Asset rows created before nessus_host_uuid was pinned (matched by IP
or hostname in older syncs) are silently skipped by
reconcile_missing_from_sync because id_field.isnot(None) excludes
them. After a reduced scan they stay ACTIVE forever, contradicting
the "sync-driven INACTIVE" promise in feedback 808246f.
- asset_lifecycle.reconcile_missing_from_sync: log a count of legacy
unpinned ACTIVE assets so the next tester reproduction surfaces
the root cause immediately.
- nessus_sync.reconcile_legacy_nessus_assets: one-shot helper that
flips these rows to INACTIVE with an audit-log entry, safe to run
multiple times.
Fixes feedback 2026-06-02 #3 (INACTIVE not flipping on reduced scan).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
vulncheck
3a68ef7fc2