fix(runtime): advance idle discovery freshness heartbeat

[pureliture]

What

• Advance REPO_HEALTH.lastSuccessfulIncrementalAt when incremental discovery successfully confirms that a repository has no new incremental work.
• Keep DISCOVERY_MODE_INITIALIZE, missing cursor, non-fast-forward, and pending-work paths from marking a repository fresh.
• Add regression coverage for idle skip, unchanged refs, no refs, and all-ledger-skipped paths.

Why

lastSuccessfulIncrementalAt is an incremental discovery heartbeat, not proof that every commit scan completed. When discover-updates --ls-remote-skip or the fetch path confirms no new work, freshness should not report a stale repository solely because it was idle.

Actual scan completion and dedupe proof remain in SCAN_JOB and SCAN_LEDGER. Baseline freshness remains separate through lastSuccessfulFullScanAt.

Review

• Reviewed locally by codebase_architecture_manager; initial initialize/no-refs blocker was fixed.
• Reviewed locally by system_architecture_manager; no remaining system-level blocker.

Verification

• uv run ruff check src/security_scanner/runtime/incremental_discovery.py tests/test_incremental_discovery.py tests/test_m4_poll_baseline.py
• uv run pytest tests/test_incremental_discovery.py tests/test_m4_poll_baseline.py tests/test_cli_timer_entrypoints.py tests/test_repo_health_freshness.py
• uv run pytest

Closes #61

[gemini-code-assist]

Code Review

This pull request updates the incremental discovery process to track skipped idle targets and conditionally advance repository health when running in enqueue mode, ensuring repositories are marked as incrementally fresh when no new work is observed. The reviewer suggests wrapping the advance_repo_health calls in try-except blocks to prevent transient database failures from aborting the discovery process, as these are best-effort, non-transactional operations.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The advance_repo_health call is a best-effort, non-transactional secondary operation. To prevent transient database failures from aborting the entire incremental discovery process, this call should be wrapped in a try-except block.

    if request.mode == DISCOVERY_MODE_ENQUEUE:
        for target in skipped_idle_targets:
            try:
                request.store.advance_repo_health(
                    repo_id_for_scan_target_url(target.url),
                    job_type=JOB_TYPE_INCREMENTAL,
                    completed_at=_now(request),
                )
            except Exception:
                import logging
                logging.getLogger(__name__).warning(
                    "Failed to advance repo health for %s",
                    target.url,
                    exc_info=True,
                )

References

1. Best-effort or non-transactional secondary operations (such as writing secondary lookup pointers or logs) should be wrapped in try-except blocks to ensure that transient failures in these operations do not abort or roll back the main transaction.

[gemini-code-assist]

The advance_repo_health call is a best-effort, non-transactional secondary operation. To prevent transient database failures from aborting the entire incremental discovery process, this call should be wrapped in a try-except block.

            if request.mode == DISCOVERY_MODE_ENQUEUE:
                try:
                    request.store.advance_repo_health(
                        repo_id,
                        job_type=JOB_TYPE_INCREMENTAL,
                        completed_at=_now(request),
                    )
                except Exception:
                    import logging
                    logging.getLogger(__name__).warning(
                        "Failed to advance repo health for %s",
                        repo_id,
                        exc_info=True,
                    )

References

1. Best-effort or non-transactional secondary operations (such as writing secondary lookup pointers or logs) should be wrapped in try-except blocks to ensure that transient failures in these operations do not abort or roll back the main transaction.

[gemini-code-assist]

The advance_repo_health call is a best-effort, non-transactional secondary operation. To prevent transient database failures from aborting the entire incremental discovery process, this call should be wrapped in a try-except block.

        if (
            request.mode == DISCOVERY_MODE_ENQUEUE
            and not pending_work_observed
            and not unsafe_to_mark_fresh
        ):
            try:
                request.store.advance_repo_health(
                    repo_id,
                    job_type=JOB_TYPE_INCREMENTAL,
                    completed_at=_now(request),
                )
            except Exception:
                import logging
                logging.getLogger(__name__).warning(
                    "Failed to advance repo health for %s",
                    repo_id,
                    exc_info=True,
                )

References

1. Best-effort or non-transactional secondary operations (such as writing secondary lookup pointers or logs) should be wrapped in try-except blocks to ensure that transient failures in these operations do not abort or roll back the main transaction.