F-048 (P7) — Scan-resilience defects (F-024 batch abort, F-025 transient finding loss) without regression test #61

Severity: 🟠 · Criterion: K8 (Tests) · Phase: P7 · Status (review): 🆕

File(s): src/Tests/DockerUpdateGuard.Tests/ImageScanOrchestratorTests.cs; src/Tests/DockerUpdateGuard.Tests/RuntimeContainerScanOrchestratorTests.cs

Finding

The orchestrator suites are overall strong and cover the
per-container resilience exemplarily (…ContinuesAfterContainerProcessingFailureAsync:
one broken container → Partial, the rest run on). What remains uncovered, however, is
exactly the two resilience defects found in P3: (a)
F-024
— an exception outside the inner try (e.g. SingleAsync on an image deleted between
listing and scan, or a DB error on the initial ScanRun save)
aborts all subsequent items in ScanAllAsync/ScanInstanceAsync; all
batch tests, however, use only one instance or skip the pre-try throw. (b)
F-025
— no test seeds active findings and then makes discovery/registry
fail, to check whether existing alerts survive the transient error
(per F-025 they do not).

Impact

Two defects with user impact (starving subsequent items;
flickering "update available" alerts) can regress unnoticed or remain
unverified on a fix — exactly on the paths the review marked as 🟠.

Recommendation

(1) A multi-instance/multi-item batch test in which the first item throws in the
pre-try region, and verification that the remaining items are scanned nonetheless. (2) A test with
pre-existing active findings + a failing discovery that proves
active findings are deleted/deactivated only after a successful re-evaluation.

_{Auto-generated from the repository code review. Source of truth: docs/review/findings.md → F-048 (P7), branch review/review-analysis-plan.}