store: the first repeat-til-ack send, and a digest entry that expired unswept (V-617)

LastSent scanned MAX(sent_at) over an empty ack_sends into a bare int64, so
the ordinary "nothing sent yet" case came back as a scan error rather than the
zero time its doc promises. ack_sends is written only by MarkSent, and MarkSent
runs only after a repeat has gone out, so every rule's FIRST repeat read an
empty table — and RepeatUnacked aborts its whole sweep on that error. The
repeat-til-ack loop could never take its first step. Scans into a NullInt64,
the same way OldestPendingTelegram already does two files over.

EnqueueDigestEntry deduped against any row still marked pending, including one
already past its expires_ts. The tick enqueues before it sweeps, so a suppressed
nudge arriving on the tick after an expiry was told deduped=true against an
entry PendingDigestEntries will never hand back: the caller drops the phrasing
it just paid the LLM for and nothing reaches the bundle. The dedupe now carries
the same expiry test the read side does. Its lookup also stops treating a real
read failure as "nothing there".

internal/store/digest.go

@@ -3,7 +3,9 @@ package store
 import (
 	"context"
 	"crypto/sha256"
+	"database/sql"
 	"encoding/hex"
+	"errors"
 	"fmt"
 	"time"
 )
@@ -44,19 +46,33 @@ func DigestBodyHash(rule, body string) string {
 }
 
 // EnqueueDigestEntry durably records a suppressed care candidate worth
-// resurfacing later. If a pending entry with the same rule+body already
+// resurfacing later. If a LIVE pending entry with the same rule+body already
 // exists, this is a no-op that returns the existing id and deduped=true —
 // the same suppressed nudge repeating across ticks must not pile up into
 // several copies of itself in the eventual bundle.
+//
+// "Live" carries the same expiry test PendingDigestEntries reads with, and for
+// the same reason: a row past its expires_ts is still status='pending' until
+// the sweep gets to it, and the tick enqueues before it sweeps. Deduping
+// against one meant reporting deduped=true against an entry that will never be
+// spoken — the caller drops the phrasing it just paid the LLM for and nothing
+// reaches the bundle. Not yet swept must not mean still deliverable on the
+// write side either.
 func (s *Store) EnqueueDigestEntry(ctx context.Context, rule string, severity int, body string, now, expiresAt time.Time) (id int64, deduped bool, err error) {
 	hash := DigestBodyHash(rule, body)
 	var existing int64
 	err = s.db.QueryRowContext(ctx,
-		`SELECT id FROM digest_entries WHERE status = ? AND rule = ? AND body_hash = ? LIMIT 1`,
-		DigestPending, rule, hash).Scan(&existing)
+		`SELECT id FROM digest_entries
+		  WHERE status = ? AND rule = ? AND body_hash = ? AND expires_ts > ? LIMIT 1`,
+		DigestPending, rule, hash, now.UnixMilli()).Scan(&existing)
 	if err == nil {
 		return existing, true, nil
 	}
+	if !errors.Is(err, sql.ErrNoRows) {
+		// A real read failure is not "nothing there". Inserting anyway would
+		// duplicate an entry whose existence we never established.
+		return 0, false, fmt.Errorf("enqueue digest entry: dedupe lookup: %w", err)
+	}
 
 	res, err := s.db.ExecContext(ctx,
 		`INSERT INTO digest_entries (rule, severity, body, body_hash, status, created_ts, expires_ts)