audit 3: every per-message question of the send log has its index

Migration 0010 (DDL only; 0009 went to stage 2b). EXPLAIN QUERY PLAN of
every send_log statement showed, beyond M2 as written (stage 2 had already
moved the by-domain counts onto (domain_id, created_at)):

- the tailer's sweep of open rows (every 5 min) and its count scanned the
  table: partial idx_send_log_open (created_at) WHERE status IN ('queued',
  'deferred'), the statuses literal in the statements, ORDER BY +id (else
  SQLite walks the table in id order to skip a sort);
- AttachRefusalLine's NOT EXISTS (... refusal_line = ?1) scanned the table
  for every refusal line: partial idx_send_log_refusal_line, the query
  carrying the index's WHERE; its row found by idx_send_log_rejected
  (status literal, +queue_id) instead of every refusal without a queue id;
- an application's level-2 count went through its domain's index:
  +domain_id in appByLogin;
- a page of one domain's or one application's log sorted all of it:
  idx_send_log_domain_id, idx_send_log_app_login (id order; several domains
  still sort, top-N). idx_send_log_domain stays for the global filter.

The statements are constants and builders (countMessagesQuery,
peakPerHourQuery, listOpenQuery, countOpenQuery, sendLogPageQuery,
attachRefusalLineQuery, limitRefusalsQuery) and
TestSendLogQueriesUseTheirIndexes explains exactly those: the index each
must use, no SCAN of send_log, no sort where none is wanted; the literal
statuses checked against the constants. It replaces the hand-written plan
check of TestLimitRefusalsSince.

Tested on the test server: go vet + go test of 24 packages, make e2e (all
pass) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/queryplan_test.go

@@ -0,0 +1,110 @@
+package store
+
+import (
+	"strings"
+	"testing"
+)
+
+// explain returns SQLite's plan for query, one step a line.
+func explain(t *testing.T, s *Store, query string, args ...any) string {
+	t.Helper()
+	rows, err := s.db.Query("EXPLAIN QUERY PLAN "+query, args...)
+	if err != nil {
+		t.Fatalf("explain: %v\n%s", err, query)
+	}
+	defer rows.Close()
+	var plan []string
+	for rows.Next() {
+		var id, parent, notused int
+		var detail string
+		if err := rows.Scan(&id, &parent, &notused, &detail); err != nil {
+			t.Fatal(err)
+		}
+		plan = append(plan, detail)
+	}
+	return strings.Join(plan, "\n")
+}
+
+// The send log is the one table that grows with the mail, and every question
+// asked of it on a path that runs per message, per log line or every few
+// minutes is answered from an index: measured with EXPLAIN QUERY PLAN against
+// the statements the store runs, not copies of them (audit 2026-10-12, M2;
+// stage 3). SQLite chooses without statistics here, as it does on a server -
+// nothing runs ANALYZE.
+func TestSendLogQueriesUseTheirIndexes(t *testing.T) {
+	s := openTestStore(t)
+	const since = "2026-10-01T00:00:00Z"
+	page := func(f SendLogFilter) (string, []any) {
+		where, args := sendLogWhere(f)
+		return sendLogPageQuery(where), append(args, 50, 0)
+	}
+	oneDomain, oneDomainArgs := page(SendLogFilter{DomainIDs: []int64{1}})
+	oneApp, oneAppArgs := page(SendLogFilter{AllDomains: true, AppLogin: "app1"})
+	byName, byNameArgs := page(SendLogFilter{AllDomains: true, Domain: "example.com"})
+
+	for _, c := range []struct {
+		name  string
+		query string
+		args  []any
+		want  []string // steps the plan must have
+		sorts bool     // whether it may sort the rows it reads
+	}{
+		{"level-2 count of a domain", countMessagesQuery(domainByName), []any{"example.com", StatusRejected, since},
+			[]string{"SEARCH send_log USING INDEX idx_send_log_domain_id_created_at (domain_id=? AND created_at>?)"}, false},
+		{"level-2 count of an application", countMessagesQuery(appByLogin), []any{"app1", StatusRejected, since},
+			[]string{"SEARCH send_log USING INDEX idx_send_log_app_login_created_at (app_login=? AND created_at>?)"}, false},
+		{"busiest hour of a domain", peakPerHourQuery(domainByName), []any{"example.com", StatusRejected, since},
+			[]string{"SEARCH send_log USING INDEX idx_send_log_domain_id_created_at (domain_id=? AND created_at>?)"}, true},
+		{"busiest hour of an application", peakPerHourQuery(appByLogin), []any{"app1", StatusRejected, since},
+			[]string{"SEARCH send_log USING INDEX idx_send_log_app_login_created_at (app_login=? AND created_at>?)"}, true},
+		{"open rows", listOpenQuery, []any{since},
+			[]string{"SEARCH send_log USING INDEX idx_send_log_open (created_at<?)"}, true},
+		{"open rows counted", countOpenQuery, []any{since},
+			[]string{"SEARCH send_log USING INDEX idx_send_log_open (created_at<?)"}, false},
+		{"a page of one domain", oneDomain, oneDomainArgs,
+			[]string{"SEARCH send_log USING INDEX idx_send_log_domain_id (domain_id=?)"}, false},
+		{"a page of one application", oneApp, oneAppArgs,
+			[]string{"SEARCH send_log USING INDEX idx_send_log_app_login (app_login=?)"}, false},
+		{"a page of a domain by name", byName, byNameArgs,
+			[]string{"SEARCH send_log USING INDEX idx_send_log_domain (domain=?)"}, false},
+		{"a refusal line", attachRefusalLineQuery,
+			[]any{"line", ReasonLimit, ReasonClient, "a@example.com", "192.0.2.1", since, since, since, "app1"},
+			[]string{
+				"SEARCH send_log USING INDEX idx_send_log_rejected (created_at>? AND created_at<?)",
+				"SEARCH send_log USING COVERING INDEX idx_send_log_refusal_line (refusal_line=?)",
+			}, true},
+		{"refusals under a limit", limitRefusalsQuery, []any{since},
+			[]string{"SEARCH l USING INDEX idx_send_log_rejected (created_at>?)"}, true},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			plan := explain(t, s, c.query, c.args...)
+			for _, want := range c.want {
+				if !strings.Contains(plan, want) {
+					t.Errorf("the plan has no %q:\n%s", want, plan)
+				}
+			}
+			for _, line := range strings.Split(plan, "\n") {
+				if strings.HasPrefix(line, "SCAN send_log") || strings.HasPrefix(line, "SCAN l") {
+					t.Errorf("the plan walks the whole send log:\n%s", plan)
+				}
+				if !c.sorts && strings.Contains(line, "TEMP B-TREE FOR ORDER BY") {
+					t.Errorf("the plan sorts the rows it reads:\n%s", plan)
+				}
+			}
+		})
+	}
+
+	// The partial indexes are used because the statuses are written into the
+	// statements as the index's WHERE has them; the constants must say the
+	// same.
+	for _, st := range []string{StatusQueued, StatusDeferred} {
+		if !strings.Contains(openRows, "'"+st+"'") {
+			t.Errorf("openRows does not name status %q: %s", st, openRows)
+		}
+	}
+	for _, q := range []string{attachRefusalLineQuery, limitRefusalsQuery} {
+		if !strings.Contains(q, "status = '"+StatusRejected+"'") {
+			t.Errorf("a refusal query does not name status %q", StatusRejected)
+		}
+	}
+}