logtail: the sweep closes only queued rows, with reason "reconcile" (audit H3)

reconcile() closed a row through UpdateStatus (WHERE queue_id AND to_addr),
which could overwrite a "sent" the tailer wrote between the listing and the
close, and rewrite an old row of a reused queue id. store.CloseUnreported
sets status bounced and reason "reconcile" (store.ReasonReconcile; the
0006 column, no schema change) WHERE ... AND status = 'queued'; the sweep
counts rows actually closed.

Tests: store - a queued row is closed with the reason, a sent row is left
alone (0 rows); logtail - the sweep's close goes through CloseUnreported.

CHANGELOG [Unreleased], audit plan line ticked, roadmap 9/61.
Evidence: go vet ./... clean; go test ./internal/store ok, ./internal/logtail
ok but for TestFollowTailsAndRotates (Windows rename of an open file, fails
here always); the server run of the stage follows before the push.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/sendlog.go

@@ -97,6 +97,25 @@ func (s *Store) UpdateStatus(queueID, recipient, status string) (int64, error) {
 	return n, nil
 }
 
+// CloseUnreported is the reconcile sweep's close of one row: "bounced", marked
+// reason "reconcile" so it is known who decided it (architecture.md § Log
+// tailer). Only a row still "queued" is closed - a result the log wrote an
+// instant earlier stands, and a months-old row of a reused queue id is not
+// rewritten (audit 2026-10-12, H3). It returns the number of rows closed.
+func (s *Store) CloseUnreported(queueID, recipient string) (int64, error) {
+	now := time.Now().UTC().Format(time.RFC3339)
+	res, err := s.db.Exec(
+		`UPDATE send_log SET status = ?, reason = ?, updated_at = ?
+		 WHERE queue_id = ? AND to_addr = ? COLLATE NOCASE AND status = ?`,
+		StatusBounced, ReasonReconcile, now, queueID, recipient, StatusQueued,
+	)
+	if err != nil {
+		return 0, fmt.Errorf("close unreported send_log row: %w", err)
+	}
+	n, _ := res.RowsAffected()
+	return n, nil
+}
+
 // QueuedDelivery is a send-log row still waiting for a delivery result,
 // reduced to what the log-tailer's reconcile sweep needs to look it up in the
 // Postfix queue and, failing that, to close it (architecture.md § Log tailer).