audit 4: cards ordered by number, a notification owed to each recipient

The cards layout (owner, 2026-10-13; the mockup first, b90a2f0): box_open
writes data-order for a box with InCards and a number, and panel.css orders
by it up to twelve - Health's eight and the kit's three.
TestCardsBoxesCarryTheirNumberAsTheirOrder reads the rendered pages.

Notifications (owner, 2026-10-14): migration 0011, notify_addressees. open
sends a subject's first message to every recipient and records who was
handed it; followUp, on every check while the subject is open and still
wrong, hands it to the owed and untold who are still recipients; closed
sends the end to the told (all recipients for a subject from before the
table). Tests: a failed copy goes out at the next check, once; the hourly
ceiling holds one back; a user added mid-subject hears nothing of it.

Also in the roadmap, from the owner today: dns-record-collapse,
notification-mail-recheck, settings-save-row (agreed, design first).

Tested on the test server: go vet + go test of 25 packages, make e2e (all
pass, 644 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/audit-2026-10-12.md

@@ -1283,7 +1283,7 @@ command whose leftover is the owner's alone.
    `mi_rd_cmd`, go-milter v0.4.1 `HandleMilterCommands` on `io.EOF` - the
    comment on CheckSocket cites them). The socket nobody listens on is
    `milter_test.go`.
-- [ ] **The `cards` layout takes its phone order from the box's number**
+- [x] **The `cards` layout takes its phone order from the box's number**
    (owner, 2026-10-13, from the Not done list of from-header-binding). The
    order on a phone is written in `panel.css` for four boxes to a stack
    (`.sp-cards > .column:first-child > .box:nth-child(1..4)`); a fifth box
@@ -1293,7 +1293,15 @@ command whose leftover is the owner's alone.
    checks that the numbers of a rendered `cards` page run in order. A change
    to a component: the mockup's components page and `theme.css` first
    (`design:` commit). - **Sonnet**
-- [ ] **A notification is owed to each recipient, not to the subject**
+   *Done 2026-10-15:* an attribute, not a class: the mockup's check
+   (`check.py`) refuses a class `theme.css` defines and no page uses, and a
+   class per number up to twelve would be eight such. `data-order="N"` is
+   not a style either, so the CSP holds; `theme.css` and `panel.css` have
+   `.sp-cards [data-order="1..12"]`. `box_open` writes it for a box with
+   `InCards` (Health's eight, the kit's three) and a number.
+   `TestCardsBoxesCarryTheirNumberAsTheirOrder` reads the rendered pages:
+   each box's data-order is its number, and the stylesheet has its rule.
+- [x] **A notification is owed to each recipient, not to the subject**
    (owner, 2026-10-14; from the reviews of panel-notifications, not found by
    the audit). `Notifier.send` ([notify.go](../internal/notify/notify.go))
    counts a subject as said when one recipient's copy was handed to Postfix;
@@ -1307,6 +1315,17 @@ command whose leftover is the owner's alone.
    open is not mailed about it. "Cleared" goes to those who were told of the
    problem. Tests: one copy fails and goes out at the next check, once; the
    ceiling; a user added mid-subject. - **Opus**
+   *Done 2026-10-15:* migration `0011`, `notify_addressees (key, address,
+   told_at)`, gone with the subject's row. `open` sends the first message
+   to every recipient and records who was handed it; `followUp`, on every
+   check while the subject is open and still wrong (DNS bad, the
+   certificate at its level, the queue still stuck, a limit within its
+   day), hands the current message to the owed and untold who are still
+   recipients; `closed` sends the end to the told (all recipients for a
+   subject opened before the table). A cleared copy that fails is not
+   retried - the subject is gone with it, as before. Tests: a failed copy
+   goes out at the next check, once; the ceiling holds one back; a user
+   added mid-subject hears nothing of it, its end included.
 - [ ] **A DNS outage is "unknown", not "wrong"** (M14, M15; owner,
    2026-10-14 - the two findings had no step). Each resolver gets a time
    budget of its own, so a silent first resolver no longer leaves the second