Story #2607 :: Task: Wire the Library Versioning achievement to per-release authorship

[herzog0]

Issue: #2607

⚠️ Base branch is teo/2486-badge-profile-display

Summary & Context

Wires the Library Maintenance achievement. The one thing worth reviewing here is the grain:
maintainers are recorded per LibraryVersion, but the badge counts libraries maintained
(1 / 2 / 5 / 10 / 20), so the iterator deduplicates across versions and yields the Library as
the achievement source.

Without that, a maintainer of one library with 40 releases would hold diamond.

• Figma link: n/a
• Link to components/page: n/a

Changes

• _iter_library_maintenance walks LibraryVersion with its maintainers prefetched and yields
  (user, library) once per (user, library) pair, tracking what it has already seen.
• Registered in BACKFILL_ITERATORS.
• test_iter_library_maintenance_dedupes_versions - three versions of one library yield exactly
  one pair.
• test_backfill_library_maintenance - two versions, one grant, one badge.

‼️ Risks & Considerations ‼️

• The dedup set is held in memory for the whole walk. It is one tuple per (user, library) pair,
  bounded by the number of maintainer relationships, not by the number of versions - a few
  thousand entries at Boost's scale.
• The source object recorded on the grant is the Library, not the LibraryVersion. This is
  what makes the grant idempotent under unique_automatic_user_achievement_source and what lets
  reconciliation match it. An earlier iteration of this feature recorded versions and had to be
  cleaned up with a data migration;
• Dropping a maintainer from every version of a library removes the grant on the next
  reconcile, the two-way command, not on a backfill. That is by design.

Screenshots

n/a - no UI.

Peer-review testing steps

The dedup is the whole PR, and it is visible on a changelist. Setup: just load_production_data,
just migrate, docker compose up.

1. The source is wired. /admin/badges/badge/ - the Maintainer row's Automatic column is a
   tick and its ladder reads 1 / 2 / 5 / 10 / 20.

2. Make yourself a maintainer of one library, several times over.
   /admin/libraries/libraryversion/, filter by a single library, then open three of its versions
   and add your own user to Maintainers on each.

3. Backfill. /admin/badges/userachievement/ -> Backfill achievements with Source set to
   Library Maintenance.

4. Three versions, one grant. Filter that changelist by Achievement: Library Maintenance: you
   have exactly one row, and its Source column links to the library, not to any of the
   three versions. Without the dedup this step is where you would see three. /admin/badges/userbadge/
   shows Maintainer / Bronze; the per-member page (your name, linked from either badge changelist)
   reads one valid grant and 1 to go to Silver.

5. A second library does move the count. Add yourself to Maintainers on one version of a
   different library and press Backfill again: two grants, and Maintainer / Silver is
   awarded. This is what proves the dedup is per (member, library) and not just "one grant per member".

6. Removal is a reconcile, and it demotes. Drop yourself from all three versions of the first
   library. Backfill changes nothing. Then Reconcile achievements with Source on Library
   Maintenance: the preview reports one removal, Apply, and the Silver row is revoked with
   Count at revocation 1 while Bronze stays held. /admin/badges/achievementsyncrun/ shows the run
   with Removed 1, and the revoked badge's notes name it.

7. Sanity-check against real data. Backfill All sources on a production copy, then filter
   /admin/badges/userbadge/ to Badge: Maintainer and Rank: Diamond. Every name there must genuinely
   maintain 20 or more libraries - filter /admin/badges/userachievement/ by Achievement: Library
   Maintenance, search their email, and count the rows, whose Source links must all be distinct
   libraries. Without the dedup, anyone maintaining a single long-lived library would be sitting in that
   Diamond list, which is the failure this PR exists to prevent.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: dde90734-d077-481f-bd21-866158cc6171

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}