fix aggregation logic

internal/vcenter/vcenter.go

@@ -208,30 +208,41 @@ func (v *Vcenter) FindVmDeletionEvents(ctx context.Context, begin, end time.Time
 	endUTC := end.UTC()
 	mgr := event.NewManager(v.client.Client)
 
+	recordDeletion := func(vmID string, ts time.Time) {
+		if vmID == "" {
+			return
+		}
+		if prev, ok := result[vmID]; !ok || ts.Before(prev) {
+			result[vmID] = ts
+		}
+	}
+
+	isDeletionMessage := func(msg string) bool {
+		msg = strings.ToLower(msg)
+		return strings.Contains(msg, "destroy") || strings.Contains(msg, "deleted")
+	}
+
 	processEvents := func(evts []types.BaseEvent) {
 		for _, ev := range evts {
 			switch e := ev.(type) {
 			case *types.VmRemovedEvent:
 				if e.Vm != nil {
 					vmID := e.Vm.Vm.Value
-					if vmID != "" {
-						result[vmID] = e.CreatedTime
-					}
+					recordDeletion(vmID, e.CreatedTime)
 				}
 			case *types.TaskEvent:
 				// Fallback for destroy task events.
 				if e.Info.Entity != nil {
 					vmID := e.Info.Entity.Value
-					msg := strings.ToLower(e.GetEvent().FullFormattedMessage)
-					if vmID != "" && (strings.Contains(msg, "destroy") || strings.Contains(msg, "deleted")) {
-						result[vmID] = e.CreatedTime
+					if vmID != "" && isDeletionMessage(e.GetEvent().FullFormattedMessage) {
+						recordDeletion(vmID, e.CreatedTime)
 					}
 				}
 			case *types.VmEvent:
 				if e.Vm != nil {
 					vmID := e.Vm.Vm.Value
-					if vmID != "" {
-						result[vmID] = e.CreatedTime
+					if vmID != "" && isDeletionMessage(e.GetEvent().FullFormattedMessage) {
+						recordDeletion(vmID, e.CreatedTime)
 					}
 				}
 			}