fix(renovate): say the two things a fork has to say

[theRealBithive]

What was wrong

Renovate has access to this repository, .github/renovate.json5 is on main, and renovate-config-validator passes on it. Across two scheduled Mondays it had opened nothing: no pull request, no dependency dashboard, no config warning.

With schedule: ['before 6am on monday'], that is indistinguishable from a healthy quiet week — which is exactly what CLAUDE.md told the reader to expect.

Checked
Pull requests by renovate[bot]	none, across the 60 most recent PRs
Dependency dashboard issue	does not exist
Config warning issue	does not exist
.github/renovate.json5 on main	yes
renovate-config-validator	passes
Issues enabled on the repo	yes (they were not when the section was written)

What changes

Two defaults were deciding this silently. Both are now written out in the config:

• forkProcessing: 'enabled' — this repository is a fork of QuackbackIO/quackback, and Renovate's 'auto' default decides for itself whether to process one. It is the single condition here specific to being a fork.
• dependencyDashboard: true — rather than inheriting it from config:recommended. It is the only surface showing what Renovate is holding back, the only checkbox that forces a run off schedule, and the only thing that tells a running app from an absent one on a non-Monday.

Neither changes what Renovate would do if it were already running. They remove the two ways it can do nothing without saying so.

The documentation was the other half of the bug

CLAUDE.md asserted the app was installed and that "a quiet week is expected rather than a symptom". Both sentences were load-bearing and one of them was wrong. The section now carries what was measured, the order to check things in when the stream goes quiet — dashboard exists, config validates, config is on the default branch — and the one thing a shell cannot check: the installation itself needs an app-authorized token, and GitHub Apps do not appear under repos/.../hooks.

What the quiet cost

bun scripts/audit-check.ts passes, because nothing is high or critical. Twenty advisories are open in the tree:

• hono ×10 — including hono/jsx not isolating context per request and memo() retaining SSR output across requests (both cross-user leaks), plus ReDoS in the CORS and language middleware
• qs ×3 (DoS), uuid, fast-xml-parser, @hono/node-server, body-parser, esbuild, @babel/core

All transitive — the class lockFileMaintenance exists for, and the class GitHub's dependency graph cannot see, because it does not parse bun.lock.

Gates

Config-only and documentation-only. renovate-config-validator passes on the edited file; prettier clean. Nothing in the running service changes.

🤖 Generated with Claude Code