🐛 fix(audit): record update-available audits on change, not on a timer

[scttbnsn]

What

The rc.9 24-hour store-size acceptance failed on auditGrowthStayedBounded: 140 audit rows of growth in 24h against the 50-row bound. 380 of 464 rows in the store were the same update-available fact (identical from→to digest pair) re-recorded over and over.

Root cause: shouldRecordUpdateAvailableAudit deduped by signature only within a time window (DD_AUDIT_UPDATE_AVAILABLE_DEDUPE_MS, default 1h). Every time the window lapsed, the unchanged update was re-recorded — ~14 identical rows/day/container for any long-pending update, bounded only by 30-day retention (~420 rows/month per stale update).

Fix

• update-available audit rows are recorded on first detection or signature change (kind/localValue/remoteValue) only — never because time elapsed. State map is now Map<identity, signature> with no timestamps.
• The signature is cached after insertAudit succeeds, so a failed insert can't permanently suppress that update (mattered once expiry was removed).
• registerContainerRemoved now also clears update-available state (same identity derivation as the report path), so remove/recreate records a fresh detection. Existing clear-on-resolve behavior is unchanged.
• DD_AUDIT_UPDATE_AVAILABLE_DEDUPE_MS is removed — it shipped only in v1.6.0 RCs, never in a GA, and no schema rejects a stale env var at startup. Docs rows updated.

Known residuals (out of scope, deliberate)

• Manifest "created" fetch failures are swallowed, making result.created nondeterministic #606 can still cause re-records through the front door: a flaky manifest created fetch can flip updateAvailable false→true, which hits the intentional clear-on-resolve path and re-records on re-detection. That's Manifest "created" fetch failures are swallowed, making result.created nondeterministic #606's bug (result nondeterminism), not a dedupe gap — the signature itself can't flap (created never enters it; verified in getRawTagUpdate/getRawDigestUpdate).
• security-alert dedupe is structurally similar (time-window, not signature) but produced only 4 rows/24h in the failed run; converting it is a non-blocking follow-up, kept out of this RC's blast radius.

Restart behavior: in-memory state means at most one duplicate row per still-pending update per process restart — accepted; seeding from the store isn't worth the complexity.

Verification

• Full app suite: 394 files, 12,431 tests, 100% statements/branches/functions/lines.
• New tests: no-re-record-after-elapsed-time (direct regression for the acceptance failure), persistence-failure retry, forget-on-removal, restart-dup documentation test, 10k-container fleet-scale churn test.
• Full lefthook pre-push gate green (coverage app+ui, builds, e2e, zizmor).

Changelog

• 🔧 Changed update-available audit deduplication to use kind, localValue, and remoteValue signatures.
• 🔧 Changed state caching to occur only after successful audit insertion.
• 🔧 Changed container removal to clear update-available state.
• 🐛 Fixed fresh update detection after container removal and recreation.
• 🗑️ Removed DD_AUDIT_UPDATE_AVAILABLE_DEDUPE_MS and its configuration getter, tests, and documentation.
• 🔧 Updated audit documentation for signature-based detection and re-detection behavior.
• 🔒 Kept security-alert deduplication unchanged.

Concerns

• Confirm known duplicate records from flaky manifest results and process restarts are acceptable.
• Check for stale references to DD_AUDIT_UPDATE_AVAILABLE_DEDUPE_MS or getAuditUpdateAvailableDedupeMs.
• Verify state identity derivation remains consistent between update detection and container removal.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
drydock-website	Ready	Preview	Jul 31, 2026 1:26pm
drydockdemo-website	Ready	Preview	Jul 31, 2026 1:26pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 33e44708-70a0-4b61-be69-481c7b448c41

📥 Commits

Reviewing files that changed from the base of the PR and between 7f55c35 and 54487bf.

⛔ Files ignored due to path filters (1)

• CHANGELOG.md is excluded by !CHANGELOG.md

📒 Files selected for processing (6)

• app/configuration/index.test.ts
• app/configuration/index.ts
• app/event/audit-subscriptions.test.ts
• app/event/audit-subscriptions.ts
• content/docs/current/configuration/server/index.mdx
• content/docs/current/monitoring/index.mdx

💤 Files with no reviewable changes (3)

• app/configuration/index.ts
• content/docs/current/configuration/server/index.mdx
• app/configuration/index.test.ts

---

📝 Walkthrough

Walkthrough

Update-available audit deduplication no longer uses DD_AUDIT_UPDATE_AVAILABLE_DEDUPE_MS. The subscription stores the last signature per container and records audits when the signature changes. Failed writes do not consume deduplication state. Container removal and cache clearing reset the state. Tests and documentation now describe signature-based behavior.

Possibly related PRs

• CodesWhat/drydock#520: Modifies audit deduplication and container state cleanup in the same subscription area.
• CodesWhat/drydock#607: Modifies update-available deduplication and candidate identity/signature handling.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/v1.6-audit-churn

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}