i KNEW there are problems, probably

.sqlx/query-1d4677e5e37a32a8c0f8ab29ec07986142a621c099a62d3c5973f368e664991c.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "INSERT OR REPLACE INTO agents (agent_id, agent_token) VALUES (?1, ?2)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Right": 2
-    },
-    "nullable": []
-  },
-  "hash": "1d4677e5e37a32a8c0f8ab29ec07986142a621c099a62d3c5973f368e664991c"
-}

.sqlx/query-a69a1ea43b1a59254cb29b549b5cd3ebfcab8130941dc2d9a78814bc2072c0d5.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "INSERT OR REPLACE INTO active_alerts\n         (alert_id, kind, severity, status, agent_id, message, value, threshold,\n          last_seen_unix, metadata_json)\n         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Right": 10
-    },
-    "nullable": []
-  },
-  "hash": "a69a1ea43b1a59254cb29b549b5cd3ebfcab8130941dc2d9a78814bc2072c0d5"
-}

.sqlx/query-b69fb8f030b9745db1d8c9db8225426334b4d1edea5d8a8c9b289c17f194c153.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "INSERT OR REPLACE INTO agent_meta (agent_id, nickname) VALUES (?1, ?2)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Right": 2
-    },
-    "nullable": []
-  },
-  "hash": "b69fb8f030b9745db1d8c9db8225426334b4d1edea5d8a8c9b289c17f194c153"
-}

.sqlx/query-c496c7a8ada53d6d88ea1a29d9e7bf178fe5f3ee9067357dba05384fa1e2772c.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "INSERT OR REPLACE INTO audit_events\n         (event_key, event_id, ts_unix, actor_type, actor_id, agent_id, request_id,\n          event_type, outcome, latency_ms, message, metadata_json)\n         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Right": 12
-    },
-    "nullable": []
-  },
-  "hash": "c496c7a8ada53d6d88ea1a29d9e7bf178fe5f3ee9067357dba05384fa1e2772c"
-}

.sqlx/query-e508aeb39a57b9defc7cec1bf854669150b8f3a02a7d8312e8fea5951391c1bb.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "INSERT OR REPLACE INTO alert_transitions\n         (transition_key, transition_id, ts_unix, alert_id, kind, agent_id,\n          from_status, to_status, message, metadata_json)\n         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Right": 10
-    },
-    "nullable": []
-  },
-  "hash": "e508aeb39a57b9defc7cec1bf854669150b8f3a02a7d8312e8fea5951391c1bb"
-}

wakey-control-plane/.sqlx/query-1d4677e5e37a32a8c0f8ab29ec07986142a621c099a62d3c5973f368e664991c.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "INSERT OR REPLACE INTO agents (agent_id, agent_token) VALUES (?1, ?2)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Right": 2
-    },
-    "nullable": []
-  },
-  "hash": "1d4677e5e37a32a8c0f8ab29ec07986142a621c099a62d3c5973f368e664991c"
-}

wakey-control-plane/.sqlx/query-a69a1ea43b1a59254cb29b549b5cd3ebfcab8130941dc2d9a78814bc2072c0d5.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "INSERT OR REPLACE INTO active_alerts\n         (alert_id, kind, severity, status, agent_id, message, value, threshold,\n          last_seen_unix, metadata_json)\n         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Right": 10
-    },
-    "nullable": []
-  },
-  "hash": "a69a1ea43b1a59254cb29b549b5cd3ebfcab8130941dc2d9a78814bc2072c0d5"
-}

wakey-control-plane/.sqlx/query-b69fb8f030b9745db1d8c9db8225426334b4d1edea5d8a8c9b289c17f194c153.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "INSERT OR REPLACE INTO agent_meta (agent_id, nickname) VALUES (?1, ?2)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Right": 2
-    },
-    "nullable": []
-  },
-  "hash": "b69fb8f030b9745db1d8c9db8225426334b4d1edea5d8a8c9b289c17f194c153"
-}

wakey-control-plane/.sqlx/query-c496c7a8ada53d6d88ea1a29d9e7bf178fe5f3ee9067357dba05384fa1e2772c.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "INSERT OR REPLACE INTO audit_events\n         (event_key, event_id, ts_unix, actor_type, actor_id, agent_id, request_id,\n          event_type, outcome, latency_ms, message, metadata_json)\n         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Right": 12
-    },
-    "nullable": []
-  },
-  "hash": "c496c7a8ada53d6d88ea1a29d9e7bf178fe5f3ee9067357dba05384fa1e2772c"
-}

wakey-control-plane/.sqlx/query-e508aeb39a57b9defc7cec1bf854669150b8f3a02a7d8312e8fea5951391c1bb.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "INSERT OR REPLACE INTO alert_transitions\n         (transition_key, transition_id, ts_unix, alert_id, kind, agent_id,\n          from_status, to_status, message, metadata_json)\n         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Right": 10
-    },
-    "nullable": []
-  },
-  "hash": "e508aeb39a57b9defc7cec1bf854669150b8f3a02a7d8312e8fea5951391c1bb"
-}

wakey-control-plane/src/state/store.rs

@@ -17,10 +17,21 @@ pub struct Store {
     db_path: PathBuf,
     pool: SqlitePool,
 }
+impl Store {
+    /// Begins a new transaction with an IMMEDIATE write lock.
+    ///
+    /// Use this for all transactions that perform writes to avoid SQLite upgrade deadlocks.
+    pub async fn begin_write(&self) -> Result<Transaction<'static, Sqlite>> {
+        self.pool
+            .begin_with("BEGIN IMMEDIATE")
+            .await
+            .context("failed to begin write transaction")
+    }
+}
 
-const SCHEMA_VERSION_KEY: &str = "schema_version";
+pub(crate) const SCHEMA_VERSION_KEY: &str = "schema_version";
 const SEEDED_ENROLL_TOKEN_PREFIX: &str = "seeded_enroll_token:";
-const SCHEMA_VERSION: u32 = 2;
+pub(crate) const SCHEMA_VERSION: u32 = 2;
 
 pub(crate) mod agent_devices;
 mod alerts;

wakey-control-plane/src/state/store/agent_devices.rs

@@ -15,11 +15,7 @@ impl Store {
         agent_id: &str,
         devices: &[Device],
     ) -> Result<usize> {
-        let mut tx = self
+        let mut tx = self.begin_write().await?;
-            .pool
-            .begin()
-            .await
-            .context("failed starting device snapshot transaction")?;
 
         let mut incoming_keys = std::collections::HashSet::with_capacity(devices.len());
         let snapshot_time = now_unix();

wakey-control-plane/src/state/store/alerts.rs

@@ -1,3 +1,4 @@
+use super::helpers::core::*;
 use super::*;
 
 impl Store {
@@ -5,6 +6,8 @@ impl Store {
         &self,
         current: &[AlertState],
     ) -> Result<Vec<AlertTransition>> {
+        let mut tx = self.begin_write().await?;
+
         let mut previous = std::collections::HashMap::<String, AlertState>::new();
         let rows = sqlx::query_as!(
             AlertStateRow,
@@ -13,7 +16,7 @@ impl Store {
                     value, threshold, last_seen_unix, metadata_json as "metadata_json!"
              FROM active_alerts"#,
         )
-        .fetch_all(&self.pool)
+        .fetch_all(&mut *tx)
         .await
         .context("failed iterating active_alerts table")?;
         for row in rows {
@@ -63,11 +66,6 @@ impl Store {
             });
         }
 
-        let mut tx = self
-            .pool
-            .begin()
-            .await
-            .context("failed starting alert transaction")?;
         sqlx::query!("DELETE FROM active_alerts")
             .execute(&mut *tx)
             .await

wakey-control-plane/src/state/store/db.rs

@@ -115,11 +115,7 @@ impl Store {
             }
 
             let expires_at = now_unix().saturating_add(seed_ttl.as_secs().max(1));
-            let mut tx = self
+            let mut tx = self.begin_write().await?;
-                .pool
-                .begin()
-                .await
-                .context("failed starting bootstrap token transaction")?;
             let expires_at_i64 = i64::try_from(expires_at).context("token expiry overflow")?;
             sqlx::query!(
                 "INSERT OR REPLACE INTO enroll_tokens (token, expires_at_unix) VALUES (?1, ?2)",

wakey-control-plane/src/state/store/devices.rs

@@ -11,11 +11,7 @@ impl Store {
         let device_id = format!("dev-{}", Uuid::new_v4());
         let now = now_unix();
 
-        let mut tx = self
+        let mut tx = self.begin_write().await?;
-            .pool
-            .begin()
-            .await
-            .context("failed starting known device transaction")?;
         let pinned = if input.pinned { 1_i64 } else { 0_i64 };
         let now_i64 = i64::try_from(now).context("known device timestamp overflow")?;
         sqlx::query!(
@@ -84,11 +80,7 @@ impl Store {
 
         let now = now_unix();
         let now_i64 = i64::try_from(now).context("known device timestamp overflow")?;
-        let mut tx = self
+        let mut tx = self.begin_write().await?;
-            .pool
-            .begin()
-            .await
-            .context("failed starting known device merge transaction")?;
 
         let target_exists = sqlx::query_scalar!(
             r#"SELECT COUNT(*) as "count!: i64" FROM known_devices WHERE device_id = ?1"#,
@@ -149,11 +141,7 @@ impl Store {
     ) -> Result<Option<KnownDevice>> {
         let identifier = normalize_device_identifier(input)?;
         let now = now_unix();
-        let mut tx = self
+        let mut tx = self.begin_write().await?;
-            .pool
-            .begin()
-            .await
-            .context("failed starting device identifier transaction")?;
         let exists = sqlx::query_scalar!(
             r#"SELECT COUNT(*) as "count!: i64" FROM known_devices WHERE device_id = ?1"#,
             device_id
@@ -188,11 +176,7 @@ impl Store {
     ) -> Result<Option<KnownDevice>> {
         let now = now_unix();
         let now_i64 = i64::try_from(now).context("known device timestamp overflow")?;
-        let mut tx = self
+        let mut tx = self.begin_write().await?;
-            .pool
-            .begin()
-            .await
-            .context("failed starting device identifier detach transaction")?;
         let exists = sqlx::query_scalar!(
             r#"SELECT COUNT(*) as "count!: i64" FROM known_devices WHERE device_id = ?1"#,
             device_id

wakey-control-plane/src/state/store/enrollment.rs

@@ -2,11 +2,7 @@ use super::*;
 
 impl Store {
     pub async fn enroll(&self, enroll_token: &str) -> Result<IssuedAgent> {
-        let mut tx = self
+        let mut tx = self.begin_write().await?;
-            .pool
-            .begin()
-            .await
-            .context("failed starting enroll transaction")?;
         let expires_at_unix = sqlx::query_scalar!(
             "SELECT expires_at_unix FROM enroll_tokens WHERE token = ?1",
             enroll_token
@@ -102,11 +98,7 @@ impl Store {
     }
 
     pub async fn revoke_agent(&self, agent_id: &str) -> Result<bool> {
-        let mut tx = self
+        let mut tx = self.begin_write().await?;
-            .pool
-            .begin()
-            .await
-            .context("failed starting revoke transaction")?;
         let result = sqlx::query!("DELETE FROM agents WHERE agent_id = ?1", agent_id)
             .execute(&mut *tx)
             .await