Guard /internal/refresh per game so a feed escape cannot 500 it

[bgard68]

Twice now a feed has thrown a type RefreshGame's catch filter did not match — XmlException from MegaMillions (#117), then plain ArgumentException from Draw.Create (#126) — and both times this endpoint answered 500. It is what the keep-alive workflow calls, so a 500 reads as the whole instance being down.

Each was fixed at its source. The endpoint itself still had no guard, so the next escape would do exactly the same thing. This closes the class rather than the instances.

Per game, not around the loop

The unguarded loop aborted on the first throw, so every game after the failing one was silently skipped — a second, quieter bug in the same code.

The catch is not a swallow

catch (Exception ex) when (ex is not OperationCanceledException)
{
    logger.LogError(ex, "{Game}: refresh failed, reporting it as a feed error.", game);
    results.Add(new RefreshResult(game, UpToDate: false, NewDraws: 0,
        SkippedInvalid: 0, JackpotUpdated: false, FeedError: ex.Message));
}

It logs the exception with its game, and records a RefreshResult carrying the message as feedError — the same shape the response already uses for the failures RefreshGame does anticipate. Callers get a 200 with the error named per game, which is the existing contract, not a new one.

OperationCanceledException is deliberately excluded: a shutdown or a disconnected client is not a feed failure and must keep propagating.

Tests

Two, both verified to fail without the guard before being accepted:

• AnUnanticipatedFeedFailure_IsReported_NotA500 — a feed throwing NotSupportedException (a type nothing in the chain anticipates) yields 200 with the error reported.
• OneGameFailing_DoesNotCostTheOtherItsRefresh — both games still appear, and the healthy one has no feedError.

321 tests pass, dotnet build -warnaserror with zero warnings.

🤖 Generated with Claude Code