Journaling: capture at the queue, the built-in journal, retention

Phase 2 of the journaling spec.

- A copy of each message is taken in MessageWrapper::queue, after DLP and
  transport rules, for every enabled journal that takes it (direction and
  scope: everyone, or accounts, groups, domains, tenants). If the copy
  can't be taken the message isn't queued (temporary failure).
- The journal report: the envelope one field a line (sender, To, Cc, Bcc
  from the envelope, list members from their ORCPT, direction, held for
  review), then the queued message byte for byte as message/rfc822.
- The built-in journal under J in the inbuxa subspace: one chain per node
  whose links name each entry by SHA-256, so entries can expire out of
  chain order; purge leaves a marker, and verify catches an entry changed
  or removed early and a report that doesn't match.
- Retention per journal (30 to 3650 days); an entry keeps what it was
  written with. The daily maintenance purges what's due, keeping entries
  whose people a legal hold covers (deleted accounts a hold keeps too),
  and records the counts in the audit log.
- inbuxa:Journal get/set, audited by the request layer. Permissions
  680-683: administrators see and change journals; the Compliance Officer
  sees, searches and exports. Whoever changes journals may grant search and
  export without holding them, so officers can still be appointed.
- Catalog entries (inbuxa:Journal, source "journal"); spec as-built notes.

tests/src/system/journal.rs: validation, internal mail with a Bcc,
outgoing into two journals, incoming over LMTP, the report and its
original, tamper and early removal caught, hold-aware purge, retention
changes leave entries alone, disabled and removed journals take nothing.

crates/jmap-proto/src/object/inbuxa_journal.rs

@@ -0,0 +1,205 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Coffey Labs
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+//! `inbuxa:Journal/get` and `/set` under `urn:inbuxa:jmap`: journals
+//! (journaling spec, JR-9, JR-12). What a journal has taken stays when the
+//! journal changes or goes; each entry keeps its own retention.
+
+use crate::{
+    object::{AnyId, JmapObject, JmapObjectId},
+    request::deserialize::DeserializeArguments,
+};
+use jmap_tools::{Element, Key, Property};
+use std::{borrow::Cow, str::FromStr};
+use types::id::Id;
+
+#[derive(Debug, Clone, Default)]
+pub struct Journal;
+
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub enum JournalProperty {
+    Id,
+    Name,
+    Description,
+    Enabled,
+    /// `outgoing`, `incoming`, `internal` or `any`.
+    Direction,
+    /// Everyone, or chosen accounts, groups, domains and tenants.
+    Scope,
+    /// How long an entry is kept; each keeps what it was written with.
+    RetentionDays,
+    CreatedBy,
+    CreatedAt,
+    UpdatedAt,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub enum JournalValue {
+    Id(Id),
+}
+
+impl Property for JournalProperty {
+    fn try_parse(parent: Option<&Key<'_, Self>>, value: &str) -> Option<Self> {
+        // Keys inside the scope stay plain keys
+        match parent {
+            None => JournalProperty::parse(value),
+            Some(_) => None,
+        }
+    }
+
+    fn to_cow(&self) -> Cow<'static, str> {
+        match self {
+            JournalProperty::Id => "id",
+            JournalProperty::Name => "name",
+            JournalProperty::Description => "description",
+            JournalProperty::Enabled => "enabled",
+            JournalProperty::Direction => "direction",
+            JournalProperty::Scope => "scope",
+            JournalProperty::RetentionDays => "retentionDays",
+            JournalProperty::CreatedBy => "createdBy",
+            JournalProperty::CreatedAt => "createdAt",
+            JournalProperty::UpdatedAt => "updatedAt",
+        }
+        .into()
+    }
+}
+
+impl JournalProperty {
+    fn parse(value: &str) -> Option<Self> {
+        hashify::tiny_map!(value.as_bytes(),
+            b"id" => JournalProperty::Id,
+            b"name" => JournalProperty::Name,
+            b"description" => JournalProperty::Description,
+            b"enabled" => JournalProperty::Enabled,
+            b"direction" => JournalProperty::Direction,
+            b"scope" => JournalProperty::Scope,
+            b"retentionDays" => JournalProperty::RetentionDays,
+            b"createdBy" => JournalProperty::CreatedBy,
+            b"createdAt" => JournalProperty::CreatedAt,
+            b"updatedAt" => JournalProperty::UpdatedAt,
+        )
+    }
+}
+
+impl FromStr for JournalProperty {
+    type Err = ();
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        JournalProperty::parse(s).ok_or(())
+    }
+}
+
+impl Element for JournalValue {
+    type Property = JournalProperty;
+
+    fn try_parse<P>(key: &Key<'_, Self::Property>, value: &str) -> Option<Self> {
+        match key {
+            Key::Property(JournalProperty::Id) => Id::from_str(value).ok().map(JournalValue::Id),
+            _ => None,
+        }
+    }
+
+    fn to_cow(&self) -> Cow<'static, str> {
+        match self {
+            JournalValue::Id(id) => id.to_string().into(),
+        }
+    }
+}
+
+/// The set call's own argument: why, for the audit log.
+#[derive(Debug, Clone, Default)]
+pub struct JournalSetArguments {
+    pub reason: Option<String>,
+}
+
+impl<'de> DeserializeArguments<'de> for JournalSetArguments {
+    fn deserialize_argument<A>(&mut self, key: &str, map: &mut A) -> Result<(), A::Error>
+    where
+        A: serde::de::MapAccess<'de>,
+    {
+        if key == "reason" {
+            self.reason = map.next_value()?;
+        } else {
+            let _ = map.next_value::<serde::de::IgnoredAny>()?;
+        }
+        Ok(())
+    }
+}
+
+impl JmapObject for Journal {
+    type Property = JournalProperty;
+
+    type Element = JournalValue;
+
+    type Id = Id;
+
+    type Filter = ();
+
+    type Comparator = ();
+
+    type GetArguments = ();
+
+    type SetArguments<'de> = JournalSetArguments;
+
+    type QueryArguments = ();
+
+    type CopyArguments = ();
+
+    type ParseArguments = ();
+
+    const ID_PROPERTY: Self::Property = JournalProperty::Id;
+}
+
+impl From<Id> for JournalValue {
+    fn from(id: Id) -> Self {
+        JournalValue::Id(id)
+    }
+}
+
+impl JmapObjectId for JournalValue {
+    fn as_id(&self) -> Option<Id> {
+        match self {
+            JournalValue::Id(id) => Some(*id),
+        }
+    }
+
+    fn as_any_id(&self) -> Option<AnyId> {
+        match self {
+            JournalValue::Id(id) => Some(AnyId::Id(*id)),
+        }
+    }
+
+    fn as_id_ref(&self) -> Option<&str> {
+        None
+    }
+
+    fn try_set_id(&mut self, new_id: AnyId) -> bool {
+        if let AnyId::Id(id) = new_id {
+            *self = JournalValue::Id(id);
+            true
+        } else {
+            false
+        }
+    }
+}
+
+impl JmapObjectId for JournalProperty {
+    fn as_id(&self) -> Option<Id> {
+        None
+    }
+
+    fn as_any_id(&self) -> Option<AnyId> {
+        None
+    }
+
+    fn as_id_ref(&self) -> Option<&str> {
+        None
+    }
+
+    fn try_set_id(&mut self, _: AnyId) -> bool {
+        false
+    }
+}

crates/jmap-proto/src/object/mod.rs

@@ -30,6 +30,7 @@ pub mod inbuxa_inventory_snapshot; // inbuxa: personal-data catalog
 pub mod inbuxa_audit; // inbuxa: the audit log
 pub mod inbuxa_legal_hold; // inbuxa: legal hold
 pub mod inbuxa_mail_rule; // inbuxa: DLP and mail flow rules
+pub mod inbuxa_journal; // inbuxa: journaling
 pub mod inbuxa_held_message; // inbuxa: mail held for review
 pub mod inbuxa_hold_export; // inbuxa: legal hold exports
 pub mod inbuxa_explanation; // inbuxa: "Explain this" with the local model