findings of the reviews of audit stage 1

Technical review (Opus) and security review (Fable) of 9efc9c7..a59e3d4;
reports in the session's scratchpad. Fixed:

- B1 (verified bug): store.UpdateStatus read before writing in its
  transaction; a commit by another connection in between (the dmarc-ingest
  process opens the same file) failed it at once with "database is locked"
  and the delivery line was lost. The first statement is now a write.
- R3: a delivery line updated every row of its queue id and recipient; it
  now updates only the newest (Postfix reuses short ids). The sweep closes
  by row id (QueuedDelivery.ID, CloseUnreported(id)).
- R4: a contradicted sweep keeps a mark, reason "reconcile-contradicted",
  instead of losing which row it was.
- R1: contradicted cannot see a lost line (never read late). New counter
  reconcile_missed: at close, the sweep looks for the row's delivery line
  in mail.log and mail.log.1 (QueueLines). 0007 edited - it has run on no
  database but throwaway stands.
- R2: queued_over_lifetime cannot measure "what removing the sweep would
  leave" while the sweep runs; its text now says rows stuck despite the
  sweep, and the rule uses closed - missed - contradicted.
- cert-reload (R5, R6, R7, security medium/low): both files copied to .new
  and the copies checked as a pair before both are renamed; acts on the copy
  only when postconf says Postfix reads it; a failed reload is retried next
  pass; umask 077; says so when the mounted files cannot be read. The e2e
  case asserts Postfix reads the copy, the copy equals the mount, the key is
  600 root.
- Security low: a recipient with a quoted local part - the journal cut
  "a b"@x at the space, deliveryRe cut "a>b"@x at the ">" - matched no
  delivery line and was closed by the sweep. cleanAddress ends a bracketed
  address at the first ">" outside quotes; deliveryRe takes the recipient
  up to the ">, " before relay= (test fixtures given the relay= every real
  delivery line has).
- Security low: postqueue -p's error carries at most 512 bytes of output.
- Nits: addDeliveryLogDay refuses a column not on its list; the truncation
  test checks its message.
- To stage 2b (page wording, mockup-first): the history step of a bounced
  row says the receiving server refused it, false for a row the sweep
  closed. To the owner when stage 2b is reached: since M13 the "deferred"
  figure counts whole messages too, which "Connections turned away" would
  not name.

Found while verifying: the e2e's main positive path failed once with "553
not owned by user app1" - an smtpd idle from before the panel's reload took
the connection in the reload's second. Measured on the stand (one-off
probe, not committed): sending 0, 10, 40, 110 s after the save (two seconds
at the soonest) always met an smtpd started after the reload. The e2e now
waits for the sender map after each application it creates
(waitForSenderMap: AUTH, MAIL, RCPT, RSET - no message, no row), and the
level-1 case uses it instead of its own loop.

Docs: architecture § Queue reconcile, schema-migrations (rows 7 and 8,
chain head 8), CHANGELOG, audit plan (stage 1 note, the measured window,
a new stage 2b line: 62 lines), roadmap 15/62.

Evidence on the test server for this tree: go vet clean, go test ./... 23
packages ok, make e2e exit 0 (renewed certificate, hung panel, level 1 at
49/60).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/e2e/cert_reload_check.go

@@ -9,6 +9,7 @@ import (
 	"net"
 	"os"
 	"path/filepath"
+	"strings"
 	"time"
 )
 
@@ -68,7 +69,7 @@ func checkCertRenewalPickedUp(s *stack) error {
 	if want.Cmp(before) == 0 {
 		return fmt.Errorf("the renewed certificate has the old serial %s", before)
 	}
-	return waitFor("port 465 to present the renewed certificate", 30*time.Second, 500*time.Millisecond, func() (bool, error) {
+	if err := waitFor("port 465 to present the renewed certificate", 30*time.Second, 500*time.Millisecond, func() (bool, error) {
 		got, err := servedSerial()
 		if err != nil {
 			return false, err
@@ -77,5 +78,19 @@ func checkCertRenewalPickedUp(s *stack) error {
 			return false, fmt.Errorf("serial %s served, want %s", got, want)
 		}
 		return true, nil
-	})
+	}); err != nil {
+		return err
+	}
+	// The path that was broken is the one taken: Postfix reads the copy, and
+	// the copy is the renewed file, the key private to root.
+	out, err := s.execIn("selfpost", "sh", "-c",
+		"postconf -h smtpd_tls_cert_file && cmp /etc/postfix/tls/fullchain.pem /etc/postfix/tls-internal/fullchain.pem && "+
+			"cmp /etc/postfix/tls/privkey.pem /etc/postfix/tls-internal/privkey.pem && stat -c '%a %U' /etc/postfix/tls-internal/privkey.pem")
+	if err != nil {
+		return fmt.Errorf("Postfix's copy of the certificate: %v\n%s", err, out)
+	}
+	if !strings.Contains(out, "/etc/postfix/tls-internal/fullchain.pem\n") || !strings.Contains(out, "600 root") {
+		return fmt.Errorf("Postfix's copy of the certificate: %q, want Postfix reading it and the key 600 root", out)
+	}
+	return nil
 }

test/e2e/main_test.go

@@ -241,6 +241,9 @@ func TestE2E(t *testing.T) {
 		if err != nil {
 			t.Fatalf("add application: %v", err)
 		}
+		if err := waitForSenderMap(login, password, "alerts@"+senderDomain); err != nil {
+			t.Fatal(err)
+		}
 		sc.appLogin, sc.appPassword = login, password
 	})
 

test/e2e/negative_test.go

@@ -20,6 +20,9 @@ func testLevel2RateLimit(t *testing.T, sc *scenario) {
 	if err != nil {
 		t.Fatalf("add application: %v", err)
 	}
+	if err := waitForSenderMap(login, password, "billing@"+senderDomain); err != nil {
+		t.Fatal(err)
+	}
 	sc.l2AppLogin, sc.l2AppPassword = login, password
 
 	appID, err := sc.panel.applicationID(sc.domainID, login)
@@ -177,7 +180,8 @@ func testSessionSurvivesRestart(t *testing.T, sc *scenario) {
 // loop went through: the case once passed on "limit tripped on attempt 1/60"
 // when the connection was reset because Postfix was still starting - and,
 // held to anvil's reply, it turned out the first message had always been
-// refused for another reason (below).
+// refused for another reason: the new login was not yet in the sender map an
+// smtpd from before the panel's reload held (waitForSenderMap).
 func testLevel1RateLimit(t *testing.T, sc *scenario) {
 	login, password, err := sc.panel.addApplication(sc.domainID, "l1app", "wildcard", "")
 	if err != nil {
@@ -191,21 +195,11 @@ func testLevel1RateLimit(t *testing.T, sc *scenario) {
 		})
 	}
 
-	// The panel writes sender_login_maps and reloads Postfix, but an smtpd
-	// process that was idle before the reload can still take the next
-	// connection with the old map and answer 553 for the new login (seen on
-	// the stand: the process that greeted waitForSMTPSReady). Wait for the map
-	// to take effect; any other refusal fails at once.
-	deadline := time.Now().Add(15 * time.Second)
-	for {
-		res := send()
-		if res.ok() {
-			break
-		}
-		if res.refusedAt("RCPT", 553, "not owned by user "+login) != nil || time.Now().After(deadline) {
-			t.Fatalf("the first message of %s, before any limit could trip: %v", login, res.firstErr())
-		}
-		time.Sleep(300 * time.Millisecond)
+	if err := waitForSenderMap(login, password, "l1@"+senderDomain); err != nil {
+		t.Fatal(err)
+	}
+	if res := send(); !res.ok() {
+		t.Fatalf("the first message of %s, before any limit could trip: %v", login, res.firstErr())
 	}
 
 	const maxAttempts = 60

test/e2e/sender_check_test.go

@@ -28,6 +28,9 @@ func testSenderCheck(t *testing.T, sc *scenario) {
 		t.Fatalf("add the second domain: %v", err)
 	}
 	listLogin, listPassword, err := sc.panel.addApplication(sc.domainID, "app-list", "list", "billing@"+senderDomain)
+	if err == nil {
+		err = waitForSenderMap(listLogin, listPassword, "billing@"+senderDomain)
+	}
 	if err != nil {
 		t.Fatalf("add the application with a list: %v", err)
 	}

test/e2e/smtp_client.go

@@ -227,3 +227,59 @@ func mailTwiceOnOneConnection(login, password, from string) [2]error {
 	_ = c.Quit()
 	return out
 }
+
+// waitForSenderMap waits until Postfix lets login use from: an application
+// the panel has just created is written into the sender map and Postfix is
+// reloaded, and an smtpd that was idle from before the reload can still take
+// a connection in the second that follows and answer 553 "not owned by user"
+// (seen on the stand; two seconds after the save it no longer happened, at 0,
+// 10, 40 or 110 s of waiting). It goes as far as RCPT and then RSET, so no
+// message is sent and no row is written. Only that 553 is waited out, for 15
+// s at most; any other answer fails at once.
+func waitForSenderMap(login, password, from string) error {
+	deadline := time.Now().Add(15 * time.Second)
+	for {
+		err := probeSender(login, password, from)
+		if err == nil {
+			return nil
+		}
+		if replyIs(err, 553, "not owned by user "+login) != nil || time.Now().After(deadline) {
+			return fmt.Errorf("Postfix does not yet let %s send as %s: %w", login, from, err)
+		}
+		time.Sleep(300 * time.Millisecond)
+	}
+}
+
+// probeSender authenticates as login and offers MAIL FROM from and one RCPT,
+// then resets. It returns the first refusal, or nil.
+func probeSender(login, password, from string) error {
+	conn, err := tls.DialWithDialer(&net.Dialer{Timeout: 10 * time.Second}, "tcp", smtpsAddr, &tls.Config{
+		InsecureSkipVerify: true,
+		ServerName:         selfpostHostname,
+	})
+	if err != nil {
+		return err
+	}
+	_ = conn.SetDeadline(time.Now().Add(30 * time.Second))
+	c, err := smtp.NewClient(conn, selfpostHostname)
+	if err != nil {
+		_ = conn.Close()
+		return err
+	}
+	defer c.Close()
+	if err := c.Hello("e2e-client.e2e.test"); err != nil {
+		return err
+	}
+	if err := c.Auth(smtp.PlainAuth("", login, password, selfpostHostname)); err != nil {
+		return err
+	}
+	if err := c.Mail(from); err != nil {
+		return err
+	}
+	if err := c.Rcpt(recipient); err != nil {
+		return err
+	}
+	_ = c.Reset()
+	_ = c.Quit()
+	return nil
+}