roadmap: decisions of 2026-10-13 on the candidates

Agreed with the owner, one question at a time; documents only, no code.

- csrf-tokens -> origin-strict (agreed): no tokens, the origin check
  refuses a request with neither header. security.md's ADR records the
  decision and when tokens are built after all.
- structured-logging, contributing: dropped, each with what brings it
  back (new roadmap section "Dropped, with the condition for return").
- template-data-typing: done by 2.0.0; its last map (healthChecks) is a
  step of the audit's stage 4.
- preflight -> health-setup-checks (certificate name, Postfix's greeting,
  trusted proxy as lines on Health) and test-email, both agreed. The port
  check is dropped with its reason; plans/preflight.md removed.
- password-reset: agreed; a reset link goes only to a confirmed e-mail,
  so the item builds confirmation first.
- phone-desktop-mode: agreed, after stages 1 and 2 of the audit.
- backup-reauth (agreed): the account password before a backup or a
  domain export, out of review-2026-08-followups.
- from-header-binding, Not done: the Delivery log box is required on a
  refused message's page, with the line Postfix wrote, for all three
  kinds of refusal (audit stage 1); the Outbound log gets a filter by
  status and by day (audit stage 4).

The audit's checklist is 48 lines (was 45).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/plans/from-header-binding.md

@@ -168,13 +168,18 @@ silence; each line says what is missing and what it would take.
 - **The Delivery log box is on a refused message's page.** The picture he
   approved had left it out; the built page keeps it, with one sentence. And
   the sentence is less than the truth for a `From:` refusal: cleanup did
-  write a line about it under a queue id (`milter-reject: END-OF-MESSAGE …
-  5.7.1 From: …`), but the check answers before the queue id reaches it, so
-  the row keeps none and the page cannot show that line. To do: either drop
-  the box for a refused row, or have the tailer attach the line to the row.
+  write a line about it under a queue id (`milter-reject: END-OF-MESSAGE ...
+  5.7.1 From: ...`), but the check answers before the queue id reaches it, so
+  the row keeps none and the page cannot show that line. **Decided
+  2026-10-13 (owner):** the box is required - he had overlooked its absence
+  from the picture, it was never a decision to drop it. The tailer attaches
+  the line to the row, for all three kinds of refusal; a step of
+  [audit-2026-10-12](../audit-2026-10-12.md) stage 1.
 - **The Outbound log has no status filter.** The mockup draws one; the built
   log filters by domain and application. With three kinds of refusal now
   told apart by tag, a filter by status and reason would be worth having.
+  **Decided 2026-10-13 (owner):** a filter by status, without the split by
+  reason, and a filter by day as the Inbound log has; a step of [audit-2026-10-12](../audit-2026-10-12.md) stage 4.
 - **"Messages deferred" counts connections Postfix turned away.** Postfix
   refuses from the connection on, before a message is offered, so a monitor
   that only connects during an outage is counted. The guide says so; the

docs/plans/preflight.md

@@ -1,77 +0,0 @@
-# Plan: preflight (installation check page)
-
-**Status:** candidate  
-**Date:** 2026-08-19  
-**Version:** `1.x` MINOR; `candidate` until explicitly agreed.
-
----
-
-## Goal
-
-A dedicated `/server/preflight` page (global-admin only) that runs infrastructure-level
-checks and helps the administrator confirm the instance is fully configured and
-ready to deliver mail. Each failed check shows an actionable recommendation
-(what to do or where to look).
-
-## Mockup
-
-[preflight](../assets/panel-redesign/panel/preflight.html), under the design
-contract of [panel-redesign.md](panel-redesign.md): **Server › Preflight**,
-path `/server/preflight`.
-
-## Scope
-
-**In:**
-
-- rDNS / PTR verification (reuse `dnscheck.Checker.checkServer`)
-- TLS certificate validity + hostname match (CN/SAN contains `SELFPOST_HOSTNAME`)
-- Port connectivity: 25, 465, and 587 (if `SUBMISSION_ENABLE`) — dial own
-  public IP from inside the container, expect a 220 banner
-- HELO/EHLO banner — connect to localhost:25, verify Postfix announces
-  `SELFPOST_HOSTNAME` (not `localhost` or a container ID)
-- Trusted proxy headers:
-  - If `TRUSTED_PROXY_CIDR` set: verify peer IP is in range and
-    `X-Forwarded-For` is present
-  - If `PANEL_COOKIE_SECURE=true`: verify `X-Forwarded-Proto: https`
-  - If `TRUSTED_PROXY_CIDR` empty: informational warning (panel exposed
-    directly)
-- DKIM signing — OpenDKIM milter socket reachable (reuse `health.CheckSocket`)
-- Send test email — admin enters recipient address, system sends via
-  localhost:25, shows queued/error result
-
-**Out:**
-
-- Per-domain DNS checks (SPF, DKIM TXT, DMARC) — those live on domain detail
-  pages.
-- Delivery tracking of test email (only confirms local MTA accepted).
-
-## Done when
-
-An administrator can open `/server/preflight`, see a traffic-light summary of all
-infrastructure prerequisites, read specific fix instructions for any failures,
-and send a test email to verify end-to-end flow.
-
-## Risks
-
-- Port-connectivity check from inside the container may not reflect external
-  reachability if NAT hairpin is unsupported (document limitation).
-- Test email requires at least one configured domain (or falls back to
-  `postmaster@SELFPOST_HOSTNAME`).
-
-## Implementation checklist
-
-Target version cut: TBD (MINOR). One commit per step; code only after roadmap
-status is **agreed**. See [development.md](../development.md) § Plan checklists.
-
-- [ ] Port-connectivity helper (`internal/health/port.go`) — dial own IP, read
-      SMTP banner — **Sonnet**
-- [ ] HELO banner check (connect localhost:25, parse 220 line) — **Sonnet**
-- [ ] Hostname-in-certificate check (extend or wrap `health.CheckCertificate`)
-      — **Sonnet**
-- [ ] Handler `handlers_preflight.go` (assemble all checks, actionable
-      recommendations) — **Sonnet**
-- [ ] Test-email handler (`POST /server/preflight/test-email`, `net/smtp` to
-      localhost:25) — **Sonnet**
-- [ ] Template `preflight.html` (traffic-light cards + test-email form) —
-      **Sonnet**
-- [ ] Routes in `web.go`, nav link — **Sonnet**