docs: roadmap checklists, Progress column, commit/version protocol

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/plans/inbound-relay.md

@@ -169,3 +169,25 @@ the SelfPost image, brought up by the operator when the option is enabled.
 
 A finished outbound path (already implemented). Agreement obtained — see the
 status above.
+
+## Implementation checklist
+
+Target version cut: **`1.4.0`** (MINOR). One commit per step; see
+[development.md](../development.md) § Plan checklists. UI reference:
+[panel-ui inbound mockups](../assets/panel-ui/inbound.html).
+
+- [ ] Migration: inbound domain / recipient / transport tables under `/data` — **Opus**
+- [ ] `INBOUND_RELAY_ENABLE` (default false) in entrypoint + `postfix-config.sh` — **Opus**
+- [ ] `master.cf`: inbound `smtp inet` on 25; separate from 465/587 — **Opus**
+- [ ] Generate `relay_domains`, `transport_maps`, `relay_recipient_maps` (injection-safe) — **Opus**
+- [ ] `smtpd_relay_restrictions` / recipient maps — no open relay, no backscatter — **Opus**
+- [ ] `internal/store` CRUD + validation (domain, host, port) — **Opus**
+- [ ] Panel: list, add, domain detail, recipients, danger zone (mockups) — **Sonnet**
+- [ ] Rate limit + `message_size_limit` on inbound smtpd — **Opus**
+- [ ] Optional `INBOUND_ANTISPAM_MILTER` + compose fragment — **Opus**
+- [ ] DNS MX copy in README/guide; `.env.example` — **Sonnet**
+- [ ] Backup/export inbound config (per plan optional flag) — **Opus**
+- [ ] Unit + handler tests; image build and container smoke — **Opus**
+- [ ] [guide.md](../guide.md) and [security.md](../security.md) — **Sonnet**
+- [ ] Security review inbound path — **Fable**
+- [ ] `go vet`, `go test`, e2e if applicable — **Haiku**