@oneuptime/common 12.0.0 → 12.0.2

package/Server/Services/CephClusterService.ts

@@ -229,11 +229,14 @@ export class Service extends DatabaseService<Model> {
     }
 
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    const data: any = {
+    const liveness: any = {
       lastSeenAt: OneUptimeDate.getCurrentDate(),
       otelCollectorStatus: "connected",
     };
 
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const data: any = { ...liveness };
+
     if (extra?.cephVersion) {
       data.cephVersion = extra.cephVersion;
     }
@@ -273,11 +276,50 @@ export class Service extends DatabaseService<Model> {
      * Heartbeat write: a single-statement UPDATE with no hooks and no
      * `version` bump, avoiding the hot-row Postgres lock convoy that the
      * full updateOneById pipeline causes. See ServiceService.updateLastSeen.
+     *
+     * Collector-supplied strings are clamped to their declared column
+     * widths inside updateColumnsByIdWithoutHooks — see
+     * DatabaseService.truncateStringColumnsToMaxLength.
      */
-    await this.updateColumnsByIdWithoutHooks({
-      id: clusterId,
-      data: data,
-    });
+    try {
+      await this.updateColumnsByIdWithoutHooks({
+        id: clusterId,
+        data: data,
+      });
+    } catch (err) {
+      /*
+       * Liveness must survive bad metadata. The enriched write carries
+       * `lastSeenAt` and `otelCollectorStatus` alongside optional,
+       * collector-supplied columns; if any one of them makes Postgres
+       * reject the statement, lastSeenAt silently stops advancing and
+       * markDisconnectedClusters flips a perfectly healthy Ceph cluster to
+       * "disconnected" 15 minutes later — with telemetry still arriving the
+       * whole time. That was issue #3006 on the Host path (a host.ip list
+       * longer than the then-varchar(500) column). Retry with liveness only
+       * so the enrichment is what gets dropped, never the heartbeat.
+       */
+      logger.warn(
+        `CephClusterService.updateLastSeen: metadata write failed for Ceph cluster ${clusterId.toString()}, falling back to a liveness-only update: ${
+          err instanceof Error ? err.message : String(err)
+        }`,
+      );
+
+      /*
+       * The throttle fingerprint was already stored, so without this the
+       * next batch would short-circuit on a cache hit and skip the retry
+       * for the rest of the window.
+       */
+      try {
+        await GlobalCache.deleteKey(LAST_SEEN_CACHE_NAMESPACE, cacheKey);
+      } catch {
+        // Best-effort; the fallback write below is what actually matters.
+      }
+
+      await this.updateColumnsByIdWithoutHooks({
+        id: clusterId,
+        data: liveness,
+      });
+    }
   }
 
   /**

package/Server/Services/CephResourceService.ts

@@ -1,8 +1,10 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/CephResource";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import ColumnLength from "../../Types/Database/ColumnLength";
 import ObjectID from "../../Types/ObjectID";
 import OneUptimeDate from "../../Types/Date";
+import { truncateShortText } from "../Utils/Database/TruncateColumnValue";
 import logger from "../Utils/Logger";
 
 /*
@@ -86,6 +88,26 @@ const UPSERT_COLUMNS: Array<string> = [
   "version",
 ];
 
+/*
+ * CephResource's text columns are all ShortText (100 chars). The bulk
+ * paths below go through manager.query(), which skips the length
+ * validation DatabaseService applies to ordinary writes, so a single
+ * oversized value aborts the whole 500-row INSERT chunk it rides in.
+ * Clamp per value instead, so one pathological daemon can never drop
+ * the rest of the scrape.
+ */
+function sanitizeResource(r: ParsedCephResource): ParsedCephResource {
+  return {
+    ...r,
+    kind: truncateShortText(r.kind),
+    externalId: truncateShortText(r.externalId),
+    name: truncateShortText(r.name),
+    hostname: truncateShortText(r.hostname),
+    daemonVersion: truncateShortText(r.daemonVersion),
+    deviceClass: truncateShortText(r.deviceClass),
+  };
+}
+
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
@@ -112,9 +134,21 @@ export class Service extends DatabaseService<Model> {
       return;
     }
 
+    const resources: Array<ParsedCephResource> = data.resources.map(
+      (r: ParsedCephResource) => {
+        const sanitized: ParsedCephResource = sanitizeResource(r);
+        if (sanitized.externalId !== r.externalId) {
+          logger.warn(
+            `CephResource externalId exceeds ${ColumnLength.ShortText} chars; truncated to "${sanitized.externalId}" (cluster ${data.cephClusterId.toString()}).`,
+          );
+        }
+        return sanitized;
+      },
+    );
+
     // Chunk to keep individual statement parameter counts reasonable.
-    for (let i: number = 0; i < data.resources.length; i += UPSERT_BATCH_SIZE) {
-      const chunk: Array<ParsedCephResource> = data.resources.slice(
+    for (let i: number = 0; i < resources.length; i += UPSERT_BATCH_SIZE) {
+      const chunk: Array<ParsedCephResource> = resources.slice(
         i,
         i + UPSERT_BATCH_SIZE,
       );
@@ -218,9 +252,14 @@ export class Service extends DatabaseService<Model> {
         valueFragments.push(
           `($${paramIndex++}, $${paramIndex++}, $${paramIndex++}::bigint, $${paramIndex++}::bigint, $${paramIndex++}::numeric, $${paramIndex++}::numeric, $${paramIndex++}::integer, $${paramIndex++}::bigint, $${paramIndex++}::bigint, $${paramIndex++}::bigint, $${paramIndex++}::bigint, $${paramIndex++}::bigint, $${paramIndex++}::timestamptz)`,
         );
+        /*
+         * The identity clamps MUST match bulkUpsert's, or this mirror
+         * UPDATE would silently miss the row the upsert just wrote
+         * under the truncated externalId.
+         */
         params.push(
-          m.kind,
-          m.externalId,
+          truncateShortText(m.kind),
+          truncateShortText(m.externalId),
           bigintOrNull(m.statBytes),
           bigintOrNull(m.statBytesUsed),
           m.applyLatencyMs !== null && m.applyLatencyMs !== undefined

package/Server/Services/CloudResourceService.ts

@@ -199,11 +199,14 @@ export class Service extends DatabaseService<Model> {
     }
 
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    const data: any = {
+    const liveness: any = {
       lastSeenAt: OneUptimeDate.getCurrentDate(),
       otelCollectorStatus: "connected",
     };
 
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const data: any = { ...liveness };
+
     if (extra?.agentVersion) {
       data.agentVersion = extra.agentVersion;
     }
@@ -230,11 +233,50 @@ export class Service extends DatabaseService<Model> {
      * Heartbeat write: a single-statement UPDATE with no hooks and no
      * `version` bump, avoiding the hot-row Postgres lock convoy that the
      * full updateOneById pipeline causes. See ServiceService.updateLastSeen.
+     *
+     * Collector-supplied strings are clamped to their declared column
+     * widths inside updateColumnsByIdWithoutHooks — see
+     * DatabaseService.truncateStringColumnsToMaxLength.
      */
-    await this.updateColumnsByIdWithoutHooks({
-      id: cloudResourceId,
-      data: data,
-    });
+    try {
+      await this.updateColumnsByIdWithoutHooks({
+        id: cloudResourceId,
+        data: data,
+      });
+    } catch (err) {
+      /*
+       * Liveness must survive bad metadata. The enriched write carries
+       * `lastSeenAt` and `otelCollectorStatus` alongside optional,
+       * collector-supplied columns; if any one of them makes Postgres
+       * reject the statement, lastSeenAt silently stops advancing and
+       * markDisconnectedResources flips a perfectly healthy cloud resource
+       * to "disconnected" 15 minutes later — with telemetry still arriving
+       * the whole time. That was issue #3006 on the Host path (a host.ip
+       * list longer than the then-varchar(500) column). Retry with liveness
+       * only so the enrichment is what gets dropped, never the heartbeat.
+       */
+      logger.warn(
+        `CloudResourceService.updateLastSeen: metadata write failed for cloud resource ${cloudResourceId.toString()}, falling back to a liveness-only update: ${
+          err instanceof Error ? err.message : String(err)
+        }`,
+      );
+
+      /*
+       * The throttle fingerprint was already stored, so without this the
+       * next batch would short-circuit on a cache hit and skip the retry
+       * for the rest of the window.
+       */
+      try {
+        await GlobalCache.deleteKey(LAST_SEEN_CACHE_NAMESPACE, cacheKey);
+      } catch {
+        // Best-effort; the fallback write below is what actually matters.
+      }
+
+      await this.updateColumnsByIdWithoutHooks({
+        id: cloudResourceId,
+        data: liveness,
+      });
+    }
   }
 
   @CaptureSpan()

package/Server/Services/DatabaseService.ts

@@ -1046,6 +1046,61 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     return data;
   }
 
+  /*
+   * Clamp string values to the max length their column declares, instead of
+   * rejecting the whole write the way checkMaxLengthOfFields does.
+   *
+   * For machine-stamped metadata harvested from OpenTelemetry resource
+   * attributes there is no user to show a validation error to, and the
+   * write these values ride along with also carries liveness columns
+   * (lastSeenAt / otelCollectorStatus). Letting one oversized optional
+   * attribute abort that statement strands a healthy resource as
+   * "disconnected" — the failure mode in issue #3006. A clipped display
+   * string is strictly better than a lost heartbeat.
+   *
+   * Only string values on columns with a declared max length are touched;
+   * `text` columns (VeryLongText and friends) declare none and pass
+   * through untouched, as do numbers, dates and ObjectIDs.
+   *
+   * The raw, hook-free write paths (updateColumnsByIdWithoutHooks and
+   * atomicAddToColumnsByIdWithoutHooks) call this themselves, so callers do
+   * NOT need to — and must not rely on being able to skip it by writing a
+   * new raw path of their own. It is NOT a substitute for sizing a column
+   * correctly: if a field is legitimately long, widen the column.
+   */
+  public truncateStringColumnsToMaxLength(
+    data: Record<string, unknown>,
+  ): Record<string, unknown> {
+    for (const column of Object.keys(data)) {
+      const value: unknown = data[column];
+
+      if (typeof value !== "string" || value.length === 0) {
+        continue;
+      }
+
+      /*
+       * Returns undefined for an unmapped column name despite its type —
+       * leave those alone and let the write path complain about them.
+       */
+      const metadata: TableColumnMetadata | undefined =
+        this.model.getTableColumnMetadata(column);
+
+      if (!metadata?.type) {
+        continue;
+      }
+
+      const maxLength: number | undefined = getMaxLengthFromTableColumnType(
+        metadata.type,
+      );
+
+      if (maxLength !== undefined && value.length > maxLength) {
+        data[column] = value.substring(0, maxLength);
+      }
+    }
+
+    return data;
+  }
+
   private async checkTotalItemsBy(
     createdBy: CreateBy<TBaseModel>,
   ): Promise<void> {
@@ -2248,6 +2303,17 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
    * the caller), and every value is bound as a parameter, so this is not an
    * injection surface. Use ONLY for trusted, internal, side-effect-free
    * column writes where the full pipeline is pure overhead.
+   *
+   * Oversized strings are CLAMPED here (truncateStringColumnsToMaxLength)
+   * rather than rejected. Skipping the hooks also skips
+   * checkMaxLengthOfFields, so before this an over-long value reached
+   * Postgres raw and failed the ENTIRE statement — including whatever else
+   * rode along with it. On the telemetry liveness writes that is fatal: one
+   * over-long OpenTelemetry resource attribute took `lastSeenAt` down with
+   * it and markDisconnected* stranded a healthy resource as "disconnected"
+   * 15 minutes later while its data kept arriving (issue #3006). Clamping
+   * in here, at the choke point, is what makes that unforgettable — every
+   * caller of this path gets it, including ones not written yet.
    */
   @CaptureSpan()
   public async updateColumnsByIdWithoutHooks(input: {
@@ -2273,9 +2339,16 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     const setClauses: Array<string> = [];
     const params: Array<unknown> = [];
 
-    for (const [propertyName, value] of Object.entries(
-      input.data as ObjectLiteral,
-    )) {
+    /*
+     * Clamp on a shallow COPY: callers must not have their own object
+     * mutated behind their back (a liveness-only retry, for instance,
+     * rebuilds its payload from the same source values).
+     */
+    const data: ObjectLiteral = this.truncateStringColumnsToMaxLength({
+      ...(input.data as ObjectLiteral),
+    });
+
+    for (const [propertyName, value] of Object.entries(data)) {
       const column: ColumnMetadata | undefined =
         metadata.findColumnWithPropertyName(propertyName);
       if (!column) {
@@ -2347,6 +2420,11 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
    * caller) and every value is bound as a parameter, so this is not an
    * injection surface. Use ONLY for trusted, internal, side-effect-free
    * column writes.
+   *
+   * `set` values are clamped to their column widths for the same reason
+   * updateColumnsByIdWithoutHooks clamps: this path also skips
+   * checkMaxLengthOfFields, and an over-long string here would abort the
+   * counter increments riding in the same statement.
    */
   @CaptureSpan()
   public async atomicAddToColumnsByIdWithoutHooks(input: {
@@ -2393,9 +2471,12 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
       setClauses.push(`${quoted} = COALESCE(${quoted}, 0) + $${params.length}`);
     }
 
-    for (const [propertyName, value] of Object.entries(
-      (input.set || {}) as ObjectLiteral,
-    )) {
+    // Shallow copy — never mutate the caller's object. See the clamp note above.
+    const set: ObjectLiteral = this.truncateStringColumnsToMaxLength({
+      ...((input.set || {}) as ObjectLiteral),
+    });
+
+    for (const [propertyName, value] of Object.entries(set)) {
       if (typeof value === "function") {
         throw new BadDataException(
           `atomicAddToColumnsByIdWithoutHooks: SQL-expression values are not supported (column "${propertyName}"); pass a literal value.`,

package/Server/Services/DockerHostService.ts

@@ -221,11 +221,14 @@ export class Service extends DatabaseService<Model> {
     }
 
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    const data: any = {
+    const liveness: any = {
       lastSeenAt: OneUptimeDate.getCurrentDate(),
       otelCollectorStatus: "connected",
     };
 
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const data: any = { ...liveness };
+
     if (extra?.osType) {
       data.osType = extra.osType;
     }
@@ -240,11 +243,50 @@ export class Service extends DatabaseService<Model> {
      * Heartbeat write: a single-statement UPDATE with no hooks and no
      * `version` bump, avoiding the hot-row Postgres lock convoy that the
      * full updateOneById pipeline causes. See ServiceService.updateLastSeen.
+     *
+     * Collector-supplied strings are clamped to their declared column
+     * widths inside updateColumnsByIdWithoutHooks — see
+     * DatabaseService.truncateStringColumnsToMaxLength.
      */
-    await this.updateColumnsByIdWithoutHooks({
-      id: hostId,
-      data: data,
-    });
+    try {
+      await this.updateColumnsByIdWithoutHooks({
+        id: hostId,
+        data: data,
+      });
+    } catch (err) {
+      /*
+       * Liveness must survive bad metadata. The enriched write carries
+       * `lastSeenAt` and `otelCollectorStatus` alongside optional,
+       * collector-supplied columns; if any one of them makes Postgres
+       * reject the statement, lastSeenAt silently stops advancing and
+       * markDisconnectedHosts flips a perfectly healthy Docker host to
+       * "disconnected" 15 minutes later — with telemetry still arriving the
+       * whole time. That was issue #3006 on the Host path (a host.ip list
+       * longer than the then-varchar(500) column). Retry with liveness only
+       * so the enrichment is what gets dropped, never the heartbeat.
+       */
+      logger.warn(
+        `DockerHostService.updateLastSeen: metadata write failed for Docker host ${hostId.toString()}, falling back to a liveness-only update: ${
+          err instanceof Error ? err.message : String(err)
+        }`,
+      );
+
+      /*
+       * The throttle fingerprint was already stored, so without this the
+       * next batch would short-circuit on a cache hit and skip the retry
+       * for the rest of the window.
+       */
+      try {
+        await GlobalCache.deleteKey(LAST_SEEN_CACHE_NAMESPACE, cacheKey);
+      } catch {
+        // Best-effort; the fallback write below is what actually matters.
+      }
+
+      await this.updateColumnsByIdWithoutHooks({
+        id: hostId,
+        data: liveness,
+      });
+    }
   }
 
   /**

package/Server/Services/DockerResourceService.ts

@@ -1,9 +1,14 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/DockerResource";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import ColumnLength from "../../Types/Database/ColumnLength";
 import ObjectID from "../../Types/ObjectID";
 import OneUptimeDate from "../../Types/Date";
 import { JSONObject } from "../../Types/JSON";
+import {
+  truncateLongText,
+  truncateShortText,
+} from "../Utils/Database/TruncateColumnValue";
 import logger from "../Utils/Logger";
 
 /*
@@ -56,6 +61,35 @@ export interface DockerHostInventoryCounts {
 const UPSERT_BATCH_SIZE: number = 500;
 const STALE_DELETE_WARN_THRESHOLD: number = 100;
 
+/*
+ * DockerResource's text columns are bounded varchars — name / imageName
+ * at 500 chars, kind / containerId / state at 100. These bulk paths go
+ * through manager.query(), which skips the length validation
+ * DatabaseService applies to ordinary writes, so a single oversized
+ * value aborts the whole 500-row INSERT chunk it rides in. Clamp per
+ * value instead, so one pathological container can never drop the rest.
+ */
+function sanitizeContainer(c: ParsedDockerContainer): ParsedDockerContainer {
+  return {
+    ...c,
+    containerName: truncateLongText(c.containerName),
+    containerId: truncateShortText(c.containerId),
+    imageName: truncateLongText(c.imageName),
+    state: truncateShortText(c.state),
+  };
+}
+
+function sanitizeResource(r: ParsedDockerResource): ParsedDockerResource {
+  return {
+    ...r,
+    kind: truncateShortText(r.kind),
+    name: truncateLongText(r.name),
+    containerId: truncateShortText(r.containerId),
+    imageName: truncateLongText(r.imageName),
+    state: truncateShortText(r.state),
+  };
+}
+
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
@@ -83,12 +117,20 @@ export class Service extends DatabaseService<Model> {
       return;
     }
 
-    for (
-      let i: number = 0;
-      i < data.containers.length;
-      i += UPSERT_BATCH_SIZE
-    ) {
-      const chunk: Array<ParsedDockerContainer> = data.containers.slice(
+    const containers: Array<ParsedDockerContainer> = data.containers.map(
+      (c: ParsedDockerContainer) => {
+        const sanitized: ParsedDockerContainer = sanitizeContainer(c);
+        if (sanitized.containerName !== c.containerName) {
+          logger.warn(
+            `DockerResource container name exceeds ${ColumnLength.LongText} chars; truncated to "${sanitized.containerName}" (host ${data.dockerHostId.toString()}).`,
+          );
+        }
+        return sanitized;
+      },
+    );
+
+    for (let i: number = 0; i < containers.length; i += UPSERT_BATCH_SIZE) {
+      const chunk: Array<ParsedDockerContainer> = containers.slice(
         i,
         i + UPSERT_BATCH_SIZE,
       );
@@ -164,8 +206,20 @@ export class Service extends DatabaseService<Model> {
       return;
     }
 
-    for (let i: number = 0; i < data.resources.length; i += UPSERT_BATCH_SIZE) {
-      const chunk: Array<ParsedDockerResource> = data.resources.slice(
+    const resources: Array<ParsedDockerResource> = data.resources.map(
+      (r: ParsedDockerResource) => {
+        const sanitized: ParsedDockerResource = sanitizeResource(r);
+        if (sanitized.name !== r.name) {
+          logger.warn(
+            `DockerResource name exceeds ${ColumnLength.LongText} chars; truncated to "${sanitized.name}" (host ${data.dockerHostId.toString()}).`,
+          );
+        }
+        return sanitized;
+      },
+    );
+
+    for (let i: number = 0; i < resources.length; i += UPSERT_BATCH_SIZE) {
+      const chunk: Array<ParsedDockerResource> = resources.slice(
         i,
         i + UPSERT_BATCH_SIZE,
       );

package/Server/Services/DockerSwarmClusterService.ts

@@ -231,11 +231,14 @@ export class Service extends DatabaseService<Model> {
     }
 
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    const data: any = {
+    const liveness: any = {
       lastSeenAt: OneUptimeDate.getCurrentDate(),
       otelCollectorStatus: "connected",
     };
 
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const data: any = { ...liveness };
+
     if (extra?.dockerVersion) {
       data.dockerVersion = extra.dockerVersion;
     }
@@ -275,11 +278,51 @@ export class Service extends DatabaseService<Model> {
      * Heartbeat write: a single-statement UPDATE with no hooks and no
      * `version` bump, avoiding the hot-row Postgres lock convoy that the
      * full updateOneById pipeline causes. See ServiceService.updateLastSeen.
+     *
+     * Collector-supplied strings are clamped to their declared column
+     * widths inside updateColumnsByIdWithoutHooks — see
+     * DatabaseService.truncateStringColumnsToMaxLength.
      */
-    await this.updateColumnsByIdWithoutHooks({
-      id: clusterId,
-      data: data,
-    });
+    try {
+      await this.updateColumnsByIdWithoutHooks({
+        id: clusterId,
+        data: data,
+      });
+    } catch (err) {
+      /*
+       * Liveness must survive bad metadata. The enriched write carries
+       * `lastSeenAt` and `otelCollectorStatus` alongside optional,
+       * collector-supplied columns; if any one of them makes Postgres
+       * reject the statement, lastSeenAt silently stops advancing and
+       * markDisconnectedClusters flips a perfectly healthy Docker Swarm
+       * cluster to "disconnected" 15 minutes later — with telemetry still
+       * arriving the whole time. That was issue #3006 on the Host path (a
+       * host.ip list longer than the then-varchar(500) column). Retry with
+       * liveness only so the enrichment is what gets dropped, never the
+       * heartbeat.
+       */
+      logger.warn(
+        `DockerSwarmClusterService.updateLastSeen: metadata write failed for Docker Swarm cluster ${clusterId.toString()}, falling back to a liveness-only update: ${
+          err instanceof Error ? err.message : String(err)
+        }`,
+      );
+
+      /*
+       * The throttle fingerprint was already stored, so without this the
+       * next batch would short-circuit on a cache hit and skip the retry
+       * for the rest of the window.
+       */
+      try {
+        await GlobalCache.deleteKey(LAST_SEEN_CACHE_NAMESPACE, cacheKey);
+      } catch {
+        // Best-effort; the fallback write below is what actually matters.
+      }
+
+      await this.updateColumnsByIdWithoutHooks({
+        id: clusterId,
+        data: liveness,
+      });
+    }
   }
 
   /**

package/Server/Services/DockerSwarmResourceService.ts

@@ -1,9 +1,14 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/DockerSwarmResource";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import ColumnLength from "../../Types/Database/ColumnLength";
 import ObjectID from "../../Types/ObjectID";
 import OneUptimeDate from "../../Types/Date";
 import { JSONObject } from "../../Types/JSON";
+import {
+  truncateLongText,
+  truncateShortText,
+} from "../Utils/Database/TruncateColumnValue";
 import logger from "../Utils/Logger";
 
 /*
@@ -95,6 +100,33 @@ const UPSERT_COLUMNS: Array<string> = [
   "version",
 ];
 
+/*
+ * DockerSwarmResource's text columns are bounded varchars — image at
+ * 500 chars, everything else at 100. The bulk paths below go through
+ * manager.query(), which skips the length validation DatabaseService
+ * applies to ordinary writes, so a single oversized value aborts the
+ * whole 500-row INSERT chunk it rides in. Clamp per value instead, so
+ * one pathological task can never drop the rest of the snapshot.
+ */
+function sanitizeResource(
+  r: ParsedDockerSwarmResource,
+): ParsedDockerSwarmResource {
+  return {
+    ...r,
+    kind: truncateShortText(r.kind),
+    externalId: truncateShortText(r.externalId),
+    name: truncateShortText(r.name),
+    state: truncateShortText(r.state),
+    role: truncateShortText(r.role),
+    serviceMode: truncateShortText(r.serviceMode),
+    image: truncateLongText(r.image),
+    stackName: truncateShortText(r.stackName),
+    serviceName: truncateShortText(r.serviceName),
+    nodeHostname: truncateShortText(r.nodeHostname),
+    driver: truncateShortText(r.driver),
+  };
+}
+
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
@@ -120,8 +152,20 @@ export class Service extends DatabaseService<Model> {
       return;
     }
 
-    for (let i: number = 0; i < data.resources.length; i += UPSERT_BATCH_SIZE) {
-      const chunk: Array<ParsedDockerSwarmResource> = data.resources.slice(
+    const resources: Array<ParsedDockerSwarmResource> = data.resources.map(
+      (r: ParsedDockerSwarmResource) => {
+        const sanitized: ParsedDockerSwarmResource = sanitizeResource(r);
+        if (sanitized.externalId !== r.externalId) {
+          logger.warn(
+            `DockerSwarmResource externalId exceeds ${ColumnLength.ShortText} chars; truncated to "${sanitized.externalId}" (cluster ${data.dockerSwarmClusterId.toString()}).`,
+          );
+        }
+        return sanitized;
+      },
+    );
+
+    for (let i: number = 0; i < resources.length; i += UPSERT_BATCH_SIZE) {
+      const chunk: Array<ParsedDockerSwarmResource> = resources.slice(
         i,
         i + UPSERT_BATCH_SIZE,
       );
@@ -231,9 +275,14 @@ export class Service extends DatabaseService<Model> {
         valueFragments.push(
           `($${paramIndex++}, $${paramIndex++}, $${paramIndex++}::numeric, $${paramIndex++}::bigint, $${paramIndex++}::bigint, $${paramIndex++}::numeric, $${paramIndex++}::timestamptz)`,
         );
+        /*
+         * The identity clamps MUST match bulkUpsert's, or this mirror
+         * UPDATE would silently miss the row the upsert just wrote
+         * under the truncated externalId.
+         */
         params.push(
-          m.kind,
-          m.externalId,
+          truncateShortText(m.kind),
+          truncateShortText(m.externalId),
           m.cpuPercent !== null && m.cpuPercent !== undefined
             ? m.cpuPercent
             : null,