streaming transport. After both prerequisites land, retarget to feat-cmux-next; the adapter diff is the final adapter commit 41186ed9220 plus rustfmt 9cf0ccc2588. It is independent of #26409's cap-removal PR, which will consume this adapter afterward.
Leo's rule: “arbitrarily large files of any type; there is no size cap”.
Validation: Exact-head validation: cmux-ci test --setup rust -- cargo test --manifest-path cmux-tui/Cargo.toml -p cmux-tui-cloud-conversations multipart -- --nocapture passed at f3dea4f10246c9f40d751aed6ec1b36849c5f05c, run 40649172310 (snapshot ee7937d0949609dd8d7324ca0df9ae39e9595cee).
The streamed body now uses a bounded reader so a nonaligned multipart part cannot consume bytes from the next part; a regression covers a 64 KiB + 17 byte declared length.
Status: dependencies #26498, #26674 and #27015 have landed; needs an exact-head independent review.
Direct transport integration (contract #27015): transport absent or worker preserves the Worker path. direct mints each part URL using the slot credential, streams its bounded file range to storage with no bearer, retains its ETag, and supplies ordered receipts to completion. Verification requests perform bounded server work; non-advancing or malformed progress fails rather than waiting indefinitely. No file-size cap was added. The transport tests use sparse 1 TiB + 7 byte fixture data and also reject missing ETags, unsafe destinations, unknown transports and stalled verification.
Validation for frozen head d3c2d74bd1a6505ac44a0faf605cba11b53a6daf: adapter run 40774784521 passed all 5 multipart tests, including the sparse terabyte direct path and failure cases (snapshot 6cdb5dff09de03f11dba2ae7ba83caecd605ff4c, identical tree). Backend run 40774838569 passed all 9 HTTP backend tests, including slot headers, ETag retention and the nonaligned part boundary, plus scoped cargo clippy --all-targets -- -D warnings (snapshot e2bc349bf7d8286cbd72cd1afb59ccbebbef93ac, identical tree). Earlier receipts above are historical.
Agent-Session: https://cmux.com/deeplink/agent?id=aid-efc21047e6bbc7791908
Agent session: agent session