audit 4: findings of the two reviews

- Two inbound domains on one upstream could never change its TLS mode,
  each save refused for the other (medium): SetTransportAs changes the
  mode for every domain on the upstream when the one saving may change
  them all; a domain user who may not is refused with the mode, not the
  other tenant's domain name (security F1: the first version named it).
- A deletion's leftover DKIM key is removed by Resync (Reload
  configuration, a restore's first start) for names no domain has.
- The backup's write deadline moves before Check.
- hasUnsavedEdit skips password and file fields and compares a multiple
  select's options; htmx.config.timeout 30 s, so a refresh never answered
  ends and is tried again; a failed refresh's promise is handled.
- An empty filtered Outbound log says no message matches the filters.
- The dummy bcrypt hash is made at start; a DMARC part over 8 MiB is
  refused for its size like the other two limits.
- Health's Configuration box says what Reload writes (design first,
  32dfe4a).
- Docs: CHANGELOG, guide § Inbound, security.md (the shared upstream's
  mode, the profile form's "username taken"), architecture.md (owed to an
  address), the plan's notes corrected.
Tests: the shared upstream (service, handler), the leftover key, all eight
Health boxes ordered, the subject from before migration 0011, the new JS
cases.

Tested on the test server: go vet + go test of 25 packages, make e2e (all
pass, 636 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/view/testdata/poll_test.js

@@ -61,6 +61,7 @@ const document = {
 const window = { addEventListener: on("window"), confirm: () => true };
 const requests = [];
 const htmx = {
+  config: {},
   ajax(verb, path, ctx) {
     requests.push({ verb, path, ctx });
   },
@@ -79,6 +80,9 @@ vm.runInNewContext(fs.readFileSync(process.argv[2], "utf8"), {
 });
 
 // --- the cases --------------------------------------------------------------
+// A request that never ends is ended: htmx's default is no timeout.
+check(htmx.config.timeout === 30000, "htmx.config.timeout is " + htmx.config.timeout + ", want 30000");
+
 const box = element("overview-stats", { "data-poll": "", "hx-get": "/overview/stats", "hx-trigger": "load" });
 inPage = { [box.id]: box };
 

internal/web/view/testdata/unsaved_test.js

@@ -30,7 +30,7 @@ const window = {
   },
 };
 vm.runInNewContext(fs.readFileSync(process.argv[2], "utf8"), {
-  document, window, htmx: { ajax() {} }, setTimeout, clearTimeout, Date, Object, Math, console,
+  document, window, htmx: { config: {}, ajax() {} }, setTimeout, clearTimeout, Date, Object, Math, console,
 });
 
 function input(type, value, defaultValue) {
@@ -85,6 +85,16 @@ scenario("a box unticked", (f) => (f[2].checked = false), true);
 scenario("a select moved off its first option", (f) => (f[3].selectedIndex = 1), true);
 scenario("a select moved off its selected option", (f) => (f[4].selectedIndex = 0), true);
 scenario("a disabled field differs", (f) => { f[0].value = "150"; f[0].disabled = true; }, false);
+// A password manager filling a password field, a file chosen: not edits.
+scenario("a password filled in", (f) => f.push(input("password", "secret", "")), false);
+scenario("a file chosen", (f) => f.push(input("file", "x.json", "")), false);
+// A list that takes several: any option off what was drawn.
+scenario("a multiple select changed", (f) => f.push(Object.assign(select(-1, [false, false]), {
+  multiple: true, options: [{ selected: true, defaultSelected: false }, { selected: false, defaultSelected: false }],
+})), true);
+scenario("a multiple select as drawn", (f) => f.push(Object.assign(select(-1, [false, false]), {
+  multiple: true, options: [{ selected: true, defaultSelected: true }, { selected: false, defaultSelected: false }],
+})), false);
 
 // Answered yes: the submission goes on.
 fields = drawn();