Why

The desktop shows a persistent "Backend out of date" toast, and clicking "Update Hermes" does nothing. The desktop requires backend contract 2 (REQUIRED_BACKEND_CONTRACT in store/updates.ts, added for the file.attach RPC) but the backend reports DESKTOP_BACKEND_CONTRACT = 1 — so reportBackendContract fires the warning on every session and it can never clear. "Update Hermes" no-ops because the source checkout is already current; the requirement is for a capability the backend lost.

Root cause: commit dbbd1d4d0 ("remote-gateway file attachments via file.attach") bumped both the desktop requirement (→2) and the backend contract (→2) and added the file.attach handler. The currently-blocked 85-commit upstream merge (mesh task hermes-fork-resolve-85-commit-upstream-sync-25-file) clobbered the backend half while the desktop half (REQUIRED=2, the FileAttachResponse type, the client tests) survived — a split-brain that orphaned the contract demand.

What changed

• tui_gateway/server.py: re-add the file.attach RPC handler + its six helpers (_format_ref_value, _attachment_ref_path, _desktop_attachment_dir, _sanitize_attachment_name, _unique_attachment_path, _resolve_gateway_attachment_path) and bump DESKTOP_BACKEND_CONTRACT 1→2. Restored verbatim from dbbd1d4d0; the file.attach symbols were confirmed absent on main (no duplication) and its cli.py dependencies (_detect_file_drop, _resolve_attachment_path, _split_path_input) are present.
• tests/test_tui_gateway_server.py: restore the 5 file.attach backend tests (workspace upload, gateway-visible copy-in, in-workspace no-copy, unresolvable error, ref quoting).

A restarted gateway now reports contract 2, so the toast clears and the backend genuinely supports the RPC the desktop advertises.

How to review

1. server.py — the appended file.attach block (sibling to the other attach handlers) and the one-line contract bump.
2. The 5 restored backend tests cover the handler's branches.
3. Confirm no symbol collisions: the six helpers + @method("file.attach") did not exist on main.

Evidence

• test_file_attach_uploads_remote_file_into_session_workspace (+ 4 siblings) exercise the restored handler end-to-end against a temp workspace.

Verification

• tests/test_tui_gateway_server.py -k file_attach — 5 passed; -k "attach or contract or detect_drop" — 14 passed (no neighbor regressions). uvx ruff check clean. py_compile clean.

Risks / gaps

• The CLIENT upload path (use-prompt-actions.ts) was reverted by the same clobber — restoring it is a larger merge against current code (it now coexists with the Phase 2b sender_device logic) and is tracked separately in hermes-restore-file-attach-client-20260610. It is NOT required to clear the toast: the contract advertises backend capability, which is now true and tested. The 3 pre-existing use-prompt-actions client test failures remain until that follow-up (they fail identically on clean main).
• This is one instance of the broader blocked-upstream-sync split-brain (hermes-fork-resolve-85-commit-upstream-sync-25-file); other reverted halves may surface similarly.

Collaborators

• @OmarB97 (operator)
• Claude Fable 5 (Claude Code)