sender check: a Sender: line is held to the rule From: is held to

The owner's decision (2026-10-16) on the security review's F1: a Sender:
line - the sending agent's, shown beside From: as "on behalf of", and
signed since 2.8.0 - was neither held to the login nor, before, signed: an
application could write its own From: and Sender: ceo@bank.com under this
server's signature. Now, when a message has one, it must be one address
the application may send as, and at most one such line (RFC 5322 § 3.6);
From: is judged first.

The refusal is "550 5.7.1 Sender: <address> - <why>", a send-log row of
reason "sender" (store.ReasonSender), tagged "wrong Sender"; the message
page names the line. The log tailer recovers such a row from cleanup's line
as it does a From: refusal (fromRefusalRe reads either). Help text as in
the design commit d9d9af3; guide, architecture, security and CHANGELOG say
it, security.md keeps Resent-From: (signed, not judged) as an accepted
risk.

Tests: TestSenderLineHeldToTheSameRule (own address, a name, another
application's, a stranger's, two addresses, two lines, From: first), the
recovery of a Sender: refusal line, the tag, the message page; e2e
sender_check_holds_the_sender_line (own Sender: passes and is signed,
another domain's refused at DATA and logged).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/architecture.md

@@ -418,7 +418,11 @@ the hole it closed was the same.
   `<b@evil.com, a@mine.com>` - is refused. That address, its local part
   unquoted as Postfix holds the envelope's, is what the bindings are asked
   about, folded to lower case in ASCII only: a Unicode fold would make the
-  Kelvin sign a `k` and let a look-alike pass. The check asks Postfix for
+  Kelvin sign a `k` and let a look-alike pass. Since `2.8.0` a `Sender:`
+  line - the sending agent's, shown beside `From:` as "on behalf of" - is
+  held to the same rule when the message has one (at most one; the owner's
+  decision, 2026-10-16): the reply says `Sender:` instead of `From:` and the
+  row's reason is `sender`. `From:` is judged first. The check asks Postfix for
   header values with their leading space (`SMFIP_HDR_LEADSPC`), as the
   signer does, so both read the same bytes. Until `2.8.0` the line was also
   read with a port of OpenDKIM's own parser, so that the address judged was