cli + misc build stuff. Yes im testing in prod.

bloat now has endpoints for removal
i trust that ts works
2026-04-30 15:46:09 +07:00 · 2026-04-30 14:17:45 +07:00 · 2026-04-30 14:15:14 +07:00 · 2026-04-30 13:59:18 +07:00
30 changed files with 1088 additions and 242 deletions
@@ -0,0 +1,2 @@
+/cache
+/project.local.yml
@@ -0,0 +1,12 @@
+# Completion Checklist
+
+Before handing back code changes, run the smallest checks covering the changed area:
+- Rust formatting: `cargo fmt`.
+- For control-plane SQLx/state/API work: `cargo test -p wakey-control-plane` and `SQLX_OFFLINE=true cargo test -p wakey-control-plane`.
+- For SQLx query macro changes: run `scripts/prepare_sqlx_sqlite.sh` and include the `.sqlx` metadata changes.
+- For wakey-linux/core inventory/observation work: `cargo test -p wakey-linux -p wakey-core`.
+- For agent session/config/protocol work: `cargo test -p wakey-agent`.
+- For UI work: `pnpm --dir ui typecheck` and `pnpm --dir ui build`; use `pnpm --dir ui format` when touching TS/TSX/CSS formatting.
+- Run relevant `cargo clippy -p <crate> --all-targets --all-features` when behavior or API shape changes.
+
+Always check `git status --short` and mention unrelated dirty files or generated metadata in the final summary.
@@ -0,0 +1,14 @@
+# Wakey Project Overview
+
+Wakey is a Wake-on-LAN and LAN observability workspace for Linux/OpenWrt routers. It includes:
+- `wakey-core`: shared model and parsing types for devices, neighbors, DHCP, interfaces, wake results.
+- `wakey-linux`: Linux/OpenWrt adapter layer for DHCP lease files, neighbor lookup, interface data, WoL sending, and local observation storage.
+- root `wakey` crate: service layer and operator CLI for inventory, leases, devs, wake, and observe.
+- `wakey-agent`: outbound router daemon. Enrolls with control plane, maintains authenticated websocket, executes relayed commands, syncs observations.
+- `wakey-control-plane`: Axum control plane, SQLx SQLite state, agent registry, command relay, known devices, observations, audit/alerts, fleet APIs, static UI hosting.
+- `ipjs`: typed wrappers around Linux `ip -j` data.
+- `ui`: React/Vite operator UI using shadcn/base-ui style components.
+
+Current persistence direction: control plane uses SQLx SQLite with migrations in `wakey-control-plane/migrations` and offline query metadata in `.sqlx` plus `wakey-control-plane/.sqlx`. Legacy sled import exists as explicit command.
+
+Current product direction: fleet-first device UI and backend. Known device identity is manual. Observations/inventory provide suggestions/current state but should not automatically promote or delete durable identifiers.
@@ -0,0 +1,23 @@
+# Style And Conventions
+
+Rust:
+- Edition 2024.
+- Prefer explicit, small service/API functions over large abstractions.
+- Use `anyhow::Context` for fallible operations in application layers.
+- Use `tracing` for logs.
+- Shared domain types live in `wakey-core`; Linux/OpenWrt I/O in `wakey-linux`; root crate owns service/CLI behavior; agent/control-plane should reuse service/domain types where possible.
+- SQLx query macros are used in control-plane state. Regenerate `.sqlx` metadata after query string changes.
+- Device identity is manual: observations and inventory may suggest, but should not silently pin, merge, promote, or delete known identifiers.
+- Hotplug observation actions should stay event-shaped (`add`, `update`, `remove`). Do not store NUD state as the action. NUD belongs to live neighbor/inventory data.
+
+Frontend:
+- React + Vite + TypeScript.
+- Use existing component/style conventions; shadcn/base-ui/lucide are available.
+- Main operator UI is fleet-first: common path is find device, inspect current IP/MAC/agent, wake, copy, remember/merge.
+- Admin/debug pages stay available but should not dominate the primary nav.
+
+Editing:
+- Keep changes scoped.
+- Preserve user edits in dirty worktrees.
+- Use `apply_patch` for manual file edits.
+- Default to ASCII unless files already use non-ASCII for a reason.
@@ -0,0 +1,31 @@
+# Suggested Commands
+
+Rust formatting and checks:
+- `cargo fmt`
+- `cargo test -p wakey-control-plane`
+- `SQLX_OFFLINE=true cargo test -p wakey-control-plane`
+- `cargo test -p wakey-linux -p wakey-core`
+- `cargo test -p wakey-agent` (may need elevated permissions if tests bind local sockets)
+- `cargo clippy -p wakey-control-plane --all-targets --all-features`
+- `cargo clippy -p wakey-linux -p wakey-core --all-targets --all-features`
+
+SQLx metadata after query macro changes:
+- `scripts/prepare_sqlx_sqlite.sh`
+
+UI checks:
+- `pnpm --dir ui typecheck`
+- `pnpm --dir ui build`
+- `pnpm --dir ui format`
+
+Local run examples:
+- `cargo run -- inventory <query>`
+- `cargo run -- leases`
+- `cargo run -- devs`
+- `cargo run -- wake --mac aa:bb:cc:dd:ee:ff`
+- `cargo run -p wakey-agent -- serve --config /etc/wakey-agent/config.toml`
+- `cargo run -p wakey-control-plane -- serve --config-file /etc/wakey-control-plane/config.toml`
+
+Useful shell tools:
+- Prefer `rg` and `rg --files` for search.
+- Use `git status --short`, `git diff --stat`, and focused `git diff -- <path>` before edits.
+- Avoid destructive git commands unless explicitly requested.
@@ -0,0 +1,155 @@
+# the name by which the project can be referenced within Serena
+project_name: "wakey"
+
+
+# list of languages for which language servers are started; choose from:
+#   al                  bash                clojure             cpp                 csharp
+#   csharp_omnisharp    dart                elixir              elm                 erlang
+#   fortran             fsharp              go                  groovy              haskell
+#   haxe                java                julia               kotlin              lua
+#   markdown
+#   matlab              nix                 pascal              perl                php
+#   php_phpactor        powershell          python              python_jedi         r
+#   rego                ruby                ruby_solargraph     rust                scala
+#   swift               terraform           toml                typescript          typescript_vts
+#   vue                 yaml                zig
+#   (This list may be outdated. For the current list, see values of Language enum here:
+#   https://github.com/oraios/serena/blob/main/src/solidlsp/ls_config.py
+#   For some languages, there are alternative language servers, e.g. csharp_omnisharp, ruby_solargraph.)
+# Note:
+#   - For C, use cpp
+#   - For JavaScript, use typescript
+#   - For Free Pascal/Lazarus, use pascal
+# Special requirements:
+#   Some languages require additional setup/installations.
+#   See here for details: https://oraios.github.io/serena/01-about/020_programming-languages.html#language-servers
+# When using multiple languages, the first language server that supports a given file will be used for that file.
+# The first language is the default language and the respective language server will be used as a fallback.
+# Note that when using the JetBrains backend, language servers are not used and this list is correspondingly ignored.
+languages:
+- rust
+- typescript
+
+# the encoding used by text files in the project
+# For a list of possible encodings, see https://docs.python.org/3.11/library/codecs.html#standard-encodings
+encoding: "utf-8"
+
+# line ending convention to use when writing source files.
+# Possible values: unset (use global setting), "lf", "crlf", or "native" (platform default)
+# This does not affect Serena's own files (e.g. memories and configuration files), which always use native line endings.
+line_ending:
+
+# The language backend to use for this project.
+# If not set, the global setting from serena_config.yml is used.
+# Valid values: LSP, JetBrains
+# Note: the backend is fixed at startup. If a project with a different backend
+# is activated post-init, an error will be returned.
+language_backend:
+
+# whether to use project's .gitignore files to ignore files
+ignore_all_files_in_gitignore: true
+
+# advanced configuration option allowing to configure language server-specific options.
+# Maps the language key to the options.
+# Have a look at the docstring of the constructors of the LS implementations within solidlsp (e.g., for C# or PHP) to see which options are available.
+# No documentation on options means no options are available.
+ls_specific_settings: {}
+
+# list of additional paths to ignore in this project.
+# Same syntax as gitignore, so you can use * and **.
+# Note: global ignored_paths from serena_config.yml are also applied additively.
+ignored_paths: []
+
+# whether the project is in read-only mode
+# If set to true, all editing tools will be disabled and attempts to use them will result in an error
+# Added on 2025-04-18
+read_only: false
+
+# list of tool names to exclude.
+# This extends the existing exclusions (e.g. from the global configuration)
+#
+# Below is the complete list of tools for convenience.
+# To make sure you have the latest list of tools, and to view their descriptions, 
+# execute `uv run scripts/print_tool_overview.py`.
+#
+#  * `activate_project`: Activates a project based on the project name or path.
+#  * `check_onboarding_performed`: Checks whether project onboarding was already performed.
+#  * `create_text_file`: Creates/overwrites a file in the project directory.
+#  * `delete_memory`: Delete a memory file. Should only happen if a user asks for it explicitly,
+#       for example by saying that the information retrieved from a memory file is no longer correct
+#       or no longer relevant for the project.
+#  * `edit_memory`: Replaces content matching a regular expression in a memory.
+#  * `execute_shell_command`: Executes a shell command.
+#  * `find_file`: Finds files in the given relative paths
+#  * `find_referencing_symbols`: Finds symbols that reference the given symbol using the language server backend
+#  * `find_symbol`: Performs a global (or local) search using the language server backend.
+#  * `get_current_config`: Prints the current configuration of the agent, including the active and available projects, tools, contexts, and modes.
+#  * `get_symbols_overview`: Gets an overview of the top-level symbols defined in a given file.
+#  * `initial_instructions`: Provides instructions Serena usage (i.e. the 'Serena Instructions Manual')
+#       for clients that do not read the initial instructions when the MCP server is connected.
+#  * `insert_after_symbol`: Inserts content after the end of the definition of a given symbol.
+#  * `insert_before_symbol`: Inserts content before the beginning of the definition of a given symbol.
+#  * `list_dir`: Lists files and directories in the given directory (optionally with recursion).
+#  * `list_memories`: List available memories. Any memory can be read using the `read_memory` tool.
+#  * `onboarding`: Performs onboarding (identifying the project structure and essential tasks, e.g. for testing or building).
+#  * `read_file`: Reads a file within the project directory.
+#  * `read_memory`: Read the content of a memory file. This tool should only be used if the information
+#       is relevant to the current task. You can infer whether the information
+#       is relevant from the memory file name.
+#       You should not read the same memory file multiple times in the same conversation.
+#  * `rename_memory`: Renames or moves a memory. Moving between project and global scope is supported
+#       (e.g., renaming "global/foo" to "bar" moves it from global to project scope).
+#  * `rename_symbol`: Renames a symbol throughout the codebase using language server refactoring capabilities.
+#       For JB, we use a separate tool.
+#  * `replace_content`: Replaces content in a file (optionally using regular expressions).
+#  * `replace_symbol_body`: Replaces the full definition of a symbol using the language server backend.
+#  * `safe_delete_symbol`:
+#  * `search_for_pattern`: Performs a search for a pattern in the project.
+#  * `write_memory`: Write some information (utf-8-encoded) about this project that can be useful for future tasks to a memory in md format.
+#       The memory name should be meaningful.
+excluded_tools: []
+
+# list of tools to include that would otherwise be disabled (particularly optional tools that are disabled by default).
+# This extends the existing inclusions (e.g. from the global configuration).
+included_optional_tools: []
+
+# fixed set of tools to use as the base tool set (if non-empty), replacing Serena's default set of tools.
+# This cannot be combined with non-empty excluded_tools or included_optional_tools.
+fixed_tools: []
+
+# list of mode names to that are always to be included in the set of active modes
+# The full set of modes to be activated is base_modes + default_modes.
+# If the setting is undefined, the base_modes from the global configuration (serena_config.yml) apply.
+# Otherwise, this setting overrides the global configuration.
+# Set this to [] to disable base modes for this project.
+# Set this to a list of mode names to always include the respective modes for this project.
+base_modes:
+
+# list of mode names that are to be activated by default.
+# The full set of modes to be activated is base_modes + default_modes.
+# If the setting is undefined, the default_modes from the global configuration (serena_config.yml) apply.
+# Otherwise, this overrides the setting from the global configuration (serena_config.yml).
+# This setting can, in turn, be overridden by CLI parameters (--mode).
+default_modes:
+
+# initial prompt for the project. It will always be given to the LLM upon activating the project
+# (contrary to the memories, which are loaded on demand).
+initial_prompt: ""
+
+# time budget (seconds) per tool call for the retrieval of additional symbol information
+# such as docstrings or parameter information.
+# This overrides the corresponding setting in the global configuration; see the documentation there.
+# If null or missing, use the setting from the global configuration.
+symbol_info_budget:
+
+# list of regex patterns which, when matched, mark a memory entry as read‑only.
+# Extends the list from the global configuration, merging the two lists.
+read_only_memory_patterns: []
+
+# list of regex patterns for memories to completely ignore.
+# Matching memories will not appear in list_memories or activate_project output
+# and cannot be accessed via read_memory or write_memory.
+# To access ignored memory files, use the read_file tool on the raw file path.
+# Extends the list from the global configuration, merging the two lists.
+# Example: ["_archive/.*", "_episodes/.*"]
+ignored_memory_patterns: []
@@ -0,0 +1,86 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT events.event_id as \"event_id!\",\n                    ('agent:' || events.agent_id || ':' || events.kind || ':' ||\n                        CASE\n                            WHEN events.kind IN ('neigh', 'inventory') AND events.mac IS NOT NULL AND events.ip IS NOT NULL\n                                THEN 'mac:' || events.mac || ':ip:' || events.ip\n                            WHEN events.mac IS NOT NULL THEN 'mac:' || events.mac\n                            WHEN events.ip IS NOT NULL THEN 'ip:' || events.ip\n                            ELSE ''\n                        END) as \"observation_key!\",\n                    events.agent_id as \"agent_id!\",\n                    events.kind as \"kind!\",\n                    events.action as \"action!\",\n                    events.mac,\n                    events.ip,\n                    events.hostname,\n                    events.ts_unix,\n                    known_devices.device_id,\n                    known_devices.display_name,\n                    known_devices.pinned\n             FROM agent_device_observation_events events\n             LEFT JOIN device_identifiers identifiers\n               ON identifiers.identifier_key =\n                  CASE\n                    WHEN events.mac IS NOT NULL THEN 'mac:' || events.mac\n                    WHEN events.ip IS NOT NULL THEN 'ip:' || events.ip\n                  END\n             LEFT JOIN known_devices ON known_devices.device_id = identifiers.device_id\n             WHERE (?1 IS NULL OR events.agent_id = ?1)\n               AND (?2 IS NULL OR events.kind = ?2)\n               AND (?3 IS NULL OR events.mac = ?3)\n               AND (?4 IS NULL OR events.ip = ?4)\n               AND (?5 IS NULL OR ('agent:' || events.agent_id || ':' || events.kind || ':' ||\n                    CASE\n                        WHEN events.kind IN ('neigh', 'inventory') AND events.mac IS NOT NULL AND events.ip IS NOT NULL\n                            THEN 'mac:' || events.mac || ':ip:' || events.ip\n                        WHEN events.mac IS NOT NULL THEN 'mac:' || events.mac\n                        WHEN events.ip IS NOT NULL THEN 'ip:' || events.ip\n                        ELSE ''\n                    END) = ?5)\n             ORDER BY events.ts_unix DESC\n             LIMIT ?6",
+  "describe": {
+    "columns": [
+      {
+        "name": "event_id!",
+        "ordinal": 0,
+        "type_info": "Text"
+      },
+      {
+        "name": "observation_key!",
+        "ordinal": 1,
+        "type_info": "Text"
+      },
+      {
+        "name": "agent_id!",
+        "ordinal": 2,
+        "type_info": "Text"
+      },
+      {
+        "name": "kind!",
+        "ordinal": 3,
+        "type_info": "Text"
+      },
+      {
+        "name": "action!",
+        "ordinal": 4,
+        "type_info": "Text"
+      },
+      {
+        "name": "mac",
+        "ordinal": 5,
+        "type_info": "Text"
+      },
+      {
+        "name": "ip",
+        "ordinal": 6,
+        "type_info": "Text"
+      },
+      {
+        "name": "hostname",
+        "ordinal": 7,
+        "type_info": "Text"
+      },
+      {
+        "name": "ts_unix",
+        "ordinal": 8,
+        "type_info": "Integer"
+      },
+      {
+        "name": "device_id",
+        "ordinal": 9,
+        "type_info": "Text"
+      },
+      {
+        "name": "display_name",
+        "ordinal": 10,
+        "type_info": "Text"
+      },
+      {
+        "name": "pinned",
+        "ordinal": 11,
+        "type_info": "Integer"
+      }
+    ],
+    "parameters": {
+      "Right": 6
+    },
+    "nullable": [
+      true,
+      true,
+      false,
+      false,
+      false,
+      true,
+      true,
+      true,
+      false,
+      true,
+      true,
+      true
+    ]
+  },
+  "hash": "3bc141cecd0ba7c9ca937036b310728dff57c69ed7b74529fd81fa6a3c0e40cf"
+}
@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "DELETE FROM device_identifiers WHERE device_id = ?1 AND identifier_key = ?2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 2
+    },
+    "nullable": []
+  },
+  "hash": "72aadefca9851a8becdd2dcce54b646aff095b64cef9837f5e8e4ea8dde71d02"
+}
@@ -1,86 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "SELECT events.event_id as \"event_id!\",\n                    ('agent:' || events.agent_id || ':' || events.kind || ':' ||\n                        CASE\n                            WHEN events.mac IS NOT NULL THEN 'mac:' || events.mac\n                            WHEN events.ip IS NOT NULL THEN 'ip:' || events.ip\n                            ELSE ''\n                        END) as \"observation_key!\",\n                    events.agent_id as \"agent_id!\",\n                    events.kind as \"kind!\",\n                    events.action as \"action!\",\n                    events.mac,\n                    events.ip,\n                    events.hostname,\n                    events.ts_unix,\n                    known_devices.device_id,\n                    known_devices.display_name,\n                    known_devices.pinned\n             FROM agent_device_observation_events events\n             LEFT JOIN device_identifiers identifiers\n               ON identifiers.identifier_key =\n                  CASE\n                    WHEN events.mac IS NOT NULL THEN 'mac:' || events.mac\n                    WHEN events.ip IS NOT NULL THEN 'ip:' || events.ip\n                  END\n             LEFT JOIN known_devices ON known_devices.device_id = identifiers.device_id\n             WHERE (?1 IS NULL OR events.agent_id = ?1)\n               AND (?2 IS NULL OR events.kind = ?2)\n               AND (?3 IS NULL OR events.mac = ?3)\n               AND (?4 IS NULL OR events.ip = ?4)\n               AND (?5 IS NULL OR ('agent:' || events.agent_id || ':' || events.kind || ':' ||\n                    CASE\n                        WHEN events.mac IS NOT NULL THEN 'mac:' || events.mac\n                        WHEN events.ip IS NOT NULL THEN 'ip:' || events.ip\n                        ELSE ''\n                    END) = ?5)\n             ORDER BY events.ts_unix DESC\n             LIMIT ?6",
-  "describe": {
-    "columns": [
-      {
-        "name": "event_id!",
-        "ordinal": 0,
-        "type_info": "Text"
-      },
-      {
-        "name": "observation_key!",
-        "ordinal": 1,
-        "type_info": "Text"
-      },
-      {
-        "name": "agent_id!",
-        "ordinal": 2,
-        "type_info": "Text"
-      },
-      {
-        "name": "kind!",
-        "ordinal": 3,
-        "type_info": "Text"
-      },
-      {
-        "name": "action!",
-        "ordinal": 4,
-        "type_info": "Text"
-      },
-      {
-        "name": "mac",
-        "ordinal": 5,
-        "type_info": "Text"
-      },
-      {
-        "name": "ip",
-        "ordinal": 6,
-        "type_info": "Text"
-      },
-      {
-        "name": "hostname",
-        "ordinal": 7,
-        "type_info": "Text"
-      },
-      {
-        "name": "ts_unix",
-        "ordinal": 8,
-        "type_info": "Integer"
-      },
-      {
-        "name": "device_id",
-        "ordinal": 9,
-        "type_info": "Text"
-      },
-      {
-        "name": "display_name",
-        "ordinal": 10,
-        "type_info": "Text"
-      },
-      {
-        "name": "pinned",
-        "ordinal": 11,
-        "type_info": "Integer"
-      }
-    ],
-    "parameters": {
-      "Right": 6
-    },
-    "nullable": [
-      true,
-      true,
-      false,
-      false,
-      false,
-      true,
-      true,
-      true,
-      false,
-      true,
-      true,
-      true
-    ]
-  },
-  "hash": "908d763909c76fb6170b818784e360372c02295523ef9970c91199db7d4f535a"
-}
@@ -24,4 +24,12 @@ $files = "update_wakey" , "wakey" , "update_tailscale" , "wireguard_setup", "lda
 $remote = $files.ForEach({ "/etc/init.d/$_" })
 $remote | ForEach-Object {
    pscp.exe -l root -scp -pw $PASSWD "192.168.100.1:$_" "$initDir\"
-}
+}
+
+$files = "dhcp/95-wakey", "neigh/95-wakey"
+$remote =  $files.ForEach({ "/etc/hotplug.d/$_" })
+$hotplugDir = Join-Path $PSScriptRoot 'hotplug.d'
+
+$remote | ForEach-Object {
+    pscp.exe -l root -scp -pw $PASSWD "192.168.100.1:$_" "$hotplugDir\"
+}
@@ -6,12 +6,27 @@ BIN="/root/.bin/wakey-agent"
 [ -n "$ACTION" ] || exit 0
 [ -n "$MACADDR" ] || exit 0

+run_wakey_agent() {
+    if [ -n "$WAKEY_AGENT_CONFIG" ]; then
+        set -- --config "$WAKEY_AGENT_CONFIG" "$@"
+    fi
+    if [ "$WAKEY_HOTPLUG_VERBOSE" = "1" ]; then
+        set -- -v "$@"
+    fi
+    # [ "$WAKEY_HOTPLUG_LOG" = "1" ] &&
+    if  command -v logger >/dev/null 2>&1; then
+        "$BIN" "$@" 2>&1 | logger -t wakey-hotplug
+    else
+        "$BIN" "$@" >/dev/null 2>&1
+    fi
+}
+
 if [ -n "$IPADDR" ] && [ -n "$HOSTNAME" ]; then
-    "$BIN" observe dhcp --action "$ACTION" --mac "$MACADDR" --ip "$IPADDR" --hostname "$HOSTNAME" >/dev/null 2>&1 || true
+    run_wakey_agent observe dhcp --action "$ACTION" --mac "$MACADDR" --ip "$IPADDR" --hostname "$HOSTNAME" || true
 elif [ -n "$IPADDR" ]; then
-    "$BIN" observe dhcp --action "$ACTION" --mac "$MACADDR" --ip "$IPADDR" >/dev/null 2>&1 || true
+    run_wakey_agent observe dhcp --action "$ACTION" --mac "$MACADDR" --ip "$IPADDR" || true
 elif [ -n "$HOSTNAME" ]; then
-    "$BIN" observe dhcp --action "$ACTION" --mac "$MACADDR" --hostname "$HOSTNAME" >/dev/null 2>&1 || true
+    run_wakey_agent observe dhcp --action "$ACTION" --mac "$MACADDR" --hostname "$HOSTNAME" || true
 else
-    "$BIN" observe dhcp --action "$ACTION" --mac "$MACADDR" >/dev/null 2>&1 || true
+    run_wakey_agent observe dhcp --action "$ACTION" --mac "$MACADDR" || true
 fi
@@ -5,12 +5,27 @@ BIN="/root/.bin/wakey-agent"
 [ -n "$BIN" ] || exit 0
 [ -n "$ACTION" ] || exit 0

+run_wakey_agent() {
+    if [ -n "$WAKEY_AGENT_CONFIG" ]; then
+        set -- --config "$WAKEY_AGENT_CONFIG" "$@"
+    fi
+    if [ "$WAKEY_HOTPLUG_VERBOSE" = "1" ]; then
+        set -- -v "$@"
+    fi
+    # [ "$WAKEY_HOTPLUG_LOG" = "1" ] &&
+    if command -v logger >/dev/null 2>&1; then
+        "$BIN" "$@" 2>&1 | logger -t wakey-hotplug
+    else
+        "$BIN" "$@" >/dev/null 2>&1
+    fi
+}
+
 if [ -n "$MACADDR" ] && [ -n "$IPADDR" ]; then
-    "$BIN" observe neigh --action "$ACTION" --mac "$MACADDR" --ip "$IPADDR" >/dev/null 2>&1 || true
+    run_wakey_agent observe neigh --action "$ACTION" --mac "$MACADDR" --ip "$IPADDR" || true
 elif [ -n "$MACADDR" ]; then
-    "$BIN" observe neigh --action "$ACTION" --mac "$MACADDR" >/dev/null 2>&1 || true
+    run_wakey_agent observe neigh --action "$ACTION" --mac "$MACADDR" || true
 elif [ -n "$IPADDR" ]; then
-    "$BIN" observe neigh --action "$ACTION" --ip "$IPADDR" >/dev/null 2>&1 || true
+    run_wakey_agent observe neigh --action "$ACTION" --ip "$IPADDR" || true
 else
-    "$BIN" observe neigh --action "$ACTION" >/dev/null 2>&1 || true
+    run_wakey_agent observe neigh --action "$ACTION" || true
 fi
@@ -4,21 +4,30 @@
 # then packaging the same bundle format and installing it.
 #
 # Simplest use:
-#   sudo -E ./scripts/update_wakey_cc_from_repo.sh
+#   ./scripts/update_wakey_cc_from_repo.sh
 #
 # Env options:
+#   WAKEY_CC_REPO_DIR    Existing checkout to update/build instead of cloning
 #   WAKEY_CC_REPO_URL    Git URL (default: https://git.ldlda.com/lda/wakey.git)
 #   WAKEY_CC_REF         Git ref/branch/tag (default: main)
 #   WAKEY_CC_TARGET      Rust target triple (default from uname)
 #   WAKEY_CC_ROOT        Install root (default: current directory)
 #   WAKEY_CC_SERVICE     systemd unit name (default: wakey-cc.service)
+#   WAKEY_CC_USER        Owner for installed files/temp dirs (default: current user)
 #   WAKEY_CC_VERSION     Bundle version label (default: v0.0.0-local-<short_sha>)
 #   WAKEY_CC_NO_RESTART  If set, skip systemd restart
 #   WAKEY_CC_KEEP_TMP    If set, keep temp checkout/build dir for debugging
-#   SUDO                 Privilege escalation command/path (default: sudo when needed)
+#   SUDO                 Privilege escalation command/path for install steps (default: sudo)
 #
 # Requires: git, cargo, tar, pnpm, systemctl (optional for restart)

+# Common existing-checkout use:
+: <<'USE CASE'
+WAKEY_CC_REPO_DIR="$HOME/dev/wakey" \
+WAKEY_CC_USER=lda \
+WAKEY_CC_KEEP_TMP=1 \
+scripts/update_wakey_cc_from_repo.sh
+USE CASE
 set -eu

 log() { printf '[update_wakey_cc_from_repo] %s\n' "$*"; }
@@ -79,6 +88,28 @@ restore_label() {
    fi
 }

+chown_if_requested() {
+    [ -n "${OWNER:-}" ] || return 0
+    priv chown -R "$OWNER:$OWNER" "$@"
+}
+
+chmod_user_rw_if_requested() {
+    [ -n "${OWNER:-}" ] || return 0
+    priv chmod -R u+rwX "$@"
+}
+
+update_existing_repo() {
+    repo_dir=$1
+    ref=$2
+
+    [ -d "$repo_dir/.git" ] || fail "WAKEY_CC_REPO_DIR is not a git checkout: $repo_dir"
+
+    log "using existing checkout $repo_dir (ref: $ref)"
+    git -C "$repo_dir" fetch --prune origin "$ref" || fail 'git fetch failed'
+    git -C "$repo_dir" checkout "$ref" || fail "git checkout failed: $ref"
+    git -C "$repo_dir" pull --ff-only origin "$ref" || fail 'git pull --ff-only failed'
+}
+
 install_executable_force() {
    src=$1
    dst=$2
@@ -90,6 +121,7 @@ install_executable_force() {
    priv rm -f "$tmp"
    priv cp -f "$src" "$tmp"
    priv chmod 0755 "$tmp"
+    chown_if_requested "$tmp"
    if [ -e "$dst" ]; then
        priv mv -f "$dst" "$old" || true
    fi
@@ -99,13 +131,25 @@ install_executable_force() {
 }

 main() {
+    REPO_DIR="${WAKEY_CC_REPO_DIR:-}"
    REPO_URL="${WAKEY_CC_REPO_URL:-https://git.ldlda.com/lda/wakey.git}"
    REF="${WAKEY_CC_REF:-main}"
    TARGET="${WAKEY_CC_TARGET:-$(default_target)}"
    ROOT="${WAKEY_CC_ROOT:-$PWD}"
    SERVICE="${WAKEY_CC_SERVICE:-wakey-cc.service}"
+    if [ -n "${WAKEY_CC_USER:-}" ]; then
+        OWNER="$WAKEY_CC_USER"
+    elif [ "$(id -u)" -eq 0 ]; then
+        OWNER=
+    else
+        OWNER=$(id -un)
+    fi
    SUDO_BIN=$(sudo_cmd)

+    if [ -n "$OWNER" ] && ! id "$OWNER" >/dev/null 2>&1; then
+        fail "WAKEY_CC_USER does not exist: $OWNER"
+    fi
+
    require_cmd git
    require_cmd cargo
    require_cmd tar
@@ -114,19 +158,34 @@ main() {
    TMPBASE="${TMPDIR:-/tmp}"
    WORKDIR="$TMPBASE/wakey-cc-src.$$"
    STAGING="$TMPBASE/wakey-cc-stage.$$"
+    CLONED_WORKDIR=1

    cleanup() {
        if [ -z "${WAKEY_CC_KEEP_TMP:-}" ]; then
-            rm -rf "$WORKDIR" "$STAGING"
+            [ "$CLONED_WORKDIR" = "0" ] || rm -rf "$WORKDIR"
+            rm -rf "$STAGING"
        else
-            log "keeping temp dir: $WORKDIR"
+            if [ "$CLONED_WORKDIR" != "0" ]; then
+                chown_if_requested "$WORKDIR"
+                chmod_user_rw_if_requested "$WORKDIR"
+                log "keeping temp dir: $WORKDIR"
+            fi
+            chown_if_requested "$STAGING"
+            chmod_user_rw_if_requested "$STAGING"
+            log "keeping temp dir: $STAGING"
        fi
    }
    trap cleanup EXIT INT TERM

-    log "cloning $REPO_URL (ref: $REF)"
-    git clone --depth 1 --branch "$REF" "$REPO_URL" "$WORKDIR" ||
-        fail 'git clone failed'
+    if [ -n "$REPO_DIR" ]; then
+        WORKDIR=$REPO_DIR
+        CLONED_WORKDIR=0
+        update_existing_repo "$WORKDIR" "$REF"
+    else
+        log "cloning $REPO_URL (ref: $REF)"
+        git clone --depth 1 --branch "$REF" "$REPO_URL" "$WORKDIR" ||
+            fail 'git clone failed'
+    fi

    cd "$WORKDIR"

@@ -165,6 +224,15 @@ main() {
    priv cp -a "$STAGING/ui" "$ROOT/"
    priv cp -a "$STAGING/scripts" "$ROOT/"
    priv cp -a "$STAGING/deploy" "$ROOT/"
+    chown_if_requested \
+        "$ROOT/bin/wakey-control-plane" \
+        "$ROOT/ui" \
+        "$ROOT/scripts" \
+        "$ROOT/deploy"
+    chmod_user_rw_if_requested \
+        "$ROOT/ui" \
+        "$ROOT/scripts" \
+        "$ROOT/deploy"

    if [ -z "${WAKEY_CC_NO_RESTART:-}" ] && command -v systemctl >/dev/null 2>&1; then
        if systemctl list-unit-files "$SERVICE" >/dev/null 2>&1; then
@@ -46,7 +46,7 @@ pub struct LeasesArgs {
    )]
    pub include_state: bool,
    /// Print machine-readable JSON instead of a table.
-    #[arg(long)]
+    #[arg(long, short)]
    pub json: bool,
 }

@@ -70,7 +70,7 @@ pub struct WakeArgs {
    #[arg(long)]
    pub ip: Option<IpAddr>,
    /// Print machine-readable JSON instead of a table.
-    #[arg(long)]
+    #[arg(short, long)]
    pub json: bool,
 }

@@ -100,7 +100,7 @@ pub struct InventoryArgs {
    #[arg(long = "mac")]
    pub macs: Vec<macaddr::MacAddr>,
    /// Print machine-readable JSON instead of a table.
-    #[arg(long)]
+    #[arg(short, long)]
    pub json: bool,
 }

@@ -114,10 +114,10 @@ pub struct DevsArgs {
    /// Optional interface name to show.
    pub dev: Option<String>,
    /// Show only interfaces whose operstate is `up`.
-    #[arg(long)]
+    #[arg(short, long)]
    pub up: bool,
    /// Print machine-readable JSON instead of a table.
-    #[arg(long)]
+    #[arg(short, long)]
    pub json: bool,
 }

@@ -42,7 +42,7 @@ pub enum Command {
 #[derive(Args)]
 pub struct ServeArgs {
    /// Path to the agent config file.
-    #[arg(long, default_value = config::DEFAULT_CONFIG_PATH)]
+    #[arg(long, short = 'c', default_value = config::DEFAULT_CONFIG_PATH)]
    pub config: PathBuf,

    /// Path to pid file for reload signaling.
@@ -80,11 +80,11 @@ pub struct EnrollArgs {
 #[derive(Args)]
 pub struct InitConfigArgs {
    /// Path to the agent config file to write. If omitted, config is printed to stdout.
-    #[arg(long)]
+    #[arg(long, short, visible_alias = "to", visible_short_alias = 't')]
    pub config: Option<PathBuf>,

    /// Existing agent config to use as a base before applying explicit overrides.
-    #[arg(long)]
+    #[arg(long, short = 'f', visible_alias = "from")]
    pub from_config: Option<PathBuf>,

    /// Print config to stdout.
@@ -118,14 +118,14 @@ pub struct ReloadArgs {
 #[derive(Args)]
 pub struct SyncObservationsArgs {
    /// Path to the agent config file.
-    #[arg(long, default_value = config::DEFAULT_CONFIG_PATH)]
+    #[arg(long, short, default_value = config::DEFAULT_CONFIG_PATH)]
    pub config: PathBuf,
 }

 #[derive(Args)]
 pub struct ObserveArgs {
    /// Path to the agent config file. If present, local path settings are passed through.
-    #[arg(long, global = true, default_value = config::DEFAULT_CONFIG_PATH)]
+    #[arg(long, short, global = true, default_value = config::DEFAULT_CONFIG_PATH)]
    pub config: PathBuf,

    #[command(subcommand)]
@@ -0,0 +1,86 @@
+{
+  "db_name": "SQLite",
+  "query": "SELECT events.event_id as \"event_id!\",\n                    ('agent:' || events.agent_id || ':' || events.kind || ':' ||\n                        CASE\n                            WHEN events.kind IN ('neigh', 'inventory') AND events.mac IS NOT NULL AND events.ip IS NOT NULL\n                                THEN 'mac:' || events.mac || ':ip:' || events.ip\n                            WHEN events.mac IS NOT NULL THEN 'mac:' || events.mac\n                            WHEN events.ip IS NOT NULL THEN 'ip:' || events.ip\n                            ELSE ''\n                        END) as \"observation_key!\",\n                    events.agent_id as \"agent_id!\",\n                    events.kind as \"kind!\",\n                    events.action as \"action!\",\n                    events.mac,\n                    events.ip,\n                    events.hostname,\n                    events.ts_unix,\n                    known_devices.device_id,\n                    known_devices.display_name,\n                    known_devices.pinned\n             FROM agent_device_observation_events events\n             LEFT JOIN device_identifiers identifiers\n               ON identifiers.identifier_key =\n                  CASE\n                    WHEN events.mac IS NOT NULL THEN 'mac:' || events.mac\n                    WHEN events.ip IS NOT NULL THEN 'ip:' || events.ip\n                  END\n             LEFT JOIN known_devices ON known_devices.device_id = identifiers.device_id\n             WHERE (?1 IS NULL OR events.agent_id = ?1)\n               AND (?2 IS NULL OR events.kind = ?2)\n               AND (?3 IS NULL OR events.mac = ?3)\n               AND (?4 IS NULL OR events.ip = ?4)\n               AND (?5 IS NULL OR ('agent:' || events.agent_id || ':' || events.kind || ':' ||\n                    CASE\n                        WHEN events.kind IN ('neigh', 'inventory') AND events.mac IS NOT NULL AND events.ip IS NOT NULL\n                            THEN 'mac:' || events.mac || ':ip:' || events.ip\n                        WHEN events.mac IS NOT NULL THEN 'mac:' || events.mac\n                        WHEN events.ip IS NOT NULL THEN 'ip:' || events.ip\n                        ELSE ''\n                    END) = ?5)\n             ORDER BY events.ts_unix DESC\n             LIMIT ?6",
+  "describe": {
+    "columns": [
+      {
+        "name": "event_id!",
+        "ordinal": 0,
+        "type_info": "Text"
+      },
+      {
+        "name": "observation_key!",
+        "ordinal": 1,
+        "type_info": "Text"
+      },
+      {
+        "name": "agent_id!",
+        "ordinal": 2,
+        "type_info": "Text"
+      },
+      {
+        "name": "kind!",
+        "ordinal": 3,
+        "type_info": "Text"
+      },
+      {
+        "name": "action!",
+        "ordinal": 4,
+        "type_info": "Text"
+      },
+      {
+        "name": "mac",
+        "ordinal": 5,
+        "type_info": "Text"
+      },
+      {
+        "name": "ip",
+        "ordinal": 6,
+        "type_info": "Text"
+      },
+      {
+        "name": "hostname",
+        "ordinal": 7,
+        "type_info": "Text"
+      },
+      {
+        "name": "ts_unix",
+        "ordinal": 8,
+        "type_info": "Integer"
+      },
+      {
+        "name": "device_id",
+        "ordinal": 9,
+        "type_info": "Text"
+      },
+      {
+        "name": "display_name",
+        "ordinal": 10,
+        "type_info": "Text"
+      },
+      {
+        "name": "pinned",
+        "ordinal": 11,
+        "type_info": "Integer"
+      }
+    ],
+    "parameters": {
+      "Right": 6
+    },
+    "nullable": [
+      true,
+      true,
+      false,
+      false,
+      false,
+      true,
+      true,
+      true,
+      false,
+      true,
+      true,
+      true
+    ]
+  },
+  "hash": "3bc141cecd0ba7c9ca937036b310728dff57c69ed7b74529fd81fa6a3c0e40cf"
+}
@@ -0,0 +1,12 @@
+{
+  "db_name": "SQLite",
+  "query": "DELETE FROM device_identifiers WHERE device_id = ?1 AND identifier_key = ?2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Right": 2
+    },
+    "nullable": []
+  },
+  "hash": "72aadefca9851a8becdd2dcce54b646aff095b64cef9837f5e8e4ea8dde71d02"
+}
@@ -1,86 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "SELECT events.event_id as \"event_id!\",\n                    ('agent:' || events.agent_id || ':' || events.kind || ':' ||\n                        CASE\n                            WHEN events.mac IS NOT NULL THEN 'mac:' || events.mac\n                            WHEN events.ip IS NOT NULL THEN 'ip:' || events.ip\n                            ELSE ''\n                        END) as \"observation_key!\",\n                    events.agent_id as \"agent_id!\",\n                    events.kind as \"kind!\",\n                    events.action as \"action!\",\n                    events.mac,\n                    events.ip,\n                    events.hostname,\n                    events.ts_unix,\n                    known_devices.device_id,\n                    known_devices.display_name,\n                    known_devices.pinned\n             FROM agent_device_observation_events events\n             LEFT JOIN device_identifiers identifiers\n               ON identifiers.identifier_key =\n                  CASE\n                    WHEN events.mac IS NOT NULL THEN 'mac:' || events.mac\n                    WHEN events.ip IS NOT NULL THEN 'ip:' || events.ip\n                  END\n             LEFT JOIN known_devices ON known_devices.device_id = identifiers.device_id\n             WHERE (?1 IS NULL OR events.agent_id = ?1)\n               AND (?2 IS NULL OR events.kind = ?2)\n               AND (?3 IS NULL OR events.mac = ?3)\n               AND (?4 IS NULL OR events.ip = ?4)\n               AND (?5 IS NULL OR ('agent:' || events.agent_id || ':' || events.kind || ':' ||\n                    CASE\n                        WHEN events.mac IS NOT NULL THEN 'mac:' || events.mac\n                        WHEN events.ip IS NOT NULL THEN 'ip:' || events.ip\n                        ELSE ''\n                    END) = ?5)\n             ORDER BY events.ts_unix DESC\n             LIMIT ?6",
-  "describe": {
-    "columns": [
-      {
-        "name": "event_id!",
-        "ordinal": 0,
-        "type_info": "Text"
-      },
-      {
-        "name": "observation_key!",
-        "ordinal": 1,
-        "type_info": "Text"
-      },
-      {
-        "name": "agent_id!",
-        "ordinal": 2,
-        "type_info": "Text"
-      },
-      {
-        "name": "kind!",
-        "ordinal": 3,
-        "type_info": "Text"
-      },
-      {
-        "name": "action!",
-        "ordinal": 4,
-        "type_info": "Text"
-      },
-      {
-        "name": "mac",
-        "ordinal": 5,
-        "type_info": "Text"
-      },
-      {
-        "name": "ip",
-        "ordinal": 6,
-        "type_info": "Text"
-      },
-      {
-        "name": "hostname",
-        "ordinal": 7,
-        "type_info": "Text"
-      },
-      {
-        "name": "ts_unix",
-        "ordinal": 8,
-        "type_info": "Integer"
-      },
-      {
-        "name": "device_id",
-        "ordinal": 9,
-        "type_info": "Text"
-      },
-      {
-        "name": "display_name",
-        "ordinal": 10,
-        "type_info": "Text"
-      },
-      {
-        "name": "pinned",
-        "ordinal": 11,
-        "type_info": "Integer"
-      }
-    ],
-    "parameters": {
-      "Right": 6
-    },
-    "nullable": [
-      true,
-      true,
-      false,
-      false,
-      false,
-      true,
-      true,
-      true,
-      false,
-      true,
-      true,
-      true
-    ]
-  },
-  "hash": "908d763909c76fb6170b818784e360372c02295523ef9970c91199db7d4f535a"
-}
@@ -6,7 +6,7 @@ mod stats;

 pub use devices::{
    attach_device_identifier, attach_observation_identifier, create_known_device,
-    forget_known_device, list_known_devices, merge_known_device,
+    detach_device_identifier, forget_known_device, list_known_devices, merge_known_device,
 };
 pub use enroll::{
    EnrollTokenStatus, IssueEnrollTokenResponse, RevokeAgentResponse, RevokeEnrollTokenResponse,
@@ -198,6 +198,32 @@ pub async fn attach_observation_identifier(
    }
 }

+pub async fn detach_device_identifier(
+    State(state): State<AppState>,
+    AxumPath((device_id, identifier_key)): AxumPath<(String, String)>,
+) -> Result<impl IntoResponse, (StatusCode, Json<serde_json::Value>)> {
+    match state
+        .store
+        .detach_device_identifier(&device_id, &identifier_key)
+        .await
+    {
+        Ok(Some(device)) => Ok((StatusCode::OK, Json(known_device_response(device)))),
+        Ok(None) => Err(json_error(
+            StatusCode::NOT_FOUND,
+            "known_device_not_found",
+            "known device not found",
+        )),
+        Err(err) => {
+            warn!(error = %err, "failed to detach device identifier");
+            Err(json_error(
+                StatusCode::BAD_REQUEST,
+                "detach_device_identifier_failed",
+                &err.to_string(),
+            ))
+        }
+    }
+}
+
 pub async fn merge_known_device(
    State(state): State<AppState>,
    AxumPath(device_id): AxumPath<String>,
@@ -144,9 +144,44 @@ struct InventoryDevice {
    #[serde(default)]
    macs: Vec<String>,
    #[serde(default)]
+    neighbors: Vec<InventoryNeighbor>,
+    #[serde(default)]
+    leases: Vec<InventoryLease>,
+    #[serde(default)]
+    observations: Vec<InventoryObservationFact>,
+    #[serde(default)]
    presence: String,
 }

+#[derive(Debug, Deserialize)]
+struct InventoryNeighbor {
+    ip: IpAddr,
+    #[serde(default)]
+    mac: Option<String>,
+    #[serde(default)]
+    state: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+struct InventoryLease {
+    ip: IpAddr,
+    mac: String,
+    #[serde(default)]
+    name: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+struct InventoryObservationFact {
+    kind: String,
+    action: String,
+    #[serde(default)]
+    mac: Option<String>,
+    #[serde(default)]
+    ip: Option<IpAddr>,
+    #[serde(default)]
+    hostname: Option<String>,
+}
+
 pub async fn list_fleet_devices(
    State(state): State<AppState>,
    Query(query): Query<ListFleetDevicesQuery>,
@@ -323,6 +358,13 @@ pub async fn wake_fleet_device(
            "selected route agent is not connected",
        ));
    }
+    if !route.wakeable {
+        return Err(json_error(
+            StatusCode::BAD_REQUEST,
+            "wake_route_unavailable",
+            "selected route is not wakeable",
+        ));
+    }

    let mac = mac.parse().map_err(|err| {
        json_error(
@@ -530,6 +572,7 @@ fn add_observation_to_entry(
    observation: AgentDeviceObservation,
    context: &FleetBuildContext,
 ) {
+    let observation_offline = observation_is_offline(&observation);
    if let Some(summary) = observation_known_device(&observation, context)
        && entry.known_device.is_none()
    {
@@ -540,7 +583,7 @@ fn add_observation_to_entry(
    if let Some(mac) = observation.mac.as_deref() {
        entry.macs.insert(mac.to_string());
    }
-    if let Some(ip) = observation.ip.as_deref() {
+    if !observation_offline && let Some(ip) = observation.ip.as_deref() {
        entry.ips.insert(ip.to_string());
    }
    if let Some(hostname) = observation.hostname.as_deref() {
@@ -595,7 +638,7 @@ fn add_observation_to_entry(
        observation.ip.as_deref(),
        &observation.kind,
    );
-    let wakeable = status.connected && observation.mac.is_some();
+    let wakeable = status.connected && observation.mac.is_some() && !observation_offline;
    entry.routes.insert(
        route_id.clone(),
        FleetWakeRoute {
@@ -612,7 +655,7 @@ fn add_observation_to_entry(
        },
    );
    if let Some(route) = entry.routes.get_mut(&route_id) {
-        route.wakeable = route.connected && route.mac.is_some();
+        route.wakeable = route.connected && route.mac.is_some() && !observation_offline;
    }
 }

@@ -708,6 +751,63 @@ fn inventory_result_to_observations(
            .iter()
            .find(|name| !name.trim().is_empty())
            .cloned();
+        let mut wrote_source_observation = false;
+        for neighbor in &device.neighbors {
+            if neighbor.mac.is_none() && device.macs.is_empty() {
+                out.push(inventory_observation(
+                    inventory_action_for_neighbor(neighbor),
+                    None,
+                    Some(neighbor.ip.to_string()),
+                    hostname.clone(),
+                    now,
+                ));
+                wrote_source_observation = true;
+                continue;
+            }
+
+            let macs = neighbor
+                .mac
+                .iter()
+                .chain(device.macs.iter())
+                .collect::<BTreeSet<_>>();
+            for mac in macs {
+                out.push(inventory_observation(
+                    inventory_action_for_neighbor(neighbor),
+                    Some(mac.clone()),
+                    Some(neighbor.ip.to_string()),
+                    hostname.clone(),
+                    now,
+                ));
+                wrote_source_observation = true;
+            }
+        }
+        for observation in &device.observations {
+            if observation.mac.is_none() && observation.ip.is_none() {
+                continue;
+            }
+            out.push(inventory_observation(
+                inventory_action_for_observation(observation),
+                observation.mac.clone(),
+                observation.ip.map(|ip| ip.to_string()),
+                observation.hostname.clone().or_else(|| hostname.clone()),
+                now,
+            ));
+            wrote_source_observation = true;
+        }
+        for lease in &device.leases {
+            out.push(inventory_observation(
+                "update",
+                Some(lease.mac.clone()),
+                Some(lease.ip.to_string()),
+                lease.name.clone().or_else(|| hostname.clone()),
+                now,
+            ));
+            wrote_source_observation = true;
+        }
+        if wrote_source_observation {
+            continue;
+        }
+
        let action = if device.presence == "offline" {
            "remove"
        } else {
@@ -715,33 +815,68 @@ fn inventory_result_to_observations(
        };
        if !device.macs.is_empty() {
            for mac in device.macs {
-                out.push(AgentDeviceObservationInput {
-                    kind: "inventory".into(),
-                    action: action.into(),
-                    mac: Some(mac),
-                    ip: device.ips.first().map(ToString::to_string),
-                    hostname: hostname.clone(),
-                    first_seen_unix: now,
-                    last_seen_unix: now,
-                });
+                out.push(inventory_observation(
+                    action,
+                    Some(mac),
+                    device.ips.first().map(ToString::to_string),
+                    hostname.clone(),
+                    now,
+                ));
            }
        } else {
            for ip in &device.ips {
-                out.push(AgentDeviceObservationInput {
-                    kind: "inventory".into(),
-                    action: action.into(),
-                    mac: None,
-                    ip: Some(ip.to_string()),
-                    hostname: hostname.clone(),
-                    first_seen_unix: now,
-                    last_seen_unix: now,
-                });
+                out.push(inventory_observation(
+                    action,
+                    None,
+                    Some(ip.to_string()),
+                    hostname.clone(),
+                    now,
+                ));
            }
        }
    }
    Ok(out)
 }

+fn inventory_observation(
+    action: &str,
+    mac: Option<String>,
+    ip: Option<String>,
+    hostname: Option<String>,
+    now: u64,
+) -> AgentDeviceObservationInput {
+    AgentDeviceObservationInput {
+        kind: "inventory".into(),
+        action: action.into(),
+        mac,
+        ip,
+        hostname,
+        first_seen_unix: now,
+        last_seen_unix: now,
+    }
+}
+
+fn inventory_action_for_neighbor(neighbor: &InventoryNeighbor) -> &'static str {
+    if neighbor
+        .state
+        .as_deref()
+        .is_some_and(|state| state.eq_ignore_ascii_case("FAILED"))
+    {
+        "remove"
+    } else {
+        "update"
+    }
+}
+
+fn inventory_action_for_observation(observation: &InventoryObservationFact) -> &str {
+    match observation.action.as_str() {
+        "add" | "old" | "update" => "update",
+        "remove" | "del" => "remove",
+        _ if observation.kind == "neigh" => "update",
+        _ => "update",
+    }
+}
+
 fn observation_presence_rank(observation: &AgentDeviceObservation) -> u8 {
    match observation.last_action.as_str() {
        "remove" => 0,
@@ -750,6 +885,10 @@ fn observation_presence_rank(observation: &AgentDeviceObservation) -> u8 {
    }
 }

+fn observation_is_offline(observation: &AgentDeviceObservation) -> bool {
+    observation.last_action == "remove"
+}
+
 fn rank_presence(rank: u8) -> &'static str {
    match rank {
        3 => "online",
@@ -932,6 +1071,26 @@ mod tests {
        assert!(!devices[0].route_candidates[0].wakeable);
    }

+    #[test]
+    fn offline_observation_does_not_advertise_current_ip_or_wake_route() {
+        let mut offline = observation(
+            "agent-a",
+            Some("aa:bb:cc:dd:ee:ff"),
+            Some("192.168.1.2"),
+            20,
+        );
+        offline.kind = "neigh".into();
+        offline.last_action = "remove".into();
+
+        let devices = build_fleet_devices(Vec::new(), vec![offline], &context(&["agent-a"]));
+
+        assert_eq!(devices.len(), 1);
+        assert!(devices[0].ips.is_empty());
+        assert_eq!(devices[0].presence, "offline");
+        assert!(devices[0].recommended_route.is_none());
+        assert!(!devices[0].route_candidates[0].wakeable);
+    }
+
    #[test]
    fn inventory_result_maps_to_stored_observations() {
        let observations = inventory_result_to_observations(serde_json::json!({
@@ -950,4 +1109,84 @@ mod tests {
        assert_eq!(observations[0].action, "update");
        assert_eq!(observations[0].mac.as_deref(), Some("aa:bb:cc:dd:ee:ff"));
    }
+
+    #[test]
+    fn inventory_result_preserves_neighbor_failed_ip_as_remove() {
+        let observations = inventory_result_to_observations(serde_json::json!({
+            "kind": "inventory",
+            "devices": [{
+                "names": ["lda"],
+                "ips": ["192.168.1.2", "192.168.1.3"],
+                "macs": ["aa:bb:cc:dd:ee:ff"],
+                "neighbors": [
+                    {
+                        "ip": "192.168.1.2",
+                        "mac": "aa:bb:cc:dd:ee:ff",
+                        "state": "FAILED"
+                    },
+                    {
+                        "ip": "192.168.1.3",
+                        "mac": "aa:bb:cc:dd:ee:ff",
+                        "state": "REACHABLE"
+                    }
+                ],
+                "presence": "online"
+            }]
+        }))
+        .expect("inventory should map");
+
+        assert_eq!(observations.len(), 2);
+        let removed = observations
+            .iter()
+            .find(|observation| observation.ip.as_deref() == Some("192.168.1.2"))
+            .expect("failed neighbor observation should exist");
+        assert_eq!(removed.action, "remove");
+        assert_eq!(removed.mac.as_deref(), Some("aa:bb:cc:dd:ee:ff"));
+
+        let current = observations
+            .iter()
+            .find(|observation| observation.ip.as_deref() == Some("192.168.1.3"))
+            .expect("reachable neighbor observation should exist");
+        assert_eq!(current.action, "update");
+        assert_eq!(current.mac.as_deref(), Some("aa:bb:cc:dd:ee:ff"));
+    }
+
+    #[test]
+    fn inventory_result_preserves_hook_observations_and_leases() {
+        let observations = inventory_result_to_observations(serde_json::json!({
+            "kind": "inventory",
+            "devices": [{
+                "names": ["lda"],
+                "ips": ["192.168.1.2", "192.168.1.3"],
+                "macs": ["aa:bb:cc:dd:ee:ff"],
+                "observations": [{
+                    "kind": "neigh",
+                    "action": "remove",
+                    "mac": "aa:bb:cc:dd:ee:ff",
+                    "ip": "192.168.1.2"
+                }],
+                "leases": [{
+                    "expires_epoch": 1893456000_u64,
+                    "ip": "192.168.1.3",
+                    "mac": "aa:bb:cc:dd:ee:ff",
+                    "name": "lda"
+                }],
+                "presence": "likely_online"
+            }]
+        }))
+        .expect("inventory should map");
+
+        assert_eq!(observations.len(), 2);
+        assert!(observations.iter().any(|observation| {
+            observation.action == "remove"
+                && observation.mac.as_deref() == Some("aa:bb:cc:dd:ee:ff")
+                && observation.ip.as_deref() == Some("192.168.1.2")
+        }));
+        assert!(observations.iter().any(|observation| {
+            observation.action == "update"
+                && observation.mac.as_deref() == Some("aa:bb:cc:dd:ee:ff")
+                && observation.ip.as_deref() == Some("192.168.1.3")
+                && observation.hostname.as_deref() == Some("lda")
+        }));
+    }
 }
@@ -12,11 +12,11 @@ pub use commands::{list_agents, run_command};
 pub use control::{
    EnrollTokenStatus, IssueEnrollTokenResponse, RevokeAgentResponse, RevokeEnrollTokenResponse,
    StateStatsResponse, attach_device_identifier, attach_observation_identifier,
-    create_known_device, enroll, forget_known_device, healthz, issue_enroll_token,
-    list_agent_observation_history, list_agent_observations, list_enroll_tokens,
-    list_fleet_devices, list_known_devices, merge_known_device, refresh_fleet_devices,
-    request_agent_observation_sync, revoke_agent, revoke_enroll_token, set_agent_nickname,
-    state_stats, upload_agent_observations, wake_fleet_device,
+    create_known_device, detach_device_identifier, enroll, forget_known_device, healthz,
+    issue_enroll_token, list_agent_observation_history, list_agent_observations,
+    list_enroll_tokens, list_fleet_devices, list_known_devices, merge_known_device,
+    refresh_fleet_devices, request_agent_observation_sync, revoke_agent, revoke_enroll_token,
+    set_agent_nickname, state_stats, upload_agent_observations, wake_fleet_device,
 };

 pub fn json_error(
@@ -87,10 +87,16 @@ pub struct ServeArgs {

 #[derive(Args, Clone)]
 pub struct InitConfigArgs {
-    #[arg(long = "config-file", alias = "config")]
+    #[arg(
+        long = "config-file",
+        short,
+        visible_alias = "config",
+        visible_alias = "to",
+        visible_short_alias = 't'
+    )]
    pub config_file: Option<PathBuf>,

-    #[arg(long)]
+    #[arg(long, short, visible_alias = "from")]
    pub from_config: Option<PathBuf>,

    #[arg(long, conflicts_with = "config_file")]
@@ -138,7 +144,7 @@ pub struct InitConfigArgs {

 #[derive(Args)]
 pub struct IssueEnrollTokenArgs {
-    #[arg(long, default_value = DEFAULT_CONFIG_FILE)]
+    #[arg(long, visible_alias = "config", default_value = DEFAULT_CONFIG_FILE)]
    pub config_file: PathBuf,

    #[arg(long)]
@@ -159,7 +165,7 @@ pub struct IssueEnrollTokenArgs {

 #[derive(Args)]
 pub struct ListEnrollTokensArgs {
-    #[arg(long, default_value = DEFAULT_CONFIG_FILE)]
+    #[arg(long, visible_alias = "config", default_value = DEFAULT_CONFIG_FILE)]
    pub config_file: PathBuf,

    #[arg(long)]
@@ -130,6 +130,10 @@ fn control_api_routes() -> Router<AppState> {
            "/api/v1/control/devices/{device_id}/identifiers",
            post(api::attach_device_identifier),
        )
+        .route(
+            "/api/v1/control/devices/{device_id}/identifiers/{identifier_key}",
+            axum::routing::delete(api::detach_device_identifier),
+        )
        .route(
            "/api/v1/control/devices/{device_id}/identifiers/from-observation",
            post(api::attach_observation_identifier),
@@ -337,6 +337,52 @@ mod tests {
        cleanup_dir(&dir);
    }

+    #[tokio::test]
+    async fn device_identifier_can_be_detached_manually() {
+        let (store, dir) = make_store().await;
+        let created = store
+            .create_known_device(KnownDeviceInput {
+                display_name: "lda".into(),
+                pinned: true,
+                notes: None,
+                identifiers: vec![
+                    DeviceIdentifierInput {
+                        kind: "mac".into(),
+                        value: "aa:bb:cc:dd:ee:ff".into(),
+                    },
+                    DeviceIdentifierInput {
+                        kind: "ip".into(),
+                        value: "192.168.1.2".into(),
+                    },
+                ],
+            })
+            .await
+            .expect("known device should create");
+
+        let updated = store
+            .detach_device_identifier(&created.device_id, "ip:192.168.1.2")
+            .await
+            .expect("identifier detach should succeed")
+            .expect("device should exist");
+
+        assert_eq!(updated.identifiers.len(), 1);
+        assert_eq!(
+            updated.identifiers[0].identifier_key,
+            "mac:aa:bb:cc:dd:ee:ff"
+        );
+
+        let unmatched = store
+            .lookup_known_device_by_identifier(DeviceIdentifierInput {
+                kind: "ip".into(),
+                value: "192.168.1.2".into(),
+            })
+            .await
+            .expect("lookup should succeed");
+        assert!(unmatched.is_none());
+
+        cleanup_dir(&dir);
+    }
+
    #[tokio::test]
    async fn merge_known_devices_moves_identifiers_and_deletes_source() {
        let (store, dir) = make_store().await;
@@ -196,6 +196,51 @@ impl Store {
        self.attach_device_identifier(device_id, input).await
    }

+    pub async fn detach_device_identifier(
+        &self,
+        device_id: &str,
+        identifier_key: &str,
+    ) -> Result<Option<KnownDevice>> {
+        let now = now_unix();
+        let now_i64 = i64::try_from(now).context("known device timestamp overflow")?;
+        let mut tx = self
+            .pool
+            .begin()
+            .await
+            .context("failed starting device identifier detach transaction")?;
+        let exists = sqlx::query_scalar!(
+            r#"SELECT COUNT(*) as "count!: i64" FROM known_devices WHERE device_id = ?1"#,
+            device_id
+        )
+        .fetch_one(&mut *tx)
+        .await
+        .context("failed checking known device existence")?;
+        if exists == 0 {
+            return Ok(None);
+        }
+
+        sqlx::query!(
+            "DELETE FROM device_identifiers WHERE device_id = ?1 AND identifier_key = ?2",
+            device_id,
+            identifier_key
+        )
+        .execute(&mut *tx)
+        .await
+        .context("failed detaching device identifier")?;
+        sqlx::query!(
+            "UPDATE known_devices SET updated_at_unix = ?1 WHERE device_id = ?2",
+            now_i64,
+            device_id
+        )
+        .execute(&mut *tx)
+        .await
+        .context("failed updating known device timestamp")?;
+        tx.commit()
+            .await
+            .context("failed committing device identifier detach transaction")?;
+        self.get_known_device(device_id).await
+    }
+
    #[cfg_attr(not(test), allow(dead_code))]
    pub async fn lookup_known_device_by_identifier(
        &self,
@@ -259,10 +259,7 @@ pub(in crate::state::store) fn normalize_agent_observation(
    let mac = normalize_optional_text(input.mac.as_deref()).map(|value| value.to_ascii_lowercase());
    let ip = normalize_optional_text(input.ip.as_deref());
    let hostname = normalize_optional_text(input.hostname.as_deref());
-    let identifier = mac
-        .as_ref()
-        .map(|value| format!("mac:{value}"))
-        .or_else(|| ip.as_ref().map(|value| format!("ip:{value}")))
+    let identifier = observation_identifier(&kind, mac.as_deref(), ip.as_deref())
        .ok_or_else(|| anyhow::anyhow!("observation requires mac or ip"))?;
    let observation_key = format!("agent:{agent_id}:{kind}:{identifier}");
    Ok(AgentDeviceObservation {
@@ -278,6 +275,15 @@ pub(in crate::state::store) fn normalize_agent_observation(
    })
 }

+fn observation_identifier(kind: &str, mac: Option<&str>, ip: Option<&str>) -> Option<String> {
+    match (kind, mac, ip) {
+        ("neigh" | "inventory", Some(mac), Some(ip)) => Some(format!("mac:{mac}:ip:{ip}")),
+        (_, Some(mac), _) => Some(format!("mac:{mac}")),
+        (_, None, Some(ip)) => Some(format!("ip:{ip}")),
+        (_, None, None) => None,
+    }
+}
+
 pub(in crate::state::store) async fn insert_device_identifier_tx(
    tx: &mut Transaction<'_, Sqlite>,
    device_id: &str,
@@ -211,6 +211,8 @@ impl Store {
            r#"SELECT events.event_id as "event_id!",
                    ('agent:' || events.agent_id || ':' || events.kind || ':' ||
                        CASE
+                            WHEN events.kind IN ('neigh', 'inventory') AND events.mac IS NOT NULL AND events.ip IS NOT NULL
+                                THEN 'mac:' || events.mac || ':ip:' || events.ip
                            WHEN events.mac IS NOT NULL THEN 'mac:' || events.mac
                            WHEN events.ip IS NOT NULL THEN 'ip:' || events.ip
                            ELSE ''
@@ -239,6 +241,8 @@ impl Store {
               AND (?4 IS NULL OR events.ip = ?4)
               AND (?5 IS NULL OR ('agent:' || events.agent_id || ':' || events.kind || ':' ||
                    CASE
+                        WHEN events.kind IN ('neigh', 'inventory') AND events.mac IS NOT NULL AND events.ip IS NOT NULL
+                            THEN 'mac:' || events.mac || ':ip:' || events.ip
                        WHEN events.mac IS NOT NULL THEN 'mac:' || events.mac
                        WHEN events.ip IS NOT NULL THEN 'ip:' || events.ip
                        ELSE ''
@@ -136,4 +136,47 @@ mod tests {
        let _ = tokio::fs::remove_file(observation_path).await;
        let _ = tokio::fs::remove_file(cache_path).await;
    }
+
+    #[tokio::test]
+    #[serial]
+    async fn neighbor_observations_are_keyed_by_mac_ip_pair() {
+        let observation_path = temp_file("neighbor-observations");
+        let _observation_guard = EnvGuard::set(OBSERVATION_STORE_ENV, &observation_path);
+        let mac = "aa:bb:cc:dd:ee:ff".parse().expect("mac should parse");
+
+        observe_neighbor_event(
+            "add",
+            Some(mac),
+            Some("192.168.1.2".parse().expect("ip should parse")),
+        )
+        .await
+        .expect("first observation should write");
+        observe_neighbor_event(
+            "update",
+            Some(mac),
+            Some("192.168.1.3".parse().expect("ip should parse")),
+        )
+        .await
+        .expect("second observation should write");
+
+        let store = load_observation_store()
+            .await
+            .expect("observation store should read");
+        assert!(
+            store
+                .neighbors
+                .contains_key("mac:aa:bb:cc:dd:ee:ff:ip:192.168.1.2")
+        );
+        assert!(
+            store
+                .neighbors
+                .contains_key("mac:aa:bb:cc:dd:ee:ff:ip:192.168.1.3")
+        );
+        assert_eq!(
+            store.neighbors["mac:aa:bb:cc:dd:ee:ff:ip:192.168.1.2"].last_action,
+            "remove"
+        );
+
+        let _ = tokio::fs::remove_file(observation_path).await;
+    }
 }
@@ -218,14 +218,11 @@ pub async fn observe_neighbor_event(
    mac: Option<MacAddr>,
    ip: Option<IpAddr>,
 ) -> io::Result<bool> {
-    if !matches!(action, "add" | "update" | "old" | "remove") {
-        // update and remove not emitted by hotplug
+    let action = normalize_neighbor_action(action);
+    if !is_neighbor_observation_action(&action) {
        return Ok(false);
    }
-    let Some(key) = mac
-        .map(|value| format!("mac:{}", value.to_string().to_ascii_lowercase()))
-        .or_else(|| ip.map(|value| format!("ip:{}", value)))
-    else {
+    let Some(key) = neighbor_observation_key(mac, ip) else {
        return Ok(false);
    };

@@ -244,7 +241,7 @@ pub async fn observe_neighbor_event(
            {
                row.mac = mac.clone();
                row.ip = ip;
-                row.last_action = action.to_string();
+                row.last_action = action.clone();
                row.last_seen_unix = now;
                changed = true;
            }
@@ -253,15 +250,78 @@ pub async fn observe_neighbor_event(
            changed = true;
            ObservedNeighbor {
                key,
-                mac,
+                mac: mac.clone(),
                ip,
                first_seen_unix: now,
                last_seen_unix: now,
-                last_action: action.to_string(),
+                last_action: action.clone(),
            }
        });
+    if let (Some(mac), Some(ip)) = (mac.as_deref(), ip)
+        && !is_offline_neighbor_action(&action)
+    {
+        mark_replaced_neighbor_ips_removed(&mut store, mac, ip, now, &mut changed);
+    }
    if changed {
        save_observation_store(&store).await?;
    }
    Ok(changed)
 }
+
+fn normalize_neighbor_action(action: &str) -> String {
+    match action.trim().to_ascii_lowercase().as_str() {
+        "del" => "remove".into(),
+        "old" => "update".into(),
+        other => other.to_string(),
+    }
+}
+
+fn is_neighbor_observation_action(action: &str) -> bool {
+    matches!(action, "add" | "update" | "remove")
+}
+
+fn is_offline_neighbor_action(action: &str) -> bool {
+    action == "remove"
+}
+
+fn neighbor_observation_key(mac: Option<MacAddr>, ip: Option<IpAddr>) -> Option<String> {
+    match (mac, ip) {
+        (Some(mac), Some(ip)) => Some(format!(
+            "mac:{}:ip:{ip}",
+            mac.to_string().to_ascii_lowercase()
+        )),
+        (Some(mac), None) => Some(format!("mac:{}", mac.to_string().to_ascii_lowercase())),
+        (None, Some(ip)) => Some(format!("ip:{ip}")),
+        (None, None) => None,
+    }
+}
+
+fn mark_replaced_neighbor_ips_removed(
+    store: &mut LocalObservationStore,
+    mac: &str,
+    current_ip: IpAddr,
+    now: u64,
+    changed: &mut bool,
+) {
+    for row in store.neighbors.values_mut() {
+        let Some(row_ip) = row.ip else {
+            continue;
+        };
+        if row.mac.as_deref() == Some(mac)
+            && row_ip != current_ip
+            && same_ip_family(row_ip, current_ip)
+            && !is_offline_neighbor_action(&row.last_action)
+        {
+            row.last_action = "remove".into();
+            row.last_seen_unix = now;
+            *changed = true;
+        }
+    }
+}
+
+fn same_ip_family(a: IpAddr, b: IpAddr) -> bool {
+    matches!(
+        (a, b),
+        (IpAddr::V4(_), IpAddr::V4(_)) | (IpAddr::V6(_), IpAddr::V6(_))
+    )
+}