[BUG] Scan History and Dashboard texts claim discovery and cleanup runs that are never recorded #278

Summary

The Scan History page description and the Dashboard's Recent scans section description both say that discovery and cleanup runs are shown. They never are. Only three kinds of work are recorded as scan runs: observed image scans, runtime container scans and vulnerability refreshes. Account discovery, Docker instance synchronization and scan cleanup leave no scan-run record. Users go looking for runs that cannot appear and may conclude that discovery or cleanup is broken.

Area

• docs/areas/web-ui.md (added in [Docs] Describe the current behavior by area #263)
• docs/areas/scan-engine.md (Scan runs), for reference
• Security area: None

Current behavior

<!-- src/DockerUpdateGuard/Components/Pages/ScanHistory.razor:10 -->
<MudText Class="page-description">Operational history for discovery, image refresh, vulnerability, and cleanup runs.</MudText>

<!-- src/DockerUpdateGuard/Components/Pages/Dashboard.razor:215 (section "Recent scans") -->
<MudText Class="section-description">Latest activity across discovery, refresh, and cleanup jobs.</MudText>

What is actually recorded:

• ScanRunType has only three values: ObservedImage, RuntimeContainer and Vulnerability (src/DockerUpdateGuard.Data/Entities/ScanRunType.cs).
• Only three classes create ScanRun entities: ImageScanOrchestrator, RuntimeContainerScanOrchestrator and VulnerabilityEnrichmentService.
• These background services create none: DockerHubAccountImageDiscoveryBackgroundService, DockerInstanceDiscoveryBackgroundService, ResourceStatisticsRefreshBackgroundService and ScanCleanupBackgroundService (all in src/DockerUpdateGuard/Images/).
• docs/areas/scan-engine.md, Scan runs, already says so: "the other jobs (instance synchronization, account discovery, resource statistics, cleanup) leave no scan-run record and report only through logs."

I searched all .razor and .cs files under src/ for "discovery", "cleanup" and "jobs" in user-facing text. These two lines are the only places that make the claim. The other uses of "discovered" (My Images: "automatically discovered from the configured Docker Hub account") describe images, not runs, and are correct.

Reproduction:

1. Start the application with a Docker Hub account and a Docker instance configured.
2. Wait until the discovery and cleanup jobs have run (their log messages appear).
3. Open /scan-history and the dashboard's Recent scans. Both list only entries of type ObservedImage, RuntimeContainer and Vulnerability.

Expected behavior

1. Decision (product manager): change the texts. The jobs do not start recording scan runs.
2. Both descriptions name only what is recorded: observed image scans, runtime container scans and vulnerability refreshes. Suggested wording (may be adjusted):
   • Scan History (ScanHistory.razor:10): "Operational history of observed image scans, runtime container scans and vulnerability refreshes."
   • Dashboard Recent scans (Dashboard.razor:215): "Latest observed image scans, runtime container scans and vulnerability refreshes."
3. No UI text claims that discovery, synchronization, resource statistics or cleanup appear as scan runs.

Acceptance criteria

• The descriptions in ScanHistory.razor and Dashboard.razor no longer mention discovery or cleanup runs/jobs, and they name the three recorded run types.
• A search of src/DockerUpdateGuard/Components for "discovery" and "cleanup" in user-facing text finds no claim about recorded runs.
• bUnit render tests in the existing style (DashboardRenderTests, which uses testContext.Render<DashboardPage>()) assert the new descriptions and that they do not contain "cleanup" or "discovery":
  • DashboardRecentScansDescriptionNamesOnlyRecordedRunTypes in DashboardRenderTests
  • ScanHistoryPageDescriptionNamesOnlyRecordedRunTypes in a new ScanHistoryRenderTests (or the existing ScanHistoryTests)
  • Names follow docs/UNIT_TESTS.md, and every assertion has a message.
• docs/areas/web-ui.md states which run types the Scan History page and the dashboard's recent scans show, and its Known gaps / open-question entry for this issue is removed.
• Format, build, tests, analyzer gate and coverage gate pass (.squad/stack.md).

Implementation notes

• This is a text-only change in two Razor files, plus tests and the area document. No service, configuration, README or migration changes.
• Do not add scan runs for the discovery, synchronization, resource statistics or cleanup jobs. That option was rejected, and it would also change:
  • retention (ScanCleanupBackgroundService keeps the latest 20 runs per type)
  • the stale-run repair
  • inventory telemetry
  • the last activity value in the top bar
• Out of scope: the Scan History Type column shows raw enum names (ObservedImage, RuntimeContainer, Vulnerability). Friendlier labels are not part of this issue.

Related

• [Docs] Describe the current behavior by area #263 (area documents)

Generated by Claude Code