Root cause: SQLite's default PASSIVE checkpoint mode cannot complete
under sustained write load (4 nodes, hundreds of events/min) because
active readers always block it. The WAL grows unbounded and eventually
corrupts the main DB file.
- Add dedicated checkpoint_wal() using PRAGMA wal_checkpoint(RESTART),
which waits for readers to finish then checkpoints fully and resets
the WAL back to the start.
- Add background checkpointer task running every 30 minutes, separate
from the 6-hour prune cycle.
- Remove PASSIVE checkpoint from prune_old_events(), replace with call
to checkpoint_wal() after pruning completes.
- Set wal_autocheckpoint=500 on every connection (~2MB threshold) so
SQLite's own auto-checkpoint also triggers more frequently.
- Reduce HOT_DAYS from 30 to 7: at current data rate (~500k beacons/day)
30-day retention would grow to several GB before first prune runs.
7 days keeps the DB under ~200MB and queries fast permanently.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Fix stale EventSource accumulation: onerror handler now closes the
existing EventSource before creating a new one, preventing multiple
live instances from stacking up and flooding /api/nodes on reconnect.
- Add in-flight guard on /api/nodes fetch so concurrent requests are
dropped if one is already in progress.
- Add dominant reason code column to Alerts tab (Most Impersonated
Networks and Most Targeted Devices tables) and Sessions tab rows.
- README: document node dropout root cause (AP overwhelm on staggered
power cycle), overnight stability confirmation, and dedicated AP todo.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Wrap all build_* route calls in asyncio.to_thread() so SQLite queries
run in a thread pool instead of blocking the event loop. Fixes tab
switch freezes and SSE stream stalls.
- Add 60s TTL caches to alerts, sessions, presence, and cross-node
endpoints (previously uncached, queried on every request).
- Scope alerts queries (top targets, devices, reason breakdown, heatmap)
to last 7 days instead of all-time full table scans.
- Add composite indexes: (bssid, received_at) on beacon_events and
deauth_events, (src_mac, received_at) on probe_events.
- Add background pruning task: runs every 6 hours, deletes events older
than HOT_DAYS from all tables, followed by WAL checkpoint.
- Document the full diagnosis and fixes in README.md.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
bot