The lines under "Doc and comment drift" that the findings' own commits
did not already fix:
- security.md: a newer confirmation link replaces the older, a reset link
is not replaced; html/template renders every page (no themes); the
container keeps eight capabilities, named, not "KILL".
- architecture.md: ImportKey writes over a name's key, as an import must;
the error text reaches the browser on the Backup page's import refusal.
- guide: with Caddy the key is in Caddy's data, so a full backup refuses
until certs/ holds a copy (or back up caddy-data).
- comments: sasldb2 holds application passwords in the clear (store,
app/password.go); texthash folds ASCII (sender.go); the supervisor
socket's group is supervisor (rpc.go); cert-reload's OpenSSL measurement
was 3.0.x of bookworm; sendReset's limits (links.go).
Migration 0013's comment stays as shipped.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mixandClaude Opus 5.5
08087795cd