Add send-log retention days to panel Settings.

Global administrators can set delivery journal retention (7-365 days) in SQLite;
SEND_LOG_RETENTION_DAYS seeds the initial default and the log-tailer re-reads
the value every prune cycle without a restart.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/guide.md

@@ -196,7 +196,7 @@ expected to set; defaults match the code exactly.
 | `INBOUND_MESSAGE_SIZE_LIMIT` | Maximum message size in bytes on inbound smtpd (`message_size_limit`). | `26214400` (25 MiB) | `.env` |
 | `RATE_LIMIT_MESSAGES_PER_IP` | Level-1 backstop: maximum messages one client IP may submit per window (Postfix `smtpd_client_message_rate_limit`). See [Rate limiting — level 1](#rate-limiting--level-1-ip-backstop). | `100` | `.env` |
 | `RATE_LIMIT_WINDOW_SECONDS` | Level-1 window length in seconds (Postfix `anvil_rate_time_unit`). | `3600` | `.env` |
-| `SEND_LOG_RETENTION_DAYS` | Days of send-log history kept before the background sweep deletes rows — the main driver of `/data` growth over time. | `90` | `.env` |
+| `SEND_LOG_RETENTION_DAYS` | Initial default for how many days of send-log history are kept before the background sweep deletes rows — the main driver of `/data` growth over time. After the first panel start, change retention on **Settings** (global administrator); the env value is only used to seed SQLite when the setting has never been saved. | `90` | `.env` |
 | `PANEL_SESSION_IDLE_DAYS` | Sliding idle timeout for the panel login session, in days. There is no absolute cap: an admin who keeps coming back stays signed in indefinitely. | `7` | `.env` |
 | `SELFPOST_DNS_RESOLVERS` | Comma-separated recursive resolvers the panel's PTR/SPF/DKIM/DMARC checks query directly (so they report what the internet sees, not what this host's stub resolver synthesises). | `1.1.1.1:53`, `8.8.8.8:53`, `9.9.9.9:53` when unset | `.env` |
 | `TRUSTED_PROXY_CIDR` | Comma-separated CIDRs (bare IPs allowed) of reverse proxies allowed to supply `X-Forwarded-For` for login, setup, and account-change rate-limiting. **Leave unset unless you know the exact address of your reverse proxy.** A wrong value lets a client spoof its rate-limit key by sending a forged `X-Forwarded-For` header — the panel trusts the last hop only when the TCP peer matches one of these CIDRs. Behind the default Apache host-network setup this is typically the Docker bridge gateway, e.g. `172.18.0.1`. | *(empty — XFF ignored)* | `.env` |
@@ -347,8 +347,10 @@ shows after manual edits under `/data`.
 `/settings` changes the signed-in user's username and/or password. **Global
 administrators** also set the panel-wide default DMARC report address (`rua=`)
 offered when a domain doesn't set its own — see
-[Domain-level DNS](#domain-level-dns-spf-dkim-dmarc). Application SASL logins
-are separate and are not changed here.
+[Domain-level DNS](#domain-level-dns-spf-dkim-dmarc) — and how many days
+**Deliveries** rows are kept before the background sweep deletes them (7–365
+days; takes effect on the next six-hour prune cycle without a container
+restart). Application SASL logins are separate and are not changed here.
 
 ### Users
 
@@ -741,8 +743,9 @@ administrators see them here because they cannot open Mail queue. Under
 both sit the `mail.log` lines for its queue id: the connection to the
 receiving server, the server's reply, and the status that reply was filed
 as. Rows outlive `mail.log`, so an older message's lines may have rotated
-away; the page says so. Retention is controlled by
-`SEND_LOG_RETENTION_DAYS`.
+away; the page says so. Retention is set on **Settings** (global
+administrator); `SEND_LOG_RETENTION_DAYS` in `.env` is only the initial
+default until it is changed there.
 
 ### Exporting and importing a single domain
 

docs/plans/send-log-retention.md

@@ -1,6 +1,6 @@
 # Plan: send-log-retention
 
-**Status:** candidate  
+**Status:** done  
 **Date:** 2026-08-17  
 **Version:** `1.x` MINOR; no schema migration required (uses existing `settings` table).
 
@@ -129,11 +129,11 @@ Target version cut: **`1.5.0`** (MINOR). One commit per step; code only after
 roadmap status is **agreed**. See [development.md](../development.md) § Plan
 checklists.
 
-- [ ] `GetSendLogRetentionDays` / `SetSetting` key `send_log_retention_days` (7–365) — **Opus**
-- [ ] Bootstrap from `SEND_LOG_RETENTION_DAYS` when settings empty — **Opus**
-- [ ] `logtail.retentionLoop`: read setting each prune cycle — **Opus**
-- [ ] Settings card on `/settings` (`settings.html`) — **Sonnet**
-- [ ] Remove hardcoded «ninety days» in handlers and templates — **Sonnet**
-- [ ] Tests: save/load, range, loop without restart — **Sonnet**
-- [ ] [guide.md](../guide.md) — **Sonnet**
-- [ ] `go vet`, `go test` on touched packages — **Haiku**
+- [x] `GetSendLogRetentionDays` / `SetSetting` key `send_log_retention_days` (7–365) — **Opus**
+- [x] Bootstrap from `SEND_LOG_RETENTION_DAYS` when settings empty — **Opus**
+- [x] `logtail.retentionLoop`: read setting each prune cycle — **Opus**
+- [x] Settings card on `/settings` (`settings.html`) — **Sonnet**
+- [x] Remove hardcoded «ninety days» in handlers and templates — **Sonnet**
+- [x] Tests: save/load, range, loop without restart — **Sonnet**
+- [x] [guide.md](../guide.md) — **Sonnet**
+- [x] `go vet`, `go test` on touched packages — **Haiku**

docs/roadmap.md

@@ -28,7 +28,7 @@ in `git log` and [CHANGELOG.md](../CHANGELOG.md).
 
 | ID | Topic | Status | Progress | Plan |
 |---|---|---|---|---|
-| send-log-retention | Send-log retention days in panel Settings | candidate | 0/8 | [plans/send-log-retention.md](plans/send-log-retention.md) |
+| send-log-retention | Send-log retention days in panel Settings | done | 8/8 | [plans/send-log-retention.md](plans/send-log-retention.md) |
 | domain-stats-auto-ratelimit | 30-day send stats + auto level-2 rate limit | candidate | 0/11 | [plans/domain-stats-auto-ratelimit.md](plans/domain-stats-auto-ratelimit.md) |
 | contributing | `CONTRIBUTING.md` | candidate | — | — |
 | dmarc-reports | DMARC aggregate report ingestion and panel UI | candidate | 0/8 | [plans/dmarc-reports.md](plans/dmarc-reports.md) |