findings of the reviews of audit stage 1

Technical review (Opus) and security review (Fable) of 9efc9c7..a59e3d4;
reports in the session's scratchpad. Fixed:

- B1 (verified bug): store.UpdateStatus read before writing in its
  transaction; a commit by another connection in between (the dmarc-ingest
  process opens the same file) failed it at once with "database is locked"
  and the delivery line was lost. The first statement is now a write.
- R3: a delivery line updated every row of its queue id and recipient; it
  now updates only the newest (Postfix reuses short ids). The sweep closes
  by row id (QueuedDelivery.ID, CloseUnreported(id)).
- R4: a contradicted sweep keeps a mark, reason "reconcile-contradicted",
  instead of losing which row it was.
- R1: contradicted cannot see a lost line (never read late). New counter
  reconcile_missed: at close, the sweep looks for the row's delivery line
  in mail.log and mail.log.1 (QueueLines). 0007 edited - it has run on no
  database but throwaway stands.
- R2: queued_over_lifetime cannot measure "what removing the sweep would
  leave" while the sweep runs; its text now says rows stuck despite the
  sweep, and the rule uses closed - missed - contradicted.
- cert-reload (R5, R6, R7, security medium/low): both files copied to .new
  and the copies checked as a pair before both are renamed; acts on the copy
  only when postconf says Postfix reads it; a failed reload is retried next
  pass; umask 077; says so when the mounted files cannot be read. The e2e
  case asserts Postfix reads the copy, the copy equals the mount, the key is
  600 root.
- Security low: a recipient with a quoted local part - the journal cut
  "a b"@x at the space, deliveryRe cut "a>b"@x at the ">" - matched no
  delivery line and was closed by the sweep. cleanAddress ends a bracketed
  address at the first ">" outside quotes; deliveryRe takes the recipient
  up to the ">, " before relay= (test fixtures given the relay= every real
  delivery line has).
- Security low: postqueue -p's error carries at most 512 bytes of output.
- Nits: addDeliveryLogDay refuses a column not on its list; the truncation
  test checks its message.
- To stage 2b (page wording, mockup-first): the history step of a bounced
  row says the receiving server refused it, false for a row the sweep
  closed. To the owner when stage 2b is reached: since M13 the "deferred"
  figure counts whole messages too, which "Connections turned away" would
  not name.

Found while verifying: the e2e's main positive path failed once with "553
not owned by user app1" - an smtpd idle from before the panel's reload took
the connection in the reload's second. Measured on the stand (one-off
probe, not committed): sending 0, 10, 40, 110 s after the save (two seconds
at the soonest) always met an smtpd started after the reload. The e2e now
waits for the sender map after each application it creates
(waitForSenderMap: AUTH, MAIL, RCPT, RSET - no message, no row), and the
level-1 case uses it instead of its own loop.

Docs: architecture § Queue reconcile, schema-migrations (rows 7 and 8,
chain head 8), CHANGELOG, audit plan (stage 1 note, the measured window,
a new stage 2b line: 62 lines), roadmap 15/62.

Evidence on the test server for this tree: go vet clean, go test ./... 23
packages ok, make e2e exit 0 (renewed certificate, hung panel, level 1 at
49/60).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/sendlog.go

@@ -84,10 +84,22 @@ func (s *Store) InsertRejected(e SendLogEntry) error {
 // number of rows updated so the caller can tell whether the line matched a
 // journal entry.
 //
+// Only the newest row of the pair is updated. Postfix reuses a short queue id
+// once the message has left the queue, and a row outlives that by months; a
+// line about today's message must not rewrite an old one (audit 2026-10-12,
+// review of stage 1).
+//
 // A row the reconcile sweep closed (reason "reconcile") that a delivery line
-// now speaks of was closed on a guess the log could have settled: the log
-// wins, the reason is cleared, and the day's reconcile_contradicted counts it
-// (delivery_log_days) - once, since the row no longer carries the reason.
+// now speaks of was closed on a guess the log could have settled: the log's
+// status wins, the reason becomes "reconcile-contradicted" - which row, and
+// updated_at says when - and the day's reconcile_contradicted counts it
+// (delivery_log_days), once, since the row no longer reads "reconcile".
+//
+// The transaction's first statement is a write. A transaction that reads
+// first and then writes fails at once with "database is locked" when another
+// connection - the dmarc-ingest process opens the same file - commits in
+// between, and the line would be lost; a write first takes the write lock,
+// and the busy timeout waits for it.
 func (s *Store) UpdateStatus(queueID, recipient, status string) (int64, error) {
 	now := time.Now().UTC()
 	tx, err := s.db.Begin()
@@ -95,18 +107,18 @@ func (s *Store) UpdateStatus(queueID, recipient, status string) (int64, error) {
 		return 0, fmt.Errorf("update send_log status: %w", err)
 	}
 	defer tx.Rollback()
-	var contradicted int64
-	if err := tx.QueryRow(
-		`SELECT COUNT(*) FROM send_log WHERE queue_id = ? AND to_addr = ? COLLATE NOCASE AND reason = ?`,
-		queueID, recipient, ReasonReconcile,
-	).Scan(&contradicted); err != nil {
+	const newest = `id = (SELECT MAX(id) FROM send_log WHERE queue_id = ? AND to_addr = ? COLLATE NOCASE)`
+	marked, err := tx.Exec(
+		`UPDATE send_log SET reason = ? WHERE `+newest+` AND reason = ?`,
+		ReasonReconcileContradicted, queueID, recipient, ReasonReconcile,
+	)
+	if err != nil {
 		return 0, fmt.Errorf("update send_log status: %w", err)
 	}
+	contradicted, _ := marked.RowsAffected()
 	res, err := tx.Exec(
-		`UPDATE send_log SET status = ?, updated_at = ?,
-			reason = CASE WHEN reason = ? THEN '' ELSE reason END
-		 WHERE queue_id = ? AND to_addr = ? COLLATE NOCASE`,
-		status, now.Format(time.RFC3339), ReasonReconcile, queueID, recipient,
+		`UPDATE send_log SET status = ?, updated_at = ? WHERE `+newest,
+		status, now.Format(time.RFC3339), queueID, recipient,
 	)
 	if err != nil {
 		return 0, fmt.Errorf("update send_log status: %w", err)
@@ -127,17 +139,16 @@ func (s *Store) UpdateStatus(queueID, recipient, status string) (int64, error) {
 	return n, nil
 }
 
-// CloseUnreported is the reconcile sweep's close of one row: "bounced", marked
-// reason "reconcile" so it is known who decided it (architecture.md § Log
-// tailer). Only a row still "queued" is closed - a result the log wrote an
-// instant earlier stands, and a months-old row of a reused queue id is not
-// rewritten (audit 2026-10-12, H3). It returns the number of rows closed.
-func (s *Store) CloseUnreported(queueID, recipient string) (int64, error) {
+// CloseUnreported is the reconcile sweep's close of one row, by its id:
+// "bounced", marked reason "reconcile" so it is known who decided it
+// (architecture.md § Log tailer). Only a row still "queued" is closed - a
+// result the log wrote an instant earlier stands (audit 2026-10-12, H3). It
+// returns the number of rows closed, 0 or 1.
+func (s *Store) CloseUnreported(id int64) (int64, error) {
 	now := time.Now().UTC().Format(time.RFC3339)
 	res, err := s.db.Exec(
-		`UPDATE send_log SET status = ?, reason = ?, updated_at = ?
-		 WHERE queue_id = ? AND to_addr = ? COLLATE NOCASE AND status = ?`,
-		StatusBounced, ReasonReconcile, now, queueID, recipient, StatusQueued,
+		`UPDATE send_log SET status = ?, reason = ?, updated_at = ? WHERE id = ? AND status = ?`,
+		StatusBounced, ReasonReconcile, now, id, StatusQueued,
 	)
 	if err != nil {
 		return 0, fmt.Errorf("close unreported send_log row: %w", err)
@@ -150,6 +161,7 @@ func (s *Store) CloseUnreported(queueID, recipient string) (int64, error) {
 // reduced to what the log-tailer's reconcile sweep needs to look it up in the
 // Postfix queue and, failing that, to close it (architecture.md § Log tailer).
 type QueuedDelivery struct {
+	ID      int64
 	QueueID string
 	To      string
 }
@@ -164,7 +176,7 @@ type QueuedDelivery struct {
 // format is chronologically correct.
 func (s *Store) ListQueuedOlderThan(cutoff time.Time) ([]QueuedDelivery, error) {
 	rows, err := s.db.Query(
-		`SELECT queue_id, to_addr FROM send_log
+		`SELECT id, queue_id, to_addr FROM send_log
 		 WHERE status = ? AND queue_id <> '' AND created_at < ?
 		 ORDER BY id`,
 		StatusQueued, cutoff.UTC().Format(time.RFC3339),
@@ -177,7 +189,7 @@ func (s *Store) ListQueuedOlderThan(cutoff time.Time) ([]QueuedDelivery, error)
 	var out []QueuedDelivery
 	for rows.Next() {
 		var d QueuedDelivery
-		if err := rows.Scan(&d.QueueID, &d.To); err != nil {
+		if err := rows.Scan(&d.ID, &d.QueueID, &d.To); err != nil {
 			return nil, fmt.Errorf("scan queued send_log row: %w", err)
 		}
 		out = append(out, d)