Review fixes: compose duplicate depends_on, .env.example splice, restore COVER_DIR test (#171)

backend/AGENTS.md

@@ -159,6 +159,15 @@ failures. The flag decays and they probe again.
 - Browser Lanes wake Chrome only when 5+ Series are due or one has waited 15m,
   and cover work runs in the background so a slow CDN can't eat a Lane's gap.
 
+### Owner notices — `internal/notify`, `latest.Fault`, `latest.Notifier`, `latest.FaultsFrom`
+
+The poller's outbound owner-notice path (issue #171): one condition today
+(the stall), judged from the durable pass log alone so the poller and any
+future reader of the same judgement cannot disagree. The webhook address is a
+secret in the class of TOKEN_KEY — never logged, never rendered, never
+carried in an error. The `owner_notices` suppression table (one row per
+condition + site) is the only state; every threshold is derived, not stored.
+
 ### Covers — `Store.OnSeriesCreated`, `latest.Acquirer`, `latest.CoverBytesFetcher`, `Store.SetSeriesCover`
 
 Acquired once when the first Bookmark of a Series is created, then served from

backend/main_test.go

@@ -21,6 +21,13 @@ func TestLoadLatestPollDefaults(t *testing.T) {
 	}
 }
 
+func TestLoadConfigReadsCoverDirectory(t *testing.T) {
+	t.Setenv("COVER_DIR", "/covers")
+	if got := loadConfig().CoverDir; got != "/covers" {
+		t.Fatalf("CoverDir = %q, want /covers", got)
+	}
+}
+
 func TestLoadConfigReadsDiscordWebhook(t *testing.T) {
 	// The address is read, never defaulted: unset stays empty (the whole
 	// path is off), set flows into the Config for the poller's notifier.