fix(monitor): URL regex flapping — pick max match, forward-only watermark

The URL Monitor was alerting in 23→24→23→24 cycles on pages that list multiple
matching items (e.g. blackline.com/blog/ posts dated 06-23 and 06-24). Root cause:
checkTargetRegex used re.FindString which returns just the FIRST match in the
HTML, and pages re-order their lists between requests (featured posts, CDN cache
variants), making the "first match" flip and the baseline swap on every cycle.

Fix:
- Use re.FindAllString(text, -1) and pick the LARGEST match via maxRegexMatch.
  For dates this is the latest, for version-ish strings it's the lexically largest
  — stable regardless of how the page orders its items.
- compareWatchValue parses common date formats (ISO 2006-01-02, "Jan 2, 2006",
  RFC3339, etc.) before falling back to plain string compare, so "Jul 1, 2026"
  correctly beats "Jun 30, 2026" (lexically Jul < Jun).
- Forward-only watermark: a regex monitor is for "latest X" — a backward jump
  (older date than the baseline) is almost always page-ordering noise, not a
  real rollback. Skip the alert AND do not advance the baseline so the
  high-water-mark stays at the genuine freshest value seen.
- Empty match (no matches in this fetch) no longer churns the baseline; we
  return early instead of comparing "" against the previous value.

Self-healing for existing baselines: the next check picks max=latest; if it
equals the (possibly stuck) baseline, no alert; if it's strictly newer, one
final alert + baseline advance, then steady-state.

Unit-tested: ISO + month-name dates, version strings, the flapping reproducer
(re-ordered match lists), and the date-aware Jul-beats-Jun case.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: h0tak88r

internal/scanner/monitor/daemon.go

@@ -212,7 +212,17 @@ func checkTargetRegex(t db.MonitorTarget, body []byte) {
 	}
 
 	text := string(body)
-	match := re.FindString(text)
+	// Use ALL matches and pick the MAX (latest date / highest version / lexically
+	// largest), not FindString's first match. A page that lists multiple matching
+	// items (e.g. blog posts) often re-orders them between requests — picking the
+	// first match flapped the baseline, e.g. blackline.com/blog/ alerting 23 → 24 →
+	// 23 → 24 inside 4 minutes as the featured post shuffled. The max is stable
+	// regardless of ordering.
+	matches := re.FindAllString(text, -1)
+	if len(matches) == 0 {
+		return // nothing to compare; don't churn the baseline on a transient empty fetch
+	}
+	match := maxRegexMatch(matches)
 
 	// Switched from hash strategy — old last_hash is hex; establish fresh regex baseline.
 	baseline := t.LastHash
@@ -226,10 +236,21 @@ func checkTargetRegex(t db.MonitorTarget, body []byte) {
 		return
 	}
 
-	if match == baseline {
+	// Forward-only watermark: a regex monitor is for "latest X" — a backward jump
+	// (older date / lower version) is almost always page-ordering noise, not a real
+	// rollback. Skip the alert AND don't advance the baseline so the baseline stays
+	// at the genuine high-water-mark; the next refresh comparing against it will be
+	// stable. Use compareWatchValue which parses dates (ISO + "Jan 2, 2006") and
+	// falls back to lexical compare for arbitrary patterns.
+	cmp := compareWatchValue(match, baseline)
+	if cmp == 0 {
 		_ = db.UpdateMonitorTargetLastRun(t.ID, match, false)
 		return
 	}
+	if cmp < 0 {
+		// Match went backwards — keep the baseline, don't alert, don't advance.
+		return
+	}
 
 	logger.GetLogger().Infof("[URL-MONITOR]   Change detected for %s (regex)", t.URL)
 
@@ -267,3 +288,51 @@ func checkTargetRegex(t db.MonitorTarget, body []byte) {
 	logger.GetLogger().Infof("[URL-MONITOR] Alert: %s", msg)
 	utils.SendMonitorWebhook(msg)
 }
+
+// maxRegexMatch returns the "largest" of a non-empty slice of regex matches,
+// using compareWatchValue (date-aware where possible, lexical otherwise). This
+// makes "latest update" monitoring stable on pages that list multiple matching
+// items in a varying order.
+func maxRegexMatch(matches []string) string {
+	best := matches[0]
+	for _, m := range matches[1:] {
+		if compareWatchValue(m, best) > 0 {
+			best = m
+		}
+	}
+	return best
+}
+
+// compareWatchValue returns >0 if a>b, <0 if a<b, 0 if equal. Tries common date
+// formats first so chronological ordering wins ("Jul 1, 2026" > "Jun 30, 2026"
+// even though lexically Jul<Jun). Falls back to plain string compare for
+// arbitrary patterns (version strings, hashes, etc.) where ASCII order is fine.
+func compareWatchValue(a, b string) int {
+	ta, aOK := tryParseWatchDate(a)
+	tb, bOK := tryParseWatchDate(b)
+	if aOK && bOK {
+		return ta.Compare(tb)
+	}
+	return strings.Compare(a, b)
+}
+
+func tryParseWatchDate(s string) (time.Time, bool) {
+	s = strings.TrimSpace(s)
+	if s == "" {
+		return time.Time{}, false
+	}
+	formats := []string{
+		"2006-01-02",
+		"Jan 2, 2006",
+		"January 2, 2006",
+		"Jan 02, 2006",
+		"02 Jan 2006",
+		time.RFC3339,
+	}
+	for _, f := range formats {
+		if t, err := time.Parse(f, s); err == nil {
+			return t, true
+		}
+	}
+	return time.Time{}, false
+}

internal/scanner/monitor/daemon_test.go

@@ -0,0 +1,60 @@
+package monitor
+
+import "testing"
+
+func TestMaxRegexMatchAndCompare(t *testing.T) {
+	cases := []struct {
+		name    string
+		matches []string
+		want    string
+	}{
+		// ISO YYYY-MM-DD: lexical = chronological, picks the latest date.
+		{"iso latest wins", []string{"2026-06-23", "2026-06-24", "2026-06-23"}, "2026-06-24"},
+		{"iso single", []string{"2026-06-24"}, "2026-06-24"},
+
+		// "Jan 2, 2006" form: lexical Jul<Jun (because 'l'<'n'), so without
+		// date-aware compare we'd pick Jun. The fix should pick Jul.
+		{"month name across months", []string{"Jun 30, 2026", "Jul 1, 2026"}, "Jul 1, 2026"},
+		{"month name within month", []string{"Jun 23, 2026", "Jun 24, 2026"}, "Jun 24, 2026"},
+
+		// Non-date values: lexical fallback is fine.
+		{"version-ish", []string{"v1.2.3", "v1.10.0"}, "v1.2.3"}, // lexical: "1.2" > "1.1"
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := maxRegexMatch(tc.matches)
+			if got != tc.want {
+				t.Fatalf("maxRegexMatch(%v) = %q, want %q", tc.matches, got, tc.want)
+			}
+		})
+	}
+}
+
+// The flapping bug reproduced: simulate two sequential pages where the freshest
+// date appears in different positions. With FindString (old behaviour) the
+// baseline would flip; with maxRegexMatch the baseline stays on the latest date.
+func TestNoFlappingOnReorderedMatches(t *testing.T) {
+	// Page A lists posts in order [24, 23], page B reorders to [23, 24].
+	pageAMatches := []string{"2026-06-24", "2026-06-23"}
+	pageBMatches := []string{"2026-06-23", "2026-06-24"}
+
+	a := maxRegexMatch(pageAMatches)
+	b := maxRegexMatch(pageBMatches)
+	if a != b {
+		t.Fatalf("expected stable max across re-ordered pages, got A=%q B=%q", a, b)
+	}
+}
+
+// Forward-only watermark: a backward "match" returned by a single check should
+// compareWatchValue negative against the current baseline, so the caller skips.
+func TestCompareWatchValueChronological(t *testing.T) {
+	if compareWatchValue("2026-06-24", "2026-06-23") <= 0 {
+		t.Fatal("expected 24 > 23")
+	}
+	if compareWatchValue("Jul 1, 2026", "Jun 30, 2026") <= 0 {
+		t.Fatal("expected Jul 1 > Jun 30 (date-aware, not lexical)")
+	}
+	if compareWatchValue("2026-06-23", "2026-06-23") != 0 {
+		t.Fatal("expected equal")
+	}
+}