audit: stage 2c - what was taken on trust, read in Postfix's source

Owner, 2026-10-14, after the rule "do not guess how code works when its
documentation or source can be read": "Есть ли ещё у нас места, где мы
угадывали?". The inventory found four: qmgr's expiry against the queue
lifetime (a margin in queued_over_lifetime), postlogd after a rename (the
rotation window), the stale smtpd after a reload (measured, not
understood), and the NOQUEUE line's fields (two fixtures carry a
sasl_username Postfix does not write, one presented as seen on the stand).
A line in stage 2c reads Postfix 3.7.11 for them, records what is read,
fixes the fixtures and the code where they disagree. Plan 66 lines.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/audit-2026-10-12.md

@@ -873,6 +873,20 @@ those after it move up one patch number each.
    shared files of lines (`from-lines-passed.txt`, `from-lines-other.txt`)
    are kept: the second one's test becomes "never signed for {other}"
    rather than "refused". - **Opus**
+- [ ] **What was taken on trust, read in Postfix's source** (owner,
+   2026-10-14: "запиши себе правило не гадать, как работает код, если можно
+   посмотреть в его документацию или исходный код"; then "Есть ли ещё у нас
+   места, где мы угадывали?"). Postfix 3.7.11 - the image's version - read
+   for: (1) when qmgr expires a message against maximal_queue_lifetime - the
+   "+ maximal_backoff" margin of queued_over_lifetime is a guess; (2) whether
+   postlogd goes on writing to the renamed mail.log until the reload - the
+   rotation window the deferred tailer fix is about; (3) why an smtpd from
+   before a reload takes one more connection, and for how long - measured
+   (under 2 s), not understood; (4) the NOQUEUE reject line's fields - two
+   test fixtures carry a sasl_username= that Postfix does not write, one
+   of them presented as seen on the stand; they are corrected. What is read
+   goes into architecture.md with the file it is in; where it contradicts
+   the code, the code is fixed in this stage. - **Opus**
 - [ ] Docs and wording: help topic sender-check and guide § Who an
    application may send as (mockup first), security.md § Mail path,
    CHANGELOG. - **Sonnet**

docs/roadmap.md

@@ -42,7 +42,7 @@ in `git log` and [CHANGELOG.md](../CHANGELOG.md).
 | from-header-binding | Hold a message's `From:` header against the application that sends it | shipped `2.4.0` | 9/9 | [plans/from-header-binding.md](plans/from-header-binding.md) |
 | panel-redesign | Panel redesign (accepted mockups, design contract) | shipped `2.0.0` | 27/27 | [plans/panel-redesign.md](plans/panel-redesign.md) |
 | schema-squash | Squash SQLite migrations into a 2.x baseline | built in panel-redesign (stage 1) | — | [plans/panel-redesign.md](plans/panel-redesign.md) |
-| audit-2026-10-12 | Follow-ups of the 2026-10-12 full-tree code audit, seven stages | in progress (stage 0 shipped `2.4.2`, stages 1+2 `2.5.0`; next stage 2b → `2.5.1`) | 30/65 | [audit-2026-10-12.md](audit-2026-10-12.md) |
+| audit-2026-10-12 | Follow-ups of the 2026-10-12 full-tree code audit, seven stages | in progress (stage 0 shipped `2.4.2`, stages 1+2 `2.5.0`; next stage 2b → `2.5.1`) | 30/66 | [audit-2026-10-12.md](audit-2026-10-12.md) |
 
 **Recommended order** (not binding; owner, 2026-10-09: feature order follows
 development convenience): **panel-redesign** shipped as `2.0.0` (2026-10-11) and