What changed

Timeline pages opt into attachments=reference; every general API call keeps inline bytes by default. Inline user files become stable per-message references, with originals loaded near the image viewport or on a file click. Single-message reads and model context retain originals.

Review fixes:

• Moved opt-in from the general API wrapper to the desktop/web transcript data adapter.
• Shared a bounded per-server LRU between image display, Revert and Fork: at most 32 user messages and 16 MiB of estimated UTF-16 content. Oversized originals are not retained. Concurrent reads coalesce; failed reads can retry.
• Passive failures stay silent and retry on the next intersection. Unloaded images render a sized placeholder without a broken-image URL or draggable image.
• Pending loads use stable reference IDs, so replacing store proxies cannot discard a valid response.
• Revert and Fork reject duplicate in-flight actions and abandon restoration if the captured draft changed.
• Both desktop export and Context-panel export explicitly request inline originals on every page.
• Regenerated the previously stale OpenAPI document and both website copies.

#56989 is now stacked on this PR and extends the same query parameter to read-tool inline files. Execute screenshots remain inline pending a hydration path. Merge this parent first, then retarget #56989 to beta.

Measurements

Reused HOME-shaped numeric fixture, with explicitly synthetic user-attachment placement. One warmup plus seven alternating-mode measurements on Pro through HiveMind:

• 200-prompt page: 9,920,082→145,676 B; default and explicit inline return identical bytes.
• Handler/serialization/client-parse medians: default 1,209.74 ms, inline 1,279.79 ms, reference 23.39 ms. This is not network or paint time.
• With the read-only child applied, latest 40 messages: 2,604,594→57,720 B.
• Same production app, seven paired inline/reference runs: newest-painted 911.5→949.9 ms, 2/7 faster. No reliable newest-paint improvement claimed.

Verification

• Shared-cache, offline restoration, LRU bounds, failed-read retry, draft-change and prompt-byte keepers pass.
• Export keeper uses the real generated client and requires inline bytes on both pages.
• Two focused component cases pass: placeholder/proxy replacement/preview, and passive retry with explicit-only error feedback.
• Full root lint/typecheck passes (36/36 tasks); client and protocol generators run; OpenAPI generated-file check passes.
• Website generated check, typecheck and production build pass.
• Final CI run is complete: Linux/Windows builds, units and session-ui components pass. App E2E/components fail on both platforms. Those failures are not established as pre-existing without clean-base reproduction. CI-blocked and unmerged; no pending jobs.