Record internal SMTP relay test

docs/release-testing-0.7.md

@@ -126,7 +126,7 @@ inputs and outputs is absent from the ZIP.
 | SMTP-01 | Port 25 greeting, HELO, EHLO, NOOP, RSET, HELP, VRFY policy, QUIT | [PASS](test-evidence/0.7-r1.md#smtp-01) |  |  |
 | SMTP-02 | Port 587 STARTTLS submission with shared GSASL authentication | [PASS](test-evidence/0.7-r1.md#smtp-0203) |  |  |
 | SMTP-03 | Port 465 implicit TLS submission | [PASS](test-evidence/0.7-r1.md#smtp-0203) |  |  |
-| SMTP-04 | Trusted port 26 accepts only configured networks and applies limits |  |  |  |
+| SMTP-04 | Trusted port 26 accepts only configured networks and applies limits | [PASS](test-evidence/0.7-r1.md#smtp-04) |  |  |
 | SMTP-05 | Internal sender/domain normalisation uses peer DNS/IP mapping safely |  |  |  |
 | SMTP-06 | Local authenticated delivery from test1 to test2 |  |  |  |
 | SMTP-07 | Internet delivery prefers STARTTLS and follows opportunistic fallback |  |  |  |

docs/test-evidence/0.7-r1.md

@@ -2058,3 +2058,44 @@ The focused native `sasl-password-mechanisms`, `smtp-capabilities`, and
 `smtp-protocol` tests also passed. The live check authenticates only; it sends
 no envelope or message data and therefore leaves Store, Queue, and external
 systems unchanged.
+
+## SMTP-04
+
+Result: **PASS**
+
+The reusable `smtp-internal-relay-check.py` exercised the dedicated internal
+SMTP listener on `172.16.11.190:26`:
+
+```sh
+export BONGO_ALLOW_LIVE_SMTP_TEST=1
+./contrib/testing/smtp-internal-relay-check.py
+```
+
+A connection sourced from the configured `172.16.11.0/24` network received
+the normal greeting. The same destination reached from `127.0.0.1` received
+exactly `554 5.7.1 Source address not permitted\r\n` and an immediate close.
+This caught and fixed a manual length of 41 for the 40-byte literal, which had
+placed a NUL byte on the SMTP wire.
+
+The test then restarted the installed service with isolated temporary limits:
+one concurrent connection, one recipient per minute, 64 bytes per minute,
+and one message per minute. A second held connection and a second recipient
+were rejected with their specific `451` diagnostics. An oversized DATA body
+was rejected by the byte limit. For the message-count case, the first DATA
+transaction intentionally used an internationalized header without
+`SMTPUTF8`, causing a pre-commit `550`; the next DATA transaction then proved
+that the one-message limit had been consumed and returned `451`. Thus none of
+the limit probes could enter Queue or Store.
+
+The installed-service run reported:
+
+```text
+SMTP-04 PASS host=172.16.11.190:26 allowed=172.16.11.190 denied=127.0.0.1 network=554-exact connection-limit=451 recipient-limit=451 byte-limit=451 message-limit=451 queue-write=no restored=yes
+```
+
+The test restored the original SMTP JSON byte-for-byte and left
+`bongo.service` active. A source-wide literal-length audit also found and
+fixed `bongo-sendmail` truncating the final LF from dot-stuffed `"..\r\n"`.
+The new `c-literal-io-lengths` CTest prevents NUL inclusion, truncation, and
+literal over-read regressions in Bongo's connection-write helpers. The final
+GCC debug suite passed all 92 CTest tests in 7.37 seconds.