Adventure news: fix posting gates, digest counts, and section gating

- Don't post adventure beats when posting.enabled=false (PostNow ignores the flag)
- Keep the adventure channel out of the round-robin rotation so it can't steal bulletins from the digest
- no_push now retires a fact against the digest, not just the live post
- Default a missing occurred_at to now instead of the Unix epoch
- Keep protocol-relative image URLs on the guarded thumbnailer
- Make digest_hour=0 (midnight UTC) settable
- Quote the true window total in the digest, not the truncated slice
- Hide the Adventure section entirely when it's disabled

internal/web/adventure.go

@@ -8,6 +8,7 @@ import (
 	"io"
 	"log/slog"
 	"net/http"
+	"net/url"
 	"strings"
 	"time"
 
@@ -56,6 +57,11 @@ type PriorityPoster func(AdvPost)
 
 const advSource = "Pete"
 
+// advBackfillEvent is the synthetic post_log event id used to retire a no_push
+// (cold-start backfill) dispatch against the daily digest. It never went to
+// Matrix; the row exists only so the digest skips it.
+const advBackfillEvent = "adv-backfill"
+
 // handleAdventureIngest receives a game-event fact from gogobee, templates it
 // into a deterministic story, publishes it to the /adventure section, and posts
 // PRIORITY beats live to Matrix. Bearer-authed; idempotent on the fact GUID.
@@ -100,6 +106,14 @@ func (s *Server) handleAdventureIngest(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// A fact with no occurred_at would otherwise be stored at the Unix epoch:
+	// dated 1970 on the permalink, pinned to the bottom of the section, and
+	// outside every digest window. Treat "missing" as "now".
+	occurredAt := f.OccurredAt
+	if occurredAt <= 0 {
+		occurredAt = time.Now().Unix()
+	}
+
 	articleURL := s.advPermalink(f.GUID)
 	imageURL := advArtURL(f.EventType)
 	if err := storage.InsertStory(&storage.Story{
@@ -111,8 +125,8 @@ func (s *Server) handleAdventureIngest(w http.ResponseWriter, r *http.Request) {
 		Source:      advSource,
 		Channel:     "adventure",
 		Classified:  true,
-		SeenAt:      f.OccurredAt,
-		PublishedAt: f.OccurredAt,
+		SeenAt:      occurredAt,
+		PublishedAt: occurredAt,
 	}); err != nil {
 		slog.Error("adventure ingest: insert failed", "guid", f.GUID, "err", err)
 		http.Error(w, "insert failed", http.StatusInternalServerError)
@@ -120,12 +134,21 @@ func (s *Server) handleAdventureIngest(w http.ResponseWriter, r *http.Request) {
 	}
 	slog.Info("adventure ingest: published", "guid", f.GUID, "event_type", f.EventType, "tier", f.Tier)
 
+	// NoPush (cold-start backfill) means "never goes to Matrix". Suppressing only
+	// the live post isn't enough: the digest collects adventure rows that carry no
+	// post_log entry, so a backfilled bulletin would still be swept into the next
+	// roundup — the back-catalogue dump NoPush exists to prevent. Retire the guid
+	// against the digest up front instead.
+	if f.NoPush {
+		storage.MarkAdventureDigested([]string{f.GUID}, advBackfillEvent)
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte("ok"))
+		return
+	}
+
 	// PRIORITY beats post live to Matrix; BULLETIN beats wait for the daily
 	// digest. Website section always gets the row above regardless of tier.
-	// NoPush (cold-start backfill) suppresses the live post so a launch doesn't
-	// dump the whole back-catalogue into the channel — the stories still land on
-	// the website with their backdated timestamps.
-	if f.Tier == "priority" && !f.NoPush && s.advPost != nil && s.adv.Channel != "" {
+	if f.Tier == "priority" && s.advPost != nil && s.adv.Channel != "" {
 		// No ImageURL: the emblem is an SVG (Matrix clients often block SVG
 		// media), and the link's og:image carries the preview instead.
 		s.advPost(AdvPost{
@@ -277,14 +300,18 @@ func (s *Server) bearerOK(r *http.Request) bool {
 	return subtle.ConstantTimeCompare([]byte(got), []byte(s.adv.IngestToken)) == 1
 }
 
+// siteURL makes a root-relative path absolute against BaseURL. Links that go out
+// to Matrix need the absolute form to survive safeHref; when BaseURL isn't
+// configured the relative form is all we have, and it's still fine on-site.
+func (s *Server) siteURL(path string) string {
+	return strings.TrimRight(s.cfg.BaseURL, "/") + path
+}
+
 // advPermalink builds the per-story Pete permalink used as article_url (the card
-// link + Matrix link). Absolute when BaseURL is configured (required for the
-// Matrix link to survive safeHref); relative otherwise (fine on-site).
+// link + Matrix link). The guid is path-escaped: it's ingest-supplied, and a
+// stray "/" or "?" would otherwise produce a link that routes somewhere else.
 func (s *Server) advPermalink(guid string) string {
-	if base := strings.TrimRight(s.cfg.BaseURL, "/"); base != "" {
-		return base + "/adventure/" + guid
-	}
-	return "/adventure/" + guid
+	return s.siteURL("/adventure/" + url.PathEscape(guid))
 }
 
 // factGuard verifies every player-name field we might render is present in the