security: L8's remaining probe accepted by the owner

Owner, 2026-10-14, asked whether to refuse every foreign address in a
display name to close what L8 leaves (refused or passed still tells an
application which domains are hosted here): "Ответ 1" - leave it. The
probe is a trusted application of this server guessing names one at a
time, as it already had to before L8, when the reply said in words what the
line itself had named. security.md (Mail path and accepted risks, with the
trigger to revisit: untrusted tenants, or the display-name rule decided
anew) and the audit plan record it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/audit-2026-10-12.md

@@ -714,8 +714,10 @@ has already run is never edited — the next file is added; the published
    passed list gained capitals, a quoted local part and a name with a space
    after its `@` (passed by design, signed for the own domain). L8 is half
    closed: refused-or-passed still tells an application which domains are
-   hosted here - the owner decides whether to refuse every foreign address
+   hosted here. *Owner, 2026-10-14: leave it* - the probe is a trusted
-   in a display name (asked 2026-10-14).
+   application's guess, one name at a time, as before L8; refusing every
+   foreign address in a display name is not wanted (security.md, accepted
+   risks).
    *Done 2026-10-14:* fifteen lines (`internal/milter/testdata/from-lines-passed.txt`),
    each signed for the application's domain alone, the signature valid. No
    disagreement. Groups are refused by the check, so none is in the file;

docs/security.md

@@ -225,8 +225,8 @@ operator can act on it.
   when the domain is a sender of this server, and passed when it is not,
   still tells an application which domains are hosted here; the probe needs
   an application of this server, and refusing every foreign address in a
-  display name would change the 2.4.0 rule - the owner decides (accepted
+  display name would change the 2.4.0 rule - accepted by the owner
-  risks). What this does not promise is what a display
+  (accepted risks). What this does not promise is what a display
   name looks like to a person: a name of another sender written without an
   `@` the scan can find (a full-width dot, a space inside the name) passes,
   signed with the application's own key - a forged display name is as old
@@ -447,11 +447,13 @@ deferred item from the roadmap.
   A `From:` whose display name or comment names an address at a domain this
   server signs for is refused; one naming any other domain passes. The reply
   no longer names the domain (audit 2026-10-12, L8), but refused or passed
-  answers the question for whoever sends the line. Accepted for now: it needs
+  answers the question for whoever sends the line. Accepted by the owner,
-  an application of this server, and closing it means refusing every
+  2026-10-14: it needs an application of this server - a trusted tenant
-  foreign address in a display name, which changes the owner's 2.4.0 rule
+  guessing names one at a time, as it already had to before L8, when the
-  (a stranger's address in the name passes) - his decision, asked on
+  reply only said in words what the line had named - and closing it means
-  2026-10-14.
+  refusing every foreign address in a display name, which would change his
+  2.4.0 rule (a stranger's address in the name passes). Trigger to revisit:
+  tenants who are not trusted, or a display-name rule decided anew.
 - ~~**A row of the inbound log belongs to a domain by name.**~~ Struck in
   `2.5.0` (audit 2026-10-12, L12): both logs now hold a domain by id, see
   § Roles.