audit 5: findings of the two reviews

- The e2e's numeric-settings test ran a container that passed every gate
  and never ended: the good values are checked beside a bad one after
  them; each run is named, bounded to a minute and removed.
- The gates refuse a value under the parameter's minimum (a zero window
  kills anvil, a zero milter timeout smtpd) and one past an int, in
  seconds for a time value (src/global/conv_time.c, src/anvil/anvil.c).
- OpenDKIM waits, five seconds at most, for the relay's socket.
- The relay marks its lines `syslog: `, writes control characters out,
  reads into a queue at once and drops past 200 lines a second, saying
  how many (security F1, F2; a stuck relay would hold OpenDKIM in
  syslog(3)).
- smtp_tls_mandatory_protocols >=TLSv1.2 too.
- extract-cert.sh keeps the old files' group and sets its trap before
  mktemp.
- crashexit spares cert-reload; architecture.md "four times running" and
  what else exits the container; security.md the restart after five panel
  exits and the /dev/log socket.
- Measured against the technical review: smtpd has the selfpost group
  (Groups 104 998), so it did reach the supervisor socket before this
  stage.
Accepted, reasons in the plan: the logrotate state file in the postfix
user's directory, envdoc_test's reading of `${VAR:-}` only, crashexit's
window pruning untested.

Tested on the test server: go vet + go test of 27 packages, make e2e (all
pass, 592 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/security.md

@@ -572,7 +572,10 @@ deferred item from the roadmap.
   off by whoever can make the panel slow. Supervisord starts a panel that
   died again at once; one that dies within a second of starting is tried
   four times in a few seconds, and then SelfPost's `crashexit` listener takes
-  the container down (supervisor 4.2.5, `startretries=3`), so the outage is
+  the container down (supervisor 4.2.5, `startretries=3`); since `2.6.0` it
+  does so too when the panel exits unexpectedly five times in ten minutes,
+  however long each run lasted - so five malformed packets on a milter
+  socket (the next item) restart the whole container. The outage is
   seconds or the whole instance; Server › Health counts the
   downtime and the mail deferred for it. Trigger to revisit: those numbers
   not staying at nothing - then the check moves into a process of its own
@@ -585,6 +588,15 @@ deferred item from the roadmap.
   of the restart defer mail instead of passing it unjournalled (technical
   review, 2026-10-12). Trigger to revisit: anything untrusted able to open
   a Unix socket in the container.
+- **The container's `/dev/log` takes datagrams from any user in it** (since
+  `2.6.0`, for OpenDKIM's log): what is written there reaches the container
+  log, each line marked `syslog: `, control characters written out, at most
+  200 lines a second (the rest counted and dropped). A user who can write it
+  can add lines to `docker logs` under that mark and no other; the panel
+  reads only `mail.log`. logrotate's state file is under `/data/log`, the
+  `postfix` user's directory: that user could stop rotation through it -
+  as through the log itself, which it owns. Trigger to revisit: anything
+  untrusted able to run in the container.
 - **When the hostname is itself a sending domain,** the server's mail is
   signed with that domain's key. Whoever may export the domain has the key,
   and its applications may send as `postmaster@<hostname>` by right. The