logtail: a refusal the panel did not get to write is written from mail.log (stage 2b)

The sender check answers 550 5.7.1 and writes the refused row through a
buffer a moment later; a panel stopped in between (a rollout, a kill) left
an application refused and a log that did not know it. A refusal at MAIL
FROM needs nothing: the journal milter writes its row before it answers.

- logtail.refusalLines remembers each queue id's login from smtpd's
  "<id>: client=..., sasl_username=<login>" (4096 ids at most) and, on
  cleanup's "<id>: milter-reject: END-OF-MESSAGE ...: 5.7.1 From: <line> -
  <why>; from=<...> to=<...>", waits 30 s and hands it to
  store.RecoverRefusal - an INSERT ... WHERE NOT EXISTS a refused row of that
  queue id within two minutes: the row the panel wrote, or one recovered
  before, means nothing is written. It is read from the saved offset on, so
  a kill is covered as well as a clean stop - which a flush of the buffer at
  shutdown would not.
- Migration 0009 (not deployed yet) gains send_log.recovered; the row is
  written with the line's time, the login's domain id, reason "from", the
  From: line as the check printed it (to the last " - " before ";").
- The message page: a fact "Written: from mail.log after a restart: the
  panel stopped before it wrote the refusal".

Tests: store (not written when the panel wrote it; written once however
often); logtail (the login from client=, the From: line with a " - " in it,
nothing before the wait is over); view (the fact). e2e
refusal_recovered_from_the_log: a From: refusal, the panel stopped, its row
deleted and the tailer's saved place moved before the message's first line
(python3 in the container, as the panel's user - a kill cannot be timed to
that moment from outside); started again, the row is back, recovered, once.

Also fixed: handlers TestMessagePageOfARefusedMessage still expected the
old sentence; it failed on the server after e166a2e, whose run showed only
the schema failures - now it wants the new one.

schema-migrations row 9, CHANGELOG [Unreleased], audit plan line ticked,
roadmap 26/62.
Evidence on the test server for this tree but the handler-test fix: make e2e
exit 0 (the new case 37 s); go test 22/23 ok, the 23rd that test - fixed,
passes locally; the full run follows before the push.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/sendlog.go

@@ -224,7 +224,10 @@ type SendLogRow struct {
 	// RefusalLine is Postfix's line about a refusal that has no queue id
 	// (migration 0009); "" for every other row, and for one refused before.
 	RefusalLine string
-	CreatedAt   time.Time
+	// Recovered is a refusal row the log tailer wrote from mail.log because
+	// the panel stopped before it wrote the row itself.
+	Recovered bool
+	CreatedAt time.Time
 	// UpdatedAt is when the status last changed — the log-tailer's report of
 	// the delivery attempt. It equals CreatedAt while a row is still queued.
 	UpdatedAt time.Time
@@ -256,6 +259,31 @@ func (s *Store) AttachRefusalLine(login, from string, at time.Time, line string)
 	return n > 0, nil
 }
 
+// RecoverRefusal writes the row of a message the sender check refused for its
+// From: line, from Postfix's line about it, when the panel stopped before it
+// wrote the row itself (audit 2026-10-12, stage 2b): the check answers 550
+// and writes the row through a buffer a moment later. The message had a queue
+// id; a refused row with that id from around at means the row was written,
+// and nothing is. It reports whether it wrote one.
+func (s *Store) RecoverRefusal(e SendLogEntry, at time.Time) (bool, error) {
+	stamp := at.UTC().Format(time.RFC3339)
+	res, err := s.db.Exec(
+		`INSERT INTO send_log
+			(queue_id, domain, app_login, from_addr, to_addr, subject, status, reason, header_from, recovered, created_at, updated_at, domain_id)
+		 SELECT ?, ?, ?, ?, ?, '', ?, ?, ?, 1, ?, ?, `+loginDomainID+`
+		 WHERE NOT EXISTS (SELECT 1 FROM send_log
+			WHERE queue_id = ? AND status = ? AND created_at BETWEEN ? AND ?)`,
+		e.QueueID, e.Domain, e.AppLogin, e.From, e.To, StatusRejected, e.Reason, e.HeaderFrom, stamp, stamp, e.AppLogin,
+		e.QueueID, StatusRejected,
+		at.Add(-refusalLineWindow).UTC().Format(time.RFC3339), at.Add(refusalLineWindow).UTC().Format(time.RFC3339),
+	)
+	if err != nil {
+		return false, fmt.Errorf("recover refusal %s: %w", e.QueueID, err)
+	}
+	n, _ := res.RowsAffected()
+	return n > 0, nil
+}
+
 // refusalLineWindow is how far apart a refusal's row and its log line may be
 // dated: the milter writes the row at MAIL FROM, Postfix the line a moment
 // later, and the log's stamps are whole seconds.
@@ -274,10 +302,10 @@ func (s *Store) GetSendLog(id int64) (SendLogRow, error) {
 		createdAt, updatedAt string
 	)
 	err := s.db.QueryRow(
-		`SELECT id, queue_id, domain, COALESCE(domain_id, 0), app_login, from_addr, to_addr, subject, status, reason, header_from, refusal_line, created_at, updated_at
+		`SELECT id, queue_id, domain, COALESCE(domain_id, 0), app_login, from_addr, to_addr, subject, status, reason, header_from, refusal_line, recovered, created_at, updated_at
 		 FROM send_log WHERE id = ?`, id,
 	).Scan(&row.ID, &row.QueueID, &row.Domain, &row.DomainID, &row.AppLogin, &row.From, &row.To,
-		&row.Subject, &row.Status, &row.Reason, &row.HeaderFrom, &row.RefusalLine, &createdAt, &updatedAt)
+		&row.Subject, &row.Status, &row.Reason, &row.HeaderFrom, &row.RefusalLine, &row.Recovered, &createdAt, &updatedAt)
 	if errors.Is(err, sql.ErrNoRows) {
 		return SendLogRow{}, ErrSendLogNotFound
 	}