🔧 chore(sync): advance main to dev/v1.6

[scttbnsn]

Routine dev → main sync, per the branch model: main only advances by merging from dev/v1.6, never by taking independent commits.

Opened from a throwaway sync/main-20260726 branch rather than from dev/v1.6 directly. Last time (#596) the head was dev/v1.6 itself, and auto-delete-head-branches deleted it on merge — which is what broke the Crowdin sync, since its base resolver then found no dev/v* on origin.

What this carries

48 files. Two things worth calling out:

Clears the CVE failing main's scheduled scan. brace-expansion goes 5.0.7 → 5.0.8 in app/, ui/, and e2e/ lockfiles, fixing CVE-2026-14257 / GHSA-mh99-v99m-4gvg (medium, DoS via unbounded expansion). 5.0.8 is the fixed version per OSV. This is the sole cause of the "🔬 CI Verify — main" failures on the twice-weekly schedule; the --all qlty gate flags it in all three lockfiles. No code change was needed, dev already had the bump.

The pipefail dead-fallback fixes (#599). The Crowdin base-branch resolver and 8 load-test find pipelines in ci-verify.yml, where a command exiting non-zero on an empty result aborted the step before its explicit fallback could run. Both covered by new tests in .github/tests/.

Plus the #587 maturity-cleared notification feature and its store/trigger plumbing.

Notes

• renovate.json still targets dev/v1.6, which matches the active dev branch, so the drift guard's bot-target assertion passes.
• Commit-count comparisons between these branches are meaningless here — the repo is squash-merge-only, so dev's commits never become ancestors of main. Tree equality is the real invariant, and that's what release-cut.yml asserts.
• No release tag is being cut by this PR. This is the routine sync that keeps main current.

✨ Added

• Maturity gate sweep scheduler with configurable cron execution.
• maturityGatePendingSince lifecycle tracking across containers and persistence.
• maturity-cleared events, audit entries, notification rules, templates, deduplication, UI support, and documentation.
• Extensive unit and workflow tests.

🔧 Changed

• Controller and watcher startup/shutdown now manage the maturity scheduler.
• Container processing checks for cleared maturity gates before emitting reports.
• Crowdin branch resolution and load-test report discovery now tolerate empty find/branch results.
• brace-expansion upgraded to 5.0.8 across lockfiles.

🔒 Security

• Dependency update addresses CVE-2026-14257 / GHSA-mh99-v99m-4gvg.

• Verify the synchronized tree matches dev/v1.6 exactly.

• Confirm renovate.json continues targeting dev/v1.6.

• Ensure no release tag is created by this synchronization.

• Validate maturity-cleared notification behavior across watch cycles, scheduled sweeps, deduplication, and failed deliveries.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
drydock-website	Ready	Preview, Comment	Jul 26, 2026 5:32pm
drydockdemo-website	Ready	Preview, Comment	Jul 26, 2026 5:32pm

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds maturity-gate lifecycle tracking through container persistence, gate-clearing events, audit logging, notification delivery, UI support, and a cron-based sweep scheduler. Startup and shutdown now manage the scheduler. Workflow shell commands are guarded against empty results, with static and runtime tests covering the updated behavior. Documentation and notification configuration describe the new maturity-cleared event and maturityGatePendingSince field.

Possibly related PRs

• CodesWhat/drydock#597 — Covers the same maturity-gate event, marker, notification, and scheduler implementation.
• CodesWhat/drydock#599 — Modifies the same workflow guards and validation tests.
• CodesWhat/drydock#592 — Modifies the same Crowdin integration-branch resolution logic.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sync/main-20260726

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[biggest-littlest]

Routine dev → main sync. Verified the brace-expansion 5.0.8 bump is present in all three lockfiles and the tree matches dev/v1.6.

[ALARGECOMPANY]

Sync looks right. Throwaway head branch this time, so dev/v1.6 survives the merge.

The merge-base changed after approval.

[biggest-littlest]

Re-approving after the conflict resolution. Tree matches dev/v1.6 exactly.

[ALARGECOMPANY]

Re-approving after the -s ours resolution.

[coderabbitai]

Actionable comments posted: 3

🧹 Nitpick comments (3)

.github/tests/ci-verify-find-pipefail-guard.test.ts (1)

38-38: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Cover unquoted command substitutions.

report=$(find ...) is valid shell but bypasses both assertions. Make assignment quotes optional.

Proposed fix

-const FIND_ASSIGNMENT_LINE = /^\s*\w+="\$\((.*)\)"\s*$/;
+const FIND_ASSIGNMENT_LINE = /^\s*\w+=(?:"\$\((.*)\)"|\$\((.*)\))\s*$/;
...
-        const inner = match[1].trim();
+        const inner = (match[1] ?? match[2]).trim();

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/tests/ci-verify-find-pipefail-guard.test.ts at line 38, Update the
FIND_ASSIGNMENT_LINE regex to accept both quoted and unquoted command
substitutions in assignments such as report=$(find ...), while preserving the
existing matching behavior and assertions for quoted forms.

app/triggers/providers/Trigger.test.ts (1)

4373-4377: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Triple await Promise.resolve() hard-codes the microtask depth of the dispatch chain.

Repeated four times (Lines 4375, 4447, 4489, 4573). Adding one await inside dispatchToTriggerOptimistically silently breaks all of them. Prefer vi.waitFor on the assertion, or extract a single flushMicrotasks() helper so the depth lives in one place.

♻️ Example

-    await Promise.resolve();
-    await Promise.resolve();
-    await Promise.resolve();
-    expect(
-      notificationHistoryStore.getLastNotifiedHash(trigger.getId(), 'mat-1', 'maturity-cleared'),
-    ).toBeDefined();
+    await vi.waitFor(() =>
+      expect(
+        notificationHistoryStore.getLastNotifiedHash(trigger.getId(), 'mat-1', 'maturity-cleared'),
+      ).toBeDefined(),
+    );

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@app/triggers/providers/Trigger.test.ts` around lines 4373 - 4377, Replace the
repeated Promise.resolve awaits in the affected Trigger tests with vi.waitFor
around the dedup-hash assertions, or centralize the microtask flushing in a
reusable flushMicrotasks helper. Apply the same change to all four occurrences
so tests no longer depend on the dispatchToTriggerOptimistically microtask
depth.

app/maturity/gate-watch.ts (1)

12-17: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Duplicate hasMaturityGatePendingSince predicate. Same body copy-pasted in both files; export one copy and import it instead of maintaining two.

• app/maturity/gate-watch.ts#L12-L17: export this helper (or relocate it next to hasRawUpdate in model/container.ts) and import it from scheduler.ts.
• app/maturity/scheduler.ts#L14-L21: drop this local copy and import the shared helper.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@app/maturity/gate-watch.ts` around lines 12 - 17, The
hasMaturityGatePendingSince predicate is duplicated across maturity modules. In
app/maturity/gate-watch.ts lines 12-17, export the existing
hasMaturityGatePendingSince helper or relocate it beside hasRawUpdate in
model/container.ts; in app/maturity/scheduler.ts lines 14-21, remove the local
duplicate and import the shared helper.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@app/store/container.ts`:
- Around line 1441-1459: Update clearMaturityGatePendingSince to clear
maturityGatePendingSince in place on the existing container data object instead
of replacing it with a spread copy. Preserve the derived
updateAvailable/updateKind getters and resultChanged behavior while keeping the
direct update and cache invalidation flow unchanged.

In `@app/triggers/providers/Trigger.ts`:
- Around line 1140-1159: Update the outbox retry delivery path in
dispatchOutboxEntry to call recordEventDeliverySuccess with the retried event’s
ruleId and container after successful delivery, including maturity-cleared
entries. Preserve the existing failure/requeue behavior and ensure the success
callback records the dedup hashes before the worker completes.

In `@content/docs/current/configuration/watchers/index.mdx`:
- Line 1249: Update the maturityGatePendingSince description to state that
clearing occurs when maybeEmitMaturityGateCleared observes the opened gate
during a subsequent watch cycle or scheduled sweep, rather than immediately when
the gate opens; preserve the existing description of the maturity-cleared
notification and other clearing behavior.

---

Nitpick comments:
In @.github/tests/ci-verify-find-pipefail-guard.test.ts:
- Line 38: Update the FIND_ASSIGNMENT_LINE regex to accept both quoted and
unquoted command substitutions in assignments such as report=$(find ...), while
preserving the existing matching behavior and assertions for quoted forms.

In `@app/maturity/gate-watch.ts`:
- Around line 12-17: The hasMaturityGatePendingSince predicate is duplicated
across maturity modules. In app/maturity/gate-watch.ts lines 12-17, export the
existing hasMaturityGatePendingSince helper or relocate it beside hasRawUpdate
in model/container.ts; in app/maturity/scheduler.ts lines 14-21, remove the
local duplicate and import the shared helper.

In `@app/triggers/providers/Trigger.test.ts`:
- Around line 4373-4377: Replace the repeated Promise.resolve awaits in the
affected Trigger tests with vi.waitFor around the dedup-hash assertions, or
centralize the microtask flushing in a reusable flushMicrotasks helper. Apply
the same change to all four occurrences so tests no longer depend on the
dispatchToTriggerOptimistically microtask depth.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 0e114d54-866c-4312-bbca-42bac0dfe3e7

📥 Commits

Reviewing files that changed from the base of the PR and between 8b0a6ab and 1e33668.

⛔ Files ignored due to path filters (4)

• CHANGELOG.md is excluded by !CHANGELOG.md
• app/package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json
• e2e/package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json
• ui/package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json

📒 Files selected for processing (44)

• .github/tests/ci-verify-find-pipefail-guard.test.ts
• .github/tests/crowdin-base-branch-resolver.test.ts
• .github/workflows/ci-verify.yml
• .github/workflows/i18n-crowdin.yml
• app/agent/AgentClient.test.ts
• app/agent/AgentClient.ts
• app/configuration/index.test.ts
• app/configuration/index.ts
• app/event/audit-subscriptions.test.ts
• app/event/audit-subscriptions.ts
• app/event/index.test.ts
• app/event/index.ts
• app/index.test.ts
• app/index.ts
• app/maturity/gate-watch.test.ts
• app/maturity/gate-watch.ts
• app/maturity/scheduler.test.ts
• app/maturity/scheduler.ts
• app/model/audit.d.ts
• app/model/container.test.ts
• app/model/container.ts
• app/model/maturity-policy.test.ts
• app/model/maturity-policy.ts
• app/registry/index.test.ts
• app/registry/index.ts
• app/store/container.test.ts
• app/store/container.ts
• app/store/notification-history.ts
• app/store/notification.ts
• app/triggers/providers/Trigger.test.ts
• app/triggers/providers/Trigger.ts
• app/watchers/providers/docker/container-processing.test.ts
• app/watchers/providers/docker/container-processing.ts
• content/docs/current/api/index.mdx
• content/docs/current/configuration/actions/update-eligibility.mdx
• content/docs/current/configuration/triggers/index.mdx
• content/docs/current/configuration/watchers/index.mdx
• e2e/package.json
• test/cpu-bench.sh
• ui/src/locales/en/listViews.json
• ui/src/stores/notifications.ts
• ui/src/types/container.d.ts
• ui/tests/components/NotificationBell.spec.ts
• ui/tests/stores/notificationStore.spec.ts

[coderabbitai]

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
ast-grep run --pattern 'export function getContainerRaw($$$) { $$$ }' --lang typescript app/store/container.ts
ast-grep run --pattern 'export function getContainer($$$) { $$$ }' --lang typescript app/store/container.ts
rg -nP -C3 'addUpdateAvailableProperty|Object\.defineProperty' app/model/container.ts

Repository: CodesWhat/drydock

Length of output: 3615

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== container store relevant sections =="
sed -n '1380,1465p' app/store/container.ts

echo
echo "== validateContainer and property decorators =="
sed -n '920,1020p' app/model/container.ts

echo
echo "== search invalidateContainersCacheForMutation usages and update paths =="
rg -n "invalidateContainersCacheForMutation|validateContainer\\(|containerDoc\\.data =|update\\(|containers\\." app/store/container.ts -A 3 -B 3

echo
echo "== direct JS semantics probe =="
node - <<'JS'
class C {}
const obj = Object.defineProperties(Object.create(C.prototype), {
  updateAvailable: { get() { return 'derived'; }, enumerable: true },
  resultChanged: { value: () => 'changed', enumerable: false },
  maturityGatePendingSince: { value: 'since', enumerable: true },
});
const spread = { ...obj, maturityGatePendingSince: undefined };
console.log(JSON.stringify({
  spreadOwnKeys: Object.keys(spread),
  spreadUpdateAvailable: spread.updateAvailable,
  spreadHasOwnUpdateAvailable: Object.prototype.hasOwnProperty.call(spread, 'updateAvailable'),
  spreadHasOwnPropertyResultChanged: Object.prototype.hasOwnProperty.call(spread, 'resultChanged'),
}, null, 2));
JS

Repository: CodesWhat/drydock

Length of output: 12394

---

Use an in-place marker clear.

This helper intentionally bypasses updateContainer()’s revalidation, but the current spread turns derived updateAvailable/updateKind getters into plain own properties and drops resultChanged, so the stored doc becomes a stale snapshot.

Proposed fix

-  const containerBefore = containerDoc.data;
-  containerDoc.data = { ...containerBefore, maturityGatePendingSince: undefined };
+  const containerBefore = { ...containerDoc.data };
+  containerDoc.data.maturityGatePendingSince = undefined;
   containers.update(containerDoc);
-  invalidateContainersCacheForMutation(containerBefore, containerDoc.data);
+  invalidateContainersCacheForMutation(containerBefore, containerDoc.data);

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	export function clearMaturityGatePendingSince(id: string): boolean {
	const containerDoc = containers.findOne({
	'data.id': id,
	});
	if (
	!containerDoc ||
	!(
	typeof containerDoc.data.maturityGatePendingSince === 'string' &&
	containerDoc.data.maturityGatePendingSince.length > 0
	)
	) {
	return false;
	}
	const containerBefore = containerDoc.data;
	containerDoc.data = { ...containerBefore, maturityGatePendingSince: undefined };
	containers.update(containerDoc);
	invalidateContainersCacheForMutation(containerBefore, containerDoc.data);
	return true;
	}
	export function clearMaturityGatePendingSince(id: string): boolean {
	const containerDoc = containers.findOne({
	'data.id': id,
	});
	if (
	!containerDoc ||
	!(
	typeof containerDoc.data.maturityGatePendingSince === 'string' &&
	containerDoc.data.maturityGatePendingSince.length > 0
	)
	) {
	return false;
	}
	const containerBefore = { ...containerDoc.data };
	containerDoc.data.maturityGatePendingSince = undefined;
	containers.update(containerDoc);
	invalidateContainersCacheForMutation(containerBefore, containerDoc.data);
	return true;
	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@app/store/container.ts` around lines 1441 - 1459, Update
clearMaturityGatePendingSince to clear maturityGatePendingSince in place on the
existing container data object instead of replacing it with a spread copy.
Preserve the derived updateAvailable/updateKind getters and resultChanged
behavior while keeping the direct update and cache invalidation flow unchanged.

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Outbox retry success never records the maturity-cleared dedup hashes.

When trigger() fails here, the entry is queued with eventName: 'maturity-cleared'. If the outbox worker later delivers it via dispatchOutboxEntry (Line 1167), recordEventDeliverySuccess is never called — so the next scan's generic update-available dispatch fires a second notification for the same result hash, which is the exact double-notify the symmetric dedup is there to prevent.

♻️ Record on successful outbox delivery

   async dispatchOutboxEntry(entry: NotificationOutboxEntry): Promise<void> {
     const payload = entry.payload as { container?: Container };
     const container = payload?.container;
     if (!container) {
       throw new Error(`Outbox entry ${entry.id} missing container payload`);
     }
     await this.trigger(container);
+    this.recordEventDeliverySuccess(entry.eventName as NotificationRuleId, container);
   }

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	.then(
	() => {
	this.recordEventDeliverySuccess(ruleId, container);
	},
	(err: unknown) => {
	const errorMessage = Trigger.getErrorMessage(err);
	if (this.shouldSuppressAutoTriggerError(ruleId, container, errorMessage)) {
	this.log.debug(`Suppressed repeated error handling ${ruleId} event (${errorMessage})`);
	} else {
	this.log.warn(`Error handling ${ruleId} event (${errorMessage})`);
	}
	this.log.debug(err);
	enqueueOutboxEntry({
	eventName: ruleId,
	payload: { container },
	triggerId,
	containerId: container.id,
	});
	},
	);
	async dispatchOutboxEntry(entry: NotificationOutboxEntry): Promise<void> {
	const payload = entry.payload as { container?: Container };
	const container = payload?.container;
	if (!container) {
	throw new Error(`Outbox entry ${entry.id} missing container payload`);
	}
	await this.trigger(container);
	this.recordEventDeliverySuccess(entry.eventName as NotificationRuleId, container);
	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@app/triggers/providers/Trigger.ts` around lines 1140 - 1159, Update the
outbox retry delivery path in dispatchOutboxEntry to call
recordEventDeliverySuccess with the retried event’s ruleId and container after
successful delivery, including maturity-cleared entries. Preserve the existing
failure/requeue behavior and ensure the success callback records the dedup
hashes before the worker completes.

[coderabbitai]

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

"Cleared the moment the gate opens" overstates the timing.

The store write path deliberately never clears on gate-open (getMaturityGatePendingSince in app/store/container.ts preserves the marker; see the explicit test "write path never auto-clears on gate-open"). Clearing happens when maybeEmitMaturityGateCleared observes it — on the container's next watch cycle or the scheduled sweep.

Proposed wording fix

-Cleared silently if the pending update disappears, and cleared the moment the gate opens, which is also what triggers the `maturity-cleared` [notification](/docs/configuration/triggers#event-types).
+Cleared silently if the pending update disappears, and cleared once the gate opens — detected on the container's next watch cycle or on the scheduled maturity sweep, which is also what triggers the `maturity-cleared` [notification](/docs/configuration/triggers#event-types).

As per path instructions, "Documentation content. Review for accuracy against the code, not prose style."

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

| `maturityGatePendingSince` | `string (ISO 8601)` | Set at the moment an update starts being withheld by the [maturity gate](/docs/configuration/actions/update-eligibility) (`maturityMode: mature` and the soak window not yet elapsed); absent otherwise. Preserved across polls and container recreation like `updateDetectedAt`. Cleared silently if the pending update disappears, and cleared the moment the gate opens, which is also what triggers the `maturity-cleared` [notification](/docs/configuration/triggers#event-types). Internal bookkeeping — not something you set directly. |

| `maturityGatePendingSince` | `string (ISO 8601)` | Set at the moment an update starts being withheld by the [maturity gate](/docs/configuration/actions/update-eligibility) (`maturityMode: mature` and the soak window not yet elapsed); absent otherwise. Preserved across polls and container recreation like `updateDetectedAt`. Cleared silently if the pending update disappears, and cleared once the gate opens — detected on the container's next watch cycle or on the scheduled maturity sweep, which is also what triggers the `maturity-cleared` [notification](/docs/configuration/triggers#event-types). Internal bookkeeping — not something you set directly. |

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@content/docs/current/configuration/watchers/index.mdx` at line 1249, Update
the maturityGatePendingSince description to state that clearing occurs when
maybeEmitMaturityGateCleared observes the opened gate during a subsequent watch
cycle or scheduled sweep, rather than immediately when the gate opens; preserve
the existing description of the maturity-cleared notification and other clearing
behavior.

Source: Path instructions