feat(cover): acquire a Series Cover at creation (#59)

A Reader who bookmarks a Series nobody holds yet no longer waits out the
poll queue for its artwork: the first Bookmark to create a Series fires
Store.OnSeriesCreated, and latest.Acquirer turns that into a single
series-page fetch yielding both the Latest Chapter and the cover URL. The
bytes are fetched through the gated cover fetcher and stored
content-addressed, so the wire carries an absolute URL on this
deployment's own origin (ADR-0007) - never a third-party address and
never one that 404s.

- series.cover_address (migration 0009) splits the third-party source
  address the bytes came from (series.cover) from the content address
  they are stored under. A blank cover_address is what "no Cover yet"
  means, so the wire field is empty until real bytes exist.
- GET /covers/{address} serves the bytes publicly and uncredentialed,
  immutable-cached; the address is gated by a 64-hex pattern and
  cross-checked against a pure function of itself before any filesystem
  read.
- Client-sent cover values are decoded and discarded permanently: the
  cover columns are absent from Upsert's INSERT and its DO UPDATE, so no
  request value can reach the shared Series row (extends ADR-0003's
  "ignored after creation" to "ignored always", keeps ADR-0004's flat
  wire so installed userscripts keep working).
- Acquisition is asynchronous and log-and-drop: the Reader's write
  neither blocks on nor fails with a third-party Site. It is bounded by
  a two-slot semaphore, cancelled at shutdown, and stamps
  latest_checked_at so the poller does not refetch the same page a tick
  later.
- store.CoverContentType canonicalises comix's non-standard "image/jpg"
  to "image/jpeg", so one image cannot land under two spellings.
- PUBLIC_BASE_URL is a new required setting; Open rejects anything that
  is not an absolute http(s) origin, since a bare hostname would start
  cleanly and emit addresses no browser can load.

Verified against a live backend: bookmarking a comix series produced a
280x420 JPEG served from /covers/<sha256> with the immutable cache
header, and the web UI card renders that address.

backend/internal/latest/acquire.go

@@ -0,0 +1,136 @@
+package latest
+
+import (
+	"context"
+	"log"
+	"slices"
+	"sync"
+	"time"
+
+	"bookmarkmanager/backend/internal/store"
+)
+
+// acquireTimeout bounds one creation-time acquisition end to end: the series
+// page plus the cover bytes. Nothing is waiting on it — the Reader's write has
+// already returned — so this only stops a stalled Site from holding a
+// goroutine and a connection open forever.
+const acquireTimeout = 45 * time.Second
+
+// Acquirer gives a Series its Latest Chapter and its Cover the moment the
+// first Bookmark creates it, instead of leaving the Reader to wait out the
+// poll queue — which is ordered by Reader count, so a Series with one Reader
+// sits behind every popular one (ADR-0007).
+//
+// Both facts come from a single series-page fetch, which is also why no
+// client-supplied cover hint is worth accepting: the page has to be fetched
+// for the chapter signal regardless, so a hint would save no request while
+// adding a client-controlled input to a server-side fetch.
+//
+// Every failure path is "log and move on". The Bookmark, its progress and its
+// Latest Chapter are already committed; a Site that is down or a Cover that
+// cannot be produced must not disturb any of them, and the Series is simply
+// left blank until the poll's own cover pass (#61) fills it.
+type Acquirer struct {
+	Store *store.Store
+	// Fetch retrieves the series page. Nil disables acquisition entirely.
+	Fetch Fetcher
+	// Covers retrieves the cover bytes. Nil leaves the Cover blank and the
+	// chapter half working.
+	Covers CoverBytesFetcher
+	// Ctx cancels in-flight acquisitions at shutdown. A hook signature has
+	// nowhere to pass one, so it lives here; nil means context.Background.
+	Ctx context.Context
+
+	inflight sync.WaitGroup
+}
+
+// acquireSlots caps how many creation-time fetches run at once. A Reader whose
+// userscript bulk-syncs creates many Series at once, and a burst of
+// simultaneous requests from one server IP is the traffic shape most likely to
+// move that IP's bot score — the same reason the poller staggers its batch.
+var acquireSlots = make(chan struct{}, 2)
+
+// Acquire starts one acquisition and returns immediately: a Reader's bookmark
+// action may not block on a third-party Site's latency, nor fail with it. It
+// is the store's OnSeriesCreated hook, so it only ever runs for a Series no
+// Reader had bookmarked before.
+func (a *Acquirer) Acquire(sr store.Series) {
+	a.inflight.Add(1)
+	go func() {
+		defer a.inflight.Done()
+		defer func() {
+			if r := recover(); r != nil {
+				log.Printf("acquire %q: recovered from panic: %v", sr.Key(), r)
+			}
+		}()
+		parent := a.Ctx
+		if parent == nil {
+			parent = context.Background()
+		}
+		select {
+		case acquireSlots <- struct{}{}:
+			defer func() { <-acquireSlots }()
+		case <-parent.Done():
+			return
+		}
+		ctx, cancel := context.WithTimeout(parent, acquireTimeout)
+		defer cancel()
+		a.acquire(ctx, sr)
+	}()
+}
+
+// Wait blocks until every started acquisition has finished. It exists for
+// tests: an asynchronous side effect is otherwise unobservable without
+// polling for it.
+func (a *Acquirer) Wait() { a.inflight.Wait() }
+
+func (a *Acquirer) acquire(ctx context.Context, sr store.Series) {
+	// Browser-backed Sites are deliberately not acquired here: their pages
+	// only yield a Cloudflare challenge to the TLS client, so the request
+	// would be spent for nothing.
+	if a.Fetch == nil || slices.Contains(browserBackedSites, sr.Site) {
+		return
+	}
+	// series_url arrives in a client-supplied PUT body, so the same gate the
+	// poller uses applies here — without it a token-holder chooses what the
+	// server fetches from its own network position.
+	if !fetchableSeriesURL(sr.Site, sr.SeriesURL) {
+		log.Printf("acquire %q: not fetchable: site=%q url=%q", sr.Key(), sr.Site, sr.SeriesURL)
+		return
+	}
+
+	body, status, err := a.Fetch.Get(ctx, sr.SeriesURL)
+	if err != nil {
+		log.Printf("acquire %q: fetch %s: %v", sr.Key(), sr.SeriesURL, err)
+		return
+	}
+	if status != 200 {
+		log.Printf("acquire %q: fetch %s: status %d", sr.Key(), sr.SeriesURL, status)
+		return
+	}
+
+	// This page just served the same purpose a poll tick would have; without
+	// the stamp the row stays due and the poller refetches it immediately.
+	if err := a.Store.MarkLatestChecked(sr.Site, sr.SeriesID, time.Now().UnixMilli()); err != nil {
+		log.Printf("acquire %q: mark checked: %v", sr.Key(), err)
+	}
+
+	if latest, ok := latestChapterFrom(sr.Site, sr.SeriesURL, body); ok {
+		if err := a.Store.SetLatestChapter(sr.Site, sr.SeriesID, latest.Label, latest.Num); err != nil {
+			log.Printf("acquire %q: set latest chapter: %v", sr.Key(), err)
+		}
+	}
+
+	cover, ok := coverFrom(sr.Site, sr.SeriesURL, body)
+	if !ok || a.Covers == nil {
+		return
+	}
+	bytes, contentType, err := a.Covers.Fetch(ctx, cover)
+	if err != nil {
+		log.Printf("acquire %q: fetch cover %s: %v", sr.Key(), cover, err)
+		return
+	}
+	if err := a.Store.SetSeriesCover(sr.Site, sr.SeriesID, cover, bytes, contentType); err != nil {
+		log.Printf("acquire %q: persist cover: %v", sr.Key(), err)
+	}
+}

backend/internal/latest/acquire_test.go

@@ -0,0 +1,239 @@
+package latest
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"bookmarkmanager/backend/internal/store"
+)
+
+// The series page carries both facts, which is the whole argument for taking
+// them from one fetch.
+const asuraSeriesAndCoverFixture = asuraSeriesFixture + asuraCoverFixture
+
+const (
+	acquireKey       = "asura:chronicles-of-the-demon-faction-f886a8af"
+	acquireSeriesID  = "chronicles-of-the-demon-faction-f886a8af"
+	acquireSeriesURL = "https://asurascans.com/comics/chronicles-of-the-demon-faction-f886a8af"
+	acquireCoverURL  = "https://cdn.asurascans.com/asura-images/covers/chronicles-of-the-demon-faction.d4dcb8.webp"
+)
+
+// newAcquirer wires an acquirer onto the store's creation hook, which is how
+// main wires it: the write path is what starts an acquisition.
+func newAcquirer(s *store.Store, page *fakeFetcher, covers *fakeBytesCoverFetcher) *Acquirer {
+	a := &Acquirer{Store: s, Fetch: page, Covers: covers}
+	s.OnSeriesCreated = a.Acquire
+	return a
+}
+
+func bookmarkNewSeries(t *testing.T, s *store.Store, seriesURL string) store.Bookmark {
+	t.Helper()
+	stored, err := s.Upsert(s.OwnerID(), store.Bookmark{
+		Key: acquireKey, Site: "asura", SeriesID: acquireSeriesID,
+		Title: "Chronicles of the Demon Faction", SeriesURL: seriesURL,
+		Cover: "https://evil.example/client-supplied.jpg", UpdatedAt: 1000,
+	})
+	if err != nil {
+		t.Fatalf("Upsert: %v", err)
+	}
+	return stored
+}
+
+func readBookmark(t *testing.T, s *store.Store, key string) store.Bookmark {
+	t.Helper()
+	b, ok, err := s.Get(s.OwnerID(), key)
+	if err != nil || !ok {
+		t.Fatalf("Get %q = %v, %v", key, ok, err)
+	}
+	return b
+}
+
+// The reported bug: a Reader bookmarks a Series nobody holds and expects the
+// Cover, not a broken image. Both facts come from the one series-page fetch.
+func TestAcquireFillsChapterAndCoverFromOneFetch(t *testing.T) {
+	s, _ := newTestStore(t)
+	page := &fakeFetcher{body: asuraSeriesAndCoverFixture, status: 200}
+	covers := &fakeBytesCoverFetcher{body: []byte("cover-bytes"), contentType: "image/jpeg"}
+	acq := newAcquirer(s, page, covers)
+
+	// The write itself must not carry the acquisition: it returns before the
+	// Cover exists, and the field is empty until the bytes land.
+	stored := bookmarkNewSeries(t, s, acquireSeriesURL)
+	if stored.Cover != "" {
+		t.Fatalf("Cover on the creating write = %q, want empty", stored.Cover)
+	}
+	acq.Wait()
+
+	if got := page.callCount(); got != 1 {
+		t.Fatalf("series page fetches = %d, want exactly 1", got)
+	}
+	if got := covers.callCount(); got != 1 {
+		t.Fatalf("cover fetches = %d, want 1", got)
+	}
+	got := readBookmark(t, s, acquireKey)
+	if got.LatestChapterNum == nil || *got.LatestChapterNum != 181 {
+		t.Fatalf("LatestChapterNum = %v, want 181", got.LatestChapterNum)
+	}
+	if want := testCoverBaseURL + "/covers/" + store.CoverAddress(acquireCoverURL); got.Cover != want {
+		t.Fatalf("Cover = %q, want the absolute address %q", got.Cover, want)
+	}
+	body, contentType, ok, err := s.CoverByAddress(store.CoverAddress(acquireCoverURL))
+	if err != nil || !ok {
+		t.Fatalf("CoverByAddress = %v, %v", ok, err)
+	}
+	if string(body) != "cover-bytes" || contentType != "image/jpeg" {
+		t.Fatalf("stored cover = (%q, %q), want the fetched bytes", body, contentType)
+	}
+}
+
+// A Series that already exists is not re-acquired: no fetch, and the Cover it
+// already has is left alone.
+func TestAcquireSkipsAnExistingSeries(t *testing.T) {
+	s, _ := newTestStore(t)
+	page := &fakeFetcher{body: asuraSeriesAndCoverFixture, status: 200}
+	covers := &fakeBytesCoverFetcher{body: []byte("cover-bytes"), contentType: "image/jpeg"}
+	acq := newAcquirer(s, page, covers)
+
+	bookmarkNewSeries(t, s, acquireSeriesURL)
+	acq.Wait()
+	bookmarkNewSeries(t, s, acquireSeriesURL)
+	acq.Wait()
+
+	if got := page.callCount(); got != 1 {
+		t.Fatalf("series page fetches = %d, want 1 — an existing series is not re-acquired", got)
+	}
+	if got := covers.callCount(); got != 1 {
+		t.Fatalf("cover fetches = %d, want 1", got)
+	}
+	got := readBookmark(t, s, acquireKey)
+	if want := testCoverBaseURL + "/covers/" + store.CoverAddress(acquireCoverURL); got.Cover != want {
+		t.Fatalf("Cover = %q, want the acquired one %q", got.Cover, want)
+	}
+}
+
+// A Site that is down costs the Cover and nothing else.
+func TestAcquireFailureLeavesTheBookmarkIntact(t *testing.T) {
+	cases := []struct {
+		name   string
+		page   *fakeFetcher
+		covers *fakeBytesCoverFetcher
+		// wantLatest is the chapter that still lands; 0 means none did.
+		wantLatest float64
+	}{
+		{
+			"the series page is unreachable",
+			&fakeFetcher{err: errors.New("connection reset")},
+			&fakeBytesCoverFetcher{body: []byte("cover-bytes"), contentType: "image/jpeg"},
+			0,
+		},
+		{
+			"the series page answers with a challenge",
+			&fakeFetcher{body: challengeFixture, status: 200},
+			&fakeBytesCoverFetcher{body: []byte("cover-bytes"), contentType: "image/jpeg"},
+			0,
+		},
+		{
+			"only the cover bytes fail",
+			&fakeFetcher{body: asuraSeriesAndCoverFixture, status: 200},
+			&fakeBytesCoverFetcher{err: errors.New("403")},
+			181,
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			s, _ := newTestStore(t)
+			acq := newAcquirer(s, tc.page, tc.covers)
+
+			stored := bookmarkNewSeries(t, s, acquireSeriesURL)
+			acq.Wait()
+
+			got := readBookmark(t, s, acquireKey)
+			if got.Cover != "" {
+				t.Fatalf("Cover = %q, want empty rather than an address that 404s", got.Cover)
+			}
+			if got.Title != stored.Title || got.UpdatedAt != stored.UpdatedAt {
+				t.Fatalf("bookmark = %+v, want it untouched by the failed acquisition", got)
+			}
+			if tc.wantLatest == 0 {
+				if got.LatestChapterNum != nil {
+					t.Fatalf("LatestChapterNum = %v, want none captured", *got.LatestChapterNum)
+				}
+				return
+			}
+			if got.LatestChapterNum == nil || *got.LatestChapterNum != tc.wantLatest {
+				t.Fatalf("LatestChapterNum = %v, want %v", got.LatestChapterNum, tc.wantLatest)
+			}
+		})
+	}
+}
+
+// series_url arrives in a client-supplied body, so the acquisition reuses the
+// poller's gate rather than deriving a second one: a non-https scheme, a
+// site the parsers do not know, or a host pinned to another site is refused
+// before the server spends a request from its own network position.
+func TestAcquireRefusesAnUnfetchableSeriesURL(t *testing.T) {
+	for _, seriesURL := range []string{
+		"http://asurascans.com/comics/x",
+		"file:///etc/passwd",
+		"",
+	} {
+		t.Run(seriesURL, func(t *testing.T) {
+			s, _ := newTestStore(t)
+			page := &fakeFetcher{body: asuraSeriesAndCoverFixture, status: 200}
+			acq := newAcquirer(s, page, &fakeBytesCoverFetcher{})
+
+			bookmarkNewSeries(t, s, seriesURL)
+			acq.Wait()
+
+			if got := page.callCount(); got != 0 {
+				t.Fatalf("fetches for %q = %d, want 0", seriesURL, got)
+			}
+		})
+	}
+}
+
+// blockingFetcher stands in for a Site that never answers, so a synchronous
+// acquisition would be visible as a stalled write rather than a slow one.
+type blockingFetcher struct {
+	release <-chan struct{}
+	body    string
+}
+
+func (f *blockingFetcher) Get(ctx context.Context, _ string) (string, int, error) {
+	select {
+	case <-f.release:
+		return f.body, 200, nil
+	case <-ctx.Done():
+		return "", 0, ctx.Err()
+	}
+}
+
+// The Reader's write may not wait on a third-party Site: with the acquisition
+// wedged on an unanswering page, the PUT still returns.
+func TestAcquireDoesNotBlockTheWrite(t *testing.T) {
+	s, _ := newTestStore(t)
+	release := make(chan struct{})
+	acq := &Acquirer{Store: s, Fetch: &blockingFetcher{release: release, body: asuraSeriesAndCoverFixture}}
+	s.OnSeriesCreated = acq.Acquire
+
+	upserted := make(chan error, 1)
+	go func() {
+		_, err := s.Upsert(s.OwnerID(), store.Bookmark{
+			Key: acquireKey, Site: "asura", SeriesID: acquireSeriesID,
+			Title: "Chronicles of the Demon Faction", SeriesURL: acquireSeriesURL, UpdatedAt: 1000,
+		})
+		upserted <- err
+	}()
+	select {
+	case err := <-upserted:
+		if err != nil {
+			t.Fatalf("Upsert: %v", err)
+		}
+	case <-time.After(10 * time.Second):
+		t.Fatal("the creating write blocked on the acquisition")
+	}
+	close(release)
+	acq.Wait()
+}

backend/internal/latest/cover.go

@@ -123,10 +123,14 @@ func (f *TLSCoverFetcher) Fetch(ctx context.Context, sourceURL string) ([]byte,
 	if resp.StatusCode != http.StatusOK {
 		return nil, "", fmt.Errorf("fetch cover: status %d", resp.StatusCode)
 	}
-	contentType, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
-	if err != nil || !store.IsCoverContentType(contentType) {
+	raw, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+	if err != nil {
 		return nil, "", fmt.Errorf("fetch cover: unsupported content type %q", resp.Header.Get("Content-Type"))
 	}
+	contentType, ok := store.CoverContentType(raw)
+	if !ok {
+		return nil, "", fmt.Errorf("fetch cover: unsupported content type %q", raw)
+	}
 	if resp.ContentLength > maxBodyBytes {
 		return nil, "", fmt.Errorf("fetch cover: response exceeds %d bytes", maxBodyBytes)
 	}

backend/internal/latest/cover_fetch_test.go

@@ -204,3 +204,23 @@ func TestCoverFetcherRejectsNonImage(t *testing.T) {
 		t.Fatalf("network calls = %d, want 1", calls)
 	}
 }
+
+// comix labels its covers "image/jpg", which is not a registered type but is
+// what the Site actually answers with; the bytes are stored under the real
+// name so one image cannot land under two spellings.
+func TestCoverFetcherCanonicalisesJpgAlias(t *testing.T) {
+	client := &http.Client{Transport: roundTripFunc(func(*http.Request) (*http.Response, error) {
+		return coverResponse(http.StatusOK, "image/jpg", "", []byte("cover-bytes")), nil
+	})}
+	fetcher := newCoverFetcher(client, func(context.Context, string) ([]netip.Addr, error) {
+		return []netip.Addr{netip.MustParseAddr("198.51.100.10")}, nil
+	})
+
+	body, contentType, err := fetcher.Fetch(context.Background(), "https://static.comix.to/cover.jpg")
+	if err != nil {
+		t.Fatalf("Fetch: %v", err)
+	}
+	if string(body) != "cover-bytes" || contentType != "image/jpeg" {
+		t.Fatalf("Fetch = (%q, %q), want (cover-bytes, image/jpeg)", body, contentType)
+	}
+}

backend/internal/latest/poller.go

@@ -87,23 +87,26 @@ func (p *Poller) prefetchCover(ctx context.Context, sr store.Series) {
 		}
 		return
 	}
-	if p.CoverBytesFetch == nil {
+	if p.CoverBytesFetch == nil || sr.CoverAddress != "" {
 		return
 	}
-	_, _, found, err := p.Store.GetCover(sr.Cover)
+	// Bytes may already be stored from an earlier poll that ran before the
+	// Series carried an address; storing them again is free (they are
+	// content-addressed and immutable), and the point of the second call is
+	// the address, which is what makes the Cover visible on the wire.
+	body, contentType, found, err := p.Store.GetCover(sr.Cover)
 	if err != nil {
 		log.Printf("latest poll %q: read cover: %v", sr.Key(), err)
 		return
 	}
-	if found {
-		return
+	if !found {
+		body, contentType, err = p.CoverBytesFetch.Fetch(ctx, sr.Cover)
+		if err != nil {
+			log.Printf("latest poll %q: fetch cover: %v", sr.Key(), err)
+			return
+		}
 	}
-	body, contentType, err := p.CoverBytesFetch.Fetch(ctx, sr.Cover)
-	if err != nil {
-		log.Printf("latest poll %q: fetch cover: %v", sr.Key(), err)
-		return
-	}
-	if err := p.Store.PutCover(sr.Cover, body, contentType); err != nil {
+	if err := p.Store.SetSeriesCover(sr.Site, sr.SeriesID, sr.Cover, body, contentType); err != nil {
 		log.Printf("latest poll %q: persist cover: %v", sr.Key(), err)
 	}
 }

backend/internal/latest/poller_test.go

@@ -3,6 +3,7 @@ package latest
 import (
 	"context"
 	"crypto/sha256"
+	"database/sql"
 	"errors"
 	"log"
 	"os"
@@ -21,13 +22,16 @@ func TestMain(m *testing.M) { os.Exit(pgtest.Main(m)) }
 // test needs one, is created by opening the same database as a second owner.
 var testOwner = store.Owner{DiscordID: "test-owner", TokenHash: sha256.Sum256([]byte("owner-token-hash"))}
 
+// testCoverBaseURL is the public origin every stored cover URL is built from.
+const testCoverBaseURL = "https://bookmarks.test"
+
 // newTestStore opens a store on a Postgres database of this test's own and
 // returns the URL, for helpers that need a second connection to the same
 // database (see TestRunOnceFetchesSharedSeriesOnce).
 func newTestStore(t *testing.T) (*store.Store, string) {
 	t.Helper()
 	url := pgtest.URL(t)
-	s, err := store.Open(url, testOwner, t.TempDir())
+	s, err := store.Open(url, testOwner, t.TempDir(), testCoverBaseURL)
 	if err != nil {
 		t.Fatalf("Open: %v", err)
 	}
@@ -168,8 +172,27 @@ func newTestPoller(t *testing.T, s *store.Store, f Fetcher, at time.Time) *Polle
 	}
 }
 
+// seedCoverSource writes a Series' cover source address without any stored
+// bytes. Nothing in production produces that state any more — a client cover
+// is discarded and an acquired one arrives with its bytes — but rows created
+// before covers moved server-side still carry one, and the prefetch is what
+// heals them.
+func seedCoverSource(t *testing.T, dbURL, site, seriesID, coverURL string) {
+	t.Helper()
+	db, err := sql.Open("pgx", dbURL)
+	if err != nil {
+		t.Fatalf("open %s: %v", dbURL, err)
+	}
+	defer db.Close()
+	if _, err := db.Exec(
+		`UPDATE series SET cover = $3 WHERE site = $1 AND series_id = $2`,
+		site, seriesID, coverURL); err != nil {
+		t.Fatalf("seed cover source %s:%s: %v", site, seriesID, err)
+	}
+}
+
 func TestRunOncePrefetchesPublicCover(t *testing.T) {
-	s, _ := newTestStore(t)
+	s, dbURL := newTestStore(t)
 	const (
 		key       = "asura:chronicles-of-the-demon-faction-f886a8af"
 		seriesURL = "https://asurascans.com/comics/chronicles-of-the-demon-faction-f886a8af"
@@ -177,10 +200,11 @@ func TestRunOncePrefetchesPublicCover(t *testing.T) {
 	)
 	if _, err := s.Upsert(s.OwnerID(), store.Bookmark{
 		Key: key, Site: "asura", SeriesID: "chronicles-of-the-demon-faction-f886a8af",
-		SeriesURL: seriesURL, Cover: coverURL, UpdatedAt: 1000,
+		SeriesURL: seriesURL, UpdatedAt: 1000,
 	}); err != nil {
 		t.Fatalf("seed: %v", err)
 	}
+	seedCoverSource(t, dbURL, "asura", "chronicles-of-the-demon-faction-f886a8af", coverURL)
 	covers := &fakeBytesCoverFetcher{body: []byte("cover-bytes"), contentType: "image/jpeg"}
 	p := &Poller{
 		Store: s, Fetch: &fakeFetcher{body: asuraSeriesFixture, status: 200}, CoverBytesFetch: covers,
@@ -201,18 +225,19 @@ func TestRunOncePrefetchesPublicCover(t *testing.T) {
 }
 
 func TestRunOnceDoesNotStoreNonImagePublicCover(t *testing.T) {
-	s, _ := newTestStore(t)
+	s, dbURL := newTestStore(t)
 	const (
 		key       = "asura:non-image-cover"
 		seriesURL = "https://asurascans.com/comics/non-image-cover"
 		coverURL  = "https://cdn.example/covers/challenge"
 	)
 	if _, err := s.Upsert(s.OwnerID(), store.Bookmark{
-		Key: key, Site: "asura", SeriesID: "non-image-cover", SeriesURL: seriesURL, Cover: coverURL,
+		Key: key, Site: "asura", SeriesID: "non-image-cover", SeriesURL: seriesURL,
 		UpdatedAt: 1000,
 	}); err != nil {
 		t.Fatalf("seed: %v", err)
 	}
+	seedCoverSource(t, dbURL, "asura", "non-image-cover", coverURL)
 	p := &Poller{
 		Store: s, Fetch: &fakeFetcher{body: asuraSeriesFixture, status: 200},
 		CoverBytesFetch: &fakeBytesCoverFetcher{body: []byte("challenge"), contentType: "text/html"},
@@ -355,7 +380,7 @@ func TestRunOnceFetchesSharedSeriesOnce(t *testing.T) {
 	// A second reader tracks the same series. The seed is the only
 	// reader-creation path, so a second Open as a different owner is how a
 	// test gets a second reader on the same database.
-	other, err := store.Open(url, store.Owner{DiscordID: "second-reader", TokenHash: sha256.Sum256([]byte("second-token-hash"))}, t.TempDir())
+	other, err := store.Open(url, store.Owner{DiscordID: "second-reader", TokenHash: sha256.Sum256([]byte("second-token-hash"))}, t.TempDir(), testCoverBaseURL)
 	if err != nil {
 		t.Fatalf("Open second reader: %v", err)
 	}
@@ -686,7 +711,7 @@ func TestKaganeUsesBrowserFetcher(t *testing.T) {
 }
 
 func TestRunOncePrefetchesKaganeCover(t *testing.T) {
-	s, _ := newTestStore(t)
+	s, dbURL := newTestStore(t)
 	const (
 		key      = "kagane:019f84bc-9ba0-7ed9-86f5-8b905ec7c28b"
 		coverURL = "https://kagane.to/api/v2/image/019f84bc-9ba0-7ed9-86f5-8b905ec7c28b/compressed"
@@ -694,10 +719,11 @@ func TestRunOncePrefetchesKaganeCover(t *testing.T) {
 	if _, err := s.Upsert(s.OwnerID(), store.Bookmark{
 		Key: key, Site: "kagane", SeriesID: "019f84bc-9ba0-7ed9-86f5-8b905ec7c28b",
 		SeriesURL: "https://kagane.to/series/019f84bc-9ba0-7ed9-86f5-8b905ec7c28b",
-		Cover:     coverURL, UpdatedAt: 1000,
+		UpdatedAt: 1000,
 	}); err != nil {
 		t.Fatalf("seed: %v", err)
 	}
+	seedCoverSource(t, dbURL, "kagane", "019f84bc-9ba0-7ed9-86f5-8b905ec7c28b", coverURL)
 	covers := &fakeCoverFetcher{body: []byte("cover-bytes"), contentType: "image/webp"}
 	p := &Poller{
 		Store: s, Fetch: &fakeFetcher{body: kaganeAPIFixture, status: 200},
@@ -720,7 +746,7 @@ func TestRunOncePrefetchesKaganeCover(t *testing.T) {
 }
 
 func TestRunOnceDoesNotRefetchKaganeCover(t *testing.T) {
-	s, _ := newTestStore(t)
+	s, dbURL := newTestStore(t)
 	const (
 		key      = "kagane:019f84bc-9ba0-7ed9-86f5-8b905ec7c28b"
 		seriesID = "019f84bc-9ba0-7ed9-86f5-8b905ec7c28b"
@@ -728,10 +754,11 @@ func TestRunOnceDoesNotRefetchKaganeCover(t *testing.T) {
 	)
 	if _, err := s.Upsert(s.OwnerID(), store.Bookmark{
 		Key: key, Site: "kagane", SeriesID: seriesID,
-		SeriesURL: "https://kagane.to/series/" + seriesID, Cover: coverURL, UpdatedAt: 1000,
+		SeriesURL: "https://kagane.to/series/" + seriesID, UpdatedAt: 1000,
 	}); err != nil {
 		t.Fatalf("seed: %v", err)
 	}
+	seedCoverSource(t, dbURL, "kagane", seriesID, coverURL)
 	at := time.UnixMilli(5_000_000)
 	covers := &fakeCoverFetcher{body: []byte("cover-bytes"), contentType: "image/webp"}
 	p := &Poller{
@@ -748,7 +775,7 @@ func TestRunOnceDoesNotRefetchKaganeCover(t *testing.T) {
 }
 
 func TestRunOnceCoverFailureDoesNotBlockChapter(t *testing.T) {
-	s, _ := newTestStore(t)
+	s, dbURL := newTestStore(t)
 	const (
 		key      = "kagane:019f84bc-9ba0-7ed9-86f5-8b905ec7c28b"
 		seriesID = "019f84bc-9ba0-7ed9-86f5-8b905ec7c28b"
@@ -756,10 +783,11 @@ func TestRunOnceCoverFailureDoesNotBlockChapter(t *testing.T) {
 	)
 	if _, err := s.Upsert(s.OwnerID(), store.Bookmark{
 		Key: key, Site: "kagane", SeriesID: seriesID,
-		SeriesURL: "https://kagane.to/series/" + seriesID, Cover: coverURL, UpdatedAt: 1000,
+		SeriesURL: "https://kagane.to/series/" + seriesID, UpdatedAt: 1000,
 	}); err != nil {
 		t.Fatalf("seed: %v", err)
 	}
+	seedCoverSource(t, dbURL, "kagane", seriesID, coverURL)
 	now := time.UnixMilli(5_000_000)
 	p := &Poller{
 		Store: s, BrowserFetch: &fakeFetcher{body: kaganeAPIFixture, status: 200},
@@ -781,7 +809,7 @@ func TestRunOnceCoverFailureDoesNotBlockChapter(t *testing.T) {
 }
 
 func TestRunOnceRejectsInvalidKaganeCover(t *testing.T) {
-	s, _ := newTestStore(t)
+	s, dbURL := newTestStore(t)
 	const (
 		key      = "kagane:019f84bc-9ba0-7ed9-86f5-8b905ec7c28b"
 		seriesID = "019f84bc-9ba0-7ed9-86f5-8b905ec7c28b"
@@ -789,10 +817,11 @@ func TestRunOnceRejectsInvalidKaganeCover(t *testing.T) {
 	)
 	if _, err := s.Upsert(s.OwnerID(), store.Bookmark{
 		Key: key, Site: "kagane", SeriesID: seriesID,
-		SeriesURL: "https://kagane.to/series/" + seriesID, Cover: coverURL, UpdatedAt: 1000,
+		SeriesURL: "https://kagane.to/series/" + seriesID, UpdatedAt: 1000,
 	}); err != nil {
 		t.Fatalf("seed: %v", err)
 	}
+	seedCoverSource(t, dbURL, "kagane", seriesID, coverURL)
 	p := &Poller{
 		Store: s, BrowserFetch: &fakeFetcher{body: kaganeAPIFixture, status: 200},
 		CoverFetch: &fakeCoverFetcher{body: []byte("not an image"), contentType: "text/html"},
@@ -806,7 +835,7 @@ func TestRunOnceRejectsInvalidKaganeCover(t *testing.T) {
 }
 
 func TestRunOnceWithoutCoverFetcherStillPollsKagane(t *testing.T) {
-	s, _ := newTestStore(t)
+	s, dbURL := newTestStore(t)
 	const (
 		key      = "kagane:019f84bc-9ba0-7ed9-86f5-8b905ec7c28b"
 		seriesID = "019f84bc-9ba0-7ed9-86f5-8b905ec7c28b"
@@ -814,10 +843,11 @@ func TestRunOnceWithoutCoverFetcherStillPollsKagane(t *testing.T) {
 	)
 	if _, err := s.Upsert(s.OwnerID(), store.Bookmark{
 		Key: key, Site: "kagane", SeriesID: seriesID,
-		SeriesURL: "https://kagane.to/series/" + seriesID, Cover: coverURL, UpdatedAt: 1000,
+		SeriesURL: "https://kagane.to/series/" + seriesID, UpdatedAt: 1000,
 	}); err != nil {
 		t.Fatalf("seed: %v", err)
 	}
+	seedCoverSource(t, dbURL, "kagane", seriesID, coverURL)
 	p := &Poller{
 		Store: s, BrowserFetch: &fakeFetcher{body: kaganeAPIFixture, status: 200},
 		Now: func() time.Time { return time.UnixMilli(5_000_000) }, Cooldown: time.Hour, BrowserCooldown: time.Hour, Batch: 10,
@@ -830,15 +860,16 @@ func TestRunOnceWithoutCoverFetcherStillPollsKagane(t *testing.T) {
 }
 
 func TestRunOnceRoutesNonKaganeCoverToPublicFetcher(t *testing.T) {
-	s, _ := newTestStore(t)
+	s, dbURL := newTestStore(t)
 	const key = "asura:solo"
 	const coverURL = "https://asurascans.com/covers/solo.jpg"
 	if _, err := s.Upsert(s.OwnerID(), store.Bookmark{
 		Key: key, Site: "asura", SeriesID: "solo", SeriesURL: "https://asurascans.com/comics/solo",
-		Cover: coverURL, UpdatedAt: 1000,
+		UpdatedAt: 1000,
 	}); err != nil {
 		t.Fatalf("seed: %v", err)
 	}
+	seedCoverSource(t, dbURL, "asura", "solo", coverURL)
 	browserCovers := &fakeCoverFetcher{body: []byte("must not be fetched"), contentType: "image/webp"}
 	publicCovers := &fakeBytesCoverFetcher{body: []byte("public cover"), contentType: "image/webp"}
 	p := &Poller{