release: 2.4.0: an application signs only as itself

from-header-binding (docs/plans/from-header-binding.md, 9/9), at the owner's
word (2026-10-12, "Да").

  - A message's From: line is held to what its envelope sender is held to:
    any address of the application's domain, or the addresses of its list,
    with or without a +extension. Anything else is refused with 550 5.7.1 -
    another registered domain, the server's own name, a domain this server
    does not sign for. Until now an application could have mail signed with
    another domain's key by writing that domain into From:.
  - The check is the panel's, first in the milter chain and strict: while
    the panel does not answer, Postfix defers mail.
  - Server > Health counts what that costs - the panel's downtime under a
    running Postfix and the submissions turned away - and is laid out anew,
    boxes numbered by importance.
  - A refused row of the Outbound log says why in its tag.
  - Migration 0006.

Upgrading: mail whose From: is not the application's own stops being
accepted - another of your domains, an address off an application's list, a
visitor's address a form puts there. The guide says what to do about each.
A stopped panel now stops submission.

Not done, written into the plan at the owner's word: the Delivery log box on
a refused message's page, the log's status filter, "messages" that are
connections, and what was reasoned about rather than run - OpenDKIM's own
parser above all.

Cut: CHANGELOG 2.4.0 written (nothing had been put under [Unreleased]
while building); image pin 2.4.0 in compose, README, guide; version table,
roadmap, plan status. security.md: a malformed packet on a milter socket,
as an accepted risk. No tag: the owner tags when he decides to, so there is
no image of this version until then.

On the test server, on c817f08: go vet ./... ok, go test ./... ok
(23 packages), make e2e ok. This commit changes documents and the pin only.

Full detail: CHANGELOG.md (2.4.0).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/roadmap.md

@@ -39,7 +39,7 @@ in `git log` and [CHANGELOG.md](../CHANGELOG.md).
 | delivery-log-storage | Keep a message's `mail.log` lines with its send-log row | shipped `2.2.0` | 8/8 | [plans/delivery-log-storage.md](plans/delivery-log-storage.md) |
 | password-reset | Password reset by e-mail | candidate | — | — |
 | phone-desktop-mode | A phone browser in "desktop site" mode gets the phone navigation | candidate | — | — |
-| from-header-binding | Hold a message's `From:` header against the application that sends it | built and reviewed, for `2.4.0` | 9/9 | [plans/from-header-binding.md](plans/from-header-binding.md) |
+| from-header-binding | Hold a message's `From:` header against the application that sends it | shipped `2.4.0` | 9/9 | [plans/from-header-binding.md](plans/from-header-binding.md) |
 | panel-redesign | Panel redesign (accepted mockups, design contract) | shipped `2.0.0` | 27/27 | [plans/panel-redesign.md](plans/panel-redesign.md) |
 | schema-squash | Squash SQLite migrations into a 2.x baseline | built in panel-redesign (stage 1) | — | [plans/panel-redesign.md](plans/panel-redesign.md) |
 
@@ -47,7 +47,8 @@ in `git log` and [CHANGELOG.md](../CHANGELOG.md).
 development convenience): **panel-redesign** shipped as `2.0.0` (2026-10-11) and
 **inbound-antispam-panel** as `2.1.0` (2026-10-12), built in the new component
 kit — styling its two screens once instead of twice. **delivery-log-storage**
-shipped as `2.2.0` the same day, and **panel-notifications** as `2.3.0`.
+shipped as `2.2.0` the same day, **panel-notifications** as `2.3.0` and
+**from-header-binding** as `2.4.0`.
 Nothing is agreed after it: every remaining
 item is a candidate. panel-docs shipped in
 [CHANGELOG.md](../CHANGELOG.md) `[1.8.0]`; dmarc-reports in `[1.7.0]`
@@ -440,8 +441,9 @@ since 2.3.0, the server's own name - into `From:` and have the message signed
 with that name's key: mail that passes DMARC as a domain the application has
 no right to, or that looks like a notification of the panel.
 
-**Agreed with the owner on 2026-10-12** and taken into work
-([plans/from-header-binding.md](plans/from-header-binding.md)). The rule he
+**Agreed with the owner on 2026-10-12**, built and reviewed the same day
+([plans/from-header-binding.md](plans/from-header-binding.md); what is not
+done is listed there under *Not done*). The rule he
 chose is wider than the one first written here: `From:` is held to exactly
 what the envelope is held to - any address of the application's domain, or
 the addresses of its list - and anything else is refused, a stranger's domain
@@ -454,8 +456,9 @@ needs a process of its own.
 tenant's `From:`, for the hostname's and for an address off its list, and
 accepted for its own.
 
-**Version:** `2.4.0` MINOR; in progress. Until it ships:
-[security.md](security.md) § Accepted risks.
+**Version:** shipped `2.4.0` (2026-10-12), MINOR. What it costs - the
+panel's downtime is now mail's - is in [security.md](security.md) § Accepted
+risks.
 
 ---