feat(email): Slice 3 persist quarantined inline media

[seonghobae]

Description

#1350 Slice 3 follow-on stacked on Draft #1398. Wiring drops tracking_pixel / unsupported_media / unresolved_cid_reference from filename-bearing image attachments, but nothing durable recorded that quarantine. A later parse of the same message could lose the operator/customer next-action.

This draft persists those already-produced admission/resolution outcomes into email_media_quarantine_records on the existing parse_eml / parse_eml_bytes / resolve_email_inline_media path (and on import/IMAP save after the email_records row is flushed). Only the closed error_code set is stored. document_image is never a quarantine. Re-parse is an idempotent upsert. Persist failure is fail-closed. No OCR, VLM, NewsDOM, egress, or #1376 EmailMediaArtifact pixel contract.

Exact previous head: 0bc7f62c2bcdfe273ff75e2b96067ab29f4ab0da (stale parent db9688768cb682edbc0195913e8ae9b0e1551dfb)
Exact current head: ff1dc18cd9de5e06649ac516b163af2db4bbde83
Exact parent SHA (live #1398 head): 1af546dbb01964e9a620ed341ae0dd3dab9439fd
Live #1397 / develop: 37b4af566d749028f7dc99545fff1db517d61d1a / dd8d15191338b841f9e6f3a06507c6a5643b95d0

Predecessor evidence does not transfer. The previous persist-head tests, coverage, and review evidence, and #1398 / #1397 predecessor-head evidence, are not this head's proof. Re-run the focused persist tests on this exact head.

Refs #1350

Customer next action

Tell the customer what was withheld and why. Example: "This inline image was withheld as a tracking pixel. It was not sent to a model." Do not send a tracker, unsupported part, or unresolved CID to a model. Do not merge this draft until it is no longer Draft and a qualifying independent APPROVE exists on the unchanged head. Keep #1398 and #1397 Draft as well.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

Exact-head verification

Retarget: normal merge ff1dc18c of live #1398 (cursor/email-media-admission-wiring-cd1a @ 1af546db, which already contains #1397 @ 37b4af56 / develop@dd8d1519) into cursor/email-media-quarantine-persist-0ad6. Not a squash. Not a force-push of develop. #1400 was not retargeted.

Focused product tests on this exact head:

cd backend
PYTHONPATH=. PYTHONWARNINGS=error python3 -m pytest -c /dev/null --noconftest -p no:cacheprovider \
  tests/test_email_media_admission.py \
  tests/test_email_media_admission_boundaries.py \
  tests/test_email_media_resolution.py \
  tests/test_email_media_resolution_boundaries.py \
  tests/test_email_parser.py \
  tests/test_email_media_quarantine.py \
  tests/test_email_media_quarantine_boundaries.py -q
# 92 passed

Owned persist module coverage on this exact head:

cd backend
PYTHONPATH=. python3 -m coverage run --branch --source=services.email_media_quarantine \
  -m pytest -c /dev/null --noconftest -p no:cacheprovider \
  tests/test_email_media_quarantine.py \
  tests/test_email_media_quarantine_boundaries.py -q
python3 -m coverage report -m
# services/email_media_quarantine.py  121  0  32  0  100%

Local count on ff1dc18c: 92 passed. Predecessor-head #1398 / #1397 / previous #1399 figures do not transfer.

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

Merge boundary

This PR must remain Draft. Merge is prohibited while Draft and prohibited without a qualifying independent non-author APPROVE on the unchanged head. Do not self-approve, mark Ready, squash-merge over a draft, merge #1398 or #1397, or treat predecessor/stacked/#1376 evidence as this head's proof.

  

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 14 minutes

Limit details: You’ve used all 1 included review currently available under your plan.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 6a1b2cf4-ce02-43a6-842e-25b18ccf91ef

📥 Commits

Reviewing files that changed from the base of the PR and between 1af546d and ff1dc18.

📒 Files selected for processing (14)

• AGENTS.md
• CHANGELOG.md
• backend/alembic/versions/0018_email_media_quarantine.py
• backend/db/models.py
• backend/services/email_import_service.py
• backend/services/email_media_quarantine.py
• backend/services/email_media_resolution.py
• backend/services/email_parser.py
• backend/services/imap_worker.py
• backend/tests/test_alembic_migrations.py
• backend/tests/test_email_media_quarantine.py
• backend/tests/test_email_media_quarantine_boundaries.py
• docs/architecture/image-content-detection.md
• docs/doctoring/email-inline-media-admission.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR governance metadata gate is not ready for ff1dc18cd9de5e06649ac516b163af2db4bbde83:

• Draft PR: merge automation is paused.

[seonghobae]

@coderabbitai review

Please review the unchanged exact current head 0bc7f62c2bcdfe273ff75e2b96067ab29f4ab0da stacked on Draft #1398 db968876. Predecessor #1398/#1397 evidence does not transfer. Local focused tests: 92 passed; services.email_media_quarantine 100% branch coverage. This comment is not an approval. Keep Draft.

[coderabbitai]

@seonghobae I will review the specified exact head. I will treat predecessor evidence as non-transferable. The PR remains Draft.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai review

Please review the unchanged exact current head ff1dc18cd9de5e06649ac516b163af2db4bbde83 stacked on live #1398 1af546db. Predecessor 0bc7f62c evidence does not transfer. Local focused tests: 92 passed; persist module 100% coverage. This comment is not an approval. Keep Draft.

[coderabbitai]

@seonghobae I will review exact head ff1dc18cd9de5e06649ac516b163af2db4bbde83 against live #1398 head 1af546db. I will treat evidence for 0bc7f62c and predecessor PRs as non-transferable. The PR remains Draft.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.