connector-imap + minimal service-mailbox: shared-mailbox (forward/BCC) ingest into sys_mail_message, associated at ingest through the seam — phase 1 of #8998 inbound mail #22871

Filing gate: ④ — a per-layer child of the coordination node #8998. Part of #8998.

Blocked-by: #22870

Provenance: same as #22870.

• Design record service: inbound mail + calendar sync (open-core scope) — plugin-email is outbound-only, so email-to-record is impossible in any app #8998 5311578770, maintainer verbatim 「同意，请记录你的分析结论，但是这个任务我刻意标了 v18，暂时不做。」
• Phase-1 carve ordered in 6038989766.
• Filed on the maintainer's order in session session_01EgxC4UNYnzhuvmG12fh5A8, verbatim 「该关的关，改开卡的开卡」.

This card carries phase 1's ingest half. It waits on #22870, which publishes the object (sys_mail_message) and the association seam this card writes to and calls.

Scope

Taken from the design record. ⛔ Nothing here re-decides it.

• packages/connectors/connector-imap: protocol and auth only, following the existing connector convention (connector-rest, connector-openapi, connector-mcp, connector-slack). The account + credential abstraction is shaped for the per-user mailbox now. The shared mailbox is its first implementor (decision 4), so per-user sync later extends it rather than rewriting it.

• packages/services/service-mailbox, minimal:

  • folder cursor and UID state;
  • incremental fetch, dedupe and threading;
  • attachment extraction;
  • bounce and auto-reply suppression.

  It writes sys_mail_message, calls the seam at ingest and stamps the association. Unmatched messages go to the pool, and the explicit re-match action retro-matches them (decisions 2 and 3).

• Phase-1 privacy semantic: "forwarding is consent" (decision 5).

• ⛔ Out of scope, as chained follow-ups filed once phase 1 proves out:

  • per-user IMAP sync;
  • CalDAV and calendar;
  • write-back;
  • the enterprise admin plane (tenant-wide delegation, bulk provisioning, sync health).

Why one card covers two packages: phase 1's connector has exactly one consumer (this service), and neither can be proven end to end alone. The lane may split it at claim time through pm:retriage.

Acceptance

An end-to-end test against an in-process IMAP server double:

• A forwarded message ingested from the shared mailbox lands as one sys_mail_message row, with the association stamped by an app-supplied resolver.
• A second fetch dedupes, and the row count stays 1.
• An unmatched message lands in the pool, and the re-match action associates it once a matching record exists.
• An auto-reply is suppressed.

Each clause has a negative control that fails when the behaviour is removed.

Who acts

The domain:services seat, size L, once #22870 lands. Clause-②: yes, because it adds two published packages.

Dedup

Same queries and readings as #22870. No mail-ingest, IMAP or calendar card exists besides #8998.