delivery-log-storage: findings of the technical and security reviews

Neither review (read-only agents, Opus and Fable, over ae06d8b..815236a) has
a Critical or High finding. What they found and what was done:

- A stranger on port 25 could grow the table: every queue-id line of inbound
  mail was stored and pruned an hour or more later, his own message-id among
  them. The tailer now leaves out the lines of a queue id that
  postfix/inbound/smtpd opened, until qmgr removes the message or another
  listener opens one under the id; 4096 such ids are remembered.
- A commit, so a disk sync, per stored line on the connection the journal
  milter shares, and a backlog written line by line. Lines are now written in
  one transaction per pass over the log, 500 at most, before the read offset
  is saved (InsertSendLogLines; follow() calls the keeper's flush).
- The prune asked the send log once per line and ran hourly. It asks once per
  queue id and runs at start and with the six-hourly sweep; with port-25 mail
  left out there is little without a row to wait for.
- The 4096-byte cut could split a character; it keeps characters whole.
- security.md did not say that a backup now carries these lines, and the plan
  said the time window excludes a reused queue id where it only limits the
  chance to the row's queue lifetime. Both are corrected; the collision is
  recorded as an accepted risk with its trigger.
- Tests that did not prove their comments: the prune is now tested with the
  sweep, a rejected row next to the prune, batching and the change from
  catching up to following, port-25 mail left out and its id reused.

Left as found and written down in the plan: lines the tailer never reads
(a file rotated away while the panel was down), and a message in the queue
across the upgrade, which shows only its later lines.

On the test server, for this tree: go vet clean, go test ./... 22 packages
ok, make e2e ok.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -12,12 +12,14 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   its send-log row lives, with the store methods to write a line, to write it
   once, to read the lines of a row and to prune
   ([plans/delivery-log-storage.md](docs/plans/delivery-log-storage.md)).
-- **The log tailer keeps what Postfix writes about queued messages.** Every
-  `mail.log` line headed by a queue id is stored with the line's own time, as
-  the tailer reads it; after an unclean stop a line read twice is stored once.
-  Lines whose queue id has no send-log row - the row was pruned, or the
-  message never had one (inbound relay mail, bounces) - are deleted once they
-  are an hour old, with every send-log sweep and hourly between.
+- **The log tailer keeps what Postfix writes about queued messages.** A
+  `mail.log` line headed by a queue id is stored with the line's own time, one
+  transaction per pass over the log; after an unclean stop a line read twice
+  is stored once. Mail that came in on port 25 is left out: a stranger's
+  message never has a send-log row, and what he can make Postfix log is not
+  written to the database. Lines whose queue id has no send-log row - the row
+  was pruned, or the message never had one (bounces) - are deleted once they
+  are an hour old, at start and with every six-hourly send-log sweep.
 
 ### Changed
 
@@ -31,6 +33,15 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   lines only while they are still in the current file, as before; the note
   shown when there are none and the *Outbound log* help topic say so.
 
+### Security
+
+- **A full backup now carries the log lines of messages in the send log** -
+  client addresses, SASL logins, message ids, receivers' replies - where
+  `mail.log` itself is not in a backup. Recorded in
+  [security.md](docs/security.md) with the accepted risk of a queue-id
+  collision showing one message's lines on another's page. Technical and
+  security reviews of 2026-10-12: no Critical or High finding.
+
 ## [2.1.0] - 2026-10-12
 
 ### Security