[cliftonc]

To ship in 3.7.0.

inbox: forwarded-as-attachment email is split. Gmail's "Forward as attachment" sends one email with N message/rfc822 parts. Until now they were stored as .eml attachments, so consumers never saw them and knowledge ingestion skipped them. A part with no disposition was merged into the parent body instead.

• inbox.parse uses postal-mime's forceRfc822Attachments, so every embedded message is a part of its own.
• Each part becomes a child message with its own R2 prefix and its own inbox.parse. It carries the embedded From, Subject, Date and Message-ID, and the parent's SPF/DKIM/DMARC verdict, because its own signatures can't be checked once re-wrapped. forwarded_by records the forward's envelope sender.
• The parent keeps the .eml rows, with expanded_message_id pointing at the child. Those rows are kept out of consumer attachments, knowledge and attachment_count, so nothing processes an email twice.
• Dedupe: a unique (tenant_id, parent_message_id, source_sha256) index stops redelivery or reprocessing from creating a second child. An embedded Message-ID the tenant already has is linked instead of stored again.
• Caps: depth 3 and 50 children per message. Past either cap the parts stay attachments, and past the children cap the message's error says how many.
• Consumer payload (InboxParsedMessage), additive: parentMessageId, forwardedBy, forwardedMessageIds.
• API and UI: summaries gain parentMessageId/forwardedBy/forwardedCount, and details gain parent/forwardedMessages. The page shows "Contains N forwarded emails" and "Forwarded inside …".
• Schema: inbox_messages gains parent_message_id, forwarded_by, forward_depth, source_sha256 and forwarded_count. inbox_attachments gains expanded_message_id. All columns are nullable or defaulted, and the host generates the DDL.
• Tests: tests/api/forwarded.test.ts covers two attached receipts becoming children with the right sender and subject, an inline rfc822 part, idempotent redelivery with consumers called once per child, Message-ID linking, the depth cap, the children cap and tenant isolation.

Duplicate note copies removed. plugins/{inbox,freeagent}/docs/plugins/<id>/upgrades/ were left behind by pnpm plugin export in 3.6.0. docs/upgrades/ is canonical, because the installer maps it to the host's docs/plugins/<id>/upgrades/. The README now says to delete the export's copy.

Run locally against kit 0.22.0: installing from this checkout, db:generate, pnpm gate and plugin check all pass. Generating a migration from an inbox 3.6.0 install gives six ADD COLUMNs, two FKs and one partial unique index.

🤖 Generated with Claude Code