Ref T11922. After updating to HEAD of master, you need to manually rebuild the index. We don't do this during bin/storage upgrade because it can take a very long time (secure.phabricator.com took roughly an hour) and can happen while Phabricator is running.
However, if we don't warn users about this they'll just get a broken index unless they go read the changelog (or file an issue, then we tell them to go read the changelog).
This adds a very simple table for notes to administrators so we can write a "you need to go rebuild the index" note, then adds one.
Administrators clear the note by completing the activity and running bin/config done reindex. This isn't automatic because there are various strategies you can use to approach the issue, which I'll discuss in greater detail in the linked documentation.
Also, fix an issue where bin/storage upgrade --apply <patch> could try to re-mark an already-applied patch as applied.