fix(logtail): keep mail.log in /data and reconcile stuck rows (v1.x closure phase 2)

Move the delivery log from the ephemeral /var/log to /data/log/mail.log so
the lines that resolve a queued send-log row survive a container recreate.
postlogd writes it as postfix, the panel reads it through the selfpost group
(dir 2750, file 0640, normalised every start); backups exclude log/.

Close the residual gap with a queue sweep: rows queued for over two minutes
whose id postqueue -p no longer lists are marked bounced. The sweep waits
until the tailer has read the log to its end and does nothing when the queue
cannot be listed, so a message in flight is never touched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

internal/postfix/queue.go

@@ -3,6 +3,7 @@ package postfix
 import (
 	"fmt"
 	"os/exec"
+	"regexp"
 	"strings"
 )
 
@@ -20,3 +21,43 @@ func Queue() (string, error) {
 	}
 	return string(out), nil
 }
+
+// QueueIDs returns the set of queue ids Postfix is still holding — everything
+// in the maildrop, incoming, active, deferred and hold queues. It answers the
+// one question the log-tailer's reconcile sweep asks about a send-log row stuck
+// at "queued": is Postfix still working on this message, or has it left the
+// queue without the panel ever seeing a delivery line for it (architecture.md §
+// Log tailer)?
+//
+// An error means the queue could not be listed and therefore says nothing about
+// any message; the caller must treat it as "no information", never as an empty
+// queue.
+func QueueIDs() (map[string]struct{}, error) {
+	out, err := Queue()
+	if err != nil {
+		return nil, err
+	}
+	return parseQueueIDs(out), nil
+}
+
+// queueEntryRe matches the first line of a `postqueue -p` entry, e.g.
+//
+//	3C5B04E6C1*     446 Thu Aug  7 10:12:31  app@example.com
+//
+// The id is at the start of the line, optionally flagged '*' (in the active
+// queue) or '!' (on hold), and is followed by the message size. Requiring the
+// size is what separates an entry from the listing's other left-margin lines:
+// the '-Queue ID-' header, the '-- 5 Kbytes in 2 Requests.' trailer, a deferred
+// entry's '(connect timed out)' reason, and 'Mail queue is empty'. Recipient
+// lines are indented and never match.
+var queueEntryRe = regexp.MustCompile(`^([0-9A-Za-z]+)[*!]?\s+\d+\s`)
+
+func parseQueueIDs(listing string) map[string]struct{} {
+	ids := make(map[string]struct{})
+	for _, line := range strings.Split(listing, "\n") {
+		if m := queueEntryRe.FindStringSubmatch(line); m != nil {
+			ids[m[1]] = struct{}{}
+		}
+	}
+	return ids
+}

internal/postfix/queue_test.go

@@ -0,0 +1,43 @@
+package postfix
+
+import "testing"
+
+// The reconcile sweep decides whether a message is still Postfix's problem, so
+// the parser must pick queue ids out of a real listing and nothing else out of
+// it: not the header, not the byte-count trailer, and above all not a deferred
+// entry's reason line, which — unlike the recipient lines — starts at the left
+// margin just as an entry does.
+func TestParseQueueIDs(t *testing.T) {
+	listing := `-Queue ID-  --Size-- ----Arrival Time---- -Sender/Recipient-------
+3C5B04E6C1*     446 Fri Aug  8 10:12:31  app@example.com
+                                         rcpt@example.net
+
+5B4A2C1D3E      446 Fri Aug  8 10:13:31  app@example.com
+(connect to mx.example.net[203.0.113.9]:25: Connection timed out)
+                                         deferred@example.net
+
+A1B2C3D4E5F!    891 Fri Aug  8 10:14:31  app@example.com
+                                         held@example.net
+
+-- 1 Kbytes in 3 Requests.
+`
+	ids := parseQueueIDs(listing)
+	want := []string{"3C5B04E6C1", "5B4A2C1D3E", "A1B2C3D4E5F"}
+	for _, id := range want {
+		if _, ok := ids[id]; !ok {
+			t.Errorf("queue id %s not found in %v", id, ids)
+		}
+	}
+	if len(ids) != len(want) {
+		t.Errorf("got %d ids %v, want exactly %v", len(ids), ids, want)
+	}
+}
+
+// An empty queue must come back as an empty set, not as a phantom id parsed out
+// of Postfix's prose — every stale row would otherwise be compared against a
+// listing that claims to hold a message called "Mail".
+func TestParseQueueIDsOnAnEmptyQueue(t *testing.T) {
+	if ids := parseQueueIDs("Mail queue is empty\n"); len(ids) != 0 {
+		t.Errorf("got %v, want no ids", ids)
+	}
+}