audit 6: documents, comments, dead code and staticcheck; the test gaps closed

The last stage of the 2026-10-12 audit; no cut.

Doc drift: architecture.md (the sender check in § OpenDKIM, the limit:
row's 48 hours, the inbound log and filter-list routes and who may open
them, migrations to 0011 and every table, KitPage as production data,
Reload configuration as a restore writes, the panel's roles counted),
schema-migrations.md (tables and columns since v2), guide.md (a delivery's
lines go at the next prune; INBOUND_JOURNAL_MILTER_SOCKET moved to
architecture.md's internal list), development.md (the env guard, the
deferral the e2e proves, its fixed sleeps), roadmap.md.

Comments say what the code does now; TestBaselineIsTheOnlyMigration is
TestChainStartsAtTheBaseline; the milter package doc names its three
milters.

Dead code gone: view.Facts, dmarc HostedSuggestion and
ValidateHostedAddress, app UpdateMode (each with the test that alone kept
it), the method checks the method-bound routes made dead;
Settings.WithResult calls resultFlash. staticcheck 2026.1 in test.yml on
both modules, clean: the e2e package builds without its tests now (a test
and two constants moved out of non-test files), three findings fixed.
The test moved, TestImageBuildPreservesLogrotateMode, had sat in a
non-test file and never run; run, it failed on the entrypoint (docker run
without a hostname) and now asks with --entrypoint stat.

The test gaps no step named, each closed: follow() with mail.log gone past
blindMin and made again; CheckRestore with a manifest that is not JSON;
the origin check with a port; every /server/ pattern in web.go through
server() and in the routes table (it found GET /server/health/fragment
missing from the table - guarded, not tested); L9 as the owner decided it
on 2026-10-12, the comment on senderSession.Headers and the test passing
an h that holds the earlier messages' From:.

Plan stage 6 ticked; roadmap audit row done, 81/81.

Tested on the test server: go vet + go test of 27 packages, make e2e (all
pass, 513 s) on this tree; staticcheck locally on both modules.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/development.md

@@ -420,9 +420,14 @@ go test ./...
 
 ### Env documentation regression
 
-`go test ./cmd/panel -run 'TestLoadConfigKeysDocumented|TestBuildScriptKeysDocumented|TestDocumentedKeysAreRead'`
-— every new `loadConfig` key must appear in the env lists in [guide.md](guide.md)
-([cmd/panel/envdoc_test.go](../cmd/panel/envdoc_test.go)).
+`go test ./cmd/panel -run 'TestEnvironment'` compares what the code reads with
+what the documents name ([cmd/panel/envdoc_test.go](../cmd/panel/envdoc_test.go)).
+Read: the `envDefault` / `envInt` / `envBool` / `envSeconds` / `envDuration` /
+`os.Getenv` / `os.LookupEnv` calls in `cmd/panel` and `internal` (tests aside),
+and `${VAR:-…}` in `build/*.sh`. Named: [guide.md](guide.md) § Environment
+variables (the table and the paragraph under it) and the internal list in
+[architecture.md](architecture.md) § Configuration. A variable read and named
+nowhere fails the first test; one named and read nowhere fails the second.
 
 ### Panel pages: the component kit and its guards
 
@@ -470,12 +475,16 @@ operator would actually use.
 
 **Coverage (summary):** bootstrap → SMTP AUTH → delivery → DKIM verify →
 send-log `queued → sent`; negatives (no AUTH, relay, sender/login mismatch,
-L1/L2 limits, milter fail-open, bad `SELFPOST_HOSTNAME`, session survives
-`docker restart`); startup checks that supervisord actually brought up
+L1/L2 limits, the panel down or hung mid-message (Postfix defers the mail
+rather than letting it through: `panel_down_defers_mail`,
+`panel_hung_mid_message_is_counted`), bad `SELFPOST_HOSTNAME`, session
+survives `docker restart`); startup checks that supervisord actually brought up
 OpenDKIM, the panel, and Postfix (`checkSupervisorProcesses`), plus logrotate
 config-mode and forced-rotation checks (`checkLogrotateConfigMode`,
 `checkLogrotateRotation` — [test/e2e/logrotate_check.go](../test/e2e/logrotate_check.go)).
-Polling with timeouts only — no fixed `sleep`.
+Waits poll with a timeout (`waitFor`); a fixed sleep is the exception and says
+why where it stands (`sender_check_test.go`: a downtime worth a second or two,
+and 35 s to show a row is not written again).
 
 Requires **Docker + Compose v2** on the machine running the suite.
 
@@ -573,7 +582,8 @@ Out of scope for v1.x: `CONTRIBUTING.md`, man pages, a separate docs site
    behaviour ships together with [guide.md](guide.md) / `.env.example` and a
    CHANGELOG entry (see [§ Commits and release build](#commits-and-release-build)).
 2. **Env regression:** [cmd/panel/envdoc_test.go](../cmd/panel/envdoc_test.go)
-   fails on an undocumented `loadConfig` or build-script key.
+   fails on a variable the code or a build script reads that no document names,
+and on one a document names that nothing reads.
 3. **New gaps** go into [roadmap.md](roadmap.md) (or the active plan file), not
    silent drive-by edits.
 4. **Schema changes:** update [schema-migrations.md](schema-migrations.md) in the