@oneuptime/common 12.0.34 → 13.0.0

package/Tests/Server/Services/NetworkDeviceAutoImportRuleEngineService.test.ts

@@ -117,6 +117,7 @@ import NetworkDeviceAutoImportRuleEngineService, {
   AUTO_IMPORT_SWEEP_LOCK_TIMEOUT_MS,
   ExistingHostnamesByProjectId,
   ImportAttemptBudgetsByProjectId,
+  MAX_CONSECUTIVE_MONITOR_CREATE_FAILURES,
   MAX_DEVICES_PER_AUTO_IMPORT_RUN,
   MAX_MONITORS_PER_AUTO_IMPORT_RUN,
   MAX_RESULT_AGE_IN_HOURS,
@@ -139,6 +140,7 @@ import NetworkDeviceDiscoveryScan, {
 } from "../../../Models/DatabaseModels/NetworkDeviceDiscoveryScan";
 import { DiscoveryScanSnmpConfig } from "../../../Utils/NetworkDiscovery/SnmpScanConfigUtil";
 import BadDataException from "../../../Types/Exception/BadDataException";
+import { JSONObject } from "../../../Types/JSON";
 import ObjectID from "../../../Types/ObjectID";
 import OneUptimeDate from "../../../Types/Date";
 import MonitorSteps from "../../../Types/Monitor/MonitorSteps";
@@ -587,6 +589,7 @@ describe("NetworkDeviceAutoImportRuleEngineService.processCompletedScan", () =>
     const unmatchedRow: DiscoveredNetworkDevice = makeHost({
       ipAddress: "192.168.1.5",
       sysName: "printer-01",
+      isAlreadyRegistered: true,
     });
 
     scanFindOneByMock.mockResolvedValue(
@@ -611,6 +614,10 @@ describe("NetworkDeviceAutoImportRuleEngineService.processCompletedScan", () =>
     expect(createMock).toHaveBeenCalledTimes(1);
     expect(monitorFindByMock).not.toHaveBeenCalled();
     expect(monitorTemplateFindByMock).not.toHaveBeenCalled();
+    expect(scanFindOneByMock.mock.calls[0]![0].props).toEqual({
+      isRoot: true,
+      ignoreHooks: true,
+    });
     const device: NetworkDevice = createdDevice(0);
     // The address is the hostname AND the dedup key downstream.
     expect(device.hostname).toBe("10.0.0.5");
@@ -813,6 +820,66 @@ describe("NetworkDeviceAutoImportRuleEngineService.processCompletedScan", () =>
       ).toBe(TEMPLATE_DEVICE_ID);
     });
 
+    /*
+     * ISSUE #3548. A template's custom fields are the DEFAULTS its monitors
+     * are born with, and this is the path that made that worth having: a
+     * discovery scan importing a thousand devices used to leave a thousand
+     * monitors with every custom field empty, fillable only one monitor at a
+     * time.
+     *
+     * Driven through the engine rather than the builder alone for the same
+     * reason as the name test above — the values only reach the create call if
+     * `customFields` is still in this service's template select, and a dropped
+     * select column is indistinguishable from a template nobody set defaults
+     * on. Two hosts, because the cached template serves the whole estate: a
+     * shallow copy would hand every monitor in the run the same jsonb object,
+     * so one later edit would reach the rest of the fleet and the template.
+     */
+    it("gives every monitor in one run its own copy of the template's custom field defaults", async () => {
+      const template: MonitorTemplate = makeTemplate({
+        customFields: { Vendor: "Cisco", Thresholds: { cpu: 80 } },
+      });
+      scanFindOneByMock.mockResolvedValue(
+        makeScan({
+          discoveredDevices: [
+            makeHost(),
+            makeHost({ ipAddress: "10.0.0.6", sysName: "core-switch-02" }),
+          ],
+        }),
+      );
+      ruleFindByMock.mockResolvedValue([
+        makeRule({ monitorTemplateId: TEMPLATE_ID }),
+      ]);
+      monitorTemplateFindByMock.mockResolvedValue([template]);
+
+      const result: AutoImportRuleRunResult | null = await processScan();
+
+      expect(result).toMatchObject({ devicesCreated: 2, monitorsCreated: 2 });
+
+      const firstMonitor: Monitor = provisionedMonitor(0);
+      const secondMonitor: Monitor = provisionedMonitor(1);
+
+      for (const monitor of [firstMonitor, secondMonitor]) {
+        expect(monitor.customFields).toEqual({
+          Vendor: "Cisco",
+          Thresholds: { cpu: 80 },
+        });
+      }
+
+      expect(firstMonitor.customFields).not.toBe(secondMonitor.customFields);
+      expect(firstMonitor.customFields?.["Thresholds"]).not.toBe(
+        secondMonitor.customFields?.["Thresholds"],
+      );
+
+      (firstMonitor.customFields!["Thresholds"] as JSONObject)["cpu"] = 10;
+      expect(
+        (secondMonitor.customFields!["Thresholds"] as JSONObject)["cpu"],
+      ).toBe(80);
+      expect((template.customFields!["Thresholds"] as JSONObject)["cpu"]).toBe(
+        80,
+      );
+    });
+
     /*
      * ISSUE #3486. "Default Monitor Name" is optional, and a template that
      * leaves it blank names what it provisions after the DEVICE and nothing
@@ -1314,7 +1381,89 @@ describe("NetworkDeviceAutoImportRuleEngineService.processCompletedScan", () =>
       expect(monitorCreateMock).not.toHaveBeenCalled();
     });
 
-    it("caps missing-template failures across a large existing estate", async () => {
+    /*
+     * OneUptime/oneuptime#3643, the report this whole block exists for.
+     *
+     * An estate of 501 devices that a previous run already imported, and a
+     * rule whose Monitor Template no longer resolves. The template is a
+     * property of the RULE: it fails for the first device and for all 500
+     * after it, and no amount of running again changes that.
+     *
+     * What the customer saw was the engine re-proving that 500 times, one
+     * wasted monitor budget slot at a time, until the budget ran out — then
+     * reporting "Stopped at the run cap - run again to continue", with no hint
+     * of what was actually wrong. What it must do instead is settle the
+     * verdict once, count every monitor that is genuinely missing, and say
+     * why.
+     */
+    it("settles an unresolvable template once instead of re-failing it per device", async () => {
+      const hosts: Array<DiscoveredNetworkDevice> = Array.from(
+        { length: MAX_MONITORS_PER_AUTO_IMPORT_RUN + 1 },
+        (_value: unknown, index: number): DiscoveredNetworkDevice => {
+          return makeHost({
+            ipAddress: `10.2.${Math.floor(index / 256)}.${index % 256}`,
+            sysName: `missing-template-switch-${index}`,
+          });
+        },
+      );
+      const devices: Array<NetworkDevice> = hosts.map(
+        (host: DiscoveredNetworkDevice): NetworkDevice => {
+          return makeExistingDevice({
+            id: ObjectID.generate(),
+            hostname: host.ipAddress,
+            name: host.sysName,
+          });
+        },
+      );
+
+      ruleFindOneByMock.mockResolvedValue(
+        makeRule({
+          ipMatchTarget: "10.0.0.0/8",
+          monitorTemplateId: TEMPLATE_ID,
+        }),
+      );
+      ruleFindByMock.mockResolvedValue([]);
+      deviceFindByMock.mockResolvedValue(devices);
+      monitorTemplateFindByMock.mockResolvedValue([]);
+      mockRunNowScans([makeScan({ discoveredDevices: hosts })]);
+
+      const result: AutoImportRuleRunResult = await runRule(false);
+
+      expect(result).toMatchObject({
+        hostsMatched: hosts.length,
+        hostsSkippedAlreadyRegistered: hosts.length,
+        devicesCreated: 0,
+        monitorsCreated: 0,
+        // Every device really is missing its monitor, so every one is counted.
+        monitorsFailed: hosts.length,
+        monitorProvisioningHalted: true,
+        /*
+         * Nothing was cut short by a cap, so nothing is waiting for another
+         * run. This is the misleading half of the customer's dialog.
+         */
+        isTruncated: false,
+      });
+
+      expect(result.monitorFailureReasons).toEqual([
+        "This rule's Monitor Template could not be loaded. It may have been deleted, moved to another project, or changed to a monitor type other than Network Device. Edit the rule and select a Network Device Monitor Template.",
+      ]);
+      expect(monitorCreateMock).not.toHaveBeenCalled();
+
+      /*
+       * And it costs one log line and one budget slot, not 500 of each. The
+       * per-device race check is an unindexed search of the monitor step
+       * payload; running it 500 times to reach the same verdict is the other
+       * half of what made this run expensive.
+       */
+      expect(
+        loggerErrorMock.mock.calls.filter((call: Array<unknown>): boolean => {
+          return String(call[0]).includes("is missing, deleted, or not valid");
+        }),
+      ).toHaveLength(1);
+      expect(monitorFindByMock.mock.calls.length).toBeLessThanOrEqual(2);
+    });
+
+    it("reports the same unresolvable template on a dry run without a cap", async () => {
       const hosts: Array<DiscoveredNetworkDevice> = Array.from(
         { length: MAX_MONITORS_PER_AUTO_IMPORT_RUN + 1 },
         (_value: unknown, index: number): DiscoveredNetworkDevice => {
@@ -1349,115 +1498,409 @@ describe("NetworkDeviceAutoImportRuleEngineService.processCompletedScan", () =>
 
       expect(result).toMatchObject({
         monitorsWouldCreate: 0,
-        monitorsFailed: MAX_MONITORS_PER_AUTO_IMPORT_RUN,
-        isTruncated: true,
+        monitorsFailed: hosts.length,
+        monitorProvisioningHalted: true,
+        isTruncated: false,
         isDryRun: true,
       });
       expect(monitorCreateMock).not.toHaveBeenCalled();
     });
-  });
 
-  /*
-   * An over-long "address" is junk that would fail the varchar(100)
-   * hostname on every pass, identically, forever — so it is refused before
-   * any counting rather than logged as a devicesFailed per worker tick.
-   */
-  it("skips a host whose address could never be a hostname, before any counting", async () => {
-    scanFindOneByMock.mockResolvedValue(
-      makeScan({
-        discoveredDevices: [
-          makeHost({ ipAddress: "9".repeat(101) }),
-          makeHost(),
-        ],
-      }),
-    );
+    /*
+     * The other shape of the same report: the template resolves fine, and
+     * every create fails the same way anyway — a plan limit, criteria naming
+     * a monitor status that no longer exists, a database refusing writes.
+     * Indistinguishable from a per-host failure on the first device, so the
+     * engine tries, and stops once the evidence is decisive.
+     */
+    it("stops provisioning after the same create failure repeats for every device", async () => {
+      const hosts: Array<DiscoveredNetworkDevice> = Array.from(
+        { length: MAX_MONITORS_PER_AUTO_IMPORT_RUN + 1 },
+        (_value: unknown, index: number): DiscoveredNetworkDevice => {
+          return makeHost({
+            ipAddress: `10.3.${Math.floor(index / 256)}.${index % 256}`,
+            sysName: `systemic-switch-${index}`,
+          });
+        },
+      );
+      const devices: Array<NetworkDevice> = hosts.map(
+        (host: DiscoveredNetworkDevice): NetworkDevice => {
+          return makeExistingDevice({
+            id: ObjectID.generate(),
+            hostname: host.ipAddress,
+            name: host.sysName,
+          });
+        },
+      );
 
-    const result: AutoImportRuleRunResult | null = await processScan();
+      ruleFindOneByMock.mockResolvedValue(
+        makeRule({
+          ipMatchTarget: "10.0.0.0/8",
+          monitorTemplateId: TEMPLATE_ID,
+        }),
+      );
+      ruleFindByMock.mockResolvedValue([]);
+      deviceFindByMock.mockResolvedValue(devices);
+      monitorFindByMock.mockResolvedValue([]);
+      monitorFindOneByMock.mockResolvedValue(null);
+      monitorTemplateFindByMock.mockResolvedValue([makeTemplate()]);
+      monitorCreateMock.mockRejectedValue(
+        new BadDataException(
+          "You have reached the maximum allowed monitor limit for the free plan.",
+        ),
+      );
+      mockRunNowScans([makeScan({ discoveredDevices: hosts })]);
 
-    // The junk row was never evaluated, let alone matched or attempted.
-    expect(result).toMatchObject({
-      hostsEvaluated: 1,
-      hostsMatched: 1,
-      devicesCreated: 1,
-      devicesFailed: 0,
+      const result: AutoImportRuleRunResult = await runRule(false);
+
+      expect(monitorCreateMock).toHaveBeenCalledTimes(
+        MAX_CONSECUTIVE_MONITOR_CREATE_FAILURES,
+      );
+      expect(result).toMatchObject({
+        monitorsCreated: 0,
+        monitorsFailed: hosts.length,
+        monitorProvisioningHalted: true,
+        isTruncated: false,
+      });
+      expect(result.monitorFailureReasons).toEqual([
+        "You have reached the maximum allowed monitor limit for the free plan.",
+      ]);
     });
-    expect(createMock).toHaveBeenCalledTimes(1);
-    expect(createdDevice(0).hostname).toBe("10.0.0.5");
-  });
 
-  describe("the create-failure protocol", () => {
     /*
-     * Names are unique per project while addresses are not, and two devices
-     * legitimately sharing a sysName is common on real estates. When the
-     * ADDRESS is still free after a failed create, the name was the problem
-     * — one retry under the address-suffixed fallback settles it.
+     * The guard has to stay narrow, or it becomes a new way to lose monitors.
+     * Failures that differ are per-host failures: every device still gets its
+     * try.
      */
-    it("retries a name collision once under the fallback name", async () => {
-      scanFindOneByMock.mockResolvedValue(
-        makeScan({ discoveredDevices: [makeHost()] }),
+    it("keeps trying every device when the failures are not identical", async () => {
+      const hosts: Array<DiscoveredNetworkDevice> = Array.from(
+        { length: 30 },
+        (_value: unknown, index: number): DiscoveredNetworkDevice => {
+          return makeHost({
+            ipAddress: `10.4.0.${index}`,
+            sysName: `varied-switch-${index}`,
+          });
+        },
+      );
+      const devices: Array<NetworkDevice> = hosts.map(
+        (host: DiscoveredNetworkDevice): NetworkDevice => {
+          return makeExistingDevice({
+            id: ObjectID.generate(),
+            hostname: host.ipAddress,
+            name: host.sysName,
+          });
+        },
       );
-      createMock
-        .mockRejectedValueOnce(
-          new BadDataException("Network Device with this name already exists."),
-        )
-        .mockResolvedValueOnce({});
-      // The address re-check finds nothing: the name really was the problem.
-      deviceFindOneByMock.mockResolvedValue(null);
 
-      const result: AutoImportRuleRunResult | null = await processScan();
+      ruleFindOneByMock.mockResolvedValue(
+        makeRule({
+          ipMatchTarget: "10.0.0.0/8",
+          monitorTemplateId: TEMPLATE_ID,
+        }),
+      );
+      ruleFindByMock.mockResolvedValue([]);
+      deviceFindByMock.mockResolvedValue(devices);
+      monitorFindByMock.mockResolvedValue([]);
+      monitorFindOneByMock.mockResolvedValue(null);
+      monitorTemplateFindByMock.mockResolvedValue([makeTemplate()]);
 
-      expect(createMock).toHaveBeenCalledTimes(2);
-      // Same device both times; only the name changed.
-      expect(createdDevice(0).name).toBe("core-switch-01");
-      expect(createdDevice(1).name).toBe("core-switch-01 (10.0.0.5)");
-      expect(createdDevice(1).name!.endsWith(" (10.0.0.5)")).toBe(true);
-      expect(createdDevice(1).hostname).toBe("10.0.0.5");
+      let attempt: number = 0;
+      monitorCreateMock.mockImplementation((): Promise<Monitor> => {
+        attempt++;
+        return Promise.reject(new Error(`name collision on device ${attempt}`));
+      });
+      mockRunNowScans([makeScan({ discoveredDevices: hosts })]);
+
+      const result: AutoImportRuleRunResult = await runRule(false);
 
+      expect(monitorCreateMock).toHaveBeenCalledTimes(hosts.length);
       expect(result).toMatchObject({
-        devicesCreated: 1,
-        devicesFailed: 0,
-        hostsSkippedAlreadyRegistered: 0,
+        monitorsFailed: hosts.length,
+        monitorProvisioningHalted: false,
       });
+      // Distinct reasons are reported, bounded.
+      expect(result.monitorFailureReasons).toHaveLength(3);
     });
 
     /*
-     * Losing a race to a concurrent import of the SAME host must read as
-     * "already registered" — retrying under a new name here would spawn a
-     * renamed twin of a device that now exists.
+     * The guard must never cost an established estate its monitors. Once this
+     * run has provisioned even one, the create pipeline is known to work, and
+     * everything after it is a per-host failure however many of them there are
+     * and however alike they read.
      */
-    it("reads a lost create race as already-registered, with no rename retry", async () => {
-      scanFindOneByMock.mockResolvedValue(
-        makeScan({ discoveredDevices: [makeHost()] }),
+    it("never gives up once the run has created a monitor at all", async () => {
+      const hosts: Array<DiscoveredNetworkDevice> = Array.from(
+        { length: MAX_CONSECUTIVE_MONITOR_CREATE_FAILURES * 3 },
+        (_value: unknown, index: number): DiscoveredNetworkDevice => {
+          return makeHost({
+            ipAddress: `10.7.0.${index}`,
+            sysName: `established-switch-${index}`,
+          });
+        },
       );
-      createMock.mockRejectedValueOnce(
-        new BadDataException("Network Device with this name already exists."),
+      const devices: Array<NetworkDevice> = hosts.map(
+        (host: DiscoveredNetworkDevice): NetworkDevice => {
+          return makeExistingDevice({
+            id: ObjectID.generate(),
+            hostname: host.ipAddress,
+            name: host.sysName,
+          });
+        },
       );
-      // The address re-check finds a device: someone imported it meanwhile.
-      deviceFindOneByMock.mockResolvedValue({
-        id: new ObjectID("44444444-4444-4444-8444-444444444444"),
-      } as unknown as NetworkDevice);
 
-      const result: AutoImportRuleRunResult | null = await processScan();
+      ruleFindOneByMock.mockResolvedValue(
+        makeRule({
+          ipMatchTarget: "10.0.0.0/8",
+          monitorTemplateId: TEMPLATE_ID,
+        }),
+      );
+      ruleFindByMock.mockResolvedValue([]);
+      deviceFindByMock.mockResolvedValue(devices);
+      monitorFindByMock.mockResolvedValue([]);
+      monitorFindOneByMock.mockResolvedValue(null);
+      monitorTemplateFindByMock.mockResolvedValue([makeTemplate()]);
 
-      expect(createMock).toHaveBeenCalledTimes(1);
-      expect(deviceFindOneByMock.mock.calls[0]![0].select.projectId).toBe(true);
+      let call: number = 0;
+      monitorCreateMock.mockImplementation(
+        ({ data }: { data: Monitor }): Promise<Monitor> => {
+          call++;
+          if (call === 1) {
+            return Promise.resolve(data);
+          }
+          return Promise.reject(new Error("name already in use"));
+        },
+      );
+      mockRunNowScans([makeScan({ discoveredDevices: hosts })]);
+
+      const result: AutoImportRuleRunResult = await runRule(false);
+
+      expect(monitorCreateMock).toHaveBeenCalledTimes(hosts.length);
       expect(result).toMatchObject({
-        hostsMatched: 1,
-        hostsSkippedAlreadyRegistered: 1,
-        devicesCreated: 0,
-        devicesFailed: 0,
+        monitorsCreated: 1,
+        monitorsFailed: hosts.length - 1,
+        monitorProvisioningHalted: false,
       });
     });
-  });
 
-  /*
-   * The cap turns "a typo'd rule meets a huge subnet" into a few paced
-   * worker ticks instead of one burst of thousands of creates — and the
-   * UNSTAMPED marker is what makes the next tick resume where this one
-   * stopped, with idempotency skipping everything already created.
-   */
-  it("stops at the device cap and leaves the marker unstamped so the next tick resumes", async () => {
-    const hosts: Array<DiscoveredNetworkDevice> = makeHostsBeyondTheCap();
+    it("lets one success reset the systemic-failure streak", async () => {
+      const hosts: Array<DiscoveredNetworkDevice> = Array.from(
+        { length: MAX_CONSECUTIVE_MONITOR_CREATE_FAILURES * 2 - 1 },
+        (_value: unknown, index: number): DiscoveredNetworkDevice => {
+          return makeHost({
+            ipAddress: `10.5.0.${index}`,
+            sysName: `recovering-switch-${index}`,
+          });
+        },
+      );
+      const devices: Array<NetworkDevice> = hosts.map(
+        (host: DiscoveredNetworkDevice): NetworkDevice => {
+          return makeExistingDevice({
+            id: ObjectID.generate(),
+            hostname: host.ipAddress,
+            name: host.sysName,
+          });
+        },
+      );
+
+      ruleFindOneByMock.mockResolvedValue(
+        makeRule({
+          ipMatchTarget: "10.0.0.0/8",
+          monitorTemplateId: TEMPLATE_ID,
+        }),
+      );
+      ruleFindByMock.mockResolvedValue([]);
+      deviceFindByMock.mockResolvedValue(devices);
+      monitorFindByMock.mockResolvedValue([]);
+      monitorFindOneByMock.mockResolvedValue(null);
+      monitorTemplateFindByMock.mockResolvedValue([makeTemplate()]);
+
+      /*
+       * Fail one short of the threshold, succeed once, then fail one short
+       * again. Without the reset the second stretch would inherit the first
+       * and halt the run.
+       */
+      let call: number = 0;
+      monitorCreateMock.mockImplementation(
+        ({ data }: { data: Monitor }): Promise<Monitor> => {
+          call++;
+          if (call === MAX_CONSECUTIVE_MONITOR_CREATE_FAILURES) {
+            return Promise.resolve(data);
+          }
+          return Promise.reject(new Error("transient write failure"));
+        },
+      );
+      mockRunNowScans([makeScan({ discoveredDevices: hosts })]);
+
+      const result: AutoImportRuleRunResult = await runRule(false);
+
+      expect(monitorCreateMock).toHaveBeenCalledTimes(hosts.length);
+      expect(result).toMatchObject({
+        monitorsCreated: 1,
+        monitorsFailed: hosts.length - 1,
+        monitorProvisioningHalted: false,
+      });
+    });
+
+    /*
+     * Overlapping scans of the same subnet are normal, and a host in both is
+     * ONE device with one missing monitor. The short circuit has to keep the
+     * same (device, template) bookkeeping a real attempt does, or the report
+     * inflates itself once per scan that mentions the host.
+     */
+    it("counts a halted device once even when two scans carry the same host", async () => {
+      const host: DiscoveredNetworkDevice = makeHost({
+        ipAddress: "10.6.0.1",
+        sysName: "overlapping-switch",
+      });
+      const device: NetworkDevice = makeExistingDevice({
+        id: ObjectID.generate(),
+        hostname: host.ipAddress,
+        name: host.sysName,
+      });
+
+      ruleFindOneByMock.mockResolvedValue(
+        makeRule({
+          ipMatchTarget: "10.0.0.0/8",
+          monitorTemplateId: TEMPLATE_ID,
+        }),
+      );
+      ruleFindByMock.mockResolvedValue([]);
+      deviceFindByMock.mockResolvedValue([device]);
+      monitorTemplateFindByMock.mockResolvedValue([]);
+      mockRunNowScans([
+        makeScan({ discoveredDevices: [host] }),
+        makeScan({ discoveredDevices: [host] }),
+      ]);
+
+      const result: AutoImportRuleRunResult = await runRule(false);
+
+      expect(result).toMatchObject({
+        hostsMatched: 2,
+        monitorsFailed: 1,
+        monitorProvisioningHalted: true,
+      });
+    });
+
+    it("records why a device could not be imported", async () => {
+      scanFindOneByMock.mockResolvedValue(
+        makeScan({ discoveredDevices: [makeHost()] }),
+      );
+      ruleFindByMock.mockResolvedValue([makeRule()]);
+      deviceFindOneByMock.mockResolvedValue(null);
+      createMock.mockRejectedValue(
+        new BadDataException("Network device name is too long."),
+      );
+
+      const result: AutoImportRuleRunResult | null = await processScan();
+
+      expect(result).toMatchObject({ devicesCreated: 0, devicesFailed: 1 });
+      expect(result?.deviceFailureReasons).toEqual([
+        "Network device name is too long.",
+      ]);
+    });
+  });
+
+  /*
+   * An over-long "address" is junk that would fail the varchar(100)
+   * hostname on every pass, identically, forever — so it is refused before
+   * any counting rather than logged as a devicesFailed per worker tick.
+   */
+  it("skips a host whose address could never be a hostname, before any counting", async () => {
+    scanFindOneByMock.mockResolvedValue(
+      makeScan({
+        discoveredDevices: [
+          makeHost({ ipAddress: "9".repeat(101) }),
+          makeHost(),
+        ],
+      }),
+    );
+
+    const result: AutoImportRuleRunResult | null = await processScan();
+
+    // The junk row was never evaluated, let alone matched or attempted.
+    expect(result).toMatchObject({
+      hostsEvaluated: 1,
+      hostsMatched: 1,
+      devicesCreated: 1,
+      devicesFailed: 0,
+    });
+    expect(createMock).toHaveBeenCalledTimes(1);
+    expect(createdDevice(0).hostname).toBe("10.0.0.5");
+  });
+
+  describe("the create-failure protocol", () => {
+    /*
+     * Names are unique per project while addresses are not, and two devices
+     * legitimately sharing a sysName is common on real estates. When the
+     * ADDRESS is still free after a failed create, the name was the problem
+     * — one retry under the address-suffixed fallback settles it.
+     */
+    it("retries a name collision once under the fallback name", async () => {
+      scanFindOneByMock.mockResolvedValue(
+        makeScan({ discoveredDevices: [makeHost()] }),
+      );
+      createMock
+        .mockRejectedValueOnce(
+          new BadDataException("Network Device with this name already exists."),
+        )
+        .mockResolvedValueOnce({});
+      // The address re-check finds nothing: the name really was the problem.
+      deviceFindOneByMock.mockResolvedValue(null);
+
+      const result: AutoImportRuleRunResult | null = await processScan();
+
+      expect(createMock).toHaveBeenCalledTimes(2);
+      // Same device both times; only the name changed.
+      expect(createdDevice(0).name).toBe("core-switch-01");
+      expect(createdDevice(1).name).toBe("core-switch-01 (10.0.0.5)");
+      expect(createdDevice(1).name!.endsWith(" (10.0.0.5)")).toBe(true);
+      expect(createdDevice(1).hostname).toBe("10.0.0.5");
+
+      expect(result).toMatchObject({
+        devicesCreated: 1,
+        devicesFailed: 0,
+        hostsSkippedAlreadyRegistered: 0,
+      });
+    });
+
+    /*
+     * Losing a race to a concurrent import of the SAME host must read as
+     * "already registered" — retrying under a new name here would spawn a
+     * renamed twin of a device that now exists.
+     */
+    it("reads a lost create race as already-registered, with no rename retry", async () => {
+      scanFindOneByMock.mockResolvedValue(
+        makeScan({ discoveredDevices: [makeHost()] }),
+      );
+      createMock.mockRejectedValueOnce(
+        new BadDataException("Network Device with this name already exists."),
+      );
+      // The address re-check finds a device: someone imported it meanwhile.
+      deviceFindOneByMock.mockResolvedValue({
+        id: new ObjectID("44444444-4444-4444-8444-444444444444"),
+      } as unknown as NetworkDevice);
+
+      const result: AutoImportRuleRunResult | null = await processScan();
+
+      expect(createMock).toHaveBeenCalledTimes(1);
+      expect(deviceFindOneByMock.mock.calls[0]![0].select.projectId).toBe(true);
+      expect(result).toMatchObject({
+        hostsMatched: 1,
+        hostsSkippedAlreadyRegistered: 1,
+        devicesCreated: 0,
+        devicesFailed: 0,
+      });
+    });
+  });
+
+  /*
+   * The cap turns "a typo'd rule meets a huge subnet" into a few paced
+   * worker ticks instead of one burst of thousands of creates — and the
+   * UNSTAMPED marker is what makes the next tick resume where this one
+   * stopped, with idempotency skipping everything already created.
+   */
+  it("stops at the device cap and leaves the marker unstamped so the next tick resumes", async () => {
+    const hosts: Array<DiscoveredNetworkDevice> = makeHostsBeyondTheCap();
 
     scanFindOneByMock.mockResolvedValue(makeScan({ discoveredDevices: hosts }));
     ruleFindByMock.mockResolvedValue([
@@ -1818,6 +2261,8 @@ describe("NetworkDeviceAutoImportRuleEngineService.applyRuleToCompletedScans", (
     ]);
     expect(rereadCall.query.projectId.toString()).toBe(PROJECT_ID.toString());
     expect(rereadCall.select.discoveredDevices).toBe(true);
+    expect(rereadCall.props).toEqual({ isRoot: true, ignoreHooks: true });
+    expect(listCall.props).toEqual({ isRoot: true });
   });
 
   it("skips a scan that vanished between the stub listing and the re-read", async () => {
@@ -2062,6 +2507,244 @@ describe("NetworkDeviceAutoImportRuleEngineService.applyRuleToCompletedScans", (
   });
 });
 
+describe("re-import after deleting discovered devices or monitors (issue #3560)", () => {
+  it.each([false, true])(
+    "uses current inventory when a processed scan still marks a deleted device registered (dry run: %s)",
+    async (isDryRun: boolean) => {
+      ruleFindOneByMock.mockResolvedValue(
+        makeRule({ monitorTemplateId: TEMPLATE_ID }),
+      );
+      ruleFindByMock.mockResolvedValue([]);
+      monitorTemplateFindByMock.mockResolvedValue([makeTemplate()]);
+      mockRunNowScans([
+        makeScan({
+          completedAt: new Date("2020-01-01T00:00:00.000Z"),
+          autoImportProcessedAt: OneUptimeDate.getCurrentDate(),
+          discoveredDevices: [makeHost({ isAlreadyRegistered: true })],
+        }),
+      ]);
+
+      const result: AutoImportRuleRunResult = await runRule(isDryRun);
+
+      expect(result).toMatchObject({
+        hostsMatched: 1,
+        hostsSkippedAlreadyRegistered: 0,
+        devicesCreated: isDryRun ? 0 : 1,
+        monitorsCreated: isDryRun ? 0 : 1,
+        monitorsWouldCreate: isDryRun ? 1 : 0,
+        devicesFailed: 0,
+        monitorsFailed: 0,
+        matchedIpAddressSample: ["10.0.0.5"],
+        isTruncated: false,
+        isDryRun,
+      });
+      expect(createMock).toHaveBeenCalledTimes(isDryRun ? 0 : 1);
+      expect(monitorCreateMock).toHaveBeenCalledTimes(isDryRun ? 0 : 1);
+      expect(scanUpdateMock).toHaveBeenCalledTimes(isDryRun ? 0 : 1);
+
+      if (!isDryRun) {
+        const device: NetworkDevice = createdDevice(0);
+        expect(device.hostname).toBe("10.0.0.5");
+        expect(device.snmpCommunityString).toBe("public");
+        expect(device.projectId?.toString()).toBe(PROJECT_ID.toString());
+        expect(
+          provisionedMonitor(0).autoProvisionedNetworkDeviceId?.toString(),
+        ).toBe(device.id?.toString());
+        expect(scanUpdateMock.mock.calls[0]![0].data).toEqual({
+          discoveredDevices: [makeHost({ isAlreadyRegistered: true })],
+        });
+      }
+    },
+  );
+
+  it("imports a deleted device from fresh automatic results with a stale registration flag", async () => {
+    scanFindOneByMock.mockResolvedValue(
+      makeScan({
+        discoveredDevices: [makeHost({ isAlreadyRegistered: true })],
+      }),
+    );
+
+    const result: AutoImportRuleRunResult | null = await processScan();
+
+    expect(result).toMatchObject({
+      devicesCreated: 1,
+      hostsSkippedAlreadyRegistered: 0,
+    });
+    expect(
+      scanUpdateMock.mock.calls[0]![0].data.autoImportProcessedAt,
+    ).toBeInstanceOf(Date);
+  });
+
+  it.each([false, true])(
+    "restores a deleted template monitor while retaining its registered device (dry run: %s)",
+    async (isDryRun: boolean) => {
+      const existingDevice: NetworkDevice = makeExistingDevice();
+      deviceFindByMock.mockResolvedValue([existingDevice]);
+      ruleFindOneByMock.mockResolvedValue(
+        makeRule({ monitorTemplateId: TEMPLATE_ID }),
+      );
+      ruleFindByMock.mockResolvedValue([]);
+      monitorTemplateFindByMock.mockResolvedValue([makeTemplate()]);
+      mockRunNowScans([
+        makeScan({
+          autoImportProcessedAt: OneUptimeDate.getCurrentDate(),
+          discoveredDevices: [makeHost({ isAlreadyRegistered: true })],
+        }),
+      ]);
+
+      const result: AutoImportRuleRunResult = await runRule(isDryRun);
+
+      expect(result).toMatchObject({
+        hostsSkippedAlreadyRegistered: 1,
+        devicesCreated: 0,
+        monitorsCreated: isDryRun ? 0 : 1,
+        monitorsWouldCreate: isDryRun ? 1 : 0,
+        monitorsSkippedAlreadyExisting: 0,
+      });
+      expect(createMock).not.toHaveBeenCalled();
+      expect(scanUpdateMock).not.toHaveBeenCalled();
+      if (!isDryRun) {
+        expect(
+          provisionedMonitor(0).autoProvisionedNetworkDeviceId?.toString(),
+        ).toBe(existingDevice.id?.toString());
+      }
+    },
+  );
+
+  it.each([false, true])(
+    "deduplicates stale registered rows within and across scans (dry run: %s)",
+    async (isDryRun: boolean) => {
+      ruleFindOneByMock.mockResolvedValue(
+        makeRule({ monitorTemplateId: TEMPLATE_ID }),
+      );
+      ruleFindByMock.mockResolvedValue([]);
+      monitorTemplateFindByMock.mockResolvedValue([makeTemplate()]);
+      mockRunNowScans([
+        makeScan({
+          discoveredDevices: [
+            makeHost({ isAlreadyRegistered: true }),
+            makeHost({ ipAddress: " 10.0.0.5 ", isAlreadyRegistered: false }),
+          ],
+        }),
+        makeScan({
+          id: ObjectID.generate(),
+          discoveredDevices: [makeHost({ isAlreadyRegistered: true })],
+        }),
+      ]);
+
+      const result: AutoImportRuleRunResult = await runRule(isDryRun);
+
+      expect(result).toMatchObject({
+        hostsMatched: 3,
+        hostsSkippedAlreadyRegistered: 2,
+        devicesCreated: isDryRun ? 0 : 1,
+        monitorsCreated: isDryRun ? 0 : 1,
+        monitorsWouldCreate: isDryRun ? 1 : 0,
+        monitorsSkippedAlreadyExisting: 2,
+        matchedIpAddressSample: ["10.0.0.5"],
+      });
+      expect(createMock).toHaveBeenCalledTimes(isDryRun ? 0 : 1);
+      expect(monitorCreateMock).toHaveBeenCalledTimes(isDryRun ? 0 : 1);
+    },
+  );
+
+  it("still honors exclusions when the registered device has been deleted", async () => {
+    ruleFindOneByMock.mockResolvedValue(makeRule());
+    ruleFindByMock.mockResolvedValue([
+      makeRule({
+        id: ObjectID.generate(),
+        isExclusion: true,
+        ipMatchTarget: "10.0.0.5",
+      }),
+    ]);
+    mockRunNowScans([
+      makeScan({
+        discoveredDevices: [makeHost({ isAlreadyRegistered: true })],
+      }),
+    ]);
+
+    const result: AutoImportRuleRunResult = await runRule(false);
+
+    expect(result).toMatchObject({
+      hostsExcluded: 1,
+      hostsMatched: 0,
+      devicesCreated: 0,
+    });
+    expect(createMock).not.toHaveBeenCalled();
+    expect(scanUpdateMock).not.toHaveBeenCalled();
+  });
+
+  it("resumes re-importing a deleted 903-device fleet across the run cap without duplicates", async () => {
+    const hosts: Array<DiscoveredNetworkDevice> = Array.from(
+      { length: 903 },
+      (_value: unknown, index: number): DiscoveredNetworkDevice => {
+        return makeHost({
+          ipAddress: `10.0.${Math.floor(index / 256)}.${index % 256}`,
+          sysName: `switch-${index}`,
+          isAlreadyRegistered: true,
+        });
+      },
+    );
+    const scan: NetworkDeviceDiscoveryScan = makeScan({
+      autoImportProcessedAt: OneUptimeDate.getCurrentDate(),
+      discoveredDevices: hosts,
+    });
+    const inventory: Map<string, NetworkDevice> = new Map();
+    devicesByHostnamesMock.mockImplementation(
+      async (data: {
+        hostnames: Array<string>;
+      }): Promise<Map<string, NetworkDevice>> => {
+        const found: Map<string, NetworkDevice> = new Map();
+        for (const hostname of data.hostnames) {
+          const device: NetworkDevice | undefined = inventory.get(hostname);
+          if (device) {
+            found.set(hostname, device);
+          }
+        }
+        return found;
+      },
+    );
+    createMock.mockImplementation(
+      async ({ data }: { data: NetworkDevice }): Promise<NetworkDevice> => {
+        data.id = ObjectID.generate();
+        inventory.set(data.hostname!, data);
+        return data;
+      },
+    );
+    ruleFindOneByMock.mockResolvedValue(
+      makeRule({ ipMatchTarget: "10.0.0.0/8" }),
+    );
+    ruleFindByMock.mockResolvedValue([]);
+
+    mockRunNowScans([scan]);
+    const firstRun: AutoImportRuleRunResult = await runRule(false);
+    expect(firstRun).toMatchObject({
+      devicesCreated: MAX_DEVICES_PER_AUTO_IMPORT_RUN,
+      hostsSkippedAlreadyRegistered: 0,
+      isTruncated: true,
+    });
+
+    mockRunNowScans([scan]);
+    const secondRun: AutoImportRuleRunResult = await runRule(false);
+    expect(secondRun).toMatchObject({
+      devicesCreated: hosts.length - MAX_DEVICES_PER_AUTO_IMPORT_RUN,
+      hostsSkippedAlreadyRegistered: MAX_DEVICES_PER_AUTO_IMPORT_RUN,
+      isTruncated: false,
+    });
+
+    mockRunNowScans([scan]);
+    const thirdRun: AutoImportRuleRunResult = await runRule(false);
+    expect(thirdRun).toMatchObject({
+      devicesCreated: 0,
+      hostsSkippedAlreadyRegistered: hosts.length,
+      isTruncated: false,
+    });
+    expect(inventory.size).toBe(hosts.length);
+    expect(createMock).toHaveBeenCalledTimes(hosts.length);
+    expect(scanUpdateMock).toHaveBeenCalledTimes(2);
+  });
+});
+
 /*
  * github.com/OneUptime/oneuptime/issues/3599 — "Auto Import Rule can't see
  * already-discovered devices while the Discovery Scan is still running".
@@ -2250,3 +2933,372 @@ describe("auto-import from a scan that is still sweeping (issue #3599)", () => {
     ]);
   });
 });
+
+/*
+ * OneUptime issue #3642: a discovery scan found 909 routers, the operator ran
+ * the auto-import rule, "500+" arrived, and the remaining 400-odd were
+ * "simply missing, with no error shown".
+ *
+ * The per-run caps were doing their job. What made them read as silence is
+ * that a capped run used to STOP EVALUATING at the cap, so every number it
+ * reported described only the part of the estate it happened to reach: 909
+ * became "matched 500 out of the 500 discovered hosts it looked at", and
+ * nothing in the answer said how many were left or that the monitor half of
+ * the work has its own separate ceiling.
+ *
+ * These pin the fix at the engine: writes stop at the cap, counting does not.
+ */
+describe("a capped run reports the remainder (issue #3642)", () => {
+  // A fleet whose hosts all match, addressed so no two collide.
+  function makeFleet(size: number): Array<DiscoveredNetworkDevice> {
+    return Array.from(
+      { length: size },
+      (_value: unknown, index: number): DiscoveredNetworkDevice => {
+        return makeHost({
+          ipAddress: `10.5.${Math.floor(index / 256)}.${index % 256}`,
+          sysName: `WANRTR-${index}`,
+        });
+      },
+    );
+  }
+
+  function makeInventoryFor(
+    hosts: Array<DiscoveredNetworkDevice>,
+  ): Array<NetworkDevice> {
+    return hosts.map((host: DiscoveredNetworkDevice): NetworkDevice => {
+      return makeExistingDevice({
+        id: ObjectID.generate(),
+        hostname: host.ipAddress,
+        name: host.sysName,
+      });
+    });
+  }
+
+  it("counts the hosts the device cap left un-imported, and still evaluates them all", async () => {
+    const hosts: Array<DiscoveredNetworkDevice> = makeFleet(909);
+
+    scanFindOneByMock.mockResolvedValue(makeScan({ discoveredDevices: hosts }));
+    ruleFindByMock.mockResolvedValue([
+      makeRule({ ipMatchTarget: "10.0.0.0/8" }),
+    ]);
+
+    const result: AutoImportRuleRunResult | null = await processScan();
+
+    // Writes stop at the cap…
+    expect(createMock).toHaveBeenCalledTimes(MAX_DEVICES_PER_AUTO_IMPORT_RUN);
+    expect(result).toMatchObject({
+      devicesCreated: MAX_DEVICES_PER_AUTO_IMPORT_RUN,
+      isTruncated: true,
+      // …counting does not: the whole scan is accounted for.
+      hostsEvaluated: 909,
+      hostsMatched: 909,
+      hostsPendingImport: 909 - MAX_DEVICES_PER_AUTO_IMPORT_RUN,
+      monitorsPendingCreation: 0,
+    });
+  });
+
+  /*
+   * The reporter's own shape: 909 devices already in the inventory, zero
+   * monitors, and a rule that has since had a Monitor Template attached. No
+   * device is created at all, so the DEVICE cap is never even approached —
+   * only the separate monitor cap stops the run.
+   */
+  it("counts the devices the monitor cap left unmonitored", async () => {
+    const hosts: Array<DiscoveredNetworkDevice> = makeFleet(909);
+
+    scanFindOneByMock.mockResolvedValue(makeScan({ discoveredDevices: hosts }));
+    deviceFindByMock.mockResolvedValue(makeInventoryFor(hosts));
+    ruleFindByMock.mockResolvedValue([
+      makeRule({ ipMatchTarget: "10.0.0.0/8", monitorTemplateId: TEMPLATE_ID }),
+    ]);
+    monitorTemplateFindByMock.mockResolvedValue([makeTemplate()]);
+
+    const result: AutoImportRuleRunResult | null = await processScan();
+
+    expect(monitorCreateMock).toHaveBeenCalledTimes(
+      MAX_MONITORS_PER_AUTO_IMPORT_RUN,
+    );
+    expect(result).toMatchObject({
+      devicesCreated: 0,
+      monitorsCreated: MAX_MONITORS_PER_AUTO_IMPORT_RUN,
+      isTruncated: true,
+      hostsEvaluated: 909,
+      hostsMatched: 909,
+      hostsSkippedAlreadyRegistered: 909,
+      // The number the report was missing.
+      monitorsPendingCreation: 909 - MAX_MONITORS_PER_AUTO_IMPORT_RUN,
+      hostsPendingImport: 0,
+    });
+  });
+
+  /*
+   * A device cap reached first must not be reported as a monitor shortfall:
+   * the hosts past it have no device yet, so what they are waiting on is the
+   * import, not a monitor.
+   */
+  it("does not double-count un-imported hosts as unmonitored devices", async () => {
+    const hosts: Array<DiscoveredNetworkDevice> = makeFleet(600);
+
+    scanFindOneByMock.mockResolvedValue(makeScan({ discoveredDevices: hosts }));
+    ruleFindByMock.mockResolvedValue([
+      makeRule({ ipMatchTarget: "10.0.0.0/8", monitorTemplateId: TEMPLATE_ID }),
+    ]);
+    monitorTemplateFindByMock.mockResolvedValue([makeTemplate()]);
+
+    const result: AutoImportRuleRunResult | null = await processScan();
+
+    expect(result).toMatchObject({
+      devicesCreated: MAX_DEVICES_PER_AUTO_IMPORT_RUN,
+      hostsPendingImport: 600 - MAX_DEVICES_PER_AUTO_IMPORT_RUN,
+      monitorsPendingCreation: 0,
+      isTruncated: true,
+    });
+  });
+
+  /*
+   * Where the issue actually lands for an operator: pressing "Run Rule"
+   * twice must finish the 909, and the second press must report nothing
+   * left. (The dashboard now chains these passes itself — see
+   * AutoImportRunChain — so this is the server half of one button press.)
+   */
+  it("finishes the 909-device monitor backfill over two manual runs", async () => {
+    const hosts: Array<DiscoveredNetworkDevice> = makeFleet(909);
+    const devices: Array<NetworkDevice> = makeInventoryFor(hosts);
+    const scan: NetworkDeviceDiscoveryScan = makeScan({
+      discoveredDevices: hosts,
+    });
+
+    /*
+     * Monitors accumulate across the two runs the way the database would:
+     * the second run's project-wide snapshot sees what the first created,
+     * and its provenance keys are what make the resume idempotent.
+     */
+    const provisioned: Array<Monitor> = [];
+    monitorCreateMock.mockImplementation(
+      ({ data }: { data: Monitor }): Promise<Monitor> => {
+        data.id = data.id || ObjectID.generate();
+        provisioned.push(data);
+        return Promise.resolve(data);
+      },
+    );
+    monitorFindByMock.mockImplementation((): Promise<Array<Monitor>> => {
+      return Promise.resolve(provisioned);
+    });
+
+    ruleFindOneByMock.mockResolvedValue(
+      makeRule({ ipMatchTarget: "10.0.0.0/8", monitorTemplateId: TEMPLATE_ID }),
+    );
+    ruleFindByMock.mockResolvedValue([]);
+    deviceFindByMock.mockResolvedValue(devices);
+    monitorTemplateFindByMock.mockResolvedValue([makeTemplate()]);
+
+    mockRunNowScans([scan]);
+    const firstRun: AutoImportRuleRunResult = await runRule(false);
+
+    expect(firstRun).toMatchObject({
+      monitorsCreated: MAX_MONITORS_PER_AUTO_IMPORT_RUN,
+      monitorsPendingCreation: 909 - MAX_MONITORS_PER_AUTO_IMPORT_RUN,
+      isTruncated: true,
+    });
+
+    mockRunNowScans([scan]);
+    const secondRun: AutoImportRuleRunResult = await runRule(false);
+
+    expect(secondRun).toMatchObject({
+      monitorsCreated: 909 - MAX_MONITORS_PER_AUTO_IMPORT_RUN,
+      monitorsSkippedAlreadyExisting: MAX_MONITORS_PER_AUTO_IMPORT_RUN,
+      monitorsPendingCreation: 0,
+      isTruncated: false,
+    });
+
+    // Every router ends up monitored exactly once.
+    expect(provisioned).toHaveLength(909);
+    expect(
+      new Set(
+        provisioned.map((monitor: Monitor): string => {
+          return monitor.autoProvisionedNetworkDeviceId!.toString();
+        }),
+      ).size,
+    ).toBe(909);
+  });
+
+  /*
+   * A capped manual run stops OPENING scans — each is a multi-megabyte jsonb
+   * read it could not act on anyway — so the remainder it counted is a floor.
+   * Reporting it as a total would have the operator run again and watch more
+   * than the promised number appear.
+   */
+  it("says the remainder is a floor when a cap left scans unread", async () => {
+    const hosts: Array<DiscoveredNetworkDevice> = makeFleet(600);
+
+    ruleFindOneByMock.mockResolvedValue(
+      makeRule({ ipMatchTarget: "10.0.0.0/8" }),
+    );
+    ruleFindByMock.mockResolvedValue([]);
+    mockRunNowScans([
+      makeScan({ discoveredDevices: hosts }),
+      makeScan({ discoveredDevices: makeFleet(5) }),
+    ]);
+
+    const result: AutoImportRuleRunResult = await runRule(false);
+
+    expect(result).toMatchObject({
+      isTruncated: true,
+      hostsPendingImport: 600 - MAX_DEVICES_PER_AUTO_IMPORT_RUN,
+      hasUnevaluatedScans: true,
+    });
+    // The second scan was never opened.
+    expect(scanFindOneByMock).toHaveBeenCalledTimes(1);
+  });
+
+  it("reports an exact remainder when the capped scan was the last one", async () => {
+    ruleFindOneByMock.mockResolvedValue(
+      makeRule({ ipMatchTarget: "10.0.0.0/8" }),
+    );
+    ruleFindByMock.mockResolvedValue([]);
+    mockRunNowScans([makeScan({ discoveredDevices: makeFleet(600) })]);
+
+    const result: AutoImportRuleRunResult = await runRule(false);
+
+    expect(result).toMatchObject({
+      isTruncated: true,
+      hostsPendingImport: 600 - MAX_DEVICES_PER_AUTO_IMPORT_RUN,
+      hasUnevaluatedScans: false,
+    });
+  });
+
+  /*
+   * The dry run predicts the real run, so it must predict the leftovers too
+   * — otherwise "what would this rule import" answers with the cap instead
+   * of with the estate.
+   */
+  it("lets a dry run predict what a real run would leave over", async () => {
+    ruleFindOneByMock.mockResolvedValue(
+      makeRule({ ipMatchTarget: "10.0.0.0/8" }),
+    );
+    ruleFindByMock.mockResolvedValue([]);
+    mockRunNowScans([makeScan({ discoveredDevices: makeFleet(909) })]);
+
+    const result: AutoImportRuleRunResult = await runRule(true);
+
+    expect(result).toMatchObject({
+      isDryRun: true,
+      isTruncated: true,
+      hostsEvaluated: 909,
+      hostsMatched: 909,
+      hostsPendingImport: 909 - MAX_DEVICES_PER_AUTO_IMPORT_RUN,
+    });
+    expect(createMock).not.toHaveBeenCalled();
+  });
+
+  /*
+   * Counting past the cap must not start issuing per-device queries again:
+   * the unindexed monitor JSON search is exactly what the budget check
+   * guards, and running it for every host past the cap would turn a capped
+   * pass into the full-table walk the cap exists to avoid.
+   */
+  it("issues no per-device monitor searches for the hosts it only counted", async () => {
+    const hosts: Array<DiscoveredNetworkDevice> = makeFleet(600);
+
+    scanFindOneByMock.mockResolvedValue(makeScan({ discoveredDevices: hosts }));
+    deviceFindByMock.mockResolvedValue(makeInventoryFor(hosts));
+    ruleFindByMock.mockResolvedValue([
+      makeRule({ ipMatchTarget: "10.0.0.0/8", monitorTemplateId: TEMPLATE_ID }),
+    ]);
+    monitorTemplateFindByMock.mockResolvedValue([makeTemplate()]);
+
+    await processScan();
+
+    /*
+     * One project-wide snapshot plus one race-check per device the run
+     * actually attempted — and none for the 100 it merely counted.
+     */
+    expect(monitorFindByMock).toHaveBeenCalledTimes(
+      1 + MAX_MONITORS_PER_AUTO_IMPORT_RUN,
+    );
+  });
+
+  /*
+   * A stored result lists duplicate rows often enough that the import path
+   * has a bucket for them. Counting rows rather than distinct work would
+   * inflate the very number this fix exists to make trustworthy.
+   */
+  it("counts a duplicated un-imported host once", async () => {
+    const overflow: DiscoveredNetworkDevice = makeHost({
+      ipAddress: "10.9.9.9",
+      sysName: "WANRTR-overflow",
+    });
+    const hosts: Array<DiscoveredNetworkDevice> = [
+      ...makeFleet(MAX_DEVICES_PER_AUTO_IMPORT_RUN),
+      overflow,
+      { ...overflow },
+      { ...overflow },
+    ];
+
+    scanFindOneByMock.mockResolvedValue(makeScan({ discoveredDevices: hosts }));
+    ruleFindByMock.mockResolvedValue([
+      makeRule({ ipMatchTarget: "10.0.0.0/8" }),
+    ]);
+
+    const result: AutoImportRuleRunResult | null = await processScan();
+
+    expect(result).toMatchObject({
+      isTruncated: true,
+      // Three rows, one address, one host still to import.
+      hostsPendingImport: 1,
+      hostsEvaluated: MAX_DEVICES_PER_AUTO_IMPORT_RUN + 3,
+    });
+  });
+
+  it("counts a duplicated unmonitored device once", async () => {
+    const hosts: Array<DiscoveredNetworkDevice> = makeFleet(
+      MAX_MONITORS_PER_AUTO_IMPORT_RUN,
+    );
+    const overflow: DiscoveredNetworkDevice = makeHost({
+      ipAddress: "10.9.9.9",
+      sysName: "WANRTR-overflow",
+    });
+    const withDuplicates: Array<DiscoveredNetworkDevice> = [
+      ...hosts,
+      overflow,
+      { ...overflow },
+    ];
+
+    scanFindOneByMock.mockResolvedValue(
+      makeScan({ discoveredDevices: withDuplicates }),
+    );
+    deviceFindByMock.mockResolvedValue(makeInventoryFor(withDuplicates));
+    ruleFindByMock.mockResolvedValue([
+      makeRule({ ipMatchTarget: "10.0.0.0/8", monitorTemplateId: TEMPLATE_ID }),
+    ]);
+    monitorTemplateFindByMock.mockResolvedValue([makeTemplate()]);
+
+    const result: AutoImportRuleRunResult | null = await processScan();
+
+    expect(result).toMatchObject({
+      isTruncated: true,
+      monitorsPendingCreation: 1,
+    });
+  });
+
+  /*
+   * The resume protocol is unchanged by the new accounting: a capped pass
+   * that made progress still leaves the marker NULL so the next worker tick
+   * continues, and the counting past the cap must not accidentally stamp it.
+   */
+  it("still leaves a capped pass's marker unstamped so the sweep resumes", async () => {
+    const hosts: Array<DiscoveredNetworkDevice> = makeFleet(600);
+
+    scanFindOneByMock.mockResolvedValue(makeScan({ discoveredDevices: hosts }));
+    ruleFindByMock.mockResolvedValue([
+      makeRule({ ipMatchTarget: "10.0.0.0/8" }),
+    ]);
+
+    await processScan();
+
+    expect(scanUpdateMock).toHaveBeenCalledTimes(1);
+    const updateCall: { data: JSONObject } = scanUpdateMock.mock
+      .calls[0]![0] as { data: JSONObject };
+    expect(Object.keys(updateCall.data)).not.toContain("autoImportProcessedAt");
+  });
+});