test-email: a test message from Server › Health

Decided by the owner on 2026-10-13 (out of preflight); the sender is his
choice of 2026-10-16 ("Да, адрес годится"); mockups e92769f, e3b2501,
8f0ccf9, the route guard 75f97c9.

Card 09 on Health, in the right stack's static end (the left stack is
polled whole): one recipient and Send. HandleTestMessage (global role)
takes one address (validate.AccountEmail - no list, nothing that reads as
an option), at most ten an hour counted from the send log, writes the
message's send-log row first (store.InsertTestMessage: queued, the
hostname as domain, no application, no queue id), awaits its Message-ID
(logtail.AwaitMessageID) and hands it to sendmail as notifications go
(notify.Mailer.SendWithID: postmaster@ the hostname, signed by the local
socket with the key of the server's own name). The browser lands on the
row; the tailer gives it its queue id from cleanup's message-id= line
(src/cleanup/cleanup_message.c:639) and from then on its delivery lines
its status. Postfix refusing the hand-over removes the row; sendmail out
of time keeps it (postdrop may have queued it). The sweep closes a row
whose id was never seen once it is no longer awaited
(CloseUnmatchedTestMessages); an id awaited past ten minutes is not taken.

Reviewed for security before the commit (2026-10-17): no high or medium;
its three low findings are fixed in this commit (the unmatched row's
close, the awaited id's age, the timeout keeping the row) and the
security.md bullet says how the queue id is matched.

Tests: TestTestMessage (refusals, the row and the page, Postfix refusing,
the hourly ten), TestTestMessageTimeoutKeepsTheRow, TestTestMessageRows,
TestCloseUnmatchedTestMessages, TestAwaitedMessageID,
TestRunGivesTheTestMessageItsQueueID, TestHealthTestMessageCard; e2e sends
one to the sink: the row is sent with a long queue id, the sink has it
signed d=mail.e2e.test. go vet + go test (26 packages) and make e2e on the
test server for this tree.

Docs: help (word for word with the mockup), guide § Overview and Health,
architecture § Log tailer, security.md, CHANGELOG [Unreleased] § Added,
roadmap row done.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/notify/mailer.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"crypto/rand"
 	"encoding/hex"
+	"errors"
 	"fmt"
 	"mime"
 	"os/exec"
@@ -38,6 +39,21 @@ func From(hostname string) string { return "postmaster@" + hostname }
 
 // Send submits one message to one recipient.
 func (m *Mailer) Send(to, subject, body string) error {
+	id, err := NewMessageID(m.hostname)
+	if err != nil {
+		return err
+	}
+	return m.SendWithID(to, subject, body, id)
+}
+
+// NewMessageID makes a Message-ID of the server's own name, for a message the
+// caller wants to know again in mail.log (the panel's test message).
+func NewMessageID(hostname string) (string, error) { return messageID(hostname) }
+
+// SendWithID is Send with the Message-ID given: cleanup logs it with the
+// message's queue id, which is how the panel finds its test message in
+// mail.log (logtail.AwaitMessageID).
+func (m *Mailer) SendWithID(to, subject, body, id string) error {
 	// The address is a panel user's, validated when it was saved. It goes into
 	// a header and onto a command line all the same, so what cannot be part of
 	// an address is refused here as well (security.md).
@@ -47,10 +63,6 @@ func (m *Mailer) Send(to, subject, body string) error {
 		return fmt.Errorf("not an address a notification can go to: %q", to)
 	}
 	from := From(m.hostname)
-	id, err := messageID(m.hostname)
-	if err != nil {
-		return err
-	}
 
 	var b bytes.Buffer
 	fmt.Fprintf(&b, "From: SelfPost <%s>\r\n", from)
@@ -81,6 +93,10 @@ func messageID(hostname string) (string, error) {
 	return fmt.Sprintf("<%s.%d@%s>", hex.EncodeToString(raw[:]), time.Now().Unix(), hostname), nil
 }
 
+// ErrTimeout is sendmail not answering in time: postdrop may have queued the
+// message all the same.
+var ErrTimeout = errors.New("sendmail timed out")
+
 // sendmail submits msg through Postfix's sendmail command. The argument list is
 // fixed apart from the two addresses, which follow "--" so that neither can be
 // read as an option; nothing goes through a shell (security.md). -i keeps a
@@ -95,7 +111,7 @@ func sendmail(from, to string, msg []byte) error {
 	cmd.WaitDelay = 5 * time.Second
 	out, err := cmd.CombinedOutput()
 	if ctx.Err() == context.DeadlineExceeded {
-		return fmt.Errorf("sendmail timed out after %s", sendmailTimeout)
+		return fmt.Errorf("%w after %s", ErrTimeout, sendmailTimeout)
 	}
 	if err != nil {
 		return fmt.Errorf("sendmail: %w: %s", err, strings.TrimSpace(string(out)))