audit 6: documents, comments, dead code and staticcheck; the test gaps closed

The last stage of the 2026-10-12 audit; no cut.

Doc drift: architecture.md (the sender check in § OpenDKIM, the limit:
row's 48 hours, the inbound log and filter-list routes and who may open
them, migrations to 0011 and every table, KitPage as production data,
Reload configuration as a restore writes, the panel's roles counted),
schema-migrations.md (tables and columns since v2), guide.md (a delivery's
lines go at the next prune; INBOUND_JOURNAL_MILTER_SOCKET moved to
architecture.md's internal list), development.md (the env guard, the
deferral the e2e proves, its fixed sleeps), roadmap.md.

Comments say what the code does now; TestBaselineIsTheOnlyMigration is
TestChainStartsAtTheBaseline; the milter package doc names its three
milters.

Dead code gone: view.Facts, dmarc HostedSuggestion and
ValidateHostedAddress, app UpdateMode (each with the test that alone kept
it), the method checks the method-bound routes made dead;
Settings.WithResult calls resultFlash. staticcheck 2026.1 in test.yml on
both modules, clean: the e2e package builds without its tests now (a test
and two constants moved out of non-test files), three findings fixed.
The test moved, TestImageBuildPreservesLogrotateMode, had sat in a
non-test file and never run; run, it failed on the entrypoint (docker run
without a hostname) and now asks with --entrypoint stat.

The test gaps no step named, each closed: follow() with mail.log gone past
blindMin and made again; CheckRestore with a manifest that is not JSON;
the origin check with a port; every /server/ pattern in web.go through
server() and in the routes table (it found GET /server/health/fragment
missing from the table - guarded, not tested); L9 as the owner decided it
on 2026-10-12, the comment on senderSession.Headers and the test passing
an h that holds the earlier messages' From:.

Plan stage 6 ticked; roadmap audit row done, 81/81.

Tested on the test server: go vet + go test of 27 packages, make e2e (all
pass, 513 s) on this tree; staticcheck locally on both modules.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/app/service.go

@@ -127,24 +127,6 @@ func (s *Service) Secret(login string) (string, error) {
 	return s.sasl.Secret(login)
 }
 
-// UpdateMode switches an application's address mode / list and rebuilds the
-// sender map (product.md). The login and password are untouched. Addresses are
-// re-validated against the application's domain.
-func (s *Service) UpdateMode(id int64, mode string, rawAddresses []string) error {
-	a, err := s.store.GetApplication(id)
-	if err != nil {
-		return err
-	}
-	addresses, err := s.validateForDomain(a.DomainID, a.Login, mode, rawAddresses)
-	if err != nil {
-		return err
-	}
-	if err := s.store.UpdateApplicationMode(id, mode, addresses); err != nil {
-		return err
-	}
-	return s.Resync()
-}
-
 // RegeneratePassword issues a fresh password for an existing application (spec
 // 7.2.9). The old password is invalidated by overwriting the SASL account; the
 // address mode and bindings are unchanged, so no map rebuild is needed. The new

internal/app/service_test.go

@@ -247,26 +247,6 @@ func TestServiceDeleteKeepsRowWhenSASLFails(t *testing.T) {
 	}
 }
 
-func TestServiceUpdateMode(t *testing.T) {
-	svc, st, _, maps := newServiceHarness(t)
-	d := addDomain(t, st, "example.com")
-	a, _, err := svc.Create(d.ID, "app1", store.AddressModeWildcard, nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if err := svc.UpdateMode(a.ID, store.AddressModeList, []string{"alerts@example.com"}); err != nil {
-		t.Fatalf("UpdateMode: %v", err)
-	}
-	if len(maps.last) != 1 || maps.last[0].Address != "alerts@example.com" {
-		t.Errorf("map after mode switch = %+v", maps.last)
-	}
-	got, _ := st.GetApplication(a.ID)
-	if got.AddressMode != store.AddressModeList || len(got.Addresses) != 1 {
-		t.Errorf("stored app after switch = %+v", got)
-	}
-}
-
 func TestServiceRegeneratePassword(t *testing.T) {
 	svc, st, rec, _ := newServiceHarness(t)
 	d := addDomain(t, st, "example.com")