feat(email): Slice 3 buyer-visible withheld-media next actions

[seonghobae]

Description

#1350 Slice 3 follow-on stacked on Draft #1399. Quarantine rows now persist in email_media_quarantine_records, but the mail UI did not tell the customer that an inline image was withheld and was not sent to a model.

This draft adds an authenticated owner-scoped read of already-persisted rows and renders the next action on the existing EmailDetail mail surface. It does not invent a second classifier, does not copy the #1376 EmailMediaArtifact pixel contract, does not render withheld image bytes, and does not fetch remote http(s).

Exact previous head: d392fc742d9129eaddf615f2283e378270c1babc (stale parent 0bc7f62c2bcdfe273ff75e2b96067ab29f4ab0da)
Exact current head: db7ca961de800a514cf9bee34d324f1c5cf233bb
Exact parent SHA (live #1399 head): ff1dc18cd9de5e06649ac516b163af2db4bbde83
Live #1398 / #1397 / develop: 1af546dbb01964e9a620ed341ae0dd3dab9439fd / 37b4af566d749028f7dc99545fff1db517d61d1a / dd8d15191338b841f9e6f3a06507c6a5643b95d0

Predecessor evidence does not transfer. The previous #1400 head tests, coverage, and review evidence, and #1399 / #1398 / #1397 predecessor-head evidence, are not this head's proof. Re-run the focused UI/API and persist/admission/resolution/parser tests on this exact head.

Refs #1350

Customer next action

Tell the customer what was withheld and what to do next. The mail detail surface now shows:

• tracking_pixel: "This inline image was withheld as a tracking pixel. It was not sent to a model."
• unsupported_media: "This inline part is unsupported and was withheld. It was not sent to a model."
• unresolved_cid_reference: "This cid: image could not be resolved from the same message and was withheld. It was not sent to a model."

Empty persist sets fail closed to {quarantine_records: []} and invent no withheld-media copy. Do not send a tracker, unsupported part, or unresolved CID to a model. Do not merge this draft until it is no longer Draft and a qualifying independent APPROVE exists on the unchanged head. Keep #1399, #1398, and #1397 Draft as well.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

Exact-head verification

Retarget: normal merge db7ca961 of live #1399 (cursor/email-media-quarantine-persist-0ad6 @ ff1dc18c, which already contains #1398 @ 1af546db → #1397 @ 37b4af56 / develop@dd8d1519) into cursor/email-media-quarantine-ui-5fff. Not a squash. Not a force-push of develop.

Focused product tests on this exact head:

cd backend
PYTHONPATH=. PYTHONWARNINGS=error python3 -m pytest \
  tests/test_email_media_admission.py \
  tests/test_email_media_admission_boundaries.py \
  tests/test_email_media_resolution.py \
  tests/test_email_media_resolution_boundaries.py \
  tests/test_email_parser.py \
  tests/test_email_media_quarantine.py \
  tests/test_email_media_quarantine_boundaries.py \
  tests/test_email_media_quarantine_read.py \
  tests/test_email_media_quarantine_api.py -q
# 101 passed

cd frontend
corepack pnpm@11.5.3 test src/lib/email-media-quarantine.test.ts src/components/EmailDetail.test.tsx
# 27 passed

Owned read-module coverage on this exact head:

cd backend
PYTHONPATH=. python3 -m coverage run --branch --source=services.email_media_quarantine_read \
  -m pytest tests/test_email_media_quarantine_read.py tests/test_email_media_quarantine_api.py -q
python3 -m coverage report -m
# services/email_media_quarantine_read.py  39  0  10  0  100%

Local counts on db7ca961: 101 passed backend, 27 passed frontend. Predecessor-head #1400 / #1399 / #1398 / #1397 figures do not transfer.

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

Merge boundary

This PR must remain Draft. Merge is prohibited while Draft and prohibited without a qualifying independent non-author APPROVE on the unchanged head. Do not self-approve, mark Ready, squash-merge over a draft, merge #1399, #1398, or #1397, or treat predecessor/stacked/#1376 evidence as this head's proof.

  

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 12 minutes

Limit details: You’ve used all 1 included review currently available under your plan.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 711afeba-a41b-4e7b-aca2-9d35665c3fd2

📥 Commits

Reviewing files that changed from the base of the PR and between ff1dc18 and db7ca96.

📒 Files selected for processing (12)

• AGENTS.md
• CHANGELOG.md
• backend/api/emails.py
• backend/services/email_media_quarantine_read.py
• backend/tests/test_email_media_quarantine_api.py
• backend/tests/test_email_media_quarantine_read.py
• docs/architecture/image-content-detection.md
• docs/doctoring/email-inline-media-admission.md
• frontend/src/components/EmailDetail.test.tsx
• frontend/src/components/EmailDetail.tsx
• frontend/src/lib/email-media-quarantine.test.ts
• frontend/src/lib/email-media-quarantine.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR governance metadata gate is not ready for db7ca961de800a514cf9bee34d324f1c5cf233bb:

• Draft PR: merge automation is paused.

[seonghobae]

@coderabbitai review

Please review the unchanged exact current head d392fc742d9129eaddf615f2283e378270c1babc stacked on Draft #1399 0bc7f62c. Predecessor persist/wiring/admission evidence does not transfer. Local: backend 101 passed, frontend 27 passed, email_media_quarantine_read 100% branch coverage. This comment is not an approval. Keep Draft.

[coderabbitai]

@seonghobae I will review pull request #1400 at d392fc742d9129eaddf615f2283e378270c1babc. I will treat the predecessor evidence as non-transferable. The pull request remains Draft.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai review

Please review the unchanged exact current head db7ca961de800a514cf9bee34d324f1c5cf233bb stacked on live #1399 ff1dc18c. Predecessor d392fc74 evidence does not transfer. Local: backend 101 passed, frontend 27 passed, quarantine_read 100%. This comment is not an approval. Keep Draft.

[coderabbitai]

@seonghobae I will review pull request #1400 at db7ca961de800a514cf9bee34d324f1c5cf233bb. I will treat d392fc74 evidence as non-transferable. The pull request remains Draft.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}