audit 4: log paging at its edges, NaN refused, a red rate limit, recalculation asks, reload writes all

Step 4 of stage 4 (L10, L11, L13, L18, L19 and a row of
review-2026-08-followups):

- The Outbound log counts first and clamps the page to the last; a number
  too large for an int (strconv's ErrRange with the largest int) is the
  last page on both logs. Tested at the edges: first, last, past the last
  however far, nonsense, an empty log asked for page 5.
- checkAutoMultiplier is "not within", so NaN and the infinities are out.
- rate-limited is red (components.go; the mockup first, 643892a).
- data-unsaved on both recalculate buttons: panel.js asks on submit
  (ev.submitter) when a field of the page differs from what it was drawn
  with; testdata/unsaved_test.js under TestPanelJS.
- HandleReload writes what a restore's first start writes - the filter
  lists and the DMARC maps too - and a failed step is an error flash on
  Health that names it, not plain text; the success flash says what was
  written.

Tested on the test server: go vet + go test of 25 packages, make e2e (all
pass, 695 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/architecture.md

@@ -1038,8 +1038,8 @@ tables, Postfix's sender map, inbound relay maps (when
 are re-derived from SQLite and both daemons are reloaded, so drift between the
 extracted archive and the database is healed before mail flows. Manual
 `POST /server/health/reload` (the *Reload configuration* button on Server ›
-Health) resyncs OpenDKIM, the sender map, and
-inbound maps only — not DMARC maps. Stopped-container
+Health) runs the same Resync, the filter lists with it, since `2.5.4`.
+Stopped-container
 `tar` of `./data` alone remains possible for state-only copies (see guide).
 
 **Optional encryption** of the two secret-bearing downloads

docs/audit-2026-10-12.md

@@ -1217,14 +1217,26 @@ command whose leftover is the owner's alone.
    `handleAjaxResponse()` follows before it looks at the status. No jsdom
    (no node tooling in the repo): `testdata/poll_test.js` runs panel.js in
    node against a stand-in for the DOM and htmx with a moved clock, from
-   `TestPanelJSPolling` (skipped where node is absent - the test server's
+   `TestPanelJS` (skipped where node is absent - the test server's
    Go has none; it fails on the old panel.js with ten findings).
-- [ ] `parsePage` clamp; `NaN` refused; `rate-limited` tag red (add the status to
+- [x] `parsePage` clamp; `NaN` refused; `rate-limited` tag red (add the status to
    `components.go`, flip the test); the recalc button posts only what it
    needs or warns; `HandleReload` either covers DMARC maps and filter lists or
    the flash and the two comments say what it covers. The log's paging is
    tested at its edges: first page, last, past the last, an empty log (a row
    of review-2026-08-followups, placed here 2026-10-14). — **Sonnet**
+   *Done 2026-10-15:* the Outbound log counts first and clamps to the last
+   page; a number too large for an int is the last page too (strconv's
+   ErrRange with the largest int), on both logs. `checkAutoMultiplier` is
+   written "not within", so NaN and the infinities are out. The mockup drew
+   rate-limited grey: `design:` commit first (out-log, and the kit's status
+   row, which had also lost `reject`), then `components.go`. The recalc
+   button warns: `data-unsaved` on both recalc buttons, and panel.js asks
+   on submit (`ev.submitter`) when a field of the page differs from what it
+   was drawn with (`testdata/unsaved_test.js` under `TestPanelJS`).
+   `HandleReload` covers what the restore's Resync covers, the filter lists
+   and the DMARC maps included, and a failed step is an error flash on
+   Health naming it.
 - [ ] `domain.Service.Delete`: say the domain is deleted when a later step fails,
    and run `apps.Resync()` anyway. — **Opus**
 - [ ] **A status filter and a day filter in the Outbound log** (owner, 2026-10-13, from the

docs/guide.md

@@ -473,11 +473,15 @@ readings, in the order of what stops mail first:
   record the internet publishes for this server's IP (forward-confirmed
   reverse DNS), see [Server-level DNS](#server-level-dns-ptrrdns); use
   *Re-check DNS* after changing DNS.
-- **Configuration** — the **Reload configuration** button re-applies OpenDKIM
-  tables and the Postfix sender map from the database (and inbound relay maps
-  when `INBOUND_RELAY_ENABLE=true`) — use it if daemons drifted from what the
-  panel shows after manual edits under `/data`. It does **not** rebuild DMARC
-  Postfix maps; a full restore Resync does (see [Restore](#restore)).
+- **Configuration** — the **Reload configuration** button writes again, from
+  the database, every file the panel keeps for the mail path - OpenDKIM's
+  tables, the Postfix sender map, the inbound relay maps and the filter lists
+  (with `INBOUND_RELAY_ENABLE=true`), the DMARC report maps (with
+  `DMARC_REPORTS_ENABLE=true`) - and has OpenDKIM and Postfix re-read them:
+  what the first start after a restore does (see [Restore](#restore)). Use it
+  if the daemons drifted from what the panel shows after manual edits under
+  `/data`. A step that fails is named on the page, and the panel's log says
+  why.
 
 ### Queue and System log
 
@@ -817,8 +821,8 @@ when `INBOUND_RELAY_ENABLE=true`; DMARC maps when `DMARC_REPORTS_ENABLE=true`)
 and both daemons are reloaded, healing any drift between the extracted files and
 the database. The manifest is deleted only after that Resync is done: a first
 start that fails on the way leaves it, and the next start is a restore again
-and runs the Resync. The *Reload configuration* button on Server › Health resyncs
-OpenDKIM, the sender map, and inbound maps only — not DMARC maps. This is why the
+and runs the Resync. The *Reload configuration* button on Server › Health runs the same Resync.
+This is why the
 compose file pins a fixed tag rather than `:latest`: without a known version,
 there'd be no way to tell which image restoring a given backup actually requires
 (see [Fixed image tag](#fixed-image-tag)).

docs/roadmap.md

@@ -42,7 +42,7 @@ in `git log` and [CHANGELOG.md](../CHANGELOG.md).
 | from-header-binding | Hold a message's `From:` header against the application that sends it | shipped `2.4.0` | 9/9 | [plans/from-header-binding.md](plans/from-header-binding.md) |
 | panel-redesign | Panel redesign (accepted mockups, design contract) | shipped `2.0.0` | 27/27 | [plans/panel-redesign.md](plans/panel-redesign.md) |
 | schema-squash | Squash SQLite migrations into a 2.x baseline | built in panel-redesign (stage 1) | — | [plans/panel-redesign.md](plans/panel-redesign.md) |
-| audit-2026-10-12 | Follow-ups of the 2026-10-12 full-tree code audit, seven stages | in progress (stage 0 shipped `2.4.2`, stages 1+2 `2.5.0`, 2b `2.5.1`, 2c `2.5.2`, 3 `2.5.3`; next stage 4 → `2.5.4`) | 58/81 | [audit-2026-10-12.md](audit-2026-10-12.md) |
+| audit-2026-10-12 | Follow-ups of the 2026-10-12 full-tree code audit, seven stages | in progress (stage 0 shipped `2.4.2`, stages 1+2 `2.5.0`, 2b `2.5.1`, 2c `2.5.2`, 3 `2.5.3`; next stage 4 → `2.5.4`) | 59/81 | [audit-2026-10-12.md](audit-2026-10-12.md) |
 
 **Recommended order** (not binding; owner, 2026-10-09: feature order follows
 development convenience): **panel-redesign** shipped as `2.0.0` (2026-10-11) and