delivery log: measure the sweep before deciding its fate (audit H3, 0007)

Migration 0007 (DDL only): delivery_log_days, a row per UTC day, kept a
year, shown nowhere - read off a copy of the database after a month by the
decision rule written in the audit plan.

- reconcile_closed: the sweep adds the rows it actually closed.
- reconcile_contradicted: store.UpdateStatus, in one transaction, counts the
  rows with reason "reconcile" a delivery line now speaks of, writes the
  log's status and clears the reason - so a re-read line counts once.
- tailer_blind_seconds: follow() tracks stretches in which the file is gone
  or reopening fails (logtail.blindness); stored when a stretch ends and
  every minute while it lasts; under 3 s not counted (the rotation's tick
  between rename and create loses nothing).
- queued_over_lifetime: every sweep overwrites the day's level with the rows
  queued past LongestLifetime + MaximalBackoff (a message Postfix still
  works on stays queued until its first retry after the lifetime).
- retentionLoop prunes days older than a year.

Tests: store (sums per day, the level overwritten, under a second nothing,
prune; a contradicted sweep counted once and its reason cleared; count of
queued rows); logtail (the sweep counts what it closed; countStuck records
the level; blindness - a one-tick gap not counted, 75 s stored as 60 + 15
from where the last part ended). Schema tests at user_version 7.

schema-migrations.md: chain head 7 (it still said 5 since 2.4.0), row 7.
CHANGELOG [Unreleased], audit plan line ticked, roadmap 10/61.
Evidence: go vet ./... clean; go test ./internal/store ok, ./internal/logtail
ok but for TestFollowTailsAndRotates (Windows); the server run of the stage
follows before the push.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/sendlog.go

@@ -83,16 +83,46 @@ func (s *Store) InsertRejected(e SendLogEntry) error {
 // case between the milter (envelope) and the delivery log. It returns the
 // number of rows updated so the caller can tell whether the line matched a
 // journal entry.
+//
+// A row the reconcile sweep closed (reason "reconcile") that a delivery line
+// now speaks of was closed on a guess the log could have settled: the log
+// wins, the reason is cleared, and the day's reconcile_contradicted counts it
+// (delivery_log_days) - once, since the row no longer carries the reason.
 func (s *Store) UpdateStatus(queueID, recipient, status string) (int64, error) {
-	now := time.Now().UTC().Format(time.RFC3339)
-	res, err := s.db.Exec(
-		`UPDATE send_log SET status = ?, updated_at = ?
+	now := time.Now().UTC()
+	tx, err := s.db.Begin()
+	if err != nil {
+		return 0, fmt.Errorf("update send_log status: %w", err)
+	}
+	defer tx.Rollback()
+	var contradicted int64
+	if err := tx.QueryRow(
+		`SELECT COUNT(*) FROM send_log WHERE queue_id = ? AND to_addr = ? COLLATE NOCASE AND reason = ?`,
+		queueID, recipient, ReasonReconcile,
+	).Scan(&contradicted); err != nil {
+		return 0, fmt.Errorf("update send_log status: %w", err)
+	}
+	res, err := tx.Exec(
+		`UPDATE send_log SET status = ?, updated_at = ?,
+			reason = CASE WHEN reason = ? THEN '' ELSE reason END
 		 WHERE queue_id = ? AND to_addr = ? COLLATE NOCASE`,
-		status, now, queueID, recipient,
+		status, now.Format(time.RFC3339), ReasonReconcile, queueID, recipient,
 	)
 	if err != nil {
 		return 0, fmt.Errorf("update send_log status: %w", err)
 	}
+	if contradicted > 0 {
+		if _, err := tx.Exec(
+			`INSERT INTO delivery_log_days (day, reconcile_contradicted) VALUES (?, ?)
+			 ON CONFLICT (day) DO UPDATE SET reconcile_contradicted = reconcile_contradicted + excluded.reconcile_contradicted`,
+			now.Format(dayLayout), contradicted,
+		); err != nil {
+			return 0, fmt.Errorf("update send_log status: count the contradicted sweep: %w", err)
+		}
+	}
+	if err := tx.Commit(); err != nil {
+		return 0, fmt.Errorf("update send_log status: %w", err)
+	}
 	n, _ := res.RowsAffected()
 	return n, nil
 }