docs-audit: the guide and the panel's words against the code

The owner's "проверь, что документация актуальна с кодом" (2026-10-16);
design c5edbd8 and f1cc3f3 settled which side moves.

The panel follows its mockups: an inbound domain's MX box ends with
"Checked N ago" (dnscheck.InboundMXCheckedAt, from the cache) and its side
menu has See also › Log for this domain (the Inbound log, filtered); a
deferred message's history ends with the open dot of the wait in the
queue, the lifetime from this Postfix; Health's lead says six cards;
Overview's head says it refreshes on its own; DMARC's hint for an
unaligned third party is the mockup's sentence.

Help, word for word with the mockup and true to the code: the
application's password kept by the server (sasldb2) for an export, a
From:/Sender: refusal one row of the Outbound log, every backup password
check counted (AllowPasswordChange before the compare), a password set
for another user ends all their sessions, the limit mail daily per
sending domain. The Filter lists topic and its menu entry are no longer
shown to a domain administrator: their page is 404 to one
(requireInboundGlobal), and Help shows only what its viewer can open.

guide.md: Health's readings in the order of the boxes, with Notification
mail; the menu and role tables have the Inbound log and Filter lists; port
25's chain has the inbound journal; level 2 does not depend on the client
address, the client list refuses a message without one; four kinds of
refusal (wrong Sender); the log is filtered, not searched, and a message
is traced by its row; a bounced row shows only the queue lifetime;
TRUSTED_PROXY_CIDR serves sign-in and setup, the account-change limit is
per user; notifications' first check and hourly ceiling. The Apache
vhost's comment names mod_rewrite.

Tests: TestHelpHasTheInboundLogAndFilterListsTopics (the topic per
viewer), TestDeliveryPageDeferredUsesRetryPolicy (the wait),
TestInDomainShowsTheMockupsBoxes (checked, the log link), the Overview
head; the DMARC tests take the new hint. go vet + go test (26 packages)
and make e2e on the test server for this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/view/fixtures_test.go

@@ -290,8 +290,8 @@ func outMessageFixture() *OutMessage {
 		{Time: StepTime(at), Strong: "Accepted and queued", Text: Plain(" — Postfix accepted the message over an authenticated submission and the journal-milter recorded it.")},
 		{Time: StepTime(at.Add(2 * time.Second)), Strong: "Deferred, will be retried", Level: LevelWarn,
 			Text: Plain(" — the receiving server could not take the message yet. Postfix retries: first after 5 minutes, then with increasing gaps up to 1 hour 7 minutes, for up to 5 days.")},
-		{Time: StepTime(time.Time{}), Strong: "Waiting for a delivery report", Level: LevelPending,
-			Text: Plain(" — the next attempt is made by Postfix on its own; the queue shows what it is still holding.")},
+		{Time: StepTime(time.Time{}), Level: LevelPending,
+			Text: Plain("Still in the queue; the next attempt is Postfix's own, and after 5 days it is bounced.")},
 	})
 	return p.WithDeliveryLog([]LogLine{
 		{Time: "13:58:07", Text: "postfix/smtpd[2114]: 4XcB7k2Jm9z1: client=unknown[198.51.100.7], sasl_username=alerts"},
@@ -324,7 +324,7 @@ func dmarcHubFixture() *DMARCHub {
 // with one source that is not this relay failing, and three reports.
 func dmarcDomainFixture() *DMARCDomain {
 	p := NewDMARCDomain(admin(), 2, "shop.example.org", true, 11204, 41, 7,
-		"A third-party source is not aligned. Do not tighten p= until that sender is fixed or removed.")
+		"Failures come from a source that is not this relay — review before tightening p=.")
 	row := func(id int64, at, reporter, window string, pass, fail int) DMARCReportRow {
 		return DMARCReportRow{Received: at, Reporter: reporter, Window: window, Pass: pass, Fail: fail, Href: DMARCReportHref(id)}
 	}
@@ -379,6 +379,7 @@ func inDomainFixture() *InDomain {
 		TLSMode: "encrypt", RecipientMode: "list", RecipientCount: 4,
 		Addresses: []string{"announce@lists.example.org", "dev@lists.example.org", "owner@lists.example.org", "security@lists.example.org"}})
 	p.WithMX("mail.example.org", DNSCheck{Status: "ok", Found: []string{"10 mail.example.org."}})
+	p.WithChecked("1 min ago").WithLog("/inbound/log?domain=lists.example.org")
 	p.WithFilter(true, "inet:antispam:11332", "accept")
 	return p
 }