Function sanitize_image_markers 

pub fn sanitize_image_markers(
    messages: &[ChatMessage],
) -> Cow<'_, [ChatMessage]>

Strip image markers that cannot be delivered inline (see strip_undeliverable_image_markers) across every message, logging one degradation warning when any are removed. Returns the input borrowed when no message needs the seam (the common, allocation-free path) or an owned rebuilt vector otherwise.

Assistant messages in native tool-call history are rewritten field-wise — only their content string, through rewrite_model_visible_text — so signed reasoning inside the envelope survives the seam.

This is the fail-closed backstop on one-shot dispatch seams that send stored history without the full multimodal preparation: a filesystem path or URL image reference can no longer reach a provider adapter, whichever route the history took. Inline data: URIs and non-loadable prose markers pass through; callers that want the turn’s images delivered run the full normalizer before they reach this point.

A DECLARED carrier is never body-scanned here: its image attachments that name a path or URL (not an inline data: URI) drop from the declared list, and its body stays verbatim, so marker syntax a tool quoted in its output remains text under the attachment-identity contract. A LEGACY carrier is cloned unchanged: it declared nothing, its body is text, and this seam does not rewrite it. Ordinary messages keep the regex strip.