findings of the reviews of audit stage 2

Technical review (Opus) and security review (Fable) of a59e3d4..cb5a4a2;
reports in the session's scratchpad. Nothing critical, high or medium; no
outright bug. Fixed:

- F2, F3 (0008 backfill, before it runs on the live database): rows are
  filled by the rule new rows follow - the application's domain, then the
  name's - and only by a domain and application that existed when the row
  was written (created_at); the inbound log likewise. Test: the migration's
  UPDATEs re-run on prepared rows (before the domain, after, null sender,
  application gone, a stranger's name). Dry run on a copy of the live
  database: 68/68 and 10/10 rows filled, none disagreeing with its login's
  domain, integrity ok.
- V2, F4: an application's statistics and level-2 count are its login's
  rows of its domain (appByLogin), and StatsWindow starts no earlier than
  the entity's creation; the message page's "may send as" only for a login
  still of the row's domain. Test: a login taken again in another domain
  starts at zero.
- F7: MAIL FROM:<> is held to the domain limit of its login
  (ApplicationByLogin fills DomainName).
- V3: an imported DKIM selector is held to DNS labels (validate.Selector).
- F5, F6: an imported auto limit's numbers are dropped and recalculated
  right after the import; its mode is stored trimmed.
- V6: the store refuses a role that is neither global nor domain.
- F9: SaveUser keeps the stored hash when no new password is given (the
  form no longer writes back the hash it read). F10: a reach naming a
  domain deleted meanwhile is ErrNoSuchDomain, answered on the form.
- V4, F12: from-lines-other.txt - lines naming another sender ({other}) in
  a quoted string, a quoted pair, capitals, a comment, an encoded word, a
  quoted local part; the unit test wants each refused, the e2e
  (lines_naming_another_sender_never_signed_for_it) wants each refused and
  none signed for it. The passed list gained a.{DOMAIN}, a comment after
  the angle address, a quoted local part, and "b@ {other}" - passed by
  design (security.md), and the e2e shows it signed for the own domain.
- F13: e2e login_in_other_capitals_does_not_authenticate - AUTH with the
  login upper-cased gets 535.

Not changed, written down: V1/F1 - L8 is half closed (refused or passed
still tells an application which domains are hosted here); security.md's
accepted risks and the CHANGELOG say so, and the owner is asked whether to
refuse every foreign address in a display name (changes the 2.4.0 rule).
F11 - deleting a domain rewrites its rows' domain_id (seconds at 1e5 rows),
accepted at this size. F8 (test cannot tell write-first from read-first;
the reviewer verified it with two stores, 30/30), V5, V7, P2: noted.

Evidence on the test server for this tree: go vet clean, go test ./... 23
packages ok, make e2e exit 0 with the three new cases.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/audit-2026-10-12.md

@@ -688,6 +688,13 @@ has already run is never edited — the next file is added; the published
    are still in the global log. — **Opus**
    *Done 2026-10-14.* DMARC reports stay by name on purpose: a report is
    about the name in DNS, and whoever holds the name now is its reader.
+   *Changed by the reviews of stage 2:* the backfill follows the rule new
+   rows follow (the application's domain, then the name) and gives a row
+   only to a domain - and an application - that existed when it was
+   written; an application's numbers are its login's rows of its domain,
+   from its creation on. Deleting a domain now rewrites its rows' domain_id
+   (14 s for 333k rows, measured by the review; milliseconds at this
+   installation's size) - accepted, to revisit if a log grows that large.
 - [x] Docs: security.md § Roles (the guard) and the struck accepted risk, guide
    § Domain export, schema-migrations.md. — **Sonnet**
 - [x] **Which key OpenDKIM signs with, seen and not reasoned** (owner,
@@ -701,6 +708,14 @@ has already run is never edited — the next file is added; the published
    shared with the check's unit test, so a line added to one is run by the
    other. A disagreement found is fixed in the check before the cut, and
    security.md § Mail path says the claim is tested. - **Opus**
+   *Changed by the reviews of stage 2:* a second list, lines naming another
+   sender in a quoted string, a comment, a quoted pair, capitals, an encoded
+   word (`from-lines-other.txt`), each refused and never signed for it; the
+   passed list gained capitals, a quoted local part and a name with a space
+   after its `@` (passed by design, signed for the own domain). L8 is half
+   closed: refused-or-passed still tells an application which domains are
+   hosted here - the owner decides whether to refuse every foreign address
+   in a display name (asked 2026-10-14).
    *Done 2026-10-14:* fifteen lines (`internal/milter/testdata/from-lines-passed.txt`),
    each signed for the application's domain alone, the signature valid. No
    disagreement. Groups are refused by the check, so none is in the file;

docs/security.md

@@ -216,10 +216,17 @@ operator can act on it.
   the line may hold one `@`. That the two agree is tested, not only argued:
   the e2e sends every `From:` line the check passes - a list it shares with
   the check's unit test, `internal/milter/testdata/from-lines-passed.txt` -
-  and wants the message signed for the application's domain and no other.
-  The reply to a refusal says that the line names another sender of the
-  server, not which: it would confirm to whoever tries names that a domain
-  is hosted here. What this does not promise is what a display
+  and wants the message signed for the application's domain and no other;
+  and every line of a second list, lines that name another sender of the
+  server in a quoted string, a comment, a quoted pair, capitals or an encoded
+  word (`from-lines-other.txt`), must be refused and never arrive signed for
+  that sender. The reply to a refusal says that the line names another
+  sender of the server, not which. That a line naming a domain is refused
+  when the domain is a sender of this server, and passed when it is not,
+  still tells an application which domains are hosted here; the probe needs
+  an application of this server, and refusing every foreign address in a
+  display name would change the 2.4.0 rule - the owner decides (accepted
+  risks). What this does not promise is what a display
   name looks like to a person: a name of another sender written without an
   `@` the scan can find (a full-width dot, a space inside the name) passes,
   signed with the application's own key - a forged display name is as old
@@ -436,6 +443,15 @@ deferred item from the roadmap.
   through - but no message data. The inbound journal itself is in the
   database, 0640. Trigger to revisit: a shared host, where the sidecar should
   instead be given the files through a group it shares with the panel.
+- **An application can learn which domains are senders of this server.**
+  A `From:` whose display name or comment names an address at a domain this
+  server signs for is refused; one naming any other domain passes. The reply
+  no longer names the domain (audit 2026-10-12, L8), but refused or passed
+  answers the question for whoever sends the line. Accepted for now: it needs
+  an application of this server, and closing it means refusing every
+  foreign address in a display name, which changes the owner's 2.4.0 rule
+  (a stranger's address in the name passes) - his decision, asked on
+  2026-10-14.
 - ~~**A row of the inbound log belongs to a domain by name.**~~ Struck in
   `2.5.0` (audit 2026-10-12, L12): both logs now hold a domain by id, see
   § Roles.