To catch both the first occurrence of a counter and any later increases, use:

increase(app_error[1h]) > 0
or
(app_error unless app_error offset 1h)

Why this works:

increase(...) catches normal increments.

app_error unless app_error offset 1h catches the first event, when the metric appears now but was missing 1 hour ago.

In comparison with the answer from @ivaylo-kolev, this returns per-label vectors instead of single scalar output, giving a more detailed result.