refactor(storage): complete unified Bun storage cutover

[mariusvniekerk]

Shared reads and writes still left a legacy query renderer, concrete adapter shadows, and several identity, vector, unit-range, and usage paths outside the Bun ownership boundary. This final layer removes those alternate paths and completes the shared Bun storage cutover.

Bun owns the common schema and public store behavior. Dialect-specific SQL remains allowed behind the documented closed seams for lifecycle, schema convergence, synchronization metadata, timestamp ordering, capability probes, FTS, and vectors. Observable usage dollar values remain unchanged under the cross-backend pricing and usage contracts, providing contract-verified dollar parity rather than relying on a one-off output comparison. Stack 5 of 5.

^{generated by a clanker}

[roborev-ci]

roborev: Combined Review (df16698)

Code review passed: no Medium, High, or Critical findings were reported.

---

Reviewers: 2 done | Synthesis: codex, 6s | Total: 33m13s

[roborev-ci]

roborev: Combined Review (3ee3fdb)

The refactor is generally sound, but one medium-severity SQLite date-bucketing regression needs correction.

Medium

• internal/db/bun_analytics.go:490 — The aggregate summary derives UTC dates with SUBSTR(..., 1, 10). Stored RFC3339 timestamps may include offsets, so 2026-08-03T23:30:00-05:00 is bucketed as August 3 instead of August 4 UTC. This can produce incorrect date-filtered totals and ActiveDays. Normalize timestamps before extracting the date (for example, with strftime('%Y-%m-%d', ...)) or disable this aggregate path for SQLite, and add a behavioral test covering an offset timestamp that crosses UTC midnight.

---

Reviewers: 2 done | Synthesis: codex, 9s | Total: 26m8s

[roborev-ci]

roborev: Combined Review (ebb6997)

No Medium, High, or Critical findings; the reviewers found no actionable issues at the requested severity threshold.

---

Reviewers: 2 done | Synthesis: codex, 5s | Total: 42m24s

[roborev-ci]

roborev: Combined Review (9917e39)

Medium

• internal/db/bun_activity_report.go:108 — Activity reports load all matching sessions and complete message histories before applying the requested date range. Even a one-day report may scale with the entire archive, causing severe latency or memory exhaustion. Apply activity-window predicates in the session query, then restrict message and usage queries to the candidate session IDs.

---

Reviewers: 2 done | Synthesis: codex, 8s | Total: 30m14s

[roborev-ci]

roborev: Combined Review (0c7127c)

The storage refactor is generally sound, but two medium-severity correctness and performance issues should be addressed.

Medium

• UTC date handling can misclassify sessions — internal/db/bun_analytics.go:493

  The analytics fast path derives dates from the first ten timestamp characters. RFC3339 timestamps with offsets can cross a UTC date boundary, causing ActiveDays and From/To filtering to disagree with the previous parsed-time behavior.

  Fix: Normalize timestamps to UTC before extracting the date with backend-specific SQL, or retain the parsed Go fallback for SQLite. Add coverage for an offset timestamp that crosses midnight UTC.

• Identity reconciliation introduces an unnecessary cross-join — internal/db/project_identity.go:1262

  Model(&winner) already supplies the model table, while TableExpr(...) adds a second snapshots-table instance. The resulting unused self-cross-join can substantially multiply reconciliation work.

  Fix: Replace TableExpr(...) with ModelTableExpr("source_session_project_identity_snapshots AS snap") so the existing model table is aliased instead of duplicated.

---

Reviewers: 2 done | Synthesis: codex, 12s | Total: 34m30s

[roborev-ci]

roborev: Combined Review (73fef1d)

Changes need revision: three medium-severity issues were identified.

Medium

• internal/postgres/schema.go:1576 — Unstamped PostgreSQL convergence validates canonical foreign-key parents before provenance repair. Sessions with blank source_archive_id fail EnsureSchema, preventing the subsequent supported provenance backfill.

  • Fix: Repair provenance before validation or exclude incomplete session provenance from this invariant. Add migration coverage for an unstamped schema containing a blank-provenance session.

• internal/db/bun_analytics.go:492 — The aggregate summary derives a UTC date by slicing the first ten characters from stored timestamps. Valid RFC3339 timestamps with non-UTC offsets that cross UTC midnight can be assigned to the wrong day and incorrectly included or excluded by From/To.

  • Fix: Convert timestamps to UTC before extracting the date, or use the parsed-row fallback for SQLite text timestamps. Add a regression test covering an offset that crosses UTC midnight.

• internal/db/bun_activity_report.go:174 — Activity-report range filtering occurs only after all matching sessions and messages are materialized; the usage query at line 298 also loads every usage row in the date window. Narrow reports can therefore scale with the entire archive and consume excessive memory.

  • Fix: Apply session-overlap filtering in the initial query, hydrate messages only for candidate session IDs, and load usage for those candidates plus only the cross-session snapshot peers required for deduplication.

---

Reviewers: 2 done | Synthesis: codex, 14s | Total: 31m16s

[roborev-ci]

roborev: Combined Review (773e891)

The PR has one medium-severity correctness issue in UTC analytics bucketing.

Medium

• internal/db/bun_analytics.go:492 — UTC day bucketing takes the first ten characters of stored timestamps instead of converting each instant to UTC. Existing SQLite RFC3339 timestamps with offsets can therefore be assigned to the wrong day; for example, 2024-06-01T23:30:00-05:00 is treated as June 1 rather than June 2.
  • Fix: Use a backend-specific UTC date expression such as SQLite strftime('%Y-%m-%d', ...), or retain the normalized Go path for SQLite. Add coverage for an offset timestamp crossing a UTC day boundary.

---

Reviewers: 2 done | Synthesis: codex, 10s | Total: 24m51s