release: 1.0.0: Public 1.0 image; delivery log; docs and SECURITY.md (incl. 1.0.1)

[1.0.0]
Added:
  - A **Delivery log** on each delivery's page (`/deliveries/{id}`): the
  - A **History** block on the same page: the journal's two timestamps stated as
Fixed:
  - Postfix config: copy TLS cert/key from the (often `:ro`, host-owned) mount
  - Postfix config: allow `maillog_file` under `/data` via
  - E2e: read `/data/setup-token` via `docker compose exec` (file is `0600`
  - Entrypoint: check `SELFPOST_HOSTNAME` before `/data` setup (so a bad identity
  - E2e gate: wait for host-published `/healthz` before panel setup, and stop
  … (3 more in CHANGELOG)
Changed:
  - Document what `.spbk` and `.spde` stand for (SelfPost backup / SelfPost domain
  - Docs aligned with the code: setup URL is `/setup/<token>` (README and
  - Full backups no longer carry `/data/log`. It is Postfix's raw log plus its
  - Monitoring screens (status, mail queue, system log, deliveries) use adaptive
  - Documentation package consolidated into `docs/development.md`: Documentation
  … (4 more in CHANGELOG)
[1.0.1]
A documentation and packaging release: no change to the mail path, the database, or the on-disk layout. Upgrading is a tag bump.
Added:
  - `SECURITY.md` — how to report a vulnerability privately (GitHub private
  - [docs/plans/](docs/plans/) — one document per agreed extension: the optional
Changed:
  - The panel's **Account** entry is now called **Settings** — nav link, page
  - The signed-in name in the panel's nav is now labelled `User:`, so it reads as
  - [docs/product.md](docs/product.md) reframes the future line: the inbound
  - [docs/security.md](docs/security.md) is now in English, matching the rest of
  - The README documentation table now points at `SECURITY.md` for reporting a
  … (2 more in CHANGELOG)
Fixed:
  - The panel's static assets are served with a content ETag and

Squashed CHANGELOG sections: [1.0.0], [1.0.1].

Full detail: CHANGELOG.md (1.0.0, 1.0.1).

internal/store/sendlog.go

@@ -17,7 +17,7 @@ const (
 	StatusDeferred = "deferred"
 	StatusBounced  = "bounced"
 	// StatusRejected marks a message the journal-milter refused with a 4xx under
-	// a level-2 rate limit (README § Rate limiting). Such a row never gets a
+	// a level-2 rate limit (guide § Rate limiting). Such a row never gets a
 	// queue-id and is excluded from the level-2 message count (it was never
 	// sent).
 	StatusRejected = "rejected"
@@ -55,7 +55,7 @@ func (s *Store) InsertQueued(e SendLogEntry) error {
 }
 
 // InsertRejected records a message the journal-milter refused under a level-2
-// rate limit (README § Rate limiting), so the rejection is visible in the
+// rate limit (guide § Rate limiting), so the rejection is visible in the
 // send-log UI. Only the fields known at MAIL FROM are set (domain, sender, app
 // login); there is no queue-id or recipient because the message was rejected
 // before it was queued.
@@ -93,6 +93,45 @@ func (s *Store) UpdateStatus(queueID, recipient, status string) (int64, error) {
 	return n, nil
 }
 
+// QueuedDelivery is a send-log row still waiting for a delivery result,
+// reduced to what the log-tailer's reconcile sweep needs to look it up in the
+// Postfix queue and, failing that, to close it (architecture.md § Log tailer).
+type QueuedDelivery struct {
+	QueueID string
+	To      string
+}
+
+// ListQueuedOlderThan returns the rows still marked "queued" that were accepted
+// before cutoff — old enough that Postfix should long since have reported a
+// result for them. Rows without a queue-id are skipped: the milter refused
+// those before Postfix ever saw the message, so the queue has nothing to say
+// about them.
+//
+// created_at is stored as RFC3339 UTC, so a lexical comparison against the same
+// format is chronologically correct.
+func (s *Store) ListQueuedOlderThan(cutoff time.Time) ([]QueuedDelivery, error) {
+	rows, err := s.db.Query(
+		`SELECT queue_id, to_addr FROM send_log
+		 WHERE status = ? AND queue_id <> '' AND created_at < ?
+		 ORDER BY id`,
+		StatusQueued, cutoff.UTC().Format(time.RFC3339),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("list queued send_log rows: %w", err)
+	}
+	defer rows.Close()
+
+	var out []QueuedDelivery
+	for rows.Next() {
+		var d QueuedDelivery
+		if err := rows.Scan(&d.QueueID, &d.To); err != nil {
+			return nil, fmt.Errorf("scan queued send_log row: %w", err)
+		}
+		out = append(out, d)
+	}
+	return out, rows.Err()
+}
+
 // SendLogRow is one row as returned to the monitoring UI (architecture.md §
 // Persistence): a SendLogEntry plus the fields that only exist once a row has
 // been written (id, current status, timestamps).