dmarc-day, health-sockets: the reporter's day said; the inbound journal dialled

The owner, 2026-10-17: "Показ времени отчёта по UTC принимаем. Это не
проблема. Пояснения добавь. Все мелочи закрой." Designs 9b33b80, 2bf9056.

DMARC: a report's day stays the reporter's, in UTC (RFC 7489 § 7.2); the
report's Window now says so under its times (windowNote), and Settings'
Time zone box and Help (#settings, #dmarc) name it as the one exception to
the panel's zone. formatDMARCWindow counts a window that ends at midnight
as ending the day before, so a daily report is one day, not "20 Sep - 21
Sep" (TestDMARCWindowIsTheReportersDay, in Moscow's zone).

Health: with the inbound relay on, the inbound journal milter's socket is
dialled (InboundJournalSocket through web and handlers Config), fail-open
as the send log's, and Overview's card counts it; the send log's socket is
named journal-milter, as the mockup names it.

The confirmation link's sign-in state is drawn (confirm-email-signin.html);
the panel already renders it.

guide: /license and /server/components, the DMARC pages' paths and day,
selfpost-backup -o / -i / -version, the Inbound log's retention field,
PANEL_COOKIE_SECURE, the inbound journal's socket, the DMARC exception to
the zone. CHANGELOG [Unreleased].

(The e2e case negative_level1_ratelimit, listed as able to pass falsely,
was fixed on 2026-10-14 - the note was stale.)

go vet + go test (26 packages) and make e2e on the test server for this
tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/handlers/handlers_status.go

@@ -572,7 +572,12 @@ func (h *Handlers) healthChecks() healthReadings {
 		signerSocket(h.cfg.SignSocket, "applications"),
 		signerSocket(h.cfg.SignLocalSocket, "notifications"),
 		health.CheckSocket("sender-check", h.cfg.SenderSocket, true),
-		health.CheckSocket("send-log", h.cfg.JournalSocket, false),
+		health.CheckSocket("journal-milter", h.cfg.JournalSocket, false),
+	}
+	// The inbound journal writes Inbound › Log, fail-open as the outbound
+	// one: dialled while there is an inbound relay to journal.
+	if h.cfg.InboundEnabled {
+		sockets = append(sockets, health.CheckSocket("inbound-journal-milter", h.cfg.InboundJournalSocket, false))
 	}
 	if on, milter, action := h.inboundFilter(); on {
 		sockets = append(sockets, filterSocket(milter, action))