Preserve runtime topology identities and deterministic inventory refresh order

[Joncallim]

Bug Description

Equivalent Docker refreshes can reorder Networking and Storage. Runtime topology generation also reports Duplicate generated runtime topology ID; retaining one node, which can silently discard a legitimate runtime record.

Scope

Make runtime IDs stable and collision-safe; retain genuinely ambiguous records visibly and non-routably; stabilize equivalent Docker snapshot presentation order; add deterministic regression coverage.

Safety constraints

Read-only inspection only; fail closed on ambiguous identities; preserve diagnostics for genuine malformed collisions.

Acceptance evidence

• equivalent reordered snapshots preserve runtime IDs and Network/Storage presentation order
• distinct container port/listener entities cannot collide and overwrite
• genuine post-redaction or malformed collisions remain visible and non-routable
• focused tests, npm run check, and applicable live/browser verification

This issue was created to track the user-reported live stability defect; it will not be auto-closed.

[Joncallim]

Resolution Evidence

• What changed: Docker listener runtime IDs are now qualified by their owning container; core and publication normalization retain collided records rather than discarding one; Network/Storage inventory order is canonicalized in daemon and web model.
• Why this resolves the issue: same-port containers no longer collide; genuine malformed/redaction collisions remain visible and non-routable instead of silently selecting one; equivalent Network/Storage snapshots render in a stable order.
• How I checked: npm run check passed; npm run test:e2e passed with 85 tests (5 explicitly skipped live-Docker/production-image cases). Focused core, daemon, model, collision, and inventory-order tests also passed during implementation.
• Remaining risk or follow-up: npm run test:live-docker was intentionally not run because this task preserves the read-only/no host-container-network-volume mutation boundary and that fixture creates Docker resources. Broader container/service presentation ordering is outside this issue’s Network/Storage scope.

Recommendation: This issue appears resolved and can be closed by a maintainer after reviewing the commit.

[Joncallim]

Resolution Evidence

• What changed: Existing collision-safe UI/runtime identity work is now complemented by merged fix: make graph derivation collision-safe #164, which makes the documented /api/graph surface fail closed on duplicate/cross-kind aliases and stable under equivalent refresh ordering.
• Why this resolves the issue: no public topology route silently chooses a first/last collided identity; inventory and graph output retain stable, visible identities without arbitrary routing relations.
• How I checked it: core collision/order regressions, independent hostile review, and two green CI matrices (TypeScript, Rust, Docker image, production-image E2E, Playwright).
• Remaining risk or follow-up: live-Docker evidence should be re-run as part of final epic/release certification on the ultimate SHA.

Recommendation: This issue appears resolved and can be closed by a maintainer.