health: sockets dialled, the certificate Postfix serves, "deferred" only for the queue

Audit 2026-10-12, stage 2c, "Health says what is served"; the pages of
ea8b6bf's mockup.

Sockets (A-38). A unix socket's file outlives a killed OpenDKIM or panel
and refuses every connect() (unix(7)); Health said "Listening" from a
stat. CheckSocket and CheckMilter's unix case now dial: refused is
"Nothing listens on the ... socket: the program that made it has
stopped", EACCES is unknown (the panel may not connect), anything else
"does not answer". The probe closes before a byte, which no milter logs:
libmilter takes the EOF as SMFIC_EOF without a line (sendmail
8.17.1.9-2+deb12u2, the image's libmilter1.0.1, libmilter/comm.c
mi_rd_cmd(), engine.c mi_engine() - its source is now in dev/upstream),
OpenDKIM's mlfi_close() has no connection to free, go-milter v0.4.1
returns quietly on io.EOF (session.go, HandleMilterCommands()). The page
polls every 5 s while in view, so this mattered.

Certificate (A-65). Postfix serves build/postfix-config.sh's copy,
refreshed by cert-reload every TLS_RELOAD_INTERVAL_SECONDS. The panel now
reads smtpd_tls_cert_file from postconf -h at its start (as the retry
policy) and TLS_RELOAD_INTERVAL_SECONDS; CheckServedCertificate checks the
served copy and, when the mounted file differs byte for byte (cert-reload's
own cmp -s), names it as Renewal: its expiry and mtime, two facts on the
card. Waiting is fine for the interval: a nearing expiry of the served one
is then no warning (an expiry still an error); past interval + 1 h it is a
warning pointing at cert-reload's lines. The notifier sends no expiry
notice while a renewal waits on time.

Wording (D-P1, D-P3, and the same for the spam filter): Sender check
note, help topics sender-check, upstream, filter, certificate - word for
word as in the mockup; the filter row's detail too.

Tests: stale socket file (Linux) refused for CheckSocket and CheckMilter;
CheckServedCertificate (same, waiting, late, expired + waiting, no served
path); intervalText; the card's facts; the notifier quiet while a renewal
waits, speaking once it is late. Stand (2026-10-15, make e2e, exit 0):
new health_shows_what_is_served - the three sockets dialled ok by the
panel's user; a certificate mounted without its key is refused by
cert-reload ("do not belong together") and the card shows the served
expiry, "Renewal expires" with the mounted one's, "Renewal mounted", and
"Postfix still serves the certificate above."; a matching pair is then
served again. go vet and go test ./... pass on the server (24 packages).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/health/health_test.go

@@ -10,6 +10,7 @@ import (
 	"net"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 )
@@ -213,3 +214,77 @@ func TestUptime(t *testing.T) {
 		}
 	}
 }
+
+// The certificate shown is the one Postfix serves; a different mounted file is
+// a renewal waiting, a warning once it waited past cert-reload's interval
+// (assumptions A-65).
+func TestCheckServedCertificate(t *testing.T) {
+	dir := t.TempDir()
+	served := filepath.Join(dir, "served.pem")
+	mounted := filepath.Join(dir, "mounted.pem")
+	day := 24 * time.Hour
+
+	// The same file: nothing waits.
+	writeCert(t, served, "mail.example.com", 60*day)
+	b, _ := os.ReadFile(served)
+	if err := os.WriteFile(mounted, b, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if got := CheckServedCertificate(served, mounted, day, time.Now()); got.Status != StatusOK || got.Renewal != nil || got.Path != served {
+		t.Errorf("same certificate: %+v", got)
+	}
+
+	// Postfix's copy nears its end, a renewal was mounted an hour ago: no
+	// warning, the renewal named.
+	writeCert(t, served, "mail.example.com", 5*day)
+	writeCert(t, mounted, "mail.example.com", 90*day)
+	now := time.Now()
+	if err := os.Chtimes(mounted, now.Add(-time.Hour), now.Add(-time.Hour)); err != nil {
+		t.Fatal(err)
+	}
+	got := CheckServedCertificate(served, mounted, day, now)
+	if got.Status != StatusOK || got.Renewal == nil || got.Renewal.Late || got.DaysLeft > 5 {
+		t.Fatalf("renewal waiting: %+v", got)
+	}
+	if !strings.Contains(got.Detail, "at most a day after it was mounted") {
+		t.Errorf("renewal waiting, detail: %q", got.Detail)
+	}
+	if d := got.Renewal.NotAfter.Sub(now); d < 89*day {
+		t.Errorf("the renewal's expiry is the mounted certificate's: %v", d)
+	}
+
+	// Waiting past the interval and an hour: a warning, cert-reload named.
+	if err := os.Chtimes(mounted, now.Add(-26*time.Hour), now.Add(-26*time.Hour)); err != nil {
+		t.Fatal(err)
+	}
+	got = CheckServedCertificate(served, mounted, day, now)
+	if got.Status != StatusWarn || got.Renewal == nil || !got.Renewal.Late || !strings.Contains(got.Detail, "cert-reload") {
+		t.Errorf("renewal late: %+v", got)
+	}
+
+	// The served one expired: still an error, the renewal said to be coming.
+	writeCert(t, served, "mail.example.com", -day)
+	if err := os.Chtimes(mounted, now, now); err != nil {
+		t.Fatal(err)
+	}
+	got = CheckServedCertificate(served, mounted, day, now)
+	if got.Status != StatusError || got.Renewal == nil || !strings.Contains(got.Detail, "A renewed one is waiting") {
+		t.Errorf("expired, renewal waiting: %+v", got)
+	}
+
+	// No served path known: the mounted file, as before.
+	if got := CheckServedCertificate("", mounted, day, now); got.Path != mounted || got.Renewal != nil {
+		t.Errorf("served path unknown: %+v", got)
+	}
+}
+
+func TestIntervalText(t *testing.T) {
+	for d, want := range map[time.Duration]string{
+		24 * time.Hour: "a day", 48 * time.Hour: "2 days", time.Hour: "an hour",
+		6 * time.Hour: "6 hours", 2 * time.Second: "2 seconds", 90 * time.Minute: "90 minutes",
+	} {
+		if got := intervalText(d); got != want {
+			t.Errorf("intervalText(%v) = %q, want %q", d, got, want)
+		}
+	}
+}