[Origami74]

What

NAP-UPLOAD always works, at least on this device, and strips metadata before anything is stored or sent.

Why

An upload failed offline, and files went up exactly as the napplet sent them — camera EXIF (GPS) included.

How

• Every upload is stripped, hashed, written to the kept Blossom store (never evicted), then sent to the configured servers best effort. Offline-only, no internet, no server or every server refusing still answers ok with url: "blossom:sha256:<hex>", localOnly: true and remoteError (Myco additions; status stays complete, the spec's state list is closed). Only a napplet without the grant gets policy denied.
• Stripping (nap/upload/strip.rs): JPEG drops APPn except JFIF/ICC/Adobe, COM and trailing bytes; PNG keeps an allow-list of chunks; WebP drops EXIF/XMP and fixes VP8X and the RIFF size; GLB drops generator, every extras and KHR_xmp_json_ld, and re-strips embedded images (skipped for meshopt or overlapping views, documented). A known type that won't parse is refused, never uploaded unstripped.
• Orientation kept: when the first EXIF block (JPEG APP1, PNG eXIf, WebP EXIF) has an Orientation (0x0112) of 2–8, it is replaced by a new minimal EXIF — TIFF header in the original byte order, IFD0 with only that entry, no next IFD (26 bytes). JPEG puts it right after SOI/APP0; PNG in place with a new CRC; WebP in place with the VP8X EXIF flag set. Orientation 1, none, or malformed EXIF → no EXIF at all. GPS, camera, timestamps, thumbnails, XMP, IPTC and comments still go. If stripping changed the bytes the result carries originalSha256, which is not published.
• Paired peers fetch kept blobs from the mesh Blossom (:24243).
• Docs: NAP-UPLOAD.md (This device first, Metadata, Offline, Results), CHANGELOG.

Testing

• cargo test -p myco-napplet-runtime passes; per-format stripping tests with synthesized files, plus orientation tests: Orientation 6/8 with a GPS IFD, Make and DateTime in both byte orders → output EXIF is exactly the 26-byte orientation-only block (JPEG, PNG, WebP incl. Exif\0\0-prefixed chunk); Orientation 1 / absent / malformed → no EXIF; truncated, out-of-range offsets and counts, wrong type, invalid value → no panic, nothing kept; cargo test -p myco-core upload passes. blossom tests: 3 LMDB ENOSPC failures locally, unrelated.
• Not yet tested on device. Manual test: two paired phones; on A turn on Offline-only and upload a camera photo from a napplet (Doodleduo) → localOnly: true, the kept file has no EXIF beyond Orientation, and a portrait photo shows upright; on B fetch blossom:sha256:<hex> through resource / mesh.blobs → served by A over the mesh.

[Origami74]

Fixed the orientation blocker in 8d3a0b1. Stripping now keeps the EXIF Orientation tag, and nothing else from the EXIF, for JPEG, PNG and WebP. When it is 2–8, the old EXIF is replaced by a minimal TIFF with IFD0 holding just tag 0x0112, in the original byte order. For JPEG it goes right after SOI/APP0. PNG gets a new CRC. WebP gets the VP8X EXIF flag. Orientation 1, a missing tag or malformed EXIF means no EXIF at all, and the parse is bounds-checked. Tests cover both byte orders, GPS-bearing EXIF and malformed input. Also rebased on main.

[Origami74]

Closing: metadata stripping belongs on the client side (in the napplet), not in Myco's NAP-UPLOAD host. The host should store and send files as the napplet hands them over. The branch feat/upload-local-first stays for reference.