findings of the reviews of audit stage 2b

Technical review (Opus) and security review (Fable) of 5be109b..5154bba;
reports in the session's scratchpad. Nothing above low from security; one
bug and three risks from the technical review. Migration 0009 is not
deployed, so it was extended.

- Bug: two refusals of one second swapped their NOQUEUE lines (each line
  went to the newest lineless row). AttachRefusalLine now matches the
  client address too (send_log.client_ip, written by the journal milter -
  Postfix's line names the client and the sender, never the login: the
  sasl_username part of the pattern never matched and could be fed by HELO,
  security F1/F2), takes the nearest row in time and the oldest of equals,
  and a line already on a row goes on no other (security F6).
- Waiting lines and recoveries lived only in memory while the saved offset
  moved past them: a stop within 30 s lost them. The tracker now never saves
  an offset past the oldest waiting item in its file (tracker.hold,
  refusalLines.oldest) - for a recovery, the client= line that names its
  login - so they are read again; the "once" guards make that harmless.
- A recovered row whose login the tailer did not see was nobody's: its
  domain_id falls back to the envelope domain's.
- The fingerprint's file identity is the inode alone: the device number can
  change across a host reboot and make the same log look rotated.
- A refused row carries its queue id; UpdateStatus's "newest row" now skips
  refused rows, so a later message with that id does not flip it to sent.
- The alive mark: its age is read first and kept from then on, so asking
  supervisord for 30 s cannot make it stale; the entrypoint removes it with
  the sockets - a container restart is not the check's downtime, and a mark
  from before would have counted the whole outage as "≈".
- Security F3: the sender check prints no ";" of the client's in the From:
  text of its reply, and the tailer reads the envelope after the first ";"
  - Postfix's own text.
- A refused row with a queue id and no stored lines says so (it was told the
  mail.log text of 2.2.0); the fact's em dash is the house hyphen.
- Docs: architecture (client address, no login), guide § Health (warns on
  either count), help topics log and sender-check (design 1ca87f2).
- e2e: refusals_show_postfixs_line wants the refusal's own sender in the
  line; refusal_recovered_from_the_log waits past the tailer's 30 s and
  checks that a refusal the panel wrote got no recovered twin.

Not changed, written down: review 9 (mail.log.1 read to its end at that
moment; postlogd may still write to it until the reload), 10 (a log under
512 bytes has no fingerprint, so places fall back to time briefly after a
rotation), 6 (a 451 at MAIL FROM of another milter reads the same - the
client and sender must match too now), security F5/F12 (info). Review 12:
the refused and closed-by-the-panel variants of out-message were shown to
the owner as pictures of the real templates, not drawn in out-message.html:
the guard ties every drawn screen to a page of the engine, and a variant
has the page's outline.

Evidence on the test server for this tree: go vet clean, go test ./... 23
packages ok, make e2e exit 0 (refusal_recovered_from_the_log 70 s).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/panel/sendercheck.go

@@ -33,13 +33,21 @@ func serveSenderCheck(ctx context.Context, cfg config, st *store.Store) error {
 	// Statistics are the database's business and supervisord's, and the check
 	// is neither: they are kept beside it, and nothing of them is waited for
 	// before it serves.
+	now := time.Now()
+	mark := cfg.senderSocket + ".alive"
+	// The mark's age is read before the mark is kept again: asking supervisord
+	// may take half a minute, and the mark must not go stale meanwhile, or a
+	// restart in that half minute would count it as downtime.
+	var markAt time.Time
+	if fi, err := os.Stat(mark); err == nil {
+		markAt = fi.ModTime()
+	}
+	go keepAlive(ctx, mark, st)
 	go func() {
-		now := time.Now()
-		mark := cfg.senderSocket + ".alive"
 		if err := st.StartSenderCheckStats(now); err != nil {
 			log.Printf("sender-check: statistics: %v", err)
 		}
-		if down, estimated := senderCheckDowntime(mark, now, postfixStarted); down > 0 {
+		if down, estimated := senderCheckDowntime(markAt, now, postfixStarted); down > 0 {
 			if estimated {
 				log.Printf("sender-check: was not answering for at most %s (supervisord did not say since when Postfix ran)", down.Round(time.Second))
 			} else {
@@ -51,7 +59,6 @@ func serveSenderCheck(ctx context.Context, cfg config, st *store.Store) error {
 				}
 			}
 		}
-		keepAlive(ctx, mark, st)
 	}()
 
 	// The two tables the mail path itself goes by: whom Postfix lets send as
@@ -69,19 +76,19 @@ type postfixState struct {
 }
 
 // senderCheckDowntime is for how long the check was not serving before now
-// while Postfix was: the time since the mark at path was last set, or since
+// while Postfix was: the time since the mark was last set (markAt; zero
+// when there is none), or since
 // Postfix started if that was later. No mark means the container is new, and
 // a Postfix that is not running means mail was stopped for another reason -
 // a rollout, a reboot - and neither is the check's downtime. When supervisord
 // could not say, the time since the mark is taken and estimated is true: an
 // upper bound, since Postfix may not have been running all of it (audit
 // 2026-10-12, stage 2b - until then such a start counted nothing).
-func senderCheckDowntime(path string, now time.Time, ask func() postfixState) (down time.Duration, estimated bool) {
-	fi, err := os.Stat(path)
-	if err != nil {
+func senderCheckDowntime(markAt, now time.Time, ask func() postfixState) (down time.Duration, estimated bool) {
+	if markAt.IsZero() {
 		return 0, false
 	}
-	from := fi.ModTime()
+	from := markAt
 	p := ask()
 	switch {
 	case !p.known: