Owner notices: the stall, one webhook path from env to Discord (#171)

Rollout note: the owner_notices table starts empty, so the first pass after deploy sends for conditions already true — correct per one-row-per-episode; say so rather than have it reported as a bug. Prod step: create the webhook, set DISCORD_WEBHOOK_URL on the deployment, redeploy — unset is silent by design, and without that step the feature ships dark. Security invariants preserved: the webhook address is a secret in the class of TOKEN_KEY (never logged, never on a config-printing line), and the owner gate is unchanged.

backend/internal/store/migrations/0020_owner_notices.sql

@@ -0,0 +1,12 @@
+-- Owner notices (issue #171): one row per episode, remembered only as "the
+-- owner was told". The row's presence is the whole state — the poller checks
+-- it before sending, writes it after a successful send, and clears it when
+-- the condition no longer holds. site is '' for a fault that is not one
+-- Site's; the composite primary key is what makes the row a lock against a
+-- second message for the same episode.
+CREATE TABLE owner_notices (
+	condition text NOT NULL,
+	site text NOT NULL,
+	notified_at bigint NOT NULL,
+	PRIMARY KEY (condition, site)
+);

backend/internal/store/store.go

@@ -1329,6 +1329,46 @@ func (s *Store) ClearSeriesFailure(site, seriesID string) error {
 	return nil
 }
 
+// NoticeSent reports whether the owner has already been told about this
+// episode (issue #171). The row's presence is the whole state, so a missing
+// row reads false without error.
+func (s *Store) NoticeSent(condition, site string) (bool, error) {
+	var at int64
+	err := s.db.QueryRow(
+		`SELECT notified_at FROM owner_notices WHERE condition = $1 AND site = $2`,
+		condition, site).Scan(&at)
+	if errors.Is(err, sql.ErrNoRows) {
+		return false, nil
+	}
+	if err != nil {
+		return false, fmt.Errorf("notice sent %s/%s: %w", condition, site, err)
+	}
+	return true, nil
+}
+
+// MarkNoticeSent records that the owner was told. Called only after a
+// successful send. Re-marking the same episode just moves the stamp: the row
+// is a lock against a second message, not a log.
+func (s *Store) MarkNoticeSent(condition, site string, at int64) error {
+	if _, err := s.db.Exec(`
+		INSERT INTO owner_notices (condition, site, notified_at) VALUES ($1, $2, $3)
+		ON CONFLICT (condition, site) DO UPDATE SET notified_at = EXCLUDED.notified_at`,
+		condition, site, at); err != nil {
+		return fmt.Errorf("mark notice sent %s/%s: %w", condition, site, err)
+	}
+	return nil
+}
+
+// ClearNotice forgets an episode, so the condition's next occurrence sends
+// again. A row that is not there is not an error.
+func (s *Store) ClearNotice(condition, site string) error {
+	if _, err := s.db.Exec(
+		`DELETE FROM owner_notices WHERE condition = $1 AND site = $2`, condition, site); err != nil {
+		return fmt.Errorf("clear notice %s/%s: %w", condition, site, err)
+	}
+	return nil
+}
+
 // DueForLatestCheck returns one Site's series whose server-side
 // latest-chapter check has aged past cutoffMs, ordered by how many bookmarks
 // reference them (descending) then least-recently-checked first. One Site per

backend/internal/store/store_test.go

@@ -2700,3 +2700,41 @@ func failureRow(t *testing.T, s *Store, site, seriesID string) (word string, sin
 	}
 	return word, since, true
 }
+
+// Owner notices are one row per episode: the row's presence is the whole
+// state. MarkNoticeSent stamps it, NoticeSent reads it, and ClearNotice
+// forgets it — including a row that was never there, which is not an error.
+func TestOwnerNoticeRows(t *testing.T) {
+	s := newTestStore(t)
+
+	if sent, err := s.NoticeSent("stall", "comix"); err != nil || sent {
+		t.Fatalf("NoticeSent on a fresh table = %v, %v; want false, nil", sent, err)
+	}
+
+	if err := s.MarkNoticeSent("stall", "comix", 4242); err != nil {
+		t.Fatalf("MarkNoticeSent: %v", err)
+	}
+	if sent, err := s.NoticeSent("stall", "comix"); err != nil || !sent {
+		t.Fatalf("NoticeSent after mark = %v, %v; want true, nil", sent, err)
+	}
+
+	// Re-marking the same episode just moves the stamp: the row is a lock,
+	// not a log. A different site is its own episode — the key is
+	// (condition, site).
+	if err := s.MarkNoticeSent("stall", "comix", 4343); err != nil {
+		t.Fatalf("re-mark: %v", err)
+	}
+	if sent, err := s.NoticeSent("stall", "kagane"); err != nil || sent {
+		t.Fatalf("NoticeSent on another site = %v, %v; want false, nil", sent, err)
+	}
+
+	if err := s.ClearNotice("stall", "comix"); err != nil {
+		t.Fatalf("ClearNotice: %v", err)
+	}
+	if sent, err := s.NoticeSent("stall", "comix"); err != nil || sent {
+		t.Fatalf("NoticeSent after clear = %v, %v; want false, nil", sent, err)
+	}
+	if err := s.ClearNotice("stall", "comix"); err != nil {
+		t.Fatalf("ClearNotice on a missing row: %v", err)
+	}
+}