findings of the reviews of audit stage 1

Technical review (Opus) and security review (Fable) of 9efc9c7..a59e3d4;
reports in the session's scratchpad. Fixed:

- B1 (verified bug): store.UpdateStatus read before writing in its
  transaction; a commit by another connection in between (the dmarc-ingest
  process opens the same file) failed it at once with "database is locked"
  and the delivery line was lost. The first statement is now a write.
- R3: a delivery line updated every row of its queue id and recipient; it
  now updates only the newest (Postfix reuses short ids). The sweep closes
  by row id (QueuedDelivery.ID, CloseUnreported(id)).
- R4: a contradicted sweep keeps a mark, reason "reconcile-contradicted",
  instead of losing which row it was.
- R1: contradicted cannot see a lost line (never read late). New counter
  reconcile_missed: at close, the sweep looks for the row's delivery line
  in mail.log and mail.log.1 (QueueLines). 0007 edited - it has run on no
  database but throwaway stands.
- R2: queued_over_lifetime cannot measure "what removing the sweep would
  leave" while the sweep runs; its text now says rows stuck despite the
  sweep, and the rule uses closed - missed - contradicted.
- cert-reload (R5, R6, R7, security medium/low): both files copied to .new
  and the copies checked as a pair before both are renamed; acts on the copy
  only when postconf says Postfix reads it; a failed reload is retried next
  pass; umask 077; says so when the mounted files cannot be read. The e2e
  case asserts Postfix reads the copy, the copy equals the mount, the key is
  600 root.
- Security low: a recipient with a quoted local part - the journal cut
  "a b"@x at the space, deliveryRe cut "a>b"@x at the ">" - matched no
  delivery line and was closed by the sweep. cleanAddress ends a bracketed
  address at the first ">" outside quotes; deliveryRe takes the recipient
  up to the ">, " before relay= (test fixtures given the relay= every real
  delivery line has).
- Security low: postqueue -p's error carries at most 512 bytes of output.
- Nits: addDeliveryLogDay refuses a column not on its list; the truncation
  test checks its message.
- To stage 2b (page wording, mockup-first): the history step of a bounced
  row says the receiving server refused it, false for a row the sweep
  closed. To the owner when stage 2b is reached: since M13 the "deferred"
  figure counts whole messages too, which "Connections turned away" would
  not name.

Found while verifying: the e2e's main positive path failed once with "553
not owned by user app1" - an smtpd idle from before the panel's reload took
the connection in the reload's second. Measured on the stand (one-off
probe, not committed): sending 0, 10, 40, 110 s after the save (two seconds
at the soonest) always met an smtpd started after the reload. The e2e now
waits for the sender map after each application it creates
(waitForSenderMap: AUTH, MAIL, RCPT, RSET - no message, no row), and the
level-1 case uses it instead of its own loop.

Docs: architecture § Queue reconcile, schema-migrations (rows 7 and 8,
chain head 8), CHANGELOG, audit plan (stage 1 note, the measured window,
a new stage 2b line: 62 lines), roadmap 15/62.

Evidence on the test server for this tree: go vet clean, go test ./... 23
packages ok, make e2e exit 0 (renewed certificate, hung panel, level 1 at
49/60).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

build/postfix-cert-reload.sh

@@ -7,60 +7,76 @@
 # root with mode 0600, which a read-only bind mount owned by the host's user
 # cannot give. A renewal of the mounted files therefore reaches Postfix only
 # through a new copy. Every interval this compares the mounted files with the
-# copy; when they differ, and the certificate and the key belong together (a
-# renewer writes them one after the other), it replaces the copy - each file
-# written beside its target and renamed over it, with the owner and modes of
-# the start - and reloads Postfix. When nothing changed it does nothing.
+# copy; when they differ it copies both beside their targets, checks that the
+# copies - not the mounted files, which a renewer may be rewriting - are a
+# certificate and the key that belongs to it, renames both over the targets
+# and reloads Postfix. When nothing changed it does nothing.
 #
 # Runs under supervisord as root. It sleeps first: at container start the
 # wrapper is still bringing Postfix up. It never exits non-zero, so a failure
 # does not trip the crashexit listener; it is logged and tried again.
 set -u
+umask 077 # the key's copy is never readable by others, not even for an instant
 
 INTERVAL="${TLS_RELOAD_INTERVAL_SECONDS:-86400}"
 SRC_CERT="${TLS_CERT_FILE:-/etc/postfix/tls/fullchain.pem}"
 SRC_KEY="${TLS_KEY_FILE:-/etc/postfix/tls/privkey.pem}"
 DIR=/etc/postfix/tls-internal
+CERT="$DIR/fullchain.pem"
+KEY="$DIR/privkey.pem"
+PENDING=0 # a copy was renewed and Postfix has not been reloaded since
 
 reload() {
 	if postfix reload; then
 		echo "cert-reload: postfix reloaded ($1)"
+		PENDING=0
 	else
-		echo "cert-reload: postfix reload failed, will retry after ${INTERVAL}s" >&2
+		echo "cert-reload: postfix reload failed, will try again after ${INTERVAL}s" >&2
 	fi
 }
 
-# same_pair says whether a certificate and a private key belong together.
+# same_pair says whether a certificate file and a private key file belong
+# together.
 same_pair() {
 	cert_pub=$(openssl x509 -noout -pubkey -in "$1" 2>/dev/null) || return 1
 	key_pub=$(openssl pkey -pubout -in "$2" 2>/dev/null) || return 1
 	[ -n "$cert_pub" ] && [ "$cert_pub" = "$key_pub" ]
 }
 
-# install_copy SRC DST MODE: DST becomes a root-owned copy of SRC in one rename.
-install_copy() {
-	cp -f "$1" "$2.new" && chown root:root "$2.new" && chmod "$3" "$2.new" && mv -f "$2.new" "$2"
-}
-
 refresh() {
-	if [ ! -f "$DIR/fullchain.pem" ]; then
-		# No copy: the mounted files were missing at start and Postfix was
-		# pointed at them as they are. A reload is what picks up a change there.
+	if [ "$PENDING" = 1 ]; then
+		reload "renewed certificate, earlier reload had failed"
+	fi
+	if [ "$(postconf -h smtpd_tls_cert_file 2>/dev/null)" != "$CERT" ]; then
+		# Postfix reads the mounted files themselves (they were missing at
+		# start, so no copy was made): a reload is what picks up a change.
 		reload "periodic TLS refresh"
 		return
 	fi
-	if cmp -s "$SRC_CERT" "$DIR/fullchain.pem" && cmp -s "$SRC_KEY" "$DIR/privkey.pem"; then
+	if [ ! -r "$SRC_CERT" ] || [ ! -r "$SRC_KEY" ]; then
+		echo "cert-reload: cannot read ${SRC_CERT} or ${SRC_KEY}; Postfix keeps the certificate it has" >&2
 		return
 	fi
-	if ! same_pair "$SRC_CERT" "$SRC_KEY"; then
+	if cmp -s "$SRC_CERT" "$CERT" && cmp -s "$SRC_KEY" "$KEY"; then
+		return
+	fi
+	rm -f "$CERT.new" "$KEY.new"
+	if ! cp "$SRC_CERT" "$CERT.new" || ! cp "$SRC_KEY" "$KEY.new"; then
+		rm -f "$CERT.new" "$KEY.new"
+		echo "cert-reload: copying the renewed certificate failed, will try again after ${INTERVAL}s" >&2
+		return
+	fi
+	if ! same_pair "$CERT.new" "$KEY.new"; then
+		rm -f "$CERT.new" "$KEY.new"
 		echo "cert-reload: the mounted certificate and key differ from Postfix's copy but do not belong together; will look again after ${INTERVAL}s" >&2
 		return
 	fi
-	if install_copy "$SRC_KEY" "$DIR/privkey.pem" 0600 && install_copy "$SRC_CERT" "$DIR/fullchain.pem" 0644; then
-		reload "renewed certificate"
-	else
-		echo "cert-reload: copying the renewed certificate failed, will retry after ${INTERVAL}s" >&2
-	fi
+	chown root:root "$CERT.new" "$KEY.new"
+	chmod 0644 "$CERT.new"
+	chmod 0600 "$KEY.new"
+	mv -f "$KEY.new" "$KEY" && mv -f "$CERT.new" "$CERT"
+	PENDING=1
+	reload "renewed certificate"
 }
 
 while true; do