fix(update,db): four fixes the 2.2.0 beta and its rollback depend on

2.1.4 is the version anyone testing the 2.2.0 beta will roll back TO, so the
protections have to be here rather than in a later patch. Each fix has a test
that was verified to fail without it.

Pre-release version ordering (update_checker)
  _parse_version stopped at the first non-integer component, so every
  "2.2.0-beta.N" parsed to (2, 2) and successive betas compared EQUAL - a tester
  would have been stranded on whichever build they installed first. Now pads to
  (major, minor, patch, is_final, stage_rank, stage_number), which also makes
  "1.3" and "1.3.0" the same release and keeps a final above its own
  pre-releases. Two long-standing xfail(strict=True) cases now pass and have
  been converted to real tests, per their own "if this starts passing, update"
  note.

Downgrade guard (database)
  On a downgrade the migration loop range(new, old) is empty, so the old code
  fell through: it still wrote a full copy of the database to a .bak on EVERY
  launch, and every write raised OperationalError - a sqlite3.Error subclass
  the handlers swallow. Reads kept working, so the app looked healthy while
  recording nothing, permanently. Now refuses outright: no backup, no writes, no
  maintenance, one clear log line. Verified live against a v8 database.

Verified WAL-safe backup (database)
  _backup_database used shutil.copy2, which copies only the main .db - in WAL
  mode everything since the last checkpoint lives in the sidecar, and the
  installer force-kills the app (taskkill /F), so the WAL is hot exactly when
  the backup matters. Measured: zero of 30,000 committed rows recovered, and the
  result still passed integrity_check. Now VACUUM INTO (which reads through the
  connection and compacts ~8x), then the copy is opened and row counts compared
  before it is trusted. Handles the target-exists case, since the filename is
  second-resolution while init retries are 0.1s apart. Prunes to the newest two;
  nothing deleted them before.

SMART update rate (config_controller)
  set_interval clamps with max(0.1, interval), so passing the -1.0 sentinel raw
  meant 100ms polling - twenty times the intended 2s, and the one rate
  update_mode.py rules out in its own header. Also a data bug: the raw tier's
  key is one-second with INSERT OR IGNORE, so ~9 of every 10 samples were
  discarded. calculate_timer_interval() already resolved the sentinel; this
  path just never called it.

Verified beyond the suite: a full build, a live migration on a real 50MB
database, a live downgrade, and the complete 2.1.4 -> 2.1.5 portable update
(hand-off, swap, relaunch from the install path, leftover sweep).

Author: erez-c137

build/version_info.txt

@@ -1,7 +1,7 @@
 VSVersionInfo(
   ffi=FixedFileInfo(
-    filevers=(2, 1, 3, 0),
-    prodvers=(2, 1, 3, 0),
+    filevers=(2, 1, 4, 0),
+    prodvers=(2, 1, 4, 0),
     mask=0x3f,
     flags=0x0,
     OS=0x40004,
@@ -17,12 +17,12 @@ VSVersionInfo(
           [
             StringStruct('CompanyName', 'Erez C137'),
             StringStruct('FileDescription', 'NetSpeedTray'),
-            StringStruct('FileVersion', '2.1.3.0'),
+            StringStruct('FileVersion', '2.1.4.0'),
             StringStruct('InternalName', 'NetSpeedTray'),
             StringStruct('LegalCopyright', 'Copyright (c) Erez C137'),
             StringStruct('OriginalFilename', 'NetSpeedTray.exe'),
             StringStruct('ProductName', 'NetSpeedTray'),
-            StringStruct('ProductVersion', '2.1.3'),
+            StringStruct('ProductVersion', '2.1.4'),
           ]
         )
       ]

src/netspeedtray/core/config_controller.py

@@ -13,6 +13,7 @@
 from netspeedtray import constants
 from netspeedtray.utils.window_state import set_window_always_on_top
 from netspeedtray.utils.config import ConfigManager
+from netspeedtray.utils.timer_utils import calculate_timer_interval
 
 if TYPE_CHECKING:
     from netspeedtray.views.widget.main import NetworkSpeedWidget
@@ -175,8 +176,14 @@ def apply_all_settings(self) -> None:
 
             if w.monitor_thread:
                 w.monitor_thread.update_config(w.config)
+                # Resolve the SMART sentinel (-1.0) BEFORE handing the value to the sampler.
+                # set_interval() clamps with max(0.1, interval), so passing -1.0 through raw
+                # set the poll interval to 0.1s - 100ms, twenty times the intended 2s, and the
+                # one rate constants/update_mode.py explicitly rules out as "too jarring for
+                # human perception". Startup was already correct (main.py resolves it); only
+                # this path, taken on every settings save, was not.
                 update_rate = w.config.get("update_rate", constants.config.defaults.DEFAULT_UPDATE_RATE)
-                w.monitor_thread.set_interval(update_rate)
+                w.monitor_thread.set_interval(calculate_timer_interval(update_rate) / 1000.0)
 
             if w.widget_state:
                 self.logger.debug("Applying widget state config...")

src/netspeedtray/core/database.py

@@ -41,6 +41,10 @@ def __init__(self, db_path: Path, parent: Optional[QObject] = None) -> None:
         # no 100ms busy-poll, lower latency, near-zero idle CPU. None is a wake-up sentinel.
         self._queue: "queue.Queue[Optional[Tuple[str, Any]]]" = queue.Queue()
         self._stop_event = threading.Event()
+        # Set when the file on disk was written by a NEWER build than this one. Every write
+        # path is then refused - see _check_and_create_schema for why silence is not an option.
+        self._schema_incompatible = False
+        self._downgrade_warned = False
         self.logger = logging.getLogger(f"NetSpeedTray.{self.__class__.__name__}")
 
 
@@ -55,7 +59,11 @@ def run(self) -> None:
             try:
                 self._initialize_connection()
                 self._check_and_create_schema()
-                self._ensure_indexes()  # idempotent; runs regardless of schema version
+                if not self._schema_incompatible:
+                    # Skipped on a downgrade: CREATE INDEX against a newer schema either errors
+                    # (a compatibility view cannot be indexed) or writes to a file this build
+                    # does not understand. Both are exactly what the guard exists to prevent.
+                    self._ensure_indexes()  # idempotent; runs regardless of schema version
                 initialized = True
                 break
             except sqlite3.Error as e:
@@ -119,6 +127,18 @@ def _execute_task(self, task: str, data: Any) -> None:
             except Exception:
                 pass
             return
+        if self._schema_incompatible:
+            # Downgrade: every task below writes (maintenance DELETEs and aggregates). Drop them
+            # rather than letting them fail into a swallowed OperationalError. Warn once - this
+            # fires per persist tick, and #263 was a 137,000-line flood from exactly this shape.
+            if not self._downgrade_warned:
+                self._downgrade_warned = True
+                self.logger.warning(
+                    "Refusing database task '%s' and all further writes: the file was written by a "
+                    "newer version of NetSpeedTray. This is logged once per session.", task,
+                )
+            return
+
         handlers = {
             "persist_speed": self._persist_speed_batch,
             "persist_hardware": self._persist_hardware_batch,
@@ -243,21 +263,132 @@ def _has_existing_data(self) -> bool:
         except Exception:
             return True
 
+    # Keep the newest N pre-migration backups; older ones are pruned. Nothing used to
+    # delete these at all, and at a year-scale database that is hundreds of MB of
+    # abandoned copies sitting in the user's roaming profile.
+    _BACKUP_RETENTION = 2
+
     def _backup_database(self) -> bool:
-        """Backs up the current database file before critical operations."""
+        """
+        Make a **verified**, WAL-safe copy of the database before a migration.
+
+        Uses ``VACUUM INTO`` rather than a file copy. ``shutil.copy2`` copies only the
+        main ``.db`` file, but in WAL mode everything committed since the last
+        checkpoint lives in the ``-wal`` sidecar - so a copy taken while the WAL is hot
+        silently loses it. That is precisely the state during an upgrade: the installer
+        force-kills the running app (``taskkill /F`` in setup.iss), so no checkpoint
+        runs. Measured against a hot WAL, a ``copy2`` backup recovered **zero of 30,000
+        committed rows** - and the result still passed ``PRAGMA integrity_check``,
+        because an empty database is a perfectly valid one.
+
+        ``VACUUM INTO`` reads through this connection, so it sees WAL content, and it
+        compacts the copy as a side effect.
+
+        The copy is then opened and checked against the source before this returns
+        True. A backup that silently isn't one is worse than no backup at all, because
+        the caller reasons about its existence.
+        """
+        backup_path: Optional[Path] = None
         try:
+            version = self._get_current_db_version()
             timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
-            backup_path = self.db_path.with_suffix(f".db.bak.v{self._get_current_db_version()}_{timestamp}")
+            backup_path = self.db_path.with_suffix(f".db.bak.v{version}_{timestamp}")
+
+            # VACUUM INTO refuses to write an existing file. The timestamp is only
+            # second-resolution while run()'s init retry backs off in 0.1s steps, so two
+            # attempts land in the same second - and that collision would fire in exactly
+            # the retry path a backup exists to protect.
+            suffix = 0
+            while backup_path.exists():
+                suffix += 1
+                backup_path = self.db_path.with_suffix(f".db.bak.v{version}_{timestamp}_{suffix}")
+
             self.logger.info("Backing up database to: %s", backup_path)
-            shutil.copy2(self.db_path, backup_path)
+            self.conn.execute("VACUUM INTO ?", (str(backup_path),))
+
+            if not self._verify_backup(backup_path, version):
+                self.logger.error("Pre-migration backup FAILED VERIFICATION; treating as no backup.")
+                backup_path.unlink(missing_ok=True)
+                return False
+
+            self._prune_old_backups()
             return True
         except Exception as e:
             # Don't swallow silently: the migration's data-loss guard assumes a backup was made, so a
             # disk-full / permission / lock failure here must be visible in the log (and the bak's absence).
             self.logger.error("Pre-migration database backup FAILED: %s", e)
+            if backup_path is not None:
+                try:
+                    backup_path.unlink(missing_ok=True)   # never leave a partial copy that looks real
+                except Exception:
+                    pass
             return False
 
 
+    def _verify_backup(self, backup_path: Path, expected_version: int) -> bool:
+        """
+        Open the backup and prove it holds the same data as the source.
+
+        Structural checks alone are not enough: the failure this exists to catch (a
+        WAL-blind copy) produces a *valid* database that is merely missing rows, which
+        ``integrity_check`` reports as ``ok``. So compare content - the schema version
+        and the row count of every history table.
+        """
+        check: Optional[sqlite3.Connection] = None
+        try:
+            # NOTE: `with sqlite3.connect(...)` commits/rolls back the transaction but does
+            # NOT close the connection. On Windows the leaked handle keeps the file locked,
+            # so _prune_old_backups() then fails with WinError 32. Close it explicitly.
+            check = sqlite3.connect(f"file:{backup_path}?mode=ro", uri=True)
+
+            if check.execute("PRAGMA quick_check").fetchone()[0] != "ok":
+                self.logger.error("Backup verification: quick_check did not return ok.")
+                return False
+
+            row = check.execute("SELECT value FROM metadata WHERE key='db_version'").fetchone()
+            if row is None or int(row[0]) != expected_version:
+                self.logger.error(
+                    "Backup verification: db_version is %s, expected %d.",
+                    row[0] if row else "missing", expected_version,
+                )
+                return False
+
+            tables = [r[0] for r in self.conn.execute(
+                "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%'"
+            )]
+            for table in tables:
+                src = self.conn.execute(f"SELECT COUNT(*) FROM '{table}'").fetchone()[0]
+                dst = check.execute(f"SELECT COUNT(*) FROM '{table}'").fetchone()[0]
+                if src != dst:
+                    self.logger.error(
+                        "Backup verification: table '%s' has %d rows in the backup but %d in the "
+                        "source. The backup is incomplete.", table, dst, src,
+                    )
+                    return False
+            return True
+        except Exception as e:
+            self.logger.error("Backup verification failed to read the copy: %s", e)
+            return False
+        finally:
+            if check is not None:
+                check.close()
+
+
+    def _prune_old_backups(self) -> None:
+        """Keep only the newest `_BACKUP_RETENTION` backups; nothing else ever deleted them."""
+        try:
+            backups = sorted(
+                self.db_path.parent.glob(f"{self.db_path.stem}.db.bak.*"),
+                key=lambda p: p.stat().st_mtime,
+                reverse=True,
+            )
+            for stale in backups[self._BACKUP_RETENTION:]:
+                stale.unlink(missing_ok=True)
+                self.logger.debug("Pruned old database backup: %s", stale.name)
+        except Exception as e:
+            self.logger.warning("Could not prune old database backups: %s", e)
+
+
     def _migrate_schema(self, current_version: int) -> None:
         """Handles migration from current_version to _DB_VERSION."""
         self.logger.info("Migrating database from version %d to %d...", current_version, self._DB_VERSION)
@@ -413,6 +544,26 @@ def _check_and_create_schema(self) -> None:
             self.logger.error("DB version is UNKNOWN; refusing to migrate or rebuild - preserving the database as-is.")
             return
 
+        if current_version > self._DB_VERSION:
+            # DOWNGRADE. The file was written by a newer build; this one cannot understand it.
+            # There is no migration to run - range(new, old) is empty - so the old code fell
+            # through and did two harmful things:
+            #   1. _migrate_schema() still ran _backup_database() unconditionally, writing a
+            #      full copy of the database on EVERY launch, which nothing ever deletes.
+            #   2. Reads kept working (a newer schema may expose compatibility views), while
+            #      every write raised OperationalError - a sqlite3.Error subclass that the
+            #      handlers below swallow. The app looked healthy and silently recorded nothing.
+            # Refusing outright is the only honest option: no backup, no writes, no maintenance.
+            self._schema_incompatible = True
+            self.logger.error(
+                "Database schema v%d was written by a NEWER version of NetSpeedTray than this one "
+                "(which understands v%d). Running READ-ONLY: history will be shown but nothing new "
+                "will be recorded, and no data will be modified or deleted. Upgrade again to resume "
+                "recording, or move %s aside to start a fresh history.",
+                current_version, self._DB_VERSION, self.db_path.name,
+            )
+            return
+
         if current_version > 0:
              self.logger.info("Database version mismatch (Current: %d, Target: %d). Attempting migration...", current_version, self._DB_VERSION)
              try:

src/netspeedtray/core/update_checker.py

@@ -21,16 +21,68 @@
 CHECK_INTERVAL_HOURS = 24
 
 
+# Pre-release stage ordering. An unrecognised stage sorts ABOVE these but still
+# below any final release, so an unexpected tag can never look newer than a real one.
+_PRERELEASE_STAGES = {"alpha": 0, "a": 0, "beta": 1, "b": 1, "rc": 2, "c": 2, "pre": 2}
+_UNKNOWN_STAGE_RANK = 3
+
+
 def _parse_version(version_str: str) -> Tuple[int, ...]:
-    """Parse 'v1.3.1' or '1.3.1' into a comparable tuple of ints."""
+    """
+    Parse a release tag into a comparable tuple of ints.
+
+    The tag is split into a release core and an optional pre-release suffix, then
+    padded to a fixed shape so plain tuple comparison implements the ordering we
+    need for a beta cycle::
+
+        (major, minor, patch, is_final, stage_rank, stage_number)
+
+    - ``1.3`` and ``1.3.0`` are the same release -> both ``(1, 3, 0, 1, 0, 0)``.
+    - A final release outranks every pre-release of it (``is_final`` 1 beats 0),
+      so ``2.2.0`` > ``2.2.0-beta.4``.
+    - Successive pre-releases order correctly: ``beta.1`` < ``beta.2`` < ``rc.1``.
+      Without this a beta tester is stranded, because every ``2.2.0-beta.N``
+      compared EQUAL and `is_newer` could never advance between them.
+    - Build metadata (``+abc``) never affects precedence, per semver.
+
+    Never raises; an unparseable tag yields ``()`` so it sorts below everything.
+    """
     cleaned = version_str.lstrip("vV").strip()
-    parts = []
-    for part in cleaned.split("."):
+    cleaned = cleaned.split("+", 1)[0]              # build metadata is not precedence
+    core, _, pre = cleaned.partition("-")
+
+    release: list[int] = []
+    for part in core.split("."):
         try:
-            parts.append(int(part))
+            release.append(int(part))
         except ValueError:
             break
-    return tuple(parts)
+    if not release:
+        return ()                                   # unparseable sorts below everything
+
+    while len(release) < 3:                         # 1.3 and 1.3.0 are one release
+        release.append(0)
+
+    if not pre:
+        return (*release, 1, 0, 0)
+
+    stage_rank, stage_number = _UNKNOWN_STAGE_RANK, 0
+    for token in pre.replace("-", ".").split("."):
+        if token.isdigit():
+            stage_number = int(token)
+            continue
+        name = token.lower()
+        if name in _PRERELEASE_STAGES:
+            stage_rank = _PRERELEASE_STAGES[name]
+            continue
+        # digits glued to the stage name, e.g. 'beta2'
+        head = name.rstrip("0123456789")
+        tail = name[len(head):]
+        if head in _PRERELEASE_STAGES:
+            stage_rank = _PRERELEASE_STAGES[head]
+            if tail:
+                stage_number = int(tail)
+    return (*release, 0, stage_rank, stage_number)
 
 
 def is_newer(latest: str, current: str) -> bool: