supervision as supervisord does it: Postfix stopped, give-ups FATAL, reload's exit read

C-P42. postfix-script's start-fg runs master as its child and master
calls setsid() (Postfix 3.7.11, conf/postfix-script; src/master/master.c);
supervisord signals the pid alone (supervisor 4.2.5, process.py,
Subprocess.kill()). A stop of program postfix left master running - a
restart then found "already running" - and a container stop cut Postfix
off with SIGKILL. The wrapper now stays the parent of "postfix start-fg"
and on TERM/INT runs "postfix stop", asking again while start-fg is still
in its checks (master -t). stopwaitsecs=15.

C-V6. The wrapper's give-up on the milter sockets came after the default
startsecs, so it was EXITED and restarted for ever. startsecs is now
MILTER_WAIT_TIMEOUT + 10, exported by the entrypoint as POSTFIX_STARTSECS
and expanded by supervisord (options.py, processes_from_section(); a
non-number MILTER_WAIT_TIMEOUT stops the start): a give-up is "Exited too
quickly", BACKOFF, FATAL after startretries, crashexit. For those seconds
after each start the program is STARTING (the healthcheck's 90 s start
period covers it; the sender check counts no downtime then).

C-V5. logrotate had startsecs=0, so a refused config restarted it every
second for ever. startsecs=1: FATAL after startretries; crashexit reads
the event's processname and leaves logrotate's FATAL on Server > Health.

B-U2. "supervisorctl start" returns when a startsecs=0 program is RUNNING,
not when it ends, and mapped "already started" to success. The panel now
speaks supervisord's XML-RPC itself (internal/supervisor, RunOnce):
startProcess without waiting, getProcessInfo until it leaves
STARTING/RUNNING, exitstatus 0 or an error; a run in progress is waited
out and one of its own follows. A failed reload while program postfix is
not RUNNING is logged, not an error: the next master reads the files.
C-V10: postfix-reload rests EXITED after a run; the e2e process check
takes STOPPED or EXITED. C-P34: the dead "postfix set-permissions" branch
goes - postfix check's create-missing builds the queue tree.

Stand (2026-10-14, make e2e, exit 0; MILTER_WAIT_TIMEOUT=10 on the stand):
new supervision_stops_postfix_and_gives_up - supervisorctl restart postfix
writes postfix-script's "stopping the Postfix mail system" and leaves one
master; with the panel's sockets removed, start answers "postfix: ERROR
(spawn error)" (finish() sets spawnerr "Exited too quickly", onwait()
reads it first) and Postfix comes up once the panel is back; a
group-writable logrotate config ends FATAL with the container up; the
panel's Reload configuration answers only after mail.log has "refreshing
the Postfix mail system", postfix-reload EXITED. session_survives_restart
sees the stop line for the container's restart. Measured: master's own
"terminating on signal 15" never reaches mail.log (master TERMs its group,
postlogd included, before it logs). go vet and go test ./... pass on the
server (24 packages; new unit tests of RunOnce against a fake supervisord).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

build/postfix-wrapper.sh

@@ -4,10 +4,15 @@
 #
 # It blocks until the milter sockets — OpenDKIM, the panel's sender check and
 # journal-milter and, with the inbound relay on, its inbound journal milter —
-# are present,
-# then execs `postfix start-fg`. If they are not ready within the
-# timeout it exits non-zero WITHOUT starting Postfix, so supervisord/Docker see
-# an explicit startup failure instead of a relay running blind.
+# are present, then runs `postfix start-fg` and stays its parent. If they are
+# not ready within the timeout it exits non-zero WITHOUT starting Postfix.
+# supervisord counts that exit as one that came too quickly - the program's
+# startsecs is the timeout plus ten seconds (build/entrypoint.sh) - so after
+# startretries it is FATAL and crashexit takes the container down, instead of
+# a relay running blind (supervisor 4.2.5, supervisor/process.py,
+# Subprocess.finish(): an exit before startsecs is "Exited too quickly" and
+# goes to BACKOFF; transition(): BACKOFF past startretries is FATAL;
+# assumptions C-V6).
 #
 # This handles cold start only. Once Postfix runs, a milter that does not
 # answer costs what its default_action says (build/postfix-config.sh): mail is
@@ -42,5 +47,41 @@ echo "postfix-wrapper: milter sockets ready, starting postfix"
 # Postfix 3.7.11: postfix(1) execs conf/postfix-script (src/postfix/postfix.c),
 # whose "start-fg" execs master only as PID 1 and otherwise runs "master -s" as
 # its child; master then makes itself a session leader (src/master/master.c,
-# setsid()). The process supervisord watches is that shell, not master.
-exec postfix start-fg
+# setsid()). A signal supervisord sends this program never reaches master
+# (supervisor 4.2.5, supervisor/process.py, Subprocess.kill(): to the pid
+# alone without stopasgroup, and master is not in its group anyway): before,
+# a stop left master running - a restart of the program then found Postfix
+# "already running", and a stop of the container cut Postfix off with
+# SIGKILL (assumptions C-P42). So this shell stays, and on TERM or INT runs
+# "postfix stop" (conf/postfix-script, "stop": TERM to master, then waits up
+# to five seconds and kills its group; src/master/master_sig.c,
+# master_sigdeath(): "terminating on signal 15").
+#
+# "postfix start-fg" spends its first seconds in its checks before master
+# runs; a stop asked then would find nothing to stop, so it is asked again
+# until the child is gone. "master -t" exits 0, silently, while no master
+# holds the lock (src/master/master.c, test_lock).
+daemon_directory=$(postconf -h daemon_directory)
+child=
+stop_postfix() {
+	trap '' TERM INT
+	while [ -n "$child" ] && kill -0 "$child" 2>/dev/null; do
+		if "$daemon_directory/master" -t 2>/dev/null; then
+			sleep 1
+		else
+			postfix stop || true
+		fi
+	done
+	exit 0
+}
+trap stop_postfix TERM INT
+postfix start-fg &
+child=$!
+# A trapped signal makes wait return at once, the trap is taken right after
+# (POSIX, Shell Command Language, 2.11 Signals and Error Handling) and exits.
+# Otherwise wait returns when Postfix ended on its own: its status is this
+# program's, and supervisord restarts it.
+status=0
+wait "$child" || status=$?
+echo "postfix-wrapper: postfix exited with status $status" >&2
+exit "$status"