findings of the reviews of audit stage 2

Technical review (Opus) and security review (Fable) of a59e3d4..cb5a4a2;
reports in the session's scratchpad. Nothing critical, high or medium; no
outright bug. Fixed:

- F2, F3 (0008 backfill, before it runs on the live database): rows are
  filled by the rule new rows follow - the application's domain, then the
  name's - and only by a domain and application that existed when the row
  was written (created_at); the inbound log likewise. Test: the migration's
  UPDATEs re-run on prepared rows (before the domain, after, null sender,
  application gone, a stranger's name). Dry run on a copy of the live
  database: 68/68 and 10/10 rows filled, none disagreeing with its login's
  domain, integrity ok.
- V2, F4: an application's statistics and level-2 count are its login's
  rows of its domain (appByLogin), and StatsWindow starts no earlier than
  the entity's creation; the message page's "may send as" only for a login
  still of the row's domain. Test: a login taken again in another domain
  starts at zero.
- F7: MAIL FROM:<> is held to the domain limit of its login
  (ApplicationByLogin fills DomainName).
- V3: an imported DKIM selector is held to DNS labels (validate.Selector).
- F5, F6: an imported auto limit's numbers are dropped and recalculated
  right after the import; its mode is stored trimmed.
- V6: the store refuses a role that is neither global nor domain.
- F9: SaveUser keeps the stored hash when no new password is given (the
  form no longer writes back the hash it read). F10: a reach naming a
  domain deleted meanwhile is ErrNoSuchDomain, answered on the form.
- V4, F12: from-lines-other.txt - lines naming another sender ({other}) in
  a quoted string, a quoted pair, capitals, a comment, an encoded word, a
  quoted local part; the unit test wants each refused, the e2e
  (lines_naming_another_sender_never_signed_for_it) wants each refused and
  none signed for it. The passed list gained a.{DOMAIN}, a comment after
  the angle address, a quoted local part, and "b@ {other}" - passed by
  design (security.md), and the e2e shows it signed for the own domain.
- F13: e2e login_in_other_capitals_does_not_authenticate - AUTH with the
  login upper-cased gets 535.

Not changed, written down: V1/F1 - L8 is half closed (refused or passed
still tells an application which domains are hosted here); security.md's
accepted risks and the CHANGELOG say so, and the owner is asked whether to
refuse every foreign address in a display name (changes the 2.4.0 rule).
F11 - deleting a domain rewrites its rows' domain_id (seconds at 1e5 rows),
accepted at this size. F8 (test cannot tell write-first from read-first;
the reviewer verified it with two stores, 30/30), V5, V7, P2: noted.

Evidence on the test server for this tree: go vet clean, go test ./... 23
packages ok, make e2e exit 0 with the three new cases.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/users.go

@@ -16,6 +16,10 @@ var ErrUserNotFound = errors.New("user not found")
 // ErrUserExists is returned when a username is already taken.
 var ErrUserExists = errors.New("username already taken")
 
+// ErrNoSuchDomain is returned when a user is assigned a domain that does not
+// exist - one deleted while the users form was open.
+var ErrNoSuchDomain = errors.New("an assigned domain does not exist")
+
 // ErrLastGlobal is returned when deleting or demoting the last global user.
 var ErrLastGlobal = errors.New("cannot remove last global administrator")
 
@@ -225,7 +229,8 @@ func (s *Store) CreateUser(username, passwordHash string, role Role, reach Reach
 }
 
 // UserChange is everything the users form sets on a user, written at once by
-// AddUser and SaveUser. ID is ignored by AddUser.
+// AddUser and SaveUser. ID is ignored by AddUser; SaveUser keeps the stored
+// password hash when PasswordHash is empty.
 type UserChange struct {
 	ID                            int64
 	Username, PasswordHash, Email string
@@ -238,6 +243,9 @@ type UserChange struct {
 // and a failure part way leaves no user rather than one without it (audit
 // 2026-10-12, M9).
 func (s *Store) AddUser(c UserChange) (int64, error) {
+	if err := knownRole(c.Role); err != nil {
+		return 0, err
+	}
 	if c.Role == RoleDomain && c.Reach.Empty() {
 		return 0, ErrEmptyReach
 	}
@@ -282,6 +290,9 @@ func (s *Store) AddUser(c UserChange) (int64, error) {
 // after the write, so two administrators demoting each other at once cannot
 // both succeed (M7).
 func (s *Store) SaveUser(c UserChange) error {
+	if err := knownRole(c.Role); err != nil {
+		return err
+	}
 	if c.Role == RoleDomain && c.Reach.Empty() {
 		return ErrEmptyReach
 	}
@@ -292,8 +303,10 @@ func (s *Store) SaveUser(c UserChange) error {
 	defer tx.Rollback()
 	// A write first: it takes the write lock, so what is counted below is
 	// what is committed.
+	// An empty hash keeps the stored one: the form read it when it was
+	// opened, and the user may have changed it on Account since.
 	res, err := tx.Exec(
-		"UPDATE users SET username = ?, password_hash = ?, email = ?, role = ? WHERE id = ?",
+		"UPDATE users SET username = ?, password_hash = COALESCE(NULLIF(?, ''), password_hash), email = ?, role = ? WHERE id = ?",
 		c.Username, c.PasswordHash, c.Email, c.Role, c.ID,
 	)
 	if err != nil {
@@ -321,6 +334,15 @@ func (s *Store) SaveUser(c UserChange) error {
 	return nil
 }
 
+// knownRole refuses a role that is neither global nor domain. The handlers
+// check the form first; this is the second line.
+func knownRole(r Role) error {
+	if r != RoleGlobal && r != RoleDomain {
+		return fmt.Errorf("unknown role %q", r)
+	}
+	return nil
+}
+
 // requireAGlobal is ErrLastGlobal when the transaction has left no global
 // user.
 func requireAGlobal(tx *sql.Tx) error {
@@ -510,6 +532,9 @@ func writeUserReach(tx *sql.Tx, userID int64, reach Reach) error {
 	if !reach.AllDomains {
 		for _, id := range reach.DomainIDs {
 			if _, err := tx.Exec("INSERT INTO user_domains (user_id, domain_id) VALUES (?, ?)", userID, id); err != nil {
+				if isForeignKeyViolation(err) {
+					return ErrNoSuchDomain
+				}
 				return fmt.Errorf("set user reach insert: %w", err)
 			}
 		}
@@ -517,6 +542,9 @@ func writeUserReach(tx *sql.Tx, userID int64, reach Reach) error {
 	if !reach.AllInbound {
 		for _, id := range reach.InboundDomainIDs {
 			if _, err := tx.Exec("INSERT INTO user_inbound_domains (user_id, inbound_domain_id) VALUES (?, ?)", userID, id); err != nil {
+				if isForeignKeyViolation(err) {
+					return ErrNoSuchDomain
+				}
 				return fmt.Errorf("set user reach insert inbound: %w", err)
 			}
 		}