Journaling: capture at the queue, the built-in journal, retention

Phase 2 of the journaling spec.

- A copy of each message is taken in MessageWrapper::queue, after DLP and
  transport rules, for every enabled journal that takes it (direction and
  scope: everyone, or accounts, groups, domains, tenants). If the copy
  can't be taken the message isn't queued (temporary failure).
- The journal report: the envelope one field a line (sender, To, Cc, Bcc
  from the envelope, list members from their ORCPT, direction, held for
  review), then the queued message byte for byte as message/rfc822.
- The built-in journal under J in the inbuxa subspace: one chain per node
  whose links name each entry by SHA-256, so entries can expire out of
  chain order; purge leaves a marker, and verify catches an entry changed
  or removed early and a report that doesn't match.
- Retention per journal (30 to 3650 days); an entry keeps what it was
  written with. The daily maintenance purges what's due, keeping entries
  whose people a legal hold covers (deleted accounts a hold keeps too),
  and records the counts in the audit log.
- inbuxa:Journal get/set, audited by the request layer. Permissions
  680-683: administrators see and change journals; the Compliance Officer
  sees, searches and exports. Whoever changes journals may grant search and
  export without holding them, so officers can still be appointed.
- Catalog entries (inbuxa:Journal, source "journal"); spec as-built notes.

tests/src/system/journal.rs: validation, internal mail with a Bcc,
outgoing into two journals, incoming over LMTP, the report and its
original, tamper and early removal caught, hold-aware purge, retention
changes leave entries alone, disabled and removed journals take nothing.

crates/smtp/src/queue/journal.rs

@@ -0,0 +1,159 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Coffey Labs
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+//! inbuxa: journaling (journaling spec, JR-1 to JR-5, JR-11): the copy
+//! taken as a message is queued, after DLP and transport rules, so it has
+//! the envelope the message actually leaves or arrives with.
+
+use crate::queue::{FROM_AUTHENTICATED, FROM_AUTOGENERATED, FROM_DSN, FROM_REPORT, Message};
+use common::Server;
+use inbuxa_features::{
+    hold::Member,
+    journal::{
+        self, Direction,
+        entries::{self, Entry},
+        report::{self, Envelope, Recipient},
+    },
+    mailflow::held::HOLD_SECONDS,
+};
+use store::write::{BatchBuilder, BlobLink, BlobOp, now};
+use types::blob_hash::BlobHash;
+
+/// Marks a journal report the server queued itself, so it's never
+/// journaled (JR-2). Free in the message flags (the MAIL parameters use
+/// the low bits, the sources bits 32 to 37).
+pub const FROM_JOURNAL: u64 = 1 << 48;
+
+/// Journals `message`, whose queued bytes are `raw`, into every enabled
+/// journal that takes it. An error means it may not have been journaled,
+/// and the caller must not queue it.
+pub async fn capture(
+    server: &Server,
+    queue_id: u64,
+    message: &Message,
+    raw: &[u8],
+) -> trc::Result<()> {
+    if message.flags & (FROM_JOURNAL | FROM_REPORT) != 0 {
+        return Ok(());
+    }
+    let journals = journal::enabled(server.store()).await?;
+    if journals.is_empty() {
+        return Ok(());
+    }
+
+    // Who's here on either side, and which way it goes
+    let mut members: Vec<Member> = Vec::new();
+    let mut sender_local = message.flags & FROM_AUTHENTICATED != 0
+        || (message.return_path.is_empty() && message.flags & (FROM_DSN | FROM_AUTOGENERATED) != 0);
+    if !message.return_path.is_empty()
+        && let Some(id) = server
+            .account_id_from_email(&message.return_path, false)
+            .await?
+    {
+        sender_local = true;
+        if let Some(member) = server.member_of(id).await {
+            members.push(member);
+        }
+    }
+    let (mut any_local, mut any_remote) = (false, false);
+    for rcpt in &message.recipients {
+        let address = rcpt.address.to_lowercase();
+        let domain = address.rsplit_once('@').map_or("", |(_, d)| d);
+        let local_domain = server.domain(domain).await.ok().flatten().is_some();
+        match server.account_id_from_email(&address, false).await? {
+            Some(id) => {
+                any_local = true;
+                if !members.iter().any(|m| m.account == id)
+                    && let Some(member) = server.member_of(id).await
+                {
+                    members.push(member);
+                }
+            }
+            None if local_domain => any_local = true,
+            None => any_remote = true,
+        }
+    }
+    let direction = Direction::of(sender_local, any_remote, any_local);
+    let taken: Vec<&journal::Journal> = journals
+        .iter()
+        .filter(|j| j.takes(direction, &members))
+        .collect();
+    if taken.is_empty() {
+        return Ok(());
+    }
+
+    // DLP holds a message by putting its release a century off
+    let at = now();
+    let held = !message.recipients.is_empty()
+        && message
+            .recipients
+            .iter()
+            .all(|rcpt| rcpt.retry.due >= at + HOLD_SECONDS / 2);
+    let recipients: Vec<Recipient> = message
+        .recipients
+        .iter()
+        .map(|rcpt| Recipient {
+            address: rcpt.address.to_string(),
+            orcpt: rcpt.orcpt.as_deref().map(Into::into),
+        })
+        .collect();
+    let envelope = Envelope {
+        sender: &message.return_path,
+        authenticated: message.flags & FROM_AUTHENTICATED != 0,
+        recipients: &recipients,
+        queue_id,
+        received: message.created,
+        direction,
+        held,
+    };
+    let host = server.core.network.server_name.as_str();
+    let (bytes, fields) = report::build(&envelope, raw, &format!("postmaster@{host}"), host);
+
+    // The report's blob, reserved until the entry links it
+    let hash = BlobHash::generate(&bytes);
+    let mut batch = BatchBuilder::new();
+    batch.set(
+        BlobOp::Link {
+            hash: hash.clone(),
+            to: BlobLink::Temporary { until: at + 120 },
+        },
+        vec![],
+    );
+    server.store().write(batch.build_all()).await?;
+    server
+        .blob_store()
+        .put_blob(hash.as_slice(), &bytes, server.core.email.compression)
+        .await?;
+
+    let retention_days = taken
+        .iter()
+        .map(|j| j.retention_days)
+        .max()
+        .unwrap_or_default();
+    let mut tenants: Vec<u32> = members.iter().filter_map(|m| m.tenant).collect();
+    tenants.sort_unstable();
+    tenants.dedup();
+    let entry = Entry {
+        queue_id,
+        at,
+        direction,
+        sender: message.return_path.to_string(),
+        authenticated: envelope.authenticated,
+        recipients: recipients.iter().map(|r| r.address.clone()).collect(),
+        subject: fields.subject,
+        message_id: fields.message_id,
+        accounts: members.iter().map(|m| m.account).collect(),
+        tenants,
+        journals: taken.iter().map(|j| j.id).collect(),
+        held,
+        blob: entries::hex(hash.as_slice()),
+        size: bytes.len() as u64,
+        sha256: entries::sha256(&bytes),
+        expires_at: at + u64::from(retention_days) * 86_400,
+    };
+    entries::append(server.store(), server.core.network.node_id, &entry).await?;
+    Ok(())
+}

crates/smtp/src/queue/mod.rs

@@ -24,6 +24,7 @@ use utils::DomainPart;
 
 pub mod dsn;
 pub mod held; // inbuxa: mail held for review
+pub mod journal; // inbuxa: journaling
 pub mod manager;
 pub mod quota;
 pub mod spool;

crates/smtp/src/queue/spool.rs

@@ -2,6 +2,8 @@
  * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
  *
  * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ *
+ * Modified by Coffey Labs in 2026 for INBUXA.
  */
 
 use super::{
@@ -453,6 +455,25 @@ impl MessageWrapper {
             return false;
         }
 
+        // inbuxa: journaling, JR-1: the copy is taken before the message is
+        // queued; if it can't be, the message isn't queued either
+        if let Err(err) = crate::queue::journal::capture(
+            server,
+            self.queue_id,
+            &self.message,
+            message.as_ref(),
+        )
+        .await
+        {
+            trc::error!(
+                err.details("Failed to journal a message.")
+                    .span_id(session_id)
+                    .caused_by(trc::location!())
+            );
+
+            return false;
+        }
+
         trc::event!(
             Queue(event),
             SpanId = session_id,