[witbrock]

Merge decision: ready — mobile users can attach images beside the draft, review or replace previews, recover failed uploads, and submit each image with the intended request.

User outcome

Adds a direct image picker to the compact composer and completes the mobile attachment lifecycle. Builds on the merged screenshot-paste recovery in #693, preserving its clipboard helper and guidance without duplicate controls.

Material changes

• Route image filenames with missing browser MIME types through image validation and keep them out of generic workflow-file bindings.
• Validate supported still formats and the 8 MiB upload limit; retain errors and retry/removal, and abort removed uploads.
• Keep image controls and previews usable within narrow composers.
• Preserve the retained implementation, reconcile main, and add reproducible authenticated acceptance.

Native task: #V#task_agent_ca207e7d618fae369ec5b9c43f3e7741.

Evidence

• 34 targeted frontend tests and 16 backend image tests pass; affected static JS lint passes.
• Authenticated disposable localhost fixture, product revision 87f70a14f973ccedb1500b395ea554fb523dddb2: actual upload and original-byte/SHA-256 read-back, preview/removal/replacement, caption preservation, upload retry and next-request/conversation binding at 360, 412 and 1440 pixels.
• Actual standalone manifest and service worker controlling the local PWA shell. Generation intercepted at the fixture boundary; no model-output or saved-history claim.
• Three image-picker widths, six composer profiles, and three desktop clipboard recovery widths pass.
• Operator-provided Android 17 / Chrome 145 / Gboard 17.2 evidence verifies the unchanged helper using native permission approval, decoded PNG and preserved captions.

Evidence and limitations: docs/engineering/otter_archive_and_conversation_images.md; retained results/screenshots in .run/image-picker-authenticated/ and .run/image-picker-current/. The final commit changes only the acceptance harness and documentation after the tested product revision.

Ship boundary

Minimum ship criteria are met: supported picker, recoverable attachment lifecycle, correct request binding, and authenticated local mobile/PWA-shell acceptance. Wrong attachment binding, lost drafts, upload failure without recovery or inaccessible narrow controls would block shipping; none remain in the affected tests.

Physical-device PWA installation, iOS, Chrome 152, vision-model answers, saved-history acceptance and offline uploads are not claimed. Native clipboard evidence does not claim original-byte fidelity or repair of Gboard keyboard-tile refusal. No public deployment is requested.