audit 6: documents, comments, dead code and staticcheck; the test gaps closed

The last stage of the 2026-10-12 audit; no cut.

Doc drift: architecture.md (the sender check in § OpenDKIM, the limit:
row's 48 hours, the inbound log and filter-list routes and who may open
them, migrations to 0011 and every table, KitPage as production data,
Reload configuration as a restore writes, the panel's roles counted),
schema-migrations.md (tables and columns since v2), guide.md (a delivery's
lines go at the next prune; INBOUND_JOURNAL_MILTER_SOCKET moved to
architecture.md's internal list), development.md (the env guard, the
deferral the e2e proves, its fixed sleeps), roadmap.md.

Comments say what the code does now; TestBaselineIsTheOnlyMigration is
TestChainStartsAtTheBaseline; the milter package doc names its three
milters.

Dead code gone: view.Facts, dmarc HostedSuggestion and
ValidateHostedAddress, app UpdateMode (each with the test that alone kept
it), the method checks the method-bound routes made dead;
Settings.WithResult calls resultFlash. staticcheck 2026.1 in test.yml on
both modules, clean: the e2e package builds without its tests now (a test
and two constants moved out of non-test files), three findings fixed.
The test moved, TestImageBuildPreservesLogrotateMode, had sat in a
non-test file and never run; run, it failed on the entrypoint (docker run
without a hostname) and now asks with --entrypoint stat.

The test gaps no step named, each closed: follow() with mail.log gone past
blindMin and made again; CheckRestore with a manifest that is not JSON;
the origin check with a port; every /server/ pattern in web.go through
server() and in the routes table (it found GET /server/health/fragment
missing from the table - guarded, not tested); L9 as the owner decided it
on 2026-10-12, the comment on senderSession.Headers and the test passing
an h that holds the earlier messages' From:.

Plan stage 6 ticked; roadmap audit row done, 81/81.

Tested on the test server: go vet + go test of 27 packages, make e2e (all
pass, 513 s) on this tree; staticcheck locally on both modules.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/guard_routes_test.go

@@ -22,7 +22,8 @@ var routes = struct{ always, inbound, dmarc []string }{
 	always: []string{
 		"GET /{$}",
 		"GET /overview", "GET /overview/fragment",
-		"GET /server/health", "POST /server/health/recheck", "POST /server/health/reload",
+		"GET /server/health", "GET /server/health/fragment",
+		"POST /server/health/recheck", "POST /server/health/reload",
 		"GET /outbound/domains", "POST /outbound/domains",
 		"GET /outbound/domains/{id}", "POST /outbound/domains/{id}/dns-recheck",
 		"GET /outbound/domains/{id}/settings",

internal/web/handlers/handlers_dmarc.go

@@ -17,11 +17,6 @@ import (
 // "custom" (an address typed for the domain). What is stored is the address
 // alone; "" is no reports.
 func (h *Handlers) HandleDomainDMARC(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		w.Header().Set("Allow", "POST")
-		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
-		return
-	}
 	d, ok := h.lookupDomain(w, r)
 	if !ok {
 		return

internal/web/handlers/handlers_settings.go

@@ -25,15 +25,12 @@ func (h *Handlers) HandleServerSettings(w http.ResponseWriter, r *http.Request)
 	if _, ok := h.requireGlobal(w, r); !ok {
 		return
 	}
-	switch r.Method {
-	case http.MethodGet:
-		h.renderServerSettings(w, r, http.StatusOK, "", h.currentRetentions())
-	case http.MethodPost:
+	// The routes are method-bound (GET and POST), so it is one or the other.
+	if r.Method == http.MethodPost {
 		h.submitServerSettings(w, r)
-	default:
-		w.Header().Set("Allow", "GET, POST")
-		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
 	}
+	h.renderServerSettings(w, r, http.StatusOK, "", h.currentRetentions())
 }
 
 // retentions are the two journal retentions the Settings form shows: the

internal/web/handlers/handlers_users.go

@@ -67,15 +67,12 @@ func (h *Handlers) HandleUserNew(w http.ResponseWriter, r *http.Request) {
 	if _, ok := h.requireGlobal(w, r); !ok {
 		return
 	}
-	switch r.Method {
-	case http.MethodGet:
-		h.renderUserForm(w, r, http.StatusOK, 0, userFormView{FormRole: string(store.RoleDomain)})
-	case http.MethodPost:
+	// The routes are method-bound (GET and POST), so it is one or the other.
+	if r.Method == http.MethodPost {
 		h.submitUserCreate(w, r)
-	default:
-		w.Header().Set("Allow", "GET, POST")
-		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
 	}
+	h.renderUserForm(w, r, http.StatusOK, 0, userFormView{FormRole: string(store.RoleDomain)})
 }
 
 // HandleUserEdit edits or deletes a panel user (global only).
@@ -97,24 +94,21 @@ func (h *Handlers) HandleUserEdit(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
-	switch r.Method {
-	case http.MethodGet:
-		h.renderUserForm(w, r, http.StatusOK, u.ID, userFormView{
-			FormUsername: u.Username,
-			FormEmail:    u.Email,
-			FormRole:     string(u.Role),
-			Reach:        u.Reach(),
-		})
-	case http.MethodPost:
+	// The routes are method-bound (GET and POST), so it is one or the other.
+	if r.Method == http.MethodPost {
 		if err := r.ParseForm(); err != nil {
 			h.renderUserForm(w, r, http.StatusBadRequest, u.ID, userFormView{FormErr: "Invalid form submission.", FormUsername: u.Username, FormEmail: u.Email, FormRole: string(u.Role)})
 			return
 		}
 		h.submitUserUpdate(w, r, u)
-	default:
-		w.Header().Set("Allow", "GET, POST")
-		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
 	}
+	h.renderUserForm(w, r, http.StatusOK, u.ID, userFormView{
+		FormUsername: u.Username,
+		FormEmail:    u.Email,
+		FormRole:     string(u.Role),
+		Reach:        u.Reach(),
+	})
 }
 
 func (h *Handlers) renderUserForm(w http.ResponseWriter, r *http.Request, status int, userID int64, form userFormView) {

internal/web/home_test.go

@@ -3,6 +3,9 @@ package web
 import (
 	"net/http"
 	"net/http/httptest"
+	"os"
+	"regexp"
+	"slices"
 	"strings"
 	"testing"
 
@@ -61,3 +64,26 @@ func TestServerSubtreeIsGlobalOnly(t *testing.T) {
 		t.Fatalf("only %d /server/ routes were checked", checked)
 	}
 }
+
+// The test above walks the routes table; a /server/ route registered beside
+// it, or past the server() guard, would not be looked at. Every pattern under
+// /server/ that web.go registers goes through server() and is in the table.
+func TestEveryServerRouteIsGuardedAndListed(t *testing.T) {
+	src, err := os.ReadFile("web.go")
+	if err != nil {
+		t.Fatal(err)
+	}
+	found := regexp.MustCompile(`([\w.]+)\("((?:GET|POST|PUT|DELETE|PATCH|HEAD) )?(/server/[^"]*)"`).FindAllStringSubmatch(string(src), -1)
+	if len(found) < 15 {
+		t.Fatalf("only %d /server/ patterns found in web.go", len(found))
+	}
+	for _, m := range found {
+		pattern := m[2] + m[3]
+		if m[1] != "server" {
+			t.Errorf("%q is registered by %s, not server(): the subtree's guard is skipped", pattern, m[1])
+		}
+		if !slices.Contains(routes.always, pattern) {
+			t.Errorf("%q is not in routes.always, so no test opens it as a domain administrator", pattern)
+		}
+	}
+}

internal/web/security_test.go

@@ -64,6 +64,30 @@ func TestOriginCheck(t *testing.T) {
 	}
 }
 
+// A panel on a port of its own: the browser's Origin carries the port, as the
+// Host the proxy passes on does, and the two compare whole (Fetch Standard
+// § 3.2: the serialised origin has the port when it is not the scheme's
+// default). The same host on another port is another origin.
+func TestOriginCheckComparesThePort(t *testing.T) {
+	tests := []struct {
+		host, origin string
+		wantRejected bool
+	}{
+		{"panel.example.com:8443", "https://panel.example.com:8443", false},
+		{"panel.example.com:8443", "https://panel.example.com", true},
+		{"panel.example.com", "https://panel.example.com:8443", true},
+		{"panel.example.com:8443", "https://panel.example.com:9443", true},
+	}
+	for _, tc := range tests {
+		r := post("", tc.origin)
+		r.Host = tc.host
+		rejected := serveSecured(true, r).Code == http.StatusForbidden
+		if rejected != tc.wantRejected {
+			t.Errorf("Host %s, Origin %s: rejected = %t, want %t", tc.host, tc.origin, rejected, tc.wantRejected)
+		}
+	}
+}
+
 // The proxy terminates TLS and forwards plain HTTP, so the panel never learns
 // its own external scheme: comparing it against the https in Origin would
 // reject every legitimate form submission in the documented deployment.

internal/web/view/account.go

@@ -135,12 +135,7 @@ func (s *Settings) WithInbound(days string) *Settings {
 // WithResult shows the result of the last action, or its refusal, between the
 // head and the form.
 func (s *Settings) WithResult(flash, formErr string) *Settings {
-	switch {
-	case formErr != "":
-		s.Flash = &Flash{Error: true, Text: Plain(formErr)}
-	case flash != "":
-		s.Flash = &Flash{Text: Plain(flash)}
-	}
+	s.Flash = resultFlash(flash, formErr)
 	return s
 }
 

internal/web/view/components.go

@@ -449,16 +449,6 @@ type Fact struct {
 	Note  Text
 }
 
-// Facts is a shorthand for plain label / value pairs: Facts("Domain",
-// "example.org", "Port", "587").
-func Facts(pairs ...string) []Fact {
-	var out []Fact
-	for i := 0; i+1 < len(pairs); i += 2 {
-		out = append(out, Fact{Label: pairs[i], Value: Plain(pairs[i+1])})
-	}
-	return out
-}
-
 // SideMenu is the input of side_menu, the left column of a detail page: groups
 // of entries with icons and count tags.
 type SideMenu struct {

internal/web/view/components_test.go

@@ -311,9 +311,6 @@ func TestFactsBigMonoAndNote(t *testing.T) {
 		`<dl class="sp-facts"><div><dt>Domain</dt><dd><a href="/outbound/domains/1">example.org</a></dd></div>`,
 		`<dd class="sp-mono">4XcB7k2Jm9z1</dd>`,
 		`<dd class="sp-big">5 days</dd><dd class="sp-muted">a supporting line</dd>`)
-	if got := Facts("A", "1", "B", "2", "odd"); len(got) != 2 || got[1].Label != "B" {
-		t.Errorf("Facts(pairs) = %#v", got)
-	}
 }
 
 func TestSideMenu(t *testing.T) {