build, deploy, inbound, dmarc, backup, e2e: cite the source of what they rely on (assumptions part C)

Comments only, no behaviour changed. Each main.cf/master.cf parameter the
build sets, the wrapper's and the reload hook's reliance on Postfix 3.7.11
(postfix-script, master.5, postconf.5, cleanup_init.c, smtpd_peer.c,
README_FILES), supervisor 4.2.5 (process.py, options.py, events.rst),
logrotate 3.21.0, OpenDKIM's config, Cyrus SASL's sasldb, rspamd 3.11.1
(milter_headers.lua, multimap, the map watcher), Docker Compose, CoreDNS
and certbot now say where that is written. Measurements already there stay
measurements ("date not recorded" where none was); hand-composed fixtures
say so.

Contradictions left for their own commits: C-P31 cleanup's size limit,
C-P42 master outside supervisor's signal, C-V5/V6 startsecs, C-V10,
C-S3/Q3 sasldb written in place, C-Q4/A1 certbot's symlinks, C-R7 rspamd
skips local clients but the signature routine does not, C-P8, C-R4, C-R12,
C-M7, C-E2, C-K8/K9, C-D1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/e2e/negative_test.go

@@ -47,7 +47,9 @@ func testLevel2RateLimit(t *testing.T, sc *scenario) {
 		authLogin: login, authPassword: password,
 		from: from, to: recipient, subject: "e2e " + uniqueToken("l2-second"), body: "should be rejected",
 	})
-	// The milter answers tempfail at MAIL FROM, which Postfix words as below.
+	// The milter answers tempfail at MAIL FROM, which Postfix words as below
+	// (Postfix 3.7.11, src/milter/milter8.c, milter8_event(), SMFIR_TEMPFAIL:
+	// "451 4.7.1 Service unavailable - try again later").
 	if err := second.refusedAt("MAIL", 451, "4.7.1 Service unavailable"); err != nil {
 		t.Fatalf("the second message over the level-2 limit: %v", err)
 	}
@@ -58,7 +60,8 @@ func testLevel2RateLimit(t *testing.T, sc *scenario) {
 	// introduce the client again, so a second MAIL FROM on the same connection
 	// used to arrive with no client address and was let through (found by the
 	// technical review of 2026-10-12; the same hole let an application past its
-	// client-address list).
+	// client-address list). Postfix's half: 3.7.11, src/smtpd/smtpd.c,
+	// smtpd_proto(), calls milter_conn_event() once per connection.
 	errs := mailTwiceOnOneConnection(login, password, from)
 	for i, err := range errs {
 		if err := replyIs(err, 451, "4.7.1 Service unavailable"); err != nil {
@@ -91,7 +94,10 @@ func testSenderLoginMismatch(t *testing.T, sc *scenario) {
 	})
 	// Postfix evaluates smtpd_sender_restrictions with smtpd_delay_reject=yes
 	// (the default): the mismatch is detected at MAIL FROM but the reject is
-	// only sent back at RCPT TO.
+	// only sent back at RCPT TO. (Postfix 3.7.11, src/global/mail_params.h,
+	// DEF_SMTPD_DELAY_REJECT 1; src/smtpd/smtpd_check.c,
+	// reject_auth_sender_login_mismatch(): 553 5.7.1 "Sender address rejected:
+	// not owned by user".)
 	if err := res.refusedAt("RCPT", 553, "5.7.1"); err != nil {
 		t.Fatalf("a sender the application does not own: %v", err)
 	}
@@ -103,6 +109,10 @@ func testSenderLoginMismatch(t *testing.T, sc *scenario) {
 // testNoAuthRejected is plan C.4 negative check 1: no SASL session, no mail.
 // The sender address used here belongs to no registered domain, so the
 // rejection is unambiguously about the missing AUTH and not sender ownership.
+// The reply: smtps's client restrictions end in "reject" (build/
+// postfix-config.sh), Postfix 3.7.11, src/smtpd/smtpd_check.c,
+// generic_checks(): var_reject_code (554) "<%s>: %s rejected: Access denied",
+// delayed to RCPT by smtpd_delay_reject.
 func testNoAuthRejected(t *testing.T, sc *scenario) {
 	res := attemptSend(sendAttempt{
 		from: "anyone@unregistered.e2e.test", to: recipient,
@@ -181,7 +191,9 @@ func testSessionSurvivesRestart(t *testing.T, sc *scenario) {
 // when the connection was reset because Postfix was still starting - and,
 // held to anvil's reply, it turned out the first message had always been
 // refused for another reason: the new login was not yet in the sender map an
-// smtpd from before the panel's reload held (waitForSenderMap).
+// smtpd from before the panel's reload held (waitForSenderMap). (An incident
+// on the stand, date not recorded.) Anvil's reply: Postfix 3.7.11,
+// src/smtpd/smtpd.c, mail_cmd(): "450 4.7.1 Error: too much mail from %s".
 func testLevel1RateLimit(t *testing.T, sc *scenario) {
 	login, password, err := sc.panel.addApplication(sc.domainID, "l1app", "wildcard", "")
 	if err != nil {