audit 4: a deleted domain says so, the Outbound log filters by status and day

L17: past DeleteDomain both rebuilds run, their errors joined under
domain.ErrDeletedIncomplete; the key is removed only when OpenDKIM's tables
were rebuilt (they may still name it otherwise); the domain list says the
domain is deleted and that Reload configuration finishes it, not "internal
error". Tests in domain (the tables failing, the sender map failing) and
handlers.

The Outbound log's status and day filters (owner, 2026-10-13; the mockup
first, 80e3979): view.OutLogFilter carried by the poll, the pages, the rows'
links and the message's way back; SendLogFilter.Status, Since, Until (whole
UTC days, as the Inbound log's); rejected is the three refusals together; a
status not in the list is no narrowing. Tests: the filters through the
handler, the poll and the way back; the day boundaries in store.

The plan's milter-socket step is ticked: done in 2.5.2 (98e09fe).

Tested on the test server: go vet + go test of 25 packages, make e2e (all
pass, 642 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/audit-2026-10-12.md

@@ -1237,9 +1237,14 @@ command whose leftover is the owner's alone.
    `HandleReload` covers what the restore's Resync covers, the filter lists
    and the DMARC maps included, and a failed step is an error flash on
    Health naming it.
-- [ ] `domain.Service.Delete`: say the domain is deleted when a later step fails,
+- [x] `domain.Service.Delete`: say the domain is deleted when a later step fails,
    and run `apps.Resync()` anyway. — **Opus**
-- [ ] **A status filter and a day filter in the Outbound log** (owner, 2026-10-13, from the
+   *Done 2026-10-15:* past `DeleteDomain` both rebuilds run and the errors
+   join under `domain.ErrDeletedIncomplete`; the key is removed only when
+   the tables were rebuilt (they may still name it otherwise). The domain
+   list says "Domain X deleted, but …; run Reload configuration" (500) -
+   which since the step above rewrites everything.
+- [x] **A status filter and a day filter in the Outbound log** (owner, 2026-10-13, from the
    Not done list of from-header-binding). The mockup `out-log` has drawn a
    third list since the redesign and the built log never had it; the Inbound
    log has its counterpart built (domain, decision, day). One list: *Any
@@ -1251,7 +1256,16 @@ command whose leftover is the owner's alone.
    commit). And a filter by day, as the Inbound log has it (owner, the same
    day): the same control, drawn in the mockup first. Both filters survive
    paging and the rows' polling. - **Sonnet**
-- [ ] **Milter sockets: "Listening" is asked of the socket** (owner,
+   *Done 2026-10-15:* `design:` commit (the list corrected, the two dates),
+   then `view.OutLogFilter` (domain, app, status, from, to) carried by the
+   poll, the pages, the rows' links and the message's way back;
+   `SendLogFilter.Status`, `Since`, `Until` (whole UTC days, as the
+   Inbound log's). A status not in the list is no narrowing. Plans: a
+   domain user's filtered page still goes by `idx_send_log_domain_id`; the
+   global role's status-only count walks the table (a page view or a 5 s
+   poll while the log is open on a status - tens of thousands of rows at
+   the retention limit, milliseconds), accepted.
+- [x] **Milter sockets: "Listening" is asked of the socket** (owner,
    2026-10-13, from the Not done list of from-header-binding).
    `health.CheckSocket` ([socket.go](../internal/health/socket.go)) stats the
    file and writes "Listening"; a process that died and left its socket
@@ -1262,6 +1276,13 @@ command whose leftover is the owner's alone.
    byte ends the sender check (security.md § Accepted risks: the milter
    library panics on an empty packet) - if it does, that is fixed first, in
    this step. A test with a socket file nobody listens on. - **Opus**
+   *Done in 2.5.2 (stage 2c, `98e09fe`), ticked here 2026-10-15:*
+   `health.CheckSocket` dials and closes; a refused connection says nobody
+   answers, a refused permission is Unknown; a connection closed without a
+   byte ends a milter session quietly on both sides (libmilter's
+   `mi_rd_cmd`, go-milter v0.4.1 `HandleMilterCommands` on `io.EOF` - the
+   comment on CheckSocket cites them). The socket nobody listens on is
+   `milter_test.go`.
 - [ ] **The `cards` layout takes its phone order from the box's number**
    (owner, 2026-10-13, from the Not done list of from-header-binding). The
    order on a phone is written in `panel.css` for four boxes to a stack

docs/guide.md

@@ -1389,9 +1389,12 @@ the only one of the two that does not depend on the panel process.
 ### Outbound log
 
 **Outbound › Log** (`/outbound/log`) is a searchable send log with server-side
-filters by domain and application; a user with the *domain* role sees only the
-rows of their domains. It refreshes its rows without resetting a filter being
-chosen. A row identifies its message and nothing more — time,
+filters by domain, application, status and day (from and to, UTC days, as on
+the Inbound log); the status *rejected* is the three kinds of refusal
+together, which the table tells apart by their tags. A user with the *domain*
+role sees only the rows of their domains. The filters are kept by the pages,
+the refresh and the way back from a message, and the log refreshes its rows
+without resetting a filter being chosen. A row identifies its message and nothing more — time,
 sender, recipient, subject and status `queued` (accepted, not yet
 delivered), `sent` (handed off successfully), `deferred` (Postfix is
 retrying), `bounced` (final failure: refused for good by the receiving server, or given

docs/roadmap.md

@@ -42,7 +42,7 @@ in `git log` and [CHANGELOG.md](../CHANGELOG.md).
 | from-header-binding | Hold a message's `From:` header against the application that sends it | shipped `2.4.0` | 9/9 | [plans/from-header-binding.md](plans/from-header-binding.md) |
 | panel-redesign | Panel redesign (accepted mockups, design contract) | shipped `2.0.0` | 27/27 | [plans/panel-redesign.md](plans/panel-redesign.md) |
 | schema-squash | Squash SQLite migrations into a 2.x baseline | built in panel-redesign (stage 1) | — | [plans/panel-redesign.md](plans/panel-redesign.md) |
-| audit-2026-10-12 | Follow-ups of the 2026-10-12 full-tree code audit, seven stages | in progress (stage 0 shipped `2.4.2`, stages 1+2 `2.5.0`, 2b `2.5.1`, 2c `2.5.2`, 3 `2.5.3`; next stage 4 → `2.5.4`) | 59/81 | [audit-2026-10-12.md](audit-2026-10-12.md) |
+| audit-2026-10-12 | Follow-ups of the 2026-10-12 full-tree code audit, seven stages | in progress (stage 0 shipped `2.4.2`, stages 1+2 `2.5.0`, 2b `2.5.1`, 2c `2.5.2`, 3 `2.5.3`; next stage 4 → `2.5.4`) | 62/81 | [audit-2026-10-12.md](audit-2026-10-12.md) |
 
 **Recommended order** (not binding; owner, 2026-10-09: feature order follows
 development convenience): **panel-redesign** shipped as `2.0.0` (2026-10-11) and