audit 5: findings of the two reviews

- The e2e's numeric-settings test ran a container that passed every gate
  and never ended: the good values are checked beside a bad one after
  them; each run is named, bounded to a minute and removed.
- The gates refuse a value under the parameter's minimum (a zero window
  kills anvil, a zero milter timeout smtpd) and one past an int, in
  seconds for a time value (src/global/conv_time.c, src/anvil/anvil.c).
- OpenDKIM waits, five seconds at most, for the relay's socket.
- The relay marks its lines `syslog: `, writes control characters out,
  reads into a queue at once and drops past 200 lines a second, saying
  how many (security F1, F2; a stuck relay would hold OpenDKIM in
  syslog(3)).
- smtp_tls_mandatory_protocols >=TLSv1.2 too.
- extract-cert.sh keeps the old files' group and sets its trap before
  mktemp.
- crashexit spares cert-reload; architecture.md "four times running" and
  what else exits the container; security.md the restart after five panel
  exits and the /dev/log socket.
- Measured against the technical review: smtpd has the selfpost group
  (Groups 104 998), so it did reach the supervisor socket before this
  stage.
Accepted, reasons in the plan: the logrotate state file in the postfix
user's directory, envdoc_test's reading of `${VAR:-}` only, crashexit's
window pruning untested.

Tested on the test server: go vet + go test of 27 packages, make e2e (all
pass, 592 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

build/logrotate-loop.sh

@@ -17,16 +17,21 @@
 # path anew (src/postlogd/postlogd.c, logwriter_open_or_die()).
 #
 # logrotate itself only rotates once the configured "daily" period has elapsed
-# (tracked in /var/lib/logrotate/status), so it is safe to invoke this more
-# often than daily — polling merely bounds how late a legitimate rotation runs.
-# (logrotate 3.21.0-1: debian/rules, --with-state-file-path=/var/lib/logrotate/
-# status. That file is in the container's own filesystem: a recreated container
-# starts without it, and logrotate.c, newState(), records a log it has no state
-# for as rotated today, so the first rotation after a recreate comes a day
-# later.)
+# (tracked in its state file), so it is safe to invoke this more often than
+# daily — polling merely bounds how late a legitimate rotation runs. The state
+# file is beside the log, under /data, not at the default
+# /var/lib/logrotate/status (logrotate 3.21.0-1: debian/rules,
+# --with-state-file-path) in the container's own filesystem: a recreated
+# container started without it, logrotate.c, newState(), records a log it has
+# no state for as rotated today, and so a host that recreates the container
+# daily - an .env change, an image bump - never rotated mail.log at all (audit
+# 2026-10-12, M19). (logrotate 3.21.0, logrotate.8.in: "-s, --state
+# statefile".) The directory is postfix:selfpost 2750 and logrotate runs as
+# root.
 set -eu
 
 CONFIG=/etc/logrotate.d/mail
+STATE=/data/log/.logrotate.status
 INTERVAL="${LOGROTATE_INTERVAL_SECONDS:-21600}"
 
 # logrotate refuses configs writable by group or others and exits 0 while
@@ -56,7 +61,7 @@ if ! logrotate_config_ok; then
 fi
 
 run_logrotate() {
-	out=$(logrotate "$CONFIG" 2>&1) || {
+	out=$(logrotate -s "$STATE" "$CONFIG" 2>&1) || {
 		echo "$out" >&2
 		return 1
 	}