Forward-netbox

Fix: **post-2.5.10 DLM and scope convergence** - optional DLM maps seed when `netbox-dlm` migrates after Forward NetBox; runtime arguments are projected onto each NQE signature, including preflight; CVEs retain valid metadata when an optional advisory URL is malformed; observed vulnerabilities populate affected software; and platforms receive a manufacturer only when ownership is unambiguous. Fix: **endpoint and CIMC identity** - generic SNMP endpoints remain off unless explicitly enabled, imported console endpoints inherit their matched include tags, CIMCs are excluded from standalone devices and can map to exact-parent inventory through a disabled opt-in map, and legacy Opengear/Avocent software-bearing DeviceTypes are reported for reviewed cleanup. Fix: **upgrade and drift evidence** - Scope Reconciliation and support evidence classify stale catalog records, while dependency previews report workload upper bounds as not-measured drift. After upgrading, run **Publish Bundled Queries** once with overwrite enabled. Python and NQE; no migration.

Fix: **DLM CVE/Vulnerability execution** - remove unsupported `primaryKey` annotations stacked with parameterized `query` declarations; Forward rejected both published queries before reading CVE data. After upgrading, run **Publish Bundled Queries** once with overwrite enabled. These parameterized maps require the default **Allow full fallback** mode; Forward's diff endpoint rejects them without a primary-key annotation, and this runtime cannot combine that annotation with `query`. Fix: **DLM installed-software associations** - device-scoped software rows now carry lifecycle dates and create the SoftwareVersion plus DeviceSoftware link together; the standalone catalog map can only enrich an associated version, so versions from Forward-only devices no longer appear with zero devices. Vulnerability imports ensure the same association. Fix: **SNMP endpoint safety and identity** - imported endpoints use the same scope rules during reconciliation; endpoint tag intersections feed NetBox scope tags; legacy sources with include tags fail closed to endpoint include scope until they explicitly save an opt-out; new sources default it on. Avocent and Opengear endpoints use stable hardware DeviceTypes and Console Server roles instead of software-bearing sysDescr strings. Endpoint probe failures abort reconciliation, and the UI/audit payload report endpoint counts. Fix: **architecture contract gate** - `invoke architecture-audit-check` now runs focused model, fetch, and query contract tests instead of calling a management command removed in 2.0. Fix: **drift report semantics** - dependency-preview workload estimates are labeled as apply work, not exact drift, so candidate rows and deletes are no longer double-counted or reported as mostly drift. Fix: **CIMC identity** - CIMC SNMP endpoints are excluded from standalone device import while the APIC CIMC inventory map remains authoritative. Fix: **release smoke validation** - restore the removed `forward_smoke_sync` command on the current single-branch backend with automatic existing-source selection and redacted evidence. Security: require `pyzipper` 0.4.0+, which removes plaintext-revealing CRC32 values from small AES-encrypted support-bundle entry headers (`PYSEC-2026-3044`). Python and NQE; no migration.

Fix: **DLM/query reliability** - Health now detects enabled optional maps whose models are not selected, base/alias hardware-notice mismatches, and missing DLM dependency readiness; dependency-related skips are rolled up into actionable ingestion issues. Fix: **live query-path publishing** - Publish Bundled Queries now updates the Forward Org Repository, clears stale direct query IDs, preserves explicit commit pins, and binds matching enabled maps to paths that resolve current head at each sync; the separate Refresh Query IDs action is removed. After upgrading, run **Publish Bundled Queries** once for each org-backed sync. Python-only; no migration and no bundled NQE source change.

Feature: **device CVE tab** — with netbox-dlm installed and the Vulnerability feed enabled, each device with findings gets a **CVEs** tab (severity totals + one row per CVE: id, severity, affected software version, description); registered only when netbox-dlm is present, hidden when a device has no findings (live-verified against netbox-dlm 0.2.0). Feature: **`forward_routing_dangling_audit`** read-only command reports netbox-routing BGP rows whose device references dangle (the post-prune sweep only covers plugin-pruned devices). Feature: **stability + scale hardening (all opt-in or default-identical, no query change)** — (1) `forward_stuck_job_recover` command recovers a sync wedged by a dead worker (idempotent merge requeue, bounded retries, or clean fail so schedules resume); (2) opt-in per-workload wall-clock **fetch budget** (`workload_fetch_timeout_seconds`) + circuit breaker so a slow shard can't silently hang a multi-hour sync; (3) opt-in **shard-key bucket-packing** (`enable_branch_budget_split`) splits an oversized unsharded model into co-located branch plan items, with an always-on warning when a workload exceeds budget; (4) bulk-apply **per-row isolation** (tree-model + virtual-chassis) so one bad row no longer rolls back a whole model batch, all unbounded `__in` lookups chunked, and event-queue hygiene so a failed isolated row's change events don't leak. Fix: REST `PATCH` of the standing-schedule intent keys now reconciles immediately; transactional schedule persist; a latent per-item stats-reset bug in the branch executor. Python-only; no NQE query change.

Feature: **standing schedules land in the UI** — the sync form's new **Standing Schedules** section sets recurring validation / dependency-preview intervals (blank disables), the sync detail page shows each schedule and its next run, and the intent is stored on the sync so schedules **self-heal**: recreated at the end of every sync run after a hard-killed worker, re-checked by every occurrence (a cancelled or re-configured chain stops or re-aligns itself — no more zombie or duplicate schedules from mid-run changes), and schedules created on 2.5.6 are adopted automatically. Cancel from the form (blank the field) or `POST {"interval": 0}`. Fix: **cron-friendly responses** — an already-active equivalent job now answers `202 {"status": "already_running"}` instead of `409` (idempotent for retry-blind schedulers, matching the webhook), prune during a sync run answers a distinct `202 {"status": "blocked_by_sync_run"}` (that prune did NOT run), idempotent schedule re-posts answer `200`, and schedule bodies on non-schedulable actions are rejected. Fix: recurring validation now **trims its own history** (newest 100 runs per sync; `PLUGINS_CONFIG["forward_netbox"]["validation_run_retention"]`, 0 disables). Fix: prune's `pruned_dangling_rows` tally and the 60-minute preview floor are enforced on raw parameter writes too. Python-only; no query change.

Feature: **operator-job automation** — the four operator buttons (dependency preview, prune orphans, tag delete-eligible IPAM, create module bays) are now REST actions (`POST /api/plugins/forward/sync/<id>/dependency-preview|prune-orphans|tag-delete-eligible-ipam|create-module-bays/`) with the button's permission, `201` + job on success and `409` when an equivalent job is already queued or running — duplicates never stack across HTML buttons, API calls, scheduled occurrences, and the post-sync ` (auto)` prune (shared overlap guard under an advisory lock). Feature: **standing schedules** — `validate` and `dependency-preview` accept `{"interval": minutes}` (optional future `schedule_at`) to keep one recurring schedule per sync: same-parameter re-posts are no-ops, changed parameters replace the schedule, cancel by deleting the scheduled job; the preview enforces a 60-minute interval floor (schedule it daily or less often — it is a full live dry-run); snapshot catch-up and drift lookups are name-scoped so schedules never suppress them, and deleting a sync cancels its scheduled jobs. Fix: duplicate **Validate** clicks/POSTs no longer stack concurrent validation runs (`409`/warning like the button jobs). Fix: pruning now also sweeps **dangling netbox-routing rows** (BGP routers/scopes/address-families/peers/settings whose generic references pointed at pruned devices) in dependency order and reports them as `pruned_dangling_rows`. Python-only; no query change.