release: 0.5.0: Pre-1.0 security review, domain-admin role, doc consolidation

A bounce could be recorded as a successful delivery. The log-tailer's
Fixed:
  - A bounce could be recorded as a successful delivery. The log-tailer's
  - Log-tailer resumes where it stopped instead of jumping to end-of-file on
  - Level-2 rate limit no longer overshoots under concurrency: messages that
Changed:
  - The project has a single public home: `github.com/mixeme/selfpost`. Codeberg
  - Code comments no longer cite the archived specification. References like
  - `docs/code-review.md` is gone. Its plan is finished — phases 0 (bar the
  - `docs/architecture.md` gained a *Code layers* section: a diagram of
  - Phase 1 doc/code hygiene (`docs/code-review.md`): removed ~30 stale
  … (1 more in CHANGELOG)
Security:
  - Pre-release security review (plan § D, model Fable, 2026-08-06): full pass
  - `saslpasswd2` argv: the application login is now passed after a `--`
Added:
  - Optional password encryption for the two secret-bearing downloads (plan
  - Domain import accepts an encrypted export: the envelope is detected by its
  - `selfpost-backup` writes encrypted archives and reads them back:
  - `TestParseDelivery` covers the exotic mail.log shapes the review asked for
  - docs: README *Encrypting a backup or export*; `docs/security.md` §
  … (14 more in CHANGELOG)
Removed:
  - docs: `security.md` — accepted risk «restore old backup revives session rows»
Changed:
  - docs: `implementation-plan.md` trimmed to the sole open v1.x gate — pre-release
  - docs: `architecture.md` — sessions (SQLite, idle renew, password change),
  - docs: `development.md` — expanded e2e stack and `release.yml` matrix workflow.
  - docs: `security.md` — accepted risk for send-log rows stuck at `queued` after
  - docs: `roadmap.md` — optional send-log / `mail.log` follow-ups under v1.x tail.
  … (10 more in CHANGELOG)

Full detail: CHANGELOG.md (0.5.0).

internal/milter/ratelimit.go

@@ -4,19 +4,24 @@ import (
 	"log"
 	"time"
 
-	"codeberg.org/mix/selfpost/internal/store"
+	"github.com/mixeme/selfpost/internal/store"
 )
 
 // overLimit reports whether the message currently being received should be
-// refused under a level-2 differentiated limit (spec 7.4). It checks the
-// domain-level and application-level limits in turn; either being exceeded is
-// enough to refuse.
+// refused under a level-2 differentiated limit (README § Rate limiting). It
+// checks the domain-level and application-level limits in turn; either being
+// exceeded is enough to refuse.
 //
 // It is deliberately fail-open: any store error, or the absence of a usable
-// limit, is treated as "not over limit" so a malfunction of the level-2 limiter
-// can never block mail — Postfix's level-1 anvil limit (spec 5) remains the
-// backstop, and it does not depend on this milter at all. Only a clean count at
-// or above a configured ceiling returns true.
+// limit, is treated as "not over limit" so a malfunction of the level-2
+// limiter can never block mail — Postfix's level-1 anvil limit
+// (architecture.md § Mail path) remains the backstop, and it does not depend
+// on this milter at all. Only a clean count at or above a configured ceiling
+// returns true.
+//
+// A message that passes reserves a slot per applicable limit, released once it
+// reaches the send log (or is abandoned) — see inflight for why the stored
+// count alone is not enough.
 func (s *session) overLimit() bool {
 	if s.clientIP == "" {
 		return false // no client IP to key on; level-2 does not apply
@@ -25,6 +30,7 @@ func (s *session) overLimit() bool {
 		{store.RateLimitScopeDomain, domainOf(s.from)},
 		{store.RateLimitScopeApp, s.login},
 	}
+	var taken []*reservation
 	for _, c := range checks {
 		if c.ref == "" {
 			continue
@@ -45,19 +51,38 @@ func (s *session) overLimit() bool {
 			log.Printf("journal-milter: rate-limit count %s %q: %v (fail-open)", c.scope, c.ref, err)
 			continue
 		}
+		key := c.scope + "|" + c.ref
+		n += s.flight.count(key, since)
 		if n >= int64(rl.MaxMessages) {
 			log.Printf("journal-milter: %s %q over limit: %d/%d in %ds from %s — refusing 4xx",
 				c.scope, c.ref, n, rl.MaxMessages, rl.WindowSeconds, s.clientIP)
+			// The message is refused, so the slots claimed for the limits
+			// checked before this one must not stay claimed.
+			for _, r := range taken {
+				s.flight.release(r)
+			}
 			return true
 		}
+		taken = append(taken, s.flight.reserve(key))
 	}
+	s.reserved = append(s.reserved, taken...)
 	return false
 }
 
-// recordRejected writes a send-log row for a message refused by a level-2 limit
-// (spec 7.4, "опционально фиксирует ... для видимости в UI"), so the rejection
-// shows up in the monitoring screen. Only MAIL-stage fields are known; the write
-// is best-effort and never affects the response.
+// releaseReservations gives back every slot this message holds. It runs once
+// the message is in the send log (where the stored count sees it), and whenever
+// the transaction ends without getting there.
+func (s *session) releaseReservations() {
+	for _, r := range s.reserved {
+		s.flight.release(r)
+	}
+	s.reserved = nil
+}
+
+// recordRejected writes a send-log row for a message refused by a level-2
+// limit (README § Rate limiting — refusals are recorded too), so the rejection
+// shows up in the monitoring screen. Only MAIL-stage fields are known; the
+// write is best-effort and never affects the response.
 func (s *session) recordRejected() {
 	err := s.rec.InsertRejected(store.SendLogEntry{
 		Domain:   domainOf(s.from),