Make new_suggestions and Send to Google Chat recoverable

MQ-167-01: a scheduled or manual batch now emits new_suggestions:{batchId}
in the transaction that first stores its Side quests, so the cards and
their notification commit together. A later round that fails, or a
failure recording the batch's end, no longer loses the event; a later
round's emit is a no-op by key; a notification that cannot be stored
fails that store, leaving no unannounced cards. Replenish batches still
never notify. finishBatch goes back to recording status only.

MQ-167-02: migration 0017 adds shopping_lists.chat_send_unconfirmed_at.
SendToChat records the send as begun before posting, clears it with
sent_to_chat_at once Google Chat accepts, and clears it alone when Chat
refuses. A post Chat does not answer, or one it accepts that cannot be
recorded, is ErrSendUnconfirmed (502 chat_unconfirmed, not retryable)
and leaves the marker, as does a crash mid-send; a repeat without resend
never reposts, and resend posts again. The Supply run screen re-reads
the list after a failed send, shows an unconfirmed send, offers no Retry
for it, and sends again only with resend.

Task: f0cd9d50-9c11-41be-a945-7bae9f5f28a4

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/shopping.go

@@ -29,6 +29,9 @@ type supplyRun struct {
 	Title        *string `json:"title"`
 	Status       string  `json:"status"`
 	SentToChatAt *string `json:"sent_to_chat_at"`
+	// ChatSendUnconfirmedAt is when a send to Google Chat whose outcome is
+	// not known began.
+	ChatSendUnconfirmedAt *string `json:"chat_send_unconfirmed_at"`
 	shopping.Counts
 	Groups []supplyRunGroup `json:"groups"`
 }
@@ -132,11 +135,13 @@ func postSupplyRunGenerate(logger *slog.Logger, svc *shopping.Service) http.Hand
 
 // postSupplyRunSendChat posts the week's Supply run to Google Chat and
 // answers with it, sent_to_chat_at recorded. Its body is a JSON object,
-// {} or {"resend": true}: a week already sent is answered as it is,
-// without a second post, unless resend is true. No webhook stored is 409
-// not_configured; Google Chat not answering is 502 chat_unreachable,
-// retryable, and refusing the message 502 chat_refused, retryable only for
-// 429 or 5xx.
+// {} or {"resend": true}: a week already sent, or with a send
+// unconfirmed, is answered as it is, without a second post, unless resend
+// is true. No webhook stored is 409 not_configured; a send whose outcome is
+// not known (Google Chat did not answer, or its acceptance could not be
+// recorded) 502 chat_unconfirmed, not retryable, since retrying could post
+// twice; and Google Chat refusing the message 502 chat_refused, retryable
+// only for 429 or 5xx.
 func postSupplyRunSendChat(logger *slog.Logger, svc *shopping.Service) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		week, ok := weekStartOrFail(w, r, logger)
@@ -154,9 +159,9 @@ func postSupplyRunSendChat(logger *slog.Logger, svc *shopping.Service) http.Hand
 		case errors.Is(err, chat.ErrNotConfigured):
 			writeError(w, r, logger, http.StatusConflict, "not_configured", "no Google Chat webhook is configured; add one in Settings")
 			return
-		case errors.Is(err, chat.ErrUnreachable):
+		case errors.Is(err, shopping.ErrSendUnconfirmed):
 			logger.WarnContext(r.Context(), "send Supply run to Google Chat", "error", err)
-			writeAPIError(w, r, logger, http.StatusBadGateway, apiError{Code: "chat_unreachable", Message: "Google Chat did not answer", Retryable: true})
+			writeAPIError(w, r, logger, http.StatusBadGateway, apiError{Code: "chat_unconfirmed", Message: shopping.ErrSendUnconfirmed.Error()})
 			return
 		case errors.As(err, &refused):
 			logger.WarnContext(r.Context(), "send Supply run to Google Chat", "error", err)
@@ -287,13 +292,14 @@ func supplyRunOf(week store.LocalDate, l shopping.List) (supplyRun, error) {
 		}
 	}
 	return supplyRun{
-		WeekStart:    l.WeekStart,
-		Label:        label,
-		Title:        l.Title,
-		Status:       l.Status,
-		SentToChatAt: l.SentToChatAt,
-		Counts:       l.Counts(),
-		Groups:       groups,
+		WeekStart:             l.WeekStart,
+		Label:                 label,
+		Title:                 l.Title,
+		Status:                l.Status,
+		SentToChatAt:          l.SentToChatAt,
+		ChatSendUnconfirmedAt: l.ChatSendUnconfirmedAt,
+		Counts:                l.Counts(),
+		Groups:                groups,
 	}, nil
 }
 

internal/server/shopping_test.go

@@ -83,14 +83,15 @@ func (e plansEnv) archive(t *testing.T) {
 // supplyRunJSON is a Supply run answer decoded with every field the API
 // promises.
 type supplyRunJSON struct {
-	WeekStart    string  `json:"weekStart"`
-	Label        string  `json:"label"`
-	Title        *string `json:"title"`
-	Status       string  `json:"status"`
-	SentToChatAt *string `json:"sent_to_chat_at"`
-	NeededCount  int     `json:"needed_count"`
-	TotalCount   int     `json:"total_count"`
-	Groups       []struct {
+	WeekStart             string  `json:"weekStart"`
+	Label                 string  `json:"label"`
+	Title                 *string `json:"title"`
+	Status                string  `json:"status"`
+	SentToChatAt          *string `json:"sent_to_chat_at"`
+	ChatSendUnconfirmedAt *string `json:"chat_send_unconfirmed_at"`
+	NeededCount           int     `json:"needed_count"`
+	TotalCount            int     `json:"total_count"`
+	Groups                []struct {
 		Dinner struct {
 			ID   string `json:"id"`
 			Name string `json:"name"`
@@ -185,7 +186,7 @@ func TestSupplyRunShape(t *testing.T) {
 	if status != http.StatusOK {
 		t.Fatalf("generate = %d %v", status, raw)
 	}
-	wantTop := []string{"groups", "label", "needed_count", "sent_to_chat_at", "skipped", "status", "title", "total_count", "weekStart"}
+	wantTop := []string{"chat_send_unconfirmed_at", "groups", "label", "needed_count", "sent_to_chat_at", "skipped", "status", "title", "total_count", "weekStart"}
 	if got := keys(raw); !reflect.DeepEqual(got, wantTop) {
 		t.Errorf("generate fields = %v, want %v", got, wantTop)
 	}
@@ -888,15 +889,19 @@ func TestSupplyRunSendChatErrors(t *testing.T) {
 	if status != http.StatusBadGateway || errorCode(body) != "chat_refused" || body["error"].(map[string]any)["retryable"] != false {
 		t.Errorf("send Google Chat answers 404 = %d %v, want 502 chat_refused, not retryable", status, body)
 	}
-	e.chat.Close()
-	status, body = callShopping(t, e, http.MethodPost, shoppingPath+"2026-10-12/send-chat", `{}`, nil)
-	if status != http.StatusBadGateway || errorCode(body) != "chat_unreachable" {
-		t.Errorf("send Google Chat does not answer = %d %v, want 502 chat_unreachable", status, body)
-	}
 	var l supplyRunJSON
 	callShopping(t, e, http.MethodGet, shoppingPath+"2026-10-12", "", &l)
-	if l.SentToChatAt != nil {
-		t.Errorf("sent_to_chat_at after failed sends = %s, want null", *l.SentToChatAt)
+	if l.SentToChatAt != nil || l.ChatSendUnconfirmedAt != nil {
+		t.Errorf("after refused sends sent_to_chat_at = %v, chat_send_unconfirmed_at = %v, want both null", l.SentToChatAt, l.ChatSendUnconfirmedAt)
+	}
+	e.chat.Close()
+	status, body = callShopping(t, e, http.MethodPost, shoppingPath+"2026-10-12/send-chat", `{}`, nil)
+	if status != http.StatusBadGateway || errorCode(body) != "chat_unconfirmed" || body["error"].(map[string]any)["retryable"] != false {
+		t.Errorf("send Google Chat does not answer = %d %v, want 502 chat_unconfirmed, not retryable", status, body)
+	}
+	callShopping(t, e, http.MethodGet, shoppingPath+"2026-10-12", "", &l)
+	if l.SentToChatAt != nil || l.ChatSendUnconfirmedAt == nil {
+		t.Errorf("after an unanswered send sent_to_chat_at = %v, chat_send_unconfirmed_at = %v, want null and set", l.SentToChatAt, l.ChatSendUnconfirmedAt)
 	}
 
 	e.archive(t)