fix(logtail): keep mail.log in /data and reconcile stuck rows (v1.x closure phase 2)

Move the delivery log from the ephemeral /var/log to /data/log/mail.log so
the lines that resolve a queued send-log row survive a container recreate.
postlogd writes it as postfix, the panel reads it through the selfpost group
(dir 2750, file 0640, normalised every start); backups exclude log/.

Close the residual gap with a queue sweep: rows queued for over two minutes
whose id postqueue -p no longer lists are marked bounced. The sweep waits
until the tailer has read the log to its end and does nothing when the queue
cannot be listed, so a message in flight is never touched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

internal/store/sendlog.go

@@ -93,6 +93,45 @@ func (s *Store) UpdateStatus(queueID, recipient, status string) (int64, error) {
 	return n, nil
 }
 
+// QueuedDelivery is a send-log row still waiting for a delivery result,
+// reduced to what the log-tailer's reconcile sweep needs to look it up in the
+// Postfix queue and, failing that, to close it (architecture.md § Log tailer).
+type QueuedDelivery struct {
+	QueueID string
+	To      string
+}
+
+// ListQueuedOlderThan returns the rows still marked "queued" that were accepted
+// before cutoff — old enough that Postfix should long since have reported a
+// result for them. Rows without a queue-id are skipped: the milter refused
+// those before Postfix ever saw the message, so the queue has nothing to say
+// about them.
+//
+// created_at is stored as RFC3339 UTC, so a lexical comparison against the same
+// format is chronologically correct.
+func (s *Store) ListQueuedOlderThan(cutoff time.Time) ([]QueuedDelivery, error) {
+	rows, err := s.db.Query(
+		`SELECT queue_id, to_addr FROM send_log
+		 WHERE status = ? AND queue_id <> '' AND created_at < ?
+		 ORDER BY id`,
+		StatusQueued, cutoff.UTC().Format(time.RFC3339),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("list queued send_log rows: %w", err)
+	}
+	defer rows.Close()
+
+	var out []QueuedDelivery
+	for rows.Next() {
+		var d QueuedDelivery
+		if err := rows.Scan(&d.QueueID, &d.To); err != nil {
+			return nil, fmt.Errorf("scan queued send_log row: %w", err)
+		}
+		out = append(out, d)
+	}
+	return out, rows.Err()
+}
+
 // SendLogRow is one row as returned to the monitoring UI (architecture.md §
 // Persistence): a SendLogEntry plus the fields that only exist once a row has
 // been written (id, current status, timestamps).

internal/store/sendlog_test.go

@@ -95,6 +95,58 @@ func TestUpdateStatusRecipientCaseInsensitive(t *testing.T) {
 	}
 }
 
+// The reconcile sweep asks for the rows old enough that Postfix should have
+// reported on them by now. A message accepted moments ago is simply in flight,
+// and one the milter refused never reached the queue at all, so neither is the
+// sweep's business.
+func TestListQueuedOlderThan(t *testing.T) {
+	st := openTestStore(t)
+
+	for _, e := range []SendLogEntry{
+		{QueueID: "OLD1", To: "stale@example.net"},
+		{QueueID: "NEW1", To: "fresh@example.net"},
+	} {
+		if err := st.InsertQueued(e); err != nil {
+			t.Fatalf("InsertQueued: %v", err)
+		}
+	}
+	// A row the milter refused: no queue-id, and a status the sweep never sees.
+	if err := st.InsertRejected(SendLogEntry{To: "refused@example.net"}); err != nil {
+		t.Fatalf("InsertRejected: %v", err)
+	}
+	// A row that has already been delivered, aged the same as the stale one.
+	if err := st.InsertQueued(SendLogEntry{QueueID: "DONE1", To: "done@example.net"}); err != nil {
+		t.Fatalf("InsertQueued: %v", err)
+	}
+	if _, err := st.UpdateStatus("DONE1", "done@example.net", StatusSent); err != nil {
+		t.Fatalf("UpdateStatus: %v", err)
+	}
+
+	cutoff := time.Now().UTC().Add(-2 * time.Minute)
+	backdate(t, st, "OLD1", cutoff.Add(-time.Hour))
+	backdate(t, st, "DONE1", cutoff.Add(-time.Hour))
+
+	got, err := st.ListQueuedOlderThan(cutoff)
+	if err != nil {
+		t.Fatalf("ListQueuedOlderThan: %v", err)
+	}
+	if len(got) != 1 || got[0] != (QueuedDelivery{QueueID: "OLD1", To: "stale@example.net"}) {
+		t.Fatalf("got %+v, want only the stale queued row", got)
+	}
+}
+
+// backdate rewrites a row's acceptance time, so a test can age it past a cutoff
+// without waiting.
+func backdate(t *testing.T, s *Store, queueID string, at time.Time) {
+	t.Helper()
+	if _, err := s.db.Exec(
+		`UPDATE send_log SET created_at = ? WHERE queue_id = ?`,
+		at.UTC().Format(time.RFC3339), queueID,
+	); err != nil {
+		t.Fatalf("backdate %s: %v", queueID, err)
+	}
+}
+
 func TestUpdateStatusNoMatch(t *testing.T) {
 	st := openTestStore(t)
 	if err := st.InsertQueued(SendLogEntry{QueueID: "Q1", To: "a@example.net"}); err != nil {