audit 6: documents, comments, dead code and staticcheck; the test gaps closed

The last stage of the 2026-10-12 audit; no cut.

Doc drift: architecture.md (the sender check in § OpenDKIM, the limit:
row's 48 hours, the inbound log and filter-list routes and who may open
them, migrations to 0011 and every table, KitPage as production data,
Reload configuration as a restore writes, the panel's roles counted),
schema-migrations.md (tables and columns since v2), guide.md (a delivery's
lines go at the next prune; INBOUND_JOURNAL_MILTER_SOCKET moved to
architecture.md's internal list), development.md (the env guard, the
deferral the e2e proves, its fixed sleeps), roadmap.md.

Comments say what the code does now; TestBaselineIsTheOnlyMigration is
TestChainStartsAtTheBaseline; the milter package doc names its three
milters.

Dead code gone: view.Facts, dmarc HostedSuggestion and
ValidateHostedAddress, app UpdateMode (each with the test that alone kept
it), the method checks the method-bound routes made dead;
Settings.WithResult calls resultFlash. staticcheck 2026.1 in test.yml on
both modules, clean: the e2e package builds without its tests now (a test
and two constants moved out of non-test files), three findings fixed.
The test moved, TestImageBuildPreservesLogrotateMode, had sat in a
non-test file and never run; run, it failed on the entrypoint (docker run
without a hostname) and now asks with --entrypoint stat.

The test gaps no step named, each closed: follow() with mail.log gone past
blindMin and made again; CheckRestore with a manifest that is not JSON;
the origin check with a port; every /server/ pattern in web.go through
server() and in the routes table (it found GET /server/health/fragment
missing from the table - guarded, not tested); L9 as the owner decided it
on 2026-10-12, the comment on senderSession.Headers and the test passing
an h that holds the earlier messages' From:.

Plan stage 6 ticked; roadmap audit row done, 81/81.

Tested on the test server: go vet + go test of 27 packages, make e2e (all
pass, 513 s) on this tree; staticcheck locally on both modules.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/sendlog.go

@@ -16,10 +16,13 @@ const (
 	StatusSent     = "sent"
 	StatusDeferred = "deferred"
 	StatusBounced  = "bounced"
-	// StatusRejected marks a message the journal-milter refused with a 4xx under
-	// a level-2 rate limit (guide § Rate limiting). Such a row never gets a
-	// queue-id and is excluded from the level-2 message count (it was never
-	// sent).
+	// StatusRejected marks a message the relay refused, and the row of that
+	// refusal. The journal-milter refuses at MAIL FROM with a 4xx when a level-2
+	// rate limit or the application's client-address list says no (Reason is
+	// ReasonLimit or ReasonClient; such a row has no queue-id). The sender check
+	// refuses a From: line that is not the application's with a 550 (ReasonFrom;
+	// its row has the queue-id). Every refused row is left out of the level-2
+	// message count (it was never sent).
 	StatusRejected = "rejected"
 )
 
@@ -72,11 +75,11 @@ func (s *Store) InsertQueued(e SendLogEntry) error {
 	return nil
 }
 
-// InsertRejected records a message the journal-milter refused under a level-2
-// rate limit (guide § Rate limiting), so the rejection is visible in the
-// send-log UI. Only the fields known at MAIL FROM are set (domain, sender, app
-// login); there is no queue-id or recipient because the message was rejected
-// before it was queued.
+// InsertRejected records a refused message (StatusRejected), so the refusal is
+// visible in the send-log UI with its reason. The journal-milter writes its
+// MAIL FROM refusals with only the fields known there (domain, sender, app
+// login, client address): no queue-id, no recipient. The sender check writes
+// its From: refusals with the queue-id and the first recipient.
 func (s *Store) InsertRejected(e SendLogEntry) error {
 	now := time.Now().UTC().Format(time.RFC3339)
 	_, err := s.db.Exec(