Discord Staff Alerts

In Discord, go to the target channel's Settings → Integrations → Webhooks → New Webhook, name it (e.g. "FlagForge"), and copy its URL. Use a private staff-only channel — the webhook URL is a secret equivalent to a password for posting there.
Set it as an environment variable before starting the server:
```
export FLAGFORGE_DISCORD_WEBHOOK_URL="https://discord.com/api/webhooks/…"
```
No environment variables on your host? Paste the webhook URL directly into alerts.yml's webhook-url value instead of the ${FLAGFORGE_DISCORD_WEBHOOK_URL} placeholder — it works the same either way. FlagForge logs a one-time startup reminder that the file then holds a plaintext secret; keep its permissions restricted and never share it with the URL still inside.
In alerts.yml, set discord.enabled: true. delivery-mode: ALWAYS (the default) sends every qualifying finding to Discord regardless of in-game staff presence; WHEN_NO_INGAME_STAFF sends only when no eligible in-game staff member is online; HIGH_RISK_ONLY restricts delivery to high-confidence/high-severity findings.
Optionally enable discord.role-mention and set FLAGFORGE_DISCORD_STAFF_ROLE_ID to a numeric Discord role ID (never a role name) to ping that one role on serious findings. FlagForge constructs Discord's allowed_mentions so only that exact role can ever be pinged — no finding/check/player-derived text can inject @everyone, @here, or an unintended mention.
Start (or restart) the server, then run /ff discord test to send a clearly labeled test message and confirm delivery, and /ff discord status to check queue health.

Discord delivery runs on its own bounded async queue:

Aggregates repeated alerts for the same player/check within a short window into one message.
Retries transient failures (network errors, timeouts, 5xx, 429 with its Retry-After hint honored) with capped exponential backoff; never retries a permanent 4xx.
Opens a circuit breaker after repeated failures, so an outage cannot slow down or affect gameplay/detection/in-game alerts.

If discord.enabled is true but no webhook URL resolves, FlagForge disables Discord delivery only and logs why — everything else keeps working normally.