sender check: connections and messages counted apart; downtime estimated when supervisord is silent (stage 2b)

Following the design commit df96690.

- Two columns (owner, 2026-10-14): sender_check_days.messages (migration
  0009, not deployed) holds the messages deferred mid-message, from
  cleanup's warning; deferred stays the connections smtpd turned away.
  AddSenderCheckDeferred takes which; the counter passes cleanup's as a
  message. The card has "Connections turned away" and "Messages deferred";
  it warns on either within 24 hours (one mark, as before).
- Supervisord silent at start: postfixStarted asks again every 2 s for 30 s
  (postfixState: started, running, known). With no answer the downtime is
  the time since the alive mark - an upper bound - booked with estimated = 1
  (sender_check_days.estimated, MAX over a day); the card prefixes such a
  period's time with "≈ " and its note says what ≈ means. Before, such a
  start counted nothing and the number the owner decides by read low.
- Help topic sender-check and the log topic word for word as the mockup
  (help.go).

Tests: store (connections and messages apart, a period with an estimated
day); logtail (cleanup's warnings are messages); cmd/panel (supervisord
silent: the time since the mark, estimated); view fixture and the Health
page at four columns with ≈; e2e reads the row's two counts (panel down:
connections; panel hung: messages). Schema at 0009 with the columns.

schema-migrations row 9, CHANGELOG [Unreleased], audit plan lines ticked
(two), roadmap 28/62.
Evidence: go vet ./... clean; go test of store, view, cmd/panel ok locally,
logtail but for the Windows-only test; the server run follows before the
push.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/sendercheck_test.go

@@ -39,16 +39,16 @@ func TestSenderCheckStats(t *testing.T) {
 			t.Fatal(err)
 		}
 	}
-	must(st.AddSenderCheckDown(now, 3*time.Second))
-	must(st.AddSenderCheckDown(now, 1500*time.Millisecond)) // whole seconds: one
-	must(st.AddSenderCheckDown(now, 400*time.Millisecond))  // nothing
-	must(st.AddSenderCheckDeferred(now.Add(-time.Hour), 2, ""))
-	must(st.AddSenderCheckDown(day(10), 30*time.Second))
-	must(st.AddSenderCheckDeferred(day(10), 1, ""))
-	must(st.AddSenderCheckDown(day(29), time.Minute))
-	must(st.AddSenderCheckDown(day(30), time.Hour)) // the 31st day back: the year's only
-	must(st.AddSenderCheckDeferred(day(200), 5, ""))
-	must(st.AddSenderCheckDown(day(365), 24*time.Hour)) // a year and a day: nobody's
+	must(st.AddSenderCheckDown(now, 3*time.Second, false))
+	must(st.AddSenderCheckDown(now, 1500*time.Millisecond, false)) // whole seconds: one
+	must(st.AddSenderCheckDown(now, 400*time.Millisecond, false))  // nothing
+	must(st.AddSenderCheckDeferred(now.Add(-time.Hour), 2, "", false))
+	must(st.AddSenderCheckDown(day(10), 30*time.Second, false))
+	must(st.AddSenderCheckDeferred(day(10), 1, "", false))
+	must(st.AddSenderCheckDown(day(29), time.Minute, false))
+	must(st.AddSenderCheckDown(day(30), time.Hour, false)) // the 31st day back: the year's only
+	must(st.AddSenderCheckDeferred(day(200), 5, "", false))
+	must(st.AddSenderCheckDown(day(365), 24*time.Hour, false)) // a year and a day: nobody's
 
 	got, err = st.SenderCheckStats(now)
 	if err != nil {
@@ -118,10 +118,10 @@ func TestRefusedRowKeepsItsReason(t *testing.T) {
 func TestSenderCheckDeferredSavesItsPlace(t *testing.T) {
 	st := openTestStore(t)
 	later := time.Date(2026, 10, 14, 12, 0, 1, 0, time.UTC)
-	if err := st.AddSenderCheckDeferred(later, 1, "abc:1.2@100"); err != nil {
+	if err := st.AddSenderCheckDeferred(later, 1, "abc:1.2@100", false); err != nil {
 		t.Fatal(err)
 	}
-	if err := st.AddSenderCheckDeferred(later.Add(-time.Hour), 1, "abc:1.2@200"); err != nil {
+	if err := st.AddSenderCheckDeferred(later.Add(-time.Hour), 1, "abc:1.2@200", false); err != nil {
 		t.Fatal(err)
 	}
 	if p, err := st.SenderCheckCountedPlace(); err != nil || p != "abc:1.2@200" {
@@ -131,3 +131,29 @@ func TestSenderCheckDeferredSavesItsPlace(t *testing.T) {
 		t.Fatalf("last deferral = %s, %v; want %s", at, err, later)
 	}
 }
+
+// Connections turned away and messages deferred in the middle are counted
+// apart (the owner, 2026-10-14), and a period holding a day whose downtime is
+// an estimate says so.
+func TestSenderCheckCountsConnectionsAndMessagesApart(t *testing.T) {
+	st := openTestStore(t)
+	now := time.Date(2026, 10, 14, 12, 0, 0, 0, time.UTC)
+	must := func(err error) {
+		t.Helper()
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	must(st.AddSenderCheckDeferred(now, 3, "", false))
+	must(st.AddSenderCheckDeferred(now, 1, "", true))
+	must(st.AddSenderCheckDown(now.AddDate(0, 0, -3), 20*time.Second, true))
+	must(st.AddSenderCheckDown(now.AddDate(0, 0, -3), 5*time.Second, false))
+	got, err := st.SenderCheckStats(now)
+	must(err)
+	if got.Today.Deferred != 3 || got.Today.Messages != 1 || got.Today.Estimated {
+		t.Errorf("today = %+v, want 3 connections, 1 message, not estimated", got.Today)
+	}
+	if got.Month.Down != 25*time.Second || !got.Month.Estimated {
+		t.Errorf("the month = %+v, want 25 s, estimated", got.Month)
+	}
+}