diff --git a/.dockerignore b/.dockerignore
index d47e802..01e3d96 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -4,6 +4,9 @@
 .gitattributes
 dev
 docs
+# test/e2e/.stage holds what an e2e run leaves behind (DKIM keys, sasldb2);
+# the e2e's own sink image is built from test/e2e/sink as its own context.
+test
 bin
 *.exe
 README.md
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b598be7..c60f8f0 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -24,6 +24,9 @@ jobs:
         with:
           go-version: "1.26"
           cache: true
+          cache-dependency-path: |
+            go.sum
+            test/e2e/go.sum
 
       - name: Format
         run: |
@@ -39,3 +42,13 @@ jobs:
 
       - name: Test
         run: go test ./...
+
+      # The e2e module runs only in release.yml, after a release is published;
+      # a type error there would first show up then. Compile it here without
+      # running it: `go test -run` would still run TestMain, which brings up
+      # the whole stand.
+      - name: Compile the e2e
+        working-directory: test/e2e
+        run: |
+          go vet ./...
+          go test -c -o /dev/null .
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 28ce810..316a2f4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,12 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   `selfpost-backup -version` against it, and `release.yml` checks the stamp
   again on the image right before pushing it. Images already published are
   left as they are.
+- **The e2e module is compiled on every push** (`test.yml`: `go vet` and
+  `go test -c` in `test/e2e`), so a type error there no longer first shows
+  up in `release.yml` after a release is published (audit 2026-10-12, M20).
+- **`test/` is out of the image's build context** (`.dockerignore`): a
+  developer build after an e2e run sent the stand's leftovers - DKIM keys,
+  `sasldb2` - to the builder (audit 2026-10-12, L33).
 
 ## [2.4.1] - 2026-10-12
 
diff --git a/docs/audit-2026-10-12.md b/docs/audit-2026-10-12.md
index a9e6e8f..feac744 100644
--- a/docs/audit-2026-10-12.md
+++ b/docs/audit-2026-10-12.md
@@ -551,9 +551,10 @@ has already run is never edited — the next file is added; the published
    image already built instead of rebuilding. Done when the e2e asserts
    `panel -version` equals what it was told, and `release.yml` runs that
    assertion before the push. — **Opus**
-- [ ] **Compile the e2e in `test.yml`** (M20): `cd test/e2e && go vet ./... && go
-   test -run xxx ./...`. — **Haiku**
-- [ ] **`.dockerignore` + `test/`** (L33). — **Haiku**
+- [x] **Compile the e2e in `test.yml`** (M20): `cd test/e2e && go vet ./... && go
+   test -c -o /dev/null .` (not `go test -run xxx`: `TestMain` would still
+   run and bring up the stand). — **Haiku**
+- [x] **`.dockerignore` + `test/`** (L33). — **Haiku**
 - [ ] **The pin** (M6): old tags and images are not touched (owner,
    2026-10-12). The next publication through the fixed `release.yml` is the
    one the pin names; until then README/guide say that the current line is
diff --git a/docs/development.md b/docs/development.md
index 8f892e8..a61189f 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -428,7 +428,9 @@ Workflows in [.github/workflows/](../.github/workflows/). What each job runs —
 
 `design-first` (needs the full history) → `gofmt -l` → `go vet ./...` →
 `go test ./...` (main module, no e2e; includes the panel guard tests, see
-[§ Panel pages](#panel-pages-the-component-kit-and-its-guards)).
+[§ Panel pages](#panel-pages-the-component-kit-and-its-guards)) → the e2e
+module compiled, not run (`go vet ./...` and `go test -c -o /dev/null .` in
+`test/e2e`).
 
 ### `release.yml` — published GitHub Release, or `workflow_dispatch` with SemVer
 
diff --git a/docs/roadmap.md b/docs/roadmap.md
index cd2aeac..1d91300 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -42,7 +42,7 @@ in `git log` and [CHANGELOG.md](../CHANGELOG.md).
 | from-header-binding | Hold a message's `From:` header against the application that sends it | shipped `2.4.0` | 9/9 | [plans/from-header-binding.md](plans/from-header-binding.md) |
 | panel-redesign | Panel redesign (accepted mockups, design contract) | shipped `2.0.0` | 27/27 | [plans/panel-redesign.md](plans/panel-redesign.md) |
 | schema-squash | Squash SQLite migrations into a 2.x baseline | built in panel-redesign (stage 1) | — | [plans/panel-redesign.md](plans/panel-redesign.md) |
-| audit-2026-10-12 | Follow-ups of the 2026-10-12 full-tree code audit, seven stages | agreed (2026-10-12: stage 0 first, then 1+2; the rest after) | 1/61 | [audit-2026-10-12.md](audit-2026-10-12.md) |
+| audit-2026-10-12 | Follow-ups of the 2026-10-12 full-tree code audit, seven stages | agreed (2026-10-12: stage 0 first, then 1+2; the rest after) | 3/61 | [audit-2026-10-12.md](audit-2026-10-12.md) |
 
 **Recommended order** (not binding; owner, 2026-10-09: feature order follows
 development convenience): **panel-redesign** shipped as `2.0.0` (2026-10-11) and