audit 4: sign-in timing and sessions, server timeouts, polling that recovers

Steps 1-3 of stage 4, tested together (their docs share files).

Step 1 (M8, L15, L16): an unknown name pays a bcrypt comparison at the
panel's work factor too (noSuchUserHash, made once) -
TestLoginTakesAsLongForAnUnknownName holds the medians within a factor of
two; the Account form's current-password check has its own limiter, per
user (AllowPasswordChange); a sign-in destroys every session the request
presents before it issues its own.

Step 2 (L14): newHTTPServer - ReadTimeout 30 s, WriteTimeout 60 s,
IdleTimeout 2 min beside ReadHeaderTimeout; the full backup moves its write
deadline to two hours through http.ResponseController (e2e: the log shows
no failure to move it).

Step 3 (M11), read in htmx 2.0.4's source (dev/upstream/htmx-2.0.4, the npm
build byte-equal to the shipped htmx.min.js): the poll passes source: box,
and the next refresh is scheduled from htmx:afterRequest, which htmx fires
on load, error, abort and timeout, and after a swap on the nearest parent
left (the box found by detail.target's id); failures in a row double the
wait to 60 s. RequireAuth answers htmx with 401 + HX-Redirect: /login,
which htmx follows before it looks at the status. testdata/poll_test.js
runs panel.js in node against a stand-in DOM and clock (TestPanelJS; skipped
without node, which the test server lacks - run here, and it fails on the
old panel.js).

Also measured: the stage-3 e2e regression for H1 fails as it should on HEAD
with the old entrypoint ("check data/postfix/e2e_extra_map: permission
denied", the panel restarting).

Tested on the test server: go vet + go test of 25 packages, make e2e (all
pass, 639 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/architecture.md

@@ -724,9 +724,15 @@ a refresh cannot differ. HTMX refreshes them every 5 s while the operator is
 active on the page, every 30 s when the tab is visible but idle, and not at all
 when it is hidden — scheduled in `panel.js` via `data-poll`, not
 `hx-trigger="every …"`, because a trigger filter is evaluated with `new
-Function`, which the CSP forbids. Polling does not extend the session idle
-timeout (only non-`HX-Request` `GET`s and mutating requests count as
-activity). The Outbound queue's retry-policy box is outside the polled region:
+Function`, which the CSP forbids. The next refresh is scheduled when a
+request of the box ends, however it ended: a refresh that failed - an error
+answer, the panel restarting, the network gone - is tried again after twice
+the wait, doubling with each failure in a row up to a minute, and the wait
+is back to normal after one that works. A request without a session answers
+htmx with `HX-Redirect: /login` (status 401), and htmx loads the sign-in
+page in place of the whole page; a browser gets the 303 as before. Polling
+does not extend the session idle timeout (only non-`HX-Request` `GET`s and
+mutating requests count as activity). The Outbound queue's retry-policy box is outside the polled region:
 it is the start-up `postconf -h` snapshot (see [Panel
 binary](#panel-binary-cmdpanel)), not a live re-read.
 

docs/audit-2026-10-12.md

@@ -1185,15 +1185,40 @@ command whose leftover is the owner's alone.
 
 ### Stage 4 — panel behaviour (M8, M11, L10–L19) → `2.5.4`
 
-- [ ] Login: dummy bcrypt on unknown user; a test that measures both paths within
+- [x] Login: dummy bcrypt on unknown user; a test that measures both paths within
    a tolerance. Account password change gets its own limiter bucket. Login
    destroys the presented session. — **Opus**
-- [ ] `http.Server`: `ReadTimeout`, `WriteTimeout`, `IdleTimeout`. — **Opus**
-- [ ] **Polling recovery**: schedule from `htmx:afterRequest` on the box (or pass
+   *Done 2026-10-15:* `noSuchUserHash` (BcryptCost, made once) compared
+   against for an unknown name or a failed lookup;
+   `TestLoginTakesAsLongForAnUnknownName` holds the medians of five tries
+   each within a factor of two at the real work factor. The bucket is per
+   user (`AllowPasswordChange(userID)`, 10 in 15 min): the guesser is
+   whoever holds that user's session. Sign-in destroys every session cookie
+   the request carries before it creates its own.
+- [x] `http.Server`: `ReadTimeout`, `WriteTimeout`, `IdleTimeout`. — **Opus**
+   *Done 2026-10-15:* 30 s, 60 s, 2 min (`newHTTPServer`); the full backup
+   would have been cut at 60 s, so `HandleBackup` moves its write deadline
+   to two hours through `http.ResponseController` (no wrapper of the
+   ResponseWriter in the chain; e2e checks the log has no failure to move
+   it). A test pins the four values.
+- [x] **Polling recovery**: schedule from `htmx:afterRequest` on the box (or pass
    `source`), handle `sendError`/`timeout` with back-off; `RequireAuth`
    answers an `HX-Request` with `HX-Redirect: /login` instead of a 303. A
    minimal JS test (node + jsdom) or at least an e2e that restarts the panel
    with Overview open. — **Sonnet**
+   *Done 2026-10-15,* read in htmx 2.0.4's source (the npm build, byte-equal
+   to the shipped `htmx.min.js`, in `dev/upstream/htmx-2.0.4`): both -
+   `source: el`, and the schedule from `htmx:afterRequest`, which
+   `issueAjaxRequest()` fires on load, error, abort and timeout, and after a
+   swap that removed the box fires again on the nearest parent still in the
+   page (so the box is found by `detail.target`'s id);
+   `detail.successful` tells failure. Back-off doubles per failure in a row
+   to 60 s. `toLogin`: 401 + `HX-Redirect` for htmx, which
+   `handleAjaxResponse()` follows before it looks at the status. No jsdom
+   (no node tooling in the repo): `testdata/poll_test.js` runs panel.js in
+   node against a stand-in for the DOM and htmx with a moved clock, from
+   `TestPanelJSPolling` (skipped where node is absent - the test server's
+   Go has none; it fails on the old panel.js with ten findings).
 - [ ] `parsePage` clamp; `NaN` refused; `rate-limited` tag red (add the status to
    `components.go`, flip the test); the recalc button posts only what it
    needs or warns; `HandleReload` either covers DMARC maps and filter lists or

docs/roadmap.md

@@ -42,7 +42,7 @@ in `git log` and [CHANGELOG.md](../CHANGELOG.md).
 | from-header-binding | Hold a message's `From:` header against the application that sends it | shipped `2.4.0` | 9/9 | [plans/from-header-binding.md](plans/from-header-binding.md) |
 | panel-redesign | Panel redesign (accepted mockups, design contract) | shipped `2.0.0` | 27/27 | [plans/panel-redesign.md](plans/panel-redesign.md) |
 | schema-squash | Squash SQLite migrations into a 2.x baseline | built in panel-redesign (stage 1) | — | [plans/panel-redesign.md](plans/panel-redesign.md) |
-| audit-2026-10-12 | Follow-ups of the 2026-10-12 full-tree code audit, seven stages | in progress (stage 0 shipped `2.4.2`, stages 1+2 `2.5.0`, 2b `2.5.1`, 2c `2.5.2`, 3 `2.5.3`; next stage 4 → `2.5.4`) | 55/81 | [audit-2026-10-12.md](audit-2026-10-12.md) |
+| audit-2026-10-12 | Follow-ups of the 2026-10-12 full-tree code audit, seven stages | in progress (stage 0 shipped `2.4.2`, stages 1+2 `2.5.0`, 2b `2.5.1`, 2c `2.5.2`, 3 `2.5.3`; next stage 4 → `2.5.4`) | 58/81 | [audit-2026-10-12.md](audit-2026-10-12.md) |
 
 **Recommended order** (not binding; owner, 2026-10-09: feature order follows
 development convenience): **panel-redesign** shipped as `2.0.0` (2026-10-11) and

docs/security.md

@@ -104,10 +104,19 @@ The panel is exposed to the internet — the items below are **not optional**.
 - `postfix reload` and any `exec` run **without** shell interpolation of user
   input; arguments are passed as separate elements.
 - Writes to config files are escaped (no injection of Postfix directives).
+- The panel's HTTP server bounds every phase a client could hold it in: the
+  header 10 s, the request 30 s, the answer 60 s, an idle kept-alive
+  connection 2 min; a full backup download moves its own write limit to
+  two hours (`2.5.4`).
 
 ### Authentication and sessions
 
-- Rate limiting on login (per IP, with lockout or delay).
+- Rate limiting on login (per IP, with lockout or delay). The Account form's
+  current-password check has a limit of its own, ten in 15 minutes per user,
+  so guesses there do not lock the address out of signing in (`2.5.4`).
+- An unknown username is refused in the time a wrong password is: the sign-in
+  compares a bcrypt hash of the panel's work factor either way, so the delay
+  does not tell which names exist (`2.5.4`).
 - Sessions: cryptographically random token; cookie `HttpOnly`, `Secure`,
   `SameSite`.
 - Sessions live in SQLite (SHA-256 of the token, not the token itself); sliding
@@ -120,7 +129,9 @@ The panel is exposed to the internet — the items below are **not optional**.
 - **What ends a user's sessions:** deleting the user (all); a password change on
   Account (that user's *other* sessions — never another user's); a password set
   for them by a global user on the user form (all of theirs, except the current
-  one when they set their own); signing out (the current one only). There is no
+  one when they set their own); signing out (the current one only); signing
+  in (the session the browser presented, if any - a token planted before the
+  sign-in is worth nothing after it, `2.5.4`). There is no
   "sign out everywhere", and a restored backup brings back the session rows it
   held.
 - Polling by the monitoring screens (`HX-Request` `GET`s) does not renew a