audit 2c: what only the stand could answer, measured and written down

All 2026-10-15; each written beside the code or text it settles.

- A-43: /usr/sbin/postlog is -rwxr-xr-x root:root in the image (postfix
  3.7.11-0+deb12u1; dpkg-statoverride lists postdrop and postqueue only):
  Debian does not install it set-gid, so it is no use to dmarc-ingest
  (cmd/panel/dmarc_ingest.go).
- C-X1: OpenSSL 3.0.22 in the image prints the same public key from
  `x509 -pubkey` and `pkey -pubout` for RSA-2048, P-256, P-384 and a SEC1
  P-256 key - cert-reload's same_pair holds for certbot's ECDSA keys.
- C-K5, D-guide:933/:233: on the live server (Docker 29.6.1, userland
  proxy on 0.0.0.0 and ::, no IPv6 on the network) an outside IPv4 client
  and the host's own public IPv4 address are logged as themselves; the
  host's IPv6 address and 127.0.0.1 arrive as 172.18.0.1. Over IPv6 every
  client is the gateway: one level-1 budget, an application IP list cannot
  name them, rspamd sees the gateway. Guide paragraph under level 1, notes
  at the milter and allow-list, comments at the anvil setup and authip.go,
  and a Security entry in the CHANGELOG (an allow-list naming the gateway
  would admit every IPv6 client).
- D-guide:61: a published port nothing listens on (a throwaway container,
  -p 20999:25) is refused from outside over IPv4 and from the host's public
  IPv4, accepted and closed through 127.0.0.1 - Docker's proxy, which IPv6
  goes through too (not probed over IPv6 for this).
- C-M8: the live installation has received one DMARC report, of one
  record: nothing to set maxReportRecords by yet - said at the constant.
- D-S7, D-arch:516, D-arch:532: a new database filled through the store to
  120 days at 1 900 messages a day (228 000 messages, 1.37 million lines,
  464 MB) on the test server (2 cores): the longest write is the line prune
  after a 30-day gap, 1.9 s for 342 000 lines (0.4 s with nothing to
  delete); the send-log delete 0.6 s; 2 000 lines of a tailer pass 18 ms;
  VACUUM INTO 1.7 s; a second connection writing every 50 ms waited 1.8 s
  at most, no SQLITE_BUSY - inside busy_timeout's 5 s. architecture.md's
  "about a second per million lines" was five times too fast; its "six to
  ten lines of 200 bytes" is 6.0 lines of 146 bytes on the live data.
- D-B16: which favicon is fetched, by the probe server's log: Edge 155
  the SVG, the desktop app's embedded Chromium 152 the PNG, with or
  without sizes="any" - layout.html's "vector wins where supported, raster
  catches the rest" holds; Firefox and Safari not measured.
- D-arch:121: the allow/deny trial again, in rspamd/rspamd:3.11.1-3 with
  today's multimap.conf: every mix of allow and deny entries matching one
  message ended reject; a changed map was used about 10 s later.
- D-sec:424: rspamd runs as _rspamd, uid 11333; the panel is uid 999.

Stand: go vet and go test ./... pass on the server (24 packages); make
e2e exit 0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/audit-2026-10-12.md

@@ -1026,7 +1026,7 @@ those after it move up one patch number each.
    per document, reviewed. Two register proposals were outdated by this
    stage's fixes (a bounce's `From:` line, `Origin: null`) and not used; the
    nginx renewal needed `--webroot` in the loop, which the register missed.
-- [ ] **What only the stand can answer** (A-43, C-K5, C-M8, C-X1, D-S7,
+- [x] **What only the stand can answer** (A-43, C-K5, C-M8, C-X1, D-S7,
    D-B16 and the document claims marked so): postlog's set-gid in the
    image; the client address Postfix sees through Docker's port publishing
    over IPv4 and IPv6; the largest DMARC report received; the public keys
@@ -1034,6 +1034,19 @@ those after it move up one patch number each.
    against busy_timeout at the retention limit; the favicon each browser
    takes. Each measured, dated and written beside the code it settles.
    - **Opus**
+   *Done 2026-10-15,* each written beside what it settles: postlog is not
+   set-gid in Debian's package (A-43); Docker's proxy hands every IPv6
+   client and the host's loopback over as the gateway, IPv4 keeps the
+   client (C-K5; a new guide paragraph, and a Security note: an allow-list
+   naming the gateway admits every IPv6 client); one DMARC report of one
+   record so far, too little to judge the cap (C-M8); OpenSSL 3.0.22 prints
+   one public key alike for RSA and ECDSA (C-X1); the longest write, the
+   line prune, 1.9 s at 1 900 messages a day after a 30-day gap, under
+   busy_timeout (D-S7, D-arch:516); about 6 lines of 146 bytes a message
+   (D-arch:532); Edge takes the SVG favicon, the desktop app's browser the
+   PNG (D-B16); a published port nothing listens on is refused over IPv4,
+   accepted by the proxy otherwise (D-guide:61); deny beats allow in every
+   mix on rspamd 3.11.1-3 (D-arch:121); rspamd runs as uid 11333 (D-sec:424).
 - [ ] Docs and wording: help topic sender-check and guide § Who an
    application may send as (mockup first), security.md § Mail path,
    CHANGELOG. - **Sonnet**