`Vault.saveDraft` wrote the draft text under the thread id with no
off-the-record check, so a half-typed message in an off-the-record chat
sat on disk under a key naming the person it was for.
This is the iOS finding from 2026-09-17 on the other platform. That one
covered iOS drafts and pins and Android pins, edits and reactions;
Android drafts were the half nobody went back for.
Turning the mode on removes an existing draft rather than leaving it
behind, since the mode can be set after something was typed. iOS gets the
same result a different way: its filter runs at the save and the whole
map is rewritten each time.
The filter is on the write, with `saveOutbox` and `saveUnreadThreads`,
for the reason those give: a later caller cannot forget it.
Falsified: without it two of the four tests go red, report XML
`tests="4" skipped="0"`. Engine 719 and client 473 green.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
