audit 5: findings of the two reviews

- The e2e's numeric-settings test ran a container that passed every gate
  and never ended: the good values are checked beside a bad one after
  them; each run is named, bounded to a minute and removed.
- The gates refuse a value under the parameter's minimum (a zero window
  kills anvil, a zero milter timeout smtpd) and one past an int, in
  seconds for a time value (src/global/conv_time.c, src/anvil/anvil.c).
- OpenDKIM waits, five seconds at most, for the relay's socket.
- The relay marks its lines `syslog: `, writes control characters out,
  reads into a queue at once and drops past 200 lines a second, saying
  how many (security F1, F2; a stuck relay would hold OpenDKIM in
  syslog(3)).
- smtp_tls_mandatory_protocols >=TLSv1.2 too.
- extract-cert.sh keeps the old files' group and sets its trap before
  mktemp.
- crashexit spares cert-reload; architecture.md "four times running" and
  what else exits the container; security.md the restart after five panel
  exits and the /dev/log socket.
- Measured against the technical review: smtpd has the selfpost group
  (Groups 104 998), so it did reach the supervisor socket before this
  stage.
Accepted, reasons in the plan: the logrotate state file in the postfix
user's directory, envdoc_test's reading of `${VAR:-}` only, crashexit's
window pruning untested.

Tested on the test server: go vet + go test of 27 packages, make e2e (all
pass, 592 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/architecture.md

@@ -46,10 +46,17 @@ that will not start, is an exit supervisord counts as too quick: once
 each start it is STARTING.
 
 `crashexit` event listener exits the container when a program of the mail path
-is FATAL, so Docker `restart: unless-stopped` starts it again - the same
-container, not a new one: the entrypoint clears what the last run left in
-`/run` (the milter sockets, the sender check's alive mark). `logrotate`'s
-FATAL (a config logrotate would ignore) stays on Server › Health instead.
+is FATAL - it crashed before its `startsecs` four times running (the start
+and `startretries=3`) - or has
+exited unexpectedly five times in ten minutes, however long each run lasted
+(an exit after `startsecs` is EXITED and restarted, never FATAL; `2.6.0`), so
+Docker `restart: unless-stopped` starts it again - the same container, not a
+new one: the entrypoint clears what the last run left in `/run` (the milter
+sockets, the sender check's alive mark). Besides a stop, supervisord itself
+dying, or the entrypoint refusing a setting, nothing else exits the
+container. `logrotate`'s FATAL (a config logrotate would ignore),
+`postfix-reload`'s (reported to the page that asked), `cert-reload`'s and
+`syslog-relay`'s stay on Server › Health instead.
 The panel runs `postfix-reload` through supervisord's XML-RPC interface and
 waits for its exit status (`internal/supervisor`, `RunOnce`); the program
 rests EXITED after a run.
@@ -1110,7 +1117,9 @@ unsupported rather than as a missing doc:
   `POSTFIX_DMARC_RELAY_DOMAINS` (`/data/postfix/dmarc_relay_domains`),
   `POSTFIX_QUEUE_DIR` (`/data/postfix/queue` — set in `build/postfix-config.sh`),
   `SELFPOST_DEPLOY_ROOT` (`/selfpost-deploy` — operator project directory for
-  full backups; mount `.:/selfpost-deploy:ro` in compose).
+  full backups; mount `.:/selfpost-deploy:ro` in compose), `ANTISPAM_DIR`
+  (`/data/antispam` — the filter lists and the filter's key, which the spam
+  filter's container mounts).
 - **Milter and Postfix startup:** `MILTER_CONNECT_TIMEOUT` (`15s`),
   `MILTER_COMMAND_TIMEOUT` (`15s`), `MILTER_CONTENT_TIMEOUT` (`30s`),
   `MILTER_WAIT_TIMEOUT` (`30` seconds).