audit 6: documents, comments, dead code and staticcheck; the test gaps closed

The last stage of the 2026-10-12 audit; no cut.

Doc drift: architecture.md (the sender check in § OpenDKIM, the limit:
row's 48 hours, the inbound log and filter-list routes and who may open
them, migrations to 0011 and every table, KitPage as production data,
Reload configuration as a restore writes, the panel's roles counted),
schema-migrations.md (tables and columns since v2), guide.md (a delivery's
lines go at the next prune; INBOUND_JOURNAL_MILTER_SOCKET moved to
architecture.md's internal list), development.md (the env guard, the
deferral the e2e proves, its fixed sleeps), roadmap.md.

Comments say what the code does now; TestBaselineIsTheOnlyMigration is
TestChainStartsAtTheBaseline; the milter package doc names its three
milters.

Dead code gone: view.Facts, dmarc HostedSuggestion and
ValidateHostedAddress, app UpdateMode (each with the test that alone kept
it), the method checks the method-bound routes made dead;
Settings.WithResult calls resultFlash. staticcheck 2026.1 in test.yml on
both modules, clean: the e2e package builds without its tests now (a test
and two constants moved out of non-test files), three findings fixed.
The test moved, TestImageBuildPreservesLogrotateMode, had sat in a
non-test file and never run; run, it failed on the entrypoint (docker run
without a hostname) and now asks with --entrypoint stat.

The test gaps no step named, each closed: follow() with mail.log gone past
blindMin and made again; CheckRestore with a manifest that is not JSON;
the origin check with a port; every /server/ pattern in web.go through
server() and in the routes table (it found GET /server/health/fragment
missing from the table - guarded, not tested); L9 as the owner decided it
on 2026-10-12, the comment on senderSession.Headers and the test passing
an h that holds the earlier messages' From:.

Plan stage 6 ticked; roadmap audit row done, 81/81.

Tested on the test server: go vet + go test of 27 packages, make e2e (all
pass, 513 s) on this tree; staticcheck locally on both modules.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/e2e/cert_reload_check.go

@@ -87,10 +87,10 @@ func checkCertRenewalPickedUp(s *stack) error {
 		"postconf -h smtpd_tls_cert_file && cmp /etc/postfix/tls/fullchain.pem /etc/postfix/tls-internal/fullchain.pem && "+
 			"cmp /etc/postfix/tls/privkey.pem /etc/postfix/tls-internal/privkey.pem && stat -c '%a %U' /etc/postfix/tls-internal/privkey.pem")
 	if err != nil {
-		return fmt.Errorf("Postfix's copy of the certificate: %v\n%s", err, out)
+		return fmt.Errorf("the certificate Postfix reads: %v\n%s", err, out)
 	}
 	if !strings.Contains(out, "/etc/postfix/tls-internal/fullchain.pem\n") || !strings.Contains(out, "600 root") {
-		return fmt.Errorf("Postfix's copy of the certificate: %q, want Postfix reading it and the key 600 root", out)
+		return fmt.Errorf("the certificate Postfix reads: %q, want Postfix reading it and the key 600 root", out)
 	}
 	return nil
 }

test/e2e/logrotate_check.go

@@ -2,11 +2,7 @@ package e2e
 
 import (
 	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
 	"strings"
-	"testing"
 	"time"
 )
 
@@ -61,46 +57,3 @@ func checkLogrotateRotation(s *stack) error {
 	}
 	return nil
 }
-
-// TestImageBuildPreservesLogrotateMode builds from a context where
-// logrotate-mail.conf is group-writable and checks the image still ships 0644.
-func TestImageBuildPreservesLogrotateMode(t *testing.T) {
-	conf := filepath.Join(h.repoRoot, "build", "logrotate-mail.conf")
-	info, err := os.Stat(conf)
-	if err != nil {
-		t.Fatalf("stat source config: %v", err)
-	}
-	origMode := info.Mode().Perm()
-
-	if err := os.Chmod(conf, origMode|0o020); err != nil {
-		t.Fatalf("chmod g+w source config: %v", err)
-	}
-	t.Cleanup(func() {
-		_ = os.Chmod(conf, origMode)
-	})
-
-	tag := "selfpost:e2e-logrotate-mode"
-	build := exec.Command("docker", "build",
-		"-f", filepath.Join(h.repoRoot, "build", "Dockerfile"),
-		"-t", tag,
-		"--build-arg", "VERSION=e2e",
-		h.repoRoot,
-	)
-	build.Env = os.Environ()
-	if out, err := build.CombinedOutput(); err != nil {
-		t.Fatalf("docker build with group-writable context config: %v\n%s", err, out)
-	}
-	t.Cleanup(func() {
-		_, _ = exec.Command("docker", "rmi", "-f", tag).CombinedOutput()
-	})
-
-	run := exec.Command("docker", "run", "--rm", tag, "stat", "-c", "%a", "/etc/logrotate.d/mail")
-	run.Env = os.Environ()
-	out, err := run.CombinedOutput()
-	if err != nil {
-		t.Fatalf("stat in image: %v\n%s", err, out)
-	}
-	if strings.TrimSpace(string(out)) != "644" {
-		t.Fatalf("image logrotate config mode is %q, want 644", strings.TrimSpace(string(out)))
-	}
-}

test/e2e/logrotate_mode_test.go

@@ -0,0 +1,55 @@
+package e2e
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// TestImageBuildPreservesLogrotateMode builds from a context where
+// logrotate-mail.conf is group-writable and checks the image still ships 0644.
+func TestImageBuildPreservesLogrotateMode(t *testing.T) {
+	conf := filepath.Join(h.repoRoot, "build", "logrotate-mail.conf")
+	info, err := os.Stat(conf)
+	if err != nil {
+		t.Fatalf("stat source config: %v", err)
+	}
+	origMode := info.Mode().Perm()
+
+	if err := os.Chmod(conf, origMode|0o020); err != nil {
+		t.Fatalf("chmod g+w source config: %v", err)
+	}
+	t.Cleanup(func() {
+		_ = os.Chmod(conf, origMode)
+	})
+
+	tag := "selfpost:e2e-logrotate-mode"
+	build := exec.Command("docker", "build",
+		"-f", filepath.Join(h.repoRoot, "build", "Dockerfile"),
+		"-t", tag,
+		"--build-arg", "VERSION=e2e",
+		h.repoRoot,
+	)
+	build.Env = os.Environ()
+	if out, err := build.CombinedOutput(); err != nil {
+		t.Fatalf("docker build with group-writable context config: %v\n%s", err, out)
+	}
+	t.Cleanup(func() {
+		_, _ = exec.Command("docker", "rmi", "-f", tag).CombinedOutput()
+	})
+
+	// Past the entrypoint, which would want a hostname and the rest: only the
+	// file's mode is asked. (Until stage 6 of the 2026-10-12 audit this test
+	// sat in a non-test file and go test never ran it.)
+	run := exec.Command("docker", "run", "--rm", "--entrypoint", "stat", tag, "-c", "%a", "/etc/logrotate.d/mail")
+	run.Env = os.Environ()
+	out, err := run.CombinedOutput()
+	if err != nil {
+		t.Fatalf("stat in image: %v\n%s", err, out)
+	}
+	if strings.TrimSpace(string(out)) != "644" {
+		t.Fatalf("image logrotate config mode is %q, want 644", strings.TrimSpace(string(out)))
+	}
+}

test/e2e/mail_helpers.go

@@ -11,6 +11,15 @@ import (
 	"github.com/emersion/go-msgauth/dkim"
 )
 
+// senderDomain and recipient are fixed for the whole run: one sending domain
+// registered in the panel, and the sink-MX as the single recipient every
+// positive send targets. Here, not in main_test.go: smtp_client.go uses them,
+// and the package builds without its tests (staticcheck reads it so).
+const (
+	senderDomain = "sender.e2e.test"
+	recipient    = "rcpt@sink.e2e.test"
+)
+
 // findSinkMessage polls the sink-MX's dump directory (see test/e2e/sink) for
 // a file whose contents contain token — the unique Subject-line marker every
 // test send carries — and returns it. Polling a directory listing rather than

test/e2e/main_test.go

@@ -62,14 +62,6 @@ func TestMain(m *testing.M) {
 	os.Exit(code)
 }
 
-// senderDomain and recipient are fixed for the whole run: one sending domain
-// registered in the panel, and the sink-MX as the single recipient every
-// positive send targets.
-const (
-	senderDomain = "sender.e2e.test"
-	recipient    = "rcpt@sink.e2e.test"
-)
-
 // The one administrator of the run.
 const (
 	adminUser     = "e2eadmin"

test/e2e/sasldb_test.go

@@ -23,7 +23,7 @@ import (
 // mode and group stay) and that nothing fails under the load; it cannot prove
 // a race absent.
 func testSASLDBChangedByRename(t *testing.T, sc *scenario) {
-	churnLogin, churnPassword, err := sc.panel.addApplication(sc.domainID, "churn", "wildcard", "")
+	churnLogin, _, err := sc.panel.addApplication(sc.domainID, "churn", "wildcard", "")
 	if err != nil {
 		t.Fatalf("add application: %v", err)
 	}
@@ -55,6 +55,7 @@ func testSASLDBChangedByRename(t *testing.T, sc *scenario) {
 	// while the old file still exists, so it cannot have the old file's
 	// number. (After many changes it may: a freed inode number is reused.)
 	before := strings.Fields(stat())
+	var churnPassword string
 	if churnPassword, err = newPassword(0); err != nil {
 		t.Fatal(err)
 	}

test/e2e/smtp_client.go

@@ -252,7 +252,7 @@ func waitForSenderMap(login, password, from string) error {
 			return nil
 		}
 		if replyIs(err, 553, "not owned by user "+login) != nil || time.Now().After(deadline) {
-			return fmt.Errorf("Postfix does not yet let %s send as %s: %w", login, from, err)
+			return fmt.Errorf("not yet: Postfix does not let %s send as %s: %w", login, from, err)
 		}
 		time.Sleep(300 * time.Millisecond)
 	}