Require verified write semantics before split-summary repair #4363

🤖 Generated by the Agentic Engineer

Problem

The split-summary section of docs/kubescape-result-coverage.md recommends deletion followed by a rescan. A version mismatch establishes inconsistent storage; it does not establish that a destructive operation will honor object identity and version preconditions or preserve newer scanner output. The current recipe supplies no such proof. It can remove the result operators need to diagnose the coverage gap.

Intended outcome

Operators retain inconsistent results while the storage repair is designed and verified. The runbook gives concrete evidence requirements for a reviewed repair and clearly separates coherent storage from a fresh scan and complete vulnerability coverage.

Smallest useful change

Replace the unconditional deletion recommendation with preservation and repeat-read guidance. Require a reviewed operation with verified write semantics, identity/version checks, recovery and post-repair scanner readback before any mutation. Keep the coverage detector read-only and fail-closed, and leave #4263 open for the implementation and coverage outcome.

Acceptance criteria

• The runbook no longer prescribes deletion as the routine repair for a version split.
• Repeat complete reads distinguish a lasting split from a concurrent scan or an unknown read.
• Repair requirements cover original identity, both observed versions, concurrent scanner writes, recovery and fresh GET/LIST agreement.
• It explicitly requires a subsequent successful scan and the full coverage check; repairing metadata alone is not a fresh scan or complete coverage.
• No scanner object, scan scope, alert or validation rule is changed.

Success signal: the merged operator guidance cannot authorize an unverified destructive repair. Documentation-only, small. Part of #4263.