postfix: long, non-repeating queue ids

The owner, 2026-10-16, of three ways to stop a reused queue id reaching an
older row (found by the technical review of inbound-upstream-result, L6):
"1" - enable_long_queue_ids=yes. A short id is the microsecond of arrival
and the queue file's inode in hex (Postfix 3.10.13, src/global/mail_queue.h,
MQID_SH_*) and repeats once the inode comes round; a later message with no
send-log row of its own (port-25 mail, a bounce Postfix sends) could then
rewrite an older Outbound log row of the same id and recipient, its page
could show the later message's stored lines (security.md's known exposure,
"enable_long_queue_ids ... ends it"), and the inbound journal's rows needed
detaching. A long id adds the time in seconds and does not repeat
(MQID_LG_*; proto/postconf.proto: existing queue files keep their names,
postqueue -p gets a wider Queue ID column). Every pattern of the panel
takes both shapes (queueLineRe's long branch, the [0-9A-Za-z]+ of the
others, queueEntryRe) - checked one by one.

Tests: e2e reads a long id on an outbound send-log row
(testExpiredMessageIsClosed) and on an inbound journal row
(testInboundUpstreamDown). go vet + go test (26 packages) and make e2e on
the test server for this tree.

Docs: security.md (the collision bullet closed for new mail, the upstream
bullet), architecture § Log tailer, delivery-log-storage's note, the
ForgetInboundQueueID comment; CHANGELOG [Unreleased] § Fixed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/inboundspam.go

@@ -135,11 +135,12 @@ const (
 
 // ForgetInboundQueueID detaches the journal rows of a queue id from it: those
 // still open lose their result too, as nothing will ever report it. The
-// milter calls it before it writes a new message's rows - Postfix reuses
-// queue ids (enable_long_queue_ids=no, the default: microseconds and the
-// queue file's inode, src/global/mail_queue.h), and only one live queue file
-// has an id, so older rows of it are of a message that is gone and must not
-// take the new one's results. The tailer calls it when cleanup removes a
+// milter calls it before it writes a new message's rows - a short queue id
+// repeats (microseconds and the queue file's inode, src/global/mail_queue.h;
+// the image has made long, non-repeating ones since 2.10.1, but a queue file
+// from before keeps its short name), and only one live queue file has an id,
+// so older rows of it are of a message that is gone and must not take the
+// new one's results. The tailer calls it when cleanup removes a
 // queue file it did not queue ("removed (canceled)"): the milter had written
 // the rows, but the message was never queued.
 func (s *Store) ForgetInboundQueueID(queueID string) error {