Docker update alerts resolved and re-fired a full delay later with no
fresh registry check in between (#2353). Image inspect shares the
15-second per-container collection budget with the sized container
inspect, stats and filesystem calls, so on a busy host it can time out.
The agent then compared an empty local digest, which reads as "not
different", and reported UpdateAvailable false with no error. The server
took that as recovery, resolved the alert and restarted the delay.
Agent: fall back to the last successful inspect of the same image ID
(an image ID names immutable content), pruned to the images in use. With
no earlier inspect, send no update status, which the server already
treats as unknown.
Server: a no-update status without a current digest is not a comparison,
so treat it like an absent or failed check. This also covers agents that
predate the fix. Only the agent produces these statuses and it always
sends the digest it compared; locally built images never assert an
update. The retention tests' clear fixtures now carry a current digest,
as real agents do.
rcourtman
2bd9000faf