#27016 Accept large Home attachment originals with bounded transfer memory

Home attachment admission accepts originals above the former 100 MB limit in the web client, backend validator, native composer and Rust upload path. Native ingestion copies bounded chunks; web hashing and uploads use slices. Optional image previews retain their decode budgets and HEIC previews preserve the original dimensions and aspect ratio. Original bytes remain unchanged.

Request: “Attachments take arbitrarily large files of any type; there is no size cap.”

The account's daily byte/intent and total stored-byte quotas remain cost controls. Byte counts must be positive safe integers. The multipart server and client adapter remain separate dependencies; Cloud/peer staging in #27073 stays outside this PR's implementation scope. The shared wire corpus, admission rules, and cross-language regressions belong together, which accounts for the size of this PR.

Verification

Final head: 24800c385ca1f47382343dcce976abe6f849a27b, tree 3a7d92ad9429e969d3793ae7c5fe679472046312, after a normal merge of 34e31e4df196d75a5dc57a16f430cbe3b863d717. The one conflict in attachmentService.ts preserves base's message grouping and this PR's uncapped originals and HEIC handling.

• 40949089531: full webviews checks and Home attachment regressions passed on the identical final tree. Static pre-push checks and whitespace checks passed.
• Final-head native app and Home core suites are submitted through the fleet, paired with the same suites on the merged base. They cover sparse full-original ingestion, large staging declarations, session checks, chunk size and offset rejection, incomplete finish, and cancellation cleanup. Submission is not a passing result.
• Final-head app build passed: fleet job 16376d97667605611715a971, artifact sha256:af3cbd272c1e62ec10d43bf33d343e60db1a374e5e443a39b684fd92a119650a. Fresh-home passed: Home rendered in 8.5 seconds, 30 seconds uptime, zero crash reports and run exceptions; cmux-ci/fresh-home: success is posted on this head.
• Synthetic native/HEIC before-and-after captures passed in light and dark. Lawrence's Chief owner review request remains in place; owner awareness.
• Independent Astra review is running on the complete final diff. The previous source SHIP applies only to 72f69a7bd57b3a8805199a47122a46a53ab0f8fc.

Historical evidence, not final-head native verification: 72f69a7bd57b3a8805199a47122a46a53ab0f8fc built successfully and passed a fresh-home launch (Home rendered in 5.7 seconds; 30 seconds uptime, no crash). Earlier backend tests, Rust/Chief tests, and attachment cap guards passed at the previously documented snapshots.

Performance

Historical measurements from the file-backed handoff; not remeasured at the merged head.

Metric	Before	After	Delta	Harness
64 MiB staged-file handoff, peak RSS increase	65,860 KiB	352 KiB	−65,508 KiB	Isolated child, VmHWM; red-first run 40786124316, green fleet job b53dbbba046fa46f273c5f50

The same prior harness measured a 360 KiB peak RSS increase for a 256 MiB file; no before value was measured for that size.

Temporary files remain owned until transport completion or failure. Native copying ends at EOF or cancellation. No timer or animation loop is added. The material risk is transport admission accepting an original before the multipart dependencies are deployed; the multipart dependencies remain follow-up work outside this PR.

Changelog

Changed: accept large Home attachment originals and transfer them without whole-file allocations, while retaining account cost quotas.

Visual evidence

Synthetic fixture only. Both builds attach the same generated 1600×900 HEIC and a 100,000,001-byte sparse binary through Home's drop entry point. Base refuses the binary as larger than 100 MB and retains one draft attachment; final head retains both. The HEIC preview keeps its wide proportions. The transcript text is seeded fixture data, not a validation report.

Before: base	After: final head

Agent session: agent session