@oneuptime/common 12.0.31 → 12.0.33

package/build/dist/Server/Services/NetworkSiteService.js

@@ -15,6 +15,9 @@ import MonitorService from "./MonitorService";
 import MonitorStatusService from "./MonitorStatusService";
 import NetworkDeviceService from "./NetworkDeviceService";
 import NetworkSiteStatusTimelineService from "./NetworkSiteStatusTimelineService";
+import NetworkSiteTypeService from "./NetworkSiteTypeService";
+import NetworkSnmpCredentialProfileService from "./NetworkSnmpCredentialProfileService";
+import ProbeService from "./ProbeService";
 import Model from "../../Models/DatabaseModels/NetworkSite";
 import Alert from "../../Models/DatabaseModels/Alert";
 import AlertStateTimeline from "../../Models/DatabaseModels/AlertStateTimeline";
@@ -25,11 +28,13 @@ import QueryHelper from "../Types/Database/QueryHelper";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import NetworkDeviceHydrationUtil from "../Utils/Monitor/NetworkDeviceHydrationUtil";
 import logger from "../Utils/Logger";
+import { NetworkDeviceMonitoringMethodUtil } from "../../Types/NetworkDevice/NetworkDeviceMonitoringMethod";
 import LIMIT_MAX, { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
 import MonitorType from "../../Types/Monitor/MonitorType";
 import ObjectID from "../../Types/ObjectID";
 import OneUptimeDate from "../../Types/Date";
+import PositiveNumber from "../../Types/PositiveNumber";
 import Text from "../../Types/Text";
 import { Raw } from "typeorm";
 import RelationIdUtil from "../Utils/Database/RelationIdUtil";
@@ -37,6 +42,7 @@ import MaterializedPathUtil from "../../Utils/NetworkSite/MaterializedPathUtil";
 import SiteStatusRollupUtil from "../../Utils/NetworkSite/SiteStatusRollupUtil";
 import { parseSiteHealthRollupPolicy } from "../../Types/NetworkSite/SiteHealthRollupPolicy";
 import NetworkSiteMaintenanceSuppression from "../Utils/NetworkSite/NetworkSiteMaintenanceSuppression";
+import NetworkSiteHierarchyLock from "../Utils/NetworkSite/NetworkSiteHierarchyLock";
 import AggregateResultUtil from "../Types/Database/AggregateResultUtil";
 import { deviceRollupStateForGroup, } from "../Utils/NetworkDevice/DeviceHealthAggregation";
 /*
@@ -47,10 +53,354 @@ import { deviceRollupStateForGroup, } from "../Utils/NetworkDevice/DeviceHealthA
  * path rebase entirely. See RelationIdUtil.
  */
 const PARENT_SITE_KEYS = ["parentSiteId", "parentSite"];
+/*
+ * Like parentSite, the site's type can be written either as its FK or as the
+ * serialised relation produced by dashboard forms. Hierarchy validation must
+ * inspect both spellings because TypeORM has not resolved the relation when
+ * the before hooks run.
+ */
+const NETWORK_SITE_TYPE_KEYS = [
+    "networkSiteTypeId",
+    "networkSiteType",
+];
+const PROJECT_KEYS = ["projectId", "project"];
+/*
+ * Both spellings of the site's two monitoring defaults: the probe that polls
+ * devices here, and the SNMP credentials they are walked with.
+ *
+ * Both are references that a device INHERITS - the probe copied onto the
+ * device at write (see NetworkDeviceService), the credentials read live at
+ * poll time (see NetworkDeviceHydrationUtil.resolveSnmpCredentials). So a
+ * cross-project value here is not a cosmetic error on one row: it reaches
+ * every device in the subtree. Watching only the FK spelling would leave the
+ * dashboard's site form - which posts the relation - unguarded, which is the
+ * bug RelationIdUtil exists to document.
+ */
+const PROBE_KEYS = ["probeId", "probe"];
+const SNMP_CREDENTIAL_PROFILE_KEYS = [
+    "snmpCredentialProfileId",
+    "snmpCredentialProfile",
+];
+const MATERIALIZED_HIERARCHY_KEYS = [
+    "materializedPath",
+    "depth",
+];
+/*
+ * Type edits have to inspect every direct child. Keep each read bounded and
+ * page until exhaustion so a very wide site cannot hide invalid edges beyond
+ * DatabaseService's single-query limit.
+ */
+const DIRECT_CHILD_TYPE_VALIDATION_PAGE_SIZE = 1000;
+/*
+ * Rebase large subtrees in bounded pages. Each successful rewrite removes the
+ * row from the old path prefix, so every page must start at offset zero.
+ */
+const SUBTREE_REBASE_PAGE_SIZE = 1000;
+/*
+ * Model instances initialise optional fields to undefined. Those properties
+ * are omissions, not requests to clear a relation; null is the explicit
+ * clear value and must still run validation.
+ */
+function isRelationWritten(data, keys) {
+    return keys.some((key) => {
+        return key in data && data[key] !== undefined;
+    });
+}
+function normalizeId(id) {
+    return id.toString().toLowerCase();
+}
+function sameId(left, right) {
+    return normalizeId(left) === normalizeId(right);
+}
+/*
+ * RelationIdUtil intentionally returns null for anything it cannot resolve.
+ * In a hierarchy hook, however, an unresolvable NON-null value cannot mean
+ * "clear": TypeORM may still interpret a raw expression or relation-shaped
+ * object during the eventual write. Require each supplied spelling to be an
+ * explicit clear or a concrete ID before checking cross-spelling agreement.
+ */
+function readStrictRelationId(data) {
+    for (const key of data.keys) {
+        const value = data.payload[key];
+        if (typeof value === "function") {
+            throw new BadDataException(`${key} cannot be set to a raw SQL expression because the network site hierarchy must be validated against an actual ID.`);
+        }
+        const isExplicitClear = value === null || value === "";
+        if (value !== undefined &&
+            !isExplicitClear &&
+            !RelationIdUtil.read(data.payload, [key])) {
+            throw new BadDataException(`${key} must contain a valid ${data.relationTitle} ID.`);
+        }
+    }
+    return RelationIdUtil.readConsistent(data.payload, data.keys, data.relationTitle);
+}
 export class Service extends DatabaseService {
     constructor() {
         super(Model);
     }
+    /*
+     * Parent/type validation and the eventual write must observe one serialized
+     * project hierarchy. The same distributed lock is used by
+     * NetworkSiteTypeService, because changing either table can invalidate the
+     * other. It surrounds the whole DatabaseService mutation so success-hook
+     * subtree maintenance is protected too and finally always releases it.
+     */
+    async create(createBy) {
+        if (createBy.props.ignoreHooks) {
+            return await super.create(createBy);
+        }
+        const rawData = createBy.data;
+        const projectId = createBy.props.tenantId ||
+            RelationIdUtil.readConsistent(rawData, ["projectId", "project"], "Project") ||
+            null;
+        return await NetworkSiteHierarchyLock.runExclusive({
+            projectIds: projectId ? [projectId] : [],
+            operation: async () => {
+                return await super.create(createBy);
+            },
+        });
+    }
+    async updateOneBy(updateOneBy) {
+        if (updateOneBy.props.ignoreHooks ||
+            !this.updateTouchesHierarchy(updateOneBy.data)) {
+            return await super.updateOneBy(updateOneBy);
+        }
+        const projectIds = await this.findMutationProjectIds({
+            query: updateOneBy.query,
+            props: updateOneBy.props,
+            limit: 1,
+            skip: 0,
+            isDelete: false,
+        });
+        return await NetworkSiteHierarchyLock.runExclusive({
+            projectIds,
+            operation: async () => {
+                return await super.updateOneBy(updateOneBy);
+            },
+        });
+    }
+    async updateBy(updateBy) {
+        if (updateBy.props.ignoreHooks ||
+            !this.updateTouchesHierarchy(updateBy.data)) {
+            return await super.updateBy(updateBy);
+        }
+        const projectIds = await this.findMutationProjectIds({
+            query: updateBy.query,
+            props: updateBy.props,
+            limit: this.positiveNumberValue(updateBy.limit, LIMIT_MAX),
+            skip: this.positiveNumberValue(updateBy.skip, 0),
+            isDelete: false,
+        });
+        return await NetworkSiteHierarchyLock.runExclusive({
+            projectIds,
+            operation: async () => {
+                return await super.updateBy(updateBy);
+            },
+        });
+    }
+    async deleteOneBy(deleteOneBy) {
+        if (deleteOneBy.props.ignoreHooks) {
+            return await super.deleteOneBy(deleteOneBy);
+        }
+        const projectIds = await this.findMutationProjectIds({
+            query: deleteOneBy.query,
+            props: deleteOneBy.props,
+            limit: 1,
+            skip: 0,
+            isDelete: true,
+        });
+        return await NetworkSiteHierarchyLock.runExclusive({
+            projectIds,
+            operation: async () => {
+                return await super.deleteOneBy(deleteOneBy);
+            },
+        });
+    }
+    async deleteBy(deleteBy) {
+        if (deleteBy.props.ignoreHooks) {
+            return await super.deleteBy(deleteBy);
+        }
+        const projectIds = await this.findMutationProjectIds({
+            query: deleteBy.query,
+            props: deleteBy.props,
+            limit: this.positiveNumberValue(deleteBy.limit, LIMIT_MAX),
+            skip: this.positiveNumberValue(deleteBy.skip, 0),
+            isDelete: true,
+        });
+        return await NetworkSiteHierarchyLock.runExclusive({
+            projectIds,
+            operation: async () => {
+                return await super.deleteBy(deleteBy);
+            },
+        });
+    }
+    async hardDeleteBy(deleteBy) {
+        if (deleteBy.props.ignoreHooks) {
+            return await super.hardDeleteBy(deleteBy);
+        }
+        /*
+         * The generic retention cron intentionally queries every tenant at once
+         * by deletedAt. Resolve that open-ended query to a closed set of leaf IDs
+         * before locking and deleting. Deleting leaves only means a limit can
+         * never split a parent from a surviving child; the cron's next iteration
+         * naturally works upward through the tree.
+         */
+        if (!NetworkSiteHierarchyLock.isSafeRootMutationScope({
+            query: deleteBy.query,
+            props: deleteBy.props,
+            tenantScopeIsClosed: true,
+        })) {
+            return await this.hardDeleteClosedLeafBatch(deleteBy);
+        }
+        const projectIds = await this.findMutationProjectIds({
+            query: deleteBy.query,
+            props: deleteBy.props,
+            limit: this.positiveNumberValue(deleteBy.limit, LIMIT_MAX),
+            skip: this.positiveNumberValue(deleteBy.skip, 0),
+            isDelete: true,
+        });
+        return await NetworkSiteHierarchyLock.runExclusive({
+            projectIds,
+            operation: async () => {
+                return await super.hardDeleteBy(deleteBy);
+            },
+        });
+    }
+    updateTouchesHierarchy(data) {
+        const record = data;
+        return (isRelationWritten(record, PARENT_SITE_KEYS) ||
+            isRelationWritten(record, NETWORK_SITE_TYPE_KEYS) ||
+            isRelationWritten(record, PROJECT_KEYS) ||
+            isRelationWritten(record, MATERIALIZED_HIERARCHY_KEYS));
+    }
+    positiveNumberValue(value, fallback) {
+        if (value instanceof PositiveNumber) {
+            return value.toNumber();
+        }
+        return value !== null && value !== void 0 ? value : fallback;
+    }
+    async hardDeleteClosedLeafBatch(deleteBy) {
+        const requestedLimit = this.positiveNumberValue(deleteBy.limit, LIMIT_MAX);
+        if (requestedLimit <= 0) {
+            return 0;
+        }
+        const scanPageSize = Math.min(DIRECT_CHILD_TYPE_VALIDATION_PAGE_SIZE, requestedLimit);
+        const leafSites = [];
+        let scanSkip = this.positiveNumberValue(deleteBy.skip, 0);
+        while (leafSites.length < requestedLimit) {
+            const candidates = await this.findBy({
+                query: deleteBy.query,
+                select: {
+                    _id: true,
+                    projectId: true,
+                },
+                sort: { _id: SortOrder.Ascending },
+                limit: scanPageSize,
+                skip: scanSkip,
+                props: { isRoot: true },
+            });
+            if (candidates.length === 0) {
+                break;
+            }
+            const candidateIds = candidates
+                .map((candidate) => {
+                return candidate.id || null;
+            })
+                .filter((id) => {
+                return Boolean(id);
+            });
+            const parentIdsWithChildren = new Set();
+            for (let parentOffset = 0; parentOffset < candidateIds.length; parentOffset += DIRECT_CHILD_TYPE_VALIDATION_PAGE_SIZE) {
+                const parentIdBatch = candidateIds.slice(parentOffset, parentOffset + DIRECT_CHILD_TYPE_VALIDATION_PAGE_SIZE);
+                let childSkip = 0;
+                while (parentIdBatch.length > 0) {
+                    const children = await this.findBy({
+                        query: {
+                            parentSiteId: QueryHelper.any(parentIdBatch),
+                        },
+                        select: { parentSiteId: true },
+                        sort: { _id: SortOrder.Ascending },
+                        limit: DIRECT_CHILD_TYPE_VALIDATION_PAGE_SIZE,
+                        skip: childSkip,
+                        props: { isRoot: true },
+                    });
+                    for (const child of children) {
+                        if (child.parentSiteId) {
+                            parentIdsWithChildren.add(normalizeId(child.parentSiteId));
+                        }
+                    }
+                    if (children.length < DIRECT_CHILD_TYPE_VALIDATION_PAGE_SIZE) {
+                        break;
+                    }
+                    childSkip += children.length;
+                }
+            }
+            for (const candidate of candidates) {
+                if (candidate.id &&
+                    candidate.projectId &&
+                    !parentIdsWithChildren.has(normalizeId(candidate.id))) {
+                    leafSites.push(candidate);
+                    if (leafSites.length === requestedLimit) {
+                        break;
+                    }
+                }
+            }
+            scanSkip += candidates.length;
+            if (candidates.length < scanPageSize) {
+                break;
+            }
+        }
+        if (leafSites.length === 0) {
+            return 0;
+        }
+        const leafIds = leafSites.map((site) => {
+            return site.id;
+        });
+        return await NetworkSiteHierarchyLock.runExclusive({
+            projectIds: leafSites.map((site) => {
+                return site.projectId;
+            }),
+            operation: async () => {
+                return await super.hardDeleteBy(Object.assign(Object.assign({}, deleteBy), { query: Object.assign(Object.assign({}, deleteBy.query), { _id: QueryHelper.any(leafIds) }), limit: leafIds.length, skip: 0 }));
+            },
+        });
+    }
+    async findMutationProjectIds(data) {
+        NetworkSiteHierarchyLock.assertSafeRootMutationScope({
+            query: data.query,
+            props: data.props,
+            tenantScopeIsClosed: data.isDelete,
+        });
+        const sites = await this.findBy({
+            query: data.isDelete
+                ? this.scopeDeleteQueryToCallerTenant(data.query, data.props)
+                : this.scopeQueryToCallerTenant(data.query, data.props),
+            select: { projectId: true },
+            limit: data.limit,
+            skip: data.skip,
+            props: { isRoot: true },
+        });
+        const projectIds = sites
+            .map((site) => {
+            return site.projectId;
+        })
+            .filter((projectId) => {
+            return Boolean(projectId);
+        });
+        projectIds.push(...NetworkSiteHierarchyLock.getExplicitProjectIds(data.query));
+        if (projectIds.length === 0 && data.props.tenantId) {
+            projectIds.push(data.props.tenantId);
+        }
+        const seenProjectIds = new Set();
+        return projectIds.filter((projectId) => {
+            const normalizedProjectId = normalizeId(projectId);
+            if (seenProjectIds.has(normalizedProjectId)) {
+                return false;
+            }
+            seenProjectIds.add(normalizedProjectId);
+            return true;
+        });
+    }
     /**
      * How many sites sit under each rolled-up MonitorStatus, counted in the
      * database.
@@ -102,7 +452,18 @@ export class Service extends DatabaseService {
      * never see, let alone rewrite, a row outside the caller's project.
      */
     scopeQueryToCallerTenant(query, props) {
-        if (props.isRoot || !props.tenantId) {
+        if (props.isRoot || props.isMasterAdmin || !props.tenantId) {
+            return query;
+        }
+        return Object.assign(Object.assign({}, query), { projectId: props.tenantId });
+    }
+    /*
+     * Root deletes are also tenant-scoped by DeletePermission when tenantId is
+     * present. Mirror that exact rule in the preflight read so limit/skip guard
+     * the same rows the eventual delete can select.
+     */
+    scopeDeleteQueryToCallerTenant(query, props) {
+        if (!props.tenantId || props.isMultiTenantRequest) {
             return query;
         }
         return Object.assign(Object.assign({}, query), { projectId: props.tenantId });
@@ -148,10 +509,10 @@ export class Service extends DatabaseService {
     /*
      * A stored path is trustworthy only when it agrees with parentSiteId: it
      * must end with the site's own id, and the segment before it must be the
-     * parent (nothing before it for a root). A delete that nulls parentSiteId,
-     * or a half-applied move, leaves the two disagreeing - and a stale path
-     * silently corrupts every prefix query built from it, so treat it as
-     * missing and let the caller rebuild.
+     * parent (nothing before it for a root). A legacy delete that nullified
+     * parentSiteId, or a half-applied move, leaves the two disagreeing - and a
+     * stale path silently corrupts every prefix query built from it, so treat
+     * it as missing and let the caller rebuild.
      */
     isPathConsistent(site) {
         if (!site.id) {
@@ -170,32 +531,329 @@ export class Service extends DatabaseService {
             : null;
         return parentSegment === parentId;
     }
+    /*
+     * Resolve a site type with tenant information and its configured direct
+     * parent type. The lookup deliberately runs as root: hook validation occurs
+     * before DatabaseService applies the caller's permission-scoped query, so
+     * the service must see the referenced row and perform the project check
+     * explicitly rather than confuse "foreign" with "missing".
+     */
+    async getNetworkSiteTypeForHierarchy(networkSiteTypeId, cache) {
+        const key = normalizeId(networkSiteTypeId);
+        const cached = cache.get(key);
+        if (cached) {
+            return cached;
+        }
+        const networkSiteType = await NetworkSiteTypeService.findOneById({
+            id: networkSiteTypeId,
+            select: {
+                _id: true,
+                projectId: true,
+                parentNetworkSiteTypeId: true,
+            },
+            props: {
+                isRoot: true,
+            },
+        });
+        if (!networkSiteType) {
+            throw new BadDataException("Network site type not found.");
+        }
+        cache.set(key, networkSiteType);
+        return networkSiteType;
+    }
+    /*
+     * Assert one proposed site edge against the type hierarchy. Untyped legacy
+     * root rows remain readable/editable, but as soon as a site has a type its
+     * placement is exact: a root type has no parent, and a non-root type has a
+     * parent site whose type is precisely the configured direct parent type.
+     */
+    async validateSiteTypeEdge(data) {
+        if (!data.networkSiteTypeId) {
+            if (data.parentSite) {
+                throw new BadDataException("A network site with a parent must have a network site type.");
+            }
+            return;
+        }
+        const networkSiteType = await this.getNetworkSiteTypeForHierarchy(data.networkSiteTypeId, data.typeCache);
+        if (data.projectId &&
+            networkSiteType.projectId &&
+            !sameId(networkSiteType.projectId, data.projectId)) {
+            throw new BadDataException("Network site type must belong to the same project.");
+        }
+        const requiredParentTypeId = networkSiteType.parentNetworkSiteTypeId || null;
+        if (!requiredParentTypeId) {
+            if (data.parentSite) {
+                throw new BadDataException("A site with a root network site type cannot have a parent site.");
+            }
+            return;
+        }
+        if (!data.parentSite) {
+            throw new BadDataException("This network site type requires a parent site.");
+        }
+        if (!data.parentSite.networkSiteTypeId ||
+            !sameId(data.parentSite.networkSiteTypeId, requiredParentTypeId)) {
+            throw new BadDataException("Parent site must use the configured parent network site type.");
+        }
+    }
+    /*
+     * Changing a site's type also changes what every direct child's type must
+     * point at. Validate those reverse edges before the update so one edit
+     * cannot strand a previously valid subtree.
+     */
+    async validateDirectChildrenForTypeChange(data) {
+        if (!data.site.id || !data.site.projectId) {
+            return;
+        }
+        const proposedParent = {
+            id: data.site.id,
+            projectId: data.site.projectId,
+            networkSiteTypeId: data.proposedNetworkSiteTypeId || undefined,
+        };
+        let skip = 0;
+        while (true) {
+            const children = await this.findBy({
+                query: {
+                    projectId: data.site.projectId,
+                    parentSiteId: data.site.id,
+                },
+                select: {
+                    _id: true,
+                    projectId: true,
+                    networkSiteTypeId: true,
+                },
+                sort: {
+                    _id: SortOrder.Ascending,
+                },
+                limit: DIRECT_CHILD_TYPE_VALIDATION_PAGE_SIZE,
+                skip: skip,
+                props: {
+                    isRoot: true,
+                },
+            });
+            for (const child of children) {
+                await this.validateSiteTypeEdge({
+                    networkSiteTypeId: child.networkSiteTypeId || null,
+                    parentSite: proposedParent,
+                    projectId: child.projectId || data.site.projectId,
+                    typeCache: data.typeCache,
+                });
+            }
+            if (children.length < DIRECT_CHILD_TYPE_VALIDATION_PAGE_SIZE) {
+                break;
+            }
+            skip += children.length;
+        }
+    }
+    /*
+     * The FK behind `probeId` only requires the Probe row to exist. It does
+     * NOT require it to belong to this project, and probe ids reach the server
+     * from the browser (the site form's dropdown posts one), so without this
+     * check an operator could name another project's probe as this site's
+     * default - and NetworkDeviceService would then copy it onto every device
+     * created into the site, handing that project's probe a target list inside
+     * this one.
+     *
+     * A GLOBAL probe has no project and is attachable anywhere, which is why
+     * this delegates to ProbeService rather than comparing projectIds: the
+     * same predicate that decides which probes a monitor may use decides which
+     * probe a site may default to.
+     */
+    async assertProbeIsAttachableToProject(data) {
+        if (!data.projectId) {
+            return;
+        }
+        const isAttachable = await ProbeService.isProbeAttachableToProject({
+            probeId: data.probeId,
+            projectId: data.projectId,
+        });
+        if (!isAttachable) {
+            throw new BadDataException("Probe not found or it does not belong to this project.");
+        }
+    }
+    /*
+     * Same hole as the probe above, and the consequence is worse: a site's
+     * credential profile is read LIVE at poll time for every device in the
+     * site that has no credentials of its own
+     * (NetworkDeviceHydrationUtil.resolveSnmpCredentials), so a cross-project
+     * reference here would put another project's community string on this
+     * project's probe's wire. The resolver drops such a reference as a
+     * backstop; this is the half that stops it being written at all.
+     */
+    async assertSnmpCredentialProfileBelongsToProject(data) {
+        if (!data.projectId) {
+            return;
+        }
+        const profile = await NetworkSnmpCredentialProfileService.findOneById({
+            id: data.snmpCredentialProfileId,
+            select: {
+                _id: true,
+                projectId: true,
+            },
+            props: {
+                isRoot: true,
+            },
+        });
+        if (!profile) {
+            throw new BadDataException("SNMP Credential Profile not found.");
+        }
+        if (profile.projectId && !sameId(profile.projectId, data.projectId)) {
+            throw new BadDataException("SNMP Credential Profile must belong to the same project.");
+        }
+    }
+    /*
+     * The site's default probe, inherited: this site's own `probeId`, or the
+     * nearest ancestor that has one.
+     *
+     * Copy-at-write, not read-through — NetworkDeviceService calls this once,
+     * when a device is created into or moved to a site with no probe of its
+     * own, and stamps the answer on the device. That is what makes editing a
+     * site's default a decision about FUTURE devices only: nothing re-reads
+     * this, so no site edit can silently re-point a fleet that is already
+     * polling.
+     *
+     * Nearest ancestor wins, so a Region's probe covers every Market under it
+     * while a Market that names its own overrides it for its own subtree.
+     * `getAncestorIds` returns root-first, hence the reverse walk.
+     */
+    async resolveDefaultProbeIdForSite(siteId) {
+        const site = await this.findOneById({
+            id: siteId,
+            select: {
+                _id: true,
+                probeId: true,
+                parentSiteId: true,
+            },
+            props: {
+                isRoot: true,
+            },
+        });
+        if (!site) {
+            return null;
+        }
+        if (site.probeId) {
+            return site.probeId;
+        }
+        /*
+         * A root site has no ancestors, so there is nothing above it to inherit
+         * from. Short-circuited here rather than left to getAncestorIds because
+         * that call is not free: it resolves — and, for a row whose path is
+         * missing or stale, REBUILDS AND PERSISTS — the materialized path. This
+         * runs on the device create path, where most sites are roots and no
+         * device write should be paying for hierarchy maintenance it cannot use.
+         */
+        if (!site.parentSiteId) {
+            return null;
+        }
+        const ancestorIds = await this.getAncestorIds(siteId);
+        if (ancestorIds.length === 0) {
+            return null;
+        }
+        const ancestors = await this.findBy({
+            query: {
+                _id: QueryHelper.any(ancestorIds.map((ancestorId) => {
+                    return ancestorId.toString();
+                })),
+            },
+            select: {
+                _id: true,
+                probeId: true,
+            },
+            limit: LIMIT_MAX,
+            skip: 0,
+            props: {
+                isRoot: true,
+            },
+        });
+        const probeIdBySiteId = new Map();
+        for (const ancestor of ancestors) {
+            if (ancestor.id && ancestor.probeId) {
+                probeIdBySiteId.set(ancestor.id.toString(), ancestor.probeId);
+            }
+        }
+        for (let index = ancestorIds.length - 1; index >= 0; index--) {
+            const probeId = probeIdBySiteId.get(ancestorIds[index].toString());
+            if (probeId) {
+                return probeId;
+            }
+        }
+        return null;
+    }
     async onBeforeCreate(createBy) {
         let parentPath = null;
+        let parentSite = null;
+        const rawData = createBy.data;
+        const projectId = createBy.props.tenantId ||
+            RelationIdUtil.readConsistent(rawData, ["projectId", "project"], "Project") ||
+            undefined;
         /*
          * Both spellings: the dashboard's site form posts the `parentSite`
          * relation, not the `parentSiteId` column. See RelationIdUtil.
          */
-        const parentSiteId = RelationIdUtil.read(createBy.data, PARENT_SITE_KEYS);
+        const parentSiteId = readStrictRelationId({
+            payload: rawData,
+            keys: PARENT_SITE_KEYS,
+            relationTitle: "Parent Site",
+        });
+        const networkSiteTypeId = readStrictRelationId({
+            payload: rawData,
+            keys: NETWORK_SITE_TYPE_KEYS,
+            relationTitle: "Network Site Type",
+        });
         if (parentSiteId) {
-            const parent = await this.findOneById({
+            parentSite = await this.findOneById({
                 id: parentSiteId,
                 select: {
                     _id: true,
                     projectId: true,
+                    networkSiteTypeId: true,
                 },
                 props: {
                     isRoot: true,
                 },
             });
-            if (!parent) {
+            if (!parentSite) {
                 throw new BadDataException("Parent site not found.");
             }
-            if (createBy.data.projectId &&
-                parent.projectId &&
-                parent.projectId.toString() !== createBy.data.projectId.toString()) {
+            if (projectId &&
+                parentSite.projectId &&
+                !sameId(parentSite.projectId, projectId)) {
                 throw new BadDataException("Parent site must belong to the same project.");
             }
+        }
+        await this.validateSiteTypeEdge({
+            networkSiteTypeId: networkSiteTypeId,
+            parentSite: parentSite,
+            projectId: projectId,
+            typeCache: new Map(),
+        });
+        /*
+         * The monitoring defaults are tenant-checked on the way in, in both
+         * spellings. See the constants for why a bad value here is not confined
+         * to this row.
+         */
+        const probeId = readStrictRelationId({
+            payload: rawData,
+            keys: PROBE_KEYS,
+            relationTitle: "Probe",
+        });
+        if (probeId) {
+            await this.assertProbeIsAttachableToProject({
+                probeId: probeId,
+                projectId: projectId,
+            });
+        }
+        const snmpCredentialProfileId = readStrictRelationId({
+            payload: rawData,
+            keys: SNMP_CREDENTIAL_PROFILE_KEYS,
+            relationTitle: "SNMP Credential Profile",
+        });
+        if (snmpCredentialProfileId) {
+            await this.assertSnmpCredentialProfileBelongsToProject({
+                snmpCredentialProfileId: snmpCredentialProfileId,
+                projectId: projectId,
+            });
+        }
+        if (parentSiteId) {
             parentPath = await this.getMaterializedPathForSite(parentSiteId);
         }
         return {
@@ -224,25 +882,85 @@ export class Service extends DatabaseService {
         return createdItem;
     }
     async onBeforeUpdate(updateBy) {
-        const dataKeys = Object.keys(updateBy.data || {});
-        if (!RelationIdUtil.isWritten(dataKeys, PARENT_SITE_KEYS)) {
+        const rawData = updateBy.data;
+        const touchesParent = isRelationWritten(rawData, PARENT_SITE_KEYS);
+        const touchesNetworkSiteType = isRelationWritten(rawData, NETWORK_SITE_TYPE_KEYS);
+        const touchesProject = isRelationWritten(rawData, PROJECT_KEYS);
+        const touchesMaterializedHierarchy = isRelationWritten(rawData, MATERIALIZED_HIERARCHY_KEYS);
+        /*
+         * These two have to be named in the early return, and that is the whole
+         * reason they are here. Setting a site's default probe or credential
+         * profile touches neither the parent nor the type, so a tenancy guard
+         * placed below the return would be dead code on exactly the write it
+         * exists for — the shape the site settings form actually posts.
+         */
+        const touchesProbe = isRelationWritten(rawData, PROBE_KEYS);
+        const touchesSnmpCredentialProfile = isRelationWritten(rawData, SNMP_CREDENTIAL_PROFILE_KEYS);
+        if (!touchesParent &&
+            !touchesNetworkSiteType &&
+            !touchesProject &&
+            !touchesMaterializedHierarchy &&
+            !touchesProbe &&
+            !touchesSnmpCredentialProfile) {
             return { updateBy, carryForward: null };
         }
-        const newParentId = RelationIdUtil.read(updateBy.data, PARENT_SITE_KEYS);
+        if (touchesMaterializedHierarchy) {
+            throw new BadDataException("materializedPath and depth are managed by the Network Site hierarchy and cannot be updated directly.");
+        }
+        const proposedProjectId = touchesProject
+            ? readStrictRelationId({
+                payload: rawData,
+                keys: PROJECT_KEYS,
+                relationTitle: "Project",
+            })
+            : null;
+        if (touchesProject && !proposedProjectId) {
+            throw new BadDataException("A Network Site cannot be moved to another project.");
+        }
+        const newParentId = touchesParent
+            ? readStrictRelationId({
+                payload: rawData,
+                keys: PARENT_SITE_KEYS,
+                relationTitle: "Parent Site",
+            })
+            : null;
+        const newNetworkSiteTypeId = touchesNetworkSiteType
+            ? readStrictRelationId({
+                payload: rawData,
+                keys: NETWORK_SITE_TYPE_KEYS,
+                relationTitle: "Network Site Type",
+            })
+            : null;
+        const updateLimit = updateBy.limit instanceof PositiveNumber
+            ? updateBy.limit.toNumber()
+            : updateBy.limit || LIMIT_MAX;
+        const updateSkip = updateBy.skip instanceof PositiveNumber
+            ? updateBy.skip.toNumber()
+            : updateBy.skip || 0;
         const previousItems = await this.findBy({
             query: this.scopeQueryToCallerTenant(updateBy.query, updateBy.props),
             select: {
                 _id: true,
                 projectId: true,
                 parentSiteId: true,
+                networkSiteTypeId: true,
                 materializedPath: true,
             },
-            limit: LIMIT_MAX,
-            skip: 0,
+            limit: updateLimit,
+            skip: updateSkip,
             props: {
                 isRoot: true,
             },
         });
+        if (touchesProject) {
+            for (const item of previousItems) {
+                if (!item.projectId ||
+                    !proposedProjectId ||
+                    !sameId(item.projectId, proposedProjectId)) {
+                    throw new BadDataException("A Network Site cannot be moved to another project.");
+                }
+            }
+        }
         /*
          * Same-project assertion for EVERY parentSiteId write, including the
          * detach case (parentSiteId: null) which has no parent to compare
@@ -252,33 +970,84 @@ export class Service extends DatabaseService {
         if (updateBy.props.tenantId) {
             for (const item of previousItems) {
                 if (item.projectId &&
-                    item.projectId.toString() !== updateBy.props.tenantId.toString()) {
+                    !sameId(item.projectId, updateBy.props.tenantId)) {
                     throw new BadDataException("Network site must belong to the same project.");
                 }
             }
         }
+        /*
+         * One check per DISTINCT project in the matched set, because a single
+         * updateBy can span more than one project when a root caller issues it,
+         * and the payload names one probe / one profile for all of them. Reading
+         * the ids here (rather than above the previousItems read) keeps a
+         * conflicting-spelling payload refused on every write shape.
+         */
+        if (touchesProbe || touchesSnmpCredentialProfile) {
+            const newProbeId = touchesProbe
+                ? readStrictRelationId({
+                    payload: rawData,
+                    keys: PROBE_KEYS,
+                    relationTitle: "Probe",
+                })
+                : null;
+            const newSnmpCredentialProfileId = touchesSnmpCredentialProfile
+                ? readStrictRelationId({
+                    payload: rawData,
+                    keys: SNMP_CREDENTIAL_PROFILE_KEYS,
+                    relationTitle: "SNMP Credential Profile",
+                })
+                : null;
+            // A clear (null) points at nothing and has nothing to check.
+            if (newProbeId || newSnmpCredentialProfileId) {
+                const checkedProjectIds = new Set();
+                for (const item of previousItems) {
+                    if (!item.projectId ||
+                        checkedProjectIds.has(normalizeId(item.projectId))) {
+                        continue;
+                    }
+                    checkedProjectIds.add(normalizeId(item.projectId));
+                    if (newProbeId) {
+                        await this.assertProbeIsAttachableToProject({
+                            probeId: newProbeId,
+                            projectId: item.projectId,
+                        });
+                    }
+                    if (newSnmpCredentialProfileId) {
+                        await this.assertSnmpCredentialProfileBelongsToProject({
+                            snmpCredentialProfileId: newSnmpCredentialProfileId,
+                            projectId: item.projectId,
+                        });
+                    }
+                }
+            }
+        }
+        if (!touchesParent && !touchesNetworkSiteType) {
+            return { updateBy, carryForward: null };
+        }
         let newParentPath = null;
-        if (newParentId) {
-            const parent = await this.findOneById({
+        let newParent = null;
+        if (touchesParent && newParentId) {
+            newParent = await this.findOneById({
                 id: newParentId,
                 select: {
                     _id: true,
                     projectId: true,
+                    networkSiteTypeId: true,
                 },
                 props: {
                     isRoot: true,
                 },
             });
-            if (!parent) {
+            if (!newParent) {
                 throw new BadDataException("Parent site not found.");
             }
             for (const item of previousItems) {
-                if (item.id && item.id.toString() === newParentId.toString()) {
+                if (item.id && sameId(item.id, newParentId)) {
                     throw new BadDataException("A site cannot be its own parent.");
                 }
                 if (item.projectId &&
-                    parent.projectId &&
-                    item.projectId.toString() !== parent.projectId.toString()) {
+                    newParent.projectId &&
+                    !sameId(item.projectId, newParent.projectId)) {
                     throw new BadDataException("Parent site must belong to the same project.");
                 }
             }
@@ -290,6 +1059,66 @@ export class Service extends DatabaseService {
                 }
             }
         }
+        const typeCache = new Map();
+        const existingParents = new Map();
+        for (const item of previousItems) {
+            let proposedParent = null;
+            if (touchesParent) {
+                proposedParent = newParent;
+            }
+            else if (item.parentSiteId) {
+                const currentParentId = normalizeId(item.parentSiteId);
+                proposedParent = existingParents.get(currentParentId) || null;
+                if (!proposedParent) {
+                    proposedParent = await this.findOneById({
+                        id: item.parentSiteId,
+                        select: {
+                            _id: true,
+                            projectId: true,
+                            networkSiteTypeId: true,
+                        },
+                        props: {
+                            isRoot: true,
+                        },
+                    });
+                    if (!proposedParent) {
+                        throw new BadDataException("Parent site not found.");
+                    }
+                    existingParents.set(currentParentId, proposedParent);
+                }
+                if (item.projectId &&
+                    proposedParent.projectId &&
+                    !sameId(item.projectId, proposedParent.projectId)) {
+                    throw new BadDataException("Parent site must belong to the same project.");
+                }
+            }
+            const proposedNetworkSiteTypeId = touchesNetworkSiteType
+                ? newNetworkSiteTypeId
+                : item.networkSiteTypeId || null;
+            await this.validateSiteTypeEdge({
+                networkSiteTypeId: proposedNetworkSiteTypeId,
+                parentSite: proposedParent,
+                projectId: item.projectId,
+                typeCache: typeCache,
+            });
+            const previousNetworkSiteTypeId = item.networkSiteTypeId
+                ? normalizeId(item.networkSiteTypeId)
+                : null;
+            const proposedNetworkSiteTypeIdString = proposedNetworkSiteTypeId
+                ? normalizeId(proposedNetworkSiteTypeId)
+                : null;
+            if (touchesNetworkSiteType &&
+                previousNetworkSiteTypeId !== proposedNetworkSiteTypeIdString) {
+                await this.validateDirectChildrenForTypeChange({
+                    site: item,
+                    proposedNetworkSiteTypeId: proposedNetworkSiteTypeId,
+                    typeCache: typeCache,
+                });
+            }
+        }
+        if (!touchesParent) {
+            return { updateBy, carryForward: null };
+        }
         const carryForward = {
             previousItems: previousItems,
             newParentId: newParentId,
@@ -339,7 +1168,19 @@ export class Service extends DatabaseService {
         const updatedIds = new Set(updatedItemIds.map((id) => {
             return id.toString();
         }));
-        for (const previousItem of parentChange.previousItems) {
+        /*
+         * A bulk update can include both an ancestor and one of its descendants.
+         * Move the deepest roots first; otherwise rebasing the ancestor changes
+         * the descendant branch away from the latter's old prefix before its own
+         * subtree has been processed.
+         */
+        const previousItemsDeepestFirst = [
+            ...parentChange.previousItems,
+        ].sort((left, right) => {
+            return (MaterializedPathUtil.segmentsOf(right.materializedPath).length -
+                MaterializedPathUtil.segmentsOf(left.materializedPath).length);
+        });
+        for (const previousItem of previousItemsDeepestFirst) {
             if (!previousItem.id || !updatedIds.has(previousItem.id.toString())) {
                 continue;
             }
@@ -358,35 +1199,43 @@ export class Service extends DatabaseService {
             });
             // ...then its entire subtree in one prefix query.
             if (oldPath) {
-                const descendants = await this.findBy({
-                    query: {
-                        projectId: previousItem.projectId,
-                        materializedPath: this.pathStartsWith(oldPath),
-                    },
-                    select: {
-                        _id: true,
-                        materializedPath: true,
-                    },
-                    limit: LIMIT_MAX,
-                    skip: 0,
-                    props: {
-                        isRoot: true,
-                    },
-                });
-                for (const descendant of descendants) {
-                    if (!descendant.id ||
-                        !descendant.materializedPath ||
-                        descendant.id.toString() === previousItem.id.toString()) {
-                        continue;
-                    }
-                    const rebasedPath = MaterializedPathUtil.rebasePaths(oldPath, newPath, [descendant.materializedPath])[0];
-                    await this.updateColumnsByIdWithoutHooks({
-                        id: descendant.id,
-                        data: {
-                            materializedPath: rebasedPath,
-                            depth: MaterializedPathUtil.depthOf(rebasedPath),
+                while (true) {
+                    const descendants = await this.findBy({
+                        query: {
+                            projectId: previousItem.projectId,
+                            materializedPath: this.pathStartsWith(oldPath),
+                        },
+                        select: {
+                            _id: true,
+                            materializedPath: true,
+                        },
+                        sort: {
+                            _id: SortOrder.Ascending,
+                        },
+                        limit: SUBTREE_REBASE_PAGE_SIZE,
+                        skip: 0,
+                        props: {
+                            isRoot: true,
                         },
                     });
+                    for (const descendant of descendants) {
+                        if (!descendant.id ||
+                            !descendant.materializedPath ||
+                            descendant.id.toString() === previousItem.id.toString()) {
+                            continue;
+                        }
+                        const rebasedPath = MaterializedPathUtil.rebasePaths(oldPath, newPath, [descendant.materializedPath])[0];
+                        await this.updateColumnsByIdWithoutHooks({
+                            id: descendant.id,
+                            data: {
+                                materializedPath: rebasedPath,
+                                depth: MaterializedPathUtil.depthOf(rebasedPath),
+                            },
+                        });
+                    }
+                    if (descendants.length < SUBTREE_REBASE_PAGE_SIZE) {
+                        break;
+                    }
                 }
             }
             /*
@@ -417,35 +1266,97 @@ export class Service extends DatabaseService {
      * checked.
      */
     async onBeforeDelete(deleteBy) {
+        const deleteLimit = deleteBy.limit instanceof PositiveNumber
+            ? deleteBy.limit.toNumber()
+            : deleteBy.limit || LIMIT_MAX;
+        const deleteSkip = deleteBy.skip instanceof PositiveNumber
+            ? deleteBy.skip.toNumber()
+            : deleteBy.skip || 0;
         const sitesToDelete = await this.findBy({
-            query: this.scopeQueryToCallerTenant(deleteBy.query, deleteBy.props),
+            query: this.scopeDeleteQueryToCallerTenant(deleteBy.query, deleteBy.props),
             select: {
                 _id: true,
                 projectId: true,
                 parentSiteId: true,
                 materializedPath: true,
             },
-            limit: LIMIT_MAX,
-            skip: 0,
+            limit: deleteLimit,
+            skip: deleteSkip,
             props: {
                 isRoot: true,
             },
         });
+        const deletingSiteIds = new Set(sitesToDelete
+            .map((site) => {
+            return site.id ? normalizeId(site.id) : null;
+        })
+            .filter((siteId) => {
+            return Boolean(siteId);
+        }));
+        const deletingSiteIdList = Array.from(deletingSiteIds);
+        const deletingProjectIdList = Array.from(new Set(sitesToDelete
+            .map((site) => {
+            return site.projectId ? normalizeId(site.projectId) : null;
+        })
+            .filter((projectId) => {
+            return Boolean(projectId);
+        })));
+        /*
+         * A valid child type explicitly names the deleted site's type as its
+         * required direct parent type. Legacy SET NULL/orphan-repair behaviour
+         * therefore cannot produce a valid edge: promoting the child to root or
+         * attaching it to the grandparent both violate its type. Reject the
+         * delete unless every direct child is part of this same bulk delete.
+         *
+         * Parent ids and result rows are both batched so neither a wide delete nor
+         * a wide site is silently truncated at a service query limit.
+         */
+        for (let parentIdOffset = 0; parentIdOffset < deletingSiteIdList.length; parentIdOffset += DIRECT_CHILD_TYPE_VALIDATION_PAGE_SIZE) {
+            const parentIdBatch = deletingSiteIdList.slice(parentIdOffset, parentIdOffset + DIRECT_CHILD_TYPE_VALIDATION_PAGE_SIZE);
+            let childSkip = 0;
+            while (true) {
+                const directChildren = await this.findBy({
+                    query: {
+                        projectId: QueryHelper.any(deletingProjectIdList),
+                        parentSiteId: QueryHelper.any(parentIdBatch),
+                    },
+                    select: {
+                        _id: true,
+                        parentSiteId: true,
+                    },
+                    sort: {
+                        _id: SortOrder.Ascending,
+                    },
+                    limit: DIRECT_CHILD_TYPE_VALIDATION_PAGE_SIZE,
+                    skip: childSkip,
+                    props: {
+                        isRoot: true,
+                    },
+                });
+                const hasSurvivingChild = directChildren.some((child) => {
+                    return !child.id || !deletingSiteIds.has(normalizeId(child.id));
+                });
+                if (hasSurvivingChild) {
+                    throw new BadDataException("A network site with child sites cannot be deleted. Move or delete its child sites first.");
+                }
+                if (directChildren.length < DIRECT_CHILD_TYPE_VALIDATION_PAGE_SIZE) {
+                    break;
+                }
+                childSkip += directChildren.length;
+            }
+        }
         const carryForward = {
             sitesToDelete: sitesToDelete,
         };
         return { deleteBy, carryForward };
     }
     /*
-     * parentSiteId is declared onDelete: "SET NULL", so Postgres detaches the
-     * deleted site's direct children but leaves their materializedPath - and
-     * their whole subtree's - routed through a row that no longer exists. That
-     * strands the subtree: the children endpoint (which reads parentSiteId)
-     * shows them at the root while the rollup engine (which reads
-     * materializedPath) still folds them into the dead ancestor's chain, double
-     * counting every outage. Re-attach the orphans to the deleted site's own
-     * parent - NULL when it was a root, which is exactly what the FK did - and
-     * rebase the subtree paths so both readers agree again.
+     * New schemas use a non-nullifying foreign key and onBeforeDelete rejects
+     * surviving children, so this repair is normally a no-op. Keep it as a
+     * defensive bridge for a database that has not applied the FK migration
+     * yet, or for a legacy write already in flight during an upgrade: reattach
+     * any detached children and rebase their subtree paths so parentSiteId and
+     * materializedPath agree.
      */
     async onDeleteSuccess(onDelete, itemIdsBeforeDelete) {
         const carryForward = onDelete.carryForward || null;
@@ -493,47 +1404,55 @@ export class Service extends DatabaseService {
             ? await this.getMaterializedPathForSite(deletedSite.parentSiteId)
             : null;
         const deletedDepth = MaterializedPathUtil.segmentsOf(oldPath).length;
-        const descendants = await this.findBy({
-            query: {
-                projectId: deletedSite.projectId,
-                materializedPath: this.pathStartsWith(oldPath),
-            },
-            select: {
-                _id: true,
-                materializedPath: true,
-            },
-            limit: LIMIT_MAX,
-            skip: 0,
-            props: {
-                isRoot: true,
-            },
-        });
-        for (const descendant of descendants) {
-            if (!descendant.id ||
-                !descendant.materializedPath ||
-                descendant.id.toString() === deletedSite.id.toString()) {
-                continue;
-            }
-            const tailSegments = MaterializedPathUtil.segmentsOf(descendant.materializedPath).slice(deletedDepth);
-            if (tailSegments.length === 0) {
-                continue;
-            }
-            let rebasedPath = parentPath;
-            for (const segment of tailSegments) {
-                rebasedPath = MaterializedPathUtil.buildPath(rebasedPath, segment);
+        while (true) {
+            const descendants = await this.findBy({
+                query: {
+                    projectId: deletedSite.projectId,
+                    materializedPath: this.pathStartsWith(oldPath),
+                },
+                select: {
+                    _id: true,
+                    materializedPath: true,
+                },
+                sort: {
+                    _id: SortOrder.Ascending,
+                },
+                limit: SUBTREE_REBASE_PAGE_SIZE,
+                skip: 0,
+                props: {
+                    isRoot: true,
+                },
+            });
+            for (const descendant of descendants) {
+                if (!descendant.id ||
+                    !descendant.materializedPath ||
+                    descendant.id.toString() === deletedSite.id.toString()) {
+                    continue;
+                }
+                const tailSegments = MaterializedPathUtil.segmentsOf(descendant.materializedPath).slice(deletedDepth);
+                if (tailSegments.length === 0) {
+                    continue;
+                }
+                let rebasedPath = parentPath;
+                for (const segment of tailSegments) {
+                    rebasedPath = MaterializedPathUtil.buildPath(rebasedPath, segment);
+                }
+                const updateData = {
+                    materializedPath: rebasedPath,
+                    depth: MaterializedPathUtil.depthOf(rebasedPath),
+                };
+                // A direct child is the one the FK just detached - give it a parent back.
+                if (tailSegments.length === 1) {
+                    updateData["parentSiteId"] = deletedSite.parentSiteId || null;
+                }
+                await this.updateColumnsByIdWithoutHooks({
+                    id: descendant.id,
+                    data: updateData,
+                });
             }
-            const data = {
-                materializedPath: rebasedPath,
-                depth: MaterializedPathUtil.depthOf(rebasedPath),
-            };
-            // A direct child is the one the FK just detached - give it a parent back.
-            if (tailSegments.length === 1) {
-                data["parentSiteId"] = deletedSite.parentSiteId || null;
+            if (descendants.length < SUBTREE_REBASE_PAGE_SIZE) {
+                break;
             }
-            await this.updateColumnsByIdWithoutHooks({
-                id: descendant.id,
-                data: data,
-            });
         }
         /*
          * The deleted site's own devices were detached by their FK too, so the
@@ -1243,8 +2162,11 @@ export class Service extends DatabaseService {
      * ------------------------------------------------------------------
      */
     /*
-     * Called by MonitorService.changeMonitorStatus after a status persists.
-     * Resolves which NetworkDevices these monitors report on, stamps those
+     * Called after a monitor's current status persists - from
+     * MonitorStatusTimelineService.onCreateSuccess / onDeleteSuccess (the one
+     * path every status change, probe-driven or manual, passes through) and
+     * from MonitorService.refreshMonitorCurrentStatus when a repair moves the
+     * id. Resolves which NetworkDevices these monitors report on, stamps those
      * devices' currentMonitorStatusId, then recomputes the rollup for every
      * affected site chain. Never throws - a rollup failure must never break a
      * monitor status change.
@@ -1258,6 +2180,26 @@ export class Service extends DatabaseService {
      *     monitor-backed path (monitoringMethod "Monitor") for gear that does
      *     not speak SNMP, so ANY monitor type qualifies — a Ping monitor on an
      *     access point is the whole point of it.
+     *
+     * What gets stamped depends on how the device is monitored:
+     *
+     *   - every device gets currentMonitorStatusId, which the pill, the site
+     *     rollup and the topology node read.
+     *   - a MONITOR-BACKED device also gets isReachable, derived from the
+     *     status row (`!isOfflineState`, the same offline-end reading
+     *     DeviceReachabilityUtil uses). Nothing polls such a device, so the
+     *     column is NULL forever otherwise - and the device list's summary
+     *     tiles and its Status filter count and filter on isReachable in SQL,
+     *     which is why a bound ping-only device sat under "Pending" there while
+     *     its own pill said Up. The server keeps the two in sync so the list
+     *     agrees with itself.
+     *   - an SNMP device's isReachable is left alone: the walk owns it
+     *     (NetworkInventoryUtil.updateFromWalk), and a Network Device monitor
+     *     going Degraded must not overwrite what the probe actually found.
+     *
+     * The status row is read at most once per call, and only when at least one
+     * collected device is monitor-backed, so an all-SNMP estate costs no extra
+     * query.
      */
     async onMonitorStatusChanged(data) {
         try {
@@ -1306,6 +2248,8 @@ export class Service extends DatabaseService {
                     select: {
                         _id: true,
                         siteId: true,
+                        // Decides whether isReachable is stamped alongside the status.
+                        monitoringMethod: true,
                     },
                     limit: LIMIT_MAX,
                     skip: 0,
@@ -1322,6 +2266,8 @@ export class Service extends DatabaseService {
                 select: {
                     _id: true,
                     siteId: true,
+                    // Decides whether isReachable is stamped alongside the status.
+                    monitoringMethod: true,
                 },
                 limit: LIMIT_MAX,
                 skip: 0,
@@ -1333,15 +2279,65 @@ export class Service extends DatabaseService {
             if (devices.length === 0) {
                 return;
             }
+            /*
+             * Resolve the status row lazily - once, and only if a monitor-backed
+             * device is in the set - because it is only needed to derive
+             * isReachable, and the SNMP-only case must stay one query cheaper.
+             *
+             * `undefined` afterwards means "do not touch isReachable": either no
+             * device needs it, or the row could not be found in this project (a
+             * status deleted between the timeline write and this call, or one
+             * from another tenant). The id is still stamped in that case so the
+             * pill keeps moving; a stale reachability is the lesser harm next to
+             * a device that stops reporting altogether.
+             */
+            const hasMonitorBackedDevice = devices.some((device) => {
+                return NetworkDeviceMonitoringMethodUtil.isMonitorBacked(device.monitoringMethod);
+            });
+            let monitorBackedIsReachable = undefined;
+            if (hasMonitorBackedDevice) {
+                const status = await MonitorStatusService.findOneBy({
+                    query: {
+                        _id: data.monitorStatusId,
+                        projectId: data.projectId,
+                    },
+                    select: {
+                        _id: true,
+                        isOfflineState: true,
+                    },
+                    props: {
+                        isRoot: true,
+                    },
+                });
+                if (status) {
+                    monitorBackedIsReachable = !status.isOfflineState;
+                }
+                else {
+                    logger.warn(`NetworkSiteService.onMonitorStatusChanged: monitor status ${data.monitorStatusId.toString()} was not found in project ${data.projectId.toString()}; stamping the status id on the bound network devices but leaving isReachable unchanged.`, {
+                        projectId: data.projectId.toString(),
+                        monitorStatusId: data.monitorStatusId.toString(),
+                    });
+                }
+            }
             for (const device of devices) {
                 if (!device.id) {
                     continue;
                 }
+                const stamp = {
+                    currentMonitorStatusId: data.monitorStatusId,
+                };
+                /*
+                 * Only a monitor-backed device gets isReachable from here. The key
+                 * is left OUT of the payload for an SNMP device rather than set to
+                 * undefined, so the walk's verdict is provably untouched.
+                 */
+                if (monitorBackedIsReachable !== undefined &&
+                    NetworkDeviceMonitoringMethodUtil.isMonitorBacked(device.monitoringMethod)) {
+                    stamp.isReachable = monitorBackedIsReachable;
+                }
                 await NetworkDeviceService.updateColumnsByIdWithoutHooks({
                     id: device.id,
-                    data: {
-                        currentMonitorStatusId: data.monitorStatusId,
-                    },
+                    data: stamp,
                 });
             }
             const distinctSiteIds = new Map();
@@ -1362,12 +2358,54 @@ export class Service extends DatabaseService {
         }
     }
 }
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "create", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "updateOneBy", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "updateBy", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "deleteOneBy", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "deleteBy", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "hardDeleteBy", null);
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
 ], Service.prototype, "getStatusCounts", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [ObjectID]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "resolveDefaultProbeIdForSite", null);
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),