Hey,
That is a weird one, and definitely frustrating! We've seen something similar happen in our instance before, where a specific action would cause the UI to flash and revert from dark to light mode.
Nine times out of ten, this is caused by a custom script somewhere that's forcing a hard page reload instead of letting the form do its normal AJAX refresh. When it does that, it sometimes "forgets" the user's theme preference and falls back to the system default.
Here's where I would start looking:
Client Scripts on the Incident form: This is the most likely culprit. Go into Configure > Client Scripts on your incident form and look for any custom scripts, especially 'onLoad' or 'onChange' types. Check the code for anything like 'window.location.reload()' or 'g_navigation.reloadWindow()'. I'd bet you'll find a script that's trying to refresh the form after the attachment is added, but it's doing it the "old fashioned" way. You can try disabling your custom scripts one by one to see if the problem disappears.
UI Policies with Scripts: Same idea. Check any UI Policies on the incident form that have the "Run scripts" checkbox ticked. The script section could contain the same kind of page-reloading code.
Business Rule on the 'sys_attachment' table: This is more of a long shot, but it's possible. There could be an "after insert" business rule on the attachment table itself that uses 'action.setRedirectURL()' to send the user back to the incident. If that URL isn't constructed properly, it could be dropping the theme parameters.
Honestly, my money is on a Client Script. The fastest way to find it is probably to use the Script Debugger in your session, attach the file, and see exactly which script runs right before the screen changes.
Hope this helps you track it down. Let us know what you find!
Cheers.
