The backlog read only the Rspamd log, on the reasoning that a client refused
at the door never delivered a message. That is true and beside the point:
what one wants on opening the command is what the followers would have
shown, and they show refusals.
So it reads both logs and merges them by time. Rspamd first, so its ids are
recorded before the journal is read - that is what makes the journal's later
mention of the same message an echo rather than a second row, the same order
the followers see it in.
Ordering needs the full ISO timestamp rather than the one in the column. The
column drops the year, which is right for reading and wrong for sorting a
window that spans New Year.
Checked against both sources for a whole day: 83 Rspamd rows plus 21
refusals, 104 in the backlog, and no two identical lines. The greylisting
case reads correctly in it as well - the same message appears as a soft
reject and then, seven minutes later under a new queue id, as accepted.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0157iwWABv8uxAxVprFEi182
