audit 4: findings of the two reviews

- Two inbound domains on one upstream could never change its TLS mode,
  each save refused for the other (medium): SetTransportAs changes the
  mode for every domain on the upstream when the one saving may change
  them all; a domain user who may not is refused with the mode, not the
  other tenant's domain name (security F1: the first version named it).
- A deletion's leftover DKIM key is removed by Resync (Reload
  configuration, a restore's first start) for names no domain has.
- The backup's write deadline moves before Check.
- hasUnsavedEdit skips password and file fields and compares a multiple
  select's options; htmx.config.timeout 30 s, so a refresh never answered
  ends and is tried again; a failed refresh's promise is handled.
- An empty filtered Outbound log says no message matches the filters.
- The dummy bcrypt hash is made at start; a DMARC part over 8 MiB is
  refused for its size like the other two limits.
- Health's Configuration box says what Reload writes (design first,
  32dfe4a).
- Docs: CHANGELOG, guide § Inbound, security.md (the shared upstream's
  mode, the profile form's "username taken"), architecture.md (owed to an
  address), the plan's notes corrected.
Tests: the shared upstream (service, handler), the leftover key, all eight
Health boxes ordered, the subject from before migration 0011, the new JS
cases.

Tested on the test server: go vet + go test of 25 packages, make e2e (all
pass, 636 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/audit-2026-10-12.md

@@ -1200,7 +1200,8 @@ command whose leftover is the owner's alone.
    would have been cut at 60 s, so `HandleBackup` moves its write deadline
    to two hours through `http.ResponseController` (no wrapper of the
    ResponseWriter in the chain; e2e checks the log has no failure to move
-   it). A test pins the four values.
+   it). A test checks the four are set and long enough for a form and a
+   DNS page.
 - [x] **Polling recovery**: schedule from `htmx:afterRequest` on the box (or pass
    `source`), handle `sendError`/`timeout` with back-off; `RequireAuth`
    answers an `HX-Request` with `HX-Redirect: /login` instead of a 303. A
@@ -1261,7 +1262,9 @@ command whose leftover is the owner's alone.
    poll, the pages, the rows' links and the message's way back;
    `SendLogFilter.Status`, `Since`, `Until` (whole UTC days, as the
    Inbound log's). A status not in the list is no narrowing. Plans: a
-   domain user's filtered page still goes by `idx_send_log_domain_id`; the
+   domain user's filtered page goes by `idx_send_log_domain_id` (with a day
+   filter by `idx_send_log_domain_id_created_at` and a sort - not pinned by
+   the plan test); the
    global role's status-only count walks the table (a page view or a 5 s
    poll while the log is open on a status - tens of thousands of rows at
    the retention limit, milliseconds), accepted.
@@ -1388,6 +1391,31 @@ command whose leftover is the owner's alone.
    saved before keep the first by domain name, as Postfix did). Tests in
    inbound and postfix (`TestRenderInboundMapsOneTLSLinePerNextHop`).
 
+*Changed by the reviews of stage 4 (2026-10-15; technical and security):*
+**two domains on one upstream could never change its TLS mode** - each
+save was refused for the other (medium); `inbound.Service.SetTransportAs`
+now changes the mode for every domain on the upstream when the one saving
+may change them all, and refuses a domain user who may not with the mode,
+not the other tenant's name (the security review's F1: the first version's
+refusal named it). The deletion's leftover key is removed by Resync (Reload
+configuration, a restore's start) for names no domain has. The backup's
+write deadline moves before Check. `hasUnsavedEdit` skips password and file
+fields (a password manager filling the export password made Recalculate
+ask) and compares a multiple select's options. `htmx.config.timeout` 30 s,
+so a refresh that is never answered ends and is tried again; the rejected
+promise of a failed refresh is handled. A filtered empty Outbound log says
+so. The dummy hash is made at start. A DMARC part over 8 MiB is refused for
+its size like the others. The Configuration box on Health says what Reload
+writes (`design:` first). Tests: the shared upstream (service and handler),
+the leftover key, all eight Health boxes ordered, the legacy subject.
+Accepted, with the reason: a notification is owed to an address
+(architecture.md § Notifications); SERVFAIL from every resolver is Unknown
+- it is not an answer about the record; Reload repeats the restore's list
+of steps by hand (`HandleReload` and `mailStack.Resync`, both commented); a
+failed `SetNotifyAddressees` is logged and the subject stays said, the next
+follow-up finds nobody owed; the profile form's "username taken" is
+documented in security.md.
+
 ### Stage 5 — image and Postfix hardening (M17–M19, M21, L30–L32) → `2.6.0`
 
 - [ ] **Supervisor socket**: a group of its own (`supervisor`), panel only;