inbound-upstream-result: the upstream's answer in the Inbound log

The owner, 2026-10-16: the Inbound log lacks the upstream's answer - "Не
понятна судьба письма: принято, отклонено, хост не доступен"; the result
in the row only, a page per message later if needed. Mockups 5348330 and
46b90d2, plan 295d72e.

- Migration 0012: inbound_spam_log gains queue_id, upstream_status ('',
  queued, held, sent, deferred, bounced; CHECK), upstream_relay,
  upstream_reply, upstream_at, and a partial index on queue_id. Schema 12.
- The inbound journal milter writes an accepted row with the queue id of
  end-of-message and "queued" ("held" when the filter had it held), the
  recipient as Postfix logs it (recipientAsLogged), after detaching older
  rows of a queue id Postfix uses again; no queue id, no result.
- The tailer: a delivery line no send-log row took goes to the journal -
  status, relay= ("" for none), the reply after the first status=, cut to
  255 printable bytes, the line's time; queued/held/deferred rows only,
  sent and bounced final. qmgr's expiry makes them bounced, keeping the
  last reply. cleanup's "removed (" detaches rows of a message never
  queued. Addresses in delivery lines are read by Postfix's quoting
  (loggedAddress): a quoted RCPT TO cannot end one early.
- The page: an Upstream column - a plain tag for queued and held, else a
  tag opening the host, the reply, when and what follows; "—" for refused
  mail and older rows. Help (word for word with the mockup), guide,
  architecture, security, schema-migrations, CHANGELOG.

Reviewed before the commit (technical and security, 2026-10-16); the plan
lists each finding and what it became.

Tests: store (results, finality, expiry, held, a reused id, the queue-id
index in every plan), milter (queue id, held, quoted recipient, no {i}),
logtail (relay and reply, a forged quoted recipient, Run hands the journal
what the send log did not take, cleanup's removal), view (the column, held,
null sender), e2e (both relayed messages sent with the sink's 250; an
upstream refusing connections deferred with the reason and no host, then
expired to bounced; the refused row has none). go vet + go test (26
packages) and make e2e on the test server for this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/view/inbound_log.go

@@ -68,9 +68,9 @@ type InLog struct {
 
 // InLogRow is one recipient of one message: when it was decided, who the mail
 // was from (and the address of the server that offered it) and for, its subject,
-// the decision as a tag that opens the sheet saying who decided and why, and —
-// for the global role, who alone edits the filter lists — the way to correct
-// the decision.
+// the decision as a tag that opens the sheet saying who decided and why, what
+// the upstream made of it, and — for the global role, who alone edits the
+// filter lists — the way to correct the decision.
 type InLogRow struct {
 	Time    string
 	From    string
@@ -78,7 +78,13 @@ type InLogRow struct {
 	To      string
 	Subject string
 	Why     Sheet
-	Action  *Anchor
+	// Upstream is the upstream's answer, a tag that opens a sheet with the
+	// last reply; Pending is a message not tried yet - queued, or held by the
+	// filter - a plain tag. Neither for refused mail and rows from before
+	// 2.10.0, which show "—".
+	Upstream *Sheet
+	Pending  *Tag
+	Action   *Anchor
 }
 
 // InLogRowInput is what the journal holds about one row. Subject, Detail and
@@ -97,6 +103,12 @@ type InLogRowInput struct {
 	Decision string
 	Engine   string
 	Detail   string
+	// The upstream's answer (store.Upstream…): its status, "" for none, the
+	// host that gave it ("" when Postfix had no session), the reply and when.
+	Upstream      string
+	UpstreamRelay string
+	UpstreamReply string
+	UpstreamAt    time.Time
 }
 
 // NewInLog builds the log for a viewer. domains are the choices of the domain
@@ -105,7 +117,7 @@ type InLogRowInput struct {
 // change it and who edits the lists, is read from m.
 func NewInLog(m Meta, retentionDays int, domains []string, filter InLogFilter) *InLog {
 	m.Title, m.Section, m.Page = "Inbound log", "inbound", "log"
-	lead := Rich("What port 25 decided about each message, one row per recipient. Accepted mail is recorded as it passes, refused mail is read from ",
+	lead := Rich("What port 25 decided about each message and what the upstream answered, one row per recipient. Accepted mail is recorded as it passes, refused mail is read from ",
 		Code("mail.log"), "; the filter's verdict appears when the spam filter is on. Rows older than "+plural(int64(retentionDays), "day", "days")+" are deleted")
 	if m.IsGlobal {
 		lead = append(lead, Inline{Text: " — change that in "}, Link("/server/settings", "Settings"))
@@ -152,12 +164,50 @@ func (p *InLog) NewRow(in InLogRowInput) InLogRow {
 			Rows: whyRows(in.Decision, in.Engine, in.Detail, in.Subject),
 		},
 	}
+	switch in.Upstream {
+	case "queued", "held":
+		r.Pending = &Tag{Status: in.Upstream}
+	case "sent", "deferred", "bounced":
+		r.Upstream = &Sheet{
+			ID: "up-" + strconv.FormatInt(in.ID, 10), Tag: Tag{Status: in.Upstream}, Title: "Upstream",
+			Rows: upstreamRows(in),
+		}
+	}
 	if p.IsGlobal && in.Listable {
 		r.Action = senderAction(in.Decision, in.Engine, in.From)
 	}
 	return r
 }
 
+// upstreamRows is the content of the Upstream sheet: the host that answered
+// (none when Postfix could not open a session: the reply names the host
+// then), the last reply, when it came, and what follows a deferral or a
+// bounce - a bounce to the sender, unless the message had none to return to
+// (Postfix does not bounce mail from the null sender).
+func upstreamRows(in InLogRowInput) []SheetRow {
+	var rows []SheetRow
+	if in.UpstreamRelay != "" {
+		rows = append(rows, SheetRow{Label: "Host", Lines: []string{in.UpstreamRelay}, Mono: true})
+	}
+	if in.UpstreamReply != "" {
+		rows = append(rows, SheetRow{Label: "Reply", Lines: []string{in.UpstreamReply}, Mono: true})
+	}
+	if !in.UpstreamAt.IsZero() {
+		rows = append(rows, SheetRow{Label: "At", Lines: []string{FormatLogTime(in.UpstreamAt)}, Mono: true})
+	}
+	switch in.Upstream {
+	case "deferred":
+		rows = append(rows, SheetRow{Label: "Then", Lines: []string{"Postfix tries again; the message is in the queue"}})
+	case "bounced":
+		then := "The sender was sent a bounce"
+		if in.From == "" {
+			then = "No bounce: the message had no return address"
+		}
+		rows = append(rows, SheetRow{Label: "Then", Lines: []string{then}})
+	}
+	return rows
+}
+
 // whyRows is the content of a row's sheet: who decided, what they said, and
 // the subject whole, which the table clips. What was said has one of two
 // shapes, and the decision says which. Mail that passed was written by the
@@ -226,9 +276,9 @@ func (p *InLog) WithRows(rows []InLogRow, page, last int) *InLog {
 		p.Foot.Link = &Anchor{Href: InLogHref(p.filter, page+1), Label: "Older →"}
 	}
 	if p.IsGlobal {
-		p.Foot.End = Rich("A decision opens its reason · Allow / Deny sender opens ", Link(inboundFilterLists, "Filter lists"), " with the entry filled in")
+		p.Foot.End = Rich("A decision opens its reason, an upstream result its last reply · Allow / Deny sender opens ", Link(inboundFilterLists, "Filter lists"), " with the entry filled in")
 	} else {
-		p.Foot.End = Plain("A decision opens its reason")
+		p.Foot.End = Plain("A decision opens its reason, an upstream result its last reply")
 	}
 	return p
 }