Bridge tracer: Discord images and files in Channel bubbles #1026

Parent

#1020 — Authorized Bridge media in Channel history. Coordination: #48.

What to build

Human views and operates actual Discord image/file messages in Channel bubbles while retaining exact channel/thread provenance and authorized history behavior.

Acceptance criteria

• Qualify native Discord attachment fields, multiple/mixed content and exact parent/child-channel or thread resource identity through real messages.
• Complete visible-image previews/enlargement and file-card download/safe open-with, with Discord-specific source/resource expiry and permission failures. Never substitute a neighboring channel/account to recover access.
• Deliver one production-shaped path through qualified Provider intake, canonical Source Event, realtime and historical Channel projection, authorized Host media access and operable bubble UI. Do not start a competing receiver or a second message store.
• Preserve external author, source-name button/Modal, message boundary and known item ordering. Multiple and mixed media remain one native message; unknown ordering/metadata is honest. Provider URLs, tokens, AES keys and credentials remain private.
• Human Channel access resolves trusted media authorization without choosing or borrowing a Bot identity. Recheck placement, source/media identity, current Channel access and independent valid source authorization during acquisition and serving.
• Visible-image previews acquire on visibility; audio/video and file actions acquire on explicit action. Reuse existing Host Attachment management; keep the default 25 MiB bound, cancellation and bounded concurrency. Display loading, too-large, unsupported, failure and retry states honestly.
• After acquisition, refresh and Host restart retain authorized history access. Ordinary Bridge reception stop allows acquired-media viewing but no new acquisition through that stopped path. Unbind/media revocation prevents acquisition and serving through that authorization; independent valid paths remain independent. Do not resurrect Content Purge content.
• Human viewing creates no Bot Observation, model-context change, Inbox admission, wake or external send authority. Inbox-only creates no Channel history. Bot understanding and own-identity permissions remain unchanged.
• Complete focused observable regression coverage and real platform/media E2E: receive a uniquely identifiable native message, inspect actual bytes/preview/play/download as applicable, refresh/restart, and demonstrate relevant stop/revoke/error recovery. Mock payloads, flags and HTTP success alone are not platform proof.
• Provide GitHub-renderable matched before/after light/dark screenshots, relevant playback/recovery recording and usable Human verification steps. Follow DSH tokens/primitives and keyboard/accessibility conventions; keep private chat content and secrets out of evidence.
• Update applicable canonical English/Chinese user guidance and bilingual release ledgers for delivered behavior; do not edit generated docs. Deliver one issue-linked PR with task claim/trace and review-risk classification, then pause for Human QA before expanding dependent slices. Merge/deployment require separate authorization.

Blocked by

• Bridge tracer: Lark file cards with download and safe open-with #1022

Planning and authority

Project: V1.1 · IM Identities & Messaging (#10). Milestone: v1.2, explicitly selected by Human; Project title does not override milestone. Human approved ticket granularity and blocking edges before publication. This publication does not claim implementation or take over existing WeChat work.