roadmap: decisions of 2026-10-13 on the candidates

Agreed with the owner, one question at a time; documents only, no code.

- csrf-tokens -> origin-strict (agreed): no tokens, the origin check
  refuses a request with neither header. security.md's ADR records the
  decision and when tokens are built after all.
- structured-logging, contributing: dropped, each with what brings it
  back (new roadmap section "Dropped, with the condition for return").
- template-data-typing: done by 2.0.0; its last map (healthChecks) is a
  step of the audit's stage 4.
- preflight -> health-setup-checks (certificate name, Postfix's greeting,
  trusted proxy as lines on Health) and test-email, both agreed. The port
  check is dropped with its reason; plans/preflight.md removed.
- password-reset: agreed; a reset link goes only to a confirmed e-mail,
  so the item builds confirmation first.
- phone-desktop-mode: agreed, after stages 1 and 2 of the audit.
- backup-reauth (agreed): the account password before a backup or a
  domain export, out of review-2026-08-followups.
- from-header-binding, Not done: the Delivery log box is required on a
  refused message's page, with the line Postfix wrote, for all three
  kinds of refusal (audit stage 1); the Outbound log gets a filter by
  status and by day (audit stage 4).

The audit's checklist is 48 lines (was 45).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/plans/from-header-binding.md

@@ -168,13 +168,18 @@ silence; each line says what is missing and what it would take.
 - **The Delivery log box is on a refused message's page.** The picture he
   approved had left it out; the built page keeps it, with one sentence. And
   the sentence is less than the truth for a `From:` refusal: cleanup did
-  write a line about it under a queue id (`milter-reject: END-OF-MESSAGE …
-  5.7.1 From: …`), but the check answers before the queue id reaches it, so
-  the row keeps none and the page cannot show that line. To do: either drop
-  the box for a refused row, or have the tailer attach the line to the row.
+  write a line about it under a queue id (`milter-reject: END-OF-MESSAGE ...
+  5.7.1 From: ...`), but the check answers before the queue id reaches it, so
+  the row keeps none and the page cannot show that line. **Decided
+  2026-10-13 (owner):** the box is required - he had overlooked its absence
+  from the picture, it was never a decision to drop it. The tailer attaches
+  the line to the row, for all three kinds of refusal; a step of
+  [audit-2026-10-12](../audit-2026-10-12.md) stage 1.
 - **The Outbound log has no status filter.** The mockup draws one; the built
   log filters by domain and application. With three kinds of refusal now
   told apart by tag, a filter by status and reason would be worth having.
+  **Decided 2026-10-13 (owner):** a filter by status, without the split by
+  reason, and a filter by day as the Inbound log has; a step of [audit-2026-10-12](../audit-2026-10-12.md) stage 4.
 - **"Messages deferred" counts connections Postfix turned away.** Postfix
   refuses from the connection on, before a message is offered, so a monitor
   that only connects during an outage is counted. The guide says so; the