audit 5: findings of the two reviews

- The e2e's numeric-settings test ran a container that passed every gate
  and never ended: the good values are checked beside a bad one after
  them; each run is named, bounded to a minute and removed.
- The gates refuse a value under the parameter's minimum (a zero window
  kills anvil, a zero milter timeout smtpd) and one past an int, in
  seconds for a time value (src/global/conv_time.c, src/anvil/anvil.c).
- OpenDKIM waits, five seconds at most, for the relay's socket.
- The relay marks its lines `syslog: `, writes control characters out,
  reads into a queue at once and drops past 200 lines a second, saying
  how many (security F1, F2; a stuck relay would hold OpenDKIM in
  syslog(3)).
- smtp_tls_mandatory_protocols >=TLSv1.2 too.
- extract-cert.sh keeps the old files' group and sets its trap before
  mktemp.
- crashexit spares cert-reload; architecture.md "four times running" and
  what else exits the container; security.md the restart after five panel
  exits and the /dev/log socket.
- Measured against the technical review: smtpd has the selfpost group
  (Groups 104 998), so it did reach the supervisor socket before this
  stage.
Accepted, reasons in the plan: the logrotate state file in the postfix
user's directory, envdoc_test's reading of `${VAR:-}` only, crashexit's
window pruning untested.

Tested on the test server: go vet + go test of 27 packages, make e2e (all
pass, 592 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

build/supervisord.conf

@@ -9,13 +9,15 @@
 ; pass, with no wait for a program to be ready.)
 ;
 ; If a managed process of the mail path exhausts its restart retries (FATAL),
-; the crashexit event listener brings the whole container down so Docker's
-; restart policy starts it again (the same container: docs.docker.com, "Start
-; containers automatically", restart policies), rather than lingering with a
-; dead component. A program reaches FATAL only through BACKOFF, by exits that
-; come before its startsecs (supervisor 4.2.5, supervisor/process.py,
-; Subprocess.finish() and transition()): an exit after it is EXITED and simply
-; restarted, for ever. logrotate's FATAL is left on Server > Health
+; or exits unexpectedly five times in ten minutes, the crashexit event listener
+; brings the whole container down so Docker's restart policy starts it again
+; (the same container: docs.docker.com, "Start containers automatically",
+; restart policies), rather than lingering with a dead component. A program
+; reaches FATAL only through BACKOFF, by exits that come before its startsecs
+; (supervisor 4.2.5, supervisor/process.py, Subprocess.finish() and
+; transition()): an exit after it is EXITED and simply restarted, for ever -
+; which the count of exits covers (audit 2026-10-12, L32). logrotate's,
+; postfix-reload's and syslog-relay's failures are left on Server > Health
 ; (build/crashexit.py).
 
 [supervisord]
@@ -66,7 +68,11 @@ stderr_logfile=/dev/stderr
 stderr_logfile_maxbytes=0
 
 [program:opendkim]
-command=/usr/sbin/opendkim -f -x /etc/opendkim.conf
+; It waits, five seconds at most, for the syslog relay's socket: supervisord
+; starts programs in priority order without waiting for one to be ready, and
+; OpenDKIM's start line would go nowhere (review of audit stage 5). exec keeps
+; the supervised pid OpenDKIM's.
+command=/bin/sh -c 'i=0; while [ ! -S /run/syslog/log ] && [ "$i" -lt 50 ]; do sleep 0.1; i=$((i+1)); done; exec /usr/sbin/opendkim -f -x /etc/opendkim.conf'
 priority=100
 autostart=true
 autorestart=true
@@ -182,6 +188,6 @@ stderr_logfile_maxbytes=0
 ; STOPPED (Subprocess.finish(), self.killing), which this listener never sees.
 [eventlistener:crashexit]
 command=/usr/local/bin/crashexit.py
-events=PROCESS_STATE_FATAL
+events=PROCESS_STATE_FATAL,PROCESS_STATE_EXITED
 stderr_logfile=/dev/stderr
 stderr_logfile_maxbytes=0