feat(panel): lay a delivery's log lines out as a table

The lines came out as one block of preformatted text, which is what the
system log page does with a tail of mail.log — right there, where the
lines are unrelated to each other and the block is the log itself. Here
they are one message's six or seven lines, and what is read off them is
the pace: the second between the connection and the banner, the ten
between DATA and the reply. Run together, every line began with a
different-width stamp and none of those numbers lined up.

So they are two columns now, when and what, the same shape the send log
itself has. logtail.SplitTimestamp takes the stamp off the head of a
line: postlogd's format, which is what this server writes, and syslog's
traditional one for a deployment that routes the log through syslogd
instead. The stamp loses its microseconds and its offset — five decimal
places are the widest part of the column and the least worth reading —
but is not converted, so the page shows the log's own wall clock rather
than a claim about which zone it was in.

A line whose head is not a stamp either parser recognises keeps its whole
text in the second column and leaves the first empty. The format is the
log's, not ours; a line we cannot split is a line we must not drop, and
the test says so.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/logtail/logtail.go

@@ -280,6 +280,37 @@ func isQueueIDByte(b byte) bool {
 	return b >= '0' && b <= '9' || b >= 'A' && b <= 'Z' || b >= 'a' && b <= 'z'
 }
 
+// Timestamps at the head of a mail.log line. The first is what Postfix's own
+// postlogd writes, which is what this server runs (maillog_file in
+// build/postfix-config.sh) — RFC 3339 down to microseconds and with an offset.
+// The second is syslog's traditional format, for a deployment that routes the
+// log through syslogd instead; it carries no year and no zone, which is why it
+// is not the one being matched first.
+var (
+	isoStampRe    = regexp.MustCompile(`^(\d{4}-\d{2}-\d{2})T(\d{2}:\d{2}:\d{2})(?:\.\d+)?(?:Z|[+-]\d{2}:?\d{2})?\s`)
+	syslogStampRe = regexp.MustCompile(`^([A-Z][a-z]{2}\s+\d{1,2} \d{2}:\d{2}:\d{2})\s`)
+)
+
+// SplitTimestamp separates the timestamp at the head of a mail.log line from
+// the rest of it, so a page can put the two in their own columns. The stamp
+// comes back without its fractional seconds and zone offset — five decimal
+// places of microsecond are the widest part of the column and the least worth
+// reading — but is otherwise the log's own wall clock, not converted: what is
+// on the page is what is in the file.
+//
+// A line whose head is not a timestamp this recognises comes back whole, as
+// rest, with an empty stamp. Nothing is ever dropped: the point of showing the
+// log is that it says what it says.
+func SplitTimestamp(line string) (stamp, rest string) {
+	if m := isoStampRe.FindStringSubmatch(line); m != nil {
+		return m[1] + " " + m[2], strings.TrimSpace(line[len(m[0]):])
+	}
+	if m := syslogStampRe.FindStringSubmatch(line); m != nil {
+		return m[1], strings.TrimSpace(line[len(m[0]):])
+	}
+	return "", line
+}
+
 // follow tails path line by line, calling handle for each complete line, until
 // ctx is cancelled. Where it starts is tr's decision (a persisted offset, the
 // start of a file that changed while the panel was down, or end-of-file on a

internal/logtail/logtail_test.go

@@ -454,3 +454,64 @@ func TestQueueLinesReadsABoundedTail(t *testing.T) {
 		t.Errorf("got %d lines, want only the one inside the budget:\n%s", len(lines), strings.Join(lines, "\n"))
 	}
 }
+
+// The delivery page shows a message's lines as a table of when and what, so the
+// timestamp has to come off the head of the line — in either of the two formats
+// a mail log arrives in — and nothing may be lost doing it.
+func TestSplitTimestamp(t *testing.T) {
+	cases := []struct {
+		name        string
+		line        string
+		stamp, rest string
+	}{
+		{
+			name:  "postlogd, which is what this server writes",
+			line:  "2026-08-03T05:15:52.219218+00:00 mail postfix/smtp[26]: 4A1B2C3D: to=<a@example.net>, status=sent (250 OK)",
+			stamp: "2026-08-03 05:15:52",
+			rest:  "mail postfix/smtp[26]: 4A1B2C3D: to=<a@example.net>, status=sent (250 OK)",
+		},
+		{
+			name:  "no fractional seconds, zone as Z",
+			line:  "2026-08-03T05:15:52Z mail postfix/qmgr[10]: 4A1B2C3D: removed",
+			stamp: "2026-08-03 05:15:52",
+			rest:  "mail postfix/qmgr[10]: 4A1B2C3D: removed",
+		},
+		{
+			name:  "no zone at all",
+			line:  "2026-08-03T05:15:52 mail opendkim[30]: 4A1B2C3D: DKIM-Signature field added",
+			stamp: "2026-08-03 05:15:52",
+			rest:  "mail opendkim[30]: 4A1B2C3D: DKIM-Signature field added",
+		},
+		{
+			name:  "syslog's traditional format, padded day",
+			line:  "Aug  3 05:15:52 mail postfix/smtpd[20]: 4A1B2C3D: client=app.example.ru[203.0.113.4]",
+			stamp: "Aug  3 05:15:52",
+			rest:  "mail postfix/smtpd[20]: 4A1B2C3D: client=app.example.ru[203.0.113.4]",
+		},
+		{
+			name:  "unrecognised head keeps the whole line",
+			line:  "mail postfix/smtp[26]: 4A1B2C3D: to=<a@example.net>, status=sent (250 OK)",
+			stamp: "",
+			rest:  "mail postfix/smtp[26]: 4A1B2C3D: to=<a@example.net>, status=sent (250 OK)",
+		},
+		{
+			// A date-like run that is not the head of the line is not a stamp.
+			name:  "date inside the text is left alone",
+			line:  "mail postfix/smtp[26]: ABC: 220 mx.example.net ready at 2026-08-03T05:15:52+00:00",
+			stamp: "",
+			rest:  "mail postfix/smtp[26]: ABC: 220 mx.example.net ready at 2026-08-03T05:15:52+00:00",
+		},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			stamp, rest := SplitTimestamp(c.line)
+			if stamp != c.stamp || rest != c.rest {
+				t.Errorf("SplitTimestamp(%q) = (%q, %q), want (%q, %q)", c.line, stamp, rest, c.stamp, c.rest)
+			}
+			// Whatever the split, the line's own text survives it whole.
+			if !strings.Contains(c.line, rest) {
+				t.Errorf("the text column is not part of the line it came from: %q", rest)
+			}
+		})
+	}
+}