audit 2c: the rest the sources contradict, and the documents

Code and config:
- C-M7: a DMARC report's explicit <pct>0</pct> stays 0; only an absent
  pct takes RFC 7489 § 6.3's default 100 (Pct *int).
- C-D1: docs/development.md now tables the Debian versions the citations
  were read at (postfix 3.7.11-0+deb12u1, opendkim and libopendkim11
  2.11.0~beta2-8+deb12u1, libmilter1.0.1 8.17.1.9-2+deb12u2, libsasl2-2 and
  sasl2-bin 2.1.28+dfsg-10, supervisor 4.2.5-1, logrotate 3.21.0-1 - read off
  the image with dpkg-query, 2026-10-15); the e2e stand's new
  checkCitedPackageVersions fails when the image it built differs.
- C-E2: the e2e zone's SOA serial only grows (CoreDNS v1.14.6's file
  plugin reloads on a grown serial, not on mtime); Corefile comment says
  so; TestZoneSerialGrows.
- C-K8, C-K9: the e2e compose and stage comments say how
  --project-directory and .env resolve.
- D-arch:154: postfix-config.sh's "Postfix insists" comment says what
  TLS_README advises and that smtpd reads the key as root.
- B-G7: inflight.go's reservationTTL comment: a dropped client does give
  ABORT (smtpd_proto() -> mail_reset() -> milter_abort()); the TTL is for
  smtpd dying or the milter connection breaking.
- D-guide:301: the nginx fragment's first-certificate command now reaches
  certbot (--entrypoint certbot, --standalone, port 80 free), and the
  renewal loop passes --webroot -w /var/www/certbot - a standalone
  certificate would otherwise renew standalone while nginx holds port 80
  (certbot docs, "Renewing certificates": the issuing plugin is used
  "unless you specify other plugins or options", and options of a
  successful renewal are saved). The register's proposal missed that.

Documents: every D-arch, D-guide and D-sec claim the register's Answers E
found false or partly true, rewritten - by three Sonnet agents, one per
document, then reviewed: two proposals were obsolete after this stage's
fixes and not used (a bounce's From: line - extract_from = "smtp" now;
"Origin: null" - Referrer-Policy is same-origin now); a stand
observation the agent had dated from a commit is now tied to the e2e test
that checks it; the SQLite writers paragraph describes _txlock=immediate;
the log tailer's rotation paragraph describes the minute's grace; the
guide's nginx steps were put in working order (links and modes before
`up`, no reconfigure step). "Deferred" is kept for Postfix's queue in the
guide too. guide.md's CRLF from the agent normalised.

Stand (2026-10-15, make e2e, exit 0, the version gate and zone serial
test included); go vet and go test ./... pass on the server (24 packages).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/nginx/docker-compose.nginx.yml

@@ -14,10 +14,15 @@
 #
 #   docker compose -f docker-compose.yml -f nginx/docker-compose.nginx.yml up -d
 #
-# First-run certificate issuance (webroot method, before nginx has a cert to
-# serve — run once):
+# First-run certificate issuance, before nginx has a certificate to serve -
+# run once, with port 80 free (certbot answers the challenge itself;
+# --webroot would need nginx already serving /.well-known). --entrypoint is
+# needed: the service's own entrypoint is the renewal loop below, an
+# `sh -c` that ignores any arguments given to `run`
+# (docs.docker.com/reference/compose-file/services/#entrypoint; assumptions
+# D-guide:301):
 #   docker compose -f docker-compose.yml -f nginx/docker-compose.nginx.yml \
-#     run --rm certbot certonly --webroot -w /var/www/certbot \
+#     run --rm -p 80:80 --entrypoint certbot certbot certonly --standalone \
 #     -d mail.example.com --email you@example.com --agree-tos --no-eff-email
 
 services:
@@ -61,5 +66,9 @@ services:
     # until a certificate is within its renewal window.
     # (eff-certbot.readthedocs.io, User Guide, "Automated Renewals": the
     # sample cron runs "certbot renew" at 0 and 12 h; renew acts only on a
-    # certificate near expiry.)
-    entrypoint: sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done'
+    # certificate near expiry.) The first certificate was issued --standalone
+    # (see the top of this file), and certbot renews with the plugin it was
+    # issued with "unless you specify other plugins or options" (same page,
+    # "Renewing certificates") - by then nginx holds port 80 and serves the
+    # webroot, so renewal names it; a renewal that succeeds with it saves it.
+    entrypoint: sh -c 'trap exit TERM; while :; do certbot renew --webroot -w /var/www/certbot; sleep 12h & wait $${!}; done'