diff --git a/netbox_librenms_plugin/api/serializers.py b/netbox_librenms_plugin/api/serializers.py
index fe576d712a..89b1436985 100644
--- a/netbox_librenms_plugin/api/serializers.py
+++ b/netbox_librenms_plugin/api/serializers.py
@@ -9,6 +9,7 @@
     ModuleTypeMapping,
     NormalizationRule,
     PlatformMapping,
+    PortStackLagPattern,
 )
 
 
@@ -129,3 +130,13 @@ class Meta:
             "carrier_module_type",
             "description",
         ]
+
+
+class PortStackLagPatternSerializer(NetBoxModelSerializer):
+    """Serialize PortStackLagPattern model for REST API."""
+
+    class Meta:
+        """Meta options for PortStackLagPatternSerializer."""
+
+        model = PortStackLagPattern
+        fields = ["id", "librenms_os", "lag_name_pattern", "description"]
diff --git a/netbox_librenms_plugin/api/urls.py b/netbox_librenms_plugin/api/urls.py
index de5f82b4aa..e6fe47d897 100644
--- a/netbox_librenms_plugin/api/urls.py
+++ b/netbox_librenms_plugin/api/urls.py
@@ -14,6 +14,7 @@
 router.register("inventory-ignore-rules", views.InventoryIgnoreRuleViewSet)
 router.register("platform-mappings", views.PlatformMappingViewSet)
 router.register("carrier-auto-install-rules", views.CarrierAutoInstallRuleViewSet)
+router.register("port-stack-lag-patterns", views.PortStackLagPatternViewSet)
 
 urlpatterns = [
     path("jobs/<int:job_pk>/sync-status/", views.sync_job_status, name="sync_job_status"),
diff --git a/netbox_librenms_plugin/api/views.py b/netbox_librenms_plugin/api/views.py
index a73fb8069f..f37cef36b6 100644
--- a/netbox_librenms_plugin/api/views.py
+++ b/netbox_librenms_plugin/api/views.py
@@ -21,6 +21,7 @@
     ModuleTypeMappingFilterSet,
     NormalizationRuleFilterSet,
     PlatformMappingFilterSet,
+    PortStackLagPatternFilterSet,
 )
 from netbox_librenms_plugin.jobs import FilterDevicesJob, ImportDevicesJob
 from netbox_librenms_plugin.models import (
@@ -32,6 +33,7 @@
     ModuleTypeMapping,
     NormalizationRule,
     PlatformMapping,
+    PortStackLagPattern,
 )
 
 from .serializers import (
@@ -43,6 +45,7 @@
     ModuleTypeMappingSerializer,
     NormalizationRuleSerializer,
     PlatformMappingSerializer,
+    PortStackLagPatternSerializer,
 )
 
 logger = logging.getLogger(__name__)
@@ -144,6 +147,16 @@ class CarrierAutoInstallRuleViewSet(NetBoxModelViewSet):
     serializer_class = CarrierAutoInstallRuleSerializer
 
 
+class PortStackLagPatternViewSet(NetBoxModelViewSet):
+    """API viewset for PortStackLagPattern CRUD operations."""
+
+    permission_classes = [LibreNMSPluginPermission]
+    filterset_class = PortStackLagPatternFilterSet
+
+    queryset = PortStackLagPattern.objects.all()
+    serializer_class = PortStackLagPatternSerializer
+
+
 @api_view(["POST"])
 @permission_classes([LibreNMSPluginPermission])
 def sync_job_status(request, job_pk):
diff --git a/netbox_librenms_plugin/filters.py b/netbox_librenms_plugin/filters.py
index 1edb57773c..a00fd1d486 100644
--- a/netbox_librenms_plugin/filters.py
+++ b/netbox_librenms_plugin/filters.py
@@ -1,5 +1,6 @@
 import django_filters
 from dcim.models import Manufacturer
+from django.db.models import Q
 
 from .models import (
     CarrierAutoInstallRule,
@@ -10,6 +11,7 @@
     ModuleTypeMapping,
     NormalizationRule,
     PlatformMapping,
+    PortStackLagPattern,
 )
 
 
@@ -143,3 +145,24 @@ class Meta:
             "librenms_child_name_pattern",
             "netbox_bay_name_pattern",
         ]
+
+
+class PortStackLagPatternFilterSet(django_filters.FilterSet):
+    """Filter set for PortStackLagPattern model."""
+
+    q = django_filters.CharFilter(method="search")
+    librenms_os = django_filters.CharFilter(lookup_expr="icontains")
+    lag_name_pattern = django_filters.CharFilter(lookup_expr="icontains")
+    description = django_filters.CharFilter(lookup_expr="icontains")
+
+    def search(self, queryset, _name, value):
+        """Search the fields exposed by the pattern list."""
+        return queryset.filter(
+            Q(librenms_os__icontains=value) | Q(lag_name_pattern__icontains=value) | Q(description__icontains=value)
+        )
+
+    class Meta:
+        """Meta options."""
+
+        model = PortStackLagPattern
+        fields = ["librenms_os", "lag_name_pattern", "description"]
diff --git a/netbox_librenms_plugin/forms.py b/netbox_librenms_plugin/forms.py
index 1dbc10c87c..1260488ae4 100644
--- a/netbox_librenms_plugin/forms.py
+++ b/netbox_librenms_plugin/forms.py
@@ -32,6 +32,7 @@
     ModuleTypeMapping,
     NormalizationRule,
     PlatformMapping,
+    PortStackLagPattern,
 )
 
 logger = logging.getLogger(__name__)
@@ -705,6 +706,36 @@ class PlatformMappingFilterForm(NetBoxModelFilterSetForm):
     model = PlatformMapping
 
 
+class PortStackLagPatternForm(NetBoxModelForm):
+    """Form for creating and editing PortStackLagPattern objects."""
+
+    class Meta:
+        """Meta options."""
+
+        model = PortStackLagPattern
+        fields = ["librenms_os", "lag_name_pattern", "description"]
+
+
+class PortStackLagPatternImportForm(NetBoxModelImportForm):
+    """Form for bulk importing PortStackLagPattern objects from CSV/JSON/YAML."""
+
+    class Meta:
+        """Meta options."""
+
+        model = PortStackLagPattern
+        fields = ["librenms_os", "lag_name_pattern", "description"]
+
+
+class PortStackLagPatternFilterForm(NetBoxModelFilterSetForm):
+    """Form for filtering PortStackLagPattern objects."""
+
+    librenms_os = forms.CharField(required=False, label="LibreNMS OS")
+    lag_name_pattern = forms.CharField(required=False, label="LAG Name Pattern")
+    description = forms.CharField(required=False, label="Description")
+
+    model = PortStackLagPattern
+
+
 class BaseSNMPForm(forms.Form):
     """
     Base form with fields shared by both SNMPv1/v2c and SNMPv3 LibreNMS device forms.
diff --git a/netbox_librenms_plugin/interface_relationships.py b/netbox_librenms_plugin/interface_relationships.py
new file mode 100644
index 0000000000..d4bdba7687
--- /dev/null
+++ b/netbox_librenms_plugin/interface_relationships.py
@@ -0,0 +1,450 @@
+"""Shared interface relationship discovery and row resolution."""
+
+from dataclasses import dataclass
+
+from dcim.models import Device, Interface
+from django.db.models import Q
+from virtualization.models import VirtualMachine, VMInterface
+
+from netbox_librenms_plugin.utils import (
+    build_librenms_id_qs,
+    get_librenms_device_id,
+    interface_name_fallback_matches_port,
+    is_list_of_dicts,
+    normalize_librenms_port_id,
+    normalize_relationship_maps,
+)
+
+
+RELATIONSHIP_CANDIDATE_BATCH_SIZE = 64
+
+
+@dataclass(frozen=True)
+class RelationshipMaps:
+    """Normalized cached relationship data for one LibreNMS snapshot."""
+
+    lag_members: dict
+    sub_interfaces: dict
+    ports_by_id: dict
+
+
+@dataclass(frozen=True)
+class RelationshipResolutionContext:
+    """Indexes and permission state shared by every row resolver."""
+
+    obj: object
+    server_key: str
+    catalog_index: dict
+    display_index: dict
+    related_index: dict
+    source_index: dict
+    actionable_owner_ids: set
+    changeable_interface_ids: set
+    can_write: bool
+
+
+def interface_owner(interface):
+    """Return the ``(device_id, virtual_machine_id)`` owner tuple for an interface."""
+    return (getattr(interface, "device_id", None), getattr(interface, "virtual_machine_id", None))
+
+
+def interface_owner_for_object(obj):
+    """Return the owner tuple for a Device or VirtualMachine."""
+    if isinstance(obj, Device):
+        return (obj.pk, None)
+    return (None, obj.pk)
+
+
+def interface_queryset_for_object(obj):
+    """Return the interfaces in a Device chassis or VirtualMachine scope."""
+    if isinstance(obj, Device):
+        if obj.virtual_chassis_id is not None:
+            member_ids = obj.virtual_chassis.members.values_list("id", flat=True)
+            return Interface.objects.filter(device__in=member_ids)
+        return Interface.objects.filter(device=obj)
+    if isinstance(obj, VirtualMachine):
+        return VMInterface.objects.filter(virtual_machine=obj)
+    return None
+
+
+def relationship_candidate_q(server_key, port_ids, names):
+    """Build one query for stable IDs and safe name hints."""
+    candidate_q = Q(pk__in=[])
+    unique_port_ids = {
+        (type(port_id).__name__, str(port_id)): port_id
+        for port_id in port_ids
+        if normalize_librenms_port_id(port_id) is not None
+    }
+    for marker in sorted(unique_port_ids):
+        port_id = unique_port_ids[marker]
+        host_q, oob_q = build_librenms_id_qs(server_key, port_id)
+        candidate_q |= host_q | oob_q
+    unique_names = sorted({name for name in names if isinstance(name, str) and name})
+    if unique_names:
+        candidate_q |= Q(name__in=unique_names)
+    return candidate_q
+
+
+def relationship_candidate_ids(obj, server_key, port_ids, names):
+    """Find relationship candidates in bounded batches."""
+    interface_queryset = interface_queryset_for_object(obj)
+    candidate_ids = set()
+    unique_port_ids = sorted(
+        {port_id for raw_port_id in port_ids if (port_id := normalize_librenms_port_id(raw_port_id)) is not None}
+    )
+    unique_names = sorted({name for name in names if isinstance(name, str) and name})
+
+    for start in range(0, len(unique_port_ids), RELATIONSHIP_CANDIDATE_BATCH_SIZE):
+        batch = unique_port_ids[start : start + RELATIONSHIP_CANDIDATE_BATCH_SIZE]
+        candidate_ids.update(
+            interface_queryset.filter(relationship_candidate_q(server_key, batch, ())).values_list("pk", flat=True)
+        )
+
+    for start in range(0, len(unique_names), RELATIONSHIP_CANDIDATE_BATCH_SIZE):
+        batch = unique_names[start : start + RELATIONSHIP_CANDIDATE_BATCH_SIZE]
+        candidate_ids.update(interface_queryset.filter(name__in=batch).values_list("pk", flat=True))
+
+    return candidate_ids
+
+
+def build_interface_index(obj, server_key, user=None, action="change", *, lock=False, allowed_ids=None):
+    """Build an ambiguity-preserving interface index for repeated resolution."""
+    interface_queryset = interface_queryset_for_object(obj)
+    if interface_queryset is None:
+        return None
+
+    if allowed_ids is not None:
+        interface_queryset = interface_queryset.filter(pk__in=allowed_ids)
+    elif user is not None:
+        interface_queryset = interface_queryset.restrict(user, action)
+    if isinstance(obj, Device):
+        interface_queryset = interface_queryset.select_related(
+            "bridge__device__virtual_chassis",
+            "device__virtual_chassis",
+            "device__location",
+            "device__rack",
+            "device__site",
+            "lag__device__virtual_chassis",
+            "parent__device__virtual_chassis",
+            "untagged_vlan__site",
+        )
+    else:
+        interface_queryset = interface_queryset.select_related(
+            "bridge__virtual_machine",
+            "virtual_machine",
+            "virtual_machine__site",
+            "parent__virtual_machine",
+            "untagged_vlan__site",
+        )
+    if lock:
+        interface_queryset = interface_queryset.select_for_update(of=("self",)).order_by("pk")
+
+    by_librenms_id = {}
+    by_name = {}
+    for interface in interface_queryset:
+        stored_id = normalize_librenms_port_id(get_librenms_device_id(interface, server_key, auto_save=False))
+        if stored_id is not None:
+            by_librenms_id.setdefault(stored_id, []).append(interface)
+        by_name.setdefault(interface.name, []).append(interface)
+    return {"by_lnms_id": by_librenms_id, "by_name": by_name}
+
+
+def filter_interface_index(index, allowed_ids):
+    """Return an interface index limited to the supplied primary keys."""
+    return {
+        key: {
+            value: [interface for interface in interfaces if interface.pk in allowed_ids]
+            for value, interfaces in mapping.items()
+            if any(interface.pk in allowed_ids for interface in interfaces)
+        }
+        for key, mapping in index.items()
+    }
+
+
+def resolve_interface_by_port_id(
+    obj, port_id: str, server_key: str, name_hint: str = "", expected_owner=None, index=None
+):
+    """Resolve one stable LibreNMS port ID, with a safe exact-name fallback."""
+    if not port_id:
+        return None, "port_id is required"
+
+    if index is None:
+        index = build_interface_index(obj, server_key)
+        if index is None:
+            return None, f"Unsupported object type: {type(obj).__name__}"
+
+    target_id = normalize_librenms_port_id(port_id)
+    matches = list(index["by_lnms_id"].get(target_id, [])) if target_id is not None else []
+    if len(matches) > 1:
+        return None, f"LibreNMS port_id {port_id} is ambiguous on {obj} (matches multiple interfaces)"
+    if expected_owner is not None:
+        owned = [match for match in matches if interface_owner(match) == expected_owner]
+        if len(owned) == 1:
+            return owned[0], None
+    elif len(matches) == 1:
+        return matches[0], None
+
+    if name_hint:
+        interface, error = _resolve_interface_by_name_hint(
+            obj,
+            name_hint,
+            index=index,
+            expected_owner=expected_owner,
+        )
+        if error:
+            return None, error
+        if interface is not None:
+            if expected_owner is not None and interface_owner(interface) != expected_owner:
+                return None, f"Interface name '{name_hint}' resolves to a different owner than the selected row"
+            if not interface_name_fallback_matches_port(interface, target_id, server_key):
+                stored_id = normalize_librenms_port_id(get_librenms_device_id(interface, server_key, auto_save=False))
+                return None, f"Interface name '{name_hint}' is already bound to LibreNMS port_id {stored_id}"
+            return interface, None
+
+    if expected_owner is not None and matches:
+        return None, f"LibreNMS port_id {port_id} resolves to a different owner than the selected row"
+    return None, f"Interface with LibreNMS port_id {port_id} not found on {obj}"
+
+
+def _resolve_interface_by_name_hint(obj, name_hint, index=None, expected_owner=None):
+    """Resolve one exact interface name while preserving ambiguity."""
+    if index is not None:
+        matches = index["by_name"].get(name_hint, [])
+        if expected_owner is not None:
+            owned = [match for match in matches if interface_owner(match) == expected_owner]
+            if owned:
+                matches = owned
+        if not matches:
+            return None, None
+        if len(matches) > 1:
+            return None, f"Interface name '{name_hint}' is ambiguous on {obj}"
+        return matches[0], None
+    try:
+        if isinstance(obj, Device):
+            if expected_owner is not None and expected_owner[0] is not None:
+                interface = Interface.objects.get(device_id=expected_owner[0], name=name_hint)
+            elif obj.virtual_chassis_id is not None:
+                member_ids = obj.virtual_chassis.members.values_list("id", flat=True)
+                interface = Interface.objects.get(device__in=member_ids, name=name_hint)
+            else:
+                interface = Interface.objects.get(device=obj, name=name_hint)
+        else:
+            interface = VMInterface.objects.get(virtual_machine=obj, name=name_hint)
+        return interface, None
+    except (Interface.DoesNotExist, VMInterface.DoesNotExist):
+        return None, None
+    except (Interface.MultipleObjectsReturned, VMInterface.MultipleObjectsReturned):
+        return None, f"Interface name '{name_hint}' is ambiguous on {obj}"
+
+
+def build_relationship_maps(cached_data):
+    """Normalize relationship maps and index host ports by stable ID."""
+    lag_members, sub_interfaces = normalize_relationship_maps(cached_data.get("port_stack_relationships"))
+    ports = cached_data.get("ports", [])
+    if not is_list_of_dicts(ports):
+        ports = []
+    ports_by_id = {}
+    for port in ports:
+        if port.get("_source") == "oob":
+            continue
+        port_id = normalize_librenms_port_id(port.get("port_id"))
+        if port_id is not None:
+            ports_by_id[port_id] = port
+    return RelationshipMaps(lag_members, sub_interfaces, ports_by_id)
+
+
+def build_candidate_relationship_context(obj, server_key, user, can_write, port_ids, names):
+    """Build one permission-aware relationship context for a bounded row set."""
+    candidate_queryset = interface_queryset_for_object(obj).filter(
+        relationship_candidate_q(server_key, port_ids, names)
+    )
+    catalog_ids = set(candidate_queryset.values_list("pk", flat=True))
+    catalog_index = build_interface_index(obj, server_key, allowed_ids=catalog_ids)
+
+    owner_model = Device if isinstance(obj, Device) else VirtualMachine
+    owner_field = "device_id" if isinstance(obj, Device) else "virtual_machine_id"
+    owner_ids = candidate_queryset.values_list(owner_field, flat=True)
+    actionable_owner_ids = set(
+        owner_model.objects.restrict(user, "view").filter(pk__in=owner_ids).values_list("pk", flat=True)
+    )
+    permitted_queryset = candidate_queryset.filter(**{f"{owner_field}__in": actionable_owner_ids})
+    viewable_ids = set(permitted_queryset.restrict(user, "view").values_list("pk", flat=True))
+    changeable_ids = set(permitted_queryset.restrict(user, "change").values_list("pk", flat=True))
+    display_index = build_interface_index(obj, server_key, allowed_ids=viewable_ids | changeable_ids)
+    source_index = filter_interface_index(display_index, changeable_ids)
+    return RelationshipResolutionContext(
+        obj=obj,
+        server_key=server_key,
+        catalog_index=catalog_index,
+        display_index=display_index,
+        related_index=display_index,
+        source_index=source_index,
+        actionable_owner_ids=actionable_owner_ids,
+        changeable_interface_ids=changeable_ids,
+        can_write=can_write,
+    )
+
+
+def enrich_port_relationships(
+    port,
+    relationship_maps,
+    interface_name_field="ifName",
+    server_key="",
+):
+    """Add LAG and parent comparison fields to a cached port row."""
+    port_id = normalize_librenms_port_id(port.get("port_id"))
+    netbox_interface = port.get("netbox_interface")
+
+    def related_interface_matches(netbox_related, librenms_related):
+        if netbox_related is None or librenms_related is None:
+            return False
+        stored_id = normalize_librenms_port_id(
+            get_librenms_device_id(netbox_related, server_key or "default", auto_save=False)
+        )
+        target_id = normalize_librenms_port_id(librenms_related.get("port_id"))
+        if stored_id is not None and target_id is not None:
+            return stored_id == target_id
+        return netbox_related.name in (
+            librenms_related.get("ifName"),
+            librenms_related.get("ifDescr"),
+            librenms_related.get(interface_name_field),
+        )
+
+    def relationship_context(port_id_to_related, related_attribute):
+        related_port_id = normalize_librenms_port_id(port_id_to_related.get(port_id)) if port_id else None
+        related_port = relationship_maps.ports_by_id.get(related_port_id) if related_port_id else None
+        related_name = related_port.get(interface_name_field) if related_port else None
+        netbox_related = getattr(netbox_interface, related_attribute, None) if netbox_interface else None
+        if related_port_id and netbox_interface:
+            if netbox_related and related_interface_matches(netbox_related, related_port):
+                status = "match"
+            elif netbox_related:
+                status = "mismatch"
+            else:
+                status = "missing_nb"
+        elif related_port_id:
+            status = "missing_nb"
+        elif netbox_related:
+            status = "missing_lnms"
+        else:
+            status = None
+        return related_name, related_port_id, status
+
+    lag_name, lag_port_id, lag_status = relationship_context(relationship_maps.lag_members, "lag")
+    port["librenms_lag_name"] = lag_name
+    port["librenms_lag_port_id"] = lag_port_id
+    port["lag_sync_status"] = lag_status
+
+    parent_name, parent_port_id, parent_status = relationship_context(
+        relationship_maps.sub_interfaces,
+        "parent",
+    )
+    port["librenms_parent_name"] = parent_name
+    port["librenms_parent_port_id"] = parent_port_id
+    port["parent_sync_status"] = parent_status
+
+
+def resolve_relationship_row(
+    context,
+    port,
+    owner,
+    interface_name_field,
+    unique_host_port_ids,
+    unambiguous_name_port_ids,
+    relationship_maps,
+):
+    """Resolve and enrich one relationship row using the shared table and verify rules."""
+    port_id = normalize_librenms_port_id(port.get("port_id"))
+    if port_id is not None:
+        port["port_id"] = port_id
+    if port.get("_source") == "oob":
+        port["netbox_interface"] = None
+        port["exists_in_netbox"] = False
+        port["name_fallback_allowed"] = False
+        port["relationship_source_resolvable"] = False
+        port["lag_target_resolvable"] = False
+        port["parent_target_resolvable"] = False
+        return None
+
+    name_fallback_allowed = port_id in unambiguous_name_port_ids
+    name_hint = (port.get(interface_name_field) or "") if name_fallback_allowed else ""
+    expected_owner = interface_owner_for_object(owner)
+    resolved_interface = None
+    if port_id is not None:
+        resolved_interface, _ = resolve_interface_by_port_id(
+            context.obj,
+            str(port_id),
+            context.server_key,
+            name_hint=name_hint,
+            expected_owner=expected_owner,
+            index=context.display_index,
+        )
+    port["netbox_interface"] = resolved_interface
+    port["exists_in_netbox"] = resolved_interface is not None
+    port["name_fallback_allowed"] = name_fallback_allowed and resolved_interface is not None
+
+    source_is_resolvable = False
+    if (
+        context.can_write
+        and owner.pk in context.actionable_owner_ids
+        and port_id in unique_host_port_ids
+        and resolved_interface is not None
+    ):
+        catalog_matches = context.catalog_index["by_lnms_id"].get(port_id, [])
+        if catalog_matches:
+            source_is_resolvable = (
+                len(catalog_matches) == 1
+                and catalog_matches[0].pk == resolved_interface.pk
+                and resolved_interface.pk in context.changeable_interface_ids
+            )
+        elif name_fallback_allowed:
+            source_interface, error = resolve_interface_by_port_id(
+                context.obj,
+                str(port_id),
+                context.server_key,
+                name_hint=name_hint,
+                expected_owner=expected_owner,
+                index=context.source_index,
+            )
+            source_is_resolvable = error is None and getattr(source_interface, "pk", None) == resolved_interface.pk
+    port["relationship_source_resolvable"] = source_is_resolvable
+
+    enrich_port_relationships(port, relationship_maps, interface_name_field, context.server_key)
+    for relation in ("lag", "parent"):
+        related_port_id = port.get(f"librenms_{relation}_port_id")
+        related_port = relationship_maps.ports_by_id.get(related_port_id)
+        related_interface = None
+        if related_port is not None and related_port_id in unique_host_port_ids:
+            related_name_hint = (
+                (related_port.get(interface_name_field) or "") if related_port_id in unambiguous_name_port_ids else ""
+            )
+            catalog_interface, catalog_error = resolve_interface_by_port_id(
+                context.obj,
+                str(related_port_id),
+                context.server_key,
+                name_hint=related_name_hint,
+                index=context.catalog_index,
+            )
+            if catalog_error is None:
+                permitted_interface, permitted_error = resolve_interface_by_port_id(
+                    context.obj,
+                    str(related_port_id),
+                    context.server_key,
+                    name_hint=related_name_hint,
+                    index=context.related_index,
+                )
+                if (
+                    permitted_error is None
+                    and catalog_interface is not None
+                    and getattr(permitted_interface, "pk", None) == catalog_interface.pk
+                ):
+                    related_interface = permitted_interface
+            if (
+                relation == "lag"
+                and related_interface is not None
+                and getattr(related_interface, "type", None) != "lag"
+                and related_interface.pk not in context.changeable_interface_ids
+            ):
+                related_interface = None
+        port[f"{relation}_target_resolvable"] = related_interface is not None
+    return resolved_interface
diff --git a/netbox_librenms_plugin/librenms_api.py b/netbox_librenms_plugin/librenms_api.py
index dcfe152a5a..bdf7d7da2e 100644
--- a/netbox_librenms_plugin/librenms_api.py
+++ b/netbox_librenms_plugin/librenms_api.py
@@ -545,6 +545,398 @@ def get_ports(self, device_id, with_vlans=True):
         except requests.exceptions.RequestException as e:
             return False, f"Error connecting to LibreNMS: {str(e)}"
 
+    def get_port_stack(self, device_id: int):
+        """
+        Fetch ifStackTable relationships from LibreNMS for a device.
+
+        Returns port_stack pairs showing parent/child interface relationships
+        (LAG membership and sub-interface nesting).
+
+        Args:
+            device_id: LibreNMS device ID
+
+        Returns:
+            tuple: (success: bool, data: list[dict] | str)
+                On success: list of {high_port_id, low_port_id, high_ifIndex, low_ifIndex} dicts
+                On failure: error string
+        """
+        try:
+            response = requests.get(
+                f"{self.librenms_url}/api/v0/devices/{device_id}/port_stack",
+                headers=self.headers,
+                timeout=DEFAULT_API_TIMEOUT,
+                verify=self.verify_ssl,
+            )
+            response.raise_for_status()
+            data = response.json()
+            # A non-object top-level payload (list, string, null) is malformed — not a valid
+            # "no relationships" answer. Fail rather than silently returning (True, []), which
+            # would be indistinguishable from "no relationships" and skip valid sync updates.
+            if not isinstance(data, dict):
+                logger.warning("Unexpected port_stack response for device %s: %r", device_id, data)
+                return False, "Unexpected response format from LibreNMS (non-object payload)"
+            # Honor an explicit error status *before* consuming mappings: an error payload can
+            # still carry mappings (e.g. {"status": "error", "message": ..., "mappings": []}),
+            # and treating that as "no relationships" would mask a real API failure and silently
+            # skip valid LAG/sub-interface sync. A genuine answer has no status (or "ok").
+            status = data.get("status")
+            if status is not None and (not isinstance(status, str) or status.lower() != "ok"):
+                # Only an absent status or a case-insensitive "ok" string is a genuine answer.
+                # A non-string status (e.g. {"status": false, "mappings": []}) is malformed and
+                # must fail the call, not be accepted as an empty "no relationships" result.
+                message = data.get("message") or "LibreNMS reported an error fetching port stack"
+                logger.warning("port_stack error status for device %s: %r", device_id, data)
+                return False, str(message)
+            mappings = data.get("mappings")
+            # The documented success envelope always contains a list-valued mappings field,
+            # including when no relationships exist. Missing, null, non-list, or mixed-list data
+            # is malformed. It must not become an authoritative empty relationship snapshot.
+            if not isinstance(mappings, list) or any(not isinstance(item, dict) for item in mappings):
+                logger.warning("Unexpected port_stack response for device %s: %r", device_id, data)
+                return False, "Unexpected response format from LibreNMS (invalid 'mappings' payload)"
+            return True, mappings
+        except requests.exceptions.HTTPError as e:
+            if e.response.status_code == 404:
+                return False, "Device not found in LibreNMS"
+            return False, f"HTTP error: {str(e)}"
+        except ValueError as e:
+            # response.json() raises ValueError (older requests) / JSONDecodeError on a non-JSON
+            # body. requests.exceptions.JSONDecodeError subclasses BOTH ValueError and
+            # RequestException, so this must precede the RequestException handler — otherwise the
+            # broad handler swallows JSON decode failures and reports "Error connecting" instead.
+            return False, f"Invalid JSON from LibreNMS: {str(e)}"
+        except requests.exceptions.RequestException as e:
+            return False, f"Error connecting to LibreNMS: {str(e)}"
+
+    def resolve_port_relationships(
+        self,
+        ports: list,
+        port_stack: list,
+        lag_patterns: dict | None = None,
+        device_os: str | None = None,
+        interface_name_field: str = "ifName",
+        compiled_lag_patterns: list | None = None,
+    ) -> dict:
+        """
+        Resolve LAG membership and sub-interface parent relationships from LibreNMS data.
+
+        Universal rules (vendor-agnostic, hardcoded):
+          1. The LAG aggregate is normally the 'low' entry in a port_stack pair, but the
+             aggregate side is determined authoritatively by _is_lag_aggregate() (ifType
+             ieee8023adLag or a configured name pattern), not by position — so a pair whose
+             aggregate is on the 'high' side is still mapped member->aggregate correctly.
+          2. Skip any pair where either port name contains ':' (Nokia SAP entries).
+          3. Strip '.N' suffix to resolve Junos sub-unit names to physical-level ports.
+          4. Sub-interface detection: a pair where one name is the other plus a numeric '.N'
+             suffix is a parent/child pair — and, like the LAG rule, the relationship is
+             position-independent, so the child may be on either the high or the low side.
+
+        Configurable via PortStackLagPattern model:
+          - Per-OS regex patterns identify LAG aggregates when ifType is not 'ieee8023adLag'.
+
+        Args:
+            ports: Port dicts from get_ports(), each with port_id, ifName, ifType keys.
+            port_stack: Port stack dicts from get_port_stack(), each with
+                        high_port_id and low_port_id keys.
+            lag_patterns: Optional dict of {librenms_os: pattern_str} overriding DB lookup.
+                          Pass an empty dict to disable name-pattern matching entirely.
+                          When None (default), patterns are fetched from PortStackLagPattern,
+                          scoped to device_os when that is provided.
+            device_os: LibreNMS OS of the device being resolved. When set (and lag_patterns
+                       is None), only that OS's pattern is loaded so a vendor-specific regex
+                       can't misclassify an interface on another platform. When None, all
+                       stored patterns are loaded (legacy, unscoped behaviour).
+            interface_name_field: Interface-name field selected for this device
+                                  ('ifName' or 'ifDescr'). Names are scanned across this
+                                  field first, then ifName and ifDescr as fallbacks, so an
+                                  ifDescr-mode device still resolves its LAG and sub-interface
+                                  relationships.
+            compiled_lag_patterns: Optional list of pre-compiled name-pattern regexes. When
+                                   provided, the PortStackLagPattern DB read and per-call
+                                   compile are skipped and this list is used directly, taking
+                                   priority over lag_patterns/device_os.
+
+        Returns:
+            dict with keys (port_ids are canonical normalized positive ints, so every
+            consumer can look up by ``normalize_librenms_port_id(...)`` without re-deriving
+            str/int fallbacks):
+                'lag_members':    {member_port_id: aggregate_port_id}
+                'sub_interfaces': {child_port_id: parent_port_id}
+        """
+        # Guard against malformed payload items (non-dict) so a single bad entry from
+        # LibreNMS doesn't crash the whole relationship resolution with AttributeError.
+        safe_ports = [p for p in ports if isinstance(p, dict)]
+
+        # Scan names across the selected interface_name_field plus ifName/ifDescr, mirroring
+        # the refresh relationship signal. On an ifDescr-mode device the aggregate or sub-unit name lives in
+        # ifDescr (ifName may be empty), so keying only on ifName here would drop every such port
+        # from the lookup maps and silently resolve no relationships even though the port_stack
+        # fetch was triggered. dict.fromkeys de-dups while preserving precedence order.
+        name_fields = tuple(dict.fromkeys((interface_name_field or "ifName", "ifName", "ifDescr")))
+
+        def _port_name_items(port: dict) -> list[tuple[str, str]]:
+            return [(field, name) for field in name_fields if isinstance(name := port.get(field), str) and name]
+
+        def _port_names(port: dict) -> list[str]:
+            return [name for _, name in _port_name_items(port)]
+
+        from netbox_librenms_plugin.utils import normalize_librenms_port_id
+
+        # by_id indexes EVERY port with a usable port_id, even a nameless one: a port_stack pair
+        # references ports by id, and _is_lag_aggregate classifies an aggregate authoritatively by
+        # ifType (ieee8023adLag) which needs no name. Excluding nameless ports here would drop a
+        # LAG relationship the port_stack + ifType define, even though ifType alone is enough to
+        # resolve it. (All downstream NAME ops iterate _port_names(port), which is empty for a
+        # nameless port, so it simply won't match any name-based rule — no string op sees a None.)
+        by_id = {}
+        ambiguous_port_ids = set()
+        for port in safe_ports:
+            port_id = normalize_librenms_port_id(port.get("port_id"))
+            if port_id is None or port_id in ambiguous_port_ids:
+                continue
+            if port_id in by_id:
+                by_id.pop(port_id)
+                ambiguous_port_ids.add(port_id)
+                continue
+            by_id[port_id] = port
+        ports_with_id = list(by_id.values())
+        # Index each name field separately. A sub-unit in ifName must resolve only through an
+        # ifName base. An unrelated ifDescr with the same text is not evidence that both rows
+        # describe one physical interface. Drop names that are ambiguous within one field.
+        by_name_by_field: dict[str, dict[str, dict]] = {field: {} for field in name_fields}
+        ambiguous_names_by_field: dict[str, set[str]] = {field: set() for field in name_fields}
+        for p in ports_with_id:
+            for field, name in _port_name_items(p):
+                field_index = by_name_by_field[field]
+                ambiguous_names = ambiguous_names_by_field[field]
+                if name in ambiguous_names:
+                    continue
+                existing = field_index.get(name)
+                if existing is not None and normalize_librenms_port_id(
+                    existing.get("port_id")
+                ) != normalize_librenms_port_id(p.get("port_id")):
+                    del field_index[name]
+                    ambiguous_names.add(name)
+                    continue
+                field_index[name] = p
+
+        if compiled_lag_patterns is not None:
+            # Caller (e.g. the interface-refresh gating) already loaded + compiled the OS-scoped
+            # patterns for this device_os and shares them here, so the DB read + regex compile
+            # happen once per refresh instead of once in the signal check and again here.
+            compiled_patterns = compiled_lag_patterns
+        elif lag_patterns is None:
+            # OS-scoped pattern loading + compile-with-skip lives on the model so the resolver
+            # and the refresh fetch trigger can't diverge on which patterns apply. A
+            # PRESENT but unusable device_os disables name-pattern matching (returns []), so a
+            # stale vendor regex can't be re-globalized; structural ieee8023adLag detection is
+            # unaffected. device_os None preserves the legacy unscoped behaviour.
+            from netbox_librenms_plugin.models import PortStackLagPattern
+
+            compiled_patterns = PortStackLagPattern.compiled_patterns_for_os(device_os)
+        else:
+            import re as _re
+
+            compiled_patterns = []
+            for pattern_str in lag_patterns.values():
+                try:
+                    compiled_patterns.append(_re.compile(pattern_str))
+                except (_re.error, TypeError) as exc:
+                    # A configured pattern with a typo'd regex (re.error) or a non-string value
+                    # (TypeError — the caller-supplied dict isn't guaranteed strings like the
+                    # DB-backed path is) is skipped rather than crashing resolution — logged so the
+                    # user can tell why LAG detection isn't working.
+                    logger.warning("Skipping invalid LAG name pattern %r: %s", pattern_str, exc)
+
+        lag_members: dict = {}
+        sub_interfaces: dict = {}
+        conflicted_lag_members: set = set()
+        conflicted_sub_interfaces: set = set()
+
+        def _is_lag_aggregate(port: dict) -> bool:
+            if port.get("ifType") == "ieee8023adLag":
+                return True
+            return any(pat.search(name) for pat in compiled_patterns for name in _port_names(port))
+
+        def _relate(mapping: dict, conflicted_keys: set, key_port: dict, value_port: dict) -> None:
+            """
+            Store a normalized ``port_id -> port_id`` edge in ``mapping``.
+
+            The maps are keyed AND valued by the canonical normalized port_id (a positive int
+            via ``normalize_librenms_port_id``), so every consumer can look up by the same
+            normalizer without re-deriving str/int fallbacks per call. ports and port_stack are
+            independent LibreNMS payloads (one may carry string ids, the other ints);
+            normalizing both sides at the source makes the maps type-agnostic and
+            self-consistent. A side whose id won't normalize is dropped rather than stored raw.
+            """
+            key_id = normalize_librenms_port_id(key_port.get("port_id"))
+            value_id = normalize_librenms_port_id(value_port.get("port_id"))
+            if key_id is None or value_id is None or key_id in conflicted_keys:
+                return
+            existing = mapping.get(key_id)
+            if existing is None:
+                mapping[key_id] = value_id
+            elif existing != value_id:
+                mapping.pop(key_id, None)
+                conflicted_keys.add(key_id)
+
+        def _resolve_physical_port(port: dict):
+            """
+            Resolve a port to its physical-level port, stripping a Junos sub-unit ``.N`` suffix.
+
+            Scans ALL known names (not just the primary), mirroring the SAP and sub-unit guards:
+            with interface_name_field="ifDescr" the structured ``xe-0/0/0.0`` / ``ae1.0`` name can
+            live in ifName while the primary (ifDescr) carries an arbitrary label. A primary-only
+            check would then fail to collapse the logical pair, and LAG sync would bind the wrong
+            (logical) ports — e.g. ``202 -> 204`` instead of the physical ``201 -> 203``.
+            """
+            for field, name in _port_name_items(port):
+                if "." not in name:
+                    continue
+                base, suffix = name.rsplit(".", 1)
+                # Only treat a NUMERIC suffix as a sub-unit (e.g. Gi0/1.100, ae1.0). A dotted name
+                # whose suffix isn't a number is a legitimate physical name, not a sub-interface,
+                # so it must not be remapped to a spurious base.
+                if suffix.isdigit() and base in by_name_by_field[field]:
+                    return by_name_by_field[field][base]
+            return port
+
+        def _is_sub_unit_of(child_name: str, parent_name: str) -> bool:
+            """True when child_name is parent_name + '.<digits>' (a numeric sub-interface)."""
+            if not child_name.startswith(parent_name + "."):
+                return False
+            return child_name[len(parent_name) + 1 :].isdigit()
+
+        def _has_sub_unit_relationship(child_port: dict, parent_port: dict) -> bool:
+            """
+            Return True when child_port has a numeric sub-unit name relationship to parent_port.
+
+            Scans ALL known names of each port (not just the primary), mirroring the SAP guard
+            below: with interface_name_field="ifDescr" the ``.N`` sub-unit marker can live in ifName
+            while the primary (ifDescr) carries a clean name, so a primary-only check would miss it.
+            """
+            return any(
+                _is_sub_unit_of(child_name, parent_name)
+                for field in name_fields
+                if isinstance(child_name := child_port.get(field), str)
+                and isinstance(parent_name := parent_port.get(field), str)
+                and child_name
+                and parent_name
+            )
+
+        for entry in port_stack:
+            if not isinstance(entry, dict):
+                continue
+            # LibreNMS returns the ports_stack rows verbatim (api_success($device->portsStack)),
+            # so the keys are the table columns: high_port_id / low_port_id. The API docs show
+            # port_id_high / port_id_low, which no server actually sends — verified against a live
+            # instance, where an entry is {id, device_id, high_ifIndex, high_port_id, low_ifIndex,
+            # low_port_id, ifStackStatus}. Reading the documented spelling silently resolved every
+            # relationship to nothing.
+            if "high_port_id" not in entry and "low_port_id" not in entry:
+                # Neither key present: a shape change would otherwise zero out every LAG and
+                # sub-interface relationship without a single error.
+                logger.warning("Unrecognized port_stack entry shape, keys: %s", sorted(entry))
+                continue
+            high_id = entry.get("high_port_id")
+            low_id = entry.get("low_port_id")
+            # 0 (int OR string) is the ifStack sentinel for "no port" (stack top/bottom).
+            # normalize_librenms_port_id treats 0/negative/non-numeric as invalid whether the API
+            # returned the id as an int or a string, so the sentinel skip stays consistent with the
+            # canonical integer keys in by_id. A bare ``not low_id`` would let a truthy string "0"
+            # fall through to the by_id lookup.
+            normalized_high_id = normalize_librenms_port_id(high_id)
+            normalized_low_id = normalize_librenms_port_id(low_id)
+            if normalized_high_id is None or normalized_low_id is None:
+                continue
+
+            high_port = by_id.get(normalized_high_id)
+            low_port = by_id.get(normalized_low_id)
+            if not high_port or not low_port:
+                continue
+
+            # Universal rule: skip Nokia SAP entries (colon notation: lag1:0, lag-1:10). Check
+            # ALL known names, not just the primary: when interface_name_field="ifDescr" a SAP port
+            # can carry a clean ifDescr but the real lag1:0 marker in ifName, so a primary-only
+            # check would miss it and misclassify the row as a LAG/sub-interface relationship.
+            if any(":" in name for name in _port_names(high_port)) or any(
+                ":" in name for name in _port_names(low_port)
+            ):
+                continue
+
+            # Sub-interface detection: the child name is parent + '.<digits>'. port_stack
+            # ordering is NOT guaranteed (the LAG branch below is already position-independent,
+            # and ifStack can emit the sub-interface as either the high or the low side), so
+            # check BOTH directions. Without the reverse check a parent=low/child=high pair
+            # falls through to the LAG branch, where _resolve_physical_port collapses both ports to
+            # the same base and the self-reference guard silently drops the relationship.
+            low_is_child = _has_sub_unit_relationship(low_port, high_port)
+            high_is_child = _has_sub_unit_relationship(high_port, low_port)
+            if low_is_child and high_is_child:
+                continue
+            if low_is_child:
+                _relate(
+                    sub_interfaces,
+                    conflicted_sub_interfaces,
+                    low_port,
+                    high_port,
+                )  # low is the child, high the parent
+                continue
+            if high_is_child:
+                _relate(
+                    sub_interfaces,
+                    conflicted_sub_interfaces,
+                    high_port,
+                    low_port,
+                )  # high is the child, low the parent
+                continue
+
+            # LAG membership: resolve each side to its physical-level port (strips the Junos
+            # sub-unit .N suffix), checking every known name so an ifDescr-mode device whose
+            # structured name lives in ifName still collapses to the physical port.
+            high_phys = _resolve_physical_port(high_port)
+            low_phys = _resolve_physical_port(low_port)
+            if not high_phys or not low_phys:
+                continue
+
+            if normalize_librenms_port_id(high_phys.get("port_id")) == normalize_librenms_port_id(
+                low_phys.get("port_id")
+            ):
+                continue  # Same port after physical resolution — skip self-references
+
+            low_is_agg = _is_lag_aggregate(low_phys)
+            high_is_agg = _is_lag_aggregate(high_phys)
+
+            if low_is_agg and high_is_agg:
+                # Both sides look like aggregates — a too-broad configured lag_name_pattern
+                # matched the member's name too (e.g. 'bond' matching both bond0 and
+                # bond0-slave). Disambiguate with the authoritative STRUCTURAL signal: the port
+                # whose ifType is ieee8023adLag is the real aggregate. Resolve only when exactly
+                # one side is structural; if neither (or both) is, we genuinely can't tell which
+                # is the aggregate, so skip rather than guess a wrong membership.
+                low_struct = low_phys.get("ifType") == "ieee8023adLag"
+                high_struct = high_phys.get("ifType") == "ieee8023adLag"
+                if low_struct and not high_struct:
+                    _relate(lag_members, conflicted_lag_members, high_phys, low_phys)
+                elif high_struct and not low_struct:
+                    _relate(lag_members, conflicted_lag_members, low_phys, high_phys)
+            elif low_is_agg:
+                _relate(
+                    lag_members,
+                    conflicted_lag_members,
+                    high_phys,
+                    low_phys,
+                )  # high is the member, low the aggregate
+            elif high_is_agg:
+                _relate(
+                    lag_members,
+                    conflicted_lag_members,
+                    low_phys,
+                    high_phys,
+                )  # low is the member, high the aggregate
+
+        return {"lag_members": lag_members, "sub_interfaces": sub_interfaces}
+
     def add_device(self, data):
         """
         Add a device to LibreNMS.
diff --git a/netbox_librenms_plugin/migrations/0013_portstacklagpattern.py b/netbox_librenms_plugin/migrations/0013_portstacklagpattern.py
new file mode 100644
index 0000000000..81761457dc
--- /dev/null
+++ b/netbox_librenms_plugin/migrations/0013_portstacklagpattern.py
@@ -0,0 +1,94 @@
+import netbox.models.deletion
+import netbox_librenms_plugin.models
+import taggit.managers
+import utilities.json
+from django.db import migrations, models
+
+INITIAL_LAG_PATTERNS = [
+    ("ios", r"^Po\d+$"),
+    ("iosxe", r"^Po\d+$"),
+    ("iosxr", r"^Bundle-Ether\d+$"),
+    ("timos", r"^lag-\d+$"),
+    ("junos", r"^ae\d+$"),
+    ("arcos", r"^bond\d+$"),
+]
+
+
+def populate_patterns(apps, schema_editor):
+    db_alias = schema_editor.connection.alias
+    PortStackLagPattern = apps.get_model("netbox_librenms_plugin", "PortStackLagPattern")
+    for os_name, pattern in INITIAL_LAG_PATTERNS:
+        PortStackLagPattern.objects.using(db_alias).get_or_create(
+            librenms_os=os_name,
+            defaults={"lag_name_pattern": pattern},
+        )
+
+
+def remove_patterns(apps, schema_editor):
+    db_alias = schema_editor.connection.alias
+    PortStackLagPattern = apps.get_model("netbox_librenms_plugin", "PortStackLagPattern")
+    for os_name, pattern in INITIAL_LAG_PATTERNS:
+        PortStackLagPattern.objects.using(db_alias).filter(
+            librenms_os=os_name,
+            lag_name_pattern=pattern,
+        ).delete()
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        # Pinned to the NetBox 4.2 floor declared by ``min_version`` in
+        # ``netbox_librenms_plugin/__init__.py`` (and the 4.2–4.5 range in README), matching
+        # sibling 0010. PortStackLagPattern is a plain NetBoxModel that only references
+        # ``extras.Tag``/``TaggedItem`` (via taggit) — all present in 4.2.x — so it needs
+        # nothing from the 4.3-era 0138. ``makemigrations`` will try to bump this to the dev
+        # environment's NetBox tip; revert it unless we actually start depending on a newer field.
+        ("extras", "0122_charfield_null_choices"),
+        ("netbox_librenms_plugin", "0012_normalize_device_serials"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="PortStackLagPattern",
+            fields=[
+                ("id", models.BigAutoField(auto_created=True, primary_key=True, serialize=False)),
+                ("created", models.DateTimeField(auto_now_add=True, null=True)),
+                ("last_updated", models.DateTimeField(auto_now=True, null=True)),
+                (
+                    "custom_field_data",
+                    models.JSONField(blank=True, default=dict, encoder=utilities.json.CustomFieldJSONEncoder),
+                ),
+                (
+                    "librenms_os",
+                    models.CharField(
+                        help_text="LibreNMS OS identifier (e.g. 'ios', 'timos', 'junos')",
+                        max_length=50,
+                        unique=True,
+                    ),
+                ),
+                (
+                    "lag_name_pattern",
+                    models.CharField(
+                        help_text=(
+                            "Regular expression matching LAG aggregate interface names. "
+                            "Used as fallback when ifType is not 'ieee8023adLag'. "
+                            r"Example: ^Po\d+$"
+                        ),
+                        max_length=200,
+                    ),
+                ),
+                ("description", models.TextField(blank=True)),
+                ("tags", taggit.managers.TaggableManager(through="extras.TaggedItem", to="extras.Tag")),
+            ],
+            options={
+                "verbose_name": "Port Stack LAG Pattern",
+                "verbose_name_plural": "Port Stack LAG Patterns",
+                "ordering": ["librenms_os"],
+            },
+            bases=(
+                netbox_librenms_plugin.models.FullCleanOnSaveMixin,
+                netbox.models.deletion.DeleteMixin,
+                models.Model,
+            ),
+        ),
+        migrations.RunPython(populate_patterns, remove_patterns),
+    ]
diff --git a/netbox_librenms_plugin/migrations/0014_portstacklagpattern_ci_unique.py b/netbox_librenms_plugin/migrations/0014_portstacklagpattern_ci_unique.py
new file mode 100644
index 0000000000..9860b0041f
--- /dev/null
+++ b/netbox_librenms_plugin/migrations/0014_portstacklagpattern_ci_unique.py
@@ -0,0 +1,98 @@
+from django.db import migrations, models
+from django.db.models.functions import Lower
+
+
+_PYTHON_STRIP_WHITESPACE = (
+    "\t\n\v\f\r\x1c\x1d\x1e\x1f \x85\xa0"
+    "\u1680\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200a\u2028\u2029\u202f\u205f\u3000"
+)
+
+
+def normalize_librenms_os_case(apps, schema_editor):
+    """Canonicalize librenms_os and fail clearly on real duplicates before the CI-unique.
+
+    UniqueConstraint(Lower("librenms_os")) is validated against existing rows the instant it is
+    added, so a database the old case-sensitive unique let accumulate both "ios" and "IOS" would
+    fail this migration with an opaque IntegrityError at deploy time. Detect genuine
+    case-insensitive collisions first and abort with an actionable message (they need a human
+    merge — the migration can't know which pattern wins); then rewrite the surviving rows to the
+    same canonical form clean() already writes on every save, so a full_clean-bypassing insert
+    (bulk_create / raw SQL / loaddata) can't leave a noncanonical value behind the constraint.
+
+    Normalize with ``.strip().lower()`` — exactly what ``clean()`` applies — NOT a bare ``Lower()``:
+    rows a bypassing path left as ``" IOS "`` and ``"ios"`` are the same pattern to ``clean()`` but
+    differ under ``Lower()`` alone, so a Lower()-only collision check would miss them and a
+    Lower()-only rewrite would leave the surrounding whitespace behind the new constraint.
+
+    All reads and writes are pinned to the migration's database alias (like sibling migrations
+    0013/0015): unrouted ``objects.all()`` would consult the default router, so
+    ``migrate --database=other`` would normalize rows on the wrong database and leave the target
+    database to fail the AddConstraint with an opaque IntegrityError.
+    """
+    PortStackLagPattern = apps.get_model("netbox_librenms_plugin", "PortStackLagPattern")
+    db_alias = schema_editor.connection.alias
+    seen_pk_by_value = {}
+    collisions = set()
+    normalized_by_pk = {}
+    for pattern in PortStackLagPattern.objects.using(db_alias).all():
+        normalized = (pattern.librenms_os or "").strip().lower()
+        if not normalized:
+            raise RuntimeError(
+                "Cannot add the case-insensitive PortStackLagPattern.librenms_os uniqueness: a row "
+                "has a blank librenms_os after normalization; fix it by hand first."
+            )
+        if seen_pk_by_value.get(normalized, pattern.pk) != pattern.pk:
+            collisions.add(normalized)
+        seen_pk_by_value.setdefault(normalized, pattern.pk)
+        normalized_by_pk[pattern.pk] = normalized
+    if collisions:
+        raise RuntimeError(
+            "Cannot add the case-insensitive PortStackLagPattern.librenms_os uniqueness: these "
+            "values already have case-variant duplicates that must be merged by hand first: "
+            + ", ".join(sorted(collisions))
+        )
+    for pattern in PortStackLagPattern.objects.using(db_alias).all():
+        normalized = normalized_by_pk[pattern.pk]
+        if pattern.librenms_os != normalized:
+            pattern.librenms_os = normalized
+            pattern.save(using=db_alias, update_fields=["librenms_os"])
+
+
+class Migration(migrations.Migration):
+    # Depend only on 0013_portstacklagpattern (which already pins extras to 0122 for the
+    # supported NetBox 4.2+ range). makemigrations tried to bump the extras dependency to a
+    # 4.3-era tip, but this migration adds nothing that needs a newer field, so keep it minimal
+    # — same rationale as the dependency note in 0013_portstacklagpattern.
+    dependencies = [
+        ("netbox_librenms_plugin", "0013_portstacklagpattern"),
+    ]
+
+    operations = [
+        # Drop the case-sensitive column unique: at the DB level it let "ios" and "IOS" coexist
+        # even though compiled_patterns_for_os reads librenms_os case-insensitively
+        # (librenms_os__iexact), making the per-OS LAG-pattern fallback ambiguous. help_text is
+        # carried verbatim from the model so makemigrations sees no residual field drift.
+        migrations.AlterField(
+            model_name="portstacklagpattern",
+            name="librenms_os",
+            field=models.CharField(
+                help_text="LibreNMS OS identifier (e.g. 'ios', 'timos', 'junos')",
+                max_length=50,
+            ),
+        ),
+        # Pre-clean before the constraint is validated: canonicalize any mixed-case rows an old
+        # full_clean-bypassing path may have left and abort with a clear message if genuine
+        # case-variant duplicates exist, instead of letting AddConstraint fail with an opaque
+        # IntegrityError at deploy time. noop reverse (lowercasing isn't reversible).
+        migrations.RunPython(normalize_librenms_os_case, migrations.RunPython.noop),
+        # Use BTRIM with Python's full whitespace set. PostgreSQL's default removes only spaces,
+        # while clean() uses str.strip(). The database must enforce the same canonical key for
+        # paths that bypass full_clean (bulk_create, raw SQL, or loaddata).
+        migrations.AddConstraint(
+            model_name="portstacklagpattern",
+            constraint=models.UniqueConstraint(
+                Lower(models.Func("librenms_os", models.Value(_PYTHON_STRIP_WHITESPACE), function="BTRIM")),
+                name="unique_portstacklagpattern_librenms_os_ci",
+            ),
+        ),
+    ]
diff --git a/netbox_librenms_plugin/models.py b/netbox_librenms_plugin/models.py
index e8aa8dec77..4a0623dd6a 100644
--- a/netbox_librenms_plugin/models.py
+++ b/netbox_librenms_plugin/models.py
@@ -7,6 +7,7 @@
 from dcim.models import DeviceType, Manufacturer, ModuleType, Platform
 from django.core.exceptions import ValidationError
 from django.db import models
+from django.db.models.functions import Lower
 from django.urls import reverse
 from netbox.models import NetBoxModel
 
@@ -14,6 +15,19 @@
 
 logger = logging.getLogger(__name__)
 
+# Characters removed by Python's no-argument str.strip(). PostgreSQL BTRIM removes only ASCII
+# spaces when its second argument is absent, so pass this set explicitly wherever the database
+# must enforce the same normalization as PortStackLagPattern.clean().
+_PYTHON_STRIP_WHITESPACE = (
+    "\t\n\v\f\r\x1c\x1d\x1e\x1f \x85\xa0"
+    "\u1680\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200a\u2028\u2029\u202f\u205f\u3000"
+)
+
+
+def _trim_python_whitespace(expression):
+    """Return a PostgreSQL expression with Python ``str.strip()`` semantics."""
+    return models.Func(expression, models.Value(_PYTHON_STRIP_WHITESPACE), function="BTRIM")
+
 
 def _validate_replacement_template(compiled: re.Pattern, replacement: str) -> None:
     """Verify that *replacement* is a valid back-reference template for *compiled*.
@@ -916,3 +930,129 @@ def to_yaml(self):
             "description": self.description,
         }
         return yaml.dump(data, sort_keys=False)
+
+
+class PortStackLagPattern(FullCleanOnSaveMixin, NetBoxModel):
+    """
+    Maps a LibreNMS OS name to the regex identifying LAG aggregate interfaces.
+
+    Used as fallback when a port's ifType is not 'ieee8023adLag'.
+    Example: Cisco IOS port-channels have ifType='propVirtual' and need name-based
+    identification via pattern '^Po\\d+$'.
+
+    Universal rules (hardcoded, vendor-agnostic):
+      - LAG aggregate is normally the 'low' entry in a port_stack pair, but the
+        aggregate side is determined authoritatively by ifType or this pattern, so a
+        pair whose aggregate is on the 'high' side is still mapped member->aggregate.
+      - Pairs where either name contains ':' are skipped (Nokia SAP entries).
+      - .N suffix is stripped for name resolution (handles Junos sub-unit pairing).
+    """
+
+    librenms_os = models.CharField(
+        max_length=50,
+        help_text="LibreNMS OS identifier (e.g. 'ios', 'timos', 'junos')",
+    )
+    lag_name_pattern = models.CharField(
+        max_length=200,
+        help_text=(
+            "Regular expression matching LAG aggregate interface names. "
+            "Used as fallback when ifType is not 'ieee8023adLag'. "
+            r"Example: ^Po\d+$"
+        ),
+    )
+    description = models.TextField(blank=True)
+
+    @functools.cached_property
+    def _compiled_pattern(self):
+        """Compiled lag_name_pattern regex, or None when it doesn't compile (skipped, not fatal)."""
+        try:
+            return re.compile(self.lag_name_pattern)
+        except re.error:
+            return None
+
+    @classmethod
+    def compiled_patterns_for_os(cls, device_os):
+        """
+        Return the compiled lag_name_pattern regexes scoped to *device_os*.
+
+        Single home for the OS-scoping + compile-with-skip used by both the relationship
+        resolver and the lazy port_stack-fetch trigger, so the two can't
+        disagree on which patterns apply. ``device_os=None`` loads every stored pattern (legacy
+        unscoped behaviour); a present-but-blank/non-string OS returns none (an unknown OS must
+        not re-globalize every vendor's regex); otherwise the patterns whose ``librenms_os``
+        matches after the same trim/lower normalization as the database constraint. Patterns
+        that fail to compile are skipped and logged.
+        """
+        if device_os is None:
+            queryset = cls.objects.all()
+        else:
+            os_filter = device_os.strip() if isinstance(device_os, str) else ""
+            if not os_filter:
+                return []
+            queryset = cls.objects.annotate(
+                normalized_librenms_os=Lower(_trim_python_whitespace("librenms_os"))
+            ).filter(normalized_librenms_os=os_filter.lower())
+        compiled = []
+        for pattern in queryset:
+            regex = pattern._compiled_pattern
+            if regex is None:
+                logger.warning(
+                    "Skipping invalid LAG name pattern for OS %r: %r",
+                    pattern.librenms_os,
+                    pattern.lag_name_pattern,
+                )
+                continue
+            compiled.append(regex)
+        return compiled
+
+    def clean(self):
+        """Validate OS name is non-blank and lag_name_pattern is a valid regex."""
+        super().clean()
+        # Invalidate the cached compiled pattern so it recompiles from the edited value.
+        self.__dict__.pop("_compiled_pattern", None)
+        os_name = (self.librenms_os or "").strip().lower()
+        if not os_name:
+            raise ValidationError({"librenms_os": "OS name must not be blank."})
+        self.librenms_os = os_name
+        lag_pattern = (self.lag_name_pattern or "").strip()
+        if not lag_pattern:
+            raise ValidationError({"lag_name_pattern": "Pattern must not be blank."})
+        self.lag_name_pattern = lag_pattern
+        # ReDoS note (low severity, accepted): see validate_regex_field, which documents
+        # the admin-supplied-pattern risk and centralizes the compile/validation path.
+        validate_regex_field(self.lag_name_pattern, "lag_name_pattern")
+
+    def get_absolute_url(self):
+        """Return URL for this pattern's detail page."""
+        return reverse("plugins:netbox_librenms_plugin:portstacklagpattern_detail", args=[self.pk])
+
+    def to_yaml(self):
+        data = {
+            "librenms_os": self.librenms_os,
+            "lag_name_pattern": self.lag_name_pattern,
+            "description": self.description,
+        }
+        return yaml.dump(data, sort_keys=False)
+
+    class Meta:
+        """Meta options for PortStackLagPattern."""
+
+        ordering = ["librenms_os"]
+        verbose_name = "Port Stack LAG Pattern"
+        verbose_name_plural = "Port Stack LAG Patterns"
+        constraints = [
+            # Enforce the same trimmed, case-insensitive key that the OS-scoped pattern lookup
+            # reads. A plain unique=True is case-sensitive, so at the DB level "ios" and "IOS"
+            # could coexist and both apply to one device, making the per-OS fallback ambiguous.
+            # clean() already normalizes with .strip().lower() on every save. BTRIM with Python's
+            # full whitespace set makes the database enforce the same canonical form for paths
+            # that skip full_clean, such as bulk_create, raw SQL, or loaddata. Lower() alone would
+            # let " ios " coexist with "ios".
+            models.UniqueConstraint(
+                Lower(_trim_python_whitespace("librenms_os")),
+                name="unique_portstacklagpattern_librenms_os_ci",
+            ),
+        ]
+
+    def __str__(self):
+        return f"{self.librenms_os} -> {self.lag_name_pattern}"
diff --git a/netbox_librenms_plugin/static/netbox_librenms_plugin/js/librenms_sync.js b/netbox_librenms_plugin/static/netbox_librenms_plugin/js/librenms_sync.js
index 78a7685888..15283635bb 100644
--- a/netbox_librenms_plugin/static/netbox_librenms_plugin/js/librenms_sync.js
+++ b/netbox_librenms_plugin/static/netbox_librenms_plugin/js/librenms_sync.js
@@ -307,7 +307,7 @@ function initializeTableCheckboxes(tableId) {
     // toggle/shift handlers from re-binding on a SURVIVING <thead> toggle; a NodeList captured once
     // would then go stale, so select-all / shift-range would iterate detached checkboxes and miss
     // the rows a later row-level swap injected.
-    const liveCheckboxes = () => Array.from(table.querySelectorAll('td input[name="select"]'));
+    const liveCheckboxes = () => Array.from(table.querySelectorAll('td input[name="select"]:not(:disabled)'));
     const toggleAll = table.querySelector('th input.toggle');
     // Persist the shift-range anchor on the TABLE element, not in a per-call closure. This
     // initializer re-runs on every htmx:afterSwap: checkboxes bound in an earlier run keep their
@@ -327,6 +327,14 @@ function initializeTableCheckboxes(tableId) {
         toggleAll.addEventListener('change', function () {
             liveCheckboxes().forEach(checkbox => {
                 checkbox.checked = toggleAll.checked;
+                // Explicitly (de)selecting every box: clear any data-auto-selected marker a child
+                // set on a parent before this loop reached it, so unchecking the last child can't
+                // later auto-deselect a parent the user included via select-all.
+                delete checkbox.dataset.autoSelected;
+                // Fire a bubbling change so the auto-select handler (cross-page parent /
+                // LAG member inclusion) runs for select-all too, not just single clicks.
+                // That handler is idempotent, so a double fire is harmless.
+                checkbox.dispatchEvent(new Event('change', { bubbles: true }));
             });
         });
     }
@@ -350,6 +358,12 @@ function initializeTableCheckboxes(tableId) {
                 if (start !== -1 && end !== -1) {
                     current.slice(Math.min(start, end), Math.max(start, end) + 1).forEach(cb => {
                         cb.checked = anchor.checked;
+                        // Explicit range selection: clear a stale data-auto-selected marker so a later
+                        // last-child uncheck can't auto-deselect a parent the user shift-selected.
+                        delete cb.dataset.autoSelected;
+                        // Fire change so shift-range selection runs the same auto-select logic
+                        // (cross-page parent / LAG member inclusion) as single clicks / select-all.
+                        cb.dispatchEvent(new Event('change', { bubbles: true }));
                     });
                 }
             }
@@ -373,6 +387,209 @@ function initializeCheckboxes() {
     initializeTableCheckboxes('librenms-module-table');
 }
 
+/**
+ * Auto-select LAG member rows when a LAG row checkbox is toggled.
+ * Reads data-port-id on the LAG row and checks all rows with
+ * data-member-of-lag matching that port_id.
+ *
+ * Also auto-selects the parent interface row when a sub-interface checkbox
+ * is toggled. Reads data-parent-port-id on the sub-interface row and finds
+ * the parent row by tr[data-port-id]. When the parent is on a different page,
+ * the server expands the cached relationship map and a brief notice is shown.
+ *
+ * Both behaviours are controlled by the #autoSelectLagMembers toggle.
+ */
+document.addEventListener('change', function (e) {
+    const checkbox = e.target;
+    if (!checkbox.matches('input[name="select"]') || checkbox.disabled) return;
+
+    const toggle = document.getElementById('autoSelectLagMembers');
+    const autoSelectEnabled = Boolean(toggle && toggle.checked);
+
+    const row = checkbox.closest('tr');
+    if (!row) return;
+
+    let changed = false;
+
+    // A checkbox that is now unchecked is no longer an auto-kept selection; drop the marker so a
+    // later manual re-check is treated as intentional (and not auto-undone with its children).
+    if (!checkbox.checked && checkbox.dataset.autoSelected) {
+        delete checkbox.dataset.autoSelected;
+    }
+
+    // --- LAG: check/uncheck all members ---
+    // Each member the aggregate pulls in is marked data-auto-selected, and the uncheck side
+    // retracts ONLY marked members — so a member the user ticked manually before touching the
+    // aggregate survives toggling it off. Still skipped for synthetic parent-UNWIND events (see
+    // the uncheck path below): that event already retracted an auto-selected parent directly, so
+    // cascading it through here would only redundantly re-toggle the aggregate's members.
+    const portId = row.dataset.portId;
+    if (autoSelectEnabled && portId && !(e.detail && e.detail.lnmsParentUnwind)) {
+        const memberRows = document.querySelectorAll('tr[data-member-of-lag="' + CSS.escape(portId) + '"]');
+        memberRows.forEach(function (memberRow) {
+            const memberCheckbox = memberRow.querySelector('input[name="select"]');
+            if (!memberCheckbox || memberCheckbox.disabled) return;
+            if (checkbox.checked) {
+                // Aggregate checked: pull in each member not already selected, marking it
+                // auto-selected so unchecking the aggregate can retract ONLY what it added. A
+                // member already checked (manually or otherwise) keeps its state and marker.
+                if (!memberCheckbox.checked) {
+                    memberCheckbox.checked = true;
+                    memberCheckbox.dataset.autoSelected = 'true';
+                    // Run the same handler for the member so its own second-order rules apply
+                    // (a member that is also a sub-interface child injects/removes its parent).
+                    memberCheckbox.dispatchEvent(new Event('change', { bubbles: true }));
+                    changed = true;
+                }
+            } else if (memberCheckbox.checked && memberCheckbox.dataset.autoSelected) {
+                // Aggregate unchecked: retract ONLY members it auto-selected — a member the user
+                // ticked themselves (no marker) is preserved.
+                delete memberCheckbox.dataset.autoSelected;
+                memberCheckbox.checked = false;
+                memberCheckbox.dispatchEvent(new Event('change', { bubbles: true }));
+                changed = true;
+            }
+        });
+    }
+
+    // --- Sub-interface: select parent when checking ---
+    const parentPortId = row.dataset.parentPortId;
+    if (autoSelectEnabled && parentPortId && checkbox.checked) {
+        const parentRow = document.querySelector('tr[data-port-id="' + CSS.escape(parentPortId) + '"]');
+        if (parentRow) {
+            // Parent is on the same page - check it directly
+            const parentCheckbox = parentRow.querySelector('input[name="select"]');
+            if (parentCheckbox && !parentCheckbox.disabled && !parentCheckbox.checked) {
+                parentCheckbox.checked = true;
+                // Mark as auto-selected so the uncheck path below can undo it when the last child
+                // is cleared — without clobbering a parent the user checked themselves.
+                parentCheckbox.dataset.autoSelected = 'true';
+                // Propagate up a nested parent chain.
+                parentCheckbox.dispatchEvent(new Event('change', { bubbles: true }));
+                changed = true;
+            }
+        } else {
+            _showParentCrossPageNotice(row.dataset.parentName || parentPortId);
+        }
+    }
+
+    // --- Sub-interface: undo parent auto-selection when the last child is unchecked ---
+    // Only act once NO other still-checked child on this page references the same parent —
+    // otherwise unchecking one sibling would drop the parent the remaining siblings still need.
+    if (parentPortId && !checkbox.checked) {
+        const siblingStillChecked = Array.prototype.some.call(
+            document.querySelectorAll(
+                'tr[data-parent-port-id="' + CSS.escape(parentPortId) + '"] input[name="select"]:not(:disabled)'
+            ),
+            function (cb) { return cb !== checkbox && cb.checked; }
+        );
+        if (!siblingStillChecked) {
+            // Same-page parent: uncheck it ONLY if we auto-selected it (data-auto-selected) — a
+            // parent the user checked themselves carries no marker and is preserved. Gated on the
+            // toggle like the auto-SELECT above: with #autoSelectLagMembers off the user has taken
+            // manual control, so a leftover marker from when the toggle was on must not let this
+            // uncheck a parent they are deliberately keeping (only the hidden-input cleanup above
+            // stays always-run). Dispatch so a nested grandparent chain unwinds too — as a
+            // CustomEvent flagged lnmsParentUnwind so the LAG member propagation ignores it (it
+            // would otherwise uncheck manually-selected member rows of an aggregate parent).
+            if (autoSelectEnabled) {
+                const parentRow = document.querySelector('tr[data-port-id="' + CSS.escape(parentPortId) + '"]');
+                if (parentRow) {
+                    const parentCheckbox = parentRow.querySelector('input[name="select"]');
+                    if (
+                        parentCheckbox &&
+                        !parentCheckbox.disabled &&
+                        parentCheckbox.checked &&
+                        parentCheckbox.dataset.autoSelected
+                    ) {
+                        delete parentCheckbox.dataset.autoSelected;
+                        parentCheckbox.checked = false;
+                        parentCheckbox.dispatchEvent(
+                            new CustomEvent('change', { bubbles: true, detail: { lnmsParentUnwind: true } })
+                        );
+                        changed = true;
+                    }
+                }
+            }
+        }
+    }
+
+    if (changed) {
+        updateBulkActionButton();
+    }
+});
+
+// Keep cross-page parent notices symmetric with #autoSelectLagMembers. Turning it back on replays
+// checked child rows because their own change handlers do not otherwise run again.
+document.addEventListener('change', function (e) {
+    const toggle = e.target;
+    if (!toggle.matches('#autoSelectLagMembers')) return;
+
+    if (toggle.checked) {
+        document.querySelectorAll('input[name="select"]:checked:not(:disabled)').forEach(function (checkbox) {
+            checkbox.dispatchEvent(new Event('change', { bubbles: true }));
+        });
+        return;
+    }
+
+    const noticeContainer = document.getElementById('parent-cross-page-notices');
+    if (noticeContainer) {
+        noticeContainer.remove();
+    }
+});
+
+/**
+ * Show a brief inline notice when a sub-interface's parent is auto-included
+ * from a different page (cross-page parent selection).
+ * The notice auto-dismisses after 5 seconds.
+ * @param {string} parentName - Name of the parent interface
+ */
+function _showParentCrossPageNotice(parentName) {
+    const containerId = 'parent-cross-page-notices';
+    let container = document.getElementById(containerId);
+    if (!container) {
+        // Insert before the table (find a stable anchor inside the form)
+        const table = document.getElementById('librenms-interface-table') ||
+                      document.getElementById('librenms-interface-table-vm');
+        if (!table) return;
+        container = document.createElement('div');
+        container.id = containerId;
+        table.parentNode.insertBefore(container, table);
+    }
+
+    // Avoid duplicate notices for the same parent
+    if (container.querySelector('[data-parent="' + CSS.escape(parentName) + '"]')) return;
+
+    const notice = document.createElement('div');
+    notice.className = 'alert alert-info alert-dismissible py-1 px-2 small mb-1';
+    notice.dataset.parent = parentName;
+
+    // Build the notice via DOM nodes rather than innerHTML: parentName is interface
+    // data and must never be interpreted as HTML (DOM-XSS). textContent escapes it.
+    const icon = document.createElement('i');
+    icon.className = 'mdi mdi-information-outline me-1';
+    notice.appendChild(icon);
+    notice.appendChild(document.createTextNode('Parent interface '));
+    const strong = document.createElement('strong');
+    strong.textContent = parentName;
+    notice.appendChild(strong);
+    notice.appendChild(
+        document.createTextNode(' is on another page and will be included in the sync automatically.')
+    );
+    const closeBtn = document.createElement('button');
+    closeBtn.type = 'button';
+    closeBtn.className = 'btn-close btn-sm';
+    closeBtn.setAttribute('data-bs-dismiss', 'alert');
+    closeBtn.setAttribute('aria-label', 'Close');
+    notice.appendChild(closeBtn);
+
+    container.appendChild(notice);
+
+    setTimeout(function () {
+        if (notice.parentNode) notice.parentNode.removeChild(notice);
+    }, 5000);
+}
+
 // ============================================
 // VIRTUAL CHASSIS & VRF HANDLING
 // ============================================
@@ -393,6 +610,15 @@ function initializeVCMemberSelect() {
             interfaceSelects.forEach(select => {
                 if (select.tomselect && !select.dataset.interfaceSelectInitialized) {
                     select.dataset.interfaceSelectInitialized = 'true';
+                    // Seed the rollback baseline HERE, before the change listener is attached:
+                    // at init time select.value still reflects the originally rendered (verified)
+                    // assignment. Seeding it lazily inside handleInterfaceChange instead would run
+                    // after select.value already equals the newly-selected member, so a verify
+                    // failure would "roll back" to the rejected member.
+                    if (typeof select._lastVerifiedMember === 'undefined') {
+                        const selectedOption = select.querySelector('option[selected]');
+                        select._lastVerifiedMember = selectedOption ? selectedOption.value : select.value;
+                    }
                     select.tomselect.on('change', function (value) {
                         handleInterfaceChange(select, value);
                     });
@@ -491,7 +717,7 @@ function initializeVlanGroupSelects() {
  */
 function openVlanDetailModal(btn) {
     const interfaceName = btn.dataset.interface;
-    const safeName = btn.dataset.safeName;
+    const rowKey = btn.dataset.rowKey;
     const deviceId = btn.dataset.deviceId;
     const vlans = JSON.parse(btn.dataset.vlans);
     const vlanGroups = JSON.parse(btn.dataset.vlanGroups);
@@ -502,7 +728,7 @@ function openVlanDetailModal(btn) {
     // Store current interface context on modal for save handler
     const modal = document.getElementById('vlanDetailModal');
     modal.dataset.currentInterface = interfaceName;
-    modal.dataset.currentSafeName = safeName;
+    modal.dataset.currentRowKey = rowKey;
     modal.dataset.currentDeviceId = deviceId;
 
     // Clear any stale error from a previous save attempt
@@ -540,7 +766,7 @@ function openVlanDetailModal(btn) {
             select.className = 'form-select form-select-sm vlan-modal-group-select';
             select.dataset.vid = vlan.vid;
             select.dataset.interface = interfaceName;
-            select.dataset.safeName = safeName;
+            select.dataset.rowKey = rowKey;
 
             vlanGroups.forEach(group => {
                 const option = document.createElement('option');
@@ -554,7 +780,7 @@ function openVlanDetailModal(btn) {
 
             // On change, update the hidden input for this VLAN immediately
             select.addEventListener('change', function () {
-                updateHiddenVlanGroupInput(safeName, vlan.vid, this.value);
+                updateHiddenVlanGroupInput(rowKey, vlan.vid, this.value);
 
                 // Re-verify VLAN colors after group change
                 verifyVlanInGroup(this, deviceId, vlan.vid, vlan.type, this.value);
@@ -579,13 +805,13 @@ function openVlanDetailModal(btn) {
 /**
  * Update the hidden input for a specific VLAN group assignment.
  *
- * @param {string} safeName - Safe interface name (slashes replaced)
+ * @param {string} rowKey - Stable LibreNMS port ID
  * @param {number} vid - VLAN ID
  * @param {string} groupId - Selected group ID
  */
-function updateHiddenVlanGroupInput(safeName, vid, groupId) {
+function updateHiddenVlanGroupInput(rowKey, vid, groupId) {
     const input = document.querySelector(
-        `input.vlan-group-hidden[name="vlan_group_${safeName}_${vid}"]`
+        `input.vlan-group-hidden[name="vlan_group_${rowKey}_${vid}"]`
     );
     if (input) {
         input.value = groupId;
@@ -620,10 +846,10 @@ function verifyVlanInGroup(select, deviceId, vid, vlanType, groupId) {
     const saveBtn = document.getElementById('saveVlanGroups');
     _vlanVerifyStart(saveBtn);
 
-    // Capture safeName before the async fetch to avoid stale closure if the modal
+    // Capture rowKey before the async fetch to avoid stale closure if the modal
     // is opened for a different interface while this request is in flight.
     const modal = document.getElementById('vlanDetailModal');
-    const capturedSafeName = modal?.dataset.currentSafeName;
+    const capturedRowKey = modal?.dataset.currentRowKey;
 
     const csrfToken = getCsrfToken();
     if (!csrfToken) {
@@ -679,8 +905,8 @@ function verifyVlanInGroup(select, deviceId, vid, vlanType, groupId) {
                 }
 
                 // Update the css in the source edit button's data-vlans
-                if (capturedSafeName) {
-                    const btn = document.querySelector(`.vlan-edit-btn[data-safe-name="${capturedSafeName}"]`);
+                if (capturedRowKey) {
+                    const btn = document.querySelector(`.vlan-edit-btn[data-row-key="${capturedRowKey}"]`);
                     if (btn) {
                         try {
                             const btnVlans = JSON.parse(btn.dataset.vlans);
@@ -716,7 +942,7 @@ function initializeVlanModalSave() {
     saveBtn.addEventListener('click', function () {
         const applyToAll = document.getElementById('applyVlanGroupToAll')?.checked;
         const modalEl = document.getElementById('vlanDetailModal');
-        const currentSafeName = modalEl.dataset.currentSafeName;
+        const currentRowKey = modalEl.dataset.currentRowKey;
 
         // Collect all group selections and resolved CSS from the modal
         const modalSelects = document.querySelectorAll('#vlanDetailTableBody .vlan-modal-group-select');
@@ -736,7 +962,7 @@ function initializeVlanModalSave() {
         // Determine which buttons to update
         const buttonsToUpdate = applyToAll
             ? document.querySelectorAll('.vlan-edit-btn')
-            : document.querySelectorAll(`.vlan-edit-btn[data-safe-name="${currentSafeName}"]`);
+            : document.querySelectorAll(`.vlan-edit-btn[data-row-key="${currentRowKey}"]`);
 
         // Apply DOM mutations (btn.dataset.vlans, hidden inputs, summary spans)
         // Called only after a successful server response when persisting, or immediately otherwise.
@@ -745,12 +971,16 @@ function initializeVlanModalSave() {
                 try {
                     const btnVlans = JSON.parse(btn.dataset.vlans);
                     const groups = JSON.parse(btn.dataset.vlanGroups);
-                    const btnSafeName = btn.dataset.safeName;
+                    const btnRowKey = btn.dataset.rowKey;
                     let changed = false;
 
                     btnVlans.forEach(v => {
                         if (vidGroupMap.hasOwnProperty(String(v.vid))) {
                             const newGroupId = vidGroupMap[String(v.vid)];
+                            const matchedGroup = groups.find(g => String(g.id) === String(newGroupId));
+                            // A VC member can expose a different scoped group for the same VID.
+                            // Do not copy a source row's scoped group into a row that cannot select it.
+                            if (newGroupId && !matchedGroup) return;
                             v.group_id = newGroupId;
 
                             // Apply resolved missing/css state BEFORE computing group_name
@@ -763,7 +993,6 @@ function initializeVlanModalSave() {
                             if (v.missing) {
                                 v.group_name = 'Not in NetBox';
                             } else {
-                                const matchedGroup = groups.find(g => String(g.id) === String(newGroupId));
                                 v.group_name = matchedGroup ? matchedGroup.name : '-- No Group (Global) --';
                             }
 
@@ -771,7 +1000,7 @@ function initializeVlanModalSave() {
 
                             // Update the hidden input for this VID on this interface
                             const input = document.querySelector(
-                                `input.vlan-group-hidden[name="vlan_group_${btnSafeName}_${v.vid}"]`
+                                `input.vlan-group-hidden[name="vlan_group_${btnRowKey}_${v.vid}"]`
                             );
                             if (input) {
                                 input.value = newGroupId;
@@ -1018,16 +1247,97 @@ function handleVRFChange(select, value) {
 function handleInterfaceChange(select, value) {
     const csrfToken = getCsrfToken();
     if (!csrfToken) return;  // missing token → abort rather than throw on `.value`
+    // Abort any still-in-flight verification for this select: on rapid VC-member changes an
+    // older /verify-interface/ response can otherwise arrive after a newer one and repaint the
+    // row with stale cells/relationship controls. Mirrors handleModuleChange's AbortController.
+    if (select._interfaceVerifyController) {
+        select._interfaceVerifyController.abort();
+    }
+    const controller = new AbortController();
+    select._interfaceVerifyController = controller;
+
+    // Resolve the row from the changed <select> itself, not by data-interface: the same
+    // interface name can appear in both the main and OOB datasets, so a name lookup can
+    // post the wrong row's port_id and repaint the wrong row. closest('tr') is unique.
+    const row = select.closest('tr');
+
+    // Defensive fallback: the baseline is normally seeded at init time (initializeVCMemberSelect),
+    // before this change listener is attached, while select.value still holds the verified
+    // assignment. If for some reason it wasn't, seed it ONLY from the rendered <option selected> —
+    // NOT from select.value, which by the time this callback runs already equals the newly
+    // selected (unverified) member, so a verify failure would otherwise "roll back" to it.
+    if (typeof select._lastVerifiedMember === 'undefined') {
+        const selectedOption = select.querySelector('option[selected]');
+        select._lastVerifiedMember = selectedOption ? selectedOption.value : null;
+    }
+
+    // Disable this row's LAG/parent sync buttons while the verify is in flight. A click landing
+    // before the response repaints the row would otherwise POST the freshly-selected member's
+    // objectId together with the *previous* member's stale relationship metadata (lag/parent
+    // port_id + name) carried by the old button markup, syncing the wrong relationship.
+    // Tag the buttons *this* flow disables with data-verify-locked so re-enabling can target
+    // exactly them by re-querying the live row, rather than replaying a captured list. Two
+    // reasons: (1) on rapid changes a second handler captures an empty set (the buttons are
+    // already disabled) and the first is aborted without re-enabling — re-querying the marker
+    // lets whichever request settles last restore them; (2) the relationship sync click handler
+    // also disables its own button mid-POST (and keeps it disabled on success), so we must not
+    // re-enable a button it owns — only ones we marked. We only lock currently-enabled buttons,
+    // so a button already disabled by an in-flight sync is left untouched.
+    if (row) {
+        row.querySelectorAll('.lag-sync-btn:not([disabled]), .parent-sync-btn:not([disabled])').forEach((b) => {
+            b.disabled = true;
+            b.dataset.verifyLocked = '1';
+        });
+    }
+    const reenableRelationshipButtons = () => {
+        if (!row) return;
+        // Re-query so the request that settles last re-enables whatever is still verify-locked,
+        // even buttons a superseded (aborted) request had locked. Buttons whose cell a successful
+        // verify repainted are gone from the row (replaced by fresh enabled markup), so they're
+        // simply not found here.
+        row.querySelectorAll('.lag-sync-btn[data-verify-locked], .parent-sync-btn[data-verify-locked]').forEach((b) => {
+            delete b.dataset.verifyLocked;
+            b.disabled = false;
+        });
+    };
+
+    // On a verify failure (non-success payload or a non-abort error), roll the dropdown back to
+    // the last confirmed member so the visible selection matches the row's current HTML, then
+    // re-enable the controls — the row is now consistent again and the user can retry. With no
+    // confirmed baseline yet, keep the controls locked rather than re-enabling on an unverified
+    // selection (which would let a retry post the previous member's stale lag/parent port_id).
+    const rollbackToLastVerified = () => {
+        if (select._lastVerifiedMember != null) {
+            // The member control is TomSelect-enhanced, so assigning select.value alone
+            // leaves the visible dropdown showing the rejected member while the backing
+            // value rolls back — the next sync click would then post a different member
+            // than the user sees. Sync through the widget (mirrors initializeVCMemberSelect
+            // at the vcMemberSelect.tomselect.setValue call); pass silent=true so this
+            // programmatic reset doesn't re-fire the change handler.
+            if (select.tomselect && typeof select.tomselect.setValue === 'function') {
+                select.tomselect.setValue(select._lastVerifiedMember, true);
+            } else {
+                select.value = select._lastVerifiedMember;
+            }
+            reenableRelationshipButtons();
+        }
+    };
 
     fetch('/plugins/librenms_plugin/verify-interface/', {
         method: 'POST',
+        signal: controller.signal,
         headers: {
             'Content-Type': 'application/json',
             'X-CSRFToken': csrfToken
         },
         body: JSON.stringify({
             device_id: value,
+            // Keep page-level migrated mode stable when the selected VC member changes.
+            origin_device_id: row?.closest('[data-interface-origin-device-id]')?.dataset.interfaceOriginDeviceId || null,
             interface_name: select.dataset.interface,
+            // Stable port_id of this row so the server picks the correct cached row even when
+            // display names collide (host vs OOB controller); interface_name is the fallback.
+            port_id: row?.dataset.portId || null,
             interface_name_field: document.querySelector('input[name="interface_name_field"]:checked')?.value || null,
             server_key: document.querySelector('input[name="server_key"]')?.value || null
         })
@@ -1039,7 +1349,8 @@ function handleInterfaceChange(select, value) {
             return response.json();
         })
         .then(data => {
-            const row = document.querySelector(`tr[data-interface="${select.dataset.rowId}"]`);
+            // Reuse the row resolved above so the response patches the row the user changed,
+            // not the first same-named row on the page.
             if (data.status === 'success' && row) {
                 const formattedRow = data.formatted_row;
                 row.querySelector('td[data-col="name"]').innerHTML = formattedRow.name;
@@ -1049,11 +1360,49 @@ function handleInterfaceChange(select, value) {
                 row.querySelector('td[data-col="mtu"]').innerHTML = formattedRow.mtu;
                 row.querySelector('td[data-col="enabled"]').innerHTML = formattedRow.enabled;
                 row.querySelector('td[data-col="description"]').innerHTML = formattedRow.description;
+                const vlanCell = row.querySelector('td[data-col="vlans"]');
+                if (vlanCell && typeof formattedRow.vlans !== 'undefined') {
+                    vlanCell.innerHTML = formattedRow.vlans;
+                }
+                // The LibreNMS ID badge's colour is member-specific (it compares this port_id
+                // against the resolved member's stored librenms_id), so refresh it too —
+                // otherwise it keeps the previously-selected member's match/mismatch state.
+                const librenmsIdCell = row.querySelector('td[data-col="librenms_id"]');
+                if (librenmsIdCell && typeof formattedRow.librenms_id !== 'undefined') {
+                    librenmsIdCell.innerHTML = formattedRow.librenms_id;
+                }
+                // Parent/LAG relationship is device-specific, so refresh it too — otherwise
+                // it keeps the previously-selected member's status and sync button.
+                const parentCell = row.querySelector('td[data-col="parent"]');
+                if (parentCell && typeof formattedRow.parent !== 'undefined') {
+                    parentCell.innerHTML = formattedRow.parent;
+                }
+                initializeVlanGroupSelects();
                 initializeFilters();
+                // This member is now server-confirmed: record it as the rollback target and
+                // re-enable the relationship controls (the row HTML now matches this member).
+                select._lastVerifiedMember = value;
+                reenableRelationshipButtons();
+            } else {
+                // 2xx with data.status !== 'success' (application-level failure/conflict): the
+                // row was NOT repainted, so the verify-locked LAG/parent buttons still carry the
+                // previous member's lag/parent port_id. Roll the dropdown back to the last
+                // confirmed member (restoring a consistent row) before re-enabling.
+                console.error('Interface verification rejected:', data.error || data.message || 'Unknown error');
+                rollbackToLastVerified();
             }
         })
         .catch(error => {
+            // A superseded request was aborted on purpose — not an error to surface. Leave the
+            // buttons disabled: the newer handleInterfaceChange call already re-disabled them and
+            // owns re-enabling once its own verify settles.
+            if (error.name === 'AbortError') return;
+            // A genuine verify failure (HTTP error / network) means the row was NOT repainted for
+            // the newly-selected member. Roll the dropdown back to the last confirmed member so
+            // the visible selection matches the unchanged row, then re-enable — rather than
+            // stranding the user on an unverified selection with locked controls.
             console.error('Error verifying interface:', error.message);
+            rollbackToLastVerified();
         });
 }
 
@@ -1201,7 +1550,9 @@ function initializeBulkEditApply() {
             // Get all selected checkboxes within the interface table
             const interfaceTable = document.getElementById('librenms-interface-table');
             if (!interfaceTable) return;
-            const selectedCheckboxes = interfaceTable.querySelectorAll('input[name="select"]:checked');
+            const selectedCheckboxes = interfaceTable.querySelectorAll(
+                'input[name="select"]:checked:not(:disabled)'
+            );
 
             selectedCheckboxes.forEach(checkbox => {
                 const row = checkbox.closest('tr');
@@ -1226,27 +1577,14 @@ function initializeBulkEditApply() {
 function initializeCheckboxListeners() {
     const interfaceTable = document.getElementById('librenms-interface-table');
     if (!interfaceTable) return;
-    // Query live inside the handlers: the bulkToggle guard below keeps the toggle handler from
-    // re-binding on a surviving <thead> toggle across htmx:afterSwap, so a captured NodeList would
-    // go stale and select-all would skip rows added by later row-level swaps.
-    const liveCheckboxes = () => interfaceTable.querySelectorAll('input[name="select"]');
+    // Query live so a later row-level swap receives its own bulk-button listener.
+    const liveCheckboxes = () => interfaceTable.querySelectorAll('input[name="select"]:not(:disabled)');
     // Idempotent across htmx:afterSwap re-runs — register the change handler once per checkbox.
     liveCheckboxes().forEach(checkbox => {
         if (checkbox.dataset.bulkChangeInitialized === 'true') return;
         checkbox.dataset.bulkChangeInitialized = 'true';
         checkbox.addEventListener('change', updateBulkActionButton);
     });
-
-    const toggleAll = interfaceTable.querySelector('input.toggle');
-    if (toggleAll && toggleAll.dataset.bulkToggleInitialized !== 'true') {
-        toggleAll.dataset.bulkToggleInitialized = 'true';
-        toggleAll.addEventListener('change', function () {
-            liveCheckboxes().forEach(checkbox => {
-                checkbox.checked = toggleAll.checked;
-            });
-            updateBulkActionButton();
-        });
-    }
 }
 
 /**
@@ -1255,7 +1593,7 @@ function initializeCheckboxListeners() {
 function updateBulkActionButton() {
     const interfaceTable = document.getElementById('librenms-interface-table');
     if (!interfaceTable) return;
-    const anyChecked = interfaceTable.querySelectorAll('input[name="select"]:checked').length > 0;
+    const anyChecked = interfaceTable.querySelectorAll('input[name="select"]:checked:not(:disabled)').length > 0;
     const bulkButton = document.getElementById('bulk-vc-member-button');
     if (bulkButton) {
         bulkButton.disabled = !anyChecked;
@@ -2089,3 +2427,94 @@ document.addEventListener('htmx:afterSettle', function (event) {
         }
     }
 });
+
+// Event delegation for LAG and parent interface sync buttons.
+// Buttons are rendered inline in the interface table's data-col="parent" cell
+// (render_parent in tables/interfaces.py renders BOTH the LAG-sync and parent-sync
+// buttons there; there is no separate data-col="lag" cell)
+// and carry data attributes: port-id, lag-port-id / parent-port-id, object-type, object-id.
+document.addEventListener('click', function (e) {
+    const btn = e.target.closest('.lag-sync-btn, .parent-sync-btn');
+    if (!btn) return;
+    e.preventDefault();
+
+    const isLag = btn.classList.contains('lag-sync-btn');
+    const portId = btn.dataset.portId || '';
+    const relatedPortId = isLag ? (btn.dataset.lagPortId || '') : (btn.dataset.parentPortId || '');
+    const url = btn.dataset.syncUrl || '';
+    // On a Virtual Chassis page the row carries a member-select dropdown; prefer the user's
+    // live selection over the server-rendered data-object-id (a name-based heuristic), so the
+    // sync POST lands on the member the user actually chose instead of the default member.
+    const row = btn.closest('tr');
+    const vcMemberSelect = row ? row.querySelector('.vc-member-select') : null;
+    // When the row has a member-select, its value is authoritative even when blank: an empty
+    // selection is a deliberate "no member chosen" state, so it must NOT fall back to the
+    // server-rendered default member (data-object-id) — that would post the sync to the previous
+    // member. Only fall back to data-object-id when there is no select at all (non-VC page).
+    const objectId =
+        vcMemberSelect ? vcMemberSelect.value : (btn.dataset.objectId || '');
+    const relatedKey = isLag ? 'lag_port_id' : 'parent_port_id';
+
+    if (!portId || !relatedPortId || !objectId || !url) {
+        btn.innerHTML = '<i class="mdi mdi-alert text-danger"></i>';
+        // A blank objectId on a VC page means no member is selected. Give that case a specific
+        // instruction, and surface malformed relationship metadata with a general explanation.
+        btn.title = vcMemberSelect && !objectId
+            ? 'Select a VC member first.'
+            : 'Required relationship data is unavailable.';
+        return;
+    }
+
+    // Fail fast: a missing input OR an empty value both POST X-CSRFToken: "" → a guaranteed
+    // 403. Surface the cause instead of firing a state-changing request that can't succeed.
+    const csrf = getCsrfToken();
+    if (!csrf) {
+        btn.title = 'CSRF token not found. Please refresh the page and try again.';
+        return;
+    }
+
+    const serverKeyInput = document.querySelector('[name=server_key]');
+    const serverKey = serverKeyInput ? serverKeyInput.value : '';
+
+    const body = new URLSearchParams({
+        csrfmiddlewaretoken: csrf,
+        port_id: portId,
+        [relatedKey]: relatedPortId,
+        interface_name_field: document.querySelector('input[name="interface_name_field"]:checked')?.value || '',
+        server_key: serverKey,
+    });
+
+    btn.disabled = true;
+    btn.innerHTML = '<i class="mdi mdi-loading mdi-spin"></i>';
+
+    fetch(url, {
+        method: 'POST',
+        headers: { 'X-CSRFToken': csrf, 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: body.toString(),
+    })
+        .then(function (r) {
+            if (!r.ok) {
+                // Surface the backend error text (403/500/HTML page) instead of a
+                // generic JSON parse failure.
+                return fetchErrorMessage(r).then(function (msg) {
+                    throw new Error(msg);
+                });
+            }
+            return r.json();
+        })
+        .then(function (data) {
+            if (data.status === 'success') {
+                btn.innerHTML = '<i class="mdi mdi-check text-success"></i>';
+                btn.title = data.message || 'Synced';
+            } else {
+                btn.disabled = false;
+                btn.innerHTML = '<i class="mdi mdi-alert text-danger"></i>';
+                btn.title = data.error || 'Sync failed';
+            }
+        })
+        .catch(function (e) {
+            btn.disabled = false;
+            btn.innerHTML = '<i class="mdi mdi-alert text-danger"></i>';
+            btn.title = e.message || 'Request failed';
+        });
+});
diff --git a/netbox_librenms_plugin/tables/interfaces.py b/netbox_librenms_plugin/tables/interfaces.py
index fad34b4810..4a0f4aa485 100644
--- a/netbox_librenms_plugin/tables/interfaces.py
+++ b/netbox_librenms_plugin/tables/interfaces.py
@@ -1,6 +1,9 @@
+import copy
 import json as json_module
+from functools import cached_property
 
 import django_tables2 as tables
+from django.urls import reverse
 from django.utils.html import escape, format_html
 from django.utils.safestring import mark_safe
 from netbox.tables.columns import BooleanColumn, ToggleColumn
@@ -18,17 +21,33 @@
     get_table_paginate_count,
     get_tagged_vlan_css_class,
     get_untagged_vlan_css_class,
-    get_virtual_chassis_member,
+    interface_name_fallback_matches_port,
     oob_badge_html,
     render_vc_member_options,
+    resolve_interface_row_device,
 )
 
+# (colour, mdi icon, full status text) per relationship sync status. Colour + icon read at a
+# glance; the text is the badge tooltip. Module-level so it isn't re-allocated on every
+# _render_relationship_column call (up to twice per table row — LAG + Parent).
+_RELATIONSHIP_STATUS_MAP = {
+    "match": ("success", "mdi-check-circle", "Match"),
+    "mismatch": ("warning", "mdi-alert-circle", "Mismatch"),
+    "missing_nb": ("info", "mdi-plus-circle", "Not in NetBox"),
+    "missing_lnms": ("secondary", "mdi-database-off", "Not in LibreNMS"),
+}
+
 
 class LibreNMSInterfaceTable(tables.Table):
     """
     Table for displaying LibreNMS interface data.
     """
 
+    # NetBox object class these rows sync against. Driven by the table subclass rather than
+    # a runtime ``self.device.cluster`` probe — a cluster-less VM has a falsy ``cluster`` and
+    # would otherwise be misclassified as a device, sending the sync POST to the wrong endpoint.
+    sync_object_type = "device"
+
     class Meta:
         """Meta options for LibreNMSInterfaceTable."""
 
@@ -43,6 +62,7 @@ class Meta:
             "enabled",
             "description",
             "librenms_id",
+            "parent",
         ]
         attrs = {
             "class": "table table-hover object-list",
@@ -57,24 +77,40 @@ def __init__(self, *args, device=None, interface_name_field=None, vlan_groups=No
         # Default the key so render_librenms_id's get_librenms_device_id(self.server_key) lookup
         # falls back to the "default" server entry; a None key would miss {"default": 42} values.
         self.server_key = server_key or "default"
+        # Donor "migrated mode": when set, the bulk sync form is hidden and donors must
+        # not mutate relationship state. Suppress the per-row LAG/parent sync buttons too,
+        # otherwise librenms_sync.js could still POST them and sync a migrated donor.
+        self.migrated_to_marker = False
         # Lazily-built {(librenms_type, librenms_speed): mapping} cache so render_type doesn't run
         # 1-2 InterfaceTypeMapping queries for every interface row (the table is small and static).
         self._interface_type_mapping_cache = None
 
-        # Update column accessors after initialization
-        for column in ["selection", "name"]:
-            self.base_columns[column].accessor = self.interface_name_field
-
-        # Set row attributes using interface_name_field
-        self._meta.row_attrs = {
-            "data-interface": lambda record: record.get(self.interface_name_field),
-            "data-name": lambda record: record.get(self.interface_name_field),
-            "data-enabled": lambda record: (
-                str(record.get("ifAdminStatus")).lower() if record.get("ifAdminStatus") is not None else ""
-            ),
-        }
+        # Retarget the two columns per instance. ``base_columns`` and ``_meta`` are class
+        # attributes, so writing to them here would retarget every later table in this worker
+        # process. ``extra_columns`` is applied to Table.__init__'s own copy, and the accessor
+        # must be set before it runs because BoundColumn.accessor is cached during binding.
+        # Submit the stable LibreNMS port ID: display names can collide when ifDescr is active.
+        selection_column = copy.deepcopy(type(self).base_columns["selection"])
+        selection_column.accessor = "port_id"
+        name_column = copy.deepcopy(type(self).base_columns["name"])
+        name_column.accessor = self.interface_name_field
 
-        super().__init__(*args, **kwargs)
+        super().__init__(
+            *args,
+            extra_columns=[("selection", selection_column), ("name", name_column)],
+            row_attrs={
+                "data-interface": lambda record: record.get(self.interface_name_field),
+                "data-name": lambda record: record.get(self.interface_name_field),
+                "data-enabled": lambda record: (
+                    str(record.get("ifAdminStatus")).lower() if record.get("ifAdminStatus") is not None else ""
+                ),
+                "data-port-id": lambda record: str(record.get("port_id", "")),
+                "data-member-of-lag": lambda record: str(record.get("librenms_lag_port_id") or ""),
+                "data-parent-port-id": lambda record: str(record.get("librenms_parent_port_id") or ""),
+                "data-parent-name": lambda record: str(record.get("librenms_parent_name") or ""),
+            },
+            **kwargs,
+        )
         self.tab = "interfaces"
         self.htmx_url = None
         self.prefix = "interfaces_"
@@ -82,7 +118,13 @@ def __init__(self, *args, device=None, interface_name_field=None, vlan_groups=No
     selection = ToggleColumn(
         orderable=False,
         visible=True,
-        attrs={"td": {"data-col": "selection"}, "input": {"name": "select"}},
+        attrs={
+            "td": {"data-col": "selection"},
+            "input": {
+                "name": "select",
+                "disabled": lambda record: None if record.get("sync_target_resolvable", True) else "disabled",
+            },
+        },
     )
     name = tables.Column(verbose_name="Name", attrs={"td": {"data-col": "name"}})
     type = tables.Column(
@@ -108,6 +150,12 @@ def __init__(self, *args, device=None, interface_name_field=None, vlan_groups=No
         verbose_name="LibreNMS ID",
         attrs={"td": {"data-col": "librenms_id"}},
     )
+    parent = tables.Column(
+        verbose_name="Parent / LAG",
+        orderable=False,
+        empty_values=(),
+        attrs={"td": {"data-col": "parent"}},
+    )
     vlans = tables.Column(
         verbose_name="VLANs",
         empty_values=(),
@@ -161,7 +209,7 @@ def render_vlans(self, value, record):
             return mark_safe("—")
 
         interface_name = record.get(self.interface_name_field, "")
-        safe_name = interface_name.replace("/", "_").replace(":", "_")
+        row_key = str(record.get("port_id", ""))
 
         # Build compact colored summary (show up to 3 VLANs, summarize rest)
         vlan_group_map = record.get("vlan_group_map", {})
@@ -198,6 +246,11 @@ def render_vlans(self, value, record):
             extra = len(all_vlans) - MAX_INLINE
             summary = format_html('{} <span class="text-muted">+{} more</span>', summary, extra)
 
+        # Keep the LibreNMS VLAN summary visible, but do not expose or submit NetBox scope
+        # details for a row whose owner is outside the user's Device view scope.
+        if not record.get("sync_target_resolvable", True):
+            return summary
+
         # Build tooltip showing auto-selected VLAN group per VLAN. Escape the LibreNMS-sourced
         # vid/vlan_type and group_name; the "&#10;" separator is a literal newline entity for the
         # title attribute, so join the escaped lines and mark the whole tooltip safe.
@@ -221,7 +274,7 @@ def render_vlans(self, value, record):
                     '<input type="hidden" name="vlan_group_{}_{}" '
                     'value="{}" class="vlan-group-hidden" '
                     'data-interface="{}" data-vid="{}">',
-                    safe_name,
+                    row_key,
                     vid,
                     group_id,
                     interface_name,
@@ -263,11 +316,11 @@ def render_vlans(self, value, record):
             )
         vlan_json = json_module.dumps(vlan_json_items)
 
-        device_id = self.device.pk if self.device else ""
+        device_id = record.get("selected_object_id") or (self.device.pk if self.device else "")
 
         # Build vlan_groups JSON for modal dropdowns
         group_options = [{"id": "", "name": "-- No Group (Global) --", "scope": ""}]
-        for group in self.vlan_groups:
+        for group in record.get("vlan_groups", self.vlan_groups):
             scope_info = str(group.scope) if hasattr(group, "scope") and group.scope else ""
             group_options.append({"id": str(group.pk), "name": group.name, "scope": scope_info})
 
@@ -280,14 +333,14 @@ def render_vlans(self, value, record):
         edit_btn = format_html(
             '<button type="button" class="btn btn-sm btn-link p-0 ms-1 vlan-edit-btn" '
             'data-interface="{}" '
-            'data-safe-name="{}" '
+            'data-row-key="{}" '
             'data-device-id="{}" '
             "data-vlans='{}' "
             "data-vlan-groups='{}' "
             'title="Edit VLAN group assignments">'
             '<i class="mdi mdi-pencil"></i></button>',
             interface_name,
-            safe_name,
+            row_key,
             device_id,
             escaped_vlan_json,
             escaped_groups_json,
@@ -374,10 +427,20 @@ def render_mtu(self, value, record):
         return self._render_field(value, record, "ifMtu", "mtu")
 
     def render_librenms_id(self, value, record):
-        """Render the 'librenms_id' field with appropriate styling based on comparison with NetBox."""
+        """
+        Render the LibreNMS port_id, coloured by how it compares to NetBox.
+
+        Red when the interface doesn't exist in NetBox or carries no librenms_id custom
+        field, orange when the stored id differs from this LibreNMS port_id, green when
+        they match.
+
+        Args:
+            value: The LibreNMS port_id to render.
+            record (dict): The table row, read for NetBox interface/existence state.
 
-        # Same XSS guard as _render_field: value/netbox_librenms_id originate outside NetBox, so
-        # use format_html to auto-escape both the body and the title attribute (issue #105).
+        Returns:
+            SafeString: The coloured ``<span>`` markup for the port_id.
+        """
         if not record.get("exists_in_netbox"):
             return format_html('<span class="text-danger">{}</span>', value)
 
@@ -386,21 +449,257 @@ def render_librenms_id(self, value, record):
             return format_html('<span class="text-danger">{}</span>', value)
 
         netbox_librenms_id = get_librenms_device_id(netbox_interface, self.server_key, auto_save=False)
-
         if netbox_librenms_id is None:
             return format_html(
                 '<span class="text-danger" title="No librenms_id custom field value found">{}</span>', value
             )
-
-        # Compare the IDs
         if str(value) != str(netbox_librenms_id):
-            # IDs do not match
             return format_html(
                 '<span class="text-warning" title="Existing LibreNMS ID: {}">{}</span>', netbox_librenms_id, value
             )
+        return format_html('<span class="text-success">{}</span>', value)
+
+    def render_parent(self, value, record):
+        """
+        Render the combined Parent / LAG relationship column.
+
+        Shows LAG membership (if any) and parent interface (if any) stacked vertically,
+        each rendered as a single compact badge combining the relationship type, LibreNMS
+        name, and status icon (see ``_render_relationship_column``). The sync buttons keep
+        their existing CSS classes (lag-sync-btn / parent-sync-btn) so the JS handler still
+        works without changes.
+
+        Args:
+            value: The cell value (unused; the row drives rendering).
+            record (dict): The table row, read for LAG/parent sync status and names.
+
+        Returns:
+            SafeString: The stacked relationship markup, or empty when neither LAG nor
+                parent applies.
+        """
+        parts = []
+
+        lag_status = record.get("lag_sync_status")
+        # LAG membership is device-only — VMInterface has no `lag` field and SyncInterfaceLagView
+        # 404s virtualmachine, so never render a LAG line/button on a VM table (it could only
+        # error). Parent/sub-interface sync is still supported for VMs and rendered below.
+        if lag_status is not None and self.sync_object_type != "virtualmachine":
+            parts.append(
+                self._render_relationship_column(
+                    type_label="LAG",
+                    lnms_name=record.get("librenms_lag_name"),
+                    lnms_port_id=record.get("librenms_lag_port_id"),
+                    sync_status=lag_status,
+                    record=record,
+                    btn_class="lag-sync-btn",
+                    data_related_key="data-lag-port-id",
+                    target_resolvable=record.get("lag_target_resolvable", True),
+                )
+            )
+
+        parent_status = record.get("parent_sync_status")
+        if parent_status is not None:
+            parts.append(
+                self._render_relationship_column(
+                    type_label="Parent",
+                    lnms_name=record.get("librenms_parent_name"),
+                    lnms_port_id=record.get("librenms_parent_port_id"),
+                    sync_status=parent_status,
+                    record=record,
+                    btn_class="parent-sync-btn",
+                    data_related_key="data-parent-port-id",
+                    target_resolvable=record.get("parent_target_resolvable", True),
+                )
+            )
+
+        if not parts:
+            return mark_safe("")
+
+        return mark_safe("".join(str(p) for p in parts))
+
+    @cached_property
+    def _vc_members(self):
+        """
+        Prefetch the chassis member Devices once per table render.
+
+        Both :meth:`_vc_members_by_position` (per-row owner resolution) and
+        :meth:`VCInterfaceTable.render_device_selection` (the per-row member dropdown) need the
+        member list; resolving it here keeps ``members.all()`` to a single query per render
+        instead of one per row (an N+1 on a large chassis table).
+        """
+        device = self.device
+        if device is None or not getattr(device, "virtual_chassis", None):
+            return []
+        try:
+            members = list(device.virtual_chassis.members.all())
+            allowed_ids = getattr(self, "allowed_vc_member_ids", None)
+            return members if allowed_ids is None else [member for member in members if member.pk in allowed_ids]
+        except (TypeError, AttributeError):
+            # A non-iterable or attribute-less stand-in device in a unit test.
+            return []
+
+    @cached_property
+    def _vc_members_by_position(self):
+        """
+        Prefetch ``{vc_position: member Device}`` once per table render.
+
+        :meth:`_resolve_row_member_id` is hit per row from BOTH the relationship sync button and
+        the VC member dropdown, and its name-based fallback otherwise issues a
+        ``members.get(vc_position=...)`` query per unresolved row — quadratic query load on a
+        large chassis table. Resolving from this map keeps it O(1) per row (one prefetch total).
+        """
+        return {member.vc_position: member for member in self._vc_members if member.vc_position is not None}
+
+    def _resolve_row_member_id(self, record):
+        """
+        Resolve the id of the device/VM that owns this row's interface.
+
+        The relationship sync button (``data-object-id``) and the VC member dropdown
+        (:meth:`VCInterfaceTable.render_device_selection`) must agree on the owner: the JS posts
+        the dropdown's value as the object id, so if the button resolved a different device the
+        sync POSTs to the wrong member and 404s (a non-ethernet sub-interface owned by another
+        member is the classic case). Both call this. Preference, most to least authoritative:
+        (1) the matched NetBox interface's device, (2) the row-selected object stamped during
+        enrichment or the cross-page verify path, (3) the shared guarded name heuristic for an
+        unbound physical row, (4) the viewed device.
+        """
+        nb_iface = record.get("netbox_interface")
+        if nb_iface is not None and getattr(nb_iface, "device_id", None):
+            return nb_iface.device_id
+        row_object_id = record.get("selected_object_id")
+        if row_object_id:
+            return row_object_id
+        if self.device is not None and getattr(self.device, "virtual_chassis", None):
+            return resolve_interface_row_device(
+                self.device,
+                record,
+                self.interface_name_field,
+                members_by_position=self._vc_members_by_position or None,
+            ).pk
+        return self.device.pk if self.device else ""
+
+    def _render_relationship_column(
+        self,
+        lnms_name,
+        lnms_port_id,
+        sync_status,
+        record,
+        btn_class,
+        data_related_key,
+        type_label="",
+        target_resolvable=True,
+    ):
+        """
+        Render one compact pill for a LAG or Parent relationship line.
+
+        Renders a Tabler light (``-lt``) badge holding a status icon + the relationship
+        ``type_label`` + the LibreNMS name, with the full status text in the badge
+        ``title``. Status is conveyed by colour + icon rather than a long inline word
+        (e.g. "Not in LibreNMS"), so the column stays glanceable and doesn't clump/wrap
+        to several lines on narrow screens. The ``-lt`` variants ship their own
+        readable text colour in both light and dark themes (and are exempt from the
+        bare-``bg-*`` badge guard).
+
+        Args:
+            lnms_name: The LibreNMS-side relationship name to display.
+            lnms_port_id: The LibreNMS port_id of the related interface (drives the
+                sync button).
+            sync_status: The relationship sync status (match/mismatch/missing_nb/
+                missing_lnms), or None to render nothing.
+            record (dict): The table row, read for port/interface context.
+            btn_class (str): The sync-button CSS class (lag-sync-btn / parent-sync-btn).
+            data_related_key (str): The data attribute carrying the related port_id.
+            type_label (str): The short relationship label ("LAG" / "Parent").
+
+        Returns:
+            SafeString: The pill markup (plus a sync button when applicable).
+        """
+        # Colour + icon read at a glance; the text is the tooltip. Map hoisted to the module-level
+        # _RELATIONSHIP_STATUS_MAP so it isn't rebuilt on every call.
+        color, icon, status_text = _RELATIONSHIP_STATUS_MAP.get(
+            sync_status, ("secondary", "mdi-help-circle", sync_status)
+        )
+        badge_css = f"bg-{color}-lt"
+
+        # format_html() escapes its args, so it's the single escape point for the name.
+        # (A manual escape() here was redundant — it returns a SafeString that format_html's
+        # conditional_escape passes through, so it didn't double-encode, just obscured intent.)
+        display_name = lnms_name or ""
+        if type_label and display_name:
+            badge_text = format_html("{} {}", type_label, display_name)
+        elif display_name:
+            badge_text = display_name
         else:
-            # IDs match
-            return format_html('<span class="text-success">{}</span>', value)
+            badge_text = type_label  # may be "" (e.g. missing_lnms with no name) → icon-only pill
+        title = f"{type_label}: {status_text}" if type_label else status_text
+        badge = format_html(
+            '<span class="badge {} fw-normal d-inline-flex align-items-center gap-1" title="{}">'
+            '<i class="mdi {}"></i>{}</span>',
+            badge_css,
+            title,
+            icon,
+            badge_text,
+        )
+
+        # Show the inline sync button when LibreNMS has a relationship to apply (lnms_port_id
+        # set) and NetBox either lacks it (missing_nb) or holds a DIFFERENT one (mismatch) —
+        # in both cases the row can be reconciled to the LibreNMS value from here. missing_lnms
+        # is excluded by the lnms_port_id guard (nothing to sync to), and a migrated donor page
+        # suppresses the control entirely: the per-row .lag-sync-btn/.parent-sync-btn POST
+        # directly via librenms_sync.js, so leaving it active would let a migrated donor mutate
+        # parent/LAG state despite the bulk form being hidden.
+        if (
+            sync_status in ("missing_nb", "mismatch")
+            and lnms_port_id
+            and record.get("netbox_interface") is not None
+            and record.get("relationship_source_resolvable", True)
+            and target_resolvable
+            and not self.migrated_to_marker
+        ):
+            port_id = record.get("port_id", "")
+            # Resolve the owning member the same way the VC member dropdown does, so the button's
+            # data-object-id and the dropdown agree (the JS posts the dropdown value, so a
+            # disagreement would 404). See _resolve_row_member_id.
+            object_id = self._resolve_row_member_id(record)
+            if not object_id:
+                # No resolvable owner. reverse() would raise NoReverseMatch and take down the
+                # whole table render, so degrade this one cell the way target_resolvable does.
+                return format_html('<div class="text-nowrap lh-sm">{}</div>', badge)
+            object_type = record.get("selected_object_type") or self.sync_object_type
+            route_name = "sync_interface_lag" if btn_class == "lag-sync-btn" else "sync_interface_parent"
+            sync_url = reverse(
+                f"plugins:netbox_librenms_plugin:{route_name}",
+                kwargs={"object_type": object_type, "object_id": object_id},
+            )
+            # A mismatch click OVERWRITES the differing NetBox lag/parent with the LibreNMS
+            # value, so spell that out in the tooltip rather than the generic "Sync".
+            sync_title = (
+                f"Update {type_label or 'relationship'} to match LibreNMS"
+                if sync_status == "mismatch"
+                else "Sync relationship"
+            )
+            btn = format_html(
+                ' <button type="button" class="btn btn-sm btn-link p-0 {}" '
+                'data-port-id="{}" {}="{}" '
+                'data-object-type="{}" data-object-id="{}" '
+                'data-sync-url="{}" '
+                'title="{}" aria-label="{}">'
+                '<i class="mdi mdi-sync"></i></button>',
+                btn_class,
+                port_id,
+                data_related_key,
+                lnms_port_id,
+                object_type,
+                object_id,
+                sync_url,
+                sync_title,
+                sync_title,
+            )
+            # text-nowrap keeps the pill + sync button on one line (no mid-line wrap); lh-sm keeps
+            # the LAG/Parent lines tightly stacked.
+            return format_html('<div class="text-nowrap lh-sm">{} {}</div>', badge, btn)
+
+        return format_html('<div class="text-nowrap lh-sm">{}</div>', badge)
 
     def _compare_mac_addresses(self, librenms_mac, netbox_interface):
         """
@@ -517,10 +816,33 @@ def format_interface_data(self, port_data, device):
         # unrelated host interface and inviting a sync the server then silently skips.
         if port_data.get("_source") == "oob":
             port_data["netbox_interface"] = None
-        else:
-            port_data["netbox_interface"] = device.interfaces.filter(name=interface_name).first()
+        # Preserve a netbox_interface already resolved by the stable port_id (e.g. the single-
+        # interface verify view resolves by port_id first). Only fall back to the fragile name
+        # lookup when nothing has been resolved yet, so a display-name change or collision can't
+        # clobber the correct port-id match with the wrong (or no) name-matched interface.
+        elif not port_data.get("netbox_interface"):
+            candidate = device.interfaces.filter(name=interface_name).first()
+            port_data["netbox_interface"] = (
+                candidate
+                if candidate
+                and port_data.get("name_fallback_allowed", False)
+                and interface_name_fallback_matches_port(
+                    candidate,
+                    port_data.get("port_id"),
+                    self.server_key,
+                )
+                else None
+            )
         port_data["exists_in_netbox"] = bool(port_data["netbox_interface"])
 
+        # Stamp the row's actual object so the relationship sync button targets it even when the
+        # row has no matching NetBox interface yet (missing_nb). This is set here, where the
+        # caller passes the row-selected device (e.g. the cross-page VC member switch), so the
+        # missing_nb branch in _render_relationship_column can prefer it over the
+        # name-based VC heuristic, which would otherwise post to the wrong device.
+        port_data["selected_object_id"] = getattr(device, "pk", None)
+        port_data["selected_object_type"] = self.sync_object_type
+
         # Clear description if it matches interface name
         if port_data["ifAlias"] == port_data["ifName"] or port_data["ifAlias"] == port_data["ifDescr"]:
             port_data["ifAlias"] = ""
@@ -533,6 +855,15 @@ def format_interface_data(self, port_data, device):
             "mtu": self.render_mtu(port_data["ifMtu"], port_data),
             "enabled": self.render_enabled(port_data["ifAdminStatus"], port_data),
             "description": self.render_description(port_data["ifAlias"], port_data),
+            "vlans": self.render_vlans(None, port_data),
+            # The librenms_id badge's colour is member-specific (it compares this port_id
+            # against the resolved NetBox interface's device librenms_id), so a VC member
+            # switch must repaint it too — otherwise it keeps the previous member's
+            # match/mismatch state. The column accessor is "port_id" (see the column def).
+            "librenms_id": self.render_librenms_id(port_data.get("port_id"), port_data),
+            # Renders from the lag/parent enrichment keys the caller stamps onto
+            # port_data; absent enrichment it returns "" (safe empty cell).
+            "parent": self.render_parent(None, port_data),
         }
 
         return formatted_data
@@ -568,8 +899,6 @@ def __init__(self, *args, device=None, interface_name_field=None, vlan_groups=No
         # Ensure device_selection column is visible
         if hasattr(self.device, "virtual_chassis") and self.device.virtual_chassis:
             self.columns.show("device_selection")
-            # Update selection column accessor to match interface_name_field
-            self.base_columns["selection"].accessor = self.interface_name_field
 
     def render_device_selection(self, value, record):
         """
@@ -577,24 +906,31 @@ def render_device_selection(self, value, record):
         Determines the selected member based on interface type and name.
         Returns an HTML select element with appropriate member options.
         """
-        members = self.device.virtual_chassis.members.all()
-        if_type = record.get("ifType", "").lower()
+        # Reuse the per-render member prefetch (see _vc_members) so the dropdown doesn't re-query
+        # the chassis members for every row (N+1 on a large chassis).
+        members = self._vc_members
         interface_name = record.get(self.interface_name_field)
+        port_id = record.get("port_id", "")
 
-        if "ethernet" in if_type:
-            chassis_member = get_virtual_chassis_member(self.device, interface_name)
-            selected_member_id = chassis_member.id if chassis_member else self.device.id
-        else:
-            selected_member_id = self.device.id
+        # Default the dropdown to the same owner the relationship sync button resolves (matched
+        # NetBox interface's device → cross-page selection → name heuristic), so the JS — which
+        # posts this dropdown's value as the sync object id — can't disagree with the button and
+        # 404. Previously non-ethernet rows always defaulted to the viewed member, breaking sync
+        # for a sub-interface owned by a different VC member.
+        selected_member_id = self._resolve_row_member_id(record) or self.device.id
 
         # Create unique base ID for TomSelect components
-        base_id = f"device_selection_{interface_name}_{hash(interface_name)}"
+        base_id = f"device_selection_{port_id}"
+        disabled = mark_safe(' disabled="disabled"') if not record.get("sync_target_resolvable", True) else ""
 
         return format_html(
-            '<select name="device_selection_{0}" id="{1}" class="form-select vc-member-select" data-interface="{0}" data-row-id="{0}">{2}</select>',
-            interface_name,
+            '<select name="device_selection_{0}" id="{1}" class="form-select vc-member-select" '
+            'data-interface="{2}" data-row-id="{0}"{4}>{3}</select>',
+            port_id,
             base_id,
+            interface_name,
             render_vc_member_options(members, selected_member_id),
+            disabled,
         )
 
     def format_interface_data(self, port_data, device):
@@ -617,6 +953,8 @@ class Meta:
             "mtu",
             "enabled",
             "description",
+            "librenms_id",
+            "parent",
         ]
         attrs = {
             "class": "table table-hover object-list",
@@ -629,6 +967,9 @@ class LibreNMSVMInterfaceTable(LibreNMSInterfaceTable):
     Table for displaying LibreNMS VM interface data.
     """
 
+    # These rows sync against VirtualMachine objects regardless of whether the VM has a cluster.
+    sync_object_type = "virtualmachine"
+
     class Meta(LibreNMSInterfaceTable.Meta):
         """Meta options for LibreNMSVMInterfaceTable."""
 
@@ -640,6 +981,11 @@ class Meta(LibreNMSInterfaceTable.Meta):
             "mtu",
             "enabled",
             "description",
+            "librenms_id",
+            # VMInterface supports sub-interface parents (LAG is skipped for VMs), and the
+            # relationship sync path resolves VMInterface targets — so the Parent/LAG column
+            # must be exposed here too, otherwise the feature is unreachable on VM pages.
+            "parent",
         ]
         attrs = {
             "class": "table table-hover object-list",
diff --git a/netbox_librenms_plugin/tables/mappings.py b/netbox_librenms_plugin/tables/mappings.py
index 1a270d144f..549bac2944 100644
--- a/netbox_librenms_plugin/tables/mappings.py
+++ b/netbox_librenms_plugin/tables/mappings.py
@@ -11,6 +11,7 @@
     ModuleTypeMapping,
     NormalizationRule,
     PlatformMapping,
+    PortStackLagPattern,
 )
 
 
@@ -327,3 +328,39 @@ class Meta:
             "actions",
         )
         attrs = {"class": "table table-hover table-headings table-striped"}
+
+
+class PortStackLagPatternTable(NetBoxTable):
+    """Table for displaying PortStackLagPattern data."""
+
+    # Use NetBoxTable's default pk ToggleColumn (input name="pk"). This table is rendered only by
+    # generic NetBox views (ObjectListView, BulkDeleteView) and the plugin's BulkExportYAMLView,
+    # all of which read request.POST.getlist("pk"); the generic list pages don't load the plugin's
+    # sync/import selection JS. Overriding the input name to "select" silently broke select-all,
+    # bulk delete, and "Export Selected (YAML)" (the view always saw zero selected pks).
+    librenms_os = tables.Column(verbose_name="LibreNMS OS", linkify=True)
+    lag_name_pattern = tables.Column(verbose_name="LAG Name Pattern (regex)")
+    description = tables.Column(verbose_name="Description", linkify=False)
+    actions = columns.ActionsColumn(actions=("edit", "delete"))
+
+    class Meta:
+        """Meta options for PortStackLagPatternTable."""
+
+        model = PortStackLagPattern
+        fields = (
+            "pk",
+            "id",
+            "librenms_os",
+            "lag_name_pattern",
+            "description",
+            "actions",
+        )
+        default_columns = (
+            "pk",
+            "id",
+            "librenms_os",
+            "lag_name_pattern",
+            "description",
+            "actions",
+        )
+        attrs = {"class": "table table-hover table-headings table-striped"}
diff --git a/netbox_librenms_plugin/templates/netbox_librenms_plugin/_interface_sync.html b/netbox_librenms_plugin/templates/netbox_librenms_plugin/_interface_sync.html
index c6afd05224..36254beb78 100644
--- a/netbox_librenms_plugin/templates/netbox_librenms_plugin/_interface_sync.html
+++ b/netbox_librenms_plugin/templates/netbox_librenms_plugin/_interface_sync.html
@@ -15,20 +15,21 @@ <h2>Interface Sync</h2>
             {% include "netbox_librenms_plugin/inc/_hidden_server_key.html" %}
             {% if has_librenms_id %}
                 {% with model_name=object|meta:"model_name" %}
+                    {% comment %}
+                    Resolve the refresh URL per object type, then render ONE button so the shared
+                    hx-vals (pagination + server_key forwarding) lives in a single place.
+                    {% endcomment %}
                     {% if model_name == "device" %}
-                        {# type="button": HTMX drives the POST via hx-post; the default type="submit" would also fire a native form submit. #}
-                        <button type="button"
-                                hx-post="{% url 'plugins:netbox_librenms_plugin:device_interface_sync' pk=object.pk %}"
-                                hx-target="#interface-sync-content"
-                                hx-include="[name='interface_name_field'], [name='server_key']"
-                                class="btn btn-outline-primary">
-                            Refresh Interfaces
-                        </button>
+                        {% url 'plugins:netbox_librenms_plugin:device_interface_sync' pk=object.pk as interface_sync_url %}
                     {% elif model_name == "virtualmachine" %}
+                        {% url 'plugins:netbox_librenms_plugin:vm_interface_sync' pk=object.pk as interface_sync_url %}
+                    {% endif %}
+                    {% if interface_sync_url %}
                         <button type="button"
-                                hx-post="{% url 'plugins:netbox_librenms_plugin:vm_interface_sync' pk=object.pk %}"
+                                hx-post="{{ interface_sync_url }}"
                                 hx-target="#interface-sync-content"
-                                hx-include="[name='interface_name_field'], [name='server_key']"
+                                hx-include="[name='interface_name_field']"
+                                hx-vals="js:{interfaces_per_page: new URLSearchParams(window.location.search).get('interfaces_per_page') || '', server_key: new URLSearchParams(window.location.search).get('server_key') || '{{ librenms_server_info.server_key|default:''|escapejs }}'}"
                                 class="btn btn-outline-primary">
                             Refresh Interfaces
                         </button>
diff --git a/netbox_librenms_plugin/templates/netbox_librenms_plugin/_interface_sync_content.html b/netbox_librenms_plugin/templates/netbox_librenms_plugin/_interface_sync_content.html
index 12c5ab9357..08b35f0407 100644
--- a/netbox_librenms_plugin/templates/netbox_librenms_plugin/_interface_sync_content.html
+++ b/netbox_librenms_plugin/templates/netbox_librenms_plugin/_interface_sync_content.html
@@ -11,16 +11,26 @@
 </div>
 {% endif %}
 
+{% if interface_sync.relationship_data_incomplete %}
+<div class="alert alert-warning d-flex align-items-center noprint" role="alert">
+    <i class="mdi mdi-alert me-2"></i>
+    <div>LAG / sub-interface relationship data could not be fetched from LibreNMS on the last refresh, so the Parent / LAG column may be incomplete. Refresh again to retry.</div>
+</div>
+{% endif %}
+
 {# Migrated donors must not sync: hiding only the button leaves the POST form live (Enter in a filter still submits), so drop the form in migrated mode. #}
 {% with model_name=interface_sync.object|meta:"model_name" %}
 {% if migrated_to_marker %}
-<div>
+<div data-interface-origin-device-id="{{ interface_sync.object.pk }}">
     {% comment %}
     No POST form in migrated mode, but the interface table still renders interactive
     relationship/VC-member dropdowns whose verify-interface POST reads the token via
     document.querySelector('[name=csrfmiddlewaretoken]'). Emit a standalone token so those
     JS-driven requests don't hit a null token (TypeError/403). A bare hidden input never
     auto-submits, so it doesn't reintroduce the live-form problem flagged above.
+    The same JS handlers read input[name="server_key"] to scope verify/sync POSTs to the
+    right LibreNMS server; without it, migrated-mode requests on a non-default server fall
+    back to null and hit the wrong server/cache. Emit it here too (still no auto-submit).
     {% endcomment %}
     <input type="hidden" name="csrfmiddlewaretoken" value="{{ csrf_token }}">
     {% comment %}
@@ -33,6 +43,7 @@
     {% endwith %}
 {% else %}
 <form method="post"
+    data-interface-origin-device-id="{{ interface_sync.object.pk }}"
     action="{% url 'plugins:netbox_librenms_plugin:sync_selected_interfaces' object_type=model_name object_id=interface_sync.object.pk %}?interface_name_field={{ interface_name_field }}">
     {# Form-only inputs live inside the form branch so migrated (donor) mode, which renders a plain <div> wrapper, never emits hidden fields outside any <form>. #}
     {% csrf_token %}
@@ -41,7 +52,7 @@
     {% endwith %}
     {% block table_actions %}
     <div class="noprint d-flex justify-content-between align-items-center mt-3 mb-3">
-        <div>
+        <div class="d-flex align-items-center gap-2">
             {% if not migrated_to_marker %}
             <button type="submit" class="btn btn-primary">
                 <span class="spinner spinner-border d-none" id="sync-spinner"></span>
@@ -52,6 +63,10 @@
                 onclick="event.preventDefault(); showModal(document.getElementById('interfaceTypeHelpModal'))">
                 <i class="mdi mdi-help-circle"></i> info
             </a>
+            <div class="d-flex align-items-center ms-2" title="When enabled, checking a LAG/portchannel row also checks all its member interfaces, and checking a sub-interface also selects its parent interface">
+                <input class="form-check-input form-check-input-sm me-1" type="checkbox" id="autoSelectLagMembers" name="auto_select_lag_members" value="1" checked>
+                <label class="form-check-label small mb-0" for="autoSelectLagMembers">Auto-select LAG members &amp; parents</label>
+            </div>
         </div>
         {% if not migrated_to_marker %}
         <div class="ms-auto d-flex align-items-center">
@@ -331,9 +346,11 @@ <h5 class="modal-title" id="netboxOnlyInterfacesModalLabel">
                     <i class="mdi mdi-alert me-2"></i>
                     {% if migrated_to_marker %}
                     {% if migrated_to_winner %}
-                    <strong>Warning:</strong> The following interfaces exist on the migrated donor but are not found in
-                    the LibreNMS data. Moving an interface reassigns it, along with related cables/IPs/MACs, to the
-                    migration winner.
+                    {# Migrated donor: this is a transfer-only flow (no bulk delete), so the copy #}
+                    {# must describe moving interfaces to the winner, not deleting them. #}
+                    <strong>Migrated device:</strong> The following interfaces exist in NetBox but are not found in the
+                    LibreNMS data. Use <em>Move</em> on a row to transfer that interface — together with its cables, IPs
+                    and MACs — to {{ migrated_to_winner.name }}.
                     {% else %}
                     <strong>Warning:</strong> The following interfaces exist on the migrated donor but are not found in
                     the LibreNMS data. The migration winner is unavailable, so these interfaces can't be moved until the
@@ -353,6 +370,8 @@ <h5 class="modal-title" id="netboxOnlyInterfacesModalLabel">
                         <table class="table table-hover">
                             <thead>
                                 <tr>
+                                    {# In migrated mode the bulk-delete button is hidden, so the #}
+                                    {# select-all column is a dead control — drop it entirely. #}
                                     {% if not migrated_to_marker %}
                                     <th>
                                         <input type="checkbox" id="select-all-netbox-interfaces"
@@ -370,6 +389,8 @@ <h5 class="modal-title" id="netboxOnlyInterfacesModalLabel">
                             <tbody>
                                 {% for interface in interface_sync.netbox_only_interfaces %}
                                 <tr>
+                                    {# Per-row bulk-select checkbox: only meaningful for the bulk #}
+                                    {# delete path, which is hidden in migrated mode. #}
                                     {% if not migrated_to_marker %}
                                     <td>
                                         <input type="checkbox" name="interface_ids" value="{{ interface.id }}"
@@ -408,6 +429,13 @@ <h5 class="modal-title" id="netboxOnlyInterfacesModalLabel">
                 {% endif %}
             </div>
             <div class="modal-footer">
+                {% comment %}
+                Hide bulk delete whenever the donor is in migrated mode: the per-row "Move to
+                winner" path preserves cables/IPs/MACs, so a blanket delete would drop interfaces
+                that should be transferred. Key off migrated_to_marker (not migrated_to_winner) so
+                a donor marked migrated never falls back to bulk delete even when the winner can't
+                be resolved — exactly when the safe move path is unavailable.
+                {% endcomment %}
                 {% if interface_sync.netbox_only_interfaces and not migrated_to_marker %}
                 <button type="button" class="btn btn-danger" id="confirm-delete-interfaces">
                     <i class="mdi mdi-delete"></i> Delete Selected Interfaces
diff --git a/netbox_librenms_plugin/templates/netbox_librenms_plugin/inc/_rules_patterns_tabs.html b/netbox_librenms_plugin/templates/netbox_librenms_plugin/inc/_rules_patterns_tabs.html
index 4531d7f66f..8433833983 100644
--- a/netbox_librenms_plugin/templates/netbox_librenms_plugin/inc/_rules_patterns_tabs.html
+++ b/netbox_librenms_plugin/templates/netbox_librenms_plugin/inc/_rules_patterns_tabs.html
@@ -17,4 +17,7 @@
     <li class="nav-item">
         <a class="nav-link{% if rules_tab_active == "carrierautoinstallrule" %} active{% endif %}" href="{% url 'plugins:netbox_librenms_plugin:carrierautoinstallrule_list' %}"{% if rules_tab_active == "carrierautoinstallrule" %} aria-current="page"{% endif %}>Carrier Auto-Install Rules</a>
     </li>
+    <li class="nav-item">
+        <a class="nav-link{% if rules_tab_active == "portstacklagpattern" %} active{% endif %}" href="{% url 'plugins:netbox_librenms_plugin:portstacklagpattern_list' %}"{% if rules_tab_active == "portstacklagpattern" %} aria-current="page"{% endif %}>Port Stack LAG Patterns</a>
+    </li>
 </ul>
diff --git a/netbox_librenms_plugin/templates/netbox_librenms_plugin/portstacklagpattern.html b/netbox_librenms_plugin/templates/netbox_librenms_plugin/portstacklagpattern.html
new file mode 100644
index 0000000000..9c921b249f
--- /dev/null
+++ b/netbox_librenms_plugin/templates/netbox_librenms_plugin/portstacklagpattern.html
@@ -0,0 +1,28 @@
+{% extends 'generic/object.html' %}
+{% load helpers %}
+{% load plugins %}
+
+{% block content %}
+<div class="row mb-3">
+  <div class="col col-md-12">
+    <div class="card">
+      <table class="table table-hover attr-table">
+        <thead>
+          <tr>
+            <th>LibreNMS OS</th>
+            <th>LAG Name Pattern (regex)</th>
+            <th>Description</th>
+          </tr>
+        </thead>
+        <tbody>
+          <tr>
+            <td><code>{{ object.librenms_os }}</code></td>
+            <td><code>{{ object.lag_name_pattern }}</code></td>
+            <td>{{ object.description|default:"—" }}</td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+  </div>
+</div>
+{% endblock %}
diff --git a/netbox_librenms_plugin/templates/netbox_librenms_plugin/portstacklagpattern_list.html b/netbox_librenms_plugin/templates/netbox_librenms_plugin/portstacklagpattern_list.html
new file mode 100644
index 0000000000..b2fbbc148c
--- /dev/null
+++ b/netbox_librenms_plugin/templates/netbox_librenms_plugin/portstacklagpattern_list.html
@@ -0,0 +1,26 @@
+{% extends 'generic/object_list.html' %}
+
+{% block tabs %}
+    {% include 'netbox_librenms_plugin/inc/_rules_patterns_tabs.html' with rules_tab_active="portstacklagpattern" %}
+    {{ block.super }}
+{% endblock %}
+
+{% block content %}
+    <div class="alert alert-info">
+        <h4>Port Stack LAG Patterns</h4>
+        <p>Define regular expression patterns to identify LAG (Link Aggregation Group) aggregate
+           interfaces by operating system when the interface type is not <code>ieee8023adLag</code>.
+           These patterns are used as a fallback during interface synchronization to correctly
+           identify parent-child relationships in port stacks.</p>
+        <p>Example: Cisco IOS port-channels have <code>ifType='propVirtual'</code> and need
+           name-based identification via pattern <code>^Po\d+$</code>.</p>
+    </div>
+    {{ block.super }}
+{% endblock %}
+
+{% block bulk_buttons %}
+    {{ block.super }}
+    <button type="submit" formaction="{% url 'plugins:netbox_librenms_plugin:portstacklagpattern_bulk_export_yaml' %}" class="btn btn-sm btn-secondary">
+        <i class="mdi mdi-download"></i> Export Selected (YAML)
+    </button>
+{% endblock %}
diff --git a/netbox_librenms_plugin/tests/conftest.py b/netbox_librenms_plugin/tests/conftest.py
index c3e56e8277..3d6c24ce62 100644
--- a/netbox_librenms_plugin/tests/conftest.py
+++ b/netbox_librenms_plugin/tests/conftest.py
@@ -1,37 +1,152 @@
 """Shared pytest fixtures for NetBox LibreNMS Plugin tests."""
 
+from copy import deepcopy
+from urllib.parse import urlsplit, urlunsplit
 from unittest.mock import MagicMock, patch
+from uuid import uuid4
 
 import pytest
 
 
+def clear_test_cache(cache_backend):
+    """Clear only the active test namespace when the backend supports patterns."""
+    try:
+        cache_backend.delete_pattern("*")
+    except (AttributeError, NotImplementedError):
+        cache_backend.clear()
+
+
+def _isolated_cache_location(location):
+    """Move Redis cache URLs to database 9 without changing other locations."""
+    if isinstance(location, list):
+        return [_isolated_cache_location(item) for item in location]
+    if isinstance(location, tuple):
+        return tuple(_isolated_cache_location(item) for item in location)
+    if not isinstance(location, str):
+        return location
+
+    parsed = urlsplit(location)
+    if parsed.scheme not in {"redis", "rediss"}:
+        return location
+
+    database = parsed.path.strip("/")
+    if database and not database.isdigit():
+        return location
+    return urlunsplit(parsed._replace(path="/9"))
+
+
+def _isolated_cache_config(caches_config):
+    """Return a cache config with a unique per-test namespace."""
+    isolated = deepcopy(caches_config)
+    default = isolated.setdefault("default", {})
+    default["LOCATION"] = _isolated_cache_location(default.get("LOCATION", ""))
+    unique_prefix = f"nblp-test-{uuid4().hex}"
+    configured_prefix = default.get("KEY_PREFIX")
+    default["KEY_PREFIX"] = f"{configured_prefix}:{unique_prefix}" if configured_prefix else unique_prefix
+    return isolated
+
+
 @pytest.fixture(autouse=True)
-def _clear_device_info_cache():
+def _isolate_test_cache(settings):
+    """Run every test in a unique cache namespace outside the dev-server database.
+
+    The devcontainer test settings point the cache at the SAME Redis DB the dev runserver
+    uses, and NetBox's DEBUG startup runs ``cache.clear()`` on every auto-reload (any ``.py``
+    edit under the workspace restarts it). A restart landing mid-test wiped seeded snapshots
+    and made cache-dependent tests flake nondeterministically. Rehoming tests to a sibling
+    Redis DB keeps django-redis semantics (``ttl()``, pickling) while being invisible to the
+    dev server. A unique key prefix isolates this test from other pytest processes and avoids
+    clearing a shared Redis database.
+    """
+    settings.CACHES = _isolated_cache_config(settings.CACHES)
+    yield
+
+
+@pytest.fixture(autouse=True)
+def _clear_device_info_cache(_isolate_test_cache):
     """Flush the plugin's caches between tests.
 
     NetBox uses Redis, which (unlike the test DB) is NOT rolled back between tests, while
     primary keys ARE reused after each rollback. Every plugin cache key is built from a model
     name and a pk (``CacheMixin.get_cache_key`` → ``librenms_links_device_7_default``), so a
     value cached by one test is read by the next test that draws the same pk, with entirely
-    different data behind it. ``librenms_*`` covers the per-object render caches (ports, links,
-    vlans, ip_addresses, inventory, last-fetched stamps, VLAN group overrides), ``get_device_info()``'s
-    short-lived lookup cache and the cached import search results. ``import_device_data_*`` sits
-    outside that prefix: the bulk-import collision gate reads it via ``cache.get_many``
-    (actions.py) BEFORE falling back to the stubbed ``get_device_info``, so a leaked entry for a
-    selected id silently bypasses the stub and defeats the collision check.
+    different data behind it.
+
+    ``_isolate_test_cache`` already gives this test its own key prefix, so clearing the whole
+    namespace is exact: it cannot reach another test or the dev server. That covers the
+    ``librenms_*`` render caches, ``get_device_info()``'s short-lived lookup cache and the
+    ``import_device_data_*`` keys the bulk-import collision gate reads through
+    ``cache.get_many`` before it falls back to the stubbed ``get_device_info``.
     """
     from django.core.cache import cache
 
-    for pattern in ("librenms_*", "import_device_data_*"):
-        try:
-            cache.delete_pattern(pattern)
-        except (AttributeError, NotImplementedError):
-            # No django-redis delete_pattern (e.g. LocMemCache): a single clear() covers all.
-            cache.clear()
+    clear_test_cache(cache)
+    yield
+
+
+def _seeded_model_rows():
+    """Yield ``(model, lookup_field, value_field, rows)`` for every data-migration seed."""
+    import importlib
+
+    from netbox_librenms_plugin.models import PortStackLagPattern
+
+    # The migration module name starts with a digit, so import syntax cannot reach it.
+    lag = importlib.import_module("netbox_librenms_plugin.migrations.0013_portstacklagpattern")
+    yield PortStackLagPattern, "librenms_os", "lag_name_pattern", lag.INITIAL_LAG_PATTERNS
+
+
+def seed_migration_rows():
+    """Recreate every row the plugin's data migrations seed."""
+    for model, lookup_field, value_field, rows in _seeded_model_rows():
+        for lookup, value in rows:
+            model.objects.get_or_create(**{lookup_field: lookup}, defaults={value_field: value})
+
+
+@pytest.fixture(autouse=True)
+def _restore_migration_seeded_rows(request):
+    """Re-seed the rows a transactional test's flush removes.
+
+    ``django_db(transaction=True)`` truncates every table, including rows a data migration
+    created, so LAG detection loses its per-OS name patterns and every later test in the run
+    sees an empty recognition table.
+
+    The flush runs in the ``transactional_db`` teardown, which finalizes AFTER this fixture, so
+    the restore has to happen on the way in. A non-transactional test runs inside a transaction
+    that is rolled back, so seeding here is visible to it and leaves nothing behind.
+    """
+    # Gate on the marker, not on request.fixturenames: pytest-django pulls "db" in dynamically
+    # from its own autouse fixture, so it is still absent from the closure at this point.
+    marker = request.node.get_closest_marker("django_db")
+    requested = {"db", "transactional_db"} & set(request.fixturenames)
+    if marker is None and not requested:
+        yield
+        return
+
+    db_fixture = "transactional_db" if (marker and marker.kwargs.get("transaction")) else "db"
+    # An autouse fixture is set up BEFORE the fixtures it does not request, so ask for the
+    # database one here: querying without it raises "Database access not allowed".
+    request.getfixturevalue(db_fixture)
+    for model, _lookup_field, _value_field, _rows in _seeded_model_rows():
+        if not model.objects.exists():
+            seed_migration_rows()
             break
     yield
 
 
+@pytest.fixture(scope="session", autouse=True)
+def _reseed_after_transactional_flush(django_db_setup, django_db_blocker):
+    """Leave the reused database seeded for the next run.
+
+    The last transactional test flushes on its way out, after every function-scoped fixture has
+    finalized. Without this the seeded rows stay missing in the reused database and the next run
+    starts with LAG pattern detection silently disabled.
+    """
+    yield
+
+    with django_db_blocker.unblock():
+        seed_migration_rows()
+
+
 # =============================================================================
 # Real-DB builders (shared by the DB-backed conversions)
 # =============================================================================
@@ -110,6 +225,18 @@ def make_serial_device(name, *, csp_names=(), cp_names=()):
     return dev, csps, cps
 
 
+def make_virtual_chassis(name, *devices):
+    """Create a VirtualChassis and enroll *devices* as members (vc_position by order)."""
+    from dcim.models import VirtualChassis
+
+    vc = VirtualChassis.objects.create(name=name)
+    for position, dev in enumerate(devices, start=1):
+        dev.virtual_chassis = vc
+        dev.vc_position = position
+        dev.save()
+    return vc
+
+
 def cable_together(term_a, term_b):
     """Create a real Cable between two terminations (NetBox 4.x multi-termination API)."""
     from dcim.models import Cable
diff --git a/netbox_librenms_plugin/tests/test_collisions.py b/netbox_librenms_plugin/tests/test_collisions.py
index e8ae0fbcf1..34fa94e162 100644
--- a/netbox_librenms_plugin/tests/test_collisions.py
+++ b/netbox_librenms_plugin/tests/test_collisions.py
@@ -405,6 +405,33 @@ def test_collision_template_renders_correct_link_targets_and_escapes():
     ), "collision badge must pair bg-danger with text-white on one element"
 
 
+def test_collision_template_hides_a_restricted_target_link_and_pk():
+    """A restricted collision shows its safe name without exposing an object URL or pk."""
+    from django.template.loader import render_to_string
+
+    html = render_to_string(
+        "netbox_librenms_plugin/htmx/bulk_import_collision.html",
+        {
+            "collisions": [
+                {
+                    "nb_device_pk": None,
+                    "nb_device_name": "restricted NetBox object",
+                    "nb_model_name": None,
+                    "nb_kind": "object",
+                    "target_visible": False,
+                    "librenms_rows": [{"device_id": 1, "hostname": "restricted-row", "role": "host"}],
+                }
+            ]
+        },
+    )
+
+    assert "restricted NetBox object" in html
+    assert "restricted-row" in html
+    assert "/dcim/devices/" not in html
+    assert "/virtualization/virtual-machines/" not in html
+    assert "(pk " not in html
+
+
 def test_non_string_merge_model_name_is_normalized():
     """A corrupt/foreign merge_candidates model_name (non-string) must not crash the dict-key bucketing — it's normalized to the 'device' default and still collides correctly."""
     bad = {"merge_candidates": {"host_named": {"pk": 88, "name": "shared", "model_name": ["not-a-str"]}}}
diff --git a/netbox_librenms_plugin/tests/test_coverage_actions.py b/netbox_librenms_plugin/tests/test_coverage_actions.py
index f9cac16d76..14187b39e2 100644
--- a/netbox_librenms_plugin/tests/test_coverage_actions.py
+++ b/netbox_librenms_plugin/tests/test_coverage_actions.py
@@ -848,10 +848,11 @@ def test_appends_rendered_messages_to_bytes_content(self):
         from netbox_librenms_plugin.views.imports.actions import _attach_messages_oob
 
         response = HttpResponse(b"<tr>row html</tr>")
+        storage = self._storage(["a message"])
         with (
             patch(
                 "netbox_librenms_plugin.views.imports.actions.messages.get_messages",
-                return_value=self._storage(["a message"]),
+                return_value=storage,
             ),
             patch(
                 "netbox_librenms_plugin.views.imports.actions.render_to_string",
@@ -866,6 +867,8 @@ def test_appends_rendered_messages_to_bytes_content(self):
         # The CodeQL-safe format_html() composition produces exactly the concatenation of the
         # original response bytes and the rendered (trusted) fragment — no escaping of either.
         assert result.content == b"<tr>row html</tr>" + b'<div id="django-messages" hx-swap-oob="true"></div>'
+        # The peek must not leave the storage consumed for the page renderer.
+        assert storage.used is False
 
     def test_skips_oob_swap_when_no_messages_queued(self):
         """No pending messages → don't append an empty OOB container that would wipe toasts already visible from an earlier action."""
@@ -875,10 +878,11 @@ def test_skips_oob_swap_when_no_messages_queued(self):
 
         response = HttpResponse(b"<tr>row html</tr>")
         original = response.content
+        storage = self._storage([])
         with (
             patch(
                 "netbox_librenms_plugin.views.imports.actions.messages.get_messages",
-                return_value=self._storage([]),
+                return_value=storage,
             ),
             patch("netbox_librenms_plugin.views.imports.actions.render_to_string") as mock_render,
         ):
@@ -886,6 +890,8 @@ def test_skips_oob_swap_when_no_messages_queued(self):
 
         mock_render.assert_not_called()
         assert result.content == original
+        # Even on the empty path, the peek must restore used so nothing is consumed.
+        assert storage.used is False
 
     def test_swallows_render_errors(self):
         from django.http import HttpResponse
@@ -7604,9 +7610,12 @@ def test_locks_candidate_row_with_select_for_update(self):
         assert reason is None and ip.pk == existing.pk
         locking = [q["sql"] for q in captured.captured_queries if "FOR UPDATE" in q["sql"].upper()]
         assert locking, "the candidate row was never locked"
-        # The lock must carry the permission join, i.e. it ran through restrict(), and must lock
-        # only the address row rather than the joined permission tables.
-        assert any("OF " in sql.upper() for sql in locking), "the lock did not restrict itself to the row"
+        # Name the locked table: a bare "OF " matches any substring, and the clause is what keeps
+        # a permission join added by restrict() out of the lock set. The scoping itself is pinned
+        # by test_rehome_denied_outside_the_constrained_change_grant.
+        assert any('FOR UPDATE OF "IPAM_IPADDRESS"' in sql.upper() for sql in locking), (
+            f"the lock did not name the address row: {locking}"
+        )
 
 
 @pytest.mark.django_db
@@ -8249,6 +8258,91 @@ def test_platform_mapping_outside_change_grant_is_not_updated(self):
         hidden.refresh_from_db()
         assert hidden.netbox_platform_id == old_platform.pk
 
+    def test_device_type_mapping_inside_change_grant_is_updated(self):
+        """Control for the refusal above: an in-grant row still updates through the same path.
+
+        Without this, a regression that skips the mapping write entirely leaves the hidden row
+        unchanged too, so the refusal test alone cannot tell scoping from a dead update path.
+        """
+        from dcim.models import DeviceType
+        from django.http import HttpResponse
+
+        from netbox_librenms_plugin.models import DeviceTypeMapping
+        from netbox_librenms_plugin.tests.view_test_helpers import grant, make_user_with_perms
+        from netbox_librenms_plugin.utils import apply_normalization_rules
+        from netbox_librenms_plugin.views.imports.actions import AddDeviceTypeMappingView
+
+        old_type = make_device("mapping-control-old").device_type
+        new_type = DeviceType.objects.create(
+            manufacturer=old_type.manufacturer,
+            model="Mapping Control New Type",
+            slug="mapping-control-new-type",
+        )
+        raw_hardware = "Allowed Hardware Control"
+        mapping_hardware = apply_normalization_rules(value=raw_hardware, scope="device_type")
+        allowed = DeviceTypeMapping.objects.create(librenms_hardware=mapping_hardware, netbox_device_type=old_type)
+        user = make_user_with_perms("mapping-change-control", [("view", type(old_type))])
+        user = grant(user, "change", DeviceTypeMapping, constraints={"pk": allowed.pk})
+        request = self._request(user, device_type_id=str(new_type.pk), server_key="default")
+        view = AddDeviceTypeMappingView()
+        view.setup(request)
+        view._librenms_api = MagicMock(server_key="default", cache_timeout=300)
+
+        with (
+            patch.object(view, "rebind_api_for_server", return_value="default"),
+            patch(
+                "netbox_librenms_plugin.views.imports.actions.fetch_device_with_cache",
+                return_value={"hardware": raw_hardware},
+            ),
+            patch(
+                "netbox_librenms_plugin.views.imports.actions.DeviceValidationDetailsView.get",
+                return_value=HttpResponse(b"<div></div>"),
+            ),
+            patch.object(view, "validate_and_apply_selections", return_value=(None, None)),
+        ):
+            response = view.post(request, device_id=1)
+
+        assert b"Existing mapping is no longer available." not in response.content
+        allowed.refresh_from_db()
+        assert allowed.netbox_device_type_id == new_type.pk
+
+    def test_platform_mapping_inside_change_grant_is_updated(self):
+        """Control for the platform refusal above (see the device-type control)."""
+        from dcim.models import Platform
+        from django.http import HttpResponse
+
+        from netbox_librenms_plugin.models import PlatformMapping
+        from netbox_librenms_plugin.tests.view_test_helpers import grant, make_user_with_perms
+        from netbox_librenms_plugin.views.imports.actions import AddPlatformMappingView
+
+        old_platform = Platform.objects.create(name="Mapping Control Old", slug="mapping-control-old")
+        new_platform = Platform.objects.create(name="Mapping Control New", slug="mapping-control-new")
+        allowed = PlatformMapping.objects.create(librenms_os="allowed-control-os", netbox_platform=old_platform)
+        user = make_user_with_perms("platform-mapping-change-control", [("view", Platform)])
+        user = grant(user, "change", PlatformMapping, constraints={"pk": allowed.pk})
+        request = self._request(user, platform_id=str(new_platform.pk), server_key="default")
+        view = AddPlatformMappingView()
+        view.setup(request)
+        view._librenms_api = MagicMock(server_key="default", cache_timeout=300)
+
+        with (
+            patch.object(view, "rebind_api_for_server", return_value="default"),
+            patch(
+                "netbox_librenms_plugin.views.imports.actions.fetch_device_with_cache",
+                return_value={"os": "allowed-control-os"},
+            ),
+            patch(
+                "netbox_librenms_plugin.views.imports.actions.DeviceValidationDetailsView.get",
+                return_value=HttpResponse(b"<div></div>"),
+            ),
+            patch.object(view, "get_validated_device_with_selections", return_value=(None, None, None)),
+        ):
+            response = view.post(request, device_id=1)
+
+        assert b"Existing mapping is no longer available." not in response.content
+        allowed.refresh_from_db()
+        assert allowed.netbox_platform_id == new_platform.pk
+
 
 # ---------------------------------------------------------------------------
 # _rebind_or_htmx_error — fail-closed rebind helper for import HTMX endpoints
diff --git a/netbox_librenms_plugin/tests/test_coverage_base_views.py b/netbox_librenms_plugin/tests/test_coverage_base_views.py
index 10a7eabe6f..b1220d5c66 100644
--- a/netbox_librenms_plugin/tests/test_coverage_base_views.py
+++ b/netbox_librenms_plugin/tests/test_coverage_base_views.py
@@ -1488,6 +1488,7 @@ def test_enrich_ports_calls_parse_per_port(self):
         assert view._librenms_api.parse_port_vlan_data.call_count == 2
 
 
+@pytest.mark.django_db
 class TestBaseInterfaceTableViewPost:
     """Tests for BaseInterfaceTableView.post."""
 
@@ -1800,10 +1801,6 @@ def test_post_oob_malformed_but_successful_payload_treated_as_incomplete(self):
             patch.object(view, "get_object", return_value=obj),
             patch.object(view, "get_redirect_url", return_value="/device/1/"),
             patch.object(view, "_enrich_ports_with_vlan_data", side_effect=lambda ports, field: ports),
-            # create=True: downstream branches add a _has_lag_signals() port_stack probe (DB-backed
-            # PortStackLagPattern). Short-circuit it so this non-DB test stays isolated; harmless
-            # where the method doesn't exist yet.
-            patch.object(view, "_has_lag_signals", return_value=False, create=True),
             patch.object(view, "get_context_data", return_value={}),
             patch.object(view, "get_cache_key", return_value="cache-key"),
             patch.object(view, "get_last_fetched_key", return_value="last-key"),
@@ -1841,7 +1838,6 @@ def test_post_oob_non_string_mac_does_not_crash(self):
             patch.object(view, "get_object", return_value=obj),
             patch.object(view, "get_redirect_url", return_value="/device/1/"),
             patch.object(view, "_enrich_ports_with_vlan_data", side_effect=lambda ports, field: ports),
-            patch.object(view, "_has_lag_signals", return_value=False, create=True),
             patch.object(view, "get_context_data", return_value={}),
             patch.object(view, "get_cache_key", return_value="cache-key"),
             patch.object(view, "get_last_fetched_key", return_value="last-key"),
@@ -1897,7 +1893,6 @@ def test_post_placeholder_mac_not_flagged_as_shared_lom(self):
             patch.object(view, "get_object", return_value=obj),
             patch.object(view, "get_redirect_url", return_value="/device/1/"),
             patch.object(view, "_enrich_ports_with_vlan_data", side_effect=lambda ports, field: ports),
-            patch.object(view, "_has_lag_signals", return_value=False, create=True),
             patch.object(view, "get_context_data", return_value={}),
             patch.object(view, "get_cache_key", return_value="cache-key"),
             patch.object(view, "get_last_fetched_key", return_value="last-key"),
@@ -1939,7 +1934,6 @@ def test_post_oob_ports_fetch_failure_warning_omits_oob_id(self):
             patch.object(view, "get_object", return_value=obj),
             patch.object(view, "get_redirect_url", return_value="/device/1/"),
             patch.object(view, "_enrich_ports_with_vlan_data", side_effect=lambda ports, field: ports),
-            patch.object(view, "_has_lag_signals", return_value=False, create=True),
             patch.object(view, "get_context_data", return_value={}),
             patch.object(view, "get_cache_key", return_value="cache-key"),
             patch.object(view, "get_last_fetched_key", return_value="last-key"),
@@ -1977,7 +1971,6 @@ def test_post_oob_invalid_id_marks_snapshot_incomplete(self):
             patch.object(view, "get_object", return_value=obj),
             patch.object(view, "get_redirect_url", return_value="/device/1/"),
             patch.object(view, "_enrich_ports_with_vlan_data", side_effect=lambda ports, field: ports),
-            patch.object(view, "_has_lag_signals", return_value=False, create=True),
             patch.object(view, "get_context_data", return_value={}),
             patch.object(view, "get_cache_key", return_value="cache-key"),
             patch.object(view, "get_last_fetched_key", return_value="last-key"),
@@ -2028,6 +2021,7 @@ def test_post_success_caches_and_renders(self):
             # Ports cache scopes to the VC sync device; pin it to obj so this caching test
             # isn't entangled with VC-routing (cache_device == obj for non-VC anyway).
             patch("netbox_librenms_plugin.views.base.interfaces_view.get_librenms_sync_device", return_value=obj),
+            patch("netbox_librenms_plugin.views.base.interfaces_view.get_librenms_oob", return_value=None),
             patch("netbox_librenms_plugin.views.base.interfaces_view.messages") as mock_messages,
             patch("netbox_librenms_plugin.views.mixins.render") as mock_render,
             patch("netbox_librenms_plugin.views.base.interfaces_view.cache") as mock_cache,
@@ -2043,6 +2037,51 @@ def test_post_success_caches_and_renders(self):
         mock_get_cache_key.assert_called_with(obj, "ports", "default")
         mock_get_last_fetched_key.assert_called_with(obj, "ports", "default")
 
+    def test_post_lag_inference_excludes_oob_ports(self):
+        """port_stack is scoped to the main device, so its lazy-fetch trigger must ignore OOB rows."""
+        view = self._make_view()
+        obj = _mock_obj()
+        request = _mock_request()
+
+        view._librenms_api.get_librenms_id.return_value = 42
+        # Host ports carry no LAG signal; the OOB controller exposes a LAG-typed port.
+        view._librenms_api.get_ports.side_effect = [
+            (True, {"ports": [{"port_id": 1, "ifName": "Gi0/0", "ifType": "ethernetCsmacd"}]}),
+            (True, {"ports": [{"port_id": 2, "ifName": "Po1", "ifType": "ieee8023adLag"}]}),
+        ]
+
+        with (
+            patch.object(view, "get_object", return_value=obj),
+            patch.object(view, "get_redirect_url", return_value="/device/1/"),
+            patch.object(view, "_enrich_ports_with_vlan_data", side_effect=lambda ports, field: ports),
+            patch.object(view, "get_context_data", return_value={}),
+            patch.object(view, "get_cache_key", return_value="cache-key"),
+            patch.object(view, "get_last_fetched_key", return_value="last-key"),
+            patch("netbox_librenms_plugin.views.base.interfaces_view.get_interface_name_field", return_value="ifName"),
+            patch("netbox_librenms_plugin.views.base.interfaces_view.get_librenms_sync_device", return_value=obj),
+            patch("netbox_librenms_plugin.views.base.interfaces_view.get_librenms_oob", return_value={"id": 99}),
+            patch("netbox_librenms_plugin.views.base.interfaces_view.messages"),
+            patch("netbox_librenms_plugin.views.mixins.render") as mock_render,
+            patch("netbox_librenms_plugin.views.base.interfaces_view.cache") as mock_cache,
+            patch("netbox_librenms_plugin.views.base.interfaces_view.timezone"),
+        ):
+            mock_render.return_value = MagicMock()
+            view.post(request, pk=1)
+
+        # Prove the OOB path actually ran end-to-end first — otherwise the assertions below
+        # would also pass if OOB ports were never fetched or merged (the whole point of the
+        # filter being that there *was* an OOB LAG row to exclude).
+        view._librenms_api.get_ports.assert_any_call(99)  # OOB controller ports fetched
+        cached_snapshot = next(
+            call.args[1] for call in mock_cache.set.call_args_list if call.args and call.args[0] == "cache-key"
+        )
+        assert any(p.get("_source") == "oob" for p in cached_snapshot["ports"]), (
+            "OOB row was never merged into the snapshot — the test would pass vacuously"
+        )
+
+        # The OOB LAG row does not trigger the main-device port_stack fetch.
+        view._librenms_api.get_port_stack.assert_not_called()
+
 
 @pytest.mark.django_db
 class TestBaseInterfaceTablePostCoercesLibreNMSId:
@@ -2234,286 +2273,194 @@ def test_corrupt_cached_id_fails_closed_before_get_device_inventory(self):
 class TestBaseInterfaceTableViewGetContextData:
     """Tests for BaseInterfaceTableView.get_context_data."""
 
-    def _make_view(self):
-        from netbox_librenms_plugin.views.base.interfaces_view import BaseInterfaceTableView
+    @staticmethod
+    def _make_real_device_view(device):
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.tests.view_test_helpers import make_request
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
 
-        view = object.__new__(BaseInterfaceTableView)
-        view._librenms_api = MagicMock()
-        view._librenms_api.server_key = "default"
-        view.model = MagicMock()
-        view.model.__name__ = "device"
-        view.interface_name_field = None
-        return view
+        request = make_request("get", path=f"/plugins/librenms/device/{device.pk}/interfaces/")
+        view = DeviceInterfaceTableView()
+        view.setup(request)
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        view._librenms_api = api
+        return view, request
+
+    def _cached_device_context(self, device, snapshot):
+        from django.core.cache import cache
+
+        view, request = self._make_real_device_view(device)
+        cache_key = view.get_cache_key(device, "ports", "default")
+        cache.set(cache_key, snapshot)
+        try:
+            return view.get_context_data(request, device, "ifName", "default")
+        finally:
+            cache.delete(cache_key)
 
-    def test_cache_miss_returns_empty_table(self):
+    def test_vm_interface_lookup_selects_parent(self, db, django_assert_num_queries):
+        """VM relationship rendering must not fetch each parent in a separate query."""
+        from virtualization.models import VMInterface
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.tests.conftest import make_vm
+        from netbox_librenms_plugin.tests.view_test_helpers import make_request
+        from netbox_librenms_plugin.views.object_sync.vms import VMInterfaceTableView
+
+        vm = make_vm("interface-context-parent-prefetch")
+        parent = VMInterface.objects.create(virtual_machine=vm, name="eth0")
+        VMInterface.objects.create(virtual_machine=vm, name="eth0.100", parent=parent)
+        view = VMInterfaceTableView()
+        view.setup(make_request("get"))
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        view._librenms_api = api
+
+        maps = view._build_interface_lookup_maps(vm)
+
+        with django_assert_num_queries(0):
+            assert maps["by_name"]["eth0.100"].parent.pk == parent.pk
+
+    def test_cache_miss_returns_empty_table(self, db):
         """When no cached data, table is None."""
-        view = self._make_view()
-        obj = _mock_obj()
-        request = _mock_request()
+        from django.core.cache import cache
 
-        with (
-            patch.object(view, "get_cache_key", return_value="key"),
-            patch.object(view, "get_last_fetched_key", return_value="last-key"),
-            patch.object(view, "get_vlan_overrides_key", return_value="overrides-key"),
-            patch.object(view, "get_vlan_groups_for_device", return_value=[]),
-            patch.object(view, "_build_vlan_lookup_maps", return_value={}),
-            patch("netbox_librenms_plugin.views.base.interfaces_view.get_interface_name_field", return_value="ifName"),
-            patch("netbox_librenms_plugin.views.base.interfaces_view.cache") as mock_cache,
-            patch("netbox_librenms_plugin.views.base.interfaces_view.timezone"),
-        ):
-            mock_cache.get.return_value = None
-            mock_cache.ttl.return_value = None
-            ctx = view.get_context_data(request, obj, "ifName")
+        device = make_device("interface-context-cache-miss")
+        view, request = self._make_real_device_view(device)
+        cache_key = view.get_cache_key(device, "ports", "default")
+        last_fetched_key = view.get_last_fetched_key(device, "ports", "default")
+        overrides_key = view.get_vlan_overrides_key(device, "default")
+        cache.delete_many((cache_key, last_fetched_key, overrides_key))
+
+        ctx = view.get_context_data(request, device, "ifName", "default")
 
         assert ctx["table"] is None
 
-    def test_malformed_non_dict_cache_degrades_to_empty_table(self):
+    def test_malformed_non_dict_cache_degrades_to_empty_table(self, db):
         """A truthy but non-dict ports cache entry (legacy/older-shape or corrupt) must degrade to an empty table, not AttributeError-500 on .get('ports')."""
-        view = self._make_view()
-        obj = _mock_obj()
-        request = _mock_request()
+        from django.core.cache import cache
 
-        with (
-            patch.object(view, "get_cache_key", return_value="key"),
-            patch.object(view, "get_last_fetched_key", return_value="last-key"),
-            patch.object(view, "get_vlan_overrides_key", return_value="overrides-key"),
-            patch.object(view, "get_vlan_groups_for_device", return_value=[]),
-            patch.object(view, "_build_vlan_lookup_maps", return_value={}),
-            patch("netbox_librenms_plugin.views.base.interfaces_view.get_interface_name_field", return_value="ifName"),
-            patch("netbox_librenms_plugin.views.base.interfaces_view.cache") as mock_cache,
-            patch("netbox_librenms_plugin.views.base.interfaces_view.timezone"),
-        ):
-            # Truthy but wrong shape (a stale list-shaped snapshot). Unfixed `if cached_data:` calls
-            # .get("ports") on the list → AttributeError-500. Fixed isinstance(dict) guard skips it.
-            mock_cache.get.side_effect = lambda key: [{"ports": []}] if key == "key" else None
-            mock_cache.ttl.return_value = None
-            ctx = view.get_context_data(request, obj, "ifName")
+        device = make_device("interface-context-malformed-cache")
+        view, request = self._make_real_device_view(device)
+        cache_key = view.get_cache_key(device, "ports", "default")
+        cache.set(cache_key, [{"ports": []}])
+        try:
+            ctx = view.get_context_data(request, device, "ifName", "default")
+        finally:
+            cache.delete(cache_key)
 
         assert ctx["table"] is None
 
-    def test_cache_hit_non_vc_builds_table(self):
+    def test_cache_hit_non_vc_builds_table(self, db):
         """Cached data without VC produces table."""
-        view = self._make_view()
-        obj = _mock_obj()
-        obj.virtual_chassis = None
-        request = _mock_request()
+        from django.core.cache import cache
 
-        cached_data = {
+        device = make_device("interface-context-cache-hit")
+        make_interface(device, "Gi0/0")
+        view, request = self._make_real_device_view(device)
+        snapshot = {
             "ports": [{"port_id": 1, "ifName": "Gi0/0", "ifAdminStatus": "up", "ifAlias": None, "ifDescr": "Gi0/0"}]
         }
+        cache_key = view.get_cache_key(device, "ports", "default")
+        cache.set(cache_key, snapshot)
+        try:
+            ctx = view.get_context_data(request, device, "ifName", "default")
+        finally:
+            cache.delete(cache_key)
 
-        mock_iface = MagicMock()
-        mock_iface.name = "Gi0/0"
-        mock_ifaces_qs = MagicMock()
-        mock_ifaces_qs.select_related.return_value.prefetch_related.return_value = [mock_iface]
-
-        mock_table = MagicMock()
-        mock_table.configure = MagicMock()
-
-        with (
-            patch.object(view, "get_cache_key", return_value="key"),
-            patch.object(view, "get_last_fetched_key", return_value="last-key"),
-            patch.object(view, "get_vlan_overrides_key", return_value="overrides-key"),
-            patch.object(view, "get_vlan_groups_for_device", return_value=[]),
-            patch.object(view, "_build_vlan_lookup_maps", return_value={"vid_to_groups": {}, "vid_to_vlans": {}}),
-            patch.object(view, "get_interfaces", return_value=mock_ifaces_qs),
-            patch.object(view, "_add_vlan_group_selection"),
-            patch.object(view, "_add_missing_vlans_info"),
-            patch.object(view, "get_table", return_value=mock_table),
-            patch("netbox_librenms_plugin.views.base.interfaces_view.get_interface_name_field", return_value="ifName"),
-            patch("netbox_librenms_plugin.views.base.interfaces_view.cache") as mock_cache,
-            patch("netbox_librenms_plugin.views.base.interfaces_view.timezone") as mock_tz,
-        ):
-            mock_cache.get.side_effect = lambda key: cached_data if key == "key" else None
-            mock_cache.ttl.return_value = 300
-            mock_tz.now.return_value = MagicMock()
-            mock_tz.timedelta.return_value = MagicMock()
-            ctx = view.get_context_data(request, obj, "ifName")
-
-        assert ctx["table"] is mock_table
+        assert ctx["table"] is not None
+        assert len(ctx["table"].data) == 1
         # A complete snapshot is not flagged incomplete.
         assert ctx["oob_incomplete"] is False
 
-    def test_get_context_data_survives_cache_backend_without_ttl(self):
+    def test_get_context_data_survives_cache_backend_without_ttl(self, db):
         """cache.ttl() is Redis-specific and not part of the Django cache API."""
-        view = self._make_view()
-        obj = _mock_obj()
-        obj.virtual_chassis = None
-        request = _mock_request()
-
-        cached_data = {"ports": [{"port_id": 1, "ifName": "Gi0/0", "ifAdminStatus": "up", "ifDescr": "Gi0/0"}]}
+        device = make_device("interface-context-cache-without-ttl")
+        view, request = self._make_real_device_view(device)
+        snapshot = {"ports": [{"port_id": 1, "ifName": "Gi0/0", "ifAdminStatus": "up", "ifDescr": "Gi0/0"}]}
+        cache_key = view.get_cache_key(device, "ports", "default")
 
-        mock_iface = MagicMock()
-        mock_iface.name = "Gi0/0"
-        mock_ifaces_qs = MagicMock()
-        mock_ifaces_qs.select_related.return_value.prefetch_related.return_value = [mock_iface]
-        mock_table = MagicMock()
+        class CacheWithoutTTL:
+            def get(self, key, default=None):
+                return snapshot if key == cache_key else default
 
-        # spec without "ttl" → getattr(cache, "ttl", ...) must take the fallback; a direct
-        # cache.ttl() call (the pre-fix code) would raise AttributeError here.
-        mock_cache = MagicMock(spec=["get", "set", "delete"])
-        mock_cache.get.side_effect = lambda key: cached_data if key == "key" else None
+            def delete(self, _key):
+                return True
 
-        with (
-            patch.object(view, "get_cache_key", return_value="key"),
-            patch.object(view, "get_last_fetched_key", return_value="last-key"),
-            patch.object(view, "get_vlan_overrides_key", return_value="overrides-key"),
-            patch.object(view, "get_vlan_groups_for_device", return_value=[]),
-            patch.object(view, "_build_vlan_lookup_maps", return_value={"vid_to_groups": {}, "vid_to_vlans": {}}),
-            patch.object(view, "get_interfaces", return_value=mock_ifaces_qs),
-            patch.object(view, "_add_vlan_group_selection"),
-            patch.object(view, "_add_missing_vlans_info"),
-            patch.object(view, "get_table", return_value=mock_table),
-            patch("netbox_librenms_plugin.views.base.interfaces_view.get_interface_name_field", return_value="ifName"),
-            patch("netbox_librenms_plugin.views.base.interfaces_view.cache", mock_cache),
-        ):
-            ctx = view.get_context_data(request, obj, "ifName")  # must not raise
+        with patch("netbox_librenms_plugin.views.base.interfaces_view.cache", CacheWithoutTTL()):
+            ctx = view.get_context_data(request, device, "ifName", "default")
 
-        assert ctx["table"] is mock_table
+        assert ctx["table"] is not None
         assert ctx["cache_expiry"] is None
 
-    def test_oob_incomplete_flag_surfaced_from_cache(self):
+    def test_oob_incomplete_flag_surfaced_from_cache(self, db):
         """A cached snapshot tagged oob_incomplete surfaces the flag in context so the template can warn that OOB rows are missing."""
-        view = self._make_view()
-        obj = _mock_obj()
-        obj.virtual_chassis = None
-        request = _mock_request()
-
-        cached_data = {
+        device = make_device("interface-context-oob-incomplete")
+        snapshot = {
             "ports": [{"port_id": 1, "ifName": "Gi0/0", "ifAdminStatus": "up", "ifAlias": None, "ifDescr": "Gi0/0"}],
             "oob_incomplete": True,
         }
-
-        mock_iface = MagicMock()
-        mock_iface.name = "Gi0/0"
-        mock_ifaces_qs = MagicMock()
-        mock_ifaces_qs.select_related.return_value.prefetch_related.return_value = [mock_iface]
-
-        with (
-            patch.object(view, "get_cache_key", return_value="key"),
-            patch.object(view, "get_last_fetched_key", return_value="last-key"),
-            patch.object(view, "get_vlan_overrides_key", return_value="overrides-key"),
-            patch.object(view, "get_vlan_groups_for_device", return_value=[]),
-            patch.object(view, "_build_vlan_lookup_maps", return_value={"vid_to_groups": {}, "vid_to_vlans": {}}),
-            patch.object(view, "get_interfaces", return_value=mock_ifaces_qs),
-            patch.object(view, "_add_vlan_group_selection"),
-            patch.object(view, "_add_missing_vlans_info"),
-            patch.object(view, "get_table", return_value=MagicMock()),
-            patch("netbox_librenms_plugin.views.base.interfaces_view.get_interface_name_field", return_value="ifName"),
-            patch("netbox_librenms_plugin.views.base.interfaces_view.cache") as mock_cache,
-            patch("netbox_librenms_plugin.views.base.interfaces_view.timezone") as mock_tz,
-        ):
-            mock_cache.get.side_effect = lambda key: cached_data if key == "key" else None
-            mock_cache.ttl.return_value = 300
-            mock_tz.now.return_value = MagicMock()
-            mock_tz.timedelta.return_value = MagicMock()
-            ctx = view.get_context_data(request, obj, "ifName")
+        ctx = self._cached_device_context(device, snapshot)
 
         assert ctx["oob_incomplete"] is True
 
-    def test_unowned_relationship_cache_metadata_is_not_surfaced(self):
-        """PR 315 must not expose warning state owned by the later parent/LAG feature."""
-        view = self._make_view()
-        obj = _mock_obj()
-        obj.virtual_chassis = None
-        request = _mock_request()
-
-        cached_data = {
+    def test_relationship_data_incomplete_flag_surfaced_from_cache(self, db):
+        """A failed relationship fetch remains visible on every cached render."""
+        device = make_device("interface-context-relationships-incomplete")
+        snapshot = {
             "ports": [{"port_id": 1, "ifName": "Gi0/0", "ifAdminStatus": "up", "ifAlias": None, "ifDescr": "Gi0/0"}],
             "relationship_data_incomplete": True,
         }
+        ctx = self._cached_device_context(device, snapshot)
 
-        mock_iface = MagicMock()
-        mock_iface.name = "Gi0/0"
-        mock_ifaces_qs = MagicMock()
-        mock_ifaces_qs.select_related.return_value.prefetch_related.return_value = [mock_iface]
-
-        with (
-            patch.object(view, "get_cache_key", return_value="key"),
-            patch.object(view, "get_last_fetched_key", return_value="last-key"),
-            patch.object(view, "get_vlan_overrides_key", return_value="overrides-key"),
-            patch.object(view, "get_vlan_groups_for_device", return_value=[]),
-            patch.object(view, "_build_vlan_lookup_maps", return_value={"vid_to_groups": {}, "vid_to_vlans": {}}),
-            patch.object(view, "get_interfaces", return_value=mock_ifaces_qs),
-            patch.object(view, "_add_vlan_group_selection"),
-            patch.object(view, "_add_missing_vlans_info"),
-            patch.object(view, "get_table", return_value=MagicMock()),
-            patch("netbox_librenms_plugin.views.base.interfaces_view.get_interface_name_field", return_value="ifName"),
-            patch("netbox_librenms_plugin.views.base.interfaces_view.cache") as mock_cache,
-            patch("netbox_librenms_plugin.views.base.interfaces_view.timezone") as mock_tz,
-        ):
-            mock_cache.get.side_effect = lambda key: cached_data if key == "key" else None
-            mock_cache.ttl.return_value = 300
-            mock_tz.now.return_value = MagicMock()
-            mock_tz.timedelta.return_value = MagicMock()
-            ctx = view.get_context_data(request, obj, "ifName")
+        assert ctx["relationship_data_incomplete"] is True
 
-        assert "relationship_data_incomplete" not in ctx
-
-    def test_cache_hit_with_vc_uses_vc_members(self):
-        """Cached data with VC queries each chassis member's interfaces."""
-        view = self._make_view()
+    def test_relationship_data_incomplete_defaults_false(self, db):
+        """A snapshot without the flag does not show a spurious relationship warning."""
+        device = make_device("interface-context-relationships-complete")
+        snapshot = {
+            "ports": [{"port_id": 1, "ifName": "Gi0/0", "ifAdminStatus": "up", "ifAlias": None, "ifDescr": "Gi0/0"}],
+        }
+        ctx = self._cached_device_context(device, snapshot)
 
-        vc = MagicMock()
-        member1 = MagicMock()
-        member1.id = 10
-        member2 = MagicMock()
-        member2.id = 11
-        vc.members.all.return_value = [member1, member2]
+        assert ctx["relationship_data_incomplete"] is False
 
-        obj = _mock_obj()
-        obj.virtual_chassis = vc
-        obj.id = 9999  # distinct from all member IDs so VC path is unambiguous
-        request = _mock_request()
+    def test_cache_hit_with_vc_uses_vc_members(self, db):
+        """Cached VC rows resolve against real chassis members."""
+        from netbox_librenms_plugin.tests.conftest import make_virtual_chassis_members
+        from netbox_librenms_plugin.utils import set_librenms_device_id
 
-        cached_data = {
-            "ports": [{"port_id": 1, "ifName": "Gi0/0", "ifAdminStatus": "up", "ifAlias": "test", "ifDescr": "Gi0/0"}]
+        _virtual_chassis, (member1, member2) = make_virtual_chassis_members("interface-context-vc")
+        interface = make_interface(member2, "Ethernet2")
+        set_librenms_device_id(interface, 1, "default")
+        interface.save()
+        snapshot = {
+            "ports": [
+                {
+                    "port_id": 1,
+                    "ifName": "Ethernet2",
+                    "ifType": "ethernetCsmacd",
+                    "ifAdminStatus": "up",
+                }
+            ]
         }
 
-        mock_iface_qs = MagicMock()
-        mock_iface_qs.select_related.return_value.prefetch_related.return_value = []
+        ctx = self._cached_device_context(member1, snapshot)
 
-        mock_table = MagicMock()
-        mock_table.configure = MagicMock()
+        assert {member.pk for member in ctx["virtual_chassis_members"]} == {member1.pk, member2.pk}
+        assert next(iter(ctx["table"].data))["selected_object_id"] == member2.pk
 
-        with (
-            patch.object(view, "get_cache_key", return_value="key"),
-            patch.object(view, "get_last_fetched_key", return_value="last-key"),
-            patch.object(view, "get_vlan_overrides_key", return_value="overrides-key"),
-            patch.object(view, "get_vlan_groups_for_device", return_value=[]),
-            patch.object(view, "_build_vlan_lookup_maps", return_value={"vid_to_groups": {}, "vid_to_vlans": {}}),
-            patch.object(view, "get_interfaces", return_value=mock_iface_qs),
-            patch.object(view, "_add_vlan_group_selection"),
-            patch.object(view, "_add_missing_vlans_info"),
-            patch.object(view, "get_table", return_value=mock_table),
-            patch(
-                "netbox_librenms_plugin.views.base.interfaces_view.get_virtual_chassis_member",
-                return_value=member1,
-            ) as mock_get_vc_member,
-            patch("netbox_librenms_plugin.views.base.interfaces_view.get_interface_name_field", return_value="ifName"),
-            patch("netbox_librenms_plugin.views.base.interfaces_view.cache") as mock_cache,
-            patch("netbox_librenms_plugin.views.base.interfaces_view.timezone") as mock_tz,
-        ):
-            mock_cache.get.side_effect = lambda key: cached_data if key == "key" else None
-            mock_cache.ttl.return_value = 300
-            mock_tz.now.return_value = MagicMock()
-            mock_tz.timedelta.return_value = MagicMock()
-            ctx = view.get_context_data(request, obj, "ifName")
-
-        # VC members should be included
-        assert ctx["virtual_chassis_members"] is not None
-        # get_virtual_chassis_member should have been called with obj and the port name
-        mock_get_vc_member.assert_called_once_with(obj, "Gi0/0")
-
-    def test_cache_hit_non_vc_ignores_duplicate_librenms_ids(self):
+    def test_cache_hit_non_vc_ignores_duplicate_librenms_ids(self, db):
         """Conflicting interface librenms_id values must not create an arbitrary port-id match."""
-        view = self._make_view()
-        obj = _mock_obj()
-        obj.virtual_chassis = None
-        obj.id = 1
-        request = _mock_request()
-
-        cached_data = {
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+
+        device = make_device("interface-context-duplicate-id")
+        interface_a = make_interface(device, "Gi0/0")
+        interface_b = make_interface(device, "Gi0/1")
+        for interface in (interface_a, interface_b):
+            set_librenms_device_id(interface, 101, "default")
+            interface.save()
+        snapshot = {
             "ports": [
                 {
                     "port_id": 101,
@@ -2524,52 +2471,11 @@ def test_cache_hit_non_vc_ignores_duplicate_librenms_ids(self):
                 }
             ]
         }
+        ctx = self._cached_device_context(device, snapshot)
+        row = next(iter(ctx["table"].data))
 
-        interface_a = MagicMock()
-        interface_a.id = 10
-        interface_a.name = "Gi0/0"
-        interface_b = MagicMock()
-        interface_b.id = 11
-        interface_b.name = "Gi0/1"
-
-        mock_ifaces_qs = MagicMock()
-        mock_ifaces_qs.select_related.return_value.prefetch_related.return_value = [interface_a, interface_b]
-
-        rows_store = {}
-
-        def capture_table(rows, *_args, **_kwargs):
-            rows_store["rows"] = rows
-            table = MagicMock()
-            table.configure = MagicMock()
-            return table
-
-        with (
-            patch.object(view, "get_cache_key", return_value="key"),
-            patch.object(view, "get_last_fetched_key", return_value="last-key"),
-            patch.object(view, "get_vlan_overrides_key", return_value="overrides-key"),
-            patch.object(view, "get_vlan_groups_for_device", return_value=[]),
-            patch.object(view, "_build_vlan_lookup_maps", return_value={"vid_to_groups": {}, "vid_to_vlans": {}}),
-            patch.object(view, "get_interfaces", return_value=mock_ifaces_qs),
-            patch.object(view, "_add_vlan_group_selection"),
-            patch.object(view, "_add_missing_vlans_info"),
-            patch.object(view, "get_table", side_effect=capture_table),
-            patch("netbox_librenms_plugin.views.base.interfaces_view.get_interface_name_field", return_value="ifName"),
-            patch("netbox_librenms_plugin.views.base.interfaces_view.cache") as mock_cache,
-            patch("netbox_librenms_plugin.views.base.interfaces_view.timezone") as mock_tz,
-        ):
-            view._librenms_api.get_stored_librenms_id.side_effect = lambda interface: 101
-            mock_cache.get.side_effect = lambda key: cached_data if key == "key" else None
-            mock_cache.ttl.return_value = 300
-            mock_tz.now.return_value = MagicMock()
-            mock_tz.timedelta.return_value = MagicMock()
-            view.get_context_data(request, obj, "ifName")
-
-        assert "rows" in rows_store
-        assert len(rows_store["rows"]) == 1
-        assert rows_store["rows"][0]["exists_in_netbox"] is False
-        assert rows_store["rows"][0]["netbox_interface"] is None
-        assert view._librenms_api.get_stored_librenms_id.call_count == 2
-        view._librenms_api.get_librenms_id.assert_not_called()
+        assert row["exists_in_netbox"] is False
+        assert row["netbox_interface"] is None
 
 
 class TestBaseInterfaceTableViewAddVlanGroupSelection:
@@ -2666,9 +2572,10 @@ def test_vlan_group_overrides_applied(self):
         from ipam.models import VLANGroup
 
         view = self._make_view()
+        default_group = VLANGroup.objects.create(name="Default-Group", slug="default-group")
         override_group = VLANGroup.objects.create(name="Override-Group", slug="override-group")
         port = {"untagged_vlan": 100, "tagged_vlans": []}
-        lookup_maps = {"vid_to_groups": {}}
+        lookup_maps = {"vid_to_groups": {100: [default_group, override_group]}}
         device = make_device("vlan-ovr-dev")
 
         view._add_vlan_group_selection(port, lookup_maps, device, vlan_group_overrides={"100": str(override_group.pk)})
@@ -3512,34 +3419,27 @@ def test_get_table_raises_not_implemented(self):
         except NotImplementedError:
             pass
 
-    def test_get_context_data_with_none_interface_name_field_calls_helper(self):
-        """When interface_name_field=None, get_interface_name_field(request) is called."""
-        from unittest.mock import MagicMock, patch
+    def test_get_context_data_with_none_interface_name_field_uses_request_preference(self, db):
+        """A missing explicit field uses the real request preference."""
+        from django.core.cache import cache
 
-        view = self._make_view()
-        obj = MagicMock()
-        obj.virtual_chassis = None
-        obj.id = 1
-        request = _mock_request()
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.tests.view_test_helpers import make_request
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
 
-        with (
-            patch.object(view, "get_cache_key", return_value="k"),
-            patch.object(view, "get_last_fetched_key", return_value="lk"),
-            patch.object(view, "get_vlan_overrides_key", return_value="vk"),
-            patch.object(view, "get_vlan_groups_for_device", return_value=[]),
-            patch.object(view, "_build_vlan_lookup_maps", return_value={}),
-            patch(
-                "netbox_librenms_plugin.views.base.interfaces_view.get_interface_name_field",
-                return_value="ifDescr",
-            ) as mock_gnf,
-            patch("netbox_librenms_plugin.views.base.interfaces_view.cache") as mock_cache,
-            patch("netbox_librenms_plugin.views.base.interfaces_view.timezone"),
-        ):
-            mock_cache.get.return_value = None
-            mock_cache.ttl.return_value = None
-            view.get_context_data(request, obj, interface_name_field=None)
+        device = make_device("interface-context-name-preference")
+        request = make_request("get", {"interface_name_field": "ifDescr"})
+        view = DeviceInterfaceTableView()
+        view.setup(request)
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        view._librenms_api = api
+        cache_key = view.get_cache_key(device, "ports", "default")
+        cache.delete(cache_key)
+
+        ctx = view.get_context_data(request, device, interface_name_field=None, server_key="default")
 
-        mock_gnf.assert_called_once_with(request)
+        assert ctx["interface_name_field"] == "ifDescr"
 
     # ---- Real-DB coverage for get_context_data (concrete DeviceInterfaceTableView) ----
     # These replace the prior MagicMock-only versions, which fed a bare MagicMock request into the
@@ -4017,3 +3917,184 @@ def test_read_only_user_gets_read_only_text_not_a_button(self):
         # A genuine view-only plugin user gets muted text, not a live mutating button.
         assert "read-only" in html
         assert move_url not in html
+
+
+@pytest.mark.django_db
+class TestVCInterfaceRenderMemberResolutionNotPerPort:
+    """The VC interface render resolves the owning member from a prebuilt map, not a query per port."""
+
+    def _view(self):
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
+
+        view = object.__new__(DeviceInterfaceTableView)
+        view._librenms_api = MagicMock(server_key="default", cache_timeout=300)
+        return view
+
+    def test_render_query_count_invariant_to_port_count(self):
+        """Rendering 2 vs 8 cached ports issues the SAME number of queries (no per-port member lookup).
+
+        get_virtual_chassis_member was the only per-port DB query in the cached-render loop; passing
+        the prebuilt {vc_position: member} map makes it O(1), so the query count no longer scales
+        with the number of ports.
+        """
+        from dcim.models import Interface
+        from django.core.cache import cache as dj_cache
+        from django.db import connection
+        from django.test import RequestFactory
+        from django.test.utils import CaptureQueriesContext
+
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface, make_virtual_chassis
+
+        m1 = make_device("vc-if-m1")
+        m2 = make_device("vc-if-m2")
+        make_virtual_chassis("vc-if-render", m1, m2)
+        make_interface(m1, "Gi1/0/1")
+        make_interface(m2, "Gi2/0/1")
+        obj = m1  # viewed member; obj.virtual_chassis is the VC
+
+        view = self._view()
+        request = RequestFactory().get("/x/")
+        request.user = make_user_with_perms(
+            "vc-if-render-viewer",
+            [("view", Device), ("view", Interface)],
+        )
+        view.request = request
+        cache_key = view.get_cache_key(obj, "ports", "default")
+
+        def render(nports):
+            ports = [{"port_id": i, "ifName": f"Gi1/0/{i}", "ifType": "ethernetCsmacd"} for i in range(1, nports + 1)]
+            dj_cache.set(cache_key, {"ports": ports})
+            with CaptureQueriesContext(connection) as ctx:
+                context = view.get_context_data(request, obj, "ifName", server_key="default", sync_device=obj)
+            return len(ctx.captured_queries), list(context["table"].data)
+
+        try:
+            # Warm process-level caches (ContentType etc.) first so the two measured renders differ
+            # ONLY by port count, not by cold-cache one-time queries on the first call.
+            render(3)
+            q_small, small_rows = render(2)
+            q_large, large_rows = render(8)
+            assert any(row.get("netbox_interface") is not None for row in small_rows)
+            assert any(row.get("netbox_interface") is not None for row in large_rows)
+            assert q_large == q_small, f"query count scaled with ports: {q_small} -> {q_large} (per-port N+1)"
+        finally:
+            # Django's cache isn't wrapped in the test's DB-transaction rollback, so delete the
+            # entry (like the sibling cache-based tests) to avoid leaking it into later runs.
+            dj_cache.delete(cache_key)
+
+
+@pytest.mark.django_db
+class TestEnrichPortLagParentNameFallback:
+    """Relationship name fallback must honor the user-selected name field.
+
+    The displayed LAG/parent name comes from port.get(interface_name_field) and
+    The relationship signal already scans {ifName, ifDescr, interface_name_field}; the
+    match fallback (no stored librenms_id on either side) compared ifName/ifDescr
+    only, so an ifAlias-driven deployment misreported a genuine match as mismatch.
+    """
+
+    def test_lag_match_via_interface_name_field_alias(self):
+        from netbox_librenms_plugin.interface_relationships import RelationshipMaps, enrich_port_relationships
+
+        dev = make_device("lag-alias-host")
+        agg = make_interface(dev, "CUSTOMER-UPLINK-A", iface_type="lag")  # named from ifAlias
+        member = make_interface(dev, "Gi0/1")
+        member.lag = agg
+        member.save()
+
+        agg_port = {"port_id": 10, "ifName": "Po1", "ifDescr": "Port-channel1", "ifAlias": "CUSTOMER-UPLINK-A"}
+        port = {"port_id": 1, "netbox_interface": member}
+
+        enrich_port_relationships(
+            port,
+            RelationshipMaps({1: 10}, {}, {10: agg_port}),
+            interface_name_field="ifAlias",
+        )
+
+        assert port["librenms_lag_name"] == "CUSTOMER-UPLINK-A"
+        assert port["lag_sync_status"] == "match"
+
+    def test_parent_match_via_interface_name_field_alias(self):
+        from netbox_librenms_plugin.interface_relationships import RelationshipMaps, enrich_port_relationships
+
+        dev = make_device("parent-alias-host")
+        parent = make_interface(dev, "CORE-TRUNK-B")  # named from ifAlias
+        child = make_interface(dev, "Gi0/2.100")
+        child.parent = parent
+        child.save()
+
+        parent_port = {"port_id": 20, "ifName": "Gi0/2", "ifDescr": "GigabitEthernet0/2", "ifAlias": "CORE-TRUNK-B"}
+        port = {"port_id": 2, "netbox_interface": child}
+
+        enrich_port_relationships(
+            port,
+            RelationshipMaps({}, {2: 20}, {20: parent_port}),
+            interface_name_field="ifAlias",
+        )
+
+        assert port["librenms_parent_name"] == "CORE-TRUNK-B"
+        assert port["parent_sync_status"] == "match"
+
+
+@pytest.mark.django_db
+class TestEnrichPortLagParentStatusSymmetry:
+    """LAG and parent must classify sync status identically across all 5 branches (the invariant the shared helper guarantees)."""
+
+    def _status(self, kind, *, lnms_has_rel, nb_related, n):
+        """Enrich a fresh port for ONE relationship kind and return its sync status.
+
+        kind: "lag" | "parent". nb_related: None | "matching" | "nonmatching".
+        """
+        from netbox_librenms_plugin.interface_relationships import RelationshipMaps, enrich_port_relationships
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+
+        dev = make_device(f"rel-sym-{kind}-{n}")
+        child = make_interface(dev, f"child-{kind}-{n}")
+        child_pid = 1000 + n
+        set_librenms_device_id(child, child_pid, "default")
+        rel_lnms_port_id = 500 + n
+
+        by_id = {}
+        if nb_related is not None:
+            related = make_interface(dev, f"rel-{kind}-{n}", iface_type="lag" if kind == "lag" else "other")
+            if nb_related == "matching":
+                set_librenms_device_id(related, rel_lnms_port_id, "default")
+                related.save()
+            setattr(child, "lag" if kind == "lag" else "parent", related)
+        child.save()
+
+        rel_map = {}
+        if lnms_has_rel:
+            # ifName intentionally "rel-<kind>-<n>" so a "matching" related iface (same name) matches
+            # by name too, and a "nonmatching" one (named "other-...") fails both id and name.
+            by_id[rel_lnms_port_id] = {"port_id": rel_lnms_port_id, "ifName": f"rel-{kind}-{n}"}
+            rel_map = {child_pid: rel_lnms_port_id}
+            if nb_related == "nonmatching":
+                related.name = f"other-{kind}-{n}"
+                related.save()
+
+        port = {"port_id": child_pid, "netbox_interface": child}
+        enrich_port_relationships(
+            port,
+            RelationshipMaps(
+                rel_map if kind == "lag" else {},
+                rel_map if kind == "parent" else {},
+                by_id,
+            ),
+            interface_name_field="ifName",
+        )
+        return port["lag_sync_status" if kind == "lag" else "parent_sync_status"]
+
+    def test_all_status_branches_are_symmetric(self):
+        # (lnms_has_rel, nb_related) -> expected status; run through BOTH relationship kinds.
+        scenarios = [
+            (True, "matching", "match"),
+            (True, "nonmatching", "mismatch"),
+            (True, None, "missing_nb"),
+            (False, "matching", "missing_lnms"),  # NetBox has the related iface, LibreNMS doesn't
+            (False, None, None),
+        ]
+        for i, (has_rel, nb_rel, expected) in enumerate(scenarios):
+            lag = self._status("lag", lnms_has_rel=has_rel, nb_related=nb_rel, n=i)
+            parent = self._status("parent", lnms_has_rel=has_rel, nb_related=nb_rel, n=100 + i)
+            assert lag == parent == expected, f"{(has_rel, nb_rel)}: lag={lag} parent={parent} expected={expected}"
diff --git a/netbox_librenms_plugin/tests/test_coverage_device_fields.py b/netbox_librenms_plugin/tests/test_coverage_device_fields.py
index db567cd171..4c97f527c4 100644
--- a/netbox_librenms_plugin/tests/test_coverage_device_fields.py
+++ b/netbox_librenms_plugin/tests/test_coverage_device_fields.py
@@ -1354,6 +1354,39 @@ def _rival_commits_first():
         assert not message_texts(req, "error")
         assert message_texts(req, "success")
 
+    def test_integrity_error_reuse_succeeds_for_an_add_only_user(self):
+        """The race winner must be reused by a user who may create but not view platforms.
+
+        This branch runs only when no platform existed at preflight, so the gate asked for
+        ("add", Platform) and never ("view", Platform). Re-reading the winner through a
+        view-restricted queryset returns none() for such a user and aborts an assign they were
+        authorized to perform.
+        """
+        from dcim.models import Device, Platform
+
+        device = make_device("plat-race-add-only")
+        user = make_user_with_perms("plat-race-add-only", [("change", Device), ("add", Platform)])
+        request = _make_request(
+            {"platform_name": "AddOnlyRacePlatform", "manufacturer": "", "create_mapping": ""},
+            user=user,
+        )
+        view = self._view(request)
+
+        def _rival_commits_first():
+            Platform.objects.create(name="AddOnlyRacePlatform", slug="addonlyraceplatform")
+
+        with (
+            _before_restricted_read(view, _rival_commits_first, on_call=1),
+            patch.object(Platform, "full_clean", _skip_once(Platform.full_clean)),
+        ):
+            _post(view, request, pk=device.pk)
+
+        winner = Platform.objects.get(name__iexact="AddOnlyRacePlatform")
+        assert Platform.objects.filter(name__iexact="AddOnlyRacePlatform").count() == 1
+        device.refresh_from_db()
+        assert device.platform_id == winner.pk
+        assert message_texts(request, "error") == []
+
     def _success_setup(self, platform_name="ios", librenms_os="ios", create_mapping="1", user=None):
         """Return ``(view, request, device)`` for a run that reaches the mapping block."""
         from django.utils.text import slugify
diff --git a/netbox_librenms_plugin/tests/test_coverage_devices.py b/netbox_librenms_plugin/tests/test_coverage_devices.py
index 62c56fd572..f2ae48680f 100644
--- a/netbox_librenms_plugin/tests/test_coverage_devices.py
+++ b/netbox_librenms_plugin/tests/test_coverage_devices.py
@@ -50,6 +50,7 @@ def _configured_default():
 def _real_port(**overrides):
     """A LibreNMS-shaped port dict with every field LibreNMSInterfaceTable.format_interface_data reads."""
     port = {
+        "port_id": 4001,
         "ifName": "eth0",
         "ifDescr": "eth0",
         "ifAlias": "",
@@ -315,6 +316,31 @@ def _make_view(self):
         view.require_object_permissions_json = MagicMock(return_value=None)
         return view
 
+    def test_denied_without_view_device_permission(self):
+        """The verify endpoint must reject a user lacking dcim.view_device (no probing arbitrary device IDs for cached interface data)."""
+        import json
+
+        from django.http import JsonResponse
+
+        view = self._make_view()
+        # Simulate the real object-permission gate denying access.
+        view.require_object_permissions_json = MagicMock(
+            return_value=JsonResponse({"error": "Missing permissions: dcim.view_device"}, status=403)
+        )
+        request = MagicMock()
+        request.body = json.dumps({"device_id": 1, "interface_name": "eth0"}).encode()
+
+        mock_device = MagicMock()
+        mock_device.virtual_chassis = None
+        with patch.object(view, "restrict_object_or_404", return_value=mock_device) as mock_get_obj:
+            with patch("netbox_librenms_plugin.views.object_sync.devices.cache") as mock_cache:
+                response = view.post(request)
+
+        assert response.status_code == 403
+        # Must deny before resolving the device (no ID probing) and before the cache.
+        mock_get_obj.assert_not_called()
+        mock_cache.get.assert_not_called()
+
     def test_returns_400_when_no_device_id(self):
         """Returns 400 JSON error when no device_id in request body."""
         import json
@@ -328,6 +354,7 @@ def test_returns_400_when_no_device_id(self):
         response = view.post(request)
         assert isinstance(response, JsonResponse)
         assert response.status_code == 400
+        view.require_object_permissions_json.assert_called_once_with("POST")
 
     def test_checks_permission_before_resolving_device(self):
         """The object-view gate must run BEFORE restrict_object_or_404 so an unauthorized caller can't probe arbitrary device IDs (existence via 404). Exercises the REAL require_object_permissions_json (only request.user.has_perm is mocked) — mocking the gate itself would mask a missing NetBoxObjectPermissionMixin base (AttributeError/500 in production)."""
@@ -370,6 +397,33 @@ def test_returns_404_when_no_cached_data(self):
         assert isinstance(response, JsonResponse)
         assert response.status_code == 404
 
+    def test_returns_404_when_cached_data_malformed(self):
+        """A truthy but malformed cache value (non-dict) is treated as a miss (404), not a 500 — reading .get() on it would raise AttributeError."""
+        import json
+
+        from django.http import JsonResponse
+
+        view = self._make_view()
+        request = MagicMock()
+        request.body = json.dumps({"device_id": 1, "interface_name": "eth0"}).encode()
+
+        mock_device = MagicMock()
+        mock_device.virtual_chassis = None
+
+        with patch.object(view, "restrict_object_or_404", return_value=mock_device):
+            with patch(
+                "netbox_librenms_plugin.views.object_sync.devices.get_librenms_sync_device", return_value=mock_device
+            ):
+                with patch("netbox_librenms_plugin.views.object_sync.devices.cache") as mock_cache:
+                    # A truthy non-dict snapshot: the old `if cached_data:` guard would enter and
+                    # raise on `cached_data.get("ports", [])`.
+                    mock_cache.get.return_value = ["not", "a", "dict"]
+                    with patch.object(view, "get_cache_key", return_value="test_key"):
+                        response = view.post(request)
+
+        assert isinstance(response, JsonResponse)
+        assert response.status_code == 404
+
     @pytest.mark.django_db
     def test_returns_404_when_interface_not_in_cache(self):
         """Returns 404 when the requested interface isn't among the real cached ports."""
@@ -418,6 +472,7 @@ def test_returns_success_when_interface_found(self):
             {
                 "device_id": device.pk,
                 "interface_name": "eth0",
+                "port_id": 4001,
                 "interface_name_field": "ifName",
                 "server_key": "default",
             },
@@ -455,6 +510,7 @@ def test_non_vc_device_uses_own_cache_key_no_sync_lookup(self):
             {
                 "device_id": device.pk,
                 "interface_name": "eth0",
+                "port_id": 4001,
                 "interface_name_field": "ifName",
                 "server_key": "default",
             },
@@ -479,6 +535,211 @@ def test_non_vc_device_uses_own_cache_key_no_sync_lookup(self):
         assert isinstance(response, JsonResponse)
         assert response.status_code == 200  # cache hit under the device's OWN key proves it was used directly
 
+    @pytest.mark.django_db
+    def test_resolves_netbox_interface_by_stable_port_id_not_name(self):
+        """The NetBox interface is matched by its stored LibreNMS port_id, not the display name — a naming-mode mismatch (synced under ifName, viewed under ifDescr) must not mis-resolve onto a same-display-named decoy. Driven through the real view/DB/render so the assertion is on rendered behaviour, not mock call patterns."""
+        import json
+
+        from django.core.cache import cache
+        from django.test import RequestFactory
+
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+
+        device = make_device("verify-portid-host")
+        # Decoy: its NetBox name equals the ifDescr display the client posts, but it carries the
+        # WRONG LibreNMS port_id and is DISABLED — a name-based lookup would wrongly land here.
+        decoy = make_interface(device, "GigabitEthernet0/1")
+        decoy.enabled = False
+        set_librenms_device_id(decoy, 7, "default")  # mutates custom_field_data in memory only
+        decoy.save()
+        # Correct: stored LibreNMS port_id 42 identifies it, though its NetBox name ("Gi0/1")
+        # differs from the current ifDescr display. ENABLED, matching the port's up state.
+        correct = make_interface(device, "Gi0/1")
+        correct.enabled = True
+        set_librenms_device_id(correct, 42, "default")
+        correct.save()
+
+        port_data = {
+            "ifDescr": "GigabitEthernet0/1",
+            "ifName": "Gi0/1",
+            "port_id": 42,
+            "ifSpeed": 1000,
+            "ifType": "ethernetCsmacd",
+            "ifAlias": "",
+            "ifPhysAddress": "",
+            "ifMtu": 1500,
+            "ifAdminStatus": "up",
+            "_source": "host",
+        }
+
+        view = self._make_view()
+        # cache.set() writes the real cache backend (NOT rolled back with the test DB); clean
+        # the key up even on assertion failure so a reused device PK cannot read stale ports.
+        cache_key = view.get_cache_key(device, "ports", "default")
+        cache.set(cache_key, {"ports": [port_data]})
+        try:
+            request = RequestFactory().post(
+                "/plugins/librenms_plugin/verify-interface/",
+                data=json.dumps(
+                    {
+                        "device_id": device.pk,
+                        "interface_name": "GigabitEthernet0/1",
+                        "interface_name_field": "ifDescr",
+                        "port_id": 42,
+                        "server_key": "default",
+                    }
+                ),
+                content_type="application/json",
+            )
+            request.user = _make_verify_superuser("verify-portid")
+            response = view.post(request)
+
+            assert response.status_code == 200
+            formatted = json.loads(response.content)["formatted_row"]
+            # The 'enabled' badge compares the RESOLVED interface's enabled flag against the port's
+            # up state. Resolving by stable port_id picks the enabled id-42 interface → green match;
+            # a display-name fallback would pick the disabled decoy → an orange mismatch. So a green
+            # badge proves port_id precedence over the name lookup — asserted on real rendered output.
+            assert "text-success" in formatted["enabled"]
+            assert "text-warning" not in formatted["enabled"]
+        finally:
+            cache.delete(cache_key)
+
+    @pytest.mark.django_db
+    def test_verify_repaint_payload_includes_member_specific_librenms_id_cell(self):
+        """The verify response's formatted_row must carry a librenms_id cell so a VC member switch can repaint the (member-specific) badge — its colour compares this port_id against the resolved member's stored librenms_id, so omitting it strands the previous member's match/mismatch state on screen."""
+        import json
+
+        from django.core.cache import cache
+        from django.test import RequestFactory
+
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+
+        device = make_device("verify-badge-host")
+        iface = make_interface(device, "Gi0/1")
+        set_librenms_device_id(iface, 42, "default")  # mutates custom_field_data in memory only
+        iface.save()
+
+        port_data = {
+            "ifDescr": "Gi0/1",
+            "ifName": "Gi0/1",
+            "port_id": 42,
+            "ifSpeed": 1000,
+            "ifType": "ethernetCsmacd",
+            "ifAlias": "",
+            "ifPhysAddress": "",
+            "ifMtu": 1500,
+            "ifAdminStatus": "up",
+            "_source": "host",
+        }
+
+        view = self._make_view()
+        # cache.set() writes the real cache backend (NOT rolled back with the test DB); clean
+        # the key up even on assertion failure so a reused device PK cannot read stale ports.
+        cache_key = view.get_cache_key(device, "ports", "default")
+        cache.set(cache_key, {"ports": [port_data]})
+        try:
+            request = RequestFactory().post(
+                "/plugins/librenms_plugin/verify-interface/",
+                data=json.dumps(
+                    {
+                        "device_id": device.pk,
+                        "interface_name": "Gi0/1",
+                        "interface_name_field": "ifName",
+                        "port_id": 42,
+                        "server_key": "default",
+                    }
+                ),
+                content_type="application/json",
+            )
+            request.user = _make_verify_superuser("verify-badge")
+            response = view.post(request)
+
+            assert response.status_code == 200
+            formatted = json.loads(response.content)["formatted_row"]
+            # The cell must be present (it was previously dropped from the repaint payload) and
+            # reflect THIS member: port_id 42 matches the resolved interface's stored librenms_id 42,
+            # so the badge is the green "match".
+            assert "librenms_id" in formatted, "verify repaint payload dropped the librenms_id cell"
+            assert "text-success" in formatted["librenms_id"]
+        finally:
+            cache.delete(cache_key)
+
+    @pytest.mark.django_db
+    def test_verify_repaint_resolves_the_selected_vc_members_librenms_id(self):
+        """Through a REAL virtual chassis: the repaint badge must reflect the SELECTED member's interface (owner-pinned resolution), while the cache key normalizes to the VC sync device. A decoy same-named interface on the sync master carries a DIFFERENT stored librenms_id, so any regression that resolves against the sync device instead of the member renders the orange mismatch, not the green match asserted here."""
+        import json
+
+        from django.core.cache import cache
+        from django.test import RequestFactory
+
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface, make_virtual_chassis
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+
+        master = make_device("verify-vc-master")
+        member = make_device("verify-vc-member")
+        make_virtual_chassis("verify-vc", master, member)
+        # Device-level librenms_id makes the MASTER the VC sync device (priority 1 in
+        # get_librenms_sync_device), so the ports cache lives under the master's key.
+        set_librenms_device_id(master, 4242, "default")  # in-memory CF mutation...
+        master.save()  # ...must be persisted for the sync-device lookup to see it
+
+        # Decoy on the sync master: same display name, DIFFERENT stored port id. Resolving
+        # against the master would match this row and paint the mismatch badge.
+        decoy = make_interface(master, "Gi0/1")
+        set_librenms_device_id(decoy, 99, "default")
+        decoy.save()
+
+        iface = make_interface(member, "Gi0/1")
+        set_librenms_device_id(iface, 42, "default")
+        iface.save()
+
+        port_data = {
+            "ifDescr": "Gi0/1",
+            "ifName": "Gi0/1",
+            "port_id": 42,
+            "ifSpeed": 1000,
+            "ifType": "ethernetCsmacd",
+            "ifAlias": "",
+            "ifPhysAddress": "",
+            "ifMtu": 1500,
+            "ifAdminStatus": "up",
+            "_source": "host",
+        }
+
+        view = self._make_view()
+        # Cache under the SYNC device (master) — the view normalizes the selected member to it.
+        cache_key = view.get_cache_key(master, "ports", "default")
+        cache.set(cache_key, {"ports": [port_data]})
+        try:
+            request = RequestFactory().post(
+                "/plugins/librenms_plugin/verify-interface/",
+                data=json.dumps(
+                    {
+                        "device_id": member.pk,
+                        "interface_name": "Gi0/1",
+                        "interface_name_field": "ifName",
+                        "port_id": 42,
+                        "server_key": "default",
+                    }
+                ),
+                content_type="application/json",
+            )
+            request.user = _make_verify_superuser("verify-vc")
+            response = view.post(request)
+
+            assert response.status_code == 200
+            formatted = json.loads(response.content)["formatted_row"]
+            assert "librenms_id" in formatted, "verify repaint payload dropped the librenms_id cell"
+            # Green = matched the MEMBER's stored id (42). The master's decoy stores 99, so a
+            # sync-device-resolved badge would be the orange mismatch instead.
+            assert "text-success" in formatted["librenms_id"]
+            assert "text-warning" not in formatted["librenms_id"]
+        finally:
+            cache.delete(cache_key)
+
 
 class TestSingleModuleVerifyView:
     """Tests for SingleModuleVerifyView."""
@@ -866,6 +1127,26 @@ def test_returns_400_when_invalid_vid(self):
         assert isinstance(response, JsonResponse)
         assert response.status_code == 400
 
+    @pytest.mark.django_db
+    def test_returns_400_when_vlan_group_id_is_not_an_integer(self):
+        """Reject a malformed group ID before it reaches the restricted ORM lookup."""
+        import json
+
+        from netbox_librenms_plugin.views.object_sync.devices import SingleVlanGroupVerifyView
+
+        device = _make_real_device("vg-invalid-group")
+        request = _real_verify_request(
+            {"device_id": device.pk, "vid": "100", "vlan_group_id": "not-an-id"},
+            "vg-invalid-group",
+        )
+        view = SingleVlanGroupVerifyView()
+        view.setup(request)
+
+        response = view.post(request)
+
+        assert response.status_code == 400
+        assert json.loads(response.content)["message"] == "Invalid VLAN group ID"
+
     @pytest.mark.django_db
     def test_returns_success_with_vlan_group(self):
         """A VID present in the selected group is reported not-missing — real Device/Interface/VLAN/VLANGroup, no mocks."""
@@ -1029,6 +1310,25 @@ def test_returns_400_when_invalid_vid(self):
         assert isinstance(response, JsonResponse)
         assert response.status_code == 400
 
+    @pytest.mark.django_db
+    def test_returns_400_when_vlan_group_id_is_not_an_integer(self):
+        """Reject a malformed group ID before it reaches the restricted ORM lookup."""
+        import json
+
+        from netbox_librenms_plugin.views.object_sync.devices import VerifyVlanSyncGroupView
+
+        request = _real_verify_request(
+            {"vid": "100", "vlan_group_id": "not-an-id"},
+            "sync-invalid-group",
+        )
+        view = VerifyVlanSyncGroupView()
+        view.setup(request)
+
+        response = view.post(request)
+
+        assert response.status_code == 400
+        assert json.loads(response.content)["message"] == "Invalid VLAN group ID"
+
     @pytest.mark.django_db
     def test_returns_success_with_vlan_group(self):
         """A VLAN that exists in the selected group with a matching name reports exists_in_netbox — real DB, no mocks."""
diff --git a/netbox_librenms_plugin/tests/test_coverage_sync_interfaces.py b/netbox_librenms_plugin/tests/test_coverage_sync_interfaces.py
index 8e9d655859..2f41433370 100644
--- a/netbox_librenms_plugin/tests/test_coverage_sync_interfaces.py
+++ b/netbox_librenms_plugin/tests/test_coverage_sync_interfaces.py
@@ -9,8 +9,26 @@
 
 import pytest
 
-from netbox_librenms_plugin.tests.conftest import make_device, make_interface, make_virtual_chassis_members, make_vm
-from netbox_librenms_plugin.tests.view_test_helpers import make_request, make_user_with_perms, make_view, missing_pk
+from netbox_librenms_plugin.interface_relationships import (
+    build_interface_index,
+    interface_owner_for_object,
+    resolve_interface_by_port_id,
+)
+from netbox_librenms_plugin.tests.conftest import (
+    make_device,
+    make_interface,
+    make_virtual_chassis_members,
+    make_vm,
+)
+from netbox_librenms_plugin.tests.view_test_helpers import (
+    grant,
+    make_request,
+    make_user_with_perms,
+    make_view,
+    message_texts,
+    missing_pk,
+    post as _post,
+)
 
 # The views here are built with real requests and real users, so the whole file needs the DB.
 pytestmark = pytest.mark.django_db
@@ -39,10 +57,27 @@ def _sync_view(request=None):
     return view
 
 
-def _denied_response():
-    resp = MagicMock()
-    resp.status_code = 403
-    return resp
+def _cache_relationship(view, obj, relation_field, source_id, related_id, source_name="", related_name=""):
+    """Seed the real VC-scoped cache snapshot required by an inline relationship POST."""
+    from django.core.cache import cache
+
+    from netbox_librenms_plugin.utils import get_librenms_sync_device
+
+    cache_obj = get_librenms_sync_device(obj, server_key="default") or obj
+    cache_key = view.get_cache_key(cache_obj, "ports", "default")
+    relationships = {"lag_members": {}, "sub_interfaces": {}}
+    relationships[relation_field][source_id] = related_id
+    ports = [{"port_id": source_id, "ifName": source_name or f"port-{source_id}"}]
+    if related_id != source_id:
+        ports.append({"port_id": related_id, "ifName": related_name or f"port-{related_id}"})
+    cache.set(
+        cache_key,
+        {
+            "ports": ports,
+            "port_stack_relationships": relationships,
+        },
+    )
+    return cache_key
 
 
 # ===========================================================================
@@ -76,6 +111,236 @@ def test_invalid_type_raises_http404(self):
             view.get_required_permissions_for_object_type("invalid")
 
 
+class TestSyncInterfaceParentViewPermissions:
+    """Exercise the object-type-specific parent endpoint with real rows and grants."""
+
+    def test_vm_post_links_real_vminterfaces(self):
+        from types import SimpleNamespace
+
+        from virtualization.models import VirtualMachine, VMInterface
+
+        from netbox_librenms_plugin.tests.conftest import make_vm
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceParentView
+
+        vm = make_vm("parent-permissions-vm")
+        child = VMInterface.objects.create(virtual_machine=vm, name="Ethernet1.100")
+        parent = VMInterface.objects.create(virtual_machine=vm, name="Ethernet1")
+        set_librenms_device_id(child, 10, "default")
+        set_librenms_device_id(parent, 11, "default")
+        child.save()
+        parent.save()
+        user = make_user_with_perms(
+            "parent-permissions-vm",
+            [("view", VirtualMachine), ("view", VMInterface), ("change", VMInterface)],
+        )
+        request = _make_request(
+            {"port_id": "10", "parent_port_id": "11", "parent_name": "Ethernet1"},
+            user=user,
+        )
+        view = SyncInterfaceParentView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        _cache_relationship(view, vm, "sub_interfaces", 10, 11, child.name, parent.name)
+
+        response = _post(view, request, object_type="virtualmachine", object_id=vm.pk)
+
+        assert response.status_code == 200, response.content
+        child.refresh_from_db()
+        assert child.parent_id == parent.pk
+
+    def test_invalid_type_raises_http404(self):
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceParentView
+        from django.http import Http404
+        import pytest
+
+        view = SyncInterfaceParentView()
+        with pytest.raises(Http404):
+            view.post(_make_request(), "invalid", 1)
+
+
+class TestSyncInterfaceLagViewPermissions:
+    def test_vm_post_is_rejected_before_any_lookup(self):
+        from django.http import Http404
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceLagView
+
+        with pytest.raises(Http404):
+            SyncInterfaceLagView().post(_make_request(), "virtualmachine", 1)
+
+
+def _js_source():
+    from pathlib import Path
+
+    import netbox_librenms_plugin
+
+    return (
+        Path(netbox_librenms_plugin.__file__).parent / "static" / "netbox_librenms_plugin" / "js" / "librenms_sync.js"
+    ).read_text(encoding="utf-8")
+
+
+def _js_block(source, start_anchor, end_anchor=None):
+    """Slice a handler block by its anchor comments, failing with a clear message (not a bare ValueError) when an anchor was reworded or the block moved."""
+    assert start_anchor in source, f"anchor comment missing from librenms_sync.js: {start_anchor!r}"
+    start = source.index(start_anchor)
+    if end_anchor is None:
+        return source[start:]
+    assert end_anchor in source[start:], f"anchor comment missing from librenms_sync.js: {end_anchor!r}"
+    return source[start : source.index(end_anchor, start)]
+
+
+def test_relationship_handler_reuses_shared_csrf_helper():
+    import re
+
+    handler = _js_block(_js_source(), "// Event delegation for LAG and parent interface sync buttons.")
+    # Regexes tolerate spacing/quote reformatting; the tokens themselves are the contract.
+    assert re.search(r"const\s+csrf\s*=\s*getCsrfToken\(\)", handler), "handler must use the shared getCsrfToken()"
+    assert not re.search(r"querySelector\(\s*['\"]\[name=csrfmiddlewaretoken\]", handler), (
+        "handler must not re-query the raw csrf input"
+    )
+
+
+def test_interface_member_verify_rebinds_replaced_vlan_controls():
+    """Replacing the VLAN cell must bind the new edit button before the user can click it."""
+    handler = _js_block(
+        _js_source(),
+        "function handleInterfaceChange(select, value)",
+        "function handleCableChange(select, value)",
+    )
+    vlan_repaint = "vlanCell.innerHTML = formattedRow.vlans;"
+    assert vlan_repaint in handler
+    assert "initializeVlanGroupSelects();" in handler[handler.index(vlan_repaint) :]
+
+
+def test_interface_member_verify_posts_the_origin_page_device():
+    """The verify response must preserve page-level migrated mode across a member change."""
+    handler = _js_block(
+        _js_source(),
+        "function handleInterfaceChange(select, value)",
+        "function handleCableChange(select, value)",
+    )
+    assert "origin_device_id:" in handler
+    assert "[data-interface-origin-device-id]" in handler
+
+
+def test_vlan_apply_all_skips_groups_unavailable_to_a_target_row():
+    handler = _js_block(
+        _js_source(),
+        "function applyButtonUpdates()",
+        "// Persist overrides in server cache",
+    )
+
+    assert "const matchedGroup = groups.find" in handler
+    assert "if (newGroupId && !matchedGroup) return;" in handler
+
+
+def test_reenabling_relationship_autoselect_replays_checked_rows():
+    """Checked children rebuild cross-page parent inputs when auto-select is re-enabled."""
+    import re
+
+    handler = _js_block(
+        _js_source(),
+        "// Keep cross-page parent notices symmetric",
+        "Show a brief inline notice",
+    )
+    assert re.search(r"toggle\.matches\(\s*['\"]#autoSelectLagMembers['\"]\s*\)", handler), (
+        "toggle handler must key on #autoSelectLagMembers"
+    )
+    assert re.search(r"if\s*\(\s*toggle\.checked\s*\)", handler), "re-enable branch must gate on toggle.checked"
+    # Backreference pins the string closing after the disabled-row exclusion. A suffix such as
+    # :not(*) (valid CSS, matches nothing) must fail this instead of slipping past a prefix check.
+    assert re.search(
+        r"querySelectorAll\(\s*(['\"])input\[name=.select.\]:checked:not\(:disabled\)\1\s*\)",
+        handler,
+    ), "re-enable branch must replay exactly the checked, enabled rows"
+    assert re.search(r"dispatchEvent\(\s*new\s+Event\(\s*['\"]change['\"]\s*,\s*\{\s*bubbles:\s*true", handler), (
+        "replay must re-dispatch a bubbling change event"
+    )
+
+
+def test_cross_page_parent_does_not_copy_child_member_target():
+    """An off-page parent is resolved independently instead of inheriting the child's owner."""
+    handler = _js_block(
+        _js_source(),
+        "// --- Sub-interface: select parent when checking ---",
+        "// --- Sub-interface: undo parent auto-selection",
+    )
+
+    assert "_showParentCrossPageNotice" in handler
+    assert "auto_parent_port_id" not in handler
+    assert "device_selection_" not in handler
+
+
+def test_interface_verify_application_failure_is_reported():
+    """A 2xx rejection must expose its server-provided reason before rollback."""
+    rejected = _js_block(
+        _js_source(),
+        "// 2xx with data.status !== 'success'",
+        "rollbackToLastVerified();",
+    )
+    assert "console.error('Interface verification rejected:', data.error || data.message" in rejected
+
+
+def test_relationship_sync_missing_data_shows_alert_icon():
+    """A relationship button with incomplete data must show a visible failure state."""
+    rejected = _js_block(
+        _js_source(),
+        "if (!portId || !relatedPortId || !objectId || !url)",
+        "// Fail fast: a missing input",
+    )
+    assert "btn.innerHTML = '<i class=\"mdi mdi-alert text-danger\"></i>'" in rejected
+    assert "Required relationship data is unavailable." in rejected
+
+
+def test_cross_page_parent_notice_close_button_has_accessible_name():
+    """The icon-only notice close button must expose its purpose to screen readers."""
+    import re
+
+    notice = _js_block(
+        _js_source(),
+        "function _showParentCrossPageNotice(parentName)",
+        "// VIRTUAL CHASSIS & VRF HANDLING",
+    )
+    assert re.search(
+        r"closeBtn\.setAttribute\(\s*['\"]aria-label['\"]\s*,\s*['\"]Close['\"]\s*\)",
+        notice,
+    )
+
+
+def test_relationship_row_selectors_are_css_escaped():
+    import re
+
+    handler = _js_block(
+        _js_source(),
+        "// --- Sub-interface: select parent when checking ---",
+        "// Keep cross-page parent notices symmetric",
+    )
+    source = _js_source()
+    assert 'data-member-of-lag="' + "' + CSS.escape(portId)" in source, (
+        "the LAG-member selector must CSS.escape the port id"
+    )
+    assert source.count('data-port-id="' + "' + CSS.escape(parentPortId)") == 2, (
+        "both parent-row selectors must CSS.escape the port id"
+    )
+    assert re.search(r"data-parent-port-id=\"'\s*\+\s*CSS\.escape\(parentPortId\)", handler), (
+        "the sibling-row attribute selector must CSS.escape the port id"
+    )
+
+
+def test_interface_select_all_has_one_change_handler():
+    source = _js_source()
+    assert source.count("toggleAll.addEventListener('change'") == 1
+
+
+def test_interface_bulk_selection_ignores_disabled_rows():
+    """Client bulk actions must match the browser form contract for disabled controls."""
+    source = _js_source()
+    table_handler = _js_block(source, "function initializeTableCheckboxes(tableId)", "function initializeCheckboxes()")
+    bulk_handler = _js_block(source, "function initializeBulkEditApply()", "// TABLE FILTERING")
+
+    assert 'td input[name="select"]:not(:disabled)' in table_handler
+    assert 'input[name="select"]:checked:not(:disabled)' in bulk_handler
+    assert 'input[name="select"]:not(:disabled)' in bulk_handler
+
+
 # ===========================================================================
 # SyncInterfacesView.get_object
 # ===========================================================================
@@ -118,28 +383,27 @@ def test_invalid_type_raises_http404(self):
 
 
 # ===========================================================================
-# SyncInterfacesView.get_selected_interfaces
+# SyncInterfacesView.get_selected_port_ids
 # ===========================================================================
 
 
-class TestSyncInterfacesViewGetSelectedInterfaces:
+class TestSyncInterfacesViewGetSelectedPortIds:
     def test_empty_selection_returns_none(self):
         from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
 
         view = object.__new__(SyncInterfacesView)
         req = _make_request(post_data={})
-        with patch("netbox_librenms_plugin.views.sync.interfaces.messages") as mock_msgs:
-            result = view.get_selected_interfaces(req, "ifName")
+        result = view.get_selected_port_ids(req)
         assert result is None
-        mock_msgs.error.assert_called_once()
+        assert message_texts(req, "error") == ["No interfaces selected for synchronization."]
 
-    def test_with_selection_returns_list(self):
+    def test_with_selection_returns_set(self):
         from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
 
         view = object.__new__(SyncInterfacesView)
-        req = _make_request(post_data={"select": ["Gi0/1", "Gi0/2"]})
-        result = view.get_selected_interfaces(req, "ifName")
-        assert result == ["Gi0/1", "Gi0/2"]
+        req = _make_request(post_data={"select": ["10", "11"]})
+        result = view.get_selected_port_ids(req)
+        assert result == {10, 11}
 
 
 # ===========================================================================
@@ -248,36 +512,50 @@ def test_no_server_key_uses_librenms_api(self):
         view.get_cache_key.assert_called_once_with(mock_obj, "ports", "mykey")
 
 
+@pytest.mark.django_db
 class TestInterfaceContextOOBRows:
     """get_context_data must not let OOB-controller rows hide / falsely-match main-device interfaces in the netbox-only reconciliation set."""
 
-    def _make_view(self, cached_ports):
-        from dcim.models import Device
-
-        from netbox_librenms_plugin.views.base.interfaces_view import BaseInterfaceTableView
+    def _make_view(self):
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
 
-        view = object.__new__(BaseInterfaceTableView)
-        # get_context_data resolves select_related via self.model.__name__, so a
-        # well-formed view under test must set it (a Device here, matching obj below).
-        view.model = Device
-        # Main device has an "idrac0" interface that LibreNMS only reports on the
-        # OOB-controller side (same name) — it must still surface as netbox-only.
-        iface = MagicMock(id=10, enabled=True, description="")
-        iface.name = "idrac0"  # `name` is reserved in the MagicMock constructor
-        iface.get_absolute_url.return_value = "/iface/10/"
-        view._build_interface_lookup_maps = MagicMock(return_value={"by_name": {"idrac0": iface}, "by_librenms_id": {}})
+        # Concrete device view: its real get_interfaces()/get_select_related_field() drive the
+        # real _build_interface_lookup_maps over obj.interfaces, and the real
+        # get_stored_librenms_id (a local custom-field/cache read — NOT an HTTP call) resolves
+        # idrac0's stored id to None for real. A real LibreNMSAPI is built under a config patch;
+        # __init__ only reads config, so no network is touched.
+        view = object.__new__(DeviceInterfaceTableView)
+        servers = {
+            "default": {
+                "librenms_url": "https://librenms.example.com",
+                "api_token": "test-token",
+                "cache_timeout": 300,
+                "verify_ssl": True,
+            }
+        }
+        with patch("netbox_librenms_plugin.librenms_api.get_plugin_config", return_value=servers):
+            view._librenms_api = LibreNMSAPI(server_key="default")
         view.get_vlan_groups_for_device = MagicMock(return_value=[])
         view._build_vlan_lookup_maps = MagicMock(return_value={})
         view._add_vlan_group_selection = MagicMock()
         view._add_missing_vlans_info = MagicMock()
-        table = MagicMock()
-        view.get_table = MagicMock(return_value=table)
+        view.get_table = MagicMock(return_value=MagicMock())
         view.get_cache_key = MagicMock(return_value="ports-key")
         view.get_last_fetched_key = MagicMock(return_value="lf-key")
         view.get_vlan_overrides_key = MagicMock(return_value="ov-key")
-        return view, cached_ports
+        return view
+
+    @staticmethod
+    def _host_with_idrac():
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+
+        device = make_device("host1")
+        # Main device has an "idrac0" interface that LibreNMS only reports on the
+        # OOB-controller side (same name) — it must still surface as netbox-only.
+        make_interface(device, "idrac0")
+        return device
 
-    @pytest.mark.django_db
     def test_oob_row_does_not_match_or_hide_host_interface(self):
         """An OOB row sharing a host interface name renders unmatched (not bound to the host interface) and still doesn't suppress that host interface from the netbox-only set."""
         from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
@@ -288,7 +566,7 @@ def test_oob_row_does_not_match_or_hide_host_interface(self):
 
         # Real DeviceInterfaceTableView so the real get_interfaces + _build_interface_lookup_maps
         # + per-port reconciliation run; only peripheral plumbing (vlan helpers, table build,
-        # cache-key derivation) is stubbed.
+        # cache-key derivation) is stubbed. A captured get_table lets us assert the OOB row's fields.
         view = object.__new__(DeviceInterfaceTableView)
         # Stub only the LibreNMS client boundary; these interfaces genuinely carry no stored id.
         view._librenms_api = MagicMock()
@@ -321,11 +599,956 @@ def cache_get(key):
         # ...and the host's own idrac0 still surfaces as netbox-only (the OOB row doesn't suppress it).
         assert "idrac0" in {i["name"] for i in ctx["netbox_only_interfaces"]}
 
+    def test_oob_row_does_not_hide_netbox_only_interface(self):
+        view = self._make_view()
+        obj = self._host_with_idrac()
+        cached = {"ports": [{"ifName": "idrac0", "_source": "oob", "port_id": 999}]}
+        req = _make_request()
+
+        def cache_get(key):
+            return cached if key == "ports-key" else ({} if key == "ov-key" else None)
+
+        with patch("netbox_librenms_plugin.views.base.interfaces_view.cache") as mock_cache:
+            mock_cache.get.side_effect = cache_get
+            mock_cache.ttl.return_value = None
+            ctx = view.get_context_data(req, obj, "ifName", "default")
+
+        names = {i["name"] for i in ctx["netbox_only_interfaces"]}
+        assert "idrac0" in names  # OOB row must not suppress the main-device interface
+
+    def test_name_fallback_does_not_match_an_interface_bound_to_another_port(self):
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
+
+        device = make_device("table-conflicting-port-id")
+        wrong_interface = make_interface(device, "Ethernet1")
+        aggregate = make_interface(device, "Port-Channel1", iface_type="lag")
+        set_librenms_device_id(wrong_interface, 30, "default")
+        set_librenms_device_id(aggregate, 40, "default")
+        wrong_interface.save()
+        aggregate.save()
+        snapshot = {
+            "ports": [
+                {"port_id": 20, "ifName": "Ethernet1", "ifType": "ethernetCsmacd"},
+                {"port_id": 40, "ifName": "Port-Channel1", "ifType": "ieee8023adLag"},
+            ],
+            "port_stack_relationships": {
+                "lag_members": {20: 40},
+                "sub_interfaces": {},
+            },
+        }
+        request = _make_request()
+        view = DeviceInterfaceTableView()
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        view._librenms_api = api
+        view.request = request
+
+        context = view.get_context_data(
+            request,
+            device,
+            "ifName",
+            "default",
+            fresh_data=snapshot,
+            sync_device=device,
+        )
+
+        row = snapshot["ports"][0]
+        assert row["exists_in_netbox"] is False
+        assert row["netbox_interface"] is None
+        assert "lag-sync-btn" not in str(context["table"].render_parent(None, row))
+
+    def test_relationship_button_is_hidden_when_related_interface_does_not_exist(self):
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
+
+        device = make_device("table-missing-related-interface")
+        source = make_interface(device, "Ethernet1")
+        set_librenms_device_id(source, 10, "default")
+        source.save()
+        snapshot = {
+            "ports": [
+                {"port_id": 10, "ifName": "Ethernet1", "ifType": "ethernetCsmacd"},
+                {"port_id": 20, "ifName": "Port-Channel1", "ifType": "ieee8023adLag"},
+            ],
+            "port_stack_relationships": {
+                "lag_members": {10: 20},
+                "sub_interfaces": {},
+            },
+        }
+        request = _make_request()
+        view = DeviceInterfaceTableView()
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        view._librenms_api = api
+        view.request = request
+
+        context = view.get_context_data(
+            request,
+            device,
+            "ifName",
+            "default",
+            fresh_data=snapshot,
+            sync_device=device,
+        )
+
+        row = snapshot["ports"][0]
+        assert row["lag_sync_status"] == "missing_nb"
+        assert "lag-sync-btn" not in str(context["table"].render_parent(None, row))
+
+    def test_relationship_button_resolves_an_unbound_same_name_source(self):
+        from types import SimpleNamespace
+
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceParentView
+
+        device = make_device("table-unbound-relationship-source")
+        child = make_interface(device, "Ethernet1.100", iface_type="virtual")
+        parent = make_interface(device, "Ethernet1")
+        set_librenms_device_id(parent, 20, "default")
+        parent.save()
+        snapshot = {
+            "ports": [
+                {"port_id": 11, "ifName": "Ethernet1.100", "ifType": "l2vlan"},
+                {"port_id": 20, "ifName": "Ethernet1", "ifType": "ethernetCsmacd"},
+            ],
+            "port_stack_relationships": {
+                "lag_members": {},
+                "sub_interfaces": {11: 20},
+            },
+        }
+        render_request = _make_request()
+        table_view = DeviceInterfaceTableView()
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        table_view._librenms_api = api
+        table_view.request = render_request
+        cache_key = table_view.get_cache_key(device, "ports", "default")
+        cache.set(cache_key, snapshot)
+        try:
+            context = table_view.get_context_data(
+                render_request,
+                device,
+                "ifName",
+                "default",
+                fresh_data=snapshot,
+                sync_device=device,
+            )
+
+            row = snapshot["ports"][0]
+            rendered = str(context["table"].render_parent(None, row))
+            assert "parent-sync-btn" in rendered
+            request = _make_request(
+                {
+                    "port_id": "11",
+                    "source_name": "Ethernet1.100",
+                    "interface_name_field": "ifName",
+                    "parent_port_id": "20",
+                    "parent_name": "Ethernet1",
+                }
+            )
+            relationship_view = SyncInterfaceParentView()
+            relationship_view._librenms_api = SimpleNamespace(server_key="default")
+
+            response = _post(
+                relationship_view,
+                request,
+                object_type="device",
+                object_id=device.pk,
+            )
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 200, response.content
+        child.refresh_from_db()
+        assert child.parent_id == parent.pk
+
+    def test_unrelated_duplicate_cached_id_does_not_break_inline_parent_sync(self):
+        """Duplicate cached IDs outside the current edge must not make its button fail."""
+        from types import SimpleNamespace
+
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceParentView
+
+        device = make_device("inline-unrelated-duplicate-id")
+        child = make_interface(device, "Ethernet1.100", iface_type="virtual")
+        parent = make_interface(device, "Ethernet1")
+        for interface, port_id in ((child, 10), (parent, 20)):
+            set_librenms_device_id(interface, port_id, "default")
+            interface.save()
+        snapshot = {
+            "ports": [
+                {"port_id": 10, "ifName": child.name, "ifType": "l2vlan"},
+                {"port_id": 20, "ifName": parent.name, "ifType": "ethernetCsmacd"},
+                {"port_id": 30, "ifName": "unrelated-a", "ifType": "ethernetCsmacd"},
+                {"port_id": "030", "ifName": "unrelated-b", "ifType": "ethernetCsmacd"},
+            ],
+            "port_stack_relationships": {"lag_members": {}, "sub_interfaces": {10: 20}},
+        }
+        render_request = _make_request()
+        table_view = DeviceInterfaceTableView()
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        table_view._librenms_api = api
+        table_view.request = render_request
+        cache_key = table_view.get_cache_key(device, "ports", "default")
+        cache.set(cache_key, snapshot)
+        try:
+            context = table_view.get_context_data(
+                render_request,
+                device,
+                "ifName",
+                "default",
+                fresh_data=snapshot,
+                sync_device=device,
+            )
+            source_row = snapshot["ports"][0]
+            assert "parent-sync-btn" in str(context["table"].render_parent(None, source_row))
+
+            relationship_view = SyncInterfaceParentView()
+            relationship_view._librenms_api = SimpleNamespace(server_key="default")
+            response = _post(
+                relationship_view,
+                _make_request(
+                    {
+                        "port_id": "10",
+                        "interface_name_field": "ifName",
+                        "parent_port_id": "20",
+                    }
+                ),
+                object_type="device",
+                object_id=device.pk,
+            )
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 200, response.content
+        child.refresh_from_db()
+        assert child.parent_id == parent.pk
+
+    def test_duplicate_display_name_does_not_make_unbound_source_actionable(self):
+        from types import SimpleNamespace
+
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceParentView
+
+        device = make_device("table-ambiguous-unbound-source")
+        source = make_interface(device, "Ethernet", iface_type="virtual")
+        first_parent = make_interface(device, "Parent1")
+        second_parent = make_interface(device, "Parent2")
+        set_librenms_device_id(first_parent, 20, "default")
+        set_librenms_device_id(second_parent, 21, "default")
+        first_parent.save()
+        second_parent.save()
+        snapshot = {
+            "ports": [
+                {"port_id": 10, "ifName": "Gi0/1", "ifDescr": "Ethernet", "ifType": "l2vlan"},
+                {"port_id": 11, "ifName": "Gi0/2", "ifDescr": "Ethernet", "ifType": "l2vlan"},
+                {"port_id": 20, "ifName": "Parent1", "ifDescr": "Parent1", "ifType": "ethernetCsmacd"},
+                {"port_id": 21, "ifName": "Parent2", "ifDescr": "Parent2", "ifType": "ethernetCsmacd"},
+            ],
+            "port_stack_relationships": {
+                "lag_members": {},
+                "sub_interfaces": {10: 20, 11: 21},
+            },
+        }
+        render_request = _make_request()
+        table_view = DeviceInterfaceTableView()
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        table_view._librenms_api = api
+        table_view.request = render_request
+        cache_key = table_view.get_cache_key(device, "ports", "default")
+        cache.set(cache_key, snapshot)
+        try:
+            context = table_view.get_context_data(
+                render_request,
+                device,
+                "ifDescr",
+                "default",
+                fresh_data=snapshot,
+                sync_device=device,
+            )
+            for row in snapshot["ports"][:2]:
+                assert row["netbox_interface"] is None
+                assert "parent-sync-btn" not in str(context["table"].render_parent(None, row))
+
+            request = _make_request(
+                {
+                    "port_id": "10",
+                    "source_name": "Ethernet",
+                    "interface_name_field": "ifDescr",
+                    "parent_port_id": "20",
+                    "parent_name": "Parent1",
+                }
+            )
+            relationship_view = SyncInterfaceParentView()
+            relationship_view._librenms_api = SimpleNamespace(server_key="default")
+            response = _post(relationship_view, request, object_type="device", object_id=device.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 404
+        source.refresh_from_db()
+        assert source.parent_id is None
+
+    def test_inline_relationship_rejects_an_edge_replaced_in_the_current_cache(self):
+        from types import SimpleNamespace
+
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceParentView
+
+        device = make_device("stale-inline-parent")
+        child = make_interface(device, "Ethernet1.100", iface_type="virtual")
+        old_parent = make_interface(device, "Ethernet1")
+        current_parent = make_interface(device, "Ethernet2")
+        for interface, port_id in ((child, 10), (old_parent, 20), (current_parent, 30)):
+            set_librenms_device_id(interface, port_id, "default")
+            interface.save()
+        snapshot = {
+            "ports": [
+                {"port_id": 10, "ifName": child.name, "ifType": "l2vlan"},
+                {"port_id": 20, "ifName": old_parent.name, "ifType": "ethernetCsmacd"},
+                {"port_id": 30, "ifName": current_parent.name, "ifType": "ethernetCsmacd"},
+            ],
+            "port_stack_relationships": {"lag_members": {}, "sub_interfaces": {10: 30}},
+        }
+        view = SyncInterfaceParentView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        cache_key = view.get_cache_key(device, "ports", "default")
+        cache.set(cache_key, snapshot)
+        request = _make_request(
+            {
+                "port_id": "10",
+                "source_name": child.name,
+                "interface_name_field": "ifName",
+                "parent_port_id": "20",
+                "parent_name": old_parent.name,
+            }
+        )
+
+        try:
+            response = _post(view, request, object_type="device", object_id=device.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 409
+        child.refresh_from_db()
+        assert child.parent_id is None
+
+    def test_inline_relationship_rejects_conflicting_canonical_cache_edges(self):
+        from types import SimpleNamespace
+
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceParentView
+
+        device = make_device("conflicting-canonical-inline-edge")
+        child = make_interface(device, "Ethernet1.100", iface_type="virtual")
+        first_parent = make_interface(device, "Ethernet1")
+        second_parent = make_interface(device, "Ethernet2")
+        for interface, port_id in ((child, 10), (first_parent, 20), (second_parent, 30)):
+            set_librenms_device_id(interface, port_id, "default")
+            interface.save()
+        snapshot = {
+            "ports": [
+                {"port_id": 10, "ifName": child.name},
+                {"port_id": 20, "ifName": first_parent.name},
+                {"port_id": 30, "ifName": second_parent.name},
+            ],
+            "port_stack_relationships": {
+                "lag_members": {},
+                "sub_interfaces": {"10": 20, "010": 30},
+            },
+        }
+        view = SyncInterfaceParentView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        cache_key = view.get_cache_key(device, "ports", "default")
+        cache.set(cache_key, snapshot)
+        request = _make_request(
+            {
+                "port_id": "10",
+                "interface_name_field": "ifName",
+                "parent_port_id": "20",
+            }
+        )
+
+        try:
+            response = _post(view, request, object_type="device", object_id=device.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 409
+        child.refresh_from_db()
+        assert child.parent_id is None
+
+    def test_duplicate_unbound_related_name_in_vc_has_no_inline_action(self):
+        from types import SimpleNamespace
+
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceLagView
+
+        _virtual_chassis, (member1, member2) = make_virtual_chassis_members("ambiguous-related-vc")
+        source = make_interface(member1, "Ethernet1")
+        first_aggregate = make_interface(member1, "Port-Channel1")
+        second_aggregate = make_interface(member2, "Port-Channel1")
+        set_librenms_device_id(source, 10, "default")
+        source.save()
+        snapshot = {
+            "ports": [
+                {"port_id": 10, "ifName": source.name, "ifType": "ethernetCsmacd"},
+                {"port_id": 20, "ifName": "Port-Channel1", "ifType": "ieee8023adLag"},
+            ],
+            "port_stack_relationships": {"lag_members": {10: 20}, "sub_interfaces": {}},
+        }
+        render_request = _make_request()
+        table_view = DeviceInterfaceTableView()
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        table_view._librenms_api = api
+        table_view.request = render_request
+        cache_key = table_view.get_cache_key(member1, "ports", "default")
+        cache.set(cache_key, snapshot)
+        try:
+            context = table_view.get_context_data(
+                render_request,
+                member1,
+                "ifName",
+                "default",
+                fresh_data=snapshot,
+                sync_device=member1,
+            )
+            source_row = snapshot["ports"][0]
+            assert "lag-sync-btn" not in str(context["table"].render_parent(None, source_row))
+
+            request = _make_request(
+                {
+                    "port_id": "10",
+                    "interface_name_field": "ifName",
+                    "lag_port_id": "20",
+                }
+            )
+            relationship_view = SyncInterfaceLagView()
+            relationship_view._librenms_api = SimpleNamespace(server_key="default")
+            response = _post(relationship_view, request, object_type="device", object_id=member1.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 404
+        source.refresh_from_db()
+        first_aggregate.refresh_from_db()
+        second_aggregate.refresh_from_db()
+        assert source.lag_id is None
+        assert first_aggregate.type != "lag"
+        assert second_aggregate.type != "lag"
+
+    def test_duplicate_related_port_id_in_vc_has_no_inline_action(self):
+        from types import SimpleNamespace
+
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceLagView
+
+        _virtual_chassis, (member1, member2) = make_virtual_chassis_members("duplicate-related-id-vc")
+        source = make_interface(member1, "Ethernet1")
+        first_aggregate = make_interface(member1, "Port-Channel1")
+        second_aggregate = make_interface(member2, "Port-Channel2")
+        for interface, port_id in ((source, 10), (first_aggregate, 20), (second_aggregate, 20)):
+            set_librenms_device_id(interface, port_id, "default")
+            interface.save()
+        snapshot = {
+            "ports": [
+                {"port_id": 10, "ifName": source.name, "ifType": "ethernetCsmacd"},
+                {"port_id": 20, "ifName": first_aggregate.name, "ifType": "ieee8023adLag"},
+            ],
+            "port_stack_relationships": {"lag_members": {10: 20}, "sub_interfaces": {}},
+        }
+        render_request = _make_request()
+        table_view = DeviceInterfaceTableView()
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        table_view._librenms_api = api
+        table_view.request = render_request
+        cache_key = table_view.get_cache_key(member1, "ports", "default")
+        cache.set(cache_key, snapshot)
+        try:
+            context = table_view.get_context_data(
+                render_request,
+                member1,
+                "ifName",
+                "default",
+                fresh_data=snapshot,
+                sync_device=member1,
+            )
+            source_row = snapshot["ports"][0]
+            assert "lag-sync-btn" not in str(context["table"].render_parent(None, source_row))
+
+            request = _make_request(
+                {
+                    "port_id": "10",
+                    "interface_name_field": "ifName",
+                    "lag_port_id": "20",
+                }
+            )
+            relationship_view = SyncInterfaceLagView()
+            relationship_view._librenms_api = SimpleNamespace(server_key="default")
+            response = _post(relationship_view, request, object_type="device", object_id=member1.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 404
+        source.refresh_from_db()
+        assert source.lag_id is None
+
+    def test_duplicate_cached_related_port_id_has_no_inline_action(self):
+        from types import SimpleNamespace
+
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceParentView
+
+        device = make_device("duplicate-cached-related-id")
+        source = make_interface(device, "Ethernet1.100", iface_type="virtual")
+        parent = make_interface(device, "Ethernet1")
+        set_librenms_device_id(source, 10, "default")
+        set_librenms_device_id(parent, 20, "default")
+        source.save()
+        parent.save()
+        snapshot = {
+            "ports": [
+                {"port_id": 10, "ifName": source.name, "ifType": "l2vlan"},
+                {"port_id": 20, "ifName": parent.name, "ifType": "ethernetCsmacd"},
+                {"port_id": "020", "ifName": "duplicate-parent", "ifType": "ethernetCsmacd"},
+            ],
+            "port_stack_relationships": {"lag_members": {}, "sub_interfaces": {10: 20}},
+        }
+        render_request = _make_request()
+        table_view = DeviceInterfaceTableView()
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        table_view._librenms_api = api
+        table_view.request = render_request
+        cache_key = table_view.get_cache_key(device, "ports", "default")
+        cache.set(cache_key, snapshot)
+        try:
+            context = table_view.get_context_data(
+                render_request,
+                device,
+                "ifName",
+                "default",
+                fresh_data=snapshot,
+                sync_device=device,
+            )
+            source_row = snapshot["ports"][0]
+            assert "parent-sync-btn" not in str(context["table"].render_parent(None, source_row))
+
+            request = _make_request({"port_id": "10", "interface_name_field": "ifName", "parent_port_id": "20"})
+            relationship_view = SyncInterfaceParentView()
+            relationship_view._librenms_api = SimpleNamespace(server_key="default")
+            response = _post(relationship_view, request, object_type="device", object_id=device.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 409
+        source.refresh_from_db()
+        assert source.parent_id is None
+
+    def test_duplicate_cached_source_port_id_is_disabled_and_verify_rejects_it(self):
+        import json
+
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.tests.view_test_helpers import make_superuser
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.object_sync.devices import (
+            DeviceInterfaceTableView,
+            SingleInterfaceVerifyView,
+        )
+
+        device = make_device("duplicate-cached-source-id")
+        source = make_interface(device, "Ethernet1.100", iface_type="virtual")
+        parent = make_interface(device, "Ethernet1")
+        set_librenms_device_id(source, 10, "default")
+        set_librenms_device_id(parent, 20, "default")
+        source.save()
+        parent.save()
+        snapshot = {
+            "ports": [
+                {"port_id": 10, "ifName": source.name, "ifType": "l2vlan"},
+                {"port_id": "010", "ifName": "duplicate-source", "ifType": "l2vlan"},
+                {"port_id": 20, "ifName": parent.name, "ifType": "ethernetCsmacd"},
+            ],
+            "port_stack_relationships": {"lag_members": {}, "sub_interfaces": {10: 20}},
+        }
+        user = make_superuser("duplicate-cached-source-id")
+        render_request = _make_request(user=user)
+        table_view = DeviceInterfaceTableView()
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        table_view._librenms_api = api
+        table_view.request = render_request
+        cache_key = table_view.get_cache_key(device, "ports", "default")
+        cache.set(cache_key, snapshot)
+        try:
+            table_view.get_context_data(
+                render_request,
+                device,
+                "ifName",
+                "default",
+                fresh_data=snapshot,
+                sync_device=device,
+            )
+            assert all(row["sync_target_resolvable"] is False for row in snapshot["ports"][:2])
+
+            verify_request = make_request(
+                "post",
+                json.dumps(
+                    {
+                        "device_id": device.pk,
+                        "interface_name": "duplicate-source",
+                        "interface_name_field": "ifName",
+                        "port_id": 10,
+                    }
+                ),
+                user=user,
+                path="/verify/",
+                content_type="application/json",
+            )
+            verify_view = SingleInterfaceVerifyView()
+            verify_view._librenms_api = api
+            response = verify_view.post(verify_request)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 404
+
+    def test_missing_port_id_disables_member_selection_and_verify_rejects_it(self):
+        import json
+
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.tests.view_test_helpers import make_superuser
+        from netbox_librenms_plugin.views.object_sync.devices import (
+            DeviceInterfaceTableView,
+            SingleInterfaceVerifyView,
+        )
+
+        _virtual_chassis, (page_device, _member) = make_virtual_chassis_members("missing-row-port-id")
+        snapshot = {
+            "ports": [
+                {"port_id": None, "ifName": "Gi0/1", "ifDescr": "Ethernet", "ifType": "ethernetCsmacd"},
+                {"port_id": None, "ifName": "Gi0/2", "ifDescr": "Ethernet", "ifType": "ethernetCsmacd"},
+            ],
+            "port_stack_relationships": {},
+        }
+        user = make_superuser("missing-row-port-id")
+        render_request = _make_request(user=user)
+        table_view = DeviceInterfaceTableView()
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        table_view._librenms_api = api
+        table_view.request = render_request
+        cache_key = table_view.get_cache_key(page_device, "ports", "default")
+        cache.set(cache_key, snapshot)
+        try:
+            context = table_view.get_context_data(
+                render_request,
+                page_device,
+                "ifDescr",
+                "default",
+                fresh_data=snapshot,
+                sync_device=page_device,
+            )
+            assert snapshot["ports"][1]["sync_target_resolvable"] is False
+            assert "disabled" in str(context["table"].render_device_selection(None, snapshot["ports"][1]))
+
+            verify_request = make_request(
+                "post",
+                json.dumps(
+                    {
+                        "device_id": page_device.pk,
+                        "interface_name": "Ethernet",
+                        "interface_name_field": "ifDescr",
+                        "port_id": None,
+                    }
+                ),
+                user=user,
+                path="/verify/",
+                content_type="application/json",
+            )
+            verify_view = SingleInterfaceVerifyView()
+            verify_view._librenms_api = api
+            response = verify_view.post(verify_request)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 404
+
+    def test_duplicate_source_port_id_has_no_inline_action(self):
+        from types import SimpleNamespace
+
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceLagView
+
+        device = make_device("duplicate-source-id")
+        source = make_interface(device, "Ethernet1")
+        duplicate_source = make_interface(device, "Ethernet2")
+        aggregate = make_interface(device, "Port-Channel1", iface_type="lag")
+        for interface, port_id in ((source, 10), (duplicate_source, 10), (aggregate, 20)):
+            set_librenms_device_id(interface, port_id, "default")
+            interface.save()
+        snapshot = {
+            "ports": [
+                {"port_id": 10, "ifName": source.name, "ifType": "ethernetCsmacd"},
+                {"port_id": 20, "ifName": aggregate.name, "ifType": "ieee8023adLag"},
+            ],
+            "port_stack_relationships": {"lag_members": {10: 20}, "sub_interfaces": {}},
+        }
+        render_request = _make_request()
+        table_view = DeviceInterfaceTableView()
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        table_view._librenms_api = api
+        table_view.request = render_request
+        cache_key = table_view.get_cache_key(device, "ports", "default")
+        cache.set(cache_key, snapshot)
+        try:
+            context = table_view.get_context_data(
+                render_request,
+                device,
+                "ifName",
+                "default",
+                fresh_data=snapshot,
+                sync_device=device,
+            )
+            source_row = snapshot["ports"][0]
+            assert "lag-sync-btn" not in str(context["table"].render_parent(None, source_row))
+
+            request = _make_request(
+                {
+                    "port_id": "10",
+                    "interface_name_field": "ifName",
+                    "lag_port_id": "20",
+                }
+            )
+            relationship_view = SyncInterfaceLagView()
+            relationship_view._librenms_api = SimpleNamespace(server_key="default")
+            response = _post(relationship_view, request, object_type="device", object_id=device.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 404
+        source.refresh_from_db()
+        duplicate_source.refresh_from_db()
+        assert source.lag_id is None
+        assert duplicate_source.lag_id is None
+
+    def test_hidden_related_interface_has_no_inline_action(self):
+        from types import SimpleNamespace
+
+        from dcim.models import Device, Interface
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceParentView
+
+        device = make_device("hidden-related-interface-action")
+        child = make_interface(device, "Ethernet1.100", iface_type="virtual")
+        parent = make_interface(device, "Ethernet1")
+        set_librenms_device_id(child, 10, "default")
+        set_librenms_device_id(parent, 20, "default")
+        child.save()
+        parent.save()
+        user = make_user_with_perms("hidden-related-interface-action", [("view", Device)])
+        user = grant(user, "change", Interface, constraints={"id": child.pk})
+        snapshot = {
+            "ports": [
+                {"port_id": 10, "ifName": child.name, "ifType": "l2vlan"},
+                {"port_id": 20, "ifName": parent.name, "ifType": "ethernetCsmacd"},
+            ],
+            "port_stack_relationships": {"lag_members": {}, "sub_interfaces": {10: 20}},
+        }
+        render_request = _make_request(user=user)
+        table_view = DeviceInterfaceTableView()
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        table_view._librenms_api = api
+        table_view.request = render_request
+        cache_key = table_view.get_cache_key(device, "ports", "default")
+        cache.set(cache_key, snapshot)
+        try:
+            context = table_view.get_context_data(
+                render_request,
+                device,
+                "ifName",
+                "default",
+                fresh_data=snapshot,
+                sync_device=device,
+            )
+            child_row = snapshot["ports"][0]
+            assert "parent-sync-btn" not in str(context["table"].render_parent(None, child_row))
+
+            request = _make_request(
+                {
+                    "port_id": "10",
+                    "interface_name_field": "ifName",
+                    "parent_port_id": "20",
+                },
+                user=user,
+            )
+            relationship_view = SyncInterfaceParentView()
+            relationship_view._librenms_api = SimpleNamespace(server_key="default")
+            response = _post(relationship_view, request, object_type="device", object_id=device.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 404
+        child.refresh_from_db()
+        assert child.parent_id is None
+
+    def test_hidden_virtual_chassis_owner_has_no_inline_action_or_target_option(self):
+        from types import SimpleNamespace
+
+        from dcim.models import Device, Interface, Rack
+        from django.contrib.contenttypes.models import ContentType
+        from django.core.cache import cache
+        from ipam.models import VLAN, VLANGroup
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceParentView
+
+        _virtual_chassis, (page_device, hidden_member) = make_virtual_chassis_members("hidden-row-owner-vc")
+        hidden_rack = Rack.objects.create(
+            name="Hidden Row Owner Rack",
+            site=hidden_member.site,
+            status="active",
+        )
+        hidden_member.rack = hidden_rack
+        hidden_member.save()
+        hidden_group = VLANGroup.objects.create(
+            name="Hidden Row Owner VLAN Group",
+            slug="hidden-row-owner-vlan-group",
+            scope_type=ContentType.objects.get_for_model(Rack),
+            scope_id=hidden_rack.pk,
+        )
+        VLAN.objects.create(vid=100, name="Hidden Row Owner VLAN", group=hidden_group, status="active")
+        source = make_interface(hidden_member, "Ethernet2.100", iface_type="virtual")
+        parent = make_interface(page_device, "Ethernet1")
+        set_librenms_device_id(source, 10, "default")
+        set_librenms_device_id(parent, 20, "default")
+        source.save()
+        parent.save()
+        user = make_user_with_perms("hidden-row-owner-vc", [])
+        user = grant(user, "view", Device, constraints={"id": page_device.pk})
+        user = grant(user, "change", Interface, constraints={"id": source.pk})
+        user = grant(user, "view", Interface, constraints={"id": parent.pk})
+        snapshot = {
+            "ports": [
+                {
+                    "port_id": 10,
+                    "ifName": source.name,
+                    "ifType": "l2vlan",
+                    "untagged_vlan": None,
+                    "tagged_vlans": [100],
+                },
+                {"port_id": 20, "ifName": parent.name, "ifType": "ethernetCsmacd"},
+            ],
+            "port_stack_relationships": {"lag_members": {}, "sub_interfaces": {10: 20}},
+        }
+        render_request = _make_request(user=user)
+        table_view = DeviceInterfaceTableView()
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        table_view._librenms_api = api
+        table_view.request = render_request
+        cache_key = table_view.get_cache_key(page_device, "ports", "default")
+        cache.set(cache_key, snapshot)
+        try:
+            context = table_view.get_context_data(
+                render_request,
+                page_device,
+                "ifName",
+                "default",
+                fresh_data=snapshot,
+                sync_device=page_device,
+            )
+            source_row = snapshot["ports"][0]
+            table = context["table"]
+            assert source_row["sync_target_resolvable"] is False
+            assert [member.pk for member in table._vc_members] == [page_device.pk]
+            assert str(hidden_member.pk) not in str(table.render_device_selection(None, source_row))
+            assert "parent-sync-btn" not in str(table.render_parent(None, source_row))
+            vlan_html = str(table.render_vlans(None, source_row))
+            assert str(hidden_member.pk) not in vlan_html
+            assert str(hidden_group.pk) not in vlan_html
+            assert hidden_group.name not in vlan_html
+
+            request = _make_request(
+                {"port_id": "10", "interface_name_field": "ifName", "parent_port_id": "20"},
+                user=user,
+            )
+            relationship_view = SyncInterfaceParentView()
+            relationship_view._librenms_api = SimpleNamespace(server_key="default")
+            from django.http import Http404
+
+            with pytest.raises(Http404):
+                _post(
+                    relationship_view,
+                    request,
+                    object_type="device",
+                    object_id=hidden_member.pk,
+                )
+        finally:
+            cache.delete(cache_key)
+
+        source.refresh_from_db()
+        assert source.parent_id is None
+
     def test_fresh_data_renders_without_reading_cache(self):
-        """On the OOB-ports-fetch-failure path the (partial) cache is deleted, so get_context_data must render from the in-memory fresh_data snapshot instead of reading the now-empty cache — otherwise the table renders empty under a "showing host interfaces" banner."""
-        view, fresh = self._make_view({"ports": [{"ifName": "idrac0", "_source": "oob", "port_id": 999}]})
-        obj = MagicMock(id=1, name="host1")
-        obj.virtual_chassis = None
+        """On the OOB-ports-fetch-failure path the (partial) cache is deleted, so
+        get_context_data must render from the in-memory fresh_data snapshot instead of
+        reading the now-empty cache — otherwise the table renders empty under a
+        "showing host interfaces" banner."""
+        view = self._make_view()
+        obj = self._host_with_idrac()
+        fresh = {"ports": [{"ifName": "idrac0", "_source": "oob", "port_id": 999}]}
         req = _make_request()
 
         with patch("netbox_librenms_plugin.views.base.interfaces_view.cache") as mock_cache:
@@ -342,11 +1565,44 @@ def test_fresh_data_renders_without_reading_cache(self):
         assert "table" in ctx
         assert "idrac0" in {i["name"] for i in ctx["netbox_only_interfaces"]}
 
+    def test_malformed_port_stack_relationships_does_not_crash(self):
+        """A cached snapshot whose port_stack_relationships is None / a non-dict (corruption, partial write, format migration) must fail soft, not AttributeError on the .get('lag_members') calls."""
+        view = self._make_view()
+        obj = self._host_with_idrac()
+        req = _make_request()
+
+        for bad in (None, ["not", "a", "dict"], "garbage"):
+            fresh = {
+                "ports": [{"ifName": "idrac0", "port_id": 999, "_source": "host"}],
+                "port_stack_relationships": bad,
+            }
+            with patch("netbox_librenms_plugin.views.base.interfaces_view.cache") as mock_cache:
+                mock_cache.get.return_value = None
+                mock_cache.ttl.return_value = None
+                ctx = view.get_context_data(req, obj, "ifName", "default", fresh_data=fresh)  # must not raise
+            assert "table" in ctx
+
+    def test_malformed_nested_relationship_maps_do_not_crash(self):
+        """port_stack_relationships is a dict but its lag_members / sub_interfaces are None / non-dict (the present-but-None key defeats the .get(..., {}) default) — iterating .items() must fail soft, not AttributeError."""
+        view = self._make_view()
+        obj = self._host_with_idrac()
+        req = _make_request()
+
+        for bad in (None, ["not", "a", "dict"], "garbage", 42):
+            fresh = {
+                "ports": [{"ifName": "idrac0", "port_id": 999, "_source": "host"}],
+                "port_stack_relationships": {"lag_members": bad, "sub_interfaces": bad},
+            }
+            with patch("netbox_librenms_plugin.views.base.interfaces_view.cache") as mock_cache:
+                mock_cache.get.return_value = None
+                mock_cache.ttl.return_value = None
+                ctx = view.get_context_data(req, obj, "ifName", "default", fresh_data=fresh)  # must not raise
+            assert "table" in ctx
+
     def test_malformed_cached_port_snapshot_fails_closed(self):
         """A stale/corrupt cached ports snapshot (non-dict, or ports not a list of dicts) must be dropped and re-rendered empty, not 500 the sync tab — and the bad entry purged so a later render re-fetches."""
-        view, _ = self._make_view({"ports": []})
-        obj = MagicMock(id=1, name="host1")
-        obj.virtual_chassis = None
+        view = self._make_view()
+        obj = self._host_with_idrac()
         req = _make_request()
 
         for bad in ("garbage-string", {"ports": "not-a-list"}, {"ports": [42]}):
@@ -360,781 +1616,3761 @@ def test_malformed_cached_port_snapshot_fails_closed(self):
             assert any(c.args and c.args[0] == "ports-key" for c in mock_cache.delete.call_args_list)
 
 
-# ===========================================================================
-# SyncInterfacesView.post — full flows
-# ===========================================================================
-
+class TestInterfaceContextVirtualChassisOwner:
+    def test_logical_row_uses_stable_id_owner_for_render_and_sync(self):
+        from dcim.models import Device, Interface
+        from django.core.cache import cache
 
-class TestSyncInterfacesViewPost:
-    def test_permission_denied_returns_early(self):
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
         from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
 
-        view = object.__new__(SyncInterfacesView)
-        view.require_all_permissions = MagicMock(return_value=_denied_response())
-        view.get_required_permissions_for_object_type = MagicMock(return_value=[])
-        req = _make_request(post_data={"select": ["Gi0/1"]})
-        view.request = req
-        result = view.post(req, "device", 1)
-        assert result.status_code == 403
+        _virtual_chassis, (page_device, other_member) = make_virtual_chassis_members("logical-row-owner")
+        correct = make_interface(page_device, "Vlan2", iface_type="virtual")
+        wrong = make_interface(other_member, "Vlan2", iface_type="virtual")
+        correct.description = "original correct"
+        wrong.description = "original other"
+        set_librenms_device_id(correct, 10, "default")
+        correct.save()
+        wrong.save()
+
+        port = {
+            "port_id": 10,
+            "ifName": "Vlan2",
+            "ifDescr": "Vlan2",
+            "ifAlias": "updated correct",
+            "ifType": "l3ipvlan",
+            "ifSpeed": None,
+            "ifPhysAddress": None,
+            "ifMtu": 1500,
+            "ifAdminStatus": "up",
+            "untagged_vlan": None,
+            "tagged_vlans": [],
+        }
+        snapshot = {"ports": [port], "port_stack_relationships": {}}
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        request = _make_request()
+        table_view = object.__new__(DeviceInterfaceTableView)
+        table_view._librenms_api = api
+        table_view.request = request
+
+        context = table_view.get_context_data(
+            request,
+            page_device,
+            "ifName",
+            "default",
+            fresh_data=snapshot,
+            sync_device=page_device,
+        )
+        rendered_row = list(context["table"].data)[0]
+        assert rendered_row["netbox_interface"].pk == correct.pk
+        selected_member_id = context["table"]._resolve_row_member_id(rendered_row)
+        assert selected_member_id == page_device.pk
 
-    def test_no_selection_redirects(self):
-        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+        user = make_user_with_perms(
+            "logical-row-owner",
+            [("view", Device), ("add", Interface), ("change", Interface)],
+        )
+        post_request = _make_request(
+            post_data={
+                "select": ["10"],
+                "device_selection_10": str(selected_member_id),
+                "exclude_columns": ["vlans", "mac_address", "mtu", "speed", "type"],
+            },
+            user=user,
+        )
+        sync_view = SyncInterfacesView()
+        sync_view._librenms_api = api
+        cache_key = sync_view.get_cache_key(page_device, "ports", "default")
+        cache.set(cache_key, snapshot)
+        try:
+            response = _post(sync_view, post_request, object_type="device", object_id=page_device.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 302
+        correct.refresh_from_db()
+        wrong.refresh_from_db()
+        assert correct.description == "updated correct"
+        assert wrong.description == "original other"
+
+    def test_non_string_interface_type_does_not_crash_row_owner_resolution(self):
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
 
-        view = object.__new__(SyncInterfacesView)
-        view.require_all_permissions = MagicMock(return_value=None)
-        view.get_required_permissions_for_object_type = MagicMock(return_value=[])
-        mock_api = MagicMock(server_key="default")
-        view._librenms_api = mock_api  # blank-POST rebind reuses the cached client
+        _virtual_chassis, (page_device, _other_member) = make_virtual_chassis_members("invalid-row-type")
+        port = {
+            "port_id": 10,
+            "ifName": "Vlan2",
+            "ifDescr": "Vlan2",
+            "ifAlias": "",
+            "ifType": 123,
+            "ifSpeed": None,
+            "ifPhysAddress": None,
+            "ifMtu": 1500,
+            "ifAdminStatus": "up",
+            "untagged_vlan": None,
+            "tagged_vlans": [],
+        }
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        request = _make_request()
+        view = object.__new__(DeviceInterfaceTableView)
+        view._librenms_api = api
+        view.request = request
 
-        mock_device = MagicMock(pk=1)
-        req = _make_request(post_data={})  # No selection
+        context = view.get_context_data(
+            request,
+            page_device,
+            "ifName",
+            "default",
+            fresh_data={"ports": [port], "port_stack_relationships": {}},
+            sync_device=page_device,
+        )
 
-        with (
-            patch(
-                "netbox_librenms_plugin.views.mixins.NetBoxObjectPermissionMixin.restrict_object_or_404",
-                return_value=mock_device,
-            ),
-            patch("netbox_librenms_plugin.views.sync.interfaces.get_interface_name_field", return_value="ifName"),
-            patch("netbox_librenms_plugin.views.sync.interfaces.messages") as mock_msgs,
-            patch("netbox_librenms_plugin.views.sync.interfaces.redirect") as mock_redirect,
-            patch("netbox_librenms_plugin.views.sync.interfaces.reverse", return_value="/sync/"),
-            patch.object(type(view), "librenms_api", new_callable=lambda: property(lambda s: mock_api)),
-        ):
-            view.request = req
-            view.post(req, "device", 1)
+        rendered_row = list(context["table"].data)[0]
+        assert rendered_row["netbox_interface"] is None
+        assert rendered_row["selected_object_id"] == page_device.pk
 
-        mock_msgs.error.assert_called_once()
-        mock_redirect.assert_called_once()
+    def test_remote_vc_row_uses_its_owner_rack_vlan_group(self):
+        from django.core.cache import cache
+        from django.contrib.contenttypes.models import ContentType
+        from dcim.models import Rack
+        from ipam.models import VLAN, VLANGroup
 
-    def test_sync_selected_interfaces_skips_oob_rows(self):
-        """OOB-controller rows are merged into the host list only for context and are never routed to a real device."""
-        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
 
-        view = object.__new__(SyncInterfacesView)
-        synced = []
-        view.sync_interface = lambda obj, port, ex, field: synced.append(port)
-        ports_data = [
-            {"ifName": "eth0", "port_id": 1, "_source": "main"},
-            {"ifName": "eth0", "port_id": 99, "_source": "oob"},
-        ]
-        with patch("netbox_librenms_plugin.views.sync.interfaces.transaction"):
-            view.sync_selected_interfaces(MagicMock(), ["eth0"], ports_data, [], "ifName")
+        _virtual_chassis, (member1, member2) = make_virtual_chassis_members("row-vlan-owner")
+        rack1 = Rack.objects.create(name="Row VLAN Rack 1", site=member1.site, status="active")
+        rack2 = Rack.objects.create(name="Row VLAN Rack 2", site=member1.site, status="active")
+        member1.rack = rack1
+        member2.rack = rack2
+        member1.save()
+        member2.save()
+        rack_type = ContentType.objects.get_for_model(Rack)
+        group1 = VLANGroup.objects.create(
+            name="Row VLAN Group 1",
+            slug="row-vlan-group-1",
+            scope_type=rack_type,
+            scope_id=rack1.pk,
+        )
+        group2 = VLANGroup.objects.create(
+            name="Row VLAN Group 2",
+            slug="row-vlan-group-2",
+            scope_type=rack_type,
+            scope_id=rack2.pk,
+        )
+        VLAN.objects.create(vid=100, name="Rack 1 VLAN", group=group1, status="active")
+        VLAN.objects.create(vid=100, name="Rack 2 VLAN", group=group2, status="active")
+        interface = make_interface(member2, "Ethernet2")
+        set_librenms_device_id(interface, 10, "default")
+        interface.save()
+        port = {
+            "port_id": 10,
+            "ifName": "Ethernet2",
+            "ifType": "ethernetCsmacd",
+            "ifAdminStatus": "up",
+            "untagged_vlan": 100,
+            "tagged_vlans": [],
+        }
+        request = _make_request()
+        view = DeviceInterfaceTableView()
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        view._librenms_api = api
+        view.request = request
+
+        overrides_key = view.get_vlan_overrides_key(member1, "default")
+        cache.set(overrides_key, {"100": str(group1.pk)})
+        try:
+            view.get_context_data(
+                request,
+                member1,
+                "ifName",
+                "default",
+                fresh_data={"ports": [port], "port_stack_relationships": {}},
+                sync_device=member1,
+            )
+        finally:
+            cache.delete(overrides_key)
+
+        assert port["selected_object_id"] == member2.pk
+        assert port["vlan_group_map"][100]["group_id"] == str(group2.pk)
+
+        VLAN.objects.filter(group=group2).delete()
+        group2.delete()
+        view.get_context_data(
+            request,
+            member1,
+            "ifName",
+            "default",
+            fresh_data={"ports": [port], "port_stack_relationships": {}},
+            sync_device=member1,
+        )
+        assert port["vlan_group_map"][100]["group_id"] == ""
+        assert port["missing_vlans"] == [100]
+
+    def test_remote_vc_target_sync_uses_its_rack_vlan_lookup(self):
+        from types import SimpleNamespace
 
-        # Pre-fix both same-named rows matched the selection and synced (the OOB row overwrote
-        # the host interface); now only the main row syncs.
-        assert len(synced) == 1
-        assert synced[0]["port_id"] == 1
-        assert synced[0]["_source"] == "main"
+        from django.contrib.contenttypes.models import ContentType
+        from django.core.cache import cache
+        from dcim.models import Device, Interface, Rack
+        from ipam.models import VLAN, VLANGroup
 
-    def test_cache_miss_redirects(self):
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
         from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
 
-        view = object.__new__(SyncInterfacesView)
-        view.require_all_permissions = MagicMock(return_value=None)
-        view.get_required_permissions_for_object_type = MagicMock(return_value=[])
-        mock_api = MagicMock(server_key="default")
-        view._librenms_api = mock_api  # blank-POST rebind reuses the cached client
+        _virtual_chassis, (member1, member2) = make_virtual_chassis_members("sync-vlan-owner")
+        rack1 = Rack.objects.create(name="Sync VLAN Rack 1", site=member1.site, status="active")
+        rack2 = Rack.objects.create(name="Sync VLAN Rack 2", site=member1.site, status="active")
+        member1.rack = rack1
+        member2.rack = rack2
+        member1.save()
+        member2.save()
+        rack_type = ContentType.objects.get_for_model(Rack)
+        group1 = VLANGroup.objects.create(
+            name="Sync VLAN Group 1",
+            slug="sync-vlan-group-1",
+            scope_type=rack_type,
+            scope_id=rack1.pk,
+        )
+        group2 = VLANGroup.objects.create(
+            name="Sync VLAN Group 2",
+            slug="sync-vlan-group-2",
+            scope_type=rack_type,
+            scope_id=rack2.pk,
+        )
+        wrong_vlan = VLAN.objects.create(vid=100, name="Wrong member VLAN", group=group1, status="active")
+        expected_vlan = VLAN.objects.create(vid=100, name="Target member VLAN", group=group2, status="active")
+        VLAN.objects.create(vid=100, name="Global fallback VLAN", group=None, status="active")
+        interface = make_interface(member2, "Ethernet2")
+        set_librenms_device_id(interface, 10, "default")
+        interface.save()
+        snapshot = {
+            "ports": [
+                {
+                    "port_id": "0010",
+                    "ifName": "Ethernet2",
+                    "ifType": "ethernetCsmacd",
+                    "ifAdminStatus": "up",
+                    "untagged_vlan": 100,
+                    "tagged_vlans": [],
+                }
+            ],
+            "port_stack_relationships": {},
+        }
+        render_request = _make_request()
+        table_view = DeviceInterfaceTableView()
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        table_view._librenms_api = api
+        table_view.request = render_request
+        context = table_view.get_context_data(
+            render_request,
+            member1,
+            "ifName",
+            "default",
+            fresh_data=snapshot,
+            sync_device=member1,
+        )
+        row = snapshot["ports"][0]
+        assert row["port_id"] == 10
+        assert 'name="device_selection_10"' in str(context["table"].render_device_selection(None, row))
+        assert 'name="vlan_group_10_100"' in str(context["table"].render_vlans(None, row))
+        user = make_user_with_perms(
+            "sync-vlan-owner",
+            [("view", Device), ("add", Interface), ("change", Interface)],
+        )
+        request = _make_request(
+            post_data={
+                "select": ["10"],
+                "device_selection_10": str(member2.pk),
+                "vlan_group_10_100": str(group2.pk),
+                "exclude_columns": ["mac_address", "description", "mtu", "speed", "type"],
+            },
+            user=user,
+        )
+        view = SyncInterfacesView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        cache_key = view.get_cache_key(member1, "ports", "default")
+        cache.set(cache_key, snapshot)
+
+        try:
+            response = _post(view, request, object_type="device", object_id=member1.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 302
+        interface.refresh_from_db()
+        assert interface.untagged_vlan_id == expected_vlan.pk
+        assert interface.untagged_vlan_id != wrong_vlan.pk
+
+        interface.mode = ""
+        interface.untagged_vlan = None
+        interface.save(update_fields=["mode", "untagged_vlan"])
+        stale_request = _make_request(
+            post_data={
+                "select": ["10"],
+                "device_selection_10": str(member2.pk),
+                "vlan_group_10_100": str(group1.pk),
+                "exclude_columns": ["mac_address", "description", "mtu", "speed", "type"],
+            },
+            user=user,
+        )
+        stale_view = SyncInterfacesView()
+        stale_view._librenms_api = SimpleNamespace(server_key="default")
+        cache.set(cache_key, snapshot)
+        try:
+            stale_response = _post(stale_view, stale_request, object_type="device", object_id=member1.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert stale_response.status_code == 302
+        interface.refresh_from_db()
+        assert interface.untagged_vlan_id == expected_vlan.pk
+
+        snapshot["ports"][0]["untagged_vlan"] = None
+        clear_request = _make_request(
+            post_data={
+                "select": ["10"],
+                "device_selection_10": str(member2.pk),
+                "exclude_columns": ["mac_address", "description", "mtu", "speed", "type"],
+            },
+            user=user,
+        )
+        clear_view = SyncInterfacesView()
+        clear_view._librenms_api = SimpleNamespace(server_key="default")
+        cache.set(cache_key, snapshot)
+        try:
+            clear_response = _post(clear_view, clear_request, object_type="device", object_id=member1.pk)
+        finally:
+            cache.delete(cache_key)
 
-        mock_device = MagicMock(pk=1)
-        req = _make_request(post_data={"select": ["Gi0/1"]})
+        assert clear_response.status_code == 302
+        interface.refresh_from_db()
+        assert interface.mode == ""
+        assert interface.untagged_vlan_id is None
 
-        with (
-            patch(
-                "netbox_librenms_plugin.views.mixins.NetBoxObjectPermissionMixin.restrict_object_or_404",
-                return_value=mock_device,
-            ),
-            patch("netbox_librenms_plugin.views.sync.interfaces.get_interface_name_field", return_value="ifName"),
-            patch("netbox_librenms_plugin.views.sync.interfaces.cache") as mock_cache,
-            patch("netbox_librenms_plugin.views.sync.interfaces.messages"),
-            patch("netbox_librenms_plugin.views.sync.interfaces.redirect") as mock_redirect,
-            patch("netbox_librenms_plugin.views.sync.interfaces.reverse", return_value="/sync/"),
-            patch.object(type(view), "get_vlan_groups_for_device", return_value=[]),
-            patch.object(view.__class__, "get_cache_key", return_value="k"),
-            patch.object(type(view), "librenms_api", new_callable=lambda: property(lambda s: mock_api)),
-        ):
-            mock_cache.get.return_value = None
-            view.request = req
-            view.post(req, "device", 1)
 
-        mock_redirect.assert_called()
+# ===========================================================================
+# SyncInterfacesView.post — full flows
+# ===========================================================================
 
-    def test_device_post_success(self):
-        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
 
-        view = object.__new__(SyncInterfacesView)
-        view.require_all_permissions = MagicMock(return_value=None)
-        view.get_required_permissions_for_object_type = MagicMock(return_value=[])
-        mock_api = MagicMock(server_key="default")
+class TestSyncInterfacesViewPost:
+    def test_integrity_error_at_the_outer_commit_is_reported_not_a_500(self):
+        """An IntegrityError escaping the outer atomic must redirect with an error, not propagate.
 
-        mock_device = MagicMock(pk=1)
-        ports = [{"ifName": "Gi0/1", "port_id": 10}]
-        req = _make_request(post_data={"select": ["Gi0/1"], "server_key": "default"})
+        The relationship pass catches IntegrityError around an inner savepoint. Postgres validates
+        Django's DEFERRABLE INITIALLY DEFERRED foreign keys at the OUTERMOST commit, so a
+        concurrently deleted related row surfaces past that handler. Injected here because a real
+        deferred violation needs a concurrent deletion inside the commit window.
+        """
+        from types import SimpleNamespace
 
-        with (
-            patch(
-                "netbox_librenms_plugin.views.mixins.NetBoxObjectPermissionMixin.restrict_object_or_404",
-                return_value=mock_device,
-            ),
-            patch("netbox_librenms_plugin.views.sync.interfaces.get_interface_name_field", return_value="ifName"),
-            patch("netbox_librenms_plugin.views.sync.interfaces.cache") as mock_cache,
-            patch("netbox_librenms_plugin.views.sync.interfaces.messages") as mock_msgs,
-            patch("netbox_librenms_plugin.views.sync.interfaces.redirect") as mock_redirect,
-            patch("netbox_librenms_plugin.views.sync.interfaces.reverse", return_value="/sync/"),
-            patch("netbox_librenms_plugin.views.sync.interfaces.transaction"),
-            patch.object(view, "sync_interface"),
-            patch.object(type(view), "get_vlan_groups_for_device", return_value=[]),
-            patch.object(view.__class__, "get_cache_key", return_value="k"),
-            patch.object(view.__class__, "_build_vlan_lookup_maps", return_value={}),
-            patch.object(type(view), "librenms_api", new_callable=lambda: property(lambda s: mock_api)),
+        from django.core.cache import cache
+        from django.db import IntegrityError
+
+        from netbox_librenms_plugin.tests.view_test_helpers import make_superuser, message_texts
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        device = make_device("outer-commit-integrity")
+        port = {
+            "port_id": 10,
+            "ifName": "Ethernet1",
+            "ifDescr": "Ethernet1",
+            "ifAlias": "",
+            "ifType": "ethernetCsmacd",
+            "ifSpeed": 1_000_000_000,
+            "ifPhysAddress": "",
+            "ifMtu": 1500,
+            "ifAdminStatus": "up",
+            "untagged_vlan": None,
+            "tagged_vlans": [],
+        }
+        request = _make_request(
+            post_data={"select": ["10"], "exclude_columns": ["mac_address", "description", "mtu", "speed", "type"]},
+            user=make_superuser("outer-commit-integrity"),
+        )
+        view = SyncInterfacesView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        cache_key = view.get_cache_key(device, "ports", "default")
+        cache.set(cache_key, {"ports": [port], "port_stack_relationships": {}})
+
+        try:
+            with patch.object(
+                SyncInterfacesView,
+                "_sync_lag_and_parent_relationships",
+                side_effect=IntegrityError("deferred FK violated at COMMIT"),
+            ):
+                response = _post(view, request, object_type="device", object_id=device.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 302
+        assert any("rolled back by a concurrent change" in text for text in message_texts(request, "error"))
+
+    def test_vlan_maps_cover_only_selected_row_owners(self):
+        """One selected row must not build VLAN scope maps for unrelated chassis members."""
+        from types import SimpleNamespace
+
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.tests.view_test_helpers import make_superuser
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        _virtual_chassis, (page_device, target_device, _unrelated_member) = make_virtual_chassis_members(
+            "selected-vlan-owner-scope",
+            count=3,
+        )
+        port = {
+            "port_id": 10,
+            "ifName": "Ethernet2",
+            "ifDescr": "Ethernet2",
+            "ifAlias": "",
+            "ifType": "ethernetCsmacd",
+            "ifSpeed": 1_000_000_000,
+            "ifPhysAddress": "",
+            "ifMtu": 1500,
+            "ifAdminStatus": "up",
+            "untagged_vlan": None,
+            "tagged_vlans": [],
+        }
+        request = _make_request(
+            post_data={
+                "select": ["10"],
+                "device_selection_10": str(target_device.pk),
+                "exclude_columns": ["mac_address", "description", "mtu", "speed", "type"],
+            },
+            user=make_superuser("selected-vlan-owner-scope"),
+        )
+        view = SyncInterfacesView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        cache_key = view.get_cache_key(page_device, "ports", "default")
+        cache.set(cache_key, {"ports": [port], "port_stack_relationships": {}})
+
+        try:
+            response = _post(view, request, object_type="device", object_id=page_device.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 302
+        assert set(view._lookup_maps_by_owner) == {target_device.pk}
+
+    def test_auto_selected_owner_materializes_only_port_id_candidates(self):
+        """One inferred row must not hydrate every Interface in a large chassis."""
+        from django.db.models.signals import post_init
+        from dcim.models import Interface
+
+        from netbox_librenms_plugin.tests.view_test_helpers import make_superuser
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        _virtual_chassis, (page_device, target_device) = make_virtual_chassis_members("auto-owner-candidate-scope")
+        target = make_interface(target_device, "Ethernet2")
+        set_librenms_device_id(target, 10, "default")
+        target.save()
+        for index in range(40):
+            make_interface(page_device, f"unrelated-{index}")
+        request = _make_request(user=make_superuser("auto-owner-candidate-scope"))
+        view = SyncInterfacesView()
+        view.setup(request)
+        materialized_interface_ids = []
+
+        def capture_interface(instance, **_kwargs):
+            materialized_interface_ids.append(instance.pk)
+
+        post_init.connect(capture_interface, sender=Interface, weak=False)
+        try:
+            targets = view._resolve_auto_selected_target_ids(
+                page_device,
+                [{"port_id": 10, "ifName": "Ethernet2", "ifType": "ethernetCsmacd"}],
+                {10},
+                "ifName",
+                "default",
+                members=[page_device, target_device],
+            )
+        finally:
+            post_init.disconnect(capture_interface, sender=Interface)
+
+        assert targets == {10: target_device.pk}
+        assert len(materialized_interface_ids) <= 5
+
+    def test_auto_selected_owner_batches_large_candidate_lookup(self):
+        """Many inferred rows must not produce one unbounded stable-ID query."""
+        from django.db import connection
+
+        from netbox_librenms_plugin.tests.view_test_helpers import make_superuser
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        _virtual_chassis, (page_device, target_device) = make_virtual_chassis_members("auto-owner-batched-lookup")
+        port_ids = set(range(1, 301))
+        ports = [
+            {
+                "port_id": port_id,
+                "ifName": f"Ethernet2/{port_id}",
+                "ifType": "ethernetCsmacd",
+            }
+            for port_id in port_ids
+        ]
+        request = _make_request(user=make_superuser("auto-owner-batched-lookup"))
+        view = SyncInterfacesView()
+        view.setup(request)
+        parameter_counts = []
+
+        def capture_parameters(execute, sql, params, many, context):
+            parameter_counts.append(len(params or ()))
+            return execute(sql, params, many, context)
+
+        with connection.execute_wrapper(capture_parameters):
+            targets = view._resolve_auto_selected_target_ids(
+                page_device,
+                ports,
+                port_ids,
+                "ifName",
+                "default",
+                members=[page_device, target_device],
+            )
+
+        assert targets == {port_id: target_device.pk for port_id in port_ids}
+        assert max(parameter_counts) < 2_000
+
+    def test_excluding_type_does_not_promote_or_link_a_non_lag_aggregate(self):
+        """The relationship pass must honor the form's explicit Type exclusion."""
+        from types import SimpleNamespace
+
+        from dcim.models import Device, Interface
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        device = make_device("bulk-exclude-lag-type")
+        member = make_interface(device, "Ethernet1")
+        aggregate = make_interface(device, "Port-Channel1", iface_type="other")
+        for interface, port_id in ((member, 10), (aggregate, 20)):
+            set_librenms_device_id(interface, port_id, "default")
+            interface.save()
+        user = make_user_with_perms(
+            "bulk-exclude-lag-type",
+            [("view", Device), ("add", Interface), ("change", Interface)],
+        )
+        request = _make_request(
+            post_data={
+                "select": ["10"],
+                "exclude_columns": ["vlans", "mac_address", "description", "mtu", "speed", "type"],
+            },
+            user=user,
+        )
+        view = SyncInterfacesView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        cache_key = view.get_cache_key(device, "ports", "default")
+        cache.set(
+            cache_key,
+            {
+                "ports": [
+                    {
+                        "port_id": 10,
+                        "ifName": member.name,
+                        "ifType": "ethernetCsmacd",
+                        "ifAdminStatus": "up",
+                    },
+                    {
+                        "port_id": 20,
+                        "ifName": aggregate.name,
+                        "ifType": "ieee8023adLag",
+                        "ifAdminStatus": "up",
+                    },
+                ],
+                "port_stack_relationships": {"lag_members": {10: 20}, "sub_interfaces": {}},
+            },
+        )
+
+        try:
+            response = _post(view, request, object_type="device", object_id=device.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 302
+        member.refresh_from_db()
+        aggregate.refresh_from_db()
+        assert aggregate.type == "other"
+        assert member.lag_id is None
+
+    def test_bulk_parent_link_resolves_a_unique_unbound_related_name(self):
+        from types import SimpleNamespace
+
+        from dcim.models import Device, Interface
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        device = make_device("bulk-unbound-related-parent")
+        child = make_interface(device, "Ethernet1.100", iface_type="virtual")
+        parent = make_interface(device, "Ethernet1")
+        set_librenms_device_id(child, 11, "default")
+        child.save()
+        user = make_user_with_perms(
+            "bulk-unbound-related-parent",
+            [("view", Device), ("add", Interface), ("change", Interface)],
+        )
+        request = _make_request(
+            post_data={
+                "select": ["11"],
+                "exclude_columns": ["vlans", "mac_address", "description", "mtu", "speed", "type"],
+            },
+            user=user,
+        )
+        view = SyncInterfacesView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        cache_key = view.get_cache_key(device, "ports", "default")
+        cache.set(
+            cache_key,
+            {
+                "ports": [
+                    {
+                        "port_id": 11,
+                        "ifName": child.name,
+                        "ifType": "l2vlan",
+                        "ifAdminStatus": "up",
+                    },
+                    {
+                        "port_id": 10,
+                        "ifName": parent.name,
+                        "ifType": "ethernetCsmacd",
+                        "ifAdminStatus": "up",
+                    },
+                ],
+                "port_stack_relationships": {
+                    "lag_members": {},
+                    "sub_interfaces": {11: 10},
+                },
+            },
+        )
+
+        try:
+            response = _post(view, request, object_type="device", object_id=device.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 302
+        child.refresh_from_db()
+        parent.refresh_from_db()
+        assert child.parent_id == parent.pk
+        assert parent.custom_field_data.get("librenms_id") is None
+
+    def test_cross_page_parent_keeps_unsubmitted_vlan_group(self):
+        from types import SimpleNamespace
+
+        from dcim.models import Device, Interface
+        from django.core.cache import cache
+        from ipam.models import VLAN, VLANGroup
+
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        device = make_device("cross-page-parent-vlan")
+        wrong_group = VLANGroup.objects.create(name="Parent fallback", slug="parent-fallback")
+        kept_group = VLANGroup.objects.create(name="Parent selected", slug="parent-selected")
+        wrong_vlan = VLAN.objects.create(vid=100, name="Parent fallback", group=wrong_group, status="active")
+        kept_vlan = VLAN.objects.create(vid=100, name="Parent selected", group=kept_group, status="active")
+
+        parent = make_interface(device, "Ethernet1")
+        parent.mode = "access"
+        parent.untagged_vlan = kept_vlan
+        set_librenms_device_id(parent, 10, "default")
+        parent.save()
+        child = make_interface(device, "Ethernet1.100", iface_type="virtual")
+        set_librenms_device_id(child, 11, "default")
+        child.save()
+
+        user = make_user_with_perms(
+            "cross-page-parent-vlan",
+            [("view", Device), ("add", Interface), ("change", Interface)],
+        )
+        request = _make_request(
+            post_data={
+                "select": ["11"],
+                "auto_select_lag_members": "1",
+                "exclude_columns": ["mac_address", "description", "mtu", "speed", "type"],
+            },
+            user=user,
+        )
+        view = SyncInterfacesView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        cache_key = view.get_cache_key(device, "ports", "default")
+        cache.set(
+            cache_key,
+            {
+                "ports": [
+                    {
+                        "port_id": 10,
+                        "ifName": "Ethernet1",
+                        "ifType": "ethernetCsmacd",
+                        "ifAdminStatus": "up",
+                        "untagged_vlan": 100,
+                        "tagged_vlans": [],
+                    },
+                    {
+                        "port_id": 11,
+                        "ifName": "Ethernet1.100",
+                        "ifType": "l2vlan",
+                        "ifAdminStatus": "up",
+                        "untagged_vlan": None,
+                        "tagged_vlans": [],
+                    },
+                ],
+                "port_stack_relationships": {
+                    "lag_members": {},
+                    "sub_interfaces": {11: 10},
+                },
+            },
+        )
+
+        try:
+            response = _post(view, request, object_type="device", object_id=device.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 302
+        parent.refresh_from_db()
+        child.refresh_from_db()
+        assert parent.untagged_vlan_id == kept_vlan.pk
+        assert parent.untagged_vlan_id != wrong_vlan.pk
+        assert child.parent_id == parent.pk
+
+    def test_selected_lag_includes_member_from_another_page(self):
+        from types import SimpleNamespace
+
+        from dcim.models import Device, Interface
+        from django.core.cache import cache
+        from django.db import connection
+        from django.test.utils import CaptureQueriesContext
+
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        _virtual_chassis, (page_device, member_device) = make_virtual_chassis_members("cross-page-lag-member")
+        aggregate = make_interface(page_device, "Port-Channel1", iface_type="lag")
+        member = make_interface(member_device, "Ethernet2")
+        set_librenms_device_id(aggregate, 100, "default")
+        set_librenms_device_id(member, 10, "default")
+        aggregate.save()
+        member.save()
+        user = make_user_with_perms(
+            "cross-page-lag-member",
+            [("view", Device), ("add", Interface), ("change", Interface)],
+        )
+        request = _make_request(
+            post_data={
+                "select": ["100"],
+                "device_selection_100": str(page_device.pk),
+                "auto_select_lag_members": "1",
+                "exclude_columns": ["vlans", "mac_address", "description", "mtu", "speed", "type"],
+            },
+            user=user,
+        )
+
+        class QueryCheckedSyncInterfacesView(SyncInterfacesView):
+            target_lookup_queries = None
+
+            def _sync_lag_and_parent_relationships(self, obj, *args, **kwargs):
+                with CaptureQueriesContext(connection) as captured:
+                    for port_id in self._selected_port_ids:
+                        self._resolve_row_target_device(obj, port_id=port_id)
+                self.target_lookup_queries = len(captured)
+                return super()._sync_lag_and_parent_relationships(obj, *args, **kwargs)
+
+        view = QueryCheckedSyncInterfacesView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        cache_key = view.get_cache_key(page_device, "ports", "default")
+        cache.set(
+            cache_key,
+            {
+                "ports": [
+                    {
+                        "port_id": 10,
+                        "ifName": "Ethernet2",
+                        "ifType": "ethernetCsmacd",
+                        "ifAdminStatus": "up",
+                    },
+                    {
+                        "port_id": 100,
+                        "ifName": "Port-Channel1",
+                        "ifType": "ieee8023adLag",
+                        "ifAdminStatus": "up",
+                    },
+                ],
+                "port_stack_relationships": {
+                    "lag_members": {10: 100},
+                    "sub_interfaces": {},
+                },
+            },
+        )
+
+        try:
+            response = _post(view, request, object_type="device", object_id=page_device.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 302
+        aggregate.refresh_from_db()
+        member.refresh_from_db()
+        assert member.lag_id == aggregate.pk
+        assert aggregate.device_id == page_device.pk
+        assert member.device_id == member_device.pk
+        assert view.target_lookup_queries == 0
+
+    @pytest.mark.parametrize("physical_ifname", ["ge-2/0/0", "2/1/1"])
+    def test_off_page_physical_member_uses_ifname_owner_in_ifdescr_mode(self, physical_ifname):
+        from types import SimpleNamespace
+
+        from dcim.models import Device, Interface
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        _virtual_chassis, (page_device, member_device) = make_virtual_chassis_members("ifdescr-cross-page-member")
+        aggregate = make_interface(member_device, "Bundle", iface_type="lag")
+        set_librenms_device_id(aggregate, 100, "default")
+        aggregate.save()
+        user = make_user_with_perms(
+            "ifdescr-cross-page-member",
+            [("view", Device), ("add", Interface), ("change", Interface)],
+        )
+        request = _make_request(
+            post_data={
+                "select": ["100"],
+                "device_selection_100": str(member_device.pk),
+                "auto_select_lag_members": "1",
+                "exclude_columns": ["vlans", "mac_address", "description", "mtu", "speed", "type"],
+            },
+            get_data={"interface_name_field": "ifDescr"},
+            user=user,
+        )
+        view = SyncInterfacesView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        cache_key = view.get_cache_key(page_device, "ports", "default")
+        cache.set(
+            cache_key,
+            {
+                "ports": [
+                    {
+                        "port_id": 10,
+                        "ifName": physical_ifname,
+                        "ifDescr": "uplink",
+                        "ifType": "ethernetCsmacd",
+                        "ifAdminStatus": "up",
+                    },
+                    {
+                        "port_id": 100,
+                        "ifName": "Port-Channel1",
+                        "ifDescr": aggregate.name,
+                        "ifType": "ieee8023adLag",
+                        "ifAdminStatus": "up",
+                    },
+                ],
+                "port_stack_relationships": {
+                    "lag_members": {10: 100},
+                    "sub_interfaces": {},
+                },
+            },
+        )
+
+        try:
+            response = _post(view, request, object_type="device", object_id=page_device.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 302
+        created_member = Interface.objects.get(device=member_device, name="uplink")
+        assert created_member.lag_id == aggregate.pk
+        assert not Interface.objects.filter(device=page_device, name="uplink").exists()
+
+    def test_same_page_lag_link_can_span_virtual_chassis_members(self):
+        from types import SimpleNamespace
+
+        from dcim.models import Device, Interface
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        _virtual_chassis, (page_device, other_member) = make_virtual_chassis_members("cross-member-lag")
+        aggregate = make_interface(page_device, "Port-Channel1", iface_type="lag")
+        member = make_interface(other_member, "Ethernet2")
+        set_librenms_device_id(aggregate, 100, "default")
+        set_librenms_device_id(member, 10, "default")
+        aggregate.save()
+        member.save()
+        user = make_user_with_perms(
+            "cross-member-lag",
+            [("view", Device), ("add", Interface), ("change", Interface)],
+        )
+        request = _make_request(
+            post_data={
+                "select": ["100", "10"],
+                "device_selection_100": str(page_device.pk),
+                "device_selection_10": str(other_member.pk),
+                "auto_select_lag_members": "1",
+                "exclude_columns": ["vlans", "mac_address", "description", "mtu", "speed", "type"],
+            },
+            user=user,
+        )
+        view = SyncInterfacesView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        cache_key = view.get_cache_key(page_device, "ports", "default")
+        cache.set(
+            cache_key,
+            {
+                "ports": [
+                    {
+                        "port_id": 10,
+                        "ifName": "Ethernet2",
+                        "ifType": "ethernetCsmacd",
+                        "ifAdminStatus": "up",
+                    },
+                    {
+                        "port_id": 100,
+                        "ifName": "Port-Channel1",
+                        "ifType": "ieee8023adLag",
+                        "ifAdminStatus": "up",
+                    },
+                ],
+                "port_stack_relationships": {
+                    "lag_members": {10: 100},
+                    "sub_interfaces": {},
+                },
+            },
+        )
+
+        try:
+            response = _post(view, request, object_type="device", object_id=page_device.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 302
+        aggregate.refresh_from_db()
+        member.refresh_from_db()
+        assert member.lag_id == aggregate.pk
+        assert aggregate.device_id == page_device.pk
+        assert member.device_id == other_member.pk
+
+    def test_same_page_parent_link_can_span_virtual_chassis_members(self):
+        from types import SimpleNamespace
+
+        from dcim.models import Device, Interface
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        _virtual_chassis, (page_device, other_member) = make_virtual_chassis_members("cross-member-parent")
+        parent = make_interface(page_device, "Ethernet1")
+        child = make_interface(other_member, "Ethernet2.100", iface_type="virtual")
+        set_librenms_device_id(parent, 10, "default")
+        set_librenms_device_id(child, 11, "default")
+        parent.save()
+        child.save()
+        user = make_user_with_perms(
+            "cross-member-parent",
+            [("view", Device), ("add", Interface), ("change", Interface)],
+        )
+        request = _make_request(
+            post_data={
+                "select": ["11", "10"],
+                "device_selection_11": str(other_member.pk),
+                "device_selection_10": str(page_device.pk),
+                "auto_select_lag_members": "1",
+                "exclude_columns": ["vlans", "mac_address", "description", "mtu", "speed", "type"],
+            },
+            user=user,
+        )
+        view = SyncInterfacesView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        cache_key = view.get_cache_key(page_device, "ports", "default")
+        cache.set(
+            cache_key,
+            {
+                "ports": [
+                    {
+                        "port_id": 10,
+                        "ifName": "Ethernet2",
+                        "ifType": "ethernetCsmacd",
+                        "ifAdminStatus": "up",
+                    },
+                    {
+                        "port_id": 11,
+                        "ifName": "Ethernet2.100",
+                        "ifType": "l2vlan",
+                        "ifAdminStatus": "up",
+                    },
+                ],
+                "port_stack_relationships": {
+                    "lag_members": {},
+                    "sub_interfaces": {11: 10},
+                },
+            },
+        )
+
+        try:
+            response = _post(view, request, object_type="device", object_id=page_device.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 302
+        parent.refresh_from_db()
+        child.refresh_from_db()
+        assert child.parent_id == parent.pk
+        assert parent.device_id == page_device.pk
+        assert child.device_id == other_member.pk
+
+    def test_invalid_selected_parent_target_does_not_fall_back_to_another_member(self):
+        from types import SimpleNamespace
+
+        from dcim.models import Device, Interface
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        _virtual_chassis, (page_device, other_member) = make_virtual_chassis_members("invalid-parent-target")
+        outside_device = make_device("invalid-parent-target-outside")
+        child = make_interface(page_device, "Ethernet1.100", iface_type="virtual")
+        existing_parent = make_interface(other_member, "Ethernet1")
+        set_librenms_device_id(child, 11, "default")
+        set_librenms_device_id(existing_parent, 10, "default")
+        child.save()
+        existing_parent.save()
+        user = make_user_with_perms(
+            "invalid-parent-target",
+            [("view", Device), ("add", Interface), ("change", Interface)],
+        )
+        request = _make_request(
+            post_data={
+                "select": ["11", "10"],
+                "device_selection_11": str(page_device.pk),
+                "device_selection_10": str(outside_device.pk),
+                "exclude_columns": ["vlans", "mac_address", "description", "mtu", "speed", "type"],
+            },
+            user=user,
+        )
+        view = SyncInterfacesView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        cache_key = view.get_cache_key(page_device, "ports", "default")
+        cache.set(
+            cache_key,
+            {
+                "ports": [
+                    {
+                        "port_id": 10,
+                        "ifName": "Ethernet1",
+                        "ifType": "ethernetCsmacd",
+                        "ifAdminStatus": "up",
+                    },
+                    {
+                        "port_id": 11,
+                        "ifName": "Ethernet1.100",
+                        "ifType": "l2vlan",
+                        "ifAdminStatus": "up",
+                    },
+                ],
+                "port_stack_relationships": {
+                    "lag_members": {},
+                    "sub_interfaces": {11: 10},
+                },
+            },
+        )
+
+        try:
+            response = _post(view, request, object_type="device", object_id=page_device.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 302
+        child.refresh_from_db()
+        existing_parent.refresh_from_db()
+        assert child.parent_id is None
+        assert existing_parent.device_id == other_member.pk
+
+    def test_auto_selected_view_only_parent_keeps_its_existing_member_owner(self):
+        from types import SimpleNamespace
+
+        from dcim.models import Device, Interface
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        _virtual_chassis, (page_device, other_member) = make_virtual_chassis_members("view-only-parent-owner")
+        child = make_interface(page_device, "Ethernet1.100", iface_type="virtual")
+        parent = make_interface(other_member, "Ethernet1", iface_type="virtual")
+        set_librenms_device_id(child, 11, "default")
+        set_librenms_device_id(parent, 10, "default")
+        child.save()
+        parent.save()
+        user = make_user_with_perms(
+            "view-only-parent-owner",
+            [("view", Device), ("add", Interface)],
+        )
+        user = grant(user, "change", Interface, constraints={"pk": child.pk})
+        user = grant(user, "view", Interface, constraints={"pk": parent.pk})
+        request = _make_request(
+            post_data={
+                "select": ["11"],
+                "device_selection_11": str(page_device.pk),
+                "auto_select_lag_members": "1",
+                "exclude_columns": ["vlans", "mac_address", "description", "mtu", "speed", "type"],
+            },
+            user=user,
+        )
+        view = SyncInterfacesView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        cache_key = view.get_cache_key(page_device, "ports", "default")
+        cache.set(
+            cache_key,
+            {
+                "ports": [
+                    {
+                        "port_id": 10,
+                        "ifName": "Ethernet1",
+                        "ifType": "l3ipvlan",
+                        "ifAdminStatus": "up",
+                    },
+                    {
+                        "port_id": 11,
+                        "ifName": "Ethernet1.100",
+                        "ifType": "l2vlan",
+                        "ifAdminStatus": "up",
+                    },
+                ],
+                "port_stack_relationships": {
+                    "lag_members": {},
+                    "sub_interfaces": {11: 10},
+                },
+            },
+        )
+
+        try:
+            response = _post(view, request, object_type="device", object_id=page_device.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 302
+        child.refresh_from_db()
+        parent.refresh_from_db()
+        assert child.parent_id == parent.pk
+        assert parent.device_id == other_member.pk
+
+    def test_auto_selected_unbound_logical_parent_without_owner_signal_is_skipped(self):
+        from types import SimpleNamespace
+
+        from dcim.models import Device, Interface
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        _virtual_chassis, (page_device, child_member) = make_virtual_chassis_members("unbound-logical-parent-owner")
+        child = make_interface(child_member, "Ethernet2.100", iface_type="virtual")
+        set_librenms_device_id(child, 11, "default")
+        child.save()
+        user = make_user_with_perms(
+            "unbound-logical-parent-owner",
+            [("view", Device), ("add", Interface), ("change", Interface)],
+        )
+        request = _make_request(
+            post_data={
+                "select": ["11"],
+                "device_selection_11": str(child_member.pk),
+                "auto_select_lag_members": "1",
+                "exclude_columns": ["vlans", "mac_address", "description", "mtu", "speed", "type"],
+            },
+            user=user,
+        )
+        view = SyncInterfacesView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        cache_key = view.get_cache_key(page_device, "ports", "default")
+        cache.set(
+            cache_key,
+            {
+                "ports": [
+                    {
+                        "port_id": 10,
+                        "ifName": "Vlan100",
+                        "ifType": "l3ipvlan",
+                        "ifAdminStatus": "up",
+                    },
+                    {
+                        "port_id": 11,
+                        "ifName": child.name,
+                        "ifType": "l2vlan",
+                        "ifAdminStatus": "up",
+                    },
+                ],
+                "port_stack_relationships": {
+                    "lag_members": {},
+                    "sub_interfaces": {11: 10},
+                },
+            },
+        )
+
+        try:
+            response = _post(view, request, object_type="device", object_id=page_device.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 302
+        child.refresh_from_db()
+        assert child.parent_id is None
+        assert not Interface.objects.filter(
+            device__virtual_chassis=page_device.virtual_chassis, name="Vlan100"
+        ).exists()
+
+    def test_off_page_parent_selection_expands_to_all_ancestors(self):
+        from types import SimpleNamespace
+
+        from dcim.models import Device, Interface
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.models import InterfaceTypeMapping
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        device = make_device("nested-off-page-parent")
+        InterfaceTypeMapping.objects.create(librenms_type="nestedVirtual", netbox_type="virtual")
+        InterfaceTypeMapping.objects.create(librenms_type="nestedPhysical", netbox_type="other")
+        user = make_user_with_perms(
+            "nested-off-page-parent",
+            [("view", Device), ("add", Interface), ("change", Interface)],
+        )
+        request = _make_request(
+            post_data={
+                "select": ["12"],
+                "auto_select_lag_members": "1",
+                "exclude_columns": ["vlans", "mac_address", "description", "mtu", "speed"],
+            },
+            user=user,
+        )
+        view = SyncInterfacesView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        cache_key = view.get_cache_key(device, "ports", "default")
+        cache.set(
+            cache_key,
+            {
+                "ports": [
+                    {
+                        "port_id": 10,
+                        "ifName": "Ethernet1",
+                        "ifType": "nestedPhysical",
+                        "ifAdminStatus": "up",
+                    },
+                    {
+                        "port_id": 11,
+                        "ifName": "Ethernet1.100",
+                        "ifType": "nestedVirtual",
+                        "ifAdminStatus": "up",
+                    },
+                    {
+                        "port_id": 12,
+                        "ifName": "Ethernet1.100.200",
+                        "ifType": "nestedVirtual",
+                        "ifAdminStatus": "up",
+                    },
+                ],
+                "port_stack_relationships": {
+                    "lag_members": {},
+                    "sub_interfaces": {12: 11, 11: 10},
+                },
+            },
+        )
+
+        try:
+            response = _post(view, request, object_type="device", object_id=device.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 302
+        grandparent = Interface.objects.get(device=device, name="Ethernet1")
+        parent = Interface.objects.get(device=device, name="Ethernet1.100")
+        child = Interface.objects.get(device=device, name="Ethernet1.100.200")
+        assert parent.parent_id == grandparent.pk
+        assert child.parent_id == parent.pk
+
+    def test_selected_row_with_blank_active_name_is_skipped(self):
+        from types import SimpleNamespace
+
+        from dcim.models import Device, Interface
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        device = make_device("blank-selected-interface-name")
+        child = make_interface(device, "Ethernet2", iface_type="virtual")
+        parent = make_interface(device, "Ethernet1")
+        set_librenms_device_id(child, 11, "default")
+        set_librenms_device_id(parent, 10, "default")
+        child.save()
+        parent.save()
+        user = make_user_with_perms(
+            "blank-selected-interface-name",
+            [("view", Device), ("add", Interface), ("change", Interface)],
+        )
+        request = _make_request(
+            post_data={
+                "select": ["11"],
+                "exclude_columns": ["vlans", "mac_address", "description", "mtu", "speed", "type"],
+            },
+            get_data={"interface_name_field": "ifDescr"},
+            user=user,
+        )
+        view = SyncInterfacesView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        cache_key = view.get_cache_key(device, "ports", "default")
+        cache.set(
+            cache_key,
+            {
+                "ports": [
+                    {
+                        "port_id": 11,
+                        "ifName": "Ethernet2",
+                        "ifDescr": None,
+                        "ifAdminStatus": "up",
+                    },
+                    {
+                        "port_id": 10,
+                        "ifName": "Ethernet1",
+                        "ifDescr": "Ethernet1",
+                        "ifAdminStatus": "up",
+                    },
+                ],
+                "port_stack_relationships": {"lag_members": {}, "sub_interfaces": {11: 10}},
+            },
+        )
+        try:
+            response = _post(view, request, object_type="device", object_id=device.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 302
+        child.refresh_from_db()
+        assert child.parent_id is None
+        assert message_texts(request, "warning") == ["1 interface(s) skipped: (unnamed) (interface name is blank)."]
+
+    def test_invalid_relationship_value_does_not_crash_auto_selection(self):
+        from types import SimpleNamespace
+
+        from dcim.models import Device, Interface
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        device = make_device("invalid-relationship-value")
+        user = make_user_with_perms(
+            "invalid-relationship-value",
+            [("view", Device), ("add", Interface), ("change", Interface)],
+        )
+        request = _make_request(
+            post_data={
+                "select": ["100"],
+                "auto_select_lag_members": "1",
+                "exclude_columns": ["vlans", "mac_address", "description", "mtu", "speed", "type"],
+            },
+            user=user,
+        )
+        view = SyncInterfacesView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        cache_key = view.get_cache_key(device, "ports", "default")
+        cache.set(
+            cache_key,
+            {
+                "ports": [{"port_id": 100, "ifName": "Port-Channel1", "ifAdminStatus": "up"}],
+                "port_stack_relationships": {
+                    "lag_members": {10: []},
+                    "sub_interfaces": {},
+                },
+            },
+        )
+
+        try:
+            response = _post(view, request, object_type="device", object_id=device.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 302
+        assert Interface.objects.filter(device=device, name="Port-Channel1").exists()
+
+    def test_duplicate_display_name_sync_uses_selected_port_id_and_target(self):
+        from types import SimpleNamespace
+
+        from dcim.models import Device, Interface
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        _virtual_chassis, (member1, member2) = make_virtual_chassis_members("stable-selection")
+        selected_interface = make_interface(member1, "Ethernet")
+        selected_interface.description = "old selected"
+        set_librenms_device_id(selected_interface, 10, "default")
+        selected_interface.save()
+        untouched_interface = make_interface(member2, "Ethernet")
+        untouched_interface.description = "old untouched"
+        set_librenms_device_id(untouched_interface, 11, "default")
+        untouched_interface.save()
+
+        user = make_user_with_perms(
+            "stable-interface-selection",
+            [("view", Device), ("add", Interface), ("change", Interface)],
+        )
+        request = _make_request(
+            post_data={
+                "select": ["10"],
+                "device_selection_10": str(member1.pk),
+                "device_selection_11": str(member2.pk),
+                "exclude_columns": ["vlans", "mac_address", "mtu", "speed", "type"],
+            },
+            get_data={"interface_name_field": "ifDescr"},
+            user=user,
+        )
+        view = SyncInterfacesView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        cache_key = view.get_cache_key(member1, "ports", "default")
+        cache.set(
+            cache_key,
+            {
+                "ports": [
+                    {
+                        "port_id": 10,
+                        "ifName": "Ethernet1",
+                        "ifDescr": "Ethernet",
+                        "ifAlias": "new selected",
+                        "ifAdminStatus": "up",
+                    },
+                    {
+                        "port_id": 11,
+                        "ifName": "Ethernet2",
+                        "ifDescr": "Ethernet",
+                        "ifAlias": "must not be applied",
+                        "ifAdminStatus": "up",
+                    },
+                ],
+                "port_stack_relationships": {},
+            },
+        )
+
+        try:
+            response = _post(view, request, object_type="device", object_id=member1.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 302
+        selected_interface.refresh_from_db()
+        untouched_interface.refresh_from_db()
+        assert selected_interface.description == "new selected"
+        assert untouched_interface.description == "old untouched"
+
+    def test_same_device_duplicate_display_name_does_not_rebind_existing_port(self):
+        from types import SimpleNamespace
+
+        from dcim.models import Device, Interface
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.utils import get_librenms_device_id, set_librenms_device_id
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        device = make_device("same-device-stable-selection")
+        existing = make_interface(device, "Ethernet")
+        existing.description = "original port"
+        set_librenms_device_id(existing, 10, "default")
+        existing.save()
+
+        user = make_user_with_perms(
+            "same-device-stable-selection",
+            [("view", Device), ("add", Interface), ("change", Interface)],
+        )
+        request = _make_request(
+            post_data={
+                "select": ["11"],
+                "exclude_columns": ["vlans", "mac_address", "mtu", "speed", "type"],
+            },
+            get_data={"interface_name_field": "ifDescr"},
+            user=user,
+        )
+        view = SyncInterfacesView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        cache_key = view.get_cache_key(device, "ports", "default")
+        cache.set(
+            cache_key,
+            {
+                "ports": [
+                    {
+                        "port_id": 10,
+                        "ifName": "Ethernet1",
+                        "ifDescr": "Ethernet",
+                        "ifAlias": "original port",
+                        "ifAdminStatus": "up",
+                    },
+                    {
+                        "port_id": 11,
+                        "ifName": "Ethernet2",
+                        "ifDescr": "Ethernet",
+                        "ifAlias": "must not be applied",
+                        "ifAdminStatus": "up",
+                    },
+                ],
+                "port_stack_relationships": {},
+            },
+        )
+
+        try:
+            response = _post(view, request, object_type="device", object_id=device.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 302
+        existing.refresh_from_db()
+        assert get_librenms_device_id(existing, "default") == 10
+        assert existing.description == "original port"
+        assert Interface.objects.filter(device=device, name="Ethernet").count() == 1
+
+    def test_same_vm_duplicate_display_name_does_not_rebind_existing_port(self):
+        from types import SimpleNamespace
+
+        from django.core.cache import cache
+        from virtualization.models import VirtualMachine, VMInterface
+
+        from netbox_librenms_plugin.utils import get_librenms_device_id, set_librenms_device_id
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        vm = make_vm("same-vm-stable-selection")
+        existing = VMInterface.objects.create(virtual_machine=vm, name="Ethernet", description="original port")
+        set_librenms_device_id(existing, 10, "default")
+        existing.save()
+
+        user = make_user_with_perms(
+            "same-vm-stable-selection",
+            [("view", VirtualMachine), ("add", VMInterface), ("change", VMInterface)],
+        )
+        request = _make_request(
+            post_data={
+                "select": ["11"],
+                "exclude_columns": ["vlans", "mac_address", "mtu", "speed", "type"],
+            },
+            get_data={"interface_name_field": "ifDescr"},
+            user=user,
+        )
+        view = SyncInterfacesView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        cache_key = view.get_cache_key(vm, "ports", "default")
+        cache.set(
+            cache_key,
+            {
+                "ports": [
+                    {
+                        "port_id": 10,
+                        "ifName": "Ethernet1",
+                        "ifDescr": "Ethernet",
+                        "ifAlias": "original port",
+                        "ifAdminStatus": "up",
+                    },
+                    {
+                        "port_id": 11,
+                        "ifName": "Ethernet2",
+                        "ifDescr": "Ethernet",
+                        "ifAlias": "must not be applied",
+                        "ifAdminStatus": "up",
+                    },
+                ],
+                "port_stack_relationships": {},
+            },
+        )
+
+        try:
+            response = _post(view, request, object_type="virtualmachine", object_id=vm.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 302
+        existing.refresh_from_db()
+        assert get_librenms_device_id(existing, "default") == 10
+        assert existing.description == "original port"
+        assert VMInterface.objects.filter(virtual_machine=vm, name="Ethernet").count() == 1
+
+    @pytest.mark.parametrize("object_type", ["device", "virtualmachine"])
+    @pytest.mark.parametrize(
+        "stored_entry",
+        [
+            "corrupt",
+            {},
+            {"id": "corrupt"},
+            None,
+        ],
+    )
+    def test_corrupt_same_name_binding_is_not_claimed_by_selected_port(self, object_type, stored_entry):
+        from types import SimpleNamespace
+
+        from dcim.models import Device, Interface
+        from django.core.cache import cache
+        from virtualization.models import VirtualMachine, VMInterface
+
+        from netbox_librenms_plugin.utils import get_librenms_device_id
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        if object_type == "device":
+            obj = make_device("corrupt-name-fallback-device")
+            interface_model = Interface
+            owner_filter = {"device": obj}
+            permissions = [("view", Device), ("add", Interface), ("change", Interface)]
+        else:
+            obj = make_vm("corrupt-name-fallback-vm")
+            interface_model = VMInterface
+            owner_filter = {"virtual_machine": obj}
+            permissions = [("view", VirtualMachine), ("add", VMInterface), ("change", VMInterface)]
+
+        existing = interface_model.objects.create(
+            **owner_filter,
+            name="Ethernet",
+            description="original description",
+            custom_field_data={"librenms_id": {"default": stored_entry}},
+        )
+        user = make_user_with_perms(f"corrupt-name-fallback-{object_type}", permissions)
+        request = _make_request(
+            post_data={
+                "select": ["11"],
+                "exclude_columns": ["vlans", "mac_address", "mtu", "speed", "type"],
+            },
+            get_data={"interface_name_field": "ifDescr"},
+            user=user,
+        )
+        view = SyncInterfacesView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        cache_key = view.get_cache_key(obj, "ports", "default")
+        cache.set(
+            cache_key,
+            {
+                "ports": [
+                    {
+                        "port_id": 11,
+                        "ifName": "Ethernet1",
+                        "ifDescr": "Ethernet",
+                        "ifAlias": "must not be applied",
+                        "ifAdminStatus": "up",
+                    }
+                ],
+                "port_stack_relationships": {},
+            },
+        )
+
+        try:
+            response = _post(view, request, object_type=object_type, object_id=obj.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 302
+        existing.refresh_from_db()
+        assert existing.custom_field_data["librenms_id"] == {"default": stored_entry}
+        assert get_librenms_device_id(existing, "default", auto_save=False) is None
+        assert existing.description == "original description"
+        assert interface_model.objects.filter(**owner_filter, name="Ethernet").count() == 1
+
+    def test_standalone_relationship_cache_read_fails_closed_on_non_dict(self):
+        from types import SimpleNamespace
+
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        obj = make_device("malformed-standalone-relationship-cache")
+        view = SyncInterfacesView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        cache_key = view.get_cache_key(obj, "ports", "default")
+        cache.set(cache_key, ["corrupt", "snapshot"])
+        try:
+            assert view._get_cached_relationships(obj, "default") == {}
+        finally:
+            cache.delete(cache_key)
+
+    def test_sync_selected_interfaces_skips_oob_rows(self):
+        """OOB-controller rows are merged into the host list only for context and are never routed to a real device."""
+        from types import SimpleNamespace
+
+        from dcim.models import Device, Interface
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        device = make_device("oob-row-not-syncable")
+        user = make_user_with_perms(
+            "oob-row-not-syncable",
+            [("view", Device), ("add", Interface), ("change", Interface)],
+        )
+        request = _make_request(
+            post_data={
+                "select": ["99"],
+                "exclude_columns": ["vlans", "mac_address", "description", "mtu", "speed", "type"],
+            },
+            user=user,
+        )
+        view = SyncInterfacesView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        cache_key = view.get_cache_key(device, "ports", "default")
+        cache.set(
+            cache_key,
+            {
+                "ports": [
+                    {
+                        "ifName": "eth0",
+                        "port_id": 99,
+                        "ifAdminStatus": "up",
+                        "_source": "oob",
+                    }
+                ]
+            },
+        )
+
+        try:
+            response = _post(view, request, object_type="device", object_id=device.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 302
+        assert not Interface.objects.filter(device=device).exists()
+
+    def test_duplicate_normalized_selected_port_id_is_rejected_before_writes(self):
+        from types import SimpleNamespace
+
+        from dcim.models import Device, Interface
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        device = make_device("duplicate-normalized-selected-id")
+        user = make_user_with_perms(
+            "duplicate-normalized-selected-id",
+            [("view", Device), ("add", Interface), ("change", Interface)],
+        )
+        request = _make_request(
+            post_data={
+                "select": ["10"],
+                "exclude_columns": ["vlans", "mac_address", "description", "mtu", "speed", "type"],
+            },
+            user=user,
+        )
+        view = SyncInterfacesView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        cache_key = view.get_cache_key(device, "ports", "default")
+        cache.set(
+            cache_key,
+            {
+                "ports": [
+                    {"port_id": 10, "ifName": "eth0", "ifAdminStatus": "up"},
+                    {"port_id": "010", "ifName": "eth1", "ifAdminStatus": "up"},
+                ],
+                "port_stack_relationships": {},
+            },
+        )
+
+        try:
+            response = _post(view, request, object_type="device", object_id=device.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 302
+        assert not Interface.objects.filter(device=device).exists()
+        assert message_texts(request, "warning") == [
+            "Selected LibreNMS port IDs are duplicated in the cached interface data. "
+            "Refresh LibreNMS data and resolve the duplicate IDs before syncing."
+        ]
+
+    def test_duplicate_normalized_related_port_id_is_not_linked(self):
+        from types import SimpleNamespace
+
+        from dcim.models import Device
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        device = make_device("duplicate-normalized-related-id")
+        child = make_interface(device, "Ethernet1.100", iface_type="virtual")
+        parent = make_interface(device, "Ethernet1")
+        set_librenms_device_id(child, 10, "default")
+        set_librenms_device_id(parent, 20, "default")
+        child.save()
+        parent.save()
+        user = make_user_with_perms(
+            "duplicate-normalized-related-id",
+            [("view", Device), ("add", type(child)), ("change", type(child))],
+        )
+        request = _make_request(
+            post_data={
+                "select": ["10"],
+                "exclude_columns": ["vlans", "mac_address", "description", "mtu", "speed", "type"],
+            },
+            user=user,
+        )
+        view = SyncInterfacesView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        cache_key = view.get_cache_key(device, "ports", "default")
+        cache.set(
+            cache_key,
+            {
+                "ports": [
+                    {"port_id": 10, "ifName": child.name, "ifAdminStatus": "up"},
+                    {"port_id": 20, "ifName": parent.name, "ifAdminStatus": "up"},
+                    {"port_id": "020", "ifName": "duplicate-parent", "ifAdminStatus": "up"},
+                ],
+                "port_stack_relationships": {
+                    "lag_members": {},
+                    "sub_interfaces": {10: 20},
+                },
+            },
+        )
+
+        try:
+            response = _post(view, request, object_type="device", object_id=device.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 302
+        child.refresh_from_db()
+        assert child.parent_id is None
+
+    def test_padded_cached_port_id_updates_its_existing_stable_match(self):
+        from types import SimpleNamespace
+
+        from dcim.models import Device, Interface
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.utils import get_librenms_device_id
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        device = make_device("padded-stable-port-id")
+        interface = make_interface(device, "oldname")
+        interface.custom_field_data["librenms_id"] = {"default": "0010"}
+        interface.save()
+        user = make_user_with_perms(
+            "padded-stable-port-id",
+            [("view", Device), ("add", Interface), ("change", Interface)],
+        )
+        request = _make_request(
+            post_data={
+                "select": ["10"],
+                "exclude_columns": ["vlans", "mac_address", "description", "mtu", "speed", "type"],
+            },
+            user=user,
+        )
+        view = SyncInterfacesView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        cache_key = view.get_cache_key(device, "ports", "default")
+        cache.set(
+            cache_key,
+            {
+                "ports": [
+                    {
+                        "port_id": "0010",
+                        "ifName": "newname",
+                        "ifAdminStatus": "up",
+                    }
+                ],
+                "port_stack_relationships": {},
+            },
+        )
+
+        try:
+            response = _post(view, request, object_type="device", object_id=device.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 302
+        interface.refresh_from_db()
+        assert interface.name == "newname"
+        assert get_librenms_device_id(interface, "default", auto_save=False) == 10
+        assert Interface.objects.filter(device=device).count() == 1
+
+
+class TestSyncInterfacesViewServerKeyAndRedirect:
+    """Issue #107: interface_name_field must be URL-escaped in the post-sync redirect.
+
+    The POSTed server_key rebind / fail-closed behavior (#108/#109) is covered by
+    test_coverage_sync_views.TestSyncInterfacesViewServerRebind, which exercises the same
+    rebind_api_for_server seam SyncInterfacesView.post actually uses.
+    """
+
+    def _make_view(self):
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        view = object.__new__(SyncInterfacesView)
+        view.require_all_permissions = MagicMock(return_value=None)
+        view.get_required_permissions_for_object_type = MagicMock(return_value=[])
+        return view
+
+    def _run_no_selection(self, view, mock_api, post_data, name_field="ifName"):
+        """Drive post() down the no-selection redirect path (server_key + redirect_url are set before that), returning the redirect call mock."""
+        with (
+            patch(
+                "netbox_librenms_plugin.views.mixins.NetBoxObjectPermissionMixin.restrict_object_or_404",
+                return_value=MagicMock(pk=1),
+            ),
+            patch("netbox_librenms_plugin.views.sync.interfaces.get_interface_name_field", return_value=name_field),
+            patch("netbox_librenms_plugin.views.sync.interfaces.messages"),
+            patch("netbox_librenms_plugin.views.sync.interfaces.redirect") as mock_redirect,
+            patch("netbox_librenms_plugin.views.sync.interfaces.reverse", return_value="/sync/"),
+            # post() rebinds the client to the POSTed server via build_librenms_api (the fail-closed
+            # seam); return a mock so a blank/valid key resolves without touching the DB or a real client.
+            patch("netbox_librenms_plugin.librenms_api.build_librenms_api", return_value=mock_api),
         ):
-            mock_cache.get.return_value = {"ports": ports}
-            view.request = req
-            view.post(req, "device", 1)
+            view.post(_make_request(post_data=post_data), "device", 1)
+        return mock_redirect
+
+    def test_interface_name_field_is_url_escaped_in_redirect(self):
+        view = self._make_view()
+        mock_api = MagicMock(server_key="default")
+        mock_redirect = self._run_no_selection(view, mock_api, {}, name_field="ifName&injected=1")
+        url = mock_redirect.call_args.args[0]
+        assert "ifName%26injected%3D1" in url
+        assert "ifName&injected=1" not in url
+
+
+# ===========================================================================
+# SyncInterfacesView.sync_interface — Device paths
+# ===========================================================================
+
+
+class TestSyncInterfacesViewSyncInterfaceDevice:
+    def _make_view(self, request=None):
+        """The real view; only its own next steps (attribute copy, VLAN sync) are stubbed."""
+        view = _sync_view(request)
+        view._lookup_maps = {}
+        view.interface_name_field = "ifName"
+        view.update_interface_attributes = MagicMock()
+        view._sync_interface_vlans = MagicMock()
+        return view
+
+    @pytest.mark.django_db
+    def test_device_interface_created(self):
+        """End-to-end: sync_interface creates a real Interface on a real Device and persists the synced attributes (the real get_or_create + update_interface_attributes + save run)."""
+        from dcim.models import Interface
+
+        view = self._make_view()
+        del view.update_interface_attributes  # exercise the real attribute sync + save
+        dev = make_device("sync-create")
+        librenms_port = {
+            "ifName": "Gi0/1",
+            "ifType": "ethernetCsmacd",
+            "ifSpeed": 1000000000,
+            "ifAlias": "uplink",
+            "ifMtu": 1500,
+            "port_id": None,
+            "ifAdminStatus": "up",
+        }
+
+        # exclude "vlans" so the (separately tested) VLAN sub-sync isn't exercised here.
+        view.sync_interface(dev, librenms_port, ["vlans"], "ifName")
+
+        iface = Interface.objects.get(device=dev, name="Gi0/1")
+        assert iface.speed == 1000000
+        assert iface.description == "uplink"
+        assert iface.mtu == 1500
+        assert iface.enabled is True
+        assert iface.type  # a real NetBox type was resolved from ifType (non-empty)
+
+    @pytest.mark.django_db
+    def test_foreign_port_id_falls_back_to_local_same_named_interface(self):
+        """A port_id owned by another device's interface still updates this device's own same-named interface."""
+        from netbox_librenms_plugin.utils import get_librenms_device_id, set_librenms_device_id
+
+        view = self._make_view()
+        del view.update_interface_attributes  # run the real attribute sync + save
+
+        # The device the user is syncing — it legitimately owns its own Gi0/1.
+        dev = make_device("sync-fallback-own")
+        own_iface = make_interface(dev, "Gi0/1")
+
+        # A DIFFERENT device whose Gi0/1 carries the LibreNMS port_id (stale/duplicate id).
+        other = make_device("sync-fallback-other")
+        other_iface = make_interface(other, "Gi0/1")
+        set_librenms_device_id(other_iface, 77, "default")
+        other_iface.save()
+
+        librenms_port = {
+            "ifName": "Gi0/1",
+            "ifType": "ethernetCsmacd",
+            "ifSpeed": 1000000000,
+            "ifAlias": "uplink-desc",
+            "ifMtu": 9000,
+            "port_id": 77,
+            "ifAdminStatus": "up",
+        }
+
+        view.sync_interface(dev, librenms_port, ["vlans"], "ifName")
+
+        own_iface.refresh_from_db()
+        other_iface.refresh_from_db()
+        # The current device's own interface was updated (not skipped).
+        assert own_iface.mtu == 9000
+        assert own_iface.description == "uplink-desc"
+        assert own_iface.speed == 1000000
+        # The other device's interface (the real owner of port_id 77) is untouched...
+        assert other_iface.mtu != 9000
+        assert get_librenms_device_id(other_iface, "default") == 77
+        # ...and the port_id is NOT reassigned onto the current device's interface.
+        assert get_librenms_device_id(own_iface, "default") is None
+
+    def test_foreign_port_id_skip_is_recorded(self):
+        """When the resolver returns None (port_id belongs to another device), the row is skipped and its name recorded in _skipped_conflicts for the post() summary."""
+        from dcim.models import Device
+
+        view = self._make_view()
+        view._skipped_conflicts = []
+        mock_device = MagicMock()
+        mock_device.__class__ = Device
+        mock_device.virtual_chassis = None
+
+        librenms_port = {"ifName": "Gi0/1", "port_id": 99}
+        view._resolve_device_interface = MagicMock(return_value=None)
+
+        view.sync_interface(mock_device, librenms_port, [], "ifName")
+
+        assert view._skipped_conflicts == ["Gi0/1 (port already mapped elsewhere or ambiguous)"]
+        view.update_interface_attributes.assert_not_called()
+
+    def test_device_selection_with_vc_valid(self):
+        """A posted sibling of the same chassis receives the interface."""
+        from dcim.models import Interface
+
+        _vc, (host, sibling) = make_virtual_chassis_members("selvalid")
+        view = self._make_view(_make_request(post_data={"device_selection_10": str(sibling.pk)}))
+
+        view.sync_interface(host, {"ifName": "Gi0/1", "port_id": 10}, [], "ifName")
+
+        assert Interface.objects.filter(device=sibling, name="Gi0/1").exists()
+        assert not Interface.objects.filter(device=host, name="Gi0/1").exists()
+
+    def test_device_selection_invalid_is_skipped(self):
+        """A device that is neither the page device nor a VC sibling is refused."""
+        from dcim.models import Interface
+
+        dev = make_device("selinvalid-page")
+        other = make_device("selinvalid-other")
+        view = self._make_view(_make_request(post_data={"device_selection_10": str(other.pk)}))
+        view._skipped_conflicts = []
+
+        view.sync_interface(dev, {"ifName": "Gi0/1", "port_id": 10}, [], "ifName")
+
+        assert not Interface.objects.filter(device=dev, name="Gi0/1").exists()
+        assert not Interface.objects.filter(device=other, name="Gi0/1").exists()
+        assert view._skipped_conflicts == ["Gi0/1 (selected target unavailable)"]
+
+    def test_device_selection_does_not_exist_is_skipped(self):
+        from dcim.models import Device, Interface
+
+        dev = make_device("selgone-page")
+        absent_pk = missing_pk(Device)
+        view = self._make_view(_make_request(post_data={"device_selection_10": str(absent_pk)}))
+        view._skipped_conflicts = []
+
+        view.sync_interface(dev, {"ifName": "Gi0/1", "port_id": 10}, [], "ifName")
+
+        assert not Interface.objects.filter(device=dev, name="Gi0/1").exists()
+        assert view._skipped_conflicts == ["Gi0/1 (selected target unavailable)"]
+
+    def test_explicit_vc_member_outside_grant_is_skipped(self):
+        """A hidden posted target must not silently sync the row onto the page device."""
+        from dcim.models import Device, Interface
+
+        _vc, (host, sibling) = make_virtual_chassis_members("selhidden")
+        user = make_user_with_perms(
+            "selhidden-user",
+            [("view", Device)],
+            constraints={"pk": host.pk},
+        )
+        request = _make_request(
+            post_data={"device_selection_10": str(sibling.pk)},
+            user=user,
+        )
+        view = self._make_view(request)
+        view._skipped_conflicts = []
+
+        view.sync_interface(host, {"ifName": "Gi0/1", "port_id": 10}, [], "ifName")
+
+        assert not Interface.objects.filter(name="Gi0/1").exists()
+        assert view._skipped_conflicts == ["Gi0/1 (selected target unavailable)"]
+
+    @pytest.mark.django_db
+    def test_device_port_id_prefers_existing_librenms_id_match(self):
+        """A port_id stored on this device's own interface updates that interface directly, no duplicate."""
+        from dcim.models import Interface
+
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+
+        view = self._make_view()
+        del view.update_interface_attributes  # run the real attribute sync + save
+
+        dev = make_device("sync-prefers-own")
+        iface = make_interface(dev, "Gi0/1")
+        set_librenms_device_id(iface, 42, "default")
+        iface.save()
+
+        librenms_port = {
+            "ifName": "Gi0/1",
+            "ifType": "ethernetCsmacd",
+            "ifSpeed": 1000000000,
+            "ifAlias": "by-id",
+            "ifMtu": 1400,
+            "port_id": 42,
+            "ifAdminStatus": "up",
+        }
+
+        view.sync_interface(dev, librenms_port, ["vlans"], "ifName")
+
+        iface.refresh_from_db()
+        assert iface.mtu == 1400
+        assert iface.description == "by-id"
+        # The existing interface matched by port_id — no duplicate was created.
+        assert Interface.objects.filter(device=dev, name="Gi0/1").count() == 1
+
+    @pytest.mark.django_db
+    def test_device_port_id_conflict_without_local_name_match_skips(self):
+        """A port_id owned by another device with no same-named local interface is skipped, not created."""
+        from dcim.models import Interface
+
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+
+        view = self._make_view()
+        view._skipped_conflicts = []
+        del view.update_interface_attributes
+
+        dev = make_device("sync-conflict-nolocal")  # deliberately has NO Gi0/1
+        other = make_device("sync-conflict-other")
+        other_iface = make_interface(other, "Gi0/1")
+        set_librenms_device_id(other_iface, 77, "default")
+        other_iface.save()
+
+        librenms_port = {
+            "ifName": "Gi0/1",
+            "ifType": "ethernetCsmacd",
+            "ifSpeed": 1000000000,
+            "ifMtu": 9000,
+            "port_id": 77,
+            "ifAdminStatus": "up",
+        }
+        view.sync_interface(dev, librenms_port, ["vlans"], "ifName")
+
+        # No same-named local interface to fall back to, and we never get_or_create one here.
+        assert view._skipped_conflicts == ["Gi0/1 (port already mapped elsewhere or ambiguous)"]
+        assert not Interface.objects.filter(device=dev, name="Gi0/1").exists()
+
+
+class TestSyncInterfacesViewSyncInterfaceVM:
+    def test_vm_interface_created(self):
+        from virtualization.models import VMInterface
+
+        vm = make_vm("vmsync-created")
+        view = _sync_view()
+        view._lookup_maps = {}
+        view.update_interface_attributes = MagicMock()
+        view._sync_interface_vlans = MagicMock()
+
+        view.sync_interface(vm, {"ifName": "eth0", "port_id": None}, [], "ifName")
+
+        assert VMInterface.objects.filter(virtual_machine=vm, name="eth0").exists()
+        view.update_interface_attributes.assert_called_once()
+
+    def test_vm_port_id_prefers_existing_librenms_id_match(self):
+        """A port_id already stored on this VM's interface updates it; no second interface."""
+        from virtualization.models import VMInterface
+
+        vm = make_vm("vmsync-portid")
+        matched = VMInterface.objects.create(virtual_machine=vm, name="eth0")
+        matched.custom_field_data["librenms_id"] = {"default": 55}
+        matched.save()
+        view = _sync_view()
+        view._lookup_maps = {}
+        view.update_interface_attributes = MagicMock()
+        view._sync_interface_vlans = MagicMock()
+        librenms_port = {"ifName": "renamed-in-librenms", "port_id": 55}
+
+        view.sync_interface(vm, librenms_port, [], "ifName")
+
+        assert VMInterface.objects.filter(virtual_machine=vm).count() == 1
+        view.update_interface_attributes.assert_called_once_with(matched, librenms_port, None, [], "ifName")
+
+    def test_invalid_obj_raises_value_error(self):
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        view = object.__new__(SyncInterfacesView)
+        view.request = _make_request()
+        librenms_port = {"ifName": "eth0"}
+
+        with pytest.raises(ValueError):
+            view.sync_interface(MagicMock(), librenms_port, [], "ifName")
 
-        mock_msgs.success.assert_called_once()
-        mock_redirect.assert_called_once()
 
-    def test_vm_post_success(self):
+class TestSyncInterfacesViewUpdateInterfaceAttributes:
+    def _make_view(self):
         from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
 
         view = object.__new__(SyncInterfacesView)
-        view.require_all_permissions = MagicMock(return_value=None)
-        view.get_required_permissions_for_object_type = MagicMock(return_value=[])
-        mock_api = MagicMock(server_key="default")
+        view.request = _make_request()
+        view._post_server_key = "default"
+        view.handle_mac_address = MagicMock()  # MAC parsing has its own dedicated test class
+        return view
+
+    def test_basic_attributes_set(self):
+        """Real Interface: the LibreNMS→NetBox field mapping is applied and persisted; the real convert_speed_to_kbps runs (bps→kbps)."""
+        from dcim.models import Interface
+
+        view = self._make_view()
+        dev = make_device("intf-attrs")
+        interface = make_interface(dev, "Gi0/0")
+        librenms_port = {
+            "ifName": "Gi0/1",
+            "ifType": "ethernetCsmacd",
+            "ifSpeed": 1000000000,
+            "ifAlias": "uplink",
+            "ifMtu": 1500,
+            "port_id": None,
+            "ifAdminStatus": "up",
+        }
+
+        view.update_interface_attributes(interface, librenms_port, "1000base-t", [], "ifName")
+
+        reloaded = Interface.objects.get(pk=interface.pk)
+        assert reloaded.name == "Gi0/1"
+        assert reloaded.type == "1000base-t"
+        assert reloaded.speed == 1000000  # 1e9 bps → 1e6 kbps via the real convert_speed_to_kbps
+        assert reloaded.description == "uplink"
+        assert reloaded.mtu == 1500
+        assert reloaded.enabled is True
+
+    def test_excluded_columns_skipped(self):
+        """Excluded columns are left untouched on a real Interface (verified via reload)."""
+        from dcim.models import Interface
+
+        view = self._make_view()
+        dev = make_device("intf-excluded")
+        interface = make_interface(dev, "orig-name", iface_type="1000base-t")
+        interface.mtu = 9000
+        interface.description = "keep-me"
+        interface.save()
+        librenms_port = {
+            "ifName": "Gi0/1",
+            "ifType": "ethernetCsmacd",
+            "ifSpeed": 0,
+            "ifAlias": "would-change",
+            "ifMtu": 1500,
+            "port_id": None,
+            "ifAdminStatus": None,
+        }
+
+        view.update_interface_attributes(
+            interface,
+            librenms_port,
+            "other",
+            ["name", "type", "speed", "description", "mtu", "enabled", "mac_address"],
+            "ifName",
+        )
+
+        # MAC handler must not be invoked when "mac_address" is excluded.
+        view.handle_mac_address.assert_not_called()
+        # Excluded attributes keep their pre-update values.
+        reloaded = Interface.objects.get(pk=interface.pk)
+        assert reloaded.name == "orig-name"
+        assert reloaded.type == "1000base-t"
+        assert reloaded.mtu == 9000
+        assert reloaded.description == "keep-me"
+
+    def test_admin_status_down_sets_disabled(self):
+        from dcim.models import Interface
+
+        view = self._make_view()
+        dev = make_device("intf-down")
+        interface = make_interface(dev, "Gi0/0")
+        librenms_port = {
+            "ifName": "Gi0/1",
+            "ifType": None,
+            "ifSpeed": None,
+            # ifAlias "" (not None): a None ifAlias would set description=None and trip the
+            # NOT-NULL constraint on a real save — see note. Empty string is the safe no-op.
+            "ifAlias": "",
+            "ifMtu": None,
+            "port_id": None,
+            "ifAdminStatus": "down",
+        }
 
-        mock_vm = MagicMock(pk=5)
-        ports = [{"ifName": "eth0", "port_id": 20}]
-        req = _make_request(post_data={"select": ["eth0"], "server_key": "default"})
+        # netbox_type "other" (the real get_netbox_interface_type fallback); passing None would
+        # set the NOT-NULL type column to NULL — another real-save constraint the mock hid.
+        view.update_interface_attributes(interface, librenms_port, "other", [], "ifName")
+
+        assert Interface.objects.get(pk=interface.pk).enabled is False
+
+    def test_port_id_calls_set_librenms_device_id(self):
+        from dcim.models import Interface
+
+        view = self._make_view()
+        interface = MagicMock()
+        interface.__class__ = Interface
+        librenms_port = {
+            "ifName": "Gi0/1",
+            "ifType": None,
+            "ifSpeed": None,
+            "ifAlias": None,
+            "ifMtu": None,
+            "port_id": 42,
+            "ifAdminStatus": "up",
+        }
 
         with (
-            patch(
-                "netbox_librenms_plugin.views.mixins.NetBoxObjectPermissionMixin.restrict_object_or_404",
-                return_value=mock_vm,
-            ),
-            patch("netbox_librenms_plugin.views.sync.interfaces.get_interface_name_field", return_value="ifName"),
-            patch("netbox_librenms_plugin.views.sync.interfaces.cache") as mock_cache,
-            patch("netbox_librenms_plugin.views.sync.interfaces.messages") as mock_msgs,
-            patch("netbox_librenms_plugin.views.sync.interfaces.redirect") as mock_redirect,
-            patch("netbox_librenms_plugin.views.sync.interfaces.reverse", return_value="/sync/"),
-            patch("netbox_librenms_plugin.views.sync.interfaces.transaction"),
-            patch.object(view, "sync_interface"),
-            patch.object(type(view), "get_vlan_groups_for_device", return_value=[]),
-            patch.object(view.__class__, "get_cache_key", return_value="k"),
-            patch.object(view.__class__, "_build_vlan_lookup_maps", return_value={}),
-            patch.object(type(view), "librenms_api", new_callable=lambda: property(lambda s: mock_api)),
+            patch("netbox_librenms_plugin.views.sync.interfaces.convert_speed_to_kbps", return_value=None),
+            patch("netbox_librenms_plugin.views.sync.interfaces.find_by_librenms_id", return_value=None),
+            patch("netbox_librenms_plugin.views.sync.interfaces.set_librenms_device_id") as mock_set,
         ):
-            mock_cache.get.return_value = {"ports": ports}
-            view.request = req
-            view.post(req, "virtualmachine", 5)
+            view.update_interface_attributes(interface, librenms_port, None, [], "ifName")
+
+        mock_set.assert_called_once_with(interface, 42, "default")
+
+    def test_port_id_conflict_does_not_overwrite(self):
+        from dcim.models import Interface
+
+        view = self._make_view()
+        interface = MagicMock()
+        interface.__class__ = Interface
+        interface.pk = 1
+        conflicting_owner = MagicMock()
+        conflicting_owner.pk = 2
+        librenms_port = {
+            "ifName": "Gi0/1",
+            "ifType": None,
+            "ifSpeed": None,
+            "ifAlias": None,
+            "ifMtu": None,
+            "port_id": 42,
+            "ifAdminStatus": "up",
+        }
+
+        with (
+            patch("netbox_librenms_plugin.views.sync.interfaces.convert_speed_to_kbps", return_value=None),
+            patch("netbox_librenms_plugin.views.sync.interfaces.find_by_librenms_id", return_value=conflicting_owner),
+            patch("netbox_librenms_plugin.views.sync.interfaces.set_librenms_device_id") as mock_set,
+        ):
+            view.update_interface_attributes(interface, librenms_port, None, [], "ifName")
+
+        mock_set.assert_not_called()
 
-        mock_msgs.success.assert_called_once()
-        mock_redirect.assert_called_once()
+    def test_ifalias_not_set_when_same_as_name(self):
+        """ifAlias should not overwrite when equal to interface name."""
+        view = _sync_view()
+        interface = make_interface(make_device("ifalias-same-as-name"), "Gi0/1")
+        librenms_port = {
+            "ifName": "Gi0/1",
+            "ifType": "ethernetCsmacd",
+            "ifSpeed": None,
+            "ifAlias": "Gi0/1",
+            "ifMtu": None,
+            "port_id": None,
+            "ifAdminStatus": "up",
+        }
+
+        view.update_interface_attributes(interface, librenms_port, "other", ["mac_address"], "ifName")
+
+        interface.refresh_from_db()
+        assert interface.description == ""
+
+
+# ===========================================================================
+# SyncInterfacesView._sync_interface_vlans
+# ===========================================================================
+
+
+class TestSyncInterfacesViewSyncInterfaceVlans:
+    def test_missing_locked_owner_vlan_map_leaves_assignments_unchanged(self):
+        from ipam.models import VLAN
 
-    def test_post_surfaces_skipped_conflicts_warning(self):
-        """When an interface is skipped (port_id owned by another device), post() surfaces a warning naming it — not just a log line."""
         from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
 
+        device = make_device("joined-vlan-owner")
+        interface = make_interface(device, "Ethernet1")
+        existing_vlan = VLAN.objects.create(vid=100, name="Existing VLAN", status="active")
+        interface.mode = "tagged"
+        interface.save()
+        interface.tagged_vlans.add(existing_vlan)
         view = object.__new__(SyncInterfacesView)
-        view.require_all_permissions = MagicMock(return_value=None)
-        view.get_required_permissions_for_object_type = MagicMock(return_value=[])
-        mock_api = MagicMock(server_key="default")
+        view.request = _make_request()
+        view._lookup_maps = view._index_vlans([existing_vlan])
+        view._lookup_maps_by_owner = {}
+        view._vlan_owners_by_id = {}
+
+        view._sync_interface_vlans(interface, {"port_id": 10, "tagged_vlans": []})
+
+        interface.refresh_from_db()
+        assert interface.mode == "tagged"
+        assert list(interface.tagged_vlans.all()) == [existing_vlan]
+
+    def test_non_numeric_cached_vid_is_dropped_instead_of_aborting_the_sync(self):
+        """A non-numeric VLAN id in the cached payload must not raise out of the sync.
+
+        ``get_cached_ports_data`` only checks that each port is a dict, so the value reaches the
+        int() coercions. A ValueError here aborts the enclosing sync transaction after other
+        rows have already applied their changes.
+        """
+        from ipam.models import VLAN
+
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        device = make_device("bad-vid-owner")
+        interface = make_interface(device, "Ethernet1")
+        real_vlan = VLAN.objects.create(vid=100, name="Real VLAN", status="active")
+        view = object.__new__(SyncInterfacesView)
+        # The group override is keyed by port_id and VID, so post the malformed VID's key too.
+        view.request = _make_request({"vlan_group_10_not-a-vid": "1", "vlan_group_10_100": "1"})
+        view._lookup_maps = view._index_vlans([real_vlan])
+        view._lookup_maps_by_owner = None
+        view._vlan_owners_by_id = {}
+
+        view._sync_interface_vlans(interface, {"port_id": 10, "untagged_vlan": "not-a-vid", "tagged_vlans": [100]})
+
+        interface.refresh_from_db()
+        # The good VID still applied; only the malformed one was dropped.
+        assert list(interface.tagged_vlans.all()) == [real_vlan]
+
+
+# ===========================================================================
+# SyncInterfacesView._sync_lag_and_parent_relationships
+# ===========================================================================
+
+
+class TestSyncLagAndParentRelationships:
+    """Outcome tests for bulk LAG/parent sync against real NetBox interfaces and validation."""
+
+    @staticmethod
+    def _make_device():
+        from netbox_librenms_plugin.tests.conftest import make_device
+
+        return make_device("lag-dev")
+
+    @staticmethod
+    def _iface(device, name, port_id, itype="1000base-t"):
+        from netbox_librenms_plugin.tests.conftest import make_interface
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+
+        iface = make_interface(device, name, iface_type=itype)
+        set_librenms_device_id(iface, port_id, "default")
+        iface.save()
+        return iface
+
+    def _make_view(self, name_field="ifName", selected_port_ids=None):
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+        view = object.__new__(SyncInterfacesView)
+        view.interface_name_field = name_field
+        view.request = make_request("post", {})
+        if selected_port_ids is not None:
+            view._selected_port_ids = set(selected_port_ids)
+        return view
+
+    def test_duplicate_display_name_links_only_selected_port(self, db):
+        """Selecting one stable port ID must not link another port with the same ifDescr."""
+        device = self._make_device()
+        m1 = self._iface(device, "Gi0/1", 10)
+        m2 = self._iface(device, "Gi0/2", 11)
+        agg = self._iface(device, "Po1", 100, itype="lag")
+
+        ports_data = [
+            {"ifDescr": "Ethernet", "ifName": "Gi0/1", "port_id": 10},
+            {"ifDescr": "Ethernet", "ifName": "Gi0/2", "port_id": 11},
+            {"ifDescr": "Po1", "ifName": "Po1", "port_id": 100},
+        ]
+        relationships = {"lag_members": {10: 100, 11: 100}, "sub_interfaces": {}}
+
+        view = self._make_view(name_field="ifDescr", selected_port_ids={10})
+        view._sync_lag_and_parent_relationships(device, ports_data, relationships, "default")
+
+        m1.refresh_from_db()
+        m2.refresh_from_db()
+        assert m1.lag_id == agg.pk
+        assert m2.lag_id is None
+
+    def test_large_bulk_relationship_set_avoids_unbounded_candidate_predicates(self):
+        """A large selection must bound SQL without locking unrelated interfaces."""
+        from django.db import connection
+
+        device = self._make_device()
+        unrelated = make_interface(device, "unrelated")
+        source_ids = range(1, 301)
+        ports_data = [{"ifName": f"Ethernet{port_id}", "port_id": port_id} for port_id in source_ids] + [
+            {"ifName": f"Port-Channel{port_id}", "port_id": 10_000 + port_id} for port_id in source_ids
+        ]
+        relationships = {
+            "lag_members": {port_id: 10_000 + port_id for port_id in source_ids},
+            "sub_interfaces": {},
+        }
+        view = self._make_view(selected_port_ids=source_ids)
+        parameter_counts = []
+        locked_interface_parameters = []
+
+        def capture_parameters(execute, sql, params, many, context):
+            parameter_counts.append(len(params or ()))
+            if "FOR UPDATE" in sql.upper() and '"dcim_interface"' in sql:
+                locked_interface_parameters.extend(params or ())
+            return execute(sql, params, many, context)
+
+        with connection.execute_wrapper(capture_parameters):
+            view._sync_lag_and_parent_relationships(device, ports_data, relationships, "default")
+
+        assert max(parameter_counts) < 2_000
+        assert unrelated.pk not in locked_interface_parameters
+
+    def test_member_selected_only_by_stable_id_is_linked(self, db):
+        """A selected stable port ID is processed by the relationship sync."""
+        device = self._make_device()
+        member = self._iface(device, "Gi0/2", 11)
+        agg = self._iface(device, "Po1", 100, itype="lag")
+
+        ports_data = [
+            {"ifName": "Gi0/2", "port_id": 11},
+            {"ifName": "Po1", "port_id": 100},
+        ]
+        relationships = {"lag_members": {11: 100}, "sub_interfaces": {}}
+
+        view = self._make_view(name_field="ifName", selected_port_ids={"11"})
+        view._sync_lag_and_parent_relationships(device, ports_data, relationships, "default")
+
+        member.refresh_from_db()
+        assert member.lag_id == agg.pk
+
+    def test_stable_ids_are_canonicalized_before_relationship_lookup(self, db):
+        """Equivalent string and integer port IDs must resolve to one canonical key."""
+        device = self._make_device()
+        member = self._iface(device, "Gi0/3", 12)
+        agg = self._iface(device, "Po2", 101, itype="lag")
+        ports_data = [
+            {"ifName": "Gi0/3", "port_id": "0012"},
+            {"ifName": "Po2", "port_id": 101},
+        ]
+        relationships = {"lag_members": {12: 101}, "sub_interfaces": {}}
+
+        view = self._make_view(selected_port_ids={"12"})
+        view._sync_lag_and_parent_relationships(device, ports_data, relationships, "default")
+
+        member.refresh_from_db()
+        assert member.lag_id == agg.pk
+
+    def test_bulk_relationship_sync_excludes_interfaces_outside_the_change_grant(self, db):
+        """A constrained change grant must scope the shared bulk relationship index."""
+        from dcim.models import Interface
+
+        from netbox_librenms_plugin.tests.view_test_helpers import grant, make_user_with_perms
+
+        device = self._make_device()
+        self._iface(device, "allowed", 20)
+        hidden_member = self._iface(device, "Gi0/4", 21)
+        hidden_agg = self._iface(device, "Po3", 102)
+        user = make_user_with_perms("bulk-rel-scope", [])
+        user = grant(user, "change", Interface, constraints={"name": "allowed"})
+        ports_data = [
+            {"ifName": "Gi0/4", "port_id": 21},
+            {"ifName": "Po3", "port_id": 102},
+        ]
+        relationships = {"lag_members": {21: 102}, "sub_interfaces": {}}
+
+        view = self._make_view(selected_port_ids={"21"})
+        view.request = make_request("post", {}, user=user)
+        view._sync_lag_and_parent_relationships(device, ports_data, relationships, "default")
+
+        hidden_member.refresh_from_db()
+        hidden_agg.refresh_from_db()
+        assert hidden_member.lag_id is None
+        assert hidden_agg.type == "1000base-t"
+
+    def test_non_dict_relationships_fails_soft_not_attributeerror(self, db):
+        """
+        A truthy but non-dict ``relationships`` (a list from a corrupt / partial-write cache) must
+        fail soft. The local ``if not relationships`` guard only catches FALSY values, so the
+        unfixed bulk path called ``relationships.get(...)`` on the list and raised AttributeError;
+        the shared ``normalize_relationship_maps`` coerces it to ``{}`` so the sync is skipped.
+        """
+        device = self._make_device()
+        member = self._iface(device, "Gi0/2", 11)
+        ports_data = [{"ifName": "Gi0/2", "port_id": 11}]
+
+        view = self._make_view(name_field="ifName", selected_port_ids={"11"})
+        # Must NOT raise AttributeError on the non-dict relationships.
+        view._sync_lag_and_parent_relationships(device, ports_data, ["garbage"], "default")
+
+        member.refresh_from_db()
+        assert member.lag_id is None  # nothing persisted from the corrupt map
+
+    def test_invalid_lag_link_rejected_by_full_clean_is_skipped(self, db):
+        """A relationship that fails Interface.full_clean() (a self-LAG from stale/crafted port_stack data) must be skipped, not persisted."""
+        device = self._make_device()
+        member = self._iface(device, "Gi0/2", 11)
+
+        ports_data = [{"ifName": "Gi0/2", "port_id": 11}]
+        # Self-LAG: the member's aggregate resolves back to itself (port_id 11 → 11), which
+        # Interface.full_clean() rejects.
+        relationships = {"lag_members": {11: 11}, "sub_interfaces": {}}
+
+        view = self._make_view(name_field="ifName", selected_port_ids={"11"})
+        view._sync_lag_and_parent_relationships(device, ports_data, relationships, "default")
+
+        member.refresh_from_db()
+        assert member.lag_id is None  # invalid self-LAG was not persisted
+
+    def test_agg_type_restored_when_a_sharing_member_fails_validation(self, db):
+        """A member whose LAG link fails full_clean must not leave the shared agg_iface.type='lag' dirty: a later valid member sharing that aggregate must still persist it as a LAG in the DB."""
+        device = self._make_device()
+        # A virtual interface cannot be assigned to a LAG, so its link fails full_clean — but only
+        # after agg.type was set to 'lag' in memory on the shared index object.
+        self._iface(device, "virt0", 10, itype="virtual")
+        member2 = self._iface(device, "Gi0/2", 11)
+        agg = self._iface(device, "Po1", 100, itype="1000base-t")  # not yet a LAG
+
+        ports_data = [
+            {"ifName": "virt0", "port_id": 10},
+            {"ifName": "Gi0/2", "port_id": 11},
+            {"ifName": "Po1", "port_id": 100},
+        ]
+        relationships = {"lag_members": {10: 100, 11: 100}, "sub_interfaces": {}}
+
+        view = self._make_view(name_field="ifName", selected_port_ids={"10", "11"})
+        view._sync_lag_and_parent_relationships(device, ports_data, relationships, "default")
+
+        member2.refresh_from_db()
+        agg.refresh_from_db()
+        # Invariant: if the valid member was linked, the aggregate MUST be persisted as a LAG.
+        assert member2.lag_id == agg.pk
+        assert agg.type == "lag"
+
+    def test_apply_relationship_restores_source_fk_on_validation_failure(self, db):
+        """A failed link must leave source_iface's FK unmutated — it is reused across rows via the shared index."""
+        from django.core.exceptions import ValidationError
+
+        from netbox_librenms_plugin.views.sync.interfaces import _apply_interface_relationship
+
+        device = self._make_device()
+        # A virtual interface cannot be assigned to a LAG, so the link fails full_clean.
+        member = self._iface(device, "virt7", 71, itype="virtual")
+        agg = self._iface(device, "Po7", 107, itype="lag")
+        assert member.lag_id is None
+
+        with pytest.raises(ValidationError):
+            _apply_interface_relationship(member, "lag", agg, prepare_related=None)
+
+        # The attempted FK is rolled back in memory so a later edge reusing this instance doesn't
+        # validate against — or persist — the failed link.
+        assert member.lag is None
+        assert member.lag_id is None
+
+    # NetBox 4.4.x reads Interface.virtual_chassis (no such attribute) when the parent sits on
+    # another device, so the validation it means to run raises AttributeError. The NetBox pinned
+    # here validates that edge correctly, so the three tests below inject the failure. `name` is
+    # what a real attribute access sets, and what the production check reads.
+    _CORE_VC_BUG = AttributeError("'Interface' object has no attribute 'virtual_chassis'", name="virtual_chassis")
+
+    def test_cross_member_parent_survives_a_netbox_that_cannot_validate_it(self, db):
+        """The edge NetBox 4.4.x cannot validate is the one it exists to allow: same chassis."""
+        from dcim.models import Interface
 
-        mock_device = MagicMock(pk=1)
-        ports = [{"ifName": "Gi0/1", "port_id": 10}]
-        req = _make_request(post_data={"select": ["Gi0/1"], "server_key": "default"})
+        from netbox_librenms_plugin.views.sync.interfaces import _apply_interface_relationship
 
-        def _record_skip(*args, **kwargs):
-            view._skipped_conflicts.append("Gi0/1 (selected target unavailable)")
+        _vc, (member1, member2) = make_virtual_chassis_members("relationship-vc-clean-bug")
+        child = make_interface(member2, "Ethernet4.100", iface_type="virtual")
+        parent = make_interface(member1, "Ethernet4")
 
-        with (
-            patch(
-                "netbox_librenms_plugin.views.mixins.NetBoxObjectPermissionMixin.restrict_object_or_404",
-                return_value=mock_device,
-            ),
-            patch("netbox_librenms_plugin.views.sync.interfaces.get_interface_name_field", return_value="ifName"),
-            patch("netbox_librenms_plugin.views.sync.interfaces.cache") as mock_cache,
-            patch("netbox_librenms_plugin.views.sync.interfaces.messages") as mock_msgs,
-            patch("netbox_librenms_plugin.views.sync.interfaces.redirect"),
-            patch("netbox_librenms_plugin.views.sync.interfaces.reverse", return_value="/sync/"),
-            patch("netbox_librenms_plugin.views.sync.interfaces.transaction"),
-            patch.object(view, "sync_interface", side_effect=_record_skip),
-            patch.object(type(view), "get_vlan_groups_for_device", return_value=[]),
-            patch.object(view.__class__, "get_cache_key", return_value="k"),
-            patch.object(view.__class__, "_build_vlan_lookup_maps", return_value={}),
-            patch.object(type(view), "librenms_api", new_callable=lambda: property(lambda s: mock_api)),
-        ):
-            mock_cache.get.return_value = {"ports": ports}
-            view.request = req
-            view.post(req, "device", 1)
+        with patch.object(Interface, "clean", side_effect=self._CORE_VC_BUG):
+            _apply_interface_relationship(child, "parent", parent)
 
-        mock_msgs.warning.assert_called_once()
-        warning_msg = mock_msgs.warning.call_args[0][1]
-        assert "Gi0/1" in warning_msg
-        assert "selected target unavailable" in warning_msg
-        assert "could not be safely matched" not in warning_msg
-        mock_msgs.success.assert_called_once()
+        child.refresh_from_db()
+        assert child.parent_id == parent.pk
 
+    def test_same_device_parent_does_not_swallow_the_attribute_error(self, db):
+        """Only the cross-chassis edge is tolerated: NetBox never reaches that branch otherwise."""
+        from dcim.models import Interface
 
-class TestSyncInterfacesViewServerKeyAndRedirect:
-    """Issue #107: interface_name_field must be URL-escaped in the post-sync redirect.
+        from netbox_librenms_plugin.views.sync.interfaces import _apply_interface_relationship
 
-    The POSTed server_key rebind / fail-closed behavior (#108/#109) is covered by
-    test_coverage_sync_views.TestSyncInterfacesViewServerRebind, which exercises the same
-    rebind_api_for_server seam SyncInterfacesView.post actually uses.
-    """
+        device = make_device("relationship-clean-bug-standalone")
+        child = make_interface(device, "Ethernet5.100", iface_type="virtual")
+        parent = make_interface(device, "Ethernet5")
 
-    def _make_view(self):
-        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+        with patch.object(Interface, "clean", side_effect=self._CORE_VC_BUG), pytest.raises(AttributeError):
+            _apply_interface_relationship(child, "parent", parent)
 
-        view = object.__new__(SyncInterfacesView)
-        view.require_all_permissions = MagicMock(return_value=None)
-        view.get_required_permissions_for_object_type = MagicMock(return_value=[])
-        return view
+        child.refresh_from_db()
+        assert child.parent_id is None
+
+    def test_an_unrelated_attribute_error_still_propagates(self, db):
+        """The tolerance is keyed on the failing attribute, not on the shape of the edge alone."""
+        from dcim.models import Interface
+
+        from netbox_librenms_plugin.views.sync.interfaces import _apply_interface_relationship
+
+        _vc, (member1, member2) = make_virtual_chassis_members("relationship-vc-other-error")
+        child = make_interface(member2, "Ethernet6.100", iface_type="virtual")
+        parent = make_interface(member1, "Ethernet6")
 
-    def _run_no_selection(self, view, mock_api, post_data, name_field="ifName"):
-        """Drive post() down the no-selection redirect path (server_key + redirect_url are set before that), returning the redirect call mock."""
         with (
-            patch(
-                "netbox_librenms_plugin.views.mixins.NetBoxObjectPermissionMixin.restrict_object_or_404",
-                return_value=MagicMock(pk=1),
+            patch.object(
+                Interface,
+                "clean",
+                side_effect=AttributeError("'Interface' object has no attribute 'nope'", name="nope"),
             ),
-            patch("netbox_librenms_plugin.views.sync.interfaces.get_interface_name_field", return_value=name_field),
-            patch("netbox_librenms_plugin.views.sync.interfaces.messages"),
-            patch("netbox_librenms_plugin.views.sync.interfaces.redirect") as mock_redirect,
-            patch("netbox_librenms_plugin.views.sync.interfaces.reverse", return_value="/sync/"),
-            # post() rebinds the client to the POSTed server via build_librenms_api (the fail-closed
-            # seam); return a mock so a blank/valid key resolves without touching the DB or a real client.
-            patch("netbox_librenms_plugin.librenms_api.build_librenms_api", return_value=mock_api),
+            pytest.raises(AttributeError),
         ):
-            view.post(_make_request(post_data=post_data), "device", 1)
-        return mock_redirect
+            _apply_interface_relationship(child, "parent", parent)
 
-    def test_interface_name_field_is_url_escaped_in_redirect(self):
-        view = self._make_view()
-        mock_api = MagicMock(server_key="default")
-        mock_redirect = self._run_no_selection(view, mock_api, {}, name_field="ifName&injected=1")
-        url = mock_redirect.call_args.args[0]
-        assert "ifName%26injected%3D1" in url
-        assert "ifName&injected=1" not in url
+        child.refresh_from_db()
+        assert child.parent_id is None
 
+    def test_vm_parent_preserves_the_original_attribute_error(self, db):
+        """A VMInterface validation error must not be replaced by a missing device attribute."""
+        from virtualization.models import VMInterface
 
-# ===========================================================================
-# SyncInterfacesView.sync_interface — Device paths
-# ===========================================================================
+        from netbox_librenms_plugin.views.sync.interfaces import _apply_interface_relationship
 
+        vm = make_vm("relationship-vm-clean-error")
+        child = VMInterface.objects.create(virtual_machine=vm, name="Ethernet1.100")
+        parent = VMInterface.objects.create(virtual_machine=vm, name="Ethernet1")
+        original = AttributeError("validation failed", name="unexpected")
 
-class TestSyncInterfacesViewSyncInterfaceDevice:
-    def _make_view(self, request=None):
-        """The real view; only its own next steps (attribute copy, VLAN sync) are stubbed."""
-        view = _sync_view(request)
-        view._lookup_maps = {}
-        view.interface_name_field = "ifName"
-        view.update_interface_attributes = MagicMock()
-        view._sync_interface_vlans = MagicMock()
-        return view
+        with patch.object(VMInterface, "clean", side_effect=original), pytest.raises(AttributeError) as raised:
+            _apply_interface_relationship(child, "parent", parent)
 
-    @pytest.mark.django_db
-    def test_device_interface_created(self):
-        """End-to-end: sync_interface creates a real Interface on a real Device and persists the synced attributes (the real get_or_create + update_interface_attributes + save run)."""
-        from dcim.models import Interface
+        assert raised.value is original
+        child.refresh_from_db()
+        assert child.parent_id is None
 
-        view = self._make_view()
-        del view.update_interface_attributes  # exercise the real attribute sync + save
-        dev = make_device("sync-create")
-        librenms_port = {
-            "ifName": "Gi0/1",
-            "ifType": "ethernetCsmacd",
-            "ifSpeed": 1000000000,
-            "ifAlias": "uplink",
-            "ifMtu": 1500,
-            "port_id": None,
-            "ifAdminStatus": "up",
-        }
+    def test_name_hint_resolves_on_expected_owner_across_vc_duplicate_names(self, db):
+        """On a VC, an id-less interface whose name is shared across members resolves to the SELECTED member, not chassis-wide ambiguity."""
+        from netbox_librenms_plugin.tests.conftest import make_virtual_chassis
 
-        # exclude "vlans" so the (separately tested) VLAN sub-sync isn't exercised here.
-        view.sync_interface(dev, librenms_port, ["vlans"], "ifName")
+        dev1 = make_device("vc-nh-m1")
+        dev2 = make_device("vc-nh-m2")
+        make_virtual_chassis("vc-nh", dev1, dev2)
+        i1 = make_interface(dev1, "Gi0/1", iface_type="1000base-t")  # id-less, on member 1
+        make_interface(dev2, "Gi0/1", iface_type="1000base-t")  # SAME name on member 2
 
-        iface = Interface.objects.get(device=dev, name="Gi0/1")
-        assert iface.speed == 1000000
-        assert iface.description == "uplink"
-        assert iface.mtu == 1500
-        assert iface.enabled is True
-        assert iface.type  # a real NetBox type was resolved from ifType (non-empty)
+        # port_id 909 matches no stored id → name-hint fallback. "Gi0/1" is duplicated across the
+        # chassis; without owner-pinning the name lookup reports ambiguity and never resolves.
+        iface, err = resolve_interface_by_port_id(
+            dev1, "909", "default", name_hint="Gi0/1", expected_owner=interface_owner_for_object(dev1)
+        )
+        assert err is None, err
+        assert iface is not None and iface.pk == i1.pk
 
-    @pytest.mark.django_db
-    def test_foreign_port_id_falls_back_to_local_same_named_interface(self):
-        """A port_id owned by another device's interface still updates this device's own same-named interface."""
-        from netbox_librenms_plugin.utils import get_librenms_device_id, set_librenms_device_id
+    def test_cross_page_parent_resolves_to_port_keyed_member_override(self, db):
+        """A cross-page parent's stable target override pins it to that member."""
+        from netbox_librenms_plugin.tests.conftest import make_virtual_chassis
 
-        view = self._make_view()
-        del view.update_interface_attributes  # run the real attribute sync + save
+        page_dev = make_device("vc-page-master")
+        member2 = make_device("vc-page-m2")
+        make_virtual_chassis("vc-page", page_dev, member2)
 
-        # The device the user is syncing — it legitimately owns its own Gi0/1.
-        dev = make_device("sync-fallback-own")
-        own_iface = make_interface(dev, "Gi0/1")
+        view = self._make_view()
+        # The JS submits the off-page parent's member (from the child row's live .vc-member-select)
+        # keyed by the parent's stable port_id.
+        view.request.POST = {"device_selection_100": str(member2.id)}
+
+        # Port-keyed override wins → the parent resolves onto member2.
+        assert view._resolve_row_target_device(page_dev, port_id="100").id == member2.id
+        # No override for this port and no name selection → the page device (unchanged default).
+        assert view._resolve_row_target_device(page_dev, port_id="999").id == page_dev.id
+
+    def test_oob_row_excluded_from_relationship_sync(self, db):
+        """An OOB-controller row sharing a selected host display name must not contribute its port_id, or the LAG pass would link the hidden controller interface instead of the host."""
+        device = self._make_device()
+        self._iface(device, "Gi0/1", 10)  # real host member sharing the name
+        self._iface(device, "Po1", 100, itype="lag")  # the LAG aggregate (port_id 100)
+        # The OOB controller's interface, which the OOB row's port_id would resolve to.
+        oob_iface = self._iface(device, "idrac0", 999)
 
-        # A DIFFERENT device whose Gi0/1 carries the LibreNMS port_id (stale/duplicate id).
-        other = make_device("sync-fallback-other")
-        other_iface = make_interface(other, "Gi0/1")
-        set_librenms_device_id(other_iface, 77, "default")
-        other_iface.save()
+        ports_data = [
+            {"ifName": "Gi0/1", "port_id": 10},
+            {"ifName": "Po1", "port_id": 100},
+            # OOB controller row merged for display; shares the selected host name "Gi0/1".
+            {"ifName": "Gi0/1", "port_id": 999, "_source": "oob"},
+        ]
+        # Crafted/colliding port_stack data maps the OOB row's port_id to the aggregate.
+        relationships = {"lag_members": {"999": 100}, "sub_interfaces": {}}
 
-        librenms_port = {
-            "ifName": "Gi0/1",
-            "ifType": "ethernetCsmacd",
-            "ifSpeed": 1000000000,
-            "ifAlias": "uplink-desc",
-            "ifMtu": 9000,
-            "port_id": 77,
-            "ifAdminStatus": "up",
-        }
+        view = self._make_view(name_field="ifName", selected_port_ids={999})
+        view._sync_lag_and_parent_relationships(device, ports_data, relationships, "default")
 
-        view.sync_interface(dev, librenms_port, ["vlans"], "ifName")
+        oob_iface.refresh_from_db()
+        assert oob_iface.lag_id is None  # OOB row skipped → no link persisted on the controller iface
 
-        own_iface.refresh_from_db()
-        other_iface.refresh_from_db()
-        # The current device's own interface was updated (not skipped).
-        assert own_iface.mtu == 9000
-        assert own_iface.description == "uplink-desc"
-        assert own_iface.speed == 1000000
-        # The other device's interface (the real owner of port_id 77) is untouched...
-        assert other_iface.mtu != 9000
-        assert get_librenms_device_id(other_iface, "default") == 77
-        # ...and the port_id is NOT reassigned onto the current device's interface.
-        assert get_librenms_device_id(own_iface, "default") is None
 
-    def test_foreign_port_id_skip_is_recorded(self):
-        """When the resolver returns None (port_id belongs to another device), the row is skipped and its name recorded in _skipped_conflicts for the post() summary."""
-        from dcim.models import Device
+# A POSTed valid non-default server_key must scope the sync to that server without 500ing on a
+# misconfigured default client. Under the stack that behavior comes from rebind_api_for_server, so
+# its coverage lives with the rebind seam in
+# test_coverage_sync_views.TestSyncInterfacesViewServerRebind
+# (test_posted_server_key_is_bound_for_the_sync / test_stale_server_key_fails_closed_without_sync).
 
-        view = self._make_view()
-        view._skipped_conflicts = []
-        mock_device = MagicMock()
-        mock_device.__class__ = Device
-        mock_device.virtual_chassis = None
+# ===========================================================================
+# Stable-ID interface resolution
+# ===========================================================================
 
-        librenms_port = {"ifName": "Gi0/1", "port_id": 99}
-        view._resolve_device_interface = MagicMock(return_value=None)
 
-        view.sync_interface(mock_device, librenms_port, [], "ifName")
+@pytest.mark.django_db
+class TestResolveInterfaceByPortId:
+    """The function must correctly read the nested {'server_key': port_id} dict format."""
 
-        assert view._skipped_conflicts == ["Gi0/1 (port already mapped elsewhere or ambiguous)"]
-        view.update_interface_attributes.assert_not_called()
+    def test_finds_interface_by_server_keyed_dict(self):
+        """When librenms_id = {'production': 42}, resolves for port_id=42 and server_key='production'."""
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+        from netbox_librenms_plugin.utils import set_librenms_device_id
 
-    def test_device_selection_with_vc_valid(self):
-        """A posted sibling of the same chassis receives the interface."""
-        from dcim.models import Interface
+        device = make_device("pci-byid")
+        iface = make_interface(device, "Gi0/1", iface_type="1000base-t")
+        set_librenms_device_id(iface, 42, "production")  # stored as {"production": 42}
+        iface.save()
 
-        _vc, (host, sibling) = make_virtual_chassis_members("selvalid")
-        view = self._make_view(_make_request(post_data={"device_selection_Gi0/1": str(sibling.pk)}))
+        found, err = resolve_interface_by_port_id(device, "42", "production")
 
-        view.sync_interface(host, {"ifName": "Gi0/1", "port_id": None}, [], "ifName")
+        assert err is None
+        assert found == iface
 
-        assert Interface.objects.filter(device=sibling, name="Gi0/1").exists()
-        assert not Interface.objects.filter(device=host, name="Gi0/1").exists()
+    def test_returns_error_when_not_found(self):
+        """Returns (None, error) when no interface has matching port_id."""
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+        from netbox_librenms_plugin.utils import set_librenms_device_id
 
-    def test_device_selection_invalid_is_skipped(self):
-        """A device that is neither the page device nor a VC sibling is refused."""
-        from dcim.models import Interface
+        device = make_device("pci-notfound")
+        # An interface exists, but carries a different port id than the one we look up.
+        iface = make_interface(device, "Gi0/1", iface_type="1000base-t")
+        set_librenms_device_id(iface, 42, "production")
+        iface.save()
 
-        dev = make_device("selinvalid-page")
-        other = make_device("selinvalid-other")
-        view = self._make_view(_make_request(post_data={"device_selection_Gi0/1": str(other.pk)}))
-        view._skipped_conflicts = []
+        found, err = resolve_interface_by_port_id(device, "99", "production")
 
-        view.sync_interface(dev, {"ifName": "Gi0/1", "port_id": None}, [], "ifName")
+        assert found is None
+        assert err is not None
 
-        assert not Interface.objects.filter(device=dev, name="Gi0/1").exists()
-        assert not Interface.objects.filter(device=other, name="Gi0/1").exists()
-        assert view._skipped_conflicts == ["Gi0/1 (selected target unavailable)"]
+    def test_name_hint_fallback_when_no_librenms_id(self):
+        """Falls back to exact name lookup when no interface has a matching librenms_id."""
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface
 
-    def test_device_selection_does_not_exist_is_skipped(self):
-        from dcim.models import Device, Interface
+        device = make_device("pci-namehint")
+        # The interface was created manually (no librenms_id) — only the name matches.
+        iface = make_interface(device, "lag-1", iface_type="lag")
 
-        dev = make_device("selgone-page")
-        absent_pk = missing_pk(Device)
-        view = self._make_view(_make_request(post_data={"device_selection_Gi0/1": str(absent_pk)}))
-        view._skipped_conflicts = []
+        found, err = resolve_interface_by_port_id(device, "42", "production", name_hint="lag-1")
 
-        view.sync_interface(dev, {"ifName": "Gi0/1", "port_id": None}, [], "ifName")
+        assert err is None
+        assert found == iface
 
-        assert not Interface.objects.filter(device=dev, name="Gi0/1").exists()
-        assert view._skipped_conflicts == ["Gi0/1 (selected target unavailable)"]
+    def test_ambiguous_port_id_returns_error_not_first_match(self):
+        """Two interfaces carrying the same stale librenms_id must fail as ambiguous, not silently bind lag/parent to whichever happens to be first."""
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+        from netbox_librenms_plugin.utils import set_librenms_device_id
 
-    def test_explicit_vc_member_outside_grant_is_skipped(self):
-        """A hidden posted target must not silently sync the row onto the page device."""
-        from dcim.models import Device, Interface
+        device = make_device("pci-ambig")
+        for name in ("Gi0/1", "Gi0/2"):
+            iface = make_interface(device, name, iface_type="1000base-t")
+            set_librenms_device_id(iface, 42, "production")  # same stale id on both
+            iface.save()
 
-        _vc, (host, sibling) = make_virtual_chassis_members("selhidden")
-        user = make_user_with_perms(
-            "selhidden-user",
-            [("view", Device)],
-            constraints={"pk": host.pk},
-        )
-        request = _make_request(
-            post_data={"device_selection_Gi0/1": str(sibling.pk)},
-            user=user,
-        )
-        view = self._make_view(request)
-        view._skipped_conflicts = []
+        found, err = resolve_interface_by_port_id(device, "42", "production")
 
-        view.sync_interface(host, {"ifName": "Gi0/1", "port_id": None}, [], "ifName")
+        assert found is None
+        assert err is not None
+        assert "ambiguous" in err.lower()
 
-        assert not Interface.objects.filter(name="Gi0/1").exists()
-        assert view._skipped_conflicts == ["Gi0/1 (selected target unavailable)"]
+    def test_name_hint_does_not_exist_falls_through_to_not_found(self):
+        """A name-hint miss (DoesNotExist) is swallowed and reported as not-found."""
+        from netbox_librenms_plugin.tests.conftest import make_device
 
-    @pytest.mark.django_db
-    def test_device_port_id_prefers_existing_librenms_id_match(self):
-        """A port_id stored on this device's own interface updates that interface directly, no duplicate."""
-        from dcim.models import Interface
+        device = make_device("pci-namemiss")  # no interfaces at all
 
-        from netbox_librenms_plugin.utils import set_librenms_device_id
+        found, err = resolve_interface_by_port_id(device, "42", "production", name_hint="lag-1")
 
-        view = self._make_view()
-        del view.update_interface_attributes  # run the real attribute sync + save
+        assert found is None
+        assert err is not None
+        assert "not found" in err.lower()
 
-        dev = make_device("sync-prefers-own")
-        iface = make_interface(dev, "Gi0/1")
-        set_librenms_device_id(iface, 42, "default")
-        iface.save()
+    def test_name_hint_multiple_matches_returns_ambiguous(self):
+        """A name-hint matching multiple interfaces returns an ambiguity error, not a silent not-found."""
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface, make_virtual_chassis
 
-        librenms_port = {
-            "ifName": "Gi0/1",
-            "ifType": "ethernetCsmacd",
-            "ifSpeed": 1000000000,
-            "ifAlias": "by-id",
-            "ifMtu": 1400,
-            "port_id": 42,
-            "ifAdminStatus": "up",
-        }
+        member1 = make_device("pci-vc-m1")
+        member2 = make_device("pci-vc-m2")
+        make_virtual_chassis("pci-vc", member1, member2)
+        # Same interface name on both members; neither has a librenms_id for port 42.
+        make_interface(member1, "lag-1", iface_type="lag")
+        make_interface(member2, "lag-1", iface_type="lag")
 
-        view.sync_interface(dev, librenms_port, ["vlans"], "ifName")
+        found, err = resolve_interface_by_port_id(member1, "42", "production", name_hint="lag-1")
 
-        iface.refresh_from_db()
-        assert iface.mtu == 1400
-        assert iface.description == "by-id"
-        # The existing interface matched by port_id — no duplicate was created.
-        assert Interface.objects.filter(device=dev, name="Gi0/1").count() == 1
+        assert found is None
+        assert err is not None
+        assert "ambiguous" in err.lower()
 
-    @pytest.mark.django_db
-    def test_device_port_id_conflict_without_local_name_match_skips(self):
-        """A port_id owned by another device with no same-named local interface is skipped, not created."""
-        from dcim.models import Interface
+    def test_unexpected_error_during_resolution_propagates(self):
+        """A real DB/runtime fault while scanning the device's interfaces must propagate, not be masked as a silent not-found."""
+        from django.db import connection
 
-        from netbox_librenms_plugin.utils import set_librenms_device_id
+        device = make_device("relationship-resolution-db-failure")
 
-        view = self._make_view()
-        view._skipped_conflicts = []
-        del view.update_interface_attributes
+        def fail_interface_query(execute, sql, params, many, context):
+            if 'FROM "dcim_interface"' in sql:
+                raise RuntimeError("database is down")
+            return execute(sql, params, many, context)
 
-        dev = make_device("sync-conflict-nolocal")  # deliberately has NO Gi0/1
-        other = make_device("sync-conflict-other")
-        other_iface = make_interface(other, "Gi0/1")
-        set_librenms_device_id(other_iface, 77, "default")
-        other_iface.save()
+        with connection.execute_wrapper(fail_interface_query):
+            with pytest.raises(RuntimeError):
+                resolve_interface_by_port_id(device, "42", "production", name_hint="lag-1")
 
-        librenms_port = {
-            "ifName": "Gi0/1",
-            "ifType": "ethernetCsmacd",
-            "ifSpeed": 1000000000,
-            "ifMtu": 9000,
-            "port_id": 77,
-            "ifAdminStatus": "up",
-        }
-        view.sync_interface(dev, librenms_port, ["vlans"], "ifName")
 
-        # No same-named local interface to fall back to, and we never get_or_create one here.
-        assert view._skipped_conflicts == ["Gi0/1 (port already mapped elsewhere or ambiguous)"]
-        assert not Interface.objects.filter(device=dev, name="Gi0/1").exists()
+class TestResolveInterfaceByPortIdExpectedOwner:
+    """Real database coverage for owner-pinned stable-ID resolution."""
 
+    @staticmethod
+    def _make_vc_members():
+        from netbox_librenms_plugin.tests.conftest import make_device, make_virtual_chassis
 
-class TestSyncInterfacesViewSyncInterfaceVM:
-    def test_vm_interface_created(self):
-        from virtualization.models import VMInterface
+        member1 = make_device("vc-m1")
+        member2 = make_device("vc-m2")
+        make_virtual_chassis("VC-1", member1, member2)
+        return member1, member2
 
-        vm = make_vm("vmsync-created")
-        view = _sync_view()
-        view._lookup_maps = {}
-        view.update_interface_attributes = MagicMock()
-        view._sync_interface_vlans = MagicMock()
+    @staticmethod
+    def _iface_with_librenms_id(device, name, port_id, server_key="default"):
+        from netbox_librenms_plugin.tests.conftest import make_interface
+        from netbox_librenms_plugin.utils import set_librenms_device_id
 
-        view.sync_interface(vm, {"ifName": "eth0", "port_id": None}, [], "ifName")
+        iface = make_interface(device, name, iface_type="1000base-t")
+        set_librenms_device_id(iface, port_id, server_key)
+        iface.save()
+        return iface
+
+    def test_rejects_match_on_a_different_vc_member(self, db):
+        """port_id resolves uniquely onto member2's interface; resolving from member1 with expected_owner=member1 must reject it (the fix) — and accept it without the guard."""
+        member1, member2 = self._make_vc_members()
+        iface2 = self._iface_with_librenms_id(member2, "Gi0/1", 42)
+
+        # Without the guard: the VC-wide search finds member2's interface (the latent bug).
+        found, err = resolve_interface_by_port_id(member1, "42", "default")
+        assert err is None
+        assert found == iface2
+
+        # With expected_owner pinned to member1: the foreign-member match is rejected.
+        found, err = resolve_interface_by_port_id(member1, "42", "default", expected_owner=(member1.pk, None))
+        assert found is None
+        assert err and "different owner" in err
+
+        # With expected_owner matching the real owner (member2): accepted.
+        found, err = resolve_interface_by_port_id(member1, "42", "default", expected_owner=(member2.pk, None))
+        assert err is None
+        assert found == iface2
+
+    def test_accepts_match_on_the_expected_member(self, db):
+        """An interface that genuinely lives on the expected member resolves cleanly."""
+        member1, _ = self._make_vc_members()
+        iface1 = self._iface_with_librenms_id(member1, "Gi0/1", 7)
+
+        found, err = resolve_interface_by_port_id(member1, "7", "default", expected_owner=(member1.pk, None))
+        assert err is None
+        assert found == iface1
+
+    def test_owner_mismatch_falls_back_to_name_hint(self, db):
+        """A stale port_id on a foreign VC member must not block the name_hint fallback to the manually-created interface on the expected owner."""
+        from netbox_librenms_plugin.tests.conftest import make_interface
+
+        member1, member2 = self._make_vc_members()
+        # Stale/reused librenms_id 42 lives on member2 (a foreign member).
+        self._iface_with_librenms_id(member2, "Gi0/1", 42)
+        # The real target: a manually-created aggregate on member1 with no stored librenms_id.
+        agg = make_interface(member1, "Po1", iface_type="lag")
+
+        # port_id 42 uniquely id-matches member2, but pinned to member1 with name_hint 'Po1'
+        # the foreign id-match must be skipped and the name fallback must find member1's Po1.
+        found, err = resolve_interface_by_port_id(
+            member1, "42", "default", name_hint="Po1", expected_owner=(member1.pk, None)
+        )
+        assert err is None, err
+        assert found == agg
 
-        assert VMInterface.objects.filter(virtual_machine=vm, name="eth0").exists()
-        view.update_interface_attributes.assert_called_once()
 
-    def test_vm_port_id_prefers_existing_librenms_id_match(self):
-        """A port_id already stored on this VM's interface updates it; no second interface."""
-        from virtualization.models import VMInterface
+class TestBulkRelationshipRobustness:
+    """Real-DB coverage for the bulk LAG/parent relationship pass robustness fixes."""
 
-        vm = make_vm("vmsync-portid")
-        matched = VMInterface.objects.create(virtual_machine=vm, name="eth0")
-        matched.custom_field_data["librenms_id"] = {"default": 55}
-        matched.save()
-        view = _sync_view()
-        view._lookup_maps = {}
-        view.update_interface_attributes = MagicMock()
-        view._sync_interface_vlans = MagicMock()
-        librenms_port = {"ifName": "renamed-in-librenms", "port_id": 55}
+    def test_non_dict_relationship_maps_do_not_crash(self, db):
+        """A corrupt list-shaped lag_members/sub_interfaces in the cached relationships must be coerced to {} (fail-soft), not crash the bulk sync POST."""
+        from netbox_librenms_plugin.tests.conftest import make_device
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
 
-        view.sync_interface(vm, librenms_port, [], "ifName")
+        device = make_device("rel-shape")
+        view = object.__new__(SyncInterfacesView)
+        # Mirrors the hardened relationship-map reader. Without the guard this raises
+        # AttributeError ('list' object has no attribute 'items').
+        view._sync_lag_and_parent_relationships(device, [], {"lag_members": [1, 2], "sub_interfaces": ["x"]}, "default")
 
-        assert VMInterface.objects.filter(virtual_machine=vm).count() == 1
-        view.update_interface_attributes.assert_called_once_with(matched, librenms_port, None, [], "ifName")
+    def test_bulk_lag_persist_does_not_clobber_concurrent_edits(self, db):
+        """The bulk LAG persist writes only the changed FK/type columns, so a concurrent edit to other fields of the stale in-memory objects isn't lost (no full-row overwrite)."""
+        from dcim.models import Interface
 
-    def test_invalid_obj_raises_value_error(self):
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface
         from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
 
+        device = make_device("toctou")
+        member = make_interface(device, "Et1", iface_type="1000base-t")
+        agg = make_interface(device, "Po1", iface_type="1000base-t")
+        # In-memory objects now hold stale descriptions; a concurrent writer commits fresh
+        # descriptions straight to the DB after these objects were loaded.
+        member.description = "member-stale"
+        agg.description = "agg-stale"
+        Interface.objects.filter(pk=member.pk).update(description="member-fresh")
+        Interface.objects.filter(pk=agg.pk).update(description="agg-fresh")
+
         view = object.__new__(SyncInterfacesView)
-        view.request = _make_request()
-        librenms_port = {"ifName": "eth0"}
+        view._apply_relationship_edge(member, "lag", agg, SyncInterfacesView._prepare_bulk_lag_aggregate, "LAG")
+
+        agg.refresh_from_db()
+        member.refresh_from_db()
+        assert agg.type == "lag"  # the intended mutation persisted
+        assert member.lag_id == agg.pk  # the link persisted
+        assert agg.description == "agg-fresh"  # concurrent edit NOT clobbered
+        assert member.description == "member-fresh"  # concurrent edit NOT clobbered
+
+    def test_locked_interface_index_preloads_relationship_validation_owners(self, django_assert_num_queries):
+        from dcim.models import Location, Rack
+        from django.db import connection, transaction
+        from django.test.utils import CaptureQueriesContext
+        from ipam.models import VLAN
+
+        from netbox_librenms_plugin.views.sync.interfaces import _apply_interface_relationship
+
+        _virtual_chassis, (member1, member2) = make_virtual_chassis_members("relationship-index")
+        location = Location.objects.create(
+            name="Relationship index location",
+            slug="relationship-index-location",
+            site=member2.site,
+            status="active",
+        )
+        rack = Rack.objects.create(
+            name="Relationship index rack", site=member2.site, location=location, status="active"
+        )
+        member2.location = location
+        member2.rack = rack
+        member2.save(update_fields=["location", "rack"])
+        aggregate = make_interface(member1, "Port-Channel1", iface_type="lag")
+        lag_member = make_interface(member2, "Ethernet3")
+        lag_member.lag = aggregate
+        lag_member.save(update_fields=["lag"])
+        parent = make_interface(member2, "Ethernet2")
+        bridge = make_interface(member2, "Bridge1", iface_type="bridge")
+        vlan = VLAN.objects.create(vid=100, name="Relationship validation VLAN", site=member2.site, status="active")
+        source = make_interface(member2, "Ethernet2.100", iface_type="virtual")
+        source.parent = parent
+        source.bridge = bridge
+        source.mode = "access"
+        source.untagged_vlan = vlan
+        source.save(update_fields=["parent", "bridge", "mode", "untagged_vlan"])
+
+        with transaction.atomic():
+            index = build_interface_index(member1, "default", lock=True)
+            indexed_source = index["by_name"][source.name][0]
+            indexed_lag_member = index["by_name"][lag_member.name][0]
+            with django_assert_num_queries(0):
+                assert indexed_source.device.virtual_chassis_id == member2.virtual_chassis_id
+                assert indexed_lag_member.lag.device.virtual_chassis_id == member1.virtual_chassis_id
+                assert indexed_source.parent.device.virtual_chassis_id == member2.virtual_chassis_id
+                assert indexed_source.bridge.device.virtual_chassis_id == member2.virtual_chassis_id
+                assert indexed_source.device.site_id == member2.site_id
+                assert indexed_source.device.location_id == location.pk
+                assert indexed_source.device.rack_id == rack.pk
+                assert indexed_source.untagged_vlan.site_id == member2.site_id
+            indexed_parent = index["by_name"][parent.name][0]
+            with CaptureQueriesContext(connection) as queries:
+                _apply_interface_relationship(indexed_source, "parent", indexed_parent)
+            assert not any('SELECT 1 AS "a" FROM "dcim_interface"' in query["sql"] for query in queries)
+
+    def test_locked_vm_interface_index_preloads_full_clean_relationships(self, django_assert_num_queries):
+        from django.db import connection, transaction
+        from django.test.utils import CaptureQueriesContext
+        from ipam.models import VLAN
+        from virtualization.models import VMInterface
 
-        with pytest.raises(ValueError):
-            view.sync_interface(MagicMock(), librenms_port, [], "ifName")
+        from netbox_librenms_plugin.views.sync.interfaces import _apply_interface_relationship
+
+        vm = make_vm("relationship-index-vm")
+        site = make_device("relationship-index-vm-site").site
+        vm.site = site
+        vm.save(update_fields=["site"])
+        parent = VMInterface.objects.create(virtual_machine=vm, name="Ethernet1")
+        bridge = VMInterface.objects.create(virtual_machine=vm, name="Bridge1")
+        vlan = VLAN.objects.create(vid=101, name="VM relationship validation VLAN", site=site, status="active")
+        source = VMInterface.objects.create(
+            virtual_machine=vm,
+            name="Ethernet1.101",
+            parent=parent,
+            bridge=bridge,
+            mode="access",
+            untagged_vlan=vlan,
+        )
 
+        with transaction.atomic():
+            index = build_interface_index(vm, "default", lock=True)
+            indexed_source = index["by_name"][source.name][0]
+            with django_assert_num_queries(0):
+                assert indexed_source.virtual_machine.site_id == site.pk
+                assert indexed_source.parent.virtual_machine_id == vm.pk
+                assert indexed_source.bridge.virtual_machine_id == vm.pk
+                assert indexed_source.untagged_vlan.site_id == site.pk
+            indexed_parent = index["by_name"][parent.name][0]
+            with CaptureQueriesContext(connection) as queries:
+                _apply_interface_relationship(indexed_source, "parent", indexed_parent)
+            assert not any('SELECT 1 AS "a" FROM "virtualization_vminterface"' in query["sql"] for query in queries)
+
+
+@pytest.mark.django_db
+class TestSyncInterfaceLagViewRealDB:
+    """End-to-end (real DB) coverage for SyncInterfaceLagView.post."""
 
-class TestSyncInterfacesViewUpdateInterfaceAttributes:
     def _make_view(self):
-        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+        from types import SimpleNamespace
 
-        view = object.__new__(SyncInterfacesView)
-        view.request = _make_request()
-        view._post_server_key = "default"
-        view.handle_mac_address = MagicMock()  # MAC parsing has its own dedicated test class
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceLagView
+
+        view = SyncInterfaceLagView()
+        view._librenms_api = SimpleNamespace(server_key="default")
         return view
 
-    def test_basic_attributes_set(self):
-        """Real Interface: the LibreNMS→NetBox field mapping is applied and persisted; the real convert_speed_to_kbps runs (bps→kbps)."""
-        from dcim.models import Interface
+    @staticmethod
+    def _iface(device, name, port_id, itype="1000base-t"):
+        from netbox_librenms_plugin.tests.conftest import make_interface
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+
+        iface = make_interface(device, name, iface_type=itype)
+        set_librenms_device_id(iface, port_id, "default")
+        iface.save()
+        return iface
+
+    def test_links_member_to_aggregate(self):
+        from netbox_librenms_plugin.tests.conftest import make_device
+
+        device = make_device("lag-host")
+        member = self._iface(device, "Gi0/1", 10)
+        agg = self._iface(device, "Po1", 20)
 
         view = self._make_view()
-        dev = make_device("intf-attrs")
-        interface = make_interface(dev, "Gi0/0")
-        librenms_port = {
-            "ifName": "Gi0/1",
-            "ifType": "ethernetCsmacd",
-            "ifSpeed": 1000000000,
-            "ifAlias": "uplink",
-            "ifMtu": 1500,
-            "port_id": None,
-            "ifAdminStatus": "up",
-        }
+        _cache_relationship(view, device, "lag_members", 10, 20, member.name, agg.name)
+        req = _make_request({"port_id": "10", "lag_port_id": "20"})
+        resp = _post(view, req, object_type="device", object_id=device.pk)
 
-        view.update_interface_attributes(interface, librenms_port, "1000base-t", [], "ifName")
+        assert resp.status_code == 200, resp.content
+        member.refresh_from_db()
+        agg.refresh_from_db()
+        # The link actually persisted, and the aggregate was promoted to type=lag.
+        assert member.lag_id == agg.pk
+        assert agg.type == "lag"
 
-        reloaded = Interface.objects.get(pk=interface.pk)
-        assert reloaded.name == "Gi0/1"
-        assert reloaded.type == "1000base-t"
-        assert reloaded.speed == 1000000  # 1e9 bps → 1e6 kbps via the real convert_speed_to_kbps
-        assert reloaded.description == "uplink"
-        assert reloaded.mtu == 1500
-        assert reloaded.enabled is True
+    def test_self_lag_rejected_by_real_full_clean(self):
+        import json
 
-    def test_excluded_columns_skipped(self):
-        """Excluded columns are left untouched on a real Interface (verified via reload)."""
-        from dcim.models import Interface
+        from netbox_librenms_plugin.tests.conftest import make_device
+
+        device = make_device("lag-host-self")
+        iface = self._iface(device, "Po1", 30)
 
         view = self._make_view()
-        dev = make_device("intf-excluded")
-        interface = make_interface(dev, "orig-name", iface_type="1000base-t")
-        interface.mtu = 9000
-        interface.description = "keep-me"
+        _cache_relationship(view, device, "lag_members", 30, 30, iface.name, iface.name)
+        # port_id == lag_port_id resolves member == aggregate (same real interface); NetBox's
+        # real Interface.clean() must reject the self-LAG with a 409 and persist nothing.
+        req = _make_request({"port_id": "30", "lag_port_id": "30"})
+        resp = _post(view, req, object_type="device", object_id=device.pk)
+
+        assert resp.status_code == 409
+        body = json.loads(resp.content)
+        assert "NetBox rejected the LAG relationship" in body["error"]
+        iface.refresh_from_db()
+        assert iface.lag_id is None
+
+    def test_cross_member_aggregate_is_linked_within_virtual_chassis(self):
+        from netbox_librenms_plugin.tests.conftest import make_device, make_virtual_chassis
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceLagView
+
+        member1 = make_device("vc-lag-m1")
+        member2 = make_device("vc-lag-m2")
+        make_virtual_chassis("VC-LAG", member1, member2)
+        local = self._iface(member1, "Gi0/1", 40)
+        aggregate = self._iface(member2, "Po1", 50)
+
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        view = SyncInterfaceLagView()
+        view._librenms_api = api
+        _cache_relationship(view, member1, "lag_members", 40, 50, local.name, aggregate.name)
+        req = _make_request({"port_id": "40", "lag_port_id": "50"})
+        resp = _post(view, req, object_type="device", object_id=member1.pk)
+
+        assert resp.status_code == 200, resp.content
+        local.refresh_from_db()
+        aggregate.refresh_from_db()
+        assert local.lag_id == aggregate.pk
+        assert aggregate.type == "lag"
+
+
+@pytest.mark.django_db
+class TestSyncInterfaceParentViewRealPermissions:
+    def test_migrated_donor_rejects_direct_parent_sync(self):
+        from types import SimpleNamespace
+
+        from netbox_librenms_plugin.utils import mark_librenms_migrated, set_librenms_device_id
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceParentView
+
+        donor = make_device("parent-migrated-donor")
+        winner = make_device("parent-migrated-winner")
+        child = make_interface(donor, "Ethernet1.100", iface_type="virtual")
+        parent = make_interface(donor, "Ethernet1")
+        set_librenms_device_id(child, 10, "default")
+        set_librenms_device_id(parent, 11, "default")
+        child.save()
+        parent.save()
+        mark_librenms_migrated(donor, winner.pk, "default")
+        donor.save()
+
+        request = _make_request({"port_id": "10", "parent_port_id": "11"})
+        view = SyncInterfaceParentView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        _cache_relationship(view, donor, "sub_interfaces", 10, 11, child.name, parent.name)
+
+        response = _post(view, request, object_type="device", object_id=donor.pk)
+
+        assert response.status_code == 409
+        child.refresh_from_db()
+        assert child.parent_id is None
+
+    def test_viewable_parent_does_not_require_change_permission(self):
+        from types import SimpleNamespace
+
+        from dcim.models import Device, Interface
+
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceParentView
+
+        device = make_device("parent-related-view-permission")
+        child = make_interface(device, "Ethernet1.100", iface_type="virtual")
+        parent = make_interface(device, "Ethernet1")
+        set_librenms_device_id(child, 10, "default")
+        set_librenms_device_id(parent, 11, "default")
+        child.save()
+        parent.save()
+
+        user = make_user_with_perms(
+            "parent-related-view-permission",
+            [("view", Device), ("view", Interface)],
+        )
+        user = grant(user, "change", Interface, constraints={"pk": child.pk})
+        request = _make_request(
+            {
+                "port_id": "10",
+                "parent_port_id": "11",
+                "parent_name": "Ethernet1",
+            },
+            user=user,
+        )
+        view = SyncInterfaceParentView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        _cache_relationship(view, device, "sub_interfaces", 10, 11, child.name, parent.name)
+
+        response = _post(view, request, object_type="device", object_id=device.pk)
+
+        assert response.status_code == 200, response.content
+        child.refresh_from_db()
+        assert child.parent_id == parent.pk
+
+    def test_self_parent_is_rejected_without_leaking_validation_detail(self):
+        import json
+        from types import SimpleNamespace
+
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceParentView
+
+        device = make_device("parent-self-link")
+        interface = make_interface(device, "Ethernet1")
+        set_librenms_device_id(interface, 12, "default")
         interface.save()
-        librenms_port = {
-            "ifName": "Gi0/1",
-            "ifType": "ethernetCsmacd",
-            "ifSpeed": 0,
-            "ifAlias": "would-change",
-            "ifMtu": 1500,
-            "port_id": None,
-            "ifAdminStatus": None,
-        }
+        request = _make_request({"port_id": "12", "parent_port_id": "12", "parent_name": "Ethernet1"})
+        view = SyncInterfaceParentView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        _cache_relationship(view, device, "sub_interfaces", 12, 12, interface.name, interface.name)
 
-        view.update_interface_attributes(
-            interface,
-            librenms_port,
-            "other",
-            ["name", "type", "speed", "description", "mtu", "enabled", "mac_address"],
-            "ifName",
+        response = _post(view, request, object_type="device", object_id=device.pk)
+
+        assert response.status_code == 409
+        body = json.loads(response.content)
+        assert "NetBox rejected the parent relationship" in body["error"]
+        assert "cannot be its own" not in body["error"]
+        interface.refresh_from_db()
+        assert interface.parent_id is None
+
+    def test_name_fallback_rejects_interface_bound_to_a_different_port(self):
+        from types import SimpleNamespace
+
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceParentView
+
+        device = make_device("parent-conflicting-id")
+        child = make_interface(device, "Ethernet1.100", iface_type="virtual")
+        wrong_parent = make_interface(device, "Ethernet1")
+        set_librenms_device_id(child, 10, "default")
+        set_librenms_device_id(wrong_parent, 30, "default")
+        child.save()
+        wrong_parent.save()
+        request = _make_request({"port_id": "10", "parent_port_id": "20", "parent_name": "Ethernet1"})
+        view = SyncInterfaceParentView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        _cache_relationship(view, device, "sub_interfaces", 10, 20, child.name, wrong_parent.name)
+
+        response = _post(view, request, object_type="device", object_id=device.pk)
+
+        assert response.status_code == 404, response.content
+        child.refresh_from_db()
+        assert child.parent_id is None
+
+    def test_unknown_server_key_fails_closed_before_relationship_lookup(self):
+        from types import SimpleNamespace
+
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceParentView
+
+        device = make_device("parent-stale-server")
+        child = make_interface(device, "Ethernet1.100", iface_type="virtual")
+        parent = make_interface(device, "Ethernet1")
+        set_librenms_device_id(child, 10, "retired")
+        set_librenms_device_id(parent, 11, "retired")
+        child.save()
+        parent.save()
+        request = _make_request(
+            {
+                "port_id": "10",
+                "parent_port_id": "11",
+                "parent_name": "Ethernet1",
+                "server_key": "retired",
+            }
         )
+        view = SyncInterfaceParentView()
+        view._librenms_api = SimpleNamespace(server_key="default")
 
-        # MAC handler must not be invoked when "mac_address" is excluded.
-        view.handle_mac_address.assert_not_called()
-        # Excluded attributes keep their pre-update values.
-        reloaded = Interface.objects.get(pk=interface.pk)
-        assert reloaded.name == "orig-name"
-        assert reloaded.type == "1000base-t"
-        assert reloaded.mtu == 9000
-        assert reloaded.description == "keep-me"
+        response = _post(view, request, object_type="device", object_id=device.pk)
 
-    def test_admin_status_down_sets_disabled(self):
-        from dcim.models import Interface
+        assert response.status_code == 400
+        child.refresh_from_db()
+        assert child.parent_id is None
 
-        view = self._make_view()
-        dev = make_device("intf-down")
-        interface = make_interface(dev, "Gi0/0")
-        librenms_port = {
-            "ifName": "Gi0/1",
-            "ifType": None,
-            "ifSpeed": None,
-            # ifAlias "" (not None): a None ifAlias would set description=None and trip the
-            # NOT-NULL constraint on a real save — see note. Empty string is the safe no-op.
-            "ifAlias": "",
-            "ifMtu": None,
-            "port_id": None,
-            "ifAdminStatus": "down",
-        }
 
-        # netbox_type "other" (the real get_netbox_interface_type fallback); passing None would
-        # set the NOT-NULL type column to NULL — another real-save constraint the mock hid.
-        view.update_interface_attributes(interface, librenms_port, "other", [], "ifName")
+@pytest.mark.django_db
+class TestPromoteLagAggregateShared:
+    """The bulk and single-row LAG endpoints promote the aggregate through one shared helper."""
 
-        assert Interface.objects.get(pk=interface.pk).enabled is False
+    def test_bulk_returns_persist_restore_and_restore_reverts_in_memory(self):
+        """_prepare_bulk_lag_aggregate returns (persist, restore); restore reverts the in-memory type."""
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
 
-    def test_port_id_calls_set_librenms_device_id(self):
-        from dcim.models import Interface
+        agg = make_interface(make_device("lag-bulk"), "ae0", iface_type="other")
+        result = SyncInterfacesView._prepare_bulk_lag_aggregate(agg)
 
-        view = self._make_view()
-        interface = MagicMock()
-        interface.__class__ = Interface
-        librenms_port = {
-            "ifName": "Gi0/1",
-            "ifType": None,
-            "ifSpeed": None,
-            "ifAlias": None,
-            "ifMtu": None,
-            "port_id": 42,
-            "ifAdminStatus": "up",
-        }
+        assert isinstance(result, tuple)
+        persist, restore = result
+        assert agg.type == "lag"  # bumped in memory
+        restore()
+        assert agg.type == "other"  # restore reverts (aggregate reused across rows)
 
-        with (
-            patch("netbox_librenms_plugin.views.sync.interfaces.convert_speed_to_kbps", return_value=None),
-            patch("netbox_librenms_plugin.views.sync.interfaces.find_by_librenms_id", return_value=None),
-            patch("netbox_librenms_plugin.views.sync.interfaces.set_librenms_device_id") as mock_set,
-        ):
-            view.update_interface_attributes(interface, librenms_port, None, [], "ifName")
+    def test_single_row_returns_bare_persist_and_saves_only_type(self):
+        """SyncInterfaceLagView._prepare_related returns a bare persist that saves type=lag."""
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceLagView
 
-        mock_set.assert_called_once_with(interface, 42, "default")
+        agg = make_interface(make_device("lag-single"), "ae0", iface_type="other")
+        view = object.__new__(SyncInterfaceLagView)
+        persist = view._prepare_related(agg)
 
-    def test_port_id_conflict_does_not_overwrite(self):
-        from dcim.models import Interface
+        assert callable(persist) and not isinstance(persist, tuple)
+        assert agg.type == "lag"  # bumped in memory
+        persist()
+        agg.refresh_from_db()
+        assert agg.type == "lag"  # persisted
 
-        view = self._make_view()
-        interface = MagicMock()
-        interface.__class__ = Interface
-        interface.pk = 1
-        conflicting_owner = MagicMock()
-        conflicting_owner.pk = 2
-        librenms_port = {
-            "ifName": "Gi0/1",
-            "ifType": None,
-            "ifSpeed": None,
-            "ifAlias": None,
-            "ifMtu": None,
-            "port_id": 42,
-            "ifAdminStatus": "up",
-        }
+    def test_already_lag_returns_none(self):
+        """An aggregate already type=lag needs no promotion (both entry points return None)."""
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceLagView, SyncInterfacesView
 
-        with (
-            patch("netbox_librenms_plugin.views.sync.interfaces.convert_speed_to_kbps", return_value=None),
-            patch("netbox_librenms_plugin.views.sync.interfaces.find_by_librenms_id", return_value=conflicting_owner),
-            patch("netbox_librenms_plugin.views.sync.interfaces.set_librenms_device_id") as mock_set,
-        ):
-            view.update_interface_attributes(interface, librenms_port, None, [], "ifName")
+        agg = make_interface(make_device("lag-noop"), "ae0", iface_type="lag")
+        assert SyncInterfacesView._prepare_bulk_lag_aggregate(agg) is None
+        assert object.__new__(SyncInterfaceLagView)._prepare_related(agg) is None
 
-        mock_set.assert_not_called()
 
-    def test_ifalias_not_set_when_same_as_name(self):
-        """ifAlias should not overwrite when equal to interface name."""
-        from dcim.models import Interface
+@pytest.mark.django_db
+class TestRelationshipSyncObjectScope:
+    """The LAG/parent endpoints write both ends, so their resolution must run through a restricted
+    queryset.
 
-        view = self._make_view()
-        # MagicMock(spec=Interface) with explicit init so plain assignments are detectable
-        interface = MagicMock(spec=Interface)
-        interface.description = None
-        interface.save = MagicMock()
-        librenms_port = {
-            "ifName": "Gi0/1",
-            "ifType": None,
-            "ifSpeed": None,
-            "ifAlias": "Gi0/1",  # Same as interface name → should not set description
-            "ifMtu": None,
-            "port_id": None,
-            "ifAdminStatus": "up",
-        }
+    NetBoxObjectPermissionMixin asks ``has_perm`` without an instance, so a CONSTRAINED
+    ``change_interface`` grant clears the POST gate; an unrestricted interface index would then let
+    it set ``lag``/``parent`` on interfaces it cannot see.
+    """
 
-        with patch("netbox_librenms_plugin.views.sync.interfaces.convert_speed_to_kbps", return_value=None):
-            view.update_interface_attributes(interface, librenms_port, None, [], "ifName")
+    @staticmethod
+    def _writer(username, specs):
+        """A real non-superuser with plugin write access plus ``specs`` = [(model, action, constraints)] grants."""
+        user = make_user_with_perms(username, [])
+        for i, (model, action, constraints) in enumerate(specs):
+            user = grant(
+                user,
+                action,
+                model,
+                constraints=constraints,
+                name=f"{username}-{action}-{i}",
+            )
+        return user
+
+    @staticmethod
+    def _iface(device, name, port_id):
+        from netbox_librenms_plugin.tests.conftest import make_interface
+        from netbox_librenms_plugin.utils import set_librenms_device_id
 
-        # description should remain None since ifAlias == interface_name
-        assert interface.description is None
+        iface = make_interface(device, name)
+        set_librenms_device_id(iface, port_id, "default")
+        iface.save()
+        return iface
 
+    def _drive(self, user, device, port_id, lag_port_id):
+        """POST the LAG link as *user*, with the real permission gate and real restrict() running."""
+        from types import SimpleNamespace
 
-# ===========================================================================
-# SyncInterfacesView._sync_interface_vlans
-# ===========================================================================
+        from django.test import RequestFactory
 
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceLagView
 
-class TestSyncInterfacesViewSyncInterfaceVlans:
-    def test_no_vlans_calls_update_with_empty(self):
-        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+        request = RequestFactory().post("/lag/", {"port_id": str(port_id), "lag_port_id": str(lag_port_id)})
+        request.user = user
+        view = SyncInterfaceLagView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        _cache_relationship(view, device, "lag_members", port_id, lag_port_id)
+        return _post(view, request, object_type="device", object_id=device.pk)
 
-        view = object.__new__(SyncInterfacesView)
-        view.request = _make_request()
-        view._lookup_maps = {}
-        view._update_interface_vlan_assignment = MagicMock()
+    def test_lag_sync_refuses_an_out_of_scope_interface(self):
+        from dcim.models import Device, Interface
 
-        interface = MagicMock()
-        librenms_port = {}
+        in_scope_device = make_device("relscope-in")
+        out_of_scope_device = make_device("relscope-out")
+        self._iface(in_scope_device, "Gi0/1", 700)
+        member = self._iface(out_of_scope_device, "Gi0/1", 701)
+        agg = self._iface(out_of_scope_device, "Po1", 702)
+        user = self._writer(
+            "relscope-user",
+            [(Device, "view", None), (Interface, "change", {"device__name": "relscope-in"})],
+        )
 
-        view._sync_interface_vlans(interface, librenms_port, "Gi0/1")
+        response = self._drive(user, out_of_scope_device, 701, 702)
 
-        view._update_interface_vlan_assignment.assert_called_once()
+        assert response.status_code == 404
+        member.refresh_from_db()
+        agg.refresh_from_db()
+        assert member.lag_id is None  # not linked
+        assert agg.type != "lag"  # the aggregate was not promoted either
 
-    def test_with_vlans_builds_group_map(self):
-        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+    def test_lag_sync_links_the_in_scope_interfaces(self):
+        """The interfaces the grant DOES cover still link — the scoping must not over-block."""
+        from dcim.models import Device, Interface
 
-        view = object.__new__(SyncInterfacesView)
-        view.request = _make_request(post_data={"vlan_group_Gi0_1_100": "5"})
-        view._lookup_maps = {}
-        view._update_interface_vlan_assignment = MagicMock()
+        device = make_device("relscope-ok")
+        member = self._iface(device, "Gi0/1", 710)
+        agg = self._iface(device, "Po1", 711)
+        user = self._writer(
+            "relscope-user-ok",
+            [(Device, "view", None), (Interface, "change", {"device__name": "relscope-ok"})],
+        )
 
-        interface = MagicMock()
-        librenms_port = {"untagged_vlan": 100, "tagged_vlans": [200]}
+        response = self._drive(user, device, 710, 711)
+
+        assert response.status_code == 200
+        member.refresh_from_db()
+        agg.refresh_from_db()
+        assert member.lag_id == agg.pk
+        assert agg.type == "lag"
+
+    def test_parent_sync_rechecks_device_scope_after_owner_change(self):
+        """A device that leaves the user's view scope before locking must not be changed."""
+        from types import SimpleNamespace
+
+        from dcim.models import Device, Interface, Site
+
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceParentView
+
+        site_a = Site.objects.create(name="relationship-owner-site-a", slug="relationship-owner-site-a")
+        site_b = Site.objects.create(name="relationship-owner-site-b", slug="relationship-owner-site-b")
+        device = make_device("relationship-owner-moved")
+        device.site = site_a
+        device.save(update_fields=["site"])
+        child = self._iface(device, "Ethernet1.100", 720)
+        child.type = "virtual"
+        child.save(update_fields=["type"])
+        parent = self._iface(device, "Ethernet1", 721)
+        user = self._writer(
+            "relationship-owner-moved",
+            [
+                (Device, "view", {"site_id": site_a.pk}),
+                (Interface, "view", None),
+                (Interface, "change", {"pk": child.pk}),
+            ],
+        )
+
+        class MoveOwnerAfterReadView(SyncInterfaceParentView):
+            def _get_current_edge(self, *args, **kwargs):
+                edge = super()._get_current_edge(*args, **kwargs)
+                assert edge is not None
+                Device.objects.filter(pk=device.pk).update(site=site_b)
+                return edge
+
+        request = _make_request(
+            {"port_id": "720", "parent_port_id": "721"},
+            user=user,
+        )
+        view = MoveOwnerAfterReadView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        _cache_relationship(view, device, "sub_interfaces", 720, 721, child.name, parent.name)
+        assert (
+            SyncInterfaceParentView._get_current_edge(
+                view,
+                device,
+                "default",
+                request,
+                "720",
+                "721",
+            )
+            is not None
+        )
 
-        view._sync_interface_vlans(interface, librenms_port, "Gi0/1")
+        response = _post(view, request, object_type="device", object_id=device.pk)
 
-        call_args = view._update_interface_vlan_assignment.call_args
-        vlan_group_map = call_args[0][2]
-        assert vlan_group_map.get("100") == "5"
+        assert response.status_code == 409
+        assert b"interface owner changed concurrently" in response.content
+        child.refresh_from_db()
+        assert child.parent_id is None
 
+    def test_parent_sync_rechecks_interface_scope_after_row_lock(self, monkeypatch):
+        """A source that leaves its change grant before locking must not be changed."""
+        from types import SimpleNamespace
 
-# ===========================================================================
-# SyncInterfacesView.sync_selected_interfaces
-# ===========================================================================
+        from dcim.models import Device, Interface
 
+        from netbox_librenms_plugin.views.sync import interfaces as sync_interfaces
+
+        device = make_device("relationship-interface-moved")
+        child = self._iface(device, "Ethernet1.100", 722)
+        child.type = "virtual"
+        child.description = "managed"
+        child.save(update_fields=["type", "description"])
+        parent = self._iface(device, "Ethernet1", 723)
+        user = self._writer(
+            "relationship-interface-moved",
+            [
+                (Device, "view", None),
+                (Interface, "view", {"pk": parent.pk}),
+                (Interface, "change", {"description": "managed"}),
+            ],
+        )
+        request = _make_request(
+            {"port_id": "722", "parent_port_id": "723"},
+            user=user,
+        )
+        view = sync_interfaces.SyncInterfaceParentView()
+        view._librenms_api = SimpleNamespace(server_key="default")
+        _cache_relationship(view, device, "sub_interfaces", 722, 723, child.name, parent.name)
+        real_build_index = sync_interfaces.build_interface_index
+        permission_revoked = False
 
-class TestSyncInterfacesViewSyncSelected:
-    def test_syncs_matching_ports(self):
-        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+        def revoke_before_lock(*args, **kwargs):
+            nonlocal permission_revoked
+            if kwargs.get("lock") and not permission_revoked:
+                Interface.objects.filter(pk=child.pk).update(description="restricted")
+                permission_revoked = True
+            return real_build_index(*args, **kwargs)
 
-        view = object.__new__(SyncInterfacesView)
-        view.interface_name_field = "ifName"
-        view.sync_interface = MagicMock()
+        monkeypatch.setattr(sync_interfaces, "build_interface_index", revoke_before_lock)
 
-        ports_data = [{"ifName": "Gi0/1"}, {"ifName": "Gi0/2"}]
-        selected = ["Gi0/1"]
+        response = _post(view, request, object_type="device", object_id=device.pk)
 
-        with patch("netbox_librenms_plugin.views.sync.interfaces.transaction"):
-            view.sync_selected_interfaces(MagicMock(), selected, ports_data, [], "ifName")
+        assert permission_revoked
+        assert response.status_code == 404
+        child.refresh_from_db()
+        assert child.parent_id is None
 
-        assert view.sync_interface.call_count == 1
-        call_args = view.sync_interface.call_args
-        assert call_args[0][1]["ifName"] == "Gi0/1"
+    @pytest.mark.parametrize("hidden_stored_id", [20, "020"])
+    def test_hidden_duplicate_stable_id_blocks_inline_and_bulk_parent_links(self, hidden_stored_id):
+        from types import SimpleNamespace
 
+        from dcim.models import Device, Interface
+        from django.core.cache import cache
 
-# A POSTed valid non-default server_key must scope the sync to that server without 500ing on a
-# misconfigured default client. Under the stack that behavior comes from rebind_api_for_server, so
-# its coverage lives with the rebind seam in
-# test_coverage_sync_views.TestSyncInterfacesViewServerRebind
-# (test_posted_server_key_is_bound_for_the_sync / test_stale_server_key_fails_closed_without_sync).
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceParentView, SyncInterfacesView
+
+        device = make_device("hidden-duplicate-parent-id")
+        child = make_interface(device, "Ethernet1.100", iface_type="virtual")
+        visible_parent = make_interface(device, "Ethernet1")
+        hidden_duplicate = make_interface(device, "Ethernet2")
+        for interface, port_id in ((child, 10), (visible_parent, 20)):
+            set_librenms_device_id(interface, port_id, "default")
+            interface.save()
+        hidden_duplicate.custom_field_data["librenms_id"] = {"default": hidden_stored_id}
+        hidden_duplicate.save()
+        user = make_user_with_perms(
+            "hidden-duplicate-parent-id",
+            [("view", Device), ("add", Interface)],
+        )
+        user = grant(user, "change", Interface, constraints={"pk": child.pk})
+        user = grant(user, "view", Interface, constraints={"pk": visible_parent.pk})
+        snapshot = {
+            "ports": [
+                {"port_id": 10, "ifName": child.name, "ifType": "l2vlan", "ifAdminStatus": "up"},
+                {
+                    "port_id": 20,
+                    "ifName": visible_parent.name,
+                    "ifType": "ethernetCsmacd",
+                    "ifAdminStatus": "up",
+                },
+            ],
+            "port_stack_relationships": {"lag_members": {}, "sub_interfaces": {10: 20}},
+        }
+        render_request = _make_request(user=user)
+        table_view = DeviceInterfaceTableView()
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        table_view._librenms_api = api
+        table_view.request = render_request
+        cache_key = table_view.get_cache_key(device, "ports", "default")
+        cache.set(cache_key, snapshot)
+
+        try:
+            context = table_view.get_context_data(
+                render_request,
+                device,
+                "ifName",
+                "default",
+                fresh_data=snapshot,
+                sync_device=device,
+            )
+            assert "parent-sync-btn" not in str(context["table"].render_parent(None, snapshot["ports"][0]))
+
+            inline_request = _make_request(
+                {"port_id": "10", "parent_port_id": "20", "interface_name_field": "ifName"},
+                user=user,
+            )
+            inline_view = SyncInterfaceParentView()
+            inline_view._librenms_api = SimpleNamespace(server_key="default")
+            inline_response = _post(inline_view, inline_request, object_type="device", object_id=device.pk)
+
+            bulk_request = _make_request(
+                post_data={
+                    "select": ["10"],
+                    "exclude_columns": ["vlans", "mac_address", "description", "mtu", "speed", "type"],
+                },
+                user=user,
+            )
+            bulk_view = SyncInterfacesView()
+            bulk_view._librenms_api = SimpleNamespace(server_key="default")
+            bulk_response = _post(bulk_view, bulk_request, object_type="device", object_id=device.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert inline_response.status_code == 404
+        assert bulk_response.status_code == 302
+        child.refresh_from_db()
+        assert child.parent_id is None
+
+    def test_hidden_duplicate_unbound_name_blocks_inline_and_bulk_parent_links(self):
+        from types import SimpleNamespace
+
+        from dcim.models import Device, Interface
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceParentView, SyncInterfacesView
+
+        _vc, (member1, member2) = make_virtual_chassis_members("hidden-duplicate-parent-name")
+        child = make_interface(member1, "Ethernet1.100", iface_type="virtual")
+        visible_parent = make_interface(member1, "Ethernet1")
+        make_interface(member2, "Ethernet1")
+        set_librenms_device_id(child, 10, "default")
+        child.save()
+        user = make_user_with_perms(
+            "hidden-duplicate-parent-name",
+            [("view", Device), ("add", Interface)],
+        )
+        user = grant(user, "change", Interface, constraints={"pk": child.pk})
+        user = grant(user, "view", Interface, constraints={"pk": visible_parent.pk})
+        snapshot = {
+            "ports": [
+                {"port_id": 10, "ifName": child.name, "ifType": "l2vlan", "ifAdminStatus": "up"},
+                {
+                    "port_id": 20,
+                    "ifName": visible_parent.name,
+                    "ifType": "ethernetCsmacd",
+                    "ifAdminStatus": "up",
+                },
+            ],
+            "port_stack_relationships": {"lag_members": {}, "sub_interfaces": {10: 20}},
+        }
+        render_request = _make_request(user=user)
+        table_view = DeviceInterfaceTableView()
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        table_view._librenms_api = api
+        table_view.request = render_request
+        cache_key = table_view.get_cache_key(member1, "ports", "default")
+        cache.set(cache_key, snapshot)
+
+        try:
+            context = table_view.get_context_data(
+                render_request,
+                member1,
+                "ifName",
+                "default",
+                fresh_data=snapshot,
+                sync_device=member1,
+            )
+            assert "parent-sync-btn" not in str(context["table"].render_parent(None, snapshot["ports"][0]))
+
+            inline_request = _make_request(
+                {"port_id": "10", "parent_port_id": "20", "interface_name_field": "ifName"},
+                user=user,
+            )
+            inline_view = SyncInterfaceParentView()
+            inline_view._librenms_api = SimpleNamespace(server_key="default")
+            inline_response = _post(inline_view, inline_request, object_type="device", object_id=member1.pk)
+
+            bulk_request = _make_request(
+                post_data={
+                    "select": ["10"],
+                    "exclude_columns": ["vlans", "mac_address", "description", "mtu", "speed", "type"],
+                },
+                user=user,
+            )
+            bulk_view = SyncInterfacesView()
+            bulk_view._librenms_api = SimpleNamespace(server_key="default")
+            bulk_response = _post(bulk_view, bulk_request, object_type="device", object_id=member1.pk)
+        finally:
+            cache.delete(cache_key)
+
+        assert inline_response.status_code == 404
+        assert bulk_response.status_code == 302
+        child.refresh_from_db()
+        assert child.parent_id is None
diff --git a/netbox_librenms_plugin/tests/test_coverage_sync_view.py b/netbox_librenms_plugin/tests/test_coverage_sync_view.py
index 3f102b7c32..d2d95dc0cd 100644
--- a/netbox_librenms_plugin/tests/test_coverage_sync_view.py
+++ b/netbox_librenms_plugin/tests/test_coverage_sync_view.py
@@ -1110,7 +1110,7 @@ def test_platform_does_not_exist(self):
 
 @pytest.mark.django_db
 class TestInterfaceSyncRefreshButtonServerKey:
-    """The 'Refresh Interfaces' buttons must carry the active server_key (hidden input + hx-include) so a non-default server tab refreshes from the right LibreNMS server/cache, not the fallback."""
+    """The 'Refresh Interfaces' button must carry the active server_key — via the hidden input the enclosing form emits (htmx includes form values on non-GET) plus the button's own hx-vals context fallback — so a non-default server tab refreshes from the right LibreNMS server/cache, not the fallback."""
 
     def _render(self, *, server_key="prod"):
         from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site
@@ -1134,6 +1134,7 @@ def _render(self, *, server_key="prod"):
             "object": device,
             "has_librenms_id": True,
             "server_key": server_key,
+            "librenms_server_info": {"server_key": server_key},
             "interface_name_field": "ifName",
             "migrated_to_marker": None,
             "migrated_to_winner": None,
@@ -1152,10 +1153,12 @@ def _render(self, *, server_key="prod"):
 
     def test_refresh_button_includes_server_key(self):
         html = self._render(server_key="prod")
-        # Hidden input carries the active server key...
+        # The refresh POST carries the active server key two ways: the hidden input the enclosing
+        # form emits (htmx includes form values on non-GET requests) and the button's own hx-vals
+        # context fallback. parent-child moved server_key OUT of the button's hx-include into hx-vals,
+        # but the hidden input the form relies on stays.
         assert '<input type="hidden" name="server_key" value="prod">' in html
-        # ...and the refresh button posts it alongside interface_name_field.
-        assert "[name='interface_name_field'], [name='server_key']" in html
+        assert "get('server_key') || 'prod'" in html
 
 
 @pytest.mark.django_db
diff --git a/netbox_librenms_plugin/tests/test_coverage_sync_views.py b/netbox_librenms_plugin/tests/test_coverage_sync_views.py
index 44d20adfaf..a46e869d30 100644
--- a/netbox_librenms_plugin/tests/test_coverage_sync_views.py
+++ b/netbox_librenms_plugin/tests/test_coverage_sync_views.py
@@ -7,7 +7,7 @@
 from netbox_librenms_plugin.tests.conftest import make_device, make_interface, make_ip, make_vm
 from netbox_librenms_plugin.tests.view_test_helpers import grant
 from netbox_librenms_plugin.tests.view_test_helpers import make_request as make_real_request
-from netbox_librenms_plugin.tests.view_test_helpers import make_user_with_perms, make_view, missing_pk
+from netbox_librenms_plugin.tests.view_test_helpers import make_user_with_perms, make_view, message_texts, missing_pk
 from netbox_librenms_plugin.tests.view_test_helpers import post as _post
 
 
@@ -630,8 +630,7 @@ def test_permission_denied_returns_early(self):
         assert view.required_object_permissions == {"POST": [("change", Device)]}
 
     def test_invalid_object_type_returns_400_without_perm_check(self):
-        """Bad client input (missing/unknown object_type) must surface a 400 immediately,
-        without triggering the permission check — there's no model to check against yet."""
+        """Bad object_type returns 400 immediately, before any permission check (no model to check yet)."""
         from netbox_librenms_plugin.views.sync.devices import AddDeviceToLibreNMSView
 
         view = _make_view(AddDeviceToLibreNMSView)
@@ -911,26 +910,6 @@ def test_invalid_type_raises_http404(self):
         assert raised
 
 
-class TestSyncInterfacesViewGetSelectedInterfaces:
-    def test_empty_list_returns_none_and_shows_error(self):
-        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
-
-        view = _make_view(SyncInterfacesView)
-        req = _make_request({"select": []})
-        with patch("netbox_librenms_plugin.views.sync.interfaces.messages") as mock_msg:
-            result = view.get_selected_interfaces(req, "ifName")
-        assert result is None
-        mock_msg.error.assert_called_once()
-
-    def test_non_empty_returns_list(self):
-        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
-
-        view = _make_view(SyncInterfacesView)
-        req = _make_request({"select": ["eth0", "eth1"]})
-        result = view.get_selected_interfaces(req, "ifName")
-        assert result == ["eth0", "eth1"]
-
-
 class TestSyncInterfacesViewGetCachedPortsData:
     def test_cache_miss_returns_none_and_warns(self):
         from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
@@ -1042,144 +1021,6 @@ def test_posted_server_key_is_bound_for_the_sync(self):
         assert "server_key=secondary" in resp["Location"]
 
 
-class TestSyncInterfacesViewPost:
-    def test_permission_denied_device_returns_early(self):
-        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
-
-        view = _make_view(SyncInterfacesView)
-        mock_error = MagicMock()
-        with patch.object(view, "require_all_permissions", return_value=mock_error):
-            result = view.post(view.request, object_type="device", object_id=1)
-        assert result is mock_error
-
-    def test_permission_denied_vm_returns_early(self):
-        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
-
-        view = _make_view(SyncInterfacesView)
-        mock_error = MagicMock()
-        with patch.object(view, "require_all_permissions", return_value=mock_error):
-            result = view.post(view.request, object_type="virtualmachine", object_id=1)
-        assert result is mock_error
-
-    def test_invalid_object_type_raises_404(self):
-        from django.http import Http404
-
-        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
-
-        view = _make_view(SyncInterfacesView)
-        raised = False
-        try:
-            view.post(view.request, object_type="invalid", object_id=1)
-        except Http404:
-            raised = True
-        assert raised
-
-    def test_no_selection_redirects(self):
-        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
-
-        view = _make_view(SyncInterfacesView)
-        mock_obj = MagicMock()
-        with patch.object(view, "require_all_permissions", return_value=None):
-            with patch.object(view, "get_object", return_value=mock_obj):
-                with patch(
-                    "netbox_librenms_plugin.views.sync.interfaces.get_interface_name_field",
-                    return_value="ifName",
-                ):
-                    with patch.object(view, "get_selected_interfaces", return_value=None):
-                        with patch(
-                            "netbox_librenms_plugin.views.sync.interfaces.reverse",
-                            return_value="/fake/",
-                        ):
-                            with patch("netbox_librenms_plugin.views.sync.interfaces.redirect") as mock_redirect:
-                                view.post(view.request, object_type="device", object_id=1)
-        mock_redirect.assert_called_once()
-
-    def test_cache_miss_redirects(self):
-        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
-
-        view = _make_view(SyncInterfacesView)
-        mock_obj = MagicMock()
-        with patch.object(view, "require_all_permissions", return_value=None):
-            with patch.object(view, "get_object", return_value=mock_obj):
-                with patch(
-                    "netbox_librenms_plugin.views.sync.interfaces.get_interface_name_field",
-                    return_value="ifName",
-                ):
-                    with patch.object(view, "get_selected_interfaces", return_value=["eth0"]):
-                        with patch.object(view, "get_cached_ports_data", return_value=None):
-                            with patch(
-                                "netbox_librenms_plugin.views.sync.interfaces.reverse",
-                                return_value="/fake/",
-                            ):
-                                with patch("netbox_librenms_plugin.views.sync.interfaces.redirect") as mock_redirect:
-                                    view.post(view.request, object_type="device", object_id=1)
-        mock_redirect.assert_called_once()
-
-    def test_device_full_sync_success(self):
-        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
-
-        view = _make_view(SyncInterfacesView)
-        mock_obj = MagicMock()
-        ports = [{"ifName": "eth0"}]
-        with patch.object(view, "require_all_permissions", return_value=None):
-            with patch.object(view, "get_object", return_value=mock_obj):
-                with patch(
-                    "netbox_librenms_plugin.views.sync.interfaces.get_interface_name_field",
-                    return_value="ifName",
-                ):
-                    with patch.object(view, "get_selected_interfaces", return_value=["eth0"]):
-                        with patch.object(view, "get_cached_ports_data", return_value=ports):
-                            with patch.object(view, "get_vlan_groups_for_device", return_value=[]):
-                                with patch.object(view, "_build_vlan_lookup_maps", return_value={}):
-                                    with patch.object(view, "sync_selected_interfaces"):
-                                        with patch(
-                                            "netbox_librenms_plugin.views.sync.interfaces.reverse",
-                                            return_value="/fake/",
-                                        ):
-                                            with patch("netbox_librenms_plugin.views.sync.interfaces.messages"):
-                                                with patch(
-                                                    "netbox_librenms_plugin.views.sync.interfaces.redirect"
-                                                ) as mock_redirect:
-                                                    view.post(
-                                                        view.request,
-                                                        object_type="device",
-                                                        object_id=1,
-                                                    )
-        mock_redirect.assert_called_once()
-
-    def test_vm_full_sync_success(self):
-        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
-
-        view = _make_view(SyncInterfacesView)
-        mock_obj = MagicMock()
-        ports = [{"ifName": "eth0"}]
-        with patch.object(view, "require_all_permissions", return_value=None):
-            with patch.object(view, "get_object", return_value=mock_obj):
-                with patch(
-                    "netbox_librenms_plugin.views.sync.interfaces.get_interface_name_field",
-                    return_value="ifName",
-                ):
-                    with patch.object(view, "get_selected_interfaces", return_value=["eth0"]):
-                        with patch.object(view, "get_cached_ports_data", return_value=ports):
-                            with patch.object(view, "get_vlan_groups_for_device", return_value=[]):
-                                with patch.object(view, "_build_vlan_lookup_maps", return_value={}):
-                                    with patch.object(view, "sync_selected_interfaces"):
-                                        with patch(
-                                            "netbox_librenms_plugin.views.sync.interfaces.reverse",
-                                            return_value="/fake/",
-                                        ):
-                                            with patch("netbox_librenms_plugin.views.sync.interfaces.messages"):
-                                                with patch(
-                                                    "netbox_librenms_plugin.views.sync.interfaces.redirect"
-                                                ) as mock_redirect:
-                                                    view.post(
-                                                        view.request,
-                                                        object_type="virtualmachine",
-                                                        object_id=1,
-                                                    )
-        mock_redirect.assert_called_once()
-
-
 @pytest.mark.django_db
 class TestSyncInterfacesViewSyncInterface:
     """Real-DB tests for SyncInterfacesView.sync_interface target resolution."""
@@ -1240,8 +1081,8 @@ def test_device_with_vc_member_selection_valid(self):
         member2.vc_position = 2
         member2.save()
         # Select member2 (a valid VC member) → the interface lands on member2, not the master.
-        view.request = _make_request({"device_selection_eth0": str(member2.id)})
-        librenms_if = {"ifName": "eth0"}
+        view.request = _make_request({"device_selection_10": str(member2.id)})
+        librenms_if = {"ifName": "eth0", "port_id": 10}
 
         p_type, p_attrs, p_vlans = self._patches(view)
         with p_type, p_attrs, p_vlans:
@@ -1265,8 +1106,8 @@ def test_device_with_invalid_vc_member_is_skipped(self):
         master.save()
         # An existing device that is not a member of this VC is an invalid explicit target.
         outsider = make_device("vc-sync-outsider")
-        view.request = _make_request({"device_selection_eth0": str(outsider.id)})
-        librenms_if = {"ifName": "eth0"}
+        view.request = _make_request({"device_selection_10": str(outsider.id)})
+        librenms_if = {"ifName": "eth0", "port_id": 10}
 
         p_type, p_attrs, p_vlans = self._patches(view)
         with p_type, p_attrs, p_vlans:
@@ -1284,8 +1125,8 @@ def test_device_with_device_selection_wrong_device_is_skipped(self):
         device = make_device("sync-iface-noVC")  # no virtual_chassis
         other = make_device("sync-iface-other")
         # A selection for another device is invalid when the page device has no chassis.
-        view.request = _make_request({"device_selection_eth0": str(other.id)})
-        librenms_if = {"ifName": "eth0"}
+        view.request = _make_request({"device_selection_10": str(other.id)})
+        librenms_if = {"ifName": "eth0", "port_id": 10}
 
         p_type, p_attrs, p_vlans = self._patches(view)
         with p_type, p_attrs, p_vlans:
@@ -1830,6 +1671,23 @@ def test_renamed_interface_resolved_via_cached_url_pk(self):
         created = IPAddress.objects.get(address="10.0.0.1/24")
         assert created.assigned_object == iface
 
+    def test_existing_bound_ip_not_unbound_when_no_interface(self):
+        """Regression for the data-loss case: when no NetBox interface resolves, an IP that is ALREADY bound must keep its binding."""
+        view = self._setup_view()
+        obj = make_device("ipsync-bound-nomatch-dev")
+        bound_owner = make_device("ipsync-bound-owner-dev")
+        bound_iface = make_interface(bound_owner, "eth9")
+        existing_ip = make_ip("10.0.0.1/24", assigned_object=bound_iface)
+        # No port_id/interface_name → _match_interface returns None → row skipped before update.
+        cached = [{"ip_address": "10.0.0.1", "ip_with_mask": "10.0.0.1/24", "interface_url": None}]
+
+        results = self._run(view, ["10.0.0.1"], cached, obj, "device")
+
+        assert "10.0.0.1" in results["skipped_no_interface"]
+        existing_ip.refresh_from_db()
+        # The existing binding must be untouched — not nulled.
+        assert existing_ip.assigned_object == bound_iface
+
     def test_ip_assigned_to_interface_matched_by_port_id(self):
         from ipam.models import IPAddress
 
@@ -2406,7 +2264,7 @@ def test_required_object_permissions(self):
         assert ("view", Device) in perms
         assert ("add", VLAN) in perms
         assert ("change", VLAN) in perms
-        assert ("view", VLANGroup) in perms
+        assert ("view", VLANGroup) not in perms
 
 
 class TestSyncVLANsViewGetObject:
@@ -2506,6 +2364,93 @@ def test_create_vlans_action_delegates(self):
         mock_handle.assert_called_once()
         assert result is mock_response
 
+    @pytest.mark.django_db
+    def test_global_vlan_sync_does_not_require_vlan_group_permission(self):
+        """A request that selects no group must not require access to VLANGroup."""
+        from dcim.models import Device
+        from ipam.models import VLAN
+
+        from netbox_librenms_plugin.views.sync.vlans import SyncVLANsView
+
+        device = make_device("vlan-global-perm")
+        user = make_user_with_perms(
+            "vlan-global-perm",
+            [("view", Device), ("add", VLAN), ("change", VLAN)],
+        )
+        request = make_real_request(
+            "post",
+            {"action": "create_vlans", "server_key": "default", "select": ["100"], "vlan_group_100": ""},
+            user=user,
+        )
+        view = make_view(SyncVLANsView, request)
+
+        response = _post(view, request, object_type="device", object_id=device.pk)
+
+        assert response.status_code == 302
+        assert message_texts(request, "error") == ["No cached VLAN data. Please refresh VLANs first."]
+
+    @pytest.mark.django_db
+    def test_grouped_vlan_sync_still_requires_vlan_group_permission(self):
+        """A non-empty per-row group selection must keep the VLANGroup permission gate."""
+        from dcim.models import Device
+        from ipam.models import VLAN, VLANGroup
+
+        from netbox_librenms_plugin.views.sync.vlans import SyncVLANsView
+
+        device = make_device("vlan-grouped-perm")
+        group = VLANGroup.objects.create(name="Group permission", slug="group-permission")
+        user = make_user_with_perms(
+            "vlan-grouped-perm",
+            [("view", Device), ("add", VLAN), ("change", VLAN)],
+        )
+        request = make_real_request(
+            "post",
+            {
+                "action": "create_vlans",
+                "server_key": "default",
+                "select": ["100"],
+                "vlan_group_100": str(group.pk),
+            },
+            user=user,
+        )
+        view = make_view(SyncVLANsView, request)
+
+        response = _post(view, request, object_type="device", object_id=device.pk)
+
+        assert response.status_code == 302
+        assert any("ipam.view_vlangroup" in text for text in message_texts(request, "error"))
+
+    @pytest.mark.django_db
+    def test_grouped_vlan_permission_uses_canonical_vid_field_name(self):
+        """A leading-zero selection must not hide its canonical group field from the gate."""
+        from dcim.models import Device
+        from ipam.models import VLAN, VLANGroup
+
+        from netbox_librenms_plugin.views.sync.vlans import SyncVLANsView
+
+        device = make_device("vlan-grouped-canonical-perm")
+        group = VLANGroup.objects.create(name="Canonical group permission", slug="canonical-group-permission")
+        user = make_user_with_perms(
+            "vlan-grouped-canonical-perm",
+            [("view", Device), ("add", VLAN), ("change", VLAN)],
+        )
+        request = make_real_request(
+            "post",
+            {
+                "action": "create_vlans",
+                "server_key": "default",
+                "select": ["0100"],
+                "vlan_group_100": str(group.pk),
+            },
+            user=user,
+        )
+        view = make_view(SyncVLANsView, request)
+
+        response = _post(view, request, object_type="device", object_id=device.pk)
+
+        assert response.status_code == 302
+        assert any("ipam.view_vlangroup" in text for text in message_texts(request, "error"))
+
 
 @pytest.mark.django_db
 class TestSyncVLANsViewHandleCreateVlans:
diff --git a/netbox_librenms_plugin/tests/test_coverage_sync_views2.py b/netbox_librenms_plugin/tests/test_coverage_sync_views2.py
index 877b69ed2d..096de12820 100644
--- a/netbox_librenms_plugin/tests/test_coverage_sync_views2.py
+++ b/netbox_librenms_plugin/tests/test_coverage_sync_views2.py
@@ -710,17 +710,12 @@ def test_process_single_interface_exception_caught(self):
         assert "port1" in results["invalid"]
 
 
-def _add_device_view(request, *, add_result=(True, "Device added"), poller_choices=()):
-    """The real AddDeviceToLibreNMSView; only the LibreNMS calls are stubbed.
-
-    ``poller_choices`` seeds the poller-group ChoiceField, whose options production fetches
-    from LibreNMS — that fetch is the external boundary, the form validation is not.
-    """
+def _add_device_view(request, *, add_result=(True, "Device added")):
+    """The real AddDeviceToLibreNMSView; only the LibreNMS calls are stubbed."""
     from netbox_librenms_plugin.views.sync.devices import AddDeviceToLibreNMSView
 
     view = make_view(AddDeviceToLibreNMSView, request)
     view._librenms_api.add_device.return_value = add_result
-    view._poller_choices = list(poller_choices)
     return view
 
 
diff --git a/netbox_librenms_plugin/tests/test_coverage_sync_views3.py b/netbox_librenms_plugin/tests/test_coverage_sync_views3.py
index 51a566946b..ee7fddd7e4 100644
--- a/netbox_librenms_plugin/tests/test_coverage_sync_views3.py
+++ b/netbox_librenms_plugin/tests/test_coverage_sync_views3.py
@@ -120,28 +120,6 @@ def test_invalid_raises_http404(self):
             v.get_object("rack", 1)
 
 
-# ===========================================================================
-# SyncInterfacesView.get_selected_interfaces
-# ===========================================================================
-
-
-class TestSyncGetSelectedInterfaces:
-    def test_empty_returns_none_and_error(self):
-        v = _make_iv()
-        req = MagicMock()
-        req.POST.getlist.return_value = []
-        with patch("netbox_librenms_plugin.views.sync.interfaces.messages") as mm:
-            result = v.get_selected_interfaces(req, "ifName")
-        assert result is None
-        mm.error.assert_called_once()
-
-    def test_with_values_returns_list(self):
-        v = _make_iv()
-        req = MagicMock()
-        req.POST.getlist.return_value = ["eth0", "eth1"]
-        assert v.get_selected_interfaces(req, "ifName") == ["eth0", "eth1"]
-
-
 # ===========================================================================
 # SyncInterfacesView.get_cached_ports_data
 # ===========================================================================
@@ -172,119 +150,6 @@ def test_cache_hit_returns_ports(self):
 # ===========================================================================
 
 
-class TestSyncInterfacesPost:
-    def _s(self):
-        v = _make_iv()
-        v.require_all_permissions = MagicMock(return_value=None)
-        v.get_vlan_groups_for_device = MagicMock(return_value=[])
-        v._build_vlan_lookup_maps = MagicMock(return_value={})
-        return v
-
-    def test_permission_denied(self):
-        v = self._s()
-        err = MagicMock()
-        v.require_all_permissions = MagicMock(return_value=err)
-        assert v.post(MagicMock(), "device", 1) is err
-
-    def test_no_selected_redirects(self):
-        from dcim.models import Device
-
-        v = self._s()
-        obj = MagicMock(spec=Device)
-        obj.pk = 1
-        v.get_object = MagicMock(return_value=obj)
-        v.get_selected_interfaces = MagicMock(return_value=None)
-        req = MagicMock()
-        req.POST.get = lambda k, *a: None
-        req.POST.getlist = lambda k: []
-        with patch("netbox_librenms_plugin.views.sync.interfaces.get_interface_name_field", return_value="ifName"):
-            with patch("netbox_librenms_plugin.views.sync.interfaces.reverse", return_value="/s/"):
-                with patch("netbox_librenms_plugin.views.sync.interfaces.redirect") as mr:
-                    v.request = req
-                    v.post(req, "device", 1)
-        mr.assert_called_once()
-
-    def test_no_ports_data_redirects(self):
-        from dcim.models import Device
-
-        v = self._s()
-        obj = MagicMock(spec=Device)
-        obj.pk = 1
-        v.get_object = MagicMock(return_value=obj)
-        v.get_selected_interfaces = MagicMock(return_value=["eth0"])
-        v.get_cached_ports_data = MagicMock(return_value=None)
-        req = MagicMock()
-        req.POST.get = lambda k, *a: None
-        req.POST.getlist = lambda k: []
-        with patch("netbox_librenms_plugin.views.sync.interfaces.get_interface_name_field", return_value="ifName"):
-            with patch("netbox_librenms_plugin.views.sync.interfaces.reverse", return_value="/s/"):
-                with patch("netbox_librenms_plugin.views.sync.interfaces.redirect") as mr:
-                    v.request = req
-                    v.post(req, "device", 1)
-        mr.assert_called_once()
-
-    def test_full_success_device(self):
-        from dcim.models import Device
-
-        v = self._s()
-        obj = MagicMock(spec=Device)
-        obj.pk = 1
-        v.get_object = MagicMock(return_value=obj)
-        v.get_selected_interfaces = MagicMock(return_value=["eth0"])
-        v.get_cached_ports_data = MagicMock(return_value=[{"ifName": "eth0"}])
-        v.sync_selected_interfaces = MagicMock()
-        req = MagicMock()
-        req.POST.get = lambda k, *a: "default" if k == "server_key" else None
-        req.POST.getlist = lambda k: []
-        with patch("netbox_librenms_plugin.views.sync.interfaces.get_interface_name_field", return_value="ifName"):
-            with patch("netbox_librenms_plugin.views.sync.interfaces.reverse", return_value="/s/"):
-                with patch("netbox_librenms_plugin.views.sync.interfaces.redirect") as mr:
-                    with patch("netbox_librenms_plugin.views.sync.interfaces.messages") as mm:
-                        v.request = req
-                        v.post(req, "device", 1)
-        v.sync_selected_interfaces.assert_called_once()
-        mm.success.assert_called_once()
-        mr.assert_called_once()
-
-    def test_full_success_vm(self):
-        from virtualization.models import VirtualMachine
-
-        v = self._s()
-        obj = MagicMock(spec=VirtualMachine)
-        obj.pk = 2
-        v.get_object = MagicMock(return_value=obj)
-        v.get_selected_interfaces = MagicMock(return_value=["eth0"])
-        v.get_cached_ports_data = MagicMock(return_value=[{"ifName": "eth0"}])
-        v.sync_selected_interfaces = MagicMock()
-        req = MagicMock()
-        req.POST.get = lambda k, *a: None
-        req.POST.getlist = lambda k: []
-        with patch("netbox_librenms_plugin.views.sync.interfaces.get_interface_name_field", return_value="ifName"):
-            with patch("netbox_librenms_plugin.views.sync.interfaces.reverse", return_value="/s/"):
-                with patch("netbox_librenms_plugin.views.sync.interfaces.redirect"):
-                    with patch("netbox_librenms_plugin.views.sync.interfaces.messages"):
-                        v.request = req
-                        v.post(req, "virtualmachine", 2)
-        v.sync_selected_interfaces.assert_called_once()
-
-
-# ===========================================================================
-# SyncInterfacesView.sync_selected_interfaces
-# ===========================================================================
-
-
-class TestSyncSelectedInterfaces:
-    def test_only_selected_processed(self):
-        v = _make_iv()
-        v.sync_interface = MagicMock()
-        obj = make_device("sync-selected")
-        ports = [{"ifName": "eth0"}, {"ifName": "eth1"}]
-        with patch("netbox_librenms_plugin.views.sync.interfaces.transaction"):
-            v.sync_selected_interfaces(obj, ["eth0"], ports, [], "ifName")
-        assert v.sync_interface.call_count == 1
-        assert v.sync_interface.call_args[0][1]["ifName"] == "eth0"
-
-
 # ===========================================================================
 # SyncInterfacesView.sync_interface
 # ===========================================================================
@@ -321,24 +186,24 @@ def test_device_vc_target_in_valid_ids(self):
         from dcim.models import Interface
 
         _vc, (host, sibling) = make_virtual_chassis_members("sync-vc-ok")
-        req = make_request("post", {"device_selection_eth0": str(sibling.pk)})
+        req = make_request("post", {"device_selection_10": str(sibling.pk)})
         v = self._v(req)
 
-        v.sync_interface(host, {"ifName": "eth0"}, [], "ifName")
+        v.sync_interface(host, {"ifName": "eth0", "port_id": 10}, [], "ifName")
 
         assert Interface.objects.filter(device=sibling, name="eth0").exists()
         assert not Interface.objects.filter(device=host, name="eth0").exists()
 
     def test_device_vc_target_not_in_valid_ids_is_skipped(self):
-        """A device outside the chassis is refused without writing to the page device."""
+        """An explicit device outside the chassis is refused without a fallback write."""
         from dcim.models import Interface
 
         _vc, (host, _sibling) = make_virtual_chassis_members("sync-vc-outsider")
         outsider = make_device("sync-vc-outsider-x")
-        req = make_request("post", {"device_selection_eth0": str(outsider.pk)})
+        req = make_request("post", {"device_selection_10": str(outsider.pk)})
         v = self._v(req)
 
-        v.sync_interface(host, {"ifName": "eth0"}, [], "ifName")
+        v.sync_interface(host, {"ifName": "eth0", "port_id": 10}, [], "ifName")
 
         assert not Interface.objects.filter(device=host, name="eth0").exists()
         assert not Interface.objects.filter(device=outsider, name="eth0").exists()
@@ -349,10 +214,10 @@ def test_device_no_vc_wrong_selection_is_skipped(self):
 
         dev = make_device("sync-novc-self")
         other = make_device("sync-novc-other")
-        req = make_request("post", {"device_selection_eth0": str(other.pk)})
+        req = make_request("post", {"device_selection_10": str(other.pk)})
         v = self._v(req)
 
-        v.sync_interface(dev, {"ifName": "eth0"}, [], "ifName")
+        v.sync_interface(dev, {"ifName": "eth0", "port_id": 10}, [], "ifName")
 
         assert not Interface.objects.filter(device=dev, name="eth0").exists()
         assert not Interface.objects.filter(device=other, name="eth0").exists()
@@ -363,10 +228,10 @@ def test_device_selection_does_not_exist_is_skipped(self):
 
         dev = make_device("sync-gone")
         absent_pk = missing_pk(Device)
-        req = make_request("post", {"device_selection_eth0": str(absent_pk)})
+        req = make_request("post", {"device_selection_10": str(absent_pk)})
         v = self._v(req)
 
-        v.sync_interface(dev, {"ifName": "eth0"}, [], "ifName")
+        v.sync_interface(dev, {"ifName": "eth0", "port_id": 10}, [], "ifName")
 
         assert not Interface.objects.filter(device=dev, name="eth0").exists()
         assert v._skipped_conflicts == ["eth0 (selected target unavailable)"]
@@ -377,10 +242,10 @@ def test_device_selection_outside_the_grant_is_skipped(self):
 
         _vc, (host, sibling) = make_virtual_chassis_members("sync-vc-scoped")
         user = make_user_with_perms("sync-scoped", [("view", Device)], constraints={"name": "sync-vc-scoped-m1"})
-        req = make_request("post", {"device_selection_eth0": str(sibling.pk)}, user=user)
+        req = make_request("post", {"device_selection_10": str(sibling.pk)}, user=user)
         v = self._v(req)
 
-        v.sync_interface(host, {"ifName": "eth0"}, [], "ifName")
+        v.sync_interface(host, {"ifName": "eth0", "port_id": 10}, [], "ifName")
 
         assert not Interface.objects.filter(device=host, name="eth0").exists()
         assert not Interface.objects.filter(device=sibling, name="eth0").exists()
@@ -485,45 +350,6 @@ def test_no_mapping_returns_other(self):
         assert result == "other"
 
 
-# ===========================================================================
-# SyncInterfacesView._sync_interface_vlans
-# ===========================================================================
-
-
-class TestSyncInterfaceVlans:
-    def test_builds_vlan_group_map_for_untagged_and_tagged(self):
-        v = _make_iv()
-        v._lookup_maps = {}
-        v._update_interface_vlan_assignment = MagicMock()
-        iface = MagicMock()
-        port = {"untagged_vlan": 100, "tagged_vlans": [200]}
-
-        def pg(key, default=""):
-            return {"vlan_group_eth0_100": "5", "vlan_group_eth0_200": "5"}.get(key, default)
-
-        v.request.POST.get = pg
-        v._sync_interface_vlans(iface, port, "eth0")
-        args = v._update_interface_vlan_assignment.call_args[0]
-        assert args[2].get("100") == "5"
-        assert args[2].get("200") == "5"
-
-    def test_no_vlans_empty_map(self):
-        v = _make_iv()
-        v._lookup_maps = {}
-        v._update_interface_vlan_assignment = MagicMock()
-        v.request.POST.get = lambda k, *a: ""
-        v._sync_interface_vlans(MagicMock(), {"untagged_vlan": None, "tagged_vlans": []}, "eth0")
-        assert v._update_interface_vlan_assignment.call_args[0][2] == {}
-
-    def test_special_chars_in_name(self):
-        v = _make_iv()
-        v._lookup_maps = {}
-        v._update_interface_vlan_assignment = MagicMock()
-        v.request.POST.get = lambda k, *a: ""
-        v._sync_interface_vlans(MagicMock(), {"untagged_vlan": None, "tagged_vlans": []}, "eth0/1:2")
-        v._update_interface_vlan_assignment.assert_called_once()
-
-
 # ===========================================================================
 # DeleteNetBoxInterfacesView.get_required_permissions_for_object_type
 # ===========================================================================
@@ -899,31 +725,40 @@ def _setup(self, tag, cached_name, existing_name):
         req = make_request("post", {"select": ["100"], "vlan_group_100": str(group.pk)})
         view = make_view(SyncVLANsView, req)
         view._post_server_key = "default"
+        cache_key = view.get_cache_key(dev, "vlans", "default")
         cache.set(
-            view.get_cache_key(dev, "vlans", "default"),
+            cache_key,
             [{"vlan_vlan": 100, "vlan_name": cached_name}],
         )
-        return view, req, dev, vlan
+        return view, req, dev, vlan, cache_key
 
     def test_grouped_vlan_with_different_name_is_renamed(self):
         """A grouped VLAN whose LibreNMS name differs is renamed and persisted."""
+        from django.core.cache import cache
         from ipam.models import VLAN
 
-        view, req, dev, vlan = self._setup("update", cached_name="NewName", existing_name="OldName")
+        view, req, dev, vlan, cache_key = self._setup("update", cached_name="NewName", existing_name="OldName")
 
-        view._handle_create_vlans(req, dev, "device", dev.pk)
+        try:
+            view._handle_create_vlans(req, dev, "device", dev.pk)
 
-        assert VLAN.objects.get(pk=vlan.pk).name == "NewName"
-        assert any("updated" in t for t in message_texts(req, "success"))
+            assert VLAN.objects.get(pk=vlan.pk).name == "NewName"
+            assert any("updated" in t for t in message_texts(req, "success"))
+        finally:
+            cache.delete(cache_key)
 
     def test_grouped_vlan_with_matching_name_is_unchanged(self):
         """A grouped VLAN already carrying the LibreNMS name is left untouched."""
+        from django.core.cache import cache
         from ipam.models import VLAN
 
-        view, req, dev, vlan = self._setup("skip", cached_name="Same", existing_name="Same")
+        view, req, dev, vlan, cache_key = self._setup("skip", cached_name="Same", existing_name="Same")
         last_updated = VLAN.objects.get(pk=vlan.pk).last_updated
 
-        view._handle_create_vlans(req, dev, "device", dev.pk)
+        try:
+            view._handle_create_vlans(req, dev, "device", dev.pk)
 
-        assert VLAN.objects.get(pk=vlan.pk).last_updated == last_updated
-        assert any("unchanged" in t for t in message_texts(req, "success"))
+            assert VLAN.objects.get(pk=vlan.pk).last_updated == last_updated
+            assert any("unchanged" in t for t in message_texts(req, "success"))
+        finally:
+            cache.delete(cache_key)
diff --git a/netbox_librenms_plugin/tests/test_coverage_tables.py b/netbox_librenms_plugin/tests/test_coverage_tables.py
index 4ca1428d43..5025761af2 100644
--- a/netbox_librenms_plugin/tests/test_coverage_tables.py
+++ b/netbox_librenms_plugin/tests/test_coverage_tables.py
@@ -10,6 +10,10 @@
 - object.__new__(TableClass) for render method tests where __init__ is complex
 - MagicMock for all external dependencies
 - assert x == y style assertions
+
+Exception: TestRenderLibreNMSId runs against real Interface rows (@pytest.mark.django_db) — the
+LibreNMS-id cell's colour depends on the real get_librenms_device_id custom-field read, which a
+MagicMock interface would let drift silently.
 """
 
 from unittest.mock import MagicMock, patch
@@ -1796,6 +1800,265 @@ def test_stack_uses_sysname_when_no_hostname(self):
 # ===========================================================================
 
 
+class TestInterfaceTableLibreNMSIdColumnAndBadgeContrast:
+    """Regression guards for two UI fixes on the interface sync table."""
+
+    # The relationship column's status keys; an unknown key exercises the .get() fallback badge.
+    _STATUSES = ["match", "mismatch", "missing_nb", "missing_lnms", "definitely-unknown-status"]
+
+    def _table(self):
+        from netbox_librenms_plugin.tables.interfaces import LibreNMSInterfaceTable
+
+        mock_device = MagicMock()
+        with patch("netbox_librenms_plugin.tables.interfaces.get_interface_name_field", return_value="ifName"):
+            return LibreNMSInterfaceTable(data=[], device=mock_device, server_key="default")
+
+    def _status_badge_classes(self, table, status):
+        """Render a status's badge in isolation and return its CSS class tokens."""
+        import re
+
+        html = str(
+            table._render_relationship_column(
+                lnms_name="",
+                lnms_port_id=None,
+                sync_status=status,
+                record={},
+                btn_class="lag-sync-btn",
+                data_related_key="data-lag-port-id",
+            )
+        )
+        m = re.search(r'class="badge ([^"]*)"', html)
+        assert m, f"no status badge rendered for {status!r}: {html!r}"
+        return m.group(1).split()
+
+    def test_librenms_id_column_present(self):
+        table = self._table()
+        column_names = [c.name for c in table.columns]
+        assert "librenms_id" in column_names, "LibreNMS ID column was dropped from the interface table"
+        assert table.columns["librenms_id"].verbose_name == "LibreNMS ID"
+
+    def test_every_status_badge_pairs_background_with_text_colour(self):
+        """A solid ``bg-*`` colour fill with no companion text colour is the grey-on-grey / grey-on-green readability bug."""
+        table = self._table()
+        for status in self._STATUSES:
+            tokens = self._status_badge_classes(table, status)
+            # A *-lt token is a known-readable pairing; it isn't a bare solid fill.
+            solid_bg = [t for t in tokens if t.startswith("bg-") and not t.endswith("-lt")]
+            has_text_colour = any(t.startswith("text-") for t in tokens)
+            assert has_text_colour or not solid_bg, (
+                f"status {status!r} badge {tokens} sets a solid background with no contrasting "
+                "text colour (use text-bg-*, bg-*-lt, or an explicit text-* class)"
+            )
+
+    def test_missing_lnms_badge_label_renders(self):
+        table = self._table()
+        tokens = self._status_badge_classes(table, "missing_lnms")
+        # The relationship pill uses Tabler's light variant (ships its own readable text colour in
+        # both themes; exempt from the bare-bg badge guard) and a status icon.
+        assert "bg-secondary-lt" in tokens
+
+
+class TestRelationshipBadgeCompactLayout:
+    """The Parent/LAG column must render ONE compact pill per relationship line: the relationship type + LibreNMS name in a single light badge, with the status conveyed by colour + an mdi icon + a title tooltip."""
+
+    def _table(self):
+        from netbox_librenms_plugin.tables.interfaces import LibreNMSInterfaceTable
+
+        with patch("netbox_librenms_plugin.tables.interfaces.get_interface_name_field", return_value="ifName"):
+            table = LibreNMSInterfaceTable(
+                data=[], device=MagicMock(pk=3, virtual_chassis=None), interface_name_field="ifName"
+            )
+        table.migrated_to_marker = False
+        return table
+
+    def test_named_relationship_renders_single_pill_with_type_name_and_title(self):
+        table = self._table()
+        html = str(
+            table._render_relationship_column(
+                type_label="LAG",
+                lnms_name="ae36",
+                lnms_port_id=None,
+                sync_status="missing_nb",
+                record={},
+                btn_class="lag-sync-btn",
+                data_related_key="data-lag-port-id",
+            )
+        )
+        # Exactly one badge — the old design rendered two (status badge + name badge).
+        assert html.count('class="badge') == 1
+        # Type + name inline in that single pill.
+        assert "LAG" in html
+        assert "ae36" in html
+        # Status conveyed by an icon + the full text in the title (not a long inline word).
+        assert "mdi-plus-circle" in html
+        assert 'title="LAG: Not in NetBox"' in html
+
+    def test_match_pill_uses_light_variant_and_check_icon(self):
+        table = self._table()
+        html = str(
+            table._render_relationship_column(
+                type_label="Parent",
+                lnms_name="lo0",
+                lnms_port_id=None,
+                sync_status="match",
+                record={},
+                btn_class="parent-sync-btn",
+                data_related_key="data-parent-port-id",
+            )
+        )
+        assert "bg-success-lt" in html
+        assert "mdi-check-circle" in html
+        assert 'title="Parent: Match"' in html
+
+    def test_render_parent_stacks_lag_and_parent_as_compact_pills(self):
+        table = self._table()
+        record = {
+            "port_id": 5,
+            "ifName": "eth0",
+            "netbox_interface": None,
+            "lag_sync_status": "missing_nb",
+            "librenms_lag_name": "ae0",
+            "librenms_lag_port_id": 111,
+            "parent_sync_status": "match",
+            "librenms_parent_name": "et-0/0/1",
+            "librenms_parent_port_id": 222,
+        }
+        html = str(table.render_parent(None, record))
+        # One pill per line — two relationships → two badges total (not four).
+        assert html.count('class="badge') == 2
+        assert "LAG" in html
+        assert "Parent" in html
+        # Type label lives inside the pill now, not in a separate muted prefix span.
+        assert "text-muted small" not in html
+
+    @pytest.mark.django_db
+    def test_mismatch_renders_reconcile_sync_button(self):
+        """A 'mismatch' (LibreNMS aggregate/parent differs from NetBox) must expose the inline sync button so the row can be reconciled to LibreNMS — not just an amber pill the user can't act on. The LibreNMS port_id is set for a mismatch, so the control has a target."""
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+
+        table = self._table()
+        source = make_interface(make_device("relationship-mismatch"), "eth0")
+        html = str(
+            table._render_relationship_column(
+                type_label="LAG",
+                lnms_name="ae9",
+                lnms_port_id=42,
+                sync_status="mismatch",
+                record={"port_id": 7, "netbox_interface": source},
+                btn_class="lag-sync-btn",
+                data_related_key="data-lag-port-id",
+            )
+        )
+        # The reconcile button is present and wired to the LibreNMS aggregate port_id.
+        assert "lag-sync-btn" in html
+        assert "mdi-sync" in html
+        assert 'data-lag-port-id="42"' in html
+        # The tooltip spells out that the click overwrites NetBox with the LibreNMS value.
+        assert 'title="Update LAG to match LibreNMS"' in html
+        # Icon-only button also carries an accessible name (title alone is not a reliable one).
+        assert 'aria-label="Update LAG to match LibreNMS"' in html
+
+    @pytest.mark.django_db
+    def test_name_field_does_not_leak_into_a_later_table(self):
+        """A non-default name field must not retarget the columns of the next table built.
+
+        ``base_columns`` and ``_meta`` are class attributes, and Table.__init__ deep-copies
+        base_columns only after ``__init__`` runs, so assigning to either before ``super()``
+        rewrote the accessor for every later table in the worker process, across requests.
+        """
+        from netbox_librenms_plugin.tables.interfaces import LibreNMSInterfaceTable
+
+        with patch("netbox_librenms_plugin.tables.interfaces.get_interface_name_field", return_value="ifName"):
+            LibreNMSInterfaceTable(data=[], device=None, interface_name_field="ifDescr", server_key="default")
+            later = LibreNMSInterfaceTable(data=[], device=None, server_key="default")
+
+        assert later.interface_name_field == "ifName"
+        assert later.columns["name"].column.accessor == "ifName"
+        # The class itself must be untouched, so a fresh worker sees the declared default.
+        assert LibreNMSInterfaceTable.base_columns["name"].accessor is None
+
+    def test_row_attrs_are_per_instance_not_shared_on_the_class(self):
+        """The row-attribute map must be bound to the instance, not written onto Meta."""
+        from netbox_librenms_plugin.tables.interfaces import LibreNMSInterfaceTable
+
+        with patch("netbox_librenms_plugin.tables.interfaces.get_interface_name_field", return_value="ifName"):
+            table = LibreNMSInterfaceTable(data=[], device=None, interface_name_field="ifDescr", server_key="default")
+
+        assert "data-interface" in table.row_attrs
+        assert not LibreNMSInterfaceTable._meta.row_attrs
+
+    @pytest.mark.django_db
+    def test_unresolvable_owner_renders_badge_only_instead_of_failing_the_render(self):
+        """An unresolved owner must degrade this cell, not raise NoReverseMatch for the table.
+
+        ``_resolve_row_member_id`` returns "" when the table has no device context and the row's
+        interface carries no device id. ``reverse()`` with an empty object_id raises, which would
+        take down the whole table render instead of dropping one button.
+        """
+        from netbox_librenms_plugin.tables.interfaces import LibreNMSInterfaceTable
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+
+        with patch("netbox_librenms_plugin.tables.interfaces.get_interface_name_field", return_value="ifName"):
+            table = LibreNMSInterfaceTable(data=[], device=None, server_key="default")
+        source = make_interface(make_device("relationship-no-owner"), "eth0")
+        source.device_id = None  # in-memory only: models the row whose owner cannot be resolved
+
+        html = str(
+            table._render_relationship_column(
+                type_label="LAG",
+                lnms_name="ae9",
+                lnms_port_id=42,
+                sync_status="mismatch",
+                record={"port_id": 7, "netbox_interface": source},
+                btn_class="lag-sync-btn",
+                data_related_key="data-lag-port-id",
+            )
+        )
+
+        assert "lag-sync-btn" not in html
+        assert "mdi-sync" not in html
+        assert 'class="badge' in html
+
+    def test_missing_lnms_renders_badge_only_no_button(self):
+        """missing_lnms (NetBox has the relationship, LibreNMS doesn't) has no LibreNMS port_id to sync TO, so the lnms_port_id guard keeps the button off — only the status pill renders."""
+        table = self._table()
+        html = str(
+            table._render_relationship_column(
+                type_label="LAG",
+                lnms_name="",
+                lnms_port_id=None,
+                sync_status="missing_lnms",
+                record={"port_id": 7},
+                btn_class="lag-sync-btn",
+                data_related_key="data-lag-port-id",
+            )
+        )
+        assert "mdi-sync" not in html
+        assert "lag-sync-btn" not in html
+
+    @pytest.mark.django_db
+    def test_mismatch_button_suppressed_on_migrated_donor(self):
+        """Even a mismatch must NOT render the inline control on a migrated donor page (the bulk form is hidden; a direct POST would mutate donor state)."""
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+
+        table = self._table()
+        table.migrated_to_marker = True
+        source = make_interface(make_device("migrated-relationship-mismatch"), "eth0")
+        html = str(
+            table._render_relationship_column(
+                type_label="LAG",
+                lnms_name="ae9",
+                lnms_port_id=42,
+                sync_status="mismatch",
+                record={"port_id": 7, "netbox_interface": source},
+                btn_class="lag-sync-btn",
+                data_related_key="data-lag-port-id",
+            )
+        )
+        assert "mdi-sync" not in html
+        assert "lag-sync-btn" not in html
+
+
 class TestLibreNMSInterfaceTableInit:
     """Tests for LibreNMSInterfaceTable.__init__()."""
 
@@ -1867,6 +2130,213 @@ def test_server_key_defaults_when_none(self):
         assert table.server_key == "default"
 
 
+class TestRelationshipSyncObjectType:
+    """The missing_nb relationship-sync button must carry the right object type, driven by the table subclass — not a runtime self.device.cluster probe that misclassifies a cluster-less VM as a device."""
+
+    def _render(self, table_cls, device, netbox_interface):
+        with patch("netbox_librenms_plugin.tables.interfaces.get_interface_name_field", return_value="ifName"):
+            table = table_cls(data=[], device=device, interface_name_field="ifName")
+        record = {"port_id": 5, "ifName": "eth0", "netbox_interface": netbox_interface}
+        return str(
+            table._render_relationship_column(
+                lnms_name="eth0",
+                lnms_port_id=10,
+                sync_status="missing_nb",
+                record=record,
+                btn_class="parent-sync-btn",
+                data_related_key="data-parent-port-id",
+            )
+        )
+
+    @pytest.mark.django_db
+    def test_device_table_emits_device_object_type(self):
+        from netbox_librenms_plugin.tables.interfaces import LibreNMSInterfaceTable
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+
+        device = make_device("relationship-object-type")
+        html = self._render(LibreNMSInterfaceTable, device, make_interface(device, "eth0"))
+        assert 'data-object-type="device"' in html
+
+    @pytest.mark.django_db
+    def test_vm_table_emits_virtualmachine_even_without_cluster(self):
+        from netbox_librenms_plugin.tables.interfaces import LibreNMSVMInterfaceTable
+        from virtualization.models import VMInterface
+
+        from netbox_librenms_plugin.tests.conftest import make_vm
+
+        vm = make_vm("relationship-object-type-vm")
+        html = self._render(LibreNMSVMInterfaceTable, vm, VMInterface.objects.create(virtual_machine=vm, name="eth0"))
+        assert 'data-object-type="virtualmachine"' in html
+
+
+class TestParentColumnContainsLagButton:
+    """Regression guard for the 'refresh the LAG cell after VC-member verification' review note."""
+
+    def _table(self, device):
+        from netbox_librenms_plugin.tables.interfaces import LibreNMSInterfaceTable
+
+        table = LibreNMSInterfaceTable(data=[], device=device, interface_name_field="ifName")
+        table.migrated_to_marker = False  # inline sync buttons active
+        return table
+
+    @pytest.mark.django_db
+    def test_render_parent_emits_lag_button_with_port_id_in_same_cell(self):
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+
+        device = make_device("relationship-buttons")
+        interface = make_interface(device, "eth0")
+        table = self._table(device)
+        record = {
+            "port_id": 5,
+            "ifName": "eth0",
+            "netbox_interface": interface,
+            "selected_object_id": 3,
+            "selected_object_type": "device",
+            # Both relationship halves present and unsynced → both buttons render.
+            "lag_sync_status": "missing_nb",
+            "librenms_lag_name": "ae0",
+            "librenms_lag_port_id": 111,
+            "parent_sync_status": "missing_nb",
+            "librenms_parent_name": "eth-parent",
+            "librenms_parent_port_id": 222,
+        }
+        html = str(table.render_parent(None, record))
+        # Both buttons live in the single combined column render_parent produces.
+        assert "lag-sync-btn" in html
+        assert 'data-lag-port-id="111"' in html
+        assert "parent-sync-btn" in html
+        assert 'data-parent-port-id="222"' in html
+
+    @pytest.mark.django_db
+    def test_relationship_button_uses_reversed_prefixed_url(self):
+        from django.urls import get_script_prefix, set_script_prefix
+
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+
+        device = make_device("prefixed-relationship-button")
+        interface = make_interface(device, "eth0")
+        table = self._table(device)
+        record = {
+            "port_id": 5,
+            "ifName": "eth0",
+            "netbox_interface": interface,
+            "selected_object_id": device.pk,
+            "selected_object_type": "device",
+            "parent_sync_status": "missing_nb",
+            "librenms_parent_name": "eth-parent",
+            "librenms_parent_port_id": 222,
+        }
+        previous_prefix = get_script_prefix()
+        set_script_prefix("/netbox/")
+        try:
+            html = str(table.render_parent(None, record))
+        finally:
+            set_script_prefix(previous_prefix)
+
+        assert f'data-sync-url="/netbox/plugins/librenms_plugin/device/{device.pk}/sync-interface-parent/"' in html
+
+    @pytest.mark.django_db
+    def test_unsynced_source_does_not_offer_relationship_action(self):
+        from netbox_librenms_plugin.tests.conftest import make_device
+
+        table = self._table(make_device("unsynced-relationship-source"))
+        record = {
+            "port_id": 5,
+            "ifName": "eth0",
+            "netbox_interface": None,
+            "lag_sync_status": "missing_nb",
+            "librenms_lag_name": "ae0",
+            "librenms_lag_port_id": 111,
+            "parent_sync_status": "missing_nb",
+            "librenms_parent_name": "eth-parent",
+            "librenms_parent_port_id": 222,
+        }
+
+        html = str(table.render_parent(None, record))
+
+        assert "Not in NetBox" in html
+        assert "lag-sync-btn" not in html
+        assert "parent-sync-btn" not in html
+
+    @pytest.mark.django_db
+    def test_no_standalone_lag_column_exists(self):
+        from netbox_librenms_plugin.tests.conftest import make_device
+
+        table = self._table(make_device("relationship-columns"))
+        col_names = [c.name for c in table.columns]
+        assert "parent" in col_names  # the combined Parent/LAG column
+        assert "lag" not in col_names  # there is no separate LAG cell for JS to target
+
+
+class TestMigratedModeSuppressesRelationshipButton:
+    """On a migrated donor page the per-row LAG/parent sync button must be suppressed: it POSTs directly via librenms_sync.js, so a live button would let a migrated donor mutate relationship state even though the bulk sync form is hidden."""
+
+    def _render(self, migrated, device, netbox_interface):
+        from netbox_librenms_plugin.tables.interfaces import LibreNMSInterfaceTable
+
+        with patch("netbox_librenms_plugin.tables.interfaces.get_interface_name_field", return_value="ifName"):
+            table = LibreNMSInterfaceTable(data=[], device=device, interface_name_field="ifName")
+        table.migrated_to_marker = migrated
+        record = {"port_id": 5, "ifName": "eth0", "netbox_interface": netbox_interface}
+        return str(
+            table._render_relationship_column(
+                lnms_name="eth0",
+                lnms_port_id=10,
+                sync_status="missing_nb",
+                record=record,
+                btn_class="parent-sync-btn",
+                data_related_key="data-parent-port-id",
+            )
+        )
+
+    @pytest.mark.django_db
+    def test_button_present_in_normal_mode(self):
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+
+        device = make_device("normal-relationship-button")
+        html = self._render(False, device, make_interface(device, "eth0"))
+        assert "parent-sync-btn" in html
+
+    @pytest.mark.django_db
+    def test_button_suppressed_in_migrated_mode(self):
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+
+        device = make_device("migrated-relationship-button")
+        html = self._render(True, device, make_interface(device, "eth0"))
+        assert "parent-sync-btn" not in html
+        # The status badge must still render so the relationship state stays visible.
+        assert "Not in NetBox" in html
+
+
+class TestRelationshipColumnNameEscaping:
+    """Contract: the related interface name in the Parent/LAG badge is escaped exactly once for a name containing & < >."""
+
+    def _render(self, lnms_name):
+        from netbox_librenms_plugin.tables.interfaces import LibreNMSInterfaceTable
+
+        with patch("netbox_librenms_plugin.tables.interfaces.get_interface_name_field", return_value="ifName"):
+            table = LibreNMSInterfaceTable(
+                data=[], device=MagicMock(pk=3, virtual_chassis=None), interface_name_field="ifName"
+            )
+        record = {"port_id": 5, "ifName": "eth0", "netbox_interface": None}
+        return str(
+            table._render_relationship_column(
+                lnms_name=lnms_name,
+                lnms_port_id=10,
+                sync_status="match",  # renders the name badge, no sync button
+                record=record,
+                btn_class="parent-sync-btn",
+                data_related_key="data-parent-port-id",
+            )
+        )
+
+    def test_special_chars_escaped_once(self):
+        html = self._render("a&b<c>")
+        assert "a&amp;b&lt;c&gt;" in html  # escaped exactly once
+        assert "&amp;amp;" not in html  # not double-encoded
+        assert "&amp;lt;" not in html
+
+
 # ===========================================================================
 # LibreNMSInterfaceTable._parse_group_id tests
 # ===========================================================================
@@ -2254,76 +2724,6 @@ def test_disabled_up_matching_in_netbox(self):
         assert "text-success" in result
 
 
-# ===========================================================================
-# LibreNMSInterfaceTable render_librenms_id tests
-# ===========================================================================
-
-
-class TestRenderLibreNMSId:
-    """Tests for LibreNMSInterfaceTable.render_librenms_id()."""
-
-    def _table(self, server_key="default"):
-        from netbox_librenms_plugin.tables.interfaces import LibreNMSInterfaceTable
-
-        t = object.__new__(LibreNMSInterfaceTable)
-        t.server_key = server_key
-        return t
-
-    def test_not_in_netbox_returns_danger(self):
-        table = self._table()
-        record = {"exists_in_netbox": False, "netbox_interface": None}
-        result = str(table.render_librenms_id(value=123, record=record))
-        assert "text-danger" in result
-        assert "123" in result
-
-    def test_no_netbox_interface_returns_danger(self):
-        table = self._table()
-        record = {"exists_in_netbox": True, "netbox_interface": None}
-        result = str(table.render_librenms_id(value=123, record=record))
-        assert "text-danger" in result
-
-    def test_netbox_librenms_id_is_none_returns_danger(self):
-        table = self._table()
-        nb_iface = MagicMock()
-        record = {"exists_in_netbox": True, "netbox_interface": nb_iface}
-
-        with patch(
-            "netbox_librenms_plugin.tables.interfaces.get_librenms_device_id",
-            return_value=None,
-        ):
-            result = str(table.render_librenms_id(value=456, record=record))
-
-        assert "text-danger" in result
-        assert "No librenms_id" in result
-
-    def test_ids_match_returns_success(self):
-        table = self._table()
-        nb_iface = MagicMock()
-        record = {"exists_in_netbox": True, "netbox_interface": nb_iface}
-
-        with patch(
-            "netbox_librenms_plugin.tables.interfaces.get_librenms_device_id",
-            return_value=42,
-        ):
-            result = str(table.render_librenms_id(value=42, record=record))
-
-        assert "text-success" in result
-
-    def test_ids_mismatch_returns_warning(self):
-        table = self._table()
-        nb_iface = MagicMock()
-        record = {"exists_in_netbox": True, "netbox_interface": nb_iface}
-
-        with patch(
-            "netbox_librenms_plugin.tables.interfaces.get_librenms_device_id",
-            return_value=99,
-        ):
-            result = str(table.render_librenms_id(value=42, record=record))
-
-        assert "text-warning" in result
-        assert "Existing LibreNMS ID: 99" in result
-
-
 # ===========================================================================
 # LibreNMSInterfaceTable._compare_mac_addresses tests
 # ===========================================================================
@@ -2737,15 +3137,18 @@ def test_clears_alias_when_same_as_name(self):
             # render_description is called with "" (cleared alias)
             mock_desc.assert_called_once_with("", port_data)
 
-    def test_oob_row_never_binds_to_host_interface_by_name(self):
+    def test_oob_row_never_binds_to_host_interface_by_name(self, db):
         """An OOB-controller row (shared-LOM 'eth0') must stay unmatched on row re-render, mirroring the interfaces-tab guard — otherwise the VC-dropdown re-render flips it to green 'matched' against an unrelated host interface."""
-        table = self._table()
-        device = MagicMock()
-        host_iface = MagicMock()  # a host interface named eth0 exists
-        device.interfaces.filter.return_value.first.return_value = host_iface
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+        from netbox_librenms_plugin.tables.interfaces import LibreNMSInterfaceTable
+
+        device = make_device("format-interface-oob")
+        make_interface(device, "eth0")
+        table = LibreNMSInterfaceTable(data=[], device=device, interface_name_field="ifName")
 
         port_data = {
             "_source": "oob",
+            "port_id": 10,
             "ifName": "eth0",
             "ifType": "ethernetCsmacd",
             "ifSpeed": 0,
@@ -2754,31 +3157,27 @@ def test_oob_row_never_binds_to_host_interface_by_name(self):
             "ifAdminStatus": "up",
             "ifAlias": "",
             "ifDescr": "eth0",
+            "untagged_vlan": None,
+            "tagged_vlans": [],
         }
 
-        with (
-            patch.object(table, "render_name", return_value=""),
-            patch.object(table, "render_type", return_value=""),
-            patch.object(table, "render_speed", return_value=""),
-            patch.object(table, "render_mac_address", return_value=""),
-            patch.object(table, "render_mtu", return_value=""),
-            patch.object(table, "render_enabled", return_value=""),
-            patch.object(table, "render_description", return_value=""),
-        ):
-            table.format_interface_data(port_data, device)
+        table.format_interface_data(port_data, device)
 
         assert port_data["netbox_interface"] is None
         assert port_data["exists_in_netbox"] is False
 
-    def test_main_row_still_binds_by_name(self):
+    def test_main_row_still_binds_by_name(self, db):
         """The guard is OOB-specific: a main-source row keeps the name binding."""
-        table = self._table()
-        device = MagicMock()
-        host_iface = MagicMock()
-        device.interfaces.filter.return_value.first.return_value = host_iface
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+        from netbox_librenms_plugin.tables.interfaces import LibreNMSInterfaceTable
+
+        device = make_device("format-interface-main")
+        host_iface = make_interface(device, "eth0")
+        table = LibreNMSInterfaceTable(data=[], device=device, interface_name_field="ifName")
 
         port_data = {
             "_source": "main",
+            "port_id": 10,
             "ifName": "eth0",
             "ifType": "ethernetCsmacd",
             "ifSpeed": 0,
@@ -2787,20 +3186,14 @@ def test_main_row_still_binds_by_name(self):
             "ifAdminStatus": "up",
             "ifAlias": "",
             "ifDescr": "eth0",
+            "untagged_vlan": None,
+            "tagged_vlans": [],
+            "name_fallback_allowed": True,
         }
 
-        with (
-            patch.object(table, "render_name", return_value=""),
-            patch.object(table, "render_type", return_value=""),
-            patch.object(table, "render_speed", return_value=""),
-            patch.object(table, "render_mac_address", return_value=""),
-            patch.object(table, "render_mtu", return_value=""),
-            patch.object(table, "render_enabled", return_value=""),
-            patch.object(table, "render_description", return_value=""),
-        ):
-            table.format_interface_data(port_data, device)
+        table.format_interface_data(port_data, device)
 
-        assert port_data["netbox_interface"] is host_iface
+        assert port_data["netbox_interface"].pk == host_iface.pk
         assert port_data["exists_in_netbox"] is True
 
 
@@ -2865,98 +3258,131 @@ def test_device_selection_column_visible_for_vc(self):
         # device_selection column should be shown for VC devices
         assert "device_selection" in table.columns
 
-    def test_render_device_selection_ethernet_uses_vc_member(self):
+    @pytest.mark.django_db
+    def test_duplicate_display_names_have_distinct_stable_form_keys(self):
         from netbox_librenms_plugin.tables.interfaces import VCInterfaceTable
+        from netbox_librenms_plugin.tests.conftest import make_device, make_virtual_chassis
+
+        member1 = make_device("stable-form-member-1")
+        member2 = make_device("stable-form-member-2")
+        make_virtual_chassis("stable-form-vc", member1, member2)
+        records = [
+            {"port_id": 10, "ifName": "Ethernet1", "ifDescr": "Ethernet", "ifType": "ethernetCsmacd"},
+            {"port_id": 11, "ifName": "Ethernet2", "ifDescr": "Ethernet", "ifType": "ethernetCsmacd"},
+        ]
+        table = VCInterfaceTable(data=records, device=member1, interface_name_field="ifDescr")
 
-        mock_member1 = MagicMock()
-        mock_member1.id = 1
-        mock_member1.name = "switch-1"
+        selection_cells = [str(row.get_cell("selection")) for row in table.rows]
+        member_selects = [str(table.render_device_selection(None, record)) for record in records]
 
-        mock_member2 = MagicMock()
-        mock_member2.id = 2
-        mock_member2.name = "switch-2"
+        assert 'name="select" value="10"' in selection_cells[0]
+        assert 'name="select" value="11"' in selection_cells[1]
+        assert 'name="device_selection_10"' in member_selects[0]
+        assert 'name="device_selection_11"' in member_selects[1]
 
-        mock_device = MagicMock()
-        mock_device.id = 1
-        mock_device.virtual_chassis = MagicMock()
-        mock_device.virtual_chassis.members.all.return_value = [mock_member1, mock_member2]
+    @pytest.mark.django_db
+    def test_render_device_selection_reuses_single_member_query(self, django_assert_num_queries):
+        """The member dropdown loads the real chassis member queryset once per table."""
+        from netbox_librenms_plugin.tables.interfaces import VCInterfaceTable
+        from netbox_librenms_plugin.tests.conftest import make_device, make_virtual_chassis
 
-        with patch("netbox_librenms_plugin.tables.interfaces.get_interface_name_field", return_value="ifName"):
-            table = VCInterfaceTable(data=[], device=mock_device, interface_name_field="ifName")
+        member1 = make_device("vc-query-member-1")
+        member2 = make_device("vc-query-member-2")
+        make_virtual_chassis("vc-query-members", member1, member2)
+        table = VCInterfaceTable(data=[], device=member1, interface_name_field="ifName")
 
-        table.device = mock_device
+        with django_assert_num_queries(1):
+            table.render_device_selection(None, {"ifName": "Gi1/0", "ifType": "ethernetCsmacd"})
+            table.render_device_selection(None, {"ifName": "Gi2/0", "ifType": "ethernetCsmacd"})
+            _ = table._vc_members_by_position
 
-        record = {
-            "ifName": "Gi1/0/1",
-            "ifType": "ethernetCsmacd",
-        }
+    @pytest.mark.django_db
+    def test_render_device_selection_ethernet_uses_vc_member(self):
+        from netbox_librenms_plugin.tables.interfaces import VCInterfaceTable
+        from netbox_librenms_plugin.tests.conftest import make_device, make_virtual_chassis
 
-        with patch(
-            "netbox_librenms_plugin.tables.interfaces.get_virtual_chassis_member",
-            return_value=mock_member1,
-        ):
-            result = str(table.render_device_selection(value=None, record=record))
+        member1 = make_device("vc-physical-member-1")
+        member2 = make_device("vc-physical-member-2")
+        make_virtual_chassis("vc-physical-members", member1, member2)
+        table = VCInterfaceTable(data=[], device=member1, interface_name_field="ifName")
+
+        result = str(
+            table.render_device_selection(
+                value=None,
+                record={"ifName": "Gi2/0/1", "ifType": "ethernetCsmacd"},
+            )
+        )
 
-        assert "switch-1" in result
-        assert "switch-2" in result
+        assert member1.name in result
+        assert member2.name in result
+        assert f'value="{member2.pk}" selected' in result
         assert "vc-member-select" in result
 
-    def test_render_device_selection_non_ethernet_uses_device_id(self):
+    @pytest.mark.django_db
+    def test_render_device_selection_logical_iface_defaults_to_viewed_member(self):
+        """
+        A not-yet-synced LOGICAL interface (Vlan2) on a real VC must default to the VIEWED member,
+        NOT the member whose vc_position happens to equal the name's trailing digit.
+
+        Real-DB: the digit in ``Vlan2`` is a VLAN id, not a member index — the name-position
+        heuristic must not run for logical types. Against the unfixed code (no ethernet/dotted
+        guard) this resolves to the position-2 member (wrong); the guard defaults it to the viewed
+        member. Uses real Devices in a real VirtualChassis so the vc_position map is genuinely
+        queried — a MagicMock member with a MagicMock vc_position hid this by never matching.
+        """
         from netbox_librenms_plugin.tables.interfaces import VCInterfaceTable
+        from netbox_librenms_plugin.tests.conftest import make_device, make_virtual_chassis
 
-        mock_member1 = MagicMock()
-        mock_member1.id = 1
-        mock_member1.name = "switch-1"
+        sw1 = make_device("sw-①-1")
+        sw2 = make_device("sw-①-2")
+        make_virtual_chassis("vc-①-logical", sw1, sw2)  # sw1 -> vc_position 1, sw2 -> 2
 
-        mock_device = MagicMock()
-        mock_device.id = 1
-        mock_device.virtual_chassis = MagicMock()
-        mock_device.virtual_chassis.members.all.return_value = [mock_member1]
+        table = VCInterfaceTable(data=[], device=sw1, interface_name_field="ifName")
 
-        with patch("netbox_librenms_plugin.tables.interfaces.get_interface_name_field", return_value="ifName"):
-            table = VCInterfaceTable(data=[], device=mock_device, interface_name_field="ifName")
-
-        table.device = mock_device
-        record = {
-            "ifName": "Vlan100",
-            "ifType": "l3ipvlan",  # non-ethernet
-        }
+        record = {"ifName": "Vlan2", "ifType": "l3ipvlan"}  # digit 2 == sw2's vc_position
 
-        result = str(table.render_device_selection(value=None, record=record))
+        assert table._resolve_row_member_id(record) == sw1.pk  # viewed member, not sw2
+        dropdown = str(table.render_device_selection(value=None, record=record))
+        assert f'value="{sw1.pk}" selected' in dropdown
+        assert f'value="{sw2.pk}" selected' not in dropdown
 
-        assert "switch-1" in result
-        assert 'value="1"' in result
-
-    def test_render_device_selection_no_member_uses_device_id(self):
-        """When get_virtual_chassis_member returns None, fall back to device.id."""
+    @pytest.mark.django_db
+    def test_render_device_selection_uses_name_heuristic_only_for_physical_rows(self):
+        """
+        The name-position heuristic applies to physical Ethernet rows. A dot does not prove that
+        a logical child belongs to the member encoded in its name.
+        """
         from netbox_librenms_plugin.tables.interfaces import VCInterfaceTable
+        from netbox_librenms_plugin.tests.conftest import make_device, make_virtual_chassis
 
-        mock_member1 = MagicMock()
-        mock_member1.id = 1
-        mock_member1.name = "switch-1"
-
-        mock_device = MagicMock()
-        mock_device.id = 1
-        mock_device.virtual_chassis = MagicMock()
-        mock_device.virtual_chassis.members.all.return_value = [mock_member1]
+        sw1 = make_device("sw-①b-1")
+        sw2 = make_device("sw-①b-2")
+        make_virtual_chassis("vc-①-physical", sw1, sw2)  # sw1 -> 1, sw2 -> 2
 
-        with patch("netbox_librenms_plugin.tables.interfaces.get_interface_name_field", return_value="ifName"):
-            table = VCInterfaceTable(data=[], device=mock_device, interface_name_field="ifName")
+        table = VCInterfaceTable(data=[], device=sw1, interface_name_field="ifName")
 
-        table.device = mock_device
-        record = {
-            "ifName": "Gi2/0/1",
-            "ifType": "ethernetcsmacd",
-        }
+        # Physical ethernet port on member 2 (ethernetCsmacd) -> heuristic resolves sw2.
+        assert table._resolve_row_member_id({"ifName": "Ethernet2", "ifType": "ethernetCsmacd"}) == sw2.pk
+        # The logical child has no stable owner binding, so it stays on the viewed member.
+        assert table._resolve_row_member_id({"ifName": "Ethernet2.100", "ifType": "l3ipvlan"}) == sw1.pk
 
-        with patch(
-            "netbox_librenms_plugin.tables.interfaces.get_virtual_chassis_member",
-            return_value=None,
-        ):
-            result = str(table.render_device_selection(value=None, record=record))
+    @pytest.mark.django_db
+    def test_render_device_selection_no_member_uses_device_id(self):
+        """A physical name with no matching position falls back to the viewed member."""
+        from netbox_librenms_plugin.tables.interfaces import VCInterfaceTable
+        from netbox_librenms_plugin.tests.conftest import make_device, make_virtual_chassis
+
+        member = make_device("vc-fallback-member")
+        make_virtual_chassis("vc-fallback", member)
+        table = VCInterfaceTable(data=[], device=member, interface_name_field="ifName")
+        result = str(
+            table.render_device_selection(
+                value=None,
+                record={"ifName": "Gi2/0/1", "ifType": "ethernetCsmacd"},
+            )
+        )
 
-        # When chassis_member is None, selected_member_id = self.device.id
-        assert "switch-1" in result
+        assert f'value="{member.pk}" selected' in result
 
     def test_format_interface_data_includes_device_selection(self):
         from netbox_librenms_plugin.tables.interfaces import VCInterfaceTable
@@ -3030,6 +3456,12 @@ def test_instantiation(self):
 
         assert table.tab == "interfaces"
 
+    def test_parent_column_is_in_sequence(self):
+        """The Parent/LAG column must be exposed on VM pages — VMInterface supports sub-interface parents and the relationship sync path resolves VMInterface targets, so omitting it from the sequence would make the feature unreachable for VMs."""
+        from netbox_librenms_plugin.tables.interfaces import LibreNMSVMInterfaceTable
+
+        assert "parent" in LibreNMSVMInterfaceTable.Meta.sequence
+
 
 # ===========================================================================
 # DeviceImportTable.__init__ integration tests
@@ -3316,3 +3748,166 @@ def test_cable_render_local_port_plain_row_has_no_badge(self):
         table = object.__new__(LibreNMSCableTable)
         html = str(table.render_local_port("Gi0/1", {"_source": "main"}))
         assert "From OOB controller" not in html
+
+
+# ---------------------------------------------------------------------------
+# Relationship owner resolution (findings S2/S3) + VM LAG button (finding #1)
+# Real-DB: real Device/VC/Interface objects so button + dropdown resolution is
+# exercised end-to-end rather than re-asserting mock call wiring.
+# ---------------------------------------------------------------------------
+class TestRelationshipOwnerResolutionConsistency:
+    """The relationship sync button (data-object-id) and the VC member dropdown must resolve the same owner; otherwise the JS posts the dropdown value and the sync 404s."""
+
+    @staticmethod
+    def _vc():
+        from netbox_librenms_plugin.tests.conftest import make_device, make_virtual_chassis
+
+        m1 = make_device("vc-owner-a")
+        m2 = make_device("vc-owner-b")
+        make_virtual_chassis("VC-OWNER", m1, m2)
+        return m1, m2
+
+    @staticmethod
+    def _vc_table(device):
+        from netbox_librenms_plugin.tables.interfaces import VCInterfaceTable
+
+        return VCInterfaceTable(data=[], device=device, interface_name_field="ifName")
+
+    def test_non_ethernet_subiface_button_and_dropdown_agree_on_owner(self, db):
+        """A non-ethernet sub-interface owned by another VC member: both the sync button and the member dropdown point at that member, not the viewed one."""
+        from netbox_librenms_plugin.tests.conftest import make_interface
+
+        m1, m2 = self._vc()
+        sub = make_interface(m2, "Vlan100", iface_type="virtual")
+        table = self._vc_table(m1)  # viewing member1
+        record = {
+            "ifName": "Vlan100",
+            "ifType": "l3ipvlan",
+            "port_id": 5,
+            "netbox_interface": sub,
+            "lag_sync_status": None,
+            "parent_sync_status": "mismatch",
+            "librenms_parent_name": "Bdi1",
+            "librenms_parent_port_id": 6,
+        }
+        dropdown = str(table.render_device_selection(None, record))
+        button = str(table.render_parent(None, record))
+        assert f'value="{m2.id}" selected' in dropdown  # dropdown defaults to the true owner
+        assert f'value="{m1.id}" selected' not in dropdown
+        assert f'data-object-id="{m2.id}"' in button  # button agrees
+        assert f'data-object-id="{m1.id}"' not in button  # not the viewed member
+
+    def test_vc_member_resolution_is_prefetched_not_per_row(self, db):
+        """The name-based VC owner resolution must prefetch members once, not query per row."""
+        from django.db import connection
+        from django.test.utils import CaptureQueriesContext
+
+        m1, m2 = self._vc()  # positions 1 and 2
+        table = self._vc_table(m1)  # viewing member1
+        # Rows that fall through to the name-based VC heuristic (no netbox_interface /
+        # selected_object_id), alternating between the two members' positions.
+        records = [{"ifName": f"Ethernet{pos}", "ifType": "ethernetCsmacd"} for pos in (1, 2, 1, 2, 1, 2)]
+
+        with CaptureQueriesContext(connection) as ctx:
+            owners = [table._resolve_row_member_id(r) for r in records]
+
+        # Behaviour preserved: each row resolves to the member at its name's vc_position.
+        assert owners == [m1.pk, m2.pk, m1.pk, m2.pk, m1.pk, m2.pk]
+        # The member set is prefetched once through the cached property.
+        assert len(ctx.captured_queries) == 1
+
+
+class TestVMTableHidesLagSyncButton:
+    """LAG sync is device-only (VMInterface has no lag field); a VM table must not render a LAG sync button that would 404. Parent sync stays available for VMs."""
+
+    @staticmethod
+    def _vm_table():
+        from netbox_librenms_plugin.tables.interfaces import LibreNMSVMInterfaceTable
+        from netbox_librenms_plugin.tests.conftest import make_vm
+
+        vm = make_vm("vm-lag")
+        return LibreNMSVMInterfaceTable(data=[], device=vm, interface_name_field="ifName"), vm
+
+    def test_vm_table_omits_lag_button(self, db):
+        from virtualization.models import VMInterface
+
+        table, vm = self._vm_table()
+        record = {
+            "ifName": "eth0",
+            "ifType": "ethernetCsmacd",
+            "port_id": 3,
+            "netbox_interface": VMInterface.objects.create(virtual_machine=vm, name="eth0"),
+            "lag_sync_status": "missing_nb",
+            "librenms_lag_name": "Po1",
+            "librenms_lag_port_id": 9,
+            "parent_sync_status": None,
+        }
+        html = str(table.render_parent(None, record))
+        assert "lag-sync-btn" not in html  # no LAG control on a VM (it could only 404)
+
+    def test_vm_table_keeps_parent_button(self, db):
+        from virtualization.models import VMInterface
+
+        table, vm = self._vm_table()
+        record = {
+            "ifName": "eth0.100",
+            "ifType": "l3ipvlan",
+            "port_id": 4,
+            "netbox_interface": VMInterface.objects.create(virtual_machine=vm, name="eth0.100"),
+            "lag_sync_status": None,
+            "parent_sync_status": "missing_nb",
+            "librenms_parent_name": "eth0",
+            "librenms_parent_port_id": 10,
+        }
+        html = str(table.render_parent(None, record))
+        assert "parent-sync-btn" in html  # parent sync IS supported for VMs
+        assert f'data-object-id="{vm.id}"' in html
+
+
+@pytest.mark.django_db
+class TestRenderLibreNMSId:
+    """render_librenms_id colours the LibreNMS-id cell by how the stored port_id compares to NetBox.
+
+    Restores real coverage (deleted on the parent/LAG UI work) using real Interface custom-field
+    reads — a mock netbox_interface would let the get_librenms_device_id contract drift silently.
+    """
+
+    def test_no_exists_in_netbox_renders_red(self):
+        table = _make_interface_table(server_key="default")
+        html = table.render_librenms_id("42", {"exists_in_netbox": False})
+        assert "text-danger" in html and ">42<" in html
+
+    def test_exists_but_no_netbox_interface_renders_red(self):
+        table = _make_interface_table(server_key="default")
+        html = table.render_librenms_id("42", {"exists_in_netbox": True, "netbox_interface": None})
+        assert "text-danger" in html
+
+    def test_interface_without_librenms_cf_renders_red_with_title(self):
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+
+        iface = make_interface(make_device("rid-nocf"), "Gi0/1")  # no librenms_id CF
+        table = _make_interface_table(server_key="default")
+        html = table.render_librenms_id("42", {"exists_in_netbox": True, "netbox_interface": iface})
+        assert "text-danger" in html and "No librenms_id" in html
+
+    def test_mismatch_renders_orange_with_existing_id(self):
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+
+        iface = make_interface(make_device("rid-mismatch"), "Gi0/1")
+        set_librenms_device_id(iface, 99, "default")
+        iface.save()
+        table = _make_interface_table(server_key="default")
+        html = table.render_librenms_id("42", {"exists_in_netbox": True, "netbox_interface": iface})
+        assert "text-warning" in html and "Existing LibreNMS ID: 99" in html and ">42<" in html
+
+    def test_match_renders_green(self):
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+
+        iface = make_interface(make_device("rid-match"), "Gi0/1")
+        set_librenms_device_id(iface, 42, "default")
+        iface.save()
+        table = _make_interface_table(server_key="default")
+        html = table.render_librenms_id("42", {"exists_in_netbox": True, "netbox_interface": iface})
+        assert "text-success" in html and ">42<" in html
diff --git a/netbox_librenms_plugin/tests/test_coverage_utils.py b/netbox_librenms_plugin/tests/test_coverage_utils.py
index 0edba1f61a..5f7d9c4184 100644
--- a/netbox_librenms_plugin/tests/test_coverage_utils.py
+++ b/netbox_librenms_plugin/tests/test_coverage_utils.py
@@ -75,6 +75,29 @@ def test_port_name_no_digit_returns_device(self):
         assert result is device
 
 
+@pytest.mark.django_db
+class TestGetVirtualChassisMemberEmptyPrefetchMap:
+    """An empty prefetched members_by_position map must not silently disable member resolution."""
+
+    def test_empty_map_falls_back_to_the_db_lookup(self):
+        from dcim.models import VirtualChassis
+
+        from netbox_librenms_plugin.tests.conftest import make_device
+        from netbox_librenms_plugin.utils import get_virtual_chassis_member
+
+        master = make_device("vc-empty-map-1")
+        member2 = make_device("vc-empty-map-2")
+        vc = VirtualChassis.objects.create(name="vc-empty-map", master=master)
+        for dev, pos in ((master, 1), (member2, 2)):
+            dev.virtual_chassis = vc
+            dev.vc_position = pos
+            dev.save()
+
+        # A caller forwarding a raw-but-empty map must still resolve via the per-call query,
+        # not short-circuit every row to the fallback device.
+        assert get_virtual_chassis_member(master, "Ethernet2", members_by_position={}) == member2
+
+
 class TestGetLibreNMSSyncDeviceServerKey:
     """Tests for get_librenms_sync_device with server_key (lines 113-125)."""
 
@@ -265,7 +288,7 @@ def test_falls_back_to_lowest_vc_position(self):
 
 
 class TestGetTablePaginateCountValueError:
-    """Tests for get_table_paginate_count ValueError path (lines 169-170)."""
+    """Tests for get_table_paginate_count fallback paths: a non-integer per_page hits the ValueError handler, and a zero/negative per_page hits the `< 1` guard — both fall back to the NetBox default rather than propagating to the paginator."""
 
     def test_invalid_per_page_falls_back_to_default(self):
         from netbox_librenms_plugin.utils import get_table_paginate_count
@@ -279,6 +302,19 @@ def test_invalid_per_page_falls_back_to_default(self):
                 result = get_table_paginate_count(request, "table_")
         assert result == 50
 
+    def test_non_positive_per_page_falls_back_to_default(self):
+        """0 or negative input must not propagate to the paginator."""
+        from netbox_librenms_plugin.utils import get_table_paginate_count
+
+        for raw in ("0", "-5"):
+            request = MagicMock()
+            request.GET = {"table_per_page": raw}
+            with patch("netbox_librenms_plugin.utils.get_config"):
+                with patch("netbox_librenms_plugin.utils.netbox_get_paginate_count") as mock_paginate:
+                    mock_paginate.return_value = 50
+                    result = get_table_paginate_count(request, "table_")
+            assert result == 50, f"per_page={raw!r} should fall back to default"
+
 
 class TestGetUserPrefNoConfig:
     """Tests for get_user_pref when user has no config (line 179)."""
diff --git a/netbox_librenms_plugin/tests/test_integration_sync.py b/netbox_librenms_plugin/tests/test_integration_sync.py
index 0cea150138..7f363e76ef 100644
--- a/netbox_librenms_plugin/tests/test_integration_sync.py
+++ b/netbox_librenms_plugin/tests/test_integration_sync.py
@@ -129,6 +129,47 @@ def test_get_ports_empty_list_when_no_ports(self, mock_server):
         assert data["ports"] == []
 
 
+class TestLibreNMSAPIPortStack:
+    """LibreNMS port-stack responses resolve through the HTTP client."""
+
+    def test_documented_port_stack_shape_resolves_lag_membership(self, mock_server):
+        mock_server.register(
+            "/api/v0/devices/42/ports",
+            {
+                "status": "ok",
+                "ports": [
+                    {"port_id": "101", "ifName": "Ethernet1", "ifType": "ethernetCsmacd"},
+                    {"port_id": "102", "ifName": "Port-Channel1", "ifType": "ieee8023adLag"},
+                ],
+            },
+        )
+        mock_server.register(
+            "/api/v0/devices/42/port_stack",
+            {
+                "status": "ok",
+                "message": "",
+                "count": 1,
+                "mappings": [
+                    {
+                        "device_id": "42",
+                        "high_port_id": "101",
+                        "low_port_id": "102",
+                        "ifStackStatus": "active",
+                    }
+                ],
+            },
+        )
+        api = _make_api(mock_server.url)
+
+        ports_ok, ports_data = api.get_ports(42)
+        stack_ok, port_stack = api.get_port_stack(42)
+        relationships = api.resolve_port_relationships(ports_data["ports"], port_stack, lag_patterns={})
+
+        assert ports_ok is True
+        assert stack_ok is True
+        assert relationships["lag_members"] == {101: 102}
+
+
 class TestLibreNMSAPIDeviceInfo:
     """LibreNMSAPI.get_device_info() correctly parses device details."""
 
diff --git a/netbox_librenms_plugin/tests/test_interface_relationship_refresh.py b/netbox_librenms_plugin/tests/test_interface_relationship_refresh.py
new file mode 100644
index 0000000000..43339e6a30
--- /dev/null
+++ b/netbox_librenms_plugin/tests/test_interface_relationship_refresh.py
@@ -0,0 +1,119 @@
+import pytest
+from django.contrib.messages import get_messages
+from django.contrib.messages.storage.fallback import FallbackStorage
+from django.test import RequestFactory
+
+from netbox_librenms_plugin.models import PortStackLagPattern
+from netbox_librenms_plugin.views.base.interfaces_view import BaseInterfaceTableView
+
+
+class _RelationshipAPI:
+    """Use the real resolver while replacing only LibreNMS HTTP responses."""
+
+    def __init__(self, resolver, *, device_info, port_stack):
+        self._resolver = resolver
+        self._device_info = device_info
+        self._port_stack = port_stack
+        self.device_info_calls = 0
+        self.port_stack_calls = 0
+
+    def get_device_info(self, _device_id):
+        self.device_info_calls += 1
+        return self._device_info
+
+    def get_port_stack(self, _device_id):
+        self.port_stack_calls += 1
+        return self._port_stack
+
+    def resolve_port_relationships(self, *args, **kwargs):
+        return self._resolver.resolve_port_relationships(*args, **kwargs)
+
+
+def _message_request():
+    request = RequestFactory().post("/")
+    request.session = {}
+    request._messages = FallbackStorage(request)
+    return request
+
+
+@pytest.mark.django_db
+class TestInterfaceRelationshipRefresh:
+    def test_structural_signal_skips_device_info_request(self, mock_librenms_api):
+        ports = [
+            {"port_id": 10, "ifName": "Ethernet1", "ifType": "ethernetCsmacd"},
+            {"port_id": 20, "ifName": "Bundle1", "ifType": "ieee8023adLag"},
+        ]
+        api = _RelationshipAPI(
+            mock_librenms_api,
+            device_info=(False, "must not be requested"),
+            port_stack=(True, [{"high_port_id": 10, "low_port_id": 20}]),
+        )
+        view = object.__new__(BaseInterfaceTableView)
+        view._librenms_api = api
+        view.librenms_id = 42
+        snapshot = {"ports": ports}
+
+        view._enrich_port_stack_relationships(_message_request(), snapshot, ports, "ifName")
+
+        assert api.device_info_calls == 0
+        assert api.port_stack_calls == 1
+        assert snapshot["port_stack_relationships"]["lag_members"] == {10: 20}
+        assert "relationship_data_incomplete" not in snapshot
+
+    def test_mixed_structural_and_name_signals_warn_when_os_is_unknown(self, mock_librenms_api):
+        # "ios" is one of the rows migration 0013 seeds, so take the existing pattern.
+        PortStackLagPattern.objects.get_or_create(librenms_os="ios", defaults={"lag_name_pattern": r"^Po\d+$"})
+        ports = [
+            {"port_id": 10, "ifName": "Ethernet1", "ifType": "ethernetCsmacd"},
+            {"port_id": 20, "ifName": "Bundle1", "ifType": "ieee8023adLag"},
+            {"port_id": 30, "ifName": "Ethernet2", "ifType": "ethernetCsmacd"},
+            {"port_id": 40, "ifName": "Po2", "ifType": "propVirtual"},
+        ]
+        api = _RelationshipAPI(
+            mock_librenms_api,
+            device_info=(False, "unavailable"),
+            port_stack=(
+                True,
+                [
+                    {"high_port_id": 10, "low_port_id": 20},
+                    {"high_port_id": 30, "low_port_id": 40},
+                ],
+            ),
+        )
+        view = object.__new__(BaseInterfaceTableView)
+        view._librenms_api = api
+        view.librenms_id = 42
+        request = _message_request()
+        snapshot = {"ports": ports}
+
+        view._enrich_port_stack_relationships(request, snapshot, ports, "ifName")
+
+        assert api.device_info_calls == 1
+        assert api.port_stack_calls == 1
+        assert snapshot["port_stack_relationships"]["lag_members"] == {10: 20}
+        assert snapshot["relationship_data_incomplete"] is True
+        assert any("device OS could not be determined" in str(message) for message in get_messages(request))
+
+    def test_structural_signal_marks_snapshot_incomplete_when_port_stack_fetch_fails(self, mock_librenms_api):
+        """A failed structural relationship fetch marks the rendered snapshot incomplete."""
+        ports = [
+            {"port_id": 10, "ifName": "Ethernet1", "ifType": "ethernetCsmacd"},
+            {"port_id": 20, "ifName": "Bundle1", "ifType": "ieee8023adLag"},
+        ]
+        api = _RelationshipAPI(
+            mock_librenms_api,
+            device_info=(False, "must not be requested"),
+            port_stack=(False, "unavailable"),
+        )
+        view = object.__new__(BaseInterfaceTableView)
+        view._librenms_api = api
+        view.librenms_id = 42
+        request = _message_request()
+        snapshot = {"ports": ports}
+
+        view._enrich_port_stack_relationships(request, snapshot, ports, "ifName")
+
+        assert api.device_info_calls == 0
+        assert api.port_stack_calls == 1
+        assert snapshot["relationship_data_incomplete"] is True
+        assert any("relationship data could not be fetched" in str(message) for message in get_messages(request))
diff --git a/netbox_librenms_plugin/tests/test_interface_sync_content_template.py b/netbox_librenms_plugin/tests/test_interface_sync_content_template.py
index d623024b9d..0908f81c90 100644
--- a/netbox_librenms_plugin/tests/test_interface_sync_content_template.py
+++ b/netbox_librenms_plugin/tests/test_interface_sync_content_template.py
@@ -3,14 +3,16 @@
 In migrated mode the POST form is replaced by a plain <div> (a migrated donor must not be
 able to POST an interface sync). The CSRF token AND the server_key hidden input must still be
 emitted in migrated mode — not because of the (absent) form, but because the interface table
-still renders interactive relationship/VC-member dropdowns whose verify-interface POSTs read
-document.querySelector('[name=csrfmiddlewaretoken]').value and
+still renders interactive relationship/VC-member dropdowns whose verify-interface / LAG-sync
+POSTs read document.querySelector('[name=csrfmiddlewaretoken]').value and
 document.querySelector('input[name="server_key"]').value. Dropping either breaks those
 JS-driven requests: a null token → TypeError/403, a null server_key → the wrong LibreNMS
 server/cache on non-default servers. A bare hidden input never auto-submits, so emitting them
 doesn't reintroduce the live-form problem migrated mode exists to avoid.
 """
 
+import re
+
 import pytest
 
 
@@ -24,6 +26,7 @@ def _render(
         netbox_only=(),
         winner=None,
         has_write=False,
+        relationship_incomplete=False,
     ):
         from django.contrib.auth.models import AnonymousUser
         from django.template.loader import render_to_string
@@ -49,6 +52,7 @@ def _render(
             "virtual_chassis_members": [],
             "cache_expiry": None,
             "oob_incomplete": False,
+            "relationship_data_incomplete": relationship_incomplete,
         }
         ctx = {
             "interface_sync": interface_sync,
@@ -69,8 +73,8 @@ def test_migrated_mode_drops_form_but_keeps_csrf_and_server_key(self):
         # The live POST form must be gone in migrated mode (a donor must not POST a sync).
         assert "<form" not in html
         # ...but BOTH the CSRF token and the server_key input must remain so JS-driven
-        # verify-interface POSTs still target the right server.
-        assert "csrfmiddlewaretoken" in html
+        # verify-interface / LAG-sync POSTs still target the right server.
+        assert re.search(r'name="csrfmiddlewaretoken" value="[^"]+"', html)
         assert 'name="server_key"' in html
         assert 'value="prod"' in html
 
@@ -88,7 +92,7 @@ def test_migrated_mode_hidden_server_key_prefers_marker_key(self):
     def test_normal_mode_emits_form_with_csrf_and_server_key(self):
         html = self._render(migrated=None)
         assert "<form" in html
-        assert "csrfmiddlewaretoken" in html
+        assert re.search(r'name="csrfmiddlewaretoken" value="[^"]+"', html)
         assert 'name="server_key"' in html
 
     def test_netbox_only_link_title_is_move_in_migrated_mode(self):
@@ -106,6 +110,14 @@ def test_netbox_only_link_title_is_delete_in_normal_mode(self):
         assert "Click to view and delete NetBox-only interfaces" in html
         assert "Click to view and move NetBox-only interfaces" not in html
 
+    def test_relationship_incomplete_renders_persistent_banner(self):
+        html = self._render(migrated=None, relationship_incomplete=True)
+        assert "LAG / sub-interface relationship data could not be fetched" in html
+
+    def test_no_relationship_banner_when_complete(self):
+        html = self._render(migrated=None, relationship_incomplete=False)
+        assert "LAG / sub-interface relationship data could not be fetched" not in html
+
     def test_migrated_mode_hides_destructive_delete_controls(self):
         # Migrated mode is move-only: the donor-side bulk-delete UI (select-all + per-row
         # checkboxes + "Delete Selected Interfaces") must not render next to the Move actions,
@@ -126,7 +138,8 @@ def test_normal_mode_keeps_delete_controls(self):
         assert "Delete Selected Interfaces" in html
 
     def test_migrated_warning_describes_move_not_delete(self):
-        # In migrated (move) mode WITH a resolved winner, the modal warning must not threaten deletion.
+        # In migrated (move) mode WITH a resolved winner, the modal warning must describe transferring
+        # interfaces to the winner, not permanently deleting them.
         from netbox_librenms_plugin.tests.conftest import make_device
 
         html = self._render(
@@ -134,7 +147,7 @@ def test_migrated_warning_describes_move_not_delete(self):
             netbox_only=[{"id": 1, "name": "eth-only"}],
             winner=make_device("iface-warn-winner"),
         )
-        assert "Moving an interface reassigns it" in html
+        assert "to transfer that interface" in html
         assert "permanently remove them from NetBox" not in html
 
     def test_migrated_warning_handles_missing_winner(self):
@@ -150,7 +163,7 @@ def test_migrated_warning_handles_missing_winner(self):
     def test_normal_warning_describes_delete(self):
         html = self._render(migrated=None, netbox_only=[{"id": 1, "name": "eth-only"}])
         assert "permanently remove them from NetBox" in html
-        assert "Moving an interface reassigns it" not in html
+        assert "to transfer that interface" not in html
 
     def test_delete_checkboxes_have_accessible_names(self):
         # The select-all and per-row checkboxes must carry aria-labels for screen-reader users.
@@ -291,3 +304,31 @@ def test_move_button_falls_back_to_active_server_key_when_marker_has_no_key(self
 
         move_button_tag = extract_enclosing_tag(html, "mdi-transfer-right")
         assert 'hx-vals=\'{"server_key": "default"}\'' in move_button_tag
+
+
+@pytest.mark.django_db
+class TestInterfaceSyncRefreshButtonServerKey:
+    """The outer _interface_sync.html Refresh button must not POST a blank server_key on initial load."""
+
+    def test_refresh_button_falls_back_to_context_server_key_not_blank(self):
+        # On initial page load window.location.search has no server_key, so the Refresh button's
+        # hx-vals must fall back to the active server from context (librenms_server_info.server_key)
+        # rather than '' — a blank key would POST to the default/wrong LibreNMS server.
+        from django.contrib.auth.models import AnonymousUser
+        from django.template.loader import render_to_string
+        from django.test import RequestFactory
+
+        from netbox_librenms_plugin.tests.conftest import make_device
+
+        device = make_device("iface-refresh-dev")
+        request = RequestFactory().get("/")
+        request.user = AnonymousUser()  # NetBox context processors read request.user
+        html = render_to_string(
+            "netbox_librenms_plugin/_interface_sync.html",
+            {"object": device, "has_librenms_id": True, "librenms_server_info": {"server_key": "prod"}},
+            request=request,
+        )
+
+        # The URL-empty fallback now resolves to the active server, not a blank string.
+        assert "get('server_key') || 'prod'" in html
+        assert "get('server_key') || ''" not in html
diff --git a/netbox_librenms_plugin/tests/test_librenms_api.py b/netbox_librenms_plugin/tests/test_librenms_api.py
index 09ea26a5dd..ec187e3097 100644
--- a/netbox_librenms_plugin/tests/test_librenms_api.py
+++ b/netbox_librenms_plugin/tests/test_librenms_api.py
@@ -10,9 +10,6 @@
 import pytest
 import requests
 
-# Import the autouse fixture from helpers
-pytest_plugins = ["netbox_librenms_plugin.tests.test_librenms_api_helpers"]
-
 
 # =============================================================================
 # Test Class 1: Initialization (3 tests)
@@ -2084,3 +2081,733 @@ def test_request_exception_returns_failure(self, mock_get, mock_librenms_config)
 
         assert success is False
         assert "net down" in msg
+
+
+# =============================================================================
+# Test Class: get_port_stack()
+# =============================================================================
+
+
+class TestGetPortStack:
+    """Tests for LibreNMSAPI.get_port_stack()."""
+
+    def test_returns_mappings_list_on_success(self, mock_librenms_api):
+        """get_port_stack returns (True, list) on HTTP 200."""
+        from unittest.mock import MagicMock, patch
+
+        fake_response = MagicMock()
+        fake_response.json.return_value = {
+            "status": "ok",
+            "mappings": [
+                {"high_port_id": 1, "low_port_id": 2, "high_ifIndex": 1, "low_ifIndex": 2},
+            ],
+        }
+        fake_response.raise_for_status = MagicMock()
+        with patch("netbox_librenms_plugin.librenms_api.requests.get", return_value=fake_response) as mock_get:
+            success, data = mock_librenms_api.get_port_stack(42)
+
+        assert success is True
+        assert data == [{"high_port_id": 1, "low_port_id": 2, "high_ifIndex": 1, "low_ifIndex": 2}]
+        mock_get.assert_called_once()
+        call_url = mock_get.call_args[0][0]
+        assert "/api/v0/devices/42/port_stack" in call_url
+
+    def test_returns_false_on_404(self, mock_librenms_api):
+        """get_port_stack returns (False, error_str) when device not found."""
+        import requests as _requests
+        from unittest.mock import MagicMock, patch
+
+        fake_resp = MagicMock()
+        fake_resp.status_code = 404
+        http_error = _requests.exceptions.HTTPError(response=fake_resp)
+        fake_resp.raise_for_status.side_effect = http_error
+        with patch("netbox_librenms_plugin.librenms_api.requests.get", return_value=fake_resp):
+            success, data = mock_librenms_api.get_port_stack(99)
+
+        assert success is False
+        assert "not found" in data.lower()
+
+    @pytest.mark.parametrize("payload", [{"status": "ok"}, {"status": "ok", "mappings": None}])
+    def test_missing_or_null_mappings_fails_closed(self, mock_librenms_api, payload):
+        """A successful response must contain the documented list-valued mappings field."""
+        from unittest.mock import MagicMock, patch
+
+        fake_response = MagicMock()
+        fake_response.json.return_value = payload
+        fake_response.raise_for_status = MagicMock()
+        with patch("netbox_librenms_plugin.librenms_api.requests.get", return_value=fake_response):
+            success, data = mock_librenms_api.get_port_stack(5)
+
+        assert success is False
+        assert "mappings" in data
+
+    def test_error_status_without_mappings_fails_not_empty(self, mock_librenms_api):
+        """An error payload that omits 'mappings' must fail, not normalise to (True, []), so a real API failure isn't masked as 'no LAG/parent relationships'."""
+        from unittest.mock import MagicMock, patch
+
+        fake_response = MagicMock()
+        fake_response.json.return_value = {"status": "error", "message": "device polling disabled"}
+        fake_response.raise_for_status = MagicMock()
+        with patch("netbox_librenms_plugin.librenms_api.requests.get", return_value=fake_response):
+            success, data = mock_librenms_api.get_port_stack(5)
+
+        assert success is False
+        assert data == "device polling disabled"
+
+    def test_error_status_with_mappings_present_still_fails(self, mock_librenms_api):
+        """An error payload that still carries mappings must honor the explicit error status before consuming them, so it fails rather than silently skipping valid sync."""
+        from unittest.mock import MagicMock, patch
+
+        fake_response = MagicMock()
+        fake_response.json.return_value = {
+            "status": "error",
+            "message": "stale poll",
+            "mappings": [],
+        }
+        fake_response.raise_for_status = MagicMock()
+        with patch("netbox_librenms_plugin.librenms_api.requests.get", return_value=fake_response):
+            success, data = mock_librenms_api.get_port_stack(5)
+
+        assert success is False
+        assert data == "stale poll"
+
+    def test_non_string_status_fails_not_empty(self, mock_librenms_api):
+        """A non-string status like `false` is malformed and must fail, not be accepted as (True, [])."""
+        from unittest.mock import MagicMock, patch
+
+        fake_response = MagicMock()
+        # {"status": false, "mappings": []} — only an absent status or "ok" is a genuine answer;
+        # accepting this would silently suppress LAG/sub-interface relationship updates.
+        fake_response.json.return_value = {"status": False, "mappings": []}
+        fake_response.raise_for_status = MagicMock()
+        with patch("netbox_librenms_plugin.librenms_api.requests.get", return_value=fake_response):
+            success, data = mock_librenms_api.get_port_stack(5)
+
+        assert success is False
+        assert "LibreNMS reported an error fetching port stack" in data
+
+    def test_returns_error_on_invalid_json(self, mock_librenms_api):
+        """A non-JSON body (response.json() raises ValueError) must surface as (False, error) instead of letting the exception escape."""
+        from unittest.mock import MagicMock, patch
+
+        fake_response = MagicMock()
+        fake_response.raise_for_status = MagicMock()
+        fake_response.json.side_effect = ValueError("Expecting value: line 1 column 1 (char 0)")
+        with patch("netbox_librenms_plugin.librenms_api.requests.get", return_value=fake_response):
+            success, data = mock_librenms_api.get_port_stack(5)
+
+        assert success is False
+        assert "Invalid JSON" in data
+
+    def test_json_decode_error_reports_invalid_json_not_connection_error(self, mock_librenms_api):
+        """requests.exceptions.JSONDecodeError subclasses BOTH ValueError and RequestException, so the ValueError handler must precede the RequestException handler — otherwise a JSON decode failure is swallowed by the broad handler and mislabeled 'Error connecting to LibreNMS'."""
+        from unittest.mock import MagicMock, patch
+
+        import requests as _requests
+
+        fake_response = MagicMock()
+        fake_response.raise_for_status = MagicMock()
+        fake_response.json.side_effect = _requests.exceptions.JSONDecodeError("Expecting value", "", 0)
+        with patch("netbox_librenms_plugin.librenms_api.requests.get", return_value=fake_response):
+            success, data = mock_librenms_api.get_port_stack(5)
+
+        assert success is False
+        assert "Invalid JSON" in data
+        assert "Error connecting" not in data
+
+    def test_malformed_mappings_fails_not_empty(self, mock_librenms_api):
+        """A non-list (or list-of-non-dicts) `mappings` is malformed, not 'no relationships'."""
+        from unittest.mock import MagicMock, patch
+
+        for bad in ({"mappings": {"oops": 1}}, {"mappings": ["not-a-dict", 2]}):
+            fake_response = MagicMock()
+            fake_response.raise_for_status = MagicMock()
+            fake_response.json.return_value = bad
+            with patch("netbox_librenms_plugin.librenms_api.requests.get", return_value=fake_response):
+                success, data = mock_librenms_api.get_port_stack(5)
+            assert success is False, f"{bad!r} should fail"
+            assert "mappings" in data
+
+    def test_non_object_payload_fails_not_empty(self, mock_librenms_api):
+        """A non-object top-level payload (list/string/null) is malformed, not 'no relationships'."""
+        from unittest.mock import MagicMock, patch
+
+        for bad in ([{"high_port_id": 1, "low_port_id": 2}], "oops", None):
+            fake_response = MagicMock()
+            fake_response.raise_for_status = MagicMock()
+            fake_response.json.return_value = bad
+            with patch("netbox_librenms_plugin.librenms_api.requests.get", return_value=fake_response):
+                success, data = mock_librenms_api.get_port_stack(5)
+            assert success is False, f"{bad!r} should fail"
+            assert "non-object" in data
+
+
+# =============================================================================
+# Fixture port data for resolve_port_relationships tests
+# =============================================================================
+
+# Fixture port data for resolve_port_relationships tests
+NOKIA_PORTS = [
+    {"port_id": 101, "ifName": "1/1/c1/1", "ifType": "ethernetCsmacd"},
+    {"port_id": 102, "ifName": "lag-1", "ifType": "ieee8023adLag"},
+]
+NOKIA_PORT_STACK = [
+    {"high_port_id": 101, "low_port_id": 102},  # valid LAG membership
+    {"high_port_id": 102, "low_port_id": 200},  # low_id 200 not in ports (missing = skip)
+]
+NOKIA_SAP_PORTS = [
+    {"port_id": 101, "ifName": "1/1/c1/1", "ifType": "ethernetCsmacd"},
+    {"port_id": 102, "ifName": "lag-1", "ifType": "ieee8023adLag"},
+    {"port_id": 200, "ifName": "lag1:0", "ifType": "ipForward"},  # SAP entry with colon
+]
+NOKIA_SAP_PORT_STACK = [
+    {"high_port_id": 101, "low_port_id": 102},  # valid LAG
+    {"high_port_id": 102, "low_port_id": 200},  # SAP: should be excluded
+]
+JUNOS_PORTS = [
+    {"port_id": 201, "ifName": "xe-0/0/0", "ifType": "ethernetCsmacd"},
+    {"port_id": 202, "ifName": "xe-0/0/0.0", "ifType": "propVirtual"},
+    {"port_id": 203, "ifName": "ae1", "ifType": "ieee8023adLag"},
+    {"port_id": 204, "ifName": "ae1.0", "ifType": "ieee8023adLag"},
+    {"port_id": 205, "ifName": "ae10", "ifType": "ieee8023adLag"},
+    {"port_id": 206, "ifName": "ae10.2221", "ifType": "l2vlan"},
+]
+JUNOS_PORT_STACK = [
+    {"high_port_id": 202, "low_port_id": 204},  # xe-0/0/0.0 -> ae1.0 resolves to xe-0/0/0 in ae1
+    {"high_port_id": 205, "low_port_id": 206},  # ae10 -> ae10.2221 (sub-interface)
+]
+CISCO_IOS_PORTS = [
+    {"port_id": 301, "ifName": "Te1/1", "ifType": "ethernetCsmacd"},
+    {"port_id": 302, "ifName": "Po10", "ifType": "propVirtual"},  # IOS port-channel
+    {"port_id": 303, "ifName": "Po10.100", "ifType": "l2vlan"},
+]
+CISCO_IOS_PORT_STACK = [
+    {"high_port_id": 301, "low_port_id": 302},  # LAG membership
+    {"high_port_id": 302, "low_port_id": 303},  # sub-interface
+]
+ARCOS_PORTS = [
+    {"port_id": 401, "ifName": "swp4", "ifType": "ethernetCsmacd"},
+    {"port_id": 402, "ifName": "bond1", "ifType": "ieee8023adLag"},
+    {"port_id": 403, "ifName": "swp15", "ifType": "ethernetCsmacd"},
+    {"port_id": 404, "ifName": "swp15.3", "ifType": "ethernetCsmacd"},  # sub-if, not propVirtual
+]
+ARCOS_PORT_STACK = [
+    {"high_port_id": 401, "low_port_id": 402},  # LAG membership
+    {"high_port_id": 403, "low_port_id": 404},  # sub-interface
+]
+
+
+# =============================================================================
+# Test Class: resolve_port_relationships()
+# =============================================================================
+
+
+@pytest.fixture
+def ios_lag_patterns():
+    """LAG patterns dict for Cisco IOS (propVirtual LAGs identified by name)."""
+    return {"ios": r"^Po\d+$"}
+
+
+class TestResolvePortRelationships:
+    """Tests for LibreNMSAPI.resolve_port_relationships()."""
+
+    def test_resolves_a_verbatim_live_port_stack_entry(self, mock_librenms_api):
+        """A port_stack entry exactly as a live LibreNMS returns it must resolve.
+
+        Pinned to a real response, not a hand-written one: LibreNMS serves the ports_stack rows
+        verbatim, so an entry carries id/device_id/high_ifIndex/high_port_id/low_ifIndex/
+        low_port_id/ifStackStatus. The API docs advertise port_id_high/port_id_low instead, and
+        every synthetic fixture in this file once used that spelling, so production and its tests
+        agreed on a shape no server sends and every relationship resolved to nothing.
+        """
+        ports = [
+            {"port_id": 6477, "ifName": "em0", "ifType": "ethernetCsmacd"},
+            {"port_id": 6482, "ifName": "em0.0", "ifType": "propVirtual"},
+        ]
+        live_entry = {
+            "id": 2795,
+            "device_id": 15,
+            "high_ifIndex": 17,
+            "high_port_id": 6477,
+            "low_ifIndex": 18,
+            "low_port_id": 6482,
+            "ifStackStatus": "active",
+        }
+
+        result = mock_librenms_api.resolve_port_relationships(ports, [live_entry], lag_patterns={})
+
+        assert result["sub_interfaces"] == {6482: 6477}
+
+    def test_unrecognized_port_stack_shape_is_logged(self, mock_librenms_api, caplog):
+        """An entry carrying neither id key must warn, not silently drop every relationship."""
+        ports = [{"port_id": 1, "ifName": "eth0", "ifType": "ethernetCsmacd"}]
+        with caplog.at_level("WARNING"):
+            result = mock_librenms_api.resolve_port_relationships(
+                ports, [{"port_id_high": 1, "port_id_low": 2}], lag_patterns={}
+            )
+        assert result == {"lag_members": {}, "sub_interfaces": {}}
+        assert any("Unrecognized port_stack entry shape" in r.getMessage() for r in caplog.records)
+
+    def test_nokia_lag_membership(self, mock_librenms_api):
+        """Nokia: high=physical, low=lag-1 (ieee8023adLag) -> member in lag_members."""
+        result = mock_librenms_api.resolve_port_relationships(NOKIA_PORTS, NOKIA_PORT_STACK[:1], lag_patterns={})
+        assert result["lag_members"] == {101: 102}
+        assert result["sub_interfaces"] == {}
+
+    def test_nameless_lag_aggregate_resolved_by_iftype(self, mock_librenms_api):
+        """A nameless aggregate (ifType=ieee8023adLag, empty ifName/ifDescr) still resolves via ifType.
+
+        ifType alone authoritatively classifies a LAG aggregate, so a valid port_id with no name must
+        stay in the by_id lookup — otherwise the port_stack pair referencing it is skipped and the
+        member's LAG membership is silently dropped.
+        """
+        ports = [
+            {"port_id": 201, "ifName": "1/1/c1/1", "ifType": "ethernetCsmacd"},
+            {"port_id": 202, "ifName": "", "ifDescr": "", "ifType": "ieee8023adLag"},  # nameless aggregate
+        ]
+        port_stack = [{"high_port_id": 201, "low_port_id": 202}]
+        result = mock_librenms_api.resolve_port_relationships(ports, port_stack, lag_patterns={})
+        assert result["lag_members"] == {201: 202}
+
+    @pytest.mark.parametrize(
+        "port_stack",
+        [
+            [
+                {"high_port_id": 10, "low_port_id": 100},
+                {"high_port_id": 10, "low_port_id": 200},
+            ],
+            [
+                {"high_port_id": 10, "low_port_id": 200},
+                {"high_port_id": 10, "low_port_id": 100},
+            ],
+        ],
+    )
+    def test_conflicting_lag_targets_are_dropped_regardless_of_input_order(self, mock_librenms_api, port_stack):
+        ports = [
+            {"port_id": 10, "ifName": "Ethernet1", "ifType": "ethernetCsmacd"},
+            {"port_id": 100, "ifName": "Port-Channel1", "ifType": "ieee8023adLag"},
+            {"port_id": 200, "ifName": "Port-Channel2", "ifType": "ieee8023adLag"},
+        ]
+
+        result = mock_librenms_api.resolve_port_relationships(ports, port_stack, lag_patterns={})
+
+        assert result["lag_members"] == {}
+
+    def test_subinterface_resolved_from_ifdescr_mode(self, mock_librenms_api):
+        """On an ifDescr-mode device the sub-unit name lives in ifDescr (ifName empty); the resolver must still pair child -> parent instead of dropping both ports (which only matched ifName before)."""
+        ports = [
+            {"port_id": 1, "ifName": "", "ifDescr": "ge-0/0/0", "ifType": "ethernetCsmacd"},
+            {"port_id": 2, "ifName": "", "ifDescr": "ge-0/0/0.100", "ifType": "l3ipvlan"},
+        ]
+        port_stack = [{"high_port_id": 2, "low_port_id": 1}]
+        result = mock_librenms_api.resolve_port_relationships(
+            ports, port_stack, lag_patterns={}, interface_name_field="ifDescr"
+        )
+        assert result["sub_interfaces"] == {2: 1}
+
+    def test_lag_aggregate_matched_from_ifdescr_name_pattern(self, mock_librenms_api):
+        """A name-pattern LAG aggregate whose name lives in ifDescr (ifName empty) is still detected via the ifDescr fallback."""
+        ports = [
+            {"port_id": 11, "ifName": "", "ifDescr": "Gi0/1", "ifType": "ethernetCsmacd"},
+            {"port_id": 12, "ifName": "", "ifDescr": "Po1", "ifType": "propVirtual"},
+        ]
+        port_stack = [{"high_port_id": 11, "low_port_id": 12}]
+        # low (Po1) is the aggregate via the configured pattern; member -> aggregate.
+        result = mock_librenms_api.resolve_port_relationships(
+            ports, port_stack, lag_patterns={"ios": r"^Po\d+$"}, interface_name_field="ifDescr"
+        )
+        assert result["lag_members"] == {11: 12}
+
+    def test_string_port_stack_ids_match_int_port_ids(self, mock_librenms_api):
+        """String high_port_id/low_port_id values must match integer port records and vice versa."""
+        # NOKIA_PORTS carries int port_ids 101/102; reference them as strings in the stack.
+        str_stack = [{"high_port_id": "101", "low_port_id": "102"}]
+        result = mock_librenms_api.resolve_port_relationships(NOKIA_PORTS, str_stack, lag_patterns={})
+        assert result["lag_members"] == {101: 102}
+        # And the inverse: int stack ids against str port_ids. The map is normalized at the
+        # source (normalize_librenms_port_id), so the result is canonical ints regardless of
+        # whether the port records carried str or int port_ids — consumers never juggle types.
+        str_ports = [
+            {"port_id": "101", "ifName": "1/1/c1/1", "ifType": "ethernetCsmacd"},
+            {"port_id": "102", "ifName": "lag-1", "ifType": "ieee8023adLag"},
+        ]
+        result = mock_librenms_api.resolve_port_relationships(
+            str_ports, [{"high_port_id": 101, "low_port_id": 102}], lag_patterns={}
+        )
+        assert result["lag_members"] == {101: 102}
+
+    def test_padded_port_ids_match_canonical_stack_ids(self, mock_librenms_api):
+        ports = [
+            {"port_id": "0101", "ifName": "1/1/c1/1", "ifType": "ethernetCsmacd"},
+            {"port_id": "00102", "ifName": "lag-1", "ifType": "ieee8023adLag"},
+        ]
+
+        result = mock_librenms_api.resolve_port_relationships(
+            ports,
+            [{"high_port_id": 101, "low_port_id": 102}],
+            lag_patterns={},
+        )
+
+        assert result["lag_members"] == {101: 102}
+
+    def test_duplicate_canonical_port_ids_make_that_endpoint_ambiguous(self, mock_librenms_api):
+        ports = [
+            {"port_id": 101, "ifName": "Ethernet1", "ifType": "ethernetCsmacd"},
+            {"port_id": "00101", "ifName": "Ethernet2", "ifType": "ethernetCsmacd"},
+            {"port_id": 102, "ifName": "lag-1", "ifType": "ieee8023adLag"},
+        ]
+
+        result = mock_librenms_api.resolve_port_relationships(
+            ports,
+            [{"high_port_id": 101, "low_port_id": 102}],
+            lag_patterns={},
+        )
+
+        assert result["lag_members"] == {}
+
+    def test_sub_interface_ids_use_port_record_types_not_stack(self, mock_librenms_api):
+        """sub_interfaces must store canonical normalized port_ids (like the LAG branch), not the raw port_stack ids."""
+        # Ports carry STRING port_ids; the stack references them as INTs.
+        str_ports = [
+            {"port_id": "205", "ifName": "ae10", "ifType": "ieee8023adLag"},
+            {"port_id": "206", "ifName": "ae10.2221", "ifType": "l2vlan"},
+        ]
+        int_stack = [{"high_port_id": 205, "low_port_id": 206}]
+        result = mock_librenms_api.resolve_port_relationships(str_ports, int_stack, lag_patterns={})
+        # Canonical normalized ids (port-record-derived, not the stack ids): str port_ids are
+        # normalized to ints at the source so the map is self-consistent for every consumer.
+        assert result["sub_interfaces"] == {206: 205}
+
+    def test_nokia_sap_excluded_when_colon_in_name(self, mock_librenms_api):
+        """Nokia SAP entries (colon in name) must be excluded from output."""
+        result = mock_librenms_api.resolve_port_relationships(NOKIA_SAP_PORTS, NOKIA_SAP_PORT_STACK, lag_patterns={})
+        assert result["lag_members"] == {101: 102}
+        assert 200 not in result["lag_members"].values()
+
+    def test_nokia_sap_excluded_when_colon_only_in_ifname_ifdescr_mode(self, mock_librenms_api):
+        """On an ifDescr-mode device a SAP port can carry a clean ifDescr (the primary name) but the real lag1:0 marker in ifName; the colon check must scan ALL names, not just the primary, or the SAP row is misclassified as a LAG member."""
+        ports = [
+            {"port_id": 101, "ifName": "1/1/c1/1", "ifDescr": "phys-1", "ifType": "ethernetCsmacd"},
+            {"port_id": 102, "ifName": "lag-1", "ifDescr": "agg-1", "ifType": "ieee8023adLag"},
+            # SAP entry: clean ifDescr (the primary in this mode), colon only in ifName.
+            {"port_id": 200, "ifName": "lag1:0", "ifDescr": "sap-clean", "ifType": "ipForward"},
+        ]
+        port_stack = [
+            {"high_port_id": 101, "low_port_id": 102},  # genuine LAG membership
+            {"high_port_id": 200, "low_port_id": 102},  # SAP row: must be skipped
+        ]
+        result = mock_librenms_api.resolve_port_relationships(
+            ports, port_stack, lag_patterns={}, interface_name_field="ifDescr"
+        )
+        assert result["lag_members"] == {101: 102}
+        assert 200 not in result["lag_members"]
+
+    def test_junos_sub_unit_stripping(self, mock_librenms_api):
+        """Junos: xe-0/0/0.0 -> ae1.0 pair strips to xe-0/0/0 member of ae1."""
+        result = mock_librenms_api.resolve_port_relationships(JUNOS_PORTS, JUNOS_PORT_STACK[:1], lag_patterns={})
+        assert result["lag_members"].get(201) == 203
+
+    def test_junos_ae_sub_interface(self, mock_librenms_api):
+        """Junos: ae10 -> ae10.2221 detected as sub-interface."""
+        result = mock_librenms_api.resolve_port_relationships(JUNOS_PORTS, JUNOS_PORT_STACK[1:], lag_patterns={})
+        assert result["sub_interfaces"] == {206: 205}
+
+    def test_sub_interface_detected_via_ifname_when_namefield_is_ifdescr(self, mock_librenms_api):
+        """With interface_name_field='ifDescr', a clean ifDescr must not hide the .N sub-unit that ifName carries."""
+        ports = [
+            # Parent: ifName xe-0/0/0, but ifDescr (the primary in this mode) is a clean unrelated label.
+            {"port_id": 401, "ifName": "xe-0/0/0", "ifDescr": "uplink-core", "ifType": "ethernetCsmacd"},
+            # Child: the .N marker lives in ifName; its ifDescr is NOT a sub-unit of the parent's ifDescr.
+            {"port_id": 402, "ifName": "xe-0/0/0.100", "ifDescr": "vlan-100-svc", "ifType": "l2vlan"},
+        ]
+        port_stack = [{"high_port_id": 401, "low_port_id": 402}]
+        result = mock_librenms_api.resolve_port_relationships(
+            ports, port_stack, lag_patterns={}, interface_name_field="ifDescr"
+        )
+        # The ifDescr primaries have no .N relationship; only ifName does. A primary-only check (the
+        # old behaviour) scanned ifDescr alone and left sub_interfaces empty — child 402 -> parent 401.
+        assert result["sub_interfaces"] == {402: 401}
+
+    def test_lag_physical_resolution_uses_ifname_when_namefield_is_ifdescr(self, mock_librenms_api):
+        """LAG physical resolution must scan ifName for the .N structure in ifDescr mode, not just the primary name."""
+        # With interface_name_field='ifDescr' the structured xe-/ae- name can live in ifName while
+        # the primary (ifDescr) is an arbitrary label. A primary-only check leaves the Junos logical
+        # units uncollapsed and binds the wrong (logical) ports: 202 -> 204 instead of 201 -> 203.
+        ports = [
+            # Physical member + its logical unit. The .N structure is in ifName; ifDescr (the
+            # primary in this mode) is an arbitrary label with no dotted relationship.
+            {"port_id": 201, "ifName": "xe-0/0/0", "ifDescr": "member-phys", "ifType": "ethernetCsmacd"},
+            {"port_id": 202, "ifName": "xe-0/0/0.0", "ifDescr": "member-unit", "ifType": "l2vlan"},
+            # Aggregate + its logical unit, likewise structured only in ifName.
+            {"port_id": 203, "ifName": "ae1", "ifDescr": "bundle-core", "ifType": "ieee8023adLag"},
+            {"port_id": 204, "ifName": "ae1.0", "ifDescr": "bundle-unit", "ifType": "l2vlan"},
+        ]
+        # ifStack relates the LOGICAL units (their ifDescr primaries are arbitrary labels).
+        port_stack = [{"high_port_id": 204, "low_port_id": 202}]
+        result = mock_librenms_api.resolve_port_relationships(
+            ports, port_stack, lag_patterns={"junos": r"^ae\d"}, interface_name_field="ifDescr"
+        )
+        # Both sides collapse to their physical ports via the ifName .N suffix: member 201 -> ae1 203.
+        assert result["lag_members"] == {201: 203}
+        # The uncollapsed logical member must NOT be the one bound.
+        assert 202 not in result["lag_members"]
+
+    def test_cisco_ios_lag_via_name_pattern(self, mock_librenms_api, ios_lag_patterns):
+        """Cisco IOS: Po10 has propVirtual type but is a LAG via name pattern."""
+        result = mock_librenms_api.resolve_port_relationships(
+            CISCO_IOS_PORTS, CISCO_IOS_PORT_STACK[:1], lag_patterns=ios_lag_patterns
+        )
+        assert result["lag_members"] == {301: 302}
+
+    def test_non_numeric_dotted_suffix_not_stripped_to_base(self, mock_librenms_api):
+        """A dotted interface name with a NON-numeric suffix is a legitimate physical name, not a Junos sub-unit (.N), and must NOT be remapped to its base port during LAG physical-resolution."""
+        ports = [
+            {"port_id": 301, "ifName": "xe-0/0/0", "ifType": "ethernetCsmacd"},  # the base port
+            {"port_id": 302, "ifName": "xe-0/0/0.foo", "ifType": "ethernetCsmacd"},  # non-numeric suffix
+            {"port_id": 303, "ifName": "ae1", "ifType": "ieee8023adLag"},
+        ]
+        stack = [{"high_port_id": 303, "low_port_id": 302}]  # ae1 <- xe-0/0/0.foo
+        result = mock_librenms_api.resolve_port_relationships(ports, stack, lag_patterns={})
+        # The member is the actual port 302, NOT the base 301 (which the old .N-agnostic strip
+        # would have wrongly resolved "xe-0/0/0.foo" to).
+        assert result["lag_members"] == {302: 303}
+        assert 301 not in result["lag_members"]
+
+    def test_cisco_ios_sub_interface(self, mock_librenms_api, ios_lag_patterns):
+        """Cisco IOS: Po10 -> Po10.100 detected as sub-interface."""
+        result = mock_librenms_api.resolve_port_relationships(
+            CISCO_IOS_PORTS, CISCO_IOS_PORT_STACK[1:], lag_patterns=ios_lag_patterns
+        )
+        assert result["sub_interfaces"] == {303: 302}
+
+    def test_arcos_lag_membership(self, mock_librenms_api):
+        """ArcOS: swp4 member of bond1 (ieee8023adLag)."""
+        result = mock_librenms_api.resolve_port_relationships(ARCOS_PORTS, ARCOS_PORT_STACK[:1], lag_patterns={})
+        assert result["lag_members"] == {401: 402}
+
+    def test_arcos_sub_interface_ethernetcsmacd(self, mock_librenms_api):
+        """ArcOS: swp15.3 sub-interface of swp15 (both ethernetCsmacd -- not propVirtual)."""
+        result = mock_librenms_api.resolve_port_relationships(ARCOS_PORTS, ARCOS_PORT_STACK[1:], lag_patterns={})
+        assert result["sub_interfaces"] == {404: 403}
+
+    def test_sub_interface_detected_when_parent_is_low(self, mock_librenms_api):
+        """Sub-interface parenting is position-independent: a pair emitted child=high/parent=low must resolve, not fall through to the LAG branch and get dropped by the self-reference guard."""
+        ports = [
+            {"port_id": 601, "ifName": "Gi0/1", "ifType": "ethernetCsmacd"},  # parent
+            {"port_id": 602, "ifName": "Gi0/1.100", "ifType": "l2vlan"},  # sub-interface child
+        ]
+        # Reverse ordering: the child (Gi0/1.100) is the HIGH side, the parent (Gi0/1) the LOW.
+        # The forward-only check (l_name.startswith(h_name + '.')) misses this; the reverse
+        # check must catch it. Map is child -> parent.
+        reverse_stack = [{"high_port_id": 602, "low_port_id": 601}]
+        result = mock_librenms_api.resolve_port_relationships(ports, reverse_stack, lag_patterns={})
+        assert result["sub_interfaces"] == {602: 601}
+        # And the forward ordering still resolves identically (child stays the map key).
+        forward_stack = [{"high_port_id": 601, "low_port_id": 602}]
+        result = mock_librenms_api.resolve_port_relationships(ports, forward_stack, lag_patterns={})
+        assert result["sub_interfaces"] == {602: 601}
+
+    @pytest.mark.parametrize(
+        ("high_id", "low_id"),
+        [
+            (1, 2),
+            (2, 1),
+        ],
+    )
+    def test_conflicting_sub_interface_directions_are_dropped(self, mock_librenms_api, high_id, low_id):
+        ports = [
+            {
+                "port_id": 1,
+                "ifName": "Eth1.1",
+                "ifDescr": "service",
+                "ifType": "l2vlan",
+            },
+            {
+                "port_id": 2,
+                "ifName": "Eth1",
+                "ifDescr": "service.1",
+                "ifType": "ethernetCsmacd",
+            },
+        ]
+        port_stack = [{"high_port_id": high_id, "low_port_id": low_id}]
+
+        result = mock_librenms_api.resolve_port_relationships(ports, port_stack, lag_patterns={})
+
+        assert result["sub_interfaces"] == {}
+
+    def test_both_aggregate_disambiguated_by_structural_iftype(self, mock_librenms_api):
+        """A too-broad name pattern that matches the member too marks both sides as aggregates; the structural ieee8023adLag signal must break the tie instead of dropping the membership."""
+        ports = [
+            {"port_id": 701, "ifName": "bond0", "ifType": "ieee8023adLag"},  # the real aggregate
+            {"port_id": 702, "ifName": "bond0-slave", "ifType": "ethernetCsmacd"},  # member
+        ]
+        stack = [{"high_port_id": 702, "low_port_id": 701}]
+        # 'bond' (unanchored) matches BOTH bond0 and bond0-slave, so name-matching alone makes
+        # both look like aggregates. The aggregate is the one whose ifType is ieee8023adLag.
+        broad = {"linux": r"bond"}
+        result = mock_librenms_api.resolve_port_relationships(ports, stack, lag_patterns=broad)
+        assert result["lag_members"] == {702: 701}
+
+    def test_both_aggregate_ambiguous_is_skipped(self, mock_librenms_api):
+        """When both sides name-match AND neither is structurally ieee8023adLag, the aggregate is genuinely ambiguous, so no (possibly wrong) membership is guessed."""
+        ports = [
+            {"port_id": 711, "ifName": "bond0", "ifType": "ethernetCsmacd"},
+            {"port_id": 712, "ifName": "bond0-slave", "ifType": "ethernetCsmacd"},
+        ]
+        stack = [{"high_port_id": 712, "low_port_id": 711}]
+        broad = {"linux": r"bond"}
+        result = mock_librenms_api.resolve_port_relationships(ports, stack, lag_patterns=broad)
+        assert result["lag_members"] == {}
+
+    def test_empty_port_stack_returns_empty_maps(self, mock_librenms_api):
+        """Empty port_stack returns empty dicts."""
+        result = mock_librenms_api.resolve_port_relationships(NOKIA_PORTS, [], lag_patterns={})
+        assert result == {"lag_members": {}, "sub_interfaces": {}}
+
+    def test_missing_port_ids_are_skipped(self, mock_librenms_api):
+        """Entries where high_port_id or low_port_id is absent from ports list are skipped."""
+        stack = [{"high_port_id": 9999, "low_port_id": 101}]
+        result = mock_librenms_api.resolve_port_relationships(NOKIA_PORTS, stack, lag_patterns={})
+        assert result["lag_members"] == {}
+
+    def test_non_dict_port_entries_are_skipped(self, mock_librenms_api):
+        """A malformed (non-dict) entry in `ports` must not crash resolution; valid pairs still resolve."""
+        ports = [None, "oops", 42, *NOKIA_PORTS]
+        result = mock_librenms_api.resolve_port_relationships(ports, NOKIA_PORT_STACK[:1], lag_patterns={})
+        assert result["lag_members"] == {101: 102}
+
+    def test_non_string_ifname_does_not_crash_and_resolves_by_iftype(self, mock_librenms_api):
+        """A non-string ifName must not crash the downstream string ops; membership still resolves by ifType.
+
+        The member's malformed name is irrelevant to LAG classification — the aggregate (502) is
+        authoritatively a LAG via ifType, and the port_stack pairs 501 to it — so the membership
+        resolves. The no-crash guarantee holds because every name op iterates _port_names (which
+        skips the non-string), never the raw ifName.
+        """
+        ports = [
+            {"port_id": 501, "ifName": 12345, "ifType": "ethernetCsmacd"},  # malformed: non-string
+            {"port_id": 502, "ifName": "lag9", "ifType": "ieee8023adLag"},
+        ]
+        stack = [{"high_port_id": 501, "low_port_id": 502}]
+        result = mock_librenms_api.resolve_port_relationships(ports, stack, lag_patterns={})
+        assert result == {"lag_members": {501: 502}, "sub_interfaces": {}}
+
+    @pytest.mark.django_db
+    def test_db_patterns_scoped_to_device_os(self, mock_librenms_api):
+        """With device_os set, only that OS's stored pattern is loaded — a pattern from a different platform must not classify this device's interfaces (the round-12 finding)."""
+        from netbox_librenms_plugin.models import PortStackLagPattern
+
+        PortStackLagPattern.objects.create(librenms_os="ztest_pochannel", lag_name_pattern=r"^Po\d+$")
+        PortStackLagPattern.objects.create(librenms_os="ztest_bond", lag_name_pattern=r"^bond\d+$")
+
+        # device_os matches the Po-channel pattern → Po10 (propVirtual) classified as a LAG.
+        scoped = mock_librenms_api.resolve_port_relationships(
+            CISCO_IOS_PORTS, CISCO_IOS_PORT_STACK[:1], device_os="ztest_pochannel"
+        )
+        assert scoped["lag_members"] == {301: 302}
+
+        # device_os scopes to the bond pattern only; Po10 is not matched → no LAG.
+        other = mock_librenms_api.resolve_port_relationships(
+            CISCO_IOS_PORTS, CISCO_IOS_PORT_STACK[:1], device_os="ztest_bond"
+        )
+        assert other["lag_members"] == {}
+
+    @pytest.mark.django_db
+    def test_db_patterns_unscoped_when_no_device_os(self, mock_librenms_api):
+        """Without device_os, every stored pattern is loaded (legacy behaviour)."""
+        from netbox_librenms_plugin.models import PortStackLagPattern
+
+        # Migration 0013 seeds ios/iosxe with ^Po\d+$, which already classifies Po10. Use a name
+        # no seeded row can match, so only the unscoped load of every stored pattern explains it.
+        PortStackLagPattern.objects.create(librenms_os="ztest_zagg", lag_name_pattern=r"^Zagg\d+$")
+        ports = [
+            {"port_id": 801, "ifName": "Te1/1", "ifType": "ethernetCsmacd"},
+            {"port_id": 802, "ifName": "Zagg7", "ifType": "propVirtual"},
+        ]
+
+        result = mock_librenms_api.resolve_port_relationships(ports, [{"high_port_id": 801, "low_port_id": 802}])
+        assert result["lag_members"] == {801: 802}
+
+    @pytest.mark.django_db
+    def test_db_patterns_non_string_device_os_disables_name_patterns(self, mock_librenms_api):
+        """A present-but-unusable device_os (LibreNMS can return ``os`` as a number) must not crash on ``.strip()`` AND must DISABLE name-pattern matching — falling back to every stored vendor regex would re-globalize them. Only an OMITTED os (None) is unscoped."""
+        from netbox_librenms_plugin.models import PortStackLagPattern
+
+        PortStackLagPattern.objects.create(librenms_os="ztest_pochannel", lag_name_pattern=r"^Po\d+$")
+
+        # device_os=123 (int) would raise AttributeError on device_os.strip() before the original fix;
+        # now it must fail closed (no name-pattern LAG match) rather than load every pattern.
+        result = mock_librenms_api.resolve_port_relationships(CISCO_IOS_PORTS, CISCO_IOS_PORT_STACK[:1], device_os=123)
+        assert result["lag_members"] == {}  # name-pattern matching disabled for a malformed os
+
+    def test_invalid_lag_pattern_is_skipped_and_logged(self, mock_librenms_api, caplog):
+        """A configured LAG pattern that isn't valid regex is skipped (it must not crash relationship resolution) AND logged at WARNING — otherwise a user with a typo in their PortStackLagPattern has no way to tell why LAG detection silently isn't working for that OS."""
+        import logging
+
+        bad = "([unterminated"  # invalid regex → re.error on compile
+        with caplog.at_level(logging.WARNING, logger="netbox_librenms_plugin.librenms_api"):
+            result = mock_librenms_api.resolve_port_relationships(
+                NOKIA_PORTS, NOKIA_PORT_STACK[:1], lag_patterns={"junos": bad}
+            )
+        # Resolution still completes: the LAG is matched structurally (ieee8023adLag ifType),
+        # independent of the broken name pattern.
+        assert result["lag_members"] == {101: 102}
+        # The invalid pattern was reported at WARNING, naming the offending pattern string.
+        warnings = [r for r in caplog.records if r.levelno == logging.WARNING]
+        assert any(bad in r.getMessage() for r in warnings)
+
+    def test_non_string_lag_pattern_is_skipped_not_crashed(self, mock_librenms_api, caplog):
+        """A non-string value in the explicit lag_patterns dict is skipped, not crashed: re.compile raises TypeError (not re.error), so unlike the DB-backed path (strings guaranteed) it must be caught too."""
+        import logging
+
+        # None (or any non-string) → re.compile raises TypeError, not re.error. Before the fix this
+        # propagated out of resolve_port_relationships and crashed the whole refresh.
+        with caplog.at_level(logging.WARNING, logger="netbox_librenms_plugin.librenms_api"):
+            result = mock_librenms_api.resolve_port_relationships(
+                NOKIA_PORTS, NOKIA_PORT_STACK[:1], lag_patterns={"junos": None}
+            )
+        # Resolution still completes via structural (ieee8023adLag) detection; the bad value skipped.
+        assert result["lag_members"] == {101: 102}
+        warnings = [r for r in caplog.records if r.levelno == logging.WARNING]
+        assert any("None" in r.getMessage() for r in warnings)
+
+    def test_ambiguous_shared_name_is_not_indexed_to_either_port(self, mock_librenms_api):
+        """A name carried by two different ports indexes neither, so a duplicate label can't hijack the base-name lookup and bind a sub-unit's LAG membership onto the wrong aggregate."""
+        ports = [
+            {"port_id": 201, "ifName": "xe-0/0/0", "ifType": "ethernetCsmacd"},  # physical member
+            {"port_id": 203, "ifName": "ae1", "ifType": "ieee8023adLag"},  # the REAL ae1 aggregate
+            {"port_id": 204, "ifName": "ae1.0", "ifType": "ieee8023adLag"},  # sub-unit of ae1
+            # A DIFFERENT aggregate whose ifDescr coincidentally equals "ae1" (ifName mode still
+            # indexes ifDescr). Processed last, so last-write-wins would point by_name["ae1"] HERE.
+            {"port_id": 999, "ifName": "ae99", "ifDescr": "ae1", "ifType": "ieee8023adLag"},
+        ]
+        port_stack = [{"high_port_id": 201, "low_port_id": 204}]  # xe-0/0/0 <-> ae1.0
+        result = mock_librenms_api.resolve_port_relationships(ports, port_stack, lag_patterns={})
+        # The ifName base resolves to the real aggregate 203. The unrelated ifDescr on 999 does
+        # not make the ifName lookup ambiguous and cannot hijack the edge.
+        assert 999 not in result["lag_members"].values()
+        assert result["lag_members"] == {201: 203}
+
+    def test_physical_resolution_does_not_cross_interface_name_fields(self, mock_librenms_api):
+        """A base name in ifName must not resolve through another port's ifDescr."""
+        ports = [
+            {"port_id": 201, "ifName": "xe-0/0/0", "ifType": "ethernetCsmacd"},
+            {"port_id": 204, "ifName": "ae1.0", "ifType": "l2vlan"},
+            {
+                "port_id": 999,
+                "ifName": "ae99",
+                "ifDescr": "ae1",
+                "ifType": "ieee8023adLag",
+            },
+        ]
+        port_stack = [{"high_port_id": 201, "low_port_id": 204}]
+
+        result = mock_librenms_api.resolve_port_relationships(
+            ports,
+            port_stack,
+            lag_patterns={"junos": r"^ae\d"},
+            interface_name_field="ifDescr",
+        )
+
+        assert 999 not in result["lag_members"].values()
+        assert result["lag_members"] == {201: 204}
diff --git a/netbox_librenms_plugin/tests/test_librenms_id.py b/netbox_librenms_plugin/tests/test_librenms_id.py
index 84fca7d165..c58d1a7c96 100644
--- a/netbox_librenms_plugin/tests/test_librenms_id.py
+++ b/netbox_librenms_plugin/tests/test_librenms_id.py
@@ -136,6 +136,24 @@ def test_finds_each_storage_shape(self):
         legacy_str = _dev("42")
         assert find_by_librenms_id(Device, 42, "anyserver") == legacy_str
 
+    @pytest.mark.parametrize(
+        ("shape", "server_key"),
+        [
+            ({"default": "0042"}, "default"),
+            ({"default": {"id": " +42 "}}, "default"),
+            ({"default": {"id": 1, "oob": {"id": "0042"}}}, "default"),
+            (" 0042 ", "anyserver"),
+        ],
+    )
+    def test_integer_lookup_finds_every_accepted_numeric_string(self, shape, server_key):
+        from dcim.models import Device
+
+        from netbox_librenms_plugin.utils import find_by_librenms_id
+
+        device = _dev(shape)
+
+        assert find_by_librenms_id(Device, 42, server_key) == device
+
     def test_librenms_id_q_resolves_each_storage_shape(self):
         """cables_view._librenms_id_q (sharing build_librenms_id_qs with find_by_librenms_id) must resolve the same storage shapes — including the OOB sub-id — so the two can't drift apart."""
         from dcim.models import Device
diff --git a/netbox_librenms_plugin/tests/test_mappings_tables.py b/netbox_librenms_plugin/tests/test_mappings_tables.py
new file mode 100644
index 0000000000..da3e1f4d31
--- /dev/null
+++ b/netbox_librenms_plugin/tests/test_mappings_tables.py
@@ -0,0 +1,115 @@
+"""Selection-column config and bulk-export contract for the mapping tables."""
+
+import pytest
+
+
+@pytest.mark.django_db
+@pytest.mark.parametrize(
+    ("query", "expected_os"),
+    [
+        ("review-os-token", "review-os-token"),
+        ("ReviewPatternToken", "review-pattern-os"),
+        ("review description token", "review-description-os"),
+    ],
+)
+def test_port_stack_lag_pattern_searches_all_exposed_fields(query, expected_os):
+    """The list search filters OS, pattern, and description through its q field."""
+    from netbox_librenms_plugin.filters import PortStackLagPatternFilterSet
+    from netbox_librenms_plugin.models import PortStackLagPattern
+
+    PortStackLagPattern.objects.bulk_create(
+        [
+            PortStackLagPattern(
+                librenms_os="review-os-token",
+                lag_name_pattern=r"^ReviewOs\d+$",
+                description="OS field match",
+            ),
+            PortStackLagPattern(
+                librenms_os="review-pattern-os",
+                lag_name_pattern=r"^ReviewPatternToken\d+$",
+                description="Pattern field match",
+            ),
+            PortStackLagPattern(
+                librenms_os="review-description-os",
+                lag_name_pattern=r"^ReviewDescription\d+$",
+                description="Review description token",
+            ),
+        ]
+    )
+
+    filterset = PortStackLagPatternFilterSet({"q": query}, queryset=PortStackLagPattern.objects.all())
+
+    assert filterset.is_valid(), filterset.errors
+    assert list(filterset.qs.values_list("librenms_os", flat=True)) == [expected_os]
+
+
+@pytest.mark.django_db
+class TestPortStackLagPatternTableSelection:
+    """PortStackLagPatternTable's selection column must submit name='pk'."""
+
+    def test_selection_checkbox_submits_pk(self):
+        """The rendered selection checkbox uses name='pk' (what the generic/export views read), not 'select'."""
+        from django.contrib.auth.models import AnonymousUser
+        from django.test import RequestFactory
+        from django_tables2 import RequestConfig
+
+        from netbox_librenms_plugin.models import PortStackLagPattern
+        from netbox_librenms_plugin.tables.mappings import PortStackLagPatternTable
+
+        PortStackLagPattern.objects.create(librenms_os="seltestos", lag_name_pattern=r"^Po\d+$")
+        table = PortStackLagPatternTable(PortStackLagPattern.objects.all())
+        request = RequestFactory().get("/")
+        request.user = AnonymousUser()
+        RequestConfig(request).configure(table)
+
+        # Render only the selection cell so the actions column's URL resolution stays out of scope.
+        pk_cell = str(table.rows[0].get_cell("pk"))
+        assert 'name="pk"' in pk_cell
+        assert 'name="select"' not in pk_cell
+
+
+@pytest.mark.django_db
+class TestPortStackLagPatternBulkExportContract:
+    """BulkExportYAMLView reads getlist('pk'); the table must submit the same key."""
+
+    def _superuser(self):
+        from django.contrib.auth import get_user_model
+
+        user = get_user_model().objects.create_user(username="psl-exporter")
+        user.is_superuser = True
+        user.is_active = True
+        user.save()
+        return user
+
+    def test_export_returns_yaml_for_pk_selected_rows(self):
+        """A POST carrying the selected pks (name='pk') exports those rows as YAML."""
+        from django.test import RequestFactory
+
+        from netbox_librenms_plugin.models import PortStackLagPattern
+        from netbox_librenms_plugin.views.mapping_views import PortStackLagPatternBulkExportYAMLView
+
+        obj = PortStackLagPattern.objects.create(librenms_os="exportos", lag_name_pattern=r"^Po\d+$")
+        request = RequestFactory().post("/", {"pk": [str(obj.pk)]})
+        request.user = self._superuser()
+
+        response = PortStackLagPatternBulkExportYAMLView.as_view()(request)
+
+        assert response.status_code == 200
+        assert response["Content-Type"] == "text/yaml; charset=utf-8"
+        assert response["Content-Disposition"] == 'attachment; filename="export.yaml"'
+        assert "exportos" in response.content.decode()
+
+    def test_select_named_inputs_alone_export_nothing(self):
+        """The old table contract (name='select') submits a key the view never reads, so it exports nothing — proving the table must submit 'pk'."""
+        from django.test import RequestFactory
+
+        from netbox_librenms_plugin.models import PortStackLagPattern
+        from netbox_librenms_plugin.views.mapping_views import PortStackLagPatternBulkExportYAMLView
+
+        obj = PortStackLagPattern.objects.create(librenms_os="ignoredos", lag_name_pattern=r"^Po\d+$")
+        request = RequestFactory().post("/", {"select": [str(obj.pk)]})
+        request.user = self._superuser()
+
+        response = PortStackLagPatternBulkExportYAMLView.as_view()(request)
+
+        assert response.status_code == 400
diff --git a/netbox_librenms_plugin/tests/test_migration_state.py b/netbox_librenms_plugin/tests/test_migration_state.py
new file mode 100644
index 0000000000..ec758bd018
--- /dev/null
+++ b/netbox_librenms_plugin/tests/test_migration_state.py
@@ -0,0 +1,37 @@
+"""Guard against model/migration state drift for the plugin's own models."""
+
+import importlib
+
+
+def test_migration_0013_field_help_text_matches_model():
+    """Migration 0013's PortStackLagPattern fields must carry the same help_text as the model (else the migration state drifts and makemigrations tracks a phantom AlterField)."""
+    from netbox_librenms_plugin.models import PortStackLagPattern
+
+    # Migration modules start with a digit (not a valid identifier), so import by string.
+    mod = importlib.import_module("netbox_librenms_plugin.migrations.0013_portstacklagpattern")
+    create_op = next(
+        op
+        for op in mod.Migration.operations
+        if op.__class__.__name__ == "CreateModel" and op.name == "PortStackLagPattern"
+    )
+    migration_fields = dict(create_op.fields)
+
+    for field_name in ("librenms_os", "lag_name_pattern"):
+        model_help = PortStackLagPattern._meta.get_field(field_name).help_text
+        assert migration_fields[field_name].help_text == model_help, (
+            f"{field_name}: migration help_text drifted from the model"
+        )
+
+
+def test_migration_0014_librenms_os_help_text_matches_model():
+    """Migration 0014 re-declares librenms_os via AlterField, so 0014 (not 0013's CreateModel) is the authoritative migration state makemigrations compares librenms_os against — its help_text must match the model too."""
+    from netbox_librenms_plugin.models import PortStackLagPattern
+
+    mod = importlib.import_module("netbox_librenms_plugin.migrations.0014_portstacklagpattern_ci_unique")
+    alter_op = next(
+        op
+        for op in mod.Migration.operations
+        if op.__class__.__name__ == "AlterField" and op.model_name == "portstacklagpattern" and op.name == "librenms_os"
+    )
+    model_help = PortStackLagPattern._meta.get_field("librenms_os").help_text
+    assert alter_op.field.help_text == model_help, "0014 AlterField librenms_os help_text drifted from the model"
diff --git a/netbox_librenms_plugin/tests/test_module_adoption_concurrency.py b/netbox_librenms_plugin/tests/test_module_adoption_concurrency.py
index eee8f270e6..2809209bd7 100644
--- a/netbox_librenms_plugin/tests/test_module_adoption_concurrency.py
+++ b/netbox_librenms_plugin/tests/test_module_adoption_concurrency.py
@@ -88,6 +88,10 @@ def install_module():
     with ThreadPoolExecutor(max_workers=1) as executor:
         future = executor.submit(install_module)
         assert install_ready.wait(5), "module install did not reach the adoption race window"
+        # The worker holds an open transaction while it waits. Bound the competing write too, so a
+        # conflicting row lock fails with a readable error instead of hanging the run.
+        with connection.cursor() as cursor:
+            cursor.execute("SET lock_timeout = '5s'")
         winner = Interface.objects.create(device=device, name="Te1/1/1", type="10gbase-x-sfpp")
         winner_committed.set()
         future.result(timeout=10)
diff --git a/netbox_librenms_plugin/tests/test_permissions.py b/netbox_librenms_plugin/tests/test_permissions.py
index ff19db07d6..2c723eb478 100644
--- a/netbox_librenms_plugin/tests/test_permissions.py
+++ b/netbox_librenms_plugin/tests/test_permissions.py
@@ -1096,7 +1096,7 @@ def test_delete_interfaces_invalid_type_raises_404(self):
 class TestRemoveServerMappingViewErrorHandling:
     """Test RemoveServerMappingView handles full_clean/save failures gracefully."""
 
-    def _make_view(self, device, server_key, post_extra=None):
+    def _make_view(self, server_key, post_extra=None):
         """Return a (view, request) pair with permissions satisfied."""
         from netbox_librenms_plugin.tests.view_test_helpers import make_request, make_view
         from netbox_librenms_plugin.views.sync.device_fields import RemoveServerMappingView
@@ -1119,7 +1119,7 @@ def test_validation_error_returns_error_message(self):
         from netbox_librenms_plugin.tests.view_test_helpers import message_texts, post as _post
 
         dev = make_device("perm-rm-validation", librenms_cf={"orphan-server": 99})
-        view, request = self._make_view(dev, "orphan-server")
+        view, request = self._make_view("orphan-server")
 
         # The custom field accepts any dict, so the rejection has to be injected; the manager,
         # the lock and the transaction all stay real.
@@ -1143,7 +1143,7 @@ def test_configured_server_refused(self):
         from netbox_librenms_plugin.tests.view_test_helpers import message_texts, post as _post
 
         dev = make_device("perm-rm-configured", librenms_cf={"active-server": 5})
-        view, request = self._make_view(dev, "active-server")
+        view, request = self._make_view("active-server")
 
         with self._plugins_config({"active-server": {"librenms_url": "http://x"}}):
             _post(view, request, pk=dev.pk)
@@ -1161,7 +1161,7 @@ def test_successful_removal_mutates_and_saves(self):
         from netbox_librenms_plugin.tests.view_test_helpers import message_texts, post as _post
 
         dev = make_device("perm-rm-ok", librenms_cf={"orphan-server": 42, "other-server": 7})
-        view, request = self._make_view(dev, "orphan-server")
+        view, request = self._make_view("orphan-server")
 
         with self._plugins_config({}):  # orphan-server NOT configured
             _post(view, request, pk=dev.pk)
diff --git a/netbox_librenms_plugin/tests/test_port_stack_lag_pattern.py b/netbox_librenms_plugin/tests/test_port_stack_lag_pattern.py
new file mode 100644
index 0000000000..85cf9f9dd9
--- /dev/null
+++ b/netbox_librenms_plugin/tests/test_port_stack_lag_pattern.py
@@ -0,0 +1,531 @@
+"""Tests for PortStackLagPattern model."""
+
+import pytest
+from django.core.exceptions import ValidationError
+
+
+@pytest.mark.django_db
+class TestPortStackLagPattern:
+    """Exercise the real ORM path: save() -> FullCleanOnSaveMixin.full_clean() -> clean() plus the unique librenms_os constraint, rather than a __new__ + patched-clean stand-in that bypasses validation entirely."""
+
+    def _model(self):
+        from netbox_librenms_plugin.models import PortStackLagPattern
+
+        return PortStackLagPattern
+
+    def test_migration_seeded_the_lowercased_default_patterns(self):
+        """Migration 0013's RunPython seed actually committed rows through the ORM (e.g. the lower-cased 'ios' default) — a real-DB check the __new__/patched-clean stand-in could never make."""
+        assert self._model().objects.filter(librenms_os="ios", lag_name_pattern=r"^Po\d+$").exists()
+
+    def test_save_normalizes_os_and_pattern(self):
+        """A real save lower-cases/strips librenms_os and strips lag_name_pattern; the normalized row round-trips from the DB."""
+        obj = self._model().objects.create(librenms_os="  ZZNORM  ", lag_name_pattern=r"  ^Po\d+$  ")
+        obj.refresh_from_db()
+        assert obj.librenms_os == "zznorm"
+        assert obj.lag_name_pattern == r"^Po\d+$"
+
+    def test_str_representation(self):
+        obj = self._model()(librenms_os="ios", lag_name_pattern=r"^Po\d+$")
+        assert str(obj) == r"ios -> ^Po\d+$"
+
+    def test_save_rejects_invalid_regex_and_does_not_persist(self):
+        """An invalid regex must raise on save (via full_clean) AND leave no row behind."""
+        model = self._model()
+        with pytest.raises(ValidationError) as exc_info:
+            model.objects.create(librenms_os="zzbadregex", lag_name_pattern="[invalid(regex")
+        assert "lag_name_pattern" in exc_info.value.message_dict
+        assert "Invalid regex:" in exc_info.value.message_dict["lag_name_pattern"][0]
+        assert not model.objects.filter(librenms_os="zzbadregex").exists()
+
+    def test_save_rejects_blank_os(self):
+        with pytest.raises(ValidationError) as exc_info:
+            self._model().objects.create(librenms_os="   ", lag_name_pattern=r"^Po\d+$")
+        assert "librenms_os" in exc_info.value.message_dict
+
+    def test_save_rejects_blank_pattern(self):
+        with pytest.raises(ValidationError) as exc_info:
+            self._model().objects.create(librenms_os="zzblankpat", lag_name_pattern="   ")
+        assert "lag_name_pattern" in exc_info.value.message_dict
+
+    def test_unique_librenms_os_rejects_case_variant_duplicate(self):
+        """librenms_os is unique case-insensitively (functional UniqueConstraint) AND lower-cased in clean(), so a case-variant duplicate ('ZZDUP' for an existing 'zzdup') is rejected by full_clean's constraint check — not silently inserted as a second row."""
+        model = self._model()
+        model.objects.create(librenms_os="zzdup", lag_name_pattern=r"^Po\d+$")
+        with pytest.raises(ValidationError):
+            model.objects.create(librenms_os="ZZDUP", lag_name_pattern=r"^Bundle-Ether\d+$")
+        assert model.objects.filter(librenms_os="zzdup").count() == 1
+
+    def test_db_enforces_case_insensitive_unique_when_full_clean_bypassed(self):
+        """The functional unique on Lower(Trim(librenms_os)) rejects a case-variant duplicate at the DB level even via bulk_create (which skips full_clean/clean), so a path that bypasses the lowercasing can't insert 'IOS' alongside 'ios'."""
+        from django.db import IntegrityError, transaction
+
+        model = self._model()
+        model.objects.create(librenms_os="zzci", lag_name_pattern=r"^Po\d+$")  # clean() lowercases -> "zzci"
+        with pytest.raises(IntegrityError):
+            # bulk_create skips full_clean, so "ZZCI" reaches the DB un-lowercased; the functional
+            # unique on Lower(Trim(librenms_os)) must still reject it. atomic() so the aborted DB
+            # state rolls back to a savepoint and the test transaction stays usable.
+            with transaction.atomic():
+                model.objects.bulk_create([model(librenms_os="ZZCI", lag_name_pattern=r"^X\d+$")])
+        assert model.objects.filter(librenms_os="zzci").count() == 1
+
+    def test_db_enforces_whitespace_variant_unique_when_full_clean_bypassed(self):
+        """The constraint must treat ' ZZWSC ' and 'zzwsc' as the SAME key: clean() canonicalizes with .strip().lower(), so the DB enforces Lower(Trim(...)) — a Lower()-only unique would let a full_clean-bypassing insert park a padded duplicate behind the app's normalization."""
+        from django.db import IntegrityError, transaction
+
+        model = self._model()
+        model.objects.create(librenms_os="zzwsc", lag_name_pattern=r"^Po\d+$")
+        with pytest.raises(IntegrityError):
+            # bulk_create skips full_clean, so the padded case-variant reaches the DB verbatim;
+            # only Trim in the constraint expression can catch it.
+            with transaction.atomic():
+                model.objects.bulk_create([model(librenms_os=" ZZWSC ", lag_name_pattern=r"^Y\d+$")])
+        assert model.objects.filter(librenms_os="zzwsc").count() == 1
+
+    def test_db_enforces_tab_variant_unique_when_full_clean_bypassed(self):
+        """The database constraint must match ``str.strip()`` for non-space whitespace."""
+        from django.db import IntegrityError, transaction
+
+        model = self._model()
+        model.objects.create(librenms_os="zztab", lag_name_pattern=r"^Po\d+$")
+
+        with pytest.raises(IntegrityError):
+            with transaction.atomic():
+                model.objects.bulk_create([model(librenms_os="\tZZTAB\t", lag_name_pattern=r"^Y\d+$")])
+
+        assert model.objects.filter(librenms_os="zztab").count() == 1
+
+    def test_scoped_read_normalizes_a_lone_bulk_created_os(self):
+        """The reader must use the same trim/lower key as the database constraint."""
+        model = self._model()
+        model.objects.bulk_create([model(librenms_os=" ZZFUT ", lag_name_pattern=r"^Po\d+$")])
+
+        patterns = model.compiled_patterns_for_os("zzfut")
+
+        assert len(patterns) == 1
+        assert patterns[0].fullmatch("Po7")
+
+    def test_api_requires_plugin_permission_and_supports_crud(self, client):
+        """The rule is available through the same permission-gated API as sibling rule models."""
+        from django.contrib.auth import get_user_model
+        from django.urls import reverse
+
+        from netbox_librenms_plugin.tests.conftest import make_superuser
+
+        url = reverse("plugins-api:netbox_librenms_plugin-api:portstacklagpattern-list")
+        user = get_user_model().objects.create_user(username="port-stack-api-denied", password="x")
+        client.force_login(user)
+        assert client.get(url).status_code == 403
+
+        client.force_login(make_superuser())
+        response = client.post(
+            url,
+            {
+                "librenms_os": "zzapi",
+                "lag_name_pattern": r"^Bundle-Ether\d+$",
+                "description": "Created through API",
+            },
+            content_type="application/json",
+        )
+
+        assert response.status_code == 201, response.json()
+        detail_url = reverse(
+            "plugins-api:netbox_librenms_plugin-api:portstacklagpattern-detail",
+            args=[response.json()["id"]],
+        )
+        response = client.patch(
+            detail_url,
+            {"description": "Updated through API"},
+            content_type="application/json",
+        )
+        assert response.status_code == 200
+        assert response.json()["description"] == "Updated through API"
+
+        response = client.delete(detail_url)
+        assert response.status_code == 204
+        assert not self._model().objects.filter(librenms_os="zzapi").exists()
+
+
+@pytest.mark.django_db
+class TestHasLagSignalsFieldSelection:
+    """Structural signals scan the active name field plus ifName and ifDescr."""
+
+    def _make_view(self):
+        from netbox_librenms_plugin.views.base.interfaces_view import BaseInterfaceTableView
+
+        return object.__new__(BaseInterfaceTableView)
+
+    def test_subiface_signal_in_ifdescr_detected(self):
+        """ifDescr-driven device: the sub-interface base+child names live only in ifDescr."""
+        view = self._make_view()
+        ports = [
+            {"ifName": "", "ifDescr": "ge-0/0/0"},  # parent
+            {"ifName": "", "ifDescr": "ge-0/0/0.100"},  # sub-interface child
+        ]
+        # Default (ifName/ifDescr) already covers the ifDescr-driven case CR flagged.
+        assert view._has_structural_relationship_signals(ports) is True
+        assert view._has_structural_relationship_signals(ports, "ifDescr") is True
+
+    def test_field_parameter_changes_outcome(self):
+        """The signal lives only in a non-default field (ifAlias)."""
+        view = self._make_view()
+        ports = [
+            {"ifAlias": "ae0"},  # parent
+            {"ifAlias": "ae0.100"},  # sub-interface child
+        ]
+        # ifAlias is neither ifName nor ifDescr, so the default scan misses it...
+        assert view._has_structural_relationship_signals(ports) is False
+        # ...but passing it as the selected field surfaces the LAG signal.
+        assert view._has_structural_relationship_signals(ports, "ifAlias") is True
+
+    def test_no_signal_returns_false(self):
+        """Plain access ports with no LAG/sub-interface signal stay False (not vacuously True)."""
+        view = self._make_view()
+        ports = [
+            {"ifName": "Gi0/0", "ifDescr": "GigabitEthernet0/0", "ifType": "ethernetCsmacd"},
+            {"ifName": "Gi0/1", "ifDescr": "GigabitEthernet0/1", "ifType": "ethernetCsmacd"},
+        ]
+        assert view._has_structural_relationship_signals(ports, "ifDescr") is False
+
+    def test_propvirtual_alone_does_not_trigger_fetch(self):
+        """A propVirtual ifType is NOT a LAG signal: loopbacks/SVIs/tunnels are propVirtual, so gating on it fired the lazy port_stack/device_info round-trips for nearly every device. Only ieee8023adLag, a name-pattern match, or a real sub-interface should gate the fetch — matching what the resolver can actually classify."""
+        view = self._make_view()
+        # Lone propVirtual ports whose names match no PortStackLagPattern and have no
+        # sub-interface child: must NOT trigger the fetch (the old code returned True here).
+        virtuals = [
+            {"ifName": "Loopback0", "ifType": "propVirtual"},
+            {"ifName": "Vlan100", "ifType": "propVirtual"},
+        ]
+        assert view._has_structural_relationship_signals(virtuals) is False
+        # A structural aggregate (ieee8023adLag) still triggers it, regardless of name.
+        assert view._has_structural_relationship_signals([{"ifName": "agg-x", "ifType": "ieee8023adLag"}]) is True
+        # A propVirtual port-channel whose name matches a seeded pattern (^Po\\d+$) still
+        # triggers it via the name-pattern branch — so real IOS LAGs are unaffected.
+        from netbox_librenms_plugin.models import PortStackLagPattern
+
+        PortStackLagPattern.objects.get_or_create(librenms_os="ios", lag_name_pattern=r"^Po\d+$")
+        patterns = PortStackLagPattern.compiled_patterns_for_os(None)
+        assert view._has_lag_name_signals([{"ifName": "Po10", "ifType": "propVirtual"}], "ifName", patterns) is True
+
+    def test_non_string_name_is_skipped_not_crashed(self):
+        """A truthy non-string ifName/ifDescr (numeric/list from a malformed payload) is skipped, not crashed.
+
+        Without the isinstance(str) guard the non-string reaches pat.search()/sub_iface_re.match() and
+        raises TypeError, which 500s the whole interface refresh — the resolver's _port_names skips it.
+        """
+        view = self._make_view()
+        ports = [
+            {"ifName": 123, "ifType": "ethernetCsmacd"},  # truthy non-string name
+            {"ifDescr": ["x", "y"], "ifType": "ethernetCsmacd"},  # truthy non-string in another field
+        ]
+        # Returns a bool (no TypeError); neither is a real LAG/sub-interface signal.
+        assert view._has_structural_relationship_signals(ports) is False
+
+
+@pytest.mark.django_db
+class TestHasLagSignalsOsScoped:
+    """The name-pattern signal must be scoped to the device OS (matching resolve_port_relationships), so a name matching another platform's LAG regex doesn't trigger a wasted port_stack fetch + empty Parent/LAG column."""
+
+    @staticmethod
+    def _view():
+        from netbox_librenms_plugin.views.base.interfaces_view import BaseInterfaceTableView
+
+        return object.__new__(BaseInterfaceTableView)
+
+    def test_name_pattern_signal_scoped_to_device_os(self):
+        from netbox_librenms_plugin.models import PortStackLagPattern
+
+        PortStackLagPattern.objects.create(librenms_os="znos", lag_name_pattern=r"^Zo\d+$")
+        view = self._view()
+        ports = [{"ifName": "Zo1", "ifType": "propVirtual"}]
+        assert view._has_lag_name_signals(ports, "ifName", PortStackLagPattern.compiled_patterns_for_os("znos"))
+        assert not view._has_lag_name_signals(
+            ports, "ifName", PortStackLagPattern.compiled_patterns_for_os("some-other-os")
+        )
+        assert view._has_lag_name_signals(ports, "ifName", PortStackLagPattern.compiled_patterns_for_os(None))
+
+    def test_structural_signal_is_os_independent(self):
+        view = self._view()
+        agg = [{"ifName": "agg0", "ifType": "ieee8023adLag"}]
+        # ieee8023adLag is structural -> fires regardless of OS scope.
+        assert view._has_structural_relationship_signals(agg) is True
+
+
+@pytest.mark.django_db
+class TestMigration0014Preflight:
+    """Exercise 0014's RunPython preflight (normalize_librenms_os_case) against the real ORM: it canonicalizes casing and aborts with an actionable error before the CI-unique constraint would fail opaquely on legacy mixed-case duplicates."""
+
+    @staticmethod
+    def _preflight():
+        import importlib
+
+        mig = importlib.import_module("netbox_librenms_plugin.migrations.0014_portstacklagpattern_ci_unique")
+        return mig.normalize_librenms_os_case
+
+    @staticmethod
+    def _schema_editor():
+        """A schema_editor stand-in carrying the REAL test connection, as migrate would pass one — the preflight reads schema_editor.connection.alias to pin its ORM traffic to the migration's database."""
+        from types import SimpleNamespace
+
+        from django.db import connection
+
+        return SimpleNamespace(connection=connection)
+
+    def test_preflight_lowercases_mixed_case_rows(self):
+        """A mixed-case librenms_os an old full_clean-bypassing path left behind is canonicalized to lowercase."""
+        from unittest.mock import patch
+
+        from django.db import connection
+        from django.db.migrations.executor import MigrationExecutor
+
+        from netbox_librenms_plugin.models import PortStackLagPattern
+
+        historical_apps = (
+            MigrationExecutor(connection)
+            .loader.project_state(("netbox_librenms_plugin", "0013_portstacklagpattern"))
+            .apps
+        )
+        historical_model = historical_apps.get_model("netbox_librenms_plugin", "portstacklagpattern")
+
+        # bulk_create skips clean()'s lowercasing, so "ZZOSX" reaches the row verbatim (unique on its
+        # own, so the CI constraint permits it). The preflight must then canonicalize it. Use a
+        # distinctive OS name so it can't collide with a migration-seeded default pattern.
+        PortStackLagPattern.objects.bulk_create([PortStackLagPattern(librenms_os="ZZOSX", lag_name_pattern=r"^zz\d+$")])
+        with patch.object(historical_model, "full_clean", lambda self, *a, **k: None):
+            self._preflight()(historical_apps, self._schema_editor())
+        assert PortStackLagPattern.objects.filter(librenms_os="zzosx").exists()
+        assert not PortStackLagPattern.objects.filter(librenms_os="ZZOSX").exists()
+
+    def test_preflight_blocks_case_variant_duplicates_with_clear_error(self):
+        """When case-variant duplicates predate the CI-unique, the preflight raises a clear RuntimeError naming the value rather than letting AddConstraint fail with an opaque IntegrityError."""
+        from django.apps import apps as django_apps
+        from django.db import connection
+
+        from netbox_librenms_plugin.models import PortStackLagPattern
+
+        constraint = next(
+            c for c in PortStackLagPattern._meta.constraints if c.name == "unique_portstacklagpattern_librenms_os_ci"
+        )
+        # Reproduce the pre-0014 world (case-sensitive unique only) so the colliding rows can
+        # coexist. Postgres DDL is transactional and this runs inside the test's transaction, so
+        # the drop — and the rows below — roll back on teardown, restoring the constraint.
+        with connection.schema_editor() as schema_editor:
+            schema_editor.remove_constraint(PortStackLagPattern, constraint)
+        PortStackLagPattern.objects.bulk_create(
+            [
+                PortStackLagPattern(librenms_os="iosdup", lag_name_pattern=r"^ae\d+$"),
+                PortStackLagPattern(librenms_os="IOSDUP", lag_name_pattern=r"^bundle\d+$"),
+            ]
+        )
+        with pytest.raises(RuntimeError, match="iosdup"):
+            self._preflight()(django_apps, self._schema_editor())
+
+    def test_preflight_normalizes_row_with_uncompilable_pattern(self):
+        """A bypassing insert can leave a row the concrete model's clean() would reject (uncompilable lag_name_pattern); the preflight rewrite must still canonicalize librenms_os instead of aborting on unrelated-field validation."""
+        from django.db import connection
+        from django.db.migrations.executor import MigrationExecutor
+
+        from netbox_librenms_plugin.models import PortStackLagPattern
+
+        historical_apps = (
+            MigrationExecutor(connection)
+            .loader.project_state(("netbox_librenms_plugin", "0013_portstacklagpattern"))
+            .apps
+        )
+        # bulk_create bypasses clean(): both the mixed-case OS name and the invalid regex land
+        # verbatim. No full_clean stub here — the preflight itself must tolerate the row.
+        PortStackLagPattern.objects.bulk_create(
+            [PortStackLagPattern(librenms_os="ZZBAD", lag_name_pattern="([invalid")]
+        )
+        pk = PortStackLagPattern.objects.get(librenms_os="ZZBAD").pk
+
+        self._preflight()(historical_apps, self._schema_editor())
+
+        assert PortStackLagPattern.objects.get(pk=pk).librenms_os == "zzbad"
+
+    def test_preflight_strips_surrounding_whitespace(self):
+        """A whitespace-padded librenms_os a bypassing path left behind is canonicalized to .strip().lower() (matching clean()), not left with surrounding spaces behind the Lower()-only constraint."""
+        from unittest.mock import patch
+
+        from django.db import connection
+        from django.db.migrations.executor import MigrationExecutor
+
+        from netbox_librenms_plugin.models import PortStackLagPattern
+
+        # Invoke the preflight with the HISTORICAL model as the migration actually sees it (state at
+        # 0013, before 0014). 0013 serialized FullCleanOnSaveMixin into the historical model's bases,
+        # so its save() still runs full_clean() — we stub full_clean below during the preflight so a
+        # future clean() gaining a strip can't mask a Lower()-only migration bug. With it stubbed the
+        # migration's OWN normalization is the only thing that writes the value, so this is the only
+        # way the test can tell a Lower()-only rewrite (leaves " zzws ") from .strip().lower() ("zzws").
+        historical_apps = (
+            MigrationExecutor(connection)
+            .loader.project_state(("netbox_librenms_plugin", "0013_portstacklagpattern"))
+            .apps
+        )
+        historical_model = historical_apps.get_model("netbox_librenms_plugin", "portstacklagpattern")
+
+        # bulk_create skips clean(): " ZZWS " reaches the row verbatim (Lower() of it is unique, so
+        # the CI constraint permits it). The preflight must strip+lower it, not just lower it.
+        PortStackLagPattern.objects.bulk_create(
+            [PortStackLagPattern(librenms_os=" ZZWS ", lag_name_pattern=r"^zw\d+$")]
+        )
+        pk = PortStackLagPattern.objects.get(lag_name_pattern=r"^zw\d+$").pk
+        # Sanity: the padded value really landed in the row (bulk_create did not canonicalize it).
+        assert PortStackLagPattern.objects.get(pk=pk).librenms_os == " ZZWS "
+        # Stub the historical model's full_clean so ONLY the migration's rewrite can normalize the
+        # row — otherwise a save-time strip could pass this test even if the migration itself is wrong.
+        with patch.object(historical_model, "full_clean", lambda self, *a, **k: None):
+            self._preflight()(historical_apps, self._schema_editor())
+        # Exact canonical value, not a DB filter: trailing/leading-space equality is collation-fuzzy
+        # and would let " zzws " match "zzws".
+        assert PortStackLagPattern.objects.get(pk=pk).librenms_os == "zzws"
+
+    def test_preflight_pins_orm_traffic_to_the_migration_alias_not_the_router(self):
+        """Multi-DB safety (the same pinned-rewrite pattern as the sibling data migrations): the preflight's OWN queryset iteration and save must be pinned to schema_editor.connection.alias via .using()/save(using=...). Unpinned ORM calls consult the database router, so `migrate --database=other` would normalize rows on the router's choice instead of the migration's target database — detected here by recording router consultations whose call stack passes through the migration module. Consults from INSIDE Model.full_clean are excluded: 0013 serialized FullCleanOnSaveMixin into the historical model's bases, so even a fully pinned save() runs full_clean, whose validate_unique/validate_constraints ask the router with instance hints and correctly fall back to the pinned instance._state.db — Django offers no using hook there, and the migration cannot avoid it."""
+        import traceback
+
+        from django.db import connection
+        from django.db.migrations.executor import MigrationExecutor
+        from django.test import override_settings
+
+        from netbox_librenms_plugin.models import PortStackLagPattern
+
+        historical_apps = (
+            MigrationExecutor(connection)
+            .loader.project_state(("netbox_librenms_plugin", "0013_portstacklagpattern"))
+            .apps
+        )
+
+        # A mixed-case row so the rewrite loop performs a real save (write path exercised too).
+        PortStackLagPattern.objects.bulk_create([PortStackLagPattern(librenms_os="ZZRTR", lag_name_pattern=r"^zr\d+$")])
+
+        unpinned = []
+
+        class _RecordingRouter:
+            """Records unpinned routing questions coming from the migration's own code."""
+
+            @staticmethod
+            def _record(kind, model):
+                if model._meta.model_name != "portstacklagpattern":
+                    return
+                frames = traceback.extract_stack()
+                in_migration = any("0014_portstacklagpattern_ci_unique" in f.filename for f in frames)
+                from_full_clean = any(f.name == "full_clean" for f in frames)
+                if in_migration and not from_full_clean:
+                    unpinned.append(kind)
+
+            def db_for_read(self, model, **hints):
+                self._record("read", model)
+                return None
+
+            def db_for_write(self, model, **hints):
+                self._record("write", model)
+                return None
+
+        with override_settings(DATABASE_ROUTERS=[_RecordingRouter()]):
+            self._preflight()(historical_apps, self._schema_editor())
+
+        assert unpinned == [], f"preflight consulted the router ({unpinned}) instead of pinning the migration alias"
+        assert PortStackLagPattern.objects.filter(librenms_os="zzrtr").exists()
+
+    def test_preflight_blocks_whitespace_and_case_variant_duplicates(self):
+        """Rows differing only by surrounding whitespace/case (' WSDUP ' vs 'wsdup') are the same pattern to clean(); the preflight must flag them as a collision via .strip().lower() — a Lower()-only check misses the whitespace variant and would leave a semantic duplicate behind the constraint."""
+        from django.apps import apps as django_apps
+        from django.db import connection
+
+        from netbox_librenms_plugin.models import PortStackLagPattern
+
+        constraint = next(
+            c for c in PortStackLagPattern._meta.constraints if c.name == "unique_portstacklagpattern_librenms_os_ci"
+        )
+        with connection.schema_editor() as schema_editor:
+            schema_editor.remove_constraint(PortStackLagPattern, constraint)
+        PortStackLagPattern.objects.bulk_create(
+            [
+                PortStackLagPattern(librenms_os="wsdup", lag_name_pattern=r"^ae\d+$"),
+                PortStackLagPattern(librenms_os=" WSDUP ", lag_name_pattern=r"^bundle\d+$"),
+            ]
+        )
+        with pytest.raises(RuntimeError, match="wsdup"):
+            self._preflight()(django_apps, self._schema_editor())
+
+
+@pytest.mark.django_db
+class TestLagPatternSharedLoad:
+    """The interface-refresh LAG gating loads OS-scoped patterns once and shares them.
+
+    The signal check and resolve_port_relationships each re-queried and recompiled
+    PortStackLagPattern per call, so a single refresh loaded the scoped patterns twice (plus the
+    resolver's own load). Both now accept a pre-loaded compiled list so the caller loads once.
+    """
+
+    def _view(self):
+        from netbox_librenms_plugin.views.base.interfaces_view import BaseInterfaceTableView
+
+        return object.__new__(BaseInterfaceTableView)
+
+    @staticmethod
+    def _seed_and_compile(os_name="sharedos"):
+        from netbox_librenms_plugin.models import PortStackLagPattern
+
+        PortStackLagPattern.objects.create(librenms_os=os_name, lag_name_pattern=r"^Po\d+$")
+        return PortStackLagPattern.compiled_patterns_for_os(os_name)
+
+    @staticmethod
+    def _no_pattern_query(ctx):
+        return not any("portstacklagpattern" in q["sql"].lower() for q in ctx.captured_queries)
+
+    def test_name_signal_reuses_supplied_patterns_without_db(self):
+        """The name signal scans supplied compiled patterns without a database query."""
+        from django.db import connection
+        from django.test.utils import CaptureQueriesContext
+
+        compiled = self._seed_and_compile()
+        view = self._view()
+        ports = [{"ifName": "Gi0/0", "ifType": "ethernetCsmacd"}]
+
+        with CaptureQueriesContext(connection) as ctx:
+            view._has_lag_name_signals(ports, "ifName", compiled)
+
+        assert self._no_pattern_query(ctx)
+
+    def test_resolver_reuses_supplied_compiled_patterns_without_db(self, mock_librenms_api):
+        """resolve_port_relationships(compiled_lag_patterns=...) resolves without re-loading patterns."""
+        from django.db import connection
+        from django.test.utils import CaptureQueriesContext
+
+        compiled = self._seed_and_compile()
+        ports = [
+            {"port_id": 11, "ifName": "Gi0/1", "ifType": "ethernetCsmacd"},
+            {"port_id": 12, "ifName": "Po1", "ifType": "propVirtual"},
+        ]
+        port_stack = [{"high_port_id": 11, "low_port_id": 12}]
+
+        with CaptureQueriesContext(connection) as ctx:
+            result = mock_librenms_api.resolve_port_relationships(
+                ports, port_stack, device_os="sharedos", compiled_lag_patterns=compiled
+            )
+
+        # Po1 aggregate matched via the supplied pattern (behavior preserved) and no pattern query.
+        assert result["lag_members"] == {11: 12}
+        assert self._no_pattern_query(ctx)
+
+    def test_string_zero_high_id_sentinel_is_skipped(self, mock_librenms_api):
+        """A string "0" port ID (the ifStack 'no port' sentinel) is skipped, not looked up."""
+        compiled = self._seed_and_compile()
+        # A port whose id is 0 exists in by_id (keyed "0"); the sentinel entry references it as the
+        # STRING "0". `not "0"` is False, so the old check would look it up and relate it to Po1.
+        ports = [
+            {"port_id": 0, "ifName": "phantom", "ifType": "ethernetCsmacd"},
+            {"port_id": 12, "ifName": "Po1", "ifType": "propVirtual"},
+        ]
+        port_stack = [{"high_port_id": "0", "low_port_id": 12}]
+
+        result = mock_librenms_api.resolve_port_relationships(
+            ports, port_stack, device_os="sharedos", compiled_lag_patterns=compiled
+        )
+
+        # The sentinel entry created no relationship at all (nothing references the phantom port 0).
+        assert result["lag_members"] == {}
+        assert result["sub_interfaces"] == {}
diff --git a/netbox_librenms_plugin/tests/test_rules_patterns_navigation.py b/netbox_librenms_plugin/tests/test_rules_patterns_navigation.py
index f979927f61..6585c50c11 100644
--- a/netbox_librenms_plugin/tests/test_rules_patterns_navigation.py
+++ b/netbox_librenms_plugin/tests/test_rules_patterns_navigation.py
@@ -26,6 +26,7 @@
     "inventoryignorerule_list",
     "normalizationrule_list",
     "carrierautoinstallrule_list",
+    "portstacklagpattern_list",
 ]
 
 
diff --git a/netbox_librenms_plugin/tests/test_sync_interface_concurrency.py b/netbox_librenms_plugin/tests/test_sync_interface_concurrency.py
index a5dab5a0d0..ddd1507079 100644
--- a/netbox_librenms_plugin/tests/test_sync_interface_concurrency.py
+++ b/netbox_librenms_plugin/tests/test_sync_interface_concurrency.py
@@ -16,11 +16,32 @@
 )
 
 
+@pytest.fixture(autouse=True)
+def mock_librenms_config():
+    """Neutralize the suite-wide autouse config mock (registered via ``pytest_plugins``).
+
+    That mock pins ``get_plugin_config`` to a ``default``-only server map, so the ``stub`` key
+    these tests post becomes an unknown explicit key and the view fails closed before it reaches
+    the behaviour under test. Same-name module fixture wins over the plugin's autouse one.
+    """
+    yield
+
+
+@pytest.fixture(autouse=True)
+def restore_librenms_id_custom_field():
+    """Recreate migration-seeded custom-field state after each TransactionTestCase flush."""
+    from netbox_librenms_plugin import _ensure_librenms_id_custom_field
+
+    executed_aliases = getattr(_ensure_librenms_id_custom_field, "_executed_aliases", set())
+    executed_aliases.discard("default")
+    _ensure_librenms_id_custom_field(sender=None, using="default")
+
+
 def test_selected_vc_target_is_locked_through_interface_sync():
     """A membership update must wait until target validation and sync commit."""
     from dcim.models import Device, Interface
     from django.contrib.auth import get_user_model
-    from django.db import close_old_connections, connection
+    from django.db import OperationalError, close_old_connections, connection
 
     from netbox_librenms_plugin.tests.view_test_helpers import make_request, make_superuser, make_view
     from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
@@ -29,8 +50,6 @@ def test_selected_vc_target_is_locked_through_interface_sync():
     user = make_superuser("sync-target-lock-user")
     validation_done = Event()
     release_sync = Event()
-    membership_changed = Event()
-    move_started = Event()
 
     port = {
         "ifName": "Gi0/1",
@@ -39,24 +58,26 @@ def test_selected_vc_target_is_locked_through_interface_sync():
         "ifAlias": "uplink",
         "ifMtu": 1500,
         "ifAdminStatus": "up",
-        "port_id": None,
+        "port_id": 101,
     }
 
     def sync_interface():
         close_old_connections()
         try:
             with connection.cursor() as cursor:
-                cursor.execute("SET lock_timeout = '5s'")
+                cursor.execute("SET lock_timeout = '500ms'")
                 cursor.execute("SET statement_timeout = '5s'")
             page = Device.objects.get(pk=page_device.pk)
             thread_user = get_user_model().objects.get(pk=user.pk)
             request = make_request(
                 "post",
-                {"device_selection_Gi0/1": str(target_device.pk)},
+                {"device_selection_101": str(target_device.pk)},
                 user=thread_user,
             )
             view = make_view(SyncInterfacesView, request)
             view._post_server_key = "default"
+            view._selected_port_ids = {101}
+            view._auto_selected_port_ids = set()
             real_resolve = view._resolve_device_interface
 
             def pause_after_validation(*args, **kwargs):
@@ -65,7 +86,7 @@ def pause_after_validation(*args, **kwargs):
                 return real_resolve(*args, **kwargs)
 
             view._resolve_device_interface = pause_after_validation
-            view.sync_selected_interfaces(page, ["Gi0/1"], [port], ["vlans"], "ifName")
+            view.sync_selected_interfaces(page, [port], ["vlans"], "ifName")
         finally:
             close_old_connections()
 
@@ -73,11 +94,9 @@ def move_target_out_of_chassis():
         close_old_connections()
         try:
             with connection.cursor() as cursor:
-                cursor.execute("SET lock_timeout = '5s'")
+                cursor.execute("SET lock_timeout = '500ms'")
                 cursor.execute("SET statement_timeout = '5s'")
-            move_started.set()
             Device.objects.filter(pk=target_device.pk).update(virtual_chassis=None, vc_position=None)
-            membership_changed.set()
         finally:
             close_old_connections()
 
@@ -85,13 +104,832 @@ def move_target_out_of_chassis():
         sync_future = executor.submit(sync_interface)
         assert validation_done.wait(5), "interface sync did not reach target validation"
         move_future = executor.submit(move_target_out_of_chassis)
-        # Without this the 0.5s window also covers thread start-up and the two SET
-        # statements, so the negative assertion below could pass with no lock held.
-        assert move_started.wait(5), "membership update thread did not start"
-        changed_during_sync = membership_changed.wait(0.5)
-        release_sync.set()
+        try:
+            with pytest.raises(OperationalError, match="lock timeout"):
+                move_future.result(timeout=5)
+        finally:
+            release_sync.set()
         sync_future.result(timeout=10)
-        move_future.result(timeout=10)
 
-    assert not changed_during_sync
     assert Interface.objects.filter(device=target_device, name="Gi0/1").exists()
+
+
+def test_vlan_scope_is_built_after_the_selected_vc_target_is_locked():
+    """A site change must not commit between VLAN scope resolution and interface sync."""
+    from types import SimpleNamespace
+
+    from dcim.models import Device, Site
+    from django.contrib.auth import get_user_model
+    from django.contrib.contenttypes.models import ContentType
+    from django.core.cache import cache
+    from django.db import close_old_connections, connection
+    from ipam.models import VLAN, VLANGroup
+
+    from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+    from netbox_librenms_plugin.tests.view_test_helpers import make_request, make_superuser, post
+    from netbox_librenms_plugin.utils import set_librenms_device_id
+    from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+    _vc, (page_device, target_device) = make_virtual_chassis_members("sync-vlan-scope-lock")
+    # Use the real configured key. The devcontainer and CI use different names, and the request
+    # must pass the configured-server guard before this test can reach the lock boundary.
+    server_key = next(iter(LibreNMSAPI.get_available_servers()))
+    set_librenms_device_id(page_device, 1, server_key)
+    page_device.save()
+    new_site = Site.objects.create(name="Sync VLAN New Site", slug="sync-vlan-new-site", status="active")
+    site_type = ContentType.objects.get_for_model(Site)
+    vlan_group = VLANGroup.objects.create(
+        name="Sync VLAN Original Site",
+        slug="sync-vlan-original-site",
+        scope_type=site_type,
+        scope_id=target_device.site_id,
+    )
+    VLAN.objects.create(vid=100, name="Sync VLAN 100", group=vlan_group, status="active")
+    user = make_superuser("sync-vlan-scope-lock-user")
+    view_template = SyncInterfacesView()
+    cache_key = view_template.get_cache_key(page_device, "ports", server_key)
+    cache.set(
+        cache_key,
+        {
+            "ports": [
+                {
+                    "port_id": 10,
+                    "ifName": "Ethernet2",
+                    "ifDescr": "Ethernet2",
+                    "ifAlias": "",
+                    "ifType": "ethernetCsmacd",
+                    "ifSpeed": 1_000_000_000,
+                    "ifPhysAddress": "",
+                    "ifMtu": 1500,
+                    "ifAdminStatus": "up",
+                    "untagged_vlan": None,
+                    "tagged_vlans": [100],
+                }
+            ],
+            "port_stack_relationships": {},
+        },
+    )
+    target_lock_reached = Event()
+    release_sync = Event()
+
+    class PausingSyncInterfacesView(SyncInterfacesView):
+        def _lock_selected_device_targets(self, obj):
+            target_lock_reached.set()
+            assert release_sync.wait(5), "test did not release the interface sync"
+            return super()._lock_selected_device_targets(obj)
+
+    def sync_interface():
+        close_old_connections()
+        try:
+            with connection.cursor() as cursor:
+                cursor.execute("SET lock_timeout = '5s'")
+                cursor.execute("SET statement_timeout = '5s'")
+            thread_user = get_user_model().objects.get(pk=user.pk)
+            request = make_request(
+                "post",
+                {
+                    "select": ["10"],
+                    "server_key": server_key,
+                    "device_selection_10": str(target_device.pk),
+                    "vlan_group_10_100": str(vlan_group.pk),
+                    "exclude_columns": ["mac_address", "mtu", "speed", "type"],
+                },
+                user=thread_user,
+            )
+            request.GET = request.GET.copy()
+            request.GET["interface_name_field"] = "ifName"
+            view = PausingSyncInterfacesView()
+            view._librenms_api = SimpleNamespace(server_key=server_key)
+            response = post(view, request, object_type="device", object_id=page_device.pk)
+            assert response.status_code == 302
+        finally:
+            close_old_connections()
+
+    def move_target_to_new_site():
+        close_old_connections()
+        try:
+            with connection.cursor() as cursor:
+                cursor.execute("SET lock_timeout = '5s'")
+                cursor.execute("SET statement_timeout = '5s'")
+            Device.objects.filter(pk=target_device.pk).update(site=new_site)
+        finally:
+            close_old_connections()
+
+    try:
+        with ThreadPoolExecutor(max_workers=2) as executor:
+            sync_future = executor.submit(sync_interface)
+            assert target_lock_reached.wait(20), "interface sync did not reach target locking"
+            move_future = executor.submit(move_target_to_new_site)
+            try:
+                move_future.result(timeout=5)
+            finally:
+                release_sync.set()
+            sync_future.result(timeout=20)
+    finally:
+        cache.delete(cache_key)
+
+    interface = target_device.interfaces.get(name="Ethernet2")
+    assert list(interface.tagged_vlans.all()) == []
+
+
+def test_auto_selected_owner_is_revalidated_after_vc_position_changes():
+    """An owner guessed before locking must not survive a later chassis-position change."""
+    from dcim.models import Device, Interface
+
+    from netbox_librenms_plugin.tests.view_test_helpers import make_request, make_superuser, make_view
+    from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+    _vc, (page_device, old_position_two, new_position_two) = make_virtual_chassis_members(
+        "sync-auto-position",
+        count=3,
+    )
+    port = {
+        "port_id": 10,
+        "ifName": "Ethernet2/1",
+        "ifType": "ethernetCsmacd",
+        "ifSpeed": 1_000_000_000,
+        "ifAlias": "",
+        "ifMtu": 1500,
+        "ifAdminStatus": "up",
+    }
+    request = make_request("post", user=make_superuser("sync-auto-position-user"))
+    view = make_view(SyncInterfacesView, request)
+    view._post_server_key = "default"
+    view._selected_port_ids = {10}
+    view._auto_selected_port_ids = {10}
+    view._auto_selected_target_ids = {10: old_position_two.pk}
+
+    Device.objects.filter(pk=old_position_two.pk).update(vc_position=None)
+    Device.objects.filter(pk=new_position_two.pk).update(vc_position=2)
+    Device.objects.filter(pk=old_position_two.pk).update(vc_position=3)
+
+    view.sync_selected_interfaces(page_device, [port], [], "ifName")
+
+    assert Interface.objects.filter(device=new_position_two, name="Ethernet2/1").exists()
+    assert not Interface.objects.filter(device=old_position_two, name="Ethernet2/1").exists()
+
+
+def test_inaccessible_selected_target_is_not_locked():
+    """A forged inaccessible target must not block work on that Device."""
+    from dcim.models import Device
+    from django.contrib.auth import get_user_model
+    from django.db import close_old_connections, connection, transaction
+
+    from netbox_librenms_plugin.tests.conftest import make_device
+    from netbox_librenms_plugin.tests.view_test_helpers import grant, make_request, make_user_with_perms, make_view
+    from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+    page_device = make_device("restricted-target-page")
+    inaccessible_target = make_device("restricted-target-hidden")
+    user = make_user_with_perms("restricted-target-user", [])
+    user = grant(user, "view", Device, constraints={"id": page_device.pk})
+    sync_finished = Event()
+
+    def sync_forged_target():
+        close_old_connections()
+        try:
+            with connection.cursor() as cursor:
+                # Below the caller's future.result(timeout=5): if this test regresses and the row
+                # IS locked, the lock timeout must fire first so the failure names the real cause.
+                cursor.execute("SET lock_timeout = '500ms'")
+                cursor.execute("SET statement_timeout = '5s'")
+            thread_page = Device.objects.get(pk=page_device.pk)
+            thread_user = get_user_model().objects.get(pk=user.pk)
+            request = make_request(
+                "post",
+                {"device_selection_10": str(inaccessible_target.pk)},
+                user=thread_user,
+            )
+            view = make_view(SyncInterfacesView, request)
+            view._post_server_key = "default"
+            view._selected_port_ids = {10}
+            view._auto_selected_port_ids = set()
+            view._auto_selected_target_ids = {}
+            view._skipped_conflicts = []
+            view._synced_count = 0
+            view.sync_selected_interfaces(
+                thread_page,
+                [{"port_id": 10, "ifName": "Ethernet1", "ifAdminStatus": "up"}],
+                ["vlans", "mac_address", "description", "mtu", "speed", "type"],
+                "ifName",
+            )
+            sync_finished.set()
+        finally:
+            close_old_connections()
+
+    with ThreadPoolExecutor(max_workers=1) as executor:
+        with transaction.atomic():
+            Device.objects.select_for_update().get(pk=inaccessible_target.pk)
+            future = executor.submit(sync_forged_target)
+            future.result(timeout=5)
+
+    assert sync_finished.is_set()
+
+
+def test_viewable_outside_selected_target_is_not_locked():
+    """A target outside the page Device scope must not be locked."""
+    from dcim.models import Device
+    from django.contrib.auth import get_user_model
+    from django.db import close_old_connections, connection, transaction
+
+    from netbox_librenms_plugin.tests.conftest import make_device
+    from netbox_librenms_plugin.tests.view_test_helpers import make_request, make_superuser, make_view
+    from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+    page_device = make_device("outside-target-page")
+    outside_target = make_device("outside-target-device")
+    user = make_superuser("outside-target-user")
+    sync_finished = Event()
+
+    def sync_forged_target():
+        close_old_connections()
+        try:
+            with connection.cursor() as cursor:
+                cursor.execute("SET lock_timeout = '500ms'")
+                cursor.execute("SET statement_timeout = '5s'")
+            thread_page = Device.objects.get(pk=page_device.pk)
+            thread_user = get_user_model().objects.get(pk=user.pk)
+            request = make_request(
+                "post",
+                {"device_selection_10": str(outside_target.pk)},
+                user=thread_user,
+            )
+            view = make_view(SyncInterfacesView, request)
+            view._post_server_key = "default"
+            view._selected_port_ids = {10}
+            view._auto_selected_port_ids = set()
+            view._auto_selected_target_ids = {}
+            view._skipped_conflicts = []
+            view._synced_count = 0
+            view.sync_selected_interfaces(
+                thread_page,
+                [{"port_id": 10, "ifName": "Ethernet1", "ifAdminStatus": "up"}],
+                ["vlans", "mac_address", "description", "mtu", "speed", "type"],
+                "ifName",
+            )
+            sync_finished.set()
+        finally:
+            close_old_connections()
+
+    with ThreadPoolExecutor(max_workers=1) as executor:
+        with transaction.atomic():
+            Device.objects.select_for_update().get(pk=outside_target.pk)
+            future = executor.submit(sync_forged_target)
+            future.result(timeout=5)
+
+    assert sync_finished.is_set()
+
+
+def test_selected_vc_targets_lock_chassis_before_devices():
+    """Bulk sync must use the same chassis-first lock order as relationship sync."""
+    from django.db import connection, transaction
+
+    from netbox_librenms_plugin.tests.view_test_helpers import make_request, make_superuser, make_view
+    from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+    _virtual_chassis, (page_device, target_device) = make_virtual_chassis_members("bulk-lock-order")
+    request = make_request(
+        "post",
+        {"device_selection_10": str(target_device.pk)},
+        user=make_superuser("bulk-lock-order-user"),
+    )
+    view = make_view(SyncInterfacesView, request)
+    locked_selects = []
+
+    def record_locked_select(execute, sql, params, many, context):
+        if "FOR UPDATE" in sql.upper():
+            locked_selects.append(sql.lower())
+        return execute(sql, params, many, context)
+
+    with transaction.atomic(), connection.execute_wrapper(record_locked_select):
+        view._lock_selected_device_targets(page_device)
+
+    chassis_lock = next(index for index, sql in enumerate(locked_selects) if "dcim_virtualchassis" in sql)
+    device_lock = next(index for index, sql in enumerate(locked_selects) if '"dcim_device"' in sql)
+    assert chassis_lock < device_lock
+
+
+def test_vm_sync_serializes_duplicate_display_name_resolution():
+    """A second VM sync must not resolve the same unbound natural-key row concurrently."""
+    from django.contrib.auth import get_user_model
+    from django.db import close_old_connections, connection
+    from virtualization.models import VMInterface, VirtualMachine
+
+    from netbox_librenms_plugin.tests.conftest import make_vm
+    from netbox_librenms_plugin.tests.view_test_helpers import make_request, make_superuser, make_view
+    from netbox_librenms_plugin.utils import get_librenms_device_id
+    from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+    vm = make_vm("vm-duplicate-name-lock")
+    VMInterface.objects.create(virtual_machine=vm, name="Ethernet")
+    user = make_superuser("vm-duplicate-name-lock-user")
+    first_resolved = Event()
+    second_resolved = Event()
+    release_first = Event()
+
+    def sync_port(port_id, resolved_event, wait_for_release):
+        close_old_connections()
+        try:
+            with connection.cursor() as cursor:
+                cursor.execute("SET lock_timeout = '5s'")
+                cursor.execute("SET statement_timeout = '5s'")
+            thread_vm = VirtualMachine.objects.get(pk=vm.pk)
+            thread_user = get_user_model().objects.get(pk=user.pk)
+            request = make_request("post", {}, user=thread_user)
+            view = make_view(SyncInterfacesView, request)
+            view._post_server_key = "default"
+            view._selected_port_ids = {port_id}
+            view._skipped_conflicts = []
+            real_resolve = view._resolve_vm_interface
+
+            def pause_after_resolution(*args, **kwargs):
+                interface = real_resolve(*args, **kwargs)
+                resolved_event.set()
+                if wait_for_release:
+                    assert release_first.wait(5), "test did not release the first VM sync"
+                return interface
+
+            view._resolve_vm_interface = pause_after_resolution
+            port = {
+                "port_id": port_id,
+                "ifName": f"Ethernet{port_id}",
+                "ifDescr": "Ethernet",
+                "ifAdminStatus": "up",
+            }
+            view.sync_selected_interfaces(
+                thread_vm,
+                [port],
+                ["vlans", "mac_address", "description", "mtu", "speed", "type"],
+                "ifDescr",
+            )
+            return list(view._skipped_conflicts)
+        finally:
+            close_old_connections()
+
+    with ThreadPoolExecutor(max_workers=2) as executor:
+        first_future = executor.submit(sync_port, 10, first_resolved, True)
+        assert first_resolved.wait(5), "first VM sync did not resolve the interface"
+        second_future = executor.submit(sync_port, 11, second_resolved, False)
+        resolved_during_first = second_resolved.wait(0.5)
+        release_first.set()
+        first_skips = first_future.result(timeout=10)
+        second_skips = second_future.result(timeout=10)
+
+    interface = VMInterface.objects.get(virtual_machine=vm, name="Ethernet")
+    assert not resolved_during_first
+    assert get_librenms_device_id(interface, "default") == 10, (
+        interface.custom_field_data,
+        first_skips,
+        second_skips,
+    )
+
+
+def test_relationship_write_locks_virtual_chassis_members_through_validation():
+    """A membership update must wait until relationship validation and persistence commit."""
+    from types import SimpleNamespace
+
+    from dcim.models import Device
+    from django.contrib.auth import get_user_model
+    from django.core.cache import cache
+    from django.db import close_old_connections, connection
+
+    from netbox_librenms_plugin.tests.conftest import make_interface
+    from netbox_librenms_plugin.tests.view_test_helpers import make_request, make_superuser, post
+    from netbox_librenms_plugin.utils import set_librenms_device_id
+    from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceLagView
+
+    _vc, (aggregate_device, member_device) = make_virtual_chassis_members("relationship-scope-lock")
+    aggregate = make_interface(aggregate_device, "Port-Channel1", iface_type="lag")
+    member = make_interface(member_device, "Ethernet2")
+    set_librenms_device_id(aggregate, 20, "default")
+    set_librenms_device_id(member, 10, "default")
+    aggregate.save()
+    member.save()
+    user = make_superuser("relationship-scope-lock-user")
+    cache_key = SyncInterfaceLagView().get_cache_key(aggregate_device, "ports", "default")
+    cache.set(
+        cache_key,
+        {
+            "ports": [
+                {"port_id": 10, "ifName": member.name},
+                {"port_id": 20, "ifName": aggregate.name},
+            ],
+            "port_stack_relationships": {"lag_members": {10: 20}, "sub_interfaces": {}},
+        },
+    )
+    validation_reached = Event()
+    release_relationship = Event()
+    membership_changed = Event()
+
+    def write_relationship():
+        close_old_connections()
+        try:
+            with connection.cursor() as cursor:
+                cursor.execute("SET lock_timeout = '5s'")
+                cursor.execute("SET statement_timeout = '5s'")
+            thread_user = get_user_model().objects.get(pk=user.pk)
+            request = make_request(
+                "post",
+                {"port_id": "10", "lag_port_id": "20", "lag_name": "Port-Channel1"},
+                user=thread_user,
+            )
+            view = SyncInterfaceLagView()
+            view._librenms_api = SimpleNamespace(server_key="default")
+            prepare_related = view._prepare_related
+
+            def pause_before_validation(related_interface):
+                validation_reached.set()
+                assert release_relationship.wait(5), "test did not release the relationship transaction"
+                return prepare_related(related_interface)
+
+            view._prepare_related = pause_before_validation
+            response = post(
+                view,
+                request,
+                object_type="device",
+                object_id=member_device.pk,
+            )
+            assert response.status_code == 200, response.content
+        finally:
+            close_old_connections()
+
+    def move_member_out_of_chassis():
+        close_old_connections()
+        try:
+            with connection.cursor() as cursor:
+                cursor.execute("SET lock_timeout = '5s'")
+                cursor.execute("SET statement_timeout = '5s'")
+            Device.objects.filter(pk=aggregate_device.pk).update(virtual_chassis=None, vc_position=None)
+            membership_changed.set()
+        finally:
+            close_old_connections()
+
+    with ThreadPoolExecutor(max_workers=2) as executor:
+        relationship_future = executor.submit(write_relationship)
+        if not validation_reached.wait(5):
+            release_relationship.set()
+            relationship_future.result(timeout=10)
+            pytest.fail("relationship sync did not reach validation")
+        membership_future = executor.submit(move_member_out_of_chassis)
+        changed_during_relationship = membership_changed.wait(0.5)
+        release_relationship.set()
+        relationship_future.result(timeout=10)
+        membership_future.result(timeout=10)
+
+    member.refresh_from_db()
+    assert not changed_during_relationship
+    assert member.lag_id == aggregate.pk
+
+
+def test_inline_relationship_rechecks_migrated_donor_after_lock():
+    """A donor migrated while the request waits for its lock must stay read-only."""
+    from types import SimpleNamespace
+
+    from dcim.models import Device
+    from django.contrib.auth import get_user_model
+    from django.core.cache import cache
+    from django.db import close_old_connections, connection, transaction
+
+    from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+    from netbox_librenms_plugin.tests.view_test_helpers import make_request, make_superuser, post
+    from netbox_librenms_plugin.utils import mark_librenms_migrated, set_librenms_device_id
+    from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceParentView
+
+    donor = make_device("relationship-migrated-donor")
+    winner = make_device("relationship-migrated-winner")
+    child = make_interface(donor, "Ethernet1.100", iface_type="virtual")
+    parent = make_interface(donor, "Ethernet1")
+    set_librenms_device_id(child, 10, "default")
+    set_librenms_device_id(parent, 20, "default")
+    child.save()
+    parent.save()
+    user = make_superuser("relationship-migrated-user")
+    view_template = SyncInterfaceParentView()
+    cache_key = view_template.get_cache_key(donor, "ports", "default")
+    cache.set(
+        cache_key,
+        {
+            "ports": [
+                {"port_id": 10, "ifName": child.name},
+                {"port_id": 20, "ifName": parent.name},
+            ],
+            "port_stack_relationships": {"lag_members": {}, "sub_interfaces": {10: 20}},
+        },
+    )
+    donor_locked = Event()
+    request_checked_cache = Event()
+
+    class PausingSyncInterfaceParentView(SyncInterfaceParentView):
+        def _get_current_edge(self, *args, **kwargs):
+            edge = super()._get_current_edge(*args, **kwargs)
+            request_checked_cache.set()
+            return edge
+
+    def migrate_donor():
+        close_old_connections()
+        try:
+            with transaction.atomic():
+                locked_donor = Device.objects.select_for_update().get(pk=donor.pk)
+                donor_locked.set()
+                assert request_checked_cache.wait(5), "relationship request did not reach cache validation"
+                mark_librenms_migrated(locked_donor, winner.pk, "default")
+                locked_donor.save()
+        finally:
+            close_old_connections()
+
+    def write_relationship():
+        close_old_connections()
+        try:
+            with connection.cursor() as cursor:
+                cursor.execute("SET lock_timeout = '5s'")
+                cursor.execute("SET statement_timeout = '5s'")
+            thread_user = get_user_model().objects.get(pk=user.pk)
+            request = make_request(
+                "post",
+                {"port_id": "10", "parent_port_id": "20"},
+                user=thread_user,
+            )
+            view = PausingSyncInterfaceParentView()
+            view._librenms_api = SimpleNamespace(server_key="default")
+            return post(view, request, object_type="device", object_id=donor.pk)
+        finally:
+            close_old_connections()
+
+    try:
+        with ThreadPoolExecutor(max_workers=2) as executor:
+            migration_future = executor.submit(migrate_donor)
+            assert donor_locked.wait(5), "migration did not lock the donor"
+            relationship_future = executor.submit(write_relationship)
+            response = relationship_future.result(timeout=10)
+            migration_future.result(timeout=10)
+    finally:
+        cache.delete(cache_key)
+
+    assert response.status_code == 409
+    child.refresh_from_db()
+    assert child.parent_id is None
+
+
+def test_inline_relationship_does_not_lock_unrelated_interfaces():
+    """A single parent update must not lock every interface on the Device."""
+    from types import SimpleNamespace
+
+    from django.contrib.auth import get_user_model
+    from django.core.cache import cache
+    from django.db import close_old_connections, connection
+
+    from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+    from netbox_librenms_plugin.tests.view_test_helpers import make_request, make_superuser, post
+    from netbox_librenms_plugin.utils import set_librenms_device_id
+    from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceParentView
+
+    device = make_device("targeted-inline-lock")
+    child = make_interface(device, "Ethernet1.100", iface_type="virtual")
+    parent = make_interface(device, "Ethernet1")
+    unrelated = make_interface(device, "Ethernet99")
+    set_librenms_device_id(child, 10, "default")
+    set_librenms_device_id(parent, 20, "default")
+    child.save()
+    parent.save()
+    user = make_superuser("targeted-inline-lock-user")
+    view_template = SyncInterfaceParentView()
+    cache_key = view_template.get_cache_key(device, "ports", "default")
+    cache.set(
+        cache_key,
+        {
+            "ports": [
+                {"port_id": 10, "ifName": child.name},
+                {"port_id": 20, "ifName": parent.name},
+            ],
+            "port_stack_relationships": {"lag_members": {}, "sub_interfaces": {10: 20}},
+        },
+    )
+    validation_reached = Event()
+    release_relationship = Event()
+    unrelated_updated = Event()
+
+    def write_relationship():
+        close_old_connections()
+        try:
+            with connection.cursor() as cursor:
+                cursor.execute("SET lock_timeout = '5s'")
+                cursor.execute("SET statement_timeout = '5s'")
+            thread_user = get_user_model().objects.get(pk=user.pk)
+            request = make_request(
+                "post",
+                {"port_id": "10", "parent_port_id": "20"},
+                user=thread_user,
+            )
+            view = SyncInterfaceParentView()
+            view._librenms_api = SimpleNamespace(server_key="default")
+
+            def pause_before_validation(_related_interface):
+                validation_reached.set()
+                assert release_relationship.wait(5), "test did not release the relationship transaction"
+
+            view._prepare_related = pause_before_validation
+            response = post(view, request, object_type="device", object_id=device.pk)
+            assert response.status_code == 200, response.content
+        finally:
+            close_old_connections()
+
+    def update_unrelated():
+        close_old_connections()
+        try:
+            with connection.cursor() as cursor:
+                cursor.execute("SET lock_timeout = '5s'")
+                cursor.execute("SET statement_timeout = '5s'")
+            type(unrelated).objects.filter(pk=unrelated.pk).update(description="updated concurrently")
+            unrelated_updated.set()
+        finally:
+            close_old_connections()
+
+    try:
+        with ThreadPoolExecutor(max_workers=2) as executor:
+            relationship_future = executor.submit(write_relationship)
+            assert validation_reached.wait(5), "relationship sync did not reach validation"
+            update_future = executor.submit(update_unrelated)
+            updated_while_relationship_open = unrelated_updated.wait(0.75)
+            release_relationship.set()
+            relationship_future.result(timeout=10)
+            update_future.result(timeout=10)
+    finally:
+        cache.delete(cache_key)
+
+    assert updated_while_relationship_open
+    child.refresh_from_db()
+    unrelated.refresh_from_db()
+    assert child.parent_id == parent.pk
+    assert unrelated.description == "updated concurrently"
+
+
+def test_bulk_relationship_pass_skips_scope_locks_without_selected_edges():
+    """An unrelated cached edge must not serialize a selected access port."""
+    from django.contrib.auth import get_user_model
+    from django.db import close_old_connections, connection, transaction
+
+    from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+    from netbox_librenms_plugin.tests.view_test_helpers import make_request, make_superuser, make_view
+    from netbox_librenms_plugin.utils import set_librenms_device_id
+    from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+    device = make_device("bulk-unrelated-edge")
+    selected = make_interface(device, "Ethernet1")
+    child = make_interface(device, "Ethernet2.100", iface_type="virtual")
+    parent = make_interface(device, "Ethernet2")
+    for interface, port_id in ((selected, 10), (child, 20), (parent, 30)):
+        set_librenms_device_id(interface, port_id, "default")
+        interface.save()
+    user = make_superuser("bulk-unrelated-edge-user")
+    relationship_finished = Event()
+    ports = [
+        {"port_id": 10, "ifName": selected.name},
+        {"port_id": 20, "ifName": child.name},
+        {"port_id": 30, "ifName": parent.name},
+    ]
+
+    def apply_relationships():
+        close_old_connections()
+        try:
+            with connection.cursor() as cursor:
+                # Below the caller's future.result(timeout=5), as in sync_forged_target above.
+                cursor.execute("SET lock_timeout = '500ms'")
+                cursor.execute("SET statement_timeout = '5s'")
+            thread_device = type(device).objects.get(pk=device.pk)
+            thread_user = get_user_model().objects.get(pk=user.pk)
+            request = make_request("post", {}, user=thread_user)
+            view = make_view(SyncInterfacesView, request)
+            view.interface_name_field = "ifName"
+            view._selected_port_ids = {10}
+            view._sync_lag_and_parent_relationships(
+                thread_device,
+                ports,
+                {"lag_members": {}, "sub_interfaces": {20: 30}},
+                "default",
+            )
+            relationship_finished.set()
+        finally:
+            close_old_connections()
+
+    with ThreadPoolExecutor(max_workers=1) as executor:
+        with transaction.atomic():
+            type(device).objects.select_for_update().get(pk=device.pk)
+            future = executor.submit(apply_relationships)
+            future.result(timeout=5)
+
+    assert relationship_finished.is_set()
+
+
+def test_bulk_relationship_pass_does_not_lock_unrelated_interfaces():
+    """A selected parent edge must lock only its source and related candidates."""
+    from django.contrib.auth import get_user_model
+    from django.db import close_old_connections, connection, transaction
+
+    from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+    from netbox_librenms_plugin.tests.view_test_helpers import make_request, make_superuser, make_view
+    from netbox_librenms_plugin.utils import set_librenms_device_id
+    from netbox_librenms_plugin.views.sync.interfaces import SyncInterfacesView
+
+    device = make_device("bulk-targeted-edge")
+    child = make_interface(device, "Ethernet1.100", iface_type="virtual")
+    parent = make_interface(device, "Ethernet1")
+    unrelated = make_interface(device, "Ethernet99")
+    for interface, port_id in ((child, 10), (parent, 20), (unrelated, 30)):
+        set_librenms_device_id(interface, port_id, "default")
+        interface.save()
+    user = make_superuser("bulk-targeted-edge-user")
+    relationship_finished = Event()
+    ports = [
+        {"port_id": 10, "ifName": child.name},
+        {"port_id": 20, "ifName": parent.name},
+        {"port_id": 30, "ifName": unrelated.name},
+    ]
+
+    def apply_relationships():
+        close_old_connections()
+        try:
+            with connection.cursor() as cursor:
+                cursor.execute("SET lock_timeout = '500ms'")
+                cursor.execute("SET statement_timeout = '5s'")
+            thread_device = type(device).objects.get(pk=device.pk)
+            thread_user = get_user_model().objects.get(pk=user.pk)
+            request = make_request("post", {}, user=thread_user)
+            view = make_view(SyncInterfacesView, request)
+            view.interface_name_field = "ifName"
+            view._selected_port_ids = {10}
+            view._auto_selected_port_ids = set()
+            view._auto_selected_target_ids = {}
+            view._sync_lag_and_parent_relationships(
+                thread_device,
+                ports,
+                {"lag_members": {}, "sub_interfaces": {10: 20}},
+                "default",
+            )
+            relationship_finished.set()
+        finally:
+            close_old_connections()
+
+    with ThreadPoolExecutor(max_workers=1) as executor:
+        with transaction.atomic():
+            type(unrelated).objects.select_for_update().get(pk=unrelated.pk)
+            future = executor.submit(apply_relationships)
+            future.result(timeout=5)
+
+    assert relationship_finished.is_set()
+    child.refresh_from_db()
+    assert child.parent_id == parent.pk
+
+
+def test_relationship_scope_lock_blocks_new_virtual_chassis_members():
+    """The relationship scope must not gain an unlocked member after enumeration."""
+    from dcim.models import Device
+    from django.db import close_old_connections, connection, transaction
+
+    from netbox_librenms_plugin.tests.conftest import make_device
+    from netbox_librenms_plugin.views.sync.interfaces import _lock_relationship_scope
+
+    virtual_chassis, (page_device, _member) = make_virtual_chassis_members("relationship-phantom-member")
+    joining_device = make_device("relationship-phantom-joining")
+    scope_locked = Event()
+    release_scope = Event()
+    member_joined = Event()
+
+    def lock_scope():
+        close_old_connections()
+        try:
+            with connection.cursor() as cursor:
+                cursor.execute("SET lock_timeout = '5s'")
+                cursor.execute("SET statement_timeout = '5s'")
+            with transaction.atomic():
+                page = Device.objects.get(pk=page_device.pk)
+                locked_page, _locked_ids = _lock_relationship_scope(page)
+                assert locked_page is not None
+                scope_locked.set()
+                assert release_scope.wait(5), "test did not release the relationship scope"
+        finally:
+            close_old_connections()
+
+    def join_scope():
+        close_old_connections()
+        try:
+            with connection.cursor() as cursor:
+                cursor.execute("SET lock_timeout = '5s'")
+                cursor.execute("SET statement_timeout = '5s'")
+            Device.objects.filter(pk=joining_device.pk).update(
+                virtual_chassis=virtual_chassis,
+                vc_position=3,
+            )
+            member_joined.set()
+        finally:
+            close_old_connections()
+
+    with ThreadPoolExecutor(max_workers=2) as executor:
+        lock_future = executor.submit(lock_scope)
+        assert scope_locked.wait(5), "relationship scope was not locked"
+        join_future = executor.submit(join_scope)
+        joined_while_scope_locked = member_joined.wait(0.75)
+        release_scope.set()
+        lock_future.result(timeout=10)
+        join_future.result(timeout=10)
+
+    assert not joined_while_scope_locked
diff --git a/netbox_librenms_plugin/tests/test_sync_modules.py b/netbox_librenms_plugin/tests/test_sync_modules.py
index 4fba4063e9..0e10db057a 100644
--- a/netbox_librenms_plugin/tests/test_sync_modules.py
+++ b/netbox_librenms_plugin/tests/test_sync_modules.py
@@ -4468,7 +4468,7 @@ def noop_atomic():
             patch.object(ModuleBay, "objects") as mock_objects,
         ):
             mock_tx.atomic = noop_atomic
-            # The module is read through restrict(user, "change"), so hand back the same manager.
+            # Both reads go through restrict(user, ...), so hand back the same manager.
             mock_objects.restrict.return_value = mock_objects
             mock_objects.select_for_update.return_value = mock_qs
             view.request = request
@@ -4645,7 +4645,7 @@ def noop_atomic():
             patch.object(Module, "objects") as mock_objects,
         ):
             mock_tx.atomic = noop_atomic
-            # The module is read through restrict(user, "change"), so hand back the same manager.
+            # Both reads go through restrict(user, ...), so hand back the same manager.
             mock_objects.restrict.return_value = mock_objects
             mock_objects.select_for_update.return_value = mock_qs
             view.request = request
diff --git a/netbox_librenms_plugin/tests/test_sync_page_server_key_forms.py b/netbox_librenms_plugin/tests/test_sync_page_server_key_forms.py
index e8c7f83d11..3b3f8eb297 100644
--- a/netbox_librenms_plugin/tests/test_sync_page_server_key_forms.py
+++ b/netbox_librenms_plugin/tests/test_sync_page_server_key_forms.py
@@ -318,3 +318,68 @@ def test_stale_server_key_fails_closed(self):
         assert response.status_code == 302
         # No client was ever bound — nothing could have been written.
         assert getattr(view, "_librenms_api", None) is None
+
+
+@pytest.mark.django_db
+class TestInterfaceSyncRefreshButtonDeduped:
+    """The Refresh Interfaces button is rendered ONCE with the object-type-correct hx-post URL.
+
+    The device and VM buttons previously duplicated the whole button + hx-vals verbatim; the
+    template now resolves the URL per type and renders a single button, so the shared hx-vals
+    (pagination + server_key forwarding) lives in one place.
+    """
+
+    def _render(self, obj):
+        from unittest.mock import MagicMock
+
+        from django.template.loader import render_to_string
+
+        # A real request (with a user) so {% csrf_token %} and the context processors the
+        # template relies on resolve instead of rendering empty with a warning.
+        request = RequestFactory().get("/")
+        request.user = MagicMock(is_authenticated=True)
+        return render_to_string(
+            "netbox_librenms_plugin/_interface_sync.html",
+            {
+                "object": obj,
+                "has_librenms_id": True,
+                "librenms_server_info": {"server_key": "default"},
+            },
+            request=request,
+        )
+
+    def _refresh_button_tag(self, html, path):
+        hx_post = html.index(f'hx-post="{path}"')
+        return html[html.rfind("<button", 0, hx_post) : html.index(">", hx_post) + 1]
+
+    def test_device_refresh_button_single_with_device_url(self):
+        from django.urls import reverse
+
+        device = make_device("refresh-btn-dev")
+        html = self._render(device)
+        device_path = reverse("plugins:netbox_librenms_plugin:device_interface_sync", kwargs={"pk": device.pk})
+        vm_path = reverse("plugins:netbox_librenms_plugin:vm_interface_sync", kwargs={"pk": device.pk})
+
+        # Exactly one refresh action button (hx-post), pointing at the device URL, with the
+        # shared hx-vals — and never the VM branch's URL.
+        assert html.count("hx-post=") == 1
+        assert f'hx-post="{device_path}"' in html
+        button = self._refresh_button_tag(html, device_path)
+        assert "hx-vals=" in button and "interfaces_per_page" in button and "server_key" in button
+        assert vm_path not in html
+
+    def test_vm_refresh_button_single_with_vm_url(self):
+        from django.urls import reverse
+
+        from netbox_librenms_plugin.tests.conftest import make_vm
+
+        vm = make_vm("refresh-btn-vm")
+        html = self._render(vm)
+        vm_path = reverse("plugins:netbox_librenms_plugin:vm_interface_sync", kwargs={"pk": vm.pk})
+        device_path = reverse("plugins:netbox_librenms_plugin:device_interface_sync", kwargs={"pk": vm.pk})
+
+        assert html.count("hx-post=") == 1
+        assert f'hx-post="{vm_path}"' in html
+        button = self._refresh_button_tag(html, vm_path)
+        assert "hx-vals=" in button and "interfaces_per_page" in button and "server_key" in button
+        assert device_path not in html
diff --git a/netbox_librenms_plugin/tests/test_template_comments.py b/netbox_librenms_plugin/tests/test_template_comments.py
index 6f49df4f75..370f18fcb6 100644
--- a/netbox_librenms_plugin/tests/test_template_comments.py
+++ b/netbox_librenms_plugin/tests/test_template_comments.py
@@ -34,3 +34,148 @@ def test_no_multiline_single_hash_comments():
     assert not offenders, "Multi-line `{# #}` comments render as literal text — use `{% comment %}`:\n" + "\n".join(
         offenders
     )
+
+
+def _guard_precedes_all(src, needle):
+    """Assert every occurrence of *needle* sits inside an open `{% if not migrated_to_marker %}` block."""
+    # Walk the template tag-by-tag, maintaining a stack of currently-ACTIVE branch conditions,
+    # and require "not migrated_to_marker" to be somewhere in that stack at each needle
+    # occurrence. A depth-unaware rfind() would latch onto the INNERMOST {% if %} and miss an
+    # OUTER migrated guard whenever the needle is nested inside another conditional (false
+    # "unguarded" report). {% elif %}/{% else %} REPLACE their level's condition rather than
+    # popping/pushing: content after them renders when the original `if` condition is false,
+    # so the spent condition must stop counting as protection there.
+    import re
+
+    comment_re = re.compile(
+        r"{%-?\s*comment\s*-?%}.*?{%-?\s*endcomment\s*-?%}|{#.*?#}",
+        re.DOTALL,
+    )
+    src = comment_re.sub(lambda match: " " * len(match.group()), src)
+    tag_re = re.compile(
+        r"{%-?\s*if\s+(?P<if>.*?)\s*-?%}"
+        r"|{%-?\s*elif\s+(?P<elif>.*?)\s*-?%}"
+        r"|{%-?\s*(?P<else>else)\s*-?%}"
+        r"|{%-?\s*(?P<endif>endif)\s*-?%}"
+    )
+    occurrences = [m.start() for m in re.finditer(re.escape(needle), src)]
+    assert occurrences, f"{needle!r} not found"
+
+    def _condition_guards(condition):
+        # Quoted literals are data, not structure: they can carry `and`/`or`/the guard text
+        # without evaluating it, so blank them before analyzing the operator shape.
+        condition = re.sub(r"'[^']*'|\"[^\"]*\"", "", condition)
+        # Only a pure and-conjunction carrying the guard as one conjunct protects the needle:
+        # any `or` (and `and` binds tighter than `or` in Django's if-tag) can render the
+        # branch with the marker set regardless of the guard operand — fail closed on those.
+        if re.search(r"\s+or\s+", condition):
+            return False
+        return "not migrated_to_marker" in re.split(r"\s+and\s+", condition)
+
+    for pos in occurrences:
+        stack = []
+        for m in tag_re.finditer(src, 0, pos):
+            if m.group("if") is not None:
+                stack.append(m.group("if"))
+            elif m.group("elif") is not None:
+                assert stack, f"{{% elif %}} outside any {{% if %}} before {needle!r}"
+                stack[-1] = m.group("elif")
+            elif m.group("else") is not None:
+                assert stack, f"{{% else %}} outside any {{% if %}} before {needle!r}"
+                stack[-1] = "<else>"
+            else:  # {% endif %}
+                assert stack, f"unbalanced {{% endif %}} before {needle!r}"
+                stack.pop()
+        assert any(_condition_guards(condition) for condition in stack), (
+            f"{needle!r} occurrence at {pos} is not inside a `not migrated_to_marker` block"
+        )
+    return True
+
+
+def test_netbox_only_modal_hides_bulk_select_in_migrated_mode():
+    """In migrated-donor mode the NetBox-only modal is transfer-only (per-row Move), so the bulk-select controls (select-all header + per-row checkboxes) must be hidden and the copy must describe moving — not deleting — interfaces."""
+    src = (TEMPLATES_DIR / "netbox_librenms_plugin" / "_interface_sync_content.html").read_text(encoding="utf-8")
+
+    # Both bulk-select inputs must sit inside a `not migrated_to_marker` guard — every occurrence.
+    assert _guard_precedes_all(src, 'id="select-all-netbox-interfaces"')
+    assert _guard_precedes_all(src, 'name="interface_ids"')
+    # Transfer-oriented copy must be present for migrated mode.
+    assert "Migrated device:" in src
+    assert "Use <em>Move</em>" in src
+
+
+def test_guard_scan_is_block_depth_aware():
+    """A needle nested inside an inner {% if %} is still recognised as guarded by the outer migrated block."""
+    import pytest
+
+    # Guarded: the needle sits inside an INNER conditional that is itself inside the migrated guard.
+    # A depth-unaware rfind() latches onto `{% if extra %}` and wrongly reports it unguarded.
+    nested_guarded = "{% if not migrated_to_marker %}<div>{% if extra %}NEEDLE{% endif %}</div>{% endif %}"
+    assert _guard_precedes_all(nested_guarded, "NEEDLE")
+
+    # Unguarded: the migrated block has already closed; the needle lives in a later, unrelated block.
+    unguarded = "{% if not migrated_to_marker %}ok{% endif %}{% if other %}NEEDLE{% endif %}"
+    with pytest.raises(AssertionError):
+        _guard_precedes_all(unguarded, "NEEDLE")
+
+
+def test_guard_scan_ignores_template_tags_inside_comments():
+    """Template tags inside either Django comment form do not change the active guard."""
+    block_comment = "{% if not migrated_to_marker %}{% comment %}{% endif %}{% endcomment %}NEEDLE{% endif %}"
+    inline_comment = "{% if not migrated_to_marker %}{# {% endif %} #}NEEDLE{% endif %}"
+
+    assert _guard_precedes_all(block_comment, "NEEDLE")
+    assert _guard_precedes_all(inline_comment, "NEEDLE")
+
+
+def test_guard_scan_tracks_else_and_elif_branches():
+    """A needle in the {% else %}/{% elif %} branch of the migrated guard renders exactly when the marker IS set, so the scanner must stop counting the spent `if` condition as protection once the branch switches."""
+    import pytest
+
+    # The else branch renders in migrated mode — a bulk control moved there must FAIL the guard.
+    in_else = "{% if not migrated_to_marker %}ok{% else %}NEEDLE{% endif %}"
+    with pytest.raises(AssertionError):
+        _guard_precedes_all(in_else, "NEEDLE")
+
+    # Same for an elif branch: its own condition replaces the guard, it doesn't inherit it.
+    in_elif = "{% if not migrated_to_marker %}ok{% elif other %}NEEDLE{% endif %}"
+    with pytest.raises(AssertionError):
+        _guard_precedes_all(in_elif, "NEEDLE")
+
+    # The guard may also ARRIVE via elif — then the needle genuinely is protected.
+    guarded_by_elif = "{% if other %}x{% elif not migrated_to_marker %}NEEDLE{% endif %}"
+    assert _guard_precedes_all(guarded_by_elif, "NEEDLE")
+
+    # And the if-branch of a guard that HAS an else stays recognised as guarded.
+    if_branch = "{% if not migrated_to_marker %}NEEDLE{% else %}x{% endif %}"
+    assert _guard_precedes_all(if_branch, "NEEDLE")
+
+
+def test_guard_scan_handles_compound_conditions():
+    """An and-conjunct guard protects the needle; any or-compound must not count as protection."""
+    import pytest
+
+    # The guard as one conjunct of a pure `and` chain always gates the render — accepted.
+    and_compound = "{% if not migrated_to_marker and extra %}NEEDLE{% endif %}"
+    assert _guard_precedes_all(and_compound, "NEEDLE")
+
+    # An `or` branch renders with the marker set whenever the other operand is true — rejected.
+    or_compound = "{% if other or not migrated_to_marker %}NEEDLE{% endif %}"
+    with pytest.raises(AssertionError):
+        _guard_precedes_all(or_compound, "NEEDLE")
+
+    # Django's if-tag binds `and` tighter than `or`, so a guard conjunct left of an `or`
+    # doesn't gate the right operand's render path either — still rejected.
+    mixed = "{% if not migrated_to_marker and extra or other %}NEEDLE{% endif %}"
+    with pytest.raises(AssertionError):
+        _guard_precedes_all(mixed, "NEEDLE")
+
+    # Operators and the guard token inside QUOTED literals are data, not structure: a literal
+    # containing the guard text must not count as protection...
+    quoted_token = '{% if value == "x and not migrated_to_marker and y" %}NEEDLE{% endif %}'
+    with pytest.raises(AssertionError):
+        _guard_precedes_all(quoted_token, "NEEDLE")
+
+    # ...and an `or` inside a literal must not disqualify a genuine and-conjunct guard.
+    quoted_or = '{% if not migrated_to_marker and label == "local or remote" %}NEEDLE{% endif %}'
+    assert _guard_precedes_all(quoted_or, "NEEDLE")
diff --git a/netbox_librenms_plugin/tests/test_utils.py b/netbox_librenms_plugin/tests/test_utils.py
index f6a8ee8b9a..9bd6603fd6 100644
--- a/netbox_librenms_plugin/tests/test_utils.py
+++ b/netbox_librenms_plugin/tests/test_utils.py
@@ -395,8 +395,91 @@ def test_normalize_librenms_port_id_rejects_invalid_values(self):
         assert normalize_librenms_port_id(0) is None
         assert normalize_librenms_port_id(-1) is None
         assert normalize_librenms_port_id("abc") is None
+        assert normalize_librenms_port_id("2_0") is None
+        assert normalize_librenms_port_id("２０") is None
+        assert normalize_librenms_port_id("٢٠") is None
+        assert normalize_librenms_port_id("1" * 5000) is None
         assert normalize_librenms_port_id(1.5) is None
 
+    def test_oversized_digit_string_is_rejected_by_the_helper_not_the_interpreter(self):
+        """The length cap must hold with CPython's int_max_str_digits limit disabled."""
+        import sys
+
+        from netbox_librenms_plugin.utils import normalize_librenms_port_id
+
+        previous = sys.get_int_max_str_digits()
+        sys.set_int_max_str_digits(0)
+        try:
+            assert normalize_librenms_port_id("1" * 5000) is None
+            # 19 digits is the bigint width and stays acceptable.
+            assert normalize_librenms_port_id("9" * 19) == int("9" * 19)
+            assert normalize_librenms_port_id("9" * 20) is None
+        finally:
+            sys.set_int_max_str_digits(previous)
+
+    def test_unambiguous_interface_name_index_rejects_duplicate_ids_and_names(self):
+        from netbox_librenms_plugin.utils import get_interface_port_identity_sets
+
+        ports = [
+            {"port_id": 10, "ifDescr": "Ethernet"},
+            {"port_id": 11, "ifDescr": "Ethernet"},
+            {"port_id": 20, "ifDescr": "Parent"},
+            {"port_id": 20, "ifDescr": "Duplicate ID"},
+            {"port_id": 30, "ifDescr": "Unique"},
+            {"port_id": 40, "ifDescr": "Unique", "_source": "oob"},
+        ]
+
+        assert get_interface_port_identity_sets(ports, "ifDescr") == ({10, 11, 30}, {30})
+
+    def test_normalize_relationship_maps_normalizes_and_guards(self):
+        from netbox_librenms_plugin.utils import normalize_relationship_maps
+
+        # JSON-round-tripped string keys are normalized to int; both maps returned.
+        lag, sub = normalize_relationship_maps({"lag_members": {"10": 100}, "sub_interfaces": {"5": 7}})
+        assert lag == {10: 100}
+        assert sub == {5: 7}
+
+    def test_normalize_relationship_maps_drops_unresolvable_keys(self):
+        from netbox_librenms_plugin.utils import normalize_relationship_maps
+
+        relationships = {
+            "lag_members": {"bad": 100, "": 101, None: 102, "10": 103},
+            "sub_interfaces": {"0": 7, False: 8, "5": 9},
+        }
+
+        lag, sub = normalize_relationship_maps(relationships)
+
+        assert lag == {10: 103}
+        assert sub == {5: 9}
+
+    def test_normalize_relationship_maps_normalizes_values_and_drops_invalid_edges(self):
+        from netbox_librenms_plugin.utils import normalize_relationship_maps
+
+        relationships = {
+            "lag_members": {"10": "100", "11": [], "12": 0},
+            "sub_interfaces": {"20": "21", "22": None, "23": False},
+        }
+
+        assert normalize_relationship_maps(relationships) == ({10: 100}, {20: 21})
+
+    def test_normalize_relationship_maps_drops_conflicting_canonical_sources(self):
+        from netbox_librenms_plugin.utils import normalize_relationship_maps
+
+        first = {"lag_members": {"10": 20, "010": 30}, "sub_interfaces": {}}
+        reversed_order = {"lag_members": {"010": 30, "10": 20}, "sub_interfaces": {}}
+
+        assert normalize_relationship_maps(first) == ({}, {})
+        assert normalize_relationship_maps(reversed_order) == ({}, {})
+
+    def test_normalize_relationship_maps_coerces_corrupt_shapes_to_empty(self):
+        from netbox_librenms_plugin.utils import normalize_relationship_maps
+
+        # A non-dict relationships (corrupt / partial-write cache) must not raise.
+        assert normalize_relationship_maps(["garbage"]) == ({}, {})
+        assert normalize_relationship_maps(None) == ({}, {})
+        # Present-but-non-dict nested maps collapse to {} instead of AttributeError on .items().
+        assert normalize_relationship_maps({"lag_members": None, "sub_interfaces": [1, 2]}) == ({}, {})
+
 
 # =============================================================================
 # TestVirtualChassisHelpers - 4 tests
@@ -805,6 +888,7 @@ def test_get_table_paginate_count_default(self, mock_netbox_paginate, mock_confi
         mock_netbox_paginate.return_value = 25
         mock_request = MagicMock()
         mock_request.GET = {}
+        mock_request.POST = {}
 
         result = get_table_paginate_count(mock_request, "table1_")
 
@@ -1745,28 +1829,6 @@ def test_empty_address_is_none(self):
         assert ip_family(IPAddress()) is None
 
 
-@pytest.mark.django_db
-class TestGetVirtualChassisMemberNoneName:
-    """A LibreNMS port row can lack the selected name field entirely (port.get(...) -> None)."""
-
-    def test_none_port_name_returns_device_instead_of_typeerror(self):
-        """A None port name falls back to the viewed device instead of raising TypeError (was a 500)."""
-        from dcim.models import Device, DeviceRole, DeviceType, Manufacturer, Site, VirtualChassis
-
-        from netbox_librenms_plugin.utils import get_virtual_chassis_member
-
-        site = Site.objects.create(name="vc-none-site", slug="vc-none-site")
-        mfr = Manufacturer.objects.create(name="vc-none-mfr", slug="vc-none-mfr")
-        dtype = DeviceType.objects.create(manufacturer=mfr, model="vc-none-dt", slug="vc-none-dt")
-        role = DeviceRole.objects.create(name="vc-none-role", slug="vc-none-role")
-        dev = Device.objects.create(name="vc-none-dev", site=site, device_type=dtype, role=role)
-        vc = VirtualChassis.objects.create(name="vc-none", master=dev)
-        Device.objects.filter(pk=dev.pk).update(virtual_chassis=vc, vc_position=1)
-        dev.refresh_from_db()
-
-        assert get_virtual_chassis_member(dev, None) is dev
-
-
 class TestCoercePositiveInt:
     """coerce_positive_int accepts only positive int / int-string and rejects non-integer types (no float truncation)."""
 
@@ -1795,3 +1857,21 @@ def test_coercion(self, value, expected):
         from netbox_librenms_plugin.utils import coerce_positive_int
 
         assert coerce_positive_int(value) == expected
+
+
+@pytest.mark.django_db
+class TestGetVirtualChassisMemberNoneName:
+    """A LibreNMS port row can lack the selected name field entirely (port.get(...) -> None)."""
+
+    def test_none_port_name_returns_device_instead_of_typeerror(self):
+        """A None port name falls back to the viewed device instead of raising TypeError (was a 500)."""
+        from netbox_librenms_plugin.tests.conftest import make_device, make_virtual_chassis
+        from netbox_librenms_plugin.utils import get_virtual_chassis_member
+
+        dev = make_device("vc-none-name-dev")
+        member = make_device("vc-none-name-m2")
+        make_virtual_chassis("vc-none-name", dev, member)
+
+        assert get_virtual_chassis_member(dev, None) is dev
+        # The prefetched-map variant must survive the same input.
+        assert get_virtual_chassis_member(dev, None, members_by_position={2: member}) is dev
diff --git a/netbox_librenms_plugin/tests/test_verify_views.py b/netbox_librenms_plugin/tests/test_verify_views.py
index 06a0b85dab..9e0ba357ce 100644
--- a/netbox_librenms_plugin/tests/test_verify_views.py
+++ b/netbox_librenms_plugin/tests/test_verify_views.py
@@ -15,6 +15,17 @@
 from netbox_librenms_plugin.views.object_sync.devices import SingleInterfaceVerifyView
 
 
+@pytest.fixture(autouse=True)
+def mock_librenms_config():
+    """Neutralize the suite-wide autouse config mock (registered via ``pytest_plugins``).
+
+    That mock pins ``get_plugin_config`` to a ``default``-only server map, so the ``stub`` key
+    these tests post becomes an unknown explicit key and the view fails closed before it reaches
+    the behaviour under test. Same-name module fixture wins over the plugin's autouse one.
+    """
+    yield
+
+
 def _make_request(body: dict) -> MagicMock:
     """Create a mock POST request with JSON body."""
     request = MagicMock()
@@ -256,6 +267,1231 @@ def test_no_device_id_returns_400(self):
         data = json.loads(response.content)
         assert data["status"] == "error"
 
+    @pytest.mark.django_db
+    def test_verify_does_not_name_match_interface_bound_to_another_port(self):
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+        from netbox_librenms_plugin.tests.view_test_helpers import make_request
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+
+        device = make_device("verify-conflicting-port-id")
+        wrong_interface = make_interface(device, "Ethernet1")
+        set_librenms_device_id(wrong_interface, 30, "default")
+        wrong_interface.save()
+        view = SingleInterfaceVerifyView()
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        view._librenms_api = api
+        cache_key = view.get_cache_key(device, "ports", "default")
+        cache.set(
+            cache_key,
+            {
+                "ports": [
+                    {
+                        "port_id": 20,
+                        "ifName": "Ethernet1",
+                        "ifDescr": "Ethernet1",
+                        "ifAlias": "",
+                        "ifType": "ethernetCsmacd",
+                        "ifSpeed": 1_000_000_000,
+                        "ifPhysAddress": "",
+                        "ifMtu": 1500,
+                        "ifAdminStatus": "up",
+                        "_source": "host",
+                    }
+                ],
+                "port_stack_relationships": {},
+            },
+        )
+        request = make_request(
+            "post",
+            json.dumps(
+                {
+                    "device_id": device.pk,
+                    "interface_name": "Ethernet1",
+                    "interface_name_field": "ifName",
+                    "port_id": 20,
+                }
+            ),
+            user=_verify_superuser("conflicting-port-id"),
+            path="/verify/",
+            content_type="application/json",
+        )
+
+        try:
+            response = view.post(request)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 200
+        row = json.loads(response.content)["formatted_row"]
+        assert "text-danger" in row["name"]
+
+    @pytest.mark.django_db
+    def test_verify_member_switch_returns_the_selected_members_vlan_group(self):
+        from django.contrib.contenttypes.models import ContentType
+        from django.core.cache import cache
+        from dcim.models import Rack
+        from ipam.models import VLAN, VLANGroup
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.tests.conftest import make_virtual_chassis_members
+        from netbox_librenms_plugin.tests.view_test_helpers import make_request
+
+        _virtual_chassis, (member1, member2) = make_virtual_chassis_members("verify-vlan-owner")
+        rack1 = Rack.objects.create(name="Verify VLAN Rack 1", site=member1.site, status="active")
+        rack2 = Rack.objects.create(name="Verify VLAN Rack 2", site=member1.site, status="active")
+        member1.rack = rack1
+        member2.rack = rack2
+        member1.save()
+        member2.save()
+        rack_type = ContentType.objects.get_for_model(Rack)
+        group1 = VLANGroup.objects.create(
+            name="Verify VLAN Group 1",
+            slug="verify-vlan-group-1",
+            scope_type=rack_type,
+            scope_id=rack1.pk,
+        )
+        group2 = VLANGroup.objects.create(
+            name="Verify VLAN Group 2",
+            slug="verify-vlan-group-2",
+            scope_type=rack_type,
+            scope_id=rack2.pk,
+        )
+        VLAN.objects.create(vid=100, name="Verify Rack 1 VLAN", group=group1, status="active")
+        VLAN.objects.create(vid=100, name="Verify Rack 2 VLAN", group=group2, status="active")
+        view = SingleInterfaceVerifyView()
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        view._librenms_api = api
+        cache_key = view.get_cache_key(member1, "ports", "default")
+        cache.set(
+            cache_key,
+            {
+                "ports": [
+                    {
+                        "port_id": 10,
+                        "ifName": "Ethernet2",
+                        "ifDescr": "Ethernet2",
+                        "ifAlias": "",
+                        "ifType": "ethernetCsmacd",
+                        "ifSpeed": 1_000_000_000,
+                        "ifPhysAddress": "",
+                        "ifMtu": 1500,
+                        "ifAdminStatus": "up",
+                        "untagged_vlan": 100,
+                        "tagged_vlans": [],
+                    }
+                ],
+                "port_stack_relationships": {},
+            },
+        )
+        request = make_request(
+            "post",
+            json.dumps(
+                {
+                    "device_id": member2.pk,
+                    "interface_name": "Ethernet2",
+                    "interface_name_field": "ifName",
+                    "port_id": 10,
+                }
+            ),
+            user=_verify_superuser("vlan-owner"),
+            path="/verify/",
+            content_type="application/json",
+        )
+
+        try:
+            response = view.post(request)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 200
+        vlan_cell = json.loads(response.content)["formatted_row"]["vlans"]
+        assert f'name="vlan_group_10_100" value="{group2.pk}"' in vlan_cell
+        assert f'name="vlan_group_10_100" value="{group1.pk}"' not in vlan_cell
+
+    @pytest.mark.django_db
+    def test_verify_normalizes_relationship_map_keys(self):
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+        from netbox_librenms_plugin.tests.view_test_helpers import make_request
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+
+        device = make_device("verify-string-relationship-key")
+        child = make_interface(device, "Ethernet1.100", iface_type="virtual")
+        parent = make_interface(device, "Ethernet1")
+        set_librenms_device_id(child, 10, "default")
+        set_librenms_device_id(parent, 20, "default")
+        child.save()
+        parent.save()
+        view = SingleInterfaceVerifyView()
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        view._librenms_api = api
+        cache_key = view.get_cache_key(device, "ports", "default")
+        cache.set(
+            cache_key,
+            {
+                "ports": [
+                    {
+                        "port_id": 10,
+                        "ifName": child.name,
+                        "ifDescr": child.name,
+                        "ifAlias": "",
+                        "ifType": "l2vlan",
+                        "ifSpeed": 1_000_000_000,
+                        "ifPhysAddress": "",
+                        "ifMtu": 1500,
+                        "ifAdminStatus": "up",
+                    },
+                    {
+                        "port_id": 20,
+                        "ifName": parent.name,
+                        "ifDescr": parent.name,
+                        "ifAlias": "",
+                        "ifType": "ethernetCsmacd",
+                        "ifSpeed": 1_000_000_000,
+                        "ifPhysAddress": "",
+                        "ifMtu": 1500,
+                        "ifAdminStatus": "up",
+                    },
+                ],
+                "port_stack_relationships": {"lag_members": {}, "sub_interfaces": {"10": 20}},
+            },
+        )
+        request = make_request(
+            "post",
+            json.dumps(
+                {
+                    "device_id": device.pk,
+                    "interface_name_field": "ifName",
+                    "port_id": 10,
+                }
+            ),
+            user=_verify_superuser("string-relationship-key"),
+            path="/verify/",
+            content_type="application/json",
+        )
+
+        try:
+            response = view.post(request)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 200
+        assert parent.name in json.loads(response.content)["formatted_row"]["parent"]
+
+    @pytest.mark.django_db
+    @pytest.mark.parametrize(
+        "bad_relationships",
+        [
+            None,
+            ["not", "a", "dict"],
+            "garbage",
+            {"lag_members": None, "sub_interfaces": None},
+            {"lag_members": "nope", "sub_interfaces": 42},
+        ],
+    )
+    def test_verify_handles_malformed_relationship_cache(self, bad_relationships):
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.tests.conftest import make_device
+        from netbox_librenms_plugin.tests.view_test_helpers import make_request
+
+        device = make_device("verify-malformed-relationships")
+        view = SingleInterfaceVerifyView()
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        view._librenms_api = api
+        cache_key = view.get_cache_key(device, "ports", "default")
+        cache.set(
+            cache_key,
+            {
+                "ports": [
+                    {
+                        "port_id": 10,
+                        "ifName": "Et1",
+                        "ifDescr": "Et1",
+                        "ifAlias": "",
+                        "ifType": "ethernetCsmacd",
+                        "ifSpeed": 1_000_000_000,
+                        "ifPhysAddress": "",
+                        "ifMtu": 1500,
+                        "ifAdminStatus": "up",
+                    }
+                ],
+                "port_stack_relationships": bad_relationships,
+            },
+        )
+        request = make_request(
+            "post",
+            json.dumps(
+                {
+                    "device_id": device.pk,
+                    "interface_name_field": "ifName",
+                    "port_id": 10,
+                }
+            ),
+            user=_verify_superuser(f"malformed-{type(bad_relationships).__name__}"),
+            path="/verify/",
+            content_type="application/json",
+        )
+
+        try:
+            response = view.post(request)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 200
+        row = json.loads(response.content)["formatted_row"]
+        assert "Parent" not in row["parent"]
+
+    @pytest.mark.django_db
+    def test_verify_missed_port_id_does_not_repaint_same_named_row(self):
+        """A supplied port_id is authoritative: if it misses, do NOT fall back to a same-named row."""
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.tests.conftest import make_device
+        from netbox_librenms_plugin.tests.view_test_helpers import make_request
+
+        device = make_device("verify-authoritative-pid")
+        user = _verify_superuser("authoritative-pid")
+        view = SingleInterfaceVerifyView()
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        view._librenms_api = api
+        cache_key = view.get_cache_key(device, "ports", "default")
+        cache.set(
+            cache_key,
+            {
+                "ports": [
+                    {
+                        "port_id": 99,
+                        "ifName": "Et1",
+                        "ifDescr": "Et1",
+                        "ifAlias": "",
+                        "ifType": "ethernetCsmacd",
+                        "ifSpeed": 1_000_000_000,
+                        "ifPhysAddress": "",
+                        "ifMtu": 1500,
+                        "ifAdminStatus": "up",
+                        "_source": "host",
+                    }
+                ]
+            },
+        )
+        matching_request = make_request(
+            "post",
+            json.dumps(
+                {"device_id": device.pk, "interface_name": "Et1", "interface_name_field": "ifName", "port_id": 99}
+            ),
+            user=user,
+            path="/verify/",
+            content_type="application/json",
+        )
+        missed_request = make_request(
+            "post",
+            json.dumps(
+                {
+                    "device_id": device.pk,
+                    "interface_name": "Et1",
+                    "interface_name_field": "ifName",
+                    "port_id": 777,
+                }
+            ),
+            user=user,
+            path="/verify/",
+            content_type="application/json",
+        )
+
+        try:
+            assert view.post(matching_request).status_code == 200
+            response = view.post(missed_request)
+        finally:
+            cache.delete(cache_key)
+
+        # The authoritative-but-missed id yields "not found", never a wrong-row repaint.
+        assert response.status_code == 404
+        data = json.loads(response.content)
+        assert data["status"] == "error"
+
+    @pytest.mark.django_db
+    def test_verify_name_hint_derived_from_matched_row(self):
+        """The interface name fallback is taken from the port_id-matched cached row, not the posted display name."""
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+        from netbox_librenms_plugin.tests.view_test_helpers import make_request
+
+        device = make_device("verify-namehint")
+        make_interface(device, "Et1")
+        view = SingleInterfaceVerifyView()
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        view._librenms_api = api
+        cache_key = view.get_cache_key(device, "ports", "default")
+        cache.set(
+            cache_key,
+            {
+                "ports": [
+                    {
+                        "port_id": 10,
+                        "ifName": "Et1",
+                        "ifDescr": "Et1",
+                        "ifAlias": "",
+                        "ifType": "ethernetCsmacd",
+                        "ifSpeed": 1_000_000_000,
+                        "ifPhysAddress": "",
+                        "ifMtu": 1500,
+                        "ifAdminStatus": "up",
+                    }
+                ]
+            },
+        )
+        request = make_request(
+            "post",
+            json.dumps(
+                {
+                    "device_id": device.pk,
+                    "interface_name": "stale-display-name",
+                    "interface_name_field": "ifName",
+                    "port_id": 10,
+                }
+            ),
+            user=_verify_superuser("namehint"),
+            path="/verify/",
+            content_type="application/json",
+        )
+
+        try:
+            response = view.post(request)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 200
+        row = json.loads(response.content)["formatted_row"]
+        assert "text-success" in row["name"]
+        assert "stale-display-name" not in row["name"]
+
+    @pytest.mark.django_db
+    def test_table_and_verify_resolve_the_same_stable_id_row(self, client):
+        """The table and verify endpoint must prefer the same stable-ID interface."""
+        from django.core.cache import cache
+        from django.urls import reverse
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+        from netbox_librenms_plugin.tests.view_test_helpers import make_request
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
+
+        server_key = next(iter(LibreNMSAPI.get_available_servers()))
+        device = make_device("verify-table-resolution")
+        stable_match = make_interface(device, "NetBoxStable")
+        name_candidate = make_interface(device, "Ethernet1")
+        set_librenms_device_id(stable_match, 10, server_key)
+        stable_match.mtu = 9000
+        stable_match.save()
+        name_candidate.mtu = 1500
+        name_candidate.save()
+        snapshot = {
+            "ports": [
+                {
+                    "port_id": 10,
+                    "ifName": "Ethernet1",
+                    "ifDescr": "Ethernet1",
+                    "ifAlias": "",
+                    "ifType": "ethernetCsmacd",
+                    "ifSpeed": 1_000_000_000,
+                    "ifPhysAddress": "",
+                    "ifMtu": 9000,
+                    "ifAdminStatus": "up",
+                }
+            ],
+            "port_stack_relationships": {},
+        }
+        user = _verify_superuser("table-resolution")
+        table_request = make_request("get", user=user)
+        table_view = DeviceInterfaceTableView()
+        table_view._librenms_api = LibreNMSAPI(server_key)
+        table_view.request = table_request
+        cache_key = table_view.get_cache_key(device, "ports", server_key)
+        cache.set(cache_key, snapshot)
+
+        try:
+            context = table_view.get_context_data(
+                table_request,
+                device,
+                "ifName",
+                server_key,
+                fresh_data=snapshot,
+                sync_device=device,
+            )
+            table_row = snapshot["ports"][0]
+            table_name = str(context["table"].render_name(table_row["ifName"], table_row))
+            table_mtu = str(context["table"].render_mtu(table_row["ifMtu"], table_row))
+
+            client.force_login(user)
+            response = client.post(
+                reverse("plugins:netbox_librenms_plugin:verify_interface"),
+                data=json.dumps(
+                    {
+                        "device_id": device.pk,
+                        "server_key": server_key,
+                        "interface_name_field": "ifName",
+                        "port_id": 10,
+                    }
+                ),
+                content_type="application/json",
+            )
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 200, response.content
+        formatted_row = json.loads(response.content)["formatted_row"]
+        verify_name = formatted_row["name"]
+        assert verify_name == table_name
+        assert formatted_row["mtu"] == table_mtu
+        assert "text-success" in formatted_row["mtu"]
+
+    @pytest.mark.django_db
+    def test_verify_keeps_view_only_interface_match_without_offering_relationship_write(self):
+        from django.core.cache import cache
+        from dcim.models import Device, Interface
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+        from netbox_librenms_plugin.tests.view_test_helpers import make_request, make_user_with_perms
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+
+        device = make_device("verify-view-only-match")
+        child = make_interface(device, "Ethernet1.100", iface_type="virtual")
+        parent = make_interface(device, "Ethernet1")
+        set_librenms_device_id(child, 10, "default")
+        set_librenms_device_id(parent, 20, "default")
+        child.save()
+        parent.save()
+        user = make_user_with_perms(
+            "verify-view-only-match",
+            [("view", Device), ("view", Interface)],
+        )
+        snapshot = {
+            "ports": [
+                {
+                    "port_id": 10,
+                    "ifName": child.name,
+                    "ifDescr": child.name,
+                    "ifAlias": "",
+                    "ifType": "l2vlan",
+                    "ifSpeed": 1_000_000_000,
+                    "ifPhysAddress": "",
+                    "ifMtu": 1500,
+                    "ifAdminStatus": "up",
+                },
+                {
+                    "port_id": 20,
+                    "ifName": parent.name,
+                    "ifDescr": parent.name,
+                    "ifAlias": "",
+                    "ifType": "ethernetCsmacd",
+                    "ifSpeed": 1_000_000_000,
+                    "ifPhysAddress": "",
+                    "ifMtu": 1500,
+                    "ifAdminStatus": "up",
+                },
+            ],
+            "port_stack_relationships": {"lag_members": {}, "sub_interfaces": {10: 20}},
+        }
+        view = SingleInterfaceVerifyView()
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        view._librenms_api = api
+        cache_key = view.get_cache_key(device, "ports", "default")
+        cache.set(cache_key, snapshot)
+        request = make_request(
+            "post",
+            json.dumps(
+                {
+                    "device_id": device.pk,
+                    "interface_name_field": "ifName",
+                    "port_id": 10,
+                }
+            ),
+            user=user,
+            path="/verify/",
+            content_type="application/json",
+        )
+
+        try:
+            response = view.post(request)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 200
+        row = json.loads(response.content)["formatted_row"]
+        assert "text-success" in row["name"]
+        assert "parent-sync-btn" not in row["parent"]
+
+    @pytest.mark.django_db
+    def test_plugin_read_only_user_never_receives_relationship_write_button(self):
+        from django.apps import apps
+        from django.core.cache import cache
+        from dcim.models import Device, Interface
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+        from netbox_librenms_plugin.tests.view_test_helpers import (
+            grant,
+            make_request,
+            make_user_with_perms,
+        )
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
+
+        device = make_device("verify-plugin-read-only")
+        child = make_interface(device, "Ethernet1.100", iface_type="virtual")
+        parent = make_interface(device, "Ethernet1")
+        set_librenms_device_id(child, 10, "default")
+        set_librenms_device_id(parent, 20, "default")
+        child.save()
+        parent.save()
+        user = make_user_with_perms(
+            "verify-plugin-read-only",
+            [("view", Device), ("view", Interface), ("change", Interface)],
+            plugin_write=False,
+        )
+        settings_model = apps.get_model("netbox_librenms_plugin", "LibreNMSSettings")
+        user = grant(user, "view", settings_model)
+        snapshot = {
+            "ports": [
+                {
+                    "port_id": 10,
+                    "ifName": child.name,
+                    "ifDescr": child.name,
+                    "ifAlias": "",
+                    "ifType": "l2vlan",
+                    "ifSpeed": 1_000_000_000,
+                    "ifPhysAddress": "",
+                    "ifMtu": 1500,
+                    "ifAdminStatus": "up",
+                },
+                {
+                    "port_id": 20,
+                    "ifName": parent.name,
+                    "ifDescr": parent.name,
+                    "ifAlias": "",
+                    "ifType": "ethernetCsmacd",
+                    "ifSpeed": 1_000_000_000,
+                    "ifPhysAddress": "",
+                    "ifMtu": 1500,
+                    "ifAdminStatus": "up",
+                },
+            ],
+            "port_stack_relationships": {"lag_members": {}, "sub_interfaces": {10: 20}},
+        }
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        table_request = make_request("get", user=user)
+        table_view = DeviceInterfaceTableView()
+        table_view._librenms_api = api
+        table_view.request = table_request
+        cache_key = table_view.get_cache_key(device, "ports", "default")
+        cache.set(cache_key, snapshot)
+
+        try:
+            context = table_view.get_context_data(
+                table_request,
+                device,
+                "ifName",
+                "default",
+                fresh_data=snapshot,
+                sync_device=device,
+            )
+            table_html = str(context["table"].render_parent(None, snapshot["ports"][0]))
+
+            verify_view = SingleInterfaceVerifyView()
+            verify_view._librenms_api = api
+            verify_request = make_request(
+                "post",
+                json.dumps({"device_id": device.pk, "interface_name_field": "ifName", "port_id": 10}),
+                user=user,
+                path="/verify/",
+                content_type="application/json",
+            )
+            verify_response = verify_view.post(verify_request)
+        finally:
+            cache.delete(cache_key)
+
+        assert verify_response.status_code == 200, verify_response.content
+        assert "parent-sync-btn" not in table_html
+        assert "parent-sync-btn" not in json.loads(verify_response.content)["formatted_row"]["parent"]
+
+    @pytest.mark.django_db
+    @pytest.mark.parametrize("migrated", [False, True], ids=["active-page", "migrated-page"])
+    def test_virtual_chassis_member_verify_uses_the_origin_page_mode(self, migrated):
+        """Member verification must keep the page mode and target the selected member."""
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.tests.conftest import (
+            make_device,
+            make_interface,
+            make_virtual_chassis_members,
+        )
+        from netbox_librenms_plugin.tests.view_test_helpers import make_request, make_superuser
+        from netbox_librenms_plugin.utils import mark_librenms_migrated, set_librenms_device_id
+
+        _virtual_chassis, (page_device, selected_device) = make_virtual_chassis_members("verify-migrated-page")
+        winner = make_device("verify-migrated-winner")
+        child = make_interface(selected_device, "Ethernet2.100", iface_type="virtual")
+        parent = make_interface(selected_device, "Ethernet2")
+        set_librenms_device_id(child, 10, "default")
+        set_librenms_device_id(parent, 20, "default")
+        child.save()
+        parent.save()
+        if migrated:
+            mark_librenms_migrated(page_device, winner.pk, "default")
+            page_device.save()
+        snapshot = {
+            "ports": [
+                {
+                    "port_id": 10,
+                    "ifName": child.name,
+                    "ifDescr": child.name,
+                    "ifAlias": "",
+                    "ifType": "l2vlan",
+                    "ifSpeed": 1_000_000_000,
+                    "ifPhysAddress": "",
+                    "ifMtu": 1500,
+                    "ifAdminStatus": "up",
+                },
+                {
+                    "port_id": 20,
+                    "ifName": parent.name,
+                    "ifDescr": parent.name,
+                    "ifAlias": "",
+                    "ifType": "ethernetCsmacd",
+                    "ifSpeed": 1_000_000_000,
+                    "ifPhysAddress": "",
+                    "ifMtu": 1500,
+                    "ifAdminStatus": "up",
+                },
+            ],
+            "port_stack_relationships": {"lag_members": {}, "sub_interfaces": {10: 20}},
+        }
+        view = SingleInterfaceVerifyView()
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        view._librenms_api = api
+        cache_key = view.get_cache_key(page_device, "ports", "default")
+        cache.set(cache_key, snapshot)
+        request = make_request(
+            "post",
+            json.dumps(
+                {
+                    "device_id": selected_device.pk,
+                    "origin_device_id": page_device.pk,
+                    "interface_name_field": "ifName",
+                    "port_id": 10,
+                }
+            ),
+            user=make_superuser("verify-migrated-page"),
+            path="/verify/",
+            content_type="application/json",
+        )
+
+        try:
+            response = view.post(request)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 200, response.content
+        parent_html = json.loads(response.content)["formatted_row"]["parent"]
+        if migrated:
+            assert "parent-sync-btn" not in parent_html
+        else:
+            assert "parent-sync-btn" in parent_html
+            assert f"/device/{selected_device.pk}/sync-interface-parent/" in parent_html
+
+    @pytest.mark.django_db
+    def test_verify_response_does_not_expose_inaccessible_vc_members(self):
+        from django.core.cache import cache
+        from dcim.models import Device
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.tests.conftest import make_virtual_chassis_members
+        from netbox_librenms_plugin.tests.view_test_helpers import grant, make_request, make_user_with_perms
+
+        _virtual_chassis, (page_device, selected_device, hidden_device) = make_virtual_chassis_members(
+            "verify-member-scope",
+            count=3,
+        )
+        user = make_user_with_perms("verify-member-scope", [])
+        user = grant(user, "view", Device, constraints={"pk": page_device.pk})
+        user = grant(user, "view", Device, constraints={"pk": selected_device.pk})
+        snapshot = {
+            "ports": [
+                {
+                    "port_id": 10,
+                    "ifName": "Ethernet2",
+                    "ifDescr": "Ethernet2",
+                    "ifAlias": "",
+                    "ifType": "ethernetCsmacd",
+                    "ifSpeed": 1_000_000_000,
+                    "ifPhysAddress": "",
+                    "ifMtu": 1500,
+                    "ifAdminStatus": "up",
+                }
+            ],
+            "port_stack_relationships": {},
+        }
+        view = SingleInterfaceVerifyView()
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        view._librenms_api = api
+        cache_key = view.get_cache_key(page_device, "ports", "default")
+        cache.set(cache_key, snapshot)
+        request = make_request(
+            "post",
+            json.dumps(
+                {
+                    "device_id": selected_device.pk,
+                    "origin_device_id": page_device.pk,
+                    "interface_name_field": "ifName",
+                    "port_id": 10,
+                }
+            ),
+            user=user,
+            path="/verify/",
+            content_type="application/json",
+        )
+
+        try:
+            response = view.post(request)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 200, response.content
+        formatted_row = json.loads(response.content)["formatted_row"]
+        body = response.content.decode()
+        assert "device_selection" not in formatted_row
+        assert hidden_device.name not in body
+        # Match the pk as a device REFERENCE, not as a bare substring: `str(pk) in body`
+        # also matches any rendered number (ifMtu 1500 collided with pk 1500), so the old
+        # assertion failed on pk allocation rather than on a member actually leaking.
+        assert f"/dcim/devices/{hidden_device.pk}/" not in body
+
+    @pytest.mark.django_db
+    def test_hidden_related_owner_stays_unavailable_through_verify_and_inline_post(self):
+        from types import SimpleNamespace
+
+        from django.core.cache import cache
+        from dcim.models import Device, Interface
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.tests.conftest import make_interface, make_virtual_chassis_members
+        from netbox_librenms_plugin.tests.view_test_helpers import (
+            grant,
+            make_request,
+            make_user_with_perms,
+            post,
+        )
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceParentView
+
+        _virtual_chassis, (page_device, hidden_parent_device) = make_virtual_chassis_members(
+            "verify-hidden-parent-owner"
+        )
+        child = make_interface(page_device, "Ethernet1.100", iface_type="virtual")
+        parent = make_interface(hidden_parent_device, "Ethernet2")
+        # Use the real configured key. The devcontainer names it ``stub`` while CI names it
+        # ``default``; a hardcoded key makes the request fail before the permission behavior.
+        server_key = next(iter(LibreNMSAPI.get_available_servers()))
+        set_librenms_device_id(child, 10, server_key)
+        set_librenms_device_id(parent, 20, server_key)
+        child.save()
+        parent.save()
+        user = make_user_with_perms("verify-hidden-parent-owner", [])
+        user = grant(user, "view", Device, constraints={"pk": page_device.pk})
+        user = grant(user, "change", Interface, constraints={"pk": child.pk})
+        user = grant(user, "view", Interface, constraints={"pk": parent.pk})
+        snapshot = {
+            "ports": [
+                {
+                    "port_id": 10,
+                    "ifName": child.name,
+                    "ifDescr": child.name,
+                    "ifAlias": "",
+                    "ifType": "l2vlan",
+                    "ifSpeed": 1_000_000_000,
+                    "ifPhysAddress": "",
+                    "ifMtu": 1500,
+                    "ifAdminStatus": "up",
+                },
+                {
+                    "port_id": 20,
+                    "ifName": parent.name,
+                    "ifDescr": parent.name,
+                    "ifAlias": "",
+                    "ifType": "ethernetCsmacd",
+                    "ifSpeed": 1_000_000_000,
+                    "ifPhysAddress": "",
+                    "ifMtu": 1500,
+                    "ifAdminStatus": "up",
+                },
+            ],
+            "port_stack_relationships": {"lag_members": {}, "sub_interfaces": {10: 20}},
+        }
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = server_key
+        table_request = make_request("get", user=user)
+        table_view = DeviceInterfaceTableView()
+        table_view._librenms_api = api
+        table_view.request = table_request
+        cache_key = table_view.get_cache_key(page_device, "ports", server_key)
+        cache.set(cache_key, snapshot)
+
+        try:
+            context = table_view.get_context_data(
+                table_request,
+                page_device,
+                "ifName",
+                server_key,
+                fresh_data=snapshot,
+                sync_device=page_device,
+            )
+            assert "parent-sync-btn" not in str(context["table"].render_parent(None, snapshot["ports"][0]))
+
+            verify_view = SingleInterfaceVerifyView()
+            verify_view._librenms_api = api
+            verify_request = make_request(
+                "post",
+                json.dumps(
+                    {
+                        "device_id": page_device.pk,
+                        "server_key": server_key,
+                        "interface_name_field": "ifName",
+                        "port_id": 10,
+                    }
+                ),
+                user=user,
+                path="/verify/",
+                content_type="application/json",
+            )
+            verify_response = verify_view.post(verify_request)
+            assert verify_response.status_code == 200, verify_response.content
+            assert "parent-sync-btn" not in json.loads(verify_response.content)["formatted_row"]["parent"]
+
+            relationship_view = SyncInterfaceParentView()
+            relationship_view._librenms_api = SimpleNamespace(server_key=server_key)
+            relationship_request = make_request(
+                "post",
+                {
+                    "port_id": "10",
+                    "parent_port_id": "20",
+                    "server_key": server_key,
+                },
+                user=user,
+            )
+            relationship_response = post(
+                relationship_view,
+                relationship_request,
+                object_type="device",
+                object_id=page_device.pk,
+            )
+        finally:
+            cache.delete(cache_key)
+
+        assert relationship_response.status_code == 404, relationship_response.content
+        child.refresh_from_db()
+        assert child.parent_id is None
+
+    @pytest.mark.django_db
+    @pytest.mark.parametrize("invalid_origin_id", [[], {}])
+    def test_verify_rejects_malformed_origin_device_id(self, invalid_origin_id):
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.tests.conftest import make_device
+        from netbox_librenms_plugin.tests.view_test_helpers import make_request
+
+        device = make_device("verify-malformed-origin")
+        view = SingleInterfaceVerifyView()
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        view._librenms_api = api
+        request = make_request(
+            "post",
+            json.dumps(
+                {
+                    "device_id": device.pk,
+                    "origin_device_id": invalid_origin_id,
+                    "interface_name_field": "ifName",
+                    "port_id": 10,
+                }
+            ),
+            user=_verify_superuser(f"malformed-origin-{type(invalid_origin_id).__name__}"),
+            path="/verify/",
+            content_type="application/json",
+        )
+
+        response = view.post(request)
+
+        assert response.status_code == 400
+        assert json.loads(response.content)["status"] == "error"
+
+    @pytest.mark.django_db
+    def test_view_only_non_lag_target_never_receives_lag_promotion_button(self):
+        from types import SimpleNamespace
+
+        from django.core.cache import cache
+        from dcim.models import Device, Interface
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+        from netbox_librenms_plugin.tests.view_test_helpers import (
+            grant,
+            make_request,
+            make_user_with_perms,
+            post,
+        )
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+        from netbox_librenms_plugin.views.object_sync.devices import DeviceInterfaceTableView
+        from netbox_librenms_plugin.views.sync.interfaces import SyncInterfaceLagView
+
+        server_key = next(iter(LibreNMSAPI.get_available_servers()))
+        device = make_device("verify-view-only-lag-target")
+        member = make_interface(device, "Ethernet1")
+        aggregate = make_interface(device, "Port-Channel1", iface_type="other")
+        set_librenms_device_id(member, 10, server_key)
+        set_librenms_device_id(aggregate, 20, server_key)
+        member.save()
+        aggregate.save()
+        user = make_user_with_perms("verify-view-only-lag-target", [("view", Device)])
+        user = grant(user, "change", Interface, constraints={"pk": member.pk})
+        user = grant(user, "view", Interface, constraints={"pk": aggregate.pk})
+        snapshot = {
+            "ports": [
+                {
+                    "port_id": 10,
+                    "ifName": member.name,
+                    "ifDescr": member.name,
+                    "ifAlias": "",
+                    "ifType": "ethernetCsmacd",
+                    "ifSpeed": 1_000_000_000,
+                    "ifPhysAddress": "",
+                    "ifMtu": 1500,
+                    "ifAdminStatus": "up",
+                },
+                {
+                    "port_id": 20,
+                    "ifName": aggregate.name,
+                    "ifDescr": aggregate.name,
+                    "ifAlias": "",
+                    "ifType": "ieee8023adLag",
+                    "ifSpeed": 1_000_000_000,
+                    "ifPhysAddress": "",
+                    "ifMtu": 1500,
+                    "ifAdminStatus": "up",
+                },
+            ],
+            "port_stack_relationships": {"lag_members": {10: 20}, "sub_interfaces": {}},
+        }
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = server_key
+        table_request = make_request("get", user=user)
+        table_view = DeviceInterfaceTableView()
+        table_view._librenms_api = api
+        table_view.request = table_request
+        cache_key = table_view.get_cache_key(device, "ports", server_key)
+        cache.set(cache_key, snapshot)
+
+        try:
+            context = table_view.get_context_data(
+                table_request,
+                device,
+                "ifName",
+                server_key,
+                fresh_data=snapshot,
+                sync_device=device,
+            )
+            table_html = str(context["table"].render_parent(None, snapshot["ports"][0]))
+
+            verify_view = SingleInterfaceVerifyView()
+            verify_view._librenms_api = api
+            verify_request = make_request(
+                "post",
+                json.dumps({"device_id": device.pk, "interface_name_field": "ifName", "port_id": 10}),
+                user=user,
+                path="/verify/",
+                content_type="application/json",
+            )
+            verify_response = verify_view.post(verify_request)
+
+            inline_view = SyncInterfaceLagView()
+            inline_view._librenms_api = SimpleNamespace(server_key=server_key)
+            inline_request = make_request(
+                "post",
+                {"port_id": "10", "lag_port_id": "20", "server_key": server_key},
+                user=user,
+            )
+            inline_response = post(
+                inline_view,
+                inline_request,
+                object_type="device",
+                object_id=device.pk,
+            )
+        finally:
+            cache.delete(cache_key)
+
+        assert verify_response.status_code == 200, verify_response.content
+        # Pin the refusal status: "!= 200" also passes for a 500 from an unrelated crash, and the
+        # state assertions below hold after any failed request because nothing was written.
+        assert inline_response.status_code == 403, inline_response.content
+        assert "lag-sync-btn" not in table_html
+        assert "lag-sync-btn" not in json.loads(verify_response.content)["formatted_row"]["parent"]
+        member.refresh_from_db()
+        aggregate.refresh_from_db()
+        assert member.lag_id is None
+        assert aggregate.type != "lag"
+
+    @pytest.mark.django_db
+    def test_verify_falls_back_when_interface_name_field_is_not_a_string(self):
+        from django.core.cache import cache
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.tests.conftest import make_device
+        from netbox_librenms_plugin.tests.view_test_helpers import make_request
+
+        device = make_device("verify-malformed-name-field")
+        snapshot = {
+            "ports": [
+                {
+                    "port_id": 10,
+                    "ifName": "Ethernet1",
+                    "ifDescr": "Ethernet1",
+                    "ifAlias": "",
+                    "ifType": "ethernetCsmacd",
+                    "ifSpeed": 1_000_000_000,
+                    "ifPhysAddress": "",
+                    "ifMtu": 1500,
+                    "ifAdminStatus": "up",
+                }
+            ],
+            "port_stack_relationships": {},
+        }
+        view = SingleInterfaceVerifyView()
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        view._librenms_api = api
+        cache_key = view.get_cache_key(device, "ports", "default")
+        cache.set(cache_key, snapshot)
+        request = make_request(
+            "post",
+            json.dumps(
+                {
+                    "device_id": device.pk,
+                    "interface_name_field": ["ifName"],
+                    "port_id": 10,
+                }
+            ),
+            user=_verify_superuser("malformed-name-field"),
+            path="/verify/",
+            content_type="application/json",
+        )
+
+        try:
+            response = view.post(request)
+        finally:
+            cache.delete(cache_key)
+
+        assert response.status_code == 200
+        # 200 alone does not say how the list was handled: a regression that coerced it into a
+        # column name would also return 200. Pin the fallback to the default name column.
+        assert "Ethernet1" in json.loads(response.content)["formatted_row"]["name"]
+
+    @pytest.mark.django_db
+    def test_verify_materializes_only_relationship_candidates(self):
+        from django.core.cache import cache
+        from django.db.models.signals import post_init
+        from dcim.models import Interface
+
+        from netbox_librenms_plugin.librenms_api import LibreNMSAPI
+        from netbox_librenms_plugin.tests.conftest import make_device, make_interface
+        from netbox_librenms_plugin.tests.view_test_helpers import make_request
+        from netbox_librenms_plugin.utils import set_librenms_device_id
+
+        device = make_device("verify-candidate-scope")
+        source = make_interface(device, "Ethernet1.100", iface_type="virtual")
+        parent = make_interface(device, "Ethernet1")
+        set_librenms_device_id(source, 10, "default")
+        set_librenms_device_id(parent, 20, "default")
+        source.save()
+        parent.save()
+        for index in range(40):
+            make_interface(device, f"unrelated-{index}")
+        snapshot = {
+            "ports": [
+                {
+                    "port_id": 10,
+                    "ifName": source.name,
+                    "ifDescr": source.name,
+                    "ifAlias": "",
+                    "ifType": "l2vlan",
+                    "ifSpeed": 1_000_000_000,
+                    "ifPhysAddress": "",
+                    "ifMtu": 1500,
+                    "ifAdminStatus": "up",
+                },
+                {
+                    "port_id": 20,
+                    "ifName": parent.name,
+                    "ifDescr": parent.name,
+                    "ifAlias": "",
+                    "ifType": "ethernetCsmacd",
+                    "ifSpeed": 1_000_000_000,
+                    "ifPhysAddress": "",
+                    "ifMtu": 1500,
+                    "ifAdminStatus": "up",
+                },
+            ],
+            "port_stack_relationships": {"lag_members": {}, "sub_interfaces": {10: 20}},
+        }
+        view = SingleInterfaceVerifyView()
+        api = object.__new__(LibreNMSAPI)
+        api.server_key = "default"
+        view._librenms_api = api
+        cache_key = view.get_cache_key(device, "ports", "default")
+        cache.set(cache_key, snapshot)
+        request = make_request(
+            "post",
+            json.dumps({"device_id": device.pk, "interface_name_field": "ifName", "port_id": 10}),
+            user=_verify_superuser("candidate-scope"),
+            path="/verify/",
+            content_type="application/json",
+        )
+        materialized_interface_ids = []
+
+        def capture_interface(instance, **_kwargs):
+            materialized_interface_ids.append(instance.pk)
+
+        post_init.connect(capture_interface, sender=Interface, weak=False)
+        try:
+            response = view.post(request)
+        finally:
+            post_init.disconnect(capture_interface, sender=Interface)
+            cache.delete(cache_key)
+
+        assert response.status_code == 200
+        assert len(materialized_interface_ids) <= 10
+
 
 # ---------------------------------------------------------------------------
 # SingleIPAddressVerifyView — object-permission gate (real DB, real has_perm)
diff --git a/netbox_librenms_plugin/tests/test_view_wiring.py b/netbox_librenms_plugin/tests/test_view_wiring.py
index 56747bb3c5..8d3494053a 100644
--- a/netbox_librenms_plugin/tests/test_view_wiring.py
+++ b/netbox_librenms_plugin/tests/test_view_wiring.py
@@ -1982,6 +1982,13 @@ class TestRoutedSyncPagesScopeTheirObject:
         ("object_sync.devices", "DeviceModuleTableView"),
     )
 
+    # The VM pages inherit the same base table views, so they inherit the scoped get_object and
+    # regress the same way. They resolve a VirtualMachine, so they need their own grant.
+    ROUTED_VM_PAGES = (
+        ("object_sync.vms", "VMInterfaceTableView"),
+        ("object_sync.vms", "VMIPAddressTableView"),
+    )
+
     @pytest.mark.django_db
     @pytest.mark.parametrize("module_path,class_name", ROUTED_DEVICE_PAGES)
     def test_a_constrained_grant_cannot_reach_a_hidden_device(self, module_path, class_name):
@@ -2014,3 +2021,35 @@ def test_a_constrained_grant_cannot_reach_a_hidden_device(self, module_path, cla
 
         with pytest.raises(Http404):
             view.get_object(hidden.pk)
+
+    @pytest.mark.django_db
+    @pytest.mark.parametrize("module_path,class_name", ROUTED_VM_PAGES)
+    def test_a_constrained_grant_cannot_reach_a_hidden_vm(self, module_path, class_name):
+        """A user granted view_virtualmachine only for VM A must not resolve VM B."""
+        import importlib
+
+        from django.http import Http404
+        from virtualization.models import VirtualMachine
+
+        from netbox_librenms_plugin.tests.conftest import make_vm
+        from netbox_librenms_plugin.tests.view_test_helpers import (
+            make_request,
+            make_user_with_perms,
+            make_view,
+        )
+
+        allowed = make_vm(f"scoped-allowed-{class_name.lower()}")
+        hidden = make_vm(f"scoped-hidden-{class_name.lower()}")
+        user = make_user_with_perms(
+            f"scoped-viewer-{class_name.lower()}",
+            [("view", VirtualMachine)],
+            constraints={"name": allowed.name},
+        )
+        request = make_request("get", user=user, path=f"/plugins/librenms/vms/{hidden.pk}/sync/")
+        view_class = getattr(importlib.import_module(f"netbox_librenms_plugin.views.{module_path}"), class_name)
+        view = make_view(view_class, request)
+
+        assert view.get_object(allowed.pk).pk == allowed.pk
+
+        with pytest.raises(Http404):
+            view.get_object(hidden.pk)
diff --git a/netbox_librenms_plugin/tests/test_vlan_sync_content_template.py b/netbox_librenms_plugin/tests/test_vlan_sync_content_template.py
new file mode 100644
index 0000000000..0caf2fcb93
--- /dev/null
+++ b/netbox_librenms_plugin/tests/test_vlan_sync_content_template.py
@@ -0,0 +1,71 @@
+"""Render the real _vlan_sync_content.html template in both modes.
+
+In migrated mode the POST form is replaced by a plain <div> (a migrated donor must not POST a
+VLAN sync). But the VLAN table still renders interactive per-row group selects whose verify JS
+(librenms_sync.js verify-vlan-group / verify-vlan-sync-group) reads
+document.querySelector('[name=csrfmiddlewaretoken]').value and posts server_key — so standalone
+CSRF + server_key hidden inputs must be emitted in migrated mode too, or those JS requests hit a
+null token (TypeError/403) / the wrong server. Only the form-submit ``action`` input is form-only.
+"""
+
+import re
+
+import pytest
+
+
+@pytest.mark.django_db
+class TestVlanSyncContentTemplateMigratedMode:
+    def _render(self, *, migrated, server_key="default"):
+        from django.contrib.auth.models import AnonymousUser
+        from django.template.loader import render_to_string
+        from django.test import RequestFactory
+        from django_tables2 import RequestConfig
+
+        from netbox_librenms_plugin.tables.vlans import LibreNMSVLANTable
+        from netbox_librenms_plugin.tests.conftest import make_device
+
+        device = make_device("vlan-tmpl-dev")
+        request = RequestFactory().get("/")
+        request.user = AnonymousUser()  # NetBox context processors read request.user
+        # At least one row so vlan_table.rows is truthy and the form/CSRF branch renders.
+        table = LibreNMSVLANTable(
+            [{"vlan_id": 10, "name": "v10", "type": "ethernet", "state": "active"}],
+            vlan_groups=[],
+        )
+        RequestConfig(request).configure(table)
+        vlan_sync = {
+            "object": device,
+            "vlan_table": table,
+            "server_key": server_key,
+            "cache_expiry": None,
+        }
+        ctx = {
+            "vlan_sync": vlan_sync,
+            "migrated_to_marker": migrated,
+            "migrated_to_winner": None,
+            "has_write_permission": False,
+        }
+        return render_to_string("netbox_librenms_plugin/_vlan_sync_content.html", ctx, request=request)
+
+    def test_migrated_mode_drops_form_but_keeps_csrf_and_server_key(self):
+        # Non-default server so the assertion proves the actual value is emitted.
+        html = self._render(
+            migrated={"server_key": "prod", "device_id": 1, "at": "now"},
+            server_key="prod",
+        )
+        # The live POST form must be gone in migrated mode (a donor must not POST a sync).
+        assert "<form" not in html
+        # ...but CSRF + server_key must remain so the JS verify-vlan-group fetch targets the
+        # right server with a USABLE token — an empty value would still POST X-CSRFToken: ''
+        # and 403, so pin a non-empty value, not mere input presence.
+        assert re.search(r'name="csrfmiddlewaretoken" value="[^"]+"', html)
+        assert re.search(r'<input[^>]*name="server_key"[^>]*value="prod"[^>]*>', html)
+        # The form-submit action input is form-only and must NOT render in migrated mode.
+        assert 'value="create_vlans"' not in html
+
+    def test_normal_mode_emits_form_with_csrf_server_key_and_action(self):
+        html = self._render(migrated=None)
+        assert "<form" in html
+        assert re.search(r'name="csrfmiddlewaretoken" value="[^"]+"', html)
+        assert 'name="server_key"' in html
+        assert 'value="create_vlans"' in html
diff --git a/netbox_librenms_plugin/urls.py b/netbox_librenms_plugin/urls.py
index 2b1d4d05a9..6a69413474 100644
--- a/netbox_librenms_plugin/urls.py
+++ b/netbox_librenms_plugin/urls.py
@@ -9,6 +9,7 @@
     ModuleTypeMapping,
     NormalizationRule,
     PlatformMapping,
+    PortStackLagPattern,
 )
 from .views import (
     AddDeviceToLibreNMSView,
@@ -123,6 +124,15 @@
     PlatformMappingEditView,
     PlatformMappingListView,
     PlatformMappingView,
+    PortStackLagPatternBulkDeleteView,
+    PortStackLagPatternBulkExportYAMLView,
+    PortStackLagPatternBulkImportView,
+    PortStackLagPatternChangeLogView,
+    PortStackLagPatternCreateView,
+    PortStackLagPatternDeleteView,
+    PortStackLagPatternEditView,
+    PortStackLagPatternListView,
+    PortStackLagPatternView,
     RemoveServerMappingView,
     SaveUserPrefView,
     SingleCableVerifyView,
@@ -134,6 +144,8 @@
     VerifyVlanSyncGroupView,
     SyncCablesView,
     SyncInterfacesView,
+    SyncInterfaceLagView,
+    SyncInterfaceParentView,
     SyncIPAddressesView,
     SyncSiteLocationView,
     SyncVLANsView,
@@ -289,6 +301,18 @@
         SyncInterfacesView.as_view(),
         name="sync_selected_interfaces",
     ),
+    # Sync interface LAG membership URL
+    path(
+        "<str:object_type>/<int:object_id>/sync-interface-lag/",
+        SyncInterfaceLagView.as_view(),
+        name="sync_interface_lag",
+    ),
+    # Sync interface parent (sub-interface) URL
+    path(
+        "<str:object_type>/<int:object_id>/sync-interface-parent/",
+        SyncInterfaceParentView.as_view(),
+        name="sync_interface_parent",
+    ),
     # Delete NetBox-only interfaces URL
     path(
         "<str:object_type>/<int:object_id>/delete-netbox-interfaces/",
@@ -881,5 +905,52 @@
         CarrierAutoInstallRuleBulkExportYAMLView.as_view(),
         name="carrierautoinstallrule_bulk_export_yaml",
     ),
+    # PortStackLagPattern
+    path(
+        "port-stack-lag-patterns/",
+        PortStackLagPatternListView.as_view(),
+        name="portstacklagpattern_list",
+    ),
+    path(
+        "port-stack-lag-patterns/<int:pk>/",
+        PortStackLagPatternView.as_view(),
+        name="portstacklagpattern_detail",
+    ),
+    path(
+        "port-stack-lag-patterns/add/",
+        PortStackLagPatternCreateView.as_view(),
+        name="portstacklagpattern_add",
+    ),
+    path(
+        "port-stack-lag-patterns/import/",
+        PortStackLagPatternBulkImportView.as_view(),
+        name="portstacklagpattern_bulk_import",
+    ),
+    path(
+        "port-stack-lag-patterns/<int:pk>/edit/",
+        PortStackLagPatternEditView.as_view(),
+        name="portstacklagpattern_edit",
+    ),
+    path(
+        "port-stack-lag-patterns/<int:pk>/delete/",
+        PortStackLagPatternDeleteView.as_view(),
+        name="portstacklagpattern_delete",
+    ),
+    path(
+        "port-stack-lag-patterns/delete/",
+        PortStackLagPatternBulkDeleteView.as_view(),
+        name="portstacklagpattern_bulk_delete",
+    ),
+    path(
+        "port-stack-lag-patterns/export-yaml/",
+        PortStackLagPatternBulkExportYAMLView.as_view(),
+        name="portstacklagpattern_bulk_export_yaml",
+    ),
+    path(
+        "port-stack-lag-patterns/<int:pk>/changelog/",
+        PortStackLagPatternChangeLogView.as_view(),
+        name="portstacklagpattern_changelog",
+        kwargs={"model": PortStackLagPattern},
+    ),
     path("api/", include("netbox_librenms_plugin.api.urls")),
 ]
diff --git a/netbox_librenms_plugin/utils.py b/netbox_librenms_plugin/utils.py
index 5b48037996..f1b86259c1 100644
--- a/netbox_librenms_plugin/utils.py
+++ b/netbox_librenms_plugin/utils.py
@@ -20,6 +20,10 @@
 
 logger = logging.getLogger(__name__)
 
+# Bounded at 19 digits, the width of a PostgreSQL bigint. Without the bound an oversized string is
+# rejected only by CPython's int_max_str_digits limit, which a host may raise or disable.
+_ASCII_POSITIVE_INTEGER_RE = re.compile(r"^[ \t\r\n\f\v]*\+?[0-9]{1,19}[ \t\r\n\f\v]*$")
+
 
 def is_list_of_dicts(value) -> bool:
     """
@@ -112,13 +116,56 @@ def format_mac_address(mac_address: str) -> str:
 
 def normalize_librenms_port_id(value) -> int | None:
     """Normalize a LibreNMS port_id to a positive integer, or None."""
-    if not isinstance(value, (int, str)) or isinstance(value, bool):
-        return None
-    try:
-        int_value = int(value)
-    except (TypeError, ValueError):
-        return None
-    return int_value if int_value > 0 else None
+    return coerce_librenms_id(value)
+
+
+def interface_name_fallback_matches_port(interface, port_id, server_key) -> bool:
+    """Return true when a same-name interface is unbound or owns the requested port ID."""
+    requested_id = normalize_librenms_port_id(port_id)
+    if requested_id is None:
+        return False
+
+    raw_mapping = interface.custom_field_data.get("librenms_id")
+    if raw_mapping is None:
+        return True
+    if isinstance(raw_mapping, dict):
+        if server_key not in raw_mapping:
+            return True
+        raw_entry = raw_mapping[server_key]
+        raw_id = raw_entry.get("id") if isinstance(raw_entry, dict) else raw_entry
+    else:
+        raw_id = raw_mapping
+
+    return normalize_librenms_port_id(raw_id) == requested_id
+
+
+def get_interface_port_identity_sets(ports, interface_name_field) -> tuple[set[int], set[int]]:
+    """Return host IDs that are unique and the subset with a unique selected display name."""
+    if not is_list_of_dicts(ports):
+        return set(), set()
+
+    port_id_counts = {}
+    port_names = {}
+    name_counts = {}
+    for port in ports:
+        if port.get("_source") == "oob":
+            continue
+        port_id = normalize_librenms_port_id(port.get("port_id"))
+        interface_name = port.get(interface_name_field)
+        if port_id is None:
+            continue
+        port_id_counts[port_id] = port_id_counts.get(port_id, 0) + 1
+        port_names[port_id] = interface_name
+        if isinstance(interface_name, str) and interface_name:
+            name_counts[interface_name] = name_counts.get(interface_name, 0) + 1
+
+    unique_port_ids = {port_id for port_id, count in port_id_counts.items() if count == 1}
+    unambiguous_name_port_ids = {
+        port_id
+        for port_id in unique_port_ids
+        if isinstance(port_names[port_id], str) and port_names[port_id] and name_counts.get(port_names[port_id]) == 1
+    }
+    return unique_port_ids, unambiguous_name_port_ids
 
 
 def validate_regex_field(value, field_name):
@@ -154,9 +201,54 @@ def validate_regex_field(value, field_name):
         raise ValidationError({field_name: f"Invalid regex: {exc}"}) from exc
 
 
+def normalize_relationship_maps(relationships) -> tuple[dict, dict]:
+    """
+    Normalize a cached ``port_stack_relationships`` mapping into int-keyed relationship maps.
+
+    Returns ``(lag_members, sub_interfaces)``. The single home for the corruption guard + key
+    normalization shared by :func:`build_relationship_maps` and the bulk sync writer, so the
+    readers and writer cannot drift.
+
+    Fails soft against a corrupt / partial-write / format-migrated cache: a None or non-dict
+    ``relationships`` (e.g. a list) — or a present-but-None / non-dict nested ``lag_members`` /
+    ``sub_interfaces`` — collapses to ``{}`` so ``.items()`` never raises ``AttributeError``. Keys
+    and values are normalized via :func:`normalize_librenms_port_id` so int-keyed lookups never miss
+    stringified JSON values. An edge is dropped unless both endpoint IDs are valid.
+    """
+    if not isinstance(relationships, dict):
+        relationships = {}
+    lag_members_raw = relationships.get("lag_members")
+    if not isinstance(lag_members_raw, dict):
+        lag_members_raw = {}
+    sub_interfaces_raw = relationships.get("sub_interfaces")
+    if not isinstance(sub_interfaces_raw, dict):
+        sub_interfaces_raw = {}
+
+    def _normalize_edges(raw_edges):
+        normalized = {}
+        conflicted_sources = set()
+        for key, value in raw_edges.items():
+            normalized_key = normalize_librenms_port_id(key)
+            normalized_value = normalize_librenms_port_id(value)
+            if normalized_key is None or normalized_value is None or normalized_key in conflicted_sources:
+                continue
+            existing_value = normalized.get(normalized_key)
+            if existing_value is not None and existing_value != normalized_value:
+                normalized.pop(normalized_key, None)
+                conflicted_sources.add(normalized_key)
+                continue
+            normalized[normalized_key] = normalized_value
+        return normalized
+
+    lag_members = _normalize_edges(lag_members_raw)
+    sub_interfaces = _normalize_edges(sub_interfaces_raw)
+    return lag_members, sub_interfaces
+
+
 def get_virtual_chassis_member(
     device: Device,
     port_name: str,
+    members_by_position: dict | None = None,
     *,
     return_device_on_failure: bool = True,
 ) -> Device | None:
@@ -166,6 +258,13 @@ def get_virtual_chassis_member(
     Args:
         device (Device): The NetBox device instance.
         port_name (str): The name of the port (e.g., 'Ethernet1').
+        members_by_position (dict | None): Optional prefetched ``{vc_position: member Device}``
+            map. When provided, the member is resolved from it instead of issuing a per-call
+            ``members.get(vc_position=...)`` query — pass it when resolving many rows of the same
+            chassis (e.g. a VC interface table) to keep resolution O(1) per row instead of one
+            query per row. An EMPTY map is treated like no map (falls back to the per-call
+            query), so a caller forwarding a raw possibly-empty dict can't silently lose
+            member resolution.
         return_device_on_failure: Return ``device`` when member matching fails. Callers
             resolving a remote VC endpoint can disable this fallback to avoid binding the
             advertised port against the wrong member.
@@ -187,17 +286,89 @@ def get_virtual_chassis_member(
         return fallback
 
     try:
-        match = re.match(r"^[A-Za-z]+(\d+)", port_name)
+        match = re.match(r"^[A-Za-z]+-?(\d+)", port_name)
+        if not match:
+            # Some stack operating systems use a slot/port form with no alphabetic prefix,
+            # such as ``2/1/1``. Require the slash so a bare numeric label is not treated as a
+            # chassis position.
+            match = re.match(r"^(\d+)/", port_name)
         if not match:
             return fallback
 
         # Get the port number and use it
         vc_position = int(match.group(1))
+        if members_by_position:
+            return members_by_position.get(vc_position, fallback)
         return device.virtual_chassis.members.get(vc_position=vc_position)
     except (re.error, ValueError, ObjectDoesNotExist):
         return fallback
 
 
+def resolve_interface_row_device(
+    device: Device,
+    port: dict,
+    interface_name_field: str,
+    *,
+    interfaces_by_port_id: dict | None = None,
+    members_by_position: dict | None = None,
+    members_by_id: dict | None = None,
+    return_device_on_failure: bool = True,
+) -> Device | None:
+    """Resolve a LibreNMS interface row to its likely Virtual Chassis member.
+
+    Prefer a unique interface already bound to the stable LibreNMS port ID. For an unbound
+    physical Ethernet row, use the member position encoded in the interface name. Do not apply
+    that heuristic to logical rows or sub-interfaces because their number is not reliably a
+    chassis position. Set ``return_device_on_failure`` to false when a writer must reject a row
+    whose owner has no stable evidence.
+    """
+    if not getattr(device, "virtual_chassis", None):
+        return device
+    fallback = device if return_device_on_failure else None
+    if not isinstance(port, dict):
+        return fallback
+
+    port_id = normalize_librenms_port_id(port.get("port_id"))
+    if port_id is not None and interfaces_by_port_id:
+        matches = interfaces_by_port_id.get(port_id, [])
+        if not isinstance(matches, (list, tuple, set)):
+            matches = [matches]
+        matches = [interface for interface in matches if interface is not None]
+        if len(matches) == 1:
+            owner_id = getattr(matches[0], "device_id", None)
+            if owner_id is not None:
+                if members_by_id and owner_id in members_by_id:
+                    return members_by_id[owner_id]
+                return matches[0].device
+
+    raw_if_type = port.get("ifType")
+    if_type = raw_if_type.lower() if isinstance(raw_if_type, str) else ""
+    if "ethernet" not in if_type:
+        return fallback
+
+    candidate_names = []
+    for field in (interface_name_field, "ifName", "ifDescr"):
+        name = port.get(field)
+        if isinstance(name, str) and name and name not in candidate_names:
+            candidate_names.append(name)
+    candidates = {
+        member.pk: member
+        for name in candidate_names
+        if (
+            member := get_virtual_chassis_member(
+                device,
+                name,
+                members_by_position=members_by_position,
+                return_device_on_failure=False,
+            )
+        )
+        is not None
+    }
+    if len(candidates) == 1:
+        return next(iter(candidates.values()))
+    return fallback
+
+
 def get_virtual_chassis_members(device: Device) -> list:
     """
     Return all member Devices of a device's virtual chassis.
@@ -657,9 +828,15 @@ def get_table_paginate_count(request: HttpRequest, table_prefix: str) -> int:
         int: Number of items to display per page
     """
     config = get_config()
-    if f"{table_prefix}per_page" in request.GET:
+    # Check GET first, then POST (HTMX refresh requests send pagination via POST body)
+    param_key = f"{table_prefix}per_page"
+    param_value = request.GET.get(param_key) or request.POST.get(param_key)
+    if param_value:
         try:
-            per_page = int(request.GET.get(f"{table_prefix}per_page"))
+            per_page = int(param_value)
+            # Guard against 0/negative input, which would break the paginator.
+            if per_page < 1:
+                return netbox_get_paginate_count(request)
             max_page_size = config.MAX_PAGE_SIZE
             # MAX_PAGE_SIZE 0/None disables the NetBox ceiling; don't clamp to it (min() with 0
             # would zero the page size, and with None it TypeErrors).
@@ -1215,11 +1392,13 @@ def coerce_librenms_id(value) -> int | None:
     if isinstance(value, int):
         return value if value > 0 else None
     if isinstance(value, str):
+        if not _ASCII_POSITIVE_INTEGER_RE.fullmatch(value):
+            return None
         try:
             coerced = int(value)
-            return coerced if coerced > 0 else None
         except ValueError:
             return None
+        return coerced if coerced > 0 else None
     return None
 
 
@@ -1575,7 +1754,8 @@ def build_librenms_id_qs(server_key, value):
     # still validate for their own reasons, but this makes the shared builder the last line of
     # defence. coerce_librenms_id() only gates validity here — the variant list below keeps its full
     # match breadth (incl. zero-padded string forms) for accepted values.
-    if coerce_librenms_id(value) is None:
+    normalized_value = coerce_librenms_id(value)
+    if normalized_value is None:
         match_none = Q(pk__in=[])
         return match_none, match_none
     variants = [value, str(value)]
@@ -1601,6 +1781,16 @@ def build_librenms_id_qs(server_key, value):
         host_q |= Q(custom_field_data__librenms_id=v)
         # The OOB controller's own device id — so a re-import recognises the merged device.
         oob_q |= Q(**{f"custom_field_data__librenms_id__{server_key}__oob__id": v})
+
+    # Every reader accepts numeric strings with leading zeroes, an optional plus sign, and
+    # surrounding whitespace. Exact JSON comparisons cannot find those forms when the caller
+    # supplies the canonical integer. Match the text extracted from each supported JSON shape so
+    # indexed candidate lookups and full in-memory scans enforce the same normalized-ID contract.
+    numeric_pattern = rf"^[ \t\r\n\f\v]*\+?0*{normalized_value}[ \t\r\n\f\v]*$"
+    host_q |= Q(**{f"custom_field_data__librenms_id__{server_key}__regex": numeric_pattern})
+    host_q |= Q(**{f"custom_field_data__librenms_id__{server_key}__id__regex": numeric_pattern})
+    host_q |= Q(custom_field_data__librenms_id__regex=numeric_pattern)
+    oob_q |= Q(**{f"custom_field_data__librenms_id__{server_key}__oob__id__regex": numeric_pattern})
     return host_q, oob_q
 
 
@@ -2310,6 +2500,24 @@ def _extract_oob_entry(owner_label, owner_name, entry):
     return summary
 
 
+def validation_error_detail(exc: ValidationError) -> str:
+    """
+    Flatten a ValidationError into a single human-readable string for a JSON error body.
+
+    Shared by the interface-sync and migrate views so the two sync flows format
+    validation errors identically.
+
+    Args:
+        exc: The ValidationError to flatten.
+
+    Returns:
+        str: ``field: message`` pairs joined with ``"; "`` (or the plain messages/str form).
+    """
+    if hasattr(exc, "message_dict"):
+        return "; ".join(f"{field}: {' '.join(str(m) for m in msgs)}" for field, msgs in exc.message_dict.items())
+    return "; ".join(str(m) for m in exc.messages) if hasattr(exc, "messages") else str(exc)
+
+
 # The device-level IP foreign keys this plugin re-homes during OOB linking, merges, and the
 # Stage-2b "move to winner" actions. NetBox requires each to reference an address assigned to
 # one of THAT device's own interfaces.
diff --git a/netbox_librenms_plugin/views/__init__.py b/netbox_librenms_plugin/views/__init__.py
index 5f1462a3c1..a6db40a5e8 100644
--- a/netbox_librenms_plugin/views/__init__.py
+++ b/netbox_librenms_plugin/views/__init__.py
@@ -109,6 +109,15 @@
     PlatformMappingEditView,
     PlatformMappingListView,
     PlatformMappingView,
+    PortStackLagPatternBulkDeleteView,
+    PortStackLagPatternBulkExportYAMLView,
+    PortStackLagPatternBulkImportView,
+    PortStackLagPatternChangeLogView,
+    PortStackLagPatternCreateView,
+    PortStackLagPatternDeleteView,
+    PortStackLagPatternEditView,
+    PortStackLagPatternListView,
+    PortStackLagPatternView,
 )
 from .imports.actions import (  # noqa: F401
     AddAsOOBView,
@@ -147,7 +156,12 @@
     UpdateDeviceTypeView,
 )
 from .sync.devices import AddDeviceToLibreNMSView, UpdateDeviceLocationView  # noqa: F401
-from .sync.interfaces import DeleteNetBoxInterfacesView, SyncInterfacesView  # noqa: F401
+from .sync.interfaces import (  # noqa: F401
+    DeleteNetBoxInterfacesView,
+    SyncInterfacesView,
+    SyncInterfaceLagView,
+    SyncInterfaceParentView,
+)
 from .sync.ip_addresses import SyncIPAddressesView  # noqa: F401
 from .sync.locations import SyncSiteLocationView  # noqa: F401
 from .sync.migrate import (  # noqa: F401
diff --git a/netbox_librenms_plugin/views/base/cables_view.py b/netbox_librenms_plugin/views/base/cables_view.py
index 86603dcd47..217ea973be 100644
--- a/netbox_librenms_plugin/views/base/cables_view.py
+++ b/netbox_librenms_plugin/views/base/cables_view.py
@@ -496,11 +496,11 @@ def enrich_local_port(self, link, obj, server_key=None):
                 server_key = self._render_server_key()
 
             # Name fallback is field-agnostic: a NetBox interface may be named from the
-            # LibreNMS field the user is *not* currently displaying (issue #88 — e.g. the
+            # LibreNMS field the user is not currently displaying. For example, the
             # interface carries the ifDescr value while interface_name_field selects ifName).
             # Match the displayed name plus the alternate field captured at fetch time,
             # mirroring the dual ifName/ifDescr fallback in
-            # interfaces_view._enrich_port_with_lag_parent. The stable librenms_id match below
+            # interface relationship enrichment. The stable librenms_id match below
             # still wins when present; this only widens the fragile name fallback.
             name_candidates = [n for n in (local_port, link.get("local_port_alt")) if n]
 
diff --git a/netbox_librenms_plugin/views/base/interfaces_view.py b/netbox_librenms_plugin/views/base/interfaces_view.py
index 1409066338..6ef951c8be 100644
--- a/netbox_librenms_plugin/views/base/interfaces_view.py
+++ b/netbox_librenms_plugin/views/base/interfaces_view.py
@@ -1,20 +1,29 @@
 import logging
+import re
 
 from django.contrib import messages
 from django.core.cache import cache
 from django.utils import timezone
 from django.views import View
 
+from netbox_librenms_plugin.interface_relationships import (
+    RelationshipResolutionContext,
+    build_relationship_maps,
+    filter_interface_index,
+    resolve_relationship_row,
+)
 from netbox_librenms_plugin.utils import (
+    build_migrated_context,
     cache_remaining_ttl,
     coerce_librenms_id,
     get_interface_name_field,
     get_librenms_oob,
     get_librenms_sync_device,
-    get_virtual_chassis_member,
+    get_interface_port_identity_sets,
     is_list_of_dicts,
     is_valid_ports_payload,
     normalize_librenms_port_id,
+    resolve_interface_row_device,
 )
 from netbox_librenms_plugin.views.mixins import (
     CacheMixin,
@@ -115,17 +124,34 @@ def _get_object_librenms_id(self, obj):
         return normalize_librenms_port_id(librenms_id)
 
     def _build_interface_lookup_maps(self, obj):
-        """Build name and LibreNMS ID indexes, dropping conflicting IDs entirely."""
+        """
+        Build name and LibreNMS ID indexes, dropping conflicting IDs entirely.
+
+        Also select the relationship fields used during enrichment. Device interfaces have
+        ``lag`` and ``parent``. VM interfaces have ``parent``.
+
+        Args:
+            obj: The NetBox device (or VM) whose interfaces are indexed.
+
+        Returns:
+            dict: Name and LibreNMS ID indexes plus the number of interfaces carrying each ID.
+                LibreNMS IDs that map to more than one interface are dropped from the direct index.
+        """
         by_name = {}
         by_librenms_id = {}
+        by_librenms_id_matches = {}
+        librenms_id_counts = {}
         duplicate_librenms_ids = set()
 
         # Prefetch the M2M relations the table renderers dereference per matched row
         # (render_vlans -> tagged_vlans, render_mac_address -> mac_addresses); without this each
-        # rendered interface row issues its own query for these.
+        # rendered interface row issues its own query for these. Also select_related the lag/parent
+        # FKs that render_parent and render_lag dereference.
+        related_field = self.get_select_related_field(obj)
+        extra_related = ["parent"] if related_field == "virtual_machine" else ["lag", "parent"]
         interfaces = (
             self.get_interfaces(obj)
-            .select_related(self.get_select_related_field(obj))
+            .select_related(related_field, *extra_related)
             .prefetch_related("tagged_vlans", "tagged_vlans__group", "mac_addresses")
         )
         for interface in interfaces:
@@ -133,6 +159,8 @@ def _build_interface_lookup_maps(self, obj):
             librenms_id = self._get_object_librenms_id(interface)
             if librenms_id is None:
                 continue
+            librenms_id_counts[librenms_id] = librenms_id_counts.get(librenms_id, 0) + 1
+            by_librenms_id_matches.setdefault(librenms_id, []).append(interface)
             if librenms_id in by_librenms_id:
                 duplicate_librenms_ids.add(librenms_id)
                 continue
@@ -144,6 +172,8 @@ def _build_interface_lookup_maps(self, obj):
         return {
             "by_name": by_name,
             "by_librenms_id": by_librenms_id,
+            "by_librenms_id_matches": by_librenms_id_matches,
+            "librenms_id_counts": librenms_id_counts,
         }
 
     def post(self, request, pk):
@@ -221,7 +251,7 @@ def post(self, request, pk):
 
         # A success=True response can still carry a malformed-but-truthy body (string/list/
         # dict-with-non-list "ports"); dereferencing it would 500 the refresh. Fail closed like
-        # the not-success path instead (issue #100). An empty ports list stays valid.
+        # the not-success path instead. An empty ports list stays valid.
         ports = librenms_data.get("ports", []) if isinstance(librenms_data, dict) else None
         if not is_list_of_dicts(ports):
             messages.error(request, "Unexpected response from LibreNMS (malformed ports payload).")
@@ -322,6 +352,21 @@ def _normalized_mac(port):
                     "showing host interfaces only. See server logs for details.",
                 )
                 oob_ports_failed = True
+        # Lazy port_stack fetch — only when device has LAG or sub-interface relationships.
+        # Enriches the host ports we fetched regardless of OOB outcome (it's independent of
+        # the OOB controller); the oob_incomplete tagging below still applies on an OOB failure.
+        # get_port_stack() is scoped to the main device, so LAG/sub-interface inference must
+        # only consider host ports. An OOB-only row matching the ifType/name heuristic would
+        # otherwise trigger a host port_stack fetch (and the "may be incomplete" warning) even
+        # when the main device has no such relationships.
+        host_ports_final = [p for p in librenms_data.get("ports", []) if p.get("_source") != "oob"]
+        self._enrich_port_stack_relationships(
+            request,
+            librenms_data,
+            host_ports_final,
+            interface_name_field,
+        )
+
         # On an OOB-ports fetch failure the snapshot is host-only. Rather than dropping it
         # (which would leave downstream views — SingleInterfaceVerifyView,
         # SaveVlanGroupOverridesView — with no backing snapshot), tag it `oob_incomplete`
@@ -363,6 +408,64 @@ def _normalized_mac(port):
         # column) so the HTMX tab refresh stays consistent with the full page.
         return self.render_sync_partial(request, obj, _server_key, context)
 
+    def _enrich_port_stack_relationships(self, request, librenms_data, host_ports, interface_name_field):
+        """Fetch and resolve host port relationships when the snapshot has a relevant signal."""
+        from netbox_librenms_plugin.models import PortStackLagPattern
+
+        structural_signal = self._has_structural_relationship_signals(host_ports, interface_name_field)
+        unscoped_patterns = PortStackLagPattern.compiled_patterns_for_os(None)
+        name_signal = self._has_lag_name_signals(host_ports, interface_name_field, unscoped_patterns)
+
+        device_os = ""
+        device_os_known = False
+        scoped_patterns = []
+        if name_signal:
+            info_success, device_info = self.librenms_api.get_device_info(self.librenms_id)
+            if info_success and isinstance(device_info, dict):
+                raw_device_os = device_info.get("os")
+                if isinstance(raw_device_os, str) and raw_device_os.strip():
+                    device_os = raw_device_os.strip()
+                    device_os_known = True
+            scoped_patterns = PortStackLagPattern.compiled_patterns_for_os(device_os)
+
+        scoped_name_signal = self._has_lag_name_signals(
+            host_ports,
+            interface_name_field,
+            scoped_patterns,
+        )
+        relationship_fetch_failed = False
+        if structural_signal or scoped_name_signal:
+            ps_success, ps_data = self.librenms_api.get_port_stack(self.librenms_id)
+            if ps_success:
+                librenms_data["port_stack_relationships"] = self.librenms_api.resolve_port_relationships(
+                    host_ports,
+                    ps_data,
+                    device_os=device_os,
+                    interface_name_field=interface_name_field,
+                    compiled_lag_patterns=scoped_patterns,
+                )
+            else:
+                relationship_fetch_failed = True
+                logger.warning("port_stack fetch failed for device %s: %s", self.librenms_id, ps_data)
+                librenms_data["relationship_data_incomplete"] = True
+                messages.warning(
+                    request,
+                    "Interfaces refreshed, but LAG/sub-interface relationship data could not be "
+                    "fetched from LibreNMS; the Parent / LAG column may be incomplete. "
+                    "See server logs for details.",
+                )
+
+        # A structural signal still gives a useful partial snapshot when the OS lookup fails.
+        # Mark it incomplete because OS-scoped name patterns could describe additional edges.
+        if name_signal and not device_os_known and not relationship_fetch_failed:
+            logger.warning("Could not determine the LibreNMS device OS for device %s", self.librenms_id)
+            librenms_data["relationship_data_incomplete"] = True
+            messages.warning(
+                request,
+                "Interfaces refreshed, but the device OS could not be determined from LibreNMS. "
+                "The Parent / LAG column may be incomplete. See server logs for details.",
+            )
+
     def _enrich_ports_with_vlan_data(self, ports, interface_name_field):
         """
         Enrich port data with VLAN information from LibreNMS.
@@ -456,8 +559,8 @@ def get_context_data(self, request, obj, interface_name_field, server_key=None,
         # list of dict ports (same contract post() validates before caching), so a malformed
         # snapshot would 500 the sync tab before the user could refresh. Purge it so a later render
         # re-fetches. A dict envelope with a malformed "ports" is kept so the isinstance(dict) block
-        # below degrades ports_data to [] and still builds an empty (but real) table (issue #100
-        # site 4); a non-dict snapshot has no envelope to render and drops to None.
+        # below degrades ports_data to [] and still builds an empty table. A non-dict snapshot
+        # has no envelope to render and drops to None.
         if cached_data is not None and not is_valid_ports_payload(cached_data):
             if fresh_data is None:
                 cache.delete(self.get_cache_key(cache_device, "ports", server_key))
@@ -471,9 +574,28 @@ def get_context_data(self, request, obj, interface_name_field, server_key=None,
         # snapshot (via an inline banner) so the missing OOB rows are never silently absent.
         oob_incomplete = bool(cached_data.get("oob_incomplete")) if isinstance(cached_data, dict) else False
 
-        # Get VLAN groups for dropdown
-        vlan_groups = self.get_vlan_groups_for_device(obj)
+        # The refresh path tags a cached snapshot when its port_stack request fails. Keep that
+        # warning attached to the snapshot so later cached renders do not silently show an
+        # incomplete Parent / LAG column after the one-shot Django message has disappeared.
+        relationship_data_incomplete = (
+            bool(cached_data.get("relationship_data_incomplete")) if isinstance(cached_data, dict) else False
+        )
+
+        virtual_chassis_members = []
+        if hasattr(obj, "virtual_chassis") and obj.virtual_chassis:
+            virtual_chassis_members = list(obj.virtual_chassis.members.all())
+
+        # Include every member's scope so rows owned by another member can resolve their VLANs.
+        vlan_scope_devices = virtual_chassis_members or [obj]
+        vlan_groups = self.get_vlan_groups_for_devices(vlan_scope_devices)
         lookup_maps = self._build_vlan_lookup_maps(vlan_groups)
+        vlan_groups_by_device = {
+            device.pk: self.filter_vlan_groups_for_device(vlan_groups, device) for device in vlan_scope_devices
+        }
+        vlan_lookup_maps_by_device = {
+            device_id: self.restrict_vlan_lookup_maps(lookup_maps, device_vlan_groups)
+            for device_id, device_vlan_groups in vlan_groups_by_device.items()
+        }
 
         # Load any user VLAN group overrides from cache (set by "apply to all")
         # Read overrides under the same VC-scoped key SaveVlanGroupOverridesView writes
@@ -495,14 +617,92 @@ def get_context_data(self, request, obj, interface_name_field, server_key=None,
                 ports_data = []
             matched_interface_ids = set()
 
+            relationship_maps = build_relationship_maps(cached_data)
+            unique_host_port_ids, unambiguous_name_port_ids = get_interface_port_identity_sets(
+                ports_data, interface_name_field
+            )
+
             # Pre-fetch all interfaces for all potential chassis members
+            # (_build_interface_lookup_maps select_relateds lag/parent for devices). Materialise the
+            # VC members once and index them by vc_position and id so the per-port member resolution
+            # and the netbox-only pass below reuse them instead of issuing a members.get(...) query
+            # per port / per netbox-only interface (N+1).
             interfaces_by_device = {}
-            if hasattr(obj, "virtual_chassis") and obj.virtual_chassis:
-                for member in obj.virtual_chassis.members.all():
+            interfaces_by_port_id = {}
+            catalog_interfaces_by_port_id = {}
+            catalog_interfaces_by_name = {}
+            members_by_position = None
+            members_by_id = None
+            if virtual_chassis_members:
+                members_by_position = {member.vc_position: member for member in virtual_chassis_members}
+                members_by_id = {member.id: member for member in virtual_chassis_members}
+                for member in virtual_chassis_members:
                     interfaces_by_device[member.id] = self._build_interface_lookup_maps(member)
             else:
                 interfaces_by_device[obj.id] = self._build_interface_lookup_maps(obj)
 
+            for interface_maps in interfaces_by_device.values():
+                for port_id, interface in interface_maps["by_librenms_id"].items():
+                    interfaces_by_port_id.setdefault(port_id, []).append(interface)
+                for port_id, interfaces in interface_maps["by_librenms_id_matches"].items():
+                    catalog_interfaces_by_port_id.setdefault(port_id, []).extend(interfaces)
+                for interface_name, interface in interface_maps["by_name"].items():
+                    catalog_interfaces_by_name.setdefault(interface_name, []).append(interface)
+
+            interface_model = self.get_interfaces(obj).model
+            owner_field = self.get_select_related_field(obj)
+            actionable_owner_ids = set(
+                obj.__class__.objects.restrict(request.user, "view")
+                .filter(pk__in=interfaces_by_device)
+                .values_list("pk", flat=True)
+            )
+            scoped_interfaces = interface_model.objects.filter(**{f"{owner_field}_id__in": interfaces_by_device})
+            viewable_interface_ids = set(scoped_interfaces.restrict(request.user, "view").values_list("pk", flat=True))
+            changeable_interface_ids = set(
+                scoped_interfaces.restrict(request.user, "change").values_list("pk", flat=True)
+            )
+            related_interface_ids = viewable_interface_ids | changeable_interface_ids
+            can_write_relationships = self.has_write_permission()
+            related_interfaces_by_port_id = {}
+            related_interfaces_by_name = {}
+            for interface_maps in interfaces_by_device.values():
+                for port_id, interfaces in interface_maps["by_librenms_id_matches"].items():
+                    permitted = [
+                        interface
+                        for interface in interfaces
+                        if interface.pk in related_interface_ids
+                        and getattr(interface, f"{owner_field}_id") in actionable_owner_ids
+                    ]
+                    if permitted:
+                        related_interfaces_by_port_id.setdefault(port_id, []).extend(permitted)
+                for interface_name, interface in interface_maps["by_name"].items():
+                    if (
+                        interface.pk in related_interface_ids
+                        and getattr(interface, f"{owner_field}_id") in actionable_owner_ids
+                    ):
+                        related_interfaces_by_name.setdefault(interface_name, []).append(interface)
+
+            catalog_index = {
+                "by_lnms_id": catalog_interfaces_by_port_id,
+                "by_name": catalog_interfaces_by_name,
+            }
+            display_index = catalog_index
+            related_index = {
+                "by_lnms_id": related_interfaces_by_port_id,
+                "by_name": related_interfaces_by_name,
+            }
+            relationship_context = RelationshipResolutionContext(
+                obj=obj,
+                server_key=server_key,
+                catalog_index=catalog_index,
+                display_index=display_index,
+                related_index=related_index,
+                source_index=filter_interface_index(related_index, changeable_interface_ids),
+                actionable_owner_ids=actionable_owner_ids,
+                changeable_interface_ids=changeable_interface_ids,
+                can_write=can_write_relationships,
+            )
+
             for port in ports_data:
                 port["enabled"] = (
                     True
@@ -515,30 +715,31 @@ def get_context_data(self, request, obj, interface_name_field, server_key=None,
                 )
 
                 if hasattr(obj, "virtual_chassis") and obj.virtual_chassis:
-                    chassis_member = get_virtual_chassis_member(obj, port.get(interface_name_field))
-                    device_interfaces = interfaces_by_device.get(
-                        chassis_member.id if chassis_member else obj.id,
-                        {"by_name": {}, "by_librenms_id": {}},
+                    chassis_member = resolve_interface_row_device(
+                        obj,
+                        port,
+                        interface_name_field,
+                        interfaces_by_port_id=interfaces_by_port_id,
+                        members_by_position=members_by_position,
+                        members_by_id=members_by_id,
                     )
                 else:
-                    device_interfaces = interfaces_by_device.get(obj.id, {"by_name": {}, "by_librenms_id": {}})
-
+                    chassis_member = obj
+
+                netbox_interface = resolve_relationship_row(
+                    relationship_context,
+                    port,
+                    chassis_member,
+                    interface_name_field,
+                    unique_host_port_ids,
+                    unambiguous_name_port_ids,
+                    relationship_maps,
+                )
                 port_id = normalize_librenms_port_id(port.get("port_id"))
-                # OOB-controller rows live on a SEPARATE LibreNMS device. Matching them against the
-                # HOST device's interfaces (by port_id or name) would mislabel a shared-LOM OOB port
-                # (e.g. both sides report "eth0"/"idrac0") as an in-sync host interface — rendering
-                # its name green/"matched" and comparing its speed/MTU/MAC against an unrelated host
-                # interface. The shared-name collision has its own signal (the "Shared LOM"
-                # _dedup_conflict badge) and sync_selected_interfaces skips _source=="oob" rows, so
-                # never bind an OOB row to a host interface: leave it unmatched (exists_in_netbox False).
-                if port.get("_source") == "oob":
-                    netbox_interface = None
-                else:
-                    netbox_interface = device_interfaces["by_librenms_id"].get(port_id) if port_id else None
-                    if not netbox_interface:
-                        netbox_interface = device_interfaces["by_name"].get(port.get(interface_name_field))
-                port["exists_in_netbox"] = bool(netbox_interface)
-                port["netbox_interface"] = netbox_interface
+                port["selected_object_id"] = chassis_member.pk
+                port["sync_target_resolvable"] = (
+                    chassis_member.pk in actionable_owner_ids and port_id in unique_host_port_ids
+                )
                 # A bound interface is now always a genuine host match (OOB rows resolved to None
                 # above), so it correctly counts toward the matched set used for netbox-only detection
                 # without an OOB row ever hiding a same-named host interface.
@@ -549,12 +750,24 @@ def get_context_data(self, request, obj, interface_name_field, server_key=None,
                     port["ifAlias"] = ""
 
                 # Add VLAN group auto-selection data to port, applying any user overrides
-                self._add_vlan_group_selection(port, lookup_maps, obj, vlan_group_overrides)
+                if chassis_member.pk in actionable_owner_ids:
+                    row_vlan_groups = vlan_groups_by_device.get(chassis_member.pk, [])
+                    row_lookup_maps = vlan_lookup_maps_by_device.get(chassis_member.pk, {})
+                else:
+                    row_vlan_groups = []
+                    row_lookup_maps = {}
+                port["vlan_groups"] = row_vlan_groups
+                self._add_vlan_group_selection(port, row_lookup_maps, chassis_member, vlan_group_overrides)
 
                 # Add missing VLANs info for warning display
-                self._add_missing_vlans_info(port, lookup_maps)
+                self._add_missing_vlans_info(port, row_lookup_maps)
 
             table = self.get_table(ports_data, obj, interface_name_field, vlan_groups=vlan_groups)
+            table.allowed_vc_member_ids = actionable_owner_ids
+            # Propagate donor "migrated mode" so the table suppresses per-row LAG/parent sync
+            # buttons (the bulk form is already hidden by the template; the row buttons POST
+            # directly, so they must be stripped here too to keep a migrated donor read-only).
+            table.migrated_to_marker = bool(build_migrated_context(obj, server_key).get("migrated_to_marker"))
             table.configure(request)
 
             # Identify NetBox-only interfaces (interfaces in NetBox but not in LibreNMS)
@@ -572,10 +785,12 @@ def get_context_data(self, request, obj, interface_name_field, server_key=None,
                     if interface.id in matched_interface_ids:
                         continue
                     if interface_name not in librenms_interface_names:
-                        # Get device name for the interface
+                        # Get device name for the interface (reuse the pre-indexed members — the
+                        # device_id keys come from interfaces_by_device, which was built from them —
+                        # instead of a members.get(id=...) query per netbox-only interface).
                         if hasattr(obj, "virtual_chassis") and obj.virtual_chassis:
-                            device = obj.virtual_chassis.members.get(id=device_id)
-                            device_name = device.name
+                            device = members_by_id.get(device_id) if members_by_id else None
+                            device_name = device.name if device else obj.name
                         else:
                             device_name = obj.name
 
@@ -596,10 +811,6 @@ def get_context_data(self, request, obj, interface_name_field, server_key=None,
                             }
                         )
 
-        virtual_chassis_members = []
-        if hasattr(obj, "virtual_chassis") and obj.virtual_chassis:
-            virtual_chassis_members = obj.virtual_chassis.members.all()
-
         # ``ttl()`` is Redis-specific; the Django cache API doesn't guarantee it. Guard with
         # getattr so non-Redis backends return None instead of raising AttributeError at render
         # (mirrors ip_addresses_view / modules_view).
@@ -623,6 +834,7 @@ def get_context_data(self, request, obj, interface_name_field, server_key=None,
             "netbox_only_interfaces": netbox_only_interfaces,
             "server_key": server_key,
             "oob_incomplete": oob_incomplete,
+            "relationship_data_incomplete": relationship_data_incomplete,
         }
 
     def _add_vlan_group_selection(self, port, lookup_maps, device, vlan_group_overrides=None):
@@ -693,15 +905,19 @@ def _add_vlan_group_selection(self, port, lookup_maps, device, vlan_group_overri
                 if vid_str in vlan_group_overrides:
                     override_group_id = vlan_group_overrides[vid_str]
                     if override_group_id:
-                        group = override_groups_by_id.get(int(override_group_id))
-                        if group:
+                        try:
+                            group = override_groups_by_id.get(int(override_group_id))
+                        except (TypeError, ValueError):
+                            group = None
+                        allowed_group_ids = {candidate.pk for candidate in vid_to_groups.get(vid, [])}
+                        if group and group.pk in allowed_group_ids:
                             vlan_group_map[vid] = {
                                 "group_id": str(group.pk),
                                 "group_name": group.name,
                                 "is_ambiguous": False,
                             }
                         # else: Override references deleted group; keep auto-selection
-                    else:
+                    elif (vid, None) in lookup_maps.get("vid_group_to_vlan", {}):
                         # User explicitly chose "No Group (Global)"
                         vlan_group_map[vid] = {
                             "group_id": "",
@@ -732,3 +948,25 @@ def _add_missing_vlans_info(self, port, lookup_maps):
                 missing_vlans.append(vid)
 
         port["missing_vlans"] = missing_vlans
+
+    @staticmethod
+    def _relationship_port_names(ports, interface_name_field):
+        """Return each port's distinct string names from the active and canonical fields."""
+        name_fields = {"ifName", "ifDescr", interface_name_field}
+        return [[name for field in name_fields if isinstance(name := port.get(field), str) and name] for port in ports]
+
+    def _has_structural_relationship_signals(self, ports, interface_name_field="ifName"):
+        """Return true for an explicit LAG type or a child name whose parent also exists."""
+        names_per_port = self._relationship_port_names(ports, interface_name_field)
+        port_names = {name for names in names_per_port for name in names}
+        sub_iface_re = re.compile(r"^(.+)\.\d+$")
+        return any(
+            port.get("ifType", "") == "ieee8023adLag"
+            or any((match := sub_iface_re.match(name)) and match.group(1) in port_names for name in names)
+            for port, names in zip(ports, names_per_port)
+        )
+
+    def _has_lag_name_signals(self, ports, interface_name_field, lag_patterns):
+        """Return true when an interface name matches one of the supplied OS-scoped patterns."""
+        names_per_port = self._relationship_port_names(ports, interface_name_field)
+        return any(pat.search(name) for names in names_per_port for pat in lag_patterns for name in names)
diff --git a/netbox_librenms_plugin/views/imports/actions.py b/netbox_librenms_plugin/views/imports/actions.py
index 9673db00fe..8ade3b1be7 100644
--- a/netbox_librenms_plugin/views/imports/actions.py
+++ b/netbox_librenms_plugin/views/imports/actions.py
@@ -90,14 +90,17 @@ def _attach_messages_oob(response, request):
         return response
     # Skip the OOB swap when nothing is queued: an empty #django-messages container
     # would replace (and wipe) toasts already visible on the page from an earlier action.
+    # Iterating the storage marks it consumed; restore used=False after peeking so the
+    # toast render below (or the page's own renderer) still emits the messages.
     storage = messages.get_messages(request)
-    if not list(storage):
-        return response
+    pending = list(storage)
     # ``get_messages`` returns a bare ``list`` (no ``.used``) when no message-storage
     # middleware ran (e.g. RequestFactory requests); a real request always has a storage
     # backend. Guard so re-marking the storage unconsumed can't AttributeError.
     if hasattr(storage, "used"):
         storage.used = False
+    if not pending:
+        return response
     try:
         rendered = render_to_string("inc/messages.html", request=request)
     except Exception:  # pragma: no cover - defensive: don't break HTMX response on render error
@@ -245,6 +248,37 @@ def _mapping_change_is_allowed(view, model, pk) -> bool:
     return view.restricted_queryset(model, "change").filter(pk=pk).exists()
 
 
+def _lock_mapping_in_scope(view, model, lookup, duplicate_message):
+    """
+    Read the candidate mapping pks unlocked, then lock the first one inside the change scope.
+
+    Shared by the device-type and platform mapping views so the permission guarantee cannot drift
+    between two copies. Scope BEFORE locking: locking first lets a caller pin a row it cannot see
+    and stall concurrent work on it. The duplicate check still has to see every row, so it reads
+    unlocked and by pk only, materialised in one query (count() would drop the FOR UPDATE clause).
+
+    Args:
+        view: The calling view, used for ``restricted_queryset``.
+        model: The mapping model to lock.
+        lookup: Filter kwargs identifying the mapping's natural key.
+        duplicate_message: Error text shown when more than one row matches.
+
+    Returns:
+        tuple: ``(locked, None)`` on success, where *locked* is None when no row exists, or
+        ``(None, error_response)`` when the caller must stop.
+    """
+    present_pks = list(model.objects.filter(**lookup).values_list("pk", flat=True)[:2])
+    if len(present_pks) > 1:
+        return None, _htmx_error_response(duplicate_message)
+    if not present_pks:
+        return None, None
+    locked = view.restricted_queryset(model, "change").select_for_update(of=("self",)).filter(pk=present_pks[0]).first()
+    # A row appeared (or left this caller's scope) after the upfront check.
+    if locked is None:
+        return None, _htmx_error_response("Existing mapping is no longer available.")
+    return locked, None
+
+
 def _oob_ip_is_reassignable(candidate, interface) -> bool:
     """
     Return whether *candidate* may be re-homed to *interface* without taking another device's IP.
@@ -2170,29 +2204,14 @@ def post(self, request, device_id):
                 # created duplicate rather than mutating an arbitrary row. Key on the
                 # NORMALISED hardware string (mapping_hardware) so the lock matches
                 # the existing_mapping lookup and create() below.
-                # Scope BEFORE locking: locking first lets a caller hold a row it cannot even see
-                # and stall concurrent work on it. The duplicate check still has to see every
-                # row, so it reads unlocked and by pk only.
-                present_pks = list(
-                    DeviceTypeMapping.objects.filter(librenms_hardware__iexact=mapping_hardware).values_list(
-                        "pk", flat=True
-                    )[:2]
+                locked, lock_error = _lock_mapping_in_scope(
+                    self,
+                    DeviceTypeMapping,
+                    {"librenms_hardware__iexact": mapping_hardware},
+                    "Multiple mappings exist for this hardware string. Remove duplicates before updating.",
                 )
-                if len(present_pks) > 1:
-                    return _htmx_error_response(
-                        "Multiple mappings exist for this hardware string. Remove duplicates before updating."
-                    )
-                locked = None
-                if present_pks:
-                    locked = (
-                        self.restricted_queryset(DeviceTypeMapping, "change")
-                        .select_for_update(of=("self",))
-                        .filter(pk=present_pks[0])
-                        .first()
-                    )
-                    # A row appeared (or left this caller's scope) after the upfront check.
-                    if locked is None:
-                        return _htmx_error_response("Existing mapping is no longer available.")
+                if lock_error is not None:
+                    return lock_error
                 if locked and not existing_mapping:
                     # A concurrent request created the mapping after our upfront read.
                     # Only escalate to change permission if we would actually mutate the row;
@@ -3884,27 +3903,14 @@ def post(self, request, device_id):
                 # lock absent rows, so the create branch handles IntegrityError.
                 # Materialise the locked rows in one query — count() would drop
                 # the FOR UPDATE clause, leaving the rows unlocked.
-                # Scope BEFORE locking: locking first lets a caller hold a row it cannot even see
-                # and stall concurrent work on it. The duplicate check still has to see every
-                # row, so it reads unlocked and by pk only.
-                present_pks = list(
-                    PlatformMapping.objects.filter(librenms_os__iexact=librenms_os).values_list("pk", flat=True)[:2]
+                locked, lock_error = _lock_mapping_in_scope(
+                    self,
+                    PlatformMapping,
+                    {"librenms_os__iexact": librenms_os},
+                    "Multiple mappings exist for this OS string. Remove duplicates before updating.",
                 )
-                if len(present_pks) > 1:
-                    return _htmx_error_response(
-                        "Multiple mappings exist for this OS string. Remove duplicates before updating."
-                    )
-                locked = None
-                if present_pks:
-                    locked = (
-                        self.restricted_queryset(PlatformMapping, "change")
-                        .select_for_update(of=("self",))
-                        .filter(pk=present_pks[0])
-                        .first()
-                    )
-                    # A row appeared (or left this caller's scope) after the upfront check.
-                    if locked is None:
-                        return _htmx_error_response("Existing mapping is no longer available.")
+                if lock_error is not None:
+                    return lock_error
                 if locked and not existing_mapping:
                     # Concurrent request created the mapping after our upfront read.
                     # Only escalate to change permission if we would actually mutate.
diff --git a/netbox_librenms_plugin/views/mapping_views.py b/netbox_librenms_plugin/views/mapping_views.py
index 60f792360e..3e92dd51ad 100644
--- a/netbox_librenms_plugin/views/mapping_views.py
+++ b/netbox_librenms_plugin/views/mapping_views.py
@@ -12,6 +12,7 @@
     ModuleTypeMappingFilterSet,
     NormalizationRuleFilterSet,
     PlatformMappingFilterSet,
+    PortStackLagPatternFilterSet,
 )
 from netbox_librenms_plugin.forms import (
     CarrierAutoInstallRuleFilterForm,
@@ -38,6 +39,9 @@
     PlatformMappingFilterForm,
     PlatformMappingForm,
     PlatformMappingImportForm,
+    PortStackLagPatternFilterForm,
+    PortStackLagPatternForm,
+    PortStackLagPatternImportForm,
 )
 from netbox_librenms_plugin.models import (
     CarrierAutoInstallRule,
@@ -48,6 +52,7 @@
     ModuleTypeMapping,
     NormalizationRule,
     PlatformMapping,
+    PortStackLagPattern,
 )
 from netbox_librenms_plugin.tables.mappings import (
     CarrierAutoInstallRuleTable,
@@ -58,6 +63,7 @@
     ModuleTypeMappingTable,
     NormalizationRuleTable,
     PlatformMappingTable,
+    PortStackLagPatternTable,
 )
 from netbox_librenms_plugin.views.mixins import (
     LibreNMSPermissionMixin,
@@ -622,3 +628,67 @@ class CarrierAutoInstallRuleChangeLogView(LibreNMSPermissionMixin, generic.Objec
 
 class CarrierAutoInstallRuleBulkExportYAMLView(BulkExportYAMLView):
     queryset = CarrierAutoInstallRule.objects.select_related("manufacturer", "carrier_module_type")
+
+
+# --- PortStackLagPattern views ---
+
+
+class PortStackLagPatternListView(LibreNMSPermissionMixin, generic.ObjectListView):
+    """Provides a view for listing all PortStackLagPattern objects."""
+
+    queryset = PortStackLagPattern.objects.all()
+    table = PortStackLagPatternTable
+    filterset = PortStackLagPatternFilterSet
+    filterset_form = PortStackLagPatternFilterForm
+    template_name = "netbox_librenms_plugin/portstacklagpattern_list.html"
+
+
+class PortStackLagPatternCreateView(LibreNMSWritePermissionMixin, generic.ObjectEditView):
+    """Provides a view for creating a new PortStackLagPattern object."""
+
+    queryset = PortStackLagPattern.objects.all()
+    form = PortStackLagPatternForm
+
+
+@register_model_view(PortStackLagPattern, "bulk_import", path="import", detail=False)
+class PortStackLagPatternBulkImportView(LibreNMSWritePermissionMixin, generic.BulkImportView):
+    """Provides a view for bulk importing PortStackLagPattern objects from CSV/JSON/YAML."""
+
+    queryset = PortStackLagPattern.objects.all()
+    model_form = PortStackLagPatternImportForm
+
+
+class PortStackLagPatternView(LibreNMSPermissionMixin, generic.ObjectView):
+    """Provides a view for displaying a PortStackLagPattern object."""
+
+    queryset = PortStackLagPattern.objects.all()
+
+
+class PortStackLagPatternEditView(LibreNMSWritePermissionMixin, generic.ObjectEditView):
+    """Provides a view for editing a PortStackLagPattern object."""
+
+    queryset = PortStackLagPattern.objects.all()
+    form = PortStackLagPatternForm
+
+
+class PortStackLagPatternDeleteView(LibreNMSWritePermissionMixin, generic.ObjectDeleteView):
+    """Provides a view for deleting a PortStackLagPattern object."""
+
+    queryset = PortStackLagPattern.objects.all()
+
+
+class PortStackLagPatternBulkDeleteView(LibreNMSWritePermissionMixin, generic.BulkDeleteView):
+    """Provides a view for bulk deleting PortStackLagPattern objects."""
+
+    queryset = PortStackLagPattern.objects.all()
+    table = PortStackLagPatternTable
+
+
+class PortStackLagPatternChangeLogView(LibreNMSPermissionMixin, generic.ObjectChangeLogView):
+    """Provides a view for displaying the changelog of a PortStackLagPattern object."""
+
+    queryset = PortStackLagPattern.objects.all()
+
+
+class PortStackLagPatternBulkExportYAMLView(BulkExportYAMLView):
+    queryset = PortStackLagPattern.objects.all()
diff --git a/netbox_librenms_plugin/views/mixins.py b/netbox_librenms_plugin/views/mixins.py
index 2361f2f40b..a609a772b1 100644
--- a/netbox_librenms_plugin/views/mixins.py
+++ b/netbox_librenms_plugin/views/mixins.py
@@ -791,15 +791,19 @@ class VlanAssignmentMixin:
     """
 
     def get_vlan_groups_for_device(self, device):
+        """Get all VLAN groups relevant to one device."""
+        return self.get_vlan_groups_for_devices([device])
+
+    def get_vlan_groups_for_devices(self, devices):
         """
-        Get all VLAN groups relevant to this device.
+        Get all VLAN groups relevant to a set of devices.
 
         Searches for VLAN groups scoped to:
-        - Site: The device's assigned site
-        - Location: The device's location and all parent locations
-        - Region: The device's site's region and all parent regions
-        - Site Group: The device's site's group and all parent site groups
-        - Rack: The device's rack
+        - Site: Each device's assigned site
+        - Location: Each device's location and all parent locations
+        - Region: Each device site's region and all parent regions
+        - Site Group: Each device site's group and all parent site groups
+        - Rack: Each device's rack
         - Global: VLAN groups with no scope
 
         Returns:
@@ -808,35 +812,32 @@ def get_vlan_groups_for_device(self, device):
         from dcim.models import Location, Rack, Region, Site, SiteGroup
         from ipam.models import VLANGroup
 
-        groups = set()
-
-        # Site-scoped VLAN groups
-        if hasattr(device, "site") and device.site:
-            site_groups = self._get_vlan_groups_for_scope(Site, [device.site])
-            groups.update(site_groups)
-
-            # Region-scoped VLAN groups (site's region and ancestors)
-            if device.site.region:
-                region_ancestors = self._get_ancestors(device.site.region)
-                region_groups = self._get_vlan_groups_for_scope(Region, region_ancestors)
-                groups.update(region_groups)
-
-            # Site Group-scoped VLAN groups (site's group and ancestors)
-            if device.site.group:
-                site_group_ancestors = self._get_ancestors(device.site.group)
-                site_group_groups = self._get_vlan_groups_for_scope(SiteGroup, site_group_ancestors)
-                groups.update(site_group_groups)
-
-        # Location-scoped VLAN groups (device's location and ancestors)
-        if hasattr(device, "location") and device.location:
-            location_ancestors = self._get_ancestors(device.location)
-            location_groups = self._get_vlan_groups_for_scope(Location, location_ancestors)
-            groups.update(location_groups)
+        sites = set()
+        locations = set()
+        regions = set()
+        site_groups = set()
+        racks = set()
+        for device in devices:
+            site = getattr(device, "site", None)
+            if site is not None:
+                sites.add(site)
+                if site.region:
+                    regions.update(self._get_ancestors(site.region))
+                if site.group:
+                    site_groups.update(self._get_ancestors(site.group))
+            location = getattr(device, "location", None)
+            if location is not None:
+                locations.update(self._get_ancestors(location))
+            rack = getattr(device, "rack", None)
+            if rack is not None:
+                racks.add(rack)
 
-        # Rack-scoped VLAN groups
-        if hasattr(device, "rack") and device.rack:
-            rack_groups = self._get_vlan_groups_for_scope(Rack, [device.rack])
-            groups.update(rack_groups)
+        groups = set()
+        groups.update(self._get_vlan_groups_for_scope(Site, sites))
+        groups.update(self._get_vlan_groups_for_scope(Location, locations))
+        groups.update(self._get_vlan_groups_for_scope(Region, regions))
+        groups.update(self._get_vlan_groups_for_scope(SiteGroup, site_groups))
+        groups.update(self._get_vlan_groups_for_scope(Rack, racks))
 
         # Global VLAN groups (no scope)
         global_groups = VLANGroup.objects.filter(scope_type__isnull=True)
@@ -845,6 +846,31 @@ def get_vlan_groups_for_device(self, device):
         # Return sorted by name for consistent display
         return sorted(groups, key=lambda g: g.name.lower())
 
+    def filter_vlan_groups_for_device(self, vlan_groups, device):
+        """Restrict a preloaded VLAN group union to the scopes relevant to one device."""
+        from dcim.models import Location, Rack, Region, Site, SiteGroup
+        from django.contrib.contenttypes.models import ContentType
+
+        scope_keys = set()
+
+        def add_scope(model, objects):
+            content_type_id = ContentType.objects.get_for_model(model).pk
+            scope_keys.update((content_type_id, obj.pk) for obj in objects if obj is not None)
+
+        site = getattr(device, "site", None)
+        add_scope(Site, [site])
+        add_scope(Region, self._get_ancestors(site.region) if site and site.region else [])
+        add_scope(SiteGroup, self._get_ancestors(site.group) if site and site.group else [])
+        location = getattr(device, "location", None)
+        add_scope(Location, self._get_ancestors(location) if location else [])
+        add_scope(Rack, [getattr(device, "rack", None)])
+
+        return [
+            group
+            for group in vlan_groups
+            if group.scope_type_id is None or (group.scope_type_id, group.scope_id) in scope_keys
+        ]
+
     def _build_vlan_lookup_maps(self, vlan_groups):
         """
         Build lookup dictionaries for VLAN matching.
@@ -857,18 +883,22 @@ def _build_vlan_lookup_maps(self, vlan_groups):
         """
         from ipam.models import VLAN
 
-        vid_to_groups = {}
-        vid_group_to_vlan = {}
-        vid_to_vlans = {}
-        vid_name_to_vlan = {}
-
         # Get all VLANs from relevant groups and global VLANs
         group_pks = [g.pk for g in vlan_groups]
         vlans = VLAN.objects.filter(group__pk__in=group_pks).select_related("group")
         # Also get global VLANs (no group)
         global_vlans = VLAN.objects.filter(group__isnull=True)
+        return self._index_vlans([*vlans, *global_vlans])
 
-        for vlan in list(vlans) + list(global_vlans):
+    @staticmethod
+    def _index_vlans(vlans):
+        """Build VLAN lookup dictionaries from an already loaded VLAN iterable."""
+        vid_to_groups = {}
+        vid_group_to_vlan = {}
+        vid_to_vlans = {}
+        vid_name_to_vlan = {}
+
+        for vlan in vlans:
             vid = vlan.vid
             group = vlan.group
             group_id = group.pk if group else None
@@ -899,6 +929,17 @@ def _build_vlan_lookup_maps(self, vlan_groups):
             "vid_name_to_vlan": vid_name_to_vlan,
         }
 
+    def restrict_vlan_lookup_maps(self, lookup_maps, vlan_groups):
+        """Restrict union lookup maps to the supplied device-relevant groups and globals."""
+        group_ids = {group.pk for group in vlan_groups}
+        vlans = {
+            vlan.pk: vlan
+            for candidates in lookup_maps.get("vid_to_vlans", {}).values()
+            for vlan in candidates
+            if vlan.group_id is None or vlan.group_id in group_ids
+        }
+        return self._index_vlans(vlans.values())
+
     def _select_most_specific_group(self, groups, device):
         """
         Select the most specific VLAN group based on device context.
diff --git a/netbox_librenms_plugin/views/object_sync/devices.py b/netbox_librenms_plugin/views/object_sync/devices.py
index 1097efb983..e7a9093a40 100644
--- a/netbox_librenms_plugin/views/object_sync/devices.py
+++ b/netbox_librenms_plugin/views/object_sync/devices.py
@@ -9,6 +9,11 @@
 from utilities.views import ViewTab, register_model_view
 
 from netbox_librenms_plugin.constants import PERM_VIEW_PLUGIN
+from netbox_librenms_plugin.interface_relationships import (
+    build_candidate_relationship_context,
+    build_relationship_maps,
+    resolve_relationship_row,
+)
 from netbox_librenms_plugin.tables.cables import (
     LibreNMSCableTable,
     VCCableTable,
@@ -19,13 +24,18 @@
 )
 from netbox_librenms_plugin.tables.modules import LibreNMSModuleTable, VCModuleTable
 from netbox_librenms_plugin.utils import (
+    build_migrated_context,
     cache_remaining_ttl,
+    coerce_positive_int,
     get_interface_name_field,
     get_librenms_sync_device,
     get_missing_vlan_warning,
     get_tagged_vlan_css_class,
     get_untagged_vlan_css_class,
+    get_interface_port_identity_sets,
     get_vlan_sync_css_class,
+    is_valid_ports_payload,
+    normalize_librenms_port_id,
 )
 
 from ..base.cables_view import BaseCableTableView
@@ -39,6 +49,7 @@
     LibreNMSAPIMixin,
     LibreNMSPermissionMixin,
     NetBoxObjectPermissionMixin,
+    VlanAssignmentMixin,
     extract_cached_ports,
     parse_request_json,
 )
@@ -120,7 +131,12 @@ def get_table(self, data, obj, interface_name_field, vlan_groups=None):
 
 
 class SingleInterfaceVerifyView(
-    LibreNMSPermissionMixin, NetBoxObjectPermissionMixin, LibreNMSAPIMixin, CacheMixin, View
+    LibreNMSPermissionMixin,
+    NetBoxObjectPermissionMixin,
+    LibreNMSAPIMixin,
+    VlanAssignmentMixin,
+    CacheMixin,
+    View,
 ):
     """Verify single interface data for a device via cached LibreNMS payload."""
 
@@ -129,18 +145,26 @@ class SingleInterfaceVerifyView(
 
     def post(self, request):
         """Verify interface data against cached LibreNMS ports for a device."""
+        # Bind the request so require_object_permissions_json() (which reads self.request)
+        # works even when post() is invoked directly rather than through dispatch().
+        self.request = request
+
+        # Gate before resolving the device: a read-only verify endpoint, this only needs
+        # dcim.view_device (model-level, like SingleModuleVerifyView). Checking first means a
+        # user without it can't probe device IDs by observing 404-vs-200 from get_object_or_404.
+        if error := self.require_object_permissions_json("POST"):
+            return error
+
         data, err = parse_request_json(request)
         if err:
             return err
-        # Gate BEFORE resolving the device: without this an unauthorized caller could probe
-        # arbitrary device IDs (existence via 404) through this endpoint.
-        if error := self.require_object_permissions_json("POST"):
-            return error
-        selected_device_id = data.get("device_id")
-        interface_name = data.get("interface_name")
-        interface_name_field = data.get("interface_name_field") or get_interface_name_field()
+        selected_device_id = coerce_positive_int(data.get("device_id"))
+        posted_name_field = data.get("interface_name_field")
+        interface_name_field = (
+            posted_name_field if posted_name_field in ("ifName", "ifDescr") else get_interface_name_field()
+        )
 
-        if not selected_device_id:
+        if selected_device_id is None:
             return JsonResponse({"status": "error", "message": "No device ID provided"}, status=400)
         # Only honour a CONFIGURED string server_key (mirrors the cable/IP verify siblings):
         # the raw value scopes cache reads and the per-server cf lookups below, so a forged
@@ -153,6 +177,23 @@ def post(self, request):
         # model-level view_device perm, so a site-scoped grant would otherwise read another
         # device's cached verify payload by raw pk.
         selected_device = self.restrict_object_or_404(Device, pk=selected_device_id)
+        origin_device = selected_device
+        raw_origin_device_id = data.get("origin_device_id")
+        if raw_origin_device_id is not None:
+            origin_device_id = coerce_positive_int(raw_origin_device_id)
+            if origin_device_id is None:
+                return JsonResponse({"status": "error", "message": "A valid origin device ID is required."}, status=400)
+            origin_device = self.restrict_object_or_404(Device, pk=origin_device_id)
+            same_device = origin_device.pk == selected_device.pk
+            same_chassis = (
+                origin_device.virtual_chassis_id is not None
+                and origin_device.virtual_chassis_id == selected_device.virtual_chassis_id
+            )
+            if not same_device and not same_chassis:
+                return JsonResponse(
+                    {"status": "error", "message": "The interface page and selected device do not match."},
+                    status=400,
+                )
 
         # Normalise to the VC sync device so cache keys match what the sync view stored
         if selected_device.virtual_chassis:
@@ -169,20 +210,103 @@ def post(self, request):
         # "Interface data not found" 404 below, not AttributeError-500 on .get("ports").
         cached_data = extract_cached_ports(cache.get(ports_cache_key), ports_cache_key)
 
-        if cached_data:
+        # Validate the shape before reading it: a truthy but malformed cache value (non-dict, or a
+        # dict without a list "ports") would otherwise raise on .get(...). Treat it as a cache miss
+        # and fall through to the controlled "not found" response, matching the base table view.
+        if is_valid_ports_payload(cached_data):
+            ports = cached_data.get("ports", [])
+            unique_host_port_ids, unambiguous_name_port_ids = get_interface_port_identity_sets(
+                ports, interface_name_field
+            )
+            # Prefer the stable port_id the client posts (data-port-id on the row): display
+            # names can collide (an OOB controller can reuse a host interface name), so a
+            # name-only match can recompute and patch the wrong cached row. Exclude OOB rows
+            # from both paths so a host row is never shadowed by a same-named controller port.
+            posted_port_id = normalize_librenms_port_id(data.get("port_id"))
+            if posted_port_id is None:
+                return JsonResponse(
+                    {"status": "error", "message": "A valid LibreNMS port ID is required."},
+                    status=404,
+                )
+            if posted_port_id not in unique_host_port_ids:
+                return JsonResponse(
+                    {"status": "error", "message": "Interface data is ambiguous. Refresh and retry."},
+                    status=404,
+                )
+            # A supplied stable port_id is authoritative: match only by it. If it misses, do not
+            # fall back to a display name that another host or OOB row can reuse.
             port_data = next(
-                (port for port in cached_data.get("ports", []) if port.get(interface_name_field) == interface_name),
+                (
+                    p
+                    for p in ports
+                    if normalize_librenms_port_id(p.get("port_id")) == posted_port_id and p.get("_source") != "oob"
+                ),
                 None,
             )
 
             if port_data:
-                table_class = VCInterfaceTable if selected_device.virtual_chassis else LibreNMSInterfaceTable
-                table = table_class(
+                vlan_groups = self.get_vlan_groups_for_device(selected_device)
+                vlan_lookup_maps = self._build_vlan_lookup_maps(vlan_groups)
+                vlan_group_overrides = cache.get(self.get_vlan_overrides_key(primary_device, server_key)) or {}
+                BaseInterfaceTableView._add_vlan_group_selection(
+                    self,
+                    port_data,
+                    vlan_lookup_maps,
+                    selected_device,
+                    vlan_group_overrides,
+                )
+                BaseInterfaceTableView._add_missing_vlans_info(self, port_data, vlan_lookup_maps)
+                port_data["vlan_groups"] = vlan_groups
+                # The caller keeps its existing VC member selector. The verify response only
+                # repaints comparison and relationship cells, so it does not need another
+                # member dropdown in the JSON payload.
+                table = LibreNMSInterfaceTable(
                     [],
                     device=selected_device,
                     interface_name_field=interface_name_field,
+                    vlan_groups=vlan_groups,
                     server_key=server_key,
                 )
+                # Mirror the main table render: a migrated donor's verify response must not
+                # re-introduce the per-row LAG/parent sync button (which posts directly).
+                table.migrated_to_marker = bool(
+                    build_migrated_context(origin_device, server_key).get("migrated_to_marker")
+                )
+                raw_port_id = port_data.get("port_id")
+                port_id = normalize_librenms_port_id(raw_port_id)
+                if port_id is not None:
+                    port_data["port_id"] = port_id
+                name_fallback_allowed = port_id in unambiguous_name_port_ids
+                relationship_maps = build_relationship_maps(cached_data)
+                candidate_port_ids = [raw_port_id]
+                candidate_names = [port_data.get(interface_name_field)] if name_fallback_allowed else []
+                for related_port_id in (
+                    relationship_maps.lag_members.get(port_id),
+                    relationship_maps.sub_interfaces.get(port_id),
+                ):
+                    related_port = relationship_maps.ports_by_id.get(related_port_id)
+                    if related_port is None:
+                        continue
+                    candidate_port_ids.append(related_port.get("port_id", related_port_id))
+                    if related_port_id in unambiguous_name_port_ids:
+                        candidate_names.append(related_port.get(interface_name_field))
+                relationship_context = build_candidate_relationship_context(
+                    selected_device,
+                    server_key,
+                    request.user,
+                    self.has_write_permission(),
+                    candidate_port_ids,
+                    candidate_names,
+                )
+                resolve_relationship_row(
+                    relationship_context,
+                    port_data,
+                    selected_device,
+                    interface_name_field,
+                    unique_host_port_ids,
+                    unambiguous_name_port_ids,
+                    relationship_maps,
+                )
                 formatted_row = table.format_interface_data(port_data, selected_device)
                 return JsonResponse({"status": "success", "formatted_row": formatted_row})
 
@@ -403,10 +527,15 @@ def post(self, request):
         except (ValueError, TypeError):
             return JsonResponse({"status": "error", "message": "Invalid VID"}, status=400)
 
+        try:
+            selected_gid = int(vlan_group_id) if vlan_group_id else None
+        except (ValueError, TypeError):
+            return JsonResponse({"status": "error", "message": "Invalid VLAN group ID"}, status=400)
+
         # Build lookup for the selected group
         visible_vlans = self.restricted_queryset(VLAN)
-        if vlan_group_id:
-            vlan_group = self.restrict_object_or_404(VLANGroup, pk=vlan_group_id)
+        if selected_gid:
+            vlan_group = self.restrict_object_or_404(VLANGroup, pk=selected_gid)
             # Get VLANs in selected group + global VLANs
             group_vids = set(visible_vlans.filter(group=vlan_group).values_list("vid", flat=True))
             global_vids = set(visible_vlans.filter(group__isnull=True).values_list("vid", flat=True))
@@ -437,8 +566,6 @@ def post(self, request):
                 netbox_tagged_group_ids[v.vid] = v.group_id
 
         # Determine group match: selected group vs NetBox VLAN's actual group
-        selected_gid = int(vlan_group_id) if vlan_group_id else None
-
         # Determine CSS class based on actual VLAN type
         if vlan_type == "U":
             # Group matches only matters when VIDs match
@@ -533,10 +660,15 @@ def post(self, request):
         except (ValueError, TypeError):
             return JsonResponse({"status": "error", "message": "Invalid VID"}, status=400)
 
+        try:
+            selected_gid = int(vlan_group_id) if vlan_group_id else None
+        except (ValueError, TypeError):
+            return JsonResponse({"status": "error", "message": "Invalid VLAN group ID"}, status=400)
+
         # Check if VLAN exists in the selected group (or globally)
         visible_vlans = self.restricted_queryset(VLAN)
-        if vlan_group_id:
-            vlan_group = self.restrict_object_or_404(VLANGroup, pk=vlan_group_id)
+        if selected_gid:
+            vlan_group = self.restrict_object_or_404(VLANGroup, pk=selected_gid)
             netbox_vlan = visible_vlans.filter(vid=vid, group=vlan_group).first()
         else:
             # No group = global VLANs
diff --git a/netbox_librenms_plugin/views/sync/device_fields.py b/netbox_librenms_plugin/views/sync/device_fields.py
index 7c9fe3c198..924774fa10 100644
--- a/netbox_librenms_plugin/views/sync/device_fields.py
+++ b/netbox_librenms_plugin/views/sync/device_fields.py
@@ -510,13 +510,11 @@ def post(self, request, pk):
                         return self._sync_redirect(
                             request, pk, getattr(getattr(self, "_librenms_api", None), "server_key", None)
                         )
-                    platform = self.restricted_queryset(Platform).filter(pk=winner.pk).first()
-                    if platform is None:
-                        transaction.set_rollback(True)
-                        messages.error(request, "Selected platform is not available.")
-                        return self._sync_redirect(
-                            request, pk, getattr(getattr(self, "_librenms_api", None), "server_key", None)
-                        )
+                    # Reuse the winner directly. This branch runs only when no platform existed at
+                    # preflight, so the gate asked for ("add", Platform) and never ("view",
+                    # Platform); a restricted_queryset() read here returns none() for an add-only
+                    # user and aborts an assign they are authorized to perform.
+                    platform = winner
             else:
                 # Reuse the existing platform unchanged — do not touch its
                 # manufacturer/vendor scoping; we only assign it and add the mapping.
diff --git a/netbox_librenms_plugin/views/sync/interfaces.py b/netbox_librenms_plugin/views/sync/interfaces.py
index a09c066eb5..2b91342f71 100644
--- a/netbox_librenms_plugin/views/sync/interfaces.py
+++ b/netbox_librenms_plugin/views/sync/interfaces.py
@@ -1,24 +1,41 @@
 import logging
 from urllib.parse import quote_plus
 
-from dcim.models import Device, Interface, MACAddress
+from dcim.models import Device, Interface, MACAddress, VirtualChassis
 from django.contrib import messages
 from django.core.cache import cache
-from django.db import transaction
+from django.core.exceptions import ValidationError
+from django.db import IntegrityError, transaction
 from django.http import Http404, JsonResponse
 from django.shortcuts import redirect
 from django.urls import reverse
 from django.views import View
 from virtualization.models import VirtualMachine, VMInterface
 
+from netbox_librenms_plugin.interface_relationships import (
+    build_interface_index,
+    filter_interface_index,
+    interface_owner_for_object,
+    interface_queryset_for_object,
+    relationship_candidate_ids,
+    relationship_candidate_q,
+    resolve_interface_by_port_id,
+)
 from netbox_librenms_plugin.models import InterfaceTypeMapping
 from netbox_librenms_plugin.utils import (
     AmbiguousLibreNMSIdError,
+    build_migrated_context,
     convert_speed_to_kbps,
+    validation_error_detail,
     find_by_librenms_id,
     get_interface_name_field,
     get_librenms_sync_device,
+    get_interface_port_identity_sets,
+    interface_name_fallback_matches_port,
+    is_list_of_dicts,
     normalize_librenms_port_id,
+    normalize_relationship_maps,
+    resolve_interface_row_device,
     set_librenms_device_id,
 )
 from netbox_librenms_plugin.views.mixins import (
@@ -27,11 +44,20 @@
     LibreNMSPermissionMixin,
     NetBoxObjectPermissionMixin,
     VlanAssignmentMixin,
+    relock_scoped_row,
 )
 
 logger = logging.getLogger(__name__)
 
 
+def _get_syncable_interface_name(port, interface_name_field):
+    """Return the active interface name, or ``None`` when the row cannot be synced."""
+    interface_name = port.get(interface_name_field)
+    if not isinstance(interface_name, str) or not interface_name.strip():
+        return None
+    return interface_name
+
+
 class SyncInterfacesView(
     LibreNMSPermissionMixin, NetBoxObjectPermissionMixin, LibreNMSAPIMixin, VlanAssignmentMixin, CacheMixin, View
 ):
@@ -83,34 +109,104 @@ def post(self, request, object_type, object_id):
                 + f"?tab=interfaces&interface_name_field={interface_name_field}"
             )
         self._post_server_key = server_key
-        selected_interfaces = self.get_selected_interfaces(request, interface_name_field)
+        selected_port_ids = self.get_selected_port_ids(request)
         exclude_columns = request.POST.getlist("exclude_columns")
 
         redirect_url = (
             reverse(url_name, kwargs={"pk": object_id})
             # quote_plus the field too: it comes from the request, so unescaped special chars
-            # could corrupt the redirect or inject extra query params (issue #107).
+            # could corrupt the redirect or inject extra query parameters.
             + f"?tab=interfaces&interface_name_field={quote_plus(interface_name_field)}"
             + (f"&server_key={quote_plus(server_key)}" if server_key else "")
         )
 
-        if selected_interfaces is None:
+        if selected_port_ids is None:
             return redirect(redirect_url)
+        visible_port_ids = selected_port_ids
+        self._selected_port_ids = set(visible_port_ids)
+        self._auto_selected_port_ids = set()
 
         ports_data = self.get_cached_ports_data(request, obj, server_key)
         if ports_data is None:
             return redirect(redirect_url)
 
-        # Prepare VLAN lookup maps if VLAN sync is enabled
-        vlan_groups = self.get_vlan_groups_for_device(obj)
-        lookup_maps = self._build_vlan_lookup_maps(vlan_groups)
-        self._lookup_maps = lookup_maps
+        relationships = self._get_cached_relationships(obj, server_key)
+        lag_members, sub_interfaces = normalize_relationship_maps(relationships)
+        if request.POST.get("auto_select_lag_members"):
+            while True:
+                related_rows = {
+                    member_id
+                    for member_id, aggregate_id in lag_members.items()
+                    if aggregate_id in self._selected_port_ids
+                }
+                related_rows.update(
+                    parent_id for child_id, parent_id in sub_interfaces.items() if child_id in self._selected_port_ids
+                )
+                added = related_rows - self._selected_port_ids
+                if not added:
+                    break
+                self._selected_port_ids.update(added)
+                self._auto_selected_port_ids.update(added - visible_port_ids)
+        host_port_id_counts = {}
+        for port in ports_data:
+            if port.get("_source") == "oob":
+                continue
+            port_id = normalize_librenms_port_id(port.get("port_id"))
+            if port_id is not None:
+                host_port_id_counts[port_id] = host_port_id_counts.get(port_id, 0) + 1
+        duplicated_selected_ids = sorted(
+            port_id for port_id in self._selected_port_ids if host_port_id_counts.get(port_id, 0) > 1
+        )
+        if duplicated_selected_ids:
+            messages.warning(
+                request,
+                "Selected LibreNMS port IDs are duplicated in the cached interface data. "
+                "Refresh LibreNMS data and resolve the duplicate IDs before syncing.",
+            )
+            return redirect(redirect_url)
+        # Resolve inferred off-page owners only after the chassis and its members are locked.
+        # A pre-lock position guess can become stale if membership positions change concurrently.
+        self._auto_selected_target_ids = {}
 
         # Collects interfaces skipped because their LibreNMS port_id resolves to an
         # interface on a *different* device (see _resolve_device/vm_interface). Surfaced
         # below so the skip isn't silent — otherwise the user only sees it in the logs.
         self._skipped_conflicts = []
-        self.sync_selected_interfaces(obj, selected_interfaces, ports_data, exclude_columns, interface_name_field)
+        self._synced_count = 0
+        try:
+            with transaction.atomic():
+                try:
+                    self.sync_selected_interfaces(
+                        obj,
+                        ports_data,
+                        exclude_columns,
+                        interface_name_field,
+                        keep_locked_targets=True,
+                    )
+
+                    # Keep the target-device locks and their current object map through relationship
+                    # validation and persistence. Reusing the map also avoids one permission-filtered
+                    # Device lookup per selected VC relationship edge.
+                    self._sync_lag_and_parent_relationships(
+                        self.object,
+                        ports_data,
+                        relationships,
+                        server_key,
+                        excluded_columns=exclude_columns,
+                    )
+                finally:
+                    self.__dict__.pop("_locked_target_devices", None)
+        except IntegrityError:
+            # This block is the outermost transaction, and Postgres validates Django's DEFERRABLE
+            # INITIALLY DEFERRED foreign keys at its COMMIT. A related row deleted mid-sync
+            # therefore surfaces here, past every inner savepoint handler, and would otherwise 500.
+            logger.warning("Bulk sync: rolled back by a concurrent DB conflict at commit", exc_info=True)
+            messages.error(
+                request,
+                "The sync was rolled back by a concurrent change to a related interface. "
+                "Refresh the LibreNMS data and try again.",
+            )
+            return redirect(redirect_url)
 
         if self._skipped_conflicts:
             skipped = ", ".join(self._skipped_conflicts)
@@ -118,7 +214,12 @@ def post(self, request, object_type, object_id):
                 request,
                 f"{len(self._skipped_conflicts)} interface(s) skipped: {skipped}.",
             )
-        messages.success(request, "Selected interfaces synced successfully.")
+        # Only claim success when at least one interface was actually synced. Track an explicit
+        # synced count rather than comparing skip-vs-selected sizes: a single selected display name
+        # can be skipped after another selected port succeeds, so the explicit count remains the
+        # source of truth for the success banner.
+        if self._synced_count > 0:
+            messages.success(request, "Selected interfaces synced successfully.")
         return redirect(redirect_url)
 
     def get_object(self, object_type, object_id):
@@ -129,13 +230,17 @@ def get_object(self, object_type, object_id):
             return self.restrict_object_or_404(VirtualMachine, pk=object_id)
         raise Http404("Invalid object type.")
 
-    def get_selected_interfaces(self, request, interface_name_field):
-        """Return the list of selected interface names from POST data."""
-        selected_interfaces = request.POST.getlist("select")
-        if not selected_interfaces:
+    def get_selected_port_ids(self, request):
+        """Return selected visible LibreNMS port IDs from POST data."""
+        visible = {
+            port_id
+            for raw_port_id in request.POST.getlist("select")
+            if (port_id := normalize_librenms_port_id(raw_port_id)) is not None
+        }
+        if not visible:
             messages.error(request, "No interfaces selected for synchronization.")
             return None
-        return selected_interfaces
+        return visible
 
     def get_cached_ports_data(self, request, obj, server_key=None):
         """Return cached LibreNMS port data for the given object."""
@@ -152,6 +257,7 @@ def get_cached_ports_data(self, request, obj, server_key=None):
         cached_data = cache.get(self.get_cache_key(cache_obj, "ports", server_key))
         # No cached entry at all (or a non-dict one) → ask the user to refresh before syncing.
         if not isinstance(cached_data, dict):
+            self._cached_ports_payload = None
             messages.warning(
                 request,
                 "No cached data found. Please refresh the data before syncing.",
@@ -168,32 +274,487 @@ def get_cached_ports_data(self, request, obj, server_key=None):
                 "No cached data found. Please refresh the data before syncing.",
             )
             return None
+        # Stash the whole payload so _get_cached_relationships can read port_stack_relationships
+        # from it without a second cache round-trip for the same key.
+        self._cached_ports_payload = cached_data
         return ports_data
 
+    def _resolve_auto_selected_target_ids(
+        self,
+        obj,
+        ports_data,
+        port_ids,
+        interface_name_field,
+        server_key,
+        *,
+        members=None,
+    ):
+        """Resolve independently owned off-page rows to their Virtual Chassis members."""
+        if not isinstance(obj, Device) or not port_ids:
+            return {}
+
+        if members is None:
+            members = list(obj.virtual_chassis.members.all()) if obj.virtual_chassis else [obj]
+        members_by_position = {member.vc_position: member for member in members if member.vc_position is not None}
+        members_by_id = {member.pk: member for member in members}
+        ports_by_id = {
+            port_id: port
+            for port in ports_data
+            if (port_id := normalize_librenms_port_id(port.get("port_id"))) is not None and port.get("_source") != "oob"
+        }
+        candidate_port_ids = [
+            ports_by_id[port_id].get("port_id", port_id)
+            for raw_port_id in port_ids
+            if (port_id := normalize_librenms_port_id(raw_port_id)) in ports_by_id
+        ]
+        if not candidate_port_ids:
+            return {}
+        candidate_ids = relationship_candidate_ids(obj, server_key, candidate_port_ids, ())
+        interface_queryset = interface_queryset_for_object(obj).filter(pk__in=candidate_ids)
+        viewable_ids = set(interface_queryset.restrict(self.request.user, "view").values_list("pk", flat=True))
+        changeable_ids = set(interface_queryset.restrict(self.request.user, "change").values_list("pk", flat=True))
+        interface_index = build_interface_index(
+            obj,
+            server_key,
+            allowed_ids=viewable_ids | changeable_ids,
+        )
+        targets = {}
+        for port_id in port_ids:
+            port = ports_by_id.get(port_id)
+            if port is None:
+                continue
+            target = resolve_interface_row_device(
+                obj,
+                port,
+                interface_name_field,
+                interfaces_by_port_id=interface_index["by_lnms_id"],
+                members_by_position=members_by_position,
+                members_by_id=members_by_id,
+                return_device_on_failure=False,
+            )
+            if target is not None:
+                targets[port_id] = target.pk
+        return targets
+
+    def _get_cached_relationships(self, obj, server_key):
+        """Return port_stack_relationships from the cached port data, or empty dict."""
+        # Reuse the payload get_cached_ports_data already fetched in post(); only hit the cache
+        # again when called independently (e.g. in isolation/tests) — same VC-scoped key.
+        cached_data = getattr(self, "_cached_ports_payload", None)
+        if cached_data is None:
+            cache_obj = get_librenms_sync_device(obj, server_key=server_key) or obj
+            cached_data = cache.get(self.get_cache_key(cache_obj, "ports", server_key))
+        if isinstance(cached_data, dict):
+            return cached_data.get("port_stack_relationships", {})
+        return {}
+
+    def _sync_lag_and_parent_relationships(
+        self,
+        obj,
+        ports_data,
+        relationships,
+        server_key,
+        *,
+        excluded_columns=(),
+    ):
+        """
+        Set LAG member and sub-interface parent relationships for synced interfaces.
+
+        Runs after sync_selected_interfaces() so all interfaces already exist in NetBox.
+        Only processes relationships where this interface is a member/child — the
+        aggregate/parent may or may not be in the selected set (it just needs to exist
+        in NB).
+
+        Args:
+            obj: The Device (or VirtualMachine) being synced.
+            ports_data: The LibreNMS port dicts for the device.
+            relationships (dict): The ``{lag_members, sub_interfaces}`` mapping to apply.
+            server_key (str): The LibreNMS server key scoping stored-id reads.
+
+        Returns:
+            None
+        """
+        if not relationships:
+            return
+        excluded_columns = set(excluded_columns)
+
+        # Normalize the relationship-map keys once at load through the helper used by both
+        # readers, so the bulk path cannot drift on the corruption guard or key normalization.
+        # resolve_port_relationships
+        # emits normalized int keys, but a JSON cache round-trip stringifies dict keys, so the cached
+        # map can arrive str- or int-keyed; re-normalizing lets every lookup below use a single
+        # normalize_librenms_port_id(port_id) call. The helper also coerces a non-dict relationships
+        # (e.g. a list from a corrupt / partial-write cache) to {} — the local `if not relationships`
+        # guard above only catches a falsy value, so a truthy non-dict would otherwise AttributeError
+        # on .get()/.items() here.
+        lag_members, sub_interfaces = normalize_relationship_maps(relationships)
+        if not lag_members and not sub_interfaces:
+            return
+
+        interface_name_field = self.interface_name_field
+        unique_host_port_ids, unambiguous_name_port_ids = get_interface_port_identity_sets(
+            ports_data, interface_name_field
+        )
+
+        # Resolve the selection to stable LibreNMS port IDs.
+        port_by_id = {}
+        selected_port_ids = {
+            str(port_id)
+            for raw_port_id in getattr(self, "_selected_port_ids", set())
+            if (port_id := normalize_librenms_port_id(raw_port_id)) is not None
+        }
+        selected_edge_source_ids = {
+            port_id
+            for port_id in selected_port_ids
+            if normalize_librenms_port_id(port_id) in lag_members
+            or normalize_librenms_port_id(port_id) in sub_interfaces
+        }
+        valid_name_port_ids = {
+            normalize_librenms_port_id(port.get("port_id"))
+            for port in ports_data
+            if port.get("_source") != "oob" and _get_syncable_interface_name(port, interface_name_field) is not None
+        }
+        selected_edge_source_ids &= {str(port_id) for port_id in valid_name_port_ids if port_id is not None}
+        if not selected_edge_source_ids:
+            return
+        for port in ports_data:
+            # OOB-controller rows are context-only (merged for shared-LOM display); sync_selected_interfaces()
+            # already skips them. Exclude them here too: on a page where an OOB row shares the host display
+            # name, adding its port_id would let the LAG/parent pass persist links on the hidden controller
+            # row instead of the host interface.
+            if port.get("_source") == "oob":
+                continue
+            pid = normalize_librenms_port_id(port.get("port_id"))
+            if pid is None or pid not in unique_host_port_ids:
+                continue
+            canonical_pid = str(pid)
+            port_by_id[canonical_pid] = port
+
+        candidate_port_ids = []
+        candidate_names = []
+        for source_port_id in selected_edge_source_ids:
+            source_entry = port_by_id.get(source_port_id)
+            if source_entry is None:
+                continue
+            related_ids = (
+                lag_members.get(normalize_librenms_port_id(source_port_id)),
+                sub_interfaces.get(normalize_librenms_port_id(source_port_id)),
+            )
+            for raw_candidate_id in (source_entry.get("port_id"), *related_ids):
+                candidate_id = normalize_librenms_port_id(raw_candidate_id)
+                if candidate_id is None:
+                    continue
+                candidate_entry = port_by_id.get(str(candidate_id), {})
+                candidate_port_ids.append(candidate_entry.get("port_id", raw_candidate_id))
+                if candidate_id in unambiguous_name_port_ids:
+                    candidate_name = candidate_entry.get(interface_name_field) or candidate_entry.get("ifName")
+                    if candidate_name:
+                        candidate_names.append(candidate_name)
+        try:
+            with transaction.atomic():
+                obj, locked_device_ids = _lock_relationship_scope(
+                    obj,
+                    self.restricted_queryset(type(obj)),
+                )
+                if obj is None:
+                    return
+                candidate_ids = relationship_candidate_ids(
+                    obj,
+                    server_key,
+                    candidate_port_ids,
+                    candidate_names,
+                )
+                catalog_index, source_index, related_index, changeable_ids = _build_locked_relationship_indexes(
+                    obj,
+                    server_key,
+                    self.request.user,
+                    locked_device_ids,
+                    candidate_ids=candidate_ids,
+                )
+
+                for port_id in selected_edge_source_ids:
+                    if port_id not in port_by_id:
+                        continue
+
+                    # Pin both ends of the relationship to the owner this row was synced onto (the
+                    # per-row device_selection target, or the VM). The VC-wide port_id search can
+                    # otherwise resolve a child/parent uniquely onto a *different* member that carries
+                    # the same stale librenms_id, persisting lag/parent on the wrong interface.
+                    target_device = self._resolve_row_target_device(obj, port_id=port_id)
+                    if target_device is None:
+                        continue
+                    expected_owner = interface_owner_for_object(target_device)
+
+                    # LAG membership: this interface is a member of a LAG aggregate. Both ends are
+                    # resolved/validated/persisted by the shared helpers below (same flow as the
+                    # parent pass), differing only in the Interface-only source guard and the
+                    # aggregate type=lag promotion.
+                    raw_lag = lag_members.get(normalize_librenms_port_id(port_id))
+                    if raw_lag is not None and normalize_librenms_port_id(raw_lag) in unique_host_port_ids:
+                        member_iface, agg_iface = self._resolve_relationship_ends(
+                            obj,
+                            port_id,
+                            raw_lag,
+                            port_by_id,
+                            catalog_index,
+                            source_index,
+                            related_index,
+                            server_key,
+                            expected_owner,
+                            interface_name_field,
+                            unambiguous_name_port_ids,
+                            "LAG",
+                            require_interface_source=True,  # VMInterface has no lag field
+                        )
+                        if member_iface and member_iface.lag_id != agg_iface.pk:
+                            if agg_iface.type != "lag" and "type" in excluded_columns:
+                                logger.warning(
+                                    "Bulk sync: skipping LAG link %s -> %s because interface type is excluded",
+                                    member_iface.name,
+                                    agg_iface.name,
+                                )
+                                self._record_skipped_conflict(
+                                    member_iface.name,
+                                    "aggregate type is excluded",
+                                )
+                            elif agg_iface.type != "lag" and agg_iface.pk not in changeable_ids:
+                                logger.warning(
+                                    "Bulk sync: skipping LAG link %s -> %s because the aggregate cannot be changed",
+                                    member_iface.name,
+                                    agg_iface.name,
+                                )
+                            else:
+                                self._apply_relationship_edge(
+                                    member_iface, "lag", agg_iface, self._prepare_bulk_lag_aggregate, "LAG"
+                                )
+
+                    # Sub-interface parent: this interface is a child of a parent interface.
+                    raw_parent = sub_interfaces.get(normalize_librenms_port_id(port_id))
+                    if raw_parent is not None and normalize_librenms_port_id(raw_parent) in unique_host_port_ids:
+                        child_iface, parent_iface = self._resolve_relationship_ends(
+                            obj,
+                            port_id,
+                            raw_parent,
+                            port_by_id,
+                            catalog_index,
+                            source_index,
+                            related_index,
+                            server_key,
+                            expected_owner,
+                            interface_name_field,
+                            unambiguous_name_port_ids,
+                            "parent",
+                        )
+                        if child_iface and child_iface.parent_id != parent_iface.pk:
+                            self._apply_relationship_edge(child_iface, "parent", parent_iface, None, "parent")
+        except IntegrityError:
+            # Immediate conflicts (a unique violation, a row already gone at write time) surface
+            # here and roll the relationship pass back as a unit. Deferred FK violations do NOT:
+            # Postgres validates those at the outermost COMMIT, which post() handles.
+            logger.warning(
+                "Bulk sync: LAG/parent relationship pass rolled back by a concurrent DB conflict",
+                exc_info=True,
+            )
+            messages.warning(
+                self.request,
+                "Interfaces synced, but LAG/parent relationships hit a concurrent change and were "
+                "not applied. Re-run the sync.",
+            )
+
+    @staticmethod
+    def _prepare_bulk_lag_aggregate(agg_iface):
+        """
+        LAG-pass hook: promote the aggregate to type=lag, returning ``(persist, restore)`` or None.
+
+        member_iface.clean() only accepts the link when the aggregate is type=lag, so it
+        is bumped in memory before validation. The aggregate object is reused across rows via
+        the shared interface index, so a member whose link later fails validation must restore
+        the in-memory type — otherwise a subsequent valid member sharing this aggregate would
+        skip the save() and leave the aggregate's type stale in the DB. The restore path is why
+        this passes ``with_restore=True`` to the shared promotion helper.
+        """
+        return _promote_lag_aggregate(agg_iface, with_restore=True)
+
+    def _resolve_relationship_ends(
+        self,
+        obj,
+        port_id,
+        related_raw,
+        port_by_id,
+        catalog_index,
+        source_index,
+        related_index,
+        server_key,
+        source_expected_owner,
+        interface_name_field,
+        unambiguous_name_port_ids,
+        log_kind,
+        *,
+        require_interface_source=False,
+    ):
+        """
+        Resolve the ``(source, related)`` interface pair for one bulk LAG/parent edge.
+
+        Both ends are resolved by stable LibreNMS port_id. The source is pinned to the row target.
+        A selected related row is pinned to its own target, which can be another member of the same
+        Virtual Chassis.
+        Returns ``(None, None)`` — skip the row — on any lookup failure (logged at debug) or,
+        when *require_interface_source* is set, when the source isn't an Interface (a
+        VMInterface has no lag field).
+        """
+        related_port_id = str(related_raw)
+        normalized_related_port_id = normalize_librenms_port_id(related_raw)
+        related_expected_owner = None
+        if normalized_related_port_id in getattr(self, "_selected_port_ids", set()):
+            related_target = self._resolve_row_target_device(obj, port_id=normalized_related_port_id)
+            if related_target is None:
+                return None, None
+            related_expected_owner = interface_owner_for_object(related_target)
+        related_entry = port_by_id.get(related_port_id, {})
+        # Use the active display field for the name fallback: in ifDescr mode the NetBox
+        # interface name matches ifDescr, so hinting ifName would look up the wrong name and
+        # silently skip the link. Fall back to ifName if absent.
+        related_name = ""
+        if normalized_related_port_id in unambiguous_name_port_ids:
+            related_name = related_entry.get(interface_name_field) or related_entry.get("ifName", "")
+
+        _, err = resolve_interface_by_port_id(
+            obj,
+            port_id,
+            server_key,
+            expected_owner=source_expected_owner,
+            index=catalog_index,
+        )
+        if err:
+            logger.debug("%s source catalog lookup failed during bulk sync: %s", log_kind, err)
+            return None, None
+        source_iface, err = resolve_interface_by_port_id(
+            obj,
+            port_id,
+            server_key,
+            expected_owner=source_expected_owner,
+            index=source_index,
+        )
+        if err:
+            logger.debug("%s source lookup failed during bulk sync: %s", log_kind, err)
+            return None, None
+        if require_interface_source and not isinstance(source_iface, Interface):
+            return None, None  # VMInterface does not support lag
+
+        _, err = resolve_interface_by_port_id(
+            obj,
+            related_port_id,
+            server_key,
+            name_hint=related_name,
+            expected_owner=related_expected_owner,
+            index=catalog_index,
+        )
+        if err:
+            logger.debug("%s related catalog lookup failed during bulk sync: %s", log_kind, err)
+            return None, None
+        related_iface, err = resolve_interface_by_port_id(
+            obj,
+            related_port_id,
+            server_key,
+            name_hint=related_name,
+            expected_owner=related_expected_owner,
+            index=related_index,
+        )
+        if err:
+            logger.debug("%s related lookup failed during bulk sync: %s", log_kind, err)
+            return None, None
+        return source_iface, related_iface
+
+    def _apply_relationship_edge(self, source_iface, relation_field, related_iface, prepare_related, log_kind):
+        """
+        Set ``source_iface.<relation_field> = related_iface`` and persist, validating first.
+
+        Thin bulk-pass wrapper over :func:`_apply_interface_relationship` (the shared
+        set -> validate -> persist core, also used by the inline single-row endpoints). A
+        validation failure is logged and skipped so the batch continues, never raised.
+        ``prepare_related`` is the LAG pass's aggregate type=lag hook (returns
+        ``(persist, restore)``); the parent pass passes None.
+        """
+        try:
+            # Own savepoint: an IntegrityError from the persist poisons the enclosing batch
+            # transaction ("current transaction is aborted" on every later row) unless the
+            # failed statements are rolled back to a savepoint first — same reasoning as the
+            # move-to-winner flow in migrate.py. It also keeps the pair atomic: a related-side
+            # persist (LAG type bump) can't outlive a failed source save.
+            with transaction.atomic():
+                _apply_interface_relationship(source_iface, relation_field, related_iface, prepare_related)
+        except ValidationError as exc:
+            logger.warning(
+                "Bulk sync: skipping invalid %s link %s -> %s: %s",
+                log_kind,
+                source_iface.name,
+                related_iface.name,
+                validation_error_detail(exc),
+            )
+            return
+        except IntegrityError as exc:
+            # Concurrent DB conflict (e.g. the related interface deleted between clean() and
+            # existence check and the FK write): skip this row and keep the batch alive,
+            # mirroring migrate.py's MoveInterfaceToWinnerView handling.
+            logger.warning(
+                "Bulk sync: skipping %s link %s -> %s due to a concurrent DB conflict: %s",
+                log_kind,
+                source_iface.name,
+                related_iface.name,
+                exc,
+            )
+            return
+        logger.info("Bulk sync: set %s.%s = %s", source_iface.name, relation_field, related_iface.name)
+
     def sync_selected_interfaces(
         self,
         obj,
-        selected_interfaces,
         ports_data,
         exclude_columns,
         interface_name_field,
+        *,
+        keep_locked_targets=False,
     ):
         """Create or update NetBox interfaces from LibreNMS port data."""
+        selected_port_ids = getattr(self, "_selected_port_ids", set())
         with transaction.atomic():
             if isinstance(obj, Device):
-                locked_targets = self._lock_selected_device_targets(
+                locked_targets = self._lock_selected_device_targets(obj)
+                obj = locked_targets.get(obj.pk)
+                if obj is None:
+                    for port in ports_data:
+                        if normalize_librenms_port_id(port.get("port_id")) in selected_port_ids:
+                            self._record_skipped_conflict(
+                                port.get(interface_name_field),
+                                "selected target unavailable",
+                            )
+                    return
+                self._locked_target_devices = locked_targets
+                self.object = obj
+                self._auto_selected_target_ids = self._resolve_auto_selected_target_ids(
                     obj,
-                    selected_interfaces,
                     ports_data,
+                    self._auto_selected_port_ids,
                     interface_name_field,
+                    self._post_server_key,
+                    members=list(locked_targets.values()),
                 )
-                obj = locked_targets.get(obj.pk)
+            elif isinstance(obj, VirtualMachine):
+                obj = self.restricted_queryset(VirtualMachine).select_for_update(of=("self",)).filter(pk=obj.pk).first()
                 if obj is None:
-                    for interface_name in selected_interfaces:
-                        self._record_skipped_conflict(interface_name, "selected target unavailable")
+                    for port in ports_data:
+                        if normalize_librenms_port_id(port.get("port_id")) in selected_port_ids:
+                            self._record_skipped_conflict(
+                                port.get(interface_name_field),
+                                "selected target unavailable",
+                            )
                     return
-                self._locked_target_devices = locked_targets
-
+                self.object = obj
+                vlan_scope_devices = [obj]
+            if "vlans" not in exclude_columns:
+                if isinstance(obj, Device):
+                    vlan_scope_devices = self._selected_vlan_scope_devices(obj, ports_data, interface_name_field)
+                self._prepare_vlan_lookup_maps(vlan_scope_devices)
             try:
                 for port in ports_data:
                     # OOB-controller rows are merged into the host's interface list only for context
@@ -203,68 +764,157 @@ def sync_selected_interfaces(
                     # selection and overwriting the host interface with the OOB row's port_id/attrs.
                     if port.get("_source") == "oob":
                         continue
-                    port_name = port.get(interface_name_field)
+                    port_id = normalize_librenms_port_id(port.get("port_id"))
 
-                    if port_name in selected_interfaces:
-                        self.sync_interface(obj, port, exclude_columns, interface_name_field)
+                    if port_id in selected_port_ids:
+                        row_excludes = exclude_columns
+                        if port_id in getattr(self, "_auto_selected_port_ids", set()) and "vlans" not in row_excludes:
+                            row_excludes = [*row_excludes, "vlans"]
+                        self.sync_interface(obj, port, row_excludes, interface_name_field)
             finally:
-                self.__dict__.pop("_locked_target_devices", None)
-
-    def _lock_selected_device_targets(self, obj, selected_interfaces, ports_data, interface_name_field):
-        """Lock the page device and selected VC targets for the sync transaction."""
-        target_ids = {obj.pk}
+                if not keep_locked_targets:
+                    self.__dict__.pop("_locked_target_devices", None)
+
+    def _selected_vlan_scope_devices(self, obj, ports_data, interface_name_field):
+        """Return the distinct locked owners whose selected rows will sync VLANs."""
+        selected_port_ids = getattr(self, "_selected_port_ids", set())
+        auto_selected_port_ids = getattr(self, "_auto_selected_port_ids", set())
+        owners = {}
         for port in ports_data:
             if port.get("_source") == "oob":
                 continue
-            interface_name = port.get(interface_name_field)
-            if interface_name not in selected_interfaces:
+            port_id = normalize_librenms_port_id(port.get("port_id"))
+            if (
+                port_id not in selected_port_ids
+                or port_id in auto_selected_port_ids
+                or _get_syncable_interface_name(port, interface_name_field) is None
+            ):
                 continue
-            selected_id = self.request.POST.get(f"device_selection_{interface_name}")
-            if selected_id:
-                try:
-                    target_ids.add(int(selected_id))
-                except (TypeError, ValueError):
-                    continue
+            owner = self._resolve_row_target_device(obj, port_id=port_id)
+            if owner is not None:
+                owners[owner.pk] = owner
+        return list(owners.values())
+
+    def _prepare_vlan_lookup_maps(self, vlan_scope_devices):
+        """Build VLAN scope maps from owner rows locked for this sync transaction."""
+        vlan_groups = self.get_vlan_groups_for_devices(vlan_scope_devices)
+        lookup_maps = self._build_vlan_lookup_maps(vlan_groups)
+        self._lookup_maps = lookup_maps
+        self._lookup_maps_by_owner = {
+            owner.pk: self.restrict_vlan_lookup_maps(
+                lookup_maps,
+                self.filter_vlan_groups_for_device(vlan_groups, owner),
+            )
+            for owner in vlan_scope_devices
+        }
+        self._vlan_owners_by_id = {owner.pk: owner for owner in vlan_scope_devices}
+
+    def _lock_selected_device_targets(self, obj):
+        """Lock the page Device and its current chassis scope in the shared lock order."""
+        virtual_chassis_id = obj.virtual_chassis_id
+        target_ids = {obj.pk}
+        if virtual_chassis_id is not None:
+            # The id came from obj, which this request already resolved through a scoped queryset.
+            locked_chassis = relock_scoped_row(VirtualChassis, pk=virtual_chassis_id)
+            if locked_chassis is None:
+                return {}
+            target_ids.update(Device.objects.filter(virtual_chassis_id=virtual_chassis_id).values_list("pk", flat=True))
+
+        locked = {
+            device.pk: device
+            for device in self.restricted_queryset(Device)
+            .select_for_update(of=("self",))
+            .filter(pk__in=target_ids)
+            .order_by("pk")
+        }
+        locked_obj = locked.get(obj.pk)
+        if locked_obj is None or locked_obj.virtual_chassis_id != virtual_chassis_id:
+            return {}
+        if virtual_chassis_id is not None:
+            locked = {
+                device_id: device
+                for device_id, device in locked.items()
+                if device.virtual_chassis_id == virtual_chassis_id
+            }
+        return locked
+
+    def _selected_row_target_id(self, port_id):
+        """Return the target override keyed by the stable LibreNMS port ID."""
+        port_id = normalize_librenms_port_id(port_id)
+        if port_id is None:
+            return None
+        auto_targets = getattr(self, "_auto_selected_target_ids", {})
+        if port_id in getattr(self, "_auto_selected_port_ids", set()):
+            return auto_targets.get(port_id)
+        return self.request.POST.get(f"device_selection_{port_id}") or auto_targets.get(port_id)
+
+    def _resolve_row_target_device(self, obj, port_id=None):
+        """
+        Resolve the Device a given interface row syncs to.
+
+        A stable port-ID-keyed override must identify an accessible VC member. An invalid, stale,
+        or inaccessible explicit target returns ``None``. The relationship phase reuses this
+        result so a LAG or parent link stays on the same owner as the synced row.
+
+        Args:
+            obj: The page Device (or VirtualMachine); returned as-is for VMs.
+            port_id: The row's stable LibreNMS port_id, when known (keys the override).
 
-        queryset = self.restricted_queryset(Device).select_for_update(of=("self",))
-        return {device.pk: device for device in queryset.filter(pk__in=target_ids).order_by("pk")}
+        Returns:
+            The selected VC member Device when valid, *obj* when no target was selected,
+            or None when an explicit target is invalid or inaccessible.
+        """
+        if not isinstance(obj, Device):
+            return obj
+        normalized_port_id = normalize_librenms_port_id(port_id)
+        if normalized_port_id in getattr(self, "_auto_selected_port_ids", set()) and normalized_port_id not in getattr(
+            self, "_auto_selected_target_ids", {}
+        ):
+            return None
+        selected_device_id = self._selected_row_target_id(port_id)
+        if not selected_device_id:
+            return obj
+        try:
+            # Scoped: the id comes from the POST, and VC membership proves where the device
+            # sits, not that the caller's grant covers it.
+            locked_targets = getattr(self, "_locked_target_devices", None)
+            if locked_targets is None:
+                target_device = self.restricted_queryset(Device).get(id=selected_device_id)
+            else:
+                target_device = locked_targets[int(selected_device_id)]
+        except (Device.DoesNotExist, KeyError, ValueError, TypeError):
+            return None
+        # Both rows are current and locked in the HTTP sync path. Re-check that the
+        # selected device is the page device or remains in the same virtual chassis.
+        if target_device.id != obj.id and (
+            obj.virtual_chassis_id is None or target_device.virtual_chassis_id != obj.virtual_chassis_id
+        ):
+            return None
+        return target_device
 
     def sync_interface(self, obj, librenms_interface, exclude_columns, interface_name_field):
         """Create or update a single NetBox interface from LibreNMS data."""
-        interface_name = librenms_interface.get(interface_name_field)
-        port_id = normalize_librenms_port_id(librenms_interface.get("port_id"))
+        raw_interface_name = librenms_interface.get(interface_name_field)
+        interface_name = _get_syncable_interface_name(librenms_interface, interface_name_field)
+        raw_port_id = librenms_interface.get("port_id")
+        port_id = normalize_librenms_port_id(raw_port_id)
+        lookup_port_id = raw_port_id if port_id is not None else None
+        if interface_name is None:
+            self._record_skipped_conflict(raw_interface_name, "interface name is blank")
+            return
 
         if isinstance(obj, Device):
             server_key = getattr(self, "_post_server_key", None) or self.librenms_api.server_key
-            device_selection_key = f"device_selection_{interface_name}"
-            selected_device_id = self.request.POST.get(device_selection_key)
-
-            if selected_device_id:
-                try:
-                    locked_targets = getattr(self, "_locked_target_devices", None)
-                    if locked_targets is None:
-                        target_device = self.restricted_queryset(Device).get(id=selected_device_id)
-                    else:
-                        target_device = locked_targets[int(selected_device_id)]
-                    # Both rows are current and locked in the HTTP sync path. Re-check that the
-                    # selected device is the page device or remains in the same virtual chassis.
-                    if target_device.id != obj.id and (
-                        obj.virtual_chassis_id is None or target_device.virtual_chassis_id != obj.virtual_chassis_id
-                    ):
-                        self._record_skipped_conflict(interface_name, "selected target unavailable")
-                        return
-                except (Device.DoesNotExist, KeyError, ValueError, TypeError):
-                    # The user explicitly selected a target. If it is stale or outside the
-                    # caller's grant, do not silently sync the row onto the page device.
-                    self._record_skipped_conflict(interface_name, "selected target unavailable")
-                    return
-            else:
-                target_device = obj
-
-            interface = self._resolve_device_interface(target_device, interface_name, port_id, server_key)
+            target_device = self._resolve_row_target_device(obj, port_id=port_id)
+            if target_device is None:
+                # The user explicitly selected a target. If it is stale or outside the
+                # caller's grant, do not silently sync the row onto the page device.
+                self._record_skipped_conflict(interface_name, "selected target unavailable")
+                return
+            interface = self._resolve_device_interface(target_device, interface_name, lookup_port_id, server_key)
         elif isinstance(obj, VirtualMachine):
             server_key = getattr(self, "_post_server_key", None) or self.librenms_api.server_key
-            interface = self._resolve_vm_interface(obj, interface_name, port_id, server_key)
+            interface = self._resolve_vm_interface(obj, interface_name, lookup_port_id, server_key)
         else:
             raise ValueError("Invalid object type.")
 
@@ -279,6 +929,12 @@ def sync_interface(self, obj, librenms_interface, exclude_columns, interface_nam
             self._record_skipped_conflict(interface_name, "port already mapped elsewhere or ambiguous")
             return
 
+        # An interface resolved and is being synced — count it explicitly (defensive getattr:
+        # sync_interface may be exercised directly without post() initialising the counter). The
+        # count, not a skip-vs-selected size comparison, drives the success banner in post().
+        if getattr(self, "_synced_count", None) is not None:
+            self._synced_count += 1
+
         netbox_type = None
         if isinstance(obj, Device):
             netbox_type = self.get_netbox_interface_type(librenms_interface)
@@ -293,7 +949,7 @@ def sync_interface(self, obj, librenms_interface, exclude_columns, interface_nam
 
         # Sync VLANs if not excluded
         if "vlans" not in exclude_columns:
-            self._sync_interface_vlans(interface, librenms_interface, interface_name)
+            self._sync_interface_vlans(interface, librenms_interface)
 
     def _record_skipped_conflict(self, interface_name, reason):
         """Record a row that cannot be synced to its requested target."""
@@ -327,9 +983,16 @@ def _resolve_device_interface(self, target_device, interface_name, port_id, serv
                 # interface (its existing_owner guard), so the foreign binding stays intact.
                 existing_by_name = Interface.objects.filter(device=target_device, name=interface_name).first()
                 if existing_by_name:
-                    return existing_by_name if changeable.filter(pk=existing_by_name.pk).exists() else None
+                    return (
+                        existing_by_name
+                        if interface_name_fallback_matches_port(existing_by_name, port_id, server_key)
+                        and changeable.filter(pk=existing_by_name.pk).exists()
+                        else None
+                    )
                 return None
         interface, created = Interface.objects.get_or_create(device=target_device, name=interface_name)
+        if not created and port_id and not interface_name_fallback_matches_port(interface, port_id, server_key):
+            return None
         return interface if created or changeable.filter(pk=interface.pk).exists() else None
 
     def _resolve_vm_interface(self, vm, interface_name, port_id, server_key):
@@ -354,9 +1017,16 @@ def _resolve_vm_interface(self, vm, interface_name, port_id, server_key):
                 # reassign the port_id off the other interface (its existing_owner guard).
                 existing_by_name = VMInterface.objects.filter(virtual_machine=vm, name=interface_name).first()
                 if existing_by_name:
-                    return existing_by_name if changeable.filter(pk=existing_by_name.pk).exists() else None
+                    return (
+                        existing_by_name
+                        if interface_name_fallback_matches_port(existing_by_name, port_id, server_key)
+                        and changeable.filter(pk=existing_by_name.pk).exists()
+                        else None
+                    )
                 return None
         interface, created = VMInterface.objects.get_or_create(virtual_machine=vm, name=interface_name)
+        if not created and port_id and not interface_name_fallback_matches_port(interface, port_id, server_key):
+            return None
         return interface if created or changeable.filter(pk=interface.pk).exists() else None
 
     def get_netbox_interface_type(self, librenms_interface):
@@ -458,7 +1128,7 @@ def update_interface_attributes(
 
         interface.save()
 
-    def _sync_interface_vlans(self, interface, librenms_port, interface_name):
+    def _sync_interface_vlans(self, interface, librenms_port):
         """
         Sync VLAN assignments from LibreNMS to NetBox interface.
         Sets mode, untagged_vlan, and tagged_vlans based on LibreNMS data.
@@ -466,10 +1136,8 @@ def _sync_interface_vlans(self, interface, librenms_port, interface_name):
         Args:
             interface: NetBox Interface or VMInterface object
             librenms_port: Port data dict from LibreNMS with VLAN info
-            interface_name: Original interface name for form field lookup
         """
-        # Get per-VLAN group selections from form (safely handle special chars in name)
-        safe_name = interface_name.replace("/", "_").replace(":", "_")
+        port_id = normalize_librenms_port_id(librenms_port.get("port_id"))
 
         # Build VLAN data from port
         vlan_data = {
@@ -486,12 +1154,44 @@ def _sync_interface_vlans(self, interface, librenms_port, interface_name):
             all_vids.append(str(vid))
 
         for vid in all_vids:
-            group_id = self.request.POST.get(f"vlan_group_{safe_name}_{vid}", "")
+            group_id = self.request.POST.get(f"vlan_group_{port_id}_{vid}", "")
             if group_id:
                 vlan_group_map[vid] = group_id
 
         # Use mixin method to update interface VLAN assignments
-        self._update_interface_vlan_assignment(interface, vlan_data, vlan_group_map, self._lookup_maps)
+        owner_id = getattr(interface, "device_id", None) or getattr(interface, "virtual_machine_id", None)
+        lookup_maps_by_owner = getattr(self, "_lookup_maps_by_owner", None)
+        if lookup_maps_by_owner is not None:
+            lookup_maps = lookup_maps_by_owner.get(owner_id)
+            if lookup_maps is None:
+                logger.warning("Skipping VLAN sync for %s because its locked owner has no VLAN scope map", interface)
+                return
+        else:
+            lookup_maps = self._lookup_maps
+        owner = getattr(self, "_vlan_owners_by_id", {}).get(owner_id)
+        for vid, group_id in list(vlan_group_map.items()):
+            try:
+                vid_int = int(vid)
+            except (TypeError, ValueError):
+                # The VID comes from the cached LibreNMS payload, which is only checked for being
+                # a dict. A non-numeric value here would abort the whole sync transaction.
+                logger.warning("Skipping VLAN group selection for non-numeric VID %r on %s", vid, interface)
+                vlan_group_map.pop(vid, None)
+                continue
+            try:
+                group_id_int = int(group_id)
+            except (TypeError, ValueError):
+                group_id_int = None
+            if group_id_int is not None and (vid_int, group_id_int) in lookup_maps.get("vid_group_to_vlan", {}):
+                continue
+
+            groups = lookup_maps.get("vid_to_groups", {}).get(vid_int, [])
+            selected_group = groups[0] if len(groups) == 1 else self._select_most_specific_group(groups, owner)
+            if selected_group is None:
+                vlan_group_map.pop(vid, None)
+            else:
+                vlan_group_map[vid] = str(selected_group.pk)
+        self._update_interface_vlan_assignment(interface, vlan_data, vlan_group_map, lookup_maps)
 
 
 class DeleteNetBoxInterfacesView(LibreNMSPermissionMixin, NetBoxObjectPermissionMixin, CacheMixin, View):
@@ -589,3 +1289,554 @@ def post(self, request, object_type, object_id):
             response_data["message"] += f" with {len(errors)} error(s)"
 
         return JsonResponse(response_data)
+
+
+def _lock_relationship_scope(obj, owner_queryset=None):
+    """Lock an object's current relationship scope and recheck owner visibility."""
+    if isinstance(obj, Device):
+        virtual_chassis_id = obj.virtual_chassis_id
+        device_ids = {obj.pk}
+        if virtual_chassis_id is not None:
+            # The id came from obj, which this request already resolved through a scoped queryset.
+            locked_chassis = relock_scoped_row(VirtualChassis, pk=virtual_chassis_id)
+            if locked_chassis is None:
+                return None, set()
+            device_ids.update(Device.objects.filter(virtual_chassis_id=virtual_chassis_id).values_list("pk", flat=True))
+        locked = {
+            device.pk: device
+            for device in Device.objects.select_for_update(of=("self",)).filter(pk__in=device_ids).order_by("pk")
+        }
+        locked_obj = locked.get(obj.pk)
+        if locked_obj is None or locked_obj.virtual_chassis_id != virtual_chassis_id:
+            return None, set()
+        if owner_queryset is not None and not owner_queryset.filter(pk=locked_obj.pk).exists():
+            return None, set()
+        return locked_obj, set(locked)
+    if isinstance(obj, VirtualMachine):
+        locked_obj = VirtualMachine.objects.select_for_update(of=("self",)).filter(pk=obj.pk).first()
+        if (
+            locked_obj is not None
+            and owner_queryset is not None
+            and not owner_queryset.filter(pk=locked_obj.pk).exists()
+        ):
+            return None, set()
+        return locked_obj, set()
+    return None, set()
+
+
+def _build_locked_relationship_indexes(
+    obj,
+    server_key,
+    user,
+    locked_device_ids,
+    *,
+    candidate_q=None,
+    candidate_ids=None,
+):
+    """Lock candidate interfaces, then derive permission indexes from their locked state."""
+    if candidate_ids is None:
+        candidate_queryset = interface_queryset_for_object(obj).filter(candidate_q)
+        candidate_ids = set(candidate_queryset.values_list("pk", flat=True))
+    else:
+        candidate_ids = set(candidate_ids)
+    catalog_index = build_interface_index(
+        obj,
+        server_key,
+        allowed_ids=candidate_ids,
+    )
+    if isinstance(obj, Device):
+        locked_ids = {
+            interface.pk
+            for interfaces in catalog_index["by_name"].values()
+            for interface in interfaces
+            if interface.device_id in locked_device_ids
+        }
+        catalog_index = filter_interface_index(catalog_index, locked_ids)
+        candidate_ids &= locked_ids
+
+    # A constrained grant can stop matching while this transaction waits for a candidate
+    # row lock. Lock only rows the user could act on before the wait, then evaluate the grant
+    # again from their locked state. The catalog stays unfiltered so hidden duplicate IDs and
+    # names still make resolution fail closed without locking rows that were never permitted.
+    permission_candidates = interface_queryset_for_object(obj).filter(pk__in=candidate_ids)
+    if isinstance(obj, Device):
+        actionable_owner_ids = set(
+            Device.objects.restrict(user, "view").filter(pk__in=locked_device_ids).values_list("pk", flat=True)
+        )
+        permission_candidates = permission_candidates.filter(device_id__in=actionable_owner_ids)
+    prelock_viewable_ids = set(permission_candidates.restrict(user, "view").values_list("pk", flat=True))
+    prelock_changeable_ids = set(permission_candidates.restrict(user, "change").values_list("pk", flat=True))
+    prelock_permitted_ids = prelock_viewable_ids | prelock_changeable_ids
+    locked_index = build_interface_index(
+        obj,
+        server_key,
+        lock=True,
+        allowed_ids=prelock_permitted_ids,
+    )
+    locked_candidates = interface_queryset_for_object(obj).filter(pk__in=prelock_permitted_ids)
+    viewable_ids = set(locked_candidates.restrict(user, "view").values_list("pk", flat=True))
+    changeable_ids = set(locked_candidates.restrict(user, "change").values_list("pk", flat=True))
+    related_index = filter_interface_index(locked_index, viewable_ids | changeable_ids)
+    source_index = filter_interface_index(related_index, changeable_ids)
+    return catalog_index, source_index, related_index, changeable_ids
+
+
+def _promote_lag_aggregate(agg, *, with_restore):
+    """
+    Bump a LAG aggregate to ``type=lag`` in memory so a member's ``clean()`` accepts the link.
+
+    Single home for the "promote aggregate to type=lag, persist only that column" rule shared by the
+    bulk LAG pass (``SyncInterfacesView._prepare_bulk_lag_aggregate``) and the single-row LAG
+    endpoint (``SyncInterfaceLagView._prepare_related``) so they can't drift on the promotion or the
+    save fields. Returns None when *agg* isn't an Interface or is already ``type=lag``.
+
+    The persist saves ONLY the ``type`` column (``update_fields=["type"]``) so a concurrent edit to
+    the aggregate's other fields — loaded into the shared interface index outside the row lock — is
+    not clobbered.
+
+    Args:
+        agg: The aggregate interface to promote.
+        with_restore (bool): When True (the bulk pass, which reuses the aggregate across member
+            rows), return a ``(persist, restore)`` pair — ``restore`` reverts the in-memory type so
+            a later valid member sharing this aggregate still saves it if an earlier member's link
+            failed validation. When False, return the bare ``persist`` callable.
+
+    Returns:
+        callable | tuple | None: ``persist`` (or ``(persist, restore)``), or None when nothing to do.
+    """
+    if not (isinstance(agg, Interface) and agg.type != "lag"):
+        return None
+    original_type = agg.type
+    agg.type = "lag"
+
+    def _persist():
+        agg.save(update_fields=["type"])
+        logger.info("Set interface %s type=lag", agg.name)
+
+    if with_restore:
+        return (_persist, lambda: setattr(agg, "type", original_type))
+    return _persist
+
+
+def _validate_relationship(source_iface, relation_field, related_iface):
+    """
+    Run NetBox's model validation for the new relationship FK.
+
+    NetBox 4.4.x reads ``self.parent.virtual_chassis`` when the parent sits on another device.
+    ``Interface`` has no such attribute (4.6 reads ``self.device.virtual_chassis``), so the
+    validation NetBox means to run raises AttributeError instead. Tolerate it only for the edge
+    that comparison exists to allow, two interfaces on members of one virtual chassis, and only
+    when the failure really is that attribute.
+
+    Args:
+        source_iface: The interface whose FK was set.
+        relation_field: The FK attribute that changed (``"lag"`` | ``"parent"``).
+        related_iface: The interface the FK now points at.
+
+    Raises:
+        ValidationError: when NetBox rejects the relationship.
+        AttributeError: any failure that is not the 4.4.x cross-chassis parent bug.
+    """
+    try:
+        source_iface.clean()
+    except AttributeError as exc:
+        source_chassis = getattr(getattr(source_iface, "device", None), "virtual_chassis_id", None)
+        related_chassis = getattr(getattr(related_iface, "device", None), "virtual_chassis_id", None)
+        if not (
+            relation_field == "parent"
+            # exc.name is the attribute the failed access asked for (Python 3.10+), so this
+            # matches the one dereference rather than any message mentioning it.
+            and getattr(exc, "name", None) == "virtual_chassis"
+            and source_chassis is not None
+            and source_chassis == related_chassis
+        ):
+            raise
+        logger.debug(
+            "Interface %s: this NetBox cannot validate a parent on another chassis member; "
+            "both interfaces belong to virtual chassis %s, so the edge is accepted.",
+            source_iface.name,
+            source_chassis,
+        )
+
+
+def _apply_interface_relationship(source_iface, relation_field, related_iface, prepare_related=None):
+    """
+    Set ``source_iface.<relation_field> = related_iface``, validate, and persist both sides.
+
+    The single place the relationship set -> validate -> persist sequence lives, shared by the
+    bulk pass (:meth:`SyncInterfacesView._apply_relationship_edge`) and the inline single-row
+    endpoints (:class:`_BaseRelationshipSyncView`) so a fix applies once, not twice.
+
+    ``prepare_related`` may mutate the related interface in memory before validation (e.g. bump
+    an aggregate to ``type=lag``) and return either a ``persist`` callable or a
+    ``(persist, restore)`` pair: ``persist`` runs only after the source validates, and
+    ``restore`` undoes the in-memory mutation when validation fails — needed when the related
+    object is reused across calls (a shared aggregate in the bulk pass).
+
+    Both rows are persisted with ``update_fields`` so a concurrent edit to their other columns
+    isn't clobbered: the objects may have been loaded into a shared index outside any row lock,
+    so a full ``save()`` of the stale instance would lose-update the concurrent write.
+
+    Raises:
+        ValidationError: when the source fails ``clean()`` (after restoring the related
+            mutation); the caller decides how to surface it (bulk logs+skips, single-row 409).
+    """
+    # Capture the source's original FK before mutating: source_iface (and the aggregate) are
+    # reused across rows via the shared interface index, so a failed attempt must leave BOTH
+    # unmutated. Otherwise a later edge validates source_iface against the rolled-back (but
+    # still in-memory) FK, or — because the aggregate already looks type=lag in memory — a later
+    # member sharing it skips the type bump and never persists it, leaving the DB type stale.
+    relation_id_field = f"{relation_field}_id"
+    original_related_id = getattr(source_iface, relation_id_field)
+    setattr(source_iface, relation_field, related_iface)
+    prepared = prepare_related(related_iface) if prepare_related else None
+    if isinstance(prepared, tuple):
+        persist_related, restore_related = prepared
+    else:
+        persist_related, restore_related = prepared, None
+
+    def _restore_in_memory():
+        setattr(source_iface, relation_id_field, original_related_id)
+        if restore_related:
+            restore_related()
+
+    try:
+        # These are existing, DB-valid rows and this path changes only one relationship FK.
+        # NetBox's model clean() contains the cross-owner/type/self-link rules that matter here.
+        # Running full_clean() would revalidate every unchanged FK and uniqueness constraint,
+        # adding several SELECTs per edge while all relationship rows remain locked.
+        _validate_relationship(source_iface, relation_field, related_iface)
+        if persist_related:
+            persist_related()
+        source_iface.save(update_fields=[relation_field])
+    except (ValidationError, IntegrityError):
+        # clean() rejection OR a statement-time persist failure (the savepoint rolls back
+        # the DB, but the in-memory instances stay mutated): undo both before the caller skips
+        # this row and continues the batch against the shared index.
+        _restore_in_memory()
+        raise
+
+
+class _BaseRelationshipSyncView(
+    LibreNMSPermissionMixin,
+    NetBoxObjectPermissionMixin,
+    LibreNMSAPIMixin,
+    CacheMixin,
+    View,
+):
+    """
+    Shared skeleton for the inline single-row relationship-sync endpoints (LAG / parent).
+
+    SyncInterfaceLagView and SyncInterfaceParentView share the permission gate, current-cache
+    edge validation, stable port ID resolution, and one transactional write path. They differ
+    only in the FK attribute set, the POST field/label wording, VM support, and the LAG-only
+    aggregate type bump. Keeping
+    one flow here stops the two endpoints drifting (a fix to the resolve/validate/persist
+    sequence applies once, not twice).
+
+    Subclass contract (class attributes):
+        relation_field   -- the Interface FK attribute set ("lag" | "parent").
+        related_port_param -- the POST field carrying the related port ID.
+        relation_label   -- human label in messages ("LAG" | "parent").
+        source_label / related_label -- the two interfaces' roles ("Member"/"Aggregate",
+            "Child"/"Parent"), used in the resolution error prefixes.
+        supports_vm      -- whether VMInterface is a valid target (parent: yes; lag: no,
+            VMInterface has no `lag` field).
+    """
+
+    relation_field: str
+    related_port_param: str
+    relation_label: str
+    source_label: str
+    related_label: str
+    supports_vm: bool = False
+
+    @staticmethod
+    def _migrated_donor_error(obj, server_key):
+        """Return a conflict response when a migrated Device is read-only."""
+        if isinstance(obj, Device) and build_migrated_context(obj, server_key).get("migrated_to_marker"):
+            return JsonResponse(
+                {"error": "This LibreNMS source has been migrated and is read-only."},
+                status=409,
+            )
+        return None
+
+    def _required_permissions(self, object_type):
+        """Object-type-scoped POST permissions; raise Http404 for an unsupported type."""
+        if object_type == "device":
+            return {"POST": [("view", Device), ("change", Interface)]}
+        if object_type == "virtualmachine" and self.supports_vm:
+            return {"POST": [("view", VirtualMachine), ("change", VMInterface)]}
+        if object_type == "virtualmachine":
+            # VMInterface has no `lag` field, so LAG membership sync is device-only. Reject up
+            # front rather than resolving a VM and failing later on a mismatched permission.
+            raise Http404(f"{self.relation_label} sync is only supported for device interfaces.")
+        raise Http404("Invalid object type.")
+
+    def _get_object(self, object_type, object_id):
+        # restrict_object_or_404, not get_object_or_404: the POST gate above clears a CONSTRAINED
+        # change grant (has_perm is asked without an instance), so a raw pk lookup would resolve a
+        # device the user may not see. An out-of-scope id 404s like a nonexistent one.
+        if object_type == "device":
+            return self.restrict_object_or_404(Device, pk=object_id)
+        if object_type == "virtualmachine" and self.supports_vm:
+            return self.restrict_object_or_404(VirtualMachine, pk=object_id)
+        raise Http404("Invalid object type.")
+
+    def _prepare_related(self, related_iface):
+        """
+        Hook: mutate the related interface in memory before the source is validated.
+
+        Returns a no-arg callable that persists that mutation (invoked only after the source
+        interface validates) or None when there's nothing to do. SyncInterfaceLagView
+        overrides this to bump the aggregate's type to 'lag'; parent has no equivalent.
+        """
+        return None
+
+    def _get_current_edge(self, obj, server_key, request, port_id, related_port_id):
+        """Return the current cached edge rows and safe name hints, or ``None`` when stale."""
+        cache_obj = get_librenms_sync_device(obj, server_key=server_key) or obj
+        cached_data = cache.get(self.get_cache_key(cache_obj, "ports", server_key))
+        if not isinstance(cached_data, dict):
+            return None
+        ports = cached_data.get("ports")
+        relationships = cached_data.get("port_stack_relationships")
+        if not is_list_of_dicts(ports) or not isinstance(relationships, dict):
+            return None
+        raw_edges = relationships.get("lag_members" if self.relation_field == "lag" else "sub_interfaces")
+        if not isinstance(raw_edges, dict):
+            return None
+
+        lag_members, sub_interfaces = normalize_relationship_maps(relationships)
+        edges = lag_members if self.relation_field == "lag" else sub_interfaces
+        source_id = normalize_librenms_port_id(port_id)
+        related_id = normalize_librenms_port_id(related_port_id)
+        if source_id is None or related_id is None or edges.get(source_id) != related_id:
+            return None
+
+        ports_by_id = {}
+        duplicate_port_ids = set()
+        for port in ports:
+            normalized_id = normalize_librenms_port_id(port.get("port_id"))
+            if port.get("_source") == "oob" or normalized_id is None:
+                continue
+            if normalized_id in ports_by_id:
+                duplicate_port_ids.add(normalized_id)
+            else:
+                ports_by_id[normalized_id] = port
+        if source_id in duplicate_port_ids or related_id in duplicate_port_ids:
+            return None
+        source_port = ports_by_id.get(source_id)
+        related_port = ports_by_id.get(related_id)
+        if source_port is None or related_port is None:
+            return None
+
+        interface_name_field = get_interface_name_field(request)
+        _unique_host_port_ids, unambiguous_name_port_ids = get_interface_port_identity_sets(ports, interface_name_field)
+        source_name = ""
+        if source_id in unambiguous_name_port_ids:
+            source_name = source_port.get(interface_name_field) or ""
+        related_name = ""
+        if related_id in unambiguous_name_port_ids:
+            related_name = related_port.get(interface_name_field) or ""
+        return source_port, related_port, source_name, related_name, interface_name_field
+
+    def post(self, request, object_type, object_id):
+        # Set the object-type-scoped permissions BEFORE the gate (an unsupported type raises
+        # Http404 here). JSON endpoint: require_all_permissions would return the mixin's
+        # HTML/redirect on denial, breaking the fetch() caller, so use the _json variant.
+        self.required_object_permissions = self._required_permissions(object_type)
+        if error := self.require_all_permissions_json("POST"):
+            return error
+
+        obj = self._get_object(object_type, object_id)
+        server_key = self.rebind_api_for_server(request.POST.get("server_key"))
+        if server_key is None:
+            return JsonResponse({"error": "Selected LibreNMS server is no longer configured."}, status=400)
+        if error := self._migrated_donor_error(obj, server_key):
+            return error
+        port_id = request.POST.get("port_id", "").strip()
+        related_port_id = request.POST.get(self.related_port_param, "").strip()
+
+        if not port_id or not related_port_id:
+            return JsonResponse({"error": f"port_id and {self.related_port_param} are required"}, status=400)
+
+        current_edge = self._get_current_edge(obj, server_key, request, port_id, related_port_id)
+        if current_edge is None:
+            return JsonResponse(
+                {"error": "The LibreNMS relationship changed or expired. Refresh and retry."},
+                status=409,
+            )
+        source_port, related_port, source_name, related_name, _interface_name_field = current_edge
+
+        # The IntegrityError wrapper sits OUTSIDE the atomic: a concurrent conflict (e.g. the
+        # related interface deleted in the validate/write TOCTOU window) raises either at the
+        # failed statement — propagating out of the atomic after rollback — or, for Django's
+        # INITIALLY DEFERRED Postgres FKs, only at the atomic's COMMIT. Both land here and
+        # become a JSON 409 instead of an unhandled 500 to the fetch() caller, mirroring the
+        # bulk pass (_apply_relationship_edge).
+        source_iface = None
+        related_iface = None
+        try:
+            with transaction.atomic():
+                obj, locked_device_ids = _lock_relationship_scope(
+                    obj,
+                    self.restricted_queryset(type(obj)),
+                )
+                if obj is None:
+                    return JsonResponse(
+                        {"error": "The interface owner changed concurrently. Refresh and retry."},
+                        status=409,
+                    )
+                if error := self._migrated_donor_error(obj, server_key):
+                    return error
+
+                candidate_q = relationship_candidate_q(
+                    server_key,
+                    (source_port.get("port_id"), related_port.get("port_id")),
+                    (source_name, related_name),
+                )
+                catalog_index, source_index, related_index, changeable_ids = _build_locked_relationship_indexes(
+                    obj,
+                    server_key,
+                    request.user,
+                    locked_device_ids,
+                    candidate_q=candidate_q,
+                )
+
+                _, err = resolve_interface_by_port_id(
+                    obj,
+                    port_id,
+                    server_key,
+                    name_hint=source_name,
+                    expected_owner=interface_owner_for_object(obj),
+                    index=catalog_index,
+                )
+                if err:
+                    return JsonResponse({"error": f"{self.source_label} interface: {err}"}, status=404)
+                source_iface, err = resolve_interface_by_port_id(
+                    obj,
+                    port_id,
+                    server_key,
+                    name_hint=source_name,
+                    expected_owner=interface_owner_for_object(obj),
+                    index=source_index,
+                )
+                if err:
+                    return JsonResponse({"error": f"{self.source_label} interface: {err}"}, status=404)
+
+                _, err = resolve_interface_by_port_id(
+                    obj,
+                    related_port_id,
+                    server_key,
+                    name_hint=related_name,
+                    index=catalog_index,
+                )
+                if err:
+                    return JsonResponse({"error": f"{self.related_label} interface: {err}"}, status=404)
+                related_iface, err = resolve_interface_by_port_id(
+                    obj,
+                    related_port_id,
+                    server_key,
+                    name_hint=related_name,
+                    index=related_index,
+                )
+                if err:
+                    return JsonResponse({"error": f"{self.related_label} interface: {err}"}, status=404)
+                if (
+                    self.relation_field == "lag"
+                    and related_iface.type != "lag"
+                    and related_iface.pk not in changeable_ids
+                ):
+                    return JsonResponse(
+                        {"error": "Aggregate interface cannot be changed to type LAG."},
+                        status=403,
+                    )
+
+                # Validate before persisting: a crafted POST with port_id == related_port_id
+                # resolves source == related, so clean() rejects the resulting
+                # self-relationship. The shared helper sets the FK, runs
+                # _prepare_related (e.g. the aggregate's type=lag, persisted only on success), and
+                # saves with update_fields.
+                try:
+                    _apply_interface_relationship(
+                        source_iface, self.relation_field, related_iface, self._prepare_related
+                    )
+                except ValidationError as exc:
+                    # Log the validation detail server-side and return a fixed message — don't echo
+                    # exception text to the client (CodeQL py/stack-trace-exposure). The
+                    # detail can include a self-link, incompatible types, or invalid chassis scope.
+                    logger.warning(
+                        "%s link validation failed (%s -> %s): %s",
+                        self.relation_label,
+                        source_iface.name,
+                        related_iface.name,
+                        validation_error_detail(exc),
+                    )
+                    return JsonResponse(
+                        {
+                            "error": (
+                                f"Cannot link {source_iface.name} to {self.relation_label} {related_iface.name}: "
+                                f"NetBox rejected the {self.relation_label} relationship. Check the interface "
+                                "types, chassis membership, and that the two interfaces are not the same interface."
+                            )
+                        },
+                        status=409,
+                    )
+                logger.info("Set %s.%s = %s", source_iface.name, self.relation_field, related_iface.name)
+        except IntegrityError as exc:
+            source_name = getattr(source_iface, "name", self.source_label.lower())
+            related_name = getattr(related_iface, "name", self.related_label.lower())
+            logger.warning(
+                "%s link hit a concurrent DB conflict (%s -> %s): %s",
+                self.relation_label,
+                source_name,
+                related_name,
+                exc,
+            )
+            return JsonResponse(
+                {
+                    "error": (
+                        f"Cannot link {source_name} to {self.relation_label} {related_name}: "
+                        "a concurrent change interrupted the update. Refresh and retry."
+                    )
+                },
+                status=409,
+            )
+
+        return JsonResponse(
+            {
+                "status": "success",
+                "message": f"Linked {source_iface.name} to {self.relation_label} {related_iface.name}",
+            }
+        )
+
+
+class SyncInterfaceLagView(_BaseRelationshipSyncView):
+    """Set Interface.lag (member -> aggregate) based on LibreNMS port_stack data."""
+
+    # Permissions are resolved per object_type in the shared post().
+    relation_field = "lag"
+    related_port_param = "lag_port_id"
+    relation_label = "LAG"
+    source_label = "Member"
+    related_label = "Aggregate"
+    supports_vm = False  # VMInterface has no `lag` field
+
+    def _prepare_related(self, related_iface):
+        """Promote the aggregate to type=lag so member_iface.clean() accepts the link."""
+        # Single-row endpoint: no aggregate reuse across rows, so no restore needed.
+        return _promote_lag_aggregate(related_iface, with_restore=False)
+
+
+class SyncInterfaceParentView(_BaseRelationshipSyncView):
+    """Set Interface.parent (sub-interface -> parent) based on LibreNMS port_stack data."""
+
+    # Both Devices (Interface) and VMs (VMInterface, which also has a parent field) are
+    # supported; permissions are resolved per object_type in the shared post().
+    relation_field = "parent"
+    related_port_param = "parent_port_id"
+    relation_label = "parent"
+    source_label = "Child"
+    related_label = "Parent"
+    supports_vm = True
diff --git a/netbox_librenms_plugin/views/sync/ip_addresses.py b/netbox_librenms_plugin/views/sync/ip_addresses.py
index ea3fee1f8a..5f1fe12f1a 100644
--- a/netbox_librenms_plugin/views/sync/ip_addresses.py
+++ b/netbox_librenms_plugin/views/sync/ip_addresses.py
@@ -212,7 +212,7 @@ def _build_interface_maps(self, obj, server_key):
         ``interface_url`` (see ``_match_interface``).
 
         For a Device in a Virtual Chassis, authorized member interfaces are indexed (not just the
-        viewed member's), mirroring ``_resolve_interface_by_port_id`` in ``views/sync/interfaces``:
+        viewed member's), matching the shared stable-ID interface resolver:
         LibreNMS treats a VC as one logical device, so a VC member IP can legitimately resolve to an
         interface on another member by stable port id. For the name fallback the viewed object's own
         interface wins. A name shared only by sibling members (none on the viewed object) stays
diff --git a/netbox_librenms_plugin/views/sync/migrate.py b/netbox_librenms_plugin/views/sync/migrate.py
index 578cc5433c..190f25cc71 100644
--- a/netbox_librenms_plugin/views/sync/migrate.py
+++ b/netbox_librenms_plugin/views/sync/migrate.py
@@ -32,6 +32,7 @@
     coerce_librenms_id,
     get_migrated_to_marker,
     set_device_ip_fk,
+    validation_error_detail,
 )
 from netbox_librenms_plugin.views.imports.actions import _htmx_error_response
 from netbox_librenms_plugin.views.mixins import (
@@ -635,11 +636,7 @@ def post(self, request, pk):
             try:
                 interface.full_clean()
             except ValidationError as exc:
-                detail = (
-                    "; ".join(f"{field}: {' '.join(str(m) for m in msgs)}" for field, msgs in exc.message_dict.items())
-                    if hasattr(exc, "message_dict")
-                    else str(exc)
-                )
+                detail = validation_error_detail(exc)
                 return self._fail(
                     request,
                     f"Cannot move interface '{interface.name}' to '{winner.name}': {detail}",
diff --git a/netbox_librenms_plugin/views/sync/vlans.py b/netbox_librenms_plugin/views/sync/vlans.py
index 084154145e..ac87972e19 100644
--- a/netbox_librenms_plugin/views/sync/vlans.py
+++ b/netbox_librenms_plugin/views/sync/vlans.py
@@ -48,12 +48,25 @@ class SyncVLANsView(LibreNMSPermissionMixin, NetBoxObjectPermissionMixin, LibreN
             # The owner device is resolved through a restricted queryset (see get_object), so
             # state that read here: a missing grant is an explicit 403, not a 404 at the lookup.
             ("view", Device),
-            ("view", VLANGroup),
             ("add", VLAN),
             ("change", VLAN),
         ],
     }
 
+    def _required_post_permissions(self, request):
+        """Require VLANGroup access only when a selected row names a group."""
+        permissions = list(type(self).required_object_permissions["POST"])
+        selected_vids = request.POST.getlist("select")
+        for vid_str in selected_vids:
+            try:
+                vid = int(vid_str)
+            except ValueError:
+                continue
+            if request.POST.get(f"vlan_group_{vid}"):
+                permissions.append(("view", VLANGroup))
+                break
+        return permissions
+
     def post(self, request, object_type: str, object_id: int):
         """
         Process sync request.
@@ -63,6 +76,8 @@ def post(self, request, object_type: str, object_id: int):
         - select: List of VLAN IDs to create
         - vlan_group_{vid}: Per-row VLAN group selection
         """
+        self.required_object_permissions = {"POST": self._required_post_permissions(request)}
+
         # Check both plugin write and NetBox object permissions
         if error := self.require_all_permissions("POST"):
             return error