@oneuptime/common 12.0.34 → 13.0.0

package/Models/DatabaseModels/GlobalConfig.ts

@@ -1153,9 +1153,9 @@ export default class GlobalConfig extends GlobalConfigModel {
   })
   @TableColumn({
     type: TableColumnType.Boolean,
-    title: "Redis Memory Notifications",
+    title: "Valkey Memory Notifications",
     description:
-      "Notify master administrators when Redis memory usage rises above the configured threshold.",
+      "Notify master administrators when Valkey memory usage rises above the configured threshold.",
     defaultValue: false,
     isDefaultValueColumn: true,
     required: true,
@@ -1174,9 +1174,9 @@ export default class GlobalConfig extends GlobalConfigModel {
   })
   @TableColumn({
     type: TableColumnType.Number,
-    title: "Redis Memory Notification Threshold (%)",
+    title: "Valkey Memory Notification Threshold (%)",
     description:
-      "Notify master administrators when Redis memory usage rises above this percentage of maxmemory.",
+      "Notify master administrators when Valkey memory usage rises above this percentage of maxmemory.",
     defaultValue: 80,
     isDefaultValueColumn: true,
     required: true,
@@ -1195,9 +1195,9 @@ export default class GlobalConfig extends GlobalConfigModel {
   })
   @TableColumn({
     type: TableColumnType.Boolean,
-    title: "Redis Connection Saturation Notifications",
+    title: "Valkey Connection Saturation Notifications",
     description:
-      "Notify master administrators when Redis client connections approach the maxclients limit or connections are being rejected.",
+      "Notify master administrators when Valkey client connections approach the maxclients limit or connections are being rejected.",
     defaultValue: false,
     isDefaultValueColumn: true,
     required: true,
@@ -1216,9 +1216,9 @@ export default class GlobalConfig extends GlobalConfigModel {
   })
   @TableColumn({
     type: TableColumnType.Number,
-    title: "Redis Connection Notification Threshold (%)",
+    title: "Valkey Connection Notification Threshold (%)",
     description:
-      "Notify master administrators when connected Redis clients rise above this percentage of maxclients.",
+      "Notify master administrators when connected Valkey clients rise above this percentage of maxclients.",
     defaultValue: 80,
     isDefaultValueColumn: true,
     required: true,
@@ -1237,9 +1237,9 @@ export default class GlobalConfig extends GlobalConfigModel {
   })
   @TableColumn({
     type: TableColumnType.Boolean,
-    title: "Redis Key Eviction Notifications",
+    title: "Valkey Key Eviction Notifications",
     description:
-      "Notify master administrators when Redis evicts keys because it reached its memory limit.",
+      "Notify master administrators when Valkey evicts keys because it reached its memory limit.",
     defaultValue: false,
     isDefaultValueColumn: true,
     required: true,
@@ -1258,9 +1258,9 @@ export default class GlobalConfig extends GlobalConfigModel {
   })
   @TableColumn({
     type: TableColumnType.Boolean,
-    title: "Redis Persistence Failure Notifications",
+    title: "Valkey Persistence Failure Notifications",
     description:
-      "Notify master administrators when a Redis RDB snapshot or AOF write fails.",
+      "Notify master administrators when a Valkey RDB snapshot or AOF write fails.",
     defaultValue: false,
     isDefaultValueColumn: true,
     required: true,

package/Models/DatabaseModels/InventoryItem.ts

@@ -18,7 +18,19 @@ import ObjectID from "../../Types/ObjectID";
 import Permission from "../../Types/Permission";
 import EntitySource from "../../Types/Telemetry/EntitySource";
 import EntityType from "../../Types/Telemetry/EntityType";
-import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
+import {
+  InventoryLiveness,
+  INVENTORY_LIVE_WINDOW_MINUTES,
+  INVENTORY_STALE_AFTER_MINUTES,
+} from "../../Types/Telemetry/InventoryLiveness";
+import {
+  Column,
+  Entity,
+  Index,
+  JoinColumn,
+  ManyToOne,
+  VirtualColumn,
+} from "typeorm";
 import DatabaseBaseModel from "./DatabaseBaseModel/DatabaseBaseModel";
 
 /*
@@ -368,6 +380,37 @@ export default class InventoryItem extends DatabaseBaseModel {
   @Column({ type: ColumnType.Date, nullable: true })
   public lastSeenAt?: Date = undefined;
 
+  /**
+   * Computed at read time so filters, counts and pagination use the same
+   * status without persisting a value that becomes stale as time passes.
+   * A virtual column needs no schema migration and is never written.
+   *
+   * The badge floors elapsed minutes before applying inclusive thresholds:
+   * 30m59s is still Live, and 24h00m59s is still Recent. Strict comparisons
+   * against the following minute preserve those exact boundaries.
+   */
+  @ColumnAccessControl({ create: [], read: READ_PERMS, update: [] })
+  @TableColumn({
+    type: TableColumnType.ShortText,
+    required: false,
+    title: "Status",
+    description:
+      "Current heartbeat status: live, recent, stale, never seen, or not tracked.",
+  })
+  @VirtualColumn({
+    type: ColumnType.ShortText,
+    query: (alias: string): string => {
+      return `CASE
+        WHEN ${alias}."source" IS DISTINCT FROM '${EntitySource.Discovered}' THEN '${InventoryLiveness.NotTracked}'
+        WHEN ${alias}."lastSeenAt" IS NULL THEN '${InventoryLiveness.Never}'
+        WHEN ${alias}."lastSeenAt" > CURRENT_TIMESTAMP - INTERVAL '${INVENTORY_LIVE_WINDOW_MINUTES + 1} minutes' THEN '${InventoryLiveness.Live}'
+        WHEN ${alias}."lastSeenAt" > CURRENT_TIMESTAMP - INTERVAL '${INVENTORY_STALE_AFTER_MINUTES + 1} minutes' THEN '${InventoryLiveness.Recent}'
+        ELSE '${InventoryLiveness.Stale}'
+      END`;
+    },
+  })
+  public inventoryStatus?: InventoryLiveness = undefined;
+
   /*
    * Archiving is the disposal route that actually works for this table.
    *

package/Models/DatabaseModels/NetworkDevice.ts

@@ -434,6 +434,132 @@ export default class NetworkDevice extends BaseModel {
   })
   public hostname?: string = undefined;
 
+  /*
+   * --- Which switch port is this device on? ---
+   *
+   * LLDP and CDP answer that for a device that speaks them. A device that
+   * does not - a POS register, a handset, a kiosk, anything monitored by
+   * ping alone - is invisible to both, and until now the only way to draw
+   * its cable on the map was a NetworkDeviceLink somebody typed in and then
+   * had to keep true by hand (issue #3489).
+   *
+   * The switches already know. Every walked switch reports its forwarding
+   * table, and the server keeps one NetworkEndpoint row per MAC it learned
+   * with the switch and port that learned it. This column is what lets a
+   * device be recognised in that inventory: a device whose MAC matches an
+   * endpoint's is drawn on the port that endpoint was learned on, and the
+   * link moves with the device when it is re-cabled, because the next walk
+   * learns the MAC somewhere else.
+   *
+   * Optional twice over. A device whose hostname is an IP address that a
+   * walked device's ARP table resolves is matched by address without it,
+   * and the MAC learned that way is written here so the match survives the
+   * ARP entry ageing out. The server fills an EMPTY value, and corrects a
+   * value it learned itself when the table later binds the address to a
+   * different MAC (isMacAddressLearned says which); anything an operator
+   * typed is left alone. Normalised to lowercase colon form on write; any
+   * of the usual spellings is accepted.
+   */
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.CreateNetworkDevice,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadNetworkDevice,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.EditNetworkDevice,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.ShortText,
+    canReadOnRelationQuery: true,
+    title: "MAC Address",
+    description:
+      "MAC address of this device. Lets the topology map find the switch port it is plugged into from the forwarding tables of walked switches, for a device that speaks neither LLDP nor CDP (one monitored by ping alone). Optional: a device whose hostname is an IP address that a walked router's ARP table resolves is matched by address, and the MAC learned that way is stored here.",
+    example: "aa:bb:cc:dd:ee:ff",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+  })
+  public macAddress?: string = undefined;
+
+  /*
+   * Where the MAC above came from, when the server wrote it.
+   *
+   * A MAC an operator typed is theirs and is never touched. A MAC the ARP
+   * pass learned is only as good as the router's table was on the walk
+   * that learned it - an address re-leased to a laptop the day before the
+   * register was plugged in stamps the laptop's MAC on the register - so
+   * the pass may correct its OWN answer when a later walk binds the
+   * address to a different MAC, and this flag is what tells the two apart.
+   * Set by the learner's write, cleared by any write of macAddress that
+   * comes through the API (see NetworkDeviceService).
+   */
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.CreateNetworkDevice,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadNetworkDevice,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.EditNetworkDevice,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.Boolean,
+    canReadOnRelationQuery: true,
+    title: "MAC Address Learned",
+    description:
+      "True when the MAC Address was filled in from a walked device's ARP table rather than typed. A learned MAC is corrected when a later walk binds the device's address to a different MAC; a typed one is never touched.",
+    defaultValue: false,
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.Boolean,
+    default: false,
+  })
+  public isMacAddressLearned?: boolean = undefined;
+
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,

package/Server/EnvironmentConfig.ts

@@ -472,32 +472,63 @@ export const HomeHostname: Hostname = Hostname.fromString(
 
 export const Env: string = process.env["NODE_ENV"] || "production";
 
-// Redis does not require password.
-export const RedisHostname: string = process.env["REDIS_HOST"] || "redis";
-export const RedisPort: Port = new Port(process.env["REDIS_PORT"] || "6379");
-export const RedisDb: number = Number(process.env["REDIS_DB"]) || 0;
-export const RedisUsername: string = process.env["REDIS_USERNAME"] || "default";
-export const RedisPassword: string =
-  process.env["REDIS_PASSWORD"] || "password";
+/*
+ * The cache and queue tier runs Valkey -- the BSD-licensed fork of Redis 7.2 --
+ * so its settings are named VALKEY_*. Any Redis-protocol server works here,
+ * including real Redis, which is why the in-code names below stay `Redis*`:
+ * they describe the protocol, not the vendor.
+ *
+ * The REDIS_* names these shipped under are still read, so an existing
+ * config.env or values.yaml keeps working untouched. They are DEPRECATED, not
+ * removed; VALKEY_* wins when both are set. Nothing here may start requiring
+ * the new name -- a self-hoster who never edits config.env must keep running.
+ *
+ * `||` here is load-bearing and must not be "modernised" to `??`. Compose
+ * materialises an unset variable as an EMPTY STRING, and docker-compose.base.yml
+ * lists every VALKEY_* name, so the new name is always *defined* inside our
+ * containers. Under `??` an empty VALKEY_PASSWORD would beat the operator's real
+ * REDIS_PASSWORD and the app would silently fall through to the literal default
+ * below.
+ */
+export function getCacheEnvVar(suffix: string): string | undefined {
+  return (
+    process.env[`VALKEY_${suffix}`] ||
+    process.env[`REDIS_${suffix}`] ||
+    undefined
+  );
+}
+
+/*
+ * The cache does not require a password.
+ *
+ * The default hostname stays "redis" even though the compose service is now
+ * `valkey`. This default is only reached when NEITHER variable is set, which
+ * never happens in our own compose or Helm -- both always set them. What it does
+ * cover is hand-written Kubernetes manifests, a bare `docker run`, and third
+ * party compose files, where the Service has been called `redis` for years.
+ * Compose is unaffected either way: its valkey service answers to `redis` too.
+ */
+export const RedisHostname: string = getCacheEnvVar("HOST") || "redis";
+export const RedisPort: Port = new Port(getCacheEnvVar("PORT") || "6379");
+export const RedisDb: number = Number(getCacheEnvVar("DB")) || 0;
+export const RedisUsername: string = getCacheEnvVar("USERNAME") || "default";
+export const RedisPassword: string = getCacheEnvVar("PASSWORD") || "password";
 
-export const RedisTlsCa: string | undefined =
-  process.env["REDIS_TLS_CA"] || undefined;
+export const RedisTlsCa: string | undefined = getCacheEnvVar("TLS_CA");
 
-export const RedisTlsCert: string | undefined =
-  process.env["REDIS_TLS_CERT"] || undefined;
+export const RedisTlsCert: string | undefined = getCacheEnvVar("TLS_CERT");
 
-export const RedisTlsKey: string | undefined =
-  process.env["REDIS_TLS_KEY"] || undefined;
+export const RedisTlsKey: string | undefined = getCacheEnvVar("TLS_KEY");
 
 export const RedisTlsSentinelMode: boolean =
-  process.env["REDIS_TLS_SENTINEL_MODE"] === "true";
+  getCacheEnvVar("TLS_SENTINEL_MODE") === "true";
 
 export const ShouldRedisTlsEnable: boolean = Boolean(
   RedisTlsCa || (RedisTlsCert && RedisTlsKey),
 );
 
-export const RedisIPFamily: number = process.env["REDIS_IP_FAMILY"]
-  ? Number(process.env["REDIS_IP_FAMILY"])
+export const RedisIPFamily: number = getCacheEnvVar("IP_FAMILY")
+  ? Number(getCacheEnvVar("IP_FAMILY"))
   : 4;
 
 export const IsProduction: boolean =

package/Server/Infrastructure/Postgres/SchemaMigrations/1791700000000-AddMacAddressToNetworkDevice.ts

@@ -0,0 +1,25 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddMacAddressToNetworkDevice1791700000000
+  implements MigrationInterface
+{
+  public name: string = "AddMacAddressToNetworkDevice1791700000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ADD "macAddress" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ADD "isMacAddressLearned" boolean DEFAULT false`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" DROP COLUMN "isMacAddressLearned"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" DROP COLUMN "macAddress"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -577,6 +577,7 @@ import { AddTelemetryIngestionKeyType1791300000000 } from "./1791300000000-AddTe
 import { SessionReplayRecordEverySessionByDefault1791400000000 } from "./1791400000000-SessionReplayRecordEverySessionByDefault";
 import { WidenCustomFieldDropdownOptions1791500000000 } from "./1791500000000-WidenCustomFieldDropdownOptions";
 import { AddCustomFieldValueMapping1791600000000 } from "./1791600000000-AddCustomFieldValueMapping";
+import { AddMacAddressToNetworkDevice1791700000000 } from "./1791700000000-AddMacAddressToNetworkDevice";
 
 export default [
   InitialMigration,
@@ -1158,4 +1159,5 @@ export default [
   SessionReplayRecordEverySessionByDefault1791400000000,
   WidenCustomFieldDropdownOptions1791500000000,
   AddCustomFieldValueMapping1791600000000,
+  AddMacAddressToNetworkDevice1791700000000,
 ];

package/Server/Infrastructure/Redis.ts

@@ -71,9 +71,9 @@ export default abstract class Redis {
       // Listen to 'error' events to the Redis connection
       this.client.on("error", (error: Error) => {
         if ((error as any).code === "ECONNRESET") {
-          logger.error("Connection to Redis Session Store timed out.");
+          logger.error("Connection to Valkey Session Store timed out.");
         } else if ((error as any).code === "ECONNREFUSED") {
-          logger.error("Connection to Redis Session Store refused!");
+          logger.error("Connection to Valkey Session Store refused!");
         } else {
           logger.error(error);
         }
@@ -82,16 +82,16 @@ export default abstract class Redis {
       // Listen to 'reconnecting' event to Redis
       this.client.on("reconnecting", () => {
         if (this.client?.status === "reconnecting") {
-          logger.error("Reconnecting to Redis Session Store...");
+          logger.error("Reconnecting to Valkey Session Store...");
         } else {
-          logger.error("Error reconnecting to Redis Session Store.");
+          logger.error("Error reconnecting to Valkey Session Store.");
         }
       });
 
       // Listen to the 'connect' event to Redis
       this.client.on("connect", (err: Error) => {
         if (!err) {
-          logger.debug("Connected to Redis Session Store!");
+          logger.debug("Connected to Valkey Session Store!");
         }
       });
 
@@ -137,7 +137,7 @@ export default abstract class Redis {
           );
         }
 
-        logger.debug("Cannot connect to Redis. Retrying again in 5 seconds");
+        logger.debug("Cannot connect to Valkey. Retrying again in 5 seconds");
         // sleep for 5 seconds.
 
         await Sleep.sleep(5000);
@@ -163,7 +163,7 @@ export default abstract class Redis {
 
       return this.client;
     } catch (err) {
-      logger.error("Redis Connection Failed");
+      logger.error("Valkey Connection Failed");
       logger.error(err);
       throw err;
     }
@@ -191,7 +191,7 @@ export default abstract class Redis {
 
       return true;
     } catch (err) {
-      logger.error("Redis Connection Lost");
+      logger.error("Valkey Connection Lost");
       logger.error(err);
       return false;
     }

package/Server/Infrastructure/Status.ts

@@ -17,12 +17,18 @@ export default class InfrastructureStatus {
     logger.info("Checking infrastructure status");
 
     if (data.checkRedisStatus) {
-      logger.info("Checking Redis status");
+      logger.info("Checking Valkey status");
       if (!(await Redis.checkConnnectionStatus())) {
-        logger.info("Redis is not connected");
-        throw new DatabaseNotConnectedException("Redis is not connected");
+        logger.info("Valkey is not connected");
+        /*
+         * This message is not log-only: StatusAPI passes it straight to
+         * sendErrorResponse, so it is the body of GET /api/status/global-cache,
+         * /ready and /live. It is the first thing an operator curls when the
+         * cache is down, which is why it says what the container actually is.
+         */
+        throw new DatabaseNotConnectedException("Valkey is not connected");
       }
-      logger.info("Redis is connected");
+      logger.info("Valkey is connected");
     }
 
     if (data.checkPostgresStatus) {

package/Server/Services/DatabaseService.ts

@@ -46,6 +46,7 @@ import Protocol from "../../Types/API/Protocol";
 import Route from "../../Types/API/Route";
 import URL from "../../Types/API/URL";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import Sort from "../../Types/BaseDatabase/Sort";
 import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import { getMaxLengthFromTableColumnType } from "../../Types/Database/ColumnLength";
 import Columns from "../../Types/Database/Columns";
@@ -1636,12 +1637,28 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
    * A query builder scoped to exactly the rows this read may see, and — this
    * is the whole point — scoped so that each of them appears ONCE.
    *
-   * The permission pipeline expresses a label-scoped read as a condition on
-   * the access-control RELATION: `{ labels: [permittedIds] }` for an allow
-   * permission, `{ labels: { _id: NotIn([...]) } }` for a block. Handed to
-   * TypeORM's FindOptions machinery those become a join through the
-   * many-to-many junction table — and a join multiplies rows. A device
-   * carrying two permitted labels comes back twice.
+   * The permission pipeline expresses a label-scoped ALLOW as a condition on
+   * the access-control RELATION — `{ labels: [permittedIds] }`, which
+   * QueryUtil.serializeQuery then nests into `{ labels: { _id: <a set
+   * membership operator> } }`. Handed to TypeORM's FindOptions machinery that
+   * becomes a join through the many-to-many junction table — and a join
+   * multiplies rows. A device carrying two permitted labels comes back twice.
+   *
+   * A label BLOCK no longer takes that route, and it is worth being precise
+   * about why, because the shape reads like the allow half's mirror image and
+   * is not. A relation condition cannot express "has NONE of these labels" at
+   * all: a device labelled {blocked, other} still matches the join through its
+   * "other" row. So ReadPermission writes the block as a flat predicate on the
+   * owner's own id instead — `_id NOT IN (SELECT ownerId FROM the junction
+   * table WHERE labelId IN (...))`. Flat means no join, which means no
+   * duplicate rows, which means the block half needs nothing from this method
+   * beyond the cheap path below.
+   *
+   * The allow half is not the only producer of relation-keyed conditions
+   * either. `@CanAccessIfCanReadOn` makes BasePermission write
+   * `query[relation] = { <the related model's access-control column>: ids }`
+   * for StatusPageResource, IncidentInternalNote, AlertEpisodeMember and
+   * others, and that arrives here indistinguishable from a label allow.
    *
    * `findBy` never notices, because entity hydration de-duplicates by primary
    * key on the way out. An aggregate has no such step: COUNT(*) would report
@@ -1656,9 +1673,10 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
    * by a DISTINCT subquery of ids. The joins live inside that subquery, where
    * duplicate rows collapse before anything is added up.
    *
-   * The subquery is skipped when the query is flat — which is every read by a
-   * user whose permissions are not label-scoped, i.e. the hot path — so the
-   * ordinary full-fleet aggregate stays a single sequential scan.
+   * The subquery is skipped when the query is flat — every read by a user with
+   * no label-scoped allow grant and no `@CanAccessIfCanReadOn` relation, which
+   * is the hot path, and the block half above with it — so the ordinary
+   * full-fleet aggregate stays a single sequential scan.
    */
   private buildAggregateScope(
     query: Query<TBaseModel>,
@@ -1698,10 +1716,14 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
       `"${this.modelName}"."_id" IN (${scopeBuilder.getQuery()})`,
     );
     /*
-     * The subquery's own bound values. Its placeholders are auto-named
-     * (`orm_param_N`) and the outer builder generates none of its own here —
-     * its only WHERE is the raw string above — so there is nothing to clash
-     * with. Caller-supplied parameters are named and applied later.
+     * The subquery's own bound values, copied across under whatever names they
+     * already carry. Two naming schemes reach this line: TypeORM auto-names
+     * the parameters it creates itself (`orm_param_N`), but a label predicate
+     * arrives as a `Raw` operator carrying its own object-literal parameters,
+     * and TypeORM registers those verbatim — QueryHelper names them with ten
+     * random characters apiece. Neither can clash with the outer builder,
+     * which generates no parameters of its own here: its only WHERE is the raw
+     * string above. Caller-supplied parameters are named and applied later.
      */
     queryBuilder.setParameters(scopeBuilder.getParameters());
 
@@ -2149,6 +2171,36 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
         throw new BadDataException("GroupBy is currently not supported");
       }
 
+      /*
+       * Complete the caller's sort into a TOTAL order.
+       *
+       * Everything here pages with LIMIT/OFFSET, and OFFSET only means
+       * anything against an ordering that has no ties: rows that compare
+       * equal may come back in any order, and Postgres is free to return them
+       * differently for the two queries that fetch page 1 and page 2. A tied
+       * row can therefore be served on both pages while another is served on
+       * neither — the same row apparently listed twice.
+       *
+       * Ties are not exotic. The Inventory list sorts on `lastSeenAt`, which
+       * the entity reconciler rewrites for every live entity every few
+       * minutes, and the inventory mirror stamps one identical timestamp
+       * across a whole page of rows; "created at" sorts tie for anything
+       * bulk-inserted in one statement. Appending the primary key breaks
+       * every tie deterministically and costs nothing — `_id` is the PK, and
+       * it is already in the select (see above), so this adds no column to
+       * the projection and nothing to strip afterwards.
+       */
+      const sortSoFar: Dictionary<SortOrder> =
+        (onBeforeFind.sort as Dictionary<SortOrder> | undefined) || {};
+
+      if (!sortSoFar["_id"]) {
+        // Copied, never mutated: callers reuse their sort objects across queries.
+        onBeforeFind.sort = {
+          ...sortSoFar,
+          _id: SortOrder.Ascending,
+        } as Sort<TBaseModel>;
+      }
+
       const items: Array<TBaseModel> = await this.getRepository().find({
         skip: onBeforeFind.skip.toNumber(),
         take: onBeforeFind.limit.toNumber(),

package/Server/Services/InventoryItemService.ts

@@ -57,6 +57,27 @@ export class InventoryItemService extends DatabaseService<Model> {
   ): Promise<OnCreate<Model>> {
     const data: Model = createBy.data;
 
+    /*
+     * Who is calling decides this, not what they sent.
+     *
+     * The two machine writers — the ingest reconciler and the inventory
+     * mirror — construct the model themselves and create it with
+     * `props: { isRoot: true }`. Everything else is a person or an API
+     * client. Keying the branch on "did the payload include an entityKey"
+     * instead let any caller opt out of every check below simply by sending
+     * one: the manual-type restriction, the required display name, the
+     * canonicalize-then-hash identity derivation and the firstSeenAt /
+     * lastSeenAt stamp were all skipped, and a hand-supplied
+     * `source: "discovered"` was taken at face value — putting a row in
+     * Inventory that claims to have been discovered from telemetry, of a type
+     * only ingest is supposed to create, which the prune sweep then treats as
+     * TTL-reapable.
+     */
+    if (createBy.props.isRoot !== true) {
+      delete data.entityKey;
+      data.source = EntitySource.Manual;
+    }
+
     if (!data.entityKey) {
       data.source = EntitySource.Manual;
     }
@@ -150,7 +171,16 @@ export class InventoryItemService extends DatabaseService<Model> {
     const countByType: Map<EntityType, number> = new Map<EntityType, number>();
 
     for (const entity of data.entities) {
-      if (!REGISTRY_PROMOTED_TYPES.has(entity.entityType)) {
+      /*
+       * Both promotion gates, repeated at the write boundary. The caller
+       * applies them too, but this method is public and the cost of a missed
+       * gate here is a registry row that should never have existed — see
+       * `ExtractedEntity.membershipOnly` for what the per-entity flag means.
+       */
+      if (
+        entity.membershipOnly ||
+        !REGISTRY_PROMOTED_TYPES.has(entity.entityType)
+      ) {
         continue;
       }
       try {