audit 6: documents, comments, dead code and staticcheck; the test gaps closed

The last stage of the 2026-10-12 audit; no cut.

Doc drift: architecture.md (the sender check in § OpenDKIM, the limit:
row's 48 hours, the inbound log and filter-list routes and who may open
them, migrations to 0011 and every table, KitPage as production data,
Reload configuration as a restore writes, the panel's roles counted),
schema-migrations.md (tables and columns since v2), guide.md (a delivery's
lines go at the next prune; INBOUND_JOURNAL_MILTER_SOCKET moved to
architecture.md's internal list), development.md (the env guard, the
deferral the e2e proves, its fixed sleeps), roadmap.md.

Comments say what the code does now; TestBaselineIsTheOnlyMigration is
TestChainStartsAtTheBaseline; the milter package doc names its three
milters.

Dead code gone: view.Facts, dmarc HostedSuggestion and
ValidateHostedAddress, app UpdateMode (each with the test that alone kept
it), the method checks the method-bound routes made dead;
Settings.WithResult calls resultFlash. staticcheck 2026.1 in test.yml on
both modules, clean: the e2e package builds without its tests now (a test
and two constants moved out of non-test files), three findings fixed.
The test moved, TestImageBuildPreservesLogrotateMode, had sat in a
non-test file and never run; run, it failed on the entrypoint (docker run
without a hostname) and now asks with --entrypoint stat.

The test gaps no step named, each closed: follow() with mail.log gone past
blindMin and made again; CheckRestore with a manifest that is not JSON;
the origin check with a port; every /server/ pattern in web.go through
server() and in the routes table (it found GET /server/health/fragment
missing from the table - guarded, not tested); L9 as the owner decided it
on 2026-10-12, the comment on senderSession.Headers and the test passing
an h that holds the earlier messages' From:.

Plan stage 6 ticked; roadmap audit row done, 81/81.

Tested on the test server: go vet + go test of 27 packages, make e2e (all
pass, 513 s) on this tree; staticcheck locally on both modules.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/milter/milter.go

@@ -1,14 +1,17 @@
-// Package milter implements the SelfPost journal-milter: a lightweight milter
-// (architecture.md § Mail path) attached to Postfix's smtpd_milters alongside
-// OpenDKIM. On the receive path it reads the SASL login, From, recipients and
+// Package milter implements the SelfPost milters: the journal-milter here, the
+// sender check (sender.go) and the inbound journal (inbound.go).
+//
+// The journal-milter is a lightweight milter (architecture.md § Mail path)
+// attached to Postfix's smtpd_milters alongside OpenDKIM. On the receive path it reads the SASL login, From, recipients and
 // Subject of each accepted message and records one send-log row per (queue-id,
 // recipient), giving the panel a structured, filterable history that raw
 // mail.log cannot.
 //
-// It is monitoring only: it never rejects, and every callback returns Continue
-// or Accept so a failure of this milter can never block the relay. Postfix is
-// configured with default_action=accept for this milter's socket, so even a
-// crash or hang fails open (architecture.md § Mail path).
+// It refuses only at MAIL FROM, with a 4xx tempfail, when a level-2 rate limit
+// or the application's client-address list says no (see MailFrom); every other
+// callback returns Continue. A failure of this milter never blocks the relay:
+// Postfix is configured with default_action=accept for this milter's socket,
+// so even a crash or hang fails open (architecture.md § Mail path).
 //
 // Postfix 3.7.11, src/milter/milter8.c, milter8_comm_error(): a milter that
 // cannot be reached, or does not answer within milter_*_timeout, gives no

internal/milter/sender.go

@@ -328,6 +328,11 @@ func (s *senderSession) Header(name, value string, m *milter.Modifier) (milter.R
 // src/cleanup/cleanup_milter.c, cleanup_milter_apply(): a "5" rejects the
 // message, and src/smtpd/smtpd.c, common_post_message_handling(), says that
 // reply to the client.
+//
+// h is not read: go-milter v0.4.1 adds every header of the connection to it
+// and empties it only on ABORT (session.go, CodeHeader, CodeAbort), so on a
+// second message it can still hold the first one's From:. The session keeps
+// its own, emptied at each MAIL FROM (audit 2026-10-12, L9).
 func (s *senderSession) Headers(h textproto.MIMEHeader, m *milter.Modifier) (milter.Response, error) {
 	shown, why, err := s.judge()
 	if err != nil {

internal/milter/sender_test.go

@@ -1,6 +1,7 @@
 package milter
 
 import (
+	"net/textproto"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -301,15 +302,19 @@ func TestBindingsDuplicateKeyBreaksTheTable(t *testing.T) {
 	}
 }
 
-// A second message on the connection is judged by its own headers.
+// A second message on the connection is judged by its own headers - not by
+// the h go-milter passes, which still holds the earlier messages' From: (it
+// is emptied only on ABORT; audit 2026-10-12, L9).
 func TestSenderCheckResetsBetweenMessages(t *testing.T) {
 	bind := NewBindings(writeMaps(t, senderMaps))
 	s := &senderSession{bind: bind}
 	auth := mods(map[string]string{"{auth_authen}": "shop"})
+	h := textproto.MIMEHeader{}
 	for i, v := range []string{"director@example.org", "a@shop.example.org", "director@example.org"} {
 		_, _ = s.MailFrom("shop@shop.example.org", auth)
+		h.Add("From", v)
 		_, _ = s.Header("From", v, mods(nil))
-		resp, _ := s.Headers(nil, mods(nil))
+		resp, _ := s.Headers(h, mods(nil))
 		if passed := resp == milter.RespContinue; passed != (i == 1) {
 			t.Fatalf("message %d (From: %s): passed=%v", i, v, passed)
 		}