audit 2c: what only the stand could answer, measured and written down

All 2026-10-15; each written beside the code or text it settles.

- A-43: /usr/sbin/postlog is -rwxr-xr-x root:root in the image (postfix
  3.7.11-0+deb12u1; dpkg-statoverride lists postdrop and postqueue only):
  Debian does not install it set-gid, so it is no use to dmarc-ingest
  (cmd/panel/dmarc_ingest.go).
- C-X1: OpenSSL 3.0.22 in the image prints the same public key from
  `x509 -pubkey` and `pkey -pubout` for RSA-2048, P-256, P-384 and a SEC1
  P-256 key - cert-reload's same_pair holds for certbot's ECDSA keys.
- C-K5, D-guide:933/:233: on the live server (Docker 29.6.1, userland
  proxy on 0.0.0.0 and ::, no IPv6 on the network) an outside IPv4 client
  and the host's own public IPv4 address are logged as themselves; the
  host's IPv6 address and 127.0.0.1 arrive as 172.18.0.1. Over IPv6 every
  client is the gateway: one level-1 budget, an application IP list cannot
  name them, rspamd sees the gateway. Guide paragraph under level 1, notes
  at the milter and allow-list, comments at the anvil setup and authip.go,
  and a Security entry in the CHANGELOG (an allow-list naming the gateway
  would admit every IPv6 client).
- D-guide:61: a published port nothing listens on (a throwaway container,
  -p 20999:25) is refused from outside over IPv4 and from the host's public
  IPv4, accepted and closed through 127.0.0.1 - Docker's proxy, which IPv6
  goes through too (not probed over IPv6 for this).
- C-M8: the live installation has received one DMARC report, of one
  record: nothing to set maxReportRecords by yet - said at the constant.
- D-S7, D-arch:516, D-arch:532: a new database filled through the store to
  120 days at 1 900 messages a day (228 000 messages, 1.37 million lines,
  464 MB) on the test server (2 cores): the longest write is the line prune
  after a 30-day gap, 1.9 s for 342 000 lines (0.4 s with nothing to
  delete); the send-log delete 0.6 s; 2 000 lines of a tailer pass 18 ms;
  VACUUM INTO 1.7 s; a second connection writing every 50 ms waited 1.8 s
  at most, no SQLITE_BUSY - inside busy_timeout's 5 s. architecture.md's
  "about a second per million lines" was five times too fast; its "six to
  ten lines of 200 bytes" is 6.0 lines of 146 bytes on the live data.
- D-B16: which favicon is fetched, by the probe server's log: Edge 155
  the SVG, the desktop app's embedded Chromium 152 the PNG, with or
  without sizes="any" - layout.html's "vector wins where supported, raster
  catches the rest" holds; Firefox and Safari not measured.
- D-arch:121: the allow/deny trial again, in rspamd/rspamd:3.11.1-3 with
  today's multimap.conf: every mix of allow and deny entries matching one
  message ended reject; a changed map was used about 10 s later.
- D-sec:424: rspamd runs as _rspamd, uid 11333; the panel is uid 999.

Stand: go vet and go test ./... pass on the server (24 packages); make
e2e exit 0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/dmarc/parse.go

@@ -84,7 +84,10 @@ type feedbackXML struct {
 // and eight megabytes of it (maxAggregateXML) fit some 160 000 empty records or
 // one name of eight megabytes - every one of them a row or a table cell later.
 // A real report has tens of records, a few thousand from the largest
-// receivers, and no field longer than a line.
+// receivers, and no field longer than a line - an estimate: the live
+// installation had received one report by 2026-10-15, of one record, which
+// says nothing yet about the largest (assumptions C-M8: keep this ten times
+// above the largest seen).
 const (
 	maxReportRecords = 5000
 	maxFieldLen      = 255

internal/milter/authip.go

@@ -11,7 +11,10 @@ import (
 // the connecting client IP. When the application has no IP restriction the
 // check passes. When it has one and the client's address is not known, the
 // check fails: an address list that an unknown address satisfies is no list.
-// Store errors are fail-open (see overLimit).
+// Store errors are fail-open (see overLimit). The address is the one Postfix
+// sees in the container: a client's own over IPv4, the Docker network's
+// gateway for every client over IPv6 (measured on a live server, 2026-10-15;
+// assumptions C-K5).
 func (s *session) authIPAllowed() bool {
 	if s.login == "" {
 		return true

internal/store/sendloglines.go

@@ -148,7 +148,12 @@ func (s *Store) SendLogLines(row SendLogRow, lifetime time.Duration, n int) ([]S
 // received, whose row the journal milter has yet to write.
 //
 // The send log is asked once per queue id, not once per line: the ids are read
-// off the index, and a message is several lines.
+// off the index, and a message is several lines. It is the longest write the
+// panel makes: measured on the test server, 2026-10-15 (2 cores; 1.37
+// million lines, 120 days at 1 900 messages a day, timed through this
+// package), 1.9 s to delete 342 000 lines after a 30-day gap, 0.4 s with
+// nothing to delete - inside busy_timeout's 5 s (Open), which dmarc-ingest's
+// writes wait through: the longest waited 1.8 s (assumptions D-S7).
 func (s *Store) PruneSendLogLines(cutoff time.Time) (int64, error) {
 	res, err := s.db.Exec(
 		`DELETE FROM send_log_lines

internal/web/view/templates/layout.html

@@ -22,7 +22,11 @@
      the two-line wordmark, which stops resolving below 32px. The PNG is declared
      first and the SVG second: a browser takes the last icon whose type it
      understands, so vector wins wherever it is supported and the raster catches
-     the rest. */}}
+     the rest. HTML links.html#rel-icon leaves "most appropriate" to the
+     browser, so measured, 2026-10-15, by which file was requested: Edge 155
+     (Chromium) takes the SVG, the Claude desktop app's embedded browser
+     (Chromium 152) the PNG, and adding sizes="any" to the SVG changes
+     neither. Firefox and Safari not measured (assumptions D-B16). */}}
 <link rel="icon" href="/static/favicon.png" sizes="32x32">
 <link rel="icon" href="/static/favicon.svg" type="image/svg+xml">
 <link rel="stylesheet" href="/static/bulma.min.css">