sasldb2 changed through a copy renamed over it, never in place

Cyrus SASL 2.1.28 opens sasldb2 with no Berkeley DB environment, so with
no locks (sasldb/db_berkeley.c, berkeleydb_open(): db_create(mbdb, NULL,
0)); saslpasswd2 puts and deletes in the file itself (_sasldb_putdata()),
while smtpd opens and closes it at every AUTH (_sasldb_getdata()) and the
backup copies it whenever it runs. Either could read a half-written page:
a spurious 535, or a torn sasldb2 in a backup whose restore breaks every
application's AUTH (assumptions C-S3, C-Q3).

SASLDB.Set and Delete now run saslpasswd2 on sasldb2.new - a byte copy of
the database, or no file when there is none yet (saslpasswd2 creates it,
DB_CREATE) - then chmod 0640, fsync, rename over sasldb2; a failed run
removes the copy and leaves the database; a copy a killed panel left is
removed first. A mutex keeps two changes of the panel from copying the
same old file. The backup needs no lock after all (the plan said one): it
reads each file through one descriptor, and a rename leaves that file
whole; the walk now leaves out a file that vanished between listing and
open (a writer's temporary file), while the SQLite snapshot's absence
stays an error. CHANGELOG also gains the entries of f2ad699 (supervision),
written then without them.

Tests: the copy holds the database's bytes, saslpasswd2 never gets the
live path, a reader of the old file keeps reading it (Linux), mode 0640,
nothing left behind; a failed change leaves the database; the first
account creates it. Stand (2026-10-15, make e2e, exit 0): new
sasldb_changed_by_rename - the inode of sasldb2 changes across one
password change (it cannot be the old one's: both exist at the copy),
then 35 AUTHs of app1 from three clients during 104 password changes of
another application, none refused; afterwards 640 panel selfpost, no copy
left in /data/sasl, the last password authenticates. That cannot prove a
race absent; it guards the mechanism. (A first run compared the inode
after 15 changes and found it equal: Linux reuses a freed inode number.)
go vet and go test ./... pass on the server (24 packages).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/audit-2026-10-12.md

@@ -962,7 +962,7 @@ those after it move up one patch number each.
    - **Opus**
    *Done 2026-10-14:* `e174537`; cleanup takes port 25's limit when it is
    larger than main.cf's; Postfix refuses the address literal at RCPT.
-- [ ] **Supervision as supervisord does it** (C-P42, C-V5, C-V6, C-V10,
+- [x] **Supervision as supervisord does it** (C-P42, C-V5, C-V6, C-V10,
    B-U2, C-P34): master leaves the shell's process group, so stopping the
    program never stops Postfix - the wrapper traps TERM and runs `postfix
    stop`; `startsecs` above the milter wait for Postfix and 1 for logrotate
@@ -970,11 +970,16 @@ those after it move up one patch number each.
    postfix-reload rests in EXITED after a run; a reload's exit status is
    read, not assumed; the dead set-permissions branch goes. e2e: restart
    of the program, stop of the container. - **Opus**
-- [ ] **sasldb written in place** (C-S3, C-Q3): Cyrus opens sasldb2 without
+   *Done 2026-10-14:* `f2ad699`; startsecs is MILTER_WAIT_TIMEOUT + 10, set
+   by the entrypoint; the reload's status is read over supervisord's XML-RPC.
+- [x] **sasldb written in place** (C-S3, C-Q3): Cyrus opens sasldb2 without
    a Berkeley DB environment, so without locks, and `saslpasswd2` writes in
    place; an AUTH or a backup during a change can read it torn. The panel
    writes a copy and renames it, and the backup reads it under the same
    lock. - **Opus**
+   *Done 2026-10-15:* no lock for the backup after all: it reads each file
+   through one descriptor, and a rename leaves that file whole; the panel's
+   own changes are serialised by a mutex.
 - [ ] **Health says what is served** (A-38, A-65, D-P1, D-P3): a socket file
    is not a listener - unix sockets are dialled as inet ones are; the
    certificate shown is the one Postfix serves (`postconf -h