audit 2c: the rest the sources contradict, and the documents

Code and config:
- C-M7: a DMARC report's explicit <pct>0</pct> stays 0; only an absent
  pct takes RFC 7489 § 6.3's default 100 (Pct *int).
- C-D1: docs/development.md now tables the Debian versions the citations
  were read at (postfix 3.7.11-0+deb12u1, opendkim and libopendkim11
  2.11.0~beta2-8+deb12u1, libmilter1.0.1 8.17.1.9-2+deb12u2, libsasl2-2 and
  sasl2-bin 2.1.28+dfsg-10, supervisor 4.2.5-1, logrotate 3.21.0-1 - read off
  the image with dpkg-query, 2026-10-15); the e2e stand's new
  checkCitedPackageVersions fails when the image it built differs.
- C-E2: the e2e zone's SOA serial only grows (CoreDNS v1.14.6's file
  plugin reloads on a grown serial, not on mtime); Corefile comment says
  so; TestZoneSerialGrows.
- C-K8, C-K9: the e2e compose and stage comments say how
  --project-directory and .env resolve.
- D-arch:154: postfix-config.sh's "Postfix insists" comment says what
  TLS_README advises and that smtpd reads the key as root.
- B-G7: inflight.go's reservationTTL comment: a dropped client does give
  ABORT (smtpd_proto() -> mail_reset() -> milter_abort()); the TTL is for
  smtpd dying or the milter connection breaking.
- D-guide:301: the nginx fragment's first-certificate command now reaches
  certbot (--entrypoint certbot, --standalone, port 80 free), and the
  renewal loop passes --webroot -w /var/www/certbot - a standalone
  certificate would otherwise renew standalone while nginx holds port 80
  (certbot docs, "Renewing certificates": the issuing plugin is used
  "unless you specify other plugins or options", and options of a
  successful renewal are saved). The register's proposal missed that.

Documents: every D-arch, D-guide and D-sec claim the register's Answers E
found false or partly true, rewritten - by three Sonnet agents, one per
document, then reviewed: two proposals were obsolete after this stage's
fixes and not used (a bounce's From: line - extract_from = "smtp" now;
"Origin: null" - Referrer-Policy is same-origin now); a stand
observation the agent had dated from a commit is now tied to the e2e test
that checks it; the SQLite writers paragraph describes _txlock=immediate;
the log tailer's rotation paragraph describes the minute's grace; the
guide's nginx steps were put in working order (links and modes before
`up`, no reconfigure step). "Deferred" is kept for Postfix's queue in the
guide too. guide.md's CRLF from the agent normalised.

Stand (2026-10-15, make e2e, exit 0, the version gate and zone serial
test included); go vet and go test ./... pass on the server (24 packages).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/dmarc/parse.go

@@ -60,7 +60,7 @@ type feedbackXML struct {
 		Domain string `xml:"domain"`
 		P      string `xml:"p"`
 		SP     string `xml:"sp"`
-		Pct    int    `xml:"pct"`
+		Pct    *int   `xml:"pct"`
 		ADKIM  string `xml:"adkim"`
 		ASPF   string `xml:"aspf"`
 	} `xml:"policy_published"`
@@ -132,12 +132,15 @@ func ParseAggregate(raw []byte) (ParsedReport, error) {
 		Domain:       strings.ToLower(field(doc.Policy.Domain)),
 		PolicyP:      field(doc.Policy.P),
 		PolicySP:     field(doc.Policy.SP),
-		PolicyPct:    doc.Policy.Pct,
 		PolicyADKIM:  field(doc.Policy.ADKIM),
 		PolicyASPF:   field(doc.Policy.ASPF),
 	}
-	if out.PolicyPct == 0 {
-		out.PolicyPct = 100
+	// RFC 7489 § 6.3: pct is "between 0 and 100, inclusive", 100 when absent.
+	// An explicit 0 is a policy applied to no message, and stays 0; only a
+	// report without the element gets the default (assumptions C-M7).
+	out.PolicyPct = 100
+	if doc.Policy.Pct != nil {
+		out.PolicyPct = *doc.Policy.Pct
 	}
 	for _, rec := range doc.Records {
 		row := ParsedRecord{

internal/dmarc/parse_test.go

@@ -5,6 +5,7 @@ import (
 	"bytes"
 	"compress/gzip"
 	"errors"
+	"strings"
 	"testing"
 	"time"
 
@@ -258,3 +259,26 @@ func gzipMessage(t *testing.T, xml string) string {
 		"Content-Type: application/gzip; name=\"report.xml.gz\"\r\n" +
 		"\r\n" + gz.String()
 }
+
+// pct is 100 when the report leaves it out (RFC 7489 § 6.3), and an explicit
+// 0 - a policy applied to no message - stays 0 (assumptions C-M7).
+func TestPolicyPct(t *testing.T) {
+	for _, c := range []struct {
+		pct  string
+		want int
+	}{
+		{"<pct>100</pct>", 100},
+		{"<pct>0</pct>", 0},
+		{"<pct>25</pct>", 25},
+		{"", 100},
+	} {
+		doc := strings.Replace(sampleXML, "<pct>100</pct>", c.pct, 1)
+		got, err := ParseAggregate([]byte(doc))
+		if err != nil {
+			t.Fatalf("%q: %v", c.pct, err)
+		}
+		if got.PolicyPct != c.want {
+			t.Errorf("%q: PolicyPct %d, want %d", c.pct, got.PolicyPct, c.want)
+		}
+	}
+}

internal/milter/inflight.go

@@ -6,12 +6,16 @@ import (
 )
 
 // reservationTTL bounds how long a message may stay reserved. A reservation is
-// released at end-of-message or on ABORT, but a client that simply drops the
-// connection after MAIL FROM produces neither callback (go-milter has no
-// connection-close hook), and a reservation that never expired would count
-// against the limit forever — a fail-closed drift this milter must not have.
-// The TTL is generously longer than any realistic DATA transfer, so a message
-// still being received is never dropped from the count.
+// released at end-of-message or on ABORT. A client that drops the connection
+// mid-transaction still produces ABORT: Postfix 3.7.11, src/smtpd/smtpd.c,
+// smtpd_proto() on a lost connection runs mail_reset(), which calls
+// milter_abort() (src/milter/milter8.c, milter8_abort(), SMFIC_ABORT)
+// (assumptions B-G7). What produces neither is smtpd itself dying, or the
+// milter connection breaking - and go-milter has no connection-close hook to
+// catch that - so a reservation that never expired would count against the
+// limit forever, a fail-closed drift this milter must not have. The TTL is
+// generously longer than any realistic DATA transfer, so a message still
+// being received is never dropped from the count.
 //
 // go-milter v0.4.1, server.go, type Milter: no callback for the end of a
 // connection; session.go, HandleMilterCommands(), returns on SMFIC_QUIT or a