@kaeawc/auto-mobile 0.0.40 → 0.0.41

package/dist/src/db/migrations/2026_07_01_000_failure_groups_signature_unique.ts

@@ -0,0 +1,162 @@
+import { Kysely, sql } from "kysely";
+
+/**
+ * #2789 — make `failure_groups.signature` uniquely indexed and back-fill any
+ * duplicate-signature rows that the original non-unique index allowed to
+ * accumulate (the racy get-or-create in `recordFailure` could INSERT two groups
+ * for one signature).
+ *
+ * ORDERING IS LOAD-BEARING. The migration connection runs with
+ * `PRAGMA foreign_keys = ON` (`configureSqliteDatabase`, src/db/database.ts) and
+ * these SQLite migrations are NOT wrapped in a DDL transaction by the migrator
+ * (`SqliteAdapter.supportsTransactionalDdl === false`). `failure_occurrences`
+ * and `failure_notifications` carry a CASCADE FK on `failure_occurrences.id` /
+ * a plain `group_id`. So we MUST repoint children onto the keeper BEFORE
+ * deleting loser groups — delete-first would CASCADE-wipe the occurrences we
+ * mean to keep. We wrap the whole de-dup + index swap in ONE transaction so a
+ * mid-way `CREATE UNIQUE INDEX` failure cannot leave losers already deleted.
+ *
+ * Keeper selection is a total order — `ORDER BY first_occurrence ASC, id ASC` —
+ * so a same-millisecond burst (two groups tied on `first_occurrence`, the exact
+ * scenario this bug produces) still collapses deterministically to one row and
+ * `CREATE UNIQUE INDEX` cannot throw on a residual duplicate.
+ *
+ * Idempotent / safe on an empty DB so it survives #2785's destructive-recovery
+ * replay (`resetDatabaseState` drops every table and re-runs all migrations):
+ * with no duplicates the de-dup statements are no-ops and the index create uses
+ * `IF NOT EXISTS`.
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+  await db.transaction().execute(async trx => {
+    // 1. Repoint occurrences from loser groups onto their signature's keeper —
+    //    BEFORE any delete, so CASCADE cannot wipe them. A "loser" is any group
+    //    that is not the keeper (earliest first_occurrence, min id tiebreak)
+    //    for its signature.
+    await sql`
+      UPDATE failure_occurrences
+      SET group_id = (
+        SELECT k.id FROM failure_groups k
+        WHERE k.signature = (
+          SELECT g.signature FROM failure_groups g WHERE g.id = failure_occurrences.group_id
+        )
+        ORDER BY k.first_occurrence ASC, k.id ASC
+        LIMIT 1
+      )
+      WHERE group_id IN (
+        SELECT g.id FROM failure_groups g
+        WHERE g.id <> (
+          SELECT k.id FROM failure_groups k
+          WHERE k.signature = g.signature
+          ORDER BY k.first_occurrence ASC, k.id ASC
+          LIMIT 1
+        )
+      )
+    `.execute(trx);
+
+    // 2. Repoint notifications the same way. `failure_notifications.group_id` is
+    //    NOT a foreign key, so nothing cascades and nothing stops us — forget
+    //    this and notifications silently strand on a deleted group id.
+    await sql`
+      UPDATE failure_notifications
+      SET group_id = (
+        SELECT k.id FROM failure_groups k
+        WHERE k.signature = (
+          SELECT g.signature FROM failure_groups g WHERE g.id = failure_notifications.group_id
+        )
+        ORDER BY k.first_occurrence ASC, k.id ASC
+        LIMIT 1
+      )
+      WHERE group_id IN (
+        SELECT g.id FROM failure_groups g
+        WHERE g.id <> (
+          SELECT k.id FROM failure_groups k
+          WHERE k.signature = g.signature
+          ORDER BY k.first_occurrence ASC, k.id ASC
+          LIMIT 1
+        )
+      )
+    `.execute(trx);
+
+    // 3. Back-fill the keeper's aggregates (only for signatures that actually
+    //    had duplicates). total_count is the SUM of the historical counts so we
+    //    do not lose increments that predate retention pruning; last_occurrence
+    //    is the MAX so a collapsed group is not sorted stale on the dashboard
+    //    (getFailureGroups orders by last_occurrence); unique_sessions is
+    //    DERIVED from the now-repointed occurrences via COUNT(DISTINCT), the
+    //    same definition recordFailure uses post-fix (summing would double-count
+    //    a session present in two duplicate groups).
+    //
+    //    Note: single-group signatures whose stored counts drifted from the
+    //    lost-increment path (issue scenario #2, which does NOT create a second
+    //    row) are intentionally left untouched. total_count deliberately
+    //    preserves increments that predate retention pruning, so a blanket
+    //    recompute of COUNT(*) from surviving occurrences would DESTROY
+    //    legitimately-retained historical counts — the two cases are
+    //    indistinguishable after the fact, so we heal only where a duplicate row
+    //    already forces a merge.
+    await sql`
+      UPDATE failure_groups
+      SET
+        total_count = (
+          SELECT COALESCE(SUM(g2.total_count), 0)
+          FROM failure_groups g2
+          WHERE g2.signature = failure_groups.signature
+        ),
+        last_occurrence = (
+          SELECT MAX(g2.last_occurrence)
+          FROM failure_groups g2
+          WHERE g2.signature = failure_groups.signature
+        ),
+        unique_sessions = (
+          SELECT COUNT(DISTINCT o.session_id)
+          FROM failure_occurrences o
+          WHERE o.group_id = failure_groups.id
+        )
+      WHERE
+        (SELECT COUNT(*) FROM failure_groups d WHERE d.signature = failure_groups.signature) > 1
+        AND id = (
+          SELECT k.id FROM failure_groups k
+          WHERE k.signature = failure_groups.signature
+          ORDER BY k.first_occurrence ASC, k.id ASC
+          LIMIT 1
+        )
+    `.execute(trx);
+
+    // 4. Delete the losers. Children were repointed in steps 1-2, so CASCADE has
+    //    nothing left to take.
+    await sql`
+      DELETE FROM failure_groups
+      WHERE id <> (
+        SELECT k.id FROM failure_groups k
+        WHERE k.signature = failure_groups.signature
+        ORDER BY k.first_occurrence ASC, k.id ASC
+        LIMIT 1
+      )
+    `.execute(trx);
+
+    // 5. Swap the plain signature index for a UNIQUE one, and add a composite
+    //    index so the post-fix `COUNT(DISTINCT session_id)` recompute per event
+    //    does not scan every occurrence in the group.
+    await sql`DROP INDEX IF EXISTS idx_failure_groups_signature`.execute(trx);
+    await sql`
+      CREATE UNIQUE INDEX IF NOT EXISTS idx_failure_groups_signature
+      ON failure_groups (signature)
+    `.execute(trx);
+    await sql`
+      CREATE INDEX IF NOT EXISTS idx_failure_occurrences_group_session
+      ON failure_occurrences (group_id, session_id)
+    `.execute(trx);
+  });
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+  await db.transaction().execute(async trx => {
+    await sql`DROP INDEX IF EXISTS idx_failure_occurrences_group_session`.execute(trx);
+    await sql`DROP INDEX IF EXISTS idx_failure_groups_signature`.execute(trx);
+    // Restore the original non-unique index.
+    await sql`
+      CREATE INDEX IF NOT EXISTS idx_failure_groups_signature
+      ON failure_groups (signature)
+    `.execute(trx);
+  });
+}

package/dist/src/db/migrations/2026_07_02_000_event_composite_indexes.ts

@@ -0,0 +1,62 @@
+import { type Kysely, sql } from "kysely";
+import { EVENT_TABLES } from "../eventTables";
+
+async function tableExists(db: Kysely<unknown>, tableName: string): Promise<boolean> {
+  const result = await sql<{ name: string }>`
+    SELECT name FROM sqlite_master WHERE type = 'table' AND name = ${tableName}
+  `.execute(db);
+  return result.rows.length > 0;
+}
+
+/**
+ * Composite (device_id, timestamp) indexes for the telemetry event tables (#2788).
+ *
+ * Every event getter queries `WHERE device_id=? [AND timestamp>=?]
+ * ORDER BY timestamp DESC LIMIT n`, but each table only carries single-column
+ * indexes on `device_id` and `timestamp` separately. SQLite uses at most one
+ * index per query, so the `device_id` equality filter forces a temp B-tree
+ * filesort for the `ORDER BY timestamp DESC`. A composite `(device_id,
+ * timestamp)` index lets the planner satisfy the equality filter and produce the
+ * ordering from a single index — scanning it backward for the DESC order — which
+ * drops the sort entirely.
+ *
+ * No DESC in the index columns: SQLite scans a plain ascending index backward for
+ * `ORDER BY ... DESC`, so a plain composite suffices (mirrors the precedent in
+ * 2025_12_30_000_performance_thresholds.ts).
+ *
+ * Additive and forward-only, per #2788's explicit scope ("do not modify the
+ * existing single-column indexes"):
+ *   - The standalone `timestamp` index MUST stay — the retention cutoff query
+ *     (`ORDER BY timestamp DESC LIMIT 1 OFFSET <cap>`, no device filter) uses it
+ *     as a covering scan, and the composite cannot substitute because `device_id`
+ *     leads the composite.
+ *   - The standalone `device_id` index is now functionally redundant: the
+ *     composite's `device_id` left-prefix serves every `device_id=?` access path
+ *     (including `COUNT(*) WHERE device_id=?`). It is deliberately RETAINED here
+ *     to keep this migration purely additive; dropping the six redundant
+ *     `idx_<table>_device` indexes to cut per-insert write amplification is
+ *     deferred to a follow-up so the change is reviewed on its own (see #2788).
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+  for (const table of EVENT_TABLES) {
+    if (!(await tableExists(db, table))) {
+      continue;
+    }
+    // .ifNotExists() so the migration survives #2785's destructive-recovery
+    // replay (drop-all then replay every migration on an empty DB).
+    await db.schema
+      .createIndex(`idx_${table}_device_timestamp`)
+      .ifNotExists()
+      .on(table as never)
+      .columns(["device_id", "timestamp"] as never[])
+      .execute();
+  }
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+  for (const table of EVENT_TABLES) {
+    // .ifExists() so a partial-up followed by down (recovery machinery can
+    // invoke migrations in unusual orders) does not throw.
+    await db.schema.dropIndex(`idx_${table}_device_timestamp`).ifExists().execute();
+  }
+}

package/dist/src/db/migrations/2026_07_03_000_drop_redundant_device_indexes.ts

@@ -0,0 +1,66 @@
+import { type Kysely, sql } from "kysely";
+import { EVENT_TABLES } from "../eventTables";
+
+async function tableExists(db: Kysely<unknown>, tableName: string): Promise<boolean> {
+  const result = await sql<{ name: string }>`
+    SELECT name FROM sqlite_master WHERE type = 'table' AND name = ${tableName}
+  `.execute(db);
+  return result.rows.length > 0;
+}
+
+/**
+ * Drop the now-redundant single-column `idx_<table>_device` indexes on the six
+ * telemetry event tables (#2893, follow-up to #2788 / PR #2890).
+ *
+ * PR #2890 added composite `(device_id, timestamp)` indexes
+ * (`idx_<table>_device_timestamp`) but was deliberately kept additive-only per
+ * #2788's scope ("do not modify the existing single-column indexes"). This
+ * migration completes the optimization it deferred.
+ *
+ * A composite `(device_id, timestamp)` index serves every access path a
+ * standalone `(device_id)` index can, via SQLite's left-prefix rule:
+ *   - `WHERE device_id=?` — equality on the composite's leading column.
+ *   - `WHERE device_id=? ORDER BY timestamp DESC` — filter + order from one index.
+ *   - `COUNT(*) WHERE device_id=?` — covering scan of the composite.
+ * There is no `ANALYZE`/`sqlite_stat1` in `src/db/`, so the planner chooses
+ * structurally and deterministically; the standalone device index is dead weight
+ * maintained on every insert for no read benefit. At the retention cap with a
+ * high insert rate this is pure write amplification.
+ *
+ * Left intact (different query shapes — out of scope):
+ *   - The standalone `timestamp` index: the retention cutoff query
+ *     (`ORDER BY timestamp DESC LIMIT 1 OFFSET <cap>`, no device filter) uses it
+ *     as a covering scan, and the composite CANNOT substitute because `device_id`
+ *     leads the composite.
+ *   - The category/content indexes (`idx_network_events_host`,
+ *     `idx_log_events_tag`, `idx_os_events_category`).
+ *
+ * Forward-only, replay-safe (`.ifExists()` / `.ifNotExists()`) so the migration
+ * survives #2785's destructive-recovery replay (drop-all then replay every
+ * migration on an empty DB) in unusual orders. Sorts after
+ * `2026_07_02_000_event_composite_indexes.ts`, so the composite that subsumes
+ * each device index is guaranteed present when its device index is dropped.
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+  for (const table of EVENT_TABLES) {
+    // .ifExists() so replay on a DB that never had the standalone device index
+    // (or a partial recovery order) does not throw.
+    await db.schema.dropIndex(`idx_${table}_device`).ifExists().execute();
+  }
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+  for (const table of EVENT_TABLES) {
+    if (!(await tableExists(db, table))) {
+      continue;
+    }
+    // Recreate the single-column device index exactly as the base migrations
+    // defined it. .ifNotExists() so a down after a partial-up is idempotent.
+    await db.schema
+      .createIndex(`idx_${table}_device`)
+      .ifNotExists()
+      .on(table as never)
+      .column("device_id" as never)
+      .execute();
+  }
+}

package/dist/src/db/migrations/2026_07_03_000_repair_datetime_now_defaults.ts

@@ -0,0 +1,268 @@
+import { type Kysely, sql } from "kysely";
+
+/**
+ * #2895 — repair the string-literal timestamp-default bug on already-migrated
+ * databases.
+ *
+ * Every migration column that passed a plain SQL time-expression string to
+ * `col.defaultTo(...)` — `"datetime('now')"` or `"CURRENT_TIMESTAMP"` — bound the
+ * argument as a VALUE, not raw SQL, so its DDL emitted `DEFAULT 'datetime(''now'')'`
+ * / `DEFAULT 'CURRENT_TIMESTAMP'`. Any row inserted without an explicit value for
+ * such a column stored the useless literal text instead of a timestamp.
+ *
+ * The DDL is fixed FORWARD (all columns now use `defaultTo(sql`(datetime('now'))`)`),
+ * so fresh databases are already correct. But a database that already ran the
+ * buggy migrations keeps the broken `DEFAULT` in its stored schema — editing a
+ * historical migration does NOT re-run it (Kysely tracks migrations by name, no
+ * content checksum). So on an upgraded DB this migration must do TWO things:
+ *
+ *   1. REBUILD each column whose live default is the broken string literal, so
+ *      FUTURE inserts that omit the column (e.g. `getOrCreateApp`, which omits
+ *      `created_at`) stop re-poisoning it. SQLite cannot alter a column default
+ *      in place, and bun:sqlite forbids editing `sqlite_master` directly, so we
+ *      use the standard table-rebuild: create a twin table with the corrected
+ *      default, copy the rows, drop the original, rename the twin back, recreate
+ *      its indexes/triggers, and restore its `sqlite_sequence` AUTOINCREMENT
+ *      high-water mark (so a rebuilt table cannot reuse a deleted top id). FK
+ *      enforcement is toggled OFF around the
+ *      rebuild (see `up`) so dropping a referenced parent cannot cascade-delete
+ *      its children, then `PRAGMA foreign_key_check` verifies integrity before it
+ *      is restored.
+ *   2. REPAIR the existing poisoned rows in those columns to an evaluated
+ *      timestamp.
+ *
+ * TARGETING — the fix keys off `pragma_table_info(...).dflt_value`, which reports
+ * a column's stored default. Only the two broken string-literal forms match
+ * ({@link BROKEN_DEFAULTS}); a corrected `(datetime('now'))` default, a bare
+ * `CURRENT_TIMESTAMP` keyword, and legitimate value defaults (`'{}'`, `'success'`)
+ * all report a different `dflt_value` and are skipped. This is deliberately
+ * NARROWER than "rewrite any TEXT cell equal to the literal": columns like
+ * `storage_events.value` persist arbitrary app data (an app could legitimately
+ * store the string `datetime('now')`), so restricting the row repair to columns
+ * that actually carry the broken default is what keeps it from corrupting real
+ * data.
+ *
+ * The evaluated `datetime('now')` written for repaired rows is the best available
+ * timestamp for a row that never had a real one (its true creation time is
+ * unrecoverable). It is stored in SQLite's `YYYY-MM-DD HH:MM:SS` format — the same
+ * format the fixed column defaults now emit and the codebase's other
+ * server-evaluated-now writes use (`sql`datetime('now')`` in ThresholdManager /
+ * MemoryThresholdManager) — rather than the app's ISO-8601. This divergence is
+ * deliberate and harmless: no column is both defaulted AND written explicit ISO at
+ * an ordered/compared read site (audited during #2895 review), and every TTL
+ * comparison wraps the value in `datetime(...)`, which normalizes both formats.
+ *
+ * Safe on a fresh DB and idempotent: fresh/replayed schemas carry the corrected
+ * default, so no column matches {@link BROKEN_DEFAULTS} and the whole pass is a
+ * no-op. A second run finds nothing left to rebuild or repair.
+ */
+
+/**
+ * A column's stored default (as reported by `pragma_table_info(...).dflt_value`)
+ * mapped to the corrected default expression it should carry and the literal
+ * value its poisoned rows hold. The `dflt_value` keys are the exact broken
+ * string-literal forms — a correct `datetime('now')` / `CURRENT_TIMESTAMP`
+ * default reports differently and never matches.
+ */
+const BROKEN_DEFAULTS: Record<string, { corrected: string; poisonedValue: string }> = {
+  "'datetime(''now'')'": { corrected: "(datetime('now'))", poisonedValue: "datetime('now')" },
+  "'CURRENT_TIMESTAMP'": { corrected: "CURRENT_TIMESTAMP", poisonedValue: "CURRENT_TIMESTAMP" },
+};
+
+interface NamedRow {
+  name: string;
+}
+
+interface ColumnInfoRow {
+  name: string;
+  dflt_value: string | null;
+}
+
+interface SqlRow {
+  sql: string | null;
+}
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+  // Fast path: on a fresh/already-fixed schema no column carries a broken default,
+  // so there is nothing to rebuild. Return WITHOUT touching PRAGMA foreign_keys so
+  // the common case (every existing DB and test) leaves the connection's FK state
+  // exactly as the caller set it. Only the rare upgraded-DB path below toggles it.
+  const brokenTables = await findTablesWithBrokenDefaults(db);
+  if (brokenTables.length === 0) {
+    return;
+  }
+
+  // Rebuilding a table that OTHER tables reference by foreign key requires FK
+  // enforcement OFF: `DROP TABLE` performs an implicit DELETE that would otherwise
+  // fire `ON DELETE CASCADE` and wipe the child rows (deferral only delays the
+  // constraint *check*, not the cascade *action*). `PRAGMA foreign_keys` is a
+  // no-op inside a transaction, so it is toggled on the connection around the
+  // transaction — safe because the migrator does not wrap SQLite migrations in a
+  // transaction and the run is serialized by the migration lock. It is restored to
+  // ON afterwards: this branch only runs on an upgraded production DB, whose
+  // connection is configured FK-ON (`configureSqliteDatabase`), which is also the
+  // state the rest of the migration chain expects.
+  await sql`PRAGMA foreign_keys = OFF`.execute(db);
+  try {
+    // One transaction so a mid-rebuild failure cannot leave a half-swapped schema.
+    await db.transaction().execute(async trx => {
+      await rebuildAndRepair(trx, brokenTables);
+    });
+  } finally {
+    await sql`PRAGMA foreign_keys = ON`.execute(db);
+  }
+}
+
+/**
+ * Return the tables that have at least one column whose stored default is a
+ * broken string literal. Uses a `SELECT`-shaped `pragma_table_info(...)` read so
+ * the bunSqliteDialect returns rows (a bare `PRAGMA x` value read does not).
+ */
+async function findTablesWithBrokenDefaults(db: Kysely<unknown>): Promise<string[]> {
+  const tables = await sql<NamedRow>`
+    SELECT name FROM sqlite_master
+    WHERE type = 'table' AND name NOT LIKE 'sqlite_%'
+  `.execute(db);
+
+  const broken: string[] = [];
+  for (const { name: table } of tables.rows) {
+    const columns = await sql<ColumnInfoRow>`
+      SELECT dflt_value FROM pragma_table_info(${table})
+    `.execute(db);
+    if (columns.rows.some(column => column.dflt_value !== null && column.dflt_value in BROKEN_DEFAULTS)) {
+      broken.push(table);
+    }
+  }
+  return broken;
+}
+
+async function rebuildAndRepair(trx: Kysely<unknown>, tables: string[]): Promise<void> {
+  for (const table of tables) {
+    const columns = await sql<ColumnInfoRow>`
+      SELECT name, dflt_value FROM pragma_table_info(${table})
+    `.execute(trx);
+
+    const brokenColumns = columns.rows.filter(
+      column => column.dflt_value !== null && column.dflt_value in BROKEN_DEFAULTS
+    );
+    if (brokenColumns.length === 0) {
+      continue;
+    }
+
+    await rebuildTableWithCorrectedDefaults(trx, table);
+
+    // Rows copied verbatim during the rebuild still hold the literal; heal them
+    // now, restricted to the columns that actually carried the broken default.
+    for (const column of brokenColumns) {
+      const { poisonedValue } = BROKEN_DEFAULTS[column.dflt_value as string];
+      await sql`
+        UPDATE ${sql.ref(table)}
+        SET ${sql.ref(column.name)} = datetime('now')
+        WHERE ${sql.ref(column.name)} = ${poisonedValue}
+      `.execute(trx);
+    }
+  }
+}
+
+/**
+ * Rebuild `table` so every broken string-literal default becomes its corrected
+ * raw-SQL form, preserving data, indexes, and triggers. Only the `DEFAULT`
+ * clauses change; column set and order are untouched, so `INSERT ... SELECT *`
+ * lines the rows up 1:1.
+ */
+async function rebuildTableWithCorrectedDefaults(
+  trx: Kysely<unknown>,
+  table: string
+): Promise<void> {
+  const createRow = await sql<SqlRow>`
+    SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ${table}
+  `.execute(trx);
+  const createSql = createRow.rows[0]?.sql;
+  if (!createSql) {
+    return;
+  }
+
+  const tempTable = `__rebuild_${table}`;
+  let correctedSql = replaceFirstTableName(createSql, table, tempTable);
+  for (const brokenDefault of Object.keys(BROKEN_DEFAULTS)) {
+    // The broken literal only appears in the schema as a column default, so a
+    // global replace cannot touch anything else.
+    correctedSql = correctedSql.split(brokenDefault).join(BROKEN_DEFAULTS[brokenDefault].corrected);
+  }
+
+  // Capture the table's own indexes and triggers before the drop — auto-indexes
+  // backing PRIMARY KEY / UNIQUE constraints have a NULL `sql` and are recreated
+  // by the CREATE TABLE itself, so only the explicit ones need replaying.
+  const auxiliary = await sql<SqlRow>`
+    SELECT sql FROM sqlite_master
+    WHERE tbl_name = ${table} AND type IN ('index', 'trigger') AND sql IS NOT NULL
+  `.execute(trx);
+
+  // Capture the AUTOINCREMENT high-water mark. `sqlite_sequence` records the
+  // highest rowid EVER used so AUTOINCREMENT never reuses a deleted id; the
+  // copy/drop/rename below would otherwise reset it to `max(current id)` and let a
+  // deleted top id be handed out again — aliasing ids that other tables reference
+  // as plain integers. Restored after the rename.
+  const originalSequence = await captureSequence(trx, table);
+
+  await sql.raw(correctedSql).execute(trx);
+  await sql`INSERT INTO ${sql.ref(tempTable)} SELECT * FROM ${sql.ref(table)}`.execute(trx);
+  await sql`DROP TABLE ${sql.ref(table)}`.execute(trx);
+  await sql`ALTER TABLE ${sql.ref(tempTable)} RENAME TO ${sql.ref(table)}`.execute(trx);
+  for (const { sql: auxSql } of auxiliary.rows) {
+    if (auxSql) {
+      await sql.raw(auxSql).execute(trx);
+    }
+  }
+
+  if (originalSequence !== undefined) {
+    await sql`DELETE FROM sqlite_sequence WHERE name = ${table}`.execute(trx);
+    await sql`INSERT INTO sqlite_sequence (name, seq) VALUES (${table}, ${originalSequence})`.execute(
+      trx
+    );
+  }
+}
+
+/**
+ * Read a table's `sqlite_sequence` high-water mark, or `undefined` when the table
+ * is not AUTOINCREMENT / has never been inserted into (no sequence row) or the
+ * `sqlite_sequence` table does not exist (no AUTOINCREMENT table in the DB).
+ */
+async function captureSequence(
+  trx: Kysely<unknown>,
+  table: string
+): Promise<number | undefined> {
+  const hasSequenceTable = await sql<NamedRow>`
+    SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'sqlite_sequence'
+  `.execute(trx);
+  if (hasSequenceTable.rows.length === 0) {
+    return undefined;
+  }
+  const seqRow = await sql<{ seq: number }>`
+    SELECT seq FROM sqlite_sequence WHERE name = ${table}
+  `.execute(trx);
+  return seqRow.rows[0]?.seq;
+}
+
+/**
+ * Replace the table name in a `CREATE TABLE` statement, tolerating the double-
+ * quoted (Kysely) and bare forms and arbitrary whitespace after the keyword.
+ * Only the first occurrence — the table being declared — is rewritten; a later
+ * self-reference (e.g. a table-level FK) keeps pointing at the real name so the
+ * copy still works.
+ */
+function replaceFirstTableName(createSql: string, from: string, to: string): string {
+  // Match the declared table name as either a double-quoted identifier (Kysely's
+  // form) or a bare word, and rewrite only when it is exactly `from` so a later
+  // self-reference in the body is left untouched.
+  return createSql.replace(
+    /^(\s*CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?)(?:"([^"]+)"|(\w+))/i,
+    (match, prefix: string, quotedName: string | undefined, bareName: string | undefined) =>
+      (quotedName ?? bareName) === from ? `${prefix}"${to}"` : match
+  );
+}
+
+export async function down(): Promise<void> {
+  // Irreversible repair: the corrected defaults and healed rows carry no
+  // information worth reverting, so the down migration is intentionally a no-op.
+}

package/dist/src/db/migrations/2026_07_04_000_storage_events_key_lookup.ts

@@ -0,0 +1,60 @@
+import type { Kysely } from "kysely";
+
+/**
+ * Seek-reduction index for `recordStorageEvent`'s per-insert previous-value
+ * lookup (#2798).
+ *
+ * On every storage telemetry insert that doesn't already carry `previousValue`,
+ * `storageEventRepository.recordStorageEvent` runs:
+ *
+ *   SELECT value FROM storage_events
+ *   WHERE device_id=? AND file_name=? AND key=?
+ *   ORDER BY timestamp DESC LIMIT 1
+ *
+ * #2798 was filed against the pre-#2788 schema, where the only usable index was
+ * the standalone `idx_storage_events_device` and the plan showed
+ * `USE TEMP B-TREE FOR ORDER BY`. That temp B-tree is ALREADY gone: PR #2890
+ * (#2788) added `idx_storage_events_device_timestamp (device_id, timestamp)` and
+ * PR #2904 (#2893) dropped the standalone device index, so the composite's
+ * `device_id` prefix now supplies the DESC order for free.
+ *
+ * What remains — and what this index fixes — is the SEEK width. With only the
+ * `(device_id, timestamp)` composite the planner seeks on `device_id=?` and then
+ * scans every row for that device in timestamp order, applying the `file_name=?`
+ * and `key=?` filters row-by-row until the first match. A device with many
+ * distinct keys makes that scan arbitrarily long. `(device_id, file_name, key,
+ * timestamp)` turns the three equality predicates into a single prefix seek that
+ * descends straight to the target key's rows, and the trailing `timestamp` column
+ * still yields the newest row without a sort (SQLite walks the ascending index
+ * backward for `ORDER BY timestamp DESC`).
+ *
+ * NOT a covering index (per Mira Kessler's review on #2798): the query selects
+ * `value`, which is deliberately NOT in the index — `value` is an arbitrarily
+ * large TEXT blob, and widening the index to make the read index-only is a bad
+ * trade. The plan is a prefix seek + one rowid lookup for `value`; the name is
+ * `_key_lookup` (a seek-reduction index), NOT `_covering`.
+ *
+ * Distinct from `idx_storage_events_device_timestamp` (#2788), not a
+ * planner-redundant near-duplicate: that composite serves the device-scoped
+ * getter (`WHERE device_id=? ORDER BY timestamp DESC`) and cannot serve this
+ * three-equality predicate as a prefix seek; this index cannot serve the
+ * device-only getter's ordering as efficiently. The planner picks each for its
+ * own shape.
+ *
+ * Additive and forward-only, `.ifNotExists()` / `.ifExists()` so the migration
+ * survives #2785's destructive-recovery replay (drop-all then replay every
+ * migration on an empty DB) in unusual orders. Sorts after
+ * `2026_07_03_*`, so `storage_events` exists when it runs during a full replay.
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+  await db.schema
+    .createIndex("idx_storage_events_key_lookup")
+    .ifNotExists()
+    .on("storage_events")
+    .columns(["device_id", "file_name", "key", "timestamp"])
+    .execute();
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+  await db.schema.dropIndex("idx_storage_events_key_lookup").ifExists().execute();
+}