logtail: a refusal the panel did not get to write is written from mail.log (stage 2b)

The sender check answers 550 5.7.1 and writes the refused row through a
buffer a moment later; a panel stopped in between (a rollout, a kill) left
an application refused and a log that did not know it. A refusal at MAIL
FROM needs nothing: the journal milter writes its row before it answers.

- logtail.refusalLines remembers each queue id's login from smtpd's
  "<id>: client=..., sasl_username=<login>" (4096 ids at most) and, on
  cleanup's "<id>: milter-reject: END-OF-MESSAGE ...: 5.7.1 From: <line> -
  <why>; from=<...> to=<...>", waits 30 s and hands it to
  store.RecoverRefusal - an INSERT ... WHERE NOT EXISTS a refused row of that
  queue id within two minutes: the row the panel wrote, or one recovered
  before, means nothing is written. It is read from the saved offset on, so
  a kill is covered as well as a clean stop - which a flush of the buffer at
  shutdown would not.
- Migration 0009 (not deployed yet) gains send_log.recovered; the row is
  written with the line's time, the login's domain id, reason "from", the
  From: line as the check printed it (to the last " - " before ";").
- The message page: a fact "Written: from mail.log after a restart: the
  panel stopped before it wrote the refusal".

Tests: store (not written when the panel wrote it; written once however
often); logtail (the login from client=, the From: line with a " - " in it,
nothing before the wait is over); view (the fact). e2e
refusal_recovered_from_the_log: a From: refusal, the panel stopped, its row
deleted and the tailer's saved place moved before the message's first line
(python3 in the container, as the panel's user - a kill cannot be timed to
that moment from outside); started again, the row is back, recovered, once.

Also fixed: handlers TestMessagePageOfARefusedMessage still expected the
old sentence; it failed on the server after e166a2e, whose run showed only
the schema failures - now it wants the new one.

schema-migrations row 9, CHANGELOG [Unreleased], audit plan line ticked,
roadmap 26/62.
Evidence on the test server for this tree but the handler-test fix: make e2e
exit 0 (the new case 37 s); go test 22/23 ok, the 23rd that test - fixed,
passes locally; the full run follows before the push.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/view/outbound_log.go

@@ -173,8 +173,11 @@ type MessageInput struct {
 	// (store.Reason*) and, for its From: line, what that line said.
 	Reason     string
 	HeaderFrom string
-	Accepted   time.Time
-	Reported   time.Time
+	// Recovered is a refused row the log tailer wrote from mail.log: the
+	// panel stopped before it wrote the row itself.
+	Recovered bool
+	Accepted  time.Time
+	Reported  time.Time
 	// BackHref is the log the message was opened from, filters and page kept.
 	BackHref string
 }
@@ -258,6 +261,9 @@ func NewOutMessage(m Meta, in MessageInput) *OutMessage {
 			facts = append(facts, Fact{Label: "From: line", Value: Plain(orDash(in.HeaderFrom)), Mono: true, Small: true})
 			history.Help = topicLink(HelpSenderCheck, "What an application may write in From:")
 		}
+		if in.Recovered {
+			facts = append(facts, Fact{Label: "Written", Value: Rich("from ", Code("mail.log"), " after a restart: the panel stopped before it wrote the refusal")})
+		}
 		if in.QueueID != "" {
 			facts = append(facts, Fact{Label: "Queue id", Value: Rich(Mono(in.QueueID), " — given, the message was not queued")})
 		} else {

internal/web/view/outbound_log_test.go

@@ -148,6 +148,16 @@ func TestOutMessageRefusedForItsFromLine(t *testing.T) {
 		`Lines from <code>mail.log</code> with this queue id`, `<span class="sp-e">postfix/cleanup[2120]: 7BCAF3C75DA0: milter-reject`)
 }
 
+// A refused row the log tailer wrote from mail.log says so.
+func TestOutMessageRecoveredFromTheLog(t *testing.T) {
+	at := time.Date(2026, 9, 21, 13, 40, 55, 0, time.UTC)
+	p := NewOutMessage(admin(), MessageInput{ID: 184232, QueueID: "E543D3C75DA0", Domain: "shop.example.org", App: "shop",
+		From: "shop@shop.example.org", To: "k.berg@web.de", Status: "rejected", Reason: "from", HeaderFrom: "director@example.org",
+		Recovered: true, Accepted: at, Reported: at}).WithDeliveryLog(nil, "")
+	out := renderSignedIn(t, "out-message", p)
+	pageHas(t, "Message", out, `<dt>Written</dt>`, `after a restart: the panel stopped before it wrote the refusal`)
+}
+
 func TestSendLogTag(t *testing.T) {
 	for _, c := range []struct {
 		status, reason string