@oneuptime/common 12.0.32 → 12.0.33

package/Tests/Server/Utils/Monitor/NetworkInventoryUtil.test.ts

@@ -17,6 +17,9 @@ import SnmpOid from "../../../../Types/Monitor/SnmpMonitor/SnmpOid";
 import SnmpVendorTemplateUtil, {
   SnmpVendorTemplate,
 } from "../../../../Types/Monitor/SnmpMonitor/SnmpVendorTemplate";
+import NetworkDeviceMonitoringMethod from "../../../../Types/NetworkDevice/NetworkDeviceMonitoringMethod";
+import { NetworkDevicePollMode } from "../../../../Server/Utils/Monitor/NetworkDeviceHydrationUtil";
+import logger from "../../../../Server/Utils/Logger";
 
 /*
  * NetworkInventoryUtil.updateFromWalk is the single writer that keeps the
@@ -153,9 +156,17 @@ function existingInterface(interfaceIndex: number): NetworkInterface {
   return row;
 }
 
+/*
+ * A poll that ran a walk. With no pollMode this is what an old probe's walk
+ * looks like to the util (the processor stamps "snmp" for it); pass
+ * pollMode "snmp" for a ping-first probe's walk.
+ */
 async function runWalk(
   snmpFields?: Partial<SnmpMonitorResponse>,
-  options?: { isOnline?: boolean | undefined },
+  options?: {
+    isOnline?: boolean | undefined;
+    pollMode?: NetworkDevicePollMode | undefined;
+  },
 ): Promise<SnmpMonitorResponse> {
   const snmpResponse: SnmpMonitorResponse = buildSnmpResponse(snmpFields);
 
@@ -164,11 +175,23 @@ async function runWalk(
     deviceId: new ObjectID(DEVICE_ID),
     snmpResponse: snmpResponse,
     isOnline: options && "isOnline" in options ? options.isOnline : true,
+    pollMode: options?.pollMode,
   });
 
   return snmpResponse;
 }
 
+// A ping-only poll: the device has no usable credentials, so no walk ran.
+async function runPingOnlyPoll(options: { isOnline: boolean }): Promise<void> {
+  await NetworkInventoryUtil.updateFromWalk({
+    projectId: new ObjectID(PROJECT_ID),
+    deviceId: new ObjectID(DEVICE_ID),
+    snmpResponse: undefined,
+    isOnline: options.isOnline,
+    pollMode: "ping",
+  });
+}
+
 beforeEach(() => {
   jest.spyOn(OneUptimeDate, "getCurrentDate").mockReturnValue(NOW);
 });
@@ -299,7 +322,7 @@ describe("NetworkInventoryUtil.updateFromWalk — project-membership guard", ()
  * called both of them Down.
  */
 describe("NetworkInventoryUtil.updateFromWalk — reachability recording", () => {
-  test("a reachable poll stamps all three columns", async () => {
+  test("a reachable poll stamps all three columns - and, for a walk, the SNMP pair", async () => {
     mockServices();
 
     await runWalk();
@@ -309,6 +332,8 @@ describe("NetworkInventoryUtil.updateFromWalk — reachability recording", () =>
     expect(update["lastPolledAt"]).toEqual(NOW);
     expect(update["isReachable"]).toBe(true);
     expect(update["lastSeenAt"]).toEqual(NOW);
+    expect(update["isSnmpReachable"]).toBe(true);
+    expect(update["lastSnmpSeenAt"]).toEqual(NOW);
   });
 
   test("an unreachable poll with no walk data still records the attempt", async () => {
@@ -334,23 +359,35 @@ describe("NetworkInventoryUtil.updateFromWalk — reachability recording", () =>
     expect(update["isReachable"]).toBe(false);
     // The device did not answer, so its last contact must not move.
     expect(update).not.toHaveProperty("lastSeenAt");
+    // The walk was attempted and failed: false, not NULL.
+    expect(update["isSnmpReachable"]).toBe(false);
+    expect(update).not.toHaveProperty("lastSnmpSeenAt");
   });
 
-  test("an unreachable poll with walk data still enriches but never stamps lastSeenAt", async () => {
+  /*
+   * Inventory comes only from a successful walk. A failed walk carries no
+   * system group in practice, and reading whatever a malformed failure did
+   * carry would let a session that never opened rewrite sysName (and so
+   * re-run site-assignment rules) or clear the LLDP snapshot.
+   */
+  test("a failed walk records the attempt but never enriches inventory", async () => {
     mockServices();
 
     await runWalk(
       {
         isOnline: false,
         systemInfo: { sysName: "core-sw-01" },
+        lldpNeighbors: [],
       },
       { isOnline: false },
     );
 
     const update: DeviceUpdatePayload = deviceUpdatePayload();
 
-    expect(update["sysName"]).toBe("core-sw-01");
+    expect(update).not.toHaveProperty("sysName");
+    expect(update).not.toHaveProperty("lldpNeighbors");
     expect(update["isReachable"]).toBe(false);
+    expect(update["isSnmpReachable"]).toBe(false);
     expect(update["lastPolledAt"]).toEqual(NOW);
     expect(update).not.toHaveProperty("lastSeenAt");
   });
@@ -810,17 +847,175 @@ describe("NetworkInventoryUtil.updateFromWalk — walks without interfaces", ()
       isOnline: true,
     });
 
-    // Exactly the reachability columns and nothing else — no walk, no data.
+    /*
+     * Exactly the reachability columns and nothing else — no walk, no
+     * data. isSnmpReachable is NULL, not false: nothing was walked. (No
+     * pollMode reads as "snmp", so the interface counts are left alone as
+     * they are across any failed walk.)
+     */
     expect(deviceUpdatePayload()).toEqual({
       lastPolledAt: NOW,
       isReachable: true,
       lastSeenAt: NOW,
+      isSnmpReachable: null,
     });
     expect(interfaceFindSpy).not.toHaveBeenCalled();
     expect(interfaceUpsertSpy).not.toHaveBeenCalled();
   });
 });
 
+/*
+ * Ping-first polling. The three device columns answer "did the device
+ * answer ping or SNMP"; the SNMP pair answers "did the WALK", and NULL there
+ * means "no walk ran" - which is what a credential-less device looks like
+ * on every poll and must never read as "SNMP down".
+ */
+describe("NetworkInventoryUtil.updateFromWalk — ping-first column matrix", () => {
+  test("a reachable ping-only poll: device columns stamped, walk columns NULL, interface counts NULL, no inventory", async () => {
+    mockServices();
+
+    await runPingOnlyPoll({ isOnline: true });
+
+    expect(deviceUpdatePayload()).toEqual({
+      lastPolledAt: NOW,
+      isReachable: true,
+      lastSeenAt: NOW,
+      isSnmpReachable: null,
+      interfacesTotal: null,
+      interfacesUp: null,
+      interfacesDown: null,
+    });
+    expect(interfaceUpsertSpy).not.toHaveBeenCalled();
+    expect(endpointUpsertSpy).not.toHaveBeenCalled();
+  });
+
+  test("an unreachable ping-only poll: the attempt is recorded, nothing was seen, walk columns NULL", async () => {
+    mockServices();
+
+    await runPingOnlyPoll({ isOnline: false });
+
+    expect(deviceUpdatePayload()).toEqual({
+      lastPolledAt: NOW,
+      isReachable: false,
+      isSnmpReachable: null,
+      interfacesTotal: null,
+      interfacesUp: null,
+      interfacesDown: null,
+    });
+  });
+
+  test("an snmp-mode poll whose walk succeeded stamps the SNMP pair and the counts beside the device columns", async () => {
+    mockServices();
+
+    await runWalk(
+      {
+        interfaces: [
+          walkedInterface({ interfaceIndex: 1, isOperationallyUp: true }),
+          walkedInterface({ interfaceIndex: 2, isOperationallyUp: false }),
+        ],
+      },
+      { isOnline: true, pollMode: "snmp" },
+    );
+
+    const update: DeviceUpdatePayload = deviceUpdatePayload();
+
+    expect(update["isReachable"]).toBe(true);
+    expect(update["lastSeenAt"]).toEqual(NOW);
+    expect(update["isSnmpReachable"]).toBe(true);
+    expect(update["lastSnmpSeenAt"]).toEqual(NOW);
+    expect(update["interfacesTotal"]).toBe(2);
+    expect(update["interfacesUp"]).toBe(1);
+    expect(update["interfacesDown"]).toBe(1);
+  });
+
+  /*
+   * The credentials are wrong, the agent is off, or an ACL blocks 161 - but
+   * the device answers ping. It is Up; its walk is down; the last good
+   * interface counts stay (the best estimate until the next good walk);
+   * and nothing the failed session "found" is written as inventory.
+   */
+  test("an snmp-mode poll where ping answered but the walk failed: device up, walk down, counts and inventory untouched", async () => {
+    mockServices();
+
+    await runWalk(
+      {
+        isOnline: false,
+        responseTimeInMs: 0,
+        failureCause: "SNMP timed out after 3 attempts",
+        systemInfo: { sysName: "should-not-land" },
+      },
+      { isOnline: true, pollMode: "snmp" },
+    );
+
+    const update: DeviceUpdatePayload = deviceUpdatePayload();
+
+    expect(update["lastPolledAt"]).toEqual(NOW);
+    expect(update["isReachable"]).toBe(true);
+    expect(update["lastSeenAt"]).toEqual(NOW);
+    expect(update["isSnmpReachable"]).toBe(false);
+    expect(update).not.toHaveProperty("lastSnmpSeenAt");
+    expect(update).not.toHaveProperty("interfacesTotal");
+    expect(update).not.toHaveProperty("interfacesUp");
+    expect(update).not.toHaveProperty("interfacesDown");
+    expect(update).not.toHaveProperty("sysName");
+  });
+
+  test("an snmp-mode poll that failed both ways: device down, walk down, nothing seen", async () => {
+    mockServices();
+
+    await runWalk(
+      {
+        isOnline: false,
+        responseTimeInMs: 0,
+        failureCause: "SNMP timed out after 3 attempts",
+      },
+      { isOnline: false, pollMode: "snmp" },
+    );
+
+    const update: DeviceUpdatePayload = deviceUpdatePayload();
+
+    expect(update["isReachable"]).toBe(false);
+    expect(update).not.toHaveProperty("lastSeenAt");
+    expect(update["isSnmpReachable"]).toBe(false);
+    expect(update).not.toHaveProperty("lastSnmpSeenAt");
+  });
+
+  /*
+   * A probe that predates ping-first polling only ever walked, so its walk
+   * verdict is the device verdict and both columns carry it - a credentialed
+   * device is never left with a NULL walk column by an old probe.
+   */
+  test("an old probe's walk (no pollMode) keeps the walk verdict for BOTH the device and the SNMP columns", async () => {
+    mockServices();
+
+    await runWalk({ isOnline: false }, { isOnline: false });
+    const failed: DeviceUpdatePayload = deviceUpdatePayload();
+
+    expect(failed["isReachable"]).toBe(false);
+    expect(failed["isSnmpReachable"]).toBe(false);
+
+    deviceUpdateSpy.mockClear();
+    await runWalk();
+    const good: DeviceUpdatePayload = deviceUpdatePayload();
+
+    expect(good["isReachable"]).toBe(true);
+    expect(good["isSnmpReachable"]).toBe(true);
+    expect(good["lastSeenAt"]).toEqual(NOW);
+    expect(good["lastSnmpSeenAt"]).toEqual(NOW);
+  });
+
+  test("a walk with no verdict at all counts as succeeded, matching the device convention", async () => {
+    mockServices();
+
+    await runWalk({ isOnline: undefined as unknown as boolean });
+
+    const update: DeviceUpdatePayload = deviceUpdatePayload();
+
+    expect(update["isSnmpReachable"]).toBe(true);
+    expect(update["lastSnmpSeenAt"]).toEqual(NOW);
+  });
+});
+
 describe("NetworkInventoryUtil.updateFromWalk — endpoint discovery", () => {
   test("a walk without ARP/FDB arrays (collection off) never touches endpoints", async () => {
     mockServices();
@@ -1034,3 +1229,154 @@ describe("NetworkInventoryUtil.updateFromWalk — vendor health template auto-ap
     expect(findArgs.select?.["oidTemplateId"]).toBe(true);
   });
 });
+
+/*
+ * A monitor-backed device (monitoringMethod "Monitor") is never meant to be
+ * walked - its bound Monitor owns reachability. But claimDevicesForPolling
+ * only excludes such rows at CLAIM time, so a device claimed as SNMP and
+ * switched to Monitor before its walk result arrived still reaches this
+ * writer. The poll verdict must not overwrite the monitor's: these cases
+ * pin that the health columns (lastPolledAt / isReachable / lastSeenAt and
+ * the cached interface counts) are withheld for such a row, that the rest
+ * of the walk's inventory still lands, and that an SNMP walk is untouched.
+ */
+describe("NetworkInventoryUtil.updateFromWalk — monitor-backed device guard", () => {
+  const POLL_AND_INTERFACE_COLUMNS: Array<string> = [
+    "lastPolledAt",
+    "isReachable",
+    "lastSeenAt",
+    "isSnmpReachable",
+    "lastSnmpSeenAt",
+    "interfacesTotal",
+    "interfacesUp",
+    "interfacesDown",
+  ];
+
+  function spyWarn(): jest.SpyInstance {
+    return jest.spyOn(logger, "warn").mockImplementation(() => {
+      return undefined;
+    });
+  }
+
+  test("a walk for a monitor-backed device leaves the poll and interface-count columns out and warns once", async () => {
+    mockServices([], {
+      monitoringMethod: NetworkDeviceMonitoringMethod.Monitor,
+    });
+    const warn: jest.SpyInstance = spyWarn();
+
+    await runWalk({
+      systemInfo: { sysName: "ap-01" },
+      interfaces: [
+        walkedInterface({ interfaceIndex: 1, isOperationallyUp: true }),
+        walkedInterface({ interfaceIndex: 2, isOperationallyUp: false }),
+      ],
+    });
+
+    const update: DeviceUpdatePayload = deviceUpdatePayload();
+
+    // Inventory still lands...
+    expect(update["sysName"]).toBe("ap-01");
+    // ...but nothing that decides the device's health does.
+    for (const column of POLL_AND_INTERFACE_COLUMNS) {
+      expect(update).not.toHaveProperty(column);
+    }
+
+    // The interface inventory itself is still recorded - it is not health.
+    expect(interfaceUpsertSpy).toHaveBeenCalledTimes(1);
+
+    expect(warn).toHaveBeenCalledTimes(1);
+    expect(String(warn.mock.calls[0]![0])).toContain(DEVICE_ID);
+  });
+
+  test("an unreachable walk of a monitor-backed device with nothing else to record writes nothing", async () => {
+    mockServices([], {
+      monitoringMethod: NetworkDeviceMonitoringMethod.Monitor,
+    });
+    const warn: jest.SpyInstance = spyWarn();
+
+    await runWalk(
+      {
+        isOnline: false,
+        responseTimeInMs: 0,
+        failureCause: "Device did not respond",
+      },
+      { isOnline: false },
+    );
+
+    /*
+     * For a probe-polled device this exact walk MUST write (the attempt has
+     * to be recorded); for a monitor-backed one the attempt is meaningless
+     * and an empty payload is correctly skipped.
+     */
+    expect(deviceUpdateSpy).not.toHaveBeenCalled();
+    expect(warn).toHaveBeenCalledTimes(1);
+  });
+
+  /*
+   * The ping-mode NULLs are health writes too: a monitor-backed device's
+   * interface counts belong to whatever last wrote them, not to a poll that
+   * should never have reached it.
+   */
+  test("a ping-only poll of a monitor-backed device writes nothing - not even the NULLs - and warns once", async () => {
+    mockServices([], {
+      monitoringMethod: NetworkDeviceMonitoringMethod.Monitor,
+    });
+    const warn: jest.SpyInstance = spyWarn();
+
+    await runPingOnlyPoll({ isOnline: true });
+
+    expect(deviceUpdateSpy).not.toHaveBeenCalled();
+    expect(warn).toHaveBeenCalledTimes(1);
+  });
+
+  test("selects monitoringMethod on the device read, or the guard can never fire", async () => {
+    mockServices();
+
+    await runWalk();
+
+    const findArgs: { select?: Record<string, boolean> } = deviceFindSpy.mock
+      .calls[0]![0] as unknown as { select?: Record<string, boolean> };
+
+    expect(findArgs.select?.["monitoringMethod"]).toBe(true);
+  });
+
+  test("an SNMP walk is unchanged: every poll and interface column is written and nothing warns", async () => {
+    mockServices([], {
+      monitoringMethod: NetworkDeviceMonitoringMethod.Probe,
+    });
+    const warn: jest.SpyInstance = spyWarn();
+
+    await runWalk({
+      interfaces: [
+        walkedInterface({ interfaceIndex: 1, isOperationallyUp: true }),
+        walkedInterface({ interfaceIndex: 2, isOperationallyUp: false }),
+      ],
+    });
+
+    const update: DeviceUpdatePayload = deviceUpdatePayload();
+
+    expect(update["lastPolledAt"]).toEqual(NOW);
+    expect(update["isReachable"]).toBe(true);
+    expect(update["lastSeenAt"]).toEqual(NOW);
+    expect(update["isSnmpReachable"]).toBe(true);
+    expect(update["lastSnmpSeenAt"]).toEqual(NOW);
+    expect(update["interfacesTotal"]).toBe(2);
+    expect(update["interfacesUp"]).toBe(1);
+    expect(update["interfacesDown"]).toBe(1);
+    expect(warn).not.toHaveBeenCalled();
+  });
+
+  test("a row with no monitoringMethod at all (written before the column existed) is walked as SNMP", async () => {
+    // The default device carries no monitoringMethod, exactly like a legacy row.
+    mockServices();
+    const warn: jest.SpyInstance = spyWarn();
+
+    await runWalk();
+
+    const update: DeviceUpdatePayload = deviceUpdatePayload();
+
+    expect(update["isReachable"]).toBe(true);
+    expect(update["lastPolledAt"]).toEqual(NOW);
+    expect(warn).not.toHaveBeenCalled();
+  });
+});

package/Tests/Server/Utils/NetworkDevice/DeviceHealthAggregation.test.ts

@@ -47,6 +47,8 @@ const NOW: Date = OneUptimeDate.fromString("2026-08-27T12:00:00.000Z");
 /** A device row as it exists in Postgres, before any grouping. */
 interface DeviceRow {
   monitorStatusIsOffline: boolean | undefined;
+  // Raw column value: null for rows written before it existed.
+  monitoringMethod: string | null;
   isReachable: boolean | null;
   lastPolledAt: Date | null;
   lastSeenAt: Date | null;
@@ -94,7 +96,7 @@ function bucketFor(
     // The bucket key stands for the status; the flag is passed alongside it.
     monitorStatusId:
       device.monitorStatusIsOffline === undefined ? null : "status-id",
-    monitoringMethod: null,
+    monitoringMethod: device.monitoringMethod,
     isReachable: device.isReachable,
     hasBeenPolled: device.lastPolledAt !== null,
     hasBeenSeen: device.lastSeenAt !== null,
@@ -116,6 +118,7 @@ function toClassifierInput(device: DeviceRow): DeviceHealthStateInput {
     lastPolledAt: device.lastPolledAt,
     lastSeenAt: device.lastSeenAt,
     pollingIntervalInMinutes: device.pollingIntervalInMinutes,
+    monitoringMethod: device.monitoringMethod,
     interfacesDown: device.interfacesDown,
   };
 }
@@ -156,6 +159,7 @@ function everyDistinguishableDevice(): Array<DeviceRow> {
             for (const interfacesDown of interfaceCounts) {
               rows.push({
                 monitorStatusIsOffline: monitorStatusIsOffline,
+                monitoringMethod: null,
                 isReachable: isReachable,
                 lastPolledAt: lastPolledAt,
                 lastSeenAt: lastSeenAt,
@@ -169,15 +173,32 @@ function everyDistinguishableDevice(): Array<DeviceRow> {
     }
   }
 
-  return rows;
+  /*
+   * Doubled across the monitoring method last, so every combination above
+   * exists once as an SNMP row and once as a monitor-backed row holding the
+   * SAME poll columns — which is exactly the shape a device switched from
+   * SNMP to Monitor has, and the shape that must classify differently.
+   */
+  const monitoringMethods: Array<string | null> = [null, "Monitor"];
+
+  return monitoringMethods.flatMap(
+    (monitoringMethod: string | null): Array<DeviceRow> => {
+      return rows.map((row: DeviceRow): DeviceRow => {
+        return { ...row, monitoringMethod: monitoringMethod };
+      });
+    },
+  );
 }
 
 describe("bucketing a device loses nothing the classifier reads", () => {
   const devices: Array<DeviceRow> = everyDistinguishableDevice();
 
   test("the matrix is big enough to be worth calling exhaustive", () => {
-    // 3 monitor states x 3 reachability x 4 x 4 timestamps x 3 intervals x 2.
-    expect(devices).toHaveLength(3 * 3 * 4 * 4 * 3 * 2);
+    /*
+     * 3 monitor states x 3 reachability x 4 x 4 timestamps x 3 intervals x
+     * 2 interface counts x 2 monitoring methods.
+     */
+    expect(devices).toHaveLength(3 * 3 * 4 * 4 * 3 * 2 * 2);
   });
 
   test("every device classifies the same through its bucket as directly", () => {
@@ -316,6 +337,7 @@ describe("bucketing a device loses nothing the classifier reads", () => {
         lastPolledAt: device.lastPolledAt,
         lastSeenAt: device.lastSeenAt,
         pollingIntervalInMinutes: device.pollingIntervalInMinutes,
+        monitoringMethod: device.monitoringMethod,
       };
 
       const direct: string | null = SiteStatusRollupUtil.worstStatus({
@@ -431,12 +453,16 @@ describe("bucketing a device loses nothing the classifier reads", () => {
   });
 
   /*
-   * `deviceHealthState` must not start reading the monitoring method: it does
-   * not today, and a bucket that carried it into the input would change every
-   * monitor-backed device's verdict on the site cards without touching a
-   * single line of the classifier.
+   * The bucket carries the monitoring method INTO the classifier input, and
+   * the classifier reads it (issue #3562). An earlier revision pinned the
+   * opposite — that carrying it changed nothing — which held only while a
+   * monitor-backed row had NULL in every poll column. The server now mirrors
+   * the bound monitor into `isReachable`, and a device switched over from
+   * SNMP keeps its old lastSeenAt until the switch-over clears it; a
+   * classifier that ignored the method would read either as a poll verdict
+   * and disagree with the device list under the card.
    */
-  test("carrying the monitoring method does not change the health verdict", () => {
+  test("the monitoring method is carried into the input and decides an unstamped bucket", () => {
     const base: DeviceHealthGroup = {
       siteId: null,
       monitorStatusId: null,
@@ -455,17 +481,115 @@ describe("bucketing a device loses nothing the classifier reads", () => {
       monitoringMethod: "Monitor",
     };
 
+    expect(
+      deviceHealthInputForGroup({ group: base, now: NOW }).monitoringMethod,
+    ).toBeNull();
+    expect(
+      deviceHealthInputForGroup({ group: withMethod, now: NOW })
+        .monitoringMethod,
+    ).toBe("Monitor");
+
+    // A mirrored, unstamped outcome on an SNMP row is a poll verdict...
+    expect(
+      deviceHealthState(
+        deviceHealthInputForGroup({ group: base, now: NOW }),
+        NOW,
+      ),
+    ).toBe("healthy");
+    // ...and on a monitor-backed row it is not a verdict at all.
     expect(
       deviceHealthState(
         deviceHealthInputForGroup({ group: withMethod, now: NOW }),
         NOW,
       ),
-    ).toBe(
+    ).toBe("unknown");
+    // A stamp is, on either.
+    expect(
       deviceHealthState(
-        deviceHealthInputForGroup({ group: base, now: NOW }),
+        deviceHealthInputForGroup({
+          group: withMethod,
+          monitorStatusIsOffline: false,
+          now: NOW,
+        }),
         NOW,
       ),
-    );
+    ).toBe("healthy");
+    expect(
+      deviceHealthState(
+        deviceHealthInputForGroup({
+          group: withMethod,
+          monitorStatusIsOffline: true,
+          now: NOW,
+        }),
+        NOW,
+      ),
+    ).toBe("down");
+  });
+
+  /*
+   * The rollup reads the same buckets through its own builder, and the site
+   * it colours is the card the tally above prints on — so the two builders
+   * have to carry the method identically or the card's counts and its
+   * colour describe different fleets.
+   */
+  test("the rollup state carries the monitoring method the same way", () => {
+    const leftovers: DeviceHealthGroup = {
+      siteId: null,
+      monitorStatusId: null,
+      monitoringMethod: null,
+      isReachable: null,
+      hasBeenPolled: false,
+      hasBeenSeen: true,
+      isStale: true,
+      hasDownInterfaces: false,
+      deviceCount: 1,
+      interfacesDownTotal: 0,
+    };
+    const operational: { monitorStatusId: string; priority: number } = {
+      monitorStatusId: "operational",
+      priority: 1,
+    };
+    const offline: { monitorStatusId: string; priority: number } = {
+      monitorStatusId: "offline",
+      priority: 3,
+    };
+
+    expect(
+      deviceRollupStateForGroup({ group: leftovers, now: NOW })
+        .monitoringMethod,
+    ).toBeNull();
+    expect(
+      deviceRollupStateForGroup({
+        group: { ...leftovers, monitoringMethod: "Monitor" },
+        now: NOW,
+      }).monitoringMethod,
+    ).toBe("Monitor");
+
+    // Stale leftovers on an SNMP row vote offline (the legacy branch)...
+    expect(
+      SiteStatusRollupUtil.worstStatus({
+        deviceStates: [
+          deviceRollupStateForGroup({ group: leftovers, now: NOW }),
+        ],
+        operationalStatus: operational,
+        offlineStatus: offline,
+        now: NOW,
+      }),
+    ).toBe("offline");
+    // ...and on a monitor-backed row they are not a vote at all.
+    expect(
+      SiteStatusRollupUtil.worstStatus({
+        deviceStates: [
+          deviceRollupStateForGroup({
+            group: { ...leftovers, monitoringMethod: "Monitor" },
+            now: NOW,
+          }),
+        ],
+        operationalStatus: operational,
+        offlineStatus: offline,
+        now: NOW,
+      }),
+    ).toBeNull();
   });
 });