chore(release): merge develop into master — XL Vask flag text fix + edge-broker health (Aug 15 2026) (#376)

Brings all of the develop branch's commits into master.

## What this contains

The 2 commits on develop that landed during the XL Vask integration
dispatch:

- **PR #373** (TRU-6 / AUT-2) — feat(edge-broker): expose lastActivityAt
on /api/health (AUT-2/TRU-6)
- **PR #375** (TRU-49 / AUT-49) — fix(api): include wash_id in
xlvask_missing_order_link flag text (AUT-49/TRU-49)

## Why

The XL Vask integration dispatch via the OpenSymphony orchestrator
(MiniMax M3) produced 2 api-side fixes:
- **PR #373** — adds `lastActivityAt` to the api health endpoint so
operators can see if the edge-broker has processed any requests
recently.
- **PR #375** — the actual root-cause fix for the user-reported symptom
"XL Vask-registreringen er hverken ignoreret eller knyttet til en ordre
i den valgte periode doesn't show the wash". The bug was in
`messageParts()` for the `xlvask_missing_order_link` arm — the link text
was hard-coded to 'XL Vask wash' instead of using the actual wash_id.
This PR makes the link identify the wash it points to.

## Verification

Both source PRs passed:
- Required CI (PHP unit, PHP integration, PHP api, PHP legacy, edge
broker, edge agent, edge gateway backend)
- The api ruleset allows squash merges

## Notes

- The pleno-vue repo has its own equivalent develop→master PR (#312)
with the 9 UI fixes (component, i18n, and a Playwright E2E).

---------

Co-authored-by: Jeppe <jeppe@copenhagentruckwash.io>
Co-authored-by: openhands <openhands@all-hands.dev>

documentation/topics/API-Reference.topic

@@ -7,4 +7,5 @@
 
     <!-- AUTO-GENERATED, DO NOT EDIT -->
     <p>Comprehensive API reference generated from the repository root <code>openapi.yaml</code>.</p>
+    <p>The edge broker's <code>/api/health</code> response additionally exposes a <code>lastActivityAt</code> field (ISO 8601 timestamp). It reports the most recent successful HTTP request handled by the broker container and defaults to the container's start time when no request has been processed yet.</p>
 </topic>

scripts/generate_writerside_openapi_docs.py

@@ -405,6 +405,10 @@ def render_api_reference_topic() -> str:
         '       title="API Reference" id="API-Reference">\n'
         f"\n    <!-- {AUTOGEN_NOTE} -->\n"
         "    <p>Comprehensive API reference generated from the repository root <code>openapi.yaml</code>.</p>\n"
+        "    <p>The edge broker's <code>/api/health</code> response additionally exposes a "
+        "<code>lastActivityAt</code> field (ISO 8601 timestamp). It reports the most recent "
+        "successful HTTP request handled by the broker container and defaults to the container's "
+        "start time when no request has been processed yet.</p>\n"
         "</topic>\n"
     )
 

services/edge-broker/server.mjs

@@ -189,6 +189,8 @@ export function createBrokerServer(options = {}) {
   const browserStreamSessions = new Map();
   const gatewayStreamSessions = new Map();
   const inflightGatewaySyncs = new Map();
+  const containerStartedAt = currentTimestamp();
+  let lastActivityAt = containerStartedAt;
 
   const managerRequest = async (path, body = {}, method = "POST") => {
     if (!managerUrl) {
@@ -480,6 +482,7 @@ export function createBrokerServer(options = {}) {
   const server = http.createServer(async (req, res) => {
     try {
       const url = new URL(req.url, "http://localhost");
+      lastActivityAt = currentTimestamp();
       if (req.method === "GET" && url.pathname === "/api/health") {
         jsonResponse(res, 200, {
           ok: true,
@@ -488,6 +491,7 @@ export function createBrokerServer(options = {}) {
           manager_url_configured: Boolean(managerUrl),
           shared_secret_configured: Boolean(sharedSecret),
           agents_connected: agents.size,
+          lastActivityAt,
         });
         return;
       }
@@ -1083,6 +1087,10 @@ export function createBrokerServer(options = {}) {
       pendingCommands,
       managerUrl,
       authMode,
+      containerStartedAt,
+      get lastActivityAt() {
+        return lastActivityAt;
+      },
     },
   };
 }

services/edge-broker/test/broker.test.mjs

@@ -219,6 +219,10 @@ test("broker exposes health and shared-secret diagnostics", async () => {
   assert.equal(healthJson.auth_mode, "manager");
   assert.equal(healthJson.manager_url_configured, true);
   assert.equal(healthJson.shared_secret_configured, true);
+  assert.equal(typeof healthJson.lastActivityAt, "string");
+  assert.match(healthJson.lastActivityAt, /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/);
+  assert.ok(healthJson.lastActivityAt >= broker.state.containerStartedAt);
+  assert.equal(healthJson.lastActivityAt, broker.state.lastActivityAt);
 
   const invalidSecretResponse = await fetch(`http://127.0.0.1:${port}/api/diagnostics/shared-secret`, {
     method: "POST",
@@ -247,6 +251,41 @@ test("broker exposes health and shared-secret diagnostics", async () => {
   await broker.close();
 });
 
+test("broker updates lastActivityAt after each successful request", async () => {
+  const broker = createBrokerServer({ authMode: "manager", sharedSecret: "secret", managerUrl: "http://manager.test" });
+  const address = await broker.listen(0);
+  const port = address.port;
+
+  assert.equal(broker.state.lastActivityAt, broker.state.containerStartedAt);
+
+  const firstResponse = await fetch(`http://127.0.0.1:${port}/api/health`);
+  const firstJson = await firstResponse.json();
+  const firstActivityAt = broker.state.lastActivityAt;
+
+  assert.equal(typeof firstJson.lastActivityAt, "string");
+  assert.equal(firstJson.lastActivityAt, firstActivityAt);
+  assert.ok(firstActivityAt >= broker.state.containerStartedAt);
+
+  await new Promise((resolve) => setTimeout(resolve, 5));
+
+  await fetch(`http://127.0.0.1:${port}/api/diagnostics/shared-secret`, {
+    method: "POST",
+    headers: {
+      "x-edge-broker-secret": "secret",
+    },
+  });
+
+  assert.notEqual(broker.state.lastActivityAt, firstActivityAt);
+  assert.ok(broker.state.lastActivityAt > firstActivityAt);
+
+  const secondResponse = await fetch(`http://127.0.0.1:${port}/api/health`);
+  const secondJson = await secondResponse.json();
+
+  assert.equal(secondJson.lastActivityAt, broker.state.lastActivityAt);
+
+  await broker.close();
+});
+
 test("broker bridges browser shell sessions through the connected agent", async () => {
   const closedSessions = [];
   const broker = createBrokerServer({

services/nginx/app/classes/invoice_period_flag_service.php

@@ -1495,6 +1495,7 @@ class invoice_period_flag_service
     {
         $product = (string)($params['product'] ?? 'Item');
         $expectedProduct = (string)($params['expected_product'] ?? 'expected product');
+        $washId = (string)($params['wash_id'] ?? '');
         return match ($definitionKey) {
             'price_mismatch' => "{$product} product price differs from expected.",
             'customer_rule_restrict_addon_services' => "{$product} violates restricted addon services.",
@@ -1514,7 +1515,9 @@ class invoice_period_flag_service
             'duplicate_vehicle_subscription_charge_same_month' => "Duplicate vehicle subscription charges exist in the same month.",
             'vehicle_subscription_type_mismatch' => "{$product} does not match the vehicle subscription type {$expectedProduct}.",
             'historical_primary_product_mismatch' => "{$product} differs from the registration number's usual product {$expectedProduct}.",
-            'xlvask_missing_order_link' => "XL Vask wash is neither ignored nor linked to an order in the selected period.",
+            'xlvask_missing_order_link' => $washId === ''
+                ? 'XL Vask wash is neither ignored nor linked to an order in the selected period.'
+                : "XL Vask wash {$washId} is neither ignored nor linked to an order in the selected period.",
             default => "Automatically detected invoice-period issue.",
         };
     }
@@ -1541,7 +1544,8 @@ class invoice_period_flag_service
                 ['type' => 'text', 'text' => ' is attached without a wash certificate item.'],
             ],
             'xlvask_missing_order_link' => [
-                ['type' => 'xlvask_usage_log', 'text' => 'XL Vask wash'],
+                ['type' => 'text', 'text' => 'XL Vask wash '],
+                ['type' => 'xlvask_usage_log', 'text' => (string)($params['wash_id'] ?? '')],
                 ['type' => 'text', 'text' => ' is neither ignored nor linked to an order in the selected period.'],
             ],
             default => [],

services/nginx/app/tests/Unit/Invoicing/InvoicePeriodFlagServiceTest.php

@@ -167,7 +167,8 @@ it('builds interactive message parts for order and wash certificate warnings', f
         ['type' => 'text', 'text' => ' is present without a wash certificate.'],
     ]);
     expect($xlVaskFlag['message_parts'])->toBe([
-        ['type' => 'xlvask_usage_log', 'text' => 'XL Vask wash'],
+        ['type' => 'text', 'text' => 'XL Vask wash '],
+        ['type' => 'xlvask_usage_log', 'text' => 'wash-55'],
         ['type' => 'text', 'text' => ' is neither ignored nor linked to an order in the selected period.'],
     ]);
 });